@opengsd/gsd-pi 1.2.0 → 1.3.0-dev.eed73bea

package/src/resources/extensions/gsd/auto-model-selection.ts

@@ -17,8 +17,9 @@ import { unitPhaseLabel } from "./auto-dashboard.js";
 import { getSessionModelOverride } from "./session-model-override.js";
 import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
+import { modelIdsForProfileResolution, resolveProfileAnchorProvider, resolveDisabledModelProvidersFromPreferences } from "./preferences.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
-import { isModelBlocked } from "./blocked-models.js";
+import { isModelBlocked, isModelTemporarilyUnavailable } from "./blocked-models.js";
 import { getRequiredWorkflowToolsForAutoUnit, isWorkflowMcpSurfaceTool } from "./workflow-mcp.js";
 
 /**
@@ -122,6 +123,14 @@ export function getToolBaselineSnapshot(pi: ExtensionAPI): string[] {
   return [...new Set([...baseline, ...live])];
 }
 
+export function getRegisteredToolSnapshot(pi: ExtensionAPI): string[] {
+  if (typeof pi.getAllTools !== "function") return getToolBaselineSnapshot(pi);
+  const names = pi.getAllTools()
+    .map((tool) => tool.name)
+    .filter((name): name is string => typeof name === "string" && name.length > 0);
+  return [...new Set(names)];
+}
+
 /**
  * Models eligible for the pre-dispatch policy gate. Prefer registry-available
  * models; when that list is empty (common after worktree resume before registry
@@ -264,6 +273,15 @@ function buildModelPolicyBlockReasons(
   }];
 }
 
+function isModelUnavailable(
+  basePath: string,
+  provider: string | undefined,
+  id: string | undefined,
+): boolean {
+  return isModelBlocked(basePath, provider, id) ||
+    isModelTemporarilyUnavailable(basePath, provider, id);
+}
+
 function restoreToolBaseline(pi: ExtensionAPI): void {
   const key = pi as unknown as object;
   const baseline = TOOL_BASELINE.get(key);
@@ -387,8 +405,11 @@ export function resolvePreferredModelConfig(
   unitType: string,
   autoModeStartModel: { provider: string; id: string; flatRateCtx?: FlatRateContext } | null,
   isAutoMode = true,
+  basePath?: string,
+  availableModelIds?: string[],
+  preferredModelId?: string,
 ): PreferredModelConfig | undefined {
-  const explicitConfig = resolveModelWithFallbacksForUnit(unitType);
+  const explicitConfig = resolveModelWithFallbacksForUnit(unitType, basePath, availableModelIds, preferredModelId);
   if (explicitConfig) {
     return {
       ...explicitConfig,
@@ -458,8 +479,14 @@ export async function selectAndApplyModel(
   // With no explicit level, fall back to the auto-start session level and raise
   // the code-writing floor — preserving prior behavior exactly. Recomputed per
   // dispatch so neither the floor nor a phase override leaks to other units.
+  const anchorProvider = resolveProfileAnchorProvider(ctx.model?.provider, autoModeStartModel?.provider);
+  const profileResolutionIds = modelIdsForProfileResolution(
+    ctx.modelRegistry,
+    anchorProvider,
+    resolveDisabledModelProvidersFromPreferences(),
+  );
   const explicitThinkingLevel =
-    resolveThinkingLevelForUnit(unitType) as ReturnType<ExtensionAPI["getThinkingLevel"]> | undefined;
+    resolveThinkingLevelForUnit(unitType, basePath, profileResolutionIds) as ReturnType<ExtensionAPI["getThinkingLevel"]> | undefined;
   const desiredThinkingLevel = explicitThinkingLevel
     ?? floorThinkingLevelForUnit(unitType, autoModeStartThinkingLevel);
   if (explicitThinkingLevel) {
@@ -501,9 +528,19 @@ export async function selectAndApplyModel(
       flatRateCtx: buildFlatRateContext(autoModeStartModel.provider, ctx, prefs),
     };
   }
+  const preferredModelId = autoModeStartModel
+    ? `${autoModeStartModel.provider}/${autoModeStartModel.id}`
+    : ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : undefined;
   const modelConfig = effectiveSessionModelOverride
     ? undefined
-    : resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode);
+    : resolvePreferredModelConfig(
+      unitType,
+      autoModeStartModel,
+      isAutoMode,
+      basePath,
+      profileResolutionIds,
+      preferredModelId,
+    );
   let routing: { tier: string; modelDowngraded: boolean } | null = null;
   let appliedModel: Model<Api> | null = null;
 
