gsd-pi 2.76.0 → 2.77.0-dev.2daa994b6

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -9,7 +9,11 @@ import type { ExtensionAPI, ExtensionContext } from "@gsd/pi-coding-agent";
 import type { AutoSession } from "./session.js";
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
 import type { UnitResult } from "./types.js";
-import { _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import {
+  getCurrentTurnGeneration,
+  runWithTurnGeneration,
+} from "./turn-epoch.js";
 import { debugLog } from "../debug-logger.js";
 import { logWarning, logError } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
@@ -42,16 +46,25 @@ export async function runUnit(
   let sessionResult: { cancelled: boolean };
   let sessionTimeoutHandle: ReturnType<typeof setTimeout> | undefined;
   const mySessionSwitchGeneration = ++sessionSwitchGeneration;
+  // #3731: Cancellation controller for newSession(). When the session-creation
+  // timeout fires, we abort this controller so that the still-in-flight
+  // newSession() discards itself after await this.abort() completes, preventing
+  // it from capturing the (now-root) process.cwd() and rebuilding the tool
+  // runtime with the wrong cwd.
+  const sessionAbortController = new AbortController();
   _setSessionSwitchInFlight(true);
   try {
-    const sessionPromise = s.cmdCtx!.newSession().finally(() => {
+    const sessionPromise = s.cmdCtx!.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
       if (sessionSwitchGeneration === mySessionSwitchGeneration) {
         _setSessionSwitchInFlight(false);
       }
     });
     const timeoutPromise = new Promise<{ cancelled: true }>((resolve) => {
       sessionTimeoutHandle = setTimeout(
-        () => resolve({ cancelled: true }),
+        () => {
+          sessionAbortController.abort();
+          resolve({ cancelled: true });
+        },
         NEW_SESSION_TIMEOUT_MS,
       );
     });
@@ -118,6 +131,43 @@ export async function runUnit(
     logWarning("engine", "Failed to chdir to basePath before dispatch", { basePath: s.basePath, error: String(e) });
   }
 
+  // ── Provider request-readiness pre-check (#4555) ──
+  // Verify the provider can accept requests before dispatching. If the token
+  // has expired since bootstrap, return cancelled immediately so the unit is
+  // not wasted on a guaranteed 401.
+  {
+    const provider = s.currentUnitModel?.provider ?? ctx.model?.provider;
+    const registry = (ctx as any).modelRegistry;
+
+    if (provider && registry != null && typeof registry.isProviderRequestReady === "function") {
+      let ready = false;
+      try {
+        ready = registry.isProviderRequestReady(provider);
+      } catch {
+        ready = false;
+      }
+
+      if (!ready) {
+        _clearCurrentResolve();
+        return {
+          status: "cancelled",
+          errorContext: {
+            message: `Provider ${provider} is not request-ready (login/token expired)`,
+            category: "provider",
+            isTransient: false,
+          },
+        };
+      }
+    }
+  }
+
+  // ── Capture turn generation for stale-write detection ──
+  // Any write site reached via the sendMessage → tool-call → await chain
+  // below sees this generation via AsyncLocalStorage. If a timeout recovery
+  // or cancellation bumps the generation while this turn is in flight, those
+  // writes see themselves as stale and self-drop.
+  const capturedTurnGen = getCurrentTurnGeneration();
+
   // ── Send the prompt ──
   debugLog("runUnit", { phase: "send-message", unitType, unitId });
 
