gsd-pi 2.65.0-dev.16e10d7 → 2.65.0-dev.6cc5110

package/src/resources/extensions/gsd/auto.ts

@@ -1141,9 +1141,9 @@ export async function startAuto(
           s.stepMode = meta.stepMode ?? requestedStepMode;
           s.autoStartTime = meta.autoStartTime || Date.now();
           s.paused = true;
-          try { unlinkSync(pausedPath); } catch (err) { /* non-fatal */
-            logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
-          }
+          // Don't delete pause file yet — defer until lock is acquired.
+          // If lock fails, the file must survive for retry.
+          s.pausedSessionFile = pausedPath;
           ctx.ui.notify(
             `Resuming paused custom workflow${meta.activeRunDir ? ` (${meta.activeRunDir})` : ""}.`,
             "info",
@@ -1167,10 +1167,9 @@ export async function startAuto(
             s.stepMode = meta.stepMode ?? requestedStepMode;
             s.autoStartTime = meta.autoStartTime || Date.now();
             s.paused = true;
-            // Clean up the persisted file — we're consuming it
-            try { unlinkSync(pausedPath); } catch (err) { /* non-fatal */
-            logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
-          }
+            // Don't delete pause file yet — defer until lock is acquired.
+            // If lock fails, the file must survive for retry.
+            s.pausedSessionFile = pausedPath;
             ctx.ui.notify(
               `Resuming paused session for ${meta.milestoneId}${meta.worktreePath ? ` (worktree)` : ""}.`,
               "info",
@@ -1187,10 +1186,21 @@ export async function startAuto(
   if (s.paused) {
     const resumeLock = acquireSessionLock(base);
     if (!resumeLock.acquired) {
+      // Reset paused state so isAutoPaused() doesn't stick true after lock failure.
+      // Pause file is preserved on disk for retry — not deleted.
+      s.paused = false;
       ctx.ui.notify(`Cannot resume: ${resumeLock.reason}`, "error");
       return;
     }
 
+    // Lock acquired — now safe to delete the pause file
+    if (s.pausedSessionFile) {
+      try { unlinkSync(s.pausedSessionFile); } catch (err) {
+        logWarning("session", `pause file cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+      }
+      s.pausedSessionFile = null;
+    }
+
     s.paused = false;
     s.active = true;
     s.verbose = verboseMode;

package/src/resources/extensions/gsd/db-writer.ts

@@ -345,8 +345,12 @@ export async function saveRequirementToDb(
       await saveFile(filePath, md);
     } catch (diskErr) {
       logError('manifest', 'disk write failed, rolling back DB row', { fn: 'saveRequirementToDb', error: String((diskErr as Error).message) });
-      const rollbackAdapter = db._getAdapter();
-      rollbackAdapter?.prepare('DELETE FROM requirements WHERE id = :id').run({ ':id': id });
+      try {
+        const rollbackAdapter = db._getAdapter();
+        rollbackAdapter?.prepare('DELETE FROM requirements WHERE id = :id').run({ ':id': id });
+      } catch (rollbackErr) {
+        logError('manifest', 'SPLIT BRAIN: disk write failed AND DB rollback failed — DB has orphaned row', { fn: 'saveRequirementToDb', id, error: String((rollbackErr as Error).message) });
+      }
       throw diskErr;
     }
     invalidateStateCache();
@@ -466,7 +470,11 @@ export async function saveDecisionToDb(
       await saveFile(filePath, md);
     } catch (diskErr) {
       logError('manifest', 'disk write failed, rolling back DB row', { fn: 'saveDecisionToDb', error: String((diskErr as Error).message) });
-      adapter?.prepare('DELETE FROM decisions WHERE id = :id').run({ ':id': id });
+      try {
+        adapter?.prepare('DELETE FROM decisions WHERE id = :id').run({ ':id': id });
+      } catch (rollbackErr) {
+        logError('manifest', 'SPLIT BRAIN: disk write failed AND DB rollback failed — DB has orphaned row', { fn: 'saveDecisionToDb', id, error: String((rollbackErr as Error).message) });
+      }
       throw diskErr;
     }
     // #2661: When a decision defers a slice, update the slice status in the DB

package/src/resources/extensions/gsd/json-persistence.ts

@@ -1,5 +1,6 @@
-import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync } from "node:fs";
+import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, unlinkSync } from "node:fs";
 import { dirname } from "node:path";
+import { randomBytes } from "node:crypto";
 
