gsd-pi 2.79.0-dev.5c910bb05 → 2.79.0-dev.9941c9c24

package/dist/resources/extensions/gsd/auto.js

@@ -31,7 +31,7 @@ import { selectAndApplyModel, resolveModelId, clearToolBaseline } from "./auto-m
 import { resetRoutingHistory, recordOutcome } from "./routing-history.js";
 import { resetHookState, runPreDispatchHooks, restoreHookState, clearPersistedHookState, } from "./post-unit-hooks.js";
 import { runGSDDoctor, rebuildState } from "./doctor.js";
-import { preDispatchHealthGate, resetProactiveHealing, setLevelChangeCallback, } from "./doctor-proactive.js";
+import { preDispatchHealthGate, recordHealthSnapshot, resetProactiveHealing, setLevelChangeCallback, } from "./doctor-proactive.js";
 import { clearSkillSnapshot } from "./skill-discovery.js";
 import { captureAvailableSkills, resetSkillTelemetry, } from "./skill-telemetry.js";
 import { getRtkSessionSavings } from "../shared/rtk-session-stats.js";
@@ -43,7 +43,7 @@ import { isAbsolute, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { readFileSync, existsSync, mkdirSync } from "node:fs";
 import { atomicWriteSync } from "./atomic-write.js";
-import { autoCommitCurrentBranch, captureIntegrationBranch, detectWorktreeName, getCurrentBranch, getMainBranch, setActiveMilestoneId, } from "./worktree.js";
+import { autoCommitCurrentBranch, captureIntegrationBranch, detectWorktreeName, getCurrentBranch, getMainBranch, setActiveMilestoneId, resolveProjectRoot, } from "./worktree.js";
 import { GitServiceImpl } from "./git-service.js";
 import { getPriorSliceCompletionBlocker } from "./dispatch-guard.js";
 import { createAutoWorktree, enterAutoWorktree, enterBranchModeForMilestone, teardownAutoWorktree, isInAutoWorktree, getAutoWorktreePath, mergeMilestoneToMain, autoWorktreeBranch, syncWorktreeStateBack, syncProjectRootToWorktree, checkResourcesStale, escapeStaleWorktree, } from "./auto-worktree.js";
@@ -82,6 +82,7 @@ import { resolveAgentEnd, resolveAgentEndCancelled, _resetPendingResolve, isSess
 import { runAutoLoopWithUok } from "./uok/kernel.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { validateDirectory } from "./validate-directory.js";
+import { createAutoOrchestrator } from "./auto/orchestrator.js";
 import { WorktreeResolver, } from "./worktree-resolver.js";
 import { reorderForCaching } from "./prompt-ordering.js";
 export { STUB_RECOVERY_THRESHOLD, NEW_SESSION_TIMEOUT_MS, } from "./auto/session.js";
@@ -904,6 +905,12 @@ export async function stopAuto(ctx, pi, reason) {
         // changes the user made between sessions (#4959 / CodeRabbit).
         if (pi)
             clearToolBaseline(pi);
+        try {
+            await s.orchestration?.stop(reason ?? "stop");
+        }
+        catch (err) {
+            debugLog("stop-orchestration-stop", { error: err instanceof Error ? err.message : String(err) });
+        }
         // Reset all session state in one call
         s.reset();
     }
@@ -953,6 +960,7 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
             activeRunDir: s.activeRunDir,
             autoStartTime: s.autoStartTime,
             milestoneLock: s.sessionMilestoneLock ?? undefined,
+            pauseReason: _errorContext?.message,
         };
         setRuntimeKv("global", "", PAUSED_SESSION_KV_KEY, pausedMeta);
     }
@@ -992,6 +1000,12 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     // Unblock pending unitPromise so autoLoop exits cleanly (#1799)
     resolveAgentEnd({ messages: [] });
     _resetPendingResolve();
+    try {
+        await s.orchestration?.stop("pause");
+    }
+    catch (err) {
+        debugLog("pause-orchestration-stop", { error: err instanceof Error ? err.message : String(err) });
+    }
     s.active = false;
     s.paused = true;
     deactivateGSD();
@@ -1041,6 +1055,132 @@ function buildResolverDeps() {
 function buildResolver() {
     return new WorktreeResolver(s, buildResolverDeps());
 }
+/**
+ * Thin entry glue for the new Auto Orchestration module.
+ *
+ * This intentionally wires only dispatch + error notification today, with
