@opengsd/gsd-pi 1.4.0 → 1.5.0

package/src/resources/extensions/gsd/activity-log.ts

@@ -16,6 +16,7 @@ import { GSDError, GSD_IO_ERROR } from "./errors.js";
 const SEQ_PREFIX_RE = /^(\d+)-/;
 import type { ExtensionContext } from "@gsd/pi-coding-agent";
 import { gsdRoot } from "./paths.js";
+import { redactSecrets } from "./redact-secrets.js";
 import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
 import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
 
@@ -127,7 +128,9 @@ export function saveActivityLog(
     const fd = openSync(filePath, "w");
     try {
       for (const entry of entries) {
-        writeSync(fd, JSON.stringify(entry) + "\n");
+        // Redact secret-shaped substrings before persisting; .gsd/ is skipped by
+        // the secret scanner, so raw LLM/tool content could otherwise leak keys.
+        writeSync(fd, redactSecrets(JSON.stringify(entry)) + "\n");
       }
     } finally {
       closeSync(fd);

package/src/resources/extensions/gsd/artifact-verification.ts

@@ -45,7 +45,6 @@ import { resolveWorktreeProjectRoot } from "./worktree-root.js";
 import { hasImplementationArtifacts } from "./milestone-implementation-evidence.js";
 import { loadAllCaptures, loadPendingCaptures } from "./captures.js";
 import { proveMilestoneCloseout } from "./milestone-closeout-proof.js";
-
 /**
  * Optional override for the legacy roadmap parser used by verifyExpectedArtifact.
  * Production leaves this null so the real parseLegacyRoadmap runs; tests inject
@@ -72,6 +71,11 @@ function parseRoadmapForRecovery(content: string): ReturnType<NonNullable<typeof
   return parseLegacyRoadmap(content) as unknown as ReturnType<NonNullable<typeof _roadmapParserFn>>;
 }
 
+/** Slice count for plan-milestone verification; shared by scoped and legacy paths. */
+export function countPlanMilestoneRoadmapSlices(content: string): number {
+  return parseRoadmapForRecovery(content).slices.length;
+}
+
 export function diagnoseWorktreeIntegrityFailure(basePath: string): string | null {
   if (!isGsdWorktreePath(basePath)) return null;
   if (!existsSync(basePath)) {
@@ -336,8 +340,7 @@ export function verifyExpectedArtifact(
 
   if (unitType === "plan-milestone") {
     try {
-      const roadmap = parseRoadmapForRecovery(readFileSync(absPath, "utf-8"));
-      if (roadmap.slices.length === 0) {
+      if (countPlanMilestoneRoadmapSlices(readFileSync(absPath, "utf-8")) === 0) {
         logWarning("recovery", `verify-fail ${unitType} ${unitId}: roadmap has zero slices at ${absPath}`);
         return false;
       }
@@ -353,6 +356,19 @@ export function verifyExpectedArtifact(
       try {
         let taskIds: string[] | null = null;
         let dbPrimary = false;
+        const planContent = readFileSync(absPath, "utf-8");
+        let parsedTaskIds: string[] | null = null;
+        const getParsedTaskIds = (): string[] => {
+          if (parsedTaskIds) return parsedTaskIds;
+          parsedTaskIds = parseLegacyPlan(planContent).tasks.map((t: { id: string }) => t.id);
+          return parsedTaskIds;
+        };
+        const tasksBlockMatch = planContent.match(/<tasks>([\s\S]*?)<\/tasks>/i);
+        const tasksBlock = tasksBlockMatch?.[1] ?? "";
+        const hasEmbeddedTaskEntries =
+          tasksBlock.length > 0 &&
+          (/^\s*- \[[xX ]\] \*\*T\d+/m.test(tasksBlock) ||
+            /^\s*#{2,4}\s+T\d+\s*(?:--|—|:)/m.test(tasksBlock));
         if (isDbAvailable()) {
           const refreshed = refreshWorkflowDatabaseFromDisk();
           if (refreshed) {
@@ -365,24 +381,24 @@ export function verifyExpectedArtifact(
         }
 
