gsd-pi 2.81.0 → 2.82.0-dev.ed17d078d

package/dist/resources/extensions/gsd/auto/orchestrator.js

@@ -3,6 +3,15 @@
 function now() {
     return Date.now();
 }
+/**
+ * Size of the dispatch-decision ring buffer used by the Auto Orchestration
+ * module's stuck-loop detector. When the same `${unitType}:${unitId}` key
+ * fills the window, advance() blocks with `action: "stop"`.
+ *
+ * Mirrors the legacy `STUCK_WINDOW_SIZE` in auto/phases.ts so behaviour is
+ * preserved across the eventual cutover (issue #5791).
+ */
+export const STUCK_WINDOW_SIZE = 6;
 export class AutoOrchestrator {
     status = {
         phase: "idle",
@@ -10,11 +19,13 @@ export class AutoOrchestrator {
     };
     deps;
     lastAdvanceKey = null;
+    dispatchKeyWindow = [];
     constructor(deps) {
         this.deps = deps;
     }
     async start(_sessionContext) {
         this.lastAdvanceKey = null;
+        this.dispatchKeyWindow = [];
         this.status.phase = "running";
         this.bumpTransition();
         await this.deps.runtime.journalTransition({ name: "start" });
@@ -24,18 +35,70 @@ export class AutoOrchestrator {
     async advance() {
         try {
             await this.deps.runtime.ensureLockOwnership();
+            const staleMsg = this.deps.health.checkResourcesStale();
+            if (staleMsg) {
+                await this.deps.uokGate.emit({
+                    gateId: "resource-version-guard",
+                    gateType: "policy",
+                    outcome: "fail",
+                    failureClass: "policy",
+                    rationale: "resource version guard blocked dispatch",
+                    findings: staleMsg,
+                });
+                const blocked = { kind: "blocked", reason: staleMsg, action: "stop" };
+                await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
+                await this.deps.health.postAdvanceRecord(blocked);
+                return blocked;
+            }
+            await this.deps.uokGate.emit({
+                gateId: "resource-version-guard",
+                gateType: "policy",
+                outcome: "pass",
+                failureClass: "none",
+                rationale: "resource version guard passed",
+            });
             const gate = await this.deps.health.preAdvanceGate();
-            if (!gate.allow) {
-                const blocked = { kind: "blocked", reason: gate.reason ?? "health gate blocked" };
+            if (gate.kind === "fail") {
+                await this.deps.uokGate.emit({
+                    gateId: "pre-dispatch-health-gate",
+                    gateType: "execution",
+                    outcome: "manual-attention",
+                    failureClass: "manual-attention",
+                    rationale: "pre-dispatch health gate blocked dispatch",
+                    findings: gate.reason,
+                });
+                const blocked = { kind: "blocked", reason: gate.reason, action: "pause" };
                 await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
                 await this.deps.health.postAdvanceRecord(blocked);
                 return blocked;
             }
+            if (gate.kind === "threw") {
+                await this.deps.uokGate.emit({
+                    gateId: "pre-dispatch-health-gate",
+                    gateType: "execution",
+                    outcome: "manual-attention",
+                    failureClass: "manual-attention",
+                    rationale: "pre-dispatch health gate threw unexpectedly",
+                    findings: String(gate.error),
+                });
+                // intentional fall-through: matches runPreDispatch behaviour
+            }
+            else {
+                await this.deps.uokGate.emit({
+                    gateId: "pre-dispatch-health-gate",
+                    gateType: "execution",
+                    outcome: "pass",
+                    failureClass: "none",
+                    rationale: "pre-dispatch health gate passed",
+                    findings: gate.fixesApplied?.join(", ") ?? "",
+                });
+            }
             const reconciliation = await this.deps.stateReconciliation.reconcileBeforeDispatch();
             if (!reconciliation.ok || !reconciliation.stateSnapshot) {
                 const blocked = {
                     kind: "blocked",
-                    reason: reconciliation.reason,
+                    reason: reconciliation.reason ?? "state reconciliation produced no snapshot",
+                    action: "pause",
                     stateSnapshot: reconciliation.stateSnapshot,
                 };
                 await this.deps.runtime.journalTransition({ name: "advance-blocked", reason: blocked.reason });
@@ -48,14 +111,49 @@ export class AutoOrchestrator {
                 this.status.phase = "stopped";
                 this.status.activeUnit = undefined;
                 this.lastAdvanceKey = null;
+                this.dispatchKeyWindow = [];
                 this.bumpTransition();
                 await this.deps.runtime.journalTransition({ name: "advance-stopped", reason: stopped.reason });
                 await this.deps.health.postAdvanceRecord(stopped);
                 return stopped;
             }
             const nextKey = `${decision.unitType}:${decision.unitId}`;
-            if (this.lastAdvanceKey === nextKey) {
-                const blocked = { kind: "blocked", reason: "idempotent advance: unit already active" };
+            // Record every dispatch decision in the ring buffer before pre-flight
+            // checks so the stuck-loop detector observes the full decision history
+            // (including decisions that idempotency would otherwise short-circuit).
