@opengsd/gsd-pi 1.2.0-dev.4813ead6 → 1.2.0-dev.5457a158

package/src/resources/extensions/gsd/tests/worktree-lifecycle.test.ts

@@ -161,13 +161,13 @@ test("enterMilestone returns ok:true mode:worktree on successful create", (t) =>
   if (result.ok) {
     assert.equal(result.mode, "worktree");
     assert.ok(
-      result.path.endsWith("/.gsd/worktrees/M001"),
-      `expected path to end with /.gsd/worktrees/M001, got ${result.path}`,
+      result.path.endsWith("/.gsd-worktrees/M001"),
+      `expected path to end with /.gsd-worktrees/M001, got ${result.path}`,
     );
   }
   assert.ok(
-    s.basePath.endsWith("/.gsd/worktrees/M001"),
-    `expected s.basePath to end with /.gsd/worktrees/M001, got ${s.basePath}`,
+    s.basePath.endsWith("/.gsd-worktrees/M001"),
+    `expected s.basePath to end with /.gsd-worktrees/M001, got ${s.basePath}`,
   );
   // After C3 (#5626) `invalidateAllCaches` is inlined; assertion against
   // `deps.calls` for cache invalidation is no longer possible.
@@ -240,6 +240,43 @@ test("adoptStrandedMilestone forces branch recovery even when normal preferences
   assert.equal(currentBranch, "milestone/M001");
 });
 
+test("enterMilestone honors stranded branch recovery instead of recreating the worktree", (t) => {
+  // Regression: after adoptStrandedMilestone checks out milestone/M001 in
+  // the project root, a plain enterMilestone under isolation:worktree used
+  // to attempt `git worktree add`, which git refuses ("branch is already in
+  // use by another worktree" — the root checkout IS the conflicting
+  // worktree), tripping a creation-failed warning and degrading isolation.
+  // The recovery override must keep re-entries in branch mode.
+  const previousCwd = process.cwd();
+  const base = makeGitRepoBase({ isolation: "worktree" });
+  t.after(() => cleanupRepoBase(base, previousCwd));
+
+  const s = makeSession({ basePath: base, originalBasePath: base });
+  const deps = makeDeps();
+  const ctx = makeCtx();
+  const lifecycle = new WorktreeLifecycle(s, deps);
+
+  const adopted = lifecycle.adoptStrandedMilestone("M001", base, ctx, {
+    mode: "branch",
+  });
+  assert.equal(adopted.ok, true, `expected adopt ok:true, got: ${JSON.stringify(adopted)}`);
+
+  const result = lifecycle.enterMilestone("M001", ctx);
+
+  assert.equal(result.ok, true, `expected ok:true, got: ${JSON.stringify(result)}`);
+  if (result.ok) {
+    assert.equal(result.mode, "branch");
+    assert.equal(result.path, base);
+  }
+  assert.equal(s.basePath, base);
+  assert.equal(s.isolationDegraded, false, "intentional branch adoption must not degrade isolation");
+  assert.equal(
+    ctx.messages.some((m) => m.msg.includes("creation for M001 failed")),
+    false,
+    "re-entry must not attempt (and fail) canonical worktree creation",
+  );
+});
+
 test("enterMilestone returns ok:false reason:isolation-degraded when session degraded", () => {
   const s = makeSession({ isolationDegraded: true });
   const deps = makeDeps({ getIsolationMode: () => "branch" });

