@opengsd/gsd-pi 1.2.0 → 1.3.0-dev.72e3af2a

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -12,8 +12,9 @@ import { unitPhaseLabel } from "./auto-dashboard.js";
 import { getSessionModelOverride } from "./session-model-override.js";
 import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
+import { modelIdsForProfileResolution, resolveProfileAnchorProvider, resolveDisabledModelProvidersFromPreferences } from "./preferences.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
-import { isModelBlocked } from "./blocked-models.js";
+import { isModelBlocked, isModelTemporarilyUnavailable } from "./blocked-models.js";
 import { getRequiredWorkflowToolsForAutoUnit, isWorkflowMcpSurfaceTool } from "./workflow-mcp.js";
 /**
  * Thrown when the model-policy gate rejects every candidate model for a unit
@@ -90,6 +91,14 @@ export function getToolBaselineSnapshot(pi) {
         return live;
     return [...new Set([...baseline, ...live])];
 }
+export function getRegisteredToolSnapshot(pi) {
+    if (typeof pi.getAllTools !== "function")
+        return getToolBaselineSnapshot(pi);
+    const names = pi.getAllTools()
+        .map((tool) => tool.name)
+        .filter((name) => typeof name === "string" && name.length > 0);
+    return [...new Set(names)];
+}
 /**
  * Models eligible for the pre-dispatch policy gate. Prefer registry-available
  * models; when that list is empty (common after worktree resume before registry
@@ -210,6 +219,10 @@ function buildModelPolicyBlockReasons(policyDenyReasons, availableModels, routin
             reason: `configured model(s) did not resolve against policy-eligible registry [${eligibleSummary}]`,
         }];
 }
+function isModelUnavailable(basePath, provider, id) {
+    return isModelBlocked(basePath, provider, id) ||
+        isModelTemporarilyUnavailable(basePath, provider, id);
+}
 function restoreToolBaseline(pi) {
     const key = pi;
     const baseline = TOOL_BASELINE.get(key);
@@ -312,8 +325,8 @@ export function floorThinkingLevelForUnit(unitType, level) {
     }
     return EXECUTE_TASK_MIN_THINKING_LEVEL;
 }
-export function resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode = true) {
-    const explicitConfig = resolveModelWithFallbacksForUnit(unitType);
+export function resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode = true, basePath, availableModelIds, preferredModelId) {
+    const explicitConfig = resolveModelWithFallbacksForUnit(unitType, basePath, availableModelIds, preferredModelId);
     if (explicitConfig) {
         return {
             ...explicitConfig,
@@ -368,7 +381,9 @@ autoModeStartThinkingLevel) {
     // With no explicit level, fall back to the auto-start session level and raise
     // the code-writing floor — preserving prior behavior exactly. Recomputed per
     // dispatch so neither the floor nor a phase override leaks to other units.
-    const explicitThinkingLevel = resolveThinkingLevelForUnit(unitType);
+    const anchorProvider = resolveProfileAnchorProvider(ctx.model?.provider, autoModeStartModel?.provider);
+    const profileResolutionIds = modelIdsForProfileResolution(ctx.modelRegistry, anchorProvider, resolveDisabledModelProvidersFromPreferences());
+    const explicitThinkingLevel = resolveThinkingLevelForUnit(unitType, basePath, profileResolutionIds);
     const desiredThinkingLevel = explicitThinkingLevel
         ?? floorThinkingLevelForUnit(unitType, autoModeStartThinkingLevel);
     if (explicitThinkingLevel) {
@@ -401,9 +416,12 @@ autoModeStartThinkingLevel) {
             flatRateCtx: buildFlatRateContext(autoModeStartModel.provider, ctx, prefs),
         };
     }
+    const preferredModelId = autoModeStartModel
+        ? `${autoModeStartModel.provider}/${autoModeStartModel.id}`
+        : ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : undefined;
     const modelConfig = effectiveSessionModelOverride
         ? undefined
-        : resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode);
+        : resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode, basePath, profileResolutionIds, preferredModelId);
     let routing = null;
     let appliedModel = null;
     // ── Restore active-tool baseline before policy evaluation (#4959, #4681, #4850) ──
@@ -563,7 +581,7 @@ autoModeStartThinkingLevel) {
                 // Hook can override model selection entirely by returning { modelId }
                 let hookOverride;
                 if (routingConfig.hooks !== false) {
-                    const eligible = getEligibleModels(classification.tier, availableModelIds, routingConfig);
+                    const eligible = getEligibleModels(classification.tier, availableModelIds, routingConfig, preferredModelId);
                     const hookResult = await pi.emitBeforeModelSelect({
                         unitType,
                         unitId,
@@ -599,7 +617,7 @@ autoModeStartThinkingLevel) {
                     };
                 }
                 else {
-                    routingResult = resolveModelForComplexity(classification, modelConfig, routingConfig, availableModelIds, unitType, classification.taskMetadata, capabilityOverrides);
+                    routingResult = resolveModelForComplexity(classification, modelConfig, routingConfig, availableModelIds, unitType, classification.taskMetadata, capabilityOverrides, preferredModelId);
                 }
                 if (routingResult.wasDowngraded) {
                     effectiveModelConfig = {
@@ -649,8 +667,8 @@ autoModeStartThinkingLevel) {
             // (issue #4513).  The block is persisted in .gsd/runtime/blocked-models.json
             // so it survives /gsd auto restarts — without this, the same dead model
             // gets reselected after every restart.
