gsd-pi 2.71.0 → 2.72.0-dev.8f83716

package/dist/resources/extensions/gsd/auto/infra-errors.js

@@ -47,3 +47,37 @@ export function isInfrastructureError(err) {
         return "SQLITE_CORRUPT";
     return null;
 }
+/**
+ * Default wait duration when a cooldown error is detected but no specific
+ * expiry is available from AuthStorage (e.g., error propagated across
+ * process boundary without structured backoff data).
+ */
+export const COOLDOWN_FALLBACK_WAIT_MS = 35_000; // 35s — slightly longer than the 30s rate-limit backoff
+/** Maximum consecutive cooldown retries before the auto-loop gives up. */
+export const MAX_COOLDOWN_RETRIES = 5;
+/**
+ * Detect whether an error is a transient credential cooldown that should
+ * be waited out rather than counted as a consecutive failure.
+ *
+ * Prefers the structured `CredentialCooldownError` (code: AUTH_COOLDOWN)
+ * thrown by sdk.ts. Falls back to message matching for errors that
+ * propagated across process boundaries without the typed class.
+ */
+export function isTransientCooldownError(err) {
+    if (err && typeof err === "object" && err.code === "AUTH_COOLDOWN") {
+        return true;
+    }
+    // Fallback: message match for cross-process error propagation
+    const msg = err instanceof Error ? err.message : String(err);
+    return /in a cooldown window/i.test(msg);
+}
+/**
+ * Extract retryAfterMs from a CredentialCooldownError, if available.
+ * Returns undefined for unstructured errors or when no retry hint exists.
+ */
+export function getCooldownRetryAfterMs(err) {
+    if (err && typeof err === "object" && err.code === "AUTH_COOLDOWN") {
+        return err.retryAfterMs;
+    }
+    return undefined;
+}

package/dist/resources/extensions/gsd/auto/loop.js

@@ -11,7 +11,7 @@ import { MAX_LOOP_ITERATIONS, } from "./types.js";
 import { _clearCurrentResolve } from "./resolve.js";
 import { runPreDispatch, runDispatch, runGuards, runUnitPhase, runFinalize, } from "./phases.js";
 import { debugLog } from "../debug-logger.js";
-import { isInfrastructureError } from "./infra-errors.js";
+import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterMs, COOLDOWN_FALLBACK_WAIT_MS, MAX_COOLDOWN_RETRIES } from "./infra-errors.js";
 import { resolveEngine } from "../engine-resolver.js";
 /**
  * Main auto-mode execution loop. Iterates: derive → dispatch → guards →
@@ -26,6 +26,7 @@ export async function autoLoop(ctx, pi, s, deps) {
     let iteration = 0;
     const loopState = { recentUnits: [], stuckRecoveryAttempts: 0, consecutiveFinalizeTimeouts: 0 };
     let consecutiveErrors = 0;
+    let consecutiveCooldowns = 0;
     const recentErrorMessages = [];
     while (s.active) {
         iteration++;
@@ -158,6 +159,7 @@ export async function autoLoop(ctx, pi, s, deps) {
                 });
                 deps.clearUnitTimeout();
                 consecutiveErrors = 0;
+                consecutiveCooldowns = 0;
                 recentErrorMessages.length = 0;
                 deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
                 debugLog("autoLoop", { phase: "iteration-complete", iteration });
@@ -220,6 +222,7 @@ export async function autoLoop(ctx, pi, s, deps) {
             if (finalizeResult.action === "continue")
                 continue;
             consecutiveErrors = 0; // Iteration completed successfully
+            consecutiveCooldowns = 0;
             recentErrorMessages.length = 0;
             deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
             debugLog("autoLoop", { phase: "iteration-complete", iteration });
@@ -246,6 +249,34 @@ export async function autoLoop(ctx, pi, s, deps) {
                 await deps.stopAuto(ctx, pi, `Infrastructure error (${infraCode}): not recoverable by retry`);
                 break;
             }
+            // ── Credential cooldown: wait and retry with bounded budget ──
+            // A 429 triggers a 30s credential backoff in AuthStorage. If the SDK's
+            // getApiKey() retries couldn't outlast the window, the error surfaces
+            // here. Wait for the cooldown to clear rather than counting it as a
+            // consecutive failure — but cap retries so we don't spin for hours
+            // on persistent quota exhaustion.
+            if (isTransientCooldownError(loopErr)) {
+                consecutiveCooldowns++;
+                const retryAfterMs = getCooldownRetryAfterMs(loopErr);
+                debugLog("autoLoop", {
+                    phase: "cooldown-wait",
+                    iteration,
+                    consecutiveCooldowns,
+                    retryAfterMs,
+                    error: msg,
+                });
+                if (consecutiveCooldowns > MAX_COOLDOWN_RETRIES) {
+                    ctx.ui.notify(`Auto-mode stopped: ${consecutiveCooldowns} consecutive credential cooldowns — rate limit or quota may be persistently exhausted.`, "error");
+                    await deps.stopAuto(ctx, pi, `${consecutiveCooldowns} consecutive credential cooldowns exceeded retry budget`);
+                    break;
+                }
+                const waitMs = (retryAfterMs !== undefined && retryAfterMs > 0 && retryAfterMs <= 60_000)
+                    ? retryAfterMs + 500 // Use structured hint + small buffer
+                    : COOLDOWN_FALLBACK_WAIT_MS;
+                ctx.ui.notify(`Credentials in cooldown (${consecutiveCooldowns}/${MAX_COOLDOWN_RETRIES}) — waiting ${Math.round(waitMs / 1000)}s before retrying.`, "warning");
+                await new Promise(resolve => setTimeout(resolve, waitMs));
+                continue; // Retry iteration without incrementing consecutiveErrors
+            }
             consecutiveErrors++;
             recentErrorMessages.push(msg.length > 120 ? msg.slice(0, 120) + "..." : msg);
             debugLog("autoLoop", {

