gsd-pi 2.73.0 → 2.73.1-dev.6ddfa43

package/src/resources/extensions/claude-code-cli/tests/stream-adapter.test.ts

@@ -343,6 +343,26 @@ describe("stream-adapter — session persistence (#2859)", () => {
 		);
 	});
 
+	test("buildSdkOptions maps reasoning to effort for adaptive Claude Code models (#3917)", () => {
+		const options = buildSdkOptions("claude-sonnet-4-6", "test", undefined, { reasoning: "high" });
+		assert.equal(options.effort, "high");
+	});
+
+	test("buildSdkOptions upgrades xhigh reasoning to max for opus 4.6 (#3917)", () => {
+		const options = buildSdkOptions("claude-opus-4-6", "test", undefined, { reasoning: "xhigh" });
+		assert.equal(options.effort, "max");
+	});
+
+	test("buildSdkOptions omits effort when reasoning is undefined (#3917)", () => {
+		const options = buildSdkOptions("claude-sonnet-4-6", "test");
+		assert.equal("effort" in options, false);
+	});
+
+	test("buildSdkOptions omits effort for non-adaptive Claude models (#3917)", () => {
+		const options = buildSdkOptions("claude-sonnet-4-20250514", "test", undefined, { reasoning: "high" });
+		assert.equal("effort" in options, false);
+	});
+
 	test("buildSdkOptions includes workflow MCP server config when env is set", () => {
 		const prev = {
 			GSD_WORKFLOW_MCP_COMMAND: process.env.GSD_WORKFLOW_MCP_COMMAND,
@@ -774,11 +794,12 @@ describe("stream-adapter — MCP elicitation bridge", () => {
 			},
 		};
 
+		const secureValue = "ui-collected-value";
 		const inputCalls: Array<{ opts?: { secure?: boolean } }> = [];
 		const handler = createClaudeCodeElicitationHandler({
 			input: async (_title: string, _placeholder?: string, opts?: { secure?: boolean }) => {
 				inputCalls.push({ opts });
-				return "example-secure-input";
+				return secureValue;
 			},
 		} as any);
 		assert.ok(handler);
@@ -787,7 +808,7 @@ describe("stream-adapter — MCP elicitation bridge", () => {
 		assert.deepEqual(result, {
 			action: "accept",
 			content: {
-				TEST_SECURE_FIELD: "example-secure-input",
+				TEST_SECURE_FIELD: secureValue,
 			},
 		});
 		assert.equal(inputCalls.length, 1);

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -52,6 +52,7 @@ import {
   checkNeedsReassessment,
   checkNeedsRunUat,
 } from "./auto-prompts.js";
+import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────
 
@@ -423,6 +424,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
           midTitle,
           researchReadySlices,
           basePath,
+          resolveModelWithFallbacksForUnit("subagent")?.primary,
         ),
       };
     },
@@ -510,6 +512,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
           sid,
           sTitle,
           basePath,
+          resolveModelWithFallbacksForUnit("subagent")?.primary,
         ),
       };
     },
@@ -548,6 +551,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
       const sid = state.activeSlice.id;
       const sTitle = state.activeSlice.title;
       const maxParallel = reactiveConfig.max_parallel ?? 2;
+      const subagentModel = reactiveConfig.subagent_model ?? resolveModelWithFallbacksForUnit("subagent")?.primary;
 
       // Dry-run mode: max_parallel=1 means graph is derived and logged but
       // execution remains sequential
@@ -618,6 +622,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
             sTitle,
             selected,
             basePath,
+            subagentModel,
           ),
         };
       } catch (err) {

package/src/resources/extensions/gsd/auto-model-selection.ts

@@ -15,6 +15,7 @@ import { resolveModelForComplexity, escalateTier, getEligibleModels, loadCapabil
 import { getLedger, getProjectTotals } from "./metrics.js";
 import { unitPhaseLabel } from "./auto-dashboard.js";
 import { getSessionModelOverride } from "./session-model-override.js";
+import { logWarning } from "./workflow-logger.js";
 
 export interface ModelSelectionResult {
   /** Routing metadata for metrics recording */
@@ -25,9 +26,7 @@ export interface ModelSelectionResult {
 
 export function resolvePreferredModelConfig(
   unitType: string,
-  autoModeStartModel: { provider: string; id: string } | null,
-  /** When false, only return explicit per-phase model configs — do not
-   *  synthesize a routing ceiling from dynamic_routing.tier_models (#3962). */
+  autoModeStartModel: { provider: string; id: string; flatRateCtx?: FlatRateContext } | null,
   isAutoMode = true,
 ) {
   const explicitConfig = resolveModelWithFallbacksForUnit(unitType);
@@ -41,7 +40,7 @@ export function resolvePreferredModelConfig(
   if (!routingConfig.enabled || !routingConfig.tier_models) return undefined;
 
