gsd-pi 2.77.0-dev.c9c8932c6 → 2.77.0-dev.cfd69e714

package/dist/resources/extensions/github-sync/templates.js

@@ -116,3 +116,106 @@ export function formatSummaryComment(data) {
     }
     return lines.join("\n");
 }
+export const SWARM_LANE_LABELS = {
+    workflow: "lane/workflow",
+    state: "lane/state",
+    writer: "lane/writer",
+    uok: "lane/uok",
+    github: "lane/github",
+};
+function checkedList(items, emptyLabel) {
+    if (!items?.length)
+        return [`- [ ] ${emptyLabel}`];
+    return items.map((item) => `- [ ] ${item}`);
+}
+export function formatSwarmLanePRBody(data) {
+    const lines = [];
+    const laneLabel = SWARM_LANE_LABELS[data.lane.id];
+    lines.push("## Swarm lane");
+    lines.push("");
+    lines.push(`**Lane:** \`${laneLabel}\``);
+    lines.push(`**Branch:** \`${data.lane.branch}\``);
+    if (data.lane.owner)
+        lines.push(`**Owner:** ${data.lane.owner}`);
+    if (data.lane.latestCommit)
+        lines.push(`**Latest commit:** \`${data.lane.latestCommit}\``);
+    lines.push("");
+    lines.push("## Impact area");
+    lines.push("");
+    lines.push(data.impactArea);
+    lines.push("");
+    lines.push("## Changed contracts");
+    lines.push(...checkedList(data.lane.changedContracts, "No shared contracts changed"));
+    lines.push("");
+    lines.push("## Transition risks");
+    lines.push(...checkedList(data.transitionRisks, "No transition risks identified"));
+    lines.push("");
+    lines.push("## Rollback plan");
+    lines.push(...checkedList(data.rollbackPlan, "Revert this lane PR"));
+    lines.push("");
+    lines.push("## Test evidence");
+    lines.push(...checkedList(data.lane.testEvidence, "Test evidence pending"));
+    lines.push("");
+    if (data.lane.blockers?.length) {
+        lines.push("## Blockers");
+        for (const blocker of data.lane.blockers)
+            lines.push(`- ${blocker}`);
+        lines.push("");
+    }
+    if (data.linkedIssue) {
+        lines.push(`Closes #${data.linkedIssue}`);
+        lines.push("");
+    }
+    lines.push("---");
+    lines.push("*Auto-generated by GSD GitHub Sync swarm routines*");
+    return lines.join("\n");
+}
+export function formatSwarmReleaseChecklistBody(data) {
+    const lines = [];
+    lines.push(`# UOK Swarm Release Checklist`);
+    lines.push("");
+    lines.push(`**Integration branch:** \`${data.integrationBranch}\``);
+    lines.push("");
+    lines.push("## Lane summary");
+    lines.push("");
+    lines.push("| Lane | Branch | Owner | Commit | Status |");
+    lines.push("|------|--------|-------|--------|--------|");
+    for (const lane of data.lanes) {
+        const owner = lane.owner ?? "";
+        const commit = lane.latestCommit ? `\`${lane.latestCommit}\`` : "";
+        const status = lane.blockers?.length ? "blocked" : "ready";
+        lines.push(`| \`${SWARM_LANE_LABELS[lane.id]}\` | \`${lane.branch}\` | ${owner} | ${commit} | ${status} |`);
+    }
+    lines.push("");
+    lines.push("## Required evidence");
+    lines.push("- [ ] Changed contracts summarized");
+    lines.push("- [ ] Transition matrix diff attached or linked");
+    lines.push("- [ ] Writer sequence proof attached or linked");
+    lines.push("- [ ] UOK parity report attached or linked");
+    lines.push("- [ ] Rollback drill evidence attached or linked");
+    lines.push("");
+    if (data.requiredChecks?.length) {
+        lines.push("## Required checks");
+        for (const check of data.requiredChecks)
+            lines.push(`- [ ] ${check}`);
+        lines.push("");
+    }
+    lines.push("## Parity report");
+    lines.push(data.parityReport ?? "Pending.");
+    lines.push("");
+    lines.push("## Rollback drill");
+    lines.push(data.rollbackDrill ?? "Pending.");
+    lines.push("");
+    lines.push("## Open risks");
+    if (data.openRisks?.length) {
+        for (const risk of data.openRisks)
+            lines.push(`- ${risk}`);
+    }
+    else {
+        lines.push("None.");
+    }
+    lines.push("");
+    lines.push("---");
+    lines.push("*Auto-generated by GSD GitHub Sync swarm routines*");
+    return lines.join("\n");
+}

