gsd-pi 2.81.0-dev.72a81bdf3 → 2.82.0-dev.2841a1e44

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -7,8 +7,8 @@
  *
  * Split into two functions called sequentially by auto-loop with
  * the verification gate between them:
- *   1. postUnitPreVerification() — commit, doctor, state rebuild, worktree sync, artifact verification
- *   2. postUnitPostVerification() — DB dual-write, hooks, triage, quick-tasks
+ *   1. postUnitPreVerification() — closeout git for non-task units, doctor, state rebuild, worktree sync, artifact verification
+ *   2. postUnitPostVerification() — post-verified task git, DB dual-write, hooks, triage, quick-tasks
  *
  * Extracted from the pre-loop agent_end handler in auto.ts.
  */
@@ -37,8 +37,7 @@ import { debugLog } from "./debug-logger.js";
 import { runSafely } from "./auto-utils.js";
 import { getEvidence, clearEvidenceFromDisk } from "./safety/evidence-collector.js";
 import { validateFileChanges } from "./safety/file-change-validator.js";
-// crossReferenceEvidence available for future use when verification_evidence is stored in DB
-// import { crossReferenceEvidence, type ClaimedEvidence } from "./safety/evidence-cross-ref.js";
+import { crossReferenceEvidence } from "./safety/evidence-cross-ref.js";
 import { validateContent } from "./safety/content-validator.js";
 import { resolveSafetyHarnessConfig } from "./safety/safety-harness.js";
 import { resolveExpectedArtifactPath as resolveArtifactForContent } from "./auto-artifact-paths.js";
@@ -171,6 +170,9 @@ export function _shouldDispatchQuickTaskForTest(state) {
         !!state.currentUnit &&
         state.currentUnit.type !== "quick-task";
 }
+export function shouldDeferCloseoutGitAction(unitType) {
+    return unitType === "execute-task";
+}
 /** Unit types that only touch `.gsd/` internal state files (no code changes).
  *  Auto-commit is skipped for these — their state files are picked up by the
  *  next actual task commit via `smartStage()`. */
@@ -360,6 +362,124 @@ export async function autoCommitUnit(basePath, unitType, unitId, ctx) {
         return null;
     }
 }
+async function runCloseoutGitAction(pctx, unit) {
+    const { s, ctx, pi, pauseAuto } = pctx;
+    const prefs = loadEffectiveGSDPreferences()?.preferences;
+    const uokFlags = resolveUokFlags(prefs);
+    const turnAction = uokFlags.gitops ? uokFlags.gitopsTurnAction : "commit";
+    const traceId = s.currentTraceId ?? `turn:${unit.startedAt}`;
+    const turnId = s.currentTurnId ?? `${unit.type}/${unit.id}/${unit.startedAt}`;
+    s.lastGitActionFailure = null;
+    s.lastGitActionStatus = null;
+    try {
+        let taskContext;
+        if (turnAction === "commit" && unit.type === "execute-task") {
+            taskContext = await buildTaskCommitContextForUnit(s.basePath, unit.id);
+        }
+        // Invalidate the nativeHasChanges cache before auto-commit (#1853).
+        // The cache has a 10-second TTL and is keyed by basePath. A stale
+        // `false` result causes autoCommit to skip staging entirely.
