gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.1594b263e

package/src/resources/extensions/gsd/auto-recovery.ts

@@ -13,16 +13,18 @@ import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice, getMilestone } from "./gsd-db.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
+import { isClosedStatus } from "./status-guards.js";
 import {
   nativeConflictFiles,
   nativeCommit,
   nativeCheckoutTheirs,
   nativeAddPaths,
   nativeMergeAbort,
+  nativeRebaseAbort,
   nativeResetHard,
 } from "./native-git-bridge.js";
 import {
@@ -50,9 +52,14 @@ import {
   resolveExpectedArtifactPath,
   diagnoseExpectedArtifact,
 } from "./auto-artifact-paths.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 
 // Re-export so existing consumers of auto-recovery.ts keep working.
 export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
+export {
+  classifyMilestoneSummaryContent,
+  type MilestoneSummaryOutcome,
+} from "./milestone-summary-classifier.js";
 
 // ─── Artifact Resolution & Verification ───────────────────────────────────────
 
@@ -268,11 +275,26 @@ export function verifyExpectedArtifact(
   // RESEARCH file. Without this, resolveExpectedArtifactPath returns null and
   // the retry/escalation machinery silently re-dispatches forever.
   //
+  // #4068: Also treat a PARALLEL-BLOCKER placeholder as a terminal completion
+  // so that timeout-recovery can write the blocker, have verifyExpectedArtifact
+  // return true, and let the dispatch loop advance past this unit.  Without
+  // this, the blocker is written but verification still returns false, the unit
+  // is never cleared from unitDispatchCount, and on the next iteration the
+  // dispatch rule (which correctly skips parallel-research when PARALLEL-BLOCKER
+  // exists) returns null — leaving the loop stuck re-deriving indefinitely.
+  //
   // NOTE: this predicate mirrors the dispatch rule at
   // auto-dispatch.ts parallel-research-slices — keep the two in sync.
   if (unitType === "research-slice" && unitId.endsWith("/parallel-research")) {
     const { milestone: mid } = parseUnitId(unitId);
     if (!mid) return false;
+
+    // #4068: PARALLEL-BLOCKER written by timeout-recovery is a terminal state.
+    const blockerPath = resolveExpectedArtifactPath(unitType, unitId, base);
+    if (blockerPath && existsSync(blockerPath)) {
+      return true;
+    }
+
     const roadmapFile = resolveMilestoneFile(base, mid, "ROADMAP");
     if (!roadmapFile || !existsSync(roadmapFile)) {
       logWarning("recovery", `verify-fail ${unitType} ${unitId}: roadmap missing`);
@@ -462,6 +484,14 @@ export function verifyExpectedArtifact(
   // A milestone with only .gsd/ plan files and zero implementation code is
   // not genuinely complete — the LLM wrote plan files but skipped actual work.
   if (unitType === "complete-milestone") {
+    const summaryOutcome = classifyMilestoneSummaryContent(readFileSync(absPath, "utf-8"));
+    if (summaryOutcome === "failure") return false;
+    const { milestone: mid } = parseUnitId(unitId);
+    if (mid && isDbAvailable()) {
+      const dbMilestone = getMilestone(mid);
+      if (!dbMilestone) return false;
+      if (!isClosedStatus(dbMilestone.status) && summaryOutcome !== "success") return false;
+    }
     if (hasImplementationArtifacts(base) === "absent") return false;
   }
 