 /**
  * Load a JSON file with validation, returning a default on failure.
@@ -51,9 +52,11 @@ export function loadJsonFileOrNull<T>(
 export function saveJsonFile<T>(filePath: string, data: T): void {
   try {
     mkdirSync(dirname(filePath), { recursive: true });
-    const tmp = filePath + ".tmp";
+    // Use randomized tmp suffix to prevent concurrent-write data loss
+    const tmp = `${filePath}.tmp.${randomBytes(4).toString("hex")}`;
     writeFileSync(tmp, JSON.stringify(data, null, 2) + "\n", "utf-8");
     renameSync(tmp, filePath);
+    // No cleanup needed — renameSync atomically removes tmp on success
   } catch {
     // Non-fatal — don't let persistence failures break operation
   }
@@ -66,7 +69,7 @@ export function saveJsonFile<T>(filePath: string, data: T): void {
 export function writeJsonFileAtomic<T>(filePath: string, data: T): void {
   try {
     mkdirSync(dirname(filePath), { recursive: true });
-    const tmp = filePath + ".tmp";
+    const tmp = `${filePath}.tmp.${randomBytes(4).toString("hex")}`;
     writeFileSync(tmp, JSON.stringify(data, null, 2), "utf-8");
     renameSync(tmp, filePath);
   } catch {

package/src/resources/extensions/gsd/state.ts

@@ -189,7 +189,7 @@ export async function getActiveMilestoneId(basePath: string): Promise<string | n
       const byId = new Map(allMilestones.map(m => [m.id, m]));
       for (const id of sortedIds) {
         const m = byId.get(id)!;
-        if (m.status === "complete" || m.status === "done" || m.status === "parked") continue;
+        if (isClosedStatus(m.status) || m.status === "parked") continue;
         return m.id;
       }
       return null;
@@ -442,13 +442,10 @@ export async function deriveStateFromDb(basePath: string): Promise<GSDState> {
       continue;
     }
 
-    // Check roadmap: all slices done means milestone is complete
-    const slices = getMilestoneSlices(m.id);
-    if (slices.length > 0 && slices.every(s => isStatusDone(s.status))) {
-      // All slices done but no summary — still counts as complete for dep resolution
-      // if a summary file exists
-      // Note: without summary file, the milestone is in validating/completing state, not complete
-    }
+    // Milestones with all slices done but no SUMMARY file are in
+    // validating/completing state — intentionally NOT added to
+    // completeMilestoneIds.  The SUMMARY file (checked above) is the
+    // terminal artifact that proves completion per #864.
   }
 
   // Phase 2: Build registry and find active milestone
@@ -954,7 +951,12 @@ export async function deriveStateFromDb(basePath: string): Promise<GSDState> {
   // ── REPLAN-TRIGGER detection ─────────────────────────────────────────
   if (!blockerTaskId) {
     const sliceRow = getSlice(activeMilestone.id, activeSlice.id);
-    if (sliceRow?.replan_triggered_at) {
+    // Check DB column first, fall back to disk trigger file when DB write
+    // was best-effort and failed (triage-resolution.ts dual-write gap).
+    const dbTriggered = !!sliceRow?.replan_triggered_at;
+    const diskTriggered = !dbTriggered &&
+      !!resolveSliceFile(basePath, activeMilestone.id, activeSlice.id, "REPLAN-TRIGGER");
+    if (dbTriggered || diskTriggered) {
       // Loop protection: if replan_history has entries, replan was already done
       const replanHistory = getReplanHistory(activeMilestone.id, activeSlice.id);
       if (replanHistory.length === 0) {

package/src/resources/extensions/gsd/tests/integration/auto-recovery.test.ts

@@ -684,7 +684,7 @@ function makeGitBase(): string {
   return base;
 }
 
-test("hasImplementationArtifacts returns false when only .gsd/ files committed (#1703)", (t) => {
+test("hasImplementationArtifacts returns 'absent' when only .gsd/ files committed (#1703)", (t) => {
   const base = makeGitBase();
   t.after(() => cleanup(base));
 