+ * no behavior changes to the existing auto loop. It provides a concrete seam
+ * the next refactor steps can adopt incrementally.
+ */
+export function createWiredAutoOrchestrationModule(ctx, _pi, dispatchBasePath, runtimeBasePath = resolveProjectRoot(dispatchBasePath)) {
+    const flowId = `auto-orchestrator-${Date.now()}`;
+    let seq = 0;
+    const deps = {
+        dispatch: {
+            async decideNextUnit() {
+                const state = await deriveState(dispatchBasePath);
+                const active = state.activeMilestone;
+                if (!active)
+                    return null;
+                const prefs = loadEffectiveGSDPreferences(dispatchBasePath)?.preferences;
+                const action = await resolveDispatch({
+                    basePath: dispatchBasePath,
+                    mid: active.id,
+                    midTitle: active.title,
+                    state,
+                    prefs,
+                });
+                if (action.action !== "dispatch")
+                    return null;
+                return {
+                    unitType: action.unitType,
+                    unitId: action.unitId,
+                    reason: action.matchedRule ?? "dispatch",
+                    preconditions: [],
+                };
+            },
+        },
+        recovery: {
+            async classifyAndRecover(input) {
+                const reason = input.error instanceof Error ? input.error.message : String(input.error ?? "unknown auto error");
+                return { action: "escalate", reason };
+            },
+        },
+        worktree: {
+            async prepareForUnit() { },
+            async syncAfterUnit() { },
+            async cleanupOnStop() { },
+        },
+        health: {
+            async preAdvanceGate() {
+                const gate = await preDispatchHealthGate(dispatchBasePath);
+                return {
+                    allow: gate.proceed,
+                    reason: gate.reason,
+                };
+            },
+            async postAdvanceRecord(result) {
+                if (result.kind === "error") {
+                    recordHealthSnapshot(1, 0, 0, [{
+                            code: "orchestration-error",
+                            message: result.reason ?? "orchestration error",
+                            severity: "error",
+                            unitId: "orchestration",
+                        }], [], "orchestration");
+                }
+                else if (result.kind === "blocked") {
+                    recordHealthSnapshot(0, 1, 0, [{
+                            code: "orchestration-blocked",
+                            message: result.reason ?? "orchestration blocked",
+                            severity: "warning",
+                            unitId: "orchestration",
+                        }], [], "orchestration");
+                }
+            },
+        },
+        runtime: {
+            async ensureLockOwnership() {
+                const status = getSessionLockStatus(runtimeBasePath);
+                if (!status.valid || status.failureReason === "pid-mismatch") {
+                    throw new Error("session lock held by another process");
+                }
+            },
+            async journalTransition(event) {
+                const eventType = event.name === "start"
+                    ? "iteration-start"
+                    : event.name === "resume"
+                        ? "iteration-start"
+                        : event.name === "advance"
+                            ? "dispatch-match"
+                            : event.name === "advance-blocked"
+                                ? "guard-block"
+                                : event.name === "advance-stopped"
+                                    ? "dispatch-stop"
+                                    : event.name === "advance-error"
+                                        ? "iteration-end"
+                                        : event.name === "advance-paused" || event.name === "advance-retry"
