gsd-pi 2.77.0 → 2.78.0-dev.aeeb2ca00

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -11,28 +11,34 @@ import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice, getMilestone } from "./gsd-db.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { nativeConflictFiles, nativeCommit, nativeCheckoutTheirs, nativeAddPaths, nativeMergeAbort, nativeResetHard, } from "./native-git-bridge.js";
+import { readIntegrationBranch } from "./git-service.js";
+import { isClosedStatus } from "./status-guards.js";
+import { nativeConflictFiles, nativeCommit, nativeCheckoutTheirs, nativeAddPaths, nativeMergeAbort, nativeRebaseAbort, nativeResetHard, } from "./native-git-bridge.js";
 import { resolveSlicePath, resolveSliceFile, resolveTasksDir, resolveTaskFiles, relMilestoneFile, relSliceFile, buildSliceFileName, resolveMilestoneFile, clearPathCache, resolveGsdRootFile, } from "./paths.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { dirname, join } from "node:path";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, } from "./auto-artifact-paths.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 // Re-export so existing consumers of auto-recovery.ts keep working.
 export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
+export { classifyMilestoneSummaryContent, } from "./milestone-summary-classifier.js";
 // ─── Artifact Resolution & Verification ───────────────────────────────────────
 /**
- * Check whether a milestone produced implementation artifacts (non-`.gsd/` files)
- * in the git history. Uses `git log --name-only` to inspect all commits on the
- * current branch that touch files outside `.gsd/`.
+ * Check whether a milestone produced implementation artifacts (non-`.gsd/`
+ * files) in git history. The primary signal is the branch diff against the
+ * integration branch. When a retry is already on the integration branch, that
+ * diff is a self-diff; if a milestone ID is available, fall back to recent
+ * GSD-tagged commits for that milestone.
  *
  * Returns "present" if implementation files found, "absent" if only .gsd/ files,
  * "unknown" if git is unavailable or check failed (callers decide how to handle).
  */
-export function hasImplementationArtifacts(basePath) {
+export function hasImplementationArtifacts(basePath, milestoneId) {
     try {
         // Verify we're in a git repo
         try {
@@ -48,19 +54,31 @@ export function hasImplementationArtifacts(basePath) {
         }
         // Strategy: check `git diff --name-only` against the merge-base with the
         // main branch. This captures ALL files changed during the milestone's
-        // lifetime. If no merge-base exists (e.g., single-branch workflow), fall
-        // back to checking the last N commits.
-        const mainBranch = detectMainBranch(basePath);
-        const changedFiles = getChangedFilesSinceBranch(basePath, mainBranch);
-        // No files changed at all — unknown (could be detached HEAD, single-
-        // commit repo, or other edge case where git diff returns nothing).
-        if (changedFiles.length === 0)
+        // lifetime while running on a milestone branch.
+        const integrationBranch = milestoneId
+            ? readIntegrationBranch(basePath, milestoneId) ?? detectMainBranch(basePath)
+            : detectMainBranch(basePath);
+        const currentBranch = getCurrentBranch(basePath);
+        const branchDiff = getChangedFilesSinceBranch(basePath, integrationBranch);
+        if (!branchDiff.ok)
             return "unknown";
-        // Filter out .gsd/ files — only implementation files count.
-        // If every changed file is under .gsd/, the milestone produced no
-        // implementation code (#1703).
-        const implFiles = changedFiles.filter(f => !f.startsWith(".gsd/") && !f.startsWith(".gsd\\"));
-        return implFiles.length > 0 ? "present" : "absent";
+        const changedFiles = branchDiff.files;
+        // No branch-diff files can mean the unit retried on main after milestone
+        // commits already landed there. In that topology, inspect GSD-tagged
+        // milestone commits instead of treating the self-diff as proof of no work.
