@opengsd/gsd-pi 1.2.0-dev.844675c9 → 1.2.0-dev.84c56d87

package/dist/resources/extensions/gsd/worktree-lifecycle.js

@@ -327,7 +327,15 @@ export function _enterMilestoneCore(s, deps, milestoneId, ctx, opts = {}) {
     // Handles the case where originalBasePath is falsy and basePath is itself
     // a worktree path — prevents double-nested worktree paths (#3729).
     const basePath = resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
-    const mode = opts.modeOverride ?? getIsolationMode(basePath);
+    // A stranded-recovery session that adopted the milestone branch in the
+    // project root must keep re-entering in that mode: the root checkout holds
+    // the branch, so creating the canonical worktree would fail with "already
+    // in use by another worktree". The override clears when the recovered
+    // milestone merges (_mergeAndExit), restoring configured isolation for
+    // subsequent milestones.
+    const mode = opts.modeOverride ??
+        s.strandedRecoveryIsolationMode ??
+        getIsolationMode(basePath);
     if (s.isolationDegraded) {
         if (mode === "worktree") {
             try {

package/dist/resources/extensions/gsd/worktree-manager.js

@@ -3,7 +3,8 @@
 /**
  * GSD Worktree Manager
  *
- * Creates and manages git worktrees under .gsd/worktrees/<name>/.
+ * Creates and manages git worktrees under .gsd-worktrees/<name>/ (canonical;
+ * legacy .gsd/worktrees/<name>/ stays recognized — see worktree-placement.ts).
  * Each worktree gets its own branch (worktree/<name>) and a full
  * working copy of the project, enabling parallel work streams.
  *
@@ -11,7 +12,7 @@
  * the main branch, then dispatches an LLM-guided merge flow.
  *
  * Flow:
- *   1. create()  — git worktree add .gsd/worktrees/<name> -b worktree/<name>
+ *   1. create()  — git worktree add .gsd-worktrees/<name> -b worktree/<name>
  *   2. user works in the worktree (new plans, milestones, etc.)
  *   3. merge()   — LLM-guided reconciliation of .gsd/ artifacts back to main
  *   4. remove()  — git worktree remove + branch cleanup
@@ -24,6 +25,7 @@ import { logWarning } from "./workflow-logger.js";
 import { nativeBranchList, nativeBranchDelete, nativeBranchExists, nativeBranchForceReset, nativeCommit, nativeDetectMainBranch, nativeDiffContent, nativeDiffNameStatus, nativeDiffNumstat, nativeGetCurrentBranch, nativeIsAncestor, nativeLogOneline, nativeMergeSquash, nativeWorktreeAdd, nativeWorktreeList, nativeWorktreePrune, nativeWorktreeRemove, } from "./native-git-bridge.js";
 import { emitCanonicalRootRedirect } from "./worktree-telemetry.js";
 import { isGsdWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
+import { canonicalWorktreesDir, worktreePathFor, worktreesDirs } from "./worktree-placement.js";
 function deleteBranchIfPresent(basePath, branch, warningPrefix) {
     try {
         if (!nativeBranchExists(basePath, branch))
@@ -81,30 +83,39 @@ export function resolveGitDir(basePath) {
     }
     return gitPath;
 }
+/** Canonical container for new worktrees. For scans that must also see legacy
+ *  worktrees, use allWorktreesDirs(). */
 export function worktreesDir(basePath) {
-    return join(resolveWorktreeProjectRoot(basePath), ".gsd", "worktrees");
+    return canonicalWorktreesDir(resolveWorktreeProjectRoot(basePath));
