gsd-pi 2.76.0 → 2.77.0-dev.1594b263e

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -4,7 +4,8 @@
  * Imports from: auto/types, auto/resolve
  */
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
-import { _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { getCurrentTurnGeneration, runWithTurnGeneration, } from "./turn-epoch.js";
 import { debugLog } from "../debug-logger.js";
 import { logWarning } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
@@ -26,15 +27,24 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     let sessionResult;
     let sessionTimeoutHandle;
     const mySessionSwitchGeneration = ++sessionSwitchGeneration;
+    // #3731: Cancellation controller for newSession(). When the session-creation
+    // timeout fires, we abort this controller so that the still-in-flight
+    // newSession() discards itself after await this.abort() completes, preventing
+    // it from capturing the (now-root) process.cwd() and rebuilding the tool
+    // runtime with the wrong cwd.
+    const sessionAbortController = new AbortController();
     _setSessionSwitchInFlight(true);
     try {
-        const sessionPromise = s.cmdCtx.newSession().finally(() => {
+        const sessionPromise = s.cmdCtx.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
             if (sessionSwitchGeneration === mySessionSwitchGeneration) {
                 _setSessionSwitchInFlight(false);
             }
         });
         const timeoutPromise = new Promise((resolve) => {
-            sessionTimeoutHandle = setTimeout(() => resolve({ cancelled: true }), NEW_SESSION_TIMEOUT_MS);
+            sessionTimeoutHandle = setTimeout(() => {
+                sessionAbortController.abort();
+                resolve({ cancelled: true });
+            }, NEW_SESSION_TIMEOUT_MS);
         });
         sessionResult = await Promise.race([sessionPromise, timeoutPromise]);
     }
@@ -92,6 +102,40 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     catch (e) {
         logWarning("engine", "Failed to chdir to basePath before dispatch", { basePath: s.basePath, error: String(e) });
     }
+    // ── Provider request-readiness pre-check (#4555) ──
+    // Verify the provider can accept requests before dispatching. If the token
+    // has expired since bootstrap, return cancelled immediately so the unit is
+    // not wasted on a guaranteed 401.
+    {
+        const provider = s.currentUnitModel?.provider ?? ctx.model?.provider;
+        const registry = ctx.modelRegistry;
+        if (provider && registry != null && typeof registry.isProviderRequestReady === "function") {
+            let ready = false;
+            try {
+                ready = registry.isProviderRequestReady(provider);
+            }
+            catch {
+                ready = false;
+            }
+            if (!ready) {
+                _clearCurrentResolve();
+                return {
+                    status: "cancelled",
+                    errorContext: {
+                        message: `Provider ${provider} is not request-ready (login/token expired)`,
+                        category: "provider",
+                        isTransient: false,
+                    },
+                };
+            }
+        }
+    }
+    // ── Capture turn generation for stale-write detection ──
+    // Any write site reached via the sendMessage → tool-call → await chain
+    // below sees this generation via AsyncLocalStorage. If a timeout recovery
+    // or cancellation bumps the generation while this turn is in flight, those
+    // writes see themselves as stale and self-drop.
+    const capturedTurnGen = getCurrentTurnGeneration();
     // ── Send the prompt ──
     debugLog("runUnit", { phase: "send-message", unitType, unitId });
     pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });
@@ -107,7 +151,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
         }, UNIT_HARD_TIMEOUT_MS);
     });
-    const result = await Promise.race([unitPromise, timeoutResult]);
+    const result = await runWithTurnGeneration(capturedTurnGen, () => Promise.race([unitPromise, timeoutResult]));
     if (unitTimeoutHandle)
         clearTimeout(unitTimeoutHandle);
     debugLog("runUnit", {

package/dist/resources/extensions/gsd/auto/session.js

@@ -16,9 +16,7 @@
  * `let` or `var` declarations.