package/src/resources/extensions/gsd/tests/worktree-manager.test.ts

@@ -142,6 +142,27 @@ describe("createWorktree", () => {
     run("git rev-parse --git-dir", info.path);
     assert.ok(!existsSync(join(info.path, "orphan.txt")), "stale file removed by recovery");
   });
+
+  test("removes stale canonical directory when legacy orphan is cleaned and canonical target is stale", () => {
+    // Scenario: a stale .gsd-worktrees/M020 directory (no .git — aborted prior
+    // creation) coexists with an orphaned .gsd/worktrees/M020 dir (.git file not
+    // registered with git). worktreePathFor returns the legacy path (canonical has
+    // no .git marker), so only the legacy path was previously cleaned — the stale
+    // canonical blocked git worktree add. The fix ensures createWorktree also
+    // removes the stale canonical before calling git worktree add.
+    const canonicalDir = join(base, ".gsd-worktrees", "M020");
+    const legacyDir = join(base, ".gsd", "worktrees", "M020");
+
+    mkdirSync(canonicalDir, { recursive: true });  // stale canonical: exists, no .git
+    mkdirSync(legacyDir, { recursive: true });
+    writeFileSync(join(legacyDir, ".git"), "gitdir: ../../../../.git/worktrees/M020\n", "utf-8");
+
+    const info = createWorktree(base, "M020");
+    assert.strictEqual(info.name, "M020");
+    assert.ok(existsSync(info.path), "worktree path should exist after creation");
+    assert.ok(existsSync(join(info.path, ".git")), "new worktree has .git marker");
+    run("git rev-parse --git-dir", info.path);
+  });
 });
 
 describe("createWorktree — duplicate rejection", () => {
@@ -180,7 +201,7 @@ describe("createWorktree — branch cleanup on add failure", () => {
 
     // Make the worktrees parent directory non-writable so `git worktree add`
     // fails after the branch has already been force-reset.
-    const parentDir = join(base, ".gsd", "worktrees");
+    const parentDir = join(base, ".gsd-worktrees");
     mkdirSync(parentDir, { recursive: true });
     run(`chmod 555 "${parentDir}"`, base);
 

package/src/resources/extensions/gsd/tests/worktree-placement.test.ts

@@ -0,0 +1,113 @@
+/**
+ * Tests for worktreePathFor — the forward seam (project + name → path).
+ *
+ * Key invariant: a stale canonical directory (no .git marker) must NOT
+ * shadow a live legacy worktree (.gsd/worktrees/<name> with .git).
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { mkdirSync, writeFileSync, rmSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+
+import { worktreePathFor, canonicalWorktreesDir, legacyWorktreesDir } from "../worktree-placement.ts";
+
+function makeTmpRoot(): string {
+  const root = join(tmpdir(), `gsd-placement-test-${randomUUID()}`);
+  mkdirSync(root, { recursive: true });
+  return root;
+}
+
+function cleanup(root: string): void {
+  try { rmSync(root, { recursive: true, force: true }); } catch { /* */ }
+}
+
+function makeCanonicalDir(root: string, name: string): string {
+  const p = join(canonicalWorktreesDir(root), name);
+  mkdirSync(p, { recursive: true });
+  return p;
+}
+
+function makeLiveCanonical(root: string, name: string): string {
+  const p = makeCanonicalDir(root, name);
+  writeFileSync(join(p, ".git"), `gitdir: ${join(root, ".git", "worktrees", name)}\n`);
+  return p;
+}
+
+function makeLiveLegacy(root: string, name: string): string {
+  const p = join(legacyWorktreesDir(root), name);
+  mkdirSync(p, { recursive: true });
+  writeFileSync(join(p, ".git"), `gitdir: ${join(root, ".git", "worktrees", name)}\n`);
+  return p;
+}
+
+test("returns canonical path when canonical has .git marker", () => {
+  const root = makeTmpRoot();
+  try {
+    const canonical = makeLiveCanonical(root, "M001");
+    assert.equal(worktreePathFor(root, "M001"), canonical);
+  } finally {
+    cleanup(root);
+  }
+});
+
+test("returns legacy path when only legacy exists with .git marker", () => {
+  const root = makeTmpRoot();
+  try {
+    const legacy = makeLiveLegacy(root, "M001");
+    assert.equal(worktreePathFor(root, "M001"), legacy);
+  } finally {
+    cleanup(root);
+  }
+});
+
+test("returns legacy path when canonical dir exists but has no .git (stale canonical)", () => {
+  const root = makeTmpRoot();
+  try {
+    makeCanonicalDir(root, "M001"); // stale: dir exists, no .git
+    const legacy = makeLiveLegacy(root, "M001");
+    assert.equal(
+      worktreePathFor(root, "M001"),
+      legacy,
+      "stale canonical must not shadow live legacy worktree",
+    );
+  } finally {
+    cleanup(root);
+  }
+});
+
+test("returns canonical path for new-worktree creation when neither path exists", () => {
+  const root = makeTmpRoot();
+  try {
+    const expected = join(canonicalWorktreesDir(root), "M001");
+    assert.equal(worktreePathFor(root, "M001"), expected);
+  } finally {
+    cleanup(root);
+  }
+});
+
+test("prefers live canonical over live legacy when both exist", () => {
+  const root = makeTmpRoot();
+  try {
+    const canonical = makeLiveCanonical(root, "M001");
+    makeLiveLegacy(root, "M001");
+    assert.equal(worktreePathFor(root, "M001"), canonical);
+  } finally {
+    cleanup(root);
+  }
+});
+
+test("returns legacy when canonical is stale and legacy has no .git (both stale)", () => {
+  const root = makeTmpRoot();
+  try {
+    makeCanonicalDir(root, "M001"); // stale canonical
+    const legacy = join(legacyWorktreesDir(root), "M001");
+    mkdirSync(legacy, { recursive: true }); // stale legacy (no .git)
+    // Falls through to legacy existsSync since canonical has no .git
+    assert.equal(worktreePathFor(root, "M001"), legacy);
+  } finally {
+    cleanup(root);
+  }
+});

