gsd-pi 2.78.1-dev.b6a389b66 → 2.78.1-dev.d8826a445

package/src/resources/extensions/gsd/tests/delegation-policy.test.ts

@@ -0,0 +1,151 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  annotateBackgroundable,
+  getDelegationVerdict,
+  getVerdictByUnitType,
+  isBackgroundable,
+  listBackgroundableTools,
+} from "../delegation-policy.js";
+
+// Pin the GOOD set: changes here must come with explicit re-evaluation.
+const EXPECTED_BACKGROUNDABLE = [
+  "gsd_execute",
+  "gsd_plan_slice",
+  "gsd_reassess_roadmap",
+  "gsd_validate_milestone",
+];
+
+test("isBackgroundable returns true for the four GOOD-verdict tools", () => {
+  for (const name of EXPECTED_BACKGROUNDABLE) {
+    assert.equal(isBackgroundable(name), true, `${name} should be backgroundable`);
+  }
+});
+
+test("isBackgroundable returns false for RISKY-verdict tools", () => {
+  for (const name of ["gsd_doctor", "gsd_plan_milestone", "gsd_replan_slice"]) {
+    assert.equal(isBackgroundable(name), false, `${name} should not be backgroundable`);
+  }
+});
+
+test("isBackgroundable returns false for NO-verdict tools", () => {
+  assert.equal(isBackgroundable("gsd_plan_task"), false);
+});
+
+test("isBackgroundable defaults to false for unknown tools (default-deny)", () => {
+  assert.equal(isBackgroundable("gsd_nonexistent_tool"), false);
+  assert.equal(isBackgroundable(""), false);
+});
+
+test("listBackgroundableTools returns exactly the four GOOD tools, sorted", () => {
+  assert.deepEqual(listBackgroundableTools(), EXPECTED_BACKGROUNDABLE);
+});
+
+test("getDelegationVerdict resolves alias names to canonical entries", () => {
+  for (const [alias, canonical] of [
+    ["gsd_milestone_validate", "gsd_validate_milestone"],
+    ["gsd_roadmap_reassess", "gsd_reassess_roadmap"],
+    ["gsd_slice_replan", "gsd_replan_slice"],
+    ["gsd_task_plan", "gsd_plan_task"],
+  ] as const) {
+    const entry = getDelegationVerdict(alias);
+    assert.ok(entry, `alias ${alias} should resolve`);
+    assert.equal(entry.toolName, canonical, `${alias} should resolve to ${canonical}`);
+  }
+});
+
+test("plan_slice carries the slice-lock + await constraints", () => {
+  const entry = getDelegationVerdict("gsd_plan_slice");
+  assert.ok(entry);
+  assert.ok(entry.constraints && entry.constraints.length >= 3);
+  assert.ok(
+    entry.constraints!.some((c) => /lock the slice/i.test(c)),
+    "plan_slice must carry the slice-lock constraint",
+  );
+  assert.ok(
+    entry.constraints!.some((c) => /await background completion/i.test(c)),
+    "plan_slice must require await before downstream reads",
+  );
+});
+
+test("doctor carries fix-mode safety constraints", () => {
+  const entry = getDelegationVerdict("gsd_doctor");
+  assert.ok(entry);
+  assert.equal(entry.verdict, "risky");
+  assert.ok(
+    entry.constraints && entry.constraints.some((c) => /fix=false/.test(c)),
+    "doctor must restrict background runs to fix=false",
+  );
+});
+
+test("getVerdictByUnitType maps dispatcher unit types back to the policy", () => {
+  assert.equal(getVerdictByUnitType("plan-slice")?.toolName, "gsd_plan_slice");
+  assert.equal(getVerdictByUnitType("validate-milestone")?.toolName, "gsd_validate_milestone");
+  assert.equal(getVerdictByUnitType("reassess-roadmap")?.toolName, "gsd_reassess_roadmap");
+  assert.equal(getVerdictByUnitType("plan-milestone")?.toolName, "gsd_plan_milestone");
+  assert.equal(getVerdictByUnitType("replan-slice")?.toolName, "gsd_replan_slice");
+  assert.equal(getVerdictByUnitType("nonexistent-unit"), null);
+});
+
+test("every entry carries a non-empty rationale so the verdict is auditable", () => {
+  for (const name of [...EXPECTED_BACKGROUNDABLE, "gsd_doctor", "gsd_plan_milestone", "gsd_replan_slice", "gsd_plan_task"]) {
+    const entry = getDelegationVerdict(name);
+    assert.ok(entry, `${name} should be in the policy`);
+    assert.ok(entry.rationale.length > 20, `${name} rationale must be substantive`);
+  }
+});
+
+// ─── annotateBackgroundable contract pins ────────────────────────────────
+
+test("annotateBackgroundable recomputes the verdict on every call (no internal cache)", () => {
+  // The annotator mutates in place. Repeated calls on the same object with
+  // different unit types must always reflect the latest unitType — never a
+  // stale cached value. This pins the contract documented in the JSDoc so a
+  // future "optimization" that adds memoization keyed on object identity
+  // breaks the suite instead of silently leaking a stale flag.
+  const action: { action: "dispatch"; unitType: string; backgroundable?: boolean } = {
+    action: "dispatch",
+    unitType: "plan-slice",
+  };
+  annotateBackgroundable(action);
+  assert.equal(action.backgroundable, true, "plan-slice should annotate true");
+
+  action.unitType = "plan-milestone";
+  annotateBackgroundable(action);
+  assert.equal(action.backgroundable, false, "plan-milestone (risky) should re-annotate false");
+
+  action.unitType = "validate-milestone";
+  annotateBackgroundable(action);
+  assert.equal(action.backgroundable, true, "validate-milestone should re-annotate true");
+
+  action.unitType = "complete-slice";
+  annotateBackgroundable(action);
+  assert.equal(action.backgroundable, false, "uncovered unit type should re-annotate false (default-deny)");
+});
+
+test("annotateBackgroundable passes stop/skip actions through unchanged", () => {
+  const stop = { action: "stop" as const, reason: "x", level: "info" as const };
+  const skip = { action: "skip" as const };
+  assert.equal(annotateBackgroundable(stop), stop);
+  assert.equal(annotateBackgroundable(skip), skip);
+  assert.equal((stop as Record<string, unknown>).backgroundable, undefined);
+  assert.equal((skip as Record<string, unknown>).backgroundable, undefined);
+});
+
+// ─── F4 latent gap pin: silent default-deny on unit types invoking GOOD tools ──
+
+test("execute-task / reactive-execute / execute-task-simple intentionally default-deny despite gsd_execute being GOOD", () => {
+  // gsd_execute carries a GOOD verdict but no `unitType`, by design — the
+  // unit-level orchestrations wrap prompt and harness work whose safety is
+  // a separate analysis. Lifting these out of default-deny must be an
+  // explicit, audited change. This test pins the current behavior; if the
+  // policy entry gains a unitType mapping (or a unitTypes array), update
+  // both the entry and this test together.
+  for (const unitType of ["execute-task", "execute-task-simple", "reactive-execute"]) {
+    assert.equal(
+      getVerdictByUnitType(unitType),
+      null,
+      `${unitType} must remain unmapped until per-unit analysis is recorded`,
+    );
+  }
+});

