gsd-pi 2.76.0-dev.fe143342a → 2.77.0-dev.1d17f366c

package/src/resources/extensions/gsd/tests/validate-milestone.test.ts

@@ -13,7 +13,7 @@ import { buildCompleteMilestonePrompt, buildValidateMilestonePrompt } from "../a
 import type { GSDState } from "../types.ts";
 import { clearPathCache } from "../paths.ts";
 import { clearParseCache } from "../files.ts";
-import { closeDatabase, insertMilestone, insertSlice, openDatabase } from "../gsd-db.ts";
+import { closeDatabase, insertMilestone, insertSlice, openDatabase, getMilestone } from "../gsd-db.ts";
 
 // ─── Helpers ──────────────────────────────────────────────────────────────
 
@@ -41,6 +41,12 @@ function writeRoadmap(base: string, mid: string, content: string): void {
   writeFileSync(join(dir, `${mid}-ROADMAP.md`), content);
 }
 
+function writeContext(base: string, mid: string, content = "# M001 Context\n\nValidated context."): void {
+  const dir = join(base, ".gsd", "milestones", mid);
+  mkdirSync(dir, { recursive: true });
+  writeFileSync(join(dir, `${mid}-CONTEXT.md`), content);
+}
+
 function writeMilestoneSummary(base: string, mid: string, content: string): void {
   const dir = join(base, ".gsd", "milestones", mid);
   mkdirSync(dir, { recursive: true });
@@ -257,8 +263,8 @@ Test
 `);
     openTestDb(base);
     insertMilestone({ id: "M001", title: "Test Milestone", status: "active" });
-    insertSlice({ id: "S01", milestoneId: "M001", title: "First slice", status: "complete", depends: [], sequence: 1 });
-    insertSlice({ id: "S02", milestoneId: "M001", title: "Skipped slice", status: "skipped", depends: [], sequence: 2 });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "First slice", status: "complete", depends: [] });
+    insertSlice({ id: "S02", milestoneId: "M001", title: "Skipped slice", status: "skipped", depends: [] });
     writeSliceSummary(base, "M001", "S01", "# S01 Summary\nDelivered.");
 
     const prompt = await buildCompleteMilestonePrompt("M001", "Test Milestone", base);
@@ -296,8 +302,8 @@ Test
 `);
     openTestDb(base);
     insertMilestone({ id: "M001", title: "Test Milestone", status: "active" });
-    insertSlice({ id: "S01", milestoneId: "M001", title: "First slice", status: "complete", depends: [], sequence: 1 });
-    insertSlice({ id: "S02", milestoneId: "M001", title: "Skipped slice", status: "skipped", depends: [], sequence: 2 });
+    insertSlice({ id: "S01", milestoneId: "M001", title: "First slice", status: "complete", depends: [] });
+    insertSlice({ id: "S02", milestoneId: "M001", title: "Skipped slice", status: "skipped", depends: [] });
     writeSliceSummary(base, "M001", "S01", "# S01 Summary\nDelivered.");
     writeSliceAssessment(base, "M001", "S01", "---\nverdict: PASS\n---\n# Assessment\nEvidence captured.");
 
@@ -328,6 +334,7 @@ test("dispatch rule matches validating-milestone phase", async () => {
   const base = makeTmpBase();
   try {
     // Set up minimal milestone structure for the prompt builder
+    writeContext(base, "M001");
     writeRoadmap(base, "M001", ALL_DONE_ROADMAP);
     writeSliceSummary(base, "M001", "S01", "# S01 Summary\nDone."); // Guard requires slice summaries (#1368)
 
@@ -364,6 +371,7 @@ test("dispatch rule skips when skip_milestone_validation preference is set", asy
 
   const base = makeTmpBase();
   try {
+    writeContext(base, "M001");
     writeRoadmap(base, "M001", ALL_DONE_ROADMAP);
     writeSliceSummary(base, "M001", "S01", "# S01 Summary\nDone."); // Guard requires slice summaries (#1368)
 