+        if (changedFiles.length === 0) {
+            if (milestoneId && currentBranch === integrationBranch) {
+                const tagged = getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId);
+                if (!tagged.ok)
+                    return "unknown";
+                if (tagged.matched)
+                    return classifyImplementationFiles(tagged.files);
+            }
+            if (currentBranch && currentBranch !== "HEAD")
+                return "absent";
+            return "unknown";
+        }
+        return classifyImplementationFiles(changedFiles);
     }
     catch (e) {
         // Non-fatal — if git operations fail, return unknown so callers can decide
@@ -68,6 +86,26 @@ export function hasImplementationArtifacts(basePath) {
         return "unknown";
     }
 }
+function getCurrentBranch(basePath) {
+    try {
+        const branch = execFileSync("git", ["rev-parse", "--abbrev-ref", "HEAD"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim();
+        return branch || null;
+    }
+    catch {
+        return null;
+    }
+}
+function classifyImplementationFiles(files) {
+    const implFiles = files.filter(isImplementationPath);
+    return implFiles.length > 0 ? "present" : "absent";
+}
+function isImplementationPath(file) {
+    return !file.startsWith(".gsd/") && !file.startsWith(".gsd\\");
+}
 /**
  * Detect the main/master branch name.
  */
@@ -112,7 +150,7 @@ function getChangedFilesSinceBranch(basePath, targetBranch) {
         const mergeBase = execFileSync("git", ["merge-base", targetBranch, "HEAD"], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
         if (mergeBase) {
             const result = execFileSync("git", ["diff", "--name-only", mergeBase, "HEAD"], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
-            return result ? result.split("\n").filter(Boolean) : [];
+            return { ok: true, files: result ? result.split("\n").filter(Boolean) : [] };
         }
     }
     catch (err) {
@@ -122,12 +160,74 @@ function getChangedFilesSinceBranch(basePath, targetBranch) {
     // Fallback: check last 20 commits
     try {
         const result = execFileSync("git", ["log", "--name-only", "--pretty=format:", "-20", "HEAD"], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
-        return result ? [...new Set(result.split("\n").filter(Boolean))] : [];
+        return { ok: true, files: result ? [...new Set(result.split("\n").filter(Boolean))] : [] };
     }
     catch (e) {
         logWarning("recovery", `git log fallback failed: ${e.message}`);
-        return [];
+        return { ok: false, files: [] };
+    }
+}
+function getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId) {
+    try {
+        const logOutput = execFileSync("git", ["log", "--format=%H%x1f%B%x1e", "HEAD", "--", `.gsd/milestones/${milestoneId}`], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+        const records = logOutput
+            .split("\x1e")
+            .map((record) => record.trim())
+            .filter(Boolean)
+            .flatMap((record) => {
+            const sep = record.indexOf("\x1f");
+            if (sep === -1)
+                return [];
+            const hash = record.slice(0, sep).trim();
+            const message = record.slice(sep + 1);
+            return [{ hash, message }];
+        });
+        const files = new Set();
+        let matched = false;
+        for (const { hash, message } of records) {
+            if (!commitMessageHasGsdTrailer(message))
+                continue;
+            const commitFiles = getChangedFilesForCommit(basePath, hash);
+            if (!commitMatchesMilestone(message, milestoneId, commitFiles))
+                continue;
+            matched = true;
+            for (const file of commitFiles) {
+                files.add(file);
+            }
+        }
+        return { ok: true, matched, files: [...files] };
+    }
+    catch (e) {
+        logWarning("recovery", `milestone-tagged commit scan failed: ${e.message}`);
+        return { ok: false, matched: false, files: [] };
+    }
+}
+function getChangedFilesForCommit(basePath, hash) {
+    const fileOutput = execFileSync("git", ["diff-tree", "--root", "--no-commit-id", "-r", "--name-only", hash], { cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" }).trim();
+    return fileOutput.split("\n").map((f) => f.trim()).filter(Boolean);
+}
+function commitMessageHasGsdTrailer(message) {
+    return /^GSD-(?:Task|Unit):\s*\S+/m.test(message);
+}
+function commitMatchesMilestone(message, milestoneId, files) {
+    if (commitTrailerStartsWithMilestone(message, milestoneId))
+        return true;
+    // Meaningful execute-task commits currently store task scope as Sxx/Tyy
+    // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone only
+    // when the commit also touched this milestone's artifacts.
+    if (/^GSD-Task:\s*S[^/\s]+\/T\S+/m.test(message)) {
+        return files.some((file) => isMilestoneArtifactPath(file, milestoneId));
     }
+    return false;
+}
+function commitTrailerStartsWithMilestone(message, milestoneId) {
+    const escapedMilestone = milestoneId.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+    const trailerPattern = new RegExp(`^GSD-(?:Task|Unit):\\s*${escapedMilestone}(?:$|[\\s/])`, "m");
+    return trailerPattern.test(message);
+}
+function isMilestoneArtifactPath(file, milestoneId) {
+    return file.startsWith(`.gsd/milestones/${milestoneId}/`)
+        || file.startsWith(`.gsd\\milestones\\${milestoneId}\\`);
 }
 /**
  * Check whether the expected artifact(s) for a unit exist on disk.