package/src/resources/extensions/gsd/tests/worktree-reentry.test.ts

@@ -65,7 +65,7 @@ describe("reenterActiveWorktreeIfNeeded", () => {
     const entered = await reenterActiveWorktreeIfNeeded(dir);
     assert.ok(entered, "re-entry returned a worktree path");
     assert.strictEqual(realpathSync(process.cwd()), realpathSync(entered!), "cwd moved into the worktree");
-    assert.strictEqual(entered, join(dir, ".gsd", "worktrees", "M001"));
+    assert.strictEqual(entered, join(dir, ".gsd-worktrees", "M001"));
   });
 
   test("no-op when already inside a worktree", async (t) => {

package/src/resources/extensions/gsd/tests/worktree-safety.test.ts

@@ -126,7 +126,9 @@ describe("Worktree Safety module", () => {
     assert.equal(result.ok, false);
     assert.equal(result.kind, "invalid-root");
     assert.equal(result.details?.unitRoot, outsideRoot);
-    assert.equal(result.details?.expectedRoot, unitRoot);
+    // The reported expected root is the canonical container; the legacy
+    // .gsd/worktrees/ location is also accepted but not surfaced here.
+    assert.equal(result.details?.expectedRoot, join(projectRoot, ".gsd-worktrees", "M001"));
   });
 
   test("accepts project root for source-writing Unit when isolation mode is none", () => {

package/src/resources/extensions/gsd/tests/worktree-symlink-removal.test.ts

@@ -8,6 +8,11 @@
  *
  * Fix: removeWorktree should query `git worktree list` to find the actual
  * registered path when the computed path doesn't match.
+ *
+ * New worktrees are created at the canonical `.gsd-worktrees/` sibling and
+ * never cross the symlink, so this scenario only applies to LEGACY worktrees
+ * (created under `.gsd/worktrees/` by older versions). The test creates the
+ * worktree at the legacy location directly to keep that coverage.
  */
 import { mkdtempSync, mkdirSync, rmSync, symlinkSync, unlinkSync, writeFileSync, existsSync, realpathSync } from "node:fs";
 import { join } from "node:path";
@@ -15,7 +20,6 @@ import { tmpdir } from "node:os";
 import { execSync } from "node:child_process";
 
 import {
-  createWorktree,
   removeWorktree,
   listWorktrees,
   worktreePath,
@@ -64,13 +68,15 @@ test('worktree-symlink-removal removes the git-registered symlink target safely'
   run("git add .", base);
   run('git commit -m "init"', base);
 
-  // Create a worktree — git will resolve the symlink and register
-  // the worktree at the external path
-  const info = createWorktree(base, "M002", { branch: "milestone/M002" });
-  assert.ok(info.exists, "worktree created");
+  // Create a LEGACY worktree through the symlinked .gsd path — git resolves
+  // the symlink and registers the worktree at the external path. (Current
+  // createWorktree() uses the canonical .gsd-worktrees/ sibling instead.)
+  const legacyPath = join(base, ".gsd", "worktrees", "M002");
+  run(`git worktree add -b milestone/M002 "${legacyPath}"`, base);
+  assert.ok(existsSync(legacyPath), "worktree created");
 