 }
+/** Every container a GSD worktree may live in (canonical + legacy), canonical first. */
+export function allWorktreesDirs(basePath) {
+    return worktreesDirs(resolveWorktreeProjectRoot(basePath));
+}
+/** Path for worktree `name` — an existing legacy worktree keeps its location. */
 export function worktreePath(basePath, name) {
-    return join(worktreesDir(basePath), name);
+    return worktreePathFor(resolveWorktreeProjectRoot(basePath), name);
 }
 export function worktreeBranchName(name) {
     return `worktree/${name}`;
 }
 /**
- * Validate that a path is inside the .gsd/worktrees/ directory.
- * Resolves symlinks and normalizes ".." traversals before comparison
- * so that a symlink-resolved or crafted path cannot escape containment.
+ * Validate that a path is inside a GSD worktrees container (canonical
+ * .gsd-worktrees/ or legacy .gsd/worktrees/). Resolves symlinks and
+ * normalizes ".." traversals before comparison so that a symlink-resolved
+ * or crafted path cannot escape containment.
  *
  * Used as a safety gate before any destructive operation (rmSync,
  * nativeWorktreeRemove --force) to prevent #2365-style data loss.
  */
 export function isInsideWorktreesDir(basePath, targetPath) {
-    const wtDirPath = worktreesDir(basePath);
-    const wtDir = existsSync(wtDirPath) ? realpathSync(wtDirPath) : resolve(wtDirPath);
     const resolved = existsSync(targetPath) ? realpathSync(targetPath) : resolve(targetPath);
-    // The resolved path must start with the worktrees dir followed by a separator,
-    // not merely be a prefix match (e.g. ".gsd/worktrees-extra" must not match).
-    return resolved === wtDir || resolved.startsWith(wtDir + sep);
+    return allWorktreesDirs(basePath).some((wtDirPath) => {
+        const wtDir = existsSync(wtDirPath) ? realpathSync(wtDirPath) : resolve(wtDirPath);
+        // The resolved path must start with the worktrees dir followed by a separator,
+        // not merely be a prefix match (e.g. ".gsd/worktrees-extra" must not match).
+        return resolved === wtDir || resolved.startsWith(wtDir + sep);
+    });
 }
 function isRegisteredGitWorktreeAtPath(basePath, wtPath) {
     try {
@@ -200,11 +211,11 @@ export function buildManualValidationGuidance(basePath, milestoneId, opts = {})
     if (!milestoneId)
         return null;
     const validationRoot = resolveCanonicalMilestoneRoot(basePath, milestoneId);
-    const inWorktree = validationRoot.includes(`${sep}.gsd${sep}worktrees${sep}`);
+    const inWorktree = isGsdWorktreePath(validationRoot);
     const lines = [`Validate the work here: ${validationRoot}`];
     if (inWorktree) {
-        lines.push("This milestone runs in a git worktree, so the code lives under the hidden " +
-            `\`.gsd/worktrees/\` path. Open it with: cd "${validationRoot}"`);
+        lines.push("This milestone runs in a git worktree, so the code lives under the " +
+            `GSD worktrees directory. Open it with: cd "${validationRoot}"`);
     }
     if (opts.uatPath) {
         lines.push(`Follow the UAT checklist at: ${opts.uatPath}`);
@@ -224,21 +235,29 @@ export function createWorktree(basePath, name, opts = {}) {
     if (!/^[a-zA-Z0-9_-]+$/.test(name)) {
