gsd-pi 2.76.0 → 2.77.0-dev.1594b263e

package/dist/resources/extensions/gsd/state.js

@@ -15,6 +15,7 @@ import { logWarning, logError } from './workflow-logger.js';
 import { extractVerdict } from './verdict-parser.js';
 import { loadEffectiveGSDPreferences } from './preferences.js';
 import { detectPendingEscalation } from './escalation.js';
+import { isTerminalMilestoneSummaryContent } from './milestone-summary-classifier.js';
 import { isDbAvailable, wasDbOpenAttempted, getAllMilestones, getMilestone, getMilestoneSlices, getSliceTasks, getReplanHistory, getSlice, insertMilestone, insertSlice, insertTask, updateSliceStatus, updateTaskStatus, getPendingGateCountForTurn, autoHealSketchFlags, } from './gsd-db.js';
 /**
  * A "ghost" milestone directory contains only META.json (and no substantive
@@ -81,6 +82,10 @@ export function isMilestoneComplete(roadmap) {
 export function isValidationTerminal(validationContent) {
     return extractVerdict(validationContent) != null;
 }
+async function isTerminalMilestoneSummaryFile(path, loader) {
+    const content = await loader(path);
+    return content != null && isTerminalMilestoneSummaryContent(content);
+}
 const CACHE_TTL_MS = 100;
 let _stateCache = null;
 // ── Telemetry counters for derive-path observability ────────────────────────
@@ -138,18 +143,19 @@ export async function getActiveMilestoneId(basePath) {
         const content = roadmapFile ? await loadFile(roadmapFile) : null;
         if (!content) {
             const summaryFile = resolveMilestoneFile(basePath, mid, "SUMMARY");
-            if (summaryFile)
+            if (summaryFile && await isTerminalMilestoneSummaryFile(summaryFile, loadFile))
                 continue;
             if (isGhostMilestone(basePath, mid))
                 continue;
             return mid;
         }
         const roadmap = parseRoadmap(content);
-        if (!isMilestoneComplete(roadmap)) {
-            const summaryFile = resolveMilestoneFile(basePath, mid, "SUMMARY");
-            if (!summaryFile)
-                return mid;
-        }
+        const summaryFile = resolveMilestoneFile(basePath, mid, "SUMMARY");
+        if (summaryFile && await isTerminalMilestoneSummaryFile(summaryFile, loadFile))
+            continue;
+        if (!isMilestoneComplete(roadmap))
+            return mid;
+        return mid;
     }
     return null;
 }
@@ -182,7 +188,7 @@ export async function deriveState(basePath) {
             let synced = false;
             for (const diskId of diskIds) {
                 if (!isGhostMilestone(basePath, diskId)) {
-                    insertMilestone({ id: diskId, status: 'active' });
+                    insertMilestone(diskMilestoneInsert(basePath, diskId));
                     synced = true;
                 }
             }
@@ -240,6 +246,36 @@ function extractContextTitle(content, fallback) {
 // isStatusDone replaced by isClosedStatus from status-guards.ts (single source of truth).
 // Alias kept for backward compatibility within this file.
 const isStatusDone = isClosedStatus;
+function loadSync(path) {
+    if (!path)
+        return null;
+    try {
+        return readFileSync(path, "utf-8");
+    }
+    catch {
+        return null;
+    }
+}
+function diskMilestoneInsert(basePath, mid) {
+    const contextContent = loadSync(resolveMilestoneFile(basePath, mid, "CONTEXT"));
+    const draftContent = !contextContent ? loadSync(resolveMilestoneFile(basePath, mid, "CONTEXT-DRAFT")) : null;
+    const roadmapContent = loadSync(resolveMilestoneFile(basePath, mid, "ROADMAP"));
+    const summaryContent = loadSync(resolveMilestoneFile(basePath, mid, "SUMMARY"));
+    const roadmap = roadmapContent ? parseRoadmap(roadmapContent) : null;
+    const summary = summaryContent ? parseSummary(summaryContent) : null;
+    const summaryTerminal = summaryContent != null && isTerminalMilestoneSummaryContent(summaryContent);
+    const parked = resolveMilestoneFile(basePath, mid, "PARKED") !== null;
+    return {
+        id: mid,
+        title: roadmap
+            ? stripMilestonePrefix(roadmap.title)
+            : (contextContent || draftContent)
+                ? extractContextTitle(contextContent || draftContent, mid)
+                : (summary?.title || mid),
+        status: parked ? "parked" : summaryTerminal ? "complete" : "active",
+        depends_on: parseContextDependsOn(contextContent ?? draftContent),
+    };
+}
 /**
  * Derive GSD state from the milestones/slices/tasks DB tables.