@@ -705,6 +742,7 @@ export async function selectAndApplyModel(
             classification.tier,
             availableModelIds,
             routingConfig,
+            preferredModelId,
           );
           const hookResult = await pi.emitBeforeModelSelect({
             unitType,
@@ -749,6 +787,7 @@ export async function selectAndApplyModel(
             unitType,
             classification.taskMetadata,
             capabilityOverrides,
+            preferredModelId,
           );
         }
 
@@ -809,9 +848,9 @@ export async function selectAndApplyModel(
       // (issue #4513).  The block is persisted in .gsd/runtime/blocked-models.json
       // so it survives /gsd auto restarts — without this, the same dead model
       // gets reselected after every restart.
-      if (isModelBlocked(basePath, model.provider, model.id)) {
+      if (isModelUnavailable(basePath, model.provider, model.id)) {
         ctx.ui.notify(
-          `Skipping blocked model ${model.provider}/${model.id} (provider rejected it for this account).`,
+          `Skipping unavailable model ${model.provider}/${model.id}.`,
           "warning",
         );
         continue;
@@ -888,7 +927,7 @@ export async function selectAndApplyModel(
       for (const model of buildPolicyEligibleFallbackOrder(ctx, routingEligibleModels, autoModeStartModel)) {
         const key = `${model.provider.toLowerCase()}/${model.id.toLowerCase()}`;
         if (!policyAllowedModelKeys.has(key)) continue;
-        if (isModelBlocked(basePath, model.provider, model.id)) continue;
+        if (isModelUnavailable(basePath, model.provider, model.id)) continue;
         const ok = await pi.setModel(model, { persist: false });
         if (!ok) continue;
         appliedModel = model;
@@ -918,10 +957,10 @@ export async function selectAndApplyModel(
       autoModeStartModel,
       effectiveSessionModelOverride,
     );
-    const startBlocked = isModelBlocked(basePath, autoModeStartModel.provider, autoModeStartModel.id);
+    const startBlocked = isModelUnavailable(basePath, autoModeStartModel.provider, autoModeStartModel.id);
     if (startBlocked) {
       ctx.ui.notify(
-        `Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is blocked for this account. Using current session model instead.`,
+        `Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is unavailable. Using current session model instead.`,
         "warning",
       );
     } else {
@@ -932,7 +971,7 @@ export async function selectAndApplyModel(
         const ok = await pi.setModel(startModel, { persist: false });
         if (!ok) {
           const byId = availableModels.find(
-            m => m.id === autoModeStartModel.id && !isModelBlocked(basePath, m.provider, m.id),
+            m => m.id === autoModeStartModel.id && !isModelUnavailable(basePath, m.provider, m.id),
           );
           if (byId) {
             const fallbackOk = await pi.setModel(byId, { persist: false });
@@ -1033,16 +1072,36 @@ export function resolveModelId<T extends { id: string; provider: string }>(
     if (providerMatch) return providerMatch;
   }
 
-  // Prefer "anthropic" as the canonical provider for Anthropic models.
-  // Transport-specific tiebreaker (ADR-012): intentionally keys on provider,
-  // not api — we want the plain Anthropic transport when multiple are available.
-  const anthropicMatch = candidates.find(m => m.provider === "anthropic");
-  if (anthropicMatch) return anthropicMatch;
+  // Subscription/OAuth routes beat pay-per-token API when the same model ID
+  // exists on multiple providers. Order matters — first match wins.
+  for (const provider of BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE) {
+    const match = candidates.find(m => m.provider === provider);
+    if (match) return match;
+  }
 
   // Fall back to first non-extension candidate, or any candidate
   return candidates.find(m => !EXTENSION_PROVIDERS.has(m.provider)) ?? candidates[0];
 }
 