-            if (isModelBlocked(basePath, model.provider, model.id)) {
-                ctx.ui.notify(`Skipping blocked model ${model.provider}/${model.id} (provider rejected it for this account).`, "warning");
+            if (isModelUnavailable(basePath, model.provider, model.id)) {
+                ctx.ui.notify(`Skipping unavailable model ${model.provider}/${model.id}.`, "warning");
                 continue;
             }
             // Warn if the ID is ambiguous across providers
@@ -716,7 +734,7 @@ autoModeStartThinkingLevel) {
                 const key = `${model.provider.toLowerCase()}/${model.id.toLowerCase()}`;
                 if (!policyAllowedModelKeys.has(key))
                     continue;
-                if (isModelBlocked(basePath, model.provider, model.id))
+                if (isModelUnavailable(basePath, model.provider, model.id))
                     continue;
                 const ok = await pi.setModel(model, { persist: false });
                 if (!ok)
@@ -738,16 +756,16 @@ autoModeStartThinkingLevel) {
         // No model preference for this unit type — re-apply the model captured
         // at auto-mode start to prevent bleed from shared global settings.json (#650).
         const availableModels = buildModelPolicyCandidates(ctx, autoModeStartModel, effectiveSessionModelOverride);
-        const startBlocked = isModelBlocked(basePath, autoModeStartModel.provider, autoModeStartModel.id);
+        const startBlocked = isModelUnavailable(basePath, autoModeStartModel.provider, autoModeStartModel.id);
         if (startBlocked) {
-            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is blocked for this account. Using current session model instead.`, "warning");
+            ctx.ui.notify(`Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is unavailable. Using current session model instead.`, "warning");
         }
         else {
             const startModel = availableModels.find(m => m.provider === autoModeStartModel.provider && m.id === autoModeStartModel.id);
             if (startModel) {
                 const ok = await pi.setModel(startModel, { persist: false });
                 if (!ok) {
-                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelBlocked(basePath, m.provider, m.id));
+                    const byId = availableModels.find(m => m.id === autoModeStartModel.id && !isModelUnavailable(basePath, m.provider, m.id));
                     if (byId) {
                         const fallbackOk = await pi.setModel(byId, { persist: false });
                         if (fallbackOk) {
@@ -831,15 +849,34 @@ export function resolveModelId(modelId, availableModels, currentProvider) {
         if (providerMatch)
             return providerMatch;
     }
-    // Prefer "anthropic" as the canonical provider for Anthropic models.
-    // Transport-specific tiebreaker (ADR-012): intentionally keys on provider,
-    // not api — we want the plain Anthropic transport when multiple are available.
-    const anthropicMatch = candidates.find(m => m.provider === "anthropic");
-    if (anthropicMatch)
-        return anthropicMatch;
+    // Subscription/OAuth routes beat pay-per-token API when the same model ID
+    // exists on multiple providers. Order matters — first match wins.
+    for (const provider of BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE) {
+        const match = candidates.find(m => m.provider === provider);
+        if (match)
+            return match;
+    }
     // Fall back to first non-extension candidate, or any candidate
     return candidates.find(m => !EXTENSION_PROVIDERS.has(m.provider)) ?? candidates[0];
 }
+/**
+ * When a bare model ID exists on multiple providers, prefer subscription/OAuth
+ * routes over pay-per-token API keys. Matches PROVIDER_ROUTES in doctor-providers
+ * but applies when *both* sides are authenticated.