+            // The ring is capped at STUCK_WINDOW_SIZE and evicts oldest-first.
+            this.dispatchKeyWindow.push(nextKey);
+            if (this.dispatchKeyWindow.length > STUCK_WINDOW_SIZE) {
+                this.dispatchKeyWindow.shift();
+            }
+            // Idempotency: same key as immediately previous successful advance.
+            // This is the soft, fast-path block kept from #5786. It only fires when
+            // the ring is NOT yet saturated for this key — once the ring is full of
+            // `nextKey`, the stuck-loop verdict takes precedence (see below). Both
+            // checks coexist: idempotency for the common immediate-repeat case,
+            // stuck-loop for the saturated-window case.
+            const matchingCount = this.dispatchKeyWindow.filter((k) => k === nextKey).length;
+            if (this.lastAdvanceKey === nextKey && matchingCount < STUCK_WINDOW_SIZE) {
+                const blocked = { kind: "blocked", reason: "idempotent advance: unit already active", action: "stop" };
+                await this.deps.runtime.journalTransition({
+                    name: "advance-blocked",
+                    reason: blocked.reason,
+                    unitType: decision.unitType,
+                    unitId: decision.unitId,
+                });
+                await this.deps.health.postAdvanceRecord(blocked);
+                return blocked;
+            }
+            // Stuck-loop detection: when the ring is saturated with copies of
+            // `nextKey` (count >= STUCK_WINDOW_SIZE), the orchestrator has been
+            // picking the same unit across the whole window and must hard-stop with
+            // a diagnosable reason.
+            if (matchingCount >= STUCK_WINDOW_SIZE) {
+                const blocked = {
+                    kind: "blocked",
+                    reason: `stuck-loop: ${nextKey} picked ${matchingCount} times`,
+                    action: "stop",
+                };
                 await this.deps.runtime.journalTransition({
                     name: "advance-blocked",
                     reason: blocked.reason,
@@ -70,6 +168,7 @@ export class AutoOrchestrator {
                 const blocked = {
                     kind: "blocked",
                     reason: contract.reason,
+                    action: "pause",
                     stateSnapshot: reconciliation.stateSnapshot,
                 };
                 await this.deps.runtime.journalTransition({
@@ -86,6 +185,7 @@ export class AutoOrchestrator {
                 const blocked = {
                     kind: "blocked",
                     reason: worktree.reason,
+                    action: "pause",
                     stateSnapshot: reconciliation.stateSnapshot,
                 };
                 await this.deps.runtime.journalTransition({
@@ -108,7 +208,11 @@ export class AutoOrchestrator {
                 unitId: decision.unitId,
             });
             await this.deps.worktree.syncAfterUnit(decision.unitType, decision.unitId);
-            const advanced = { kind: "advanced", stateSnapshot: reconciliation.stateSnapshot };
+            const advanced = {
+                kind: "advanced",
+                unit: { unitType: decision.unitType, unitId: decision.unitId },
+                stateSnapshot: reconciliation.stateSnapshot,
+            };
             await this.deps.health.postAdvanceRecord(advanced);
             return advanced;
         }
@@ -134,6 +238,7 @@ export class AutoOrchestrator {
             }
             if (result.kind === "stopped") {
                 this.lastAdvanceKey = null;
+                this.dispatchKeyWindow = [];
                 this.status.activeUnit = undefined;
             }
             this.bumpTransition();
@@ -158,6 +263,7 @@ export class AutoOrchestrator {
     }
     async resume() {
         this.lastAdvanceKey = null;
+        this.dispatchKeyWindow = [];
         this.status.phase = "running";
         this.bumpTransition();
         await this.deps.runtime.journalTransition({ name: "resume" });
@@ -172,6 +278,7 @@ export class AutoOrchestrator {
         this.status.phase = "stopped";
         this.status.activeUnit = undefined;