  */
 // ─── Constants ───────────────────────────────────────────────────────────────
-export const MAX_UNIT_DISPATCHES = 3;
 export const STUB_RECOVERY_THRESHOLD = 2;
-export const MAX_LIFETIME_DISPATCHES = 6;
 export const NEW_SESSION_TIMEOUT_MS = 120_000;
 // ─── AutoSession ─────────────────────────────────────────────────────────────
 export class AutoSession {
@@ -65,6 +63,8 @@ export class AutoSession {
     currentDispatchedModelId = null;
     originalModelId = null;
     originalModelProvider = null;
+    autoModeStartThinkingLevel = null;
+    originalThinkingLevel = null;
     lastBudgetAlertLevel = 0;
     // ── Recovery ─────────────────────────────────────────────────────────────
     pendingCrashRecovery = null;
@@ -77,6 +77,17 @@ export class AutoSession {
     lastStateRebuildAt = 0;
     // ── Sidecar queue ─────────────────────────────────────────────────────
     sidecarQueue = [];
+    // ── Pre-exec gate failure context (#4551) ───────────────────────────
+    /**
+     * Persisted when a pre-execution gate fails on a plan-slice or refine-slice
+     * unit. The planning → plan-slice dispatch rule reads this field and injects
+     * the failure details into the next re-dispatch prompt so the LLM can fix the
+     * specific issues instead of producing an identical plan.
+     *
+     * Cleared after it has been consumed (injected into the prompt) to avoid
+     * stale context bleeding into unrelated slices.
+     */
+    lastPreExecFailure = null;
     // ── Tool invocation errors (#2883) ──────────────────────────────────
     /** Set when a GSD tool execution ends with isError due to malformed/truncated
      *  JSON arguments. Checked by postUnitPreVerification to break retry loops. */
@@ -92,6 +103,11 @@ export class AutoSession {
     /** Set to true after phases.ts successfully calls mergeAndExit, so that
      *  stopAuto does not attempt the same merge a second time (#2645). */
     milestoneMergedInPhases = false;
+    // #4765 — slice-cadence collapse: main-branch SHAs at the moment each
+    // milestone's first slice merge began. Used by resquashMilestoneOnMain at
+    // milestone completion to collapse N slice commits into one. Cleared when
+    // the milestone finishes (or resquash runs).
+    milestoneStartShas = new Map();
     // ── Dispatch circuit breakers ──────────────────────────────────────
     rewriteAttemptCount = 0;
     /** Tracks consecutive bootstrap attempts that found phase === "complete".
@@ -137,7 +153,12 @@ export class AutoSession {
         this.unitLifetimeDispatches.clear();
     }
     get lockBasePath() {
-        return this.originalBasePath || this.basePath;
+        // Prefer originalBasePath (project root); fall back to basePath.
+        // Strip /.gsd/worktrees/ suffix if basePath is itself a worktree path
+        // to avoid reading/writing the lock inside the worktree (#3729).
+        const resolved = this.originalBasePath || this.basePath;
+        const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+        return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
     }
     reset() {
         this.clearTimers();
@@ -177,6 +198,8 @@ export class AutoSession {
         this.currentDispatchedModelId = null;
         this.originalModelId = null;
         this.originalModelProvider = null;
+        this.autoModeStartThinkingLevel = null;
+        this.originalThinkingLevel = null;
         this.lastBudgetAlertLevel = 0;
         // Recovery
         this.pendingCrashRecovery = null;
@@ -195,11 +218,13 @@ export class AutoSession {
         this.sidecarQueue = [];
         this.rewriteAttemptCount = 0;
         this.consecutiveCompleteBootstraps = 0;
+        this.lastPreExecFailure = null;
         this.lastToolInvocationError = null;
         this.lastGitActionFailure = null;
         this.lastGitActionStatus = null;
         this.isolationDegraded = false;
         this.milestoneMergedInPhases = false;
+        this.milestoneStartShas = new Map();
         this.checkpointSha = null;
         // Signal handler
         this.sigtermHandler = null;

package/dist/resources/extensions/gsd/auto/turn-epoch.js

@@ -0,0 +1,95 @@
+/**
+ * auto/turn-epoch.ts — Turn generation counter + AsyncLocalStorage-backed
+ * capture for stale-turn write dropping.
+ *
+ * Problem: when auto-timeout-recovery synthetically resolves a timed-out
+ * unit so the loop can advance, the original LLM turn keeps running in the
+ * background. Its subsequent writes (journal events, audit events, tool
+ * calls that flow through closeout) then race the replacement unit's
+ * writes. DB-level guards (complete-task/complete-slice) block double
+ * state transitions, but journal/audit/closeout side-effects still fire
+ * with fresh identifiers and pollute forensics.
+ *
+ * Containment: every time we decide a turn is done (timeout recovery,
+ * explicit cancellation), bump a module-level generation counter.