package/dist/resources/extensions/gsd/auto/phases.js

@@ -13,6 +13,7 @@ import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
 import { PROJECT_FILES } from "../detection.js";
 import { MergeConflictError } from "../git-service.js";
+import { setCurrentPhase, clearCurrentPhase } from "../../shared/gsd-phase-state.js";
 import { join, basename, dirname, parse as parsePath } from "node:path";
 import { existsSync, cpSync, readdirSync } from "node:fs";
 import { logWarning, logError } from "../workflow-logger.js";
@@ -770,6 +771,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         s.currentUnit.id === unitId);
     const previousTier = s.currentUnitRouting?.tier;
     s.currentUnit = { type: unitType, id: unitId, startedAt: Date.now() };
+    setCurrentPhase(unitType);
     s.lastToolInvocationError = null; // #2883: clear stale error from previous unit
     const unitStartSeq = ic.nextSeq();
     deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: unitStartSeq, eventType: "unit-start", data: { unitType, unitId } });
@@ -857,7 +859,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         logWarning("engine", "Prompt reorder failed", { error: msg });
     }
     // Select and apply model (with tier escalation on retry — normal units only)
-    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier });
+    const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride);
     s.currentUnitRouting =
         modelResult.routing;
     s.currentUnitModel =
@@ -1115,6 +1117,7 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         // Detach session from the timed-out unit so late async completions
         // cannot mutate state for the next unit (#3757).
         s.currentUnit = null;
+        clearCurrentPhase();
         loopState.consecutiveFinalizeTimeouts++;
         debugLog("autoLoop", {
             phase: "pre-verification-timeout",
@@ -1189,6 +1192,7 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
         // Detach session from the timed-out unit so late async completions
         // cannot mutate state for the next unit (#3757).
         s.currentUnit = null;
+        clearCurrentPhase();
         loopState.consecutiveFinalizeTimeouts++;
         debugLog("autoLoop", {
             phase: "post-verification-timeout",

