gsd-pi 2.77.0-dev.eaa4973bc → 2.78.0-dev.aeeb2ca00

package/src/resources/extensions/gsd/tests/artifact-retry-cap.test.ts

@@ -0,0 +1,270 @@
+/**
+ * artifact-retry-cap.test.ts — Regression tests for #2007.
+ *
+ * Three interacting bugs caused unbounded artifact-verification retry loops
+ * that burned unlimited budget (202 dispatches observed in production):
+ *
+ * Bug 1: postUnitPreVerification in auto-post-unit.ts had no MAX check before
+ *        returning "retry" when an expected artifact was missing. The attempt
+ *        counter incremented forever.
+ *
+ * Bug 2: runDispatch in auto/phases.ts only pushed to loopState.recentUnits
+ *        when pendingVerificationRetry was falsy, so the sliding-window stuck
+ *        detector never saw artifact-retry dispatches and could not fire.
+ *
+ * Bug 3: MAX_UNIT_DISPATCHES and MAX_LIFETIME_DISPATCHES were exported from
+ *        auto/session.ts but never compared against unitDispatchCount anywhere
+ *        in the codebase — dead constants that provided false confidence.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { join } from "node:path";
+import ts from "typescript";
+
+const dir = join(import.meta.dirname, "..");
+
+const postUnitSrc = readFileSync(join(dir, "auto-post-unit.ts"), "utf-8");
+const phasesSrc = readFileSync(join(dir, "auto", "phases.ts"), "utf-8");
+const sessionSrc = readFileSync(join(dir, "auto", "session.ts"), "utf-8");
+const autoSrc = readFileSync(join(dir, "auto.ts"), "utf-8");
+
+function extractFunctionBody(source: string, functionName: string): string {
+  const sourceFile = ts.createSourceFile(
+    "auto-post-unit.ts",
+    source,
+    ts.ScriptTarget.Latest,
+    true,
+    ts.ScriptKind.TS,
+  );
+  let body: ts.Block | undefined;
+
+  function visit(node: ts.Node): void {
+    if (
+      ts.isFunctionDeclaration(node) &&
+      node.name?.text === functionName
+    ) {
+      body = node.body;
+      return;
+    }
+    ts.forEachChild(node, visit);
+  }
+
+  visit(sourceFile);
+
+  assert.ok(body, `${functionName} must have a function body`);
+  return source.slice(body.getStart(sourceFile) + 1, body.end - 1);
+}
+
+function extractStuckDetectionSection(source: string): string {
+  const stuckSectionIdx = source.indexOf("Sliding-window stuck detection");
+  assert.ok(stuckSectionIdx !== -1, "stuck-detection section must exist");
+
+  const preDispatchIdx = source.indexOf("// Pre-dispatch hooks", stuckSectionIdx);
+  assert.ok(preDispatchIdx !== -1, "pre-dispatch hooks section must follow stuck detection");
+
+  return source.slice(stuckSectionIdx, preDispatchIdx);
+}
+
+const postUnitPreVerificationBody = extractFunctionBody(
+  postUnitSrc,
+  "postUnitPreVerification",
+);
+
+// ─── Bug 1: artifact retry must be bounded ───────────────────────────────────
+
+test("#2007 bug 1: MAX_ARTIFACT_VERIFICATION_RETRIES constant is defined", () => {
+  assert.ok(
+    postUnitSrc.includes("MAX_ARTIFACT_VERIFICATION_RETRIES"),
+    "auto-post-unit.ts must define MAX_ARTIFACT_VERIFICATION_RETRIES",
+  );
+});
+
+test("#2007 bug 1: attempt is compared against MAX_ARTIFACT_VERIFICATION_RETRIES before returning retry", () => {
+  const retryBlockIdx = postUnitPreVerificationBody.indexOf("const retryKey =");
+  assert.ok(retryBlockIdx !== -1, "retry block must exist in postUnitPreVerification");
+
+  const retryIdx = postUnitPreVerificationBody.indexOf("return \"retry\"", retryBlockIdx);
+  assert.ok(retryIdx !== -1, "return \"retry\" must exist in postUnitPreVerification");
+
+  const maxIdx = postUnitPreVerificationBody.indexOf(
+    "if (attempt > MAX_ARTIFACT_VERIFICATION_RETRIES)",
+    retryBlockIdx,
+  );
+  assert.ok(maxIdx !== -1, "retry block must compare attempt against MAX");
+  assert.ok(
+    maxIdx < retryIdx,
+    "MAX_ARTIFACT_VERIFICATION_RETRIES check must appear before return \"retry\"",
+  );
+});
+
+test("#2007 bug 1: exhaustion path pauses auto-mode instead of silently continuing", () => {