@@ -697,10 +697,10 @@ test("hasImplementationArtifacts returns false when only .gsd/ files committed (
   execFileSync("git", ["commit", "-m", "chore: add plan files"], { cwd: base, stdio: "ignore" });
 
   const result = hasImplementationArtifacts(base);
-  assert.equal(result, false, "should return false when only .gsd/ files were committed");
+  assert.equal(result, "absent", "should return 'absent' when only .gsd/ files were committed");
 });
 
-test("hasImplementationArtifacts returns true when implementation files committed (#1703)", (t) => {
+test("hasImplementationArtifacts returns 'present' when implementation files committed (#1703)", (t) => {
   const base = makeGitBase();
   t.after(() => cleanup(base));
 
@@ -714,16 +714,16 @@ test("hasImplementationArtifacts returns true when implementation files committe
   execFileSync("git", ["commit", "-m", "feat: add feature"], { cwd: base, stdio: "ignore" });
 
   const result = hasImplementationArtifacts(base);
-  assert.equal(result, true, "should return true when implementation files are present");
+  assert.equal(result, "present", "should return 'present' when implementation files are present");
 });
 
-test("hasImplementationArtifacts returns true on non-git directory (fail-open)", (t) => {
+test("hasImplementationArtifacts returns 'unknown' on non-git directory (fail-open)", (t) => {
   const base = join(tmpdir(), `gsd-test-nogit-${randomUUID()}`);
   mkdirSync(base, { recursive: true });
   t.after(() => cleanup(base));
 
   const result = hasImplementationArtifacts(base);
-  assert.equal(result, true, "should return true (fail-open) in non-git directory");
+  assert.equal(result, "unknown", "should return 'unknown' (fail-open) in non-git directory");
 });
 
 // ─── verifyExpectedArtifact: complete-milestone requires impl artifacts (#1703) ──

package/src/resources/extensions/gsd/tests/wave1-critical-regressions.test.ts

@@ -0,0 +1,49 @@
+// GSD State Machine — Wave 1 Critical Regression Tests
+// Validates fixes for event log format mismatch, skipped milestone status,
+// dead code removal, and replan disk-file fallback.
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { extractEntityKey } from "../workflow-reconcile.js";
+import { isClosedStatus } from "../status-guards.js";
+import type { WorkflowEvent } from "../workflow-events.js";
+
+// ── Fix 1: Event log cmd format — hyphens and underscores both accepted ──
+
+describe("extractEntityKey normalizes cmd format", () => {
+  const baseEvent = { params: {}, ts: "", hash: "", actor: "agent" as const, session_id: "" };
+
+  test("accepts hyphenated complete-task", () => {
+    const event: WorkflowEvent = { ...baseEvent, cmd: "complete-task", params: { taskId: "T01" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "task", id: "T01" });
+  });
+
+  test("accepts underscored complete_task (legacy)", () => {
+    const event: WorkflowEvent = { ...baseEvent, cmd: "complete_task", params: { taskId: "T01" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "task", id: "T01" });
+  });
+
+  test("accepts hyphenated complete-slice", () => {
+    const event: WorkflowEvent = { ...baseEvent, cmd: "complete-slice", params: { sliceId: "S01" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "slice", id: "S01" });
+  });
+
+  test("accepts hyphenated complete-milestone", () => {
+    const event: WorkflowEvent = { ...baseEvent, cmd: "complete-milestone", params: { milestoneId: "M001" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "milestone", id: "M001" });
+  });
+});
+
+// ── Fix 3: getActiveMilestoneId must skip "skipped" milestones ──
+
+describe("isClosedStatus includes skipped", () => {
+  test("complete is closed", () => assert.ok(isClosedStatus("complete")));
+  test("done is closed", () => assert.ok(isClosedStatus("done")));
+  test("skipped is closed", () => assert.ok(isClosedStatus("skipped")));
+  test("pending is not closed", () => assert.ok(!isClosedStatus("pending")));
+  test("active is not closed", () => assert.ok(!isClosedStatus("active")));
+});