@@ -433,7 +533,18 @@ export function verifyExpectedArtifact(unitType, unitId, base) {
     // A milestone with only .gsd/ plan files and zero implementation code is
     // not genuinely complete — the LLM wrote plan files but skipped actual work.
     if (unitType === "complete-milestone") {
-        if (hasImplementationArtifacts(base) === "absent")
+        const summaryOutcome = classifyMilestoneSummaryContent(readFileSync(absPath, "utf-8"));
+        if (summaryOutcome === "failure")
+            return false;
+        const { milestone: mid } = parseUnitId(unitId);
+        if (mid && isDbAvailable()) {
+            const dbMilestone = getMilestone(mid);
+            if (!dbMilestone)
+                return false;
+            if (!isClosedStatus(dbMilestone.status) && summaryOutcome !== "success")
+                return false;
+        }
+        if (hasImplementationArtifacts(base, mid) === "absent")
             return false;
     }
     return true;
@@ -563,6 +674,72 @@ function abortAndResetMerge(basePath, hasMergeHead, squashMsgPath) {
         logError("recovery", `git reset failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/**
+ * Detect and abort other in-progress git operations left behind by a SIGKILL'd
+ * worker (rebase, cherry-pick, revert). Without this, a killed worker mid-rebase
+ * leaves `.git/rebase-merge/` or `.git/CHERRY_PICK_HEAD` and the worktree is
+ * wedged until the user manually runs the matching `--abort`.
+ *
+ * Called before merge-state reconciliation because these states block any
+ * subsequent merge/commit operation. (Issue #4980 HIGH-7)
+ */
+function reconcileOtherInProgressGitOps(basePath, ctx) {
+    const gitDir = join(basePath, ".git");
+    const states = [
+        {
+            label: "rebase",
+            indicators: [join(gitDir, "rebase-merge"), join(gitDir, "rebase-apply")],
+            abort: () => nativeRebaseAbort(basePath),
+        },
+        {
+            label: "cherry-pick",
+            indicators: [join(gitDir, "CHERRY_PICK_HEAD")],
+            abort: () => {
+                // No native helper; fall back to git CLI.
+                try {
+                    execFileSync("git", ["cherry-pick", "--abort"], {
+                        cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+                    });
+                }
+                catch (err) {
+                    logWarning("recovery", `cherry-pick --abort failed: ${getErrorMessage(err)}`);
+                }
+            },
+        },
+        {
+            label: "revert",
+            indicators: [join(gitDir, "REVERT_HEAD")],
+            abort: () => {
+                try {
+                    execFileSync("git", ["revert", "--abort"], {
+                        cwd: basePath, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8",
+                    });
+                }
+                catch (err) {
+                    logWarning("recovery", `revert --abort failed: ${getErrorMessage(err)}`);
+                }
+            },
+        },
+    ];
+    let reconciled = false;
+    for (const s of states) {
+        const present = s.indicators.some((p) => existsSync(p));
+        if (!present)
+            continue;
+        try {
+            s.abort();
+            ctx.ui.notify(`Detected leftover ${s.label} state from prior session — aborted.`, "warning");
+            reconciled = true;
+        }
+        catch (err) {
+            logError("recovery", `${s.label} abort failed: ${getErrorMessage(err)}`);
+            ctx.ui.notify(`Detected leftover ${s.label} state but auto-abort failed. ` +
+                `Run \`git ${s.label} --abort\` manually before retrying.`, "error");
+            return "blocked";
+        }
+    }
+    return reconciled ? "reconciled" : "clean";
+}
 /**
  * Detect leftover merge state from a prior session and reconcile it.
  * If MERGE_HEAD or SQUASH_MSG exists, check whether conflicts are resolved.
@@ -570,12 +747,21 @@ function abortAndResetMerge(basePath, hasMergeHead, squashMsgPath) {
  * If code conflicts remain: fail safe without modifying the worktree.