+  const exhaustionIdx = postUnitPreVerificationBody.indexOf("phase: \"artifact-verify-exhausted\"");
+  assert.ok(exhaustionIdx !== -1, "exhaustion branch must log artifact-verify-exhausted");
+
+  const pauseIdx = postUnitPreVerificationBody.indexOf("await pauseAuto", exhaustionIdx);
+  const dispatchedIdx = postUnitPreVerificationBody.indexOf("return \"dispatched\"", exhaustionIdx);
+
+  assert.ok(
+    pauseIdx !== -1 && dispatchedIdx !== -1 && pauseIdx < dispatchedIdx,
+    "exhaustion branch must pause auto-mode before returning \"dispatched\"",
+  );
+});
+
+test("#2007 bug 1: failure context message includes attempt count and max", () => {
+  const failureContextIdx = postUnitPreVerificationBody.indexOf("failureContext:");
+  assert.ok(failureContextIdx !== -1, "failureContext assignment must exist");
+  assert.ok(
+    postUnitPreVerificationBody.includes(
+      "attempt ${attempt}/${MAX_ARTIFACT_VERIFICATION_RETRIES}",
+      failureContextIdx,
+    ),
+    "failure context should include attempt progress (attempt/current-max)",
+  );
+});
+
+// ─── Bug 2: stuck detection must see all dispatches ──────────────────────────
+
+test("#2007 bug 2: recentUnits.push is unconditional — not gated on pendingVerificationRetry", () => {
+  const stuckSection = extractStuckDetectionSection(phasesSrc);
+  const pushIdx = stuckSection.indexOf("recentUnits.push");
+  assert.ok(pushIdx !== -1, "recentUnits.push must exist in phases.ts");
+
+  const pendingCheckIdx = stuckSection.indexOf("!s.pendingVerificationRetry");
+  assert.ok(pendingCheckIdx !== -1, "pendingVerificationRetry guard must exist");
+
+  // The push must come BEFORE the pendingVerificationRetry guard
+  assert.ok(
+    pushIdx < pendingCheckIdx,
+    "recentUnits.push must be unconditional — it must appear before the !pendingVerificationRetry check",
+  );
+});
+
+test("#2007 bug 2: detectStuck is still inside the pendingVerificationRetry guard", () => {
+  // detectStuck should only run when NOT in a retry — to avoid false positives
+  // during legitimate retries, but now the window is always populated.
+  const stuckSection = extractStuckDetectionSection(phasesSrc);
+  const pendingCheckIdx = stuckSection.indexOf("!s.pendingVerificationRetry");
+  assert.ok(
+    pendingCheckIdx !== -1,
+    "pendingVerificationRetry guard must exist in the stuck-detection section",
+  );
+  const detectStuckIdx = stuckSection.indexOf("detectStuck(", pendingCheckIdx);
+
+  assert.ok(
+    detectStuckIdx !== -1 && detectStuckIdx > pendingCheckIdx,
+    "detectStuck call must remain inside the !pendingVerificationRetry block",
+  );
+});
+
+// ─── Bug 3: dead dispatch-limit constants removed ────────────────────────────
+
+test("#2007 bug 3: MAX_UNIT_DISPATCHES is removed from session.ts", () => {
+  assert.ok(
+    !sessionSrc.includes("MAX_UNIT_DISPATCHES"),
+    "MAX_UNIT_DISPATCHES was never enforced and must be removed to prevent false confidence",
+  );
+});
+
+test("#2007 bug 3: MAX_LIFETIME_DISPATCHES is removed from session.ts", () => {
+  assert.ok(
+    !sessionSrc.includes("MAX_LIFETIME_DISPATCHES"),
+    "MAX_LIFETIME_DISPATCHES was never enforced and must be removed to prevent false confidence",
+  );
+});
+
+test("#2007 bug 3: dead constants are not re-exported from auto.ts", () => {
+  assert.ok(
+    !autoSrc.includes("MAX_UNIT_DISPATCHES"),
+    "MAX_UNIT_DISPATCHES must not be re-exported from auto.ts",
+  );
+  assert.ok(
+    !autoSrc.includes("MAX_LIFETIME_DISPATCHES"),
+    "MAX_LIFETIME_DISPATCHES must not be re-exported from auto.ts",
+  );
+});
+
+// ─── No stray dead constants left behind by the fix ──────────────────────────
+
+test("#2007 fix does not introduce a new dead constant (STATE_REBUILD_MIN_INTERVAL_MS)", () => {
+  // Bug 3 was about removing dead constants. A draft of this PR added
+  // STATE_REBUILD_MIN_INTERVAL_MS without referencing it — the same anti-pattern
+  // it set out to remove. Lock that down so it cannot regress.