package/src/resources/extensions/gsd/tests/dispatch-backgroundable-annotation.test.ts

@@ -0,0 +1,55 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import {
+  annotateBackgroundable,
+  type AnnotatableDispatchAction,
+} from "../delegation-policy.js";
+
+function dispatchAction(unitType: string): AnnotatableDispatchAction {
+  return {
+    action: "dispatch",
+    unitType,
+    unitId: `M001/${unitType}`,
+    prompt: "(test prompt)",
+  };
+}
+
+test("annotateBackgroundable marks plan-slice as backgroundable", () => {
+  const annotated = annotateBackgroundable(dispatchAction("plan-slice"));
+  assert.equal(annotated.action, "dispatch");
+  if (annotated.action !== "dispatch") return;
+  assert.equal(annotated.backgroundable, true);
+  assert.equal(annotated.unitType, "plan-slice");
+});
+
+test("annotateBackgroundable marks validate-milestone and reassess-roadmap as backgroundable", () => {
+  for (const unitType of ["validate-milestone", "reassess-roadmap"]) {
+    const annotated = annotateBackgroundable(dispatchAction(unitType));
+    assert.equal(annotated.action, "dispatch");
+    if (annotated.action !== "dispatch") continue;
+    assert.equal(annotated.backgroundable, true, `${unitType} should be backgroundable`);
+  }
+});
+
+test("annotateBackgroundable marks plan-milestone and replan-slice as NOT backgroundable", () => {
+  for (const unitType of ["plan-milestone", "replan-slice"]) {
+    const annotated = annotateBackgroundable(dispatchAction(unitType));
+    assert.equal(annotated.action, "dispatch");
+    if (annotated.action !== "dispatch") continue;
+    assert.equal(annotated.backgroundable, false, `${unitType} should not be backgroundable`);
+  }
+});
+
+test("annotateBackgroundable defaults unknown unit types to false (default-deny)", () => {
+  const annotated = annotateBackgroundable(dispatchAction("execute-task"));
+  assert.equal(annotated.action, "dispatch");
+  if (annotated.action !== "dispatch") return;
+  assert.equal(annotated.backgroundable, false);
+});
+
+test("annotateBackgroundable leaves stop and skip actions untouched", () => {
+  const stop: AnnotatableDispatchAction = { action: "stop", reason: "test", level: "info" };
+  const skip: AnnotatableDispatchAction = { action: "skip" };
+  assert.deepEqual(annotateBackgroundable(stop), stop);
+  assert.deepEqual(annotateBackgroundable(skip), skip);
+});

