@opengsd/gsd-pi 1.4.0-dev.5fc22c6f → 1.4.0-dev.c18009cd

package/pkg/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@glittercowboy/gsd",
-  "version": "1.4.0-dev.5fc22c6f",
+  "version": "1.4.0-dev.c18009cd",
   "piConfig": {
     "name": "gsd",
     "configDir": ".gsd"

package/src/resources/extensions/claude-code-cli/stream-adapter.ts

@@ -50,6 +50,7 @@ import { markToolStart, markToolEnd } from "../gsd/auto.js";
 import {
 	markInteractiveElicitationStart,
 	markInteractiveElicitationEnd,
+	isInteractiveElicitationInFlight,
 } from "../gsd/auto-tool-tracking.js";
 import {
 	discoverBrowserMcpServerName,
@@ -227,6 +228,36 @@ interface SDKInputUserMessage {
 const OTHER_OPTION_LABEL = "None of the above";
 /** Regex pattern that identifies field names and descriptions that should be treated as sensitive/secure inputs. */
 const SENSITIVE_FIELD_PATTERN = /(password|passphrase|secret|token|api[_\s-]*key|private[_\s-]*key|credential)/i;
+/** Mirrors @opengsd/mcp-server's ask_user_questions host elicitation timeout. */
+const WORKFLOW_ELICIT_TIMEOUT_MS = 10 * 60 * 1000;
+/** Close the local form just before the server drops the MCP elicitation request. */
+const WORKFLOW_ELICIT_TIMEOUT_SKEW_MS = 1_000;
+export const CLAUDE_CODE_INTERVIEW_FORM_TIMEOUT_MS = Math.max(
+	1,
+	WORKFLOW_ELICIT_TIMEOUT_MS - WORKFLOW_ELICIT_TIMEOUT_SKEW_MS,
+);
+const ELICITATION_EXPIRED_NOTICE =
+	"Question expired before you answered - the form was closed and no answers were sent.";
+const activeAskUserQuestionElicitationTimeoutAborters = new Set<() => void>();
+
+function isAskUserQuestionsToolName(toolName: string | undefined): boolean {
+	const name = String(toolName ?? "");
+	return name === "ask_user_questions" || name.endsWith("__ask_user_questions");
+}
+
+function isAskUserQuestionsTimedOutResult(
+	toolCall: Pick<ToolCall, "name">,
+	result: ExternalToolResultPayload,
+): boolean {
+	return isAskUserQuestionsToolName(toolCall.name) && result.details?.timed_out === true;
+}
+
+function abortActiveAskUserQuestionElicitationsForTimeout(): void {
+	if (!isInteractiveElicitationInFlight()) return;
+	for (const abort of [...activeAskUserQuestionElicitationTimeoutAborters]) {
+		abort();
+	}
+}
 