+  assert.ok(
+    !postUnitSrc.includes("STATE_REBUILD_MIN_INTERVAL_MS"),
+    "STATE_REBUILD_MIN_INTERVAL_MS was added but never referenced — must be removed",
+  );
+});
+
+// ─── Behavioral: retry counter is cleared on success ─────────────────────────
+
+test("#2007 verificationRetryCount is cleared on artifact verification success", () => {
+  // Find the success-clear we just added: when triggerArtifactVerified is
+  // true, the retry counter for the current unit must be deleted so a future
+  // failure of the same unit type+id gets the full retry budget instead of
+  // a stale leftover count.
+  //
+  // We assert on the structural shape because a behavioral test would need
+  // to mock 30+ imports of postUnitPreVerification. The AutoSession-level
+  // test below covers the Map contract.
+  const successClearIdx = postUnitPreVerificationBody.indexOf(
+    "if (triggerArtifactVerified)",
+  );
+  assert.ok(
+    successClearIdx !== -1,
+    "Must guard the retry-count clear behind a triggerArtifactVerified check",
+  );
+  const deleteIdx = postUnitPreVerificationBody.indexOf(
+    "verificationRetryCount.delete",
+    successClearIdx,
+  );
+  assert.ok(
+    deleteIdx !== -1,
+    "verificationRetryCount.delete must be called on the verification-success path",
+  );
+});
+
+// ─── AutoSession.verificationRetryCount Map behavior ─────────────────────────
+
+import { AutoSession } from "../auto/session.ts";
+
+test("AutoSession.verificationRetryCount tracks attempts per retry key", () => {
+  const s = new AutoSession();
+  const key = "execute-task:M01/S01/T01";
+
+  assert.equal(s.verificationRetryCount.get(key), undefined);
+
+  s.verificationRetryCount.set(key, 1);
+  assert.equal(s.verificationRetryCount.get(key), 1);
+
+  s.verificationRetryCount.set(key, 2);
+  assert.equal(s.verificationRetryCount.get(key), 2);
+
+  // Simulate the success-clear path
+  s.verificationRetryCount.delete(key);
+  assert.equal(s.verificationRetryCount.get(key), undefined);
+});
+
+test("AutoSession.verificationRetryCount is cleared on session reset", () => {
+  const s = new AutoSession();
+  s.verificationRetryCount.set("execute-task:M01/S01/T01", 2);
+  s.verificationRetryCount.set("plan-slice:M01/S02", 1);
+
+  s.reset();
+
+  assert.equal(s.verificationRetryCount.size, 0);
+});
+
+test("AutoSession.verificationRetryCount independence across retry keys", () => {
+  // Critical: if retries for unit A fail twice and unit A then succeeds, the
+  // counter for A should be cleared but B's counter must remain untouched.
