gsd-pi 2.77.0-dev.c9c8932c6 → 2.77.0-dev.eaa4973bc

package/dist/cli-web-branch.d.ts

@@ -34,6 +34,7 @@ export interface RunWebCliBranchDeps {
     webPreferencesPath?: string;
 }
 export declare function parseCliArgs(argv: string[]): CliFlags;
+export declare function buildHeadlessAutoArgs(flags: Pick<CliFlags, 'messages' | 'model'>): string[];
 export { getProjectSessionsDir } from './project-sessions.js';
 export declare function migrateLegacyFlatSessions(baseSessionsDir: string, projectSessionsDir: string): void;
 /**

package/dist/cli-web-branch.js

@@ -73,6 +73,9 @@ export function parseCliArgs(argv) {
     }
     return flags;
 }
+export function buildHeadlessAutoArgs(flags) {
+    return flags.model ? ['--model', flags.model, ...flags.messages] : [...flags.messages];
+}
 export { getProjectSessionsDir } from './project-sessions.js';
 export function migrateLegacyFlatSessions(baseSessionsDir, projectSessionsDir) {
     if (!existsSync(baseSessionsDir))

package/dist/cli.js

@@ -12,7 +12,8 @@ import { checkForUpdates } from './update-check.js';
 import { printHelp, printSubcommandHelp } from './help-text.js';
 import { applySecurityOverrides } from './security-overrides.js';
 import { validateConfiguredModel } from './startup-model-validation.js';
-import { parseCliArgs, runWebCliBranch, migrateLegacyFlatSessions, } from './cli-web-branch.js';
+import { migrateAnthropicDefaultToClaudeCode } from './provider-migrations.js';
+import { buildHeadlessAutoArgs, parseCliArgs, runWebCliBranch, migrateLegacyFlatSessions, } from './cli-web-branch.js';
 import { stopWebMode } from './web-mode.js';
 import { getProjectSessionsDir } from './project-sessions.js';
 import { markStartup, printStartupTimings } from './startup-timings.js';
@@ -366,11 +367,18 @@ async function runHeadlessFromAuto(headlessArgs) {
     await runHeadless(parseHeadlessArgs(argv));
     process.exit(0);
 }
+function flushPendingProviderRegistrations(resourceLoader, modelRegistry) {
+    const { runtime } = resourceLoader.getExtensions();
+    for (const { name, config } of runtime.pendingProviderRegistrations) {
+        modelRegistry.registerProvider(name, config);
+    }
+    runtime.pendingProviderRegistrations = [];
+}
 // `gsd auto [args...]` — shorthand for `gsd headless auto [args...]` (#2732)
 // Without this, `gsd auto` falls through to the interactive TUI which hangs
 // when stdin/stdout are piped (non-TTY environments).
 if (cliFlags.messages[0] === 'auto') {
-    await runHeadlessFromAuto(cliFlags.messages);
+    await runHeadlessFromAuto(buildHeadlessAutoArgs(cliFlags));
 }
 // Pi's tool bootstrap can mis-detect already-installed fd/rg on some systems
 // because spawnSync(..., ["--version"]) returns EPERM despite a zero exit code.
@@ -504,6 +512,13 @@ if (isPrintMode) {
     });
     await resourceLoader.reload();
     markStartup('resourceLoader.reload');
+    flushPendingProviderRegistrations(resourceLoader, modelRegistry);
+    migrateAnthropicDefaultToClaudeCode({
+        authStorage,
+        isClaudeCodeReady: modelRegistry.isProviderRequestReady('claude-code'),
+        settingsManager,
+        modelRegistry,
+    });
     const { session, extensionsResult, modelFallbackMessage } = await createAgentSession({
         authStorage,
         modelRegistry,
@@ -642,6 +657,13 @@ const resourceLoadPromise = resourceLoader.reload();
 // Then await the resource promise before creating the agent session.
 await resourceLoadPromise;
 markStartup('resourceLoader.reload');
+flushPendingProviderRegistrations(resourceLoader, modelRegistry);
+migrateAnthropicDefaultToClaudeCode({
+    authStorage,
+    isClaudeCodeReady: modelRegistry.isProviderRequestReady('claude-code'),
+    settingsManager,
+    modelRegistry,
+});
 const { session, extensionsResult, modelFallbackMessage: interactiveFallbackMsg } = await createAgentSession({
     authStorage,
     modelRegistry,