 // ---------------------------------------------------------------------------
 // Stream factory
@@ -1566,12 +1597,32 @@ export function createClaudeCodeElicitationHandler(
 			// it does not tear down the very elicitation that IS the human boundary
 			// (#cc-elicitation-self-cancel). It clears in the finally on every exit.
 			const elicId = "cc-elicit-" + ((request as { id?: string | number }).id ?? `${Date.now()}-${nextElicitationSeq()}`);
+			const formAbortController = new AbortController();
+			let expiryNoticeShown = false;
+			const abortExpiredForm = (): void => {
+				if (formAbortController.signal.aborted) return;
+				formAbortController.abort();
+				if (!expiryNoticeShown) {
+					expiryNoticeShown = true;
+					ui.notify(ELICITATION_EXPIRED_NOTICE, "warning");
+				}
+			};
+			const forwardSdkAbort = (): void => {
+				if (!formAbortController.signal.aborted) formAbortController.abort();
+			};
+			if (signal.aborted) {
+				forwardSdkAbort();
+			} else {
+				signal.addEventListener("abort", forwardSdkAbort, { once: true });
+			}
+			const expiryTimer = setTimeout(abortExpiredForm, CLAUDE_CODE_INTERVIEW_FORM_TIMEOUT_MS);
 			markInteractiveElicitationStart();
 			markToolStart(elicId, "ask_user_questions");
+			activeAskUserQuestionElicitationTimeoutAborters.add(abortExpiredForm);
 			try {
 				const interviewResult = await showInterviewRound(
 					questions,
-					{ signal, overlay: true },
+					{ signal: formAbortController.signal, overlay: true },
 					{ ui } as any,
 				).catch(() => undefined);
 				if (interviewResult === undefined) {
@@ -1580,7 +1631,7 @@ export function createClaudeCodeElicitationHandler(
 					// `finally` runs the moment the promise is created and the fallback
 					// wait runs with zero in-flight tools — reintroducing the
 					// self-cancel on this path (Bugbot #1c00624d).
-					return await promptElicitationWithDialogs(request, questions, ui, signal);
+					return await promptElicitationWithDialogs(request, questions, ui, formAbortController.signal);
 				}
 				if (Object.keys(interviewResult.answers).length === 0) {
 					// A system/host teardown (compaction, session_switch, true
@@ -1596,6 +1647,9 @@ export function createClaudeCodeElicitationHandler(
 					content: roundResultToElicitationContent(questions, interviewResult),
 				};
 			} finally {
+				clearTimeout(expiryTimer);
+				signal.removeEventListener("abort", forwardSdkAbort);
+				activeAskUserQuestionElicitationTimeoutAborters.delete(abortExpiredForm);
 				markToolEnd(elicId);
 				markInteractiveElicitationEnd();
 			}
@@ -2526,6 +2580,9 @@ async function pumpSdkMessages(
 								// Push synthetic completion events with result attached so the
 								// chat-controller can update pending ToolExecutionComponents.
 								if (block.type === "toolCall") {
+									if (isAskUserQuestionsTimedOutResult(block, extResult)) {
+										abortActiveAskUserQuestionElicitationsForTimeout();
+									}
 									if (suppressDuplicateUnavailable) {
 										delete (block as ToolCallWithExternalResult).externalResult;
 										stream.push({
@@ -2554,9 +2611,13 @@ async function pumpSdkMessages(
 									});
 									emittedExternalToolResultIds.add(block.id);
 								} else if (block.type === "serverToolUse") {
+									const toolCall = serverToolUseToToolCallLike(block);
+									if (isAskUserQuestionsTimedOutResult(toolCall, extResult)) {
+										abortActiveAskUserQuestionElicitationsForTimeout();
+									}
 									try {
 										await onExternalToolResult?.({
-											toolCall: serverToolUseToToolCallLike(block),
+											toolCall,
 											result: extResult,
 										});
 									} catch (error) {

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -1,5 +1,5 @@
 // gsd-pi - Claude Code stream adapter regression tests
-import { describe, test } from "node:test";
+import { describe, mock, test } from "node:test";
 import { clearGuidedUnitContext, setGuidedUnitContext } from "../../gsd/guided-unit-context.ts";
 import assert from "node:assert/strict";
 import { existsSync, mkdirSync, mkdtempSync, readFileSync, realpathSync, rmSync, writeFileSync } from "node:fs";
@@ -46,6 +46,7 @@ import {
 	buildWorkflowMcpReadinessProgressMessage,
 	pushWorkflowMcpReadinessProgressEvent,
 	resolveWorkflowMcpPreflightServerConfig,
+	CLAUDE_CODE_INTERVIEW_FORM_TIMEOUT_MS,
 } from "../stream-adapter.ts";
 import { CLAUDE_CODE_MODELS } from "../models.ts";
 import type { AssistantMessage, Context, Message } from "@gsd/pi-ai";
@@ -107,6 +108,51 @@ function setWorkflowMcpEnv(
 	};
 }
 