package/src/resources/extensions/gsd/tests/draft-promotion.test.ts

@@ -133,29 +133,9 @@ assert(
   "stale CONTEXT-DRAFT.md should be deleted in both-files case",
 );
 
-// ─── Static: guided-flow.ts has cleanup code ───────────────────────────
-
-console.log("=== Static: cleanup code in guided-flow.ts ===");
-
-const { readFileSync } = await import("node:fs");
-const guidedFlowSource = readFileSync(
-  join(import.meta.dirname, "..", "guided-flow.ts"),
-  "utf-8",
-);
-
-const checkFnIdx = guidedFlowSource.indexOf("checkAutoStartAfterDiscuss");
-const checkFnEnd = guidedFlowSource.indexOf("\nexport ", checkFnIdx + 1);
-const checkFnChunk = guidedFlowSource.slice(checkFnIdx, checkFnEnd > checkFnIdx ? checkFnEnd : checkFnIdx + 5000);
-
-assert(
-  checkFnChunk.includes("CONTEXT-DRAFT"),
-  "checkAutoStartAfterDiscuss should reference CONTEXT-DRAFT for cleanup",
-);
-
-assert(
-  checkFnChunk.includes("unlinkSync"),
-  "checkAutoStartAfterDiscuss should use unlinkSync to delete the draft",
-);
+// Note: source-grep assertions removed per CONTRIBUTING.md (no asserting against
+// readFileSync of source). The behavioral scenarios above already exercise the
+// CONTEXT-DRAFT cleanup path end-to-end via the actual filesystem state.
 