   // Don't synthesize a routing config for flat-rate providers (#3453).
-  if (autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider)) return undefined;
+  if (autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider, autoModeStartModel.flatRateCtx)) return undefined;
 
   const ceilingModel = routingConfig.tier_models.heavy
     ?? (autoModeStartModel ? `${autoModeStartModel.provider}/${autoModeStartModel.id}` : undefined);
@@ -68,7 +67,7 @@ export async function selectAndApplyModel(
   basePath: string,
   prefs: GSDPreferences | undefined,
   verbose: boolean,
-  autoModeStartModel: { provider: string; id: string } | null,
+  autoModeStartModel: { provider: string; id: string; flatRateCtx?: FlatRateContext } | null,
   retryContext?: { isRetry: boolean; previousTier?: string },
   /** When false (interactive/guided-flow), skip dynamic routing and use the session model.
    *  Dynamic routing only applies in auto-mode where cost optimization is expected. (#3962) */
@@ -79,6 +78,17 @@ export async function selectAndApplyModel(
   const effectiveSessionModelOverride = sessionModelOverride === undefined
     ? getSessionModelOverride(ctx.sessionManager.getSessionId())
     : (sessionModelOverride ?? undefined);
+  // Enrich the start model with a flat-rate context up front so routing
+  // synthesis and the dispatch-time guard see the same signals (built-in
+  // list + user `flat_rate_providers` preference + externalCli auto-
+  // detection).  The dispatch-time primary-model check below builds its
+  // own per-provider context when it has a resolved primary model.
+  if (autoModeStartModel) {
+    autoModeStartModel = {
+      ...autoModeStartModel,
+      flatRateCtx: buildFlatRateContext(autoModeStartModel.provider, ctx, prefs),
+    };
+  }
   const modelConfig = effectiveSessionModelOverride
     ? undefined
     : resolvePreferredModelConfig(unitType, autoModeStartModel, isAutoMode);
@@ -107,12 +117,16 @@ export async function selectAndApplyModel(
     if (routingConfig.enabled) {
       const primaryModel = resolveModelId(modelConfig.primary, availableModels, ctx.model?.provider);
       if (primaryModel) {
-        if (isFlatRateProvider(primaryModel.provider)) {
+        const primaryFlatRateCtx = buildFlatRateContext(primaryModel.provider, ctx, prefs);
+        if (isFlatRateProvider(primaryModel.provider, primaryFlatRateCtx)) {
           routingConfig.enabled = false;
         }
       } else if (
-        (autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider))
-        || (ctx.model?.provider && isFlatRateProvider(ctx.model.provider))
+        (autoModeStartModel && isFlatRateProvider(autoModeStartModel.provider, autoModeStartModel.flatRateCtx))
+        || (ctx.model?.provider && isFlatRateProvider(
+          ctx.model.provider,
+          buildFlatRateContext(ctx.model.provider, ctx, prefs),
+        ))
       ) {
         // Primary model unresolvable but provider signals indicate flat-rate —
         // disable routing to prevent quality degradation.
@@ -416,8 +430,68 @@ export function resolveModelId<T extends { id: string; provider: string }>(
  * Uses case-insensitive matching with alias support to prevent fail-open on
  * provider naming variations (e.g. "copilot" vs "github-copilot").
  */
-const FLAT_RATE_PROVIDERS = new Set(["github-copilot", "copilot", "claude-code"]);
+const BUILTIN_FLAT_RATE = new Set(["github-copilot", "copilot", "claude-code"]);
+
+/**
+ * Optional context that lets callers extend flat-rate detection beyond the
+ * hard-coded built-in list.  Either signal on its own is enough to classify
+ * a provider as flat-rate.
+ */
+export interface FlatRateContext {
+  /**
+   * Auth mode for the specific provider being checked, as returned by
+   * `ctx.modelRegistry.getProviderAuthMode(provider)`.  Any provider that
+   * wraps a local CLI (externalCli) is, by definition, a flat-rate
+   * subscription wrapper — every request costs the same regardless of
+   * model, so dynamic routing only degrades quality.
+   */
+  authMode?: "apiKey" | "oauth" | "externalCli" | "none";
+  /**
+   * Case-insensitive list of extra provider IDs the user has declared as
+   * flat-rate via `preferences.flat_rate_providers`.  Used for private
+   * subscription-backed proxies and enterprise-gated deployments that the
+   * built-in list doesn't know about.
+   */
+  userFlatRate?: readonly string[];
+}
+
+export function isFlatRateProvider(provider: string, opts?: FlatRateContext): boolean {
+  const p = provider.toLowerCase();
+  if (BUILTIN_FLAT_RATE.has(p)) return true;
+  if (opts?.userFlatRate?.some(id => id.toLowerCase() === p)) return true;
+  if (opts?.authMode === "externalCli") return true;
+  return false;
+}
 
