gsd-pi 2.73.0-dev.e1c09f2 → 2.73.1-dev.06e4302

package/src/resources/extensions/gsd/preferences-models.ts

@@ -7,6 +7,8 @@
  */
 
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
 import type { DynamicRoutingConfig } from "./model-router.js";
 import { defaultRoutingConfig } from "./model-router.js";
 import type { TokenProfile, InlineLevel } from "./types.js";
@@ -185,6 +187,45 @@ export function resolveDefaultSessionModel(
   return undefined;
 }
 
+/**
+ * Returns true if `provider` is defined as a custom provider in the user's
+ * `~/.gsd/agent/models.json` (Ollama, vLLM, LM Studio, OpenAI-compatible
+ * proxies, etc.).
+ *
+ * Used by auto-mode bootstrap to decide whether the session model
+ * (set via `/gsd model`) should override `PREFERENCES.md`.  Custom providers
+ * are never reachable from `PREFERENCES.md` (which only knows built-in
+ * providers), so when the user has explicitly selected one, it must take
+ * priority — otherwise auto-mode tries to start the built-in provider from
+ * PREFERENCES.md and fails with "Not logged in · Please run /login" (#4122).
+ *
+ * Reads models.json directly with a lightweight JSON parse to avoid
+ * pulling in the full model-registry at this call site.  Falls back to
+ * `~/.pi/agent/models.json` for parity with `resolveModelsJsonPath()`.
+ * Any read or parse error yields `false` (treat as not-custom) so a
+ * malformed models.json never breaks the session bootstrap.
+ */
+export function isCustomProvider(provider: string | undefined): boolean {
+  if (!provider) return false;
+  const candidates = [
+    join(homedir(), ".gsd", "agent", "models.json"),
+    join(homedir(), ".pi", "agent", "models.json"),
+  ];
+  for (const path of candidates) {
+    if (!existsSync(path)) continue;
+    try {
+      const raw = readFileSync(path, "utf-8");
+      const parsed = JSON.parse(raw) as { providers?: Record<string, unknown> };
+      if (parsed?.providers && Object.prototype.hasOwnProperty.call(parsed.providers, provider)) {
+        return true;
+      }
+    } catch {
+      // Ignore — malformed models.json must not break bootstrap.
+    }
+  }
+  return false;
+}
+
 /**
  * Determines the next fallback model to try when the current model fails.
  * If the current model is not in the configured list, returns the primary model.

package/src/resources/extensions/gsd/preferences-types.ts

@@ -113,6 +113,7 @@ export const KNOWN_PREFERENCE_KEYS = new Set<string>([
   "discuss_preparation",
   "discuss_web_research",
   "discuss_depth",
+  "flat_rate_providers",
 ]);
 
 /** Canonical list of all dispatch unit types. */
@@ -359,6 +360,17 @@ export interface GSDPreferences {
    * Default: "standard".
    */
   discuss_depth?: "quick" | "standard" | "thorough";
+  /**
+   * Extra provider IDs to treat as flat-rate (no cost benefit from dynamic
+   * routing).  Dynamic routing is suppressed for any provider listed here,
+   * in addition to the built-in list (github-copilot, copilot, claude-code)
+   * and any provider auto-detected via `authMode: "externalCli"`.
+   *
+   * Intended for private subscription-backed proxies, enterprise-gated
+   * deployments, and custom CLI wrappers where every request costs the
+   * same regardless of model.  Case-insensitive.
+   */
+  flat_rate_providers?: string[];
 }
 
 export interface LoadedGSDPreferences {

package/src/resources/extensions/gsd/preferences-validation.ts

@@ -180,6 +180,29 @@ export function validatePreferences(preferences: GSDPreferences): {
     }
   }
 