+ *
+ * Order rationale:
+ * - openai-codex before github-copilot: ChatGPT-native for shared GPT IDs
+ * - google-antigravity before google-gemini-cli: Antigravity replaced Gemini CLI for individuals
+ * - anthropic before github-copilot: first-party Claude API/OAuth over Copilot
+ * - github-copilot before openai/google: Copilot OAuth over platform API keys
+ */
+export const BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE = [
+    "openai-codex",
+    "google-antigravity",
+    "google-gemini-cli",
+    "anthropic",
+    "github-copilot",
+];
 /**
  * Flat-rate providers charge the same per request regardless of model.
  * Dynamic routing provides no cost benefit — it only degrades quality (#3453).

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -16,8 +16,8 @@ import { deriveState } from "./state.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { loadFile, parseSummary, resolveAllOverrides } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
-import { isAwaitingUserInput } from "./user-input-boundary.js";
-import { resolveMilestonePath, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, buildTaskFileName, } from "./paths.js";
+import { isAwaitingUserInput } from "./consent-question.js";
+import { resolveSliceFile, resolveSlicePath, relSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, resolveFile, relMilestoneFile, relSliceFile, relTaskFile, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { rebuildState } from "./doctor.js";
 import { parseUnitId } from "./unit-id.js";
@@ -28,9 +28,9 @@ import { regenerateIfMissing } from "./workflow-projections.js";
 import { WorktreeStateProjection } from "./worktree-state-projection.js";
 import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
-import { isDbAvailable, getDbPath, refreshOpenDatabaseFromDisk, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
-import { renderPlanCheckboxes, renderRoadmapFromDb } from "./markdown-renderer.js";
-import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
+import { isDbAvailable, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
+import { getWorkflowDatabasePath, refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
+import { renderPlanCheckboxes, renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "./markdown-renderer.js";
 import { consumeSignal } from "./session-status-io.js";
 import { checkPostUnitHooks, consumeHookFailure, isRetryPending, consumeRetryTrigger, consumeGateBlock, persistHookState, resolveHookArtifactPath, } from "./post-unit-hooks.js";
 import { hasPendingCaptures, loadPendingCaptures, revertExecutorResolvedCaptures } from "./captures.js";
@@ -38,7 +38,7 @@ import { debugLog } from "./debug-logger.js";
 import { runSafely } from "./auto-utils.js";
 import { isMilestoneCloseoutSettled, runMilestoneCloseoutGitHub, } from "./milestone-closeout.js";
 import { getEvidence, clearEvidenceFromDisk, isExecutionToolName } from "./safety/evidence-collector.js";
-import { validateFileChanges } from "./safety/file-change-validator.js";
+import { validateFileChanges, effectiveFileChangeAllowlist } from "./safety/file-change-validator.js";
 import { crossReferenceEvidence } from "./safety/evidence-cross-ref.js";
 import { validateContent } from "./safety/content-validator.js";
 import { resolveSafetyHarnessConfig } from "./safety/safety-harness.js";
@@ -54,11 +54,12 @@ import { writeTurnGitTransaction } from "./uok/gitops.js";
 import { isClosedStatus } from "./status-guards.js";
 import { detectAbandonMilestone } from "./abandon-detect.js";
 import { getPendingGate } from "./bootstrap/write-gate.js";
-import { isDeterministicPolicyError } from "./auto-tool-tracking.js";
+import { isDeterministicPolicyError, isToolUnavailableError } from "./auto-tool-tracking.js";
 import { formatConnectedStepStack, formatPostUnitStatusCard } from "./auto-status-message.js";
 import { clearProjectResearchInflightMarker, finalizeProjectResearchTimeout, } from "./project-research-policy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
+import { saveCustomVerifyRetryCounts } from "./auto/custom-verify-retry-store.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
@@ -186,7 +187,6 @@ function completeSliceReopenReplanHandoffDetected(s, agentEndMessages) {
     const unitId = s.currentUnit.id;
     return (agentEndMessagesIncludeSuccessfulToolResult(agentEndMessages, "gsd_task_reopen") ||