package/dist/resources/extensions/google-search/index.js

@@ -1,6 +1,7 @@
 export default function (pi) {
     pi.on("session_start", async (_event, ctx) => {
-        ctx.ui.notify("google_search has moved to @gsd-extensions/google-search. " +
-            "Install: gsd extensions install @gsd-extensions/google-search", "warning");
+        ctx.ui.notify("google_search is being extracted to @gsd-extensions/google-search " +
+            "(not yet published to npm). This stub will be replaced once the " +
+            "package is available. No action needed for now.", "warning");
     });
 }

package/dist/resources/extensions/gsd/abandon-detect.js

@@ -0,0 +1,44 @@
+/**
+ * Abandon-milestone detection for rewrite-docs overrides (#3490).
+ *
+ * Isolated from auto-post-unit.ts so behavioral tests can import this module
+ * without pulling in the full post-unit handler graph (which transitively
+ * loads model-router, workflow engine, etc.).
+ */
+// Detect when a rewrite-docs override is about abandoning THE CURRENT
+// MILESTONE — not just any override containing an abandon verb. Naively
+// matching `/\b(abandon|cancel|drop|...)\b/` against override text produces
+// false positives on scope-change prose ("cancel the standup reminder",
+// "drop the dependency on X", "scrap the v1 design for the landing page").
+//
+// To qualify as an abandon-milestone signal, an override must contain both:
+//   1. An abandon-family verb (abandon|descope|cancel|shelve|drop|scrap)
+//   2. A milestone reference — either the literal word "milestone" or the
+//      current milestone ID — in the same override text.
+// Verb variants cover both US and UK inflections:
+//   cancel / canceled / canceling / cancelled / cancelling / cancels
+//   travel-style "l"-doubling also applies to shelve/drop/scrap.
+// "descope" also accepts "de-scope" and "de scope" (hyphen / space forms).
+const ABANDON_VERB_RE = /\b(abandon(?:ed|ing|s)?|de[-\s]?scope(?:d|s|ing)?|cancel(?:led|ling|ed|ing|s)?|shelve(?:d|s)?|shelving|drop(?:ped|ping|s)?|scrap(?:ped|ping|s)?)\b/i;
+/**
+ * Decide whether a set of active overrides indicates the current milestone
+ * should be parked. Pure function — no I/O, no imports beyond types.
+ */
+export function detectAbandonMilestone(overrides, currentMilestoneId) {
+    if (!currentMilestoneId) {
+        return { shouldPark: false, reason: "", matched: [] };
+    }
+    const escapedId = currentMilestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const milestoneRefRe = new RegExp(`\\b(?:milestone|${escapedId})\\b`, "i");
+    const matched = overrides
+        .filter(o => ABANDON_VERB_RE.test(o.change) && milestoneRefRe.test(o.change))
+        .map(o => o.change);
+    if (matched.length === 0) {
+        return { shouldPark: false, reason: "", matched: [] };
+    }
+    return {
+        shouldPark: true,
+        reason: matched.join("; "),
+        matched,
+    };
+}