+  // ─── Flat-rate Providers ────────────────────────────────────────────
+  // User-declared flat-rate providers for dynamic routing suppression.
+  // Built-in providers (github-copilot, copilot, claude-code) and any
+  // externalCli provider are already auto-detected; this list layers on
+  // top for private subscription proxies and custom CLI wrappers.
+  if (preferences.flat_rate_providers !== undefined) {
+    if (Array.isArray(preferences.flat_rate_providers)) {
+      const allStrings = preferences.flat_rate_providers.every(
+        (item: unknown) => typeof item === "string",
+      );
+      if (allStrings) {
+        // Strip empty/whitespace-only entries to avoid false matches.
+        validated.flat_rate_providers = preferences.flat_rate_providers
+          .map((s: string) => s.trim())
+          .filter((s: string) => s.length > 0);
+      } else {
+        errors.push("flat_rate_providers must be an array of strings");
+      }
+    } else {
+      errors.push("flat_rate_providers must be an array of strings");
+    }
+  }
+
   // ─── Phase Skip Preferences ─────────────────────────────────────────
   if (preferences.phases !== undefined) {
     if (typeof preferences.phases === "object" && preferences.phases !== null) {

package/src/resources/extensions/gsd/state.ts

@@ -386,6 +386,10 @@ function buildCompletenessSet(basePath: string, milestones: MilestoneRow[]) {
   const completeMilestoneIds = new Set<string>();
   const parkedMilestoneIds = new Set<string>();
 
+  // DB-authoritative: a milestone is only "complete" when its DB row says so.
+  // SUMMARY-file presence is NOT a completion signal here — an orphan SUMMARY
+  // (crashed complete-milestone turn, partial merge, manual edit) must not
+  // flip derived state to complete and cascade into a false auto-merge (#4179).
   for (const m of milestones) {
     const parkedFile = resolveMilestoneFile(basePath, m.id, "PARKED");
     if (parkedFile || m.status === 'parked') {
@@ -396,11 +400,6 @@ function buildCompletenessSet(basePath: string, milestones: MilestoneRow[]) {
       completeMilestoneIds.add(m.id);
       continue;
     }
-    const summaryFile = resolveMilestoneFile(basePath, m.id, "SUMMARY");
-    if (summaryFile) {
-      completeMilestoneIds.add(m.id);
-      continue;
-    }
   }
   return { completeMilestoneIds, parkedMilestoneIds };
 }
@@ -429,18 +428,22 @@ async function buildRegistryAndFindActive(
       if (isGhostMilestone(basePath, m.id)) continue;
     }
 
-    const summaryFile = resolveMilestoneFile(basePath, m.id, "SUMMARY");
-
-    if (completeMilestoneIds.has(m.id) || (summaryFile !== null)) {
+    // DB-authoritative completeness (#4179): only trust completeMilestoneIds,
+    // which is itself derived from DB status. SUMMARY-file presence alone must
+    // not imply completion. The summary file may still be consulted below as a
+    // title source for legitimately-complete milestones whose DB row has no title.
+    if (completeMilestoneIds.has(m.id)) {
       let title = stripMilestonePrefix(m.title) || m.id;
-      if (summaryFile && !m.title) {
-        const summaryContent = await loadFile(summaryFile);
-        if (summaryContent) {
-          title = parseSummary(summaryContent).title || m.id;
+      if (!m.title) {
+        const summaryFile = resolveMilestoneFile(basePath, m.id, "SUMMARY");
+        if (summaryFile) {
+          const summaryContent = await loadFile(summaryFile);
+          if (summaryContent) {
+            title = parseSummary(summaryContent).title || m.id;
+          }
         }
       }
       registry.push({ id: m.id, title, status: 'complete' });
-      completeMilestoneIds.add(m.id);
       continue;
     }
 
@@ -481,7 +484,14 @@ async function buildRegistryAndFindActive(
         const validationContent = validationFile ? await loadFile(validationFile) : null;
         const validationTerminal = validationContent ? isValidationTerminal(validationContent) : false;
 