  * Flag files (PARKED, VALIDATION, CONTINUE, REPLAN, REPLAN-TRIGGER, CONTEXT-DRAFT)
@@ -255,7 +291,7 @@ function reconcileDiskToDb(basePath) {
     let synced = false;
     for (const diskId of diskIds) {
         if (!dbIdSet.has(diskId) && !isGhostMilestone(basePath, diskId)) {
-            insertMilestone({ id: diskId, status: 'active' });
+            insertMilestone(diskMilestoneInsert(basePath, diskId));
             synced = true;
         }
     }
@@ -501,7 +537,7 @@ async function handleAllSlicesDone(basePath, activeMilestone, registry, requirem
     const validationContent = validationFile ? await loadFile(validationFile) : null;
     const validationTerminal = validationContent ? isValidationTerminal(validationContent) : false;
     const verdict = validationContent ? extractVerdict(validationContent) : undefined;
-    if (!validationTerminal || verdict === 'needs-remediation') {
+    if (!validationTerminal) {
         return {
             activeMilestone, activeSlice: null, activeTask: null,
             phase: 'validating-milestone',
@@ -511,6 +547,23 @@ async function handleAllSlicesDone(basePath, activeMilestone, registry, requirem
             progress: { milestones: milestoneProgress, slices: sliceProgress },
         };
     }
+    // All roadmap slices are done (enforced by caller) and verdict is
+    // needs-remediation — remediation cannot progress without new slices.
+    // Return blocked instead of re-dispatching validate-milestone (#4506).
+    if (verdict === 'needs-remediation') {
+        return {
+            activeMilestone, activeSlice: null, activeTask: null,
+            phase: 'blocked',
+            recentDecisions: [],
+            blockers: [
+                `Milestone ${activeMilestone.id} validation verdict is needs-remediation but all slices are complete. ` +
+                    `Add remediation slices via gsd_reassess_roadmap or override the verdict manually.`,
+            ],
+            nextAction: `Resolve ${activeMilestone.id} remediation before proceeding.`,
+            registry, requirements,
+            progress: { milestones: milestoneProgress, slices: sliceProgress },
+        };
+    }
     return {
         activeMilestone, activeSlice: null, activeTask: null,
         phase: 'completing-milestone',
@@ -533,9 +586,6 @@ function resolveSliceDependencies(activeMilestoneSlices) {
             return { activeSlice: null, activeSliceRow: null };
         }
     }
-    // First pass: find a slice with ALL dependencies satisfied (strict)
-    let bestFallback = null;
-    let bestFallbackSatisfied = -1;
     for (const s of activeMilestoneSlices) {
         if (isStatusDone(s.status))
             continue;
@@ -544,36 +594,25 @@ function resolveSliceDependencies(activeMilestoneSlices) {
         if (s.depends.every(dep => doneSliceIds.has(dep))) {
             return { activeSlice: { id: s.id, title: s.title }, activeSliceRow: s };
         }
-        // Track the slice with the most satisfied dependencies as fallback
-        const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
-        if (satisfied > bestFallbackSatisfied || (satisfied === bestFallbackSatisfied && !bestFallback)) {
-            bestFallback = s;
-            bestFallbackSatisfied = satisfied;
-        }
-    }
-    // Fallback: if no slice has all deps met but there ARE incomplete non-deferred
-    // slices, pick the one with the most deps satisfied. This prevents hard-blocking
-    // when dependency metadata is stale (e.g. after reassessment added/removed slices)
-    // or when deps reference slices from previous milestones.