         throw new GSDError(GSD_PARSE_ERROR, `Invalid worktree name "${name}". Use only letters, numbers, hyphens, and underscores.`);
     }
-    const wtPath = worktreePath(basePath, name);
+    const existingPath = worktreePath(basePath, name);
     const branch = opts.branch ?? worktreeBranchName(name);
-    if (existsSync(wtPath)) {
+    if (existsSync(existingPath)) {
         // A valid git worktree is registered in `git worktree list` and has a .git
         // *file* with a gitdir: pointer. Leftover directories (no .git, a standalone
         // .git directory from accidental `git init`, or an orphan pointer) block
         // creation unless removed.
-        if (isRegisteredGitWorktreeAtPath(basePath, wtPath)) {
-            throw new GSDError(GSD_STALE_STATE, `Worktree "${name}" already exists at ${wtPath}`);
+        if (isRegisteredGitWorktreeAtPath(basePath, existingPath)) {
+            throw new GSDError(GSD_STALE_STATE, `Worktree "${name}" already exists at ${existingPath}`);
         }
-        removeStaleWorktreeDirectory(wtPath, name);
+        removeStaleWorktreeDirectory(existingPath, name);
     }
-    // Ensure the .gsd/worktrees/ directory exists
+    // New worktrees always land in the canonical container, even when a stale
+    // legacy directory was just cleaned up.
     const wtDir = worktreesDir(basePath);
+    const wtPath = join(wtDir, name);
     mkdirSync(wtDir, { recursive: true });
+    // When existingPath resolved to a legacy location, the canonical target may
+    // still hold a stale directory from a prior aborted creation (no .git marker).
+    // Remove it so git worktree add does not fail with "path already exists".
+    if (existingPath !== wtPath && existsSync(wtPath) && !isRegisteredGitWorktreeAtPath(basePath, wtPath)) {
+        removeStaleWorktreeDirectory(wtPath, name);
+    }
     // Prune any stale worktree entries from a previous removal
     nativeWorktreePrune(basePath);
     // Use the explicit start point (e.g. integration branch) if provided,
@@ -305,7 +324,8 @@ export function createWorktree(basePath, name, opts = {}) {
 }
 /**
  * List all GSD-managed worktrees.
- * Uses native worktree list and filters to those under .gsd/worktrees/.
+ * Uses native worktree list and filters to those under a GSD worktrees
+ * container (canonical .gsd-worktrees/ or legacy .gsd/worktrees/).
  */
 export function listWorktrees(basePath) {
     basePath = normalizeBasePathForWorktreeOps(basePath);
@@ -315,12 +335,8 @@ export function listWorktrees(basePath) {
     }
     const seenRoots = new Set();
     const worktreeRoots = baseVariants
-        .map(baseVariant => {
-        const path = join(baseVariant, ".gsd", "worktrees");
-        return {
-            normalized: normalizePathForComparison(path),
-        };
-    })
+        .flatMap(baseVariant => worktreesDirs(baseVariant))
+        .map(path => ({ normalized: normalizePathForComparison(path) }))
         .filter(root => {
         if (seenRoots.has(root.normalized))
             return false;
@@ -645,6 +661,7 @@ export function removeWorktree(basePath, name, opts = {}) {
  * This module uses a split representation (paths/exact/prefixes) for efficient matching.
  */
 const SKIP_PATHS = [
+    ".gsd-worktrees/",
     ".gsd/worktrees/",
     ".gsd/runtime/",
     ".gsd/activity/",