         this.lastAdvanceKey = null;
+        this.dispatchKeyWindow = [];
         this.bumpTransition();
         await this.deps.runtime.journalTransition({ name: "stop", reason });
         await this.deps.notifications.notifyLifecycle({ name: "stop", detail: reason });

package/dist/resources/extensions/gsd/auto/phases.js

@@ -31,6 +31,7 @@ import { withTimeout, FINALIZE_PRE_TIMEOUT_MS, FINALIZE_POST_TIMEOUT_MS } from "
 import { getEligibleSlices } from "../slice-parallel-eligibility.js";
 import { startSliceParallel } from "../slice-parallel-orchestrator.js";
 import { isDbAvailable, getMilestoneSlices } from "../gsd-db.js";
+import { reconcileBeforeSpawn } from "../state-reconciliation.js";
 import { ensurePlanV2Graph, isEmptyPlanV2GraphResult, isMissingFinalizedContextResult } from "../uok/plan-v2.js";
 import { resolveUokFlags } from "../uok/flags.js";
 import { UokGateRunner } from "../uok/gate-runner.js";
@@ -41,11 +42,53 @@ import { resolveSafetyHarnessConfig } from "../safety/safety-harness.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, supportsStructuredQuestions, } from "../workflow-mcp.js";
 import { resolveManifest } from "../unit-context-manifest.js";
 import { createWorktreeSafetyModule } from "../worktree-safety.js";
+import { isSuspiciousGhostCompletion } from "../auto-unit-closeout.js";
+import { decideVerificationRetry, verificationRetryKey } from "./verification-retry-policy.js";
 // ─── Path Comparison Helper ───────────────────────────────────────────────
 /** Compare two paths for physical identity, tolerating trailing slashes and symlinks. */
 function isSamePathLocal(a, b) {
     return normalizeWorktreePathForCompare(a) === normalizeWorktreePathForCompare(b);
 }
+async function applyVerificationRetryPolicy(ic, unitType, phase) {
+    const { ctx, pi, s, deps } = ic;
+    const retryInfo = s.pendingVerificationRetry;
+    const key = unitType && retryInfo
+        ? verificationRetryKey(unitType, retryInfo.unitId)
+        : undefined;
+    const decision = decideVerificationRetry({
+        unitType,
+        retryInfo,
+        previousFailureHash: key ? s.verificationRetryFailureHashes.get(key) : undefined,
+    });
+    if (decision.action === "pause") {
+        s.pendingVerificationRetry = null;
+        debugLog("autoLoop", {
+            phase: `${phase}-paused`,
+            reason: decision.reason,
+            unitType,
+            unitId: retryInfo?.unitId,
+            failureHash: decision.failureHash,
+        });
+        ctx.ui.notify(decision.reason === "duplicate-failure-context"
+            ? `Verification retry for ${unitType ?? "unit"} ${retryInfo?.unitId ?? "unknown"} produced the same failure context. Pausing auto-mode instead of re-dispatching.`
+            : "Verification retry requested without retry context. Pausing auto-mode instead of re-dispatching.", "warning");
+        await deps.pauseAuto(ctx, pi);
+        return { action: "break", reason: decision.reason };
+    }
+    s.verificationRetryFailureHashes.set(decision.key, decision.failureHash);
+    debugLog("autoLoop", {
+        phase: `${phase}-backoff`,
+        iteration: ic.iteration,
+        unitType,
+        unitId: retryInfo?.unitId,
+        attempt: retryInfo?.attempt,
+        delayMs: decision.delayMs,
+        baseDelayMs: decision.baseDelayMs,
+        failureHash: decision.failureHash,
+    });
+    await new Promise((resolve) => setTimeout(resolve, decision.delayMs));
+    return null;
+}
 export function shouldDegradeEmptyWorktreeToProjectRoot(worktreeClassification, projectRootClassification) {
     return (worktreeClassification.kind === "greenfield" &&
         projectRootClassification.kind !== "greenfield" &&
@@ -605,6 +648,13 @@ export async function runPreDispatch(ic, loopState) {
                         eligibleSlices: eligible.map(e => e.id),
                     });
                     ctx.ui.notify(`Slice-parallel: dispatching ${eligible.length} eligible slices for ${mid}.`, "info");
+                    // ADR-017 #5707: reconcile before spawning so each worker doesn't
+                    // independently race on the same drift. Failure aborts the spawn.
