gsd-pi 2.80.0-dev.c5f2443b3 → 2.80.0-dev.d4fc28e6b

package/dist/resources/extensions/gsd/auto/run-unit.js

@@ -1,14 +1,11 @@
-/**
- * auto/run-unit.ts — Single unit execution: session create → prompt → await agent_end.
- *
- * Imports from: auto/types, auto/resolve
- */
+// GSD-2 + src/resources/extensions/gsd/auto/run-unit.ts - Runs one GSD auto-mode unit from session creation through agent completion.
 import { NEW_SESSION_TIMEOUT_MS } from "./session.js";
-import { _clearCurrentResolve, _setCurrentResolve, _setSessionSwitchInFlight } from "./resolve.js";
+import { _clearCurrentResolve, _consumePendingSwitchCancellation, _markSessionSwitchAbortGraceWindow, _setCurrentResolve, _setSessionSwitchInFlight, } from "./resolve.js";
 import { getCurrentTurnGeneration, runWithTurnGeneration, } from "./turn-epoch.js";
 import { debugLog } from "../debug-logger.js";
 import { logWarning } from "../workflow-logger.js";
 import { resolveAutoSupervisorConfig } from "../preferences.js";
+import { formatAutoUnitWorkingMessage } from "../working-output-messages.js";
 // Tracks the latest session-switch attempt so a late timeout settlement from an
 // older runUnit() call cannot clear the guard for a newer one.
 let sessionSwitchGeneration = 0;
@@ -22,44 +19,23 @@ let sessionSwitchGeneration = 0;
  */
 export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     debugLog("runUnit", { phase: "start", unitType, unitId });
-    // Ensure cwd matches basePath BEFORE newSession() captures it. The new
-    // session reads process.cwd() during construction to anchor its tool
-    // runtime and system prompt; if cwd has drifted (async_bash, background
-    // jobs, prior unit cleanup), the session would otherwise be rooted to
-    // the wrong directory. Must be synchronous — no awaits between chdir
-    // and newSession (#1389, #4762 follow-up).
-    try {
-        if (process.cwd() !== s.basePath) {
-            process.chdir(s.basePath);
-        }
-    }
-    catch (e) {
-        const msg = `Failed to chdir to basePath before newSession (basePath: ${s.basePath}): ${String(e)}`;
-        logWarning("engine", msg, { basePath: s.basePath, error: String(e) });
-        return {
-            status: "cancelled",
-            errorContext: {
-                message: msg,
-                category: "session-failed",
-                isTransient: true,
-            },
-        };
-    }
     // ── Session creation with timeout ──
     debugLog("runUnit", { phase: "session-create", unitType, unitId });
     let sessionResult;
     let sessionTimeoutHandle;
     const mySessionSwitchGeneration = ++sessionSwitchGeneration;
-    // #3731: Cancellation controller for newSession(). When the session-creation
-    // timeout fires, we abort this controller so that the still-in-flight
-    // newSession() discards itself after await this.abort() completes, preventing
-    // it from capturing the (now-root) process.cwd() and rebuilding the tool
-    // runtime with the wrong cwd.
+    // #3731: Cancellation controller for newSession(). When session creation
+    // times out, abort before a late session switch can rebuild the tool runtime
+    // against a stale workspace root.
