@opengsd/gsd-pi 1.2.0-dev.4c756166 → 1.2.0-dev.955e4da0

package/dist/resources/extensions/gsd/tools/complete-slice.js

@@ -11,8 +11,7 @@
  */
 import { existsSync, readFileSync } from "node:fs";
 import { join } from "node:path";
-import { isClosedStatus } from "../status-guards.js";
-import { transaction, insertMilestone, insertSlice, getSlice, getSliceTasks, getMilestone, updateSliceStatus, setSliceSummaryMd, saveGateResult, getPendingGatesForTurn, getMilestoneSlices, updateMilestoneStatus, } from "../gsd-db.js";
+import { completeSliceCascade, setSliceSummaryMd, saveGateResult, getPendingGatesForTurn, } from "../gsd-db.js";
 import { getGatesForTurn } from "../gate-registry.js";
 import { gsdProjectionRoot, clearPathCache, resolveMilestoneFile } from "../paths.js";
 import { resolveCanonicalMilestoneRoot } from "../worktree-manager.js";
@@ -295,52 +294,34 @@ export async function handleCompleteSlice(params, basePath) {
             error: `UAT requires browser verification (opening a page in a browser, navigating to a page or localhost, screenshots) but declares "UAT mode: artifact-driven", which only runs static/file checks and would defer the browser work to a human. Use a mode that actually verifies the UI: "browser-executable" (interactive browser tools), "runtime-executable" (a browser test command such as playwright), or a browser-inclusive "mixed"/"live-runtime". Re-author the UAT Type section and complete the slice again.`,
         };
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
+    // ── Atomic completion cascade (guards + writes in one transaction) ───────
     const completedAt = new Date().toISOString();
     let guardError = null;
     let existingSummaryMd = "";
     let duplicateComplete = false;
-    transaction(() => {
-        // State machine preconditions (inside txn for atomicity).
-        // Milestone/slice not existing is OK — insertMilestone/insertSlice below will auto-create.
-        // Only block if they exist and are closed.
-        const milestone = getMilestone(params.milestoneId);
-        if (milestone && isClosedStatus(milestone.status)) {
-            guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-            return;
-        }
-        const slice = getSlice(params.milestoneId, params.sliceId);
-        existingSummaryMd = slice?.full_summary_md?.trim() ?? "";
-        if (slice && isClosedStatus(slice.status)) {
-            duplicateComplete = true;
-            return;
-        }
-        // Verify all tasks are complete
-        const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-        if (tasks.length === 0) {
-            guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
-            return;
-        }
-        const incompleteTasks = tasks.filter(t => !isClosedStatus(t.status));
-        if (incompleteTasks.length > 0) {
-            const incompleteIds = incompleteTasks.map(t => `${t.id} (status: ${t.status})`).join(", ");
-            guardError = `incomplete tasks: ${incompleteIds}`;
-            return;
-        }
-        // All guards passed — perform writes. Preserve existing planning metadata:
-        // completion should not overwrite title/risk/depends/demo/sequence.
-        insertMilestone({ id: params.milestoneId, title: params.milestoneId });
-        if (!slice) {
-            insertSlice({ id: params.sliceId, milestoneId: params.milestoneId, title: params.sliceTitle || params.sliceId });
-        }
-        updateSliceStatus(params.milestoneId, params.sliceId, "complete", completedAt);
-        const updatedSlices = getMilestoneSlices(params.milestoneId);
-        if (milestone?.status === "planned" &&
-            updatedSlices.length > 0 &&
-            updatedSlices.every((s) => isClosedStatus(s.status))) {
-            updateMilestoneStatus(params.milestoneId, "active");
-        }
+    const outcome = completeSliceCascade(params.milestoneId, params.sliceId, {
+        sliceTitle: params.sliceTitle,
+        completedAt,
     });
+    if (outcome.ok) {
+        existingSummaryMd = outcome.existingSummaryMd;
+        duplicateComplete = outcome.duplicate;
+    }
+    else {
+        switch (outcome.reason) {
+            case "milestone-closed":
+                guardError = `cannot complete slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})`;
+                break;
+            case "no-tasks":
+                guardError = `no tasks found for slice ${params.sliceId} in milestone ${params.milestoneId}`;
+                break;
+            case "incomplete-tasks": {
+                const incompleteIds = outcome.incomplete.map((t) => `${t.id} (status: ${t.status})`).join(", ");
+                guardError = `incomplete tasks: ${incompleteIds}`;
+                break;
+            }
+        }
+    }
     if (duplicateComplete) {
         const staleSummaryPath = sliceSummaryPath(artifactBasePath, params.milestoneId, params.sliceId);
         const duplicateIsStale = isStaleWrite("complete-slice");