@@ -141,7 +191,9 @@ export async function runUnit(
       resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
     }, UNIT_HARD_TIMEOUT_MS);
   });
-  const result = await Promise.race([unitPromise, timeoutResult]);
+  const result = await runWithTurnGeneration(capturedTurnGen, () =>
+    Promise.race([unitPromise, timeoutResult]),
+  );
   if (unitTimeoutHandle) clearTimeout(unitTimeoutHandle);
   debugLog("runUnit", {
     phase: "agent-end-received",

package/src/resources/extensions/gsd/auto/session.ts

@@ -17,7 +17,7 @@
  */
 
 import type { Api, Model } from "@gsd/pi-ai";
-import type { ExtensionCommandContext } from "@gsd/pi-coding-agent";
+import type { ExtensionAPI, ExtensionCommandContext } from "@gsd/pi-coding-agent";
 import type { GitServiceImpl } from "../git-service.js";
 import type { CaptureEntry } from "../captures.js";
 import type { BudgetAlertLevel } from "../auto-budget.js";
@@ -40,6 +40,8 @@ export interface StartModel {
   id: string;
 }
 
+export type ThinkingLevelSnapshot = ReturnType<ExtensionAPI["getThinkingLevel"]>;
+
 export interface PendingVerificationRetry {
   unitId: string;
   failureContext: string;
@@ -62,6 +64,15 @@ export interface SidecarItem {
   captureId?: string;
 }
 
+export interface PreExecFailure {
+  /** Milestone/slice that failed (e.g. "M001/S02"). */
+  unitId: string;
+  /** Verbatim blocking check strings from the failed gate run. */
+  blockingFindings: string[];
+  /** Condensed gate verdict excerpt for context (status + rationale). */
+  verdictExcerpt: string;
+}
+
 // ─── Constants ───────────────────────────────────────────────────────────────
 
 export const MAX_UNIT_DISPATCHES = 3;
@@ -120,6 +131,8 @@ export class AutoSession {
   currentDispatchedModelId: string | null = null;
   originalModelId: string | null = null;
   originalModelProvider: string | null = null;
+  autoModeStartThinkingLevel: ThinkingLevelSnapshot | null = null;
+  originalThinkingLevel: ThinkingLevelSnapshot | null = null;
   lastBudgetAlertLevel: BudgetAlertLevel = 0;
 
   // ── Recovery ─────────────────────────────────────────────────────────────
@@ -135,6 +148,18 @@ export class AutoSession {
   // ── Sidecar queue ─────────────────────────────────────────────────────
   sidecarQueue: SidecarItem[] = [];
 
+  // ── Pre-exec gate failure context (#4551) ───────────────────────────
+  /**
+   * Persisted when a pre-execution gate fails on a plan-slice or refine-slice
+   * unit. The planning → plan-slice dispatch rule reads this field and injects
+   * the failure details into the next re-dispatch prompt so the LLM can fix the
+   * specific issues instead of producing an identical plan.
+   *
+   * Cleared after it has been consumed (injected into the prompt) to avoid
+   * stale context bleeding into unrelated slices.
+   */
+  lastPreExecFailure: PreExecFailure | null = null;
+
   // ── Tool invocation errors (#2883) ──────────────────────────────────
   /** Set when a GSD tool execution ends with isError due to malformed/truncated
    *  JSON arguments. Checked by postUnitPreVerification to break retry loops. */
@@ -153,6 +178,12 @@ export class AutoSession {
    *  stopAuto does not attempt the same merge a second time (#2645). */
   milestoneMergedInPhases = false;
 
+  // #4765 — slice-cadence collapse: main-branch SHAs at the moment each
+  // milestone's first slice merge began. Used by resquashMilestoneOnMain at
+  // milestone completion to collapse N slice commits into one. Cleared when
+  // the milestone finishes (or resquash runs).
+  milestoneStartShas: Map<string, string> = new Map();
+
   // ── Dispatch circuit breakers ──────────────────────────────────────
   rewriteAttemptCount = 0;
   /** Tracks consecutive bootstrap attempts that found phase === "complete".
@@ -195,7 +226,12 @@ export class AutoSession {
   }
 
   get lockBasePath(): string {
-    return this.originalBasePath || this.basePath;
+    // Prefer originalBasePath (project root); fall back to basePath.
+    // Strip /.gsd/worktrees/ suffix if basePath is itself a worktree path
+    // to avoid reading/writing the lock inside the worktree (#3729).
+    const resolved = this.originalBasePath || this.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
   }
 
   reset(): void {
@@ -241,6 +277,8 @@ export class AutoSession {
     this.currentDispatchedModelId = null;
     this.originalModelId = null;
     this.originalModelProvider = null;
+    this.autoModeStartThinkingLevel = null;
+    this.originalThinkingLevel = null;
     this.lastBudgetAlertLevel = 0;
 