+/**
+ * When a bare model ID exists on multiple providers, prefer subscription/OAuth
+ * routes over pay-per-token API keys. Matches PROVIDER_ROUTES in doctor-providers
+ * but applies when *both* sides are authenticated.
+ *
+ * Order rationale:
+ * - openai-codex before github-copilot: ChatGPT-native for shared GPT IDs
+ * - google-antigravity before google-gemini-cli: Antigravity replaced Gemini CLI for individuals
+ * - anthropic before github-copilot: first-party Claude API/OAuth over Copilot
+ * - github-copilot before openai/google: Copilot OAuth over platform API keys
+ */
+export const BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE = [
+  "openai-codex",
+  "google-antigravity",
+  "google-gemini-cli",
+  "anthropic",
+  "github-copilot",
+] as const;
+
 /**
  * Flat-rate providers charge the same per request regardless of model.
  * Dynamic routing provides no cost benefit — it only degrades quality (#3453).

package/src/resources/extensions/gsd/auto-post-unit.ts

@@ -18,15 +18,18 @@ import { deriveState } from "./state.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { loadFile, parseSummary, resolveAllOverrides } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
-import { isAwaitingUserInput } from "./user-input-boundary.js";
+import { isAwaitingUserInput } from "./consent-question.js";
 import {
-  resolveMilestonePath,
   resolveSliceFile,
   resolveSlicePath,
+  relSlicePath,
   resolveTaskFile,
   resolveMilestoneFile,
   resolveTasksDir,
-  buildTaskFileName,
+  resolveFile,
+  relMilestoneFile,
+  relSliceFile,
+  relTaskFile,
 } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { rebuildState } from "./doctor.js";
@@ -49,9 +52,9 @@ import { regenerateIfMissing } from "./workflow-projections.js";
 import { WorktreeStateProjection } from "./worktree-state-projection.js";
 import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
-import { isDbAvailable, getDbPath, refreshOpenDatabaseFromDisk, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
-import { renderPlanCheckboxes, renderRoadmapFromDb } from "./markdown-renderer.js";
-import { parseRoadmap as parseLegacyRoadmap } from "./parsers-legacy.js";
+import { isDbAvailable, getTask, getSlice, getMilestone, getMilestoneSlices, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
+import { getWorkflowDatabasePath, refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
+import { renderPlanCheckboxes, renderRoadmapFromDb, roadmapRenderMarksSliceDone } from "./markdown-renderer.js";
 import { consumeSignal } from "./session-status-io.js";
 import {
   checkPostUnitHooks,
@@ -71,7 +74,7 @@ import {
 } from "./milestone-closeout.js";
 import type { AutoSession, SidecarItem } from "./auto/session.js";
 import { getEvidence, clearEvidenceFromDisk, isExecutionToolName } from "./safety/evidence-collector.js";
-import { validateFileChanges } from "./safety/file-change-validator.js";
+import { validateFileChanges, effectiveFileChangeAllowlist } from "./safety/file-change-validator.js";
 import { crossReferenceEvidence, type ClaimedEvidence } from "./safety/evidence-cross-ref.js";
 import { validateContent } from "./safety/content-validator.js";
 import { resolveSafetyHarnessConfig } from "./safety/safety-harness.js";
@@ -87,7 +90,7 @@ import { writeTurnGitTransaction } from "./uok/gitops.js";
 import { isClosedStatus } from "./status-guards.js";
 import { detectAbandonMilestone } from "./abandon-detect.js";
 import { getPendingGate } from "./bootstrap/write-gate.js";
-import { isDeterministicPolicyError } from "./auto-tool-tracking.js";
+import { isDeterministicPolicyError, isToolUnavailableError } from "./auto-tool-tracking.js";
 import { formatConnectedStepStack, formatPostUnitStatusCard } from "./auto-status-message.js";
 import {
   clearProjectResearchInflightMarker,
@@ -95,6 +98,7 @@ import {
 } from "./project-research-policy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
+import { saveCustomVerifyRetryCounts } from "./auto/custom-verify-retry-store.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
@@ -232,7 +236,6 @@ function completeSliceReopenReplanHandoffDetected(
   return (
     agentEndMessagesIncludeSuccessfulToolResult(agentEndMessages, "gsd_task_reopen") ||
     agentEndMessagesIncludeToolCall(agentEndMessages, "gsd_task_reopen") ||
-    agentEndMessagesMentionTool(agentEndMessages, "gsd_task_reopen") ||
     unitActivityMentionsTool(s.basePath, unitType, unitId, "gsd_task_reopen") ||
     unitActivityMentionsTool(s.canonicalProjectRoot, unitType, unitId, "gsd_task_reopen")
   );
@@ -246,7 +249,6 @@ function completeSliceReplanSignalDetected(
   return (
     agentEndMessagesIncludeSuccessfulToolResult(agentEndMessages, "gsd_replan_slice") ||
     agentEndMessagesIncludeToolCall(agentEndMessages, "gsd_replan_slice") ||
-    agentEndMessagesMentionTool(agentEndMessages, "gsd_replan_slice") ||
     unitActivityMentionsTool(s.basePath, s.currentUnit.type, s.currentUnit.id, "gsd_replan_slice") ||
     unitActivityMentionsTool(s.canonicalProjectRoot, s.currentUnit.type, s.currentUnit.id, "gsd_replan_slice")
   );
@@ -440,6 +442,22 @@ function getPlannedKeyFiles(tasks: Array<
 export const _parseReactiveBatchTaskIdsForTest = parseReactiveBatchTaskIds;
 export const _getPlannedKeyFilesForTest = getPlannedKeyFiles;
 