@@ -385,6 +393,131 @@ test("dispatch rule skips when skip_milestone_validation preference is set", asy
   }
 });
 
+test("dispatch rule fails closed for failure-path SUMMARY when DB milestone is not complete (#4658)", async () => {
+  const state: GSDState = {
+    activeMilestone: { id: "M001", title: "Test" },
+    activeSlice: null,
+    activeTask: null,
+    phase: "completing-milestone",
+    recentDecisions: [],
+    blockers: [],
+    nextAction: "Complete milestone M001.",
+    registry: [{ id: "M001", title: "Test", status: "active" }],
+    progress: { milestones: { done: 0, total: 1 } },
+  };
+
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+    insertMilestone({ id: "M001", title: "Test", status: "active" });
+    writeContext(base, "M001");
+    writeMilestoneSummary(base, "M001", "# Milestone Summary\nverification FAILED — not complete.");
+
+    const ctx: DispatchContext = {
+      basePath: base,
+      mid: "M001",
+      midTitle: "Test",
+      state,
+      prefs: undefined,
+    };
+    const result = await resolveDispatch(ctx);
+    assert.equal(result.action, "stop");
+    if (result.action === "stop") {
+      assert.equal(result.level, "warning");
+      assert.match(result.reason, /failure-path SUMMARY/i);
+    }
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("dispatch rule reconciles DB for successful stale SUMMARY (#4658)", async () => {
+  const state: GSDState = {
+    activeMilestone: { id: "M001", title: "Test" },
+    activeSlice: null,
+    activeTask: null,
+    phase: "completing-milestone",
+    recentDecisions: [],
+    blockers: [],
+    nextAction: "Complete milestone M001.",
+    registry: [{ id: "M001", title: "Test", status: "active" }],
+    progress: { milestones: { done: 0, total: 1 } },
+  };
+
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+    insertMilestone({ id: "M001", title: "Test", status: "active" });
+    writeContext(base, "M001");
+    writeMilestoneSummary(
+      base,
+      "M001",
+      [
+        "---",
+        "id: M001",
+        "status: complete",
+        "---",
+        "",
+        "# M001: Test",
+        "",
+        "**Complete.**",
+      ].join("\n"),
+    );
+
+    const ctx: DispatchContext = {
+      basePath: base,
+      mid: "M001",
+      midTitle: "Test",
+      state,
+      prefs: undefined,
+    };
+    const result = await resolveDispatch(ctx);
+    assert.equal(result.action, "skip");
+    const milestone = getMilestone("M001");
+    assert.equal(milestone?.status, "complete");
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("dispatch rule fails closed for ambiguous stale SUMMARY (#4658)", async () => {
+  const state: GSDState = {
+    activeMilestone: { id: "M001", title: "Test" },
+    activeSlice: null,
+    activeTask: null,
+    phase: "completing-milestone",
+    recentDecisions: [],
+    blockers: [],
+    nextAction: "Complete milestone M001.",
+    registry: [{ id: "M001", title: "Test", status: "active" }],
+    progress: { milestones: { done: 0, total: 1 } },
+  };
+
+  const base = makeTmpBase();
+  try {
+    openTestDb(base);
+    insertMilestone({ id: "M001", title: "Test", status: "active" });
+    writeContext(base, "M001");
+    writeMilestoneSummary(base, "M001", "# M001 Summary\nSome notes without completion metadata.");
+
+    const ctx: DispatchContext = {
+      basePath: base,
+      mid: "M001",
+      midTitle: "Test",
+      state,
+      prefs: undefined,
+    };
+    const result = await resolveDispatch(ctx);
+    assert.equal(result.action, "stop");
+    if (result.action === "stop") {
+      assert.equal(result.level, "warning");
+      assert.match(result.reason, /ambiguous SUMMARY/i);
+    }
+  } finally {
+    cleanup(base);
+  }
+});
+
 // ─── Artifact resolution & verification ───────────────────────────────────
 