package/dist/provider-migrations.d.ts

@@ -5,6 +5,24 @@ type AnthropicMigrationDeps = {
     defaultProvider: string | undefined;
     env?: NodeJS.ProcessEnv;
 };
+type MigrationModel = {
+    provider: string;
+    id: string;
+};
+type AnthropicDefaultMigrationDeps = {
+    authStorage: Pick<AuthStorage, "getCredentialsForProvider">;
+    isClaudeCodeReady: boolean;
+    settingsManager: {
+        getDefaultProvider(): string | undefined;
+        getDefaultModel(): string | undefined;
+        setDefaultModelAndProvider(provider: string, modelId: string): void;
+    };
+    modelRegistry: {
+        getAvailable(): MigrationModel[];
+    };
+    env?: NodeJS.ProcessEnv;
+};
 export declare function hasDirectAnthropicApiKey(authStorage: Pick<AuthStorage, "getCredentialsForProvider">, env?: NodeJS.ProcessEnv): boolean;
 export declare function shouldMigrateAnthropicToClaudeCode({ authStorage, isClaudeCodeReady, defaultProvider, env, }: AnthropicMigrationDeps): boolean;
+export declare function migrateAnthropicDefaultToClaudeCode({ authStorage, isClaudeCodeReady, settingsManager, modelRegistry, env, }: AnthropicDefaultMigrationDeps): boolean;
 export {};

package/dist/provider-migrations.js

@@ -10,3 +10,17 @@ export function shouldMigrateAnthropicToClaudeCode({ authStorage, isClaudeCodeRe
     }
     return !hasDirectAnthropicApiKey(authStorage, env);
 }
+export function migrateAnthropicDefaultToClaudeCode({ authStorage, isClaudeCodeReady, settingsManager, modelRegistry, env = process.env, }) {
+    const defaultProvider = settingsManager.getDefaultProvider();
+    if (!shouldMigrateAnthropicToClaudeCode({ authStorage, isClaudeCodeReady, defaultProvider, env })) {
+        return false;
+    }
+    const defaultModel = settingsManager.getDefaultModel();
+    const target = modelRegistry.getAvailable().find((model) => model.provider === "claude-code" && model.id === defaultModel) ||
+        modelRegistry.getAvailable().find((model) => model.provider === "claude-code");
+    if (!target) {
+        return false;
+    }
+    settingsManager.setDefaultModelAndProvider(target.provider, target.id);
+    return true;
+}

package/dist/resources/extensions/claude-code-cli/stream-adapter.js

@@ -511,7 +511,7 @@ export async function resolveClaudePermissionMode(env = process.env) {
         console.warn("[claude-code-cli] Headless mode detected (GSD_HEADLESS=1): defaulting permissionMode to 'bypassPermissions' so verification Bash commands can run. Set GSD_CLAUDE_CODE_PERMISSION_MODE=acceptEdits to opt out.");
         return "bypassPermissions";
     }
-    return "acceptEdits";
+    return "bypassPermissions";
 }
 // NOTE: These helpers intentionally mirror @gsd/pi-ai anthropic-shared
 // behavior so this extension remains typecheck-stable even when the published
@@ -563,21 +563,25 @@ function mapThinkingLevelToAnthropicEffort(level, modelId) {
 export function buildSdkOptions(modelId, prompt, overrides, extraOptions = {}) {
     const { reasoning, ...sdkExtraOptions } = extraOptions;
     const mcpServers = buildWorkflowMcpServers();
-    const permissionMode = overrides?.permissionMode ?? "acceptEdits";
-    const disallowedTools = ["AskUserQuestion"];
-    // Pre-authorize the safe built-ins and every registered workflow MCP
-    // server's tools. `acceptEdits` mode (the interactive default) only
-    // auto-approves file edits — Read/Glob/Grep, basic shell inspection, and
-    // every `mcp__gsd-workflow__*` call still surface as "This command
-    // requires approval" and block GSD actions (#4099).
+    const permissionMode = overrides?.permissionMode ?? "bypassPermissions";
+    // Globally unblock all tools. Users reported that the `acceptEdits` default
+    // plus a narrow allowlist silently declined most Bash/Agent/WebFetch calls
+    // when `extensionUIContext` wasn't threaded through. Default to
+    // bypassPermissions and an empty disallow list so every tool — including
+    // `AskUserQuestion` and every `mcp__*` workflow tool — is auto-approved.
+    // Opt back into gated mode with GSD_CLAUDE_CODE_PERMISSION_MODE=acceptEdits.
+    const disallowedTools = [];
     const allowedTools = [
         "Read",
         "Write",
         "Edit",
         "Glob",
         "Grep",
-        "Bash(ls:*)",
-        "Bash(pwd)",
+        "Bash",
+        "Agent",
+        "WebFetch",
+        "WebSearch",
+        "AskUserQuestion",
         ...(mcpServers ? Object.keys(mcpServers).map((serverName) => `mcp__${serverName}__*`) : []),
     ];
     const supportsAdaptive = modelSupportsAdaptiveThinking(modelId);