     const sessionAbortController = new AbortController();
     _setSessionSwitchInFlight(true);
     try {
-        const sessionPromise = s.cmdCtx.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
+        const sessionPromise = s.cmdCtx.newSession({
+            abortSignal: sessionAbortController.signal,
+            workspaceRoot: s.basePath,
+        }).finally(() => {
             if (sessionSwitchGeneration === mySessionSwitchGeneration) {
+                _markSessionSwitchAbortGraceWindow();
                 _setSessionSwitchInFlight(false);
             }
         });
@@ -74,6 +50,7 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     catch (sessionErr) {
         if (sessionTimeoutHandle)
             clearTimeout(sessionTimeoutHandle);
+        _consumePendingSwitchCancellation();
         const msg = sessionErr instanceof Error ? sessionErr.message : String(sessionErr);
         debugLog("runUnit", {
             phase: "session-error",
@@ -86,15 +63,18 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     if (sessionTimeoutHandle)
         clearTimeout(sessionTimeoutHandle);
     if (sessionResult.cancelled) {
+        _consumePendingSwitchCancellation();
         debugLog("runUnit-session-timeout", { unitType, unitId });
         return { status: "cancelled", errorContext: { message: "Session creation timed out", category: "timeout", isTransient: true } };
     }
     if (!s.active) {
+        _consumePendingSwitchCancellation();
         return { status: "cancelled" };
     }
     if (s.currentUnitModel && typeof pi.setModel === "function") {
         const restored = await pi.setModel(s.currentUnitModel, { persist: false });
         if (!restored) {
+            _consumePendingSwitchCancellation();
             const message = `Failed to restore configured model ${s.currentUnitModel.provider}/${s.currentUnitModel.id} after session creation`;
             ctx.ui.notify(`${message}. Cancelling unit before dispatch.`, "warning");
             return {
@@ -110,10 +90,19 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     // ── Create the agent_end promise (per-unit one-shot) ──
     // This happens after newSession completes so session-switch agent_end events
     // from the previous session cannot resolve the new unit.
+    _markSessionSwitchAbortGraceWindow();
     _setSessionSwitchInFlight(false);
     const unitPromise = new Promise((resolve) => {
         _setCurrentResolve(resolve);
     });
+    const pendingSwitchCancellation = _consumePendingSwitchCancellation();
+    if (pendingSwitchCancellation) {
+        _clearCurrentResolve();
+        return {
+            status: "cancelled",
+            ...(pendingSwitchCancellation.errorContext ? { errorContext: pendingSwitchCancellation.errorContext } : {}),
+        };
+    }
     // ── Provider request-readiness pre-check (#4555) ──
     // Verify the provider can accept requests before dispatching. If the token
     // has expired since bootstrap, return cancelled immediately so the unit is
@@ -151,22 +140,29 @@ export async function runUnit(ctx, pi, s, unitType, unitId, prompt) {
     // ── Send the prompt ──
     debugLog("runUnit", { phase: "send-message", unitType, unitId });
     const requestDispatchedAt = Date.now();
-    pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });
+    ctx.ui.setWorkingMessage?.(formatAutoUnitWorkingMessage(unitType, unitId));
     // ── Await agent_end with absolute timeout (H4 fix) ──
     // If supervision fails to resolve unitPromise within 30s, treat as cancelled.
     // Without this, a crashed agent that never emits agent_end hangs the loop (#3161).
-    debugLog("runUnit", { phase: "awaiting-agent-end", unitType, unitId });
     const supervisor = resolveAutoSupervisorConfig();
     const UNIT_HARD_TIMEOUT_MS = Math.max(30_000, ((supervisor.hard_timeout_minutes ?? 30) * 60 * 1000) + 30_000);
     let unitTimeoutHandle;
-    const timeoutResult = new Promise((resolve) => {
-        unitTimeoutHandle = setTimeout(() => {
-            resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
-        }, UNIT_HARD_TIMEOUT_MS);
-    });
-    const result = await runWithTurnGeneration(capturedTurnGen, () => Promise.race([unitPromise, timeoutResult]));
-    if (unitTimeoutHandle)
-        clearTimeout(unitTimeoutHandle);
+    let result;
+    try {
+        pi.sendMessage({ customType: "gsd-auto", content: prompt, display: s.verbose }, { triggerTurn: true });
+        debugLog("runUnit", { phase: "awaiting-agent-end", unitType, unitId });
+        const timeoutResult = new Promise((resolve) => {
+            unitTimeoutHandle = setTimeout(() => {
+                resolve({ status: "cancelled", errorContext: { message: "Unit hard timeout — supervision may have failed", category: "timeout", isTransient: true } });
+            }, UNIT_HARD_TIMEOUT_MS);
+        });
+        result = await runWithTurnGeneration(capturedTurnGen, () => Promise.race([unitPromise, timeoutResult]));
+    }
+    finally {
+        if (unitTimeoutHandle)
+            clearTimeout(unitTimeoutHandle);
+        ctx.ui.setWorkingMessage?.(undefined);
+    }
     debugLog("runUnit", {
         phase: "agent-end-received",
         unitType,

package/dist/resources/extensions/gsd/auto/session.js

@@ -106,6 +106,13 @@ export class AutoSession {
      * stale context bleeding into unrelated slices.
