gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.1594b263e

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -11,18 +11,21 @@ import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice, getMilestone } from "./gsd-db.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { nativeConflictFiles, nativeCommit, nativeCheckoutTheirs, nativeAddPaths, nativeMergeAbort, nativeResetHard, } from "./native-git-bridge.js";
+import { isClosedStatus } from "./status-guards.js";
+import { nativeConflictFiles, nativeCommit, nativeCheckoutTheirs, nativeAddPaths, nativeMergeAbort, nativeRebaseAbort, nativeResetHard, } from "./native-git-bridge.js";
 import { resolveSlicePath, resolveSliceFile, resolveTasksDir, resolveTaskFiles, relMilestoneFile, relSliceFile, buildSliceFileName, resolveMilestoneFile, clearPathCache, resolveGsdRootFile, } from "./paths.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, } from "./auto-artifact-paths.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 // Re-export so existing consumers of auto-recovery.ts keep working.
 export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
+export { classifyMilestoneSummaryContent, } from "./milestone-summary-classifier.js";
 // ─── Artifact Resolution & Verification ───────────────────────────────────────
 /**
  * Check whether a milestone produced implementation artifacts (non-`.gsd/` files)
@@ -220,12 +223,25 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     // RESEARCH file. Without this, resolveExpectedArtifactPath returns null and
     // the retry/escalation machinery silently re-dispatches forever.
     //
+    // #4068: Also treat a PARALLEL-BLOCKER placeholder as a terminal completion
+    // so that timeout-recovery can write the blocker, have verifyExpectedArtifact
+    // return true, and let the dispatch loop advance past this unit.  Without
+    // this, the blocker is written but verification still returns false, the unit
+    // is never cleared from unitDispatchCount, and on the next iteration the
+    // dispatch rule (which correctly skips parallel-research when PARALLEL-BLOCKER
+    // exists) returns null — leaving the loop stuck re-deriving indefinitely.
+    //
     // NOTE: this predicate mirrors the dispatch rule at
     // auto-dispatch.ts parallel-research-slices — keep the two in sync.
     if (unitType === "research-slice" && unitId.endsWith("/parallel-research")) {
         const { milestone: mid } = parseUnitId(unitId);
         if (!mid)
             return false;
+        // #4068: PARALLEL-BLOCKER written by timeout-recovery is a terminal state.
+        const blockerPath = resolveExpectedArtifactPath(unitType, unitId, base);
+        if (blockerPath && existsSync(blockerPath)) {
+            return true;
+        }
         const roadmapFile = resolveMilestoneFile(base, mid, "ROADMAP");
         if (!roadmapFile || !existsSync(roadmapFile)) {
             logWarning("recovery", `verify-fail ${unitType} ${unitId}: roadmap missing`);
@@ -420,6 +436,17 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     // A milestone with only .gsd/ plan files and zero implementation code is
     // not genuinely complete — the LLM wrote plan files but skipped actual work.
     if (unitType === "complete-milestone") {
+        const summaryOutcome = classifyMilestoneSummaryContent(readFileSync(absPath, "utf-8"));
+        if (summaryOutcome === "failure")
+            return false;
+        const { milestone: mid } = parseUnitId(unitId);
+        if (mid && isDbAvailable()) {
+            const dbMilestone = getMilestone(mid);
+            if (!dbMilestone)
+                return false;
+            if (!isClosedStatus(dbMilestone.status) && summaryOutcome !== "success")
+                return false;
+        }
         if (hasImplementationArtifacts(base) === "absent")
             return false;
     }
@@ -497,6 +524,24 @@ export function writeBlockerPlaceholder(unitType, unitId, base, reason) {
                 logWarning("recovery", `appendEvent failed for slice recovery: ${e instanceof Error ? e.message : String(e)}`);
             }
         }
+        // Insert a placeholder complete slice so deriveState sees activeMilestoneSlices.length > 0
+        // and exits the pre-planning phase. Without this, activeMilestoneSlices stays empty
+        // after the blocker ROADMAP.md is written, causing deriveState to return phase:'pre-planning'
+        // indefinitely and re-dispatching plan-milestone in an infinite loop (#4378).