-    if (bestFallback) {
-        const unmet = bestFallback.depends.filter(dep => !doneSliceIds.has(dep));
-        logWarning("state", `No slice has all deps satisfied — falling back to ${bestFallback.id} ` +
-            `(${bestFallbackSatisfied}/${bestFallback.depends.length} deps met, ` +
-            `unmet: ${unmet.join(", ")})`, { mid: activeMilestoneSlices[0]?.milestone_id, sid: bestFallback.id });
-        return { activeSlice: { id: bestFallback.id, title: bestFallback.title }, activeSliceRow: bestFallback };
     }
     return { activeSlice: null, activeSliceRow: null };
 }
 async function reconcileSliceTasks(basePath, milestoneId, sliceId, planFile) {
     let tasks = getSliceTasks(milestoneId, sliceId);
-    if (tasks.length === 0 && planFile) {
+    // #3600/#4974: import missing plan-file tasks even when the DB already has
+    // a partial task set. Existing DB task statuses stay authoritative.
+    if (planFile) {
         try {
             const planContent = await loadFile(planFile);
             if (planContent) {
                 const diskPlan = parsePlan(planContent);
                 if (diskPlan.tasks.length > 0) {
+                    const dbTaskIds = new Set(tasks.map(t => t.id));
+                    let inserted = 0;
                     for (let i = 0; i < diskPlan.tasks.length; i++) {
                         const t = diskPlan.tasks[i];
+                        if (dbTaskIds.has(t.id))
+                            continue;
                         try {
                             insertTask({
                                 id: t.id,
@@ -583,13 +622,16 @@ async function reconcileSliceTasks(basePath, milestoneId, sliceId, planFile) {
                                 status: t.done ? 'complete' : 'pending',
                                 sequence: i + 1,
                             });
+                            inserted++;
                         }
                         catch (insertErr) {
                             logWarning("reconcile", `failed to insert task ${t.id} from plan file: ${insertErr instanceof Error ? insertErr.message : String(insertErr)}`);
                         }
                     }
-                    tasks = getSliceTasks(milestoneId, sliceId);
-                    logWarning("reconcile", `imported ${tasks.length} tasks from plan file for ${milestoneId}/${sliceId} — DB was empty (#3600)`, { mid: milestoneId, sid: sliceId });
+                    if (inserted > 0) {
+                        tasks = getSliceTasks(milestoneId, sliceId);
+                        logWarning("reconcile", `imported ${inserted} missing task(s) from plan file for ${milestoneId}/${sliceId}`, { mid: milestoneId, sid: sliceId });
+                    }
                 }
             }
         }
@@ -971,7 +1013,7 @@ export async function _deriveStateImpl(basePath) {
         const rc = rf ? await cachedLoadFile(rf) : null;
         if (!rc) {
             const sf = resolveMilestoneFile(basePath, mid, "SUMMARY");
-            if (sf)
+            if (sf && await isTerminalMilestoneSummaryFile(sf, cachedLoadFile))
                 completeMilestoneIds.add(mid);
             continue;
         }
@@ -981,12 +1023,12 @@ export async function _deriveStateImpl(basePath) {
             // Summary is the terminal artifact — if it exists, the milestone is
             // complete even when roadmap checkboxes weren't ticked (#864).
             const sf = resolveMilestoneFile(basePath, mid, "SUMMARY");
-            if (sf)
+            if (sf && await isTerminalMilestoneSummaryFile(sf, cachedLoadFile))
                 completeMilestoneIds.add(mid);
             continue;
         }
         const sf = resolveMilestoneFile(basePath, mid, "SUMMARY");
-        if (sf)
+        if (sf && await isTerminalMilestoneSummaryFile(sf, cachedLoadFile))
             completeMilestoneIds.add(mid);
     }
     // Phase 2: Build registry using cached roadmaps (no re-parsing or re-reading)
@@ -1011,12 +1053,14 @@ export async function _deriveStateImpl(basePath) {
             const summaryFile = resolveMilestoneFile(basePath, mid, "SUMMARY");
             if (summaryFile) {
                 const summaryContent = await cachedLoadFile(summaryFile);
-                const summaryTitle = summaryContent
-                    ? (parseSummary(summaryContent).title || mid)
-                    : mid;
-                registry.push({ id: mid, title: summaryTitle, status: 'complete' });
-                completeMilestoneIds.add(mid);
-                continue;
+                if (summaryContent != null && isTerminalMilestoneSummaryContent(summaryContent)) {
+                    const summaryTitle = summaryContent
+                        ? (parseSummary(summaryContent).title || mid)
+                        : mid;
+                    registry.push({ id: mid, title: summaryTitle, status: 'complete' });
+                    completeMilestoneIds.add(mid);
+                    continue;
+                }
             }
             // Ghost milestone (only META.json, no CONTEXT/ROADMAP/SUMMARY) — skip entirely
             if (isGhostMilestone(basePath, mid))
@@ -1070,7 +1114,7 @@ export async function _deriveStateImpl(basePath) {
             const verdict = validationContent ? extractVerdict(validationContent) : undefined;
             // needs-remediation is terminal but requires re-validation (#3596)
             const needsRevalidation = !validationTerminal || verdict === 'needs-remediation';
-            if (summaryFile) {
+            if (summaryFile && await isTerminalMilestoneSummaryFile(summaryFile, cachedLoadFile)) {
                 // Summary exists → milestone is complete regardless of validation state.
