gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.1d17f366c

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -18,10 +18,12 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { logWarning, logError } from "./workflow-logger.js";
 import { join } from "node:path";
 import { hasImplementationArtifacts } from "./auto-recovery.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { buildDiscussMilestonePrompt, buildResearchMilestonePrompt, buildPlanMilestonePrompt, buildResearchSlicePrompt, buildPlanSlicePrompt, buildRefineSlicePrompt, buildExecuteTaskPrompt, buildCompleteSlicePrompt, buildCompleteMilestonePrompt, buildValidateMilestonePrompt, buildReplanSlicePrompt, buildRunUatPrompt, buildReassessRoadmapPrompt, buildRewriteDocsPrompt, buildReactiveExecutePrompt, buildGateEvaluatePrompt, buildParallelResearchSlicesPrompt, checkNeedsReassessment, checkNeedsRunUat, } from "./auto-prompts.js";
 import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
+import { EXECUTION_ENTRY_PHASES, hasFinalizedMilestoneContext } from "./uok/plan-v2.js";
 function missingSliceStop(mid, phase) {
     return {
         action: "stop",
@@ -155,6 +157,35 @@ export const DISPATCH_RULES = [
             };
         },
     },
+    {
+        // #4671 — Recovery path for execution-entry phases with missing CONTEXT.md.
+        //
+        // Once `deriveStateFromDb` returns an execution-entry phase (executing /
+        // summarizing / validating-milestone / completing-milestone), the
+        // pre-planning guard at `pre-planning (no context) → discuss-milestone`
+        // no longer fires. The plan-v2 gate correctly detects the missing context
+        // but can only block — it cannot redispatch. Without this rule the
+        // milestone is stuck until `/gsd doctor heal` repairs it (and heal
+        // historically missed this check too).
+        //
+        // Fire BEFORE the execution-entry phase rules so we redispatch to
+        // `discuss-milestone` instead of hitting the plan-v2 gate.
+        name: "execution-entry phase (no context) → discuss-milestone",
+        match: async ({ state, mid, midTitle, basePath, structuredQuestionsAvailable }) => {
+            if (!EXECUTION_ENTRY_PHASES.has(state.phase))
+                return null;
+            // Align with the plan-v2 gate's lookup semantics: whitespace-only counts
+            // as missing, and an auto worktree may fall back to GSD_PROJECT_ROOT.
+            if (hasFinalizedMilestoneContext(basePath, mid))
+                return null;
+            return {
+                action: "dispatch",
+                unitType: "discuss-milestone",
+                unitId: mid,
+                prompt: await buildDiscussMilestonePrompt(mid, midTitle, basePath, structuredQuestionsAvailable),
+            };
+        },
+    },
     {
         name: "summarizing → complete-slice",
         match: async ({ state, mid, midTitle, basePath }) => {
@@ -319,6 +350,30 @@ export const DISPATCH_RULES = [
             };
         },
     },
+    {
+        name: "planning (require_slice_discussion) → pause for discussion (#3454)",
+        match: async ({ state, mid, basePath, prefs }) => {
+            if (state.phase !== "planning")
+                return null;
+            if (!prefs?.phases?.require_slice_discussion)
+                return null;
+            if (!state.activeSlice)
+                return null;
+            // Only pause if the slice has no context file yet (discussion not done).
+            // resolveSliceFile returns null when the file does not exist on disk,
+            // but cachedReaddir could return a stale hit — verify with existsSync
+            // so the guard is defence-in-depth and the contract is explicit at the
+            // call site.
+            const sliceContextFile = resolveSliceFile(basePath, mid, state.activeSlice.id, "CONTEXT");
+            if (sliceContextFile && existsSync(sliceContextFile))
+                return null; // discussion already done, proceed
+            return {
+                action: "stop",
+                reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.`,
+                level: "info",
+            };
+        },
+    },
     {
         // Keep this rule before the single-slice research rule so the multi-slice
         // path wins whenever 2+ slices are ready.