 test("resolveExpectedArtifactPath returns VALIDATION path for validate-milestone", () => {

package/src/resources/extensions/gsd/tests/workflow-mcp.test.ts

@@ -180,6 +180,11 @@ test("detectWorkflowMcpLaunchConfig resolves the bundled server relative to the
 test("workflow MCP launch config reaches mutation tools over stdio", async () => {
   const projectRoot = mkdtempSync(join(tmpdir(), "gsd-workflow-transport-"));
   mkdirSync(join(projectRoot, ".gsd"), { recursive: true });
+  // Isolate the spawned MCP server from the developer's real ~/.gsd so it
+  // can't pick up a configured Discord/Slack/Telegram channel from global
+  // PREFERENCES.md and route ask_user_questions through a remote adapter
+  // instead of MCP elicitation.
+  const isolatedGsdHome = mkdtempSync(join(tmpdir(), "gsd-workflow-home-"));
 
   const launch = detectWorkflowMcpLaunchConfig(projectRoot, {});
   assert.ok(launch, "expected a workflow MCP launch config");
@@ -219,7 +224,14 @@ test("workflow MCP launch config reaches mutation tools over stdio", async () =>
   const transport = new StdioClientTransport({
     command: launch.command,
     args: launch.args,
-    env: { ...process.env, ...launch.env } as Record<string, string>,
+    env: {
+      ...process.env,
+      ...launch.env,
+      GSD_HOME: isolatedGsdHome,
+      DISCORD_BOT_TOKEN: "",
+      SLACK_BOT_TOKEN: "",
+      TELEGRAM_BOT_TOKEN: "",
+    } as Record<string, string>,
     cwd: launch.cwd,
     stderr: "pipe",
   });
@@ -345,12 +357,14 @@ test("workflow MCP launch config reaches mutation tools over stdio", async () =>
   } finally {
     await client.close().catch(() => {});
     rmSync(projectRoot, { recursive: true, force: true });
+    rmSync(isolatedGsdHome, { recursive: true, force: true });
   }
 });
 
 test("workflow MCP ask_user_questions uses stdio elicitation round-trip", async () => {
   const projectRoot = mkdtempSync(join(tmpdir(), "gsd-workflow-elicit-"));
   mkdirSync(join(projectRoot, ".gsd"), { recursive: true });
+  const isolatedGsdHome = mkdtempSync(join(tmpdir(), "gsd-workflow-home-"));
 
   const launch = detectWorkflowMcpLaunchConfig(projectRoot, {});
   assert.ok(launch, "expected a workflow MCP launch config");
@@ -381,7 +395,14 @@ test("workflow MCP ask_user_questions uses stdio elicitation round-trip", async
   const transport = new StdioClientTransport({
     command: launch.command,
     args: launch.args,
-    env: { ...process.env, ...launch.env } as Record<string, string>,
+    env: {
+      ...process.env,
+      ...launch.env,
+      GSD_HOME: isolatedGsdHome,
+      DISCORD_BOT_TOKEN: "",
+      SLACK_BOT_TOKEN: "",
+      TELEGRAM_BOT_TOKEN: "",
+    } as Record<string, string>,
     cwd: launch.cwd,
     stderr: "pipe",
   });
@@ -432,6 +453,8 @@ test("workflow MCP ask_user_questions uses stdio elicitation round-trip", async
     );
   } finally {
     await client.close();
+    rmSync(projectRoot, { recursive: true, force: true });
+    rmSync(isolatedGsdHome, { recursive: true, force: true });
   }
 });
 