package/dist/resources/extensions/gsd/tools/exec-tool.js

@@ -4,6 +4,7 @@ import { EXEC_DEFAULTS, runExecSandbox, } from "../exec-sandbox.js";
 import { realpathSync } from "node:fs";
 import path from "node:path";
 import { isContextModeEnabled } from "../preferences-types.js";
+import { findWorktreeSegment } from "../worktree-root.js";
 import { contextModeDisabledResult } from "./context-mode-tool-result.js";
 const UAT_EXEC_INTENTS = [
     "uat-artifact-check",
@@ -141,12 +142,11 @@ function normalizeScanPath(value) {
 }
 function parseWorktreeBase(baseDir) {
     const normalizedBase = normalizeScanPath(baseDir);
-    const marker = "/.gsd/worktrees/";
-    const markerIndex = normalizedBase.indexOf(marker);
-    if (markerIndex <= 0)
+    const segment = findWorktreeSegment(normalizedBase);
+    if (!segment || segment.gsdIdx <= 0)
         return null;
     return {
-        originalRoot: normalizedBase.slice(0, markerIndex),
+        originalRoot: normalizedBase.slice(0, segment.gsdIdx),
         worktreeRoot: normalizedBase,
     };
 }
@@ -234,7 +234,7 @@ function scriptReferencesOriginalRootFromWorktree(script, baseDir) {
         return false;
     const normalizedScript = script.replace(/\\/g, "/");
     return comparablePathVariants(parsed.originalRoot).some((originalRoot) => {
-        const originalRootPattern = new RegExp(`${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd/worktrees(?:/|$)))`);
+        const originalRootPattern = new RegExp(`${escapeRegExp(originalRoot)}(?=$|[\\s'"\\\`;)&|<>]|/(?!\\.gsd(?:-worktrees|/worktrees)(?:/|$)))`);
         return originalRootPattern.test(normalizedScript);
     });
 }

package/dist/resources/extensions/gsd/tools/reopen-milestone.js

@@ -7,9 +7,8 @@
  * artifacts so the DB-filesystem reconciler does not auto-correct
  * entities back to "complete".
  */
-import { getMilestone, getMilestoneSlices, getSliceTasks, reopenMilestoneStatus, updateSliceStatus, updateTaskStatus, transaction, } from "../gsd-db.js";
+import { getMilestoneSlices, getSliceTasks, reopenMilestoneCascade, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
-import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -23,35 +22,18 @@ export async function handleReopenMilestone(params, basePath) {
     if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
         return { error: "milestoneId is required and must be a non-empty string" };
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
-    let guardError = null;
-    let slicesResetCount = 0;
-    let tasksResetCount = 0;
-    transaction(() => {
-        const milestone = getMilestone(params.milestoneId);
-        if (!milestone) {
-            guardError = `milestone not found: ${params.milestoneId}`;
-            return;
+    // ── Atomic reopen cascade (guards + writes in one transaction) ───────────
+    const outcome = reopenMilestoneCascade(params.milestoneId);
+    if (!outcome.ok) {
+        switch (outcome.reason) {
+            case "milestone-not-found":
+                return { error: `milestone not found: ${params.milestoneId}` };
+            case "milestone-not-closed":
+                return { error: `milestone ${params.milestoneId} is not closed (status: ${outcome.status}) — nothing to reopen` };
         }
-        if (!isClosedStatus(milestone.status)) {
-            guardError = `milestone ${params.milestoneId} is not closed (status: ${milestone.status}) — nothing to reopen`;
-            return;
-        }
-        reopenMilestoneStatus(params.milestoneId);
-        const slices = getMilestoneSlices(params.milestoneId);
-        slicesResetCount = slices.length;
-        for (const slice of slices) {
-            updateSliceStatus(params.milestoneId, slice.id, "in_progress");
-            const tasks = getSliceTasks(params.milestoneId, slice.id);
-            tasksResetCount += tasks.length;
-            for (const task of tasks) {
-                updateTaskStatus(params.milestoneId, slice.id, task.id, "pending");
-            }
-        }
-    });
-    if (guardError) {
-        return { error: guardError };
     }
+    const slicesResetCount = outcome.slicesReset;
+    const tasksResetCount = outcome.tasksReset;
     // ── Invalidate caches ────────────────────────────────────────────────────
     invalidateStateCache();
     // ── Clean up stale filesystem artifacts (M12 fix) ────────────────────────