+                                            ? "guard-block"
+                                            : event.name === "stop"
+                                                ? "terminal"
+                                                : "iteration-end";
+                _emitJournalEvent(runtimeBasePath, {
+                    ts: new Date().toISOString(),
+                    flowId,
+                    seq: ++seq,
+                    eventType,
+                    data: {
+                        source: "auto-orchestrator",
+                        name: event.name,
+                        reason: event.reason,
+                        unitType: event.unitType,
+                        unitId: event.unitId,
+                    },
+                });
+            },
+        },
+        notifications: {
+            async notifyLifecycle(event) {
+                if (event.name === "error") {
+                    ctx.ui.notify(event.detail ?? "auto orchestration error", "error");
+                }
+            },
+        },
+    };
+    return createAutoOrchestrator(deps);
+}
+function ensureOrchestrationModule(ctx, pi, basePath) {
+    s.orchestration = createWiredAutoOrchestrationModule(ctx, pi, basePath, lockBase());
+}
 /**
  * Build the LoopDeps object from auto.ts private scope.
  * This bundles all private functions that autoLoop needs without exporting them.
@@ -1398,6 +1538,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             // s.basePath may have been updated to a worktree path by enterMilestone.
             rebuildScope(s.basePath, s.currentMilestoneId);
         }
+        ensureOrchestrationModule(ctx, pi, s.basePath || base);
         registerSigtermHandler(lockBase());
         ctx.ui.setStatus("gsd-auto", s.stepMode ? "next" : "auto");
         ctx.ui.setWidget("gsd-health", undefined);
@@ -1457,6 +1598,12 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             clearPausedSession("paused-session DB cleanup failed (resume activation)");
         }
         pi.events.emit(CMUX_CHANNELS.LOG, { preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, message: s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", level: "progress" });
+        try {
+            await s.orchestration?.resume();
+        }
+        catch (err) {
+            debugLog("resume-orchestration-resume", { error: err instanceof Error ? err.message : String(err) });
+        }
         startAutoCommandPolling(s.basePath);
         await runAutoLoopWithUok({
             ctx,
@@ -1482,6 +1629,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     // Build scope after bootstrap has populated s.basePath / s.originalBasePath /
     // s.currentMilestoneId (including worktree setup inside bootstrapAutoSession).
     rebuildScope(s.basePath, s.currentMilestoneId);
+    ensureOrchestrationModule(ctx, pi, s.basePath || base);
     captureProjectRootEnv(s.originalBasePath || s.basePath);
     registerAutoWorkerForSession(s);
     try {
@@ -1492,6 +1640,12 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         logWarning("engine", `cmux sync failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
     }
     pi.events.emit(CMUX_CHANNELS.LOG, { preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, message: requestedStepMode ? "Step-mode started." : "Auto-mode started.", level: "progress" });
+    try {
+        await s.orchestration?.start({ basePath: s.basePath, trigger: "auto-loop" });
+    }
+    catch (err) {
+        debugLog("start-orchestration-start", { error: err instanceof Error ? err.message : String(err) });
+    }
     startAutoCommandPolling(s.basePath);
     // Dispatch the first unit
     await runAutoLoopWithUok({
@@ -1576,6 +1730,9 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         s.pendingQuickTasks = [];
     }
     s.basePath = targetBasePath;
+    if (!s.orchestration) {
+        ensureOrchestrationModule(ctx, pi, s.basePath);
+    }
     const hookUnitType = `hook/${hookName}`;
     const hookStartedAt = Date.now();
     s.currentUnit = {