      */
     lastPreExecFailure = null;
+    /**
+     * Tracks how many consecutive times each slice unit has failed pre-execution
+     * checks. Keyed by unitId (e.g. "M001/S01"). Used to break the infinite
+     * plan-slice → pre-exec fail → re-dispatch loop when the planner cannot fix
+     * the issues after MAX_PRE_EXEC_RETRIES re-attempts.
+     */
+    preExecRetryCount = new Map();
     // ── Tool invocation errors (#2883) ──────────────────────────────────
     /** Set when a GSD tool execution ends with isError due to malformed/truncated
      *  JSON arguments. Checked by postUnitPreVerification to break retry loops. */
@@ -258,6 +265,7 @@ export class AutoSession {
         this.rewriteAttemptCount = 0;
         this.consecutiveCompleteBootstraps = 0;
         this.lastPreExecFailure = null;
+        this.preExecRetryCount.clear();
         this.lastToolInvocationError = null;
         this.lastUnitAgentEndMessages = null;
         this.lastGitActionFailure = null;

package/dist/resources/extensions/gsd/auto/workflow-dispatch-claim.js

@@ -1,7 +1,39 @@
 // Project/App: GSD-2
 // File Purpose: Best-effort unit dispatch claim adapter for auto-mode loop.
+export function ensureDispatchLease(s, milestoneId, deps, opts = {}) {
+    if (!s.workerId)
+        return { kind: "degraded", reason: "missing-worker" };
+    if (!milestoneId)
+        return { kind: "degraded", reason: "missing-milestone" };
+    if (!opts.forceReclaim && typeof s.milestoneLeaseToken === "number") {
+        return { kind: "ready", token: s.milestoneLeaseToken, recovered: false };
+    }
+    s.milestoneLeaseToken = null;
+    try {
+        const claim = deps.claimMilestoneLease(s.workerId, milestoneId);
+        if (!claim.ok) {
+            const reason = `Milestone ${milestoneId} is held by worker ${claim.byWorker} until ${claim.expiresAt}.`;
+            deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+            return { kind: "blocked", reason };
+        }
+        s.currentMilestoneId = milestoneId;
+        s.milestoneLeaseToken = claim.token;
+        deps.logLeaseRecovered({
+            milestoneId,
+            workerId: s.workerId,
+            token: claim.token,
+            recovered: opts.forceReclaim === true,
+        });
+        return { kind: "ready", token: claim.token, recovered: opts.forceReclaim === true };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+        return { kind: "failed", reason };
+    }
+}
 export function openDispatchClaim(s, flowId, turnId, iterData, deps) {
-    if (!s.workerId || s.milestoneLeaseToken === null)
+    if (!s.workerId || typeof s.milestoneLeaseToken !== "number")
         return { kind: "degraded" };
     const mid = iterData.mid;
     if (!mid)

package/dist/resources/extensions/gsd/auto/workflow-worker-heartbeat.js

@@ -6,7 +6,15 @@ export function maintainWorkerHeartbeat(session, deps) {
     try {
         deps.heartbeatAutoWorker(session.workerId);
         if (session.currentMilestoneId && session.milestoneLeaseToken) {
-            deps.refreshMilestoneLease(session.workerId, session.currentMilestoneId, session.milestoneLeaseToken);
+            const refreshed = deps.refreshMilestoneLease(session.workerId, session.currentMilestoneId, session.milestoneLeaseToken);
+            if (!refreshed) {
+                deps.logLeaseRefreshMiss?.({
+                    workerId: session.workerId,
+                    milestoneId: session.currentMilestoneId,
+                    fencingToken: session.milestoneLeaseToken,
+                });
+                session.milestoneLeaseToken = null;
+            }
         }
     }
     catch (err) {

package/dist/resources/extensions/gsd/auto-dashboard.js

@@ -1,10 +1,4 @@
-/**
- * Auto-mode Dashboard — progress widget rendering, elapsed time formatting,
- * unit description helpers, and slice progress caching.
- *
- * Pure functions that accept specific parameters — no module-level globals
- * or AutoContext dependency. State accessors are passed as callbacks.
