gsd-pi 2.77.0-dev.c9c8932c6 → 2.77.0-dev.eaa4973bc

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -9,7 +9,7 @@ import { existsSync, cpSync, readFileSync, readdirSync, mkdirSync, realpathSync,
 import { isAbsolute, join, sep as pathSep } from "node:path";
 import { homedir } from "node:os";
 import { GSDError, GSD_IO_ERROR, GSD_GIT_ERROR } from "./errors.js";
-import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, } from "./gsd-db.js";
+import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, closeDatabase, openDatabase, getDbPath, } from "./gsd-db.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { execFileSync } from "node:child_process";
 import { safeCopy, safeCopyRecursive } from "./safe-fs.js";
@@ -1433,26 +1433,53 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     const milestonesDir = join(gsdRoot(originalBasePath_), "milestones");
     const shelterDir = join(gsdRoot(originalBasePath_), ".milestone-shelter");
     const shelteredDirs = [];
+    let shelterRestored = false;
     // Helper: restore sheltered milestone directories (#2505).
     // Called on both success and error paths to ensure queued CONTEXT files
-    // are never permanently lost.
+    // are never permanently lost. Idempotent — the error path may fire after
+    // the success path has already restored and removed the shelter dir; a
+    // second call is a no-op instead of logging a misleading "shelter restore
+    // failed: ENOENT" error for shelter sources that were cleaned up legitimately.
     const restoreShelter = () => {
+        if (shelterRestored)
+            return;
+        shelterRestored = true;
         if (shelteredDirs.length === 0)
             return;
+        let restoreFailed = false;
         for (const dirName of shelteredDirs) {
+            const src = join(shelterDir, dirName);
+            // If the shelter source is missing the restore cannot proceed for this
+            // entry. Distinguish "legitimately missing" (shelter dir removed by a
+            // prior successful restore or never copied) from a surprising ENOENT
+            // inside an otherwise-populated shelter.
+            if (!existsSync(src)) {
+                logWarning("worktree", `shelter source missing for ${dirName}; skipping restore (shelter already cleaned or entry never staged)`);
+                continue;
+            }
             try {
                 mkdirSync(milestonesDir, { recursive: true });
-                cpSync(join(shelterDir, dirName), join(milestonesDir, dirName), { recursive: true, force: true });
+                cpSync(src, join(milestonesDir, dirName), { recursive: true, force: true });
             }
             catch (err) { /* best-effort */
-                logError("worktree", `shelter restore failed: ${err instanceof Error ? err.message : String(err)}`);
+                restoreFailed = true;
+                logError("worktree", `shelter restore failed (${dirName}): ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-        try {
-            rmSync(shelterDir, { recursive: true, force: true });
+        // Preserve the shelter if any per-entry restore failed — it is the only
+        // surviving copy of the queued milestone dirs (sources were deleted during
+        // shelter). Deleting it here would permanently lose those files (#2505).
+        if (restoreFailed) {
+            logWarning("worktree", `shelter retained at ${shelterDir} — manual recovery required for unrestored entries`);
+            return;
         }
-        catch (err) { /* best-effort */
-            logWarning("worktree", `shelter cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+        if (existsSync(shelterDir)) {
+            try {
+                rmSync(shelterDir, { recursive: true, force: true });
+            }
+            catch (err) { /* best-effort */
+                logWarning("worktree", `shelter cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
         }
     };
     try {
@@ -1491,6 +1518,21 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     //     entries (e.g. a gitignored `.gsd` symlink under ADR-002) (#4573).
     //     Queued CONTEXT files under `.gsd/milestones/*` are already sheltered
     //     in step 7 above, so they won't be swept into the stash.
+    // On Windows, SQLite holds mandatory file locks on the gsd.db WAL/SHM
+    // sidecars while the connection is open. `git stash --include-untracked`
+    // walks those files and fails with EBUSY (#4704). Close the DB before
+    // stashing so Windows releases the handles; reopen after. No-op on
+    // POSIX, where advisory locks don't block git.
+    const needsDbCycle = process.platform === "win32" && isDbAvailable();
+    const dbPathToReopen = needsDbCycle ? getDbPath() : null;
+    if (needsDbCycle) {
+        try {
+            closeDatabase();
+        }
+        catch (err) {
+            logWarning("worktree", `pre-stash db close failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     let stashed = false;
     try {
         const status = execFileSync("git", ["status", "--porcelain"], {
@@ -1508,6 +1550,14 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         // report the dirty tree if it fails.
         logWarning("worktree", `git stash failed: ${err instanceof Error ? err.message : String(err)}`);
     }
+    if (needsDbCycle && dbPathToReopen) {
+        try {
+            openDatabase(dbPathToReopen);
+        }
+        catch (err) {
+            logWarning("worktree", `post-stash db reopen failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     // 7b. Clean up stale merge state before attempting squash merge (#2912).
     // A leftover MERGE_HEAD (from a previous failed merge, libgit2 native path,
     // or interrupted operation) causes `git merge --squash` to refuse with