+        _resetHasChangesCache();
+        const skipLifecycleCommit = turnAction === "commit" && LIFECYCLE_ONLY_UNITS.has(unit.type);
+        if (skipLifecycleCommit) {
+            debugLog("postUnit", {
+                phase: "git-action-skipped",
+                reason: "lifecycle-only-unit",
+                unitType: unit.type,
+                unitId: unit.id,
+            });
+        }
+        else {
+            const gitResult = runTurnGitAction({
+                basePath: s.basePath,
+                action: turnAction,
+                unitType: unit.type,
+                unitId: unit.id,
+                taskContext,
+            });
+            if (uokFlags.gitops) {
+                writeTurnGitTransaction({
+                    basePath: s.basePath,
+                    traceId,
+                    turnId,
+                    unitType: unit.type,
+                    unitId: unit.id,
+                    stage: "publish",
+                    action: turnAction,
+                    push: uokFlags.gitopsTurnPush,
+                    status: gitResult.status,
+                    error: gitResult.error,
+                    metadata: {
+                        dirty: gitResult.dirty,
+                        commitMessage: gitResult.commitMessage,
+                        snapshotLabel: gitResult.snapshotLabel,
+                    },
+                });
+            }
+            if (gitResult.status === "failed") {
+                s.lastGitActionFailure = gitResult.error ?? `git ${turnAction} failed`;
+                s.lastGitActionStatus = "failed";
+                if (uokFlags.gitops && uokFlags.gates) {
+                    const parsed = parseUnitId(unit.id);
+                    const gateRunner = new UokGateRunner();
+                    gateRunner.register({
+                        id: "closeout-git-action",
+                        type: "closeout",
+                        execute: async () => ({
+                            outcome: "fail",
+                            failureClass: "git",
+                            rationale: `turn git action "${turnAction}" failed`,
+                            findings: gitResult.error ?? "unknown git failure",
+                        }),
+                    });
+                    await gateRunner.run("closeout-git-action", {
+                        basePath: s.basePath,
+                        traceId,
+                        turnId,
+                        milestoneId: parsed.milestone ?? undefined,
+                        sliceId: parsed.slice ?? undefined,
+                        taskId: parsed.task ?? undefined,
+                        unitType: unit.type,
+                        unitId: unit.id,
+                    });
+                }
+                const failureMsg = `Git ${turnAction} failed: ${(gitResult.error ?? "unknown error").split("\n")[0]}`;
+                ctx.ui.notify(failureMsg, "error");
+                debugLog("postUnit", {
+                    phase: "git-action-failed-blocking",
+                    action: turnAction,
+                    error: gitResult.error ?? "unknown error",
+                });
+                await pauseAuto(ctx, pi);
+                return "dispatched";
+            }
+            s.lastGitActionStatus = "ok";
+            if (turnAction === "commit" && gitResult.commitMessage) {
+                ctx.ui.notify(`Committed: ${gitResult.commitMessage.split("\n")[0]}`, "info");
+            }
+            else if (turnAction === "snapshot" && gitResult.snapshotLabel) {
+                ctx.ui.notify(`Snapshot recorded: ${gitResult.snapshotLabel}`, "info");
+            }
+        }
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        s.lastGitActionFailure = message;
+        s.lastGitActionStatus = "failed";
+        debugLog("postUnit", { phase: "git-action", error: message, action: turnAction });
+        ctx.ui.notify(`Git ${turnAction} failed: ${message.split("\n")[0]}`, uokFlags.gitops ? "error" : "warning");
+        if (uokFlags.gitops) {
+            await pauseAuto(ctx, pi);
+            return "dispatched";
+        }
+    }
+    // GitHub sync (non-blocking, opt-in)
+    await runSafely("postUnit", "github-sync", async () => {
+        const { runGitHubSync } = await import("../github-sync/sync.js");
+        await runGitHubSync(s.basePath, unit.type, unit.id);
+    });
+    return "continue";
+}
 /**
  * Pre-verification processing: parallel worker signal check, cache invalidation,
  * auto-commit, doctor run, state rebuild, worktree sync, artifact verification.
@@ -370,7 +490,7 @@ export async function autoCommitUnit(basePath, unitType, unitId, ctx) {
  * - "retry" — artifact verification failed, s.pendingVerificationRetry set for loop re-iteration
  */
 export async function postUnitPreVerification(pctx, opts) {
-    const { s, ctx, pi, buildSnapshotOpts, stopAuto, pauseAuto } = pctx;
+    const { s, ctx, pi, stopAuto, pauseAuto } = pctx;
     // ── Parallel worker signal check ──
     const milestoneLock = process.env.GSD_MILESTONE_LOCK;
     if (milestoneLock) {
@@ -392,125 +512,22 @@ export async function postUnitPreVerification(pctx, opts) {
     if (!opts?.skipSettleDelay) {
         await new Promise(r => setTimeout(r, 100));
     }
-    const prefs = loadEffectiveGSDPreferences()?.preferences;
-    const uokFlags = resolveUokFlags(prefs);
     // Turn-level git action (commit | snapshot | status-only)
     if (s.currentUnit) {
         const unit = s.currentUnit;
-        const turnAction = uokFlags.gitops ? uokFlags.gitopsTurnAction : "commit";
-        const traceId = s.currentTraceId ?? `turn:${unit.startedAt}`;
-        const turnId = s.currentTurnId ?? `${unit.type}/${unit.id}/${unit.startedAt}`;
-        s.lastGitActionFailure = null;
-        s.lastGitActionStatus = null;
-        try {
-            let taskContext;
-            if (turnAction === "commit" && s.currentUnit.type === "execute-task") {
-                taskContext = await buildTaskCommitContextForUnit(s.basePath, s.currentUnit.id);
-            }
-            // Invalidate the nativeHasChanges cache before auto-commit (#1853).