         agentEndMessagesIncludeToolCall(agentEndMessages, "gsd_task_reopen") ||
-        agentEndMessagesMentionTool(agentEndMessages, "gsd_task_reopen") ||
         unitActivityMentionsTool(s.basePath, unitType, unitId, "gsd_task_reopen") ||
         unitActivityMentionsTool(s.canonicalProjectRoot, unitType, unitId, "gsd_task_reopen"));
 }
@@ -195,7 +195,6 @@ function completeSliceReplanSignalDetected(s, agentEndMessages) {
         return false;
     return (agentEndMessagesIncludeSuccessfulToolResult(agentEndMessages, "gsd_replan_slice") ||
         agentEndMessagesIncludeToolCall(agentEndMessages, "gsd_replan_slice") ||
-        agentEndMessagesMentionTool(agentEndMessages, "gsd_replan_slice") ||
         unitActivityMentionsTool(s.basePath, s.currentUnit.type, s.currentUnit.id, "gsd_replan_slice") ||
         unitActivityMentionsTool(s.canonicalProjectRoot, s.currentUnit.type, s.currentUnit.id, "gsd_replan_slice"));
 }
@@ -358,6 +357,17 @@ function getPlannedKeyFiles(tasks) {
 }
 export const _parseReactiveBatchTaskIdsForTest = parseReactiveBatchTaskIds;
 export const _getPlannedKeyFilesForTest = getPlannedKeyFiles;
+function resolveTaskArtifactPath(basePath, mid, sid, tid, suffix) {
+    const legacy = resolveTaskFile(basePath, mid, sid, tid, suffix);
+    if (legacy)
+        return legacy;
+    const slicePath = resolveSlicePath(basePath, mid, sid);
+    if (!slicePath)
+        return null;
+    const taskDir = resolveTasksDir(basePath, mid, sid) ?? slicePath;
+    const file = resolveFile(taskDir, tid, suffix);
+    return file ? join(taskDir, file) : null;
+}
 function resolveVerificationFailureMarkerPath(unitType, unitId, basePath) {
     const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
     switch (unitType) {
@@ -365,22 +375,19 @@ function resolveVerificationFailureMarkerPath(unitType, unitId, basePath) {
             const existing = resolveMilestoneFile(basePath, mid, "VERIFICATION-FAILED");
             if (existing)
                 return existing;
-            const milestoneDir = resolveMilestonePath(basePath, mid);
-            return milestoneDir ? join(milestoneDir, `${mid}-VERIFICATION-FAILED.md`) : null;
+            return join(basePath, relMilestoneFile(basePath, mid, "VERIFICATION-FAILED"));
         }
         case "complete-slice": {
             const existing = resolveSliceFile(basePath, mid, sid, "VERIFICATION-FAILED");
             if (existing)
                 return existing;
-            const sliceDir = resolveSlicePath(basePath, mid, sid);
-            return sliceDir ? join(sliceDir, `${sid}-VERIFICATION-FAILED.md`) : null;
+            return join(basePath, relSliceFile(basePath, mid, sid, "VERIFICATION-FAILED"));
         }
         case "execute-task": {
-            const existing = resolveTaskFile(basePath, mid, sid, tid, "VERIFICATION-FAILED");
+            const existing = resolveTaskArtifactPath(basePath, mid, sid, tid, "VERIFICATION-FAILED");
             if (existing)
                 return existing;
-            const tasksDir = resolveTasksDir(basePath, mid, sid);
-            return tasksDir ? join(tasksDir, buildTaskFileName(tid, "VERIFICATION-FAILED")) : null;
+            return join(basePath, relTaskFile(basePath, mid, sid, tid, "VERIFICATION-FAILED"));
         }
         default:
             return null;
@@ -394,7 +401,7 @@ async function buildTaskCommitContextForUnit(basePath, unitId) {
     const slice = isDbAvailable() ? getSlice(mid, sid) : null;
     const task = isDbAvailable() ? getTask(mid, sid, tid) : null;
     let summary = null;
-    const summaryPath = resolveTaskFile(basePath, mid, sid, tid, "SUMMARY");
+    const summaryPath = resolveTaskArtifactPath(basePath, mid, sid, tid, "SUMMARY");
     if (summaryPath) {
         try {
             const summaryContent = await loadFile(summaryPath);
@@ -506,9 +513,10 @@ export function _hasExecutionToolCallsInSessionForTest(entries) {
         if (e?.type === "toolCall" && isExecutionToolName(e?.name ?? e?.toolName)) {
             return true;
         }
-        if (e?.type !== "message")
-            continue;
-        const msg = e?.message;
+        // Accept both session-manager entries ({type: "message", message}) and
+        // bare agent-end messages ({role, content}) — the auto loop passes the
+        // latter via opts.agentEndMessages.