package/dist/resources/extensions/gsd/auto.js

@@ -274,6 +274,10 @@ export function getAutoDashboardData() {
 export function isAutoActive() {
     return s.active;
 }
+/** Test-only seam for validating auto-mode guards (#4704). Do not use in production code. */
+export function _setAutoActiveForTest(active) {
+    s.active = active;
+}
 export function isAutoPaused() {
     return s.paused;
 }

package/dist/resources/extensions/gsd/bootstrap/provider-error-resume.js

@@ -3,6 +3,8 @@ import { resetTransientRetryState } from "./agent-end-recovery.js";
 import { resetSessionTimeoutState } from "../auto/phases.js";
 const defaultDeps = {
     getSnapshot: () => getAutoDashboardData(),
+    resetTransientRetryState,
+    resetSessionTimeoutState,
     startAuto,
 };
 export async function resumeAutoAfterProviderDelay(pi, ctx, deps = defaultDeps) {
@@ -18,8 +20,8 @@ export async function resumeAutoAfterProviderDelay(pi, ctx, deps = defaultDeps)
     // Reset retry counters before restarting — without this, counters
     // accumulate across pause/resume cycles and permanently lock out
     // auto-resume after their respective MAX thresholds.
-    resetTransientRetryState();
-    resetSessionTimeoutState();
+    deps.resetTransientRetryState();
+    deps.resetSessionTimeoutState();
     await deps.startAuto(ctx, pi, snapshot.basePath, false, { step: snapshot.stepMode });
     return "resumed";
 }