@@ -451,18 +506,31 @@ export const DISPATCH_RULES = [
     },
     {
         name: "planning → plan-slice",
-        match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry }) => {
+        match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry, session }) => {
             if (state.phase !== "planning")
                 return null;
             if (!state.activeSlice)
                 return missingSliceStop(mid, state.phase);
             const sid = state.activeSlice.id;
             const sTitle = state.activeSlice.title;
+            // #4551: Consume any persisted pre-exec failure for this slice so the
+            // re-dispatched prompt includes the exact blocked references. Clear the
+            // field immediately after reading to prevent stale context leaking into
+            // a later, unrelated plan-slice run.
+            const unitId = `${mid}/${sid}`;
+            let priorPreExecFailure;
+            if (session?.lastPreExecFailure?.unitId === unitId) {
+                priorPreExecFailure = {
+                    blockingFindings: session.lastPreExecFailure.blockingFindings,
+                    verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,
+                };
+                session.lastPreExecFailure = null;
+            }
             return {
                 action: "dispatch",
                 unitType: "plan-slice",
-                unitId: `${mid}/${sid}`,
-                prompt: await buildPlanSlicePrompt(mid, midTitle, sid, sTitle, basePath, undefined, { sessionContextWindow, modelRegistry }),
+                unitId,
+                prompt: await buildPlanSlicePrompt(mid, midTitle, sid, sTitle, basePath, undefined, { sessionContextWindow, modelRegistry, priorPreExecFailure }),
             };
         },
     },
@@ -689,22 +757,13 @@ export const DISPATCH_RULES = [
                     return { action: "skip" };
                 }
             }
-            // Reconciliation guard (#4324): when the SUMMARY file already exists
-            // on disk but the DB says the milestone is not complete, the DB is
-            // out of sync (e.g. journal reset, partial merge, crash recovery).
-            // Reconcile the DB status directly instead of re-dispatching the
-            // tool, which would overwrite the richer on-disk SUMMARY with a
-            // thinner regenerated version — causing silent data loss.
             const existingSummary = resolveMilestoneFile(basePath, mid, "SUMMARY");
-            if (existingSummary && isDbAvailable()) {
-                try {
-                    updateMilestoneStatus(mid, "complete", new Date().toISOString());
-                    logWarning("dispatch", `Milestone ${mid} has SUMMARY on disk but DB status was not complete — reconciled DB to complete (#4324)`);
-                }
-                catch (err) {
-                    logWarning("dispatch", `Failed to reconcile milestone ${mid} status: ${err instanceof Error ? err.message : String(err)}`);
+            let summaryOutcome = "unknown";
+            if (existingSummary) {
+                const summaryContent = await loadFile(existingSummary);
+                if (summaryContent) {
+                    summaryOutcome = classifyMilestoneSummaryContent(summaryContent);
                 }
-                return { action: "skip" };
             }
             // Safety guard (#2675): block completion when VALIDATION verdict is
             // needs-remediation. The state machine treats needs-remediation as
@@ -782,6 +841,45 @@ export const DISPATCH_RULES = [
             catch (err) { /* fall through — don't block on DB errors */
                 logWarning("dispatch", `verification class check failed: ${err instanceof Error ? err.message : String(err)}`);
             }
+            // Disk/DB mismatch handling (#4658): SUMMARY presence alone is not enough.