package/dist/resources/extensions/gsd/worktree-placement.js

@@ -0,0 +1,59 @@
+/**
+ * Worktree Placement module — owns WHERE GSD worktrees physically live.
+ *
+ * Canonical placement: `<projectRoot>/.gsd-worktrees/<name>` — a real
+ * directory that never crosses the `.gsd` symlink managed by repo-identity.
+ * Under the external-state layout (`.gsd → ~/.gsd/projects/<hash>/`), the
+ * legacy `.gsd/worktrees/` location materialised worktrees inside the user's
+ * home directory behind an opaque hash path; the canonical sibling keeps the
+ * working copy at the project root regardless of where `.gsd` state lives.
+ *
+ * Legacy placement (`<projectRoot>/.gsd/worktrees/<name>`, possibly resolving
+ * through the symlink to `~/.gsd/projects/<hash>/worktrees/<name>`) stays
+ * recognized so in-flight milestones keep working across upgrades:
+ *   - creation always uses the canonical location;
+ *   - resolution prefers an existing legacy worktree for the same name;
+ *   - containment checks accept membership in either location.
+ *
+ * Path → project identification lives in worktree-root.ts; this module owns
+ * only the forward direction (project + name → physical path).
+ */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+/** Directory name of the canonical worktrees container at the project root. */
+export const CANONICAL_WORKTREES_DIRNAME = ".gsd-worktrees";
+/** Canonical container for newly created worktrees. Never crosses the `.gsd` symlink. */
+export function canonicalWorktreesDir(projectRoot) {
+    return join(projectRoot, CANONICAL_WORKTREES_DIRNAME);
+}
+/** Legacy container (`.gsd/worktrees/`) — may resolve through the external-state symlink. */
+export function legacyWorktreesDir(projectRoot) {
+    return join(projectRoot, ".gsd", "worktrees");
+}
+/**
+ * All containers a GSD worktree may live in, canonical first.
+ * Use for listing, scanning, and containment checks.
+ */
+export function worktreesDirs(projectRoot) {
+    return [canonicalWorktreesDir(projectRoot), legacyWorktreesDir(projectRoot)];
+}
+/**
+ * Physical path for the worktree `name` under `projectRoot`.
+ *
+ * Canonical wins only when it has a `.git` marker (i.e. is a live worktree).
+ * A bare directory with no `.git` — a stale leftover from an aborted create
+ * or a partial cleanup — does not shadow an existing legacy worktree, so the
+ * legacy path is tried next. The legacy check remains a plain existsSync;
+ * callers that need a *registered* worktree validate the `.git` marker
+ * themselves (resolveCanonicalMilestoneRoot, getAutoWorktreePath).
+ * Falls back to canonical for new-worktree creation when neither path exists.
+ */
+export function worktreePathFor(projectRoot, name) {
+    const canonical = join(canonicalWorktreesDir(projectRoot), name);
+    if (existsSync(canonical) && existsSync(join(canonical, ".git")))
+        return canonical;
+    const legacy = join(legacyWorktreesDir(projectRoot), name);
+    if (existsSync(legacy))
+        return legacy;
+    return canonical;
+}

package/dist/resources/extensions/gsd/worktree-reentry.js

@@ -8,19 +8,23 @@
 import { readdirSync } from "node:fs";
 import { enterAutoWorktree, getAutoWorktreePath } from "./auto-worktree.js";
 import { getIsolationMode } from "./preferences.js";
-import { worktreesDir } from "./worktree-manager.js";
+import { allWorktreesDirs } from "./worktree-manager.js";
 import { isGsdWorktreePath, resolveWorktreeProjectRoot } from "./worktree-root.js";
 /**
- * Enumerate the live (valid git) auto-worktrees under <projectRoot>/.gsd/worktrees/.
+ * Enumerate the live (valid git) auto-worktrees in the project's worktree
+ * containers (canonical .gsd-worktrees/ and legacy .gsd/worktrees/).
  * Reuses getAutoWorktreePath's validation so stray directories are ignored.
  */
 function liveMilestoneWorktrees(projectRoot) {
-    let names;
-    try {
-        names = readdirSync(worktreesDir(projectRoot));
-    }
-    catch {
-        return [];
+    const names = new Set();
+    for (const dir of allWorktreesDirs(projectRoot)) {
+        try {
+            for (const name of readdirSync(dir))
+                names.add(name);
+        }
+        catch {
+            // container absent — skip
+        }
     }
     const live = [];
     for (const id of names) {