package/dist/resources/extensions/gsd/commands/handlers/workflow.js

@@ -17,6 +17,22 @@ import { validateDefinition } from "../../definition-loader.js";
 import { formatPluginInfo, listPluginsFormatted, resolvePlugin, } from "../../workflow-plugins.js";
 import { dispatchOneshot } from "../../workflow-dispatch.js";
 import { fetchWorkflowSource, globalInstallDir, inferPluginName, installPlugin, previewContent, projectInstallDir, resolveSourceUrl, uninstallPlugin, validateFetchedContent, } from "../../workflow-install.js";
+/**
+ * Refuses interactive commands that mutate durable .gsd/ planning state while
+ * auto-mode holds the worktree. Returns true if the command was blocked and
+ * the caller should return immediately; false if it is safe to proceed.
+ *
+ * Auto-mode's squash merge performs a pre-merge dirty-tree check; concurrent
+ * writes by interactive commands between that check and the merge itself
+ * cause __dirty_working_tree__ failures (#4704).
+ */
+function requireNotAutoActive(commandName, ctx) {
+    if (!isAutoActive())
+        return false;
+    ctx.ui.notify(`${commandName} cannot run while auto-mode is active.\n` +
+        `Stop auto-mode first with /gsd stop, then run ${commandName}.`, "error");
+    return true;
+}
 // ─── Custom Workflow Subcommands ─────────────────────────────────────────
 const RESERVED_SUBCOMMANDS = new Set([
     "new", "run", "list", "validate", "pause", "resume",
@@ -394,12 +410,16 @@ async function handleCustomWorkflow(sub, ctx, pi) {
 export async function handleWorkflowCommand(trimmed, ctx, pi) {
     // ── /gsd do — natural language routing (must be early to route to other commands) ──
     if (trimmed === "do" || trimmed.startsWith("do ")) {
+        if (requireNotAutoActive("/gsd do", ctx))
+            return true;
         const { handleDo } = await import("../../commands-do.js");
         await handleDo(trimmed.replace(/^do\s*/, "").trim(), ctx, pi);
         return true;
     }
     // ── Backlog management ──
     if (trimmed === "backlog" || trimmed.startsWith("backlog ")) {
+        if (requireNotAutoActive("/gsd backlog", ctx))
+            return true;
         const { handleBacklog } = await import("../../commands-backlog.js");
         await handleBacklog(trimmed.replace(/^backlog\s*/, "").trim(), ctx, pi);
         return true;
@@ -410,23 +430,26 @@ export async function handleWorkflowCommand(trimmed, ctx, pi) {
         return handleCustomWorkflow(sub, ctx, pi);
     }
     if (trimmed === "queue") {
+        if (requireNotAutoActive("/gsd queue", ctx))
+            return true;
         await showQueue(ctx, pi, projectRoot());
         return true;
     }
     if (trimmed === "discuss") {
+        if (requireNotAutoActive("/gsd discuss", ctx))
+            return true;
         await showDiscuss(ctx, pi, projectRoot());
         return true;
     }
     if (trimmed === "quick" || trimmed.startsWith("quick ")) {
-        if (isAutoActive()) {
-            ctx.ui.notify("/gsd quick cannot run while auto-mode is active.\n" +
-                "Stop auto-mode first with /gsd stop, then run /gsd quick.", "error");
+        if (requireNotAutoActive("/gsd quick", ctx))
             return true;
-        }
         await handleQuick(trimmed.replace(/^quick\s*/, "").trim(), ctx, pi);
         return true;
     }
     if (trimmed === "new-milestone") {
+        if (requireNotAutoActive("/gsd new-milestone", ctx))
+            return true;
         const basePath = projectRoot();
         const headlessContextPath = join(gsdRoot(basePath), "runtime", "headless-context.md");
         if (existsSync(headlessContextPath)) {
@@ -452,6 +475,8 @@ export async function handleWorkflowCommand(trimmed, ctx, pi) {
         return true;
     }
     if (trimmed === "park" || trimmed.startsWith("park ")) {
+        if (requireNotAutoActive("/gsd park", ctx))
+            return true;
         const basePath = projectRoot();
         const arg = trimmed.replace(/^park\s*/, "").trim();
         let targetId = arg;
@@ -474,6 +499,8 @@ export async function handleWorkflowCommand(trimmed, ctx, pi) {
         return true;
     }
     if (trimmed === "unpark" || trimmed.startsWith("unpark ")) {
+        if (requireNotAutoActive("/gsd unpark", ctx))
+            return true;
         const basePath = projectRoot();
         const arg = trimmed.replace(/^unpark\s*/, "").trim();
         let targetId = arg;

package/dist/resources/extensions/gsd/file-lock.js

@@ -1,11 +1,19 @@
 import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+// The file-lock module is loaded in both CJS builds and ESM sources. Under ESM
+// the bare `require` identifier is not defined, so we always go through
+// createRequire. We try the current module's resolution context first and fall
+// back to the installed gsd-pi package if we are running from a consumer
+// project that does not hoist proper-lockfile.
+const localRequire = createRequire(import.meta.url);
 function _require(name) {
     try {
-        return require(name);
+        return localRequire(name);
     }
     catch {
         try {
-            const gsdPiRequire = require("module").createRequire(require("path").join(process.cwd(), "node_modules", "gsd-pi", "index.js"));
+            const gsdPiRequire = createRequire(join(process.cwd(), "node_modules", "gsd-pi", "index.js"));
             return gsdPiRequire(name);
         }
         catch {
@@ -13,14 +21,44 @@ function _require(name) {
         }
     }
 }
-export function withFileLockSync(filePath, fn) {
+const DEFAULT_RETRIES = 5;
+const DEFAULT_STALE_MS = 10000;
+const SYNC_RETRY_DELAY_MS = 50;
+// Block the thread for `ms` milliseconds without spinning the CPU.
+// Used by the sync lock retry loop, since proper-lockfile's lockSync does not
+// accept a `retries` option (only the async `lock` does).
+function sleepSync(ms) {
+    if (ms <= 0)
+        return;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireLockSyncWithRetry(lockfile, filePath, retries, stale) {
+    let lastErr;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            return lockfile.lockSync(filePath, { stale });
+        }
+        catch (err) {
+            lastErr = err;
+            if (err?.code !== "ELOCKED")
+                throw err;
+            if (attempt < retries)
+                sleepSync(SYNC_RETRY_DELAY_MS);
+        }
+    }
+    throw lastErr;
+}
+export function withFileLockSync(filePath, fn, opts = {}) {
     const lockfile = _require("proper-lockfile");
     if (!lockfile)
         return fn();
     if (!existsSync(filePath))
         return fn();
+    const retries = opts.retries ?? DEFAULT_RETRIES;
+    const stale = opts.stale ?? DEFAULT_STALE_MS;
+    const onLocked = opts.onLocked ?? "fail";
     try {
-        const release = lockfile.lockSync(filePath, { retries: 5, stale: 10000 });
+        const release = acquireLockSyncWithRetry(lockfile, filePath, retries, stale);
         try {
             return fn();
         }
@@ -29,21 +67,23 @@ export function withFileLockSync(filePath, fn) {
         }
     }
     catch (err) {
-        if (err.code === "ELOCKED") {
-            // Could not get lock after retries, let's fallback to un-locked instead of crashing the whole state machine
+        if (err?.code === "ELOCKED" && onLocked === "skip") {
             return fn();
         }
         throw err;
     }
 }
-export async function withFileLock(filePath, fn) {
+export async function withFileLock(filePath, fn, opts = {}) {
     const lockfile = _require("proper-lockfile");
     if (!lockfile)
         return await fn();
     if (!existsSync(filePath))
         return await fn();
+    const retries = opts.retries ?? DEFAULT_RETRIES;
+    const stale = opts.stale ?? DEFAULT_STALE_MS;
+    const onLocked = opts.onLocked ?? "fail";
     try {
-        const release = await lockfile.lock(filePath, { retries: 5, stale: 10000 });
+        const release = await lockfile.lock(filePath, { retries, stale });
         try {
             return await fn();
         }
@@ -52,7 +92,7 @@ export async function withFileLock(filePath, fn) {
         }
     }
     catch (err) {
-        if (err.code === "ELOCKED") {
+        if (err?.code === "ELOCKED" && onLocked === "skip") {
             return await fn();
         }
         throw err;