package/src/resources/extensions/gsd/tests/workflow-tool-executors.test.ts

@@ -1,6 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
-import { mkdirSync, rmSync, readFileSync, existsSync, writeFileSync } from "node:fs";
+import { mkdirSync, rmSync, readFileSync, existsSync, writeFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { randomUUID } from "node:crypto";
@@ -11,7 +11,7 @@ import {
   _getAdapter,
   insertGateRow,
 } from "../gsd-db.ts";
-import { markDepthVerified, clearDiscussionFlowState } from "../bootstrap/write-gate.ts";
+import { markDepthVerified, clearDiscussionFlowState, loadWriteGateSnapshot } from "../bootstrap/write-gate.ts";
 import {
   executeCompleteMilestone,
   executePlanMilestone,
@@ -742,3 +742,66 @@ test("executeSummarySave leaves sibling CONTEXT-DRAFT intact for non-CONTEXT art
     cleanup(base);
   }
 });
+
+test("executeSummarySave CONTEXT HARD BLOCK clears after write-gate state file is deleted (#4343)", async () => {
+  const base = makeTmpBase();
+  const originalEnv = process.env.GSD_PERSIST_WRITE_GATE_STATE;
+  process.env.GSD_PERSIST_WRITE_GATE_STATE = "1";
+  try {
+    openTestDb(base);
+    clearDiscussionFlowState();
+
+    // First call: CONTEXT artifact without depth verification → HARD BLOCK
+    const blocked = await inProjectDir(base, () => executeSummarySave({
+      milestone_id: "M001",
+      artifact_type: "CONTEXT",
+      content: "# Context\n\ncontent",
+    }, base));
+    assert.equal(blocked.isError, true, "should be blocked without depth verification");
+    assert.match(
+      blocked.content[0].text,
+      /HARD BLOCK/,
+      "blocked result should mention HARD BLOCK",
+    );
+
+    // Verify the state file was written (persist mode is active)
+    const stateFilePath = join(base, ".gsd", "runtime", "write-gate-state.json");
+    // The state file may or may not exist at this point (block doesn't write state).
+    // Write a fake state file simulating stale persisted block state.
+    mkdirSync(join(base, ".gsd", "runtime"), { recursive: true });
+    writeFileSync(stateFilePath, JSON.stringify({
+      verifiedDepthMilestones: [],
+      activeQueuePhase: false,
+      pendingGateId: "depth_verification_M001",
+    }));
+
+    // User deletes the state file to reset the block
+    unlinkSync(stateFilePath);
+    assert.ok(!existsSync(stateFilePath), "state file deleted");
+
+    // The snapshot loaded after deletion should be clean (no pending gate, no block)
+    const snapshot = loadWriteGateSnapshot(base);
+    assert.equal(snapshot.pendingGateId, null, "pendingGateId should be null after file deletion");
+    assert.deepEqual(snapshot.verifiedDepthMilestones, [], "verifiedDepthMilestones should be empty after file deletion");
+
+    // Depth-verify and re-attempt: should succeed after deletion clears stale state
+    markDepthVerified("M001", base);
+
+    const unblocked = await inProjectDir(base, () => executeSummarySave({
+      milestone_id: "M001",
+      artifact_type: "CONTEXT",
+      content: "# Context\n\nfinal content",
+    }, base));
+    assert.equal(unblocked.isError, undefined, "should not be blocked after depth verification");
+    assert.equal(unblocked.details.operation, "save_summary");
+  } finally {
+    if (originalEnv === undefined) {
+      delete process.env.GSD_PERSIST_WRITE_GATE_STATE;
+    } else {
+      process.env.GSD_PERSIST_WRITE_GATE_STATE = originalEnv;
+    }
+    clearDiscussionFlowState();
+    closeDatabase();
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/worktree-db.test.ts

@@ -10,6 +10,8 @@ import {
   insertDecision,
   insertRequirement,
   insertArtifact,
+  insertMilestone,
+  getMilestone,
   getDecisionById,
   getRequirementById,
   _getAdapter,
@@ -442,4 +444,37 @@ console.log('\n=== worktree-db: reconcileWorktreeDb ===');
   cleanup(mainDir, wtDir);
 }
 