package/src/resources/extensions/gsd/tests/wave2-events-regressions.test.ts

@@ -0,0 +1,48 @@
+// GSD State Machine — Wave 2 Event Log Regression Tests
+// Validates fixes for appendEvent isolation, entity replay handlers,
+// and post-reconcile cache invalidation.
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { extractEntityKey } from "../workflow-reconcile.js";
+import type { WorkflowEvent } from "../workflow-events.js";
+
+const base = { params: {}, ts: "", hash: "", actor: "agent" as const, session_id: "" };
+
+// ── Fix 8: New entity event types handled by extractEntityKey ──
+
+describe("extractEntityKey handles plan events", () => {
+  test("plan-milestone → milestone type", () => {
+    const event: WorkflowEvent = { ...base, cmd: "plan-milestone", params: { milestoneId: "M001" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "milestone", id: "M001" });
+  });
+
+  test("plan-task → task type", () => {
+    const event: WorkflowEvent = { ...base, cmd: "plan-task", params: { taskId: "T01" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "task", id: "T01" });
+  });
+
+  test("plan-slice preserves slice_plan type (conflict isolation)", () => {
+    const event: WorkflowEvent = { ...base, cmd: "plan-slice", params: { sliceId: "S01" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "slice_plan", id: "S01" });
+  });
+
+  test("replan-slice → slice type", () => {
+    const event: WorkflowEvent = { ...base, cmd: "replan-slice", params: { sliceId: "S01" } };
+    const key = extractEntityKey(event);
+    assert.deepStrictEqual(key, { type: "slice", id: "S01" });
+  });
+});
+
+// ── Fix 8b: Unknown commands return null (don't crash) ──
+
+describe("extractEntityKey handles unknown commands gracefully", () => {
+  test("unknown-command returns null", () => {
+    const event: WorkflowEvent = { ...base, cmd: "unknown-future-cmd", params: { foo: "bar" } };
+    const key = extractEntityKey(event);
+    assert.strictEqual(key, null);
+  });
+});

package/src/resources/extensions/gsd/tests/wave3-session-regressions.test.ts

@@ -0,0 +1,47 @@
+// GSD State Machine — Wave 3 Session Regression Tests
+// Validates tri-state hasImplementationArtifacts and AutoSession.consecutiveCompleteBootstraps.
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { hasImplementationArtifacts } from "../auto-recovery.js";
+import { AutoSession } from "../auto/session.js";
+
+// ── Fix 9: hasImplementationArtifacts returns tri-state ──
+
+describe("hasImplementationArtifacts tri-state return", () => {
+  test("returns 'unknown' for non-git directory", () => {
+    const result = hasImplementationArtifacts("/tmp/not-a-git-repo-" + Date.now());
+    assert.strictEqual(result, "unknown");
+  });
+
+  test("return type is one of present/absent/unknown", () => {
+    const result = hasImplementationArtifacts(process.cwd());
+    assert.ok(
+      result === "present" || result === "absent" || result === "unknown",
+      `Expected present/absent/unknown, got: ${result}`,
+    );
+  });
+});
+
+// ── Fix 11: consecutiveCompleteBootstraps is per-session ──
+
+describe("AutoSession.consecutiveCompleteBootstraps", () => {
+  test("initial value is 0", () => {
+    const s = new AutoSession();
+    assert.strictEqual(s.consecutiveCompleteBootstraps, 0);
+  });
+
+  test("reset() clears the counter", () => {
+    const s = new AutoSession();
+    s.consecutiveCompleteBootstraps = 5;
+    s.reset();
+    assert.strictEqual(s.consecutiveCompleteBootstraps, 0);
+  });
+
+  test("two sessions have independent counters", () => {
+    const s1 = new AutoSession();
+    const s2 = new AutoSession();
+    s1.consecutiveCompleteBootstraps = 3;
+    assert.strictEqual(s2.consecutiveCompleteBootstraps, 0);
+  });
+});

package/src/resources/extensions/gsd/tests/wave4-write-safety-regressions.test.ts