package/dist/resources/extensions/gsd/auto/session.js

@@ -36,6 +36,10 @@ export class AutoSession {
     previousProjectRootEnv = null;
     hadProjectRootEnv = false;
     projectRootEnvCaptured = false;
+    previousMilestoneLockEnv = null;
+    hadMilestoneLockEnv = false;
+    milestoneLockEnvCaptured = false;
+    sessionMilestoneLock = null;
     gitService = null;
     // ── Dispatch counters ────────────────────────────────────────────────────
     unitDispatchCount = new Map();
@@ -52,6 +56,8 @@ export class AutoSession {
     currentMilestoneId = null;
     // ── Model state ──────────────────────────────────────────────────────────
     autoModeStartModel = null;
+    /** Explicit /gsd model pin captured at bootstrap (session-scoped policy override). */
+    manualSessionModelOverride = null;
     currentUnitModel = null;
     /** Fully-qualified model ID (provider/id) set after selectAndApplyModel + hook overrides (#2899). */
     currentDispatchedModelId = null;
@@ -140,6 +146,10 @@ export class AutoSession {
         this.previousProjectRootEnv = null;
         this.hadProjectRootEnv = false;
         this.projectRootEnvCaptured = false;
+        this.previousMilestoneLockEnv = null;
+        this.hadMilestoneLockEnv = false;
+        this.milestoneLockEnvCaptured = false;
+        this.sessionMilestoneLock = null;
         this.gitService = null;
         // Dispatch
         this.unitDispatchCount.clear();
@@ -151,6 +161,7 @@ export class AutoSession {
         this.currentMilestoneId = null;
         // Model
         this.autoModeStartModel = null;
+        this.manualSessionModelOverride = null;
         this.currentUnitModel = null;
         this.currentDispatchedModelId = null;
         this.originalModelId = null;

