gsd-pi 2.76.0 → 2.77.0-dev.1594b263e

package/dist/resources/extensions/gsd/auto-start.js

@@ -19,22 +19,24 @@ import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
-import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, } from "./native-git-bridge.js";
+import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
 import { getAutoWorktreePath } from "./auto-worktree.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
+import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
 import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
-import { isDbAvailable, getMilestone, openDatabase } from "./gsd-db.js";
-import { hideFooter } from "./auto-dashboard.js";
+import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
+import { isClosedStatus } from "./status-guards.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
 import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
@@ -62,25 +64,15 @@ export async function openProjectDbIfPresent(basePath) {
         logWarning("engine", `gsd-db: failed to open existing database: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/**
- * Audit for orphaned milestone branches at bootstrap.
- *
- * After a milestone completes, the teardown step (merge branch → main,
- * delete branch, remove worktree) runs as a post-completion engine step.
- * If the session ends between completion and teardown, the branch and
- * worktree are orphaned — the DB says "complete" so auto-mode won't
- * re-enter the milestone, and the teardown is never retried.
- *
- * This audit runs on every fresh bootstrap to catch that gap:
- * 1. Lists all local `milestone/*` branches.
- * 2. For each, checks if the milestone's DB status is "complete".
- * 3. If the branch is already merged into main → deletes the branch
- *    and cleans up any orphaned worktree directory (safe, no data loss).
- * 4. If the branch is NOT merged → preserves it and warns the user
- *    so they can merge manually (data safety first).
- *
- * Returns a summary of actions taken for the caller to surface via notify.
- */
+export function decideSurvivorAction(hasSurvivorBranch, phase) {
+    if (!hasSurvivorBranch)
+        return "none";
+    if (phase === "needs-discussion")
+        return "discuss";
+    if (phase === "complete")
+        return "finalize";
+    return "none";
+}
 export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     const recovered = [];
     const warnings = [];
@@ -119,10 +111,58 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     for (const branch of milestoneBranches) {
         const milestoneId = branch.replace(/^milestone\//, "");
         const milestone = getMilestone(milestoneId);
-        // Only audit completed milestones
-        if (!milestone || milestone.status !== "complete")
+        if (!milestone)
             continue;
         const isMerged = mergedBranches.has(branch);
+        // #4762 — in-progress milestone branch with unmerged commits ahead of
+        // main. This is the pre-completion orphan case: auto-mode exited without
+        // completing the milestone (pause, stop, crash, merge error, blocker) and
+        // work is stranded on the branch or in the worktree. Data safety first:
+        // we never delete or touch; we just surface a warning so the user knows
+        // where to look.
+        //
+        // Gate on isClosedStatus so we only warn about genuinely open milestones.
+        // Parked/other closed statuses go through the legacy complete/unmerged
+        // path below where appropriate.
+        if (!isClosedStatus(milestone.status)) {
+            if (isMerged)
+                continue; // nothing to recover
+            let commitsAhead = 0;
+            try {
+                commitsAhead = nativeCommitCountBetween(basePath, mainBranch, branch);
+            }
+            catch {
+                // Rev-walk failure — skip rather than noise
+                continue;
+            }
+            if (commitsAhead === 0)
+                continue;
+            const wtDir = getWorktreeDir(basePath, milestoneId);
+            const wtDirExists = existsSync(wtDir);
+            const wtSuffix = wtDirExists
+                ? ` Worktree directory at .gsd/worktrees/${milestoneId}/ holds the live work.`
+                : "";
+            warnings.push(`Branch ${branch} has ${commitsAhead} commit(s) ahead of ${mainBranch} for in-progress milestone ${milestoneId}.` +
+                wtSuffix +
+                ` Run \`/gsd auto\` to resume, or merge manually if abandoning.`);
+            // #4764 telemetry
+            try {
+                emitWorktreeOrphaned(basePath, milestoneId, {
+                    reason: "in-progress-unmerged",
+                    commitsAhead,
+                    worktreeDirExists: wtDirExists,
+                });
+            }
+            catch (err) {
+                logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            continue;
+        }
+        // Only the "complete" status participates in the merged/unmerged cleanup
+        // paths below — other closed statuses (parked, etc.) are intentionally
+        // left alone.
