gsd-pi 2.71.0-dev.e17e0ce → 2.72.0-dev.3118184

package/dist/resources/extensions/gsd/auto/loop.js

@@ -13,6 +13,69 @@ import { runPreDispatch, runDispatch, runGuards, runUnitPhase, runFinalize, } fr
 import { debugLog } from "../debug-logger.js";
 import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterMs, COOLDOWN_FALLBACK_WAIT_MS, MAX_COOLDOWN_RETRIES } from "./infra-errors.js";
 import { resolveEngine } from "../engine-resolver.js";
+import { logWarning } from "../workflow-logger.js";
+import { gsdRoot } from "../paths.js";
+import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+// ── Stuck detection persistence (#3704) ──────────────────────────────────
+// Persist stuck detection state to disk so it survives session restarts.
+// Without this, restarting auto-mode resets all counters, allowing the
+// same blocked unit to burn a full retry budget each session.
+function stuckStatePath(basePath) {
+    return join(gsdRoot(basePath), "runtime", "stuck-state.json");
+}
+function loadStuckState(basePath) {
+    try {
+        const data = JSON.parse(readFileSync(stuckStatePath(basePath), "utf-8"));
+        return {
+            recentUnits: Array.isArray(data.recentUnits) ? data.recentUnits : [],
+            stuckRecoveryAttempts: typeof data.stuckRecoveryAttempts === "number" ? data.stuckRecoveryAttempts : 0,
+        };
+    }
+    catch (err) {
+        debugLog("autoLoop", { phase: "load-stuck-state-failed", error: err instanceof Error ? err.message : String(err) });
+        return { recentUnits: [], stuckRecoveryAttempts: 0 };
+    }
+}
+function saveStuckState(basePath, state) {
+    try {
+        const filePath = stuckStatePath(basePath);
+        mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
+        writeFileSync(filePath, JSON.stringify({
+            recentUnits: state.recentUnits.slice(-20), // keep last 20 entries
+            stuckRecoveryAttempts: state.stuckRecoveryAttempts,
+            updatedAt: new Date().toISOString(),
+        }) + "\n");
+    }
+    catch (err) {
+        debugLog("autoLoop", { phase: "save-stuck-state-failed", error: err instanceof Error ? err.message : String(err) });
+    }
+}
+// ── Memory pressure monitoring (#3331) ──────────────────────────────────
+// Check heap usage every N iterations and trigger graceful shutdown before
+// the OS OOM killer sends SIGKILL. The threshold is 90% of the V8 heap
+// limit (--max-old-space-size or default ~1.5-4GB depending on platform).
+const MEMORY_CHECK_INTERVAL = 5; // check every 5 iterations
+const MEMORY_PRESSURE_THRESHOLD = 0.85; // 85% of heap limit
+function checkMemoryPressure() {
+    const mem = process.memoryUsage();
+    // v8.getHeapStatistics() gives heap_size_limit but requires import
+    // Use a conservative estimate: RSS > 3GB is danger zone on most systems
+    const heapMB = Math.round(mem.heapUsed / 1024 / 1024);
+    const rssMB = Math.round(mem.rss / 1024 / 1024);
+    // Try to get the actual V8 heap limit
+    let limitMB = 4096; // conservative default
+    try {
+        const v8 = require("node:v8");
+        const stats = v8.getHeapStatistics();
+        limitMB = Math.round(stats.heap_size_limit / 1024 / 1024);
+    }
+    catch {
+        limitMB = 4096; /* v8 stats unavailable — use conservative default */
+    }
+    const pct = heapMB / limitMB;
+    return { pressured: pct > MEMORY_PRESSURE_THRESHOLD, heapMB, limitMB, pct };
+}
 /**
  * Main auto-mode execution loop. Iterates: derive → dispatch → guards →
  * runUnit → finalize → repeat. Exits when s.active becomes false or a
@@ -24,7 +87,13 @@ import { resolveEngine } from "../engine-resolver.js";
 export async function autoLoop(ctx, pi, s, deps) {
     debugLog("autoLoop", { phase: "enter" });
     let iteration = 0;
-    const loopState = { recentUnits: [], stuckRecoveryAttempts: 0, consecutiveFinalizeTimeouts: 0 };
+    // Load persisted stuck state so counters survive session restarts (#3704)
+    const persisted = loadStuckState(s.basePath);
+    const loopState = {
+        recentUnits: persisted.recentUnits,
+        stuckRecoveryAttempts: persisted.stuckRecoveryAttempts,
+        consecutiveFinalizeTimeouts: 0,
+    };
     let consecutiveErrors = 0;
     let consecutiveCooldowns = 0;
     const recentErrorMessages = [];
@@ -44,6 +113,19 @@ export async function autoLoop(ctx, pi, s, deps) {
             await deps.stopAuto(ctx, pi, `Safety: loop exceeded ${MAX_LOOP_ITERATIONS} iterations — possible runaway`);
             break;
         }
+        // ── Memory pressure check (#3331) ──
+        // Graceful shutdown before OOM killer sends SIGKILL.
+        if (iteration % MEMORY_CHECK_INTERVAL === 0) {
+            const mem = checkMemoryPressure();
+            debugLog("autoLoop", { phase: "memory-check", ...mem });
+            if (mem.pressured) {
+                logWarning("dispatch", `Memory pressure: ${mem.heapMB}MB / ${mem.limitMB}MB (${Math.round(mem.pct * 100)}%) — stopping auto-mode to prevent OOM kill`);
+                await deps.stopAuto(ctx, pi, `Memory pressure: heap at ${mem.heapMB}MB / ${mem.limitMB}MB (${Math.round(mem.pct * 100)}%). ` +
+                    `Stopping gracefully to prevent OOM kill after ${iteration} iterations. ` +
+                    `Resume with /gsd auto to continue from where you left off.`);
+                break;
+            }
+        }
         if (!s.cmdCtx) {
             debugLog("autoLoop", { phase: "exit", reason: "no-cmdCtx" });
             break;
@@ -162,6 +244,7 @@ export async function autoLoop(ctx, pi, s, deps) {
                 consecutiveCooldowns = 0;
                 recentErrorMessages.length = 0;
                 deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
+                saveStuckState(s.basePath, loopState); // persist across session restarts (#3704)
                 debugLog("autoLoop", { phase: "iteration-complete", iteration });
                 if (reconcileResult.outcome === "milestone-complete") {
                     await deps.stopAuto(ctx, pi, "Workflow complete");