package/dist/resources/extensions/gsd/auto-dashboard.js

@@ -10,7 +10,6 @@ import { getActiveHook } from "./post-unit-hooks.js";
 import { getLedger, getProjectTotals } from "./metrics.js";
 import { getErrorMessage } from "./error-utils.js";
 import { isDbAvailable, getMilestoneSlices, getSliceTasks } from "./gsd-db.js";
-import { formatShortcut } from "./files.js";
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { truncateToWidth, visibleWidth } from "@gsd/pi-tui";
@@ -23,6 +22,7 @@ import { resolveServiceTierIcon, getEffectiveServiceTier } from "./service-tier.
 import { parseUnitId } from "./unit-id.js";
 import { formatRtkSavingsLabel, getRtkSessionSavings, } from "../shared/rtk-session-stats.js";
 import { logWarning } from "./workflow-logger.js";
+import { formattedShortcutPair } from "./shortcut-defs.js";
 // ─── UAT Slice Extraction ─────────────────────────────────────────────────────
 /**
  * Extract the target slice ID from a run-uat unit ID (e.g. "M001/S01" → "S01").
@@ -282,12 +282,23 @@ function getLastCommit(basePath) {
 }
 // ─── Footer Factory ───────────────────────────────────────────────────────────
 /**
- * Footer factory that renders zero lines — hides the built-in footer entirely.
- * All footer info (pwd, branch, tokens, cost, model) is shown inside the
- * progress widget instead, so there's no gap or redundancy.
+ * Footer factory used by auto-mode.
+ * Keep footer minimal but preserve extension status context from setStatus().
  */
-export const hideFooter = () => ({
-    render(_width) { return []; },
+function sanitizeFooterStatus(text) {
+    return text.replace(/\s+/g, " ").trim();
+}
+export const hideFooter = (_tui, theme, footerData) => ({
+    render(width) {
+        const extensionStatuses = footerData.getExtensionStatuses();
+        if (extensionStatuses.size === 0)
+            return [];
+        const statusLine = Array.from(extensionStatuses.entries())
+            .sort(([a], [b]) => a.localeCompare(b))
+            .map(([, text]) => sanitizeFooterStatus(text))
+            .join(" ");
+        return [truncateToWidth(theme.fg("dim", statusLine), width, theme.fg("dim", "..."))];
+    },
     invalidate() { },
     dispose() { },
 });
@@ -522,13 +533,6 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                         : theme.fg("dim", elapsed))
                     : "";
                 lines.push(rightAlign(headerLeft, headerRight, width));
-                // Worktree/branch right-aligned below header
-                const branchLabel = worktreeName && cachedBranch
-                    ? `${worktreeName} (${cachedBranch})`
-                    : cachedBranch ?? "";
-                if (branchLabel) {
-                    lines.push(rightAlign("", theme.fg("dim", branchLabel), width));
-                }
                 // Show health signal details when degraded (yellow/red)
                 if (score.level !== "green" && score.signals.length > 0 && widgetMode !== "min") {
                     // Show up to 3 most relevant signals in compact form
@@ -776,16 +780,18 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                 // Hints line
                 const hintParts = [];
                 hintParts.push("esc pause");
-                hintParts.push(`${formatShortcut("Ctrl+Alt+G")} dashboard`);
+                hintParts.push(`${formattedShortcutPair("dashboard")} dashboard`);
+                hintParts.push(`${formattedShortcutPair("parallel")} parallel`);
                 const hintStr = theme.fg("dim", hintParts.join(" | "));
                 const commitStr = lastCommit
                     ? theme.fg("dim", `${lastCommit.timeAgo} ago: ${commitMsg}`)
                     : "";
+                const locationStr = theme.fg("dim", widgetPwd);
                 if (commitStr) {
-                    lines.push(rightAlign(`${pad}${commitStr}`, hintStr, width));
+                    lines.push(rightAlign(`${pad}${locationStr} · ${commitStr}`, hintStr, width));
                 }
                 else {
-                    lines.push(rightAlign("", hintStr, width));
+                    lines.push(rightAlign(`${pad}${locationStr}`, hintStr, width));
                 }
                 lines.push(...ui.bar());
                 cachedLines = lines;

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -8,6 +8,7 @@ import { classifyUnitComplexity, tierLabel } from "./complexity-classifier.js";
 import { resolveModelForComplexity, escalateTier, getEligibleModels, loadCapabilityOverrides, adjustToolSet } from "./model-router.js";
 import { getLedger, getProjectTotals } from "./metrics.js";
 import { unitPhaseLabel } from "./auto-dashboard.js";
+import { getSessionModelOverride } from "./session-model-override.js";
 export function resolvePreferredModelConfig(unitType, autoModeStartModel, 
 /** When false, only return explicit per-phase model configs — do not
  *  synthesize a routing ceiling from dynamic_routing.tier_models (#3962). */
@@ -44,8 +45,15 @@ isAutoMode = true) {
 export async function selectAndApplyModel(ctx, pi, unitType, unitId, basePath, prefs, verbose, autoModeStartModel, retryContext, 
 /** When false (interactive/guided-flow), skip dynamic routing and use the session model.
  *  Dynamic routing only applies in auto-mode where cost optimization is expected. (#3962) */
-isAutoMode = true) {
-    const modelConfig = resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode);
+isAutoMode = true, 
+/** Explicit /gsd model pin captured at bootstrap for long-running auto loops. */
+sessionModelOverride) {
+    const effectiveSessionModelOverride = sessionModelOverride === undefined
+        ? getSessionModelOverride(ctx.sessionManager.getSessionId())
+        : (sessionModelOverride ?? undefined);
+    const modelConfig = effectiveSessionModelOverride
+        ? undefined
+        : resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode);
     let routing = null;
     let appliedModel = null;
     if (modelConfig) {