-export function isFlatRateProvider(provider: string): boolean {
-  return FLAT_RATE_PROVIDERS.has(provider.toLowerCase());
+/**
+ * Build a FlatRateContext for a given provider from live runtime state.
+ * Safe to call when ctx or prefs are undefined — missing pieces are
+ * treated as "no signal".
+ */
+export function buildFlatRateContext(
+  provider: string,
+  ctx?: { modelRegistry?: { getProviderAuthMode?: (p: string) => string } },
+  prefs?: { flat_rate_providers?: readonly string[] },
+): FlatRateContext {
+  let authMode: FlatRateContext["authMode"];
+  const getAuthMode = ctx?.modelRegistry?.getProviderAuthMode;
+  if (typeof getAuthMode === "function") {
+    try {
+      const mode = getAuthMode(provider);
+      if (mode === "apiKey" || mode === "oauth" || mode === "externalCli" || mode === "none") {
+        authMode = mode;
+      }
+    } catch (err) {
+      // Registry lookup failure must never break flat-rate detection —
+      // fall through with authMode undefined and surface the cause.
+      logWarning(
+        "dispatch",
+        `flat-rate auth-mode lookup failed for ${provider}: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+  }
+  return {
+    authMode,
+    userFlatRate: prefs?.flat_rate_providers,
+  };
 }

package/src/resources/extensions/gsd/auto-prompts.ts

@@ -1926,6 +1926,7 @@ export async function buildReassessRoadmapPrompt(
 export async function buildReactiveExecutePrompt(
   mid: string, midTitle: string, sid: string, sTitle: string,
   readyTaskIds: string[], base: string,
+  subagentModel?: string,
 ): Promise<string> {
   const { loadSliceTaskIO, deriveTaskGraph, graphMetrics } = await import("./reactive-graph.js");
 
@@ -1970,10 +1971,11 @@ export async function buildReactiveExecutePrompt(
       { carryForwardPaths: depPaths },
     );
 
+    const modelSuffix = subagentModel ? ` with model: "${subagentModel}"` : "";
     subagentSections.push([
       `### ${tid}: ${tTitle}`,
       "",
-      "Use this as the prompt for a `subagent` call:",
+      `Use this as the prompt for a \`subagent\` call${modelSuffix}:`,
       "",
       "```",
       taskPrompt,
@@ -2049,15 +2051,17 @@ export async function buildParallelResearchSlicesPrompt(
   midTitle: string,
   slices: Array<{ id: string; title: string }>,
   basePath: string,
+  subagentModel?: string,
 ): Promise<string> {
   // Build individual research-slice prompts for each slice
   const subagentSections: string[] = [];
+  const modelSuffix = subagentModel ? ` with model: "${subagentModel}"` : "";
   for (const slice of slices) {
     const slicePrompt = await buildResearchSlicePrompt(mid, midTitle, slice.id, slice.title, basePath);
     subagentSections.push([
       `### ${slice.id}: ${slice.title}`,
       "",
-      "Use this as the prompt for a `subagent` call (agent: `gsd-executor` or the default agent):",
+      `Use this as the prompt for a \`subagent\` call${modelSuffix} (agent: \`gsd-executor\` or the default agent):`,
       "",
       "```",
       slicePrompt,
@@ -2077,6 +2081,7 @@ export async function buildParallelResearchSlicesPrompt(
 export async function buildGateEvaluatePrompt(
   mid: string, midTitle: string, sid: string, sTitle: string,
   base: string,
+  subagentModel?: string,
 ): Promise<string> {
   // Pull only the gates this turn actually owns (Q3/Q4). Filter via the
   // registry so that scope:"slice" gates owned by other turns (Q8) can't
@@ -2128,10 +2133,11 @@ export async function buildGateEvaluatePrompt(
       "- `findings`: detailed markdown findings (or empty if omitted)",
     ].join("\n");
 