+function resolveTaskArtifactPath(
+  basePath: string,
+  mid: string,
+  sid: string,
+  tid: string,
+  suffix: string,
+): string | null {
+  const legacy = resolveTaskFile(basePath, mid, sid, tid, suffix);
+  if (legacy) return legacy;
+  const slicePath = resolveSlicePath(basePath, mid, sid);
+  if (!slicePath) return null;
+  const taskDir = resolveTasksDir(basePath, mid, sid) ?? slicePath;
+  const file = resolveFile(taskDir, tid, suffix);
+  return file ? join(taskDir, file) : null;
+}
+
 function resolveVerificationFailureMarkerPath(
   unitType: string,
   unitId: string,
@@ -450,20 +468,17 @@ function resolveVerificationFailureMarkerPath(
     case "complete-milestone": {
       const existing = resolveMilestoneFile(basePath, mid, "VERIFICATION-FAILED");
       if (existing) return existing;
-      const milestoneDir = resolveMilestonePath(basePath, mid);
-      return milestoneDir ? join(milestoneDir, `${mid}-VERIFICATION-FAILED.md`) : null;
+      return join(basePath, relMilestoneFile(basePath, mid, "VERIFICATION-FAILED"));
     }
     case "complete-slice": {
       const existing = resolveSliceFile(basePath, mid, sid!, "VERIFICATION-FAILED");
       if (existing) return existing;
-      const sliceDir = resolveSlicePath(basePath, mid, sid!);
-      return sliceDir ? join(sliceDir, `${sid}-VERIFICATION-FAILED.md`) : null;
+      return join(basePath, relSliceFile(basePath, mid, sid!, "VERIFICATION-FAILED"));
     }
     case "execute-task": {
-      const existing = resolveTaskFile(basePath, mid, sid!, tid!, "VERIFICATION-FAILED");
+      const existing = resolveTaskArtifactPath(basePath, mid, sid!, tid!, "VERIFICATION-FAILED");
       if (existing) return existing;
-      const tasksDir = resolveTasksDir(basePath, mid, sid!);
-      return tasksDir ? join(tasksDir, buildTaskFileName(tid!, "VERIFICATION-FAILED")) : null;
+      return join(basePath, relTaskFile(basePath, mid, sid!, tid!, "VERIFICATION-FAILED"));
     }
     default:
       return null;
@@ -482,7 +497,7 @@ async function buildTaskCommitContextForUnit(
   const task = isDbAvailable() ? getTask(mid, sid, tid) : null;
   let summary: ReturnType<typeof parseSummary> | null = null;
 
-  const summaryPath = resolveTaskFile(basePath, mid, sid, tid, "SUMMARY");
+  const summaryPath = resolveTaskArtifactPath(basePath, mid, sid, tid, "SUMMARY");
   if (summaryPath) {
     try {
       const summaryContent = await loadFile(summaryPath);
@@ -618,8 +633,10 @@ export function _hasExecutionToolCallsInSessionForTest(entries: readonly unknown
       return true;
     }
 