package/dist/resources/extensions/gsd/bootstrap/agent-end-recovery.js

@@ -39,6 +39,14 @@ function resolveAgentEndBasePath() {
         return undefined;
     }
 }
+export function _buildAbortedPauseContext(lastMsg) {
+    const hasErrorMessage = Object.prototype.hasOwnProperty.call(lastMsg, "errorMessage") && !!lastMsg.errorMessage;
+    return {
+        message: hasErrorMessage ? String(lastMsg.errorMessage) : "Operation aborted",
+        category: "aborted",
+        isTransient: true,
+    };
+}
 async function pauseTransientWithBackoff(cls, pi, ctx, errorDetail, isRateLimit) {
     retryState.consecutiveTransientCount += 1;
     const baseRetryAfterMs = "retryAfterMs" in cls ? cls.retryAfterMs : 15_000;
@@ -134,7 +142,7 @@ export async function handleAgentEnd(pi, event, ctx) {
             }
             return;
         }
-        await pauseAuto(ctx, pi);
+        await pauseAuto(ctx, pi, _buildAbortedPauseContext(lastMsg));
         return;
     }
     if (lastMsg && "stopReason" in lastMsg && lastMsg.stopReason === "error") {

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -166,7 +166,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         const { getEcosystemReadyPromise } = await import("../ecosystem/loader.js");
         await getEcosystemReadyPromise();
         const beforeAgentBasePath = process.cwd();
-        const pendingApprovalGate = getPendingGate();
+        const pendingApprovalGate = getPendingGate(beforeAgentBasePath);
         if (pendingApprovalGate && isExplicitApprovalResponse(event.prompt, pendingApprovalGate)) {
             markApprovalGateVerified(pendingApprovalGate, beforeAgentBasePath);
             const milestoneId = extractDepthVerificationMilestoneId(pendingApprovalGate);
@@ -363,15 +363,15 @@ export function registerHooks(pi, ecosystemHandlers) {
         // ── Discussion gate enforcement: block tool calls while gate is pending ──
         // If ask_user_questions was called with a gate ID but hasn't been confirmed,
         // block all non-read-only tool calls to prevent the model from skipping gates.
-        if (getPendingGate()) {
+        if (getPendingGate(discussionBasePath)) {
             const milestoneId = await getDiscussionMilestoneIdFor(discussionBasePath);
             if (isToolCallEventType("bash", event)) {
-                const bashGuard = shouldBlockPendingGateBash(event.input.command, milestoneId, isQueuePhaseActive());
+                const bashGuard = shouldBlockPendingGateBash(event.input.command, milestoneId, isQueuePhaseActive(discussionBasePath), discussionBasePath);
                 if (bashGuard.block)
                     return bashGuard;
             }
             else {
-                const gateGuard = shouldBlockPendingGate(toolName, milestoneId, isQueuePhaseActive());
+                const gateGuard = shouldBlockPendingGate(toolName, milestoneId, isQueuePhaseActive(discussionBasePath), discussionBasePath);
                 if (gateGuard.block)
                     return gateGuard;
             }
@@ -380,7 +380,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         // When /gsd queue is active, the agent should only create milestones,
         // not execute work. Block write/edit to non-.gsd/ paths and bash commands
         // that would modify files.
-        if (isQueuePhaseActive()) {
+        if (isQueuePhaseActive(discussionBasePath)) {
             let queueInput = "";
             if (isToolCallEventType("write", event)) {
                 queueInput = event.input.path;
@@ -445,7 +445,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         }
         if (!isToolCallEventType("write", event))
             return;
-        const result = shouldBlockContextWrite(event.toolName, event.input.path, await getDiscussionMilestoneIdFor(discussionBasePath), isQueuePhaseActive());
+        const result = shouldBlockContextWrite(event.toolName, event.input.path, await getDiscussionMilestoneIdFor(discussionBasePath), isQueuePhaseActive(discussionBasePath), discussionBasePath);
         if (result.block)
             return result;
     });
@@ -500,7 +500,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             return;
         const basePath = process.cwd();
         const milestoneId = await getDiscussionMilestoneIdFor(basePath);
-        const queueActive = isQueuePhaseActive();
+        const queueActive = isQueuePhaseActive(basePath);
         const details = event.details;
         // ── Discussion gate enforcement: handle gate question responses ──
         // If the result is cancelled or has no response, the pending gate stays active
@@ -508,7 +508,7 @@ export function registerHooks(pi, ecosystemHandlers) {
         // If the user responded at all (even "needs adjustment"), clear the pending gate
         // because the user engaged — the prompt handles the re-ask-after-adjustment flow.
         const questions = event.input?.questions ?? [];
-        const currentPendingGate = getPendingGate();
+        const currentPendingGate = getPendingGate(basePath);
         if (currentPendingGate) {
             if (details?.cancelled || !details?.response) {
                 // Gate stays pending. Direct the agent to the most reliable recovery