+// ---------------------------------------------------------------------------
+// Shared MCP elicitation fixture — a representative ask_user_questions
+// elicitation request. Used both by the external-tool-results interview
+// lifecycle tests and by the MCP elicitation bridge tests, so it lives at
+// module scope.
+// ---------------------------------------------------------------------------
+
+const askUserQuestionsRequest = {
+	serverName: "gsd-workflow",
+	message: "Please answer the following question(s).",
+	mode: "form" as const,
+	requestedSchema: {
+		type: "object" as const,
+		properties: {
+			storage_scope: {
+				type: "string",
+				title: "Storage",
+				description: "Does this app need to sync across devices?",
+				oneOf: [
+					{ const: "Local-only (Recommended)", title: "Local-only (Recommended)" },
+					{ const: "Cloud-synced", title: "Cloud-synced" },
+					{ const: "None of the above", title: "None of the above" },
+				],
+			},
+			storage_scope__note: {
+				type: "string",
+				title: "Storage Note",
+				description: "Optional note for None of the above.",
+			},
+			platform: {
+				type: "array",
+				title: "Platform",
+				description: "Where should it run?",
+				items: {
+					anyOf: [
+						{ const: "Web", title: "Web" },
+						{ const: "Desktop", title: "Desktop" },
+						{ const: "Mobile", title: "Mobile" },
+					],
+				},
+			},
+		},
+	},
+};
+
 // ---------------------------------------------------------------------------
 // Existing tests — exhausted stream fallback (#2575)
 // ---------------------------------------------------------------------------
@@ -820,6 +866,134 @@ describe("stream-adapter — Claude Code external tool results", () => {
 		);
 	});
 
+	test("closes an in-flight interview when ask_user_questions reports timed_out first", async (t) => {
+		const notifications: Array<{ message: string; type?: string }> = [];
+		let elicitationPromise: Promise<unknown> | undefined;
+		let elicitationSignalController: AbortController | undefined;
+		let customOpened = false;
+		const ui = {
+			custom: async (factory: any) => new Promise((resolve) => {
+				customOpened = true;
+				factory({ requestRender() {} } as any, {} as any, {} as any, resolve);
+			}),
+			notify: (message: string, type?: string) => {
+				notifications.push({ message, type });
+			},
+		};
+		t.after(() => {
+			elicitationSignalController?.abort();
+		});
+
+		const stream = streamViaClaudeCode(
+			{ id: "claude-sonnet-4-6" } as any,
+			{ messages: [{ role: "user", content: "Ask me." } as Message] },
+			{
+				extensionUIContext: ui as any,
+				_skipWorkflowMcpPreflightForTest: true,
+				async *_sdkQueryForTest(args: {
+					prompt: string | AsyncIterable<unknown>;
+					options?: Record<string, unknown>;
+				}) {
+					const onElicitation = args.options?.onElicitation as
+						| ((request: unknown, options: { signal: AbortSignal }) => Promise<unknown>)
+						| undefined;
+					assert.equal(typeof onElicitation, "function");
+					elicitationSignalController = new AbortController();
+					elicitationPromise = onElicitation!(askUserQuestionsRequest, {
+						signal: elicitationSignalController.signal,
+					});
+					assert.equal(customOpened, true, "interview overlay should be open before the tool result arrives");
+
+					// The adapter only assembles tool-call blocks after a
+					// message_start has created the partial-message builder. Real
+					// SDK streams always emit it before a tool_use content block;
+					// without it the timed_out result is never matched to the
+					// in-flight ask_user_questions block, so the interview would
+					// never be closed.
+					yield {
+						type: "stream_event",
+						event: { type: "message_start", message: { model: "claude-sonnet-4-6" } },
+						parent_tool_use_id: null,
+						uuid: "partial-1",
+						session_id: "session-1",
+					};
+					yield {
+						type: "stream_event",
+						event: {
+							type: "content_block_start",
+							index: 0,
+							content_block: {
+								type: "tool_use",
+								id: "ask-1",
+								name: "mcp__gsd-workflow__ask_user_questions",
+								input: {},
+							},
+						},
+						parent_tool_use_id: null,
+						uuid: "partial-1",
+						session_id: "session-1",
+					};
+					yield {
+						type: "user",
+						uuid: "user-result-1",
+						session_id: "session-1",
+						parent_tool_use_id: "ask-1",
+						message: {
+							role: "user",
+							content: [{
+								type: "mcp_tool_result",
+								tool_use_id: "ask-1",
+								content: [{ type: "text", text: "timed out" }],
+								structuredContent: { timed_out: true },
+								is_error: false,
+							}],
+						},
+					};
+					yield {
+						type: "result",
+						subtype: "success",
+						uuid: "result-1",
+						session_id: "session-1",
+						duration_ms: 1,
+						duration_api_ms: 1,
+						is_error: false,
+						num_turns: 1,
+						result: "done",
+						stop_reason: "end_turn",
+						total_cost_usd: 0,
+						usage: {
+							input_tokens: 0,
+							output_tokens: 0,
+							cache_read_input_tokens: 0,
+							cache_creation_input_tokens: 0,
+						},
+					};
+				},
+			} as any,
+		);
+
+		await stream.result();
+		assert.ok(elicitationPromise);
+		let guard: ReturnType<typeof setTimeout> | undefined;
+		const elicitationResult = await Promise.race([
+			elicitationPromise,
+			new Promise<never>((_, reject) => {
+				guard = setTimeout(
+					() => reject(new Error("timed out waiting for in-flight interview to close")),
+					250,
+				);
+			}),
+		]).finally(() => {
+			if (guard) clearTimeout(guard);
+		});
+
+		assert.deepEqual(elicitationResult, { action: "decline" });
+		assert.deepEqual(notifications, [{
+			message: "Question expired before you answered - the form was closed and no answers were sent.",
+			type: "warning",
+		}]);
+	});
+
 	test("serverToolUseToToolCallLike preserves object input for extension tool_result routing", () => {
 		const toolCall = serverToolUseToToolCallLike({
 			id: "srv-1",
@@ -2595,44 +2769,6 @@ describe("stream-adapter — workflow MCP readiness", () => {
 });
 