+    const modelSuffix = subagentModel ? ` with model: "${subagentModel}"` : "";
     subagentSections.push([
       `### ${def.id}: ${def.question}`,
       "",
-      "Use this as the prompt for a `subagent` call:",
+      `Use this as the prompt for a \`subagent\` call${modelSuffix}:`,
       "",
       "```",
       subPrompt,

package/src/resources/extensions/gsd/auto-start.ts

@@ -83,7 +83,11 @@ import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
-import { resolveDefaultSessionModel, resolveDynamicRoutingConfig } from "./preferences-models.js";
+import {
+  isCustomProvider,
+  resolveDefaultSessionModel,
+  resolveDynamicRoutingConfig,
+} from "./preferences-models.js";
 import type { WorktreeResolver } from "./worktree-resolver.js";
 import { getSessionModelOverride } from "./session-model-override.js";
 
@@ -274,8 +278,18 @@ export async function bootstrapAutoSession(
   //
   // This preserves #3517 defaults while honoring explicit runtime model
   // selection for subsequent /gsd runs in the same session.
+  //
+  // Exception (#4122): when the session provider is a custom provider declared
+  // in ~/.gsd/agent/models.json (Ollama, vLLM, OpenAI-compatible proxy, etc.),
+  // PREFERENCES.md is skipped entirely. PREFERENCES.md cannot reference custom
+  // providers, so honoring it would silently reroute auto-mode to a built-in
+  // provider the user is not logged into and surface as "Not logged in · Please
+  // run /login" before pausing and resetting to claude-code/claude-sonnet-4-6.
   const manualSessionOverride = getSessionModelOverride(ctx.sessionManager.getSessionId());
-  const preferredModel = resolveDefaultSessionModel(ctx.model?.provider);
+  const sessionProviderIsCustom = isCustomProvider(ctx.model?.provider);
+  const preferredModel = sessionProviderIsCustom
+    ? null
+    : resolveDefaultSessionModel(ctx.model?.provider);
   // Validate the preferred model against the live registry + provider auth so
   // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
   // start-model snapshot. Without this, every subsequent unit would try to
@@ -811,12 +825,19 @@ export async function bootstrapAutoSession(
       ? `${s.autoModeStartModel.provider}/${s.autoModeStartModel.id}`
       : ctx.model ? `${ctx.model.provider}/${ctx.model.id}` : "default";
 
-    // Flat-rate providers (e.g. GitHub Copilot, claude-code) suppress routing
-    // at dispatch time (#3453) — reflect that in the banner.
-    const { isFlatRateProvider } = await import("./auto-model-selection.js");
+    // Flat-rate providers (e.g. GitHub Copilot, claude-code, user-declared
+    // subscription proxies, externalCli CLIs) suppress routing at dispatch
+    // time (#3453) — reflect that in the banner.  Thread the same
+    // FlatRateContext used by selectAndApplyModel so user-declared
+    // flat-rate providers and externalCli auto-detection are respected.
+    const { isFlatRateProvider, buildFlatRateContext } = await import("./auto-model-selection.js");
+    const bannerPrefs = loadEffectiveGSDPreferences()?.preferences;
     const effectiveProvider = s.autoModeStartModel?.provider ?? ctx.model?.provider;
     const effectivelyEnabled = routingConfig.enabled
-      && !(effectiveProvider && isFlatRateProvider(effectiveProvider));
+      && !(effectiveProvider && isFlatRateProvider(
+        effectiveProvider,
+        buildFlatRateContext(effectiveProvider, ctx, bannerPrefs),
+      ));
 