package/dist/resources/extensions/gsd/auto/phases.js

@@ -13,6 +13,7 @@ import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
 import { PROJECT_FILES } from "../detection.js";
 import { MergeConflictError } from "../git-service.js";
+import { setCurrentPhase, clearCurrentPhase } from "../../shared/gsd-phase-state.js";
 import { join, basename, dirname, parse as parsePath } from "node:path";
 import { existsSync, cpSync, readdirSync } from "node:fs";
 import { logWarning, logError } from "../workflow-logger.js";
@@ -770,6 +771,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         s.currentUnit.id === unitId);
     const previousTier = s.currentUnitRouting?.tier;
     s.currentUnit = { type: unitType, id: unitId, startedAt: Date.now() };
+    setCurrentPhase(unitType);
     s.lastToolInvocationError = null; // #2883: clear stale error from previous unit
     const unitStartSeq = ic.nextSeq();
     deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: unitStartSeq, eventType: "unit-start", data: { unitType, unitId } });
@@ -1115,6 +1117,7 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         // Detach session from the timed-out unit so late async completions
         // cannot mutate state for the next unit (#3757).
         s.currentUnit = null;
+        clearCurrentPhase();
         loopState.consecutiveFinalizeTimeouts++;
         debugLog("autoLoop", {
             phase: "pre-verification-timeout",
@@ -1189,6 +1192,7 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         // Detach session from the timed-out unit so late async completions
         // cannot mutate state for the next unit (#3757).
         s.currentUnit = null;
+        clearCurrentPhase();
         loopState.consecutiveFinalizeTimeouts++;
         debugLog("autoLoop", {
             phase: "post-verification-timeout",