+        if (milestone.status !== "complete")
+            continue;
         if (isMerged) {
             // Branch is merged — safe to delete branch and clean up worktree dir
             try {
@@ -169,6 +209,16 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
             // Branch is NOT merged — preserve for safety, warn the user
             warnings.push(`Branch ${branch} exists for completed milestone ${milestoneId} but is NOT merged into ${mainBranch}. ` +
                 `This may contain unmerged work. Merge manually or run \`/gsd health --fix\` to resolve.`);
+            // #4764 telemetry
+            try {
+                emitWorktreeOrphaned(basePath, milestoneId, {
+                    reason: "complete-unmerged",
+                    worktreeDirExists: existsSync(getWorktreeDir(basePath, milestoneId)),
+                });
+            }
+            catch (err) {
+                logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
         }
     }
     return { recovered, warnings };
@@ -190,8 +240,8 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     //
     // Precedence:
     // 1) Explicit session override via /gsd model (this session)
-    // 2) GSD model preferences from PREFERENCES.md (validated against live auth)
-    // 3) Current session model from settings/session restore (if provider ready)
+    // 2) Current session model from settings/session restore (if provider ready)
+    // 3) GSD model preferences from PREFERENCES.md (validated against live auth)
     //
     // This preserves #3517 defaults while honoring explicit runtime model
     // selection for subsequent /gsd runs in the same session.
@@ -224,11 +274,14 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
     }
     const sessionModelReady = ctx.model && ctx.modelRegistry.isProviderRequestReady(ctx.model.provider);
+    const currentSessionModel = (sessionModelReady && ctx.model)
+        ? { provider: ctx.model.provider, id: ctx.model.id }
+        : null;
+    const startThinkingSnapshot = pi.getThinkingLevel();
     const startModelSnapshot = manualSessionOverride
+        ?? currentSessionModel
         ?? validatedPreferredModel
-        ?? (sessionModelReady && ctx.model
-            ? { provider: ctx.model.provider, id: ctx.model.id }
-            : null);
+        ?? null;
     try {
         // Validate GSD_PROJECT_ID early so the user gets immediate feedback
         const customProjectId = process.env.GSD_PROJECT_ID;
@@ -244,7 +297,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // the parent git root). See #2393 and related issue.
         const hasLocalGit = existsSync(join(base, ".git"));
         if (!hasLocalGit || isInheritedRepo(base)) {
-            const mainBranch = loadEffectiveGSDPreferences()?.preferences?.git?.main_branch || "main";
+            const mainBranch = loadEffectiveGSDPreferences(base)?.preferences?.git?.main_branch || "main";
             nativeInit(base, mainBranch);
         }
         // Migrate legacy in-project .gsd/ to external state directory.
@@ -260,7 +313,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Ensure .gitignore has baseline patterns.
         // ensureGitignore checks for git-tracked .gsd/ files and skips the
         // ".gsd" pattern if the project intentionally tracks .gsd/ in git.
-        const gitPrefs = loadEffectiveGSDPreferences()?.preferences?.git;
+        const gitPrefs = loadEffectiveGSDPreferences(base)?.preferences?.git;
         const manageGitignore = gitPrefs?.manage_gitignore;
         ensureGitignore(base, { manageGitignore });
         if (manageGitignore !== false)
@@ -286,7 +339,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             prepareWorkflowMcpForProject(ctx, base);
         }
         // Initialize GitServiceImpl
-        s.gitService = new GitServiceImpl(s.basePath, loadEffectiveGSDPreferences()?.preferences?.git ?? {});
+        s.gitService = new GitServiceImpl(s.basePath, loadEffectiveGSDPreferences(base)?.preferences?.git ?? {});
         // ── Debug mode ──
         if (!isDebugEnabled() && process.env.GSD_DEBUG === "1") {
             enableDebug(base);
@@ -309,17 +362,38 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // Invalidate caches before initial state derivation
         invalidateAllCaches();
-        // Clean stale runtime unit files for completed milestones (#887)
-        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => !!resolveMilestoneFile(base, mid, "SUMMARY"));
         // Open the project-root DB before deriveState so DB-backed state
         // derivation (queue-order, task status) works on a cold start (#2841).