+  const s = new AutoSession();
+  s.verificationRetryCount.set("execute-task:M01/S01/T01", 2);
+  s.verificationRetryCount.set("execute-task:M01/S01/T02", 1);
+
+  s.verificationRetryCount.delete("execute-task:M01/S01/T01");
+
+  assert.equal(s.verificationRetryCount.get("execute-task:M01/S01/T01"), undefined);
+  assert.equal(s.verificationRetryCount.get("execute-task:M01/S01/T02"), 1);
+});

package/src/resources/extensions/gsd/tests/artifacts-table-preserved-on-cache-invalidate.test.ts

@@ -22,6 +22,7 @@ import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 
 import { invalidateAllCaches } from "../cache.ts";
+import { extractSourceRegion } from "./test-helpers.ts";
 import {
   openDatabase,
   closeDatabase,
@@ -160,7 +161,7 @@ describe("cache.ts must not re-import clearArtifacts into invalidateAllCaches",
   test("invalidateAllCaches does not call clearArtifacts", () => {
     const fnIdx = src.indexOf("function invalidateAllCaches");
     assert.ok(fnIdx !== -1);
-    const body = src.slice(fnIdx, fnIdx + 1000);
+    const body = extractSourceRegion(src, "function invalidateAllCaches", { fromIdx: fnIdx });
     assert.ok(
       !/\bclearArtifacts\s*\(/.test(body),
       "invalidateAllCaches must not call clearArtifacts() — it wipes the write-through store",

package/src/resources/extensions/gsd/tests/auto-deterministic-error-classification-4973.test.ts

@@ -0,0 +1,341 @@
+// GSD-2 + Regression tests for deterministic policy error classification (#4973)
+//
+// When gsd_summary_save returns context_write_blocked (a deterministic write-gate
+// rejection), the retry controller must NOT re-dispatch with escalating model tiers.
+// Instead it must write a blocker placeholder and advance the pipeline immediately.
+//
+// Test 5 — deterministic error short-circuits retry:
+//   - isDeterministicPolicyError correctly classifies context_write_blocked errors
+//   - recordToolInvocationError captures deterministic errors in lastToolInvocationError
+//   - postUnitPreVerification returns "continue" (not "retry"), writes placeholder,
+//     leaves pendingVerificationRetry null — zero additional model calls dispatched
+//
+// Test 6 — model-quality failures still use standard retry path:
+//   - non-deterministic failures set pendingVerificationRetry and return "retry"
+//   - tier escalates on retry 1 (previousTier "standard" → "heavy")
+//   - tier is RETAINED at "heavy" on subsequent retries (no downgrade back to fresh
+//     classification when already at max tier) — "escalate once" semantics
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, existsSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+
+import {
+  isDeterministicPolicyError,
+  DETERMINISTIC_POLICY_ERROR_STRINGS,
+} from "../auto-tool-tracking.ts";
+import { AutoSession } from "../auto/session.ts";
+import { _setAutoActiveForTest } from "../auto.ts";
+import { escalateTier } from "../model-router.ts";
+
+// ─── Helpers ─────────────────────────────────────────────────────────────────
+
+const tmpDirs: string[] = [];
+
+function makeTmpBase(): string {
+  const base = mkdtempSync(join(tmpdir(), `gsd-test-4973-${randomUUID().slice(0, 8)}-`));
+  tmpDirs.push(base);
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  return base;
+}
+
+function resetAutoState(): void {
+  _setAutoActiveForTest(false);
+}
+
+// ─── Test 5: Deterministic error short-circuits retry ─────────────────────
+
+describe("Test 5 — isDeterministicPolicyError classifier (#4973)", () => {
+  // ── Classifier unit tests ──────────────────────────────────────────────
+
+  test("classifies context_write_blocked fallback text as deterministic", () => {
+    // This is the text emitted by workflow-tool-executors.ts when contextGuard.reason
+    // is undefined: `Error saving artifact: ${contextGuard.reason ?? "context write blocked"}`
+    const errorText = "gsd_summary_save: Error saving artifact: context write blocked";
+    assert.strictEqual(
+      isDeterministicPolicyError(errorText),
+      true,
+      "fallback context_write_blocked text must be classified as deterministic",
+    );
+  });
+
+  test("classifies write-gate verbose reason as deterministic", () => {
+    // This is the text when shouldBlockContextArtifactSaveInSnapshot returns its reason:
+    // "HARD BLOCK: Cannot save milestone CONTEXT without depth verification for M001. ..."