+        if (unitType === "plan-milestone" && mid) {
+            try {
+                insertSlice({ id: "S00-blocker", milestoneId: mid, title: "Blocker placeholder — planning failed", status: "complete", sequence: 0 });
+            }
+            catch (e) {
+                logWarning("recovery", `insertSlice placeholder failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`);
+            }
+            try {
+                appendEvent(base, { cmd: "plan-milestone", params: { milestoneId: mid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" });
+            }
+            catch (e) {
+                logWarning("recovery", `appendEvent failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
     }
     return diagnoseExpectedArtifact(unitType, unitId, base);
 }
@@ -532,6 +577,72 @@ function abortAndResetMerge(basePath, hasMergeHead, squashMsgPath) {
         logError("recovery", `git reset failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/**
+ * Detect and abort other in-progress git operations left behind by a SIGKILL'd
+ * worker (rebase, cherry-pick, revert). Without this, a killed worker mid-rebase
+ * leaves `.git/rebase-merge/` or `.git/CHERRY_PICK_HEAD` and the worktree is
+ * wedged until the user manually runs the matching `--abort`.
+ *
+ * Called before merge-state reconciliation because these states block any
+ * subsequent merge/commit operation. (Issue #4980 HIGH-7)
+ */
+function reconcileOtherInProgressGitOps(basePath, ctx) {
+    const gitDir = join(basePath, ".git");
+    const states = [
+        {
+            label: "rebase",
+            indicators: [join(gitDir, "rebase-merge"), join(gitDir, "rebase-apply")],
+            abort: () => nativeRebaseAbort(basePath),
+        },
+        {
+            label: "cherry-pick",
+            indicators: [join(gitDir, "CHERRY_PICK_HEAD")],
+            abort: () => {
+                // No native helper; fall back to git CLI.
+                try {
+                    execFileSync("git", ["cherry-pick", "--abort"], {
+                        cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+                    });
+                }
+                catch (err) {
+                    logWarning("recovery", `cherry-pick --abort failed: ${getErrorMessage(err)}`);
+                }
+            },
+        },
+        {
+            label: "revert",
+            indicators: [join(gitDir, "REVERT_HEAD")],
+            abort: () => {
+                try {
+                    execFileSync("git", ["revert", "--abort"], {
+                        cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+                    });
+                }
+                catch (err) {
+                    logWarning("recovery", `revert --abort failed: ${getErrorMessage(err)}`);
+                }
+            },
+        },
+    ];
+    let reconciled = false;
+    for (const s of states) {
+        const present = s.indicators.some((p) => existsSync(p));
+        if (!present)
+            continue;
+        try {
+            s.abort();
+            ctx.ui.notify(`Detected leftover ${s.label} state from prior session — aborted.`, "warning");
+            reconciled = true;
+        }
+        catch (err) {
+            logError("recovery", `${s.label} abort failed: ${getErrorMessage(err)}`);
+            ctx.ui.notify(`Detected leftover ${s.label} state but auto-abort failed. ` +
+                `Run \`git ${s.label} --abort\` manually before retrying.`, "error");
+            return "blocked";
+        }
+    }
+    return reconciled ? "reconciled" : "clean";
+}
 /**
  * Detect leftover merge state from a prior session and reconcile it.
  * If MERGE_HEAD or SQUASH_MSG exists, check whether conflicts are resolved.
@@ -539,12 +650,21 @@ function abortAndResetMerge(basePath, hasMergeHead, squashMsgPath) {
  * If code conflicts remain: fail safe without modifying the worktree.