-            // The cache has a 10-second TTL and is keyed by basePath.  A stale
-            // `false` result causes autoCommit to skip staging entirely, leaving
-            // code files only in the working tree where they are destroyed by
-            // `git worktree remove --force` during teardown.
-            _resetHasChangesCache();
-            const skipLifecycleCommit = turnAction === "commit" && LIFECYCLE_ONLY_UNITS.has(s.currentUnit.type);
-            if (skipLifecycleCommit) {
-                debugLog("postUnit", {
-                    phase: "git-action-skipped",
-                    reason: "lifecycle-only-unit",
-                    unitType: s.currentUnit.type,
-                    unitId: s.currentUnit.id,
-                });
-            }
-            else {
-                const gitResult = runTurnGitAction({
-                    basePath: s.basePath,
-                    action: turnAction,
-                    unitType: s.currentUnit.type,
-                    unitId: s.currentUnit.id,
-                    taskContext,
-                });
-                if (uokFlags.gitops) {
-                    writeTurnGitTransaction({
-                        basePath: s.basePath,
-                        traceId,
-                        turnId,
-                        unitType: unit.type,
-                        unitId: unit.id,
-                        stage: "publish",
-                        action: turnAction,
-                        push: uokFlags.gitopsTurnPush,
-                        status: gitResult.status,
-                        error: gitResult.error,
-                        metadata: {
-                            dirty: gitResult.dirty,
-                            commitMessage: gitResult.commitMessage,
-                            snapshotLabel: gitResult.snapshotLabel,
-                        },
-                    });
-                }
-                if (gitResult.status === "failed") {
-                    s.lastGitActionFailure = gitResult.error ?? `git ${turnAction} failed`;
-                    s.lastGitActionStatus = "failed";
-                    if (uokFlags.gitops && uokFlags.gates) {
-                        const parsed = parseUnitId(unit.id);
-                        const gateRunner = new UokGateRunner();
-                        gateRunner.register({
-                            id: "closeout-git-action",
-                            type: "closeout",
-                            execute: async () => ({
-                                outcome: "fail",
-                                failureClass: "git",
-                                rationale: `turn git action "${turnAction}" failed`,
-                                findings: gitResult.error ?? "unknown git failure",
-                            }),
-                        });
-                        await gateRunner.run("closeout-git-action", {
-                            basePath: s.basePath,
-                            traceId,
-                            turnId,
-                            milestoneId: parsed.milestone ?? undefined,
-                            sliceId: parsed.slice ?? undefined,
-                            taskId: parsed.task ?? undefined,
-                            unitType: unit.type,
-                            unitId: unit.id,
-                        });
-                    }
-                    const failureMsg = `Git ${turnAction} failed: ${(gitResult.error ?? "unknown error").split("\n")[0]}`;
-                    ctx.ui.notify(failureMsg, "error");
-                    debugLog("postUnit", {
-                        phase: "git-action-failed-blocking",
-                        action: turnAction,
-                        error: gitResult.error ?? "unknown error",
-                    });
-                    await pauseAuto(ctx, pi);
-                    return "dispatched";
-                }
-                s.lastGitActionStatus = "ok";
-                if (turnAction === "commit" && gitResult.commitMessage) {
-                    ctx.ui.notify(`Committed: ${gitResult.commitMessage.split("\n")[0]}`, "info");
-                }
-                else if (turnAction === "snapshot" && gitResult.snapshotLabel) {
-                    ctx.ui.notify(`Snapshot recorded: ${gitResult.snapshotLabel}`, "info");
-                }
-            }
+        if (shouldDeferCloseoutGitAction(unit.type)) {
+            debugLog("postUnit", {
+                phase: "git-action-deferred-until-verification",
+                unitType: unit.type,