package/dist/resources/extensions/gsd/git-service.js

@@ -84,6 +84,7 @@ export class MergeConflictError extends GSDError {
  */
 export const RUNTIME_EXCLUSION_PATHS = [
     ".gsd/activity/",
+    ".gsd/audit/",
     ".gsd/forensics/",
     ".gsd/runtime/",
     ".gsd/worktrees/",

package/dist/resources/extensions/gsd/gitignore.js

@@ -24,6 +24,7 @@ import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
  */
 const GSD_RUNTIME_PATTERNS = [
     ".gsd/activity/",
+    ".gsd/audit/",
     ".gsd/forensics/",
     ".gsd/runtime/",
     ".gsd/worktrees/",

package/dist/resources/extensions/gsd/guided-flow-queue.js

@@ -13,6 +13,7 @@ import { deriveState } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
 import { gsdRoot, resolveMilestoneFile, resolveGsdRootFile, relGsdRootFile, } from "./paths.js";
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { atomicWriteSync } from "./atomic-write.js";
 import { nativeAddPaths, nativeCommit } from "./native-git-bridge.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { saveQueueOrder } from "./queue-order.js";
@@ -361,5 +362,7 @@ function syncProjectMdSequence(basePath, registry, newOrder) {
     const separatorLine = lines[tableStart + 1];
     const newTable = [headerLine, separatorLine, ...newRows];
     lines.splice(tableStart, tableEnd - tableStart, ...newTable);
-    writeFileSync(projectPath, lines.join("\n"), "utf-8");
+    // Atomic write: tmp+rename avoids a torn PROJECT.md appearing dirty in
+    // another worktree's working tree during a concurrent /gsd auto merge.
+    atomicWriteSync(projectPath, lines.join("\n"), "utf-8");
 }