+        // Must happen before cleanStaleRuntimeUnits so the cleanup predicate can
+        // consult DB status and avoid clearing runtime units for milestones that
+        // only have a failure-path SUMMARY on disk (#4663).
         await openProjectDbIfPresent(base);
+        // Clean stale runtime unit files for completed milestones (#887).
+        // DB-authoritative: when DB is available, require DB status to be closed
+        // before clearing runtime units. A SUMMARY file alone is no longer
+        // trusted as proof of completion (#4663). Fall back to SUMMARY-file
+        // presence only when DB is unavailable (legacy/pre-migration).
+        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => {
+            if (isDbAvailable()) {
+                const row = getMilestone(mid);
+                return !!row && isClosedStatus(row.status);
+            }
+            const summaryFile = resolveMilestoneFile(base, mid, "SUMMARY");
+            if (!summaryFile)
+                return false;
+            try {
+                return classifyMilestoneSummaryContent(readFileSync(summaryFile, "utf-8")) !== "failure";
+            }
+            catch {
+                return false;
+            }
+        });
         // ── Orphaned milestone branch audit ──
         // Catches completed milestones whose teardown (merge + branch delete)
         // was lost due to session ending between completion and teardown.
         // Must run after DB open and before worktree entry.
         try {
-            const auditResult = auditOrphanedMilestoneBranches(base, getIsolationMode());
+            const auditResult = auditOrphanedMilestoneBranches(base, getIsolationMode(base));
             for (const msg of auditResult.recovered) {
                 ctx.ui.notify(`Orphan audit: ${msg}`, "info");
             }
@@ -337,7 +411,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         let state = await deriveState(base);
         // Stale worktree state recovery (#654)
         if (state.activeMilestone &&
-            shouldUseWorktreeIsolation() &&
+            shouldUseWorktreeIsolation(base) &&
             !detectWorktreeName(base)) {
             const wtPath = getAutoWorktreePath(base, state.activeMilestone.id);
             if (wtPath) {
@@ -352,7 +426,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         let hasSurvivorBranch = false;
         if (state.activeMilestone &&
             (state.phase === "pre-planning" || state.phase === "complete") &&
-            getIsolationMode() !== "none" &&
+            getIsolationMode(base) !== "none" &&
             !detectWorktreeName(base) &&
             !base.includes(`${pathSep}.gsd${pathSep}worktrees${pathSep}`)) {
             const milestoneBranch = `milestone/${state.activeMilestone.id}`;
@@ -366,7 +440,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The worktree/branch was created but the milestone only has CONTEXT-DRAFT.md.
         // Route to the interactive discussion handler instead of falling through to
         // auto-mode, which would immediately stop with "needs discussion".
-        if (hasSurvivorBranch && state.phase === "needs-discussion") {
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "discuss") {
             const { showSmartEntry } = await import("./guided-flow.js");
             await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
             invalidateAllCaches();
@@ -386,7 +460,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The milestone artifacts were written but finalization (merge, worktree
         // cleanup) never ran. Run mergeAndExit to finalize, then re-derive state
         // so the normal "all milestones complete" or "next milestone" path runs.
-        if (hasSurvivorBranch && state.phase === "complete") {
+        // Re-evaluate via the helper — the discuss branch above may have cleared
+        // hasSurvivorBranch after a successful promotion.