     // Recovery
@@ -261,11 +299,13 @@ export class AutoSession {
     this.sidecarQueue = [];
     this.rewriteAttemptCount = 0;
     this.consecutiveCompleteBootstraps = 0;
+    this.lastPreExecFailure = null;
     this.lastToolInvocationError = null;
     this.lastGitActionFailure = null;
     this.lastGitActionStatus = null;
     this.isolationDegraded = false;
     this.milestoneMergedInPhases = false;
+    this.milestoneStartShas = new Map();
     this.checkpointSha = null;
 
     // Signal handler

package/src/resources/extensions/gsd/auto/turn-epoch.ts

@@ -0,0 +1,108 @@
+/**
+ * auto/turn-epoch.ts — Turn generation counter + AsyncLocalStorage-backed
+ * capture for stale-turn write dropping.
+ *
+ * Problem: when auto-timeout-recovery synthetically resolves a timed-out
+ * unit so the loop can advance, the original LLM turn keeps running in the
+ * background. Its subsequent writes (journal events, audit events, tool
+ * calls that flow through closeout) then race the replacement unit's
+ * writes. DB-level guards (complete-task/complete-slice) block double
+ * state transitions, but journal/audit/closeout side-effects still fire
+ * with fresh identifiers and pollute forensics.
+ *
+ * Containment: every time we decide a turn is done (timeout recovery,
+ * explicit cancellation), bump a module-level generation counter.
+ * Turn-aware call sites wrap their body in `runWithTurnGeneration`, which
+ * captures the generation into AsyncLocalStorage. Write sites deep in the
+ * stack call `isStaleWrite` — if the captured generation is older than
+ * current, the turn has been superseded and the write is dropped.
+ *
+ * Failure mode: if AsyncLocalStorage context is lost across some exotic
+ * async boundary (e.g. a native-side worker callback), the write site sees
+ * `no-store` and falls through to current behavior — the write proceeds
+ * normally. That is a safe default; the correctness regression is only
+ * "noisier forensics under rare boundary loss," not duplicated state.
+ */
+
+import { AsyncLocalStorage } from "node:async_hooks";
+
+import { debugLog } from "../debug-logger.js";
+
+let _currentGeneration = 0;
+
+const turnContext = new AsyncLocalStorage<{ capturedGen: number }>();
+
+/** Current turn generation. Mutated only by bumpTurnGeneration. */
+export function getCurrentTurnGeneration(): number {
+  return _currentGeneration;
+}
+
+/**
+ * Bump the turn generation and return the new value. Every caller should
+ * pass a short `reason` string so forensics can reconstruct why a given
+ * turn was marked stale.
+ */
+export function bumpTurnGeneration(reason: string): number {
+  _currentGeneration += 1;
+  debugLog("turnEpoch.bump", { reason, newGeneration: _currentGeneration });
+  return _currentGeneration;
+}
+
+/**
+ * Run fn() with `capturedGen` attached to AsyncLocalStorage so that any
+ * write site reached from within fn() can check for staleness without
+ * parameter threading.
+ */
+export function runWithTurnGeneration<T>(capturedGen: number, fn: () => T): T {
+  return turnContext.run({ capturedGen }, fn);
+}
+
+/**
+ * True when the current async context was started at a turn generation
+ * older than the current one — meaning the turn has been superseded by
+ * recovery/cancellation since it began.
+ *
+ * Returns false when there is no captured generation (e.g. the write is
+ * happening outside any wrapped turn). That is the safe default: writes
+ * proceed as they did before this epoch was introduced.
+ */
+export function isStaleWrite(component?: string): boolean {
+  const store = turnContext.getStore();
+  if (!store) return false;
+  const captured = store.capturedGen;
+  const current = _currentGeneration;
+  if (captured < current) {
+    debugLog("turnEpoch.stale", {
+      component: component ?? "unknown",
+      captured,
+      current,
+    });
+    return true;
+  }
+  return false;
+}
+
+/**
+ * Snapshot of both the captured turn generation and the current one.
+ * Used by closeoutUnit to persist an orphan-marker entry instead of
+ * silently skipping the full closeout on a stale turn.
+ */
+export function describeTurnEpoch(): {
+  captured: number | null;
+  current: number;
+  stale: boolean;
+} {
+  const store = turnContext.getStore();
+  const captured = store?.capturedGen ?? null;
+  const current = _currentGeneration;
+  return {
+    captured,
+    current,
+    stale: captured !== null && captured < current,
+  };
+}
+
+/** Test helper — resets module state so tests start from a known baseline. */
+export function _resetTurnEpoch(): void {
+  _currentGeneration = 0;
+}