-    if (e?.type !== "message") continue;
-    const msg = e?.message;
+    // Accept both session-manager entries ({type: "message", message}) and
+    // bare agent-end messages ({role, content}) — the auto loop passes the
+    // latter via opts.agentEndMessages.
+    const msg = e?.type === "message" ? e?.message : e;
     if (!msg || msg.role !== "assistant" || !Array.isArray(msg.content)) continue;
     for (const block of msg.content) {
       if (block?.type !== "toolCall") continue;
@@ -693,7 +710,7 @@ export function detectRogueFileWrites(
   if (unitType === "execute-task") {
     if (!mid || !sid || !tid) return [];
 
-    const summaryPath = resolveTaskFile(basePath, mid, sid, tid, "SUMMARY");
+    const summaryPath = resolveTaskArtifactPath(basePath, mid, sid, tid, "SUMMARY");
     if (!summaryPath || !existsSync(summaryPath)) return [];
 
     const dbRow = getTask(mid, sid, tid);
@@ -759,7 +776,7 @@ export function detectRogueFileWrites(
   } else if (unitType === "plan-task") {
     if (!mid || !sid || !tid) return [];
 
-    const taskPlanPath = resolveTaskFile(basePath, mid, sid, tid, "PLAN");
+    const taskPlanPath = resolveTaskArtifactPath(basePath, mid, sid, tid, "PLAN");
     if (!taskPlanPath || !existsSync(taskPlanPath)) return [];
 
     const dbRow = getTask(mid, sid, tid);
@@ -898,7 +915,7 @@ export const USER_DRIVEN_DEEP_UNITS = new Set([
   "discuss-milestone",
   "research-decision",
 ]);
-export { isAwaitingUserInput } from "./user-input-boundary.js";
+export { isAwaitingUserInput } from "./consent-question.js";
 
 function artifactValidationKind(unitType: string): "project" | "requirements" | null {
   if (unitType === "discuss-project") return "project";
@@ -987,11 +1004,13 @@ async function repairCompleteSliceRoadmapProjection(
     return false;
   }
 
+  // Stale-render detection (ADR-017): the DB already says the slice is closed;
+  // this only checks whether the rendered ROADMAP projection reflects it, to
+  // decide whether a repair re-render is needed.
   const roadmapPath = resolveMilestoneFile(artifactBase, mid, "ROADMAP");
   if (roadmapPath && existsSync(roadmapPath)) {
     try {
-      const roadmap = parseLegacyRoadmap(readFileSync(roadmapPath, "utf-8"));
-      if (roadmap.slices.find((roadmapSlice) => roadmapSlice.id === sid)?.done) {
+      if (roadmapRenderMarksSliceDone(readFileSync(roadmapPath, "utf-8"), sid)) {
         return false;
       }
     } catch (err) {
@@ -1273,9 +1292,9 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
     await new Promise(r => setTimeout(r, 100));
   }
 
-  const dbPath = getDbPath();
+  const dbPath = getWorkflowDatabasePath();
   if (isDbAvailable() && dbPath && dbPath !== ":memory:") {
-    const refreshed = refreshOpenDatabaseFromDisk();
+    const refreshed = refreshWorkflowDatabaseFromDisk();
     if (!refreshed) {
       logWarning("db", "post-unit database refresh failed; derived state may be stale");
     }
@@ -1534,6 +1553,11 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
       if (safetyConfig.enabled) {
         const { milestone: sMid, slice: sSid, task: sTid } = parseUnitId(s.currentUnit.id);
 