  */
 export function reconcileMergeState(basePath, ctx) {
+    // First, abort any rebase/cherry-pick/revert left over from a SIGKILL'd
+    // worker. Doing this before the merge-state check unblocks any merge that
+    // would otherwise refuse with "you have unfinished operation". (HIGH-7)
+    const otherOpsResult = reconcileOtherInProgressGitOps(basePath, ctx);
+    if (otherOpsResult === "blocked")
+        return "blocked";
     const mergeHeadPath = join(basePath, ".git", "MERGE_HEAD");
     const squashMsgPath = join(basePath, ".git", "SQUASH_MSG");
     const hasMergeHead = existsSync(mergeHeadPath);
     const hasSquashMsg = existsSync(squashMsgPath);
-    if (!hasMergeHead && !hasSquashMsg)
-        return "clean";
+    if (!hasMergeHead && !hasSquashMsg) {
+        // If we cleaned up another op type, return "reconciled" so the caller
+        // re-derives state from a known-good baseline.
+        return otherOpsResult === "reconciled" ? "reconciled" : "clean";
+    }
     const conflictedFiles = nativeConflictFiles(basePath);
     if (conflictedFiles.length === 0) {
         // All conflicts resolved — finalize the merge/squash commit

package/dist/resources/extensions/gsd/auto-start.js

@@ -19,22 +19,24 @@ import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
-import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, } from "./native-git-bridge.js";
+import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
 import { getAutoWorktreePath } from "./auto-worktree.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
+import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
 import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
-import { hideFooter } from "./auto-dashboard.js";
+import { isClosedStatus } from "./status-guards.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
 import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
@@ -62,25 +64,15 @@ export async function openProjectDbIfPresent(basePath) {
         logWarning("engine", `gsd-db: failed to open existing database: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/**
- * Audit for orphaned milestone branches at bootstrap.
- *
- * After a milestone completes, the teardown step (merge branch → main,
- * delete branch, remove worktree) runs as a post-completion engine step.
- * If the session ends between completion and teardown, the branch and
- * worktree are orphaned — the DB says "complete" so auto-mode won't
- * re-enter the milestone, and the teardown is never retried.
- *
- * This audit runs on every fresh bootstrap to catch that gap:
- * 1. Lists all local `milestone/*` branches.
- * 2. For each, checks if the milestone's DB status is "complete".
- * 3. If the branch is already merged into main → deletes the branch
- *    and cleans up any orphaned worktree directory (safe, no data loss).
- * 4. If the branch is NOT merged → preserves it and warns the user
- *    so they can merge manually (data safety first).
- *
- * Returns a summary of actions taken for the caller to surface via notify.
- */
+export function decideSurvivorAction(hasSurvivorBranch, phase) {
+    if (!hasSurvivorBranch)
+        return "none";
+    if (phase === "needs-discussion")
+        return "discuss";
+    if (phase === "complete")
+        return "finalize";
+    return "none";
+}
 export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     const recovered = [];
     const warnings = [];
@@ -119,10 +111,58 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     for (const branch of milestoneBranches) {
         const milestoneId = branch.replace(/^milestone\//, "");
         const milestone = getMilestone(milestoneId);
-        // Only audit completed milestones
-        if (!milestone || milestone.status !== "complete")
+        if (!milestone)
             continue;
         const isMerged = mergedBranches.has(branch);
+        // #4762 — in-progress milestone branch with unmerged commits ahead of
+        // main. This is the pre-completion orphan case: auto-mode exited without
+        // completing the milestone (pause, stop, crash, merge error, blocker) and
+        // work is stranded on the branch or in the worktree. Data safety first:
+        // we never delete or touch; we just surface a warning so the user knows
+        // where to look.
+        //
+        // Gate on isClosedStatus so we only warn about genuinely open milestones.
+        // Parked/other closed statuses go through the legacy complete/unmerged
+        // path below where appropriate.