     // The actual ceiling may come from tier_models.heavy, not the start model.
     const effectiveCeiling = (routingConfig.enabled && routingConfig.tier_models?.heavy)

package/src/resources/extensions/gsd/auto.ts

@@ -52,6 +52,7 @@ import {
   readCrashLock,
   isLockProcessAlive,
   formatCrashInfo,
+  emitCrashRecoveredUnitEnd,
 } from "./crash-recovery.js";
 import {
   acquireSessionLock,
@@ -1332,6 +1333,10 @@ export async function startAuto(
   }
 
   if (freshStartAssessment.lock) {
+    // Emit a synthetic unit-end for any unit-start that has no closing event.
+    // This closes the journal gap reported in #3348 where the worker wrote side
+    // effects (SUMMARY.md, DB updates) but died before emitting unit-end.
+    emitCrashRecoveredUnitEnd(base, freshStartAssessment.lock);
     clearLock(base);
   }
 

package/src/resources/extensions/gsd/bootstrap/crash-log.ts

@@ -0,0 +1,32 @@
+/**
+ * crash-log.ts — Write crash diagnostics to ~/.gsd/crash/<timestamp>.log
+ *
+ * Zero cross-dependencies: only uses Node.js built-ins so it can be imported
+ * safely from uncaughtException / unhandledRejection handlers and from tests
+ * without pulling in the full extension dependency tree.
+ */
+
+import { appendFileSync, mkdirSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+/**
+ * Write a crash log to ~/.gsd/crash/<timestamp>.log (or $GSD_HOME/crash/).
+ * Never throws — must be safe to call from any error handler.
+ */
+export function writeCrashLog(err: Error, source: string): void {
+  try {
+    const crashDir = join(process.env.GSD_HOME ?? join(homedir(), ".gsd"), "crash");
+    mkdirSync(crashDir, { recursive: true });
+    const ts = new Date().toISOString().replace(/[:.]/g, "-");
+    const logPath = join(crashDir, `${ts}.log`);
+    const lines = [
+      `[gsd] ${source}: ${err.message}`,
+      `timestamp: ${new Date().toISOString()}`,
+      `pid: ${process.pid}`,
+      err.stack ?? "(no stack trace available)",
+      "",
+    ];
+    appendFileSync(logPath, lines.join("\n"));
+  } catch { /* never throw from crash handler */ }
+}

package/src/resources/extensions/gsd/bootstrap/register-extension.ts

@@ -11,6 +11,9 @@ import { registerJournalTools } from "./journal-tools.js";
 import { registerQueryTools } from "./query-tools.js";
 import { registerHooks } from "./register-hooks.js";
 import { registerShortcuts } from "./register-shortcuts.js";
+import { writeCrashLog } from "./crash-log.js";
+
+export { writeCrashLog } from "./crash-log.js";
 
 export function handleRecoverableExtensionProcessError(err: Error): boolean {
   if ((err as NodeJS.ErrnoException).code === "EPIPE") {
@@ -33,16 +36,25 @@ export function handleRecoverableExtensionProcessError(err: Error): boolean {
 function installEpipeGuard(): void {
   if (!process.listeners("uncaughtException").some((listener) => listener.name === "_gsdEpipeGuard")) {
     const _gsdEpipeGuard = (err: Error): void => {
-      if (handleRecoverableExtensionProcessError(err)) {
-        return;
-      }
-      // Log unhandled errors instead of re-throwing — throwing inside an
-      // uncaughtException handler is a fatal double-fault in Node.js (#3163).
-      process.stderr.write(`[gsd] uncaught extension error (non-fatal): ${err.message}\n`);
-      if (err.stack) process.stderr.write(`${err.stack}\n`);
+      if (handleRecoverableExtensionProcessError(err)) return;
+      // Write crash log and exit cleanly for unrecoverable errors.
+      // Logging and continuing was the original double-fault fix (#3163), but
+      // continuing in an indeterminate state is worse than a clean exit (#3348).
+      writeCrashLog(err, "uncaughtException");
+      process.exit(1);
     };
     process.on("uncaughtException", _gsdEpipeGuard);
   }
+
+  if (!process.listeners("unhandledRejection").some((listener) => listener.name === "_gsdRejectionGuard")) {
+    const _gsdRejectionGuard = (reason: unknown, _promise: Promise<unknown>): void => {
+      const err = reason instanceof Error ? reason : new Error(String(reason));
+      if (handleRecoverableExtensionProcessError(err)) return;
+      writeCrashLog(err, "unhandledRejection");
+      process.exit(1);
+    };
+    process.on("unhandledRejection", _gsdRejectionGuard);
+  }
 }
 