+            // Apply post-gate policy:
+            // - success summary: reconcile DB and skip re-dispatch
+            // - failure summary: pause/fail-closed
+            // - unknown summary: pause/fail-closed
+            if (existingSummary) {
+                const milestone = isDbAvailable() ? getMilestone(mid) : null;
+                const status = milestone?.status ?? (isDbAvailable() ? "missing" : "unavailable");
+                if (summaryOutcome === "success") {
+                    if (!isDbAvailable()) {
+                        logWarning("dispatch", `Milestone ${mid} SUMMARY indicates completion while DB is unavailable — skipping duplicate complete-milestone dispatch`);
+                        return { action: "skip" };
+                    }
+                    try {
+                        updateMilestoneStatus(mid, "complete", new Date().toISOString());
+                        logWarning("dispatch", `Milestone ${mid} SUMMARY indicates completion while DB status was "${status}" — reconciled DB to complete (#4658)`);
+                        return { action: "skip" };
+                    }
+                    catch (err) {
+                        return {
+                            action: "stop",
+                            level: "warning",
+                            reason: `Milestone ${mid} SUMMARY indicates completion but DB reconciliation failed (${err instanceof Error ? err.message : String(err)}). Auto-mode paused for manual review.`,
+                        };
+                    }
+                }
+                if (summaryOutcome === "failure") {
+                    return {
+                        action: "stop",
+                        level: "warning",
+                        reason: `Milestone ${mid} has a failure-path SUMMARY while DB status is "${status}". Auto-mode will not promote completion from failure artifacts. Re-run complete-milestone only after blockers are resolved and verification passes.`,
+                    };
+                }
+                return {
+                    action: "stop",
+                    level: "warning",
+                    reason: `Milestone ${mid} has an ambiguous SUMMARY while DB status is "${status}". Auto-mode paused instead of promoting completion from file presence alone.`,
+                };
+            }
             return {
                 action: "dispatch",
                 unitType: "complete-milestone",

package/dist/resources/extensions/gsd/auto-loop.js

@@ -8,6 +8,6 @@
  */
 export { autoLoop, runUokKernelLoop, runLegacyAutoLoop } from "./auto/loop.js";
 export { isInfrastructureError, INFRA_ERROR_CODES } from "./auto/infra-errors.js";
-export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
+export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _hasPendingResolveForTest, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
 export { detectStuck } from "./auto/detect-stuck.js";
 export { runUnit } from "./auto/run-unit.js";

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -291,7 +291,7 @@ autoModeStartThinkingLevel) {
                 // ADR-005: Adjust active tool set for the selected model's provider capabilities.
                 // Hard-filter incompatible tools, then let extensions override via adjust_tool_set hook.
                 const activeToolNames = pi.getActiveTools();
-                const { toolNames: compatibleTools, removedTools } = adjustToolSet(activeToolNames, model.api);
+                const { toolNames: compatibleTools, removedTools } = adjustToolSet(activeToolNames, model.api, model.provider);
                 let finalToolNames = compatibleTools;
                 // Fire adjust_tool_set hook — extensions can override the filtered tool set
                 if (routingConfig.hooks !== false) {

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -30,7 +30,7 @@ import { checkPostUnitHooks, isRetryPending, consumeRetryTrigger, persistHookSta
 import { hasPendingCaptures, loadPendingCaptures, revertExecutorResolvedCaptures } from "./captures.js";
 import { debugLog } from "./debug-logger.js";
 import { runSafely } from "./auto-utils.js";
-import { getEvidence } from "./safety/evidence-collector.js";
+import { getEvidence, clearEvidenceFromDisk } from "./safety/evidence-collector.js";
 import { validateFileChanges } from "./safety/file-change-validator.js";
 // crossReferenceEvidence available for future use when verification_evidence is stored in DB
 // import { crossReferenceEvidence, type ClaimedEvidence } from "./safety/evidence-cross-ref.js";
@@ -45,8 +45,24 @@ import { ensureCodebaseMapFresh } from "./codebase-generator.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
 import { writeTurnGitTransaction } from "./uok/gitops.js";
+import { isClosedStatus } from "./status-guards.js";
+import { detectAbandonMilestone } from "./abandon-detect.js";
 /** Maximum verification retry attempts before escalating to blocker placeholder (#2653). */
 const MAX_VERIFICATION_RETRIES = 3;
+const COMPLETE_MILESTONE_DB_SETTLE_MS = 1500;
+const COMPLETE_MILESTONE_DB_SETTLE_POLL_MS = 100;
+async function waitForMilestoneDbClose(mid) {
+    const deadline = Date.now() + COMPLETE_MILESTONE_DB_SETTLE_MS;
+    while (Date.now() < deadline) {
+        if (!isDbAvailable())
+            return false;
+        const milestone = getMilestone(mid);
+        if (milestone && isClosedStatus(milestone.status))
+            return true;
+        await new Promise((resolve) => setTimeout(resolve, COMPLETE_MILESTONE_DB_SETTLE_POLL_MS));
+    }
+    return false;
+}
 /** Enqueue a sidecar item (hook, triage, or quick-task) for the main loop to
  *  drain via runUnit. Logs the enqueue event and notifies the UI. */
 function enqueueSidecar(s, ctx, entry, debugExtra, notification) {
@@ -457,6 +473,36 @@ export async function postUnitPreVerification(pctx, opts) {
         // Rewrite-docs completion
         if (s.currentUnit.type === "rewrite-docs") {
             await runSafely("postUnit", "rewrite-docs-resolve", async () => {
+                // Detect abandon/descope overrides BEFORE resolving them (#3490).