+        const msg = e?.type === "message" ? e?.message : e;
         if (!msg || msg.role !== "assistant" || !Array.isArray(msg.content))
             continue;
         for (const block of msg.content) {
@@ -561,7 +569,7 @@ export function detectRogueFileWrites(unitType, unitId, basePath) {
     if (unitType === "execute-task") {
         if (!mid || !sid || !tid)
             return [];
-        const summaryPath = resolveTaskFile(basePath, mid, sid, tid, "SUMMARY");
+        const summaryPath = resolveTaskArtifactPath(basePath, mid, sid, tid, "SUMMARY");
         if (!summaryPath || !existsSync(summaryPath))
             return [];
         const dbRow = getTask(mid, sid, tid);
@@ -627,7 +635,7 @@ export function detectRogueFileWrites(unitType, unitId, basePath) {
     else if (unitType === "plan-task") {
         if (!mid || !sid || !tid)
             return [];
-        const taskPlanPath = resolveTaskFile(basePath, mid, sid, tid, "PLAN");
+        const taskPlanPath = resolveTaskArtifactPath(basePath, mid, sid, tid, "PLAN");
         if (!taskPlanPath || !existsSync(taskPlanPath))
             return [];
         const dbRow = getTask(mid, sid, tid);
@@ -720,7 +728,7 @@ export const USER_DRIVEN_DEEP_UNITS = new Set([
     "discuss-milestone",
     "research-decision",
 ]);
-export { isAwaitingUserInput } from "./user-input-boundary.js";
+export { isAwaitingUserInput } from "./consent-question.js";
 function artifactValidationKind(unitType) {
     if (unitType === "discuss-project")
         return "project";
@@ -798,11 +806,13 @@ async function repairCompleteSliceRoadmapProjection(unitType, unitId, basePath)
     if (!summaryPath || !existsSync(summaryPath) || !uatPath || !existsSync(uatPath)) {
         return false;
     }
+    // Stale-render detection (ADR-017): the DB already says the slice is closed;
+    // this only checks whether the rendered ROADMAP projection reflects it, to
+    // decide whether a repair re-render is needed.
     const roadmapPath = resolveMilestoneFile(artifactBase, mid, "ROADMAP");
     if (roadmapPath && existsSync(roadmapPath)) {
         try {
-            const roadmap = parseLegacyRoadmap(readFileSync(roadmapPath, "utf-8"));
-            if (roadmap.slices.find((roadmapSlice) => roadmapSlice.id === sid)?.done) {
+            if (roadmapRenderMarksSliceDone(readFileSync(roadmapPath, "utf-8"), sid)) {
                 return false;
             }
         }
@@ -1052,9 +1062,9 @@ export async function postUnitPreVerification(pctx, opts) {
     if (!opts?.skipSettleDelay) {
         await new Promise(r => setTimeout(r, 100));
     }
-    const dbPath = getDbPath();
+    const dbPath = getWorkflowDatabasePath();
     if (isDbAvailable() && dbPath && dbPath !== ":memory:") {
-        const refreshed = refreshOpenDatabaseFromDisk();
+        const refreshed = refreshWorkflowDatabaseFromDisk();
         if (!refreshed) {
             logWarning("db", "post-unit database refresh failed; derived state may be stale");
         }
@@ -1288,6 +1298,7 @@ export async function postUnitPreVerification(pctx, opts) {
             const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
             if (safetyConfig.enabled) {
                 const { milestone: sMid, slice: sSid, task: sTid } = parseUnitId(s.currentUnit.id);
+                const fileChangeAllowlist = effectiveFileChangeAllowlist(safetyConfig.file_change_allowlist, prefs?.git?.manage_gitignore);
                 // File change validation (execute-task only, after unit execution)
                 if (safetyConfig.file_change_validation && s.currentUnit.type === "execute-task" && sMid && sSid && sTid) {
                     try {
@@ -1302,7 +1313,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             const plannedFiles = getPlannedKeyFiles(sliceTaskRows.map((taskRow) => ({
                                 files: taskRow.files,
                             })));
-                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                             if (audit && audit.violations.length > 0) {
                                 const warnings = audit.violations.filter(v => v.severity === "warning");
                                 for (const v of warnings) {
@@ -1318,7 +1329,7 @@ export async function postUnitPreVerification(pctx, opts) {
                             if (taskRow) {
                                 const expectedOutput = taskRow.expected_output ?? [];
                                 const plannedFiles = taskRow.files ?? [];
-                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+                                const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
                                 if (audit && audit.violations.length > 0) {