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -15,7 +15,8 @@ import { getLoadedSkills } from "@gsd/pi-coding-agent";
 import { join, basename } from "node:path";
 import { existsSync } from "node:fs";
 import { computeBudgets, resolveExecutorContextWindow, truncateAtSectionBoundary } from "./context-budget.js";
-import { getPendingGates } from "./gsd-db.js";
+import { getPendingGatesForTurn } from "./gsd-db.js";
+import { assertGateCoverage, getGatesForTurn, } from "./gate-registry.js";
 import { formatDecisionsCompact, formatRequirementsCompact } from "./structured-data-formatter.js";
 import { readPhaseAnchor, formatAnchorForPrompt } from "./phase-anchor.js";
 import { logWarning } from "./workflow-logger.js";
@@ -1221,6 +1222,13 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
         ? `### Runtime Context\nSource: \`.gsd/RUNTIME.md\`\n\n${runtimeContent.trim()}`
         : "";
     const phaseAnchorSection = planAnchor ? formatAnchorForPrompt(planAnchor) : "";
+    // Task-scoped gates owned by execute-task (Q5/Q6/Q7). Pull only the
+    // gates that plan-slice actually seeded for this task — tasks with no
+    // external dependencies legitimately skip Q5, tasks with no runtime
+    // load dimension skip Q6, etc.
+    const etPending = getPendingGatesForTurn(mid, sid, "execute-task", tid);
+    assertGateCoverage(etPending, "execute-task", { requireAll: false });
+    const gatesToClose = renderGatesToCloseBlock(getGatesForTurn("execute-task"), { pending: new Set(etPending.map((g) => g.gate_id)), allowOmit: true });
     return loadPrompt("execute-task", {
         overridesSection,
         runtimeContext,
@@ -1238,6 +1246,7 @@ export async function buildExecuteTaskPrompt(mid, sid, sTitle, tid, tTitle, base
         taskSummaryPath,
         inlinedTemplates,
         verificationBudget,
+        gatesToClose,
         skillActivation: buildSkillActivationBlock({
             base,
             milestoneId: mid,
@@ -1298,6 +1307,15 @@ export async function buildCompleteSlicePrompt(mid, _midTitle, sid, sTitle, base
     const sliceRel = relSlicePath(base, mid, sid);
     const sliceSummaryPath = join(base, `${sliceRel}/${sid}-SUMMARY.md`);
     const sliceUatPath = join(base, `${sliceRel}/${sid}-UAT.md`);
+    // Gates owned by complete-slice (e.g. Q8). Pull from the DB so the
+    // prompt only prompts for gates the plan actually seeded. The tool
+    // handler closes each gate based on the SUMMARY.md section content
+    // after the assistant calls gsd_complete_slice.
+    const csPending = getPendingGatesForTurn(mid, sid, "complete-slice");
+    // coverage check: every pending row must be owned by complete-slice.
+    // requireAll:false because a slice may have already closed some gates.
+    assertGateCoverage(csPending, "complete-slice", { requireAll: false });
+    const gatesToClose = renderGatesToCloseBlock(getGatesForTurn("complete-slice"), { pending: new Set(csPending.map((g) => g.gate_id)), allowOmit: true });
     return loadPrompt("complete-slice", {
         workingDirectory: base,
         milestoneId: mid, sliceId: sid, sliceTitle: sTitle,
@@ -1306,6 +1324,7 @@ export async function buildCompleteSlicePrompt(mid, _midTitle, sid, sTitle, base
         inlinedContext,
         sliceSummaryPath,
         sliceUatPath,
+        gatesToClose,
     });
 }
 export async function buildCompleteMilestonePrompt(mid, midTitle, base, level) {
@@ -1498,6 +1517,15 @@ export async function buildValidateMilestonePrompt(mid, midTitle, base, level) {
     const inlinedContext = capPreamble(`## Inlined Context (preloaded — do not re-read these files)\n\n${inlined.join("\n\n---\n\n")}`);