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
             ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
             const resolver = buildResolver();
@@ -413,29 +489,15 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 }
                 const { showSmartEntry } = await import("./guided-flow.js");
                 await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
-                invalidateAllCaches();
-                const postState = await deriveState(base);
-                if (postState.activeMilestone &&
-                    postState.phase !== "complete" &&
-                    postState.phase !== "pre-planning") {
-                    s.consecutiveCompleteBootstraps = 0; // Successfully advanced past "complete"
-                    state = postState;
-                }
-                else if (postState.activeMilestone &&
-                    postState.phase === "pre-planning") {
-                    const contextFile = resolveMilestoneFile(base, postState.activeMilestone.id, "CONTEXT");
-                    const hasContext = !!(contextFile && (await loadFile(contextFile)));
-                    if (hasContext) {
-                        state = postState;
-                    }
-                    else {
-                        ctx.ui.notify("Discussion completed but no milestone context was written. Run /gsd to try the discussion again, or /gsd auto after creating the milestone manually.", "warning");
-                        return releaseLockAndReturn();
-                    }
-                }
-                else {
-                    return releaseLockAndReturn();
-                }
+                // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+                // it queues the message and returns immediately, before the LLM turn runs.
+                // Checking postState here would always see the pre-dispatch state, causing
+                // the premature "Discussion completed but..." warning (#3420).
+                //
+                // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+                // auto-mode by calling startAutoDetached after the discussion completes.
+                // Release the lock and let the async dispatch proceed.
+                return releaseLockAndReturn();
             }
             // Active milestone exists but has no roadmap
             if (state.phase === "pre-planning") {
@@ -445,15 +507,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 if (!hasContext) {
                     const { showSmartEntry } = await import("./guided-flow.js");
                     await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
-                    invalidateAllCaches();
-                    const postState = await deriveState(base);
-                    if (postState.activeMilestone && postState.phase !== "pre-planning") {
-                        state = postState;
-                    }
-                    else {
-                        ctx.ui.notify("Discussion completed but milestone context is still missing. Run /gsd to try again.", "warning");
-                        return releaseLockAndReturn();
-                    }
+                    // showSmartEntry dispatches via pi.sendMessage() which is fire-and-forget:
+                    // it queues the message and returns immediately, before the LLM turn runs.
+                    // Checking postState here fires before the LLM has had a turn, so the
+                    // pre-planning phase would still appear unchanged and a premature warning
+                    // would be emitted (#3420).
+                    //
+                    // checkAutoStartAfterDiscuss (in guided-flow.ts) already handles re-entering
+                    // auto-mode by calling startAutoDetached after the discussion completes.
+                    // Release the lock and let the async dispatch proceed.
+                    return releaseLockAndReturn();
                 }
             }
             // Active milestone has CONTEXT-DRAFT but no full context — needs discussion
@@ -506,13 +569,14 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.pendingQuickTasks = [];
         s.currentUnit = null;
         s.currentMilestoneId = state.activeMilestone?.id ?? null;
-        s.originalModelId = ctx.model?.id ?? null;
-        s.originalModelProvider = ctx.model?.provider ?? null;
+        s.originalModelId = startModelSnapshot?.id ?? ctx.model?.id ?? null;
+        s.originalModelProvider = startModelSnapshot?.provider ?? ctx.model?.provider ?? null;
+        s.originalThinkingLevel = startThinkingSnapshot ?? null;
         // Register SIGTERM handler
         registerSigtermHandler(base);
         // Capture integration branch
         if (s.currentMilestoneId) {
-            if (getIsolationMode() !== "none") {
+            if (getIsolationMode(base) !== "none") {
                 captureIntegrationBranch(base, s.currentMilestoneId);
             }
             setActiveMilestoneId(base, s.currentMilestoneId);
@@ -520,7 +584,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Guard against stale milestone branch when isolation:none (#3613).
         // A prior session with isolation:branch/worktree may have left HEAD on
         // milestone/<MID>. Auto-checkout back to the integration branch.