+ * Turn-aware call sites wrap their body in `runWithTurnGeneration`, which
+ * captures the generation into AsyncLocalStorage. Write sites deep in the
+ * stack call `isStaleWrite` — if the captured generation is older than
+ * current, the turn has been superseded and the write is dropped.
+ *
+ * Failure mode: if AsyncLocalStorage context is lost across some exotic
+ * async boundary (e.g. a native-side worker callback), the write site sees
+ * `no-store` and falls through to current behavior — the write proceeds
+ * normally. That is a safe default; the correctness regression is only
+ * "noisier forensics under rare boundary loss," not duplicated state.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { debugLog } from "../debug-logger.js";
+let _currentGeneration = 0;
+const turnContext = new AsyncLocalStorage();
+/** Current turn generation. Mutated only by bumpTurnGeneration. */
+export function getCurrentTurnGeneration() {
+    return _currentGeneration;
+}
+/**
+ * Bump the turn generation and return the new value. Every caller should
+ * pass a short `reason` string so forensics can reconstruct why a given
+ * turn was marked stale.
+ */
+export function bumpTurnGeneration(reason) {
+    _currentGeneration += 1;
+    debugLog("turnEpoch.bump", { reason, newGeneration: _currentGeneration });
+    return _currentGeneration;
+}
+/**
+ * Run fn() with `capturedGen` attached to AsyncLocalStorage so that any
+ * write site reached from within fn() can check for staleness without
+ * parameter threading.
+ */
+export function runWithTurnGeneration(capturedGen, fn) {
+    return turnContext.run({ capturedGen }, fn);
+}
+/**
+ * True when the current async context was started at a turn generation
+ * older than the current one — meaning the turn has been superseded by
+ * recovery/cancellation since it began.
+ *
+ * Returns false when there is no captured generation (e.g. the write is
+ * happening outside any wrapped turn). That is the safe default: writes
+ * proceed as they did before this epoch was introduced.
+ */
+export function isStaleWrite(component) {
+    const store = turnContext.getStore();
+    if (!store)
+        return false;
+    const captured = store.capturedGen;
+    const current = _currentGeneration;
+    if (captured < current) {
+        debugLog("turnEpoch.stale", {
+            component: component ?? "unknown",
+            captured,
+            current,
+        });
+        return true;
+    }
+    return false;
+}
+/**
+ * Snapshot of both the captured turn generation and the current one.
+ * Used by closeoutUnit to persist an orphan-marker entry instead of
+ * silently skipping the full closeout on a stale turn.
+ */
+export function describeTurnEpoch() {
+    const store = turnContext.getStore();
+    const captured = store?.capturedGen ?? null;
+    const current = _currentGeneration;
+    return {
+        captured,
+        current,
+        stale: captured !== null && captured < current,
+    };
+}
+/** Test helper — resets module state so tests start from a known baseline. */
+export function _resetTurnEpoch() {
+    _currentGeneration = 0;
+}

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -18,10 +18,46 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { logWarning, logError } from "./workflow-logger.js";
 import { join } from "node:path";
 import { hasImplementationArtifacts } from "./auto-recovery.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { buildDiscussMilestonePrompt, buildResearchMilestonePrompt, buildPlanMilestonePrompt, buildResearchSlicePrompt, buildPlanSlicePrompt, buildRefineSlicePrompt, buildExecuteTaskPrompt, buildCompleteSlicePrompt, buildCompleteMilestonePrompt, buildValidateMilestonePrompt, buildReplanSlicePrompt, buildRunUatPrompt, buildReassessRoadmapPrompt, buildRewriteDocsPrompt, buildReactiveExecutePrompt, buildGateEvaluatePrompt, buildParallelResearchSlicesPrompt, checkNeedsReassessment, checkNeedsRunUat, } from "./auto-prompts.js";
 import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
+import { getMilestonePipelineVariant } from "./milestone-scope-classifier.js";
+import { EXECUTION_ENTRY_PHASES, hasFinalizedMilestoneContext } from "./uok/plan-v2.js";
+import { isAutoActive } from "./auto.js";
+import { markDepthVerified } from "./bootstrap/write-gate.js";
+let reassessmentChecker = checkNeedsReassessment;
+export function setReassessmentCheckerForTest(checker) {
+    const previous = reassessmentChecker;
+    reassessmentChecker = checker;
+    return () => {
+        reassessmentChecker = previous;
+    };
+}
+async function readUatGateVerdict(basePath, mid, sliceId) {
+    const uatFile = resolveSliceFile(basePath, mid, sliceId, "UAT");
+    const assessmentFile = resolveSliceFile(basePath, mid, sliceId, "ASSESSMENT");
+    const uatContent = uatFile ? await loadFile(uatFile) : null;
+    const uatType = uatContent ? extractUatType(uatContent) : undefined;
+    const assessmentContent = assessmentFile ? await loadFile(assessmentFile) : null;
+    if (assessmentContent) {
+        const assessmentVerdict = extractVerdict(assessmentContent);
+        if (assessmentVerdict) {
+            return {
+                verdict: assessmentVerdict,
+                uatType: uatType ?? extractUatType(assessmentContent),
+            };
+        }
+    }
+    if (uatContent) {
+        const legacyUatVerdict = extractVerdict(uatContent);
+        if (legacyUatVerdict) {
+            return { verdict: legacyUatVerdict, uatType };
+        }
+    }
+    return null;
+}
 function missingSliceStop(mid, phase) {
     return {
         action: "stop",
@@ -155,6 +191,45 @@ export const DISPATCH_RULES = [
             };
         },
     },
+    {
+        // #4671 — Recovery path for execution-entry phases with missing CONTEXT.md.