package/dist/resources/extensions/gsd/journal.js

@@ -11,8 +11,10 @@
  * - queryJournal() enables programmatic filtering by flowId, eventType, unitId, time range
  * - Silent failure: journal writes never throw — absence of events is the failure signal
  */
-import { appendFileSync, mkdirSync, readdirSync, readFileSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readdirSync, readFileSync, } from "node:fs";
 import { join } from "node:path";
+import { isStaleWrite } from "./auto/turn-epoch.js";
+import { withFileLockSync } from "./file-lock.js";
 import { gsdRoot } from "./paths.js";
 import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
 import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
@@ -26,12 +28,25 @@ import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
  * Never throws — all errors are silently caught.
  */
 export function emitJournalEvent(basePath, entry) {
+    // Drop writes from a turn superseded by timeout recovery / cancellation.
+    // See auto/turn-epoch.ts for the full rationale.
+    if (isStaleWrite("journal"))
+        return;
     try {
         const journalDir = join(gsdRoot(basePath), "journal");
         mkdirSync(journalDir, { recursive: true });
         const dateStr = entry.ts.slice(0, 10);
         const filePath = join(journalDir, `${dateStr}.jsonl`);
-        appendFileSync(filePath, JSON.stringify(entry) + "\n");
+        // Ensure file exists so proper-lockfile can acquire a lock against it.
+        if (!existsSync(filePath))
+            closeSync(openSync(filePath, "a"));
+        // onLocked: "skip" — journal writes are best-effort. POSIX O_APPEND
+        // atomicity still protects small entries; the lock mainly serializes
+        // larger writes and gives cross-process exclusivity on platforms where
+        // O_APPEND semantics are weaker (Windows).
+        withFileLockSync(filePath, () => {
+            appendFileSync(filePath, JSON.stringify(entry) + "\n");
+        }, { onLocked: "skip" });
     }
     catch {
         // Silent failure — journal must never break auto-mode

package/dist/resources/extensions/gsd/milestone-actions.js

@@ -18,6 +18,18 @@ import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
 import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
 import { removeWorktree } from "./worktree-manager.js";
 import { logWarning } from "./workflow-logger.js";
+import { isAutoActive } from "./auto.js";
+/**
+ * Writer-side assert for mutations that race with auto-mode's squash merge (#4704).
+ * Auto-mode is confirmed not to call parkMilestone/discardMilestone/unparkMilestone
+ * internally — these throws only surface invariant violations from new or forgotten
+ * call sites, which is the correct failure mode to catch loudly.
+ */
+function assertNotAutoActive(action) {
+    if (isAutoActive()) {
+        throw new Error(`${action} cannot run while auto-mode is active. Stop auto-mode first with /gsd stop.`);
+    }
+}
 // ─── Park ──────────────────────────────────────────────────────────────────
 /**
  * Park a milestone — creates a PARKED.md marker file with reason and timestamp.
@@ -25,6 +37,7 @@ import { logWarning } from "./workflow-logger.js";
  * Returns true if successfully parked, false if milestone not found or already parked.
  */
 export function parkMilestone(basePath, milestoneId, reason) {
+    assertNotAutoActive("park milestone");
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;
@@ -65,6 +78,7 @@ export function parkMilestone(basePath, milestoneId, reason) {
  * Returns true if successfully unparked, false if milestone not found or not parked.
  */
 export function unparkMilestone(basePath, milestoneId) {
+    assertNotAutoActive("unpark milestone");
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;
@@ -97,6 +111,7 @@ export function unparkMilestone(basePath, milestoneId) {
  * Returns true if successfully discarded, false if milestone not found.
  */
 export function discardMilestone(basePath, milestoneId) {
+    assertNotAutoActive("discard milestone");
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;

package/dist/resources/extensions/gsd/reports.js

@@ -13,8 +13,9 @@
  * Auto-triggered: after each milestone completion (when auto_report: true).
  * Manual: /gsd export --html
  */
-import { writeFileSync, readFileSync, mkdirSync, existsSync } from 'node:fs';
+import { readFileSync, mkdirSync, existsSync } from 'node:fs';
 import { join } from 'node:path';
+import { atomicWriteSync } from './atomic-write.js';
 import { gsdRoot } from './paths.js';
 import { formatCost, formatTokenCount } from './metrics.js';
 import { formatDateShort, formatDuration } from '../shared/format-utils.js';
@@ -43,7 +44,7 @@ export function loadReportsIndex(basePath) {
 function saveReportsIndex(basePath, index) {
     const dir = reportsDir(basePath);
     mkdirSync(dir, { recursive: true });
-    writeFileSync(reportsIndexPath(basePath), JSON.stringify(index, null, 2) + '\n', 'utf-8');
+    atomicWriteSync(reportsIndexPath(basePath), JSON.stringify(index, null, 2) + '\n', 'utf-8');
 }
 /**
  * Write a report snapshot to .gsd/reports/, update reports.json, regenerate index.html.
@@ -56,7 +57,7 @@ export function writeReportSnapshot(args) {
     const prefix = args.milestoneId === 'final' ? 'final' : args.milestoneId;
     const filename = `${prefix}-${timestamp}.html`;
     const filePath = join(dir, filename);
-    writeFileSync(filePath, args.html, 'utf-8');
+    atomicWriteSync(filePath, args.html, 'utf-8');
     // Load or init registry
     const existing = loadReportsIndex(args.basePath);
     const index = existing ?? {
@@ -97,7 +98,7 @@ export function writeReportSnapshot(args) {
 // ─── HTML Index Generator ─────────────────────────────────────────────────────
 export function regenerateHtmlIndex(basePath, index) {
     const html = buildIndexHtml(index);
-    writeFileSync(reportsHtmlIndexPath(basePath), html, 'utf-8');
+    atomicWriteSync(reportsHtmlIndexPath(basePath), html, 'utf-8');
 }
 function buildIndexHtml(index) {
     const { projectName, projectPath, gsdVersion, entries } = index;