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -16,6 +16,7 @@ import { loadFile, parseSummary, resolveAllOverrides } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
 import { resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, buildTaskFileName, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
+import { rebuildState } from "./doctor.js";
 import { parseUnitId } from "./unit-id.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
 import { autoCommitCurrentBranch, } from "./worktree.js";
@@ -288,6 +289,11 @@ export async function postUnitPreVerification(pctx, opts) {
                 debugLog("postUnit", { phase: "browser-teardown", status: "closed" });
             }
         });
+        // Keep the on-disk STATE.md aligned with the live derived state after
+        // ordinary unit completion, before any worktree state is synced back.
+        await runSafely("postUnit", "state-rebuild", async () => {
+            await rebuildState(s.basePath);
+        });
         // Sync worktree state back to project root (skipped for lightweight sidecars)
         if (!opts?.skipWorktreeSync && s.originalBasePath && s.originalBasePath !== s.basePath) {
             await runSafely("postUnit", "worktree-sync", () => {

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -15,7 +15,8 @@ import { getLoadedSkills } from "@gsd/pi-coding-agent";
 import { join, basename } from "node:path";
 import { existsSync } from "node:fs";
 import { computeBudgets, resolveExecutorContextWindow, truncateAtSectionBoundary } from "./context-budget.js";
-import { getPendingGates } from "./gsd-db.js";
+import { getPendingGatesForTurn } from "./gsd-db.js";
+import { assertGateCoverage, getGatesForTurn, } from "./gate-registry.js";
 import { formatDecisionsCompact, formatRequirementsCompact } from "./structured-data-formatter.js";
 import { readPhaseAnchor, formatAnchorForPrompt } from "./phase-anchor.js";
 import { logWarning } from "./workflow-logger.js";
@@ -1221,6 +1222,13 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
         ? `### Runtime Context\nSource: \`.gsd/RUNTIME.md\`\n\n${runtimeContent.trim()}`
         : "";
     const phaseAnchorSection = planAnchor ? formatAnchorForPrompt(planAnchor) : "";
+    // Task-scoped gates owned by execute-task (Q5/Q6/Q7). Pull only the
+    // gates that plan-slice actually seeded for this task — tasks with no
+    // external dependencies legitimately skip Q5, tasks with no runtime
+    // load dimension skip Q6, etc.
+    const etPending = getPendingGatesForTurn(mid, sid, "execute-task", tid);
+    assertGateCoverage(etPending, "execute-task", { requireAll: false });
+    const gatesToClose = renderGatesToCloseBlock(getGatesForTurn("execute-task"), { pending: new Set(etPending.map((g) => g.gate_id)), allowOmit: true });
     return loadPrompt("execute-task", {
         overridesSection,
         runtimeContext,
@@ -1238,6 +1246,7 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
         taskSummaryPath,
         inlinedTemplates,
         verificationBudget,
+        gatesToClose,
         skillActivation: buildSkillActivationBlock({
             base,
             milestoneId: mid,
@@ -1298,6 +1307,15 @@ export async function buildCompleteSlicePrompt(mid, _midTitle, sid, sTitle, base
     const sliceRel = relSlicePath(base, mid, sid);
     const sliceSummaryPath = join(base, `${sliceRel}/${sid}-SUMMARY.md`);
     const sliceUatPath = join(base, `${sliceRel}/${sid}-UAT.md`);
+    // Gates owned by complete-slice (e.g. Q8). Pull from the DB so the
+    // prompt only prompts for gates the plan actually seeded. The tool
+    // handler closes each gate based on the SUMMARY.md section content
+    // after the assistant calls gsd_complete_slice.
+    const csPending = getPendingGatesForTurn(mid, sid, "complete-slice");
+    // coverage check: every pending row must be owned by complete-slice.
+    // requireAll:false because a slice may have already closed some gates.
+    assertGateCoverage(csPending, "complete-slice", { requireAll: false });