+    const verboseError = [
+      "gsd_summary_save: Error saving artifact:",
+      "HARD BLOCK: Cannot save milestone CONTEXT without depth verification for M001.",
+      "This is a mechanical gate — you MUST NOT proceed, retry, or rationalize past this block.",
+    ].join(" ");
+    assert.strictEqual(
+      isDeterministicPolicyError(verboseError),
+      true,
+      "verbose write-gate reason containing 'CONTEXT without depth verification' must be classified as deterministic",
+    );
+  });
+
+  test("returns false for malformed-JSON errors (separate classification path)", () => {
+    assert.strictEqual(
+      isDeterministicPolicyError("Unexpected end of JSON input"),
+      false,
+      "malformed-JSON errors are not deterministic policy errors",
+    );
+    assert.strictEqual(
+      isDeterministicPolicyError("Validation failed for tool gsd_complete_slice"),
+      false,
+    );
+  });
+
+  test("returns false for normal business-logic tool errors", () => {
+    assert.strictEqual(
+      isDeterministicPolicyError("Slice S01 is already complete"),
+      false,
+    );
+    assert.strictEqual(
+      isDeterministicPolicyError("Error saving artifact: db_unavailable"),
+      false,
+    );
+  });
+
+  test("returns false for empty string", () => {
+    assert.strictEqual(isDeterministicPolicyError(""), false);
+  });
+
+  test("DETERMINISTIC_POLICY_ERROR_STRINGS list is non-empty and contains context_write_blocked entry", () => {
+    assert.ok(
+      DETERMINISTIC_POLICY_ERROR_STRINGS.length > 0,
+      "must have at least one known deterministic error string",
+    );
+    const hasContextWriteBlocked = DETERMINISTIC_POLICY_ERROR_STRINGS.some(
+      (s) => s.includes("context write blocked") || s.includes("CONTEXT without depth verification"),
+    );
+    assert.ok(hasContextWriteBlocked, "must include context_write_blocked family entries");
+  });
+});
+
+describe("Test 5 — recordToolInvocationError captures deterministic errors (#4973)", () => {
+  beforeEach(resetAutoState);
+  afterEach(resetAutoState);
+
+  test("lastToolInvocationError is NOT set for deterministic errors on current main (pre-fix baseline)", () => {
+    // This test documents the FIXED behavior: deterministic errors ARE captured.
+    // On current main (before this fix), recordToolInvocationError would NOT store
+    // context_write_blocked because it only checked isToolInvocationError and
+    // isQueuedUserMessageSkip.  After the fix, it also checks isDeterministicPolicyError.
+    //
+    // We test the fixed behavior here: the error IS captured.
+    _setAutoActiveForTest(true);
+
+    // Import recordToolInvocationError from auto.ts (it delegates to auto-tool-tracking.ts)
+    // We test indirectly via the session state: after calling recordToolInvocationError,
+    // lastToolInvocationError should be set for deterministic errors.
+    //
+    // Since recordToolInvocationError is not exported directly, we verify the fix
+    // through the AutoSession field behavior documented in the classifier tests above.
+    // The recordToolInvocationError integration is exercised in the postUnitPreVerification
+    // integration test below.
+    const s = new AutoSession();
+    assert.strictEqual(s.lastToolInvocationError, null, "starts null");
+
+    // Simulate what postUnitPreVerification checks: if isDeterministicPolicyError
+    // matches on lastToolInvocationError, the short-circuit fires.
+    // The value is set by recordToolInvocationError (tested via auto.ts integration).
+    s.lastToolInvocationError = "gsd_summary_save: Error saving artifact: context write blocked";
+    assert.ok(
+      isDeterministicPolicyError(s.lastToolInvocationError),
+      "classifier recognises the stored error — short-circuit will fire",
+    );
+    assert.strictEqual(s.pendingVerificationRetry, null, "pendingVerificationRetry starts null");
+  });
+
+  test("AutoSession.lastToolInvocationError can hold a deterministic policy error string", () => {
+    const s = new AutoSession();
+    s.lastToolInvocationError = "gsd_summary_save: Error saving artifact: context write blocked";
+    assert.ok(s.lastToolInvocationError);
+    assert.ok(isDeterministicPolicyError(s.lastToolInvocationError));
+  });
+
+  test("AutoSession.lastToolInvocationError is cleared on reset()", () => {
+    const s = new AutoSession();
+    s.lastToolInvocationError = "gsd_summary_save: Error saving artifact: context write blocked";
+    s.reset();
+    assert.strictEqual(s.lastToolInvocationError, null);
+  });
+});
+
+describe("Test 5 — postUnitPreVerification short-circuits on deterministic error (#4973)", () => {
+  // This integration test calls postUnitPreVerification with a deterministic error
+  // in lastToolInvocationError and asserts that:
+  //   1. pendingVerificationRetry is NOT set (no retry dispatched)
+  //   2. the blocker placeholder is written to disk
+  //   3. the function returns "continue" (not "retry" or "dispatched")
+
+  let base = "";
+  beforeEach(() => {
+    base = makeTmpBase();
+    _setAutoActiveForTest(true);
+  });
+  afterEach(() => {
+    _setAutoActiveForTest(false);
+    // Cleanup is handled by tmpDirs at process exit; individual cleanup here
+    // is best-effort only so as not to mask assertion failures.