- */
+// GSD-2 + src/resources/extensions/gsd/auto-dashboard.ts - Auto-mode progress widget rendering and dashboard helpers.
 import { getCurrentBranch } from "./worktree.js";
 import { getActiveHook } from "./post-unit-hooks.js";
 import { getLedger, getProjectTotals } from "./metrics.js";
@@ -25,6 +19,7 @@ import { formatRtkSavingsLabel, getRtkSessionSavings, } from "../shared/rtk-sess
 import { logWarning } from "./workflow-logger.js";
 import { formattedShortcutPair } from "./shortcut-defs.js";
 import { homedir } from "node:os";
+import { readUnitRuntimeRecord } from "./unit-runtime.js";
 // ─── UAT Slice Extraction ─────────────────────────────────────────────────────
 /**
  * Extract the target slice ID from a run-uat unit ID (e.g. "M001/S01" → "S01").
@@ -165,6 +160,30 @@ export function formatWidgetTokens(count) {
         return `${(count / 1000000).toFixed(1)}M`;
     return `${Math.round(count / 1000000)}M`;
 }
+export function formatRuntimeHealthSignal(record, now = Date.now()) {
+    if (!record)
+        return null;
+    const idleMs = Math.max(0, now - record.lastProgressAt);
+    const idleMinutes = Math.floor(idleMs / 60_000);
+    if ((record.recoveryAttempts ?? 0) > 0 || record.phase === "recovered" || record.lastProgressKind.includes("recovery")) {
+        return {
+            level: "yellow",
+            summary: "Recovering",
+            detail: `retry ${record.recoveryAttempts ?? 1} after ${record.lastRecoveryReason ?? "idle"} stall`,
+        };
+    }
+    if (record.progressCount === 0 && idleMs >= 60_000) {
+        return {
+            level: "yellow",
+            summary: "Waiting on provider",
+            detail: `no output for ${idleMinutes}m`,
+        };
+    }
+    return null;
+}
+export function shouldRenderRoadmapProgress(progress) {
+    return !!progress && progress.total > 0;
+}
 // ─── ETA Estimation ──────────────────────────────────────────────────────────
 /**
  * Estimate remaining time based on average unit duration from the metrics ledger.
@@ -499,6 +518,7 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
         let cachedLines;
         let cachedWidth;
         let cachedRtkLabel;
+        let cachedRuntimeRecord = null;
         const refreshRtkLabel = () => {
             try {
                 const sessionId = ctx.sessionManager.getSessionId();
@@ -510,7 +530,16 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                 cachedRtkLabel = null;
             }
         };
+        const refreshRuntimeRecord = () => {
+            try {
+                cachedRuntimeRecord = readUnitRuntimeRecord(accessors.getBasePath(), unitType, unitId);
+            }
+            catch {
+                cachedRuntimeRecord = null;
+            }
+        };
         refreshRtkLabel();
+        refreshRuntimeRecord();
         const pulseTimer = setInterval(() => {
             pulseBright = !pulseBright;
             cachedLines = undefined;
@@ -526,6 +555,7 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                     updateSliceProgressCache(accessors.getBasePath(), mid.id, slice?.id);
                 }
                 refreshRtkLabel();
+                refreshRuntimeRecord();
                 cachedLines = undefined;
             }
             catch (err) { /* non-fatal */
@@ -555,13 +585,16 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                 const modeTag = accessors.isStepMode() ? "NEXT" : "AUTO";
                 // Health indicator in header
                 const score = computeProgressScore();
-                const healthColor = score.level === "green" ? "success"
-                    : score.level === "yellow" ? "warning"
+                const runtimeSignal = formatRuntimeHealthSignal(cachedRuntimeRecord);
+                const healthLevel = runtimeSignal?.level ?? score.level;
+                const healthSummary = runtimeSignal?.summary ?? score.summary;
+                const healthColor = healthLevel === "green" ? "success"
+                    : healthLevel === "yellow" ? "warning"
                         : "error";
-                const healthIcon = score.level === "green" ? GLYPH.statusActive
-                    : score.level === "yellow" ? "!"
+                const healthIcon = healthLevel === "green" ? GLYPH.statusActive
+                    : healthLevel === "yellow" ? "!"