 // ─── Cleanup ──────────────────────────────────────────────────────────
 

package/src/resources/extensions/gsd/tests/gate-1b-orphan-discrimination.test.ts

@@ -0,0 +1,193 @@
+/**
+ * GSD-2 / guided-flow — regression tests for Gate 1b orphan discrimination
+ *
+ * Gate 1b in checkAutoStartAfterDiscuss discriminates between two "queued" states:
+ *   (a) plan-blocked: discuss completed (CONTEXT.md on disk), but gsd_plan_milestone
+ *       was hard-blocked by the depth-verification gate.  DB row stuck at "queued".
+ *       → emit recovery hint directing the LLM to retry gsd_plan_milestone.
+ *   (b) discuss-incomplete: discuss did not finish, no CONTEXT.md, DB row "queued".
+ *       → silent block (no recovery hint).
+ */
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  checkAutoStartAfterDiscuss,
+  setPendingAutoStart,
+  clearPendingAutoStart,
+} from "../guided-flow.ts";
+import { drainLogs } from "../workflow-logger.ts";
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+} from "../gsd-db.ts";
+
+// ─── Harness ───────────────────────────────────────────────────────────────
+
+interface MockCapture {
+  notifies: Array<{ msg: string; level: string }>;
+  messages: Array<{ payload: any; options: any }>;
+}
+
+function mkCapture(): MockCapture {
+  return { notifies: [], messages: [] };
+}
+
+function mkCtx(cap: MockCapture): any {
+  return {
+    ui: {
+      notify: (msg: string, level: string) => {
+        cap.notifies.push({ msg, level });
+      },
+    },
+  };
+}
+
+function mkPi(cap: MockCapture): any {
+  return {
+    sendMessage: (payload: any, options: any) => {
+      cap.messages.push({ payload, options });
+    },
+    setActiveTools: () => undefined,
+    getActiveTools: () => [],
+  };
+}
+
+/**
+ * Create a minimal temp tree with a .gsd/milestones/M001 directory.
+ */
+function mkBase(): string {
+  const base = mkdtempSync(join(tmpdir(), "gsd-gate1b-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  return base;
+}
+
+// ─── Tests ─────────────────────────────────────────────────────────────────
+
+describe("Gate 1b orphan discrimination in checkAutoStartAfterDiscuss", () => {
+  let base: string;
+  let cap: MockCapture;
+
+  beforeEach(() => {
+    clearPendingAutoStart();
+    drainLogs(); // discard noise from prior tests
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    clearPendingAutoStart();
+    if (base) {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  test("plan-blocked: CONTEXT.md present + DB row queued → returns false + recovery hint emitted", () => {
+    base = mkBase();
+    openDatabase(":memory:");
+
+    // DB row exists with status "queued" (plan_milestone was blocked)
+    insertMilestone({ id: "M001", title: "Test Milestone", status: "queued" });
+
+    // CONTEXT.md on disk (discuss phase completed)
+    writeFileSync(
+      join(base, ".gsd", "milestones", "M001", "M001-CONTEXT.md"),
+      "# M001: Test Milestone\n\nContext written by discuss phase.\n",
+    );
+
+    cap = mkCapture();
+    setPendingAutoStart(base, {
+      basePath: base,
+      milestoneId: "M001",
+      ctx: mkCtx(cap),
+      pi: mkPi(cap),
+    });
+
+    const result = checkAutoStartAfterDiscuss();
+
+    // Must return false — auto-start should not proceed
+    assert.equal(result, false, "checkAutoStartAfterDiscuss must return false (plan still blocked)");
+
+    // Recovery hint must be sent to the LLM
+    assert.equal(
+      cap.messages.length,
+      1,
+      "exactly one sendMessage call expected for the recovery hint",
+    );
+    assert.equal(
+      cap.messages[0].payload.customType,
+      "gsd-plan-milestone-blocked-recovery",
+      "recovery message must have customType gsd-plan-milestone-blocked-recovery",
+    );
+    assert.equal(
+      cap.messages[0].options.triggerTurn,
+      true,
+      "recovery message must set triggerTurn: true",
+    );
+    assert.match(
+      cap.messages[0].payload.content,
+      /gsd_plan_milestone/,
+      "recovery message content must mention gsd_plan_milestone",
+    );
+
+    // User must be notified via ctx.ui.notify
+    assert.ok(
+      cap.notifies.some((n) => n.level === "warning" && /queued/.test(n.msg)),
+      "user must be notified with a warning about the queued state",
+    );
+
+    // logWarning must have recorded the Gate 1b event
+    const logs = drainLogs();
+    const gate1bLog = logs.find(
+      (e) => e.component === "guided" && /Gate 1b/.test(e.message),
+    );
+    assert.ok(gate1bLog, "Gate 1b warning must be logged via logWarning");
+  });
+
+  test("discuss-incomplete: no CONTEXT.md + DB row queued → returns false silently (no recovery hint)", () => {
+    base = mkBase();
+    openDatabase(":memory:");
+
+    // DB row exists with status "queued", but NO CONTEXT.md on disk
+    insertMilestone({ id: "M001", title: "Test Milestone", status: "queued" });
+
+    // No CONTEXT.md written — discuss phase is incomplete
+    cap = mkCapture();
+    setPendingAutoStart(base, {
+      basePath: base,
+      milestoneId: "M001",
+      ctx: mkCtx(cap),
+      pi: mkPi(cap),
+    });
+
+    drainLogs(); // clear any noise before the call
+
+    const result = checkAutoStartAfterDiscuss();
+
+    // Must return false — silent block
+    assert.equal(result, false, "checkAutoStartAfterDiscuss must return false when discuss is incomplete");
+
+    // No recovery hint — Gate 1 blocks before Gate 1b is reached
+    assert.equal(
+      cap.messages.length,
+      0,
+      "no sendMessage calls expected when CONTEXT.md is absent",
+    );
+    assert.equal(
+      cap.notifies.length,
+      0,
+      "no user notifications expected for discuss-incomplete case",
+    );
+
+    // No Gate 1b log entry
+    const logs = drainLogs();
+    const gate1bLog = logs.find(
+      (e) => e.component === "guided" && /Gate 1b/.test(e.message),
+    );
+    assert.equal(gate1bLog, undefined, "Gate 1b must not log when CONTEXT.md is absent");
+  });
+});

package/src/resources/extensions/gsd/tests/gate-1b-recovery-bound-corrections.test.ts