 describe("stream-adapter — MCP elicitation bridge", () => {
-	const askUserQuestionsRequest = {
-		serverName: "gsd-workflow",
-		message: "Please answer the following question(s).",
-		mode: "form" as const,
-		requestedSchema: {
-			type: "object" as const,
-			properties: {
-				storage_scope: {
-					type: "string",
-					title: "Storage",
-					description: "Does this app need to sync across devices?",
-					oneOf: [
-						{ const: "Local-only (Recommended)", title: "Local-only (Recommended)" },
-						{ const: "Cloud-synced", title: "Cloud-synced" },
-						{ const: "None of the above", title: "None of the above" },
-					],
-				},
-				storage_scope__note: {
-					type: "string",
-					title: "Storage Note",
-					description: "Optional note for None of the above.",
-				},
-				platform: {
-					type: "array",
-					title: "Platform",
-					description: "Where should it run?",
-					items: {
-						anyOf: [
-							{ const: "Web", title: "Web" },
-							{ const: "Desktop", title: "Desktop" },
-							{ const: "Mobile", title: "Mobile" },
-						],
-					},
-				},
-			},
-		},
-	};
-
 	test("parseAskUserQuestionsElicitation rebuilds interview questions from the MCP schema", () => {
 		const questions = parseAskUserQuestionsElicitation(askUserQuestionsRequest);
 		assert.deepEqual(questions, [
@@ -3041,6 +3177,43 @@ describe("stream-adapter — MCP elicitation bridge", () => {
 		assert.deepEqual(result, { action: "decline" });
 	});
 
+	test("expires the interview overlay before the MCP elicitation response is dropped", async (t) => {
+		mock.timers.enable({ apis: ["setTimeout"] });
+		t.after(() => {
+			mock.timers.reset();
+		});
+
+		const notifications: Array<{ message: string; type?: string }> = [];
+		let customOpened = false;
+		const handler = createClaudeCodeElicitationHandler({
+			custom: async (factory: any) => new Promise((resolve) => {
+				customOpened = true;
+				factory({ requestRender() {} } as any, {} as any, {} as any, resolve);
+			}),
+			notify: (message: string, type?: string) => {
+				notifications.push({ message, type });
+			},
+			select: async () => {
+				throw new Error("expired interview must not re-open dialog fallback");
+			},
+		} as any);
+		assert.ok(handler);
+
+		const resultPromise = handler!(askUserQuestionsRequest, { signal: new AbortController().signal });
+		await Promise.resolve();
+		assert.equal(customOpened, true);
+
+		mock.timers.tick(CLAUDE_CODE_INTERVIEW_FORM_TIMEOUT_MS);
+		const result = await resultPromise;
+
+		assert.deepEqual(result, { action: "decline" });
+		assert.deepEqual(notifications, [{
+			message: "Question expired before you answered - the form was closed and no answers were sent.",
+			type: "warning",
+		}]);
+		assert.equal(isInteractiveElicitationInFlight(), false, "marker must clear after deadline expiry");
+	});
+
 	test("returns cancel (today's semantics) when the user genuinely dismisses", async () => {
 		const handler = createClaudeCodeElicitationHandler({
 			custom: async () => ({ endInterview: false, answers: {} }),