@@ -532,6 +562,16 @@ export function writeBlockerPlaceholder(
       try { updateSliceStatus(mid, sid, "complete", ts); } catch (e) { logWarning("recovery", `updateSliceStatus failed during context exhaustion: ${e instanceof Error ? e.message : String(e)}`); }
       try { appendEvent(base, { cmd: "complete-slice", params: { milestoneId: mid, sliceId: sid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" }); } catch (e) { logWarning("recovery", `appendEvent failed for slice recovery: ${e instanceof Error ? e.message : String(e)}`); }
     }
+    // Insert a placeholder complete slice so deriveState sees activeMilestoneSlices.length > 0
+    // and exits the pre-planning phase. Without this, activeMilestoneSlices stays empty
+    // after the blocker ROADMAP.md is written, causing deriveState to return phase:'pre-planning'
+    // indefinitely and re-dispatching plan-milestone in an infinite loop (#4378).
+    if (unitType === "plan-milestone" && mid) {
+      try {
+        insertSlice({ id: "S00-blocker", milestoneId: mid, title: "Blocker placeholder — planning failed", status: "complete", sequence: 0 });
+      } catch (e) { logWarning("recovery", `insertSlice placeholder failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`); }
+      try { appendEvent(base, { cmd: "plan-milestone", params: { milestoneId: mid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" }); } catch (e) { logWarning("recovery", `appendEvent failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`); }
+    }
   }
 
   return diagnoseExpectedArtifact(unitType, unitId, base);
@@ -573,6 +613,79 @@ function abortAndResetMerge(
 
 export type MergeReconcileResult = "clean" | "reconciled" | "blocked";
 
+/**
+ * Detect and abort other in-progress git operations left behind by a SIGKILL'd
+ * worker (rebase, cherry-pick, revert). Without this, a killed worker mid-rebase
+ * leaves `.git/rebase-merge/` or `.git/CHERRY_PICK_HEAD` and the worktree is
+ * wedged until the user manually runs the matching `--abort`.
+ *
+ * Called before merge-state reconciliation because these states block any
+ * subsequent merge/commit operation. (Issue #4980 HIGH-7)
+ */
+function reconcileOtherInProgressGitOps(
+  basePath: string,
+  ctx: ExtensionContext,
+): "clean" | "reconciled" | "blocked" {
+  const gitDir = join(basePath, ".git");
+  const states: Array<{
+    label: string;
+    indicators: string[];
+    abort: () => void;
+  }> = [
+    {
+      label: "rebase",
+      indicators: [join(gitDir, "rebase-merge"), join(gitDir, "rebase-apply")],
+      abort: () => nativeRebaseAbort(basePath),
+    },
+    {
+      label: "cherry-pick",
+      indicators: [join(gitDir, "CHERRY_PICK_HEAD")],
+      abort: () => {
+        // No native helper; fall back to git CLI.
+        try {
+          execFileSync("git", ["cherry-pick", "--abort"], {
+            cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+          });
+        } catch (err) { logWarning("recovery", `cherry-pick --abort failed: ${getErrorMessage(err)}`); }
+      },
+    },
+    {
+      label: "revert",
+      indicators: [join(gitDir, "REVERT_HEAD")],
+      abort: () => {
+        try {
+          execFileSync("git", ["revert", "--abort"], {
+            cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+          });
+        } catch (err) { logWarning("recovery", `revert --abort failed: ${getErrorMessage(err)}`); }
+      },
+    },
+  ];
+
+  let reconciled = false;
+  for (const s of states) {
+    const present = s.indicators.some((p) => existsSync(p));
+    if (!present) continue;
+    try {
+      s.abort();
+      ctx.ui.notify(
+        `Detected leftover ${s.label} state from prior session — aborted.`,
+        "warning",
+      );
+      reconciled = true;
+    } catch (err) {
+      logError("recovery", `${s.label} abort failed: ${getErrorMessage(err)}`);
+      ctx.ui.notify(
+        `Detected leftover ${s.label} state but auto-abort failed. ` +
+        `Run \`git ${s.label} --abort\` manually before retrying.`,
+        "error",
+      );
+      return "blocked";
+    }
+  }
+  return reconciled ? "reconciled" : "clean";
+}
+
 /**
  * Detect leftover merge state from a prior session and reconcile it.
  * If MERGE_HEAD or SQUASH_MSG exists, check whether conflicts are resolved.
@@ -583,11 +696,21 @@ export function reconcileMergeState(
   basePath: string,
   ctx: ExtensionContext,
 ): MergeReconcileResult {
+  // First, abort any rebase/cherry-pick/revert left over from a SIGKILL'd
+  // worker. Doing this before the merge-state check unblocks any merge that
+  // would otherwise refuse with "you have unfinished operation". (HIGH-7)
+  const otherOpsResult = reconcileOtherInProgressGitOps(basePath, ctx);
+  if (otherOpsResult === "blocked") return "blocked";
+
   const mergeHeadPath = join(basePath, ".git", "MERGE_HEAD");
   const squashMsgPath = join(basePath, ".git", "SQUASH_MSG");
   const hasMergeHead = existsSync(mergeHeadPath);
   const hasSquashMsg = existsSync(squashMsgPath);
-  if (!hasMergeHead && !hasSquashMsg) return "clean";
+  if (!hasMergeHead && !hasSquashMsg) {
+    // If we cleaned up another op type, return "reconciled" so the caller
+    // re-derives state from a known-good baseline.
+    return otherOpsResult === "reconciled" ? "reconciled" : "clean";
+  }
 