                 // The summary is the terminal artifact (#864).
                 registry.push({ id: mid, title, status: 'complete' });
@@ -1101,7 +1145,7 @@ export async function _deriveStateImpl(basePath) {
             // Roadmap slices not all checked — but if a summary exists, the milestone
             // is still complete. The summary is the terminal artifact (#864).
             const summaryFile = resolveMilestoneFile(basePath, mid, "SUMMARY");
-            if (summaryFile) {
+            if (summaryFile && await isTerminalMilestoneSummaryFile(summaryFile, cachedLoadFile)) {
                 registry.push({ id: mid, title, status: 'complete' });
             }
             else if (!activeMilestoneFound) {
@@ -1278,9 +1322,11 @@ export async function _deriveStateImpl(basePath) {
             done: activeRoadmap.slices.length,
             total: activeRoadmap.slices.length,
         };
-        // Force re-validation when verdict is needs-remediation — remediation slices
-        // may have completed since the stale validation was written (#3596).
-        if (!validationTerminal || verdict === 'needs-remediation') {
+        // Force re-validation when VALIDATION.md is absent or non-terminal —
+        // remediation slices may have completed since the stale validation was
+        // written (#3596). But needs-remediation with all slices done is a dead
+        // end — return blocked to avoid an infinite dispatch loop (#4506).
+        if (!validationTerminal) {
             return {
                 activeMilestone,
                 activeSlice: null,
@@ -1297,6 +1343,26 @@ export async function _deriveStateImpl(basePath) {
                 },
             };
         }
+        if (verdict === 'needs-remediation') {
+            return {
+                activeMilestone,
+                activeSlice: null,
+                activeTask: null,
+                phase: 'blocked',
+                recentDecisions: [],
+                blockers: [
+                    `Milestone ${activeMilestone.id} validation verdict is needs-remediation but all slices are complete. ` +
+                        `Add remediation slices via gsd_reassess_roadmap or override the verdict manually.`,
+                ],
+                nextAction: `Resolve ${activeMilestone.id} remediation before proceeding.`,
+                registry,
+                requirements,
+                progress: {
+                    milestones: milestoneProgress,
+                    slices: sliceProgress,
+                },
+            };
+        }
         return {
             activeMilestone,
             activeSlice: null,
@@ -1348,8 +1414,6 @@ export async function _deriveStateImpl(basePath) {
         }
     }
     else {
-        let bestFallbackLegacy = null;
-        let bestFallbackLegacySatisfied = -1;
         for (const s of activeRoadmap.slices) {
             if (s.done)
                 continue;
@@ -1357,20 +1421,6 @@ export async function _deriveStateImpl(basePath) {
                 activeSlice = { id: s.id, title: s.title };
                 break;
             }
-            // Track best fallback
-            const satisfied = s.depends.filter(dep => doneSliceIds.has(dep)).length;
-            if (satisfied > bestFallbackLegacySatisfied) {
-                bestFallbackLegacy = s;
-                bestFallbackLegacySatisfied = satisfied;
-            }
-        }
-        // Fallback: if no slice has all deps met, pick the one with the most deps satisfied
-        if (!activeSlice && bestFallbackLegacy) {
-            const unmet = bestFallbackLegacy.depends.filter(dep => !doneSliceIds.has(dep));
-            logWarning("state", `No slice has all deps satisfied — falling back to ${bestFallbackLegacy.id} ` +
-                `(${bestFallbackLegacySatisfied}/${bestFallbackLegacy.depends.length} deps met, ` +
-                `unmet: ${unmet.join(", ")})`);
-            activeSlice = { id: bestFallbackLegacy.id, title: bestFallbackLegacy.title };
         }
     }
     if (!activeSlice) {

package/dist/resources/extensions/gsd/sync-lock.js

@@ -1,10 +1,9 @@
 // GSD Extension — Advisory Sync Lock
 // Prevents concurrent worktree syncs from colliding via a simple file lock.