+                // If an override is about abandoning the milestone, park it so the
+                // state engine skips it. Without this, rewrite-docs only edits
+                // markdown but the DB still has the milestone as active.
+                try {
+                    const { loadActiveOverrides } = await import("./files.js");
+                    const overrides = await loadActiveOverrides(s.basePath);
+                    const decision = detectAbandonMilestone(overrides, s.currentMilestoneId);
+                    if (decision.shouldPark && s.currentMilestoneId) {
+                        const { parkMilestone } = await import("./milestone-actions.js");
+                        const parked = parkMilestone(s.basePath, s.currentMilestoneId, decision.reason);
+                        if (parked) {
+                            ctx.ui.notify(`Milestone ${s.currentMilestoneId} parked: "${decision.reason}"`, "info");
+                        }
+                        else {
+                            // Park refused: milestone directory missing, milestone already
+                            // completed (SUMMARY present), or PARKED.md already exists.
+                            // resolveAllOverrides below will still consume the override —
+                            // surface this loudly so the user notices state drift rather
+                            // than silently losing the abandon directive.
+                            const msg = `Abandon detected for ${s.currentMilestoneId} but park refused (milestone is completed, already parked, or missing). Override will be resolved anyway — verify state is correct.`;
+                            logError("engine", msg);
+                            ctx.ui.notify(msg, "warning");
+                        }
+                    }
+                }
+                catch (err) {
+                    logError("engine", `abandon-detect failed: ${err.message}`);
+                    ctx.ui.notify(`Abandon detection failed — check logs. Overrides will still be resolved.`, "warning");
+                }
                 await resolveAllOverrides(s.basePath);
                 // Reset both disk and in-memory counters. Disk counter is authoritative
                 // (survives restarts); in-memory is kept in sync for the current session.
@@ -535,7 +581,7 @@ export async function postUnitPreVerification(pctx, opts) {
                         if (taskRow) {
                             const expectedOutput = taskRow.expected_output ?? [];
                             const plannedFiles = taskRow.files ?? [];
-                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles);
+                            const audit = validateFileChanges(s.basePath, expectedOutput, plannedFiles, safetyConfig.file_change_allowlist);
                             if (audit && audit.violations.length > 0) {
                                 const warnings = audit.violations.filter(v => v.severity === "warning");
                                 for (const v of warnings) {
@@ -588,6 +634,16 @@ export async function postUnitPreVerification(pctx, opts) {
                         debugLog("postUnit", { phase: "safety-content-validation", error: String(e) });
                     }
                 }
+                // Clear persisted evidence file now that post-unit processing is complete
+                // (Bug #4385 — prevents stale evidence from affecting retries of same unit ID).
+                if (safetyConfig.evidence_collection && s.currentUnit.type === "execute-task" && sMid && sSid && sTid) {
+                    try {
+                        clearEvidenceFromDisk(s.basePath, sMid, sSid, sTid);
+                    }
+                    catch (e) {
+                        debugLog("postUnit", { phase: "safety-evidence-clear", error: String(e) });
+                    }
+                }
             }
         }
         catch (e) {
@@ -607,6 +663,25 @@ export async function postUnitPreVerification(pctx, opts) {
             }
             // If verification failed, attempt to regenerate missing projection files
             // from DB data before giving up (e.g. research-slice produces PLAN from engine).