     const validationOutputPath = join(base, `${relMilestonePath(base, mid)}/${mid}-VALIDATION.md`);
     const roadmapOutputPath = `${relMilestonePath(base, mid)}/${mid}-ROADMAP.md`;
+    // Every milestone validation turn owns MV01–MV04 unconditionally: the
+    // registry is the source of truth for which gates the validator must
+    // address, and the block below is what the template renders so the
+    // assistant can never accidentally skip one.
+    const mvGates = getGatesForTurn("validate-milestone");
+    const gatesToEvaluate = renderGatesToCloseBlock(mvGates, {
+        pending: new Set(mvGates.map((g) => g.id)),
+        allowOmit: false,
+    });
     return loadPrompt("validate-milestone", {
         workingDirectory: base,
         milestoneId: mid,
@@ -1506,6 +1534,7 @@ export async function buildValidateMilestonePrompt(mid, midTitle, base, level) {
         inlinedContext,
         validationPath: validationOutputPath,
         remediationRound: String(remediationRound),
+        gatesToEvaluate,
         skillActivation: buildSkillActivationBlock({
             base,
             milestoneId: mid,
@@ -1740,26 +1769,43 @@ export async function buildReactiveExecutePrompt(mid, midTitle, sid, sTitle, rea
     });
 }
 // ─── Gate Evaluation ──────────────────────────────────────────────────────
-const GATE_QUESTIONS = {
-    Q3: {
-        question: "How can this be exploited?",
-        guidance: [
-            "Identify abuse scenarios: parameter tampering, replay attacks, privilege escalation.",
-            "Map data exposure risks: PII, tokens, secrets accessible through this slice.",
-            "Define input trust boundaries: untrusted user input reaching DB, API, or filesystem.",
-            "If none apply, return verdict 'omitted' with rationale explaining why.",
-        ].join("\n"),
-    },
-    Q4: {
-        question: "What existing promises does this break?",
-        guidance: [
-            "List which existing requirements (R001, R003, etc.) are touched by this slice.",
-            "Identify what must be re-tested after shipping.",
-            "Flag decisions that should be revisited given the new scope.",
-            "If no existing requirements are affected, return verdict 'omitted'.",
-        ].join("\n"),
-    },
-};
+//
+// Gate definitions (question, guidance, owner turn) now live in
+// gate-registry.ts so that prompt builders, dispatch rules, state
+// derivation, and tool handlers all consult the same source of truth.
+// See gate-registry.ts for the full ownership map.
+/**
+ * Render a "Gates to Close" block for turns like `complete-slice` and
+ * `validate-milestone` that own gates which are closed as a side-effect
+ * of writing artifact sections (not via a dedicated gate-evaluate
+ * subagent loop).
+ *
+ * Returns a plain-text block or an empty string if there are no gates to
+ * close, so callers can drop it straight into a template variable.
+ */
+function renderGatesToCloseBlock(gates, opts) {
+    const applicable = gates.filter((g) => opts.pending.has(g.id));
+    if (applicable.length === 0)
+        return "";
+    const lines = [];
+    lines.push("## Gates to Close");
+    lines.push("");
+    lines.push("These quality gates are still pending for this unit. You MUST address every one before calling the closing tool — the handler closes the DB row based on whether the corresponding artifact section is present.");
+    lines.push("");
+    for (const def of applicable) {
+        lines.push(`### ${def.id} — ${def.promptSection}`);
+        lines.push("");
+        lines.push(`**Question:** ${def.question}`);
+        lines.push("");
+        lines.push(def.guidance);