+    const gatesToClose = renderGatesToCloseBlock(getGatesForTurn("complete-slice"), { pending: new Set(csPending.map((g) => g.gate_id)), allowOmit: true });
     return loadPrompt("complete-slice", {
         workingDirectory: base,
         milestoneId: mid, sliceId: sid, sliceTitle: sTitle,
@@ -1306,6 +1324,7 @@ export async function buildCompleteSlicePrompt(mid, _midTitle, sid, sTitle, base
         inlinedContext,
         sliceSummaryPath,
         sliceUatPath,
+        gatesToClose,
     });
 }
 export async function buildCompleteMilestonePrompt(mid, midTitle, base, level) {
@@ -1498,6 +1517,15 @@ export async function buildValidateMilestonePrompt(mid, midTitle, base, level) {
     const inlinedContext = capPreamble(`## Inlined Context (preloaded — do not re-read these files)\n\n${inlined.join("\n\n---\n\n")}`);
     const validationOutputPath = join(base, `${relMilestonePath(base, mid)}/${mid}-VALIDATION.md`);
     const roadmapOutputPath = `${relMilestonePath(base, mid)}/${mid}-ROADMAP.md`;
+    // Every milestone validation turn owns MV01–MV04 unconditionally: the
+    // registry is the source of truth for which gates the validator must
+    // address, and the block below is what the template renders so the
+    // assistant can never accidentally skip one.
+    const mvGates = getGatesForTurn("validate-milestone");
+    const gatesToEvaluate = renderGatesToCloseBlock(mvGates, {
+        pending: new Set(mvGates.map((g) => g.id)),
+        allowOmit: false,
+    });
     return loadPrompt("validate-milestone", {
         workingDirectory: base,
         milestoneId: mid,
@@ -1506,6 +1534,7 @@ export async function buildValidateMilestonePrompt(mid, midTitle, base, level) {
         inlinedContext,
         validationPath: validationOutputPath,
         remediationRound: String(remediationRound),
+        gatesToEvaluate,
         skillActivation: buildSkillActivationBlock({
             base,
             milestoneId: mid,
@@ -1740,26 +1769,43 @@ export async function buildReactiveExecutePrompt(mid, midTitle, sid, sTitle, rea
     });
 }
 // ─── Gate Evaluation ──────────────────────────────────────────────────────
-const GATE_QUESTIONS = {
-    Q3: {
-        question: "How can this be exploited?",
-        guidance: [
-            "Identify abuse scenarios: parameter tampering, replay attacks, privilege escalation.",
-            "Map data exposure risks: PII, tokens, secrets accessible through this slice.",
-            "Define input trust boundaries: untrusted user input reaching DB, API, or filesystem.",
-            "If none apply, return verdict 'omitted' with rationale explaining why.",
-        ].join("\n"),
-    },
-    Q4: {
-        question: "What existing promises does this break?",
-        guidance: [
-            "List which existing requirements (R001, R003, etc.) are touched by this slice.",
-            "Identify what must be re-tested after shipping.",
-            "Flag decisions that should be revisited given the new scope.",
-            "If no existing requirements are affected, return verdict 'omitted'.",
-        ].join("\n"),
-    },
-};
+//
+// Gate definitions (question, guidance, owner turn) now live in
+// gate-registry.ts so that prompt builders, dispatch rules, state
+// derivation, and tool handlers all consult the same source of truth.
+// See gate-registry.ts for the full ownership map.
+/**
+ * Render a "Gates to Close" block for turns like `complete-slice` and
+ * `validate-milestone` that own gates which are closed as a side-effect
+ * of writing artifact sections (not via a dedicated gate-evaluate
+ * subagent loop).
+ *
+ * Returns a plain-text block or an empty string if there are no gates to
+ * close, so callers can drop it straight into a template variable.
+ */
+function renderGatesToCloseBlock(gates, opts) {
+    const applicable = gates.filter((g) => opts.pending.has(g.id));
+    if (applicable.length === 0)
+        return "";
+    const lines = [];
+    lines.push("## Gates to Close");
+    lines.push("");