+// Test: reconcileWorktreeDb must NOT downgrade milestone status complete→active (#4372)
+{
+  const mainDir = tempDir();
+  const wtDir = tempDir();
+  const mainDb = path.join(mainDir, 'gsd.db');
+  const wtDb = path.join(wtDir, 'gsd.db');
+
+  // Seed main with a milestone already marked complete
+  seedMainDb(mainDb);
+  const mainAdapter = _getAdapter()!;
+  insertMilestone({ id: 'M-COMP', title: 'Completed Milestone', status: 'complete' });
+  // Manually mark completed_at so it's a realistic complete record
+  mainAdapter.prepare(`UPDATE milestones SET completed_at = '2025-06-01T00:00:00.000Z' WHERE id = 'M-COMP'`).run();
+  closeDatabase();
+
+  // Copy to worktree — the worktree has the milestone as 'active' (stale / older snapshot)
+  copyWorktreeDb(mainDb, wtDb);
+  openDatabase(wtDb);
+  const wtAdapter = _getAdapter()!;
+  wtAdapter.prepare(`UPDATE milestones SET status = 'active', completed_at = NULL WHERE id = 'M-COMP'`).run();
+  closeDatabase();
+
+  // Reconcile: main should win and keep 'complete'
+  openDatabase(mainDb);
+  reconcileWorktreeDb(mainDb, wtDb);
+
+  const m = getMilestone('M-COMP');
+  assert.ok(m !== null, 'milestone M-COMP still exists after reconcile');
+  assert.strictEqual(m!.status, 'complete', 'complete milestone must not be downgraded to active by stale worktree');
+
+  cleanup(mainDir, wtDir);
+}
+
 // ─── Final Report ──────────────────────────────────────────────────────────

package/src/resources/extensions/gsd/tests/worktree-journal-events.test.ts

@@ -190,7 +190,12 @@ describe("worktree journal events", () => {
     });
     const resolver = new WorktreeResolver(s, deps);
 
-    resolver.mergeAndExit("M001", makeNotifyCtx());
+    // Since #4380, mergeAndExit re-throws all errors after emitting the journal
+    // event and restoring state — callers must handle the throw.
+    assert.throws(
+      () => resolver.mergeAndExit("M001", makeNotifyCtx()),
+      /conflict in main/,
+    );
 
     const entries = readJournalEntries(tmp);
     const failed = entries.find(e => e.eventType === "worktree-merge-failed");

package/src/resources/extensions/gsd/tests/worktree-resolver.test.ts

@@ -313,6 +313,43 @@ test("enterMilestone uses originalBasePath as base for worktree ops", () => {
   assert.equal(createdFrom, "/project"); // uses originalBasePath, not current basePath
 });
 
+test("enterMilestone does not create double-nested worktree when originalBasePath is empty and basePath is a worktree path", () => {
+  // Regression test for #3729: when s.originalBasePath is "" (falsy) and
+  // s.basePath is already a worktree path, the expression
+  // `this.s.originalBasePath || this.s.basePath` evaluates to the worktree
+  // path. Passing that to createAutoWorktree produces a doubly-nested path
+  // like /project/.gsd/worktrees/M001/.gsd/worktrees/M002.
+  const wtPath = "/project/.gsd/worktrees/M001";
+  const s = makeSession({
+    basePath: wtPath,
+    originalBasePath: "/project", // will be overwritten below to simulate the bug
+  });
+  // Simulate the real bug: originalBasePath is "" (falsy) as it is when AutoSession
+  // is constructed fresh or reset() is called without auto-start re-setting it.
+  s.originalBasePath = "";
+
+  let createdFromPath = "";
+  const deps = makeDeps({
+    getAutoWorktreePath: () => null,
+    createAutoWorktree: (basePath: string, _mid: string) => {
+      createdFromPath = basePath;
+      return `/project/.gsd/worktrees/M002`;
+    },
+  });
+  const ctx = makeNotifyCtx();
+  const resolver = new WorktreeResolver(s, deps);
+
+  resolver.enterMilestone("M002", ctx);
+
+  // The path passed to createAutoWorktree must be the project root, NOT the
+  // worktree path. If it equals wtPath the worktree would be created at
+  // /project/.gsd/worktrees/M001/.gsd/worktrees/M002 (double-nesting).
+  assert.ok(
+    !createdFromPath.includes("/.gsd/worktrees/"),
+    `createAutoWorktree must be called with project root, got: "${createdFromPath}"`,
+  );
+});
+
 // ─── enterMilestone Tests (branch mode) ──────────────────────────────────────
 