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -16,6 +16,7 @@ import { checkOwnership, sliceUnitKey } from "../unit-ownership.js";
 import { saveFile, clearParseCache } from "../files.js";
 import { invalidateStateCache } from "../state.js";
 import { renderRoadmapCheckboxes } from "../markdown-renderer.js";
+import { isStaleWrite } from "../auto/turn-epoch.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -228,6 +229,10 @@ export async function handleCompleteSlice(params, basePath) {
         }
         const slice = getSlice(params.milestoneId, params.sliceId);
         if (slice && isClosedStatus(slice.status)) {
+            if (isStaleWrite("complete-slice")) {
+                guardError = "__stale_duplicate__";
+                return;
+            }
             guardError = `slice ${params.sliceId} is already complete — use gsd_slice_reopen first if you need to redo it`;
             return;
         }
@@ -248,6 +253,22 @@ export async function handleCompleteSlice(params, basePath) {
         insertSlice({ id: params.sliceId, milestoneId: params.milestoneId, title: params.sliceId });
         updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
     });
+    if (guardError === "__stale_duplicate__") {
+        // Stale duplicate from a turn superseded by timeout recovery. Return a
+        // non-mutating success so the orphaned LLM tool call unwinds quietly.
+        const sliceDir = resolveSlicePath(basePath, params.milestoneId, params.sliceId);
+        const staleSummaryPath = sliceDir
+            ? join(sliceDir, `${params.sliceId}-SUMMARY.md`)
+            : join(basePath, ".gsd", "milestones", params.milestoneId, "slices", params.sliceId, `${params.sliceId}-SUMMARY.md`);
+        return {
+            sliceId: params.sliceId,
+            milestoneId: params.milestoneId,
+            summaryPath: staleSummaryPath,
+            uatPath: staleSummaryPath.replace(/-SUMMARY\.md$/, "-UAT.md"),
+            duplicate: true,
+            stale: true,
+        };
+    }
     if (guardError) {
         return { error: guardError };
     }

package/dist/resources/extensions/gsd/tools/complete-task.js

@@ -21,6 +21,7 @@ import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning, logError } from "../workflow-logger.js";
 import { loadEffectiveGSDPreferences } from "../preferences.js";
+import { isStaleWrite } from "../auto/turn-epoch.js";
 import { buildEscalationArtifact, writeEscalationArtifact } from "../escalation.js";
 /**
  * Map an execute-task-owned gate id to the CompleteTaskParams field whose
@@ -167,6 +168,18 @@ export async function handleCompleteTask(params, basePath) {
         }
         const existingTask = getTask(params.milestoneId, params.sliceId, params.taskId);
         if (existingTask && isClosedStatus(existingTask.status)) {
+            // Stale-turn path: a timed-out turn that was superseded by recovery
+            // can still reach this code when its LLM call eventually returns and
+            // invokes gsd_complete_task. Returning an error would produce noisy
+            // "already complete — use reopen first" logs in the orphaned turn.
+            // Instead, signal the duplicate via a non-mutating success shape that
+            // callers can detect via `duplicate: true` / `stale: true`.
+            if (isStaleWrite("complete-task")) {
+                // Sentinel handled below — outside the transaction — so we don't
+                // render SUMMARY.md or flip plan checkboxes for a stale duplicate.
+                guardError = "__stale_duplicate__";
+                return;
+            }
             guardError = `task ${params.taskId} is already complete — use gsd_task_reopen first if you need to redo it`;
             return;
         }
@@ -201,6 +214,24 @@ export async function handleCompleteTask(params, basePath) {
             });
         }
     });
+    if (guardError === "__stale_duplicate__") {
+        // Orphaned-turn duplicate: the task is already complete from the
+        // superseded turn's earlier (real) call. Return a non-mutating success
+        // so the stale LLM tool call unwinds cleanly. summaryPath is synthesized
+        // from the existing on-disk layout; no file is written.
+        const tasksDir = resolveTasksDir(basePath, params.milestoneId, params.sliceId);
+        const staleSummaryPath = tasksDir
+            ? join(tasksDir, `${params.taskId}-SUMMARY.md`)
+            : join(basePath, ".gsd", "milestones", params.milestoneId, "slices", params.sliceId, "tasks", `${params.taskId}-SUMMARY.md`);
+        return {
+            taskId: params.taskId,
+            sliceId: params.sliceId,
+            milestoneId: params.milestoneId,
+            summaryPath: staleSummaryPath,
+            duplicate: true,
+            stale: true,
+        };
+    }
     if (guardError) {
         return { error: guardError };
     }