         if (!taskIds) {
-          const planContent = readFileSync(absPath, "utf-8");
           const hasCheckboxTask = /^\s*- \[[xX ]\] \*\*T\d+/m.test(planContent);
           const hasHeadingTask = /^\s*#{2,4}\s+T\d+\s*(?:--|—|:)/m.test(planContent);
           if (!hasCheckboxTask && !hasHeadingTask) {
             logWarning("recovery", `verify-fail ${unitType} ${unitId}: plan has no task checkbox/heading (len=${planContent.length}) at ${absPath}`);
             return false;
           }
-          const plan = parseLegacyPlan(planContent);
-          if (plan.tasks.length > 0) taskIds = plan.tasks.map((t: { id: string }) => t.id);
+          const parsedIds = getParsedTaskIds();
+          if (parsedIds.length > 0) taskIds = parsedIds;
         }
 
-        if (taskIds && taskIds.length > 0) {
+        if (taskIds && taskIds.length > 0 && !hasEmbeddedTaskEntries) {
           const tasksDir = join(dirname(absPath), "tasks");
           if (existsSync(tasksDir)) {
             for (const tid of taskIds) {
               const taskPlanFile = join(tasksDir, `${tid}-PLAN.md`);
-              if (!existsSync(taskPlanFile)) {
-                logWarning("recovery", `verify-fail ${unitType} ${unitId}: task plan missing ${taskPlanFile}`);
+              const taskSummaryFile = join(tasksDir, `${tid}-SUMMARY.md`);
+              if (!existsSync(taskPlanFile) && !existsSync(taskSummaryFile)) {
+                logWarning("recovery", `verify-fail ${unitType} ${unitId}: task artifact missing for ${tid}`);
                 return false;
               }
             }

package/src/resources/extensions/gsd/auto/closeout.ts

@@ -79,13 +79,14 @@ export async function restorePreflightStashOrStop(
 }
 
 /**
- * Run a milestone merge surrounded by preflight stash + always-on postflight
- * pop. The previous code popped the stash only after a successful merge, which
- * leaked `gsd-preflight-stash:M00x:*` entries whenever `mergeAndExit` threw —
- * leaving the user's pre-merge working tree silently stashed away after a
- * merge-conflict or other merge error. This helper restores the stash on
- * every exit path, then surfaces the merge or stash failure (in priority
- * order) as the loop's stop reason.
+ * Run a milestone merge through Worktree Lifecycle's guarded merge option,
+ * which surrounds the inner merge with preflight stash + always-on postflight
+ * pop. The previous closeout code popped the stash only after a successful
+ * merge, which leaked `gsd-preflight-stash:M00x:*` entries whenever
+ * `mergeAndExit` threw — leaving the user's pre-merge working tree silently
+ * stashed away after a merge-conflict or other merge error. Lifecycle now
+ * restores the stash on every attempted merge path, then this adapter surfaces
+ * the merge or stash failure (in priority order) as the loop's stop reason.
  *
  * Returns a `break` action when auto-mode must stop, or `null` when the merge
  * succeeded and the stash (if any) was restored cleanly.
@@ -97,66 +98,45 @@ export async function _runMilestoneMergeWithStashRestore(
 ): Promise<{ action: "break"; reason: string } | null> {
   const { ctx, pi, s, deps } = ic;
 