+        const fileChangeAllowlist = effectiveFileChangeAllowlist(
+          safetyConfig.file_change_allowlist,
+          (prefs?.git as { manage_gitignore?: boolean } | undefined)?.manage_gitignore,
+        );
+
         // File change validation (execute-task only, after unit execution)
         if (safetyConfig.file_change_validation && s.currentUnit.type === "execute-task" && sMid && sSid && sTid) {
           try {
@@ -1553,7 +1577,7 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
                   files: taskRow.files,
                 })),
               );
-              const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
+              const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, fileChangeAllowlist);
               if (audit && audit.violations.length > 0) {
                 const warnings = audit.violations.filter(v => v.severity === "warning");
                 for (const v of warnings) {
@@ -1575,7 +1599,7 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
                   s.basePath,
                   expectedOutput,
                   plannedFiles,
-                  safetyConfig.file_change_allowlist,
+                  fileChangeAllowlist,
                 );
                 if (audit && audit.violations.length > 0) {
                   const warnings = audit.violations.filter(v => v.severity === "warning");
@@ -2014,7 +2038,35 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
           "error",
         );
       } else if (!triggerArtifactVerified) {
-        if (s.lastToolInvocationError) {
+        if (s.lastToolInvocationError && isToolUnavailableError(s.lastToolInvocationError)) {
+          // Tool-unavailable is transient: the workflow MCP server registers
+          // its surface asynchronously, so a Unit's first call can race the
+          // registration. Retry with escalating delay, bounded at 3 attempts.
+          // ponytail: MAX constant so the guard, log, and display all agree
+          const MAX_TOOL_UNAVAIL_RETRIES = 3;
+          if (s.toolUnavailableRetries >= MAX_TOOL_UNAVAIL_RETRIES) {
+            debugLog("postUnit", { phase: "tool-unavailable-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, retries: s.toolUnavailableRetries });
+            ctx.ui.notify(
+              `Tool unavailable for ${s.currentUnit.type} after ${MAX_TOOL_UNAVAIL_RETRIES} retries: ${s.lastToolInvocationError}. MCP server may not be starting — pausing auto-mode.`,
+              "error",
+            );
+            s.lastToolInvocationError = null;
+            await pauseAuto(ctx, pi);
+            return "dispatched";
+          }
+          s.toolUnavailableRetries++;
+          // Exponential backoff starting at 10s (10s, 20s, 40s capped at 45s). MCP server
+          // startup can take tens of seconds; a 1s/2s/3s linear delay re-dispatches before
+          // the server finishes connecting, causing a stuck loop. See #817.
+          const delayMs = Math.min(10_000 * Math.pow(2, s.toolUnavailableRetries - 1), 45_000);
+          debugLog("postUnit", { phase: "tool-unavailable-retry", unitType: s.currentUnit.type, unitId: s.currentUnit.id, error: s.lastToolInvocationError, attempt: s.toolUnavailableRetries, delayMs });
+          ctx.ui.notify(
+            `Tool unavailable for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Waiting ${delayMs}ms for MCP server — retry ${s.toolUnavailableRetries}/${MAX_TOOL_UNAVAIL_RETRIES}.`,
+            "warning",
+          );
+          s.lastToolInvocationError = null;
+          await new Promise(r => setTimeout(r, delayMs));
+        } else if (s.lastToolInvocationError) {
           const isUserSkip = /queued user message/i.test(s.lastToolInvocationError);
           const errMsg = isUserSkip
             ? `Tool skipped for ${s.currentUnit.type}: ${s.lastToolInvocationError}. Queued user message interrupted the turn — pausing auto-mode.`
@@ -2065,9 +2117,6 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
             return "dispatched";
           }
           if (getUnitCostSpikeAction(unitCostUsd, rollingAvgUsd, resolveUnitCostSpikeMultiplier(prefs)) === "pause") {
-            s.pendingVerificationRetry = null;
-            s.verificationRetryCount.delete(retryKey);
-            s.verificationRetryFailureHashes.delete(retryKey);
             const advancedPastUnit = await hasArtifactCostGuardAdvancedPastUnit(
               s,
               ctx,
@@ -2076,6 +2125,9 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
               prefs,
             );
             if (advancedPastUnit) {
+              s.pendingVerificationRetry = null;
+              s.verificationRetryCount.delete(retryKey);
+              s.verificationRetryFailureHashes.delete(retryKey);
               debugLog("postUnit", {
                 phase: "artifact-cost-spike-continue-after-advance",
                 unitType: s.currentUnit.type,
@@ -2096,14 +2148,21 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
               unitCostUsd,
               rollingAvgUsd,
             );
+            if (parallelBlocker) {
+              s.pendingVerificationRetry = null;
+              s.verificationRetryCount.delete(retryKey);
+              s.verificationRetryFailureHashes.delete(retryKey);
+              ctx.ui.notify(
+                `Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) — wrote parallel blocker and pausing auto-mode.`,
+                "error",
+              );
+              await pauseAuto(ctx, pi);
+              return "dispatched";
+            }
             ctx.ui.notify(
-              parallelBlocker
-                ? `Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) — wrote parallel blocker and pausing auto-mode.`
-                : `Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) — pausing auto-mode.`,
-              "error",
+              `Unit ${s.currentUnit.id} cost spike detected (${unitCostUsd.toFixed(2)} vs avg ${rollingAvgUsd.toFixed(2)}) during artifact verification retry; keeping verification failure as the authoritative blocker.`,
+              "warning",
             );
-            await pauseAuto(ctx, pi);
-            return "dispatched";
           }
           const attempt = (s.verificationRetryCount.get(retryKey) ?? 0) + 1;
           const failureDetails = describeArtifactVerificationFailure(
@@ -2140,6 +2199,7 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
               }
             }
             s.exhaustedVerificationUnits.add(retryKey);
+            saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
             debugLog("postUnit", { phase: "artifact-verify-exhausted", unitType: s.currentUnit.type, unitId: s.currentUnit.id, attempt });
             ctx.ui.notify(
               `${failureDetails} Pausing auto-mode after ${MAX_ARTIFACT_VERIFICATION_RETRIES} retries.`,
@@ -2149,6 +2209,7 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
             return "dispatched";
           }
           s.verificationRetryCount.set(retryKey, attempt);
+          saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
           s.pendingVerificationRetry = {
             unitId: s.currentUnit.id,
             failureContext: `${failureDetails} (attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}).`,
@@ -2170,8 +2231,11 @@ export async function postUnitPreVerification(pctx: PostUnitContext, opts?: PreV
         if (s.pendingVerificationRetry?.unitId === s.currentUnit.id) {
           s.pendingVerificationRetry = null;
         }
+        s.toolUnavailableRetries = 0;
         s.verificationRetryCount.delete(retryKey);
         s.verificationRetryFailureHashes.delete(retryKey);
+        s.exhaustedVerificationUnits.delete(retryKey);
+        saveCustomVerifyRetryCounts(s, { logFailure: err => debugLog("postUnit", { phase: "save-verify-retries-failed", error: err instanceof Error ? err.message : String(err) }) });
 