package/dist/resources/extensions/gsd/worktree-root.js

@@ -14,10 +14,16 @@ export function normalizeWorktreePathForCompare(path) {
     return process.platform === "win32" ? (trimmed || "/").toLowerCase() : (trimmed || "/");
 }
 /**
- * Find the GSD worktree segment in both direct project layout and the
- * symlink-resolved external-state layout used by ~/.gsd/projects/<hash>.
+ * Find the GSD worktree segment in the canonical layout (.gsd-worktrees/),
+ * the legacy direct layout (.gsd/worktrees/), and the symlink-resolved
+ * external-state layout used by ~/.gsd/projects/<hash>.
  */
 export function findWorktreeSegment(normalizedPath) {
+    const canonicalMarker = "/.gsd-worktrees/";
+    const canonicalIdx = normalizedPath.indexOf(canonicalMarker);
+    if (canonicalIdx !== -1) {
+        return { gsdIdx: canonicalIdx, afterWorktrees: canonicalIdx + canonicalMarker.length };
+    }
     const directMarker = "/.gsd/worktrees/";
     const directIdx = normalizedPath.indexOf(directMarker);
     if (directIdx !== -1) {
@@ -51,6 +57,17 @@ export function findWorktreeSegment(normalizedPath) {
 export function isGsdWorktreePath(path) {
     return findWorktreeSegment(path.replaceAll("\\", "/")) !== null;
 }
+/**
+ * Project-root prefix of a GSD worktree path, or null when the path is not
+ * inside a recognized worktree layout. Pure string split — no env handling,
+ * HOME guard, or filesystem fallbacks (resolveWorktreeProjectRoot adds
+ * those). Separator normalization is 1:1 on characters, so the prefix is
+ * sliced from the ORIGINAL string and keeps its separators.
+ */
+export function projectRootFromWorktreePath(path) {
+    const segment = findWorktreeSegment(path.replaceAll("\\", "/"));
+    return segment ? path.slice(0, segment.gsdIdx) : null;
+}
 /**
  * When a milestone worktree lives under the external-state layout
  * (`<gsdHome>/projects/<hash>/worktrees/<MID>/`, or the `GSD_STATE_DIR`
@@ -60,7 +77,9 @@ export function isGsdWorktreePath(path) {
  */
 export function resolveExternalStateProjectGsdFromWorktreePath(projectPath) {
     const normalized = resolve(projectPath).replaceAll("\\", "/");
-    // Direct layout — parent state is resolved via repoIdentity(git root).
+    // Canonical/direct layouts — parent state is resolved via repoIdentity(git root).
+    if (normalized.includes("/.gsd-worktrees/"))
+        return null;
     if (normalized.includes("/.gsd/worktrees/") && !normalized.includes("/.gsd/projects/")) {
         return null;
     }
@@ -117,12 +136,15 @@ function resolveProjectRootFromPath(path) {
     if (!segment) {
         return resolveNearestBootstrappedGsdRoot(path) ?? resolveGitWorkingTreeRoot(path) ?? path;
     }
+    // Slice at the first `.gsd` boundary, but never past the worktree segment:
+    // in the canonical layout (`<root>/.gsd-worktrees/<MID>/.gsd/...`) the first
+    // `/.gsd/` occurrence is the worktree-local projection dir, not the project
+    // root's state dir.
     const sepChar = path.includes("\\") ? "\\" : "/";
     const gsdMarker = `${sepChar}.gsd${sepChar}`;
     const markerIdx = path.indexOf(gsdMarker);
-    const candidate = markerIdx !== -1
-        ? path.slice(0, markerIdx)
-        : path.slice(0, segment.gsdIdx);
+    const sliceIdx = markerIdx !== -1 ? Math.min(markerIdx, segment.gsdIdx) : segment.gsdIdx;
+    const candidate = path.slice(0, sliceIdx);
     const gsdHomeNorm = normalizeWorktreePathForCompare(gsdHome());
     const candidateGsdPath = normalizeWorktreePathForCompare(join(candidate, ".gsd"));
     if (candidateGsdPath === gsdHomeNorm || candidateGsdPath.startsWith(`${gsdHomeNorm}/`)) {