-// Stale locks (mtime > 60s) are auto-overridden. Lock acquisition waits up
-// to 5 seconds then skips non-fatally.
-import { existsSync, statSync, unlinkSync } from "node:fs";
-import { join } from "node:path";
-import { atomicWriteSync } from "./atomic-write.js";
+// Stale locks (mtime > 60s, owner PID confirmed dead) are overridden. Lock
+// acquisition waits up to 5 seconds then skips non-fatally.
+import { closeSync, existsSync, mkdirSync, openSync, readFileSync, statSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
 const STALE_THRESHOLD_MS = 60_000; // 60 seconds
 const DEFAULT_TIMEOUT_MS = 5_000; // 5 seconds
 const SPIN_INTERVAL_MS = 100; // 100ms polling interval
@@ -17,60 +16,117 @@ function lockFilePath(basePath) {
 function sleepSync(ms) {
     Atomics.wait(SLEEP_VIEW, 0, 0, ms);
 }
+/** True if the given PID is alive in the current process namespace. */
+function isPidAlive(pid) {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        if (err.code === "EPERM")
+            return true;
+        return false;
+    }
+}
+/**
+ * Atomically create the lock file with `O_EXCL` semantics. Returns true on
+ * exclusive create, false if the file already existed. Any other error
+ * propagates.
+ */
+function tryCreateLockFile(lp, payload) {
+    // Ensure parent dir exists (`atomicWriteSync` previously did this implicitly).
+    try {
+        mkdirSync(dirname(lp), { recursive: true });
+    }
+    catch {
+        /* best-effort */
+    }
+    let fd;
+    try {
+        // "wx" → O_WRONLY | O_CREAT | O_EXCL — atomic create-if-not-exists on POSIX.
+        fd = openSync(lp, "wx");
+    }
+    catch (err) {
+        const code = err.code;
+        if (code === "EEXIST")
+            return false;
+        throw err;
+    }
+    try {
+        writeSync(fd, payload);
+    }
+    finally {
+        closeSync(fd);
+    }
+    return true;
+}
 /**
  * Acquire an advisory sync lock for the given basePath.
  * Returns { acquired: true } on success, { acquired: false } after timeout.
  *
- * - Creates lock file at {basePath}/.gsd/sync.lock with JSON { pid, acquired_at }
- * - If lock exists and mtime > 60s (stale), overrides it
- * - If lock exists and not stale, spins up to timeoutMs before giving up
+ * Replaces a non-atomic `existsSync` + `atomicWriteSync` (write-temp+rename,
+ * which is not exclusive-create) sequence that allowed two callers to both
+ * believe they had acquired the lock, corrupting the event log.
+ * (Issue #4980 CRIT-4)
+ *
+ * Stale-lock override now also verifies the recorded owner PID is dead
+ * before stealing — prevents a slow event-loop pause (>60s under heavy I/O)
+ * from making a legitimately-held lock appear stale and get stolen.
+ * (Issue #4980 M-concurrency-3)
  */
 export function acquireSyncLock(basePath, timeoutMs = DEFAULT_TIMEOUT_MS) {
     const lp = lockFilePath(basePath);
     const deadline = Date.now() + timeoutMs;
+    const lockData = JSON.stringify({ pid: process.pid, acquired_at: new Date().toISOString() }, null, 2);
     while (true) {
-        // Check if lock file exists
-        if (existsSync(lp)) {
-            // Check staleness
-            try {
-                const stat = statSync(lp);
-                const age = Date.now() - stat.mtimeMs;
-                if (age > STALE_THRESHOLD_MS) {
-                    // Stale lock — override it
-                    try {
-                        unlinkSync(lp);
+        // First try the fast path: atomic create. No check-then-write race.