                                     const warnings = audit.violations.filter(v => v.severity === "warning");
                                     for (const v of warnings) {
@@ -1698,7 +1709,30 @@ export async function postUnitPreVerification(pctx, opts) {
                 ctx.ui.notify(`Artifact missing for ${s.currentUnit.type} ${s.currentUnit.id} — DB unavailable, skipping retry.${dbSkipDiag ? ` Expected: ${dbSkipDiag}` : ""}`, "error");
             }
             else if (!triggerArtifactVerified) {
-                if (s.lastToolInvocationError) {
+                if (s.lastToolInvocationError && isToolUnavailableError(s.lastToolInvocationError)) {
+                    // Tool-unavailable is transient: the workflow MCP server registers
+                    // its surface asynchronously, so a Unit's first call can race the
+                    // registration. Retry with escalating delay, bounded at 3 attempts.
+                    // ponytail: MAX constant so the guard, log, and display all agree
+                    const MAX_TOOL_UNAVAIL_RETRIES = 3;
+                    if (s.toolUnavailableRetries >= MAX_TOOL_UNAVAIL_RETRIES) {
+                        debugLog("postUnit", { phase: "tool-unavailable-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, retries: s.toolUnavailableRetries });
+                        ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type} after ${MAX_TOOL_UNAVAIL_RETRIES} retries: ${s.lastToolInvocationError}. MCP server may not be starting — pausing auto-mode.`, "error");
+                        s.lastToolInvocationError = null;
+                        await pauseAuto(ctx, pi);
+                        return "dispatched";
+                    }
+                    s.toolUnavailableRetries++;
+                    // Exponential backoff starting at 10s (10s, 20s, 40s capped at 45s). MCP server
+                    // startup can take tens of seconds; a 1s/2s/3s linear delay re-dispatches before
+                    // the server finishes connecting, causing a stuck loop. See #817.
+                    const delayMs = Math.min(10_000 * Math.pow(2, s.toolUnavailableRetries - 1), 45_000);
+                    debugLog("postUnit", { phase: "tool-unavailable-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError, attempt: s.toolUnavailableRetries, delayMs });
+                    ctx.ui.notify(`Tool unavailable for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Waiting ${delayMs}ms for MCP server — retry ${s.toolUnavailableRetries}/${MAX_TOOL_UNAVAIL_RETRIES}.`, "warning");
+                    s.lastToolInvocationError = null;
+                    await new Promise(r => setTimeout(r, delayMs));
+                }
+                else if (s.lastToolInvocationError) {
                     const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
                     const errMsg = isUserSkip
                         ? `Tool skipped for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Queued user message interrupted the turn — pausing auto-mode.`
@@ -1741,11 +1775,11 @@ export async function postUnitPreVerification(pctx, opts) {
                         return "dispatched";
                     }
                     if (getUnitCostSpikeAction(unitCostUsd, rollingAvgUsd, resolveUnitCostSpikeMultiplier(prefs)) === "pause") {
-                        s.pendingVerificationRetry = null;
-                        s.verificationRetryCount.delete(retryKey);
-                        s.verificationRetryFailureHashes.delete(retryKey);
                         const advancedPastUnit = await hasArtifactCostGuardAdvancedPastUnit(s, ctx, s.currentUnit.type, s.currentUnit.id, prefs);
                         if (advancedPastUnit) {
+                            s.pendingVerificationRetry = null;
+                            s.verificationRetryCount.delete(retryKey);
+                            s.verificationRetryFailureHashes.delete(retryKey);
                             debugLog("postUnit", {
                                 phase: "artifact-cost-spike-continue-after-advance",
                                 unitType: s.currentUnit.type,
@@ -1757,11 +1791,15 @@ export async function postUnitPreVerification(pctx, opts) {
                             return "continue";
                         }
                         const parallelBlocker = maybeWriteParallelResearchCostSpikeBlocker(s.currentUnit.type, s.currentUnit.id, verificationBasePath, unitCostUsd, rollingAvgUsd);
-                        ctx.ui.notify(parallelBlocker
-                            ? `Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) — wrote parallel blocker and pausing auto-mode.`