package/dist/resources/extensions/gsd/tools/reopen-slice.js

@@ -9,9 +9,8 @@
  */
 // GSD — reopen-slice tool handler
 // Copyright (c) 2026 Jeremy McSpadden <jeremy@fluxlabs.net>
-import { getMilestone, getSlice, getSliceTasks, updateSliceStatus, updateTaskStatus, transaction, } from "../gsd-db.js";
+import { getSliceTasks, reopenSliceCascade, } from "../gsd-db.js";
 import { invalidateStateCache } from "../state.js";
-import { isClosedStatus } from "../status-guards.js";
 import { renderAllProjections } from "../workflow-projections.js";
 import { writeManifest } from "../workflow-manifest.js";
 import { appendEvent } from "../workflow-events.js";
@@ -27,39 +26,21 @@ export async function handleReopenSlice(params, basePath) {
     if (!params.milestoneId || typeof params.milestoneId !== "string" || params.milestoneId.trim() === "") {
         return { error: "milestoneId is required and must be a non-empty string" };
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ───
-    let guardError = null;
-    let tasksResetCount = 0;
-    transaction(() => {
-        const milestone = getMilestone(params.milestoneId);
-        if (!milestone) {
-            guardError = `milestone not found: ${params.milestoneId}`;
-            return;
+    // ── Atomic reopen cascade (guards + writes in one transaction) ───────────
+    const outcome = reopenSliceCascade(params.milestoneId, params.sliceId);
+    if (!outcome.ok) {
+        switch (outcome.reason) {
+            case "milestone-not-found":
+                return { error: `milestone not found: ${params.milestoneId}` };
+            case "milestone-closed":
+                return { error: `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${outcome.status})` };
+            case "slice-not-found":
+                return { error: `slice not found: ${params.milestoneId}/${params.sliceId}` };
+            case "slice-not-complete":
+                return { error: `slice ${params.sliceId} is not complete (status: ${outcome.status}) — nothing to reopen` };
         }
-        if (isClosedStatus(milestone.status)) {
-            guardError = `cannot reopen slice in a closed milestone: ${params.milestoneId} (status: ${milestone.status})`;
-            return;
-        }
-        const slice = getSlice(params.milestoneId, params.sliceId);
-        if (!slice) {
-            guardError = `slice not found: ${params.milestoneId}/${params.sliceId}`;
-            return;
-        }
-        if (!isClosedStatus(slice.status)) {
-            guardError = `slice ${params.sliceId} is not complete (status: ${slice.status}) — nothing to reopen`;
-            return;
-        }
-        // Fetch tasks inside txn so the list is consistent with the slice status check
-        const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-        tasksResetCount = tasks.length;
-        updateSliceStatus(params.milestoneId, params.sliceId, "in_progress");
-        for (const task of tasks) {
-            updateTaskStatus(params.milestoneId, params.sliceId, task.id, "pending");
-        }
-    });
-    if (guardError) {
-        return { error: guardError };
     }
+    const tasksResetCount = outcome.tasksReset;
     // ── Invalidate caches ────────────────────────────────────────────────────
     invalidateStateCache();
     // ── Clean up stale filesystem artifacts (M12 fix) ────────────────────────