package/src/resources/extensions/gsd/auto/types.ts

@@ -9,7 +9,7 @@ import type { ExtensionAPI, ExtensionContext } from "@gsd/pi-coding-agent";
 import type { AutoSession } from "./session.js";
 import type { GSDPreferences } from "../preferences.js";
 import type { GSDState } from "../types.js";
-import type { CmuxLogLevel } from "../../cmux/index.js";
+import type { CmuxLogLevel } from "../../shared/cmux-events.js";
 import type { LoopDeps } from "./loop-deps.js";
 
 /**

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -34,6 +34,7 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import { logWarning, logError } from "./workflow-logger.js";
 import { join } from "node:path";
 import { hasImplementationArtifacts } from "./auto-recovery.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import {
   buildDiscussMilestonePrompt,
   buildResearchMilestonePrompt,
@@ -58,6 +59,8 @@ import {
 import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
+import { getMilestonePipelineVariant } from "./milestone-scope-classifier.js";
+import { EXECUTION_ENTRY_PHASES, hasFinalizedMilestoneContext } from "./uok/plan-v2.js";
 
 // ─── Types ────────────────────────────────────────────────────────────────
 
@@ -88,6 +91,18 @@ export interface DispatchContext {
   modelRegistry?: MinimalModelRegistry;
 }
 