package/dist/resources/extensions/gsd/worktree-safety.js

@@ -4,6 +4,7 @@ import { existsSync, lstatSync } from "node:fs";
 import { execFileSync } from "node:child_process";
 import { join, resolve } from "node:path";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
+import { worktreesDirs } from "./worktree-placement.js";
 import { listWorktrees } from "./worktree-manager.js";
 import { getCurrentBranch } from "./worktree.js";
 const fsOnlyDeps = {
@@ -59,15 +60,17 @@ export function createWorktreeSafetyModule(deps = defaultDeps) {
             const projectRoot = resolve(input.projectRoot);
             const unitRoot = resolve(input.unitRoot);
             const isolationMode = input.isolationMode ?? "worktree";
-            const expectedRoot = isolationMode === "worktree"
-                ? join(projectRoot, ".gsd", "worktrees", milestoneId)
-                : projectRoot;
-            if (!samePath(unitRoot, expectedRoot)) {
+            // A milestone worktree may live in the canonical container or the
+            // legacy one (pre-placement-change worktrees keep their location).
+            const expectedRoots = isolationMode === "worktree"
+                ? worktreesDirs(projectRoot).map((dir) => join(dir, milestoneId))
+                : [projectRoot];
+            if (!expectedRoots.some((expectedRoot) => samePath(unitRoot, expectedRoot))) {
                 return failure("invalid-root", isolationMode === "worktree"
                     ? `Unit root ${unitRoot} is not the expected worktree root for ${milestoneId}.`
                     : `Unit root ${unitRoot} is not the project root while isolation mode is ${isolationMode}.`, isolationMode === "worktree"
                     ? "Prepare the Unit in its canonical milestone worktree before allowing source writes."
-                    : "Run the Unit from the project root when worktree isolation is disabled.", { expectedRoot, unitRoot });
+                    : "Run the Unit from the project root when worktree isolation is disabled.", { expectedRoot: expectedRoots[0], unitRoot });
             }
             if (!deps.existsSync(unitRoot)) {
                 return failure("worktree-missing", `Worktree root ${unitRoot} does not exist.`, "Create or recover the milestone worktree before dispatching the source-writing Unit.", { unitRoot });

package/dist/resources/extensions/gsd/worktree-session-state.js

@@ -1,4 +1,5 @@
 // GSD worktree session state
+import { findWorktreeSegment, projectRootFromWorktreePath } from "./worktree-root.js";
 let originalCwd = null;
 export function getWorktreeOriginalCwd() {
     return originalCwd;
@@ -12,22 +13,22 @@ export function clearWorktreeOriginalCwd() {
 export function ensureWorktreeOriginalCwdFromPath(cwd = process.cwd()) {
     if (originalCwd)
         return originalCwd;
-    const marker = `${/\\/.test(cwd) ? "\\" : "/"}.gsd${/\\/.test(cwd) ? "\\" : "/"}worktrees${/\\/.test(cwd) ? "\\" : "/"}`;
-    const markerIdx = cwd.indexOf(marker);
-    if (markerIdx !== -1) {
-        originalCwd = cwd.slice(0, markerIdx);
-    }
+    const root = projectRootFromWorktreePath(cwd);
+    if (root)
+        originalCwd = root;
     return originalCwd;
 }
 export function getActiveWorktreeName() {
     if (!originalCwd)
         return null;
-    const cwd = process.cwd();
-    const wtDir = `${originalCwd.replace(/[\\/]+$/, "")}/.gsd/worktrees`.replaceAll("\\", "/");
-    const normalizedCwd = cwd.replaceAll("\\", "/");
-    if (!normalizedCwd.startsWith(`${wtDir}/`))
+    const normalizedCwd = process.cwd().replaceAll("\\", "/");
+    const normalizedOriginal = originalCwd.replace(/[\\/]+$/, "").replaceAll("\\", "/");
+    const segment = findWorktreeSegment(normalizedCwd);
+    if (!segment)
         return null;
-    const rel = normalizedCwd.slice(wtDir.length + 1);
-    const name = rel.split("/")[0];
+    // Only treat the cwd as an active worktree of OUR project root.
+    if (normalizedCwd.slice(0, segment.gsdIdx) !== normalizedOriginal)
+        return null;
+    const name = normalizedCwd.slice(segment.afterWorktrees).split("/")[0];
     return name || null;
 }