-  const preflight = deps.preflightCleanRoot(
-    s.originalBasePath || s.basePath,
+  const projectRoot = s.originalBasePath || s.basePath;
+  const mergeResult = deps.lifecycle.exitMilestone(
     milestoneId,
-    ctx.ui.notify.bind(ctx.ui),
+    {
+      merge: true,
+      guardedMerge: {
+        projectRoot,
+        preflightCleanRoot: deps.preflightCleanRoot,
+        postflightPopStash: deps.postflightPopStash,
+      },
+    },
+    ctx.ui,
   );
-  if (preflight.blocked) {
-    const reason = preflight.blockedReason === "unmerged-conflicts"
+
+  if (mergeResult.ok) {
+    await markMilestoneMergedAndRebuild(s);
+    return null;
+  }
+
+  if (mergeResult.reason === "postflight-stash-restore-failed") {
+    await markMilestoneMergedAndRebuild(s);
+  }
+
+  if (mergeResult.reason === "preflight-dirty-overlap" || mergeResult.reason === "preflight-unmerged-conflicts") {
+    const reason = mergeResult.reason === "preflight-unmerged-conflicts"
       ? `Pre-merge unresolved Git conflicts block milestone ${milestoneId}`
       : `Pre-merge dirty working tree overlaps milestone ${milestoneId}`;
     await deps.stopAuto(ctx, pi, reason, {
       preserveCompletedMilestoneBranch: true,
       preserveCloseoutTranscript: options.preserveCloseoutTranscript,
     });
-    return {
-      action: "break",
-      reason: preflight.blockedReason === "unmerged-conflicts"
-        ? "preflight-unmerged-conflicts"
-        : "preflight-dirty-overlap",
-    };
-  }
-
-  let mergeError: unknown = null;
-  const exitResult = deps.lifecycle.exitMilestone(
-    milestoneId,
-    { merge: true },
-    ctx.ui,
-  );
-  if (exitResult.ok) {
-    s.milestoneMergedInPhases = true;
-    try {
-      const projectRoot = s.originalBasePath || s.canonicalProjectRoot || s.basePath;
-      const { rebuildMarkdownProjectionsFromDb } = await import("../commands-maintenance.js");
-      await rebuildMarkdownProjectionsFromDb(projectRoot);
-    } catch (err) {
-      logWarning(
-        "engine",
-        `markdown projection rebuild after milestone merge failed: ${err instanceof Error ? err.message : String(err)}`,
-      );
-    }
-  } else {
-    mergeError = exitResult.cause ?? new Error(`exit ${exitResult.reason}`);
-  }
-
-  // Always attempt to restore the stashed working tree, even on merge error.
-  // postflightPopStash itself does not throw; failures surface via the
-  // PostflightResult.needsManualRecovery flag.
-  let stashResult: PostflightResult | null = null;
-  if (preflight.stashPushed) {
-    stashResult = deps.postflightPopStash(
-      s.originalBasePath || s.basePath,
-      milestoneId,
-      preflight.stashMarker,
-      ctx.ui.notify.bind(ctx.ui),
-    );
+    return { action: "break", reason: mergeResult.reason };
   }
 
   // Merge failure takes priority over stash recovery — the merge is the
   // authoritative gate. If the stash also needed manual recovery, the user
   // already saw the postflightPopStash notify above.
-  if (mergeError) {
+  if (mergeResult.reason === "merge-conflict") {
+    const mergeError = mergeResult.cause;
     if (mergeError instanceof MergeConflictError) {
       // A merge conflict is a recoverable human checkpoint, not an
       // infrastructure failure — the user resolves the conflict and runs
@@ -173,6 +153,10 @@ export async function _runMilestoneMergeWithStashRestore(
       });
       return { action: "break", reason: "merge-conflict" };
     }
+  }
+
+  if (mergeResult.reason === "merge-failed" || mergeResult.reason === "merge-conflict") {
+    const mergeError = mergeResult.cause;
     logError("engine", "Milestone merge failed with non-conflict error", {
       milestone: milestoneId,
       error: String(mergeError),
@@ -190,12 +174,26 @@ export async function _runMilestoneMergeWithStashRestore(
     return { action: "break", reason: "merge-failed" };
   }
 