+    lines.push("These quality gates are still pending for this unit. You MUST address every one before calling the closing tool — the handler closes the DB row based on whether the corresponding artifact section is present.");
+    lines.push("");
+    for (const def of applicable) {
+        lines.push(`### ${def.id} — ${def.promptSection}`);
+        lines.push("");
+        lines.push(`**Question:** ${def.question}`);
+        lines.push("");
+        lines.push(def.guidance);
+        if (opts.allowOmit) {
+            lines.push("");
+            lines.push(`If this gate genuinely does not apply to this unit, leave the **${def.promptSection}** section empty and the handler will record it as \`omitted\`. Otherwise, fill the section with concrete evidence.`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n").trimEnd();
+}
 export async function buildParallelResearchSlicesPrompt(mid, midTitle, slices, basePath) {
     // Build individual research-slice prompts for each slice
     const subagentSections = [];
@@ -1784,24 +1830,33 @@ export async function buildParallelResearchSlicesPrompt(mid, midTitle, slices, b
     });
 }
 export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base) {
-    const pending = getPendingGates(mid, sid, "slice");
+    // Pull only the gates this turn actually owns (Q3/Q4). Filter via the
+    // registry so that scope:"slice" gates owned by other turns (Q8) can't
+    // leak into this prompt and can't block dispatch via silent skip.
+    const pending = getPendingGatesForTurn(mid, sid, "gate-evaluate");
+    // Fails loudly if the pending list contains a gate id the registry
+    // doesn't own for this turn. Missing owned gates is allowed here —
+    // `gate-evaluate` is dispatched whenever *any* of its owned gates are
+    // pending, not only when all of them are.
+    assertGateCoverage(pending, "gate-evaluate", { requireAll: false });
     // Load the slice plan for context
     const planFile = resolveSliceFile(base, mid, sid, "PLAN");
     const planContent = planFile ? (await loadFile(planFile)) ?? "(plan file empty)" : "(plan file not found)";
-    // Build per-gate subagent prompts
+    // Build per-gate subagent prompts from the pending rows. Because the
+    // registry has already validated every row, `getGateDefinition` cannot
+    // return undefined here.
+    const pendingIds = new Set(pending.map((g) => g.gate_id));
+    const gateDefs = getGatesForTurn("gate-evaluate").filter((def) => pendingIds.has(def.id));
     const subagentSections = [];
     const gateListLines = [];
-    for (const gate of pending) {
-        const meta = GATE_QUESTIONS[gate.gate_id];
-        if (!meta)
-            continue;
-        gateListLines.push(`- **${gate.gate_id}**: ${meta.question}`);
+    for (const def of gateDefs) {
+        gateListLines.push(`- **${def.id}**: ${def.question}`);
         const subPrompt = [
-            `You are evaluating quality gate **${gate.gate_id}** for slice ${sid} (${sTitle}).`,
+            `You are evaluating quality gate **${def.id}** for slice ${sid} (${sTitle}).`,
             "",
-            `## Question: ${meta.question}`,
+            `## Question: ${def.question}`,
             "",
-            meta.guidance,
+            def.guidance,
             "",
             "## Slice Plan",
             "",
@@ -1813,13 +1868,13 @@ export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base)
             `Call the \`gsd_save_gate_result\` tool with:`,
             `- \`milestoneId\`: "${mid}"`,
             `- \`sliceId\`: "${sid}"`,
-            `- \`gateId\`: "${gate.gate_id}"`,
+            `- \`gateId\`: "${def.id}"`,
             "- `verdict`: \"pass\" (no concerns), \"flag\" (concerns found), or \"omitted\" (not applicable)",
             "- `rationale`: one-sentence justification",
             "- `findings`: detailed markdown findings (or empty if omitted)",
         ].join("\n");
         subagentSections.push([
-            `### ${gate.gate_id}: ${meta.question}`,
+            `### ${def.id}: ${def.question}`,
             "",
             "Use this as the prompt for a `subagent` call:",
             "",