 export function registerGsdExtension(pi: ExtensionAPI): void {

package/src/resources/extensions/gsd/bootstrap/system-context.ts

@@ -9,6 +9,7 @@ import { debugTime } from "../debug-logger.js";
 import { loadPrompt, getTemplatesDir } from "../prompt-loader.js";
 import { readForensicsMarker } from "../forensics.js";
 import { resolveAllSkillReferences, renderPreferencesForSystemPrompt, loadEffectiveGSDPreferences } from "../preferences.js";
+import { resolveModelWithFallbacksForUnit } from "../preferences-models.js";
 import { resolveSkillReference } from "../preferences-skills.js";
 import { resolveGsdRootFile, resolveSliceFile, resolveSlicePath, resolveTaskFile, resolveTaskFiles, resolveTasksDir, relSliceFile, relSlicePath, relTaskFile } from "../paths.js";
 import { ensureCodebaseMapFresh, readCodebaseMap } from "../codebase-generator.js";
@@ -175,7 +176,13 @@ export async function buildBeforeAgentStartResult(
   const forensicsInjection = !injection ? buildForensicsContextInjection(process.cwd(), event.prompt) : null;
 
   const worktreeBlock = buildWorktreeContextBlock();
-  const fullSystem = `${event.systemPrompt}\n\n[SYSTEM CONTEXT — GSD]\n\n${systemContent}${preferenceBlock}${knowledgeBlock}${codebaseBlock}${memoryBlock}${newSkillsBlock}${worktreeBlock}`;
+
+  const subagentModelConfig = resolveModelWithFallbacksForUnit("subagent");
+  const subagentModelBlock = subagentModelConfig
+    ? `\n\n## Subagent Model\n\nWhen spawning subagents via the \`subagent\` tool, always pass \`model: "${subagentModelConfig.primary}"\` in the tool call parameters. Never omit this — always specify it explicitly.`
+    : "";
+
+  const fullSystem = `${event.systemPrompt}\n\n[SYSTEM CONTEXT — GSD]\n\n${systemContent}${preferenceBlock}${knowledgeBlock}${codebaseBlock}${memoryBlock}${newSkillsBlock}${worktreeBlock}${subagentModelBlock}`;
 
   stopContextTimer({
     systemPromptSize: fullSystem.length,

package/src/resources/extensions/gsd/crash-recovery.ts

@@ -15,6 +15,7 @@ import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { effectiveLockFile } from "./session-lock.js";
+import { emitJournalEvent, queryJournal } from "./journal.js";
 
 export interface LockData {
   pid: number;
@@ -118,3 +119,61 @@ export function formatCrashInfo(lock: LockData): string {
 
   return lines.join("\n");
 }
+
+/**
+ * Emit a synthetic unit-end event for a unit that crashed without emitting its own.
+ *
+ * Queries the journal to find the most recent unit-start for the crashed unit.
+ * If a matching unit-end already exists (e.g. the hard timeout fired), this is a
+ * no-op. Called during crash recovery, before clearing the stale lock.
+ *
+ * Addresses the gap reported in #3348 where `unit-start` was emitted but no
+ * `unit-end` followed — side effects landed but the worker died before closeout.
+ */
+export function emitCrashRecoveredUnitEnd(basePath: string, lock: LockData): void {
+  // Skip bootstrap / starting pseudo-units — they have no meaningful unit-start event.
+  if (!lock.unitType || !lock.unitId || lock.unitType === "starting") return;
+
+  try {
+    const all = queryJournal(basePath);
+
+    // Find the most recent unit-start for this unitId
+    const starts = all.filter(
+      (e) => e.eventType === "unit-start" && e.data?.unitId === lock.unitId,
+    );
+    if (starts.length === 0) return;
+
+    const lastStart = starts[starts.length - 1];
+
+    // Check if a unit-end was already emitted (e.g. hard timeout fired after the crash)
+    const alreadyClosed = all.some(
+      (e) =>
+        e.eventType === "unit-end" &&
+        e.data?.unitId === lock.unitId &&
+        e.causedBy?.flowId === lastStart.flowId &&
+        e.causedBy?.seq === lastStart.seq,
+    );
+    if (alreadyClosed) return;
+
+    // Find the highest seq in this flow for monotonic ordering
+    const maxSeq = all
+      .filter((e) => e.flowId === lastStart.flowId)
+      .reduce((max, e) => Math.max(max, e.seq), lastStart.seq);
+
+    emitJournalEvent(basePath, {
+      ts: new Date().toISOString(),
+      flowId: lastStart.flowId,
+      seq: maxSeq + 1,
+      eventType: "unit-end",
+      data: {
+        unitType: lock.unitType,
+        unitId: lock.unitId,
+        status: "crash-recovered",
+        artifactVerified: false,
+      },
+      causedBy: { flowId: lastStart.flowId, seq: lastStart.seq },
+    });
+  } catch {
+    // Never throw from crash recovery path — journal failure must not block recovery
+  }
+}