@@ -0,0 +1,70 @@
+// GSD State Machine — Wave 4 Write Safety Regression Tests
+// Validates randomized tmp suffix in json-persistence and atomic writes.
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, readFileSync, readdirSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { saveJsonFile, loadJsonFile } from "../json-persistence.js";
+
+// ── Fix 15: json-persistence uses randomized tmp suffix ──
+
+describe("saveJsonFile atomic write", () => {
+  test("writes JSON file correctly", () => {
+    const tmp = mkdtempSync(join(tmpdir(), "gsd-json-test-"));
+    try {
+      const file = join(tmp, "test.json");
+      saveJsonFile(file, { key: "value" });
+      const content = JSON.parse(readFileSync(file, "utf-8"));
+      assert.deepStrictEqual(content, { key: "value" });
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  test("no .tmp file left after successful write", () => {
+    const tmp = mkdtempSync(join(tmpdir(), "gsd-json-test-"));
+    try {
+      const file = join(tmp, "test.json");
+      saveJsonFile(file, { data: 123 });
+      const files = readdirSync(tmp);
+      const tmpFiles = files.filter((f: string) => f.includes(".tmp"));
+      assert.strictEqual(tmpFiles.length, 0, "No .tmp files should remain after write");
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  test("concurrent writes don't corrupt data", () => {
+    const tmp = mkdtempSync(join(tmpdir(), "gsd-json-test-"));
+    try {
+      const file = join(tmp, "shared.json");
+      // Write two different values rapidly — both should succeed without corruption
+      saveJsonFile(file, { writer: "first" });
+      saveJsonFile(file, { writer: "second" });
+      const content = JSON.parse(readFileSync(file, "utf-8"));
+      assert.strictEqual(content.writer, "second");
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+
+  test("round-trip through loadJsonFile", () => {
+    const tmp = mkdtempSync(join(tmpdir(), "gsd-json-test-"));
+    try {
+      const file = join(tmp, "roundtrip.json");
+      const data = { items: [1, 2, 3], name: "test" };
+      saveJsonFile(file, data);
+      const loaded = loadJsonFile(
+        file,
+        (d): d is typeof data => typeof d === "object" && d !== null && "items" in d,
+        () => ({ items: [], name: "" }),
+      );
+      assert.deepStrictEqual(loaded.items, [1, 2, 3]);
+      assert.strictEqual(loaded.name, "test");
+    } finally {
+      rmSync(tmp, { recursive: true, force: true });
+    }
+  });
+});

package/src/resources/extensions/gsd/tests/workflow-logger-audit.test.ts

@@ -90,18 +90,21 @@ describe("workflow-logger audit persistence", () => {
     assert.ok(ctx, "context should exist");
     assert.equal(ctx.fn, "saveDecisionToDb");
     assert.equal(ctx.tool, "gsd_decision_save");
-    assert.equal(ctx.error, undefined, "error key must be stripped from persisted context");
+    assert.equal(ctx.error, "SQLITE_BUSY: database is locked", "error key should be preserved in persisted context");
     assert.equal(ctx.file, undefined, "file key must be stripped from persisted context");
   });
 
-  test("persisted errors omit context when no safe keys present", () => {
+  test("persisted errors preserve error key but strip other unsafe keys", () => {
     logError("bootstrap", "ensureDbOpen failed", {
       error: "ENOENT",
       cwd: "/home/user/project",
     });
     const lines = readAuditLines(tmp);
     assert.equal(lines.length, 1);
-    assert.equal(lines[0].context, undefined, "context should be omitted when no safe keys match");
+    const ctx = lines[0].context as Record<string, string>;
+    assert.ok(ctx, "context should exist when error key is present");
+    assert.equal(ctx.error, "ENOENT", "error key should be preserved");
+    assert.equal(ctx.cwd, undefined, "cwd key must be stripped");
   });
 
   test("mixed warnings and errors only persist errors", () => {

package/src/resources/extensions/gsd/tools/complete-milestone.ts

@@ -23,7 +23,7 @@ import { invalidateStateCache } from "../state.js";
 import { renderAllProjections, stripIdPrefix } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-import { logWarning } from "../workflow-logger.js";
+import { logWarning, logError } from "../workflow-logger.js";
 
 export interface CompleteMilestoneParams {
   milestoneId: string;
@@ -218,9 +218,19 @@ export async function handleCompleteMilestone(
   clearParseCache();
 