                         : "x";
-                const healthStr = `  ${theme.fg(healthColor, healthIcon)} ${theme.fg(healthColor, score.summary)}`;
+                const healthStr = `  ${theme.fg(healthColor, healthIcon)} ${theme.fg(healthColor, healthSummary)}`;
                 const headerLeft = `${pad}${dot} ${theme.fg("accent", theme.bold("GSD"))}  ${theme.fg("success", modeTag)}${healthStr}`;
                 // ETA in header right, after elapsed
                 const eta = estimateTimeRemaining();
@@ -573,7 +606,10 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                     : "";
                 lines.push(rightAlign(headerLeft, headerRight, width));
                 // Show health signal details when degraded (yellow/red)
-                if (score.level !== "green" && score.signals.length > 0 && widgetMode !== "min") {
+                if (runtimeSignal?.detail && widgetMode !== "min") {
+                    lines.push(`${pad}  ${theme.fg("dim", runtimeSignal.detail)}`);
+                }
+                else if (score.level !== "green" && score.signals.length > 0 && widgetMode !== "min") {
                     // Show up to 3 most relevant signals in compact form
                     const topSignals = score.signals
                         .filter(s => s.kind === "negative")
@@ -645,7 +681,7 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                     lines.push(rightAlign(actionLeft, theme.fg("dim", phaseLabel), width));
                     // Progress bar
                     const roadmapSlices = mid ? getRoadmapSlicesSync() : null;
-                    if (roadmapSlices) {
+                    if (shouldRenderRoadmapProgress(roadmapSlices)) {
                         const { done, total, activeSliceTasks } = roadmapSlices;
                         const barWidth = Math.max(6, Math.min(18, Math.floor(width * 0.25)));
                         const pct = total > 0 ? done / total : 0;
@@ -706,7 +742,7 @@ export function updateProgressWidget(ctx, unitType, unitId, state, accessors, ti
                     ? Math.floor(width * (width >= 100 ? 0.45 : 0.50))
                     : width;
                 const leftLines = [];
-                if (roadmapSlices) {
+                if (shouldRenderRoadmapProgress(roadmapSlices)) {
                     const { done, total, activeSliceTasks } = roadmapSlices;
                     const barWidth = Math.max(6, Math.min(18, Math.floor(leftColWidth * 0.4)));
                     const pct = total > 0 ? done / total : 0;

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -11,7 +11,6 @@ import { buildResearchSlicePrompt, buildResearchMilestonePrompt, buildPlanSliceP
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { pauseAuto } from "./auto.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
-import { logWarning } from "./workflow-logger.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
 export async function dispatchDirectPhase(ctx, pi, phase, base) {
     const state = await deriveState(base);
@@ -231,36 +230,10 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
         return;
     }
     ctx.ui.notify(`Dispatching ${unitType} for ${unitId}...`, "info");
-    const originalCwd = process.cwd();
-    try {
-        // Ensure cwd matches dispatchBase BEFORE newSession() captures it. Synchronous —
-        // no awaits between chdir and newSession.