   const conflictedFiles = nativeConflictFiles(basePath);
   if (conflictedFiles.length === 0) {

package/src/resources/extensions/gsd/auto-start.ts

@@ -45,6 +45,7 @@ import {
   nativeBranchListMerged,
   nativeBranchDelete,
   nativeWorktreeRemove,
+  nativeCommitCountBetween,
 } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import {
@@ -55,13 +56,16 @@ import {
 import { getAutoWorktreePath, isInAutoWorktree } from "./auto-worktree.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
+import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
 import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
-import { hideFooter } from "./auto-dashboard.js";
+import { isClosedStatus } from "./status-guards.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
+
 import {
   debugLog,
   enableDebug,
@@ -74,6 +78,7 @@ import type { AutoSession } from "./auto/session.js";
 import {
   existsSync,
   mkdirSync,
+  readFileSync,
   readdirSync,
   rmSync,
   statSync,
@@ -141,6 +146,35 @@ export async function openProjectDbIfPresent(basePath: string): Promise<void> {
  *
  * Returns a summary of actions taken for the caller to surface via notify.
  */
+/**
+ * Decide which survivor-branch recovery action bootstrapAutoSession must
+ * run for the current (hasSurvivorBranch, phase) combination. Extracted
+ * from the inline chain at `bootstrapAutoSession` (around line 604) so
+ * the decision table is testable without constructing a full session.
+ *
+ * - `none`     — no survivor, or phase doesn't call for recovery. Fall
+ *                through to normal bootstrap flow.
+ * - `discuss`  — survivor + phase=needs-discussion (#1726). Route to
+ *                showSmartEntry.
+ * - `finalize` — survivor + phase=complete (#2358). Run mergeAndExit to
+ *                merge the milestone branch and clear the worktree.
+ *
+ * Any other phase with a survivor (pre-planning, planning, executing…)
+ * returns `none` — the caller continues its normal flow and the
+ * survivor branch participates in whatever auto-mode happens next.
+ */
+export type SurvivorAction = "none" | "discuss" | "finalize";
+
+export function decideSurvivorAction(
+  hasSurvivorBranch: boolean,
+  phase: string | null | undefined,
+): SurvivorAction {
+  if (!hasSurvivorBranch) return "none";
+  if (phase === "needs-discussion") return "discuss";
+  if (phase === "complete") return "finalize";
+  return "none";
+}
+
 export function auditOrphanedMilestoneBranches(
   basePath: string,
   isolationMode: "worktree" | "branch" | "none",
@@ -184,11 +218,61 @@ export function auditOrphanedMilestoneBranches(
     const milestoneId = branch.replace(/^milestone\//, "");
     const milestone = getMilestone(milestoneId);
 
-    // Only audit completed milestones
-    if (!milestone || milestone.status !== "complete") continue;
+    if (!milestone) continue;
 
     const isMerged = mergedBranches.has(branch);
 