package/dist/resources/extensions/gsd/abandon-detect.js

@@ -0,0 +1,44 @@
+/**
+ * Abandon-milestone detection for rewrite-docs overrides (#3490).
+ *
+ * Isolated from auto-post-unit.ts so behavioral tests can import this module
+ * without pulling in the full post-unit handler graph (which transitively
+ * loads model-router, workflow engine, etc.).
+ */
+// Detect when a rewrite-docs override is about abandoning THE CURRENT
+// MILESTONE — not just any override containing an abandon verb. Naively
+// matching `/\b(abandon|cancel|drop|...)\b/` against override text produces
+// false positives on scope-change prose ("cancel the standup reminder",
+// "drop the dependency on X", "scrap the v1 design for the landing page").
+//
+// To qualify as an abandon-milestone signal, an override must contain both:
+//   1. An abandon-family verb (abandon|descope|cancel|shelve|drop|scrap)
+//   2. A milestone reference — either the literal word "milestone" or the
+//      current milestone ID — in the same override text.
+// Verb variants cover both US and UK inflections:
+//   cancel / canceled / canceling / cancelled / cancelling / cancels
+//   travel-style "l"-doubling also applies to shelve/drop/scrap.
+// "descope" also accepts "de-scope" and "de scope" (hyphen / space forms).
+const ABANDON_VERB_RE = /\b(abandon(?:ed|ing|s)?|de[-\s]?scope(?:d|s|ing)?|cancel(?:led|ling|ed|ing|s)?|shelve(?:d|s)?|shelving|drop(?:ped|ping|s)?|scrap(?:ped|ping|s)?)\b/i;
+/**
+ * Decide whether a set of active overrides indicates the current milestone
+ * should be parked. Pure function — no I/O, no imports beyond types.
+ */
+export function detectAbandonMilestone(overrides, currentMilestoneId) {
+    if (!currentMilestoneId) {
+        return { shouldPark: false, reason: "", matched: [] };
+    }
+    const escapedId = currentMilestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const milestoneRefRe = new RegExp(`\\b(?:milestone|${escapedId})\\b`, "i");
+    const matched = overrides
+        .filter(o => ABANDON_VERB_RE.test(o.change) && milestoneRefRe.test(o.change))
+        .map(o => o.change);
+    if (matched.length === 0) {
+        return { shouldPark: false, reason: "", matched: [] };
+    }
+    return {
+        shouldPark: true,
+        reason: matched.join("; "),
+        matched,
+    };
+}

package/dist/resources/extensions/gsd/auto/resolve.js

@@ -8,6 +8,7 @@
  * Imports from: auto/types
  */
 import { debugLog } from "../debug-logger.js";
+import { bumpTurnGeneration } from "./turn-epoch.js";
 // ─── Per-unit one-shot promise state ────────────────────────────────────────
 //
 // A single module-level resolve function scoped to the current unit execution.
@@ -56,6 +57,22 @@ export function resolveAgentEnd(event) {
 export function isSessionSwitchInFlight() {
     return _sessionSwitchInFlight;
 }
+// ─── bumpAndResolveSynthetic ────────────────────────────────────────────────
+/**
+ * Bump the turn epoch and synthetically resolve the pending unit promise —
+ * the exact sequence timeout recovery must perform when it advances past a
+ * timed-out unit. Using this helper enforces the invariant "bump iff we are
+ * actually superseding the turn" so a future caller cannot resolve without
+ * bumping (orphaned writes leak) or bump without resolving (next turn starts
+ * already stale).
+ *
+ * NOT to be used for steering retries that keep the same turn alive — those
+ * do not supersede the turn and must not bump.
+ */
+export function bumpAndResolveSynthetic(reason) {
+    bumpTurnGeneration(reason);
+    resolveAgentEnd({ messages: [], _synthetic: reason });
+}
 // ─── resolveAgentEndCancelled ─────────────────────────────────────────────────
 /**
  * Force-resolve the pending unit promise with { status: "cancelled" }.
@@ -66,6 +83,10 @@ export function isSessionSwitchInFlight() {
  */
 export function resolveAgentEndCancelled(errorContext) {
     if (_currentResolve) {
+        // Cancellation supersedes the in-flight turn the same way timeout
+        // recovery does — bump the turn epoch so any lingering writes from the
+        // cancelled turn drop themselves.
+        bumpTurnGeneration(`cancelled:${errorContext?.category ?? "unknown"}`);
         debugLog("resolveAgentEndCancelled", { status: "resolving-cancelled" });
         const r = _currentResolve;
         _currentResolve = null;
@@ -81,6 +102,9 @@ export function _resetPendingResolve() {
     _currentResolve = null;
     _sessionSwitchInFlight = false;
 }
+export function _hasPendingResolveForTest() {
+    return _currentResolve !== null;
+}
 /**
  * No-op for backward compatibility with tests that previously set the
  * active session. The module no longer holds a session reference.