  */
 export function reconcileMergeState(basePath, ctx) {
+    // First, abort any rebase/cherry-pick/revert left over from a SIGKILL'd
+    // worker. Doing this before the merge-state check unblocks any merge that
+    // would otherwise refuse with "you have unfinished operation". (HIGH-7)
+    const otherOpsResult = reconcileOtherInProgressGitOps(basePath, ctx);
+    if (otherOpsResult === "blocked")
+        return "blocked";
     const mergeHeadPath = join(basePath, ".git", "MERGE_HEAD");
     const squashMsgPath = join(basePath, ".git", "SQUASH_MSG");
     const hasMergeHead = existsSync(mergeHeadPath);
     const hasSquashMsg = existsSync(squashMsgPath);
-    if (!hasMergeHead && !hasSquashMsg)
-        return "clean";
+    if (!hasMergeHead && !hasSquashMsg) {
+        // If we cleaned up another op type, return "reconciled" so the caller
+        // re-derives state from a known-good baseline.
+        return otherOpsResult === "reconciled" ? "reconciled" : "clean";
+    }
     const conflictedFiles = nativeConflictFiles(basePath);
     if (conflictedFiles.length === 0) {
         // All conflicts resolved — finalize the merge/squash commit

package/dist/resources/extensions/gsd/auto-start.js

@@ -19,21 +19,24 @@ import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
-import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, } from "./native-git-bridge.js";
+import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
 import { getAutoWorktreePath } from "./auto-worktree.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
+import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
 import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
+import { isClosedStatus } from "./status-guards.js";
+import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
-import { existsSync, mkdirSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, unlinkSync, } from "node:fs";
 import { join } from "node:path";
 import { sep as pathSep } from "node:path";
 import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
@@ -61,25 +64,15 @@ export async function openProjectDbIfPresent(basePath) {
         logWarning("engine", `gsd-db: failed to open existing database: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
-/**
- * Audit for orphaned milestone branches at bootstrap.
- *
- * After a milestone completes, the teardown step (merge branch → main,
- * delete branch, remove worktree) runs as a post-completion engine step.
- * If the session ends between completion and teardown, the branch and
- * worktree are orphaned — the DB says "complete" so auto-mode won't
- * re-enter the milestone, and the teardown is never retried.
- *
- * This audit runs on every fresh bootstrap to catch that gap:
- * 1. Lists all local `milestone/*` branches.
- * 2. For each, checks if the milestone's DB status is "complete".
- * 3. If the branch is already merged into main → deletes the branch
- *    and cleans up any orphaned worktree directory (safe, no data loss).
- * 4. If the branch is NOT merged → preserves it and warns the user
- *    so they can merge manually (data safety first).
- *
- * Returns a summary of actions taken for the caller to surface via notify.
- */
+export function decideSurvivorAction(hasSurvivorBranch, phase) {
+    if (!hasSurvivorBranch)
+        return "none";
+    if (phase === "needs-discussion")
+        return "discuss";
+    if (phase === "complete")
+        return "finalize";
+    return "none";
+}
 export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     const recovered = [];
     const warnings = [];
@@ -118,10 +111,58 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     for (const branch of milestoneBranches) {
         const milestoneId = branch.replace(/^milestone\//, "");
         const milestone = getMilestone(milestoneId);
-        // Only audit completed milestones
-        if (!milestone || milestone.status !== "complete")
+        if (!milestone)
             continue;
         const isMerged = mergedBranches.has(branch);
+        // #4762 — in-progress milestone branch with unmerged commits ahead of
+        // main. This is the pre-completion orphan case: auto-mode exited without
+        // completing the milestone (pause, stop, crash, merge error, blocker) and
+        // work is stranded on the branch or in the worktree. Data safety first:
+        // we never delete or touch; we just surface a warning so the user knows
+        // where to look.
+        //
+        // Gate on isClosedStatus so we only warn about genuinely open milestones.
+        // Parked/other closed statuses go through the legacy complete/unmerged
+        // path below where appropriate.