-                            : `Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) — pausing auto-mode.`, "error");
-                        await pauseAuto(ctx, pi);
-                        return "dispatched";
+                        if (parallelBlocker) {
+                            s.pendingVerificationRetry = null;
+                            s.verificationRetryCount.delete(retryKey);
+                            s.verificationRetryFailureHashes.delete(retryKey);
+                            ctx.ui.notify(`Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) — wrote parallel blocker and pausing auto-mode.`, "error");
+                            await pauseAuto(ctx, pi);
+                            return "dispatched";
+                        }
+                        ctx.ui.notify(`Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) during artifact verification retry; keeping verification failure as the authoritative blocker.`, "warning");
                     }
                     const attempt = (s.verificationRetryCount.get(retryKey) ?? 0) + 1;
                     const failureDetails = describeArtifactVerificationFailure(s.currentUnit.type, s.currentUnit.id, verificationBasePath, s.lastUnitAgentEndMessages);
@@ -1786,12 +1824,14 @@ export async function postUnitPreVerification(pctx, opts) {
                             }
                         }
                         s.exhaustedVerificationUnits.add(retryKey);
+                        saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                         debugLog("postUnit", { phase: "artifact-verify-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
                         ctx.ui.notify(`${failureDetails} Pausing auto-mode after ${MAX_ARTIFACT_VERIFICATION_RETRIES} retries.`, "error");
                         await pauseAuto(ctx, pi);
                         return "dispatched";
                     }
                     s.verificationRetryCount.set(retryKey, attempt);
+                    saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                     s.pendingVerificationRetry = {
                         unitId: s.currentUnit.id,
                         failureContext: `${failureDetails} (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}).`,
@@ -1809,8 +1849,11 @@ export async function postUnitPreVerification(pctx, opts) {
                 if (s.pendingVerificationRetry?.unitId === s.currentUnit.id) {
                     s.pendingVerificationRetry = null;
                 }
+                s.toolUnavailableRetries = 0;
                 s.verificationRetryCount.delete(retryKey);
                 s.verificationRetryFailureHashes.delete(retryKey);
+                s.exhaustedVerificationUnits.delete(retryKey);
+                saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
                 if (s.currentUnit.type === "complete-milestone") {
                     const { milestone: mid } = parseUnitId(s.currentUnit.id);
                     if (mid) {
@@ -1918,12 +1961,9 @@ export async function postUnitPostVerification(pctx) {
                     // 2. Delete SUMMARY.md for the task
                     if (mid && sid && tid) {
                         // Phase C: read+delete via canonical project root.
-                        const tasksDir = resolveTasksDir(s.canonicalProjectRoot, mid, sid);
-                        if (tasksDir) {
-                            const summaryFile = join(tasksDir, buildTaskFileName(tid, "SUMMARY"));
-                            if (existsSync(summaryFile)) {
-                                unlinkSync(summaryFile);
-                            }
+                        const summaryPath = resolveTaskArtifactPath(s.canonicalProjectRoot, mid, sid, tid, "SUMMARY");
+                        if (summaryPath && existsSync(summaryPath)) {
+                            unlinkSync(summaryPath);
                         }
                     }
                     // 3. Delete the retry_on artifact (e.g. NEEDS-REWORK.md)
@@ -2055,7 +2095,7 @@ export async function postUnitPostVerification(pctx) {
                 // Write evidence JSON to slice artifacts directory
                 const slicePath = resolveSlicePath(s.canonicalProjectRoot, mid, sid);
                 const evidenceFileName = `${sid}-PRE-EXEC-VERIFY.json`;
-                let evidencePath = join(".gsd", "milestones", mid, "slices", sid, evidenceFileName);
+                let evidencePath = join(relSlicePath(s.canonicalProjectRoot, mid, sid), evidenceFileName);
                 if (slicePath) {
                     writePreExecutionEvidence(result, slicePath, mid, sid);
                     evidencePath = relative(s.canonicalProjectRoot, join(slicePath, evidenceFileName)) || evidenceFileName;