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -4,7 +4,8 @@
  * Imports from: auto/types, auto/resolve
  */
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
-import { _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { getCurrentTurnGeneration, runWithTurnGeneration, } from "./turn-epoch.js";
 import { debugLog } from "../debug-logger.js";
 import { logWarning } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
@@ -117,6 +118,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
                 ready = false;
             }
             if (!ready) {
+                _clearCurrentResolve();
                 return {
                     status: "cancelled",
                     errorContext: {
@@ -128,6 +130,12 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             }
         }
     }
+    // ── Capture turn generation for stale-write detection ──
+    // Any write site reached via the sendMessage → tool-call → await chain
+    // below sees this generation via AsyncLocalStorage. If a timeout recovery
+    // or cancellation bumps the generation while this turn is in flight, those
+    // writes see themselves as stale and self-drop.
+    const capturedTurnGen = getCurrentTurnGeneration();
     // ── Send the prompt ──
     debugLog("runUnit", { phase: "send-message", unitType, unitId });
     pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });
@@ -143,7 +151,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
             resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
         }, UNIT_HARD_TIMEOUT_MS);
     });
-    const result = await Promise.race([unitPromise, timeoutResult]);
+    const result = await runWithTurnGeneration(capturedTurnGen, () => Promise.race([unitPromise, timeoutResult]));
     if (unitTimeoutHandle)
         clearTimeout(unitTimeoutHandle);
     debugLog("runUnit", {

package/dist/resources/extensions/gsd/auto/turn-epoch.js

@@ -0,0 +1,95 @@
+/**
+ * auto/turn-epoch.ts — Turn generation counter + AsyncLocalStorage-backed
+ * capture for stale-turn write dropping.
+ *
+ * Problem: when auto-timeout-recovery synthetically resolves a timed-out
+ * unit so the loop can advance, the original LLM turn keeps running in the
+ * background. Its subsequent writes (journal events, audit events, tool
+ * calls that flow through closeout) then race the replacement unit's
+ * writes. DB-level guards (complete-task/complete-slice) block double
+ * state transitions, but journal/audit/closeout side-effects still fire
+ * with fresh identifiers and pollute forensics.
+ *
+ * Containment: every time we decide a turn is done (timeout recovery,
+ * explicit cancellation), bump a module-level generation counter.
+ * Turn-aware call sites wrap their body in `runWithTurnGeneration`, which
+ * captures the generation into AsyncLocalStorage. Write sites deep in the
+ * stack call `isStaleWrite` — if the captured generation is older than
+ * current, the turn has been superseded and the write is dropped.
+ *
+ * Failure mode: if AsyncLocalStorage context is lost across some exotic
+ * async boundary (e.g. a native-side worker callback), the write site sees
+ * `no-store` and falls through to current behavior — the write proceeds
+ * normally. That is a safe default; the correctness regression is only
+ * "noisier forensics under rare boundary loss," not duplicated state.
+ */
+import { AsyncLocalStorage } from "node:async_hooks";
+import { debugLog } from "../debug-logger.js";
+let _currentGeneration = 0;
+const turnContext = new AsyncLocalStorage();
+/** Current turn generation. Mutated only by bumpTurnGeneration. */
+export function getCurrentTurnGeneration() {
+    return _currentGeneration;
+}
+/**
+ * Bump the turn generation and return the new value. Every caller should
+ * pass a short `reason` string so forensics can reconstruct why a given
+ * turn was marked stale.
+ */
+export function bumpTurnGeneration(reason) {
+    _currentGeneration += 1;
+    debugLog("turnEpoch.bump", { reason, newGeneration: _currentGeneration });
+    return _currentGeneration;
+}
+/**
+ * Run fn() with `capturedGen` attached to AsyncLocalStorage so that any
+ * write site reached from within fn() can check for staleness without
+ * parameter threading.
+ */
+export function runWithTurnGeneration(capturedGen, fn) {
+    return turnContext.run({ capturedGen }, fn);
+}
+/**
+ * True when the current async context was started at a turn generation
+ * older than the current one — meaning the turn has been superseded by
+ * recovery/cancellation since it began.
+ *
+ * Returns false when there is no captured generation (e.g. the write is
+ * happening outside any wrapped turn). That is the safe default: writes
+ * proceed as they did before this epoch was introduced.
+ */
+export function isStaleWrite(component) {
+    const store = turnContext.getStore();
+    if (!store)
+        return false;
+    const captured = store.capturedGen;
+    const current = _currentGeneration;
+    if (captured < current) {
+        debugLog("turnEpoch.stale", {
+            component: component ?? "unknown",
+            captured,
+            current,
+        });
+        return true;
+    }
+    return false;
+}
+/**
+ * Snapshot of both the captured turn generation and the current one.
+ * Used by closeoutUnit to persist an orphan-marker entry instead of
+ * silently skipping the full closeout on a stale turn.
+ */
+export function describeTurnEpoch() {
+    const store = turnContext.getStore();
+    const captured = store?.capturedGen ?? null;
+    const current = _currentGeneration;
+    return {
+        captured,
+        current,
+        stale: captured !== null && captured < current,
+    };
+}
+/** Test helper — resets module state so tests start from a known baseline. */
+export function _resetTurnEpoch() {
+    _currentGeneration = 0;
+}