+            if (!triggerArtifactVerified) {
+                if (s.currentUnit.type === "complete-milestone") {
+                    try {
+                        const { milestone: mid } = parseUnitId(s.currentUnit.id);
+                        if (mid) {
+                            const settled = await waitForMilestoneDbClose(mid);
+                            if (settled) {
+                                triggerArtifactVerified = verifyExpectedArtifact(s.currentUnit.type, s.currentUnit.id, s.basePath);
+                                if (triggerArtifactVerified) {
+                                    invalidateAllCaches();
+                                }
+                            }
+                        }
+                    }
+                    catch (e) {
+                        debugLog("postUnit", { phase: "artifact-verify-settle-db", error: String(e) });
+                    }
+                }
+            }
             if (!triggerArtifactVerified) {
                 try {
                     const { milestone: mid, slice: sid } = parseUnitId(s.currentUnit.id);
@@ -950,12 +1025,25 @@ export async function postUnitPostVerification(pctx) {
                     const suffix = blockingChecks.length > 3 ? `\n  \u2022 ...and ${blockingChecks.length - 3} more` : "";
                     const evidenceNote = `\nSee ${sid}-PRE-EXEC-VERIFY.json for full details.`;
                     ctx.ui.notify(`Pre-execution checks failed: ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} found\n${details}${suffix}${evidenceNote}`, "error");
+                    // Persist failure context so the next plan-slice re-dispatch can inject
+                    // it into the prompt and break the infinite loop (#4551).
+                    s.lastPreExecFailure = {
+                        unitId: currentUnit.id,
+                        blockingFindings: blockingChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
+                        verdictExcerpt: `status=${result.status}; ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} detected`,
+                    };
                     preExecPauseNeeded = true;
                 }
                 else if (result.status === "warn") {
                     ctx.ui.notify(`Pre-execution checks passed with warnings`, "warning");
                     // Strict mode: treat warnings as blocking
                     if (prefs?.enhanced_verification_strict === true) {
+                        const warnChecks = result.checks.filter(c => !c.passed);
+                        s.lastPreExecFailure = {
+                            unitId: currentUnit.id,
+                            blockingFindings: warnChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
+                            verdictExcerpt: `status=${result.status} (strict mode); ${warnChecks.length} warning${warnChecks.length === 1 ? "" : "s"} treated as blocking`,
+                        };
                         preExecPauseNeeded = true;
                     }
                 }

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -1223,6 +1223,20 @@ export async function buildPlanSlicePrompt(mid, _midTitle, sid, sTitle, base, le
         prependBlocks.push(`## Prior Sketch Scope (soft hint — non-binding)\n\n${options.softScopeHint.trim()}\n\n` +
             `This scope was captured during an earlier progressive-planning pass that was later disabled. Treat it as context only — you may plan beyond it if the work genuinely requires more scope. Do NOT treat this as a hard boundary.`);
     }
+    // #4551: inject pre-exec failure context so the re-dispatched plan-slice
+    // addresses the exact blocked references rather than reproducing the same plan.
+    if (options?.priorPreExecFailure) {
+        const { blockingFindings, verdictExcerpt } = options.priorPreExecFailure;
+        const findingsList = blockingFindings.length > 0
+            ? blockingFindings.map(f => `- ${f}`).join("\n")
+            : "- (no specific findings recorded)";
+        prependBlocks.push(`## Fix these specific issues from the prior pre-exec check\n\n` +
+            `The previous plan-slice attempt was blocked by pre-execution validation.\n` +
+            `Gate verdict: ${verdictExcerpt}\n\n` +
+            `Blocked references that must be resolved in this plan:\n${findingsList}\n\n` +
+            `Revise the plan so that every reference listed above is satisfied before execution begins. ` +
+            `Do not reproduce the same file paths, package names, or task ordering that caused these failures.`);
+    }
     return renderSlicePrompt({
         mid, sid, sTitle, base,
         level: level ?? resolveInlineLevel(),

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -11,18 +11,21 @@ import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice, getMilestone } from "./gsd-db.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
+import { isClosedStatus } from "./status-guards.js";
 import { nativeConflictFiles, nativeCommit, nativeCheckoutTheirs, nativeAddPaths, nativeMergeAbort, nativeResetHard, } from "./native-git-bridge.js";
 import { resolveSlicePath, resolveSliceFile, resolveTasksDir, resolveTaskFiles, relMilestoneFile, relSliceFile, buildSliceFileName, resolveMilestoneFile, clearPathCache, resolveGsdRootFile, } from "./paths.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, } from "./auto-artifact-paths.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 // Re-export so existing consumers of auto-recovery.ts keep working.
 export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
+export { classifyMilestoneSummaryContent, } from "./milestone-summary-classifier.js";
 // ─── Artifact Resolution & Verification ───────────────────────────────────────
 /**
  * Check whether a milestone produced implementation artifacts (non-`.gsd/` files)
@@ -220,12 +223,25 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     // RESEARCH file. Without this, resolveExpectedArtifactPath returns null and
     // the retry/escalation machinery silently re-dispatches forever.