+    // #4762 — in-progress milestone branch with unmerged commits ahead of
+    // main. This is the pre-completion orphan case: auto-mode exited without
+    // completing the milestone (pause, stop, crash, merge error, blocker) and
+    // work is stranded on the branch or in the worktree. Data safety first:
+    // we never delete or touch; we just surface a warning so the user knows
+    // where to look.
+    //
+    // Gate on isClosedStatus so we only warn about genuinely open milestones.
+    // Parked/other closed statuses go through the legacy complete/unmerged
+    // path below where appropriate.
+    if (!isClosedStatus(milestone.status)) {
+      if (isMerged) continue; // nothing to recover
+      let commitsAhead = 0;
+      try {
+        commitsAhead = nativeCommitCountBetween(basePath, mainBranch, branch);
+      } catch {
+        // Rev-walk failure — skip rather than noise
+        continue;
+      }
+      if (commitsAhead === 0) continue;
+
+      const wtDir = getWorktreeDir(basePath, milestoneId);
+      const wtDirExists = existsSync(wtDir);
+      const wtSuffix = wtDirExists
+        ? ` Worktree directory at .gsd/worktrees/${milestoneId}/ holds the live work.`
+        : "";
+      warnings.push(
+        `Branch ${branch} has ${commitsAhead} commit(s) ahead of ${mainBranch} for in-progress milestone ${milestoneId}.` +
+        wtSuffix +
+        ` Run \`/gsd auto\` to resume, or merge manually if abandoning.`,
+      );
+
+      // #4764 telemetry
+      try {
+        emitWorktreeOrphaned(basePath, milestoneId, {
+          reason: "in-progress-unmerged",
+          commitsAhead,
+          worktreeDirExists: wtDirExists,
+        });
+      } catch (err) {
+        logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+      }
+
+      continue;
+    }
+
+    // Only the "complete" status participates in the merged/unmerged cleanup
+    // paths below — other closed statuses (parked, etc.) are intentionally
+    // left alone.
+    if (milestone.status !== "complete") continue;
+
     if (isMerged) {
       // Branch is merged — safe to delete branch and clean up worktree dir
       try {
@@ -233,6 +317,16 @@ export function auditOrphanedMilestoneBranches(
         `Branch ${branch} exists for completed milestone ${milestoneId} but is NOT merged into ${mainBranch}. ` +
         `This may contain unmerged work. Merge manually or run \`/gsd health --fix\` to resolve.`,
       );
+
+      // #4764 telemetry
+      try {
+        emitWorktreeOrphaned(basePath, milestoneId, {
+          reason: "complete-unmerged",
+          worktreeDirExists: existsSync(getWorktreeDir(basePath, milestoneId)),
+        });
+      } catch (err) {
+        logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+      }
     }
   }
 
@@ -419,16 +513,35 @@ export async function bootstrapAutoSession(
     // Invalidate caches before initial state derivation
     invalidateAllCaches();
 
-    // Clean stale runtime unit files for completed milestones (#887)
-    cleanStaleRuntimeUnits(
-      gsdRoot(base),
-      (mid) => !!resolveMilestoneFile(base, mid, "SUMMARY"),
-    );
-
     // Open the project-root DB before deriveState so DB-backed state
     // derivation (queue-order, task status) works on a cold start (#2841).
+    // Must happen before cleanStaleRuntimeUnits so the cleanup predicate can
+    // consult DB status and avoid clearing runtime units for milestones that
+    // only have a failure-path SUMMARY on disk (#4663).
     await openProjectDbIfPresent(base);
 