package/dist/resources/extensions/gsd/bootstrap/write-gate.js

@@ -298,8 +298,8 @@ export function getPendingGate(basePath = process.cwd()) {
  * Returns { block: true, reason } if the tool should be blocked.
  * ask_user_questions itself is allowed so the model can re-ask the gate.
  */
-export function shouldBlockPendingGate(toolName, milestoneId, queuePhaseActive) {
-    return shouldBlockPendingGateInSnapshot(currentWriteGateSnapshot(), toolName, milestoneId, queuePhaseActive);
+export function shouldBlockPendingGate(toolName, milestoneId, queuePhaseActive, basePath = process.cwd()) {
+    return shouldBlockPendingGateInSnapshot(currentWriteGateSnapshot(basePath), toolName, milestoneId, queuePhaseActive);
 }
 export function shouldBlockPendingGateInSnapshot(snapshot, toolName, _milestoneId, _queuePhaseActive) {
     if (!snapshot.pendingGateId)
@@ -322,8 +322,8 @@ export function shouldBlockPendingGateInSnapshot(snapshot, toolName, _milestoneI
  * Check whether a bash command should be blocked because a discussion gate is pending.
  * All bash is blocked while waiting for confirmation so the question stays visible.
  */
-export function shouldBlockPendingGateBash(command, milestoneId, queuePhaseActive) {
-    return shouldBlockPendingGateBashInSnapshot(currentWriteGateSnapshot(), command, milestoneId, queuePhaseActive);
+export function shouldBlockPendingGateBash(command, milestoneId, queuePhaseActive, basePath = process.cwd()) {
+    return shouldBlockPendingGateBashInSnapshot(currentWriteGateSnapshot(basePath), command, milestoneId, queuePhaseActive);
 }
 export function shouldBlockPendingGateBashInSnapshot(snapshot, command, _milestoneId, _queuePhaseActive) {
     if (!snapshot.pendingGateId)
@@ -363,7 +363,7 @@ export function isDepthConfirmationAnswer(selected, options) {
     // Returning false prevents any free-form string from unlocking the gate.
     return false;
 }
-export function shouldBlockContextWrite(toolName, inputPath, milestoneId, _queuePhaseActive) {
+export function shouldBlockContextWrite(toolName, inputPath, milestoneId, _queuePhaseActive, basePath = process.cwd()) {
     if (toolName !== "write")
         return { block: false };
     if (!MILESTONE_CONTEXT_RE.test(inputPath))
@@ -379,7 +379,7 @@ export function shouldBlockContextWrite(toolName, inputPath, milestoneId, _queue
             ].join(" "),
         };
     }
-    if (isMilestoneDepthVerified(targetMilestoneId))
+    if (isMilestoneDepthVerified(targetMilestoneId, basePath))
         return { block: false };
     return {
         block: true,
@@ -397,8 +397,8 @@ export function shouldBlockContextWrite(toolName, inputPath, milestoneId, _queue
  * Slice-level CONTEXT artifacts are allowed; milestone-level CONTEXT writes
  * require the milestone to be depth-verified first.
  */
-export function shouldBlockContextArtifactSave(artifactType, milestoneId, sliceId) {
-    return shouldBlockContextArtifactSaveInSnapshot(currentWriteGateSnapshot(), artifactType, milestoneId, sliceId);
+export function shouldBlockContextArtifactSave(artifactType, milestoneId, sliceId, basePath = process.cwd()) {
+    return shouldBlockContextArtifactSaveInSnapshot(currentWriteGateSnapshot(basePath), artifactType, milestoneId, sliceId);
 }
 export function shouldBlockContextArtifactSaveInSnapshot(snapshot, artifactType, milestoneId, sliceId) {
     if (artifactType !== "CONTEXT")

package/dist/resources/extensions/gsd/gsd-db.js

@@ -669,6 +669,10 @@ function columnExists(db, table, column) {
     const rows = db.prepare(`PRAGMA table_info(${table})`).all();
     return rows.some((row) => row["name"] === column);
 }
+function formatFtsUnavailableError(err) {
+    const message = err instanceof Error ? err.message : String(err);
+    return message.replace(/\bmoduel\s*:\s*/gi, "module: ");
+}
 /**
  * Create the FTS5 virtual table for memories plus the triggers that keep it
  * in sync with the base table. FTS5 may be unavailable on stripped-down
@@ -704,7 +708,7 @@ export function tryCreateMemoriesFts(db) {
         return true;
     }
     catch (err) {
-        logWarning("db", `FTS5 unavailable — memory queries will use LIKE fallback: ${err.message}`);
+        logWarning("db", `FTS5 unavailable — memory queries will use LIKE fallback: ${formatFtsUnavailableError(err)}`);
         return false;
     }
 }
@@ -1653,6 +1657,35 @@ export function closeDatabase() {
     _lastDbError = null;
     _lastDbPhase = null;
 }
+/**
+ * Re-open the active database connection from disk.
+ *
+ * Auto-mode can observe artifacts written by a workflow server running in a
+ * different process before its long-lived singleton has re-synchronized. The
+ * recovery path uses this to force the next state derivation to read from the
+ * current on-disk database instead of continuing with a possibly stale handle.
+ */
+export function refreshOpenDatabaseFromDisk() {
+    if (!currentDb || !currentPath)
+        return false;
+    if (currentPath === ":memory:")
+        return false;
+    const dbPath = currentPath;
+    const identityKey = _currentIdentityKey;
+    try {
+        closeDatabase();
+        const opened = openDatabase(dbPath);
+        if (opened && identityKey && currentDb) {
+            _dbCache.set(identityKey, { dbPath, db: currentDb });
+            _currentIdentityKey = identityKey;
+        }
+        return opened;
+    }
+    catch (e) {
+        logWarning("db", `database refresh failed: ${e.message}`);
+        return false;
+    }
+}
 /** Run a full VACUUM — call sparingly (e.g. after milestone completion). */
 export function vacuumDatabase() {
     if (!currentDb)