+        try {
+            if (tryCreateLockFile(lp, lockData)) {
+                return { acquired: true };
+            }
+        }
+        catch {
+            /* unexpected — fall through to retry */
+        }
+        // File exists. Decide whether to steal (stale + owner dead) or wait.
+        let canSteal = false;
+        try {
+            const stat = statSync(lp);
+            const age = Date.now() - stat.mtimeMs;
+            if (age > STALE_THRESHOLD_MS) {
+                // Verify the recorded owner PID is dead before stealing.
+                let ownerAlive = false;
+                try {
+                    const data = JSON.parse(readFileSync(lp, "utf-8"));
+                    if (typeof data.pid === "number" && data.pid !== process.pid) {
+                        ownerAlive = isPidAlive(data.pid);
                     }
-                    catch { /* race: already removed */ }
                 }
-                else {
-                    // Lock is held and not stale — wait or give up
-                    if (Date.now() >= deadline) {
-                        return { acquired: false };
-                    }
-                    sleepSync(SPIN_INTERVAL_MS);
-                    continue;
+                catch {
+                    // Lock contents unreadable — be conservative and steal only on age.
+                    // A garbage lock file that we cannot parse is safer to remove than
+                    // to leave wedging the lock indefinitely.
                 }
+                canSteal = !ownerAlive;
             }
-            catch {
-                // stat failed (file removed between exists check and stat) — try to acquire
-            }
-        }
-        // Lock file does not exist (or was just removed) — try to write it
-        try {
-            const lockData = {
-                pid: process.pid,
-                acquired_at: new Date().toISOString(),
-            };
-            atomicWriteSync(lp, JSON.stringify(lockData, null, 2));
-            return { acquired: true };
         }
         catch {
-            // Write failed (race condition with another process) — retry or give up
-            if (Date.now() >= deadline) {
-                return { acquired: false };
+            // stat failed (file removed between exists and stat) — retry create.
+            continue;
+        }
+        if (canSteal) {
+            try {
+                unlinkSync(lp);
             }
-            sleepSync(SPIN_INTERVAL_MS);
+            catch { /* race: already removed */ }
+            // Loop back to retry create.
+            continue;
+        }
+        // Lock is held and not stale (or owner is alive) — wait or give up.
+        if (Date.now() >= deadline) {
+            return { acquired: false };
         }
+        sleepSync(SPIN_INTERVAL_MS);
     }
 }
 /**

package/dist/resources/extensions/gsd/token-counter.js

@@ -16,7 +16,11 @@ async function getEncoder() {
     try {
         // @ts-ignore — tiktoken may not have type declarations in extensions tsconfig
         const tiktoken = await import("tiktoken");
-        encoder = tiktoken.encoding_for_model("gpt-4o");
+        // Use cl100k_base — the most conservative and broadly compatible BPE encoding.
+        // It is shared by GPT-3.5/GPT-4 and gives a safer (larger) estimate than
+        // gpt-4o's o200k_base encoding, which produces fewer tokens for the same text
+        // and would cause context windows for non-OpenAI providers to be under-counted.
+        encoder = tiktoken.get_encoding("cl100k_base");
         return encoder;
     }
     catch {
@@ -24,19 +28,32 @@ async function getEncoder() {
         return null;
     }
 }
-export async function countTokens(text) {
+/**
+ * Count tokens in `text` using tiktoken (cl100k_base) when available.
+ *
+ * When tiktoken is not loaded, falls back to a provider-aware character-ratio
+ * estimate via `estimateTokensForProvider`. Passing `provider` is recommended
+ * so the heuristic fallback is as accurate as possible.
+ */
+export async function countTokens(text, provider) {
     const enc = await getEncoder();
     if (enc) {
         const tokens = enc.encode(text);
         return tokens.length;
     }
-    return Math.ceil(text.length / 4);
+    return estimateTokensForProvider(text, provider ?? "unknown");
 }
-export function countTokensSync(text) {
+/**
+ * Synchronous token count — only accurate after `initTokenCounter()` resolves.
+ *
+ * Before init, or when tiktoken is unavailable, falls back to a provider-aware
+ * character-ratio estimate. Passing `provider` is recommended.