-        if (getIsolationMode() === "none" && nativeIsRepo(base)) {
+        if (getIsolationMode(base) === "none" && nativeIsRepo(base)) {
             try {
                 const currentBranch = nativeGetCurrentBranch(base);
                 if (currentBranch.startsWith("milestone/")) {
@@ -548,7 +612,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             return symlinkRe.test(p);
         };
         if (s.currentMilestoneId &&
-            getIsolationMode() !== "none" &&
+            getIsolationMode(base) !== "none" &&
             !detectWorktreeName(base) &&
             !isUnderGsdWorktrees(base)) {
             buildResolver().enterMilestone(s.currentMilestoneId, {
@@ -593,8 +657,21 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // call returns "db_unavailable", triggering artifact-retry which
         // re-dispatches the same task — producing an infinite loop (#2419).
         if (existsSync(gsdDbPath) && !isDbAvailable()) {
-            ctx.ui.notify("SQLite database exists but failed to open. Auto-mode cannot proceed without a working database provider. " +
-                "Check for corrupt gsd.db or missing native SQLite bindings.", "error");
+            const dbStatus = getDbStatus();
+            const phaseHint = dbStatus.lastPhase === "open"
+                ? "The database file could not be opened"
+                : dbStatus.lastPhase === "initSchema"
+                    ? "The database schema could not be initialized"
+                    : dbStatus.lastPhase === "vacuum-recovery"
+                        ? "Corruption recovery (VACUUM) failed"
+                        : dbStatus.attempted
+                            ? "The database could not be opened (phase unknown)"
+                            : "The database provider could not be loaded";
+            const errorDetail = dbStatus.lastError ? ` (${dbStatus.lastError.message})` : "";
+            const providerHint = dbStatus.provider
+                ? ` Provider: ${dbStatus.provider}.`
+                : " No SQLite provider available — check Node >= 22 or install better-sqlite3.";
+            ctx.ui.notify(`SQLite database exists but failed to open: ${gsdDbPath}. ${phaseHint}${errorDetail}.${providerHint}`, "error");
             return releaseLockAndReturn();
         }
         // Initialize metrics
@@ -608,6 +685,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 id: startModelSnapshot.id,
             };
         }
+        s.autoModeStartThinkingLevel = startThinkingSnapshot ?? null;
         s.manualSessionModelOverride = manualSessionOverride ?? null;
         // Apply worker model override from parallel orchestrator (#worker-model).
         // GSD_WORKER_MODEL is injected by the coordinator when parallel.worker_model
@@ -628,13 +706,10 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             }
         }
         // Snapshot installed skills
-        if (resolveSkillDiscoveryMode() !== "off") {
+        if (resolveSkillDiscoveryMode(base) !== "off") {
             snapshotSkills();
         }
         ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
-        ctx.ui.setFooter(hideFooter);
-        // Hide gsd-health during AUTO — gsd-progress is the single source of truth
-        // for last-commit / cost / health signal while auto is running.
         ctx.ui.setWidget("gsd-health", undefined);
         const modeLabel = s.stepMode ? "Step-mode" : "Auto-mode";
         const pendingCount = (state.registry ?? []).filter((m) => m.status !== "complete" && m.status !== "parked").length;
@@ -656,7 +731,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // FlatRateContext used by selectAndApplyModel so user-declared
         // flat-rate providers and externalCli auto-detection are respected.
         const { isFlatRateProvider, buildFlatRateContext } = await import("./auto-model-selection.js");
-        const bannerPrefs = loadEffectiveGSDPreferences()?.preferences;
+        const bannerPrefs = loadEffectiveGSDPreferences(base)?.preferences;
         const effectiveProvider = s.autoModeStartModel?.provider ?? ctx.model?.provider;
         const effectivelyEnabled = routingConfig.enabled
             && (routingConfig.allow_flat_rate_providers
@@ -693,14 +768,32 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         catch (err) {
             ctx.ui.notify(`Secrets collection error: ${err instanceof Error ? err.message : String(err)}. Continuing with next task.`, "warning");
         }
-        // Self-heal: remove stale .git/index.lock
+        // Self-heal: remove stale .git/index.lock.