package/dist/resources/extensions/gsd/auto/loop.js

@@ -12,13 +12,15 @@ import { _clearCurrentResolve } from "./resolve.js";
 import { runPreDispatch, runDispatch, runGuards, runUnitPhase, runFinalize, } from "./phases.js";
 import { debugLog } from "../debug-logger.js";
 import { isInfrastructureError, isTransientCooldownError, getCooldownRetryAfterMs, COOLDOWN_FALLBACK_WAIT_MS, MAX_COOLDOWN_RETRIES } from "./infra-errors.js";
+import { ModelPolicyDispatchBlockedError } from "../auto-model-selection.js";
 import { resolveEngine } from "../engine-resolver.js";
 import { logWarning } from "../workflow-logger.js";
 import { gsdRoot } from "../paths.js";
+import { atomicWriteSync } from "../atomic-write.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { scheduleSidecarQueue } from "../uok/execution-graph.js";
 import { ExecutionGraphScheduler } from "../uok/execution-graph.js";
-import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 // ── Stuck detection persistence (#3704) ──────────────────────────────────
 // Persist stuck detection state to disk so it survives session restarts.
@@ -62,12 +64,64 @@ function saveStuckState(basePath, state) {
         debugLog("autoLoop", { phase: "save-stuck-state-failed", error: err instanceof Error ? err.message : String(err) });
     }
 }
+// ── Custom workflow verification retry persistence ───────────────────────
+// Custom workflows can request verification retries after a step runs. The
+// retry budget must survive an auto-mode restart or a failing verifier can
+// consume a fresh retry budget every session.
+function customVerifyRetryStateDir(s) {
+    return s.activeRunDir ? join(s.activeRunDir, "runtime") : join(gsdRoot(s.basePath), "runtime");
+}
+function customVerifyRetryStatePath(s) {
+    return join(customVerifyRetryStateDir(s), "custom-verify-retries.json");
+}
+function hydrateCustomVerifyRetryCounts(s) {
+    if (s.verificationRetryCount.size > 0) {
+        return s.verificationRetryCount;
+    }
+    try {
+        const raw = JSON.parse(readFileSync(customVerifyRetryStatePath(s), "utf-8"));
+        const counts = raw && typeof raw === "object" && raw.counts && typeof raw.counts === "object"
+            ? raw.counts
+            : {};
+        for (const [key, value] of Object.entries(counts)) {
+            if (typeof value === "number" && Number.isFinite(value) && value > 0) {
+                s.verificationRetryCount.set(key, Math.floor(value));
+            }
+        }
+    }
+    catch (err) {
+        debugLog("autoLoop", { phase: "load-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+    }
+    return s.verificationRetryCount;
+}
+function saveCustomVerifyRetryCounts(s) {
+    const retryCounts = s.verificationRetryCount;
+    const filePath = customVerifyRetryStatePath(s);
+    try {
+        if (!retryCounts || retryCounts.size === 0) {
+            unlinkSync(filePath);
+            return;
+        }
+        mkdirSync(customVerifyRetryStateDir(s), { recursive: true });
+        atomicWriteSync(filePath, JSON.stringify({
+            counts: Object.fromEntries(retryCounts),
+            updatedAt: new Date().toISOString(),
+        }) + "\n");
+    }
+    catch (err) {
+        const code = err && typeof err === "object" && "code" in err ? err.code : undefined;
+        if (code !== "ENOENT") {
+            debugLog("autoLoop", { phase: "save-custom-verify-retries-failed", error: err instanceof Error ? err.message : String(err) });
+        }
+    }
+}
 // ── Memory pressure monitoring (#3331) ──────────────────────────────────
 // Check heap usage every N iterations and trigger graceful shutdown before
 // the OS OOM killer sends SIGKILL. The threshold is 90% of the V8 heap
 // limit (--max-old-space-size or default ~1.5-4GB depending on platform).
 const MEMORY_CHECK_INTERVAL = 5; // check every 5 iterations
 const MEMORY_PRESSURE_THRESHOLD = 0.85; // 85% of heap limit
+const MAX_CUSTOM_ENGINE_VERIFY_RETRIES = 3;
 function checkMemoryPressure() {
     const mem = process.memoryUsage();
     // v8.getHeapStatistics() gives heap_size_limit but requires import
@@ -360,15 +414,41 @@ export async function autoLoop(ctx, pi, s, deps, options) {
                     break;
                 }
                 if (verifyResult === "retry") {
-                    debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId });
+                    const recoveryKey = `${iterData.unitType}/${iterData.unitId}`;
+                    const retryCounts = hydrateCustomVerifyRetryCounts(s);
+                    const attempts = (retryCounts.get(recoveryKey) ?? 0) + 1;
+                    retryCounts.set(recoveryKey, attempts);
+                    saveCustomVerifyRetryCounts(s);
+                    debugLog("autoLoop", { phase: "custom-engine-verify-retry", iteration, unitId: iterData.unitId, attempts });
                     deps.uokObserver?.onPhaseResult("custom-engine", "retry", {
                         unitType: iterData.unitType,