+        if (!isClosedStatus(milestone.status)) {
+            if (isMerged)
+                continue; // nothing to recover
+            let commitsAhead = 0;
+            try {
+                commitsAhead = nativeCommitCountBetween(basePath, mainBranch, branch);
+            }
+            catch {
+                // Rev-walk failure — skip rather than noise
+                continue;
+            }
+            if (commitsAhead === 0)
+                continue;
+            const wtDir = getWorktreeDir(basePath, milestoneId);
+            const wtDirExists = existsSync(wtDir);
+            const wtSuffix = wtDirExists
+                ? ` Worktree directory at .gsd/worktrees/${milestoneId}/ holds the live work.`
+                : "";
+            warnings.push(`Branch ${branch} has ${commitsAhead} commit(s) ahead of ${mainBranch} for in-progress milestone ${milestoneId}.` +
+                wtSuffix +
+                ` Run \`/gsd auto\` to resume, or merge manually if abandoning.`);
+            // #4764 telemetry
+            try {
+                emitWorktreeOrphaned(basePath, milestoneId, {
+                    reason: "in-progress-unmerged",
+                    commitsAhead,
+                    worktreeDirExists: wtDirExists,
+                });
+            }
+            catch (err) {
+                logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            continue;
+        }
+        // Only the "complete" status participates in the merged/unmerged cleanup
+        // paths below — other closed statuses (parked, etc.) are intentionally
+        // left alone.
+        if (milestone.status !== "complete")
+            continue;
         if (isMerged) {
             // Branch is merged — safe to delete branch and clean up worktree dir
             try {
@@ -168,6 +209,16 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
             // Branch is NOT merged — preserve for safety, warn the user
             warnings.push(`Branch ${branch} exists for completed milestone ${milestoneId} but is NOT merged into ${mainBranch}. ` +
                 `This may contain unmerged work. Merge manually or run \`/gsd health --fix\` to resolve.`);
+            // #4764 telemetry
+            try {
+                emitWorktreeOrphaned(basePath, milestoneId, {
+                    reason: "complete-unmerged",
+                    worktreeDirExists: existsSync(getWorktreeDir(basePath, milestoneId)),
+                });
+            }
+            catch (err) {
+                logWarning("engine", `worktree-orphaned telemetry failed for ${milestoneId}: ${err instanceof Error ? err.message : String(err)}`);
+            }
         }
     }
     return { recovered, warnings };
@@ -311,11 +362,32 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // Invalidate caches before initial state derivation
         invalidateAllCaches();
-        // Clean stale runtime unit files for completed milestones (#887)
-        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => !!resolveMilestoneFile(base, mid, "SUMMARY"));
         // Open the project-root DB before deriveState so DB-backed state
         // derivation (queue-order, task status) works on a cold start (#2841).
+        // Must happen before cleanStaleRuntimeUnits so the cleanup predicate can
+        // consult DB status and avoid clearing runtime units for milestones that
+        // only have a failure-path SUMMARY on disk (#4663).
         await openProjectDbIfPresent(base);
+        // Clean stale runtime unit files for completed milestones (#887).
+        // DB-authoritative: when DB is available, require DB status to be closed
+        // before clearing runtime units. A SUMMARY file alone is no longer
+        // trusted as proof of completion (#4663). Fall back to SUMMARY-file
+        // presence only when DB is unavailable (legacy/pre-migration).
+        cleanStaleRuntimeUnits(gsdRoot(base), (mid) => {
+            if (isDbAvailable()) {
+                const row = getMilestone(mid);
+                return !!row && isClosedStatus(row.status);
+            }
+            const summaryFile = resolveMilestoneFile(base, mid, "SUMMARY");
+            if (!summaryFile)
+                return false;
+            try {
+                return classifyMilestoneSummaryContent(readFileSync(summaryFile, "utf-8")) !== "failure";
+            }
+            catch {
+                return false;
+            }
+        });
         // ── Orphaned milestone branch audit ──
         // Catches completed milestones whose teardown (merge + branch delete)
         // was lost due to session ending between completion and teardown.
@@ -368,7 +440,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The worktree/branch was created but the milestone only has CONTEXT-DRAFT.md.
         // Route to the interactive discussion handler instead of falling through to
         // auto-mode, which would immediately stop with "needs discussion".
-        if (hasSurvivorBranch && state.phase === "needs-discussion") {
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "discuss") {
             const { showSmartEntry } = await import("./guided-flow.js");
             await showSmartEntry(ctx, pi, base, { step: requestedStepMode });
             invalidateAllCaches();
@@ -388,7 +460,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // The milestone artifacts were written but finalization (merge, worktree
         // cleanup) never ran. Run mergeAndExit to finalize, then re-derive state
         // so the normal "all milestones complete" or "next milestone" path runs.