+        //
+        // Once `deriveStateFromDb` returns an execution-entry phase (executing /
+        // summarizing / validating-milestone / completing-milestone), the
+        // pre-planning guard at `pre-planning (no context) → discuss-milestone`
+        // no longer fires. The plan-v2 gate correctly detects the missing context
+        // but can only block — it cannot redispatch. Without this rule the
+        // milestone is stuck until `/gsd doctor heal` repairs it (and heal
+        // historically missed this check too).
+        //
+        // Fire BEFORE the execution-entry phase rules so we redispatch to
+        // `discuss-milestone` instead of hitting the plan-v2 gate.
+        name: "execution-entry phase (no context) → discuss-milestone",
+        match: async ({ state, mid, midTitle, basePath, structuredQuestionsAvailable }) => {
+            if (!EXECUTION_ENTRY_PHASES.has(state.phase))
+                return null;
+            // Align with the plan-v2 gate's lookup semantics: whitespace-only counts
+            // as missing, and an auto worktree may fall back to GSD_PROJECT_ROOT.
+            if (hasFinalizedMilestoneContext(basePath, mid))
+                return null;
+            // H6 fix (#4973): In auto-mode there is no human to answer the
+            // depth-verification ask_user_questions, so the write-gate deadlocks.
+            // Pre-mark the milestone as depth-verified so gsd_summary_save({artifact_type:"CONTEXT"})
+            // is not blocked. Safe ordering: session_switch fires clearDiscussionFlowState()
+            // (register-hooks.ts:106) before before_agent_start, which fires before resolveDispatch
+            // reaches this match fn — so this call always happens after any session-switch reset.
+            // Interactive sessions (isAutoActive()===false) are unaffected.
+            if (isAutoActive()) {
+                markDepthVerified(mid, basePath);
+            }
+            return {
+                action: "dispatch",
+                unitType: "discuss-milestone",
+                unitId: mid,
+                prompt: await buildDiscussMilestonePrompt(mid, midTitle, basePath, structuredQuestionsAvailable),
+            };
+        },
+    },
     {
         name: "summarizing → complete-slice",
         match: async ({ state, mid, midTitle, basePath }) => {
@@ -205,27 +280,29 @@ export const DISPATCH_RULES = [
             // Only applies when UAT dispatch is enabled
             if (!prefs?.uat_dispatch)
                 return null;
-            const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-            // DB-first: get completed slices from DB
-            let completedSliceIds;
+            // DB-first: prefer closed slices from DB; fall back to ROADMAP on disk.
+            let closedSliceIds;
             if (isDbAvailable()) {
-                completedSliceIds = getMilestoneSlices(mid)
-                    .filter(s => s.status === "complete")
+                closedSliceIds = getMilestoneSlices(mid)
+                    .filter(s => isClosedStatus(s.status))
                     .map(s => s.id);
             }
             else {
-                return null;
+                // Filesystem fallback for degraded / unmigrated projects.
+                // `slice.done` in the parsed ROADMAP is the disk-level closed signal.