+                    const spawnGate = await reconcileBeforeSpawn(s.basePath);
+                    if (!spawnGate.ok) {
+                        ctx.ui.notify(`Slice-parallel: aborting spawn — ${spawnGate.reason}`, "error");
+                        return { action: "break", reason: `slice-parallel-reconciliation-failed: ${spawnGate.reason}` };
+                    }
                     const result = await startSliceParallel(s.basePath, mid, eligible, {
                         maxWorkers: prefs.slice_parallel.max_workers ?? 2,
                         useExecutionGraph: uokFlags.executionGraph,
@@ -726,7 +776,13 @@ export async function runPreDispatch(ic, loopState) {
             }
             deps.sendDesktopNotification("GSD", "All milestones complete!", "success", "milestone", basename(s.originalBasePath || s.basePath));
             deps.logCmuxEvent(prefs, "All milestones complete.", "success");
-            await deps.stopAuto(ctx, pi, "All milestones complete");
+            await deps.stopAuto(ctx, pi, "All milestones complete", {
+                completionWidget: {
+                    milestoneId: s.currentMilestoneId,
+                    milestoneTitle: midTitle,
+                    allMilestonesComplete: true,
+                },
+            });
         }
         else if (incomplete.length === 0 && state.registry.length === 0) {
             // Empty registry — no milestones visible, likely a path resolution bug
@@ -794,7 +850,16 @@ export async function runPreDispatch(ic, loopState) {
         }
         deps.sendDesktopNotification("GSD", `Milestone ${mid} complete!`, "success", "milestone", basename(s.originalBasePath || s.basePath));
         deps.logCmuxEvent(prefs, `Milestone ${mid} complete.`, "success");
-        await closeoutAndStop(ctx, pi, s, deps, `Milestone ${mid} complete`);
+        if (s.currentUnit) {
+            await deps.closeoutUnit(ctx, s.basePath, s.currentUnit.type, s.currentUnit.id, s.currentUnit.startedAt, deps.buildSnapshotOpts(s.currentUnit.type, s.currentUnit.id));
+            s.currentUnit = null;
+        }
+        await deps.stopAuto(ctx, pi, `Milestone ${mid} complete`, {
+            completionWidget: {
+                milestoneId: mid,
+                milestoneTitle: midTitle,
+            },
+        });
         debugLog("autoLoop", { phase: "exit", reason: "milestone-complete" });
         deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: ic.nextSeq(), eventType: "terminal", data: { reason: "milestone-complete", milestoneId: mid } });
         return { action: "break", reason: "milestone-complete" };
@@ -914,118 +979,115 @@ export async function runDispatch(ic, preData, loopState) {
         return worktreeSafetyBlock;
     // ── Sliding-window stuck detection with graduated recovery ──
     const derivedKey = `${unitType}/${unitId}`;
-    // Always record this dispatch in the sliding window so detectStuck() has
-    // accurate history. Skipping the push when pendingVerificationRetry is set
-    // caused infinite artifact-retry loops to be invisible to stuck detection
-    // (#2007). Only the *response* to a stuck signal is suppressed during retries.
+    // Always record this dispatch in the sliding window and run detection so
+    // Rules 1/3/4 can catch retry loops with repeated failure content (#5719).
+    // Rules 2/2b suppress legitimate retry backoff through the dispatch ledger.