+type ReassessmentChecker = typeof checkNeedsReassessment;
+
+let reassessmentChecker: ReassessmentChecker = checkNeedsReassessment;
+
+export function setReassessmentCheckerForTest(checker: ReassessmentChecker): () => void {
+  const previous = reassessmentChecker;
+  reassessmentChecker = checker;
+  return () => {
+    reassessmentChecker = previous;
+  };
+}
+
 export interface DispatchRule {
   /** Human-readable name for debugging and test identification */
   name: string;
@@ -242,6 +257,38 @@ export const DISPATCH_RULES: DispatchRule[] = [
       };
     },
   },
+  {
+    // #4671 — Recovery path for execution-entry phases with missing CONTEXT.md.
+    //
+    // Once `deriveStateFromDb` returns an execution-entry phase (executing /
+    // summarizing / validating-milestone / completing-milestone), the
+    // pre-planning guard at `pre-planning (no context) → discuss-milestone`
+    // no longer fires. The plan-v2 gate correctly detects the missing context
+    // but can only block — it cannot redispatch. Without this rule the
+    // milestone is stuck until `/gsd doctor heal` repairs it (and heal
+    // historically missed this check too).
+    //
+    // Fire BEFORE the execution-entry phase rules so we redispatch to
+    // `discuss-milestone` instead of hitting the plan-v2 gate.
+    name: "execution-entry phase (no context) → discuss-milestone",
+    match: async ({ state, mid, midTitle, basePath, structuredQuestionsAvailable }) => {
+      if (!EXECUTION_ENTRY_PHASES.has(state.phase)) return null;
+      // Align with the plan-v2 gate's lookup semantics: whitespace-only counts
+      // as missing, and an auto worktree may fall back to GSD_PROJECT_ROOT.
+      if (hasFinalizedMilestoneContext(basePath, mid)) return null;
+      return {
+        action: "dispatch",
+        unitType: "discuss-milestone",
+        unitId: mid,
+        prompt: await buildDiscussMilestonePrompt(
+          mid,
+          midTitle,
+          basePath,
+          structuredQuestionsAvailable,
+        ),
+      };
+    },
+  },
   {
     name: "summarizing → complete-slice",
     match: async ({ state, mid, midTitle, basePath }) => {
@@ -337,11 +384,15 @@ export const DISPATCH_RULES: DispatchRule[] = [
     name: "reassess-roadmap (post-completion)",
     match: async ({ state, mid, midTitle, basePath, prefs }) => {
       if (prefs?.phases?.skip_reassess) return null;
-      // Default reassess_after_slice to true — reassessment after slice completion
-      // is essential for roadmap integrity. Opt-out via explicit `false`.
-      const reassessEnabled = prefs?.phases?.reassess_after_slice ?? true;
+      // Default reassess_after_slice to false per ADR-003 §4 — most reassess
+      // units conclude "roadmap is fine" and burn a session for no change.
+      // The plan-slice prompt now carries a reassessment preamble so the
+      // next slice's planner does JIT roadmap verification at zero extra
+      // cost. Opt-in via explicit `reassess_after_slice: true` (e.g.
+      // burn-max profile) when you want the dedicated reassess session.
+      const reassessEnabled = prefs?.phases?.reassess_after_slice ?? false;
       if (!reassessEnabled) return null;
-      const needsReassess = await checkNeedsReassessment(basePath, mid, state);
+      const needsReassess = await reassessmentChecker(basePath, mid, state);
       if (!needsReassess) return null;
       return {
         action: "dispatch",
@@ -421,6 +472,26 @@ export const DISPATCH_RULES: DispatchRule[] = [
       };
     },
   },
+  {
+    name: "planning (require_slice_discussion) → pause for discussion (#3454)",
+    match: async ({ state, mid, basePath, prefs }) => {
+      if (state.phase !== "planning") return null;
+      if (!prefs?.phases?.require_slice_discussion) return null;
+      if (!state.activeSlice) return null;
+      // Only pause if the slice has no context file yet (discussion not done).
+      // resolveSliceFile returns null when the file does not exist on disk,
+      // but cachedReaddir could return a stale hit — verify with existsSync
+      // so the guard is defence-in-depth and the contract is explicit at the
+      // call site.
+      const sliceContextFile = resolveSliceFile(basePath, mid, state.activeSlice.id, "CONTEXT");
+      if (sliceContextFile && existsSync(sliceContextFile)) return null; // discussion already done, proceed
+      return {
+        action: "stop" as const,
+        reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.`,
+        level: "info" as const,
+      };
+    },
+  },
   {
     // Keep this rule before the single-slice research rule so the multi-slice
     // path wins whenever 2+ slices are ready.
@@ -428,6 +499,11 @@ export const DISPATCH_RULES: DispatchRule[] = [
     match: async ({ state, mid, midTitle, basePath, prefs }) => {
       if (state.phase !== "planning") return null;
       if (prefs?.phases?.skip_research || prefs?.phases?.skip_slice_research) return null;
+      // #4781 phase 2: trivial-scope milestones skip dedicated slice research.
+      // plan-slice absorbs the lightweight discovery a trivial deliverable
+      // needs. Null result (DB unavailable / unknown) falls through to today's
+      // behavior.
+      if (await getMilestonePipelineVariant(mid) === "trivial") return null;
 