+                const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
+                const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
+                if (!roadmapContent)
+                    return null;
+                const roadmap = parseRoadmap(roadmapContent);
+                closedSliceIds = roadmap.slices.filter(s => s.done).map(s => s.id);
             }
-            for (const sliceId of completedSliceIds) {
-                const resultFile = resolveSliceFile(basePath, mid, sliceId, "UAT");
-                if (!resultFile)
+            for (const sliceId of closedSliceIds) {
+                const result = await readUatGateVerdict(basePath, mid, sliceId);
+                if (!result)
                     continue;
-                const content = await loadFile(resultFile);
-                if (!content)
-                    continue;
-                const verdict = extractVerdict(content);
-                const uatType = extractUatType(content);
-                if (verdict && !isAcceptableUatVerdict(verdict, uatType)) {
+                const { verdict, uatType } = result;
+                if (!isAcceptableUatVerdict(verdict, uatType)) {
                     return {
                         action: "stop",
                         reason: `UAT verdict for ${sliceId} is "${verdict}" — blocking progression until resolved.\nReview the UAT result and update the verdict to PASS, or re-run /gsd auto after fixing.`,
@@ -241,12 +318,16 @@ export const DISPATCH_RULES = [
         match: async ({ state, mid, midTitle, basePath, prefs }) => {
             if (prefs?.phases?.skip_reassess)
                 return null;
-            // Default reassess_after_slice to true — reassessment after slice completion
-            // is essential for roadmap integrity. Opt-out via explicit `false`.
-            const reassessEnabled = prefs?.phases?.reassess_after_slice ?? true;
+            // Default reassess_after_slice to false per ADR-003 §4 — most reassess
+            // units conclude "roadmap is fine" and burn a session for no change.
+            // The plan-slice prompt now carries a reassessment preamble so the
+            // next slice's planner does JIT roadmap verification at zero extra
+            // cost. Opt-in via explicit `reassess_after_slice: true` (e.g.
+            // burn-max profile) when you want the dedicated reassess session.
+            const reassessEnabled = prefs?.phases?.reassess_after_slice ?? false;
             if (!reassessEnabled)
                 return null;
-            const needsReassess = await checkNeedsReassessment(basePath, mid, state);
+            const needsReassess = await reassessmentChecker(basePath, mid, state);
             if (!needsReassess)
                 return null;
             return {
@@ -262,6 +343,12 @@ export const DISPATCH_RULES = [
         match: async ({ state, mid, midTitle, basePath, structuredQuestionsAvailable }) => {
             if (state.phase !== "needs-discussion")
                 return null;
+            // H6 fix (#4973): auto-mark depth-verified so the write-gate does not
+            // deadlock in non-interactive (auto-mode) runs. See ordering note at
+            // "execution-entry phase (no context) → discuss-milestone" above.
+            if (isAutoActive()) {
+                markDepthVerified(mid, basePath);
+            }
             return {
                 action: "dispatch",
                 unitType: "discuss-milestone",
@@ -279,6 +366,12 @@ export const DISPATCH_RULES = [
             const hasContext = !!(contextFile && (await loadFile(contextFile)));
             if (hasContext)
                 return null; // fall through to next rule
+            // H6 fix (#4973): auto-mark depth-verified so the write-gate does not
+            // deadlock in non-interactive (auto-mode) runs. See ordering note at
+            // "execution-entry phase (no context) → discuss-milestone" above.
+            if (isAutoActive()) {
+                markDepthVerified(mid, basePath);
+            }
             return {
                 action: "dispatch",
                 unitType: "discuss-milestone",
@@ -319,6 +412,30 @@ export const DISPATCH_RULES = [
             };
         },
     },
+    {
+        name: "planning (require_slice_discussion) → pause for discussion (#3454)",
+        match: async ({ state, mid, basePath, prefs }) => {
+            if (state.phase !== "planning")
+                return null;
+            if (!prefs?.phases?.require_slice_discussion)
+                return null;
+            if (!state.activeSlice)
+                return null;
+            // Only pause if the slice has no context file yet (discussion not done).
+            // resolveSliceFile returns null when the file does not exist on disk,
+            // but cachedReaddir could return a stale hit — verify with existsSync
+            // so the guard is defence-in-depth and the contract is explicit at the
+            // call site.