package/dist/resources/extensions/gsd/tools/skip-slice.js

@@ -9,8 +9,7 @@
  * This function performs DB writes only. The MCP wrapper in
  * bootstrap/db-tools.ts handles state-cache invalidation and STATE.md rebuild.
  */
-import { getSlice, getSliceTasks, isDbAvailable, transaction, updateSliceStatus, updateTaskStatus, } from "../gsd-db.js";
-import { isClosedStatus } from "../status-guards.js";
+import { isDbAvailable, skipSliceCascade, } from "../gsd-db.js";
 /**
  * Mark a slice as "skipped" and cascade the skip to every non-closed task in
  * that slice. Runs as a single transaction so slice status and task statuses
@@ -39,40 +38,23 @@ export function handleSkipSlice(params) {
     if (!isDbAvailable()) {
         throw new Error("handleSkipSlice: GSD database is not available");
     }
-    // ── Guards + DB writes inside a single transaction (prevents TOCTOU) ────
-    let guardError = null;
-    let guardCode = null;
-    let wasAlreadySkipped = false;
-    let tasksSkipped = 0;
-    transaction(() => {
-        const slice = getSlice(params.milestoneId, params.sliceId);
-        if (!slice) {
-            guardError = `Slice ${params.sliceId} not found in milestone ${params.milestoneId}`;
-            guardCode = "slice_not_found";
-            return;
+    // ── Atomic skip cascade (guards + writes in one transaction) ────────────
+    const outcome = skipSliceCascade(params.milestoneId, params.sliceId);
+    if (!outcome.ok) {
+        switch (outcome.reason) {
+            case "slice-not-found":
+                return {
+                    ...base,
+                    error: `Slice ${params.sliceId} not found in milestone ${params.milestoneId}`,
+                    errorCode: "slice_not_found",
+                };
+            case "slice-already-complete":
+                return {
+                    ...base,
+                    error: `Slice ${params.sliceId} is already complete — cannot skip.`,
+                    errorCode: "already_complete",
+                };
         }
-        if (slice.status === "complete" || slice.status === "done") {
-            guardError = `Slice ${params.sliceId} is already complete — cannot skip.`;
-            guardCode = "already_complete";
-            return;
-        }
-        wasAlreadySkipped = slice.status === "skipped";
-        if (!wasAlreadySkipped) {
-            updateSliceStatus(params.milestoneId, params.sliceId, "skipped");
-        }
-        // Cascade: mark every non-closed task as skipped so milestone completion
-        // doesn't trip the deep-task guard (#4375). Closed tasks (complete/done/
-        // skipped) are left untouched — we never downgrade.
-        const tasks = getSliceTasks(params.milestoneId, params.sliceId);
-        for (const task of tasks) {
-            if (!isClosedStatus(task.status)) {
-                updateTaskStatus(params.milestoneId, params.sliceId, task.id, "skipped");
-                tasksSkipped++;
-            }
-        }
-    });
-    if (guardError) {
-        return { ...base, error: guardError, errorCode: guardCode ?? undefined };
     }
-    return { ...base, tasksSkipped, wasAlreadySkipped };
+    return { ...base, tasksSkipped: outcome.tasksSkipped, wasAlreadySkipped: outcome.wasAlreadySkipped };
 }

package/dist/resources/extensions/gsd/undo.js

@@ -11,7 +11,7 @@ import { deriveState } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
 import { gsdRoot, resolveTasksDir, resolveSlicePath, resolveTaskFile, buildTaskFileName, buildSliceFileName } from "./paths.js";
 import { sendDesktopNotification } from "./notifications.js";
-import { getTask, getSlice, getSliceTasks, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
+import { getTask, getSlice, getSliceTasks, updateTaskStatus, resetSliceCascade } from "./gsd-db.js";
 import { renderPlanCheckboxes, renderRoadmapCheckboxes } from "./markdown-renderer.js";
 /**
  * Undo the last completed unit: revert git commits,
@@ -275,20 +275,21 @@ export async function handleResetSlice(args, ctx, _pi, basePath) {
             `Run /gsd reset-slice ${rawId} --force to confirm.`, "warning");
         return;
     }
-    // Reset all tasks
-    let tasksReset = 0;
+    // Reset all task statuses to "pending" and the slice to "active" in one
+    // atomic commit (DB is source of truth). Previously a per-task updateTaskStatus
+    // loop + a separate updateSliceStatus, which could leave a partial reset if
+    // interrupted mid-loop.
+    resetSliceCascade(mid, sid);
+    // Delete task summary files — projection cleanup, separate from the DB reset.
+    const tasksReset = tasks.length;
     let summariesDeleted = 0;
     for (const t of tasks) {
-        updateTaskStatus(mid, sid, t.id, "pending");
-        tasksReset++;
         const summaryPath = resolveTaskFile(basePath, mid, sid, t.id, "SUMMARY");
         if (summaryPath && existsSync(summaryPath)) {
             unlinkSync(summaryPath);
             summariesDeleted++;
         }
     }
-    // Reset slice status
-    updateSliceStatus(mid, sid, "active");
     // Delete slice summary and UAT files
     let sliceFilesDeleted = 0;
     const slicePath = resolveSlicePath(basePath, mid, sid);