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -319,6 +319,30 @@ export const DISPATCH_RULES = [
             };
         },
     },
+    {
+        name: "planning (require_slice_discussion) → pause for discussion (#3454)",
+        match: async ({ state, mid, basePath, prefs }) => {
+            if (state.phase !== "planning")
+                return null;
+            if (!prefs?.phases?.require_slice_discussion)
+                return null;
+            if (!state.activeSlice)
+                return null;
+            // Only pause if the slice has no context file yet (discussion not done).
+            // resolveSliceFile returns null when the file does not exist on disk,
+            // but cachedReaddir could return a stale hit — verify with existsSync
+            // so the guard is defence-in-depth and the contract is explicit at the
+            // call site.
+            const sliceContextFile = resolveSliceFile(basePath, mid, state.activeSlice.id, "CONTEXT");
+            if (sliceContextFile && existsSync(sliceContextFile))
+                return null; // discussion already done, proceed
+            return {
+                action: "stop",
+                reason: `Slice ${state.activeSlice.id} requires discussion before planning (require_slice_discussion is enabled). Run /gsd discuss to discuss this slice, then /gsd auto to resume.`,
+                level: "info",
+            };
+        },
+    },
     {
         // Keep this rule before the single-slice research rule so the multi-slice
         // path wins whenever 2+ slices are ready.

package/dist/resources/extensions/gsd/auto-loop.js

@@ -8,6 +8,6 @@
  */
 export { autoLoop, runUokKernelLoop, runLegacyAutoLoop } from "./auto/loop.js";
 export { isInfrastructureError, INFRA_ERROR_CODES } from "./auto/infra-errors.js";
-export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
+export { resolveAgentEnd, resolveAgentEndCancelled, isSessionSwitchInFlight, _hasPendingResolveForTest, _resetPendingResolve, _setActiveSession } from "./auto/resolve.js";
 export { detectStuck } from "./auto/detect-stuck.js";
 export { runUnit } from "./auto/run-unit.js";