+                unitId: unit.id,
+            });
         }
-        catch (e) {
-            const message = e instanceof Error ? e.message : String(e);
-            s.lastGitActionFailure = message;
-            s.lastGitActionStatus = "failed";
-            debugLog("postUnit", { phase: "git-action", error: message, action: turnAction });
-            ctx.ui.notify(`Git ${turnAction} failed: ${message.split("\n")[0]}`, uokFlags.gitops ? "error" : "warning");
-            if (uokFlags.gitops) {
-                await pauseAuto(ctx, pi);
+        else {
+            const gitActionResult = await runCloseoutGitAction(pctx, unit);
+            if (gitActionResult === "dispatched") {
                 return "dispatched";
             }
         }
-        // GitHub sync (non-blocking, opt-in)
-        await runSafely("postUnit", "github-sync", async () => {
-            const { runGitHubSync } = await import("../github-sync/sync.js");
-            await runGitHubSync(s.basePath, unit.type, unit.id);
-        });
         // Prune dead bg-shell processes
         await runSafely("postUnit", "prune-bg-shell", async () => {
             const { pruneDeadProcesses } = await import("../bg-shell/process-manager.js");
@@ -723,7 +740,7 @@ export async function postUnitPreVerification(pctx, opts) {
             const safetyConfig = resolveSafetyHarnessConfig(prefs?.safety_harness);
             if (safetyConfig.enabled) {
                 const { milestone: sMid, slice: sSid, task: sTid } = parseUnitId(s.currentUnit.id);
-                // File change validation (execute-task only, after auto-commit)
+                // File change validation (execute-task only, after unit execution)
                 if (safetyConfig.file_change_validation && s.currentUnit.type === "execute-task" && sMid && sSid && sTid && isDbAvailable()) {
                     try {
                         const taskRow = getTask(sMid, sSid, sTid);
@@ -756,12 +773,34 @@ export async function postUnitPreVerification(pctx, opts) {
                         const bashCalls = actual.filter(e => e.kind === "bash");
                         if (sMid && sSid && sTid && isDbAvailable()) {
                             const taskRow = getTask(sMid, sSid, sTid);
-                            const claimedCommands = getVerificationEvidence(sMid, sSid, sTid)
-                                .map((row) => row.command)
-                                .filter((command) => typeof command === "string" && command.trim().length > 0);
-                            if (taskRow?.status === "complete" && claimedCommands.length > 0 && bashCalls.length === 0) {
-                                logWarning("safety", "task claimed verification command evidence but no execution tool calls were recorded");
-                                ctx.ui.notify(`Safety: task ${sTid} claimed command evidence but no execution tool calls were recorded`, "warning");
+                            if (taskRow?.status === "complete") {
+                                const claimedEvidence = getVerificationEvidence(sMid, sSid, sTid)
+                                    .map((row) => ({
+                                    command: row.command,
+                                    exitCode: row.exit_code,
+                                    verdict: row.verdict,
+                                }))
+                                    .filter((row) => typeof row.command === "string" && row.command.trim().length > 0);
+                                const mismatches = crossReferenceEvidence(claimedEvidence, actual);
+                                for (const mismatch of mismatches) {
+                                    const logMessage = `evidence-xref: ${mismatch.reason}`;
+                                    if (mismatch.severity === "error") {
+                                        logError("safety", logMessage);
+                                    }
+                                    else {
+                                        logWarning("safety", logMessage);
+                                    }
+                                }
+                                if (claimedEvidence.length > 0 && bashCalls.length === 0) {
+                                    logWarning("safety", "task claimed verification command evidence but no execution tool calls were recorded");
+                                    ctx.ui.notify(`Safety: task ${sTid} claimed command evidence but no execution tool calls were recorded`, "warning");
+                                }