   // ── Post-mutation hook: projections, manifest, event log ───────────────
+  // Separate try/catch per step so a projection failure doesn't prevent
+  // the event log entry (critical for worktree reconciliation).
   try {
     await renderAllProjections(basePath, params.milestoneId);
+  } catch (projErr) {
+    logWarning("tool", `complete-milestone projection warning: ${(projErr as Error).message}`);
+  }
+  try {
     writeManifest(basePath);
+  } catch (mfErr) {
+    logWarning("tool", `complete-milestone manifest warning: ${(mfErr as Error).message}`);
+  }
+  try {
     appendEvent(basePath, {
       cmd: "complete-milestone",
       params: { milestoneId: params.milestoneId },
@@ -229,8 +239,8 @@ export async function handleCompleteMilestone(
       actor_name: params.actorName,
       trigger_reason: params.triggerReason,
     });
-  } catch (hookErr) {
-    logWarning("tool", `complete-milestone post-mutation hook warning: ${(hookErr as Error).message}`);
+  } catch (eventErr) {
+    logError("tool", `complete-milestone event log FAILED — completion invisible to reconciliation`, { error: (eventErr as Error).message });
   }
 
   return {

package/src/resources/extensions/gsd/tools/complete-slice.ts

@@ -30,7 +30,7 @@ import { renderRoadmapCheckboxes } from "../markdown-renderer.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-import { logWarning } from "../workflow-logger.js";
+import { logWarning, logError } from "../workflow-logger.js";
 
 export interface CompleteSliceResult {
   sliceId: string;
@@ -336,9 +336,19 @@ export async function handleCompleteSlice(
   clearParseCache();
 
   // ── Post-mutation hook: projections, manifest, event log ───────────────
+  // Separate try/catch per step so a projection failure doesn't prevent
+  // the event log entry (critical for worktree reconciliation).
   try {
     await renderAllProjections(basePath, params.milestoneId);
+  } catch (projErr) {
+    logWarning("tool", `complete-slice projection warning for ${params.milestoneId}/${params.sliceId}: ${(projErr as Error).message}`);
+  }
+  try {
     writeManifest(basePath);
+  } catch (mfErr) {
+    logWarning("tool", `complete-slice manifest warning: ${(mfErr as Error).message}`);
+  }
+  try {
     appendEvent(basePath, {
       cmd: "complete-slice",
       params: { milestoneId: params.milestoneId, sliceId: params.sliceId },
@@ -347,8 +357,8 @@ export async function handleCompleteSlice(
       actor_name: params.actorName,
       trigger_reason: params.triggerReason,
     });
-  } catch (hookErr) {
-    logWarning("tool", `complete-slice post-mutation hook failed for ${params.milestoneId}/${params.sliceId}`, { error: (hookErr as Error).message });
+  } catch (eventErr) {
+    logError("tool", `complete-slice event log FAILED — completion invisible to reconciliation`, { error: (eventErr as Error).message });
   }
 
   return {

package/src/resources/extensions/gsd/tools/complete-task.ts

@@ -33,7 +33,7 @@ import { renderPlanCheckboxes } from "../markdown-renderer.js";
 import { renderAllProjections, renderSummaryContent } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
-import { logWarning } from "../workflow-logger.js";
+import { logWarning, logError } from "../workflow-logger.js";
 
 export interface CompleteTaskResult {
   taskId: string;
@@ -242,9 +242,19 @@ export async function handleCompleteTask(
   clearParseCache();
 
   // ── Post-mutation hook: projections, manifest, event log ───────────────
+  // Separate try/catch per step so a projection failure doesn't prevent
+  // the event log entry (critical for worktree reconciliation).
   try {
     await renderAllProjections(basePath, params.milestoneId);
+  } catch (projErr) {
+    logWarning("tool", `complete-task projection warning: ${(projErr as Error).message}`);
+  }
+  try {
     writeManifest(basePath);
+  } catch (mfErr) {
+    logWarning("tool", `complete-task manifest warning: ${(mfErr as Error).message}`);
+  }
+  try {
     appendEvent(basePath, {
       cmd: "complete-task",
       params: { milestoneId: params.milestoneId, sliceId: params.sliceId, taskId: params.taskId },
@@ -253,8 +263,8 @@ export async function handleCompleteTask(
       actor_name: params.actorName,
       trigger_reason: params.triggerReason,
     });
-  } catch (hookErr) {
-    logWarning("tool", `complete-task post-mutation hook warning: ${(hookErr as Error).message}`);
+  } catch (eventErr) {
+    logError("tool", `complete-task event log FAILED — completion invisible to reconciliation`, { error: (eventErr as Error).message });
   }
 
   return {

package/src/resources/extensions/gsd/triage-resolution.ts

@@ -10,7 +10,8 @@
  * Also provides detectFileOverlap() for surfacing downstream impact on quick tasks.
  */
 