+        //
+        // Threshold raised from 60s → 5min because a 60s-old lock is not
+        // definitively stale: `git gc --auto` triggered by a heavy commit, NFS
+        // delays, or concurrent worktree writes can hold .git/index.lock for
+        // minutes on large repos. Force-removing a live lock causes the holder
+        // to encounter `fatal: Unable to create '.git/index.lock'` on its next
+        // write, or worse, operate on a partially-written index → corruption
+        // requiring `git fsck`/`git reset` to recover.
+        // (Issue #4980 CRIT-3)
         try {
             const gitLockFile = join(base, ".git", "index.lock");
             if (existsSync(gitLockFile)) {
                 const lockAge = Date.now() - statSync(gitLockFile).mtimeMs;
-                if (lockAge > 60_000) {
+                const STALE_GIT_LOCK_THRESHOLD_MS = 5 * 60_000;
+                if (lockAge > STALE_GIT_LOCK_THRESHOLD_MS) {
                     unlinkSync(gitLockFile);
-                    ctx.ui.notify("Removed stale .git/index.lock from prior crash.", "info");
+                    ctx.ui.notify(`Removed stale .git/index.lock (age ${Math.round(lockAge / 1000)}s, > 5min threshold).`, "warning");
+                }
+                else {
+                    // Lock present but not yet stale — surface so the user knows why
+                    // git ops may be queueing instead of silently waiting.
+                    debugLog("git-lock-present-not-stale", {
+                        ageMs: lockAge,
+                        thresholdMs: STALE_GIT_LOCK_THRESHOLD_MS,
+                    });
                 }
             }
         }

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -6,8 +6,14 @@
 import { readUnitRuntimeRecord, writeUnitRuntimeRecord, formatExecuteTaskRecoveryStatus, inspectExecuteTaskDurability, } from "./unit-runtime.js";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, writeBlockerPlaceholder, } from "./auto-recovery.js";
 import { existsSync } from "node:fs";
-import { resolveAgentEnd } from "./auto-loop.js";
+import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rctx) {
+    // Note on turn epoch: the bump is intentionally NOT unconditional at
+    // function entry. Two branches below (the "steering retry" paths) keep
+    // the same LLM turn alive and let it try again — they must NOT bump,
+    // otherwise the retry's legitimate writes get marked stale and drop.
+    // Each advance branch calls `bumpAndResolveSynthetic` to bump+resolve
+    // atomically. Search for that helper to find all supersede sites.
     const { basePath, verbose, currentUnitStartedAt, unitRecoveryCount } = rctx;
     const runtime = readUnitRuntimeRecord(basePath, unitType, unitId);
     const recoveryAttempts = runtime?.recoveryAttempts ?? 0;
@@ -36,7 +42,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         if (recoveryAttempts < maxRecoveryAttempts) {
@@ -90,7 +96,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts (${diagnostic}). Blocker artifacts written. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         // Fallback: couldn't write skip artifacts — pause as before.
@@ -115,7 +121,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} artifact already exists on disk. Advancing. (attempt ${attemptNumber})`, "info");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     if (recoveryAttempts < maxRecoveryAttempts) {
@@ -180,7 +186,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts. Blocker placeholder written to ${placeholder}. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     // Fallback: couldn't resolve artifact path — pause as before.

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -77,20 +77,21 @@ export function clearInFlightTools() {
 }
 // ─── Tool invocation error classification (#2883) ────────────────────────
 /**
- * Patterns that indicate a tool invocation failed due to malformed or truncated
- * JSON arguments — as opposed to a normal business-logic error from the tool
- * handler. When these errors occur, retrying the same unit will produce the same
- * failure, so the retry loop must be broken.