+            const sliceContextFile = resolveSliceFile(basePath, mid, state.activeSlice.id, "CONTEXT");
+            if (sliceContextFile && existsSync(sliceContextFile))
+                return null; // discussion already done, proceed
+            return {
+                action: "stop",
+                reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.`,
+                level: "info",
+            };
+        },
+    },
     {
         // Keep this rule before the single-slice research rule so the multi-slice
         // path wins whenever 2+ slices are ready.
@@ -328,6 +445,12 @@ export const DISPATCH_RULES = [
                 return null;
             if (prefs?.phases?.skip_research || prefs?.phases?.skip_slice_research)
                 return null;
+            // #4781 phase 2: trivial-scope milestones skip dedicated slice research.
+            // plan-slice absorbs the lightweight discovery a trivial deliverable
+            // needs. Null result (DB unavailable / unknown) falls through to today's
+            // behavior.
+            if (await getMilestonePipelineVariant(mid) === "trivial")
+                return null;
             // Load roadmap to find all slices
             const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
             const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
@@ -377,6 +500,9 @@ export const DISPATCH_RULES = [
             // Phase skip: skip research when preference or profile says so
             if (prefs?.phases?.skip_research || prefs?.phases?.skip_slice_research)
                 return null;
+            // #4781 phase 2: trivial-scope milestones skip dedicated slice research.
+            if (await getMilestonePipelineVariant(mid) === "trivial")
+                return null;
             if (!state.activeSlice)
                 return missingSliceStop(mid, state.phase);
             const sid = state.activeSlice.id;
@@ -451,18 +577,31 @@ export const DISPATCH_RULES = [
     },
     {
         name: "planning → plan-slice",
-        match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry }) => {
+        match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry, session }) => {
             if (state.phase !== "planning")
                 return null;
             if (!state.activeSlice)
                 return missingSliceStop(mid, state.phase);
             const sid = state.activeSlice.id;
             const sTitle = state.activeSlice.title;
+            // #4551: Consume any persisted pre-exec failure for this slice so the
+            // re-dispatched prompt includes the exact blocked references. Clear the
+            // field immediately after reading to prevent stale context leaking into
+            // a later, unrelated plan-slice run.
+            const unitId = `${mid}/${sid}`;
+            let priorPreExecFailure;
+            if (session?.lastPreExecFailure?.unitId === unitId) {
+                priorPreExecFailure = {
+                    blockingFindings: session.lastPreExecFailure.blockingFindings,
+                    verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,
+                };
+                session.lastPreExecFailure = null;
+            }
             return {
                 action: "dispatch",
                 unitType: "plan-slice",
-                unitId: `${mid}/${sid}`,
-                prompt: await buildPlanSlicePrompt(mid, midTitle, sid, sTitle, basePath, undefined, { sessionContextWindow, modelRegistry }),
+                unitId,
+                prompt: await buildPlanSlicePrompt(mid, midTitle, sid, sTitle, basePath, undefined, { sessionContextWindow, modelRegistry, priorPreExecFailure }),
             };
         },
     },
@@ -645,22 +784,29 @@ export const DISPATCH_RULES = [
                     level: "error",
                 };
             }
-            // Skip preference: write a minimal pass-through VALIDATION file
-            if (prefs?.phases?.skip_milestone_validation) {
+            // #4781 phase 2: trivial-scope milestones skip the dedicated validate
+            // unit — complete-milestone's own verification steps (3/4/5 in the
+            // closer prompt) are sufficient proof for contained deliverables.
+            const trivialVariant = await getMilestonePipelineVariant(mid) === "trivial";
+            // Skip preference OR trivial scope: write a minimal pass-through VALIDATION file.
+            if (prefs?.phases?.skip_milestone_validation || trivialVariant) {
                 const mDir = resolveMilestonePath(basePath, mid);
                 if (mDir) {
                     if (!existsSync(mDir))
                         mkdirSync(mDir, { recursive: true });
                     const validationPath = join(mDir, buildMilestoneFileName(mid, "VALIDATION"));
+                    const skipSource = trivialVariant
+                        ? "trivial-scope pipeline variant (#4781)"
+                        : "`skip_milestone_validation` preference";
                     const content = [
                         "---",
                         "verdict: pass",
                         "remediation_round: 0",
                         "---",
                         "",
-                        "# Milestone Validation (skipped by preference)",
+                        "# Milestone Validation (skipped)",
                         "",
-                        "Milestone validation was skipped via `skip_milestone_validation` preference.",
+                        `Milestone validation was skipped via ${skipSource}.`,
                     ].join("\n");
                     writeFileSync(validationPath, content, "utf-8");
                 }
@@ -689,22 +835,13 @@ export const DISPATCH_RULES = [
                     return { action: "skip" };
                 }
             }
-            // Reconciliation guard (#4324): when the SUMMARY file already exists
-            // on disk but the DB says the milestone is not complete, the DB is
-            // out of sync (e.g. journal reset, partial merge, crash recovery).