     loopState.recentUnits.push({ key: derivedKey });
     if (loopState.recentUnits.length > STUCK_WINDOW_SIZE)
         loopState.recentUnits.shift();
-    if (!s.pendingVerificationRetry) {
-        const stuckSignal = detectStuck(loopState.recentUnits);
-        if (stuckSignal) {
-            debugLog("autoLoop", {
-                phase: "stuck-check",
-                unitType,
-                unitId,
-                reason: stuckSignal.reason,
-                recoveryAttempts: loopState.stuckRecoveryAttempts,
-            });
-            if (loopState.stuckRecoveryAttempts === 0) {
-                // Level 1: try verifying the artifact, then cache invalidation + retry
-                loopState.stuckRecoveryAttempts++;
-                const artifactExists = verifyExpectedArtifact(unitType, unitId, s.basePath);
-                if (artifactExists) {
-                    if (unitType === "complete-milestone") {
-                        const stuckDiag = diagnoseExpectedArtifact(unitType, unitId, s.basePath);
-                        const stuckParts = [
-                            `Detected ${unitType} ${unitId} output on disk, but the same unit is still being derived.`,
-                            "This usually means the milestone summary exists while the DB row still does not mark the milestone complete.",
-                        ];
-                        if (stuckDiag)
-                            stuckParts.push(`Expected: ${stuckDiag}`);
-                        ctx.ui.notify(stuckParts.join(" "), "warning");
-                        await deps.pauseAuto(ctx, pi);
-                        return { action: "break", reason: "complete-milestone-artifact-db-mismatch" };
-                    }
-                    debugLog("autoLoop", {
-                        phase: "stuck-recovery",
-                        level: 1,
-                        action: "artifact-found",
-                    });
-                    const recoveryDb = refreshRecoveryDbForArtifact(unitType, unitId);
-                    if (!recoveryDb.ok) {
-                        ctx.ui.notify(recoveryDb.fatal
-                            ? `${recoveryDb.message} Pausing auto-mode for manual recovery.`
-                            : `${recoveryDb.message} Keeping stuck state for retry.`, "warning");
-                        if (recoveryDb.fatal) {
-                            await deps.pauseAuto(ctx, pi);
-                            return { action: "break", reason: recoveryDb.reason };
-                        }
-                        return { action: "continue" };
-                    }
-                    ctx.ui.notify(`Stuck recovery: artifact for ${unitType} ${unitId} found on disk. Invalidating caches.`, "info");
-                    deps.invalidateAllCaches();
-                    loopState.recentUnits.length = 0;
-                    loopState.stuckRecoveryAttempts = 0;
-                    return { action: "continue" };
+    const stuckSignal = detectStuck(loopState.recentUnits);
+    if (stuckSignal) {
+        debugLog("autoLoop", {
+            phase: "stuck-check",
+            unitType,
+            unitId,
+            reason: stuckSignal.reason,
+            recoveryAttempts: loopState.stuckRecoveryAttempts,
+        });
+        if (loopState.stuckRecoveryAttempts === 0) {
+            // Level 1: try verifying the artifact, then cache invalidation + retry
+            loopState.stuckRecoveryAttempts++;
+            const artifactExists = verifyExpectedArtifact(unitType, unitId, s.basePath);
+            if (artifactExists) {
+                if (unitType === "complete-milestone") {
+                    const stuckDiag = diagnoseExpectedArtifact(unitType, unitId, s.basePath);
+                    const stuckParts = [
+                        `Detected ${unitType} ${unitId} output on disk, but the same unit is still being derived.`,
+                        "This usually means the milestone summary exists while the DB row still does not mark the milestone complete.",
+                    ];
+                    if (stuckDiag)
+                        stuckParts.push(`Expected: ${stuckDiag}`);
+                    ctx.ui.notify(stuckParts.join(" "), "warning");
+                    await deps.pauseAuto(ctx, pi);
+                    return { action: "break", reason: "complete-milestone-artifact-db-mismatch" };
                 }
-                ctx.ui.notify(`Stuck on ${unitType} ${unitId} (${stuckSignal.reason}). Invalidating caches and retrying.`, "warning");
-                deps.invalidateAllCaches();
-            }
-            else {
-                // Level 2: hard stop — genuinely stuck
-                deps.invalidateAllCaches();
-                const artifactExists = verifyExpectedArtifact(unitType, unitId, s.basePath);
-                if (artifactExists && unitType !== "complete-milestone") {
-                    debugLog("autoLoop", {