package/dist/resources/extensions/gsd/worktree-git-recovery.js

@@ -0,0 +1,287 @@
+// Project/App: gsd-pi
+// File Purpose: Git checkout/stash/merge-state recovery primitives for worktree operations.
+/**
+ * Worktree Git Recovery — the recurring-bug hot spot, in one place.
+ *
+ * Owns the verbs that recover a repository from interrupted or conflicting
+ * git operations during worktree transitions:
+ *
+ *   - `checkoutBranchWithStashGuard` — branch switch with stash protection,
+ *     including the stash-pop EEXIST collision recovery for `.gsd/` runtime
+ *     files (force-checkout + targeted stash drop).
+ *   - `removeMergeStateFiles` — clears SQUASH_MSG / MERGE_HEAD / etc. left by
+ *     a failed merge so subsequent merges don't fail on stale state.
+ *   - `cleanupConflictState` — merge-abort + index reset + state-file cleanup
+ *     after a conflicted (including squash) merge.
+ *   - stash helpers (`popStashByRef`, `stashRefFromError`,
+ *     `stashAlreadyExistsFilesFromError`, `gsdJsonlFilesWithConflictMarkers`)
+ *     used by the merge pipeline in auto-worktree.ts.
+ *
+ * Extracted from auto-worktree.ts so recovery fixes land here instead of as
+ * embedded special cases in a 2,600-line orchestration module, and so the
+ * rules can be tested against scripted git states.
+ *
+ * The State Reconciliation drift repair (`state-reconciliation/drift/
+ * merge-state.ts`) keeps its own merge-state primitive by design — drift
+ * repairs own their raw primitives (see CONTEXT.md, Drift repair).
+ */
+import { execFileSync } from "node:child_process";
+import { existsSync, readFileSync, unlinkSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { debugLog } from "./debug-logger.js";
+import { logError, logWarning } from "./workflow-logger.js";
+import { nativeAddPaths, nativeCheckoutBranch, nativeConflictFiles, nativeLsFiles, nativeMergeAbort, nativeWorkingTreeStatus, } from "./native-git-bridge.js";
+import { resolveGitDir } from "./worktree-manager.js";
+/**
+ * Pop the stash entry created with `stashMarker` in its subject, resolving it
+ * to a concrete `stash@{n}` ref first so a concurrent stash push cannot make
+ * `git stash pop` grab the wrong entry.
+ *
+ * If `stashMarker` is null or no longer present in the stash list (e.g. a
+ * concurrent process popped/dropped it), leaves the stash list untouched and
+ * returns null.
+ *
+ * Throws on pop failure so callers can handle conflict cases the same way
+ * they would with the prior `git stash pop` form. When throwing after a
+ * targeted pop attempt, the error is annotated with the targeted stash ref.
+ *
+ * (Issue #4980 HIGH-6)
+ */
+export function popStashByRef(basePath, stashMarker) {
+    let popArg = null;
+    if (stashMarker) {
+        try {
+            const list = execFileSync("git", ["stash", "list", "--format=%gd%x00%s"], {
+                cwd: basePath,
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf-8",
+            }).trim().split("\n").filter(Boolean);
+            for (const entry of list) {
+                const [ref, subject] = entry.split("\0");
+                if (ref && subject?.includes(stashMarker)) {
+                    popArg = ref;
+                    break;
+                }
+            }
+        }
+        catch (err) {
+            logWarning("worktree", `stash list lookup failed; leaving stash untouched: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    if (!popArg) {
+        logWarning("worktree", "recorded stash entry could not be resolved; skipping automatic pop");
+        return null;
+    }
+    try {
+        execFileSync("git", ["stash", "pop", popArg], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+    }
+    catch (err) {
+        if (err && typeof err === "object") {
+            err.stashRef = popArg;
+        }
+        throw err;
+    }
+    return popArg;
+}
+/**
+ * Extract a stash ref annotation injected by popStashByRef() when git stash
+ * pop fails and we need to conditionally drop the exact stash entry later.
+ */
+export function stashRefFromError(err) {
+    if (!err || typeof err !== "object")
+        return null;
+    const stashRef = err.stashRef;
+    return typeof stashRef === "string" && stashRef.length > 0 ? stashRef : null;
+}
+export function stashAlreadyExistsFilesFromError(err) {
+    if (!err || typeof err !== "object")