-            // Reconcile the DB status directly instead of re-dispatching the
-            // tool, which would overwrite the richer on-disk SUMMARY with a
-            // thinner regenerated version — causing silent data loss.
             const existingSummary = resolveMilestoneFile(basePath, mid, "SUMMARY");
-            if (existingSummary && isDbAvailable()) {
-                try {
-                    updateMilestoneStatus(mid, "complete", new Date().toISOString());
-                    logWarning("dispatch", `Milestone ${mid} has SUMMARY on disk but DB status was not complete — reconciled DB to complete (#4324)`);
-                }
-                catch (err) {
-                    logWarning("dispatch", `Failed to reconcile milestone ${mid} status: ${err instanceof Error ? err.message : String(err)}`);
+            let summaryOutcome = "unknown";
+            if (existingSummary) {
+                const summaryContent = await loadFile(existingSummary);
+                if (summaryContent) {
+                    summaryOutcome = classifyMilestoneSummaryContent(summaryContent);
                 }
-                return { action: "skip" };
             }
             // Safety guard (#2675): block completion when VALIDATION verdict is
             // needs-remediation. The state machine treats needs-remediation as
@@ -782,6 +919,45 @@ export const DISPATCH_RULES = [
             catch (err) { /* fall through — don't block on DB errors */
                 logWarning("dispatch", `verification class check failed: ${err instanceof Error ? err.message : String(err)}`);
             }
+            // Disk/DB mismatch handling (#4658): SUMMARY presence alone is not enough.
+            // Apply post-gate policy:
+            // - success summary: reconcile DB and skip re-dispatch
+            // - failure summary: pause/fail-closed
+            // - unknown summary: pause/fail-closed
+            if (existingSummary) {
+                const milestone = isDbAvailable() ? getMilestone(mid) : null;
+                const status = milestone?.status ?? (isDbAvailable() ? "missing" : "unavailable");
+                if (summaryOutcome === "success") {
+                    if (!isDbAvailable()) {
+                        logWarning("dispatch", `Milestone ${mid} SUMMARY indicates completion while DB is unavailable — skipping duplicate complete-milestone dispatch`);
+                        return { action: "skip" };
+                    }
+                    try {
+                        updateMilestoneStatus(mid, "complete", new Date().toISOString());
+                        logWarning("dispatch", `Milestone ${mid} SUMMARY indicates completion while DB status was "${status}" — reconciled DB to complete (#4658)`);
+                        return { action: "skip" };
+                    }
+                    catch (err) {
+                        return {
+                            action: "stop",
+                            level: "warning",
+                            reason: `Milestone ${mid} SUMMARY indicates completion but DB reconciliation failed (${err instanceof Error ? err.message : String(err)}). Auto-mode paused for manual review.`,
+                        };
+                    }
+                }
+                if (summaryOutcome === "failure") {
+                    return {
+                        action: "stop",
+                        level: "warning",
+                        reason: `Milestone ${mid} has a failure-path SUMMARY while DB status is "${status}". Auto-mode will not promote completion from failure artifacts. Re-run complete-milestone only after blockers are resolved and verification passes.`,
+                    };
+                }
+                return {
+                    action: "stop",
+                    level: "warning",
+                    reason: `Milestone ${mid} has an ambiguous SUMMARY while DB status is "${status}". Auto-mode paused instead of promoting completion from file presence alone.`,
+                };
+            }
             return {
                 action: "dispatch",
                 unitType: "complete-milestone",

package/dist/resources/extensions/gsd/auto-loop.js

@@ -8,6 +8,6 @@
  */
 export { autoLoop, runUokKernelLoop, runLegacyAutoLoop } from "./auto/loop.js";
 export { isInfrastructureError, INFRA_ERROR_CODES } from "./auto/infra-errors.js";
-export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
+export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _hasPendingResolveForTest, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
 export { detectStuck } from "./auto/detect-stuck.js";
 export { runUnit } from "./auto/run-unit.js";