package/dist/resources/extensions/gsd/worktree-state-projection.js

@@ -60,6 +60,23 @@ const VERDICT_RE = /verdict:\s*[\w-]+/i;
  * Only overwrites when the source has a verdict — never clobbers a
  * worktree ASSESSMENT with a verdictless project-root copy.
  */
+function forceOverwriteValidationWithVerdict(srcMilestoneDir, dstMilestoneDir, milestoneId) {
+    if (!existsSync(srcMilestoneDir) || !milestoneId)
+        return;
+    const srcFile = join(srcMilestoneDir, `${milestoneId}-VALIDATION.md`);
+    if (!existsSync(srcFile))
+        return;
+    try {
+        const srcContent = readFileSync(srcFile, "utf-8");
+        if (!VERDICT_RE.test(srcContent))
+            return;
+        mkdirSync(dstMilestoneDir, { recursive: true });
+        safeCopy(srcFile, join(dstMilestoneDir, `${milestoneId}-VALIDATION.md`), { force: true });
+    }
+    catch (err) {
+        logWarning("worktree", `validation force-copy failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}
 function forceOverwriteAssessmentsWithVerdict(srcMilestoneDir, dstMilestoneDir) {
     if (!existsSync(srcMilestoneDir))
         return;
@@ -211,7 +228,10 @@ export function _projectRootToWorktreeImpl(projectRoot, worktreePath_, milestone
     // session resume the DB is rebuilt from disk, and if the stale ASSESSMENT
     // persists, checkNeedsRunUat finds no passing verdict → re-dispatches
     // run-uat indefinitely (stuck-loop ×9).
-    forceOverwriteAssessmentsWithVerdict(join(prGsd, "milestones", milestoneId), join(wtGsd, "milestones", milestoneId));
+    const prMilestoneDir = join(prGsd, "milestones", milestoneId);
+    const wtMilestoneDir = join(wtGsd, "milestones", milestoneId);
+    forceOverwriteValidationWithVerdict(prMilestoneDir, wtMilestoneDir, milestoneId);
+    forceOverwriteAssessmentsWithVerdict(prMilestoneDir, wtMilestoneDir);
     // Forward-sync completed-units.json from project root to worktree.
     // Project root is authoritative for completion state after crash recovery;
     // without this, the worktree re-dispatches already-completed units (#1886).
@@ -354,14 +374,20 @@ export class WorktreeStateProjection {
      * any Unit dispatches.
      */
     projectRootToWorktree(scope) {
-        _projectRootToWorktreeImpl(scope.workspace.projectRoot, scope.workspace.worktreeRoot ?? scope.workspace.projectRoot, scope.milestoneId);
+        this.projectRootToWorktreePaths(scope.workspace.projectRoot, scope.workspace.worktreeRoot ?? scope.workspace.projectRoot, scope.milestoneId);
+    }
+    projectRootToWorktreePaths(projectRoot, worktreePath, milestoneId) {
+        _projectRootToWorktreeImpl(projectRoot, worktreePath, milestoneId);
     }
     /**
      * Project state from the auto-worktree back onto the project root for `scope`.
      * Called by the post-unit pipeline between Units.
      */
     projectWorktreeToRoot(scope) {
-        _projectWorktreeToRootImpl(scope.workspace.worktreeRoot ?? scope.workspace.projectRoot, scope.workspace.projectRoot, scope.milestoneId);
+        this.projectWorktreeToRootPaths(scope.workspace.worktreeRoot ?? scope.workspace.projectRoot, scope.workspace.projectRoot, scope.milestoneId);
+    }
+    projectWorktreeToRootPaths(worktreePath, projectRoot, milestoneId) {
+        _projectWorktreeToRootImpl(worktreePath, projectRoot, milestoneId);
     }
     /**
      * Final projection from the auto-worktree to the project root before
@@ -373,6 +399,9 @@ export class WorktreeStateProjection {
      * telemetry on what crossed the boundary.
      */
     finalizeProjectionForMerge(scope) {
-        return _finalizeProjectionForMergeImpl(scope.workspace.projectRoot, scope.workspace.worktreeRoot ?? scope.workspace.projectRoot, scope.milestoneId);
+        return this.finalizeProjectionForMergePaths(scope.workspace.projectRoot, scope.workspace.worktreeRoot ?? scope.workspace.projectRoot, scope.milestoneId);
+    }
+    finalizeProjectionForMergePaths(projectRoot, worktreePath, milestoneId) {
+        return _finalizeProjectionForMergeImpl(projectRoot, worktreePath, milestoneId);
     }
 }