+                                const blockingMismatch = mismatches.find((mismatch) => mismatch.severity === "error");
+                                if (blockingMismatch) {
+                                    ctx.ui.notify(`Safety: task ${sTid} claimed passing verification that failed in recorded execution`, "error");
+                                    await pauseAuto(ctx, pi);
+                                    return "dispatched";
+                                }
                             }
                         }
                     }
@@ -992,6 +1031,12 @@ export async function postUnitPreVerification(pctx, opts) {
 export async function postUnitPostVerification(pctx) {
     const { s, ctx, pi, buildSnapshotOpts, lockBase, stopAuto, pauseAuto, updateProgressWidget } = pctx;
     if (s.currentUnit) {
+        if (shouldDeferCloseoutGitAction(s.currentUnit.type)) {
+            const gitActionResult = await runCloseoutGitAction(pctx, s.currentUnit);
+            if (gitActionResult === "dispatched") {
+                return "stopped";
+            }
+        }
         try {
             const codebasePrefs = loadEffectiveGSDPreferences()?.preferences?.codebase;
             const refresh = ensureCodebaseMapFresh(s.basePath, codebasePrefs

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -728,12 +728,20 @@ export async function inlineDecisionsFromDb(base, milestoneId, scope, level) {
     try {
         const { isDbAvailable } = await import("./gsd-db.js");
         if (isDbAvailable()) {
-            const { queryDecisions, formatDecisionsForPrompt } = await import("./context-store.js");
+            // ADR-013 Phase 6 cutover (Stage 1): read decisions from the `memories`
+            // table. Both `queryDecisions` (legacy) and `queryDecisionsFromMemories`
+            // return identical Decision[] for active rows once Phase 5 dual-write is
+            // caught up. Switching the read here lets the destructive Phase 6 step
+            // (#5755) retire the legacy `decisions` table without changing prompt
+            // contents. Projection regen (`DECISIONS.md`) still sources from the
+            // legacy table — that switch lands separately to handle superseded
+            // history cleanly.
+            const { queryDecisionsFromMemories, formatDecisionsForPrompt } = await import("./context-store.js");
             // First query: try with both milestoneId and scope (if scope provided)
-            let decisions = queryDecisions({ milestoneId, scope });
+            let decisions = queryDecisionsFromMemories({ milestoneId, scope });
             // Cascade: if empty AND scope was provided, retry without scope
             if (decisions.length === 0 && scope) {
-                decisions = queryDecisions({ milestoneId });
+                decisions = queryDecisionsFromMemories({ milestoneId });
             }
             if (decisions.length > 0) {
                 // Use compact format for non-full levels to save ~35% tokens
@@ -2769,7 +2777,7 @@ export async function buildParallelResearchSlicesPrompt(mid, midTitle, slices, b
         subagentSections.push([
             `### ${slice.id}: ${slice.title}`,
             "",
-            `Use this as the prompt for a \`subagent\` call${modelSuffix} (agent: \`gsd-executor\` or the default agent):`,
+            `Use this as the prompt for a \`subagent\` call${modelSuffix} (agent: \`scout\`):`,
             "",
             "```",
             slicePrompt,
@@ -2838,7 +2846,7 @@ export async function buildGateEvaluatePrompt(mid, midTitle, sid, sTitle, base,
         subagentSections.push([
             `### ${def.id}: ${def.question}`,
             "",
-            `Use this as the prompt for a \`subagent\` call${modelSuffix}:`,
+            `Use this as the prompt for a \`subagent\` call${modelSuffix} (agent: \`tester\`):`,
             "",
             "```",
             subPrompt,

package/dist/resources/extensions/gsd/auto-verification.js

@@ -18,9 +18,7 @@ import { join } from "node:path";
 import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
-function isInfraVerificationFailure(stderr) {
-    return /\b(ENOENT|ENOTFOUND|ETIMEDOUT|ECONNRESET|EAI_AGAIN|spawn\s+\S+\s+ENOENT|command not found)\b/i.test(stderr);
-}
+import { decideVerificationVerdict } from "./verification-verdict.js";
 /**
  * Post-unit guard for `validate-milestone` units (#4094).
  *
@@ -128,7 +126,7 @@ async function countIncompleteSlices(basePath, milestoneId) {
 /**
  * Run the verification gate for the current execute-task unit.