package/src/resources/extensions/gsd/artifact-verification.ts

@@ -356,6 +356,19 @@ export function verifyExpectedArtifact(
       try {
         let taskIds: string[] | null = null;
         let dbPrimary = false;
+        const planContent = readFileSync(absPath, "utf-8");
+        let parsedTaskIds: string[] | null = null;
+        const getParsedTaskIds = (): string[] => {
+          if (parsedTaskIds) return parsedTaskIds;
+          parsedTaskIds = parseLegacyPlan(planContent).tasks.map((t: { id: string }) => t.id);
+          return parsedTaskIds;
+        };
+        const tasksBlockMatch = planContent.match(/<tasks>([\s\S]*?)<\/tasks>/i);
+        const tasksBlock = tasksBlockMatch?.[1] ?? "";
+        const hasEmbeddedTaskEntries =
+          tasksBlock.length > 0 &&
+          (/^\s*- \[[xX ]\] \*\*T\d+/m.test(tasksBlock) ||
+            /^\s*#{2,4}\s+T\d+\s*(?:--|—|:)/m.test(tasksBlock));
         if (isDbAvailable()) {
           const refreshed = refreshWorkflowDatabaseFromDisk();
           if (refreshed) {
@@ -368,18 +381,17 @@ export function verifyExpectedArtifact(
         }
 
         if (!taskIds) {
-          const planContent = readFileSync(absPath, "utf-8");
           const hasCheckboxTask = /^\s*- \[[xX ]\] \*\*T\d+/m.test(planContent);
           const hasHeadingTask = /^\s*#{2,4}\s+T\d+\s*(?:--|—|:)/m.test(planContent);
           if (!hasCheckboxTask && !hasHeadingTask) {
             logWarning("recovery", `verify-fail ${unitType} ${unitId}: plan has no task checkbox/heading (len=${planContent.length}) at ${absPath}`);
             return false;
           }
-          const plan = parseLegacyPlan(planContent);
-          if (plan.tasks.length > 0) taskIds = plan.tasks.map((t: { id: string }) => t.id);
+          const parsedIds = getParsedTaskIds();
+          if (parsedIds.length > 0) taskIds = parsedIds;
         }
 
-        if (taskIds && taskIds.length > 0) {
+        if (taskIds && taskIds.length > 0 && !hasEmbeddedTaskEntries) {
           const tasksDir = join(dirname(absPath), "tasks");
           if (existsSync(tasksDir)) {
             for (const tid of taskIds) {

package/src/resources/extensions/gsd/auto/closeout.ts

@@ -79,13 +79,14 @@ export async function restorePreflightStashOrStop(
 }
 
 /**
- * Run a milestone merge surrounded by preflight stash + always-on postflight
- * pop. The previous code popped the stash only after a successful merge, which
- * leaked `gsd-preflight-stash:M00x:*` entries whenever `mergeAndExit` threw —
- * leaving the user's pre-merge working tree silently stashed away after a
- * merge-conflict or other merge error. This helper restores the stash on
- * every exit path, then surfaces the merge or stash failure (in priority
- * order) as the loop's stop reason.
+ * Run a milestone merge through Worktree Lifecycle's guarded merge option,
+ * which surrounds the inner merge with preflight stash + always-on postflight
+ * pop. The previous closeout code popped the stash only after a successful
+ * merge, which leaked `gsd-preflight-stash:M00x:*` entries whenever
+ * `mergeAndExit` threw — leaving the user's pre-merge working tree silently
+ * stashed away after a merge-conflict or other merge error. Lifecycle now
+ * restores the stash on every attempted merge path, then this adapter surfaces
+ * the merge or stash failure (in priority order) as the loop's stop reason.
  *
  * Returns a `break` action when auto-mode must stop, or `null` when the merge
  * succeeded and the stash (if any) was restored cleanly.
@@ -97,66 +98,45 @@ export async function _runMilestoneMergeWithStashRestore(
 ): Promise<{ action: "break"; reason: string } | null> {
   const { ctx, pi, s, deps } = ic;
 