package/dist/resources/extensions/gsd/uok/audit.js

@@ -1,6 +1,8 @@
-import { appendFileSync, mkdirSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
+import { isStaleWrite } from "../auto/turn-epoch.js";
+import { withFileLockSync } from "../file-lock.js";
 import { gsdRoot } from "../paths.js";
 import { isDbAvailable, insertAuditEvent } from "../gsd-db.js";
 function auditLogPath(basePath) {
@@ -22,9 +24,23 @@ export function buildAuditEnvelope(args) {
     };
 }
 export function emitUokAuditEvent(basePath, event) {
+    // Drop writes from a turn superseded by timeout recovery / cancellation.
+    if (isStaleWrite("uok-audit"))
+        return;
     try {
         ensureAuditDir(basePath);
-        appendFileSync(auditLogPath(basePath), `${JSON.stringify(event)}\n`, "utf-8");
+        const path = auditLogPath(basePath);
+        // proper-lockfile requires the target file to exist before locking.
+        // Touch it via open(O_APPEND|O_CREAT) so the first writer wins the race
+        // atomically at the kernel level.
+        if (!existsSync(path))
+            closeSync(openSync(path, "a"));
+        // onLocked: "skip" — audit writes are best-effort; under heavy contention
+        // POSIX O_APPEND atomicity still protects small line writes, so skipping
+        // the lock rather than stalling orchestration is the correct tradeoff.
+        withFileLockSync(path, () => {
+            appendFileSync(path, `${JSON.stringify(event)}\n`, "utf-8");
+        }, { onLocked: "skip" });
     }
     catch {
         // Best-effort: audit writes must never break orchestration.

package/dist/resources/extensions/gsd/workflow-logger.js

@@ -15,8 +15,9 @@
 // a process. The auto-loop must call _resetLogs() (or drainAndSummarize()) at
 // the start of each unit to prevent log bleed between units running in the same
 // Node process.
-import { appendFileSync, readFileSync, existsSync, mkdirSync } from "node:fs";
+import { appendFileSync, closeSync, existsSync, mkdirSync, openSync, readFileSync, } from "node:fs";
 import { join } from "node:path";
+import { withFileLockSync } from "./file-lock.js";
 import { appendNotification } from "./notification-store.js";
 import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
 import { isUnifiedAuditEnabled } from "./uok/audit-toggle.js";
@@ -231,8 +232,15 @@ function _push(severity, component, message, context) {
         try {
             const auditDir = join(_auditBasePath, ".gsd");
             mkdirSync(auditDir, { recursive: true });
+            const auditPath = join(auditDir, "audit-log.jsonl");
             const sanitized = _sanitizeForAudit(entry);
-            appendFileSync(join(auditDir, "audit-log.jsonl"), JSON.stringify(sanitized) + "\n", "utf-8");
+            // Ensure file exists so proper-lockfile can acquire a lock against it.
+            if (!existsSync(auditPath))
+                closeSync(openSync(auditPath, "a"));
+            // onLocked: "skip" — never block error logging on lock contention.
+            withFileLockSync(auditPath, () => {
+                appendFileSync(auditPath, JSON.stringify(sanitized) + "\n", "utf-8");
+            }, { onLocked: "skip" });
         }
         catch (auditErr) {
             // Best-effort — never let audit write failures bubble up