+        if (!isClosedStatus(milestone.status)) {
+            if (isMerged)
+                continue; // nothing to recover
+            let commitsAhead = 0;
+            try {
+                commitsAhead = nativeCommitCountBetween(basePath, mainBranch, branch);
+            }
+            catch {
+                // Rev-walk failure — skip rather than noise
+                continue;
+            }
+            if (commitsAhead === 0)
+                continue;
+            const wtDir = getWorktreeDir(basePath, milestoneId);
+            const wtDirExists = existsSync(wtDir);
+            const wtSuffix = wtDirExists
+                ? ` Worktree directory at .gsd/worktrees/${milestoneId}/ holds the live work.`
+                : "";
+            warnings.push(`Branch ${branch} has ${commitsAhead} commit(s) ahead of ${mainBranch} for in-progress milestone ${milestoneId}.` +
+                wtSuffix +
+                ` Run \`/gsd auto\` to resume, or merge manually if abandoning.`);
+            // #4764 telemetry
+            try {
+                emitWorktreeOrphaned(basePath, milestoneId, {
+                    reason: "in-progress-unmerged",
+                    commitsAhead,
+                    worktreeDirExists: wtDirExists,
+                });
+            }
+            catch (err) {
+                logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            continue;
+        }
+        // Only the "complete" status participates in the merged/unmerged cleanup
+        // paths below — other closed statuses (parked, etc.) are intentionally
+        // left alone.
+        if (milestone.status !== "complete")
+            continue;
         if (isMerged) {
             // Branch is merged — safe to delete branch and clean up worktree dir
             try {
@@ -169,6 +209,16 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
             // Branch is NOT merged — preserve for safety, warn the user
             warnings.push(`Branch ${branch} exists for completed milestone ${milestoneId} but is NOT merged into ${mainBranch}. ` +
                 `This may contain unmerged work. Merge manually or run \`/gsd health --fix\` to resolve.`);
+            // #4764 telemetry
+            try {
+                emitWorktreeOrphaned(basePath, milestoneId, {
+                    reason: "complete-unmerged",
+                    worktreeDirExists: existsSync(getWorktreeDir(basePath, milestoneId)),
+                });
+            }
+            catch (err) {
+                logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
         }
     }
     return { recovered, warnings };
@@ -312,11 +362,32 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // Invalidate caches before initial state derivation
         invalidateAllCaches();
-        // Clean stale runtime unit files for completed milestones (#887)
-        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => !!resolveMilestoneFile(base, mid, "SUMMARY"));
         // Open the project-root DB before deriveState so DB-backed state
         // derivation (queue-order, task status) works on a cold start (#2841).
+        // Must happen before cleanStaleRuntimeUnits so the cleanup predicate can
+        // consult DB status and avoid clearing runtime units for milestones that
+        // only have a failure-path SUMMARY on disk (#4663).
         await openProjectDbIfPresent(base);
+        // Clean stale runtime unit files for completed milestones (#887).
+        // DB-authoritative: when DB is available, require DB status to be closed
+        // before clearing runtime units. A SUMMARY file alone is no longer
+        // trusted as proof of completion (#4663). Fall back to SUMMARY-file
+        // presence only when DB is unavailable (legacy/pre-migration).
+        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => {
+            if (isDbAvailable()) {
+                const row = getMilestone(mid);
+                return !!row && isClosedStatus(row.status);
+            }
+            const summaryFile = resolveMilestoneFile(base, mid, "SUMMARY");
+            if (!summaryFile)
+                return false;
+            try {
+                return classifyMilestoneSummaryContent(readFileSync(summaryFile, "utf-8")) !== "failure";
+            }
+            catch {
+                return false;
+            }
+        });
         // ── Orphaned milestone branch audit ──
         // Catches completed milestones whose teardown (merge + branch delete)
         // was lost due to session ending between completion and teardown.
@@ -369,7 +440,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The worktree/branch was created but the milestone only has CONTEXT-DRAFT.md.