-  const preflight = deps.preflightCleanRoot(
-    s.originalBasePath || s.basePath,
+  const projectRoot = s.originalBasePath || s.basePath;
+  const mergeResult = deps.lifecycle.exitMilestone(
     milestoneId,
-    ctx.ui.notify.bind(ctx.ui),
+    {
+      merge: true,
+      guardedMerge: {
+        projectRoot,
+        preflightCleanRoot: deps.preflightCleanRoot,
+        postflightPopStash: deps.postflightPopStash,
+      },
+    },
+    ctx.ui,
   );
-  if (preflight.blocked) {
-    const reason = preflight.blockedReason === "unmerged-conflicts"
+
+  if (mergeResult.ok) {
+    await markMilestoneMergedAndRebuild(s);
+    return null;
+  }
+
+  if (mergeResult.reason === "postflight-stash-restore-failed") {
+    await markMilestoneMergedAndRebuild(s);
+  }
+
+  if (mergeResult.reason === "preflight-dirty-overlap" || mergeResult.reason === "preflight-unmerged-conflicts") {
+    const reason = mergeResult.reason === "preflight-unmerged-conflicts"
       ? `Pre-merge unresolved Git conflicts block milestone ${milestoneId}`
       : `Pre-merge dirty working tree overlaps milestone ${milestoneId}`;
     await deps.stopAuto(ctx, pi, reason, {
       preserveCompletedMilestoneBranch: true,
       preserveCloseoutTranscript: options.preserveCloseoutTranscript,
     });
-    return {
-      action: "break",
-      reason: preflight.blockedReason === "unmerged-conflicts"
-        ? "preflight-unmerged-conflicts"
-        : "preflight-dirty-overlap",
-    };
-  }
-
-  let mergeError: unknown = null;
-  const exitResult = deps.lifecycle.exitMilestone(
-    milestoneId,
-    { merge: true },
-    ctx.ui,
-  );
-  if (exitResult.ok) {
-    s.milestoneMergedInPhases = true;
-    try {
-      const projectRoot = s.originalBasePath || s.canonicalProjectRoot || s.basePath;
-      const { rebuildMarkdownProjectionsFromDb } = await import("../commands-maintenance.js");
-      await rebuildMarkdownProjectionsFromDb(projectRoot);
-    } catch (err) {
-      logWarning(
-        "engine",
-        `markdown projection rebuild after milestone merge failed: ${err instanceof Error ? err.message : String(err)}`,
-      );
-    }
-  } else {
-    mergeError = exitResult.cause ?? new Error(`exit ${exitResult.reason}`);
-  }
-
-  // Always attempt to restore the stashed working tree, even on merge error.
-  // postflightPopStash itself does not throw; failures surface via the
-  // PostflightResult.needsManualRecovery flag.
-  let stashResult: PostflightResult | null = null;
-  if (preflight.stashPushed) {
-    stashResult = deps.postflightPopStash(
-      s.originalBasePath || s.basePath,
-      milestoneId,
-      preflight.stashMarker,
-      ctx.ui.notify.bind(ctx.ui),
-    );
+    return { action: "break", reason: mergeResult.reason };
   }
 
   // Merge failure takes priority over stash recovery — the merge is the
   // authoritative gate. If the stash also needed manual recovery, the user
   // already saw the postflightPopStash notify above.
-  if (mergeError) {
+  if (mergeResult.reason === "merge-conflict") {
+    const mergeError = mergeResult.cause;
     if (mergeError instanceof MergeConflictError) {
       // A merge conflict is a recoverable human checkpoint, not an
       // infrastructure failure — the user resolves the conflict and runs
@@ -173,6 +153,10 @@ export async function _runMilestoneMergeWithStashRestore(
       });
       return { action: "break", reason: "merge-conflict" };
     }
+  }
+
+  if (mergeResult.reason === "merge-failed" || mergeResult.reason === "merge-conflict") {
+    const mergeError = mergeResult.cause;
     logError("engine", "Milestone merge failed with non-conflict error", {
       milestone: milestoneId,
       error: String(mergeError),
@@ -190,12 +174,26 @@ export async function _runMilestoneMergeWithStashRestore(
     return { action: "break", reason: "merge-failed" };
   }
 