+        return [];
+    const stderr = err.stderr;
+    const stderrText = typeof stderr === "string"
+        ? stderr
+        : stderr instanceof Uint8Array
+            ? Buffer.from(stderr).toString("utf-8")
+            : "";
+    const message = err instanceof Error ? err.message : String(err);
+    const text = `${stderrText}\n${message}`;
+    const files = new Set();
+    for (const line of text.split("\n")) {
+        const m = line.match(/^(.*?)\s+already exists, no checkout\s*$/i);
+        if (!m)
+            continue;
+        const filePath = m[1]?.trim();
+        if (filePath)
+            files.add(filePath);
+    }
+    return [...files];
+}
+/**
+ * Detect whether an on-disk file still contains unresolved merge conflict
+ * markers from a failed stash-pop or merge attempt.
+ *
+ * Returns false when the file cannot be read.
+ */
+export function hasConflictMarkers(filePath) {
+    try {
+        const content = readFileSync(filePath, "utf-8");
+        return content.includes("<<<<<<<") && content.includes("=======") && content.includes(">>>>>>>");
+    }
+    catch {
+        return false;
+    }
+}
+export function gsdJsonlFilesWithConflictMarkers(basePath) {
+    return nativeLsFiles(basePath, ".gsd/*.jsonl").filter((f) => hasConflictMarkers(join(basePath, f)));
+}
+export function removeMergeStateFiles(basePath, contextLabel) {
+    try {
+        for (const f of ["SQUASH_MSG", "MERGE_MSG", "MERGE_MODE", "MERGE_HEAD", "AUTO_MERGE"]) {
+            const rawPath = execFileSync("git", ["rev-parse", "--git-path", f], {
+                cwd: basePath,
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf-8",
+            }).trim();
+            const p = rawPath.length > 0
+                ? (isAbsolute(rawPath) ? rawPath : resolve(basePath, rawPath))
+                : join(resolveGitDir(basePath), f);
+            if (existsSync(p))
+                unlinkSync(p);
+        }
+    }
+    catch (err) {
+        logError("worktree", `${contextLabel} merge state cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
+export function cleanupConflictState(basePath) {
+    // Merge conflicts can leave unmerged index entries; merge-abort alone is not
+    // enough for squash merges (MERGE_HEAD is never written). Reset the merge
+    // index, then remove merge message files that native/libgit2 paths may have
+    // created.
+    try {
+        nativeMergeAbort(basePath);
+    }
+    catch (err) {
+        // MERGE_HEAD absent (squash merge path) — abort is a no-op, which is fine.
+        debugLog("conflict-cleanup:merge-abort-skipped", {
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+    try {
+        execFileSync("git", ["reset", "--merge"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+    }
+    catch (err) {
+        logError("worktree", `git reset --merge failed after merge conflict: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    removeMergeStateFiles(basePath, "conflict");
+}
+export function checkoutBranchWithStashGuard(basePath, branch, reason) {
+    let stashMarker = null;
+    let stashed = false;
+    const status = nativeWorkingTreeStatus(basePath).trim();
+    if (status.length > 0) {
+        stashMarker = `gsd-checkout-stash:${reason}:${process.pid}:${Date.now()}:${process.hrtime.bigint().toString(36)}`;
+        const stashListBefore = execFileSync("git", ["stash", "list"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: checkout stash [${stashMarker}]`], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        const stashListAfter = execFileSync("git", ["stash", "list"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        stashed = stashListAfter !== stashListBefore;
+    }
+    // Checkout and stash-restore are split so we can distinguish two failure
+    // modes: (a) checkout failed → HEAD did not move, restore stash and rethrow;
+    // (b) checkout succeeded but stash pop failed → HEAD moved to `branch` but
+    // the working-tree changes remain in the stash list. We surface a distinct
+    // error in case (b) so callers don't assume the branch switch was rolled back.
+    try {
+        nativeCheckoutBranch(basePath, branch);
+    }
+    catch (checkoutErr) {
+        if (stashed) {
+            try {
+                popStashByRef(basePath, stashMarker);
+            }
+            catch (restoreErr) {