       // Load roadmap to find all slices
       const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
@@ -484,6 +560,8 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // Phase skip: skip research when preference or profile says so
       if (prefs?.phases?.skip_research || prefs?.phases?.skip_slice_research)
         return null;
+      // #4781 phase 2: trivial-scope milestones skip dedicated slice research.
+      if (await getMilestonePipelineVariant(mid) === "trivial") return null;
       if (!state.activeSlice) return missingSliceStop(mid, state.phase);
       const sid = state.activeSlice!.id;
       const sTitle = state.activeSlice!.title;
@@ -568,15 +646,28 @@ export const DISPATCH_RULES: DispatchRule[] = [
   },
   {
     name: "planning → plan-slice",
-    match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry }) => {
+    match: async ({ state, mid, midTitle, basePath, sessionContextWindow, modelRegistry, session }) => {
       if (state.phase !== "planning") return null;
       if (!state.activeSlice) return missingSliceStop(mid, state.phase);
       const sid = state.activeSlice!.id;
       const sTitle = state.activeSlice!.title;
+      // #4551: Consume any persisted pre-exec failure for this slice so the
+      // re-dispatched prompt includes the exact blocked references. Clear the
+      // field immediately after reading to prevent stale context leaking into
+      // a later, unrelated plan-slice run.
+      const unitId = `${mid}/${sid}`;
+      let priorPreExecFailure: { blockingFindings: string[]; verdictExcerpt: string } | undefined;
+      if (session?.lastPreExecFailure?.unitId === unitId) {
+        priorPreExecFailure = {
+          blockingFindings: session.lastPreExecFailure.blockingFindings,
+          verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,
+        };
+        session.lastPreExecFailure = null;
+      }
       return {
         action: "dispatch",
         unitType: "plan-slice",
-        unitId: `${mid}/${sid}`,
+        unitId,
         prompt: await buildPlanSlicePrompt(
           mid,
           midTitle,
@@ -584,7 +675,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
           sTitle,
           basePath,
           undefined,
-          { sessionContextWindow, modelRegistry },
+          { sessionContextWindow, modelRegistry, priorPreExecFailure },
         ),
       };
     },
@@ -823,8 +914,13 @@ export const DISPATCH_RULES: DispatchRule[] = [
         };
       }
 
-      // Skip preference: write a minimal pass-through VALIDATION file
-      if (prefs?.phases?.skip_milestone_validation) {
+      // #4781 phase 2: trivial-scope milestones skip the dedicated validate
+      // unit — complete-milestone's own verification steps (3/4/5 in the
+      // closer prompt) are sufficient proof for contained deliverables.
+      const trivialVariant = await getMilestonePipelineVariant(mid) === "trivial";
+
+      // Skip preference OR trivial scope: write a minimal pass-through VALIDATION file.
+      if (prefs?.phases?.skip_milestone_validation || trivialVariant) {
         const mDir = resolveMilestonePath(basePath, mid);
         if (mDir) {
           if (!existsSync(mDir)) mkdirSync(mDir, { recursive: true });
@@ -832,15 +928,18 @@ export const DISPATCH_RULES: DispatchRule[] = [
             mDir,
             buildMilestoneFileName(mid, "VALIDATION"),
           );
+          const skipSource = trivialVariant
+            ? "trivial-scope pipeline variant (#4781)"
+            : "`skip_milestone_validation` preference";
           const content = [
             "---",
             "verdict: pass",
             "remediation_round: 0",
             "---",
             "",
-            "# Milestone Validation (skipped by preference)",
+            "# Milestone Validation (skipped)",
             "",
-            "Milestone validation was skipped via `skip_milestone_validation` preference.",
+            `Milestone validation was skipped via ${skipSource}.`,
           ].join("\n");
           writeFileSync(validationPath, content, "utf-8");
         }
@@ -870,21 +969,13 @@ export const DISPATCH_RULES: DispatchRule[] = [
         }
       }
 