-  if (stashResult) {
-    return stopOnPostflightRecoveryNeeded(ic, stashResult, milestoneId);
+  if (mergeResult.postflight) {
+    return stopOnPostflightRecoveryNeeded(ic, mergeResult.postflight, milestoneId);
   }
   return null;
 }
 
+async function markMilestoneMergedAndRebuild(s: AutoSession): Promise<void> {
+  s.milestoneMergedInPhases = true;
+  try {
+    const rebuildBasePath = s.originalBasePath || s.canonicalProjectRoot || s.basePath;
+    const { rebuildMarkdownProjectionsFromDb } = await import("../commands-maintenance.js");
+    await rebuildMarkdownProjectionsFromDb(rebuildBasePath);
+  } catch (err) {
+    logWarning(
+      "engine",
+      `markdown projection rebuild after milestone merge failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
 export async function _runMilestoneMergeOnceWithStashRestore(
   ic: IterationContext,
   milestoneId: string,

package/src/resources/extensions/gsd/auto/finalize.ts

@@ -373,6 +373,14 @@ export async function runFinalize(
         files: leak.files.map((file) => ({ path: file.path, status: file.status })),
       });
       ctx.ui.notify(message, "error");
+      try {
+        deps.checkpointWorkflowDatabase?.();
+      } catch (err) {
+        debugLog("autoLoop", {
+          phase: "root-write-leak-checkpoint-failed",
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
       await deps.stopAuto(ctx, pi, "Root-write leak during isolated auto-mode", {
         preserveCompletedMilestoneBranch: true,
       });

package/src/resources/extensions/gsd/auto/loop-deps.ts

@@ -80,6 +80,7 @@ export interface LoopDeps {
   ) => Promise<void>;
   pauseAuto: PauseAutoFn;
   clearUnitTimeout: () => void;
+  checkpointWorkflowDatabase?: () => void;
   updateProgressWidget: (
     ctx: ExtensionContext,
     unitType: string,

package/src/resources/extensions/gsd/auto/orchestrator.ts

@@ -731,7 +731,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         return new GitServiceImpl(basePath, gitConfig);
       },
       worktreeProjection: new WorktreeStateProjection(),
-      mergeMilestoneToMain: createMilestoneMergeTransaction(mergeMilestoneToMain),
+      mergeMilestone: createMilestoneMergeTransaction(mergeMilestoneToMain),
     });
   }
 

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -26,7 +26,7 @@ import { debugLog } from "../debug-logger.js";
 import { logWarning, logError } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
 import { readUnitRuntimeRecord, type AutoUnitRuntimeRecord } from "../unit-runtime.js";
-import { consumeAutoWakeup } from "./schedule-wakeup.js";
+import { clearAutoWakeup, consumeAutoWakeup } from "./schedule-wakeup.js";
 import { applyUnitSkillVisibility } from "../skill-scope.js";
 
 const UNIT_FAILSAFE_BUFFER_MS = 30_000;
@@ -248,7 +248,7 @@ export async function runUnit(
     ((supervisor.idle_timeout_minutes ?? 10) * 60 * 1000) + UNIT_FAILSAFE_BUFFER_MS,
   );
   let unitTimeoutHandle: ReturnType<typeof setTimeout> | undefined;
-  let result: UnitResult;
+  let result: UnitResult = { status: "cancelled" };
   try {
     const awaitAgentEndWithTimeout = (agentEndPromise: Promise<UnitResult>): Promise<UnitResult> => {
       const timeoutResult = new Promise<UnitResult>((resolve) => {
@@ -360,6 +360,9 @@ export async function runUnit(
     }
   } finally {
     if (unitTimeoutHandle) clearTimeout(unitTimeoutHandle);
+    if (result.status !== "completed") {
+      clearAutoWakeup(s.basePath, unitType, unitId);
+    }
     ctx.ui.setWorkingMessage?.(undefined);
     setVisibleSkills?.(undefined);
   }