-        if (!validationTerminal || (validationTerminal && !summaryFile)) {
+        // DB-authoritative (#4179): completeness is already decided by
+        // completeMilestoneIds above. If we reached this branch, the DB says
+        // the milestone is NOT complete — so any SUMMARY file on disk is an
+        // orphan (crashed complete-milestone, partial merge, manual edit) and
+        // must not short-circuit this path. When validation is terminal, fall
+        // through to the default active-push below so `complete-milestone` can
+        // re-run idempotently.
+        if (!validationTerminal) {
           activeMilestone = { id: m.id, title };
           activeMilestoneSlices = slices;
           activeMilestoneFound = true;
@@ -630,13 +640,39 @@ function resolveSliceDependencies(activeMilestoneSlices: SliceRow[]): { activeSl
     }
   }
 
+  // First pass: find a slice with ALL dependencies satisfied (strict)
+  let bestFallback: SliceRow | null = null;
+  let bestFallbackSatisfied = -1;
+
   for (const s of activeMilestoneSlices) {
     if (isStatusDone(s.status)) continue;
     if (isDeferredStatus(s.status)) continue;
     if (s.depends.every(dep => doneSliceIds.has(dep))) {
       return { activeSlice: { id: s.id, title: s.title }, activeSliceRow: s };
     }
+    // Track the slice with the most satisfied dependencies as fallback
+    const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
+    if (satisfied > bestFallbackSatisfied || (satisfied === bestFallbackSatisfied && !bestFallback)) {
+      bestFallback = s;
+      bestFallbackSatisfied = satisfied;
+    }
   }
+
+  // Fallback: if no slice has all deps met but there ARE incomplete non-deferred
+  // slices, pick the one with the most deps satisfied. This prevents hard-blocking
+  // when dependency metadata is stale (e.g. after reassessment added/removed slices)
+  // or when deps reference slices from previous milestones.
+  if (bestFallback) {
+    const unmet = bestFallback.depends.filter(dep => !doneSliceIds.has(dep));
+    logWarning("state",
+      `No slice has all deps satisfied — falling back to ${bestFallback.id} ` +
+      `(${bestFallbackSatisfied}/${bestFallback.depends.length} deps met, ` +
+      `unmet: ${unmet.join(", ")})`,
+      { mid: activeMilestoneSlices[0]?.milestone_id, sid: bestFallback.id },
+    );
+    return { activeSlice: { id: bestFallback.id, title: bestFallback.title }, activeSliceRow: bestFallback };
+  }
+
   return { activeSlice: null, activeSliceRow: null };
 }
 
@@ -684,7 +720,7 @@ async function reconcileSliceTasks(
     const summaryPath = resolveTaskFile(basePath, milestoneId, sliceId, t.id, "SUMMARY");
     if (summaryPath && existsSync(summaryPath)) {
       try {
-        updateTaskStatus(milestoneId, sliceId, t.id, "complete");
+        updateTaskStatus(milestoneId, sliceId, t.id, "complete", new Date().toISOString());
         logWarning("reconcile", `task ${milestoneId}/${sliceId}/${t.id} status reconciled from "${t.status}" to "complete" (#2514)`, { mid: milestoneId, sid: sliceId, tid: t.id });
         reconciled = true;
       } catch (e) {
@@ -1431,12 +1467,32 @@ export async function _deriveStateImpl(basePath: string): Promise<GSDState> {
       };
     }
   } else {
+    let bestFallbackLegacy: { id: string; title: string; depends: string[] } | null = null;
+    let bestFallbackLegacySatisfied = -1;
+
     for (const s of activeRoadmap.slices) {
       if (s.done) continue;
       if (s.depends.every(dep => doneSliceIds.has(dep))) {
         activeSlice = { id: s.id, title: s.title };
         break;
       }
+      // Track best fallback
+      const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
+      if (satisfied > bestFallbackLegacySatisfied) {
+        bestFallbackLegacy = s;
+        bestFallbackLegacySatisfied = satisfied;
+      }
+    }
+
+    // Fallback: if no slice has all deps met, pick the one with the most deps satisfied
+    if (!activeSlice && bestFallbackLegacy) {
+      const unmet = bestFallbackLegacy.depends.filter(dep => !doneSliceIds.has(dep));
+      logWarning("state",
+        `No slice has all deps satisfied — falling back to ${bestFallbackLegacy.id} ` +
+        `(${bestFallbackLegacySatisfied}/${bestFallbackLegacy.depends.length} deps met, ` +
+        `unmet: ${unmet.join(", ")})`,
+      );
+      activeSlice = { id: bestFallbackLegacy.id, title: bestFallbackLegacy.title };
     }
   }
 