-                        phase: "stuck-recovery",
-                        level: 2,
-                        action: "artifact-found",
-                    });
-                    const recoveryDb = refreshRecoveryDbForArtifact(unitType, unitId);
-                    if (recoveryDb.ok) {
-                        ctx.ui.notify(`Stuck recovery: artifact for ${unitType} ${unitId} found on disk after cache invalidation. Continuing.`, "info");
-                        loopState.recentUnits.length = 0;
-                        loopState.stuckRecoveryAttempts = 0;
-                        return { action: "continue" };
-                    }
+                debugLog("autoLoop", {
+                    phase: "stuck-recovery",
+                    level: 1,
+                    action: "artifact-found",
+                });
+                const recoveryDb = refreshRecoveryDbForArtifact(unitType, unitId);
+                if (!recoveryDb.ok) {
                     ctx.ui.notify(recoveryDb.fatal
                         ? `${recoveryDb.message} Pausing auto-mode for manual recovery.`
-                        : `${recoveryDb.message} Stopping for manual recovery.`, "warning");
+                        : `${recoveryDb.message} Keeping stuck state for retry.`, "warning");
                     if (recoveryDb.fatal) {
                         await deps.pauseAuto(ctx, pi);
                         return { action: "break", reason: recoveryDb.reason };
                     }
+                    return { action: "continue" };
                 }
-                debugLog("autoLoop", {
-                    phase: "stuck-detected",
-                    unitType,
-                    unitId,
-                    reason: stuckSignal.reason,
-                });
-                const stuckDiag = diagnoseExpectedArtifact(unitType, unitId, s.basePath);
-                const stuckRemediation = buildLoopRemediationSteps(unitType, unitId, s.basePath);
-                const stuckParts = [`Stuck on ${unitType} ${unitId} — ${stuckSignal.reason}.`];
-                if (stuckDiag)
-                    stuckParts.push(`Expected: ${stuckDiag}`);
-                if (stuckRemediation)
-                    stuckParts.push(`To recover:\n${stuckRemediation}`);
-                ctx.ui.notify(stuckParts.join(" "), "error");
-                await deps.stopAuto(ctx, pi, `Stuck: ${stuckSignal.reason}`);
-                return { action: "break", reason: "stuck-detected" };
+                ctx.ui.notify(`Stuck recovery: artifact for ${unitType} ${unitId} found on disk. Invalidating caches.`, "info");
+                deps.invalidateAllCaches();
+                loopState.recentUnits.length = 0;
+                loopState.stuckRecoveryAttempts = 0;
+                return { action: "continue" };
             }
+            ctx.ui.notify(`Stuck on ${unitType} ${unitId} (${stuckSignal.reason}). Invalidating caches and retrying.`, "warning");
+            deps.invalidateAllCaches();
         }
         else {
-            // Progress detected — reset recovery counter
-            if (loopState.stuckRecoveryAttempts > 0) {
+            // Level 2: hard stop — genuinely stuck
+            deps.invalidateAllCaches();
+            const artifactExists = verifyExpectedArtifact(unitType, unitId, s.basePath);
+            if (artifactExists && unitType !== "complete-milestone") {
                 debugLog("autoLoop", {
-                    phase: "stuck-counter-reset",
-                    from: loopState.recentUnits[loopState.recentUnits.length - 2]?.key ?? "",
-                    to: derivedKey,
+                    phase: "stuck-recovery",
+                    level: 2,
+                    action: "artifact-found",
                 });
-                loopState.stuckRecoveryAttempts = 0;
+                const recoveryDb = refreshRecoveryDbForArtifact(unitType, unitId);
+                if (recoveryDb.ok) {
+                    ctx.ui.notify(`Stuck recovery: artifact for ${unitType} ${unitId} found on disk after cache invalidation. Continuing.`, "info");
+                    loopState.recentUnits.length = 0;
+                    loopState.stuckRecoveryAttempts = 0;
+                    return { action: "continue" };
+                }
+                ctx.ui.notify(recoveryDb.fatal
+                    ? `${recoveryDb.message} Pausing auto-mode for manual recovery.`
+                    : `${recoveryDb.message} Stopping for manual recovery.`, "warning");
+                if (recoveryDb.fatal) {
+                    await deps.pauseAuto(ctx, pi);
+                    return { action: "break", reason: recoveryDb.reason };
+                }
             }
+            debugLog("autoLoop", {
+                phase: "stuck-detected",
+                unitType,
+                unitId,
+                reason: stuckSignal.reason,
+            });
+            const stuckDiag = diagnoseExpectedArtifact(unitType, unitId, s.basePath);