                         unitId: iterData.unitId,
+                        attempts,
                     });
+                    if (attempts > MAX_CUSTOM_ENGINE_VERIFY_RETRIES) {
+                        const recovery = await policy.recover(iterData.unitType, iterData.unitId, { basePath: s.basePath });
+                        if (recovery.outcome === "pause") {
+                            await deps.pauseAuto(ctx, pi);
+                            finishTurn("paused", "manual-attention", recovery.reason ?? "custom-engine-verify-retry-exhausted");
+                            break;
+                        }
+                        if (recovery.outcome === "skip") {
+                            await deps.stopAuto(ctx, pi, recovery.reason ??
+                                `Custom workflow verification for ${iterData.unitId} requested skip after retry exhaustion, but the custom engine cannot reconcile skipped steps.`);
+                            finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+                            break;
+                        }
+                        const exhaustedReason = `Custom workflow verification for ${iterData.unitId} requested retry ${attempts} times without passing.`;
+                        await deps.stopAuto(ctx, pi, recovery.outcome === "stop" && recovery.reason ? recovery.reason : exhaustedReason);
+                        finishTurn("stopped", "manual-attention", "custom-engine-verify-retry-exhausted");
+                        break;
+                    }
                     finishTurn("retry");
                     continue;
                 }
                 // Verification passed — mark step complete
+                s.verificationRetryCount?.delete(`${iterData.unitType}/${iterData.unitId}`);
+                saveCustomVerifyRetryCounts(s);
                 debugLog("autoLoop", { phase: "custom-engine-reconcile", iteration, unitId: iterData.unitId });
                 const reconcileResult = await engine.reconcile(engineState, {
                     unitType: iterData.unitType,
@@ -516,6 +596,48 @@ export async function autoLoop(ctx, pi, s, deps, options) {
             // completion even on failure (#2344). Without this, errors in
             // runFinalize leave the journal incomplete, making diagnosis harder.
             deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration, error: msg } });
+            // ── Pre-send model-policy block: not a retryable error (#4959 / #4850) ──
+            // The model-policy gate runs before the prompt is sent.  When every
+            // candidate model is denied (cross-provider disabled + flat-rate
+            // baseline + tool-policy denial), retrying the same unit produces the
+            // same denial — burning the consecutive-error budget toward a 3-strike
+            // hard stop and corrupting auto-mode state.  Pause for user attention
+            // instead, with the per-model deny reasons surfaced from the typed
+            // error.
+            if (loopErr instanceof ModelPolicyDispatchBlockedError) {
+                debugLog("autoLoop", {
+                    phase: "model-policy-blocked",
+                    iteration,
+                    unitType: loopErr.unitType,
+                    unitId: loopErr.unitId,
+                    reasons: loopErr.reasons,
+                });
+                ctx.ui.notify(`Auto-mode paused: model-policy denied dispatch for ${loopErr.unitType}/${loopErr.unitId}. ${msg}`, "error");
+                deps.emitJournalEvent({
+                    ts: new Date().toISOString(),
+                    flowId,
+                    seq: nextSeq(),
+                    eventType: "unit-end",
+                    data: {
+                        unitType: loopErr.unitType,
+                        unitId: loopErr.unitId,
+                        status: "blocked",
+                        reason: "model-policy-dispatch-blocked",
+                        reasons: loopErr.reasons,
+                    },
+                });
+                // Carry the blocked unit identity into the turn-result observer:
+                // the throw originated inside dispatch, so observedUnitType/Id were
+                // not assigned by the success path at lines 453/631/647 — but the
+                // typed error already names the unit (#4959 / CodeRabbit).
+                observedUnitType = loopErr.unitType;
+                observedUnitId = loopErr.unitId;
+                await deps.pauseAuto(ctx, pi);
+                finishTurn("paused", "manual-attention", msg);
+                // Do NOT increment consecutiveErrors — the failure is configuration,
+                // not a transient runtime fault.
+                break;
+            }
             // ── Infrastructure errors: immediate stop, no retry ──
             // These are unrecoverable (disk full, OOM, etc.). Retrying just burns
             // LLM budget on guaranteed failures.