+    // Clean stale runtime unit files for completed milestones (#887).
+    // DB-authoritative: when DB is available, require DB status to be closed
+    // before clearing runtime units. A SUMMARY file alone is no longer
+    // trusted as proof of completion (#4663). Fall back to SUMMARY-file
+    // presence only when DB is unavailable (legacy/pre-migration).
+    cleanStaleRuntimeUnits(
+      gsdRoot(base),
+      (mid) => {
+        if (isDbAvailable()) {
+          const row = getMilestone(mid);
+          return !!row && isClosedStatus(row.status);
+        }
+        const summaryFile = resolveMilestoneFile(base, mid, "SUMMARY");
+        if (!summaryFile) return false;
+        try {
+          return classifyMilestoneSummaryContent(readFileSync(summaryFile, "utf-8")) !== "failure";
+        } catch {
+          return false;
+        }
+      },
+    );
+
     // ── Orphaned milestone branch audit ──
     // Catches completed milestones whose teardown (merge + branch delete)
     // was lost due to session ending between completion and teardown.
@@ -491,7 +604,7 @@ export async function bootstrapAutoSession(
     // The worktree/branch was created but the milestone only has CONTEXT-DRAFT.md.
     // Route to the interactive discussion handler instead of falling through to
     // auto-mode, which would immediately stop with "needs discussion".
-    if (hasSurvivorBranch && state.phase === "needs-discussion") {
+    if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "discuss") {
       const { showSmartEntry } = await import("./guided-flow.js");
       await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
 
@@ -517,7 +630,9 @@ export async function bootstrapAutoSession(
     // The milestone artifacts were written but finalization (merge, worktree
     // cleanup) never ran. Run mergeAndExit to finalize, then re-derive state
     // so the normal "all milestones complete" or "next milestone" path runs.
-    if (hasSurvivorBranch && state.phase === "complete") {
+    // Re-evaluate via the helper — the discuss branch above may have cleared
+    // hasSurvivorBranch after a successful promotion.
+    if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
       const mid = state.activeMilestone!.id;
       ctx.ui.notify(
         `Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`,
@@ -553,37 +668,15 @@ export async function bootstrapAutoSession(
         const { showSmartEntry } = await import("./guided-flow.js");
         await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
 
-        invalidateAllCaches();
-        const postState = await deriveState(base);
-        if (
-          postState.activeMilestone &&
-          postState.phase !== "complete" &&
-          postState.phase !== "pre-planning"
-        ) {
-          s.consecutiveCompleteBootstraps = 0; // Successfully advanced past "complete"
-          state = postState;
-        } else if (
-          postState.activeMilestone &&
-          postState.phase === "pre-planning"
-        ) {
-          const contextFile = resolveMilestoneFile(
-            base,
-            postState.activeMilestone.id,
-            "CONTEXT",
-          );
-          const hasContext = !!(contextFile && (await loadFile(contextFile)));
-          if (hasContext) {
-            state = postState;
-          } else {
-            ctx.ui.notify(
-              "Discussion completed but no milestone context was written. Run /gsd to try the discussion again, or /gsd auto after creating the milestone manually.",
-              "warning",
-            );
-            return releaseLockAndReturn();
-          }
-        } else {
-          return releaseLockAndReturn();
-        }
+        // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+        // it queues the message and returns immediately, before the LLM turn runs.
+        // Checking postState here would always see the pre-dispatch state, causing
+        // the premature "Discussion completed but..." warning (#3420).
+        //
+        // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+        // auto-mode by calling startAutoDetached after the discussion completes.
+        // Release the lock and let the async dispatch proceed.
+        return releaseLockAndReturn();
       }
 
       // Active milestone exists but has no roadmap
@@ -595,17 +688,16 @@ export async function bootstrapAutoSession(
           const { showSmartEntry } = await import("./guided-flow.js");
           await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
 
-          invalidateAllCaches();
-          const postState = await deriveState(base);
-          if (postState.activeMilestone && postState.phase !== "pre-planning") {
-            state = postState;
-          } else {
-            ctx.ui.notify(
-              "Discussion completed but milestone context is still missing. Run /gsd to try again.",
-              "warning",
-            );
-            return releaseLockAndReturn();
-          }
+          // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+          // it queues the message and returns immediately, before the LLM turn runs.
+          // Checking postState here fires before the LLM has had a turn, so the
+          // pre-planning phase would still appear unchanged and a premature warning
+          // would be emitted (#3420).
+          //
+          // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+          // auto-mode by calling startAutoDetached after the discussion completes.
+          // Release the lock and let the async dispatch proceed.
+          return releaseLockAndReturn();
         }
       }
 