+  });
+
+  test("returns 'continue' and writes placeholder for context_write_blocked — no pendingVerificationRetry set", async () => {
+    const { postUnitPreVerification } = await import("../auto-post-unit.ts");
+
+    const s = new AutoSession();
+    s.active = true;
+    s.basePath = base;
+    s.currentUnit = { type: "discuss-milestone", id: "M001", startedAt: Date.now() };
+    // Set the deterministic error that would be recorded by recordToolInvocationError
+    s.lastToolInvocationError = "gsd_summary_save: Error saving artifact: context write blocked";
+    s.verificationRetryCount.set("discuss-milestone:M001", 2);
+
+    let pauseCalled = false;
+    const ctx = {
+      ui: { notify: () => {} },
+    } as any;
+    const pi = {} as any;
+
+    const pctx = {
+      s,
+      ctx,
+      pi,
+      buildSnapshotOpts: () => ({}) as any,
+      lockBase: () => base,
+      stopAuto: async () => {},
+      pauseAuto: async () => { pauseCalled = true; },
+      updateProgressWidget: () => {},
+    } as any;
+
+    const result = await postUnitPreVerification(pctx, { skipSettleDelay: true });
+
+    // Core assertion: deterministic error short-circuits — returns "continue",
+    // no retry, and the placeholder is written so the pipeline can advance.
+    assert.strictEqual(result, "continue", "must return 'continue', not 'retry' or 'dispatched'");
+    assert.strictEqual(s.pendingVerificationRetry, null, "pendingVerificationRetry must NOT be set");
+    assert.strictEqual(s.verificationRetryCount.has("discuss-milestone:M001"), false, "deterministic short-circuit clears stale retry count");
+    assert.strictEqual(s.lastToolInvocationError, null, "lastToolInvocationError cleared after handling");
+    assert.strictEqual(pauseCalled, false, "pauseAuto must NOT be called for deterministic errors");
+
+    // The blocker placeholder must exist on disk so the pipeline can advance.
+    const placeholderPath = join(base, ".gsd", "milestones", "M001", "M001-CONTEXT.md");
+    assert.ok(
+      existsSync(placeholderPath),
+      `blocker placeholder must be written at ${placeholderPath}`,
+    );
+  });
+});
+
+// ─── Test 6: Model-quality failures use standard retry path ──────────────────
+
+describe("Test 6 — non-deterministic failures use standard retry; tier escalates once (#4973)", () => {
+  // ── escalateTier behavior (existing, unchanged) ───────────────────────────
+
+  test("escalateTier: light → standard → heavy → null (max)", () => {
+    assert.strictEqual(escalateTier("light"), "standard");
+    assert.strictEqual(escalateTier("standard"), "heavy");
+    assert.strictEqual(escalateTier("heavy"), null, "heavy is the max tier — no further escalation");
+  });
+
+  test("standard-start retry: escalates to heavy on retry 1, stays at heavy on retry 2 (escalateTier returns null)", () => {
+    // Simulate what selectAndApplyModel does across two retries for a standard-start unit.
+    // Retry 1: previousTier = "standard", escalateTier → "heavy". Applied tier = "heavy".
+    const tier1 = escalateTier("standard");
+    assert.strictEqual(tier1, "heavy", "retry 1: standard escalates to heavy");
+
+    // Retry 2: previousTier = "heavy" (from retry 1 result), escalateTier → null.
+    // The "retain escalated tier" fix kicks in: prevOrder(heavy=2) > freshOrder(standard=1),
+    // so the tier stays at "heavy" rather than reverting to fresh classification.