-  if (stashResult) {
-    return stopOnPostflightRecoveryNeeded(ic, stashResult, milestoneId);
+  if (mergeResult.postflight) {
+    return stopOnPostflightRecoveryNeeded(ic, mergeResult.postflight, milestoneId);
   }
   return null;
 }
 
+async function markMilestoneMergedAndRebuild(s: AutoSession): Promise<void> {
+  s.milestoneMergedInPhases = true;
+  try {
+    const rebuildBasePath = s.originalBasePath || s.canonicalProjectRoot || s.basePath;
+    const { rebuildMarkdownProjectionsFromDb } = await import("../commands-maintenance.js");
+    await rebuildMarkdownProjectionsFromDb(rebuildBasePath);
+  } catch (err) {
+    logWarning(
+      "engine",
+      `markdown projection rebuild after milestone merge failed: ${err instanceof Error ? err.message : String(err)}`,
+    );
+  }
+}
+
 export async function _runMilestoneMergeOnceWithStashRestore(
   ic: IterationContext,
   milestoneId: string,

package/src/resources/extensions/gsd/auto/finalize.ts

@@ -373,6 +373,14 @@ export async function runFinalize(
         files: leak.files.map((file) => ({ path: file.path, status: file.status })),
       });
       ctx.ui.notify(message, "error");
+      try {
+        deps.checkpointWorkflowDatabase?.();
+      } catch (err) {
+        debugLog("autoLoop", {
+          phase: "root-write-leak-checkpoint-failed",
+          error: err instanceof Error ? err.message : String(err),
+        });
+      }
       await deps.stopAuto(ctx, pi, "Root-write leak during isolated auto-mode", {
         preserveCompletedMilestoneBranch: true,
       });

package/src/resources/extensions/gsd/auto/loop-deps.ts

@@ -80,6 +80,7 @@ export interface LoopDeps {
   ) => Promise<void>;
   pauseAuto: PauseAutoFn;
   clearUnitTimeout: () => void;
+  checkpointWorkflowDatabase?: () => void;
   updateProgressWidget: (
     ctx: ExtensionContext,
     unitType: string,

package/src/resources/extensions/gsd/auto/orchestrator.ts

@@ -731,7 +731,7 @@ export class AutoOrchestrator implements AutoOrchestrationModule {
         return new GitServiceImpl(basePath, gitConfig);
       },
       worktreeProjection: new WorktreeStateProjection(),
-      mergeMilestoneToMain: createMilestoneMergeTransaction(mergeMilestoneToMain),
+      mergeMilestone: createMilestoneMergeTransaction(mergeMilestoneToMain),
     });
   }
 

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -26,7 +26,7 @@ import { debugLog } from "../debug-logger.js";
 import { logWarning, logError } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
 import { readUnitRuntimeRecord, type AutoUnitRuntimeRecord } from "../unit-runtime.js";
-import { consumeAutoWakeup } from "./schedule-wakeup.js";
+import { clearAutoWakeup, consumeAutoWakeup } from "./schedule-wakeup.js";
 import { applyUnitSkillVisibility } from "../skill-scope.js";
 
 const UNIT_FAILSAFE_BUFFER_MS = 30_000;
@@ -248,7 +248,7 @@ export async function runUnit(
     ((supervisor.idle_timeout_minutes ?? 10) * 60 * 1000) + UNIT_FAILSAFE_BUFFER_MS,
   );
   let unitTimeoutHandle: ReturnType<typeof setTimeout> | undefined;
-  let result: UnitResult;
+  let result: UnitResult = { status: "cancelled" };
   try {
     const awaitAgentEndWithTimeout = (agentEndPromise: Promise<UnitResult>): Promise<UnitResult> => {
       const timeoutResult = new Promise<UnitResult>((resolve) => {
@@ -360,6 +360,9 @@ export async function runUnit(
     }
   } finally {
     if (unitTimeoutHandle) clearTimeout(unitTimeoutHandle);
+    if (result.status !== "completed") {
+      clearAutoWakeup(s.basePath, unitType, unitId);
+    }
     ctx.ui.setWorkingMessage?.(undefined);
     setVisibleSkills?.(undefined);
   }