package/dist/resources/extensions/gsd/auto/phases.js

@@ -11,12 +11,12 @@ import { MAX_RECOVERY_CHARS, BUDGET_THRESHOLDS, MAX_FINALIZE_TIMEOUTS, } from ".
 import { detectStuck } from "./detect-stuck.js";
 import { runUnit } from "./run-unit.js";
 import { debugLog } from "../debug-logger.js";
-import { PROJECT_FILES } from "../detection.js";
+import { PROJECT_FILES, hasProjectFileInAncestor } from "../detection.js";
 import { MergeConflictError } from "../git-service.js";
 import { setCurrentPhase, clearCurrentPhase } from "../../shared/gsd-phase-state.js";
 import { pauseAutoForProviderError } from "../provider-error-pause.js";
 import { resumeAutoAfterProviderDelay } from "../bootstrap/provider-error-resume.js";
-import { join, basename, dirname, parse as parsePath } from "node:path";
+import { join, basename } from "node:path";
 import { existsSync, cpSync, readdirSync } from "node:fs";
 import { logWarning, logError, _resetLogs, drainLogs, drainAndSummarize, formatForNotification, hasAnyIssues, } from "../workflow-logger.js";
 import { gsdRoot } from "../paths.js";
@@ -27,7 +27,7 @@ import { withTimeout, FINALIZE_PRE_TIMEOUT_MS, FINALIZE_POST_TIMEOUT_MS } from "
 import { getEligibleSlices } from "../slice-parallel-eligibility.js";
 import { startSliceParallel } from "../slice-parallel-orchestrator.js";
 import { isDbAvailable, getMilestoneSlices } from "../gsd-db.js";
-import { ensurePlanV2Graph } from "../uok/plan-v2.js";
+import { ensurePlanV2Graph, isMissingFinalizedContextResult } from "../uok/plan-v2.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { UokGateRunner } from "../uok/gate-runner.js";
 import { resetEvidence, loadEvidenceFromDisk } from "../safety/evidence-collector.js";
@@ -127,6 +127,7 @@ async function generateMilestoneReport(s, ctx, milestoneId) {
 async function closeoutAndStop(ctx, pi, s, deps, reason) {
     if (s.currentUnit) {
         await deps.closeoutUnit(ctx, s.basePath, s.currentUnit.type, s.currentUnit.id, s.currentUnit.startedAt, deps.buildSnapshotOpts(s.currentUnit.type, s.currentUnit.id));
+        s.currentUnit = null;
     }
     await deps.stopAuto(ctx, pi, reason);
 }
@@ -296,27 +297,42 @@ export async function runPreDispatch(ic, loopState) {
         const compiled = ensurePlanV2Graph(s.basePath, state);
         if (!compiled.ok) {
             const reason = compiled.reason ?? "Plan v2 compilation failed";
+            if (isMissingFinalizedContextResult(compiled)) {
+                await runPreDispatchGate({
+                    gateId: "plan-v2-gate",
+                    gateType: "policy",
+                    outcome: "pass",
+                    failureClass: "none",
+                    rationale: "plan v2 missing context recovery deferred to dispatch",
+                    findings: reason,
+                    milestoneId: state.activeMilestone?.id ?? undefined,
+                });
+            }
+            else {
+                await runPreDispatchGate({
+                    gateId: "plan-v2-gate",
+                    gateType: "policy",
+                    outcome: "manual-attention",
+                    failureClass: "manual-attention",
+                    rationale: "plan v2 compile gate failed",
+                    findings: reason,
+                    milestoneId: state.activeMilestone?.id ?? undefined,
+                });
+                ctx.ui.notify(`Plan gate failed-closed: ${reason}\n\nIf this keeps happening, try: /gsd doctor heal`, "error");
+                await deps.pauseAuto(ctx, pi);
+                return { action: "break", reason: "plan-v2-gate-failed" };
+            }
+        }
+        if (compiled.ok) {
             await runPreDispatchGate({
                 gateId: "plan-v2-gate",
                 gateType: "policy",
-                outcome: "manual-attention",
-                failureClass: "manual-attention",
-                rationale: "plan v2 compile gate failed",
-                findings: reason,
+                outcome: "pass",
+                failureClass: "none",
+                rationale: "plan v2 compile gate passed",
                 milestoneId: state.activeMilestone?.id ?? undefined,
             });
-            ctx.ui.notify(`Plan gate failed-closed: ${reason}\n\nIf this keeps happening, try: /gsd doctor heal`, "error");
-            await deps.pauseAuto(ctx, pi);
-            return { action: "break", reason: "plan-v2-gate-failed" };
         }
-        await runPreDispatchGate({
-            gateId: "plan-v2-gate",
-            gateType: "policy",
-            outcome: "pass",
-            failureClass: "none",
-            rationale: "plan v2 compile gate passed",