package/dist/resources/extensions/gsd/guided-flow.js

@@ -44,6 +44,7 @@ import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForGuidedUnit
 import { runPreparation, formatCodebaseBrief, formatPriorContextBrief, } from "./preparation.js";
 import { verifyExpectedArtifact } from "./auto-recovery.js";
 import { createWorkspace, scopeMilestone } from "./workspace.js";
+import { getPendingGate, extractDepthVerificationMilestoneId } from "./bootstrap/write-gate.js";
 // ─── Re-exports (preserve public API for existing importers) ────────────────
 export { MILESTONE_ID_RE, generateMilestoneSuffix, nextMilestoneId, extractMilestoneSeq, parseMilestoneId, milestoneIdSort, maxMilestoneNum, findMilestoneIds, reserveMilestoneId, claimReservedId, getReservedMilestoneIds, clearReservedMilestoneIds, } from "./milestone-ids.js";
 export { showQueue, handleQueueReorder, showQueueAdd, buildExistingMilestonesContext, } from "./guided-flow-queue.js";
@@ -295,6 +296,14 @@ export async function checkDeepProjectSetupAfterTurn(_event, ctx, basePath) {
             return false;
         }
     }
+    // R2: a depth-verification gate is still pending — the LLM emitted the
+    // confirmation question (via ask_user_questions or plain chat) but the user
+    // has not approved yet. Returning false keeps the entry in the
+    // pendingDeepProjectSetupMap so the next user message can resume.
+    const pendingGateId = getPendingGate(entry.basePath);
+    if (pendingGateId) {
+        return false;
+    }
     return dispatchNextDeepProjectSetupStage(entry);
 }
 async function dispatchNextDeepProjectSetupStage(entry) {
@@ -368,6 +377,23 @@ export function checkAutoStartAfterDiscuss() {
     const roadmapFile = existsSync(roadmapFilePath) ? roadmapFilePath : null;
     if (!contextFile && !roadmapFile)
         return false; // neither artifact yet — keep waiting
+    // Gate 1a: a depth-verification gate is still pending for THIS milestone — the
+    // LLM emitted the confirmation question (via ask_user_questions or plain chat)
+    // but the user has not answered yet. Advancing now would skip the gate and
+    // race ahead with unverified context.
+    const basePathForGate = entry.scope.workspace.projectRoot;
+    const pendingGateId = getPendingGate(basePathForGate);
+    if (pendingGateId) {
+        const pendingMilestoneId = extractDepthVerificationMilestoneId(pendingGateId);
+        // Block advancement if the gate is for THIS milestone, OR if it's a
+        // project/requirements gate (no milestone id encoded) for the deep setup flow.
+        const isProjectGate = pendingGateId === "depth_verification_project_confirm" ||
+            pendingGateId === "depth_verification_requirements_confirm" ||
+            pendingGateId === "depth_verification_research_decision_confirm";
+        if (pendingMilestoneId === milestoneId || isProjectGate) {
+            return false;
+        }
+    }
     // Gate 1b: Discriminate plan-blocked from discuss-incomplete when the DB row is queued.
     // If the DB is available and the row is still "queued" but CONTEXT.md already exists on
     // disk, the discuss phase completed but gsd_plan_milestone was hard-blocked by the
@@ -489,6 +515,20 @@ export function checkAutoStartAfterDiscuss() {
             logWarning("guided", `manifest unlink failed: ${e.message}`);
         }
     }
+    // R3b: belt-and-suspenders for silent registration failure. The discuss flow
+    // finished and STATE.md exists, but the milestone may never have landed in
+    // the DB. Without this guard, the user sees "Milestone M001 ready." and then
+    // /gsd reports "No Active Milestone".
+    if (isDbAvailable()) {
+        const milestoneRow = getMilestone(milestoneId);
+        if (!milestoneRow) {
+            ctx.ui.notify(`Milestone ${milestoneId}: discuss artifacts on disk but no DB row exists. ` +
+                `PROJECT.md may have failed to register milestones. ` +
+                `Re-save PROJECT.md with canonical "- [ ] M001: Title — One-liner" lines, ` +
+                `then re-run /gsd to recover.`, "error");
+            return false;
+        }
+    }
     pendingAutoStartMap.delete(basePath);
     ctx.ui.notify(`Milestone ${milestoneId} ready.`, "success");
     startAutoDetached(ctx, pi, basePath, false, { step });