-        if (hasSurvivorBranch && state.phase === "complete") {
+        // Re-evaluate via the helper — the discuss branch above may have cleared
+        // hasSurvivorBranch after a successful promotion.
+        if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
             ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
             const resolver = buildResolver();
@@ -694,14 +768,32 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         catch (err) {
             ctx.ui.notify(`Secrets collection error: ${err instanceof Error ? err.message : String(err)}. Continuing with next task.`, "warning");
         }
-        // Self-heal: remove stale .git/index.lock
+        // Self-heal: remove stale .git/index.lock.
+        //
+        // Threshold raised from 60s → 5min because a 60s-old lock is not
+        // definitively stale: `git gc --auto` triggered by a heavy commit, NFS
+        // delays, or concurrent worktree writes can hold .git/index.lock for
+        // minutes on large repos. Force-removing a live lock causes the holder
+        // to encounter `fatal: Unable to create '.git/index.lock'` on its next
+        // write, or worse, operate on a partially-written index → corruption
+        // requiring `git fsck`/`git reset` to recover.
+        // (Issue #4980 CRIT-3)
         try {
             const gitLockFile = join(base, ".git", "index.lock");
             if (existsSync(gitLockFile)) {
                 const lockAge = Date.now() - statSync(gitLockFile).mtimeMs;
-                if (lockAge > 60_000) {
+                const STALE_GIT_LOCK_THRESHOLD_MS = 5 * 60_000;
+                if (lockAge > STALE_GIT_LOCK_THRESHOLD_MS) {
                     unlinkSync(gitLockFile);
-                    ctx.ui.notify("Removed stale .git/index.lock from prior crash.", "info");
+                    ctx.ui.notify(`Removed stale .git/index.lock (age ${Math.round(lockAge / 1000)}s, > 5min threshold).`, "warning");
+                }
+                else {
+                    // Lock present but not yet stale — surface so the user knows why
+                    // git ops may be queueing instead of silently waiting.
+                    debugLog("git-lock-present-not-stale", {
+                        ageMs: lockAge,
+                        thresholdMs: STALE_GIT_LOCK_THRESHOLD_MS,
+                    });
                 }
             }
         }

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -6,8 +6,14 @@
 import { readUnitRuntimeRecord, writeUnitRuntimeRecord, formatExecuteTaskRecoveryStatus, inspectExecuteTaskDurability, } from "./unit-runtime.js";
 import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, writeBlockerPlaceholder, } from "./auto-recovery.js";
 import { existsSync } from "node:fs";
-import { resolveAgentEnd } from "./auto-loop.js";
+import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rctx) {
+    // Note on turn epoch: the bump is intentionally NOT unconditional at
+    // function entry. Two branches below (the "steering retry" paths) keep
+    // the same LLM turn alive and let it try again — they must NOT bump,
+    // otherwise the retry's legitimate writes get marked stale and drop.
+    // Each advance branch calls `bumpAndResolveSynthetic` to bump+resolve
+    // atomically. Search for that helper to find all supersede sites.
     const { basePath, verbose, currentUnitStartedAt, unitRecoveryCount } = rctx;
     const runtime = readUnitRuntimeRecord(basePath, unitType, unitId);
     const recoveryAttempts = runtime?.recoveryAttempts ?? 0;
@@ -36,7 +42,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         if (recoveryAttempts < maxRecoveryAttempts) {
@@ -90,7 +96,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
             });
             ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts (${diagnostic}). Blocker artifacts written. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
             unitRecoveryCount.delete(recoveryKey);
-            resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+            bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";
         }
         // Fallback: couldn't write skip artifacts — pause as before.
@@ -115,7 +121,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} artifact already exists on disk. Advancing. (attempt ${attemptNumber})`, "info");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     if (recoveryAttempts < maxRecoveryAttempts) {
@@ -180,7 +186,7 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         });
         ctx.ui.notify(`${unitType} ${unitId} skipped after ${maxRecoveryAttempts} recovery attempts. Blocker placeholder written to ${placeholder}. Advancing pipeline. (attempt ${attemptNumber})`, "warning");
         unitRecoveryCount.delete(recoveryKey);
-        resolveAgentEnd({ messages: [], _synthetic: "timeout-recovery" });
+        bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
         return "recovered";
     }
     // Fallback: couldn't resolve artifact path — pause as before.