+        if (opts.allowOmit) {
+            lines.push("");
+            lines.push(`If this gate genuinely does not apply to this unit, leave the **${def.promptSection}** section empty and the handler will record it as \`omitted\`. Otherwise, fill the section with concrete evidence.`);
+        }
+        lines.push("");
+    }
+    return lines.join("\n").trimEnd();
+}
 export async function buildParallelResearchSlicesPrompt(mid, midTitle, slices, basePath) {
     // Build individual research-slice prompts for each slice
     const subagentSections = [];
@@ -1784,24 +1830,33 @@ export async function buildParallelResearchSlicesPrompt(mid, midTitle, slices, b
     });
 }
 export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base) {
-    const pending = getPendingGates(mid, sid, "slice");
+    // Pull only the gates this turn actually owns (Q3/Q4). Filter via the
+    // registry so that scope:"slice" gates owned by other turns (Q8) can't
+    // leak into this prompt and can't block dispatch via silent skip.
+    const pending = getPendingGatesForTurn(mid, sid, "gate-evaluate");
+    // Fails loudly if the pending list contains a gate id the registry
+    // doesn't own for this turn. Missing owned gates is allowed here —
+    // `gate-evaluate` is dispatched whenever *any* of its owned gates are
+    // pending, not only when all of them are.
+    assertGateCoverage(pending, "gate-evaluate", { requireAll: false });
     // Load the slice plan for context
     const planFile = resolveSliceFile(base, mid, sid, "PLAN");
     const planContent = planFile ? (await loadFile(planFile)) ?? "(plan file empty)" : "(plan file not found)";
-    // Build per-gate subagent prompts
+    // Build per-gate subagent prompts from the pending rows. Because the
+    // registry has already validated every row, `getGateDefinition` cannot
+    // return undefined here.
+    const pendingIds = new Set(pending.map((g) => g.gate_id));
+    const gateDefs = getGatesForTurn("gate-evaluate").filter((def) => pendingIds.has(def.id));
     const subagentSections = [];
     const gateListLines = [];
-    for (const gate of pending) {
-        const meta = GATE_QUESTIONS[gate.gate_id];
-        if (!meta)
-            continue;
-        gateListLines.push(`- **${gate.gate_id}**: ${meta.question}`);
+    for (const def of gateDefs) {
+        gateListLines.push(`- **${def.id}**: ${def.question}`);
         const subPrompt = [
-            `You are evaluating quality gate **${gate.gate_id}** for slice ${sid} (${sTitle}).`,
+            `You are evaluating quality gate **${def.id}** for slice ${sid} (${sTitle}).`,
             "",
-            `## Question: ${meta.question}`,
+            `## Question: ${def.question}`,
             "",
-            meta.guidance,
+            def.guidance,
             "",
             "## Slice Plan",
             "",
@@ -1813,13 +1868,13 @@ export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base)
             `Call the \`gsd_save_gate_result\` tool with:`,
             `- \`milestoneId\`: "${mid}"`,
             `- \`sliceId\`: "${sid}"`,
-            `- \`gateId\`: "${gate.gate_id}"`,
+            `- \`gateId\`: "${def.id}"`,
             "- `verdict`: \"pass\" (no concerns), \"flag\" (concerns found), or \"omitted\" (not applicable)",
             "- `rationale`: one-sentence justification",
             "- `findings`: detailed markdown findings (or empty if omitted)",
         ].join("\n");
         subagentSections.push([
-            `### ${gate.gate_id}: ${meta.question}`,
+            `### ${def.id}: ${def.question}`,
             "",
             "Use this as the prompt for a `subagent` call:",
             "",