-import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, unlinkSync } from "node:fs";
+import { atomicWriteSync } from "./atomic-write.js";
 import { join } from "node:path";
 import { createRequire } from "node:module";
 import { gsdRoot, milestonesDir } from "./paths.js";
@@ -65,10 +66,10 @@ export function executeInject(
     const filesSection = content.indexOf("## Files Likely Touched");
     if (filesSection !== -1) {
       const updated = content.slice(0, filesSection) + newTask + "\n\n" + content.slice(filesSection);
-      writeFileSync(planPath, updated, "utf-8");
+      atomicWriteSync(planPath, updated, "utf-8");
     } else {
       // No Files section — append at end
-      writeFileSync(planPath, content.trimEnd() + "\n\n" + newTask + "\n", "utf-8");
+      atomicWriteSync(planPath, content.trimEnd() + "\n\n" + newTask + "\n", "utf-8");
     }
 
     return newId;
@@ -105,7 +106,7 @@ export function executeReplan(
       `will detect it and enter the replanning-slice phase.`,
     ].join("\n");
 
-    writeFileSync(triggerPath, content, "utf-8");
+    atomicWriteSync(triggerPath, content, "utf-8");
 
     // Also write replan_triggered_at column for DB-backed detection
     try {
@@ -183,7 +184,7 @@ export function executeBacktrack(
       `3. Resume auto-mode — the state machine will re-enter discussion for the target`,
     ].join("\n");
 
-    writeFileSync(triggerPath, content, "utf-8");
+    atomicWriteSync(triggerPath, content, "utf-8");
 
     // If we have a valid target, also reset that milestone's completion status
     // so deriveState() will re-enter it as the active milestone.
@@ -194,7 +195,7 @@ export function executeBacktrack(
           // Write a regression marker so the state machine knows this milestone
           // needs re-discussion, not just re-execution
           const regressionPath = join(targetDir, `${targetMilestoneId}-REGRESSION.md`);
-          writeFileSync(regressionPath, [
+          atomicWriteSync(regressionPath, [
             `# Milestone Regression`,
             ``,
             `**From:** ${currentMilestoneId}`,
@@ -361,7 +362,7 @@ export function ensureDeferMilestoneDir(
       ``,
     ].join("\n");
 
-    writeFileSync(
+    atomicWriteSync(
       join(msDir, `${targetMilestone}-CONTEXT-DRAFT.md`),
       draftContent,
       "utf-8",

package/src/resources/extensions/gsd/undo.ts

@@ -4,9 +4,10 @@
 // handleResetSlice: Reset a slice and all its tasks, re-rendering plan + roadmap.
 
 import type { ExtensionCommandContext, ExtensionAPI } from "@gsd/pi-coding-agent";
-import { existsSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
+import { existsSync, readFileSync, unlinkSync, readdirSync } from "node:fs";
 import { join, basename } from "node:path";
 import { nativeRevertCommit, nativeRevertAbort } from "./native-git-bridge.js";
+import { atomicWriteSync } from "./atomic-write.js";
 import { parseUnitId } from "./unit-id.js";
 import { deriveState } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
@@ -393,7 +394,7 @@ export function uncheckTaskInPlan(basePath: string, mid: string, sid: string, ti
   const regex = new RegExp(`^(\\s*-\\s*)\\[x\\](\\s*\\**${tid}\\**[:\\s])`, "mi");
   if (regex.test(content)) {
     content = content.replace(regex, "$1[ ]$2");
-    writeFileSync(planFile, content, "utf-8");
+    atomicWriteSync(planFile, content);
     return true;
   }
   return false;

package/src/resources/extensions/gsd/workflow-events.ts

@@ -19,7 +19,7 @@ export function getSessionId(): string {
 // ─── Event Types ─────────────────────────────────────────────────────────
 
 export interface WorkflowEvent {
-  cmd: string;           // e.g. "complete_task"
+  cmd: string;           // e.g. "complete-task" (canonical: hyphens; legacy: underscores — both accepted by replay)
   params: Record<string, unknown>;
   ts: string;            // ISO 8601
   hash: string;          // content hash (hex, 16 chars)