package/src/resources/extensions/gsd/auto/schedule-wakeup.ts

@@ -35,6 +35,14 @@ export function consumeAutoWakeup(
   return wakeup;
 }
 
+export function clearAutoWakeup(
+  basePath: string,
+  unitType: string,
+  unitId: string,
+): void {
+  pendingWakeups.delete(wakeupKey(basePath, unitType, unitId));
+}
+
 export function _resetAutoWakeupsForTest(): void {
   pendingWakeups.clear();
 }

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -838,7 +838,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
     },
   },
   {
-    name: "uat-verdict-gate (non-PASS blocks progression)",
+    name: "uat-verdict-gate (non-PASS observed; closeout enforces)",
     match: async ({ mid, basePath, prefs }) => {
       // Only applies when UAT dispatch is enabled
       if (!prefs?.uat_dispatch) return null;
@@ -852,9 +852,9 @@ export const DISPATCH_RULES: DispatchRule[] = [
         const { verdict, uatType } = result;
 
         if (!isAcceptableUatVerdict(verdict, uatType)) {
-          // Do not hard-stop auto-mode on non-PASS verdicts. Allow progression
-          // so follow-up slices can remediate, while complete-milestone still
-          // enforces manual UAT PASS sign-off before closure.
+          // Observe non-PASS verdicts without hard-stopping auto-mode. Allow
+          // progression so follow-up slices can remediate, while
+          // complete-milestone still enforces manual UAT PASS sign-off before closure.
           continue;
         }
       }
@@ -1130,9 +1130,21 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // call site.
       const sliceContextFile = resolveSliceFile(basePath, mid, state.activeSlice.id, "CONTEXT");
       if (sliceContextFile && existsSync(sliceContextFile)) return null; // discussion already done, proceed
+
+      const closedSliceIds = getClosedSliceIds(mid);
+      const justClosedSliceId = closedSliceIds[closedSliceIds.length - 1];
+      let priorVerdictWarning = "";
+      if (justClosedSliceId) {
+        const prior = await readUatGateVerdict(basePath, mid, justClosedSliceId);
+        if (prior && !isAcceptableUatVerdict(prior.verdict, prior.uatType)) {
+          priorVerdictWarning =
+            ` Note: the slice just closed (${justClosedSliceId}) recorded a non-PASS UAT verdict (${prior.verdict.toUpperCase()}); review before continuing.`;
+        }
+      }
+
       return {
         action: "stop" as const,
-        reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.`,
+        reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.${priorVerdictWarning}`,
         level: "warning" as const,
       };
     },

package/src/resources/extensions/gsd/auto-model-selection.ts

@@ -409,7 +409,13 @@ export function resolvePreferredModelConfig(
   availableModelIds?: string[],
   preferredModelId?: string,
 ): PreferredModelConfig | undefined {
-  const explicitConfig = resolveModelWithFallbacksForUnit(unitType, basePath, availableModelIds, preferredModelId);
+  const explicitConfig = resolveModelWithFallbacksForUnit(
+    unitType,
+    basePath,
+    availableModelIds,
+    preferredModelId,
+    true,
+  );
   if (explicitConfig) {
     return {
       ...explicitConfig,
@@ -422,26 +428,55 @@ export function resolvePreferredModelConfig(
   if (!isAutoMode) return undefined;
 
   const routingConfig = resolveDynamicRoutingConfig();
-  if (!routingConfig.enabled || !routingConfig.tier_models) return undefined;
+  if (!routingConfig.enabled) return undefined;
 