@@ -0,0 +1,246 @@
+// GSD-2 + Gate 1b recovery bound corrections — regression tests for the two bugs
+// found in peer review of the H1 fix (commit f0e1d42a2):
+//   1. Escalation message must describe /gsd (counter reset) AND /gsd-debug (diagnose).
+//   2. planBlockedRecoveryCount must NOT increment when pi.sendMessage throws.
+
+import { describe, test, beforeEach, afterEach } from "node:test";
+import assert from "node:assert/strict";
+import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+
+import {
+  checkAutoStartAfterDiscuss,
+  setPendingAutoStart,
+  clearPendingAutoStart,
+  _getPendingAutoStart,
+} from "../guided-flow.ts";
+import { drainLogs } from "../workflow-logger.ts";
+import {
+  openDatabase,
+  closeDatabase,
+  insertMilestone,
+} from "../gsd-db.ts";
+
+// ─── Harness ───────────────────────────────────────────────────────────────
+
+interface MockCapture {
+  notifies: Array<{ msg: string; level: string }>;
+  messages: Array<{ payload: any; options: any }>;
+}
+
+function mkCapture(): MockCapture {
+  return { notifies: [], messages: [] };
+}
+
+function mkCtx(cap: MockCapture): any {
+  return {
+    ui: {
+      notify: (msg: string, level: string) => {
+        cap.notifies.push({ msg, level });
+      },
+    },
+  };
+}
+
+/** Returns a pi stub whose sendMessage throws on the first call, succeeds after. */
+function mkPiThrowOnce(cap: MockCapture): any {
+  let callCount = 0;
+  return {
+    sendMessage: (payload: any, options: any) => {
+      callCount += 1;
+      if (callCount === 1) {
+        throw new Error("transient network error");
+      }
+      cap.messages.push({ payload, options });
+    },
+    setActiveTools: () => undefined,
+    getActiveTools: () => [],
+  };
+}
+
+function mkPi(cap: MockCapture): any {
+  return {
+    sendMessage: (payload: any, options: any) => {
+      cap.messages.push({ payload, options });
+    },
+    setActiveTools: () => undefined,
+    getActiveTools: () => [],
+  };
+}
+
+function mkBase(): string {
+  const base = mkdtempSync(join(tmpdir(), "gsd-gate1b-corrections-"));
+  mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+  writeFileSync(
+    join(base, ".gsd", "milestones", "M001", "M001-CONTEXT.md"),
+    "# M001: Corrections Test\n\nContext written by discuss phase.\n",
+  );
+  return base;
+}
+
+// ─── Tests ─────────────────────────────────────────────────────────────────
+
+describe("Gate 1b recovery bound corrections", () => {
+  let base: string;
+  let cap: MockCapture;
+
+  beforeEach(() => {
+    clearPendingAutoStart();
+    drainLogs();
+  });
+
+  afterEach(() => {
+    closeDatabase();
+    clearPendingAutoStart();
+    if (base) {
+      rmSync(base, { recursive: true, force: true });
+    }
+  });
+
+  // ── Fix 1: escalation message ──────────────────────────────────────────
+
+  test("escalation message describes /gsd for reset AND /gsd-debug for diagnosis", () => {
+    base = mkBase();
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Corrections Test", status: "queued" });
+
+    cap = mkCapture();
+    setPendingAutoStart(base, {
+      basePath: base,
+      milestoneId: "M001",
+      ctx: mkCtx(cap),
+      pi: mkPi(cap),
+    });
+
+    // Exhaust the recovery budget (MAX = 3)
+    checkAutoStartAfterDiscuss(); // count → 1
+    checkAutoStartAfterDiscuss(); // count → 2
+    checkAutoStartAfterDiscuss(); // count → 3
+
+    cap.notifies = [];
+    drainLogs();
+
+    // This call hits the cap and must escalate
+    const result = checkAutoStartAfterDiscuss();
+    assert.equal(result, false, "escalation call must return false");
+
+    const errorNotify = cap.notifies.find((n) => n.level === "error");
+    assert.ok(errorNotify, "escalation must emit a notify with level 'error'");
+
+    // Must mention /gsd with reset semantics
+    assert.match(
+      errorNotify.msg,
+      /\/gsd\b/,
