fix(#2257): auto-resume debug on non-terminal session-manager return (#2300)

The /gsd-debug orchestrator handled the gsd-debug-session-manager return
with only two literal-string checks (DEBUG SESSION COMPLETE, ABANDONED)
and no else branch, so a usable-but-non-terminal progress summary (the
manager's own turn/context budget exhausted mid-loop, with a valid
on-disk checkpoint) fell through to the user as if the debug were
complete. Same gap at the continue subcommand.

Callee side (agents/gsd-debug-session-manager.md): add an explicit
non-terminal CONTINUE_REQUIRED return marker, distinct from the two
terminal shapes and from a genuine user-input checkpoint.

Orchestrator (gsd-core/workflows/debug.md Sections 4 and 1c): classify
returns exhaustively — recognized terminal markers behave as before,
anything else is non-terminal and auto-resumes by re-spawning the
session manager from the same slug/checkpoint. Anti-loop guard: after
two consecutive no-progress resumes (unchanged next_action/updated),
emit a blocker report instead of looping.

Regression test (source-text contract guard, fix-2196 idiom) asserts
both sections' non-terminal/auto-resume branch, the CONTINUE_REQUIRED
marker, and the anti-loop bound.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

gsd-core/workflows/debug.md

@@ -137,6 +137,10 @@ specialist_dispatch_enabled: true
 
 Display the compact summary returned by the session manager.
 
+**Return handling — exhaustive, no fallthrough (#2257).** Apply the same three-way classification as Section 4 "Session Management" below: `DEBUG SESSION COMPLETE` and `ABANDONED` are the only two terminal shapes. ANYTHING ELSE — including the explicit `## CONTINUE_REQUIRED` marker and any unrecognized or malformed summary that is not one of the two terminal markers — is non-terminal. Read `.planning/debug/{SLUG}.md` for the current `status`/`next_action` and AUTO-RESUME by re-spawning `gsd-debug-session-manager` with the SAME `SLUG`/checkpoint (identical `session_params` as the spawn above) — do NOT return control to the user, and do NOT report the session as complete.
+
+**Anti-loop guard.** Same two-stop policy as Section 4 "Session Management": (1) a no-progress heuristic keyed on `next_action` ALONE from `.planning/debug/{SLUG}.md` — never `updated`, which is overwritten on every checkpoint write (`agents/gsd-debugger.md`: "Update the file BEFORE taking action"), so it changes every cycle and can never signal no-progress. Two consecutive auto-resumes with `next_action` UNCHANGED stop the loop and print a blocker report to the user (checkpoint path, status, next_action, "N auto-resumes made no progress"). And (2) an absolute hard cap, independent of content: the orchestrator tracks a running total of auto-resume spawns for this `SLUG` within the current `/gsd:debug` invocation; after **3** total auto-resumes for the slug, STOP auto-resuming and emit the blocker report REGARDLESS of whether `next_action` changed. The hard cap is the guaranteed termination bound; the no-progress heuristic is only a faster early exit before the cap is reached.
+
 ## 1d. Check Active Sessions (SUBCMD=debug)
 
 When SUBCMD=debug:
@@ -222,8 +226,18 @@ specialist_dispatch_enabled: true
 
 Display the compact summary returned by the session manager.
 
-If summary shows `DEBUG SESSION COMPLETE`: done.
-If summary shows `ABANDONED`: note session saved at `.planning/debug/{slug}.md` for later `/gsd:debug continue {slug}`.
+**Return handling — exhaustive, no fallthrough (#2257).** Every return from the session manager falls into exactly one of three buckets. Do not treat "not recognized" as "complete."
+
+1. **Terminal — complete.** Summary shows `DEBUG SESSION COMPLETE` (without an `ABANDONED` status line): the session is finished. Stop.
+2. **Terminal — abandoned.** Summary shows `ABANDONED`: note session saved at `.planning/debug/{slug}.md` for later `/gsd:debug continue {slug}`. Stop.
+3. **Non-terminal — auto-resume.** ANYTHING ELSE — including the explicit `## CONTINUE_REQUIRED` marker and any unrecognized or malformed summary that is not one of the two terminal markers above — is non-terminal. Read `.planning/debug/{slug}.md` for the current `status` and `next_action`, then AUTO-RESUME by re-spawning `gsd-debug-session-manager` with the SAME `slug`/`debug_file_path` and identical `session_params` as the spawn above. Do NOT return control to the user; do NOT report the session as complete.
+
+**Anti-loop guard.** Two independent stops apply; the orchestrator honors whichever trips first:
+
+1. **No-progress heuristic (fast early-stop).** Before each auto-resume, record the checkpoint's `next_action` from `.planning/debug/{slug}.md`. Do NOT key this off `updated` — the session manager overwrites `updated` on every checkpoint write (`agents/gsd-debugger.md`: "Update the file BEFORE taking action"), so it changes every cycle and can never signal no-progress; an AND-condition on `updated` is permanently false and makes the guard dead. After the resumed spawn returns, compare `next_action` against the pre-spawn value. If two consecutive auto-resumes complete with `next_action` UNCHANGED, STOP auto-resuming: print a blocker report to the user — checkpoint path, status, next_action, and "N auto-resumes made no progress" — and return control.
+2. **Absolute hard cap (real termination bound).** Independent of content: the orchestrator tracks a running total of auto-resume spawns for this `slug` within the current `/gsd:debug` invocation. After **3** total auto-resumes for the slug, STOP auto-resuming and emit the blocker report REGARDLESS of whether `next_action` changed. This hard cap is the guaranteed termination bound; the no-progress heuristic above is only a faster early exit before the cap is reached.
+
+**Note — session-manager-internal pause points.** Genuine user input / architectural decisions, destructive-action approvals, unresolved blockers, unrepairable gate failures, and readiness-for-native-UAT are all handled INSIDE `gsd-debug-session-manager` via `AskUserQuestion` (Step 3d `CHECKPOINT REACHED`) — the manager pauses, collects the response, and loops internally; it does not return to the orchestrator for these. The orchestrator only ever sees the two terminal markers (`DEBUG SESSION COMPLETE`, `ABANDONED`) or a non-terminal return that triggers auto-resume — the classification above stays strictly terminal-vs-non-terminal, with no third orchestrator-visible "stop for user" return type.
 
 </process>
 
@@ -236,4 +250,6 @@ If summary shows `ABANDONED`: note session saved at `.planning/debug/{slug}.md`
 - [ ] gsd-debug-session-manager spawned with security-hardened session_params
 - [ ] Session manager handles full checkpoint/continuation loop in isolated context
 - [ ] Compact summary displayed to user after session manager returns
+- [ ] Non-terminal returns (`CONTINUE_REQUIRED` or unrecognized) auto-resume from the checkpoint instead of being treated as complete
+- [ ] Anti-loop guard stops auto-resume after repeated no-progress cycles and reports a blocker
 </success_criteria>