-        try {
-            if (process.cwd() !== dispatchBase) {
-                process.chdir(dispatchBase);
-            }
-        }
-        catch (err) {
-            const msg = `Failed to chdir before direct-dispatch newSession (basePath: ${dispatchBase}): ${err instanceof Error ? err.message : String(err)}`;
-            logWarning("engine", msg, { file: "auto-direct-dispatch.ts", basePath: dispatchBase, error: err instanceof Error ? err.message : String(err) });
-            ctx.ui.notify(`${msg}. Cancelling dispatch to avoid running in the wrong directory.`, "error");
-            return;
-        }
-        const result = await ctx.newSession();
-        if (result.cancelled) {
-            ctx.ui.notify("Session creation cancelled.", "warning");
-            return;
-        }
-        pi.sendMessage({ customType: "gsd-dispatch", content: prompt, display: false }, { triggerTurn: true });
-    }
-    finally {
-        try {
-            if (process.cwd() !== originalCwd) {
-                process.chdir(originalCwd);
-            }
-        }
-        catch (err) {
-            logWarning("engine", `Failed to restore cwd after direct dispatch: ${err instanceof Error ? err.message : String(err)}`, { file: "auto-direct-dispatch.ts", basePath: originalCwd });
-        }
+    const result = await ctx.newSession({ workspaceRoot: dispatchBase });
+    if (result.cancelled) {
+        ctx.ui.notify("Session creation cancelled.", "warning");
+        return;
     }
+    pi.sendMessage({ customType: "gsd-dispatch", content: prompt, display: false }, { triggerTurn: true });
 }

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -93,6 +93,16 @@ export function hasPendingDeepStage(prefs, basePath) {
     const gate = getDeepStageGate(prefs, basePath);
     return gate.status === "pending" || gate.status === "blocked";
 }
+export function shouldRunDeepProjectSetup(state, prefs, basePath, options = {}) {
+    if (options.hasSurvivorBranch === true)
+        return false;
+    if (state.phase !== "pre-planning" &&
+        state.phase !== "needs-discussion" &&
+        state.phase !== "planning") {
+        return false;
+    }
+    return hasPendingDeepStage(prefs, basePath);
+}
 function missingSliceStop(mid, phase) {
     return {
         action: "stop",
@@ -781,6 +791,22 @@ export const DISPATCH_RULES = [
             const unitId = `${mid}/${sid}`;
             let priorPreExecFailure;
             if (session?.lastPreExecFailure?.unitId === unitId) {
+                // Circuit breaker: stop re-dispatching after 2 failed retries. The
+                // planner has had multiple attempts with injected failure context and
+                // still cannot produce a valid plan — human review is required.
+                const MAX_PRE_EXEC_RETRIES = 2;
+                const retryCount = session.preExecRetryCount?.get(unitId) ?? 0;
+                if (retryCount >= MAX_PRE_EXEC_RETRIES) {
+                    const findings = session.lastPreExecFailure.blockingFindings.join("; ");
+                    session.lastPreExecFailure = null;
+                    session.preExecRetryCount?.delete(unitId);
+                    return {
+                        action: "stop",
+                        reason: `Pre-execution checks failed ${retryCount} times for ${unitId} — manual intervention required. Blocking findings: ${findings}. Fix the plan manually, then run /gsd auto to resume.`,
+                        level: "error",
+                        matchedRule: "planning → plan-slice",
+                    };
+                }
                 priorPreExecFailure = {
                     blockingFindings: session.lastPreExecFailure.blockingFindings,
                     verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -25,7 +25,7 @@ import { verifyExpectedArtifact, resolveExpectedArtifactPath, writeBlockerPlaceh
 import { regenerateIfMissing } from "./workflow-projections.js";
 import { syncStateToProjectRoot } from "./auto-worktree.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
-import { isDbAvailable, getTask, getSlice, getMilestone, updateTaskStatus, _getAdapter } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getMilestone, updateTaskStatus, _getAdapter, getVerificationEvidence } from "./gsd-db.js";
 import { renderPlanCheckboxes } from "./markdown-renderer.js";
 import { consumeSignal } from "./session-status-io.js";
 import { checkPostUnitHooks, isRetryPending, consumeRetryTrigger, persistHookState, resolveHookArtifactPath, } from "./post-unit-hooks.js";
@@ -719,21 +719,21 @@ export async function postUnitPreVerification(pctx, opts) {
                     }
                 }
                 // Evidence cross-reference (execute-task only)
-                // Verification evidence is passed via the complete-task tool call and
-                // stored in the SUMMARY.md on disk — not available as structured data
-                // in the DB. The evidence collector tracks actual bash tool calls, so
-                // we can still detect units that claimed success but ran no commands.
+                // Only compare against concrete command evidence persisted by the task
+                // completion tool. A prose Verify field can be satisfied later by the
+                // host verification gate, so it is not enough to accuse the unit.
                 if (safetyConfig.evidence_cross_reference && s.currentUnit.type === "execute-task") {
                     try {
                         const actual = getEvidence();
                         const bashCalls = actual.filter(e => e.kind === "bash");
-                        // If the task is marked complete but zero bash commands were run,
-                        // it's suspicious — the LLM may have fabricated results.