 test("enterMilestone in branch mode calls enterBranchModeForMilestone and rebuilds GitService", () => {
@@ -577,9 +614,11 @@ test("mergeAndExit in worktree mode restores to project root on merge failure",
   const ctx = makeNotifyCtx();
   const resolver = new WorktreeResolver(s, deps);
 
-  resolver.mergeAndExit("M001", ctx);
+  // Error propagates (#4380) — callers handle recovery. restoreToProjectRoot()
+  // still runs before re-throw so state is consistent for the caller.
+  assert.throws(() => resolver.mergeAndExit("M001", ctx), /conflict in main/);
 
-  assert.equal(s.basePath, "/project"); // error recovery — restored
+  assert.equal(s.basePath, "/project"); // error recovery — restored before re-throw
   assert.ok(
     ctx.messages.some(
       (m) => m.level === "warning" && m.msg.includes("conflict in main"),
@@ -607,7 +646,8 @@ test("mergeAndExit failure message tells user worktree and branch are preserved
   const ctx = makeNotifyCtx();
   const resolver = new WorktreeResolver(s, deps);
 
-  resolver.mergeAndExit("M001", ctx);
+  // Error propagates (#4380) — notification is still emitted before re-throw
+  assert.throws(() => resolver.mergeAndExit("M001", ctx), /pathspec 'main' did not match/);
 
   const warning = ctx.messages.find((m) => m.level === "warning");
   assert.ok(warning, "a warning message is emitted");
@@ -643,7 +683,8 @@ test("mergeAndExit failure message references /gsd dispatch complete-milestone,
   const ctx = makeNotifyCtx();
   const resolver = new WorktreeResolver(s, deps);
 
-  resolver.mergeAndExit("M001", ctx);
+  // Error propagates (#4380) — notification is still emitted before re-throw
+  assert.throws(() => resolver.mergeAndExit("M001", ctx), /dirty working tree/);
 
   const warning = ctx.messages.find((m) => m.level === "warning");
   assert.ok(warning, "a warning message is emitted");
@@ -709,7 +750,8 @@ test("mergeAndExit in branch mode handles merge failure gracefully", () => {
   const ctx = makeNotifyCtx();
   const resolver = new WorktreeResolver(s, deps);
 
-  resolver.mergeAndExit("M001", ctx);
+  // Error propagates (#4380) — notification is still emitted before re-throw
+  assert.throws(() => resolver.mergeAndExit("M001", ctx), /branch merge conflict/);
 