package/src/resources/extensions/gsd/tests/auto-loop.test.ts

@@ -688,8 +688,8 @@ test("autoLoop exits on terminal blocked state", async (t) => {
 
   assert.ok(deps.callLog.includes("deriveState"), "should have derived state");
   assert.ok(
-    deps.callLog.includes("stopAuto"),
-    "should have called stopAuto for blocked state",
+    deps.callLog.includes("pauseAuto"),
+    "should have called pauseAuto for blocked state",
   );
   assert.ok(
     !deps.callLog.includes("resolveDispatch"),

package/src/resources/extensions/gsd/tests/auto-post-unit-step-message.test.ts

@@ -0,0 +1,53 @@
+// GSD-2 — Tests for step-mode completion messages in auto-post-unit
+
+import test from "node:test";
+import assert from "node:assert/strict";
+
+import { buildStepCompleteMessage, STEP_COMPLETE_FALLBACK_MESSAGE } from "../auto-post-unit.ts";
+import type { GSDState } from "../types.ts";
+
+function makeState(overrides: Partial<GSDState>): GSDState {
+  return {
+    activeMilestone: null,
+    activeSlice: null,
+    activeTask: null,
+    phase: "executing",
+    recentDecisions: [],
+    blockers: [],
+    nextAction: "",
+    registry: [],
+    ...overrides,
+  };
+}
+
+test("buildStepCompleteMessage: milestone complete surfaces review guidance", () => {
+  const msg = buildStepCompleteMessage(makeState({ phase: "complete" }));
+  assert.match(msg, /milestone finished/);
+  assert.match(msg, /\/gsd status/);
+  assert.doesNotMatch(msg, /Next:/);
+});
+
+test("buildStepCompleteMessage: mid-flight step includes next unit label and /clear hint", () => {
+  const state = makeState({
+    phase: "executing",
+    activeSlice: { id: "S01", title: "Core" },
+    activeTask: { id: "T03", title: "Wire notify" },
+  });
+  const msg = buildStepCompleteMessage(state);
+  assert.match(msg, /Next: Execute T03: Wire notify/);
+  assert.match(msg, /\/clear/);
+  assert.match(msg, /\/gsd to continue/);
+});
+
+test("buildStepCompleteMessage: unknown phase falls back to generic continue label", () => {
+  // Cast to bypass Phase union so we exercise the default branch of describeNextUnit.
+  const state = makeState({ phase: "totally-unknown" as unknown as GSDState["phase"] });
+  const msg = buildStepCompleteMessage(state);
+  assert.match(msg, /Next: Continue/);
+  assert.match(msg, /\/clear/);
+});
+
+test("STEP_COMPLETE_FALLBACK_MESSAGE: used when deriveState throws, still points users at /clear + /gsd", () => {
+  assert.match(STEP_COMPLETE_FALLBACK_MESSAGE, /\/clear/);
+  assert.match(STEP_COMPLETE_FALLBACK_MESSAGE, /\/gsd/);
+});

package/src/resources/extensions/gsd/tests/auto-start-model-capture.test.ts

@@ -33,8 +33,12 @@ test("bootstrapAutoSession checks manual session override before preferences", (
   assert.ok(manualIdx > -1, "auto-start.ts should read session model override first");
 
   // resolveDefaultSessionModel() should still be called for fallback behavior
-  const preferredIdx = source.indexOf("const preferredModel = resolveDefaultSessionModel(");
-  assert.ok(preferredIdx > -1, "auto-start.ts should call resolveDefaultSessionModel()");
+  const preferredIdx = source.indexOf("const preferredModel = ");
+  assert.ok(preferredIdx > -1, "auto-start.ts should build preferredModel");
+  assert.ok(
+    source.indexOf("resolveDefaultSessionModel(") > -1,
+    "auto-start.ts should call resolveDefaultSessionModel()",
+  );
 