+ * Patterns that indicate a tool invocation failed deterministically before
+ * useful work could be completed — as opposed to a normal business-logic error
+ * from the tool handler. When these errors occur, retrying the same unit will
+ * produce the same failure, so the retry loop must be broken.
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON/i;
+const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
 /**
- * Returns true if the error message indicates a tool invocation failure due to
- * malformed/truncated arguments (as opposed to a normal tool execution error).
+ * Returns true if the error message indicates a deterministic invocation or
+ * policy failure (as opposed to a normal tool execution error).
  */
 export function isToolInvocationError(errorMsg) {
     if (!errorMsg)
         return false;
-    return TOOL_INVOCATION_ERROR_RE.test(errorMsg);
+    return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
 /**
  * Returns true if the error message indicates the tool was skipped because
@@ -102,3 +103,42 @@ export function isQueuedUserMessageSkip(errorMsg) {
         return false;
     return /^Skipped due to queued user message\.?$/i.test(errorMsg.trim());
 }
+// ─── Deterministic policy error classification (#4973, #4974) ──────────────
+/**
+ * Known deterministic policy error substrings. Each entry is a stable string
+ * that will appear in the tool error text content when the corresponding
+ * policy gate fires. Retrying these errors will always produce the same outcome.
+ *
+ * Add new entries here as new deterministic gates are introduced. Do NOT use
+ * regex — explicit substrings keep the list auditable.
+ */
+export const DETERMINISTIC_POLICY_ERROR_STRINGS = [
+    // gsd_summary_save write-gate: CONTEXT artifact blocked pending depth verification (#4973).
+    // Matches the fallback text in workflow-tool-executors.ts and the verbose reason
+    // from shouldBlockContextArtifactSaveInSnapshot at write-gate.ts:432-442.
+    "context write blocked",
+    "CONTEXT without depth verification",
+    // Raw write tool gate (#4973): shouldBlockContextWrite at write-gate.ts:390-399 emits
+    // "Cannot write to milestone CONTEXT.md without depth verification." for direct
+    // write tool calls to *-CONTEXT.md paths (different code path than gsd_summary_save).
+    "CONTEXT.md without depth verification",
+];
+/**
+ * Returns true if the error message indicates a deterministic policy gate
+ * blocked the tool call before execution. Retrying the same unit without
+ * changing behavior will hit the same gate, so auto-mode should pause instead
+ * of re-dispatching.
+ *
+ * Combines the regex-based gate set from #4974 (HARD BLOCK / queue planning /
+ * STATE.md / mechanical gate) and the substring-based set from #4973 (context
+ * write block / CONTEXT depth verification). Both branches landed on main
+ * independently and their parallel `isDeterministicPolicyError` declarations
+ * were not deduplicated at merge — this consolidated form preserves both
+ * matchers under a single export.
+ */
+export function isDeterministicPolicyError(errorMsg) {
+    if (!errorMsg)
+        return false;
+    return (DETERMINISTIC_POLICY_ERROR_RE.test(errorMsg) ||
+        DETERMINISTIC_POLICY_ERROR_STRINGS.some(s => errorMsg.includes(s)));
+}

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -20,9 +20,18 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import('./memory-extractor.js');
             const llmCallFn = buildMemoryLLMCall(ctx);
             if (llmCallFn) {
-                extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn).catch((err) => {
+                // Awaited: a fire-and-forget here lets memory-extractor writes land in
+                // .gsd/ after closeoutUnit returns but before the milestone merge
+                // runs, which made the working tree appear dirty to `git merge
+                // --squash` (root cause class of #4704). Completion latency is now
+                // bounded by the extractor's LLM call, which is the acceptable price
+                // for not racing the merge boundary.
+                try {
+                    await extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn);
+                }
+                catch (err) {
                     logWarning("engine", `memory extraction failed for ${unitType}/${unitId}: ${err.message}`);
-                });
+                }
             }
         }
         catch (err) { /* non-fatal */