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -224,6 +224,17 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
         if (!isValidationTerminal(validationContent))
             return false;
     }
+    if (unitType === "plan-milestone") {
+        try {
+            const roadmap = parseLegacyRoadmap(readFileSync(absPath, "utf-8"));
+            if (roadmap.slices.length === 0)
+                return false;
+        }
+        catch (err) {
+            logWarning("recovery", `plan-milestone roadmap verification failed: ${err instanceof Error ? err.message : String(err)}`);
+            return false;
+        }
+    }
     // plan-slice must produce a plan with actual task entries, not just a scaffold.
     // The plan file may exist from a prior discussion/context step with only headings
     // but no tasks. Without this check the artifact is considered "complete" and the

package/dist/resources/extensions/gsd/auto-start.js

@@ -190,16 +190,33 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     //
     // Precedence:
     // 1) Explicit session override via /gsd model (this session)
-    // 2) GSD model preferences from PREFERENCES.md
-    // 3) Current session model from settings/session restore
+    // 2) GSD model preferences from PREFERENCES.md (validated against live auth)
+    // 3) Current session model from settings/session restore (if provider ready)
     //
     // This preserves #3517 defaults while honoring explicit runtime model
     // selection for subsequent /gsd runs in the same session.
     const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
     const preferredModel = resolveDefaultSessionModel(ctx.model?.provider);
+    // Validate the preferred model against the live registry + provider auth so
+    // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
+    // start-model snapshot. Without this, every subsequent unit would try to
+    // fall back to an unusable model.
+    let validatedPreferredModel;
+    if (preferredModel) {
+        const { resolveModelId } = await import("./auto-model-selection.js");
+        const available = ctx.modelRegistry.getAvailable();
+        const match = resolveModelId(`${preferredModel.provider}/${preferredModel.id}`, available, ctx.model?.provider);
+        if (match) {
+            validatedPreferredModel = { provider: match.provider, id: match.id };
+        }
+        else {
+            ctx.ui.notify(`Preferred model ${preferredModel.provider}/${preferredModel.id} from PREFERENCES.md is not configured; falling back to session default.`, "warning");
+        }
+    }
+    const sessionModelReady = ctx.model && ctx.modelRegistry.isProviderRequestReady(ctx.model.provider);
     const startModelSnapshot = manualSessionOverride
-        ?? preferredModel
-        ?? (ctx.model
+        ?? validatedPreferredModel
+        ?? (sessionModelReady && ctx.model
             ? { provider: ctx.model.provider, id: ctx.model.id }
             : null);
     try {
@@ -453,6 +470,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Successfully resolved an active milestone — reset the re-entry guard
         s.consecutiveCompleteBootstraps = 0;
         // ── Initialize session state ──
+        // Notify shared phase state so subagent conflict checks can fire
+        const { activateGSD: activateGSDPhaseState } = await import("../shared/gsd-phase-state.js");
+        activateGSDPhaseState();
         s.active = true;
         s.stepMode = requestedStepMode;
         s.verbose = verboseMode;