     //
+    // #4068: Also treat a PARALLEL-BLOCKER placeholder as a terminal completion
+    // so that timeout-recovery can write the blocker, have verifyExpectedArtifact
+    // return true, and let the dispatch loop advance past this unit.  Without
+    // this, the blocker is written but verification still returns false, the unit
+    // is never cleared from unitDispatchCount, and on the next iteration the
+    // dispatch rule (which correctly skips parallel-research when PARALLEL-BLOCKER
+    // exists) returns null — leaving the loop stuck re-deriving indefinitely.
+    //
     // NOTE: this predicate mirrors the dispatch rule at
     // auto-dispatch.ts parallel-research-slices — keep the two in sync.
     if (unitType === "research-slice" && unitId.endsWith("/parallel-research")) {
         const { milestone: mid } = parseUnitId(unitId);
         if (!mid)
             return false;
+        // #4068: PARALLEL-BLOCKER written by timeout-recovery is a terminal state.
+        const blockerPath = resolveExpectedArtifactPath(unitType, unitId, base);
+        if (blockerPath && existsSync(blockerPath)) {
+            return true;
+        }
         const roadmapFile = resolveMilestoneFile(base, mid, "ROADMAP");
         if (!roadmapFile || !existsSync(roadmapFile)) {
             logWarning("recovery", `verify-fail ${unitType} ${unitId}: roadmap missing`);
@@ -420,6 +436,17 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     // A milestone with only .gsd/ plan files and zero implementation code is
     // not genuinely complete — the LLM wrote plan files but skipped actual work.
     if (unitType === "complete-milestone") {
+        const summaryOutcome = classifyMilestoneSummaryContent(readFileSync(absPath, "utf-8"));
+        if (summaryOutcome === "failure")
+            return false;
+        const { milestone: mid } = parseUnitId(unitId);
+        if (mid && isDbAvailable()) {
+            const dbMilestone = getMilestone(mid);
+            if (!dbMilestone)
+                return false;
+            if (!isClosedStatus(dbMilestone.status) && summaryOutcome !== "success")
+                return false;
+        }
         if (hasImplementationArtifacts(base) === "absent")
             return false;
     }
@@ -497,6 +524,24 @@ export function writeBlockerPlaceholder(unitType, unitId, base, reason) {
                 logWarning("recovery", `appendEvent failed for slice recovery: ${e instanceof Error ? e.message : String(e)}`);
             }
         }
+        // Insert a placeholder complete slice so deriveState sees activeMilestoneSlices.length > 0
+        // and exits the pre-planning phase. Without this, activeMilestoneSlices stays empty
+        // after the blocker ROADMAP.md is written, causing deriveState to return phase:'pre-planning'
+        // indefinitely and re-dispatching plan-milestone in an infinite loop (#4378).
+        if (unitType === "plan-milestone" && mid) {
+            try {
+                insertSlice({ id: "S00-blocker", milestoneId: mid, title: "Blocker placeholder — planning failed", status: "complete", sequence: 0 });
+            }
+            catch (e) {
+                logWarning("recovery", `insertSlice placeholder failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`);
+            }
+            try {
+                appendEvent(base, { cmd: "plan-milestone", params: { milestoneId: mid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" });
+            }
+            catch (e) {
+                logWarning("recovery", `appendEvent failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`);
+            }
+        }
     }
     return diagnoseExpectedArtifact(unitType, unitId, base);
 }

package/dist/resources/extensions/gsd/auto-start.js

@@ -31,10 +31,11 @@ import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
-import { hideFooter } from "./auto-dashboard.js";
+import { isClosedStatus } from "./status-guards.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
 import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
@@ -312,11 +313,32 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // Invalidate caches before initial state derivation
         invalidateAllCaches();
-        // Clean stale runtime unit files for completed milestones (#887)
-        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => !!resolveMilestoneFile(base, mid, "SUMMARY"));
         // Open the project-root DB before deriveState so DB-backed state
         // derivation (queue-order, task status) works on a cold start (#2841).