   assert.ok(
     ctx.messages.some(
@@ -1069,3 +1111,34 @@ test("mergeAndExit in none mode remains a no-op when NOT in a worktree (#2625)",
   assert.equal(findCalls(deps.calls, "mergeMilestoneToMain").length, 0,
     "must NOT merge when not in a worktree and mode is none");
 });
+
+// ─── #4380 — Non-MergeConflictError must not be swallowed ────────────────────
+
+test("mergeAndExit propagates non-MergeConflictError to caller (#4380)", () => {
+  // Regression test: previously the catch block in _mergeWorktreeMode only
+  // re-threw MergeConflictError. Permission errors, filesystem errors, and other
+  // non-conflict failures were swallowed silently, making broken states impossible
+  // to diagnose and preventing callers (phases.ts) from applying their own
+  // error-recovery logic.
+  const permissionError = new Error("EACCES: permission denied, open '/project/.git/SQUASH_MSG'");
+  const s = makeSession({
+    basePath: "/project/.gsd/worktrees/M001",
+    originalBasePath: "/project",
+  });
+  const deps = makeDeps({
+    isInAutoWorktree: () => true,
+    getIsolationMode: () => "worktree",
+    mergeMilestoneToMain: () => {
+      throw permissionError;
+    },
+  });
+  const ctx = makeNotifyCtx();
+  const resolver = new WorktreeResolver(s, deps);
+
+  // The error must propagate — callers need it to apply their own recovery logic
+  assert.throws(
+    () => resolver.mergeAndExit("M001", ctx),
+    (err: unknown) => err === permissionError,
+    "non-MergeConflictError must propagate to the caller, not be swallowed",
+  );
+});

package/src/resources/extensions/gsd/tests/write-gate.test.ts

@@ -11,6 +11,10 @@
 
 import test from 'node:test';
 import assert from 'node:assert/strict';
+import { mkdirSync, writeFileSync, unlinkSync, existsSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { randomUUID } from 'node:crypto';
 import {
   isDepthConfirmationAnswer,
   shouldBlockContextWrite,
@@ -20,8 +24,10 @@ import {
   markDepthVerified,
   isMilestoneDepthVerified,
   shouldBlockContextArtifactSave,
+  shouldBlockContextArtifactSaveInSnapshot,
   clearDiscussionFlowState,
   resetWriteGateState,
+  loadWriteGateSnapshot,
 } from '../bootstrap/write-gate.ts';
 
 // ─── Scenario 1: Blocks CONTEXT.md write during discussion without depth verification (absolute path) ──
@@ -488,3 +494,61 @@ test('write-gate: isDepthConfirmationAnswer falls back to (Recommended) match wi
     'should reject non-Recommended via fallback',
   );
 });
+
+// ─── Scenario 29: loadWriteGateSnapshot returns clean state when persist file deleted (#4343) ──
+
+test('write-gate: loadWriteGateSnapshot returns empty default when persist file is deleted (#4343)', () => {
+  const base = join(tmpdir(), `gsd-write-gate-4343-${randomUUID()}`);
+  mkdirSync(join(base, '.gsd', 'runtime'), { recursive: true });
+  const stateFilePath = join(base, '.gsd', 'runtime', 'write-gate-state.json');
+  const originalEnv = process.env.GSD_PERSIST_WRITE_GATE_STATE;
+
+  try {
+    process.env.GSD_PERSIST_WRITE_GATE_STATE = '1';
+
+    // Write a state file with a pending gate and verified milestone
+    writeFileSync(stateFilePath, JSON.stringify({
+      verifiedDepthMilestones: ['M001'],
+      activeQueuePhase: false,
+      pendingGateId: 'depth_verification_M001',
+    }));
+    assert.ok(existsSync(stateFilePath), 'precondition: state file exists');
+
+    // While file exists, snapshot reflects its contents
+    const beforeDeletion = loadWriteGateSnapshot(base);
+    assert.strictEqual(beforeDeletion.pendingGateId, 'depth_verification_M001', 'pending gate from file');
+    assert.deepEqual(beforeDeletion.verifiedDepthMilestones, ['M001'], 'verified milestones from file');
+
+    // User deletes the state file to clear the HARD BLOCK
+    unlinkSync(stateFilePath);
+    assert.ok(!existsSync(stateFilePath), 'state file deleted');
+
+    // After deletion in persist mode, snapshot should be clean (not stale in-memory)
+    const afterDeletion = loadWriteGateSnapshot(base);
+    assert.strictEqual(afterDeletion.pendingGateId, null, 'pendingGateId cleared after file deletion');
+    assert.deepEqual(afterDeletion.verifiedDepthMilestones, [], 'verifiedDepthMilestones cleared after file deletion');
+    assert.strictEqual(afterDeletion.activeQueuePhase, false, 'activeQueuePhase cleared after file deletion');
+
+    // The CONTEXT artifact block check must also resolve to unblocked after deletion+verification
+    // (simulate the re-verify flow users would do: delete → depth verify → save)
+    const stillBlocked = shouldBlockContextArtifactSaveInSnapshot(afterDeletion, 'CONTEXT', 'M001', null);
+    assert.strictEqual(stillBlocked.block, true, 'still blocked without new depth verification');
+
+    const verifiedSnapshot = {
+      ...afterDeletion,
+      verifiedDepthMilestones: ['M001'],
+    };
+    const unblocked = shouldBlockContextArtifactSaveInSnapshot(verifiedSnapshot, 'CONTEXT', 'M001', null);
+    assert.strictEqual(unblocked.block, false, 'unblocked after fresh depth verification');
+  } finally {
+    if (originalEnv === undefined) {
+      delete process.env.GSD_PERSIST_WRITE_GATE_STATE;
+    } else {
+      process.env.GSD_PERSIST_WRITE_GATE_STATE = originalEnv;
+    }
+    clearDiscussionFlowState();
+    try {
+      rmSync(base, { recursive: true, force: true });
+    } catch { /* swallow */ }
+  }
+});