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -46,6 +46,7 @@ import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
 import { writeTurnGitTransaction } from "./uok/gitops.js";
 import { isClosedStatus } from "./status-guards.js";
+import { detectAbandonMilestone } from "./abandon-detect.js";
 /** Maximum verification retry attempts before escalating to blocker placeholder (#2653). */
 const MAX_VERIFICATION_RETRIES = 3;
 const COMPLETE_MILESTONE_DB_SETTLE_MS = 1500;
@@ -472,6 +473,36 @@ export async function postUnitPreVerification(pctx, opts) {
         // Rewrite-docs completion
         if (s.currentUnit.type === "rewrite-docs") {
             await runSafely("postUnit", "rewrite-docs-resolve", async () => {
+                // Detect abandon/descope overrides BEFORE resolving them (#3490).
+                // If an override is about abandoning the milestone, park it so the
+                // state engine skips it. Without this, rewrite-docs only edits
+                // markdown but the DB still has the milestone as active.
+                try {
+                    const { loadActiveOverrides } = await import("./files.js");
+                    const overrides = await loadActiveOverrides(s.basePath);
+                    const decision = detectAbandonMilestone(overrides, s.currentMilestoneId);
+                    if (decision.shouldPark && s.currentMilestoneId) {
+                        const { parkMilestone } = await import("./milestone-actions.js");
+                        const parked = parkMilestone(s.basePath, s.currentMilestoneId, decision.reason);
+                        if (parked) {
+                            ctx.ui.notify(`Milestone ${s.currentMilestoneId} parked: "${decision.reason}"`, "info");
+                        }
+                        else {
+                            // Park refused: milestone directory missing, milestone already
+                            // completed (SUMMARY present), or PARKED.md already exists.
+                            // resolveAllOverrides below will still consume the override —
+                            // surface this loudly so the user notices state drift rather
+                            // than silently losing the abandon directive.
+                            const msg = `Abandon detected for ${s.currentMilestoneId} but park refused (milestone is completed, already parked, or missing). Override will be resolved anyway — verify state is correct.`;
+                            logError("engine", msg);
+                            ctx.ui.notify(msg, "warning");
+                        }
+                    }
+                }
+                catch (err) {
+                    logError("engine", `abandon-detect failed: ${err.message}`);
+                    ctx.ui.notify(`Abandon detection failed — check logs. Overrides will still be resolved.`, "warning");
+                }
                 await resolveAllOverrides(s.basePath);
                 // Reset both disk and in-memory counters. Disk counter is authoritative
                 // (survives restarts); in-memory is kept in sync for the current session.

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -6,8 +6,14 @@
 import { readUnitRuntimeRecord, writeUnitRuntimeRecord, formatExecuteTaskRecoveryStatus, inspectExecuteTaskDurability, } from "./unit-runtime.js";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, writeBlockerPlaceholder, } from "./auto-recovery.js";
 import { existsSync } from "node:fs";
-import { resolveAgentEnd } from "./auto-loop.js";
+import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rctx) {
+    // Note on turn epoch: the bump is intentionally NOT unconditional at
+    // function entry. Two branches below (the "steering retry" paths) keep
+    // the same LLM turn alive and let it try again — they must NOT bump,
+    // otherwise the retry's legitimate writes get marked stale and drop.
+    // Each advance branch calls `bumpAndResolveSynthetic` to bump+resolve
+    // atomically. Search for that helper to find all supersede sites.
     const { basePath, verbose, currentUnitStartedAt, unitRecoveryCount } = rctx;
     const runtime = readUnitRuntimeRecord(basePath, unitType, unitId);
     const recoveryAttempts = runtime?.recoveryAttempts ?? 0;
@@ -36,7 +42,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         if (recoveryAttempts < maxRecoveryAttempts) {
@@ -90,7 +96,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts (${diagnostic}). Blocker artifacts written. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         // Fallback: couldn't write skip artifacts — pause as before.
@@ -115,7 +121,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} artifact already exists on disk. Advancing. (attempt ${attemptNumber})`, "info");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     if (recoveryAttempts < maxRecoveryAttempts) {
@@ -180,7 +186,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts. Blocker placeholder written to ${placeholder}. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     // Fallback: couldn't resolve artifact path — pause as before.

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -20,9 +20,18 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import('./memory-extractor.js');
             const llmCallFn = buildMemoryLLMCall(ctx);
             if (llmCallFn) {
-                extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn).catch((err) => {
+                // Awaited: a fire-and-forget here lets memory-extractor writes land in
+                // .gsd/ after closeoutUnit returns but before the milestone merge
+                // runs, which made the working tree appear dirty to `git merge
+                // --squash` (root cause class of #4704). Completion latency is now
+                // bounded by the extractor's LLM call, which is the acceptable price
+                // for not racing the merge boundary.
+                try {
+                    await extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn);
+                }
+                catch (err) {
                     logWarning("engine", `memory extraction failed for ${unitType}/${unitId}: ${err.message}`);
-                });
+                }
             }
         }
         catch (err) { /* non-fatal */