-  // Don't synthesize a routing config for flat-rate providers (#3453).
-  // Users can opt into routing for flat-rate subscriptions (e.g. claude-code)
-  // via dynamic_routing.allow_flat_rate_providers (#4386).
+  // Only an explicit flat-rate opt-out suppresses synthesized routing.
+  // `dynamic_routing.enabled: true` is user intent to run routing even when
+  // the start provider is a flat-rate subscription. Applied ahead of both the
+  // tier-pin and profile-derived synthesis paths so the opt-out is uniform.
   if (
-    !routingConfig.allow_flat_rate_providers &&
+    routingConfig.allow_flat_rate_providers === false &&
     autoModeStartModel &&
     isFlatRateProvider(autoModeStartModel.provider, autoModeStartModel.flatRateCtx)
   ) {
     return undefined;
   }
 
-  const ceilingModel = routingConfig.tier_models.heavy
-    ?? (autoModeStartModel ? `${autoModeStartModel.provider}/${autoModeStartModel.id}` : undefined);
-  if (!ceilingModel) return undefined;
+  // With explicit `tier_models` pins, synthesize a heavy-tier ceiling that
+  // dynamic routing downgrades from per unit.
+  if (routingConfig.tier_models) {
+    const ceilingModel = routingConfig.tier_models.heavy
+      ?? (autoModeStartModel ? `${autoModeStartModel.provider}/${autoModeStartModel.id}` : undefined);
+    if (!ceilingModel) return undefined;
+
+    return {
+      primary: ceilingModel,
+      fallbacks: [],
+      source: "synthesized",
+    };
+  }
+
+  // No `tier_models` pins: fall back to the token-profile's per-phase model so
+  // profile tier resolution survives. `skipProfileDefaults` is left false here
+  // (unlike the explicit-detection call above) precisely because we WANT the
+  // profile defaults this time — they are the routing ceiling, not a hard
+  // user selection. Labeling the result `synthesized` (not `explicit`) keeps
+  // dynamic routing and fallbacks enabled downstream. Without this branch,
+  // `resolvePreferredModelConfig` returns undefined for profile-only configs
+  // and auto dispatch bleeds the start model onto every unit, silently
+  // discarding the profile (#1115: routing/fallbacks disabled when a
+  // token_profile is set but no tier_models are pinned).
+  const profileConfig = resolveModelWithFallbacksForUnit(
+    unitType,
+    basePath,
+    availableModelIds,
+    preferredModelId,
+    false,
+  );
+  if (!profileConfig) return undefined;
 
   return {
-    primary: ceilingModel,
-    fallbacks: [],
+    ...profileConfig,
     source: "synthesized",
   };
 }
@@ -647,15 +682,11 @@ export async function selectAndApplyModel(
       }
     }
 
-    // Disable routing for flat-rate providers like GitHub Copilot (#3453).
-    // All models cost the same per request, so downgrading to a cheaper
-    // model provides no cost benefit — it only degrades quality.
+    // Disable routing for flat-rate providers only when the user explicitly
+    // opts out with dynamic_routing.allow_flat_rate_providers: false.
     // Fail-closed: if primary model can't be resolved, fall back to
     // provider-level signals rather than allowing unwanted downgrades.
-    // Opt-in: dynamic_routing.allow_flat_rate_providers skips the bypass so
-    // claude-code subscribers can still get intelligent per-task selection
-    // across their subscription (#4386).
-    if (routingConfig.enabled && !routingConfig.allow_flat_rate_providers) {
+    if (routingConfig.enabled && routingConfig.allow_flat_rate_providers === false) {
       const primaryModel = resolveModelId(modelConfig.primary, routingEligibleModels, ctx.model?.provider);
       if (primaryModel) {
         const primaryFlatRateCtx = buildFlatRateContext(primaryModel.provider, ctx, prefs);