+                logWarning("worktree", `git stash pop failed during checkout restore: ${restoreErr instanceof Error ? restoreErr.message : String(restoreErr)}`);
+            }
+        }
+        throw checkoutErr;
+    }
+    if (stashed) {
+        try {
+            popStashByRef(basePath, stashMarker);
+        }
+        catch (popErr) {
+            const msg = popErr instanceof Error ? popErr.message : String(popErr);
+            const stderr = popErr && typeof popErr === "object"
+                ? popErr.stderr
+                : undefined;
+            const stderrText = typeof stderr === "string"
+                ? stderr
+                : stderr instanceof Uint8Array
+                    ? Buffer.from(stderr).toString("utf-8")
+                    : "";
+            const stashPopMessage = `${stderrText}\n${msg}`.trim();
+            const alreadyExists = stashAlreadyExistsFilesFromError(popErr);
+            const gsdAlreadyExists = alreadyExists.filter((f) => f.startsWith(".gsd/"));
+            const nonGsdAlreadyExists = alreadyExists.filter((f) => !f.startsWith(".gsd/"));
+            const isUntrackedRestoreFailure = stashPopMessage.includes("could not restore untracked files from stash");
+            const stashRefForDrop = stashRefFromError(popErr);
+            const nonGsdUnmerged = nativeConflictFiles(basePath).filter((f) => !f.startsWith(".gsd/"));
+            const gsdContentConflicts = isUntrackedRestoreFailure
+                ? gsdJsonlFilesWithConflictMarkers(basePath)
+                : [];
+            const gsdConflictFiles = [...new Set([...gsdAlreadyExists, ...gsdContentConflicts])];
+            if (isUntrackedRestoreFailure &&
+                gsdConflictFiles.length > 0 &&
+                nonGsdAlreadyExists.length === 0 &&
+                nonGsdUnmerged.length === 0) {
+                for (const f of gsdConflictFiles) {
+                    execFileSync("git", ["checkout", "HEAD", "--", f], {
+                        cwd: basePath,
+                        stdio: ["ignore", "pipe", "pipe"],
+                        encoding: "utf-8",
+                    });
+                    nativeAddPaths(basePath, [f]);
+                }
+                if (stashRefForDrop) {
+                    try {
+                        execFileSync("git", ["stash", "drop", stashRefForDrop], {
+                            cwd: basePath,
+                            stdio: ["ignore", "pipe", "pipe"],
+                            encoding: "utf-8",
+                        });
+                    }
+                    catch (err) { /* stash may already be consumed */
+                        logWarning("worktree", `git stash drop failed: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                }
+                else {
+                    logWarning("worktree", "recorded stash entry could not be resolved; skipping automatic drop");
+                }
+                return;
+            }
+            const wrapped = new Error(`checkout to '${branch}' succeeded but stash restore failed; working tree changes remain in the stash list. Original error: ${msg}`);
+            if (stashRefForDrop)
+                wrapped.stashRef = stashRefForDrop;
+            throw wrapped;
+        }
+    }
+}

package/dist/resources/extensions/gsd/worktree-lifecycle.js

@@ -327,7 +327,15 @@ export function _enterMilestoneCore(s, deps, milestoneId, ctx, opts = {}) {
     // Handles the case where originalBasePath is falsy and basePath is itself
     // a worktree path — prevents double-nested worktree paths (#3729).
     const basePath = resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
-    const mode = opts.modeOverride ?? getIsolationMode(basePath);
+    // A stranded-recovery session that adopted the milestone branch in the
+    // project root must keep re-entering in that mode: the root checkout holds
+    // the branch, so creating the canonical worktree would fail with "already
+    // in use by another worktree". The override clears when the recovered
+    // milestone merges (_mergeAndExit), restoring configured isolation for
+    // subsequent milestones.
+    const mode = opts.modeOverride ??
+        s.strandedRecoveryIsolationMode ??
+        getIsolationMode(basePath);
     if (s.isolationDegraded) {
         if (mode === "worktree") {
             try {