package/src/resources/extensions/gsd/gsd-db.ts

@@ -1564,6 +1564,23 @@ export interface TaskRow {
   sequence: number;
 }
 
+function parseTaskArrayColumn(raw: unknown): string[] {
+  if (typeof raw !== "string" || raw.trim() === "") return [];
+
+  try {
+    const parsed = JSON.parse(raw);
+    if (Array.isArray(parsed)) return parsed.map((value) => String(value));
+    if (parsed === null || parsed === undefined || parsed === "") return [];
+    return [String(parsed)];
+  } catch {
+    // Older/corrupt rows may contain comma-separated strings instead of JSON.
+    return raw
+      .split(",")
+      .map((value) => value.trim())
+      .filter(Boolean);
+  }
+}
+
 function rowToTask(row: Record<string, unknown>): TaskRow {
   const parseTaskArray = (value: unknown): string[] => {
     if (Array.isArray(value)) {
@@ -1603,8 +1620,8 @@ function rowToTask(row: Record<string, unknown>): TaskRow {
     blocker_discovered: (row["blocker_discovered"] as number) === 1,
     deviations: row["deviations"] as string,
     known_issues: row["known_issues"] as string,
-    key_files: JSON.parse((row["key_files"] as string) || "[]"),
-    key_decisions: JSON.parse((row["key_decisions"] as string) || "[]"),
+    key_files: parseTaskArrayColumn(row["key_files"]),
+    key_decisions: parseTaskArrayColumn(row["key_decisions"]),
     full_summary_md: row["full_summary_md"] as string,
     description: (row["description"] as string) ?? "",
     estimate: (row["estimate"] as string) ?? "",
@@ -2200,6 +2217,39 @@ export function deleteSlice(milestoneId: string, sliceId: string): void {
   });
 }
 
+export function deleteMilestone(milestoneId: string): void {
+  if (!currentDb) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+  transaction(() => {
+    currentDb!.prepare(
+      `DELETE FROM verification_evidence WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM quality_gates WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM tasks WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM slice_dependencies WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM slices WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM replan_history WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM assessments WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM artifacts WHERE milestone_id = :mid`,
+    ).run({ ":mid": milestoneId });
+    currentDb!.prepare(
+      `DELETE FROM milestones WHERE id = :mid`,
+    ).run({ ":mid": milestoneId });
+  });
+}
+
 export function updateSliceFields(milestoneId: string, sliceId: string, fields: {
   title?: string;
   risk?: string;

package/src/resources/extensions/gsd/milestone-actions.ts

@@ -20,7 +20,8 @@ import {
 } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
-import { getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
+import { removeWorktree } from "./worktree-manager.js";
 import { logWarning } from "./workflow-logger.js";
 
 // ─── Park ──────────────────────────────────────────────────────────────────
@@ -110,6 +111,15 @@ export function discardMilestone(basePath: string, milestoneId: string): boolean
   const mDir = resolveMilestonePath(basePath, milestoneId);
   if (!mDir || !existsSync(mDir)) return false;
 
+  try {
+    removeWorktree(basePath, milestoneId, {
+      branch: `milestone/${milestoneId}`,
+      deleteBranch: true,
+    });
+  } catch (err) {
+    logWarning("engine", `discardMilestone worktree cleanup failed for ${milestoneId}: ${(err as Error).message}`);
+  }
+
   rmSync(mDir, { recursive: true, force: true });
 
   // Prune from queue order if present
@@ -118,6 +128,14 @@ export function discardMilestone(basePath: string, milestoneId: string): boolean
     saveQueueOrder(basePath, order.filter(id => id !== milestoneId));
   }
 
+  if (isDbAvailable()) {
+    try {
+      deleteMilestone(milestoneId);
+    } catch (err) {
+      logWarning("engine", `discardMilestone DB cleanup failed for ${milestoneId}: ${(err as Error).message}`);
+    }
+  }
+
   invalidateAllCaches();
   return true;
 }