-            milestoneId: state.activeMilestone?.id ?? undefined,
-        });
     }
     deps.syncCmuxSidebar(prefs, state);
     let mid = state.activeMilestone?.id;
@@ -667,10 +683,14 @@ export async function runDispatch(ic, preData, loopState) {
     const pauseAfterUatDispatch = dispatchResult.pauseAfterDispatch ?? false;
     // ── Sliding-window stuck detection with graduated recovery ──
     const derivedKey = `${unitType}/${unitId}`;
+    // Always record this dispatch in the sliding window so detectStuck() has
+    // accurate history. Skipping the push when pendingVerificationRetry is set
+    // caused infinite artifact-retry loops to be invisible to stuck detection
+    // (#2007). Only the *response* to a stuck signal is suppressed during retries.
+    loopState.recentUnits.push({ key: derivedKey });
+    if (loopState.recentUnits.length > STUCK_WINDOW_SIZE)
+        loopState.recentUnits.shift();
     if (!s.pendingVerificationRetry) {
-        loopState.recentUnits.push({ key: derivedKey });
-        if (loopState.recentUnits.length > STUCK_WINDOW_SIZE)
-            loopState.recentUnits.shift();
         const stuckSignal = detectStuck(loopState.recentUnits);
         if (stuckSignal) {
             debugLog("autoLoop", {
@@ -996,22 +1016,9 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         // Monorepo support (#2347): if no project files in the worktree directory,
         // walk parent directories up to the filesystem root. In monorepos,
         // package.json / Cargo.toml etc. live in a parent directory.
-        let hasProjectFileInParent = false;
-        if (!hasProjectFile && !hasSrcDir && !hasXcodeBundle) {
-            let checkDir = dirname(s.basePath);
-            const { root } = parsePath(checkDir);
-            while (checkDir !== root) {
-                // Stop at git repository boundary — ancestors above the repo root
-                // (e.g. ~ or /usr/local) may contain unrelated project files.
-                if (deps.existsSync(join(checkDir, ".git")))
-                    break;
-                if (PROJECT_FILES.some((f) => deps.existsSync(join(checkDir, f)))) {
-                    hasProjectFileInParent = true;
-                    break;
-                }
-                checkDir = dirname(checkDir);
-            }
-        }
+        const hasProjectFileInParent = !hasProjectFile && !hasSrcDir && !hasXcodeBundle
+            ? hasProjectFileInAncestor(s.basePath, deps.existsSync)
+            : false;
         if (!hasProjectFile && !hasSrcDir && !hasXcodeBundle && !hasProjectFileInParent) {
             // Greenfield projects won't have project files yet — the first task creates them.
             // Log a warning but allow execution to proceed. The .git check above is sufficient
@@ -1241,9 +1248,18 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
     }
     if (unitResult.status === "cancelled") {
         const errorCategory = unitResult.errorContext?.category;
-        // Provider-error pause: pauseAuto already handled cleanup and scheduled
-        // recovery. Don't hard-stop — just break out of the loop (#2762).
+        // Provider-error pause: agent_end recovery normally pauses before this
+        // branch. Provider readiness failures happen before dispatch, so pause here
+        // if nothing upstream already did.
         if (errorCategory === "provider") {
+            if (!s.paused) {
+                const detail = unitResult.errorContext?.message ?? `Provider unavailable for ${unitType} ${unitId}`;
+                await pauseAutoForProviderError(ctx.ui, detail, () => deps.pauseAuto(ctx, pi), {
+                    isRateLimit: false,
+                    isTransient: Boolean(unitResult.errorContext?.isTransient),
+                    retryAfterMs: unitResult.errorContext?.retryAfterMs,
+                });
+            }
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
             debugLog("autoLoop", { phase: "exit", reason: "provider-pause", isTransient: unitResult.errorContext?.isTransient });
             return { action: "break", reason: "provider-pause" };
@@ -1537,6 +1553,8 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
     }
     // Both pre and post verification completed without timeout — reset counter
     loopState.consecutiveFinalizeTimeouts = 0;
+    s.currentUnit = null;
+    clearCurrentPhase();
     // Surface accumulated workflow-logger issues for this unit to the user.
     // Warnings/errors logged during the unit are buffered in the logger and
     // drained here so the user sees a single consolidated post-unit alert.