@@ -824,9 +916,6 @@ export async function bootstrapAutoSession(
     }
 
     ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
-    ctx.ui.setFooter(hideFooter);
-    // Hide gsd-health during AUTO — gsd-progress is the single source of truth
-    // for last-commit / cost / health signal while auto is running.
     ctx.ui.setWidget("gsd-health", undefined);
     const modeLabel = s.stepMode ? "Step-mode" : "Auto-mode";
     const pendingCount = (state.registry ?? []).filter(
@@ -913,17 +1002,34 @@ export async function bootstrapAutoSession(
       );
     }
 
-    // Self-heal: remove stale .git/index.lock
+    // Self-heal: remove stale .git/index.lock.
+    //
+    // Threshold raised from 60s → 5min because a 60s-old lock is not
+    // definitively stale: `git gc --auto` triggered by a heavy commit, NFS
+    // delays, or concurrent worktree writes can hold .git/index.lock for
+    // minutes on large repos. Force-removing a live lock causes the holder
+    // to encounter `fatal: Unable to create '.git/index.lock'` on its next
+    // write, or worse, operate on a partially-written index → corruption
+    // requiring `git fsck`/`git reset` to recover.
+    // (Issue #4980 CRIT-3)
     try {
       const gitLockFile = join(base, ".git", "index.lock");
       if (existsSync(gitLockFile)) {
         const lockAge = Date.now() - statSync(gitLockFile).mtimeMs;
-        if (lockAge > 60_000) {
+        const STALE_GIT_LOCK_THRESHOLD_MS = 5 * 60_000;
+        if (lockAge > STALE_GIT_LOCK_THRESHOLD_MS) {
           unlinkSync(gitLockFile);
           ctx.ui.notify(
-            "Removed stale .git/index.lock from prior crash.",
-            "info",
+            `Removed stale .git/index.lock (age ${Math.round(lockAge / 1000)}s, > 5min threshold).`,
+            "warning",
           );
+        } else {
+          // Lock present but not yet stale — surface so the user knows why
+          // git ops may be queueing instead of silently waiting.
+          debugLog("git-lock-present-not-stale", {
+            ageMs: lockAge,
+            thresholdMs: STALE_GIT_LOCK_THRESHOLD_MS,
+          });
         }
       }
     } catch (e) {

package/src/resources/extensions/gsd/auto-timeout-recovery.ts

@@ -18,7 +18,7 @@ import {
 } from "./auto-recovery.js";
 import { existsSync } from "node:fs";
 
-import { resolveAgentEnd } from "./auto-loop.js";
+import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 
 export interface RecoveryContext {
   basePath: string;
@@ -35,6 +35,13 @@ export async function recoverTimedOutUnit(
   reason: "idle" | "hard",
   rctx: RecoveryContext,
 ): Promise<"recovered" | "paused"> {
+  // Note on turn epoch: the bump is intentionally NOT unconditional at
+  // function entry. Two branches below (the "steering retry" paths) keep
+  // the same LLM turn alive and let it try again — they must NOT bump,
+  // otherwise the retry's legitimate writes get marked stale and drop.
+  // Each advance branch calls `bumpAndResolveSynthetic` to bump+resolve
+  // atomically. Search for that helper to find all supersede sites.
+
   const { basePath, verbose, currentUnitStartedAt, unitRecoveryCount } = rctx;
 
   const runtime = readUnitRuntimeRecord(basePath, unitType, unitId);
@@ -74,7 +81,7 @@ export async function recoverTimedOutUnit(
         "info",
       );
       unitRecoveryCount.delete(recoveryKey);
-      resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" } as any);
+      bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
       return "recovered";
     }
 
@@ -145,7 +152,7 @@ export async function recoverTimedOutUnit(
         "warning",
       );
       unitRecoveryCount.delete(recoveryKey);
-      resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" } as any);
+      bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
       return "recovered";
     }
 