   // Verify worktree was created at the resolved (external) path
-  const realWtPath = realpathSync(info.path);
+  const realWtPath = realpathSync(legacyPath);
   assert.ok(
     realWtPath.startsWith(externalState),
     `worktree real path (${realWtPath}) is under external state dir`,

package/src/resources/extensions/gsd/tests/worktree-teardown-safety.test.ts

@@ -116,8 +116,8 @@ describe("worktree-teardown-safety", () => {
 
     const wtPathResult = worktreePath(tempDir, "anything");
     assertTrue(
-      wtPathResult.startsWith(join(tempDir, ".gsd", "worktrees")),
-      "worktreePath returns path under .gsd/worktrees/",
+      wtPathResult.startsWith(join(tempDir, ".gsd-worktrees")),
+      "worktreePath returns path under the canonical .gsd-worktrees/ container",
     );
   });
 

package/src/resources/extensions/gsd/tests/write-gate.test.ts

@@ -803,3 +803,45 @@ test('write-gate: resetWriteGateState persists through dangling .gsd symlink', (
     } catch { /* swallow */ }
   }
 });
+
+// ─── Scenario 31: hydrate in-memory gate state from persisted snapshot (MCP subprocess) ──
+
+test('write-gate: getPendingGate hydrates from disk when workflow MCP verified gate in child process', () => {
+  const base = join(tmpdir(), `gsd-write-gate-mcp-hydrate-${randomUUID()}`);
+  const stateFilePath = join(base, '.gsd', 'runtime', 'write-gate-state.json');
+  const originalEnv = process.env.GSD_PERSIST_WRITE_GATE_STATE;
+  const gateId = 'depth_verification_M005_confirm';
+
+  try {
+    process.env.GSD_PERSIST_WRITE_GATE_STATE = '1';
+    mkdirSync(join(base, '.gsd', 'runtime'), { recursive: true });
+    clearDiscussionFlowState(base);
+    setPendingGate(gateId, base);
+
+    writeFileSync(stateFilePath, JSON.stringify({
+      verifiedDepthMilestones: ['M005'],
+      verifiedApprovalGates: [gateId],
+      activeQueuePhase: false,
+      pendingGateId: null,
+    }, null, 2), 'utf-8');
+
+    assert.strictEqual(getPendingGate(base), null, 'stale in-memory pending must refresh from disk');
+    assert.strictEqual(isMilestoneDepthVerified('M005', base), true, 'verified milestone must hydrate from disk');
+    assert.deepEqual(loadWriteGateSnapshot(base), {
+      verifiedDepthMilestones: ['M005'],
+      verifiedApprovalGates: [gateId],
+      activeQueuePhase: false,
+      pendingGateId: null,
+    });
+  } finally {
+    if (originalEnv === undefined) {
+      delete process.env.GSD_PERSIST_WRITE_GATE_STATE;
+    } else {
+      process.env.GSD_PERSIST_WRITE_GATE_STATE = originalEnv;
+    }
+    clearDiscussionFlowState(base);
+    try {
+      rmSync(base, { recursive: true, force: true });
+    } catch { /* swallow */ }
+  }
+});