   // Session provider should be passed for bare model ID resolution
   const withProviderIdx = source.indexOf("resolveDefaultSessionModel(ctx.model?.provider)");
@@ -47,6 +51,51 @@ test("bootstrapAutoSession checks manual session override before preferences", (
     manualIdx < snapshotIdx && preferredIdx < snapshotIdx,
     "manual override and preference fallback must be resolved before building startModelSnapshot",
   );
+
+  // The validated preferred model must still appear as one of the snapshot
+  // sources so PREFERENCES.md continues to win over a stale settings.json
+  // default for built-in providers.
+  const snapshotBlock = source.slice(snapshotIdx, snapshotIdx + 400);
+  assert.ok(
+    snapshotBlock.includes("validatedPreferredModel") || snapshotBlock.includes("preferredModel"),
+    "startModelSnapshot must still consider preferredModel for built-in providers",
+  );
+});
+
+test("bootstrapAutoSession prefers session model over PREFERENCES.md when provider is custom (#4122)", () => {
+  // Custom providers (Ollama, vLLM, OpenAI-compatible proxies) live in
+  // ~/.gsd/agent/models.json, not PREFERENCES.md.  When the user picks one
+  // via /gsd model, that selection must win over any preferredModel from
+  // PREFERENCES.md, otherwise auto-mode tries to start a built-in provider
+  // the user is not logged into and pauses with "Not logged in".
+  const customCheckIdx = source.indexOf("isCustomProvider(ctx.model?.provider)");
+  assert.ok(
+    customCheckIdx > -1,
+    "auto-start.ts should call isCustomProvider() to detect custom-model sessions",
+  );
+
+  // sessionProviderIsCustom must gate preferredModel resolution so that when the
+  // session provider is custom, preferredModel is null and PREFERENCES.md is
+  // skipped entirely — the snapshot then falls through to ctx.model.
+  const gateIdx = source.indexOf("sessionProviderIsCustom");
+  assert.ok(gateIdx > -1, "auto-start.ts should bind sessionProviderIsCustom");
+
+  const preferredIdx = source.indexOf("const preferredModel = ");
+  assert.ok(preferredIdx > -1, "auto-start.ts should build preferredModel");
+
+  const preferredBlock = source.slice(preferredIdx, preferredIdx + 200);
+  assert.ok(
+    preferredBlock.includes("sessionProviderIsCustom"),
+    "preferredModel must be gated on sessionProviderIsCustom so PREFERENCES.md is skipped for custom providers",
+  );
+
+  const snapshotIdx = source.indexOf("const startModelSnapshot = ");
+  assert.ok(snapshotIdx > -1, "auto-start.ts should build startModelSnapshot");
+
+  assert.ok(
+    customCheckIdx < preferredIdx && preferredIdx < snapshotIdx,
+    "isCustomProvider() must be evaluated before preferredModel, which must be resolved before startModelSnapshot",
+  );
 });
 
 test("bootstrapAutoSession validates preferred model against live registry auth (#unconfigured-models)", () => {

package/src/resources/extensions/gsd/tests/complete-milestone-false-merge.test.ts