package/src/resources/extensions/gsd/auto-prompts.ts

@@ -20,14 +20,15 @@ import {
   relTaskFile, resolveGsdRootFile, relGsdRootFile, resolveRuntimeFile,
 } from "./paths.js";
 import { resolveInlineLevel, loadEffectiveGSDPreferences } from "./preferences.js";
+import { createRepositoryRegistryFromPreferences } from "./repository-registry.js";
 import { isContextModeEnabled } from "./preferences-types.js";
 import { parseRoadmap } from "./parsers-legacy.js";
 import type { GSDState, InlineLevel } from "./types.js";
 import type { GSDPreferences } from "./preferences.js";
-import { join, basename, relative } from "node:path";
+import { join, basename, relative, sep } from "node:path";
 import { existsSync } from "node:fs";
 import { computeBudgets, resolveExecutorContextWindow, truncateAtSectionBoundary, type MinimalModelRegistry } from "./context-budget.js";
-import { getPendingGates, getPendingGatesForTurn } from "./gsd-db.js";
+import { getGateResults, getPendingGates, getPendingGatesForTurn } from "./gsd-db.js";
 import {
   GATE_REGISTRY,
   assertGateCoverage,
@@ -393,6 +394,37 @@ function formatExecutorConstraints(
   ].join("\n");
 }
 
+/**
+ * Builds the Declared Repositories block for parent-workspace planners.
+ * Returns "" for single-repo projects so the common-case prompt is unchanged;
+ * only parent mode with declared child repos gets the registry list and the
+ * targetRepositories assignment instruction.
+ */
+export function buildRepoRegistryBlock(base: string): string {
+  let registry;
+  try {
+    registry = createRepositoryRegistryFromPreferences(base, loadEffectiveGSDPreferences(base)?.preferences);
+  } catch {
+    return "";
+  }
+  const hasChildRepo = registry.repositories.some((repo) => repo.id !== "project");
+  if (registry.mode !== "parent" || !hasChildRepo) return "";
+
+  const lines = registry.repositories.map((repo) => {
+    const relPath = relative(registry.projectRoot, repo.root).split(sep).join("/") || ".";
+    const role = repo.role ? ` — ${repo.role}` : "";
+    const root = repo.id === "project" ? " (root)" : ` (${relPath})`;
+    return `- \`${repo.id}\`${root}${role}`;
+  });
+  return [
+    "### Declared Repositories",
+    "",
+    ...lines,
+    "",
+    "This is a parent workspace. Assign each task's `targetRepositories` to the repository id(s) it touches (from the list above). Omit `targetRepositories` to inherit the slice-wide default from `gsd_plan_slice`; set it explicitly when a task differs (e.g. `[\"project\"]` for parent-root work).",
+  ].join("\n");
+}
+
 /**
  * Returns a markdown bullet list of known context file paths for the given
  * milestone (and optionally slice). Falls back to a generic tool-agnostic
@@ -2504,6 +2536,7 @@ async function renderSlicePrompt(options: {
     inlinedContext,
     dependencySummaries: depContent,
     sourceFilePaths: buildSourceFilePaths(base, mid, sid),
+    repoRegistry: buildRepoRegistryBlock(base),
     executorContextConstraints,
     commitInstruction,
     skillActivation: buildSkillActivationBlock({
@@ -3362,6 +3395,44 @@ export async function buildValidateMilestonePrompt(
     trackPromptContext(contextTelemetry, "outstanding-items", "inline", outstandingBlock);
   }
 