+      "escalation message must reference /gsd (the command that resets the counter)",
+    );
+    assert.match(
+      errorNotify.msg,
+      /reset/i,
+      "escalation message must use the word 'reset' so users know /gsd resets the counter",
+    );
+
+    // Must also mention /gsd-debug
+    assert.match(
+      errorNotify.msg,
+      /\/gsd-debug/i,
+      "escalation message must also reference /gsd-debug for diagnosis",
+    );
+
+    // Must NOT suggest /gsd-debug alone as the sole remediation
+    assert.doesNotMatch(
+      errorNotify.msg,
+      /^[^/]*\/gsd-debug[^/]*$/,
+      "escalation message must not mention /gsd-debug as the only option",
+    );
+  });
+
+  // ── Fix 2: counter ordering ────────────────────────────────────────────
+
+  test("counter stays at 0 when sendMessage throws on the first call", () => {
+    base = mkBase();
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Corrections Test", status: "queued" });
+
+    cap = mkCapture();
+    setPendingAutoStart(base, {
+      basePath: base,
+      milestoneId: "M001",
+      ctx: mkCtx(cap),
+      pi: mkPiThrowOnce(cap),
+    });
+
+    // First call: sendMessage throws — counter must NOT increment
+    const result = checkAutoStartAfterDiscuss();
+    assert.equal(result, false, "must return false even when sendMessage throws");
+
+    const entry = _getPendingAutoStart(base);
+    assert.ok(entry, "entry must still exist after a failed sendMessage");
+    assert.equal(
+      entry.planBlockedRecoveryCount,
+      0,
+      "counter must remain 0 when sendMessage throws — no budget burned by transient failure",
+    );
+  });
+
+  test("counter increments to 1 on the second call when first sendMessage threw", () => {
+    base = mkBase();
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Corrections Test", status: "queued" });
+
+    cap = mkCapture();
+    setPendingAutoStart(base, {
+      basePath: base,
+      milestoneId: "M001",
+      ctx: mkCtx(cap),
+      pi: mkPiThrowOnce(cap),
+    });
+
+    checkAutoStartAfterDiscuss(); // sendMessage throws → count stays 0
+
+    const entryAfterThrow = _getPendingAutoStart(base);
+    assert.equal(entryAfterThrow!.planBlockedRecoveryCount, 0, "count is 0 after throw");
+
+    checkAutoStartAfterDiscuss(); // sendMessage succeeds → count becomes 1
+    assert.equal(cap.messages.length, 1, "second call must produce one successful sendMessage");
+
+    const entryAfterSuccess = _getPendingAutoStart(base);
+    assert.equal(
+      entryAfterSuccess!.planBlockedRecoveryCount,
+      1,
+      "counter must be 1 after first successful dispatch",
+    );
+  });
+
+  test("3 successful sendMessage calls exhaust the budget; 4th emits escalation notify", () => {
+    base = mkBase();
+    openDatabase(":memory:");
+    insertMilestone({ id: "M001", title: "Corrections Test", status: "queued" });
+
+    cap = mkCapture();
+    setPendingAutoStart(base, {
+      basePath: base,
+      milestoneId: "M001",
+      ctx: mkCtx(cap),
+      pi: mkPi(cap),
+    });
+
+    // Three successful recoveries
+    checkAutoStartAfterDiscuss(); // count → 1
+    checkAutoStartAfterDiscuss(); // count → 2
+    checkAutoStartAfterDiscuss(); // count → 3
+
+    const entry = _getPendingAutoStart(base);
+    assert.equal(entry!.planBlockedRecoveryCount, 3, "counter must be 3 after three successes");
+    assert.equal(cap.messages.length, 3, "three sendMessage calls must have occurred");
+
+    // Fourth call hits the cap
+    cap.notifies = [];
+    cap.messages = [];
+    const resultAtCap = checkAutoStartAfterDiscuss();
+    assert.equal(resultAtCap, false, "4th call must return false");
+    assert.equal(cap.messages.length, 0, "4th call must NOT call sendMessage");
+    const errorNotify = cap.notifies.find((n) => n.level === "error");
+    assert.ok(errorNotify, "4th call must emit escalation notify with level 'error'");
+  });
+});