+            const stuckRemediation = buildLoopRemediationSteps(unitType, unitId, s.basePath);
+            const stuckParts = [`Stuck on ${unitType} ${unitId} — ${stuckSignal.reason}.`];
+            if (stuckDiag)
+                stuckParts.push(`Expected: ${stuckDiag}`);
+            if (stuckRemediation)
+                stuckParts.push(`To recover:\n${stuckRemediation}`);
+            ctx.ui.notify(stuckParts.join(" "), "error");
+            await deps.stopAuto(ctx, pi, `Stuck: ${stuckSignal.reason}`);
+            return { action: "break", reason: "stuck-detected" };
+        }
+    }
+    else {
+        // Progress detected — reset recovery counter
+        if (loopState.stuckRecoveryAttempts > 0) {
+            debugLog("autoLoop", {
+                phase: "stuck-counter-reset",
+                from: loopState.recentUnits[loopState.recentUnits.length - 2]?.key ?? "",
+                to: derivedKey,
+            });
+            loopState.stuckRecoveryAttempts = 0;
         }
     }
     return {
@@ -1472,6 +1534,29 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         unitId,
         status: unitResult.status,
     });
+    if (unitResult.status === "completed" &&
+        s.currentUnit &&
+        (unitResult.event?.messages?.length ?? 0) === 0 &&
+        isSuspiciousGhostCompletion(ctx, unitResult.requestDispatchedAt ?? s.currentUnit.startedAt)) {
+        const message = `${unitType} ${unitId} completed without assistant output or tool calls; treating as a stale ghost completion.`;
+        debugLog("autoLoop", {
+            phase: "ghost-completion",
+            iteration: ic.iteration,
+            unitType,
+            unitId,
+            elapsedMs: Date.now() - (unitResult.requestDispatchedAt ?? s.currentUnit.startedAt),
+        });
+        logWarning("engine", message);
+        ctx.ui.notify(`${message} Pausing auto-mode before closeout side effects.`, "warning");
+        await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, {
+            message,
+            category: "unknown",
+            isTransient: true,
+        });
+        s.currentUnit = null;
+        await deps.pauseAuto(ctx, pi);
+        return { action: "break", reason: "ghost-completion" };
+    }
     // Now that runUnit has called newSession(), the session file path is correct.
     const sessionFile = deps.getSessionFile(ctx);
     deps.updateSessionLock(deps.lockBase(), unitType, unitId, sessionFile);
@@ -1571,6 +1656,15 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
             await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
             return { action: "break", reason: "session-timeout" };
         }
+        if (unitResult.errorContext?.isTransient &&
+            errorCategory === "aborted") {
+            ctx.ui.notify(`Unit ${unitType} ${unitId} was aborted by the user. Pausing auto-mode (recoverable).`, "warning");
+            debugLog("autoLoop", { phase: "unit-aborted-transient-pause", unitType, unitId, category: errorCategory });
+            await deps.pauseAuto(ctx, pi);
+            await deps.autoCommitUnit?.(s.basePath, unitType, unitId, ctx);
+            await emitCancelledUnitEnd(ic, unitType, unitId, unitStartSeq, unitResult.errorContext);
+            return { action: "break", reason: "unit-aborted-pause" };
+        }
         // All other cancelled states (structural errors, non-transient failures): hard stop
         if (s.currentUnit) {
             await deps.closeoutUnit(ctx, s.basePath, unitType, unitId, s.currentUnit.startedAt, deps.buildSnapshotOpts(unitType, unitId));
@@ -1753,6 +1847,10 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
                     attempt: retryInfo?.attempt,
                 },
             });
+            const retryPolicyResult = await applyVerificationRetryPolicy(ic, preUnitSnapshot?.type, "artifact-verification-retry");
+            if (retryPolicyResult) {
+                return retryPolicyResult;
+            }
             // Continue the loop — next iteration will inject the retry context into the prompt.
             debugLog("autoLoop", { phase: "artifact-verification-retry", iteration: ic.iteration });
             return { action: "continue" };
@@ -1781,6 +1879,10 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
             }
             else {
                 // s.pendingVerificationRetry was set by runPostUnitVerification.
+                const retryPolicyResult = await applyVerificationRetryPolicy(ic, iterData.unitType, "verification-retry");
+                if (retryPolicyResult) {
+                    return retryPolicyResult;
+                }
                 // Continue the loop — next iteration will inject the retry context into the prompt.
                 debugLog("autoLoop", { phase: "verification-retry", iteration: ic.iteration });
                 return { action: "continue" };