package/dist/resources/extensions/gsd/auto-start.js

@@ -39,6 +39,7 @@ import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
 import { resolveDefaultSessionModel, resolveDynamicRoutingConfig } from "./preferences-models.js";
+import { getSessionModelOverride } from "./session-model-override.js";
 /**
  * Bootstrap a fresh auto-mode session. Handles everything from git init
  * through secrets collection, returning when ready for the first
@@ -187,13 +188,35 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     // Capture the user's session model before guided-flow dispatch can apply a
     // phase-specific planning model for a discuss turn (#2829).
     //
-    // GSD PREFERENCES.md takes priority over the session model from settings.json
-    // (#3517).  The session model (ctx.model) comes from findInitialModel() which
-    // reads defaultProvider/defaultModel from ~/.gsd/agent/settings.json.  When
-    // the user has explicit model preferences in PREFERENCES.md, those should win.
+    // Precedence:
+    // 1) Explicit session override via /gsd model (this session)
+    // 2) GSD model preferences from PREFERENCES.md (validated against live auth)
+    // 3) Current session model from settings/session restore (if provider ready)
+    //
+    // This preserves #3517 defaults while honoring explicit runtime model
+    // selection for subsequent /gsd runs in the same session.
+    const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
     const preferredModel = resolveDefaultSessionModel(ctx.model?.provider);
-    const startModelSnapshot = preferredModel
-        ?? (ctx.model
+    // Validate the preferred model against the live registry + provider auth so
+    // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
+    // start-model snapshot. Without this, every subsequent unit would try to
+    // fall back to an unusable model.
+    let validatedPreferredModel;
+    if (preferredModel) {
+        const { resolveModelId } = await import("./auto-model-selection.js");
+        const available = ctx.modelRegistry.getAvailable();
+        const match = resolveModelId(`${preferredModel.provider}/${preferredModel.id}`, available, ctx.model?.provider);
+        if (match) {
+            validatedPreferredModel = { provider: match.provider, id: match.id };
+        }
+        else {
+            ctx.ui.notify(`Preferred model ${preferredModel.provider}/${preferredModel.id} from PREFERENCES.md is not configured; falling back to session default.`, "warning");
+        }
+    }
+    const sessionModelReady = ctx.model && ctx.modelRegistry.isProviderRequestReady(ctx.model.provider);
+    const startModelSnapshot = manualSessionOverride
+        ?? validatedPreferredModel
+        ?? (sessionModelReady && ctx.model
             ? { provider: ctx.model.provider, id: ctx.model.id }
             : null);
     try {
@@ -447,6 +470,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Successfully resolved an active milestone — reset the re-entry guard
         s.consecutiveCompleteBootstraps = 0;
         // ── Initialize session state ──
+        // Notify shared phase state so subagent conflict checks can fire
+        const { activateGSD: activateGSDPhaseState } = await import("../shared/gsd-phase-state.js");
+        activateGSDPhaseState();
         s.active = true;
         s.stepMode = requestedStepMode;
         s.verbose = verboseMode;
@@ -523,7 +549,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             }
         }
         // ── DB lifecycle ──
-        const gsdDbPath = join(s.basePath, ".gsd", "gsd.db");
+        const gsdDbPath = resolveProjectRootDbPath(s.basePath);
         const gsdDirPath = join(s.basePath, ".gsd");
         if (existsSync(gsdDirPath) && !existsSync(gsdDbPath)) {
             const hasDecisions = existsSync(join(gsdDirPath, "DECISIONS.md"));
@@ -571,6 +597,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 id: startModelSnapshot.id,
             };
         }
+        s.manualSessionModelOverride = manualSessionOverride ?? null;
         // Apply worker model override from parallel orchestrator (#worker-model).
         // GSD_WORKER_MODEL is injected by the coordinator when parallel.worker_model
         // is configured, so parallel milestone workers use a cheaper model than the

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -82,7 +82,7 @@ export function clearInFlightTools() {
  * handler. When these errors occur, retrying the same unit will produce the same
  * failure, so the retry loop must be broken.
  */
-const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Expected ',' or '\}' in JSON|Unexpected end of JSON|Unexpected token.*in JSON/i;
+const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON/i;
 /**
  * Returns true if the error message indicates a tool invocation failure due to
  * malformed/truncated arguments (as opposed to a normal tool execution error).

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -1795,7 +1795,7 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     // 12. Remove worktree directory first (must happen before branch deletion)
     try {
         removeWorktree(originalBasePath_, milestoneId, {
-            branch: null,
+            branch: milestoneBranch,
             deleteBranch: false,
         });
     }