         // Route to the interactive discussion handler instead of falling through to
         // auto-mode, which would immediately stop with "needs discussion".
-        if (hasSurvivorBranch && state.phase === "needs-discussion") {
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "discuss") {
             const { showSmartEntry } = await import("./guided-flow.js");
             await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
             invalidateAllCaches();
@@ -389,7 +460,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The milestone artifacts were written but finalization (merge, worktree
         // cleanup) never ran. Run mergeAndExit to finalize, then re-derive state
         // so the normal "all milestones complete" or "next milestone" path runs.
-        if (hasSurvivorBranch && state.phase === "complete") {
+        // Re-evaluate via the helper — the discuss branch above may have cleared
+        // hasSurvivorBranch after a successful promotion.
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
             ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
             const resolver = buildResolver();
@@ -416,29 +489,15 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 }
                 const { showSmartEntry } = await import("./guided-flow.js");
                 await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
-                invalidateAllCaches();
-                const postState = await deriveState(base);
-                if (postState.activeMilestone &&
-                    postState.phase !== "complete" &&
-                    postState.phase !== "pre-planning") {
-                    s.consecutiveCompleteBootstraps = 0; // Successfully advanced past "complete"
-                    state = postState;
-                }
-                else if (postState.activeMilestone &&
-                    postState.phase === "pre-planning") {
-                    const contextFile = resolveMilestoneFile(base, postState.activeMilestone.id, "CONTEXT");
-                    const hasContext = !!(contextFile && (await loadFile(contextFile)));
-                    if (hasContext) {
-                        state = postState;
-                    }
-                    else {
-                        ctx.ui.notify("Discussion completed but no milestone context was written. Run /gsd to try the discussion again, or /gsd auto after creating the milestone manually.", "warning");
-                        return releaseLockAndReturn();
-                    }
-                }
-                else {
-                    return releaseLockAndReturn();
-                }
+                // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+                // it queues the message and returns immediately, before the LLM turn runs.
+                // Checking postState here would always see the pre-dispatch state, causing
+                // the premature "Discussion completed but..." warning (#3420).
+                //
+                // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+                // auto-mode by calling startAutoDetached after the discussion completes.
+                // Release the lock and let the async dispatch proceed.
+                return releaseLockAndReturn();
             }
             // Active milestone exists but has no roadmap
             if (state.phase === "pre-planning") {
@@ -448,15 +507,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 if (!hasContext) {
                     const { showSmartEntry } = await import("./guided-flow.js");
                     await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
-                    invalidateAllCaches();
-                    const postState = await deriveState(base);
-                    if (postState.activeMilestone && postState.phase !== "pre-planning") {
-                        state = postState;
-                    }
-                    else {
-                        ctx.ui.notify("Discussion completed but milestone context is still missing. Run /gsd to try again.", "warning");
-                        return releaseLockAndReturn();
-                    }
+                    // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+                    // it queues the message and returns immediately, before the LLM turn runs.
+                    // Checking postState here fires before the LLM has had a turn, so the
+                    // pre-planning phase would still appear unchanged and a premature warning
+                    // would be emitted (#3420).
+                    //
+                    // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+                    // auto-mode by calling startAutoDetached after the discussion completes.
+                    // Release the lock and let the async dispatch proceed.
+                    return releaseLockAndReturn();
                 }
             }
             // Active milestone has CONTEXT-DRAFT but no full context — needs discussion
@@ -650,9 +710,6 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             snapshotSkills();
         }
         ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
-        ctx.ui.setFooter(hideFooter);
-        // Hide gsd-health during AUTO — gsd-progress is the single source of truth
-        // for last-commit / cost / health signal while auto is running.
         ctx.ui.setWidget("gsd-health", undefined);
         const modeLabel = s.stepMode ? "Step-mode" : "Auto-mode";
         const pendingCount = (state.registry ?? []).filter((m) => m.status !== "complete" && m.status !== "parked").length;
@@ -711,14 +768,32 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         catch (err) {
             ctx.ui.notify(`Secrets collection error: ${err instanceof Error ? err.message : String(err)}. Continuing with next task.`, "warning");
         }
-        // Self-heal: remove stale .git/index.lock
+        // Self-heal: remove stale .git/index.lock.