+ */
+export function countTokensSync(text, provider) {
     if (encoder) {
         return encoder.encode(text).length;
     }
-    return Math.ceil(text.length / 4);
+    return estimateTokensForProvider(text, provider ?? "unknown");
 }
 export async function initTokenCounter() {
     const enc = await getEncoder();

package/dist/resources/extensions/gsd/tools/complete-milestone.js

@@ -6,7 +6,7 @@
  * for recovery, and invalidates caches.
  */
 import { join } from "node:path";
-import { mkdirSync } from "node:fs";
+import { mkdirSync, existsSync } from "node:fs";
 import { transaction, getMilestone, getMilestoneSlices, getSliceTasks, updateMilestoneStatus, } from "../gsd-db.js";
 import { resolveMilestonePath, clearPathCache } from "../paths.js";
 import { isClosedStatus } from "../status-guards.js";
@@ -141,15 +141,21 @@ export async function handleCompleteMilestone(params, basePath) {
         mkdirSync(manualDir, { recursive: true });
         summaryPath = join(manualDir, `${params.milestoneId}-SUMMARY.md`);
     }
-    try {
-        await saveFile(summaryPath, summaryMd);
-    }
-    catch (renderErr) {
-        // Disk render failed — roll back DB status so state stays consistent
-        logWarning("tool", `complete_milestone — disk render failed, rolling back DB status: ${renderErr.message}`);
-        updateMilestoneStatus(params.milestoneId, 'active', null);
-        invalidateStateCache();
-        return { error: `disk render failed: ${renderErr.message}` };
+    // Guard (#4598): if SUMMARY.md already exists on disk, do not overwrite it.
+    // This handles re-dispatch scenarios (DB/disk state divergence) where a prior
+    // completion already wrote the file. Overwriting would silently destroy the
+    // richer content the agent produced during the original completion run.
+    if (!existsSync(summaryPath)) {
+        try {
+            await saveFile(summaryPath, summaryMd);
+        }
+        catch (renderErr) {
+            // Disk render failed — roll back DB status so state stays consistent
+            logWarning("tool", `complete_milestone — disk render failed, rolling back DB status: ${renderErr.message}`);
+            updateMilestoneStatus(params.milestoneId, 'active', null);
+            invalidateStateCache();
+            return { error: `disk render failed: ${renderErr.message}` };
+        }
     }
     // Invalidate all caches
     invalidateStateCache();

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -16,6 +16,7 @@ import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapCheckboxes } from "../markdown-renderer.js";
+import { isStaleWrite } from "../auto/turn-epoch.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -228,6 +229,10 @@ export async function handleCompleteSlice(params, basePath) {
         }
         const slice = getSlice(params.milestoneId, params.sliceId);
         if (slice && isClosedStatus(slice.status)) {
+            if (isStaleWrite("complete-slice")) {
+                guardError = "__stale_duplicate__";
+                return;
+            }
             guardError = `slice ${params.sliceId} is already complete — use gsd_slice_reopen first if you need to redo it`;
             return;
         }
@@ -248,6 +253,22 @@ export async function handleCompleteSlice(params, basePath) {
         insertSlice({ id: params.sliceId, milestoneId: params.milestoneId, title: params.sliceId });
         updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
     });
+    if (guardError === "__stale_duplicate__") {
+        // Stale duplicate from a turn superseded by timeout recovery. Return a
+        // non-mutating success so the orphaned LLM tool call unwinds quietly.
+        const sliceDir = resolveSlicePath(basePath, params.milestoneId, params.sliceId);
+        const staleSummaryPath = sliceDir
+            ? join(sliceDir, `${params.sliceId}-SUMMARY.md`)
+            : join(basePath, ".gsd", "milestones", params.milestoneId, "slices", params.sliceId, `${params.sliceId}-SUMMARY.md`);
+        return {
+            sliceId: params.sliceId,
+            milestoneId: params.milestoneId,
+            summaryPath: staleSummaryPath,
+            uatPath: staleSummaryPath.replace(/-SUMMARY\.md$/, "-UAT.md"),
+            duplicate: true,
+            stale: true,
+        };
+    }
     if (guardError) {
         return { error: guardError };
     }