package/src/resources/extensions/gsd/tool-surface-readiness.ts

@@ -0,0 +1,76 @@
+// Project/App: gsd-pi
+// File Purpose: Tool Contract module's runtime face — verify the live SDK tool surface covers a Unit's required workflow tools.
+
+import { mcpToolMatchesBaseName } from "./mcp-tool-name.js";
+import { getRequiredWorkflowToolsForUnit } from "./unit-tool-contracts.js";
+import { isWorkflowToolSurfaceName } from "./workflow-tool-surface.js";
+
+/**
+ * Stable phrase recognized as transient by auto-tool-tracking's
+ * isToolUnavailableError and error-classifier's transient buckets,
+ * which build their matchers from this constant.
+ */
+export const TOOL_SURFACE_NOT_READY = "workflow tool surface not ready";
+
+/** MCP server statuses that will not self-heal within the session. */
+const TERMINAL_MCP_SERVER_STATUSES = new Set(["failed", "needs-auth", "disabled"]);
+
+export interface LiveToolSurfaceObservation {
+  /** Tool names the session reported at init (MCP tools appear as mcp__<server>__<tool>). */
+  tools: readonly string[];
+  /** MCP server connection statuses the session reported at init. */
+  mcpServers: readonly { name: string; status: string }[];
+}
+
+/**
+ * Verify the live tool surface observed at SDK session init covers the Unit's
+ * required workflow tools. Complements the static pre-dispatch gate
+ * (getWorkflowTransportSupportError), which only proves the MCP launch config
+ * is discoverable — the workflow server connects asynchronously after session
+ * start, so the static gate cannot see whether the tools actually registered.
+ *
+ * Returns a transient, recovery-classifiable error (kind tool-unavailable →
+ * retry) when the workflow server failed or has not yet registered a required
+ * tool, so dispatch aborts before the first model turn instead of letting the
+ * Unit improvise around "No such tool available". Returns null when no
+ * workflow server is part of this session (native tool path), when the Unit
+ * requires no workflow tools, or when the surface is ready.
+ */
+export function getToolSurfaceReadinessError(input: {
+  unitType: string | undefined;
+  workflowServerName: string | undefined;
+  observation: LiveToolSurfaceObservation;
+}): string | null {
+  const { unitType, workflowServerName, observation } = input;
+  if (!unitType || !workflowServerName) return null;
+
+  const required = getRequiredWorkflowToolsForUnit(unitType).filter(isWorkflowToolSurfaceName);
+  if (required.length === 0) return null;
+
+  const server = observation.mcpServers.find((entry) => entry.name === workflowServerName);
+  if (!server) {
+    return `${TOOL_SURFACE_NOT_READY} for ${unitType}: MCP server "${workflowServerName}" is absent from the init surface (not yet connected): ${required.join(", ")}`;
+  }
+
+  // The SDK does not wait for MCP servers before init — a still-connecting
+  // server reports "pending" there routinely, then registers within seconds,
+  // usually well before the Unit's first workflow tool call. Aborting on
+  // "pending" would fail the common healthy session, so it passes through;
+  // a genuine miss after pass-through still surfaces in-session as
+  // "No such tool available" and classifies tool-unavailable → bounded retry.
+  // Only statuses that cannot self-heal abort here.
+  if (server.status !== "connected" && !TERMINAL_MCP_SERVER_STATUSES.has(server.status)) {
+    return null;
+  }
+
+  const missing = required.filter(
+    (tool) => !observation.tools.some((name) => name === tool || mcpToolMatchesBaseName(name, tool)),
+  );
+  if (missing.length === 0) return null;
+
+  const serverDetail =
+    server.status === "connected"
+      ? `MCP server "${workflowServerName}" is connected but has not registered`
+      : `MCP server "${workflowServerName}" status is "${server.status}" and it has not registered`;
+  return `${TOOL_SURFACE_NOT_READY} for ${unitType}: ${serverDetail}: ${missing.join(", ")}`;
+}

package/src/resources/extensions/gsd/tools/complete-slice.ts

@@ -15,20 +15,11 @@ import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
 
 import type { CompleteSliceParams } from "../types.js";
-import { isClosedStatus } from "../status-guards.js";
 import {
-  transaction,
-  insertMilestone,
-  insertSlice,
-  getSlice,
-  getSliceTasks,
-  getMilestone,
-  updateSliceStatus,
+  completeSliceCascade,
   setSliceSummaryMd,
   saveGateResult,
   getPendingGatesForTurn,
-  getMilestoneSlices,
-  updateMilestoneStatus,
 } from "../gsd-db.js";
 import { getGatesForTurn } from "../gate-registry.js";
 import { gsdProjectionRoot, clearPathCache, resolveMilestoneFile } from "../paths.js";
@@ -371,60 +362,34 @@ export async function handleCompleteSlice(
     };
   }
 
-  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+  // ── Atomic completion cascade (guards + writes in one transaction) ───────
   const completedAt = new Date().toISOString();
   let guardError: string | null = null;
   let existingSummaryMd = "";
   let duplicateComplete = false;
 