@@ -0,0 +1,142 @@
+/**
+ * complete-milestone-false-merge.test.ts — Regression test for #4175.
+ *
+ * Before the fix, a failed complete-milestone unit could leave a stub
+ * SUMMARY blocker placeholder on disk. stopAuto's SUMMARY-presence check
+ * then treated the milestone as complete and merged the worktree branch
+ * into main — emitting a misleading metadata-only merge warning for a
+ * milestone that was never legitimately finished.
+ *
+ * The fix has three cooperating parts:
+ *   1. stopAuto uses DB status (authoritative) instead of SUMMARY presence
+ *      when the project DB is available.
+ *   2. postUnitPreVerification pauses auto-mode for complete-milestone
+ *      after retries are exhausted instead of writing a blocker placeholder.
+ *   3. recoverTimedOutUnit pauses for complete-milestone instead of
+ *      writing a blocker placeholder.
+ *
+ * This test guards all three via source inspection so a future refactor
+ * cannot silently reintroduce the false-merge path.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+
+const gsdDir = join(import.meta.dirname, "..");
+const autoSrc = readFileSync(join(gsdDir, "auto.ts"), "utf-8");
+const postUnitSrc = readFileSync(join(gsdDir, "auto-post-unit.ts"), "utf-8");
+const timeoutSrc = readFileSync(join(gsdDir, "auto-timeout-recovery.ts"), "utf-8");
+
+test("#4175: stopAuto uses DB status as the authoritative milestone-complete signal", () => {
+  const step4Idx = autoSrc.indexOf("Step 4: Auto-worktree exit");
+  assert.ok(step4Idx !== -1, "Step 4 comment exists in stopAuto");
+  const step5Idx = autoSrc.indexOf("Step 5:", step4Idx);
+  const step4Block = autoSrc.slice(step4Idx, step5Idx);
+
+  assert.ok(
+    step4Block.includes("isDbAvailable()"),
+    "Step 4 should branch on isDbAvailable() so DB is consulted when present",
+  );
+  assert.ok(
+    step4Block.includes("getMilestone(s.currentMilestoneId)"),
+    "Step 4 should read authoritative milestone status via getMilestone()",
+  );
+  assert.ok(
+    /status\s*===\s*"complete"/.test(step4Block),
+    'Step 4 should compare the DB row status to "complete"',
+  );
+});
+
+test("#4175: stopAuto imports getMilestone from gsd-db", () => {
+  assert.ok(
+    /import\s*\{[^}]*\bgetMilestone\b[^}]*\}\s*from\s*"\.\/gsd-db\.js"/.test(autoSrc),
+    "auto.ts should import getMilestone from ./gsd-db.js",
+  );
+});
+
+test("#4175: stopAuto still falls back to SUMMARY presence when DB is unavailable", () => {
+  const step4Idx = autoSrc.indexOf("Step 4: Auto-worktree exit");
+  const step5Idx = autoSrc.indexOf("Step 5:", step4Idx);
+  const step4Block = autoSrc.slice(step4Idx, step5Idx);
+
+  assert.ok(
+    step4Block.includes("resolveMilestoneFile"),
+    "Step 4 should keep SUMMARY-file resolution for DB-unavailable projects",
+  );
+  assert.ok(
+    step4Block.includes("preserveBranch"),
+    "Step 4 should still preserve branch for incomplete milestones (fallback path)",
+  );
+});
+
+test("#4175: postUnitPreVerification pauses complete-milestone after retries exhausted", () => {
+  // The pause branch must live inside the retries-exhausted block, above the
+  // writeBlockerPlaceholder call — otherwise the stub SUMMARY is still written.
+  const retriesExhaustedIdx = postUnitSrc.indexOf(
+    "if (attempt > MAX_VERIFICATION_RETRIES)",
+  );
+  assert.ok(
+    retriesExhaustedIdx !== -1,
+    "retries-exhausted guard exists in postUnitPreVerification",
+  );
+
+  const blockerCallIdx = postUnitSrc.indexOf("writeBlockerPlaceholder", retriesExhaustedIdx);
+  assert.ok(
+    blockerCallIdx !== -1,
+    "blocker placeholder call still exists for non-milestone units",
+  );
+
+  const exhaustedBlock = postUnitSrc.slice(retriesExhaustedIdx, blockerCallIdx);
+
+  assert.ok(
+    /s\.currentUnit\.type\s*===\s*"complete-milestone"/.test(exhaustedBlock),
+    "retries-exhausted block should specifically handle complete-milestone",
+  );
+  assert.ok(
+    /pauseAuto\s*\(\s*ctx\s*,\s*pi\s*\)/.test(exhaustedBlock),
+    "complete-milestone path should call pauseAuto instead of falling through",
+  );
+  // The pause branch must return so execution never reaches writeBlockerPlaceholder.
+  assert.ok(
+    /return\s+"dispatched"\s*;/.test(exhaustedBlock),
+    "complete-milestone pause branch should return before the placeholder call",
+  );
+});
+
+test("#4175: recoverTimedOutUnit pauses complete-milestone instead of writing a blocker placeholder", () => {
+  // The complete-milestone pause branch must sit immediately above the
+  // "retries exhausted" writeBlockerPlaceholder call so a failed
+  // complete-milestone never produces a stub SUMMARY. Anchor on the
+  // comment that precedes that specific placeholder call rather than the
+  // function's earlier writeBlockerPlaceholder use sites or its import.
+  // Use lastIndexOf so we find the final retries-exhausted block in
+  // recoverTimedOutUnit, not an earlier helper with the same comment.
+  const exhaustedAnchor = "Retries exhausted — write a blocker placeholder";
+  const exhaustedIdx = timeoutSrc.lastIndexOf(exhaustedAnchor);
+  assert.ok(
+    exhaustedIdx !== -1,
+    "retries-exhausted blocker-placeholder path still exists for non-milestone units",
+  );
+
+  const guardIdx = timeoutSrc.lastIndexOf(
+    'unitType === "complete-milestone"',
+    exhaustedIdx,
+  );
+  assert.ok(
+    guardIdx !== -1,
+    "complete-milestone guard should appear above the retries-exhausted placeholder call",
+  );
+
+  const guardBlock = timeoutSrc.slice(guardIdx, exhaustedIdx);
+  assert.ok(
+    /return\s+"paused"\s*;/.test(guardBlock),
+    "complete-milestone guard should return 'paused' before the placeholder call",
+  );
+  // The guard itself must not call writeBlockerPlaceholder.
+  assert.ok(
+    !guardBlock.includes("writeBlockerPlaceholder"),
+    "complete-milestone guard must not write a blocker placeholder",
+  );
+});