+        //
+        // Threshold raised from 60s → 5min because a 60s-old lock is not
+        // definitively stale: `git gc --auto` triggered by a heavy commit, NFS
+        // delays, or concurrent worktree writes can hold .git/index.lock for
+        // minutes on large repos. Force-removing a live lock causes the holder
+        // to encounter `fatal: Unable to create '.git/index.lock'` on its next
+        // write, or worse, operate on a partially-written index → corruption
+        // requiring `git fsck`/`git reset` to recover.
+        // (Issue #4980 CRIT-3)
         try {
             const gitLockFile = join(base, ".git", "index.lock");
             if (existsSync(gitLockFile)) {
                 const lockAge = Date.now() - statSync(gitLockFile).mtimeMs;
-                if (lockAge > 60_000) {
+                const STALE_GIT_LOCK_THRESHOLD_MS = 5 * 60_000;
+                if (lockAge > STALE_GIT_LOCK_THRESHOLD_MS) {
                     unlinkSync(gitLockFile);
-                    ctx.ui.notify("Removed stale .git/index.lock from prior crash.", "info");
+                    ctx.ui.notify(`Removed stale .git/index.lock (age ${Math.round(lockAge / 1000)}s, > 5min threshold).`, "warning");
+                }
+                else {
+                    // Lock present but not yet stale — surface so the user knows why
+                    // git ops may be queueing instead of silently waiting.
+                    debugLog("git-lock-present-not-stale", {
+                        ageMs: lockAge,
+                        thresholdMs: STALE_GIT_LOCK_THRESHOLD_MS,
+                    });
                 }
             }
         }

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -6,8 +6,14 @@
 import { readUnitRuntimeRecord, writeUnitRuntimeRecord, formatExecuteTaskRecoveryStatus, inspectExecuteTaskDurability, } from "./unit-runtime.js";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, writeBlockerPlaceholder, } from "./auto-recovery.js";
 import { existsSync } from "node:fs";
-import { resolveAgentEnd } from "./auto-loop.js";
+import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rctx) {
+    // Note on turn epoch: the bump is intentionally NOT unconditional at
+    // function entry. Two branches below (the "steering retry" paths) keep
+    // the same LLM turn alive and let it try again — they must NOT bump,
+    // otherwise the retry's legitimate writes get marked stale and drop.
+    // Each advance branch calls `bumpAndResolveSynthetic` to bump+resolve
+    // atomically. Search for that helper to find all supersede sites.
     const { basePath, verbose, currentUnitStartedAt, unitRecoveryCount } = rctx;
     const runtime = readUnitRuntimeRecord(basePath, unitType, unitId);
     const recoveryAttempts = runtime?.recoveryAttempts ?? 0;
@@ -36,7 +42,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         if (recoveryAttempts < maxRecoveryAttempts) {
@@ -90,7 +96,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts (${diagnostic}). Blocker artifacts written. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         // Fallback: couldn't write skip artifacts — pause as before.
@@ -115,7 +121,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} artifact already exists on disk. Advancing. (attempt ${attemptNumber})`, "info");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     if (recoveryAttempts < maxRecoveryAttempts) {
@@ -180,7 +186,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts. Blocker placeholder written to ${placeholder}. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     // Fallback: couldn't resolve artifact path — pause as before.

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -77,20 +77,21 @@ export function clearInFlightTools() {
 }
 // ─── Tool invocation error classification (#2883) ────────────────────────
 /**
- * Patterns that indicate a tool invocation failed due to malformed or truncated
- * JSON arguments — as opposed to a normal business-logic error from the tool
- * handler. When these errors occur, retrying the same unit will produce the same
- * failure, so the retry loop must be broken.