package/src/resources/extensions/gsd/token-counter.ts

@@ -22,7 +22,11 @@ async function getEncoder(): Promise<TokenEncoder | null> {
 	try {
 		// @ts-ignore — tiktoken may not have type declarations in extensions tsconfig
 		const tiktoken = await import("tiktoken");
-		encoder = tiktoken.encoding_for_model("gpt-4o") as TokenEncoder;
+		// Use cl100k_base — the most conservative and broadly compatible BPE encoding.
+		// It is shared by GPT-3.5/GPT-4 and gives a safer (larger) estimate than
+		// gpt-4o's o200k_base encoding, which produces fewer tokens for the same text
+		// and would cause context windows for non-OpenAI providers to be under-counted.
+		encoder = tiktoken.get_encoding("cl100k_base") as TokenEncoder;
 		return encoder;
 	} catch {
 		encoderFailed = true;
@@ -30,20 +34,33 @@ async function getEncoder(): Promise<TokenEncoder | null> {
 	}
 }
 
-export async function countTokens(text: string): Promise<number> {
+/**
+ * Count tokens in `text` using tiktoken (cl100k_base) when available.
+ *
+ * When tiktoken is not loaded, falls back to a provider-aware character-ratio
+ * estimate via `estimateTokensForProvider`. Passing `provider` is recommended
+ * so the heuristic fallback is as accurate as possible.
+ */
+export async function countTokens(text: string, provider?: TokenProvider): Promise<number> {
 	const enc = await getEncoder();
 	if (enc) {
 		const tokens = enc.encode(text);
 		return tokens.length;
 	}
-	return Math.ceil(text.length / 4);
+	return estimateTokensForProvider(text, provider ?? "unknown");
 }
 
-export function countTokensSync(text: string): number {
+/**
+ * Synchronous token count — only accurate after `initTokenCounter()` resolves.
+ *
+ * Before init, or when tiktoken is unavailable, falls back to a provider-aware
+ * character-ratio estimate. Passing `provider` is recommended.
+ */
+export function countTokensSync(text: string, provider?: TokenProvider): number {
 	if (encoder) {
 		return encoder.encode(text).length;
 	}
-	return Math.ceil(text.length / 4);
+	return estimateTokensForProvider(text, provider ?? "unknown");
 }
 
 export async function initTokenCounter(): Promise<boolean> {