package/dist/resources/extensions/gsd/auto/resolve.js

@@ -8,6 +8,7 @@
  * Imports from: auto/types
  */
 import { debugLog } from "../debug-logger.js";
+import { bumpTurnGeneration } from "./turn-epoch.js";
 // ─── Per-unit one-shot promise state ────────────────────────────────────────
 //
 // A single module-level resolve function scoped to the current unit execution.
@@ -56,6 +57,22 @@ export function resolveAgentEnd(event) {
 export function isSessionSwitchInFlight() {
     return _sessionSwitchInFlight;
 }
+// ─── bumpAndResolveSynthetic ────────────────────────────────────────────────
+/**
+ * Bump the turn epoch and synthetically resolve the pending unit promise —
+ * the exact sequence timeout recovery must perform when it advances past a
+ * timed-out unit. Using this helper enforces the invariant "bump iff we are
+ * actually superseding the turn" so a future caller cannot resolve without
+ * bumping (orphaned writes leak) or bump without resolving (next turn starts
+ * already stale).
+ *
+ * NOT to be used for steering retries that keep the same turn alive — those
+ * do not supersede the turn and must not bump.
+ */
+export function bumpAndResolveSynthetic(reason) {
+    bumpTurnGeneration(reason);
+    resolveAgentEnd({ messages: [], _synthetic: reason });
+}
 // ─── resolveAgentEndCancelled ─────────────────────────────────────────────────
 /**
  * Force-resolve the pending unit promise with { status: "cancelled" }.
@@ -66,6 +83,10 @@ export function isSessionSwitchInFlight() {
  */
 export function resolveAgentEndCancelled(errorContext) {
     if (_currentResolve) {
+        // Cancellation supersedes the in-flight turn the same way timeout
+        // recovery does — bump the turn epoch so any lingering writes from the
+        // cancelled turn drop themselves.
+        bumpTurnGeneration(`cancelled:${errorContext?.category ?? "unknown"}`);
         debugLog("resolveAgentEndCancelled", { status: "resolving-cancelled" });
         const r = _currentResolve;
         _currentResolve = null;
@@ -81,6 +102,9 @@ export function _resetPendingResolve() {
     _currentResolve = null;
     _sessionSwitchInFlight = false;
 }
+export function _hasPendingResolveForTest() {
+    return _currentResolve !== null;
+}
 /**
  * No-op for backward compatibility with tests that previously set the
  * active session. The module no longer holds a session reference.