@@ -179,7 +186,7 @@ export async function recoverTimedOutUnit(
       "info",
     );
     unitRecoveryCount.delete(recoveryKey);
-    resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" } as any);
+    bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
     return "recovered";
   }
 
@@ -265,7 +272,7 @@ export async function recoverTimedOutUnit(
       "warning",
     );
     unitRecoveryCount.delete(recoveryKey);
-    resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" } as any);
+    bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
     return "recovered";
   }
 

package/src/resources/extensions/gsd/auto-tool-tracking.ts

@@ -87,20 +87,21 @@ export function clearInFlightTools(): void {
 // ─── Tool invocation error classification (#2883) ────────────────────────
 
 /**
- * Patterns that indicate a tool invocation failed due to malformed or truncated
- * JSON arguments — as opposed to a normal business-logic error from the tool
- * handler. When these errors occur, retrying the same unit will produce the same
- * failure, so the retry loop must be broken.
+ * Patterns that indicate a tool invocation failed deterministically before
+ * useful work could be completed — as opposed to a normal business-logic error
+ * from the tool handler. When these errors occur, retrying the same unit will
+ * produce the same failure, so the retry loop must be broken.
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON/i;
+const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
 
 /**
- * Returns true if the error message indicates a tool invocation failure due to
- * malformed/truncated arguments (as opposed to a normal tool execution error).
+ * Returns true if the error message indicates a deterministic invocation or
+ * policy failure (as opposed to a normal tool execution error).
  */
 export function isToolInvocationError(errorMsg: string): boolean {
   if (!errorMsg) return false;
-  return TOOL_INVOCATION_ERROR_RE.test(errorMsg);
+  return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
 
 /**
@@ -112,3 +113,46 @@ export function isQueuedUserMessageSkip(errorMsg: string): boolean {
   if (!errorMsg) return false;
   return /^Skipped due to queued user message\.?$/i.test(errorMsg.trim());
 }
+
+// ─── Deterministic policy error classification (#4973, #4974) ──────────────
+
+/**
+ * Known deterministic policy error substrings. Each entry is a stable string
+ * that will appear in the tool error text content when the corresponding
+ * policy gate fires. Retrying these errors will always produce the same outcome.
+ *
+ * Add new entries here as new deterministic gates are introduced. Do NOT use
+ * regex — explicit substrings keep the list auditable.
+ */
+export const DETERMINISTIC_POLICY_ERROR_STRINGS = [
+  // gsd_summary_save write-gate: CONTEXT artifact blocked pending depth verification (#4973).
+  // Matches the fallback text in workflow-tool-executors.ts and the verbose reason
+  // from shouldBlockContextArtifactSaveInSnapshot at write-gate.ts:432-442.
+  "context write blocked",
+  "CONTEXT without depth verification",
+  // Raw write tool gate (#4973): shouldBlockContextWrite at write-gate.ts:390-399 emits
+  // "Cannot write to milestone CONTEXT.md without depth verification." for direct
+  // write tool calls to *-CONTEXT.md paths (different code path than gsd_summary_save).
+  "CONTEXT.md without depth verification",
+] as const;
+
+/**
+ * Returns true if the error message indicates a deterministic policy gate
+ * blocked the tool call before execution. Retrying the same unit without
+ * changing behavior will hit the same gate, so auto-mode should pause instead
+ * of re-dispatching.
+ *
+ * Combines the regex-based gate set from #4974 (HARD BLOCK / queue planning /
+ * STATE.md / mechanical gate) and the substring-based set from #4973 (context
+ * write block / CONTEXT depth verification). Both branches landed on main
+ * independently and their parallel `isDeterministicPolicyError` declarations
+ * were not deduplicated at merge — this consolidated form preserves both
+ * matchers under a single export.
+ */
+export function isDeterministicPolicyError(errorMsg: string): boolean {
+  if (!errorMsg) return false;
+  return (
+    DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg) ||
+    DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s))
+  );
+}