+ * Patterns that indicate a tool invocation failed deterministically before
+ * useful work could be completed — as opposed to a normal business-logic error
+ * from the tool handler. When these errors occur, retrying the same unit will
+ * produce the same failure, so the retry loop must be broken.
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON/i;
+const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
 /**
- * Returns true if the error message indicates a tool invocation failure due to
- * malformed/truncated arguments (as opposed to a normal tool execution error).
+ * Returns true if the error message indicates a deterministic invocation or
+ * policy failure (as opposed to a normal tool execution error).
  */
 export function isToolInvocationError(errorMsg) {
     if (!errorMsg)
         return false;
-    return TOOL_INVOCATION_ERROR_RE.test(errorMsg);
+    return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
 /**
  * Returns true if the error message indicates the tool was skipped because
@@ -102,3 +103,42 @@ export function isQueuedUserMessageSkip(errorMsg) {
         return false;
     return /^Skipped due to queued user message\.?$/i.test(errorMsg.trim());
 }
+// ─── Deterministic policy error classification (#4973, #4974) ──────────────
+/**
+ * Known deterministic policy error substrings. Each entry is a stable string
+ * that will appear in the tool error text content when the corresponding
+ * policy gate fires. Retrying these errors will always produce the same outcome.
+ *
+ * Add new entries here as new deterministic gates are introduced. Do NOT use
+ * regex — explicit substrings keep the list auditable.
+ */
+export const DETERMINISTIC_POLICY_ERROR_STRINGS = [
+    // gsd_summary_save write-gate: CONTEXT artifact blocked pending depth verification (#4973).
+    // Matches the fallback text in workflow-tool-executors.ts and the verbose reason
+    // from shouldBlockContextArtifactSaveInSnapshot at write-gate.ts:432-442.
+    "context write blocked",
+    "CONTEXT without depth verification",
+    // Raw write tool gate (#4973): shouldBlockContextWrite at write-gate.ts:390-399 emits
+    // "Cannot write to milestone CONTEXT.md without depth verification." for direct
+    // write tool calls to *-CONTEXT.md paths (different code path than gsd_summary_save).
+    "CONTEXT.md without depth verification",
+];
+/**
+ * Returns true if the error message indicates a deterministic policy gate
+ * blocked the tool call before execution. Retrying the same unit without
+ * changing behavior will hit the same gate, so auto-mode should pause instead
+ * of re-dispatching.
+ *
+ * Combines the regex-based gate set from #4974 (HARD BLOCK / queue planning /
+ * STATE.md / mechanical gate) and the substring-based set from #4973 (context
+ * write block / CONTEXT depth verification). Both branches landed on main
+ * independently and their parallel `isDeterministicPolicyError` declarations
+ * were not deduplicated at merge — this consolidated form preserves both
+ * matchers under a single export.
+ */
+export function isDeterministicPolicyError(errorMsg) {
+    if (!errorMsg)
+        return false;
+    return (DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg) ||
+        DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s)));
+}

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -20,9 +20,18 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import('./memory-extractor.js');
             const llmCallFn = buildMemoryLLMCall(ctx);
             if (llmCallFn) {
-                extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn).catch((err) => {
+                // Awaited: a fire-and-forget here lets memory-extractor writes land in
+                // .gsd/ after closeoutUnit returns but before the milestone merge
+                // runs, which made the working tree appear dirty to `git merge
+                // --squash` (root cause class of #4704). Completion latency is now
+                // bounded by the extractor's LLM call, which is the acceptable price
+                // for not racing the merge boundary.
+                try {
+                    await extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn);
+                }
+                catch (err) {
                     logWarning("engine", `memory extraction failed for ${unitType}/${unitId}: ${err.message}`);
-                });
+                }
             }
         }
         catch (err) { /* non-fatal */