                         if (sMid && sSid && sTid && isDbAvailable()) {
                             const taskRow = getTask(sMid, sSid, sTid);
-                            if (taskRow?.status === "complete" && taskRow.verify && bashCalls.length === 0) {
-                                logWarning("safety", "task marked complete with verification commands but no bash calls were executed");
-                                ctx.ui.notify(`Safety: task ${sTid} has verification commands but no bash calls were recorded`, "warning");
+                            const claimedCommands = getVerificationEvidence(sMid, sSid, sTid)
+                                .map((row) => row.command)
+                                .filter((command) => typeof command === "string" && command.trim().length > 0);
+                            if (taskRow?.status === "complete" && claimedCommands.length > 0 && bashCalls.length === 0) {
+                                logWarning("safety", "task claimed verification command evidence but no execution tool calls were recorded");
+                                ctx.ui.notify(`Safety: task ${sTid} claimed command evidence but no execution tool calls were recorded`, "warning");
                             }
                         }
                     }
@@ -1123,8 +1123,11 @@ export async function postUnitPostVerification(pctx) {
                     return;
                 }
                 const strictMode = prefs?.enhanced_verification_strict === true;
-                // Run pre-execution checks
-                const result = await runPreExecutionChecks(tasks, s.basePath);
+                // Run pre-execution checks against the canonical project root. In
+                // worktree isolation, s.basePath can point at a metadata-only worktree,
+                // while source files remain under the project root.
+                const preExecutionBasePath = s.canonicalProjectRoot;
+                const result = await runPreExecutionChecks(tasks, preExecutionBasePath);
                 // Log summary to stderr in existing verification output format
                 const emoji = result.status === "pass" ? "✅" : result.status === "warn" ? "⚠️" : "❌";
                 process.stderr.write(`gsd-pre-exec: ${emoji} Pre-execution checks ${result.status} for ${mid}/${sid} (${result.durationMs}ms)\n`);
@@ -1134,12 +1137,12 @@ export async function postUnitPostVerification(pctx) {
                     process.stderr.write(`gsd-pre-exec:   ${checkEmoji} [${check.category}] ${check.target}: ${check.message}\n`);
                 }
                 // Write evidence JSON to slice artifacts directory
-                const slicePath = resolveSlicePath(s.basePath, mid, sid);
+                const slicePath = resolveSlicePath(preExecutionBasePath, mid, sid);
                 const evidenceFileName = `${sid}-PRE-EXEC-VERIFY.json`;
                 let evidencePath = join(".gsd", "milestones", mid, "slices", sid, evidenceFileName);
                 if (slicePath) {
                     writePreExecutionEvidence(result, slicePath, mid, sid);
-                    evidencePath = relative(s.basePath, join(slicePath, evidenceFileName)) || evidenceFileName;
+                    evidencePath = relative(preExecutionBasePath, join(slicePath, evidenceFileName)) || evidenceFileName;
                 }
                 if (uokFlags.gates) {
                     const failedChecks = result.checks
@@ -1187,6 +1190,9 @@ export async function postUnitPostVerification(pctx) {
                         blockingFindings: blockingChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
                         verdictExcerpt: `status=${result.status}; ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} detected`,
                     };
+                    // Track consecutive pre-exec failures per slice for loop detection.
+                    const retryKey = currentUnit.id;
+                    s.preExecRetryCount.set(retryKey, (s.preExecRetryCount.get(retryKey) ?? 0) + 1);
                     preExecPauseNeeded = true;
                 }
                 else if (result.status === "warn") {
@@ -1199,9 +1205,16 @@ export async function postUnitPostVerification(pctx) {
                             blockingFindings: warnChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
                             verdictExcerpt: `status=${result.status} (strict mode); ${warnChecks.length} warning${warnChecks.length === 1 ? "" : "s"} treated as blocking`,
                         };
+                        const retryKey = currentUnit.id;
+                        s.preExecRetryCount.set(retryKey, (s.preExecRetryCount.get(retryKey) ?? 0) + 1);
                         preExecPauseNeeded = true;
                     }
                 }
+                // Reset the retry counter when checks pass — a successful re-plan
+                // should not carry over a stale failure count into future slices.
+                if (result.status === "pass") {
+                    s.preExecRetryCount.delete(currentUnit.id);
+                }
                 debugLog("postUnitPostVerification", {
                     phase: "pre-execution-checks",
                     status: result.status,