package/dist/resources/extensions/gsd/worktree-telemetry.js

@@ -63,6 +63,18 @@ export function normalizeAutoExitReason(rawReason) {
                                                         ? reasonLc
                                                         : "other";
 }
+export function autoExitReasonForTerminalOutcome(outcome) {
+    switch (outcome?.code) {
+        case "all-complete":
+            return "all-complete";
+        case "settlement-blocked":
+            return "blocked";
+        case "no-remaining-units":
+            return "stop";
+        default:
+            return null;
+    }
+}
 // ─── Emitters ────────────────────────────────────────────────────────────
 export function emitWorktreeCreated(projectRoot, milestoneId, meta = {}) {
     emitJournalEvent(projectRoot, baseEntry("worktree-created", {

package/dist/resources/extensions/search-the-web/native-search.js

@@ -214,9 +214,11 @@ export function registerNativeSearchHooks(pi) {
             isAnthropic = isAnthropicProvider && payloadLooksAnthropic !== false;
         }
         else {
-            // Last resort: session-restore paths where the SDK doesn't pass model.
-            // The model-name prefix is best-effort and assumes direct Anthropic.
-            isAnthropic = payloadLooksAnthropic === true;
+            // No authoritative provider info available (no event.model, no model_select).
+            // Do NOT inject native web_search — guessing on model name alone causes 400
+            // "unsupported_value" errors when the actual provider (copilot, openrouter,
+            // proxy, etc.) doesn't expose the server-side search tool (#648).
+            isAnthropic = false;
         }
         if (!isAnthropic)
             return;

package/dist/resources/extensions/shared/browser-contract.js

@@ -0,0 +1,59 @@
+// Project/App: gsd-pi
+// File Purpose: Browser Automation Contract — the single source for the canonical
+// Pi-facing browser tool vocabulary. Engine adapters (legacy Playwright, managed
+// gsd-browser), UAT policy, dispatch preflight, and evidence detection all derive
+// their browser tool knowledge from this module instead of re-listing names.
+/**
+ * Canonical `browser_*` tool names of the Browser Automation Contract.
+ *
+ * These are the product-level names Units see regardless of which Browser
+ * Automation Engine serves them (ADR-024). Adding a capability here is the
+ * one-line vocabulary change; the engine adapters and presentation surfaces
+ * are typed against this list, so missing coverage fails typecheck.
+ */
+export const BROWSER_CONTRACT_TOOL_NAMES = [
+    "browser_navigate",
+    "browser_click",
+    "browser_type",
+    "browser_fill_form",
+    "browser_click_ref",
+    "browser_fill_ref",
+    "browser_wait_for",
+    "browser_assert",
+    "browser_verify",
+    "browser_screenshot",
+    "browser_snapshot_refs",
+    "browser_find",
+    "browser_get_console_logs",
+    "browser_get_network_logs",
+    "browser_evaluate",
+    "browser_reload",
+    "browser_batch",
+    "browser_act",
+];
+const BROWSER_CONTRACT_TOOL_NAME_SET = new Set(BROWSER_CONTRACT_TOOL_NAMES);
+export function isBrowserContractToolName(name) {
+    return BROWSER_CONTRACT_TOOL_NAME_SET.has(name);
+}
+/**
+ * Whether a canonical (non-MCP-prefixed) tool name belongs to the browser tool
+ * family. Broader than the contract list on purpose: an External MCP Client or
+ * host integration may supply additional `browser_*` tools that still satisfy
+ * browser-backed UAT.
+ */
+export function hasBrowserContractPrefix(canonicalToolName) {
+    return canonicalToolName.startsWith("browser_");
+}
+/**
+ * Contract tool names whose appearance in prose marks browser-backed UAT
+ * activity (requirement or evidence language). Consumed by the
+ * browser-evidence regexes so textual detection stays derived from the
+ * contract vocabulary.
+ */
+export const BROWSER_EVIDENCE_SIGNAL_TOOL_NAMES = [
+    "browser_assert",
+    "browser_batch",
+    "browser_find",
+    "browser_verify",
+    "browser_snapshot_refs",
+];