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -4,7 +4,8 @@
  * Imports from: auto/types, auto/resolve
  */
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
-import { _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { getCurrentTurnGeneration, runWithTurnGeneration, } from "./turn-epoch.js";
 import { debugLog } from "../debug-logger.js";
 import { logWarning } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
@@ -117,6 +118,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
                 ready = false;
             }
             if (!ready) {
+                _clearCurrentResolve();
                 return {
                     status: "cancelled",
                     errorContext: {
@@ -128,6 +130,12 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             }
         }
     }
+    // ── Capture turn generation for stale-write detection ──
+    // Any write site reached via the sendMessage → tool-call → await chain
+    // below sees this generation via AsyncLocalStorage. If a timeout recovery
+    // or cancellation bumps the generation while this turn is in flight, those
+    // writes see themselves as stale and self-drop.
+    const capturedTurnGen = getCurrentTurnGeneration();
     // ── Send the prompt ──
     debugLog("runUnit", { phase: "send-message", unitType, unitId });
     pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });
@@ -143,7 +151,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
         }, UNIT_HARD_TIMEOUT_MS);
     });
-    const result = await Promise.race([unitPromise, timeoutResult]);
+    const result = await runWithTurnGeneration(capturedTurnGen, () => Promise.race([unitPromise, timeoutResult]));
     if (unitTimeoutHandle)
         clearTimeout(unitTimeoutHandle);
     debugLog("runUnit", {

package/dist/resources/extensions/gsd/auto/session.js

@@ -16,9 +16,7 @@
  * `let` or `var` declarations.
  */
 // ─── Constants ───────────────────────────────────────────────────────────────
-export const MAX_UNIT_DISPATCHES = 3;
 export const STUB_RECOVERY_THRESHOLD = 2;
-export const MAX_LIFETIME_DISPATCHES = 6;
 export const NEW_SESSION_TIMEOUT_MS = 120_000;
 // ─── AutoSession ─────────────────────────────────────────────────────────────
 export class AutoSession {
@@ -105,6 +103,11 @@ export class AutoSession {
     /** Set to true after phases.ts successfully calls mergeAndExit, so that
      *  stopAuto does not attempt the same merge a second time (#2645). */
     milestoneMergedInPhases = false;
+    // #4765 — slice-cadence collapse: main-branch SHAs at the moment each
+    // milestone's first slice merge began. Used by resquashMilestoneOnMain at
+    // milestone completion to collapse N slice commits into one. Cleared when
+    // the milestone finishes (or resquash runs).
+    milestoneStartShas = new Map();
     // ── Dispatch circuit breakers ──────────────────────────────────────
     rewriteAttemptCount = 0;
     /** Tracks consecutive bootstrap attempts that found phase === "complete".
@@ -221,6 +224,7 @@ export class AutoSession {
         this.lastGitActionStatus = null;
         this.isolationDegraded = false;
         this.milestoneMergedInPhases = false;
+        this.milestoneStartShas = new Map();
         this.checkpointSha = null;
         // Signal handler
         this.sigtermHandler = null;