package/dist/resources/extensions/gsd/paths.js

@@ -177,8 +177,12 @@ export function resolveDir(parentDir, idPrefix) {
         const exact = entries.find(e => e.isDirectory() && e.name === idPrefix);
         if (exact)
             return exact.name;
+        const idLower = idPrefix.toLowerCase();
+        const exactCaseInsensitive = entries.find(e => e.isDirectory() && e.name.toLowerCase() === idLower);
+        if (exactCaseInsensitive)
+            return exactCaseInsensitive.name;
         // Prefix match for legacy descriptor dirs: M001-SOMETHING
-        const prefixed = entries.find(e => e.isDirectory() && e.name.startsWith(idPrefix + "-"));
+        const prefixed = entries.find(e => e.isDirectory() && e.name.toLowerCase().startsWith(idLower + "-"));
         return prefixed ? prefixed.name : null;
     }
     catch {

package/dist/resources/extensions/gsd/tools/workflow-tool-executors.js

@@ -141,7 +141,6 @@ export async function executeSummarySave(params, basePath = process.cwd()) {
             task_id: isRootArtifact ? undefined : params.task_id,
         }, basePath);
         let registeredMilestones = [];
-        let registrationWarning;
         if (params.artifact_type === "PROJECT") {
             try {
                 registeredMilestones = registerProjectMilestoneSequence(contentToSave);
@@ -150,12 +149,55 @@ export async function executeSummarySave(params, basePath = process.cwd()) {
             }
             catch (err) {
                 const msg = err instanceof Error ? err.message : String(err);
-                registrationWarning = `PROJECT artifact saved, but milestone registration failed: ${msg}`;
-                logWarning("tool", registrationWarning, {
+                logError("tool", `gsd_summary_save: PROJECT artifact persisted but milestone registration threw: ${msg}`, {
                     tool: "gsd_summary_save",
                     error: String(err),
                     stack: err instanceof Error ? err.stack ?? "" : "",
                 });
+                // PROJECT.md was persisted by saveArtifactToDb above; the artifacts row
+                // changed even though no milestones registered. Invalidate so subsequent
+                // /gsd reads see the persisted artifact instead of the pre-save cache.
+                invalidateStateCache();
+                return {
+                    content: [{
+                            type: "text",
+                            text: `Error: PROJECT.md was saved to ${relativePath} but milestone registration failed: ${msg}. ` +
+                                `The DB has no milestone rows for this project, so /gsd will report "No Active Milestone". ` +
+                                `Re-call gsd_summary_save(PROJECT) once the underlying error is resolved — INSERT OR IGNORE makes registration idempotent.`,
+                        }],
+                    details: {
+                        operation: "save_summary",
+                        path: relativePath,
+                        artifact_type: params.artifact_type,
+                        error: "milestone_registration_threw",
+                        registration_error: msg,
+                    },
+                    isError: true,
+                };
+            }
+            if (registeredMilestones.length === 0) {
+                logError("tool", `gsd_summary_save: PROJECT.md saved to ${relativePath} but parsed zero milestones — registration produced no DB rows`, {
+                    tool: "gsd_summary_save",
+                });
+                // PROJECT.md was persisted; invalidate so subsequent reads see the new
+                // artifacts row even though no milestones registered.
+                invalidateStateCache();
+                return {
+                    content: [{
+                            type: "text",
+                            text: `Error: PROJECT.md was saved to ${relativePath} but contains zero parseable milestone lines, ` +
+                                `so no milestones were registered in the DB. /gsd will report "No Active Milestone". ` +
+                                `Rewrite PROJECT.md so the "Milestone Sequence" section uses canonical lines: ` +
+                                `\`- [ ] M001: <Title> — <One-liner>\` (em-dash, double-dash \`--\`, or single-dash \`-\` separator), then re-call gsd_summary_save(PROJECT).`,
+                        }],
+                    details: {
+                        operation: "save_summary",
+                        path: relativePath,
+                        artifact_type: params.artifact_type,
+                        error: "milestone_registration_empty_parse",
+                    },
+                    isError: true,
+                };
             }
         }
         if (params.artifact_type === "CONTEXT" && !params.task_id) {
@@ -178,7 +220,6 @@ export async function executeSummarySave(params, basePath = process.cwd()) {
                 artifact_type: params.artifact_type,
                 content_source: contentSource,
                 ...(registeredMilestones.length > 0 ? { registeredMilestones } : {}),
-                ...(registrationWarning ? { warning: registrationWarning } : {}),
             },
         };
     }