-  transaction(() => {
-    // State machine preconditions (inside txn for atomicity).
-    // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
-    // Only block if they exist and are closed.
-    const milestone = getMilestone(params.milestoneId);
-    if (milestone && isClosedStatus(milestone.status)) {
-      guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-      return;
-    }
-
-    const slice = getSlice(params.milestoneId, params.sliceId);
-    existingSummaryMd = slice?.full_summary_md?.trim() ?? "";
-    if (slice && isClosedStatus(slice.status)) {
-      duplicateComplete = true;
-      return;
-    }
-
-    // Verify all tasks are complete
-    const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-    if (tasks.length === 0) {
-      guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
-      return;
-    }
-
-    const incompleteTasks = tasks.filter(t => !isClosedStatus(t.status));
-    if (incompleteTasks.length > 0) {
-      const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
-      guardError = `incomplete tasks: ${incompleteIds}`;
-      return;
-    }
-
-    // All guards passed — perform writes. Preserve existing planning metadata:
-    // completion should not overwrite title/risk/depends/demo/sequence.
-    insertMilestone({ id: params.milestoneId, title: params.milestoneId });
-    if (!slice) {
-      insertSlice({ id: params.sliceId, milestoneId: params.milestoneId, title: params.sliceTitle || params.sliceId });
-    }
-    updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
-
-    const updatedSlices = getMilestoneSlices(params.milestoneId);
-    if (
-      milestone?.status === "planned" &&
-      updatedSlices.length > 0 &&
-      updatedSlices.every((s) => isClosedStatus(s.status))
-    ) {
-      updateMilestoneStatus(params.milestoneId, "active");
-    }
+  const outcome = completeSliceCascade(params.milestoneId, params.sliceId, {
+    sliceTitle: params.sliceTitle,
+    completedAt,
   });
+  if (outcome.ok) {
+    existingSummaryMd = outcome.existingSummaryMd;
+    duplicateComplete = outcome.duplicate;
+  } else {
+    switch (outcome.reason) {
+      case "milestone-closed":
+        guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})`;
+        break;
+      case "no-tasks":
+        guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
+        break;
+      case "incomplete-tasks": {
+        const incompleteIds = outcome.incomplete.map((t) => `${t.id} (status: ${t.status})`).join(", ");
+        guardError = `incomplete tasks: ${incompleteIds}`;
+        break;
+      }
+    }
+  }
 
   if (duplicateComplete) {
     const staleSummaryPath = sliceSummaryPath(

package/src/resources/extensions/gsd/tools/exec-tool.ts

@@ -11,6 +11,7 @@ import {
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import { isContextModeEnabled, type ContextModeConfig } from "../preferences-types.js";
+import { projectRootFromWorktreePath } from "../worktree-root.js";
 import { contextModeDisabledResult, type ToolExecutionResult } from "./context-mode-tool-result.js";
 
 export interface ExecToolParams {
@@ -201,13 +202,9 @@ function normalizeScanPath(value: string): string {
 
 function parseWorktreeBase(baseDir: string): { originalRoot: string; worktreeRoot: string } | null {
   const normalizedBase = normalizeScanPath(baseDir);
-  const marker = "/.gsd/worktrees/";
-  const markerIndex = normalizedBase.indexOf(marker);
-  if (markerIndex <= 0) return null;
-  return {
-    originalRoot: normalizedBase.slice(0, markerIndex),
-    worktreeRoot: normalizedBase,
-  };
+  const originalRoot = projectRootFromWorktreePath(normalizedBase);
+  if (!originalRoot) return null;
+  return { originalRoot, worktreeRoot: normalizedBase };
 }
 
 function pathInside(parent: string, target: string): boolean {
@@ -297,7 +294,7 @@ function scriptReferencesOriginalRootFromWorktree(script: string, baseDir: strin
   const normalizedScript = script.replace(/\\/g, "/");
   return comparablePathVariants(parsed.originalRoot).some((originalRoot) => {
     const originalRootPattern = new RegExp(
-      `${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd/worktrees(?:/|$)))`,
+      `${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd(?:-worktrees|/worktrees)(?:/|$)))`,
     );
     return originalRootPattern.test(normalizedScript);
   });