+  const persistedGateFlags: string[] = [];
+  try {
+    const gateLabels = {
+      Q3: "Threat Surface",
+      Q4: "Requirement Impact",
+    } as const;
+    for (const sid of seenValSlices) {
+      for (const gate of getGateResults(mid, sid, "slice")) {
+        if (gate.gate_id !== "Q3" && gate.gate_id !== "Q4") continue;
+        const findings = gate.findings.trim();
+        const rationale = gate.rationale.trim();
+        const verdict = gate.verdict ?? "";
+        const hasNonPassVerdict = verdict !== "" && verdict !== "pass" && verdict !== "omitted";
+        if (!findings && !hasNonPassVerdict) continue;
+
+        const displayVerdict = verdict || gate.status;
+        const detail = findings || rationale || "_No findings text recorded; reconcile the persisted non-pass verdict._";
+        persistedGateFlags.push(`- **${sid} / ${gate.gate_id} (${gateLabels[gate.gate_id]}) / ${displayVerdict}:** ${detail}`);
+        if (findings && rationale) persistedGateFlags.push(`  - Rationale: ${rationale}`);
+      }
+    }
+  } catch (err) {
+    logWarning("prompt", `buildValidateMilestonePrompt persisted gate flags lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+  }
+  if (persistedGateFlags.length > 0) {
+    const persistedGateFlagsBlock = [
+      "### Persisted Slice-Level Gate Flags (from quality_gates)",
+      "",
+      "These slice gates recorded findings or non-pass verdicts during execution. Reconcile each against the milestone-level evidence before returning MV03/MV04 verdicts.",
+      "",
+      ...persistedGateFlags,
+    ].join("\n");
+    inlined.push(persistedGateFlagsBlock);
+    trackPromptContext(contextTelemetry, "persisted-slice-gate-flags", "inline", persistedGateFlagsBlock);
+  } else {
+    trackPromptContext(contextTelemetry, "persisted-slice-gate-flags", "skipped", null, "none");
+  }
+
   // Inline existing VALIDATION file if this is a re-validation round
   const validationPath = resolveMilestoneFile(base, mid, "VALIDATION");
   const validationRel = relMilestoneFile(base, mid, "VALIDATION");

package/src/resources/extensions/gsd/auto-start.ts

@@ -1849,8 +1849,9 @@ export async function bootstrapAutoSession(
       : ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "default";
 
     // Flat-rate providers (e.g. GitHub Copilot, claude-code, user-declared
-    // subscription proxies, externalCli CLIs) suppress routing at dispatch
-    // time (#3453) — reflect that in the banner.  Thread the same
+    // subscription proxies, externalCli CLIs) suppress routing only when the
+    // user explicitly opts out with allow_flat_rate_providers: false. Reflect
+    // that in the banner. Thread the same
     // FlatRateContext used by selectAndApplyModel so user-declared
     // flat-rate providers and externalCli auto-detection are respected.
     const { isFlatRateProvider, buildFlatRateContext } = await import("./auto-model-selection.js");
@@ -1862,7 +1863,7 @@ export async function bootstrapAutoSession(
     )?.preferences;
     const effectiveProvider = s.autoModeStartModel?.provider ?? ctx.model?.provider;
     const effectivelyEnabled = routingConfig.enabled
-      && (routingConfig.allow_flat_rate_providers
+      && (routingConfig.allow_flat_rate_providers !== false
         || !(effectiveProvider && isFlatRateProvider(
           effectiveProvider,
           buildFlatRateContext(effectiveProvider, ctx, bannerPrefs),

package/src/resources/extensions/gsd/auto-timeout-recovery.ts

@@ -97,6 +97,8 @@ export async function recoverTimedOutUnit(
         lastProgressAt: Date.now(),
         progressCount: (runtime?.progressCount ?? 0) + 1,
         lastProgressKind: reason === "idle" ? "idle-recovery-retry" : "hard-recovery-retry",
+        // This steering retry is a fresh chance for the same unit to save a valid result.
+        harnessAbort: undefined,
       });
 
       const steeringLines = isEscalation
@@ -222,6 +224,8 @@ export async function recoverTimedOutUnit(
       lastProgressAt: Date.now(),
       progressCount: (runtime?.progressCount ?? 0) + 1,
       lastProgressKind: reason === "idle" ? "idle-recovery-retry" : "hard-recovery-retry",
+      // This steering retry is a fresh chance for the same unit to save a valid result.
+      harnessAbort: undefined,
     });
 
     const steeringLines = isEscalation