+    const tier2 = escalateTier("heavy");
+    assert.strictEqual(tier2, null, "retry 2: heavy cannot escalate further");
+
+    // Verify the tier-order comparison used in selectAndApplyModel (#4973 fix):
+    const tierOrder: Record<string, number> = { light: 0, standard: 1, heavy: 2 };
+    const prevOrder = tierOrder["heavy"] ?? 0;      // 2 (from retry 1 result)
+    const freshOrder = tierOrder["standard"] ?? 0;  // 1 (fresh classifyUnitComplexity for a standard unit)
+    assert.ok(
+      prevOrder > freshOrder,
+      "prevOrder(heavy=2) > freshOrder(standard=1) — the fix retains 'heavy' and prevents revert",
+    );
+  });
+
+  test("light-start retry 3: escalated tier is retained, not reverted to 'light'", () => {
+    // Without the fix: retry 3 would see previousTier="heavy" (from retry 2),
+    // escalateTier returns null, and fresh classification is "light" — the model
+    // reverts to a cheap light-tier model. With the fix, we retain "heavy".
+
+    // Retry 1: light → standard
+    assert.strictEqual(escalateTier("light"), "standard");
+    // Retry 2: standard → heavy
+    assert.strictEqual(escalateTier("standard"), "heavy");
+    // Retry 3: heavy → null (can't escalate), fix retains "heavy" instead of reverting to "light"
+    assert.strictEqual(escalateTier("heavy"), null);
+
+    // The fix logic: when escalateTier returns null, compare prevOrder vs freshOrder.
+    const tierOrder: Record<string, number> = { light: 0, standard: 1, heavy: 2 };
+    const prevOrderRetry3 = tierOrder["heavy"] ?? 0;  // 2
+    const freshOrderLight = tierOrder["light"] ?? 0;  // 0
+    assert.ok(
+      prevOrderRetry3 > freshOrderLight,
+      "on retry 3, prevOrder(heavy=2) > freshOrder(light=0) — 'heavy' must be retained, not reverted",
+    );
+  });
+
+  test("non-deterministic error: session sets pendingVerificationRetry (standard retry path)", () => {
+    // Simulate what postUnitPreVerification does for a non-deterministic failure:
+    // no lastToolInvocationError → falls into the standard retry path → sets pendingVerificationRetry.
+    const s = new AutoSession();
+    s.currentUnit = { type: "plan-slice", id: "M001:S01", startedAt: Date.now() };
+
+    // Simulate the retry count increment (as postUnitPreVerification does internally)
+    const retryKey = `${s.currentUnit.type}:${s.currentUnit.id}`;
+    const attempt = (s.verificationRetryCount.get(retryKey) ?? 0) + 1;
+    s.verificationRetryCount.set(retryKey, attempt);
+
+    // Simulate setting pendingVerificationRetry (what the "else" branch does)
+    s.pendingVerificationRetry = {
+      unitId: s.currentUnit.id,
+      failureContext: `Artifact verification failed: expected artifact for ${s.currentUnit.type} "${s.currentUnit.id}" was not found on disk after unit execution (attempt ${attempt}).`,
+      attempt,
+    };
+
+    assert.ok(s.pendingVerificationRetry !== null, "standard retry path sets pendingVerificationRetry");
+    assert.strictEqual(s.pendingVerificationRetry.attempt, 1, "attempt is 1");
+    assert.ok(
+      s.pendingVerificationRetry.failureContext.includes("plan-slice"),
+      "failureContext references the unit type",
+    );
+  });
+
+  test("isDeterministicPolicyError returns false for non-deterministic verification failure", () => {
+    // A plain 'artifact not found' is NOT a deterministic policy error.
+    // The standard retry path must still fire for these.
+    assert.strictEqual(
+      isDeterministicPolicyError(""),
+      false,
+      "empty error (no tool error) is not deterministic",
+    );
+    assert.strictEqual(
+      isDeterministicPolicyError("Artifact not found on disk"),
+      false,
+      "plain artifact-missing message is not a deterministic policy error",
+    );
+    assert.strictEqual(
+      isDeterministicPolicyError("existsSync returned false"),
+      false,
+    );
+  });
+
+});
+
+// Cleanup all temp dirs after the test suite completes
+process.on("exit", () => {
+  for (const dir of tmpDirs) {
+    try { rmSync(dir, { recursive: true, force: true }); } catch { /* ignore */ }
+  }
+});