         if (s.currentUnit.type === "complete-milestone") {
           const { milestone: mid } = parseUnitId(s.currentUnit.id);
@@ -2304,12 +2368,9 @@ export async function postUnitPostVerification(pctx: PostUnitContext): Promise<"
           // 2. Delete SUMMARY.md for the task
           if (mid && sid && tid) {
             // Phase C: read+delete via canonical project root.
-            const tasksDir = resolveTasksDir(s.canonicalProjectRoot, mid, sid);
-            if (tasksDir) {
-              const summaryFile = join(tasksDir, buildTaskFileName(tid, "SUMMARY"));
-              if (existsSync(summaryFile)) {
-                unlinkSync(summaryFile);
-              }
+            const summaryPath = resolveTaskArtifactPath(s.canonicalProjectRoot, mid, sid, tid, "SUMMARY");
+            if (summaryPath && existsSync(summaryPath)) {
+              unlinkSync(summaryPath);
             }
           }
 
@@ -2468,7 +2529,7 @@ export async function postUnitPostVerification(pctx: PostUnitContext): Promise<"
         // Write evidence JSON to slice artifacts directory
         const slicePath = resolveSlicePath(s.canonicalProjectRoot, mid, sid);
         const evidenceFileName = `${sid}-PRE-EXEC-VERIFY.json`;
-        let evidencePath = join(".gsd", "milestones", mid, "slices", sid, evidenceFileName);
+        let evidencePath = join(relSlicePath(s.canonicalProjectRoot, mid, sid), evidenceFileName);
         if (slicePath) {
           writePreExecutionEvidence(result, slicePath, mid, sid);
           evidencePath = relative(s.canonicalProjectRoot, join(slicePath, evidenceFileName)) || evidenceFileName;