package/dist/resources/extensions/gsd/auto.js

@@ -34,6 +34,7 @@ import { preDispatchHealthGate, resetProactiveHealing, setLevelChangeCallback, }
 import { clearSkillSnapshot } from "./skill-discovery.js";
 import { captureAvailableSkills, resetSkillTelemetry, } from "./skill-telemetry.js";
 import { getRtkSessionSavings } from "../shared/rtk-session-stats.js";
+import { deactivateGSD } from "../shared/gsd-phase-state.js";
 import { initMetrics, resetMetrics, getLedger, getProjectTotals, formatCost, formatTokenCount, } from "./metrics.js";
 import { logWarning } from "./workflow-logger.js";
 import { homedir } from "node:os";
@@ -374,6 +375,7 @@ function handleLostSessionLock(ctx, lockStatus) {
     });
     s.active = false;
     s.paused = false;
+    deactivateGSD();
     clearUnitTimeout();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
@@ -406,6 +408,7 @@ function handleLostSessionLock(ctx, lockStatus) {
 function cleanupAfterLoopExit(ctx) {
     s.currentUnit = null;
     s.active = false;
+    deactivateGSD();
     clearUnitTimeout();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
@@ -422,9 +425,13 @@ function cleanupAfterLoopExit(ctx) {
         /* best-effort — mirror stopAuto cleanup */
         logWarning("session", `lock cleanup failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
     }
-    ctx.ui.setStatus("gsd-auto", undefined);
-    ctx.ui.setWidget("gsd-progress", undefined);
-    ctx.ui.setFooter(undefined);
+    // A transient provider-error pause intentionally leaves the paused badge
+    // visible so the user still has a resumable auto-mode signal on screen.
+    if (!s.paused) {
+        ctx.ui.setStatus("gsd-auto", undefined);
+        ctx.ui.setWidget("gsd-progress", undefined);
+        ctx.ui.setFooter(undefined);
+    }
     // Restore CWD out of worktree back to original project root
     if (s.originalBasePath) {
         s.basePath = s.originalBasePath;
@@ -526,7 +533,22 @@ export async function stopAuto(ctx, pi, reason) {
         catch (e) {
             debugLog("stop-cleanup-worktree", { error: e instanceof Error ? e.message : String(e) });
         }
-        // ── Step 5: DB cleanup ──
+        // ── Step 5: Rebuild state while DB is still open (#3599) ──
+        // rebuildState() calls deriveState() which needs the DB for authoritative
+        // state. Previously this ran after closeDatabase(), forcing a filesystem
+        // fallback that could disagree with the DB-backed dispatch decisions —
+        // a split-brain where dispatch says "blocked" but STATE.md shows work.
+        if (s.basePath) {
+            try {
+                await rebuildState(s.basePath);
+            }
+            catch (e) {
+                debugLog("stop-rebuild-state-failed", {
+                    error: e instanceof Error ? e.message : String(e),
+                });
+            }
+        }
+        // ── Step 6: DB cleanup ──
         if (isDbAvailable()) {
             try {
                 const { closeDatabase } = await import("./gsd-db.js");
@@ -538,7 +560,7 @@ export async function stopAuto(ctx, pi, reason) {
                 });
             }
         }
-        // ── Step 6: Restore basePath and chdir ──
+        // ── Step 7: Restore basePath and chdir ──
         try {
             if (s.originalBasePath) {
                 s.basePath = s.originalBasePath;
@@ -554,7 +576,7 @@ export async function stopAuto(ctx, pi, reason) {
         catch (e) {
             debugLog("stop-cleanup-basepath", { error: e instanceof Error ? e.message : String(e) });
         }
-        // ── Step 7: Ledger notification ──
+        // ── Step 8: Ledger notification ──
         try {
             const ledger = getLedger();
             if (ledger && ledger.units.length > 0) {
@@ -568,17 +590,6 @@ export async function stopAuto(ctx, pi, reason) {
         catch (e) {
             debugLog("stop-cleanup-ledger", { error: e instanceof Error ? e.message : String(e) });
         }
-        // ── Step 8: Rebuild state ──
-        if (s.basePath) {
-            try {
-                await rebuildState(s.basePath);
-            }
-            catch (e) {
-                debugLog("stop-rebuild-state-failed", {
-                    error: e instanceof Error ? e.message : String(e),
-                });
-            }
-        }
         // ── Step 9: Cmux sidebar / event log ──
         try {
             clearCmuxSidebar(loadedPreferences);
@@ -743,6 +754,7 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     _resetPendingResolve();
     s.active = false;
     s.paused = true;
+    deactivateGSD();
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     s.pendingVerificationRetry = null;
@@ -1290,8 +1302,6 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
     pi.sendMessage({ customType: "gsd-auto", content: hookPrompt, display: true }, { triggerTurn: true });
     return true;
 }
-// Direct phase dispatch → auto-direct-dispatch.ts
-export { dispatchDirectPhase } from "./auto-direct-dispatch.js";
 // Re-export recovery functions for external consumers
 export { buildLoopRemediationSteps, } from "./auto-recovery.js";
 export { resolveExpectedArtifactPath } from "./auto-artifact-paths.js";