package/src/resources/extensions/gsd/tools/plan-slice.ts

@@ -26,8 +26,9 @@ import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
 import { logWarning } from "../workflow-logger.js";
 import { validatePathOnlyPlanningFields, validatePlanningPathScope } from "../planning-path-scope.js";
-import { checkFilePathConsistency, checkTaskOrdering } from "../pre-execution-checks.js";
+import { runTaskPathChecks } from "../pre-execution-checks.js";
 import type { TaskRow } from "../db-task-slice-rows.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
 import { buildTaskFileName, gsdProjectionRoot } from "../paths.js";
 import { loadEffectiveGSDPreferences } from "../preferences.js";
 import { createRepositoryRegistryFromPreferences, defaultRepositoryTargets, type RepositoryRegistry } from "../repository-registry.js";
@@ -268,11 +269,16 @@ function validateTaskPathsBeforePersist(
   const additionalRoots = allowedRoots
     .map((root) => resolve(root))
     .filter((root) => root !== baseRoot);
-  const context = additionalRoots.length > 0 ? { additionalRoots } : undefined;
-  const checks = [
-    ...checkFilePathConsistency(taskRows, basePath, context),
-    ...checkTaskOrdering(taskRows, basePath, context),
-  ];
+  const resolvedCanonicalRoot = resolve(resolveWorktreeProjectRoot(basePath));
+  const canonicalProjectRoot = resolvedCanonicalRoot !== baseRoot ? resolvedCanonicalRoot : undefined;
+  const hasContext = additionalRoots.length > 0 || canonicalProjectRoot !== undefined;
+  const context = hasContext
+    ? {
+        ...(additionalRoots.length > 0 ? { additionalRoots } : {}),
+        ...(canonicalProjectRoot !== undefined ? { canonicalProjectRoot } : {}),
+      }
+    : undefined;
+  const checks = runTaskPathChecks(taskRows, basePath, context);
   const blocking = checks.filter((check) => !check.passed && check.blocking);
 
   if (blocking.length === 0) return null;

package/src/resources/extensions/gsd/tools/reopen-milestone.ts

@@ -10,16 +10,11 @@
  */
 
 import {
-  getMilestone,
   getMilestoneSlices,
   getSliceTasks,
-  reopenMilestoneStatus,
-  updateSliceStatus,
-  updateTaskStatus,
-  transaction,
+  reopenMilestoneCascade,
 } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
-import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -53,40 +48,18 @@ export async function handleReopenMilestone(
     return { error: "milestoneId is required and must be a non-empty string" };
   }
 
-  // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
-  let guardError: string | null = null;
-  let slicesResetCount = 0;
-  let tasksResetCount = 0;
-
-  transaction(() => {
-    const milestone = getMilestone(params.milestoneId);
-    if (!milestone) {
-      guardError = `milestone not found: ${params.milestoneId}`;
-      return;
-    }
-    if (!isClosedStatus(milestone.status)) {
-      guardError = `milestone ${params.milestoneId} is not closed (status: ${milestone.status}) — nothing to reopen`;
-      return;
-    }
-
-    reopenMilestoneStatus(params.milestoneId);
-
-    const slices = getMilestoneSlices(params.milestoneId);
-    slicesResetCount = slices.length;
-
-    for (const slice of slices) {
-      updateSliceStatus(params.milestoneId, slice.id, "in_progress");
-      const tasks = getSliceTasks(params.milestoneId, slice.id);
-      tasksResetCount += tasks.length;
-      for (const task of tasks) {
-        updateTaskStatus(params.milestoneId, slice.id, task.id, "pending");
-      }
+  // ── Atomic reopen cascade (guards + writes in one transaction) ───────────
+  const outcome = reopenMilestoneCascade(params.milestoneId);
+  if (!outcome.ok) {
+    switch (outcome.reason) {
+      case "milestone-not-found":
+        return { error: `milestone not found: ${params.milestoneId}` };
+      case "milestone-not-closed":
+        return { error: `milestone ${params.milestoneId} is not closed (status: ${outcome.status}) — nothing to reopen` };
     }
-  });
-
-  if (guardError) {
-    return { error: guardError };
   }
+  const slicesResetCount = outcome.slicesReset;
+  const tasksResetCount = outcome.tasksReset;
 
   // ── Invalidate caches ────────────────────────────────────────────────────
   invalidateStateCache();