package/dist/resources/extensions/gsd/uok/audit.js

@@ -1,3 +1,4 @@
+// GSD2 UOK Audit Events and DB-First Projection Writes
 import { appendFileSync, closeSync, existsSync, mkdirSync, openSync } from "node:fs";
 import { join } from "node:path";
 import { randomUUID } from "node:crypto";
@@ -5,6 +6,7 @@ import { isStaleWrite } from "../auto/turn-epoch.js";
 import { withFileLockSync } from "../file-lock.js";
 import { gsdRoot } from "../paths.js";
 import { isDbAvailable, insertAuditEvent } from "../gsd-db.js";
+import { CURRENT_UOK_CONTRACT_VERSION, validateAuditEvent } from "./contracts.js";
 function auditLogPath(basePath) {
     return join(gsdRoot(basePath), "audit", "events.jsonl");
 }
@@ -13,6 +15,7 @@ function ensureAuditDir(basePath) {
 }
 export function buildAuditEnvelope(args) {
     return {
+        version: CURRENT_UOK_CONTRACT_VERSION,
         eventId: randomUUID(),
         traceId: args.traceId,
         turnId: args.turnId,
@@ -27,6 +30,25 @@ export function emitUokAuditEvent(basePath, event) {
     // Drop writes from a turn superseded by timeout recovery / cancellation.
     if (isStaleWrite("uok-audit"))
         return;
+    const validation = validateAuditEvent(event);
+    if (!validation.ok) {
+        throw new Error(`Invalid UOK audit event: ${validation.issues.map((issue) => `${issue.path}: ${issue.message}`).join("; ")}`);
+    }
+    const canonical = validation.value;
+    if (isDbAvailable()) {
+        try {
+            insertAuditEvent({
+                ...canonical,
+                payload: {
+                    ...canonical.payload,
+                    contractVersion: canonical.version ?? CURRENT_UOK_CONTRACT_VERSION,
+                },
+            });
+        }
+        catch (err) {
+            throw new Error(`DB authoritative audit write failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     try {
         ensureAuditDir(basePath);
         const path = auditLogPath(basePath);
@@ -39,18 +61,10 @@ export function emitUokAuditEvent(basePath, event) {
         // POSIX O_APPEND atomicity still protects small line writes, so skipping
         // the lock rather than stalling orchestration is the correct tradeoff.
         withFileLockSync(path, () => {
-            appendFileSync(path, `${JSON.stringify(event)}\n`, "utf-8");
+            appendFileSync(path, `${JSON.stringify(canonical)}\n`, "utf-8");
         }, { onLocked: "skip" });
     }
     catch {
         // Best-effort: audit writes must never break orchestration.
     }
-    if (!isDbAvailable())
-        return;
-    try {
-        insertAuditEvent(event);
-    }
-    catch {
-        // Projection failures are non-fatal while legacy readers are still active.
-    }
 }