package/dist/resources/extensions/gsd/bootstrap/db-tools.js

@@ -919,12 +919,12 @@ export function registerDbTools(pi) {
     const saveGateResultTool = {
         name: "gsd_save_gate_result",
         label: "Save Gate Result",
-        description: "Save the result of a quality gate evaluation (Q3-Q8) to the GSD database. " +
+        description: "Save the result of a quality gate evaluation (Q3-Q8 or MV01-MV04) to the GSD database. " +
             "Called by gate evaluation sub-agents after analyzing a specific quality question.",
         promptSnippet: "Save quality gate evaluation result (verdict, rationale, findings)",
         promptGuidelines: [
             "Use gsd_save_gate_result after evaluating a quality gate question.",
-            "gateId must be one of: Q3, Q4, Q5, Q6, Q7, Q8.",
+            "gateId must be one of: Q3, Q4, Q5, Q6, Q7, Q8, MV01, MV02, MV03, MV04.",
             "verdict must be: pass (no concerns), flag (concerns found), or omitted (not applicable).",
             "rationale should be a one-sentence justification for the verdict.",
             "findings should contain detailed markdown analysis (or empty string if omitted).",
@@ -932,7 +932,7 @@ export function registerDbTools(pi) {
         parameters: Type.Object({
             milestoneId: Type.String({ description: "Milestone ID (e.g. M001)" }),
             sliceId: Type.String({ description: "Slice ID (e.g. S01)" }),
-            gateId: Type.String({ description: "Gate ID: Q3, Q4, Q5, Q6, Q7, or Q8" }),
+            gateId: Type.String({ description: "Gate ID: Q3, Q4, Q5, Q6, Q7, Q8, MV01, MV02, MV03, or MV04" }),
             taskId: Type.Optional(Type.String({ description: "Task ID for task-scoped gates (Q5/Q6/Q7)" })),
             verdict: Type.String({ description: "pass, flag, or omitted" }),
             rationale: Type.String({ description: "One-sentence justification" }),

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -172,14 +172,10 @@ export function registerHooks(pi) {
         // Only gate-shaped ask_user_questions calls should block execution.
         // The gate stays pending until the user selects the approval option.
         if (event.toolName === "ask_user_questions") {
-            const milestoneId = getDiscussionMilestoneId(discussionBasePath);
-            const inDiscussion = milestoneId !== null || isQueuePhaseActive();
-            if (inDiscussion) {
-                const questions = event.input?.questions ?? [];
-                const questionId = questions.find((question) => typeof question?.id === "string" && isGateQuestionId(question.id))?.id;
-                if (typeof questionId === "string") {
-                    setPendingGate(questionId);
-                }
+            const questions = event.input?.questions ?? [];
+            const questionId = questions.find((question) => typeof question?.id === "string" && isGateQuestionId(question.id))?.id;
+            if (typeof questionId === "string") {
+                setPendingGate(questionId);
             }
         }
         // ── Discussion gate enforcement: block tool calls while gate is pending ──
@@ -261,8 +257,6 @@ export function registerHooks(pi) {
             return;
         const milestoneId = getDiscussionMilestoneId(process.cwd());
         const queueActive = isQueuePhaseActive();
-        if (!milestoneId && !queueActive)
-            return;
         const details = event.details;
         // ── Discussion gate enforcement: handle gate question responses ──
         // If the result is cancelled or has no response, the pending gate stays active
@@ -293,12 +287,16 @@ export function registerHooks(pi) {
                 // Only unlock the gate if the user selected the first option (confirmation).
                 // Cross-references against the question's defined options to reject free-form "Other" text.
                 const answer = details.response?.answers?.[question.id];
+                const inferredMilestoneId = extractDepthVerificationMilestoneId(question.id) ?? milestoneId;
                 if (isDepthConfirmationAnswer(answer?.selected, question.options)) {
-                    markDepthVerified(extractDepthVerificationMilestoneId(question.id) ?? milestoneId);
+                    markDepthVerified(inferredMilestoneId);
+                    clearPendingGate();
                 }
                 break;
             }
         }
+        if (!milestoneId && !queueActive)
+            return;
         if (!milestoneId)
             return;
         const basePath = process.cwd();

package/dist/resources/extensions/gsd/bootstrap/register-shortcuts.js

@@ -71,9 +71,6 @@ export function registerShortcuts(pi) {
         description: shortcutDesc(GSD_SHORTCUTS.parallel.action, GSD_SHORTCUTS.parallel.command),
         handler: openParallelOverlay,
     });
-    // Fallback for terminals where Ctrl+Alt letter chords are not forwarded reliably.
-    pi.registerShortcut(Key.ctrlShift(GSD_SHORTCUTS.parallel.key), {
-        description: shortcutDesc(`${GSD_SHORTCUTS.parallel.action} (fallback)`, GSD_SHORTCUTS.parallel.command),
-        handler: openParallelOverlay,
-    });
+    // No Ctrl+Shift+P fallback — conflicts with cycleModelBackward (shift+ctrl+p).
+    // Use Ctrl+Alt+P or /gsd parallel watch instead.
 }