  * Returns:
- * - "continue" — gate passed (or no checks configured), proceed normally
+ * - "continue" — host-owned verification passed, proceed normally
  * - "retry" — gate failed with retries remaining, s.pendingVerificationRetry set for loop re-iteration
  * - "pause" — gate failed with retries exhausted, pauseAuto already called
  */
@@ -178,6 +176,10 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                 process.stderr.write(`  [${w.severity}] ${w.name}: ${w.title}\n`);
             }
         }
+        const verdict = decideVerificationVerdict(s.currentUnit.type, result);
+        if (!verdict.passed) {
+            result.passed = false;
+        }
         if (uokFlags.gates) {
             const gateRunner = new UokGateRunner();
             gateRunner.register({
@@ -190,10 +192,12 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                         : "verification",
                     rationale: result.passed
                         ? "verification checks passed"
-                        : "verification checks failed",
+                        : verdict.reason === "no-host-checks"
+                            ? "no runnable host-owned verification checks discovered"
+                            : "verification checks failed",
                     findings: result.passed
                         ? ""
-                        : formatFailureContext(result),
+                        : verdict.failureContext || formatFailureContext(result),
                 }),
             });
             await gateRunner.run("verification-gate", {
@@ -251,7 +255,11 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                     }
                     else {
                         const nextAttempt = attempt + 1;
-                        writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id, nextAttempt, maxRetries);
+                        const includeRetryMetadata = !result.passed &&
+                            verdict.retryable &&
+                            autoFixEnabled &&
+                            nextAttempt <= maxRetries;
+                        writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id, includeRetryMetadata ? nextAttempt : undefined, includeRetryMetadata ? maxRetries : undefined);
                     }
                 }
             }
@@ -259,18 +267,6 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                 logWarning("engine", `verification-evidence write error: ${evidenceErr.message}`);
             }
         }
-        const advisoryFailure = !result.passed &&
-            (result.discoverySource === "package-json" ||
-                result.checks.some((check) => isInfraVerificationFailure(check.stderr)));
-        if (advisoryFailure) {
-            s.verificationRetryCount.delete(retryKey);
-            s.verificationRetryFailureHashes.delete(retryKey);
-            s.pendingVerificationRetry = null;
-            ctx.ui.notify(result.discoverySource === "package-json"
-                ? "Verification failed in auto-discovered package.json checks — treating as advisory."
-                : "Verification failed due to infrastructure/runtime environment issues — treating as advisory.", "warning");
-            return "continue";
-        }
         // ── Post-execution checks (run after main verification passes for execute-task units) ──
         let postExecChecks;
         let postExecBlockingFailure = false;
@@ -430,6 +426,15 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
             s.pendingVerificationRetry = null;
             return "continue";
         }
+        else if (verdict.reason === "no-host-checks") {
+            s.verificationRetryCount.delete(retryKey);
+            s.verificationRetryFailureHashes.delete(retryKey);
+            s.pendingVerificationRetry = null;
+            ctx.ui.notify("Verification gate FAILED — no runnable host-owned verification checks were discovered. Pausing for human review.", "error");
+            process.stderr.write(`verification-gate: ${verdict.failureContext}\n`);
+            await pauseAuto(ctx, pi);
+            return "pause";
+        }
         else if (postExecBlockingFailure) {
             // Post-execution failures are cross-task consistency issues — retrying the same task won't fix them.
             // Skip retry and pause immediately for human review.
@@ -445,7 +450,7 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
             s.verificationRetryCount.set(retryKey, nextAttempt);
             s.pendingVerificationRetry = {
                 unitId: s.currentUnit.id,
-                failureContext: formatFailureContext(result),
+                failureContext: verdict.failureContext || formatFailureContext(result),
                 attempt: nextAttempt,
             };
             const failedCmds = result.checks
@@ -475,9 +480,10 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
         }
     }
     catch (err) {
-        // Gate errors are non-fatal
         logWarning("engine", `verification-gate error: ${err.message}`);
-        return "continue";
+        ctx.ui.notify(`Verification gate errored before producing an authoritative verdict: ${err.message}`, "error");
+        await pauseAuto(ctx, pi);
+        return "pause";
     }
 }
 /**