+        // Must happen before cleanStaleRuntimeUnits so the cleanup predicate can
+        // consult DB status and avoid clearing runtime units for milestones that
+        // only have a failure-path SUMMARY on disk (#4663).
         await openProjectDbIfPresent(base);
+        // Clean stale runtime unit files for completed milestones (#887).
+        // DB-authoritative: when DB is available, require DB status to be closed
+        // before clearing runtime units. A SUMMARY file alone is no longer
+        // trusted as proof of completion (#4663). Fall back to SUMMARY-file
+        // presence only when DB is unavailable (legacy/pre-migration).
+        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => {
+            if (isDbAvailable()) {
+                const row = getMilestone(mid);
+                return !!row && isClosedStatus(row.status);
+            }
+            const summaryFile = resolveMilestoneFile(base, mid, "SUMMARY");
+            if (!summaryFile)
+                return false;
+            try {
+                return classifyMilestoneSummaryContent(readFileSync(summaryFile, "utf-8")) !== "failure";
+            }
+            catch {
+                return false;
+            }
+        });
         // ── Orphaned milestone branch audit ──
         // Catches completed milestones whose teardown (merge + branch delete)
         // was lost due to session ending between completion and teardown.
@@ -416,29 +438,15 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 }
                 const { showSmartEntry } = await import("./guided-flow.js");
                 await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
-                invalidateAllCaches();
-                const postState = await deriveState(base);
-                if (postState.activeMilestone &&
-                    postState.phase !== "complete" &&
-                    postState.phase !== "pre-planning") {
-                    s.consecutiveCompleteBootstraps = 0; // Successfully advanced past "complete"
-                    state = postState;
-                }
-                else if (postState.activeMilestone &&
-                    postState.phase === "pre-planning") {
-                    const contextFile = resolveMilestoneFile(base, postState.activeMilestone.id, "CONTEXT");
-                    const hasContext = !!(contextFile && (await loadFile(contextFile)));
-                    if (hasContext) {
-                        state = postState;
-                    }
-                    else {
-                        ctx.ui.notify("Discussion completed but no milestone context was written. Run /gsd to try the discussion again, or /gsd auto after creating the milestone manually.", "warning");
-                        return releaseLockAndReturn();
-                    }
-                }
-                else {
-                    return releaseLockAndReturn();
-                }
+                // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+                // it queues the message and returns immediately, before the LLM turn runs.
+                // Checking postState here would always see the pre-dispatch state, causing
+                // the premature "Discussion completed but..." warning (#3420).
+                //
+                // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+                // auto-mode by calling startAutoDetached after the discussion completes.
+                // Release the lock and let the async dispatch proceed.
+                return releaseLockAndReturn();
             }
             // Active milestone exists but has no roadmap
             if (state.phase === "pre-planning") {
@@ -448,15 +456,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 if (!hasContext) {
                     const { showSmartEntry } = await import("./guided-flow.js");
                     await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
-                    invalidateAllCaches();
-                    const postState = await deriveState(base);
-                    if (postState.activeMilestone && postState.phase !== "pre-planning") {
-                        state = postState;
-                    }
-                    else {
-                        ctx.ui.notify("Discussion completed but milestone context is still missing. Run /gsd to try again.", "warning");
-                        return releaseLockAndReturn();
-                    }
+                    // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+                    // it queues the message and returns immediately, before the LLM turn runs.
+                    // Checking postState here fires before the LLM has had a turn, so the
+                    // pre-planning phase would still appear unchanged and a premature warning
+                    // would be emitted (#3420).
+                    //
+                    // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+                    // auto-mode by calling startAutoDetached after the discussion completes.
+                    // Release the lock and let the async dispatch proceed.
+                    return releaseLockAndReturn();
                 }
             }
             // Active milestone has CONTEXT-DRAFT but no full context — needs discussion
@@ -650,9 +659,6 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             snapshotSkills();
         }
         ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
-        ctx.ui.setFooter(hideFooter);
-        // Hide gsd-health during AUTO — gsd-progress is the single source of truth
-        // for last-commit / cost / health signal while auto is running.
         ctx.ui.setWidget("gsd-health", undefined);
         const modeLabel = s.stepMode ? "Step-mode" : "Auto-mode";
         const pendingCount = (state.registry ?? []).filter((m) => m.status !== "complete" && m.status !== "parked").length;