-      // Reconciliation guard (#4324): when the SUMMARY file already exists
-      // on disk but the DB says the milestone is not complete, the DB is
-      // out of sync (e.g. journal reset, partial merge, crash recovery).
-      // Reconcile the DB status directly instead of re-dispatching the
-      // tool, which would overwrite the richer on-disk SUMMARY with a
-      // thinner regenerated version — causing silent data loss.
       const existingSummary = resolveMilestoneFile(basePath, mid, "SUMMARY");
-      if (existingSummary && isDbAvailable()) {
-        try {
-          updateMilestoneStatus(mid, "complete", new Date().toISOString());
-          logWarning("dispatch", `Milestone ${mid} has SUMMARY on disk but DB status was not complete — reconciled DB to complete (#4324)`);
-        } catch (err) {
-          logWarning("dispatch", `Failed to reconcile milestone ${mid} status: ${err instanceof Error ? err.message : String(err)}`);
+      let summaryOutcome: "success" | "failure" | "unknown" = "unknown";
+      if (existingSummary) {
+        const summaryContent = await loadFile(existingSummary);
+        if (summaryContent) {
+          summaryOutcome = classifyMilestoneSummaryContent(summaryContent);
         }
-        return { action: "skip" };
       }
 
       // Safety guard (#2675): block completion when VALIDATION verdict is
@@ -969,6 +1060,48 @@ export const DISPATCH_RULES: DispatchRule[] = [
         logWarning("dispatch", `verification class check failed: ${err instanceof Error ? err.message : String(err)}`);
       }
 
+      // Disk/DB mismatch handling (#4658): SUMMARY presence alone is not enough.
+      // Apply post-gate policy:
+      // - success summary: reconcile DB and skip re-dispatch
+      // - failure summary: pause/fail-closed
+      // - unknown summary: pause/fail-closed
+      if (existingSummary) {
+        const milestone = isDbAvailable() ? getMilestone(mid) : null;
+        const status = milestone?.status ?? (isDbAvailable() ? "missing" : "unavailable");
+
+        if (summaryOutcome === "success") {
+          if (!isDbAvailable()) {
+            logWarning("dispatch", `Milestone ${mid} SUMMARY indicates completion while DB is unavailable — skipping duplicate complete-milestone dispatch`);
+            return { action: "skip" };
+          }
+          try {
+            updateMilestoneStatus(mid, "complete", new Date().toISOString());
+            logWarning("dispatch", `Milestone ${mid} SUMMARY indicates completion while DB status was "${status}" — reconciled DB to complete (#4658)`);
+            return { action: "skip" };
+          } catch (err) {
+            return {
+              action: "stop",
+              level: "warning",
+              reason: `Milestone ${mid} SUMMARY indicates completion but DB reconciliation failed (${err instanceof Error ? err.message : String(err)}). Auto-mode paused for manual review.`,
+            };
+          }
+        }
+
+        if (summaryOutcome === "failure") {
+          return {
+            action: "stop",
+            level: "warning",
+            reason: `Milestone ${mid} has a failure-path SUMMARY while DB status is "${status}". Auto-mode will not promote completion from failure artifacts. Re-run complete-milestone only after blockers are resolved and verification passes.`,
+          };
+        }
+
+        return {
+          action: "stop",
+          level: "warning",
+          reason: `Milestone ${mid} has an ambiguous SUMMARY while DB status is "${status}". Auto-mode paused instead of promoting completion from file presence alone.`,
+        };
+      }
+
       return {
         action: "dispatch",
         unitType: "complete-milestone",

package/src/resources/extensions/gsd/auto-loop.ts

@@ -9,7 +9,7 @@
 
 export { autoLoop, runUokKernelLoop, runLegacyAutoLoop } from "./auto/loop.js";
 export { isInfrastructureError, INFRA_ERROR_CODES } from "./auto/infra-errors.js";
-export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
+export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _hasPendingResolveForTest, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
 export { detectStuck } from "./auto/detect-stuck.js";
 export { runUnit } from "./auto/run-unit.js";
 export type { LoopDeps } from "./auto/loop-deps.js";