package/src/resources/extensions/gsd/tests/completed-at-reconcile.test.ts

@@ -0,0 +1,42 @@
+/**
+ * Regression test for #4129: tasks.completed_at stays NULL when status is
+ * reconciled to 'complete' via the file-existence path in state.ts.
+ *
+ * Root cause: reconcileSliceTasks called
+ *   updateTaskStatus(milestoneId, sliceId, t.id, "complete")
+ * without a completedAt timestamp, so the column stays NULL.
+ *
+ * Fix: pass new Date().toISOString() as the 5th argument.
+ */
+
+import { describe, test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { fileURLToPath } from "node:url";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const stateSource = readFileSync(join(__dirname, "..", "state.ts"), "utf-8");
+
+describe("completed-at reconcile (#4129)", () => {
+  test("reconcileSliceTasks passes a completedAt timestamp when setting status to complete", () => {
+    // Before the fix, state.ts had:
+    //   updateTaskStatus(milestoneId, sliceId, t.id, "complete")
+    // which leaves completed_at NULL in the DB.
+    // After the fix, a timestamp must be passed as the 5th argument.
+    assert.doesNotMatch(
+      stateSource,
+      /updateTaskStatus\(\s*milestoneId\s*,\s*sliceId\s*,\s*t\.id\s*,\s*["']complete["']\s*\)/,
+      "updateTaskStatus must not be called without a completedAt timestamp when reconciling tasks to 'complete' (#4129)",
+    );
+  });
+
+  test("reconcileSliceTasks passes new Date().toISOString() as the completedAt argument", () => {
+    // Positive assertion: the fixed call must include a timestamp.
+    assert.match(
+      stateSource,
+      /updateTaskStatus\(\s*milestoneId\s*,\s*sliceId\s*,\s*t\.id\s*,\s*["']complete["']\s*,\s*new Date\(\)\.toISOString\(\)\s*\)/,
+      "reconcileSliceTasks must pass new Date().toISOString() as completedAt when setting task status to 'complete' (#4129)",
+    );
+  });
+});