@opengsd/gsd-pi 1.2.0-dev.844675c9 → 1.2.0-dev.955e4da0

package/dist/resources/extensions/gsd/auto-verification.js

@@ -2,11 +2,11 @@
 // File Purpose: Post-unit verification gate for GSD auto-mode units.
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { gsdProjectionRoot, resolveSlicePath, resolveMilestoneFile } from "./paths.js";
+import { resolveMilestoneValidationVerdict } from "./milestone-validation-verdict.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
 import { parseUnitId } from "./unit-id.js";
 import { isDbAvailable, getTask, getSliceTasks, getMilestoneSlices } from "./gsd-db.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
-import { extractVerdict } from "./verdict-parser.js";
 import { isClosedStatus } from "./status-guards.js";
 import { loadFile } from "./files.js";
 import { parseRoadmap } from "./parsers-legacy.js";
@@ -214,22 +214,22 @@ async function runValidateMilestonePostCheck(vctx, pauseAuto) {
     };
     const validationBasePath = resolveCanonicalMilestoneRoot(s.basePath, mid);
     const validationFile = join(gsdProjectionRoot(validationBasePath), "milestones", mid, `${mid}-VALIDATION.md`);
-    if (!validationFile) {
+    const validationContent = await loadFile(validationFile);
+    if (validationContent !== null && validationContent.trim() === "") {
         if (await reassessmentInvalidatedValidation()) {
             clearValidationRetry();
             return "continue";
         }
-        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. No VALIDATION.md was created.");
+        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. VALIDATION.md exists but is empty.");
     }
-    const validationContent = await loadFile(validationFile);
-    if (!validationContent) {
+    const verdict = await resolveMilestoneValidationVerdict(s.basePath, mid);
+    if (!verdict) {
         if (await reassessmentInvalidatedValidation()) {
             clearValidationRetry();
             return "continue";
         }
-        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. VALIDATION.md exists but is empty.");
+        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. No VALIDATION.md was created.");
     }
-    const verdict = extractVerdict(validationContent);
     if (verdict === "needs-attention") {
         ctx.ui.notify(`Milestone ${mid} validation returned verdict=needs-attention. Pausing for human review.`, "error");
         process.stderr.write([

package/dist/resources/extensions/gsd/auto-worktree-repair.js

@@ -3,6 +3,7 @@
 import { existsSync, lstatSync, readdirSync } from "node:fs";
 import { join } from "node:path";
 import { worktreePath } from "./worktree-manager.js";
+import { worktreesDirs } from "./worktree-placement.js";
 import { normalizeWorktreePathForCompare } from "./worktree-root.js";
 const defaultFs = {
     existsSync,
@@ -22,6 +23,13 @@ export function expectedAutoWorktreePath(projectRoot, milestoneId) {
         return null;
     return worktreePath(projectRoot, id);
 }
+/** Every path the milestone worktree may legitimately live at (canonical + legacy). */
+function candidateAutoWorktreePaths(projectRoot, milestoneId) {
+    const id = milestoneId?.trim();
+    if (!id || !isValidMilestoneId(id))
+        return [];
+    return worktreesDirs(projectRoot).map((dir) => join(dir, id));
+}
 export function resolvePausedAutoWorktreePath(input) {
     if (input.baseIsAutoWorktree)
         return input.basePath;
@@ -43,8 +51,8 @@ export function assessAutoWorktreeRepairTarget(input) {
     if (!expectedPath) {
         return { ok: false, reason: "missing expected worktree path" };
     }
-    const computedExpectedPath = expectedAutoWorktreePath(input.projectRoot, input.milestoneId);
-    if (!computedExpectedPath || !samePath(expectedPath, computedExpectedPath)) {
+    const candidatePaths = candidateAutoWorktreePaths(input.projectRoot, input.milestoneId);
+    if (candidatePaths.length === 0 || !candidatePaths.some((candidate) => samePath(expectedPath, candidate))) {
         return { ok: false, reason: "expected worktree path does not match milestone" };
     }
     if (!samePath(input.activeRoot, input.projectRoot) && !samePath(input.activeRoot, expectedPath)) {

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -8,28 +8,33 @@
  * manages create, enter, detect, and teardown for auto-mode worktrees.
  */
 import { existsSync, cpSync, readFileSync, readdirSync, mkdirSync, realpathSync, rmSync, unlinkSync, lstatSync as lstatSyncFn, } from "node:fs";
-import { dirname, isAbsolute, join, relative, resolve, sep as pathSep } from "node:path";
+import { dirname, isAbsolute, join, relative } from "node:path";
 import { GSDError, GSD_IO_ERROR, GSD_GIT_ERROR } from "./errors.js";
-import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, getSliceTasks, closeDatabase, openDatabase, getDbPath, } from "./gsd-db.js";
+import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, getSliceTasks, } from "./gsd-db.js";
+import { closeWorkflowDatabase, getWorkflowDatabasePath, openWorkflowDatabasePath, } from "./db-workspace.js";
 import { execFileSync } from "node:child_process";
 import { gsdRoot, resolveGsdPathContract } from "./paths.js";
-import { createWorktree, removeWorktree, resolveGitDir, worktreePath, isInsideWorktreesDir, } from "./worktree-manager.js";
+import { createWorktree, removeWorktree, worktreePath, isInsideWorktreesDir, } from "./worktree-manager.js";
 import { detectWorktreeName, nudgeGitBranchCache, } from "./worktree.js";
-import { isGsdWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
+import { findWorktreeSegment, isGsdWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
 import { autoResolveSafeConflictPaths } from "./git-conflict-resolve.js";
-import { MergeConflictError, createDraftPR, readIntegrationBranch, resolveMilestoneIntegrationBranch, RUNTIME_EXCLUSION_PATHS } from "./git-service.js";
-import { buildPrEvidence } from "./pr-evidence.js";
+import { MergeConflictError, readIntegrationBranch, resolveMilestoneIntegrationBranch, RUNTIME_EXCLUSION_PATHS } from "./git-service.js";
+import { buildPullRequestEvidence, createDraftPullRequestFromEvidence, } from "./pull-request-process.js";
 import { debugLog } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
+import { checkoutBranchWithStashGuard, cleanupConflictState, gsdJsonlFilesWithConflictMarkers, hasConflictMarkers, popStashByRef, removeMergeStateFiles, stashAlreadyExistsFilesFromError, stashRefFromError, } from "./worktree-git-recovery.js";
+// Re-export for existing callers/tests (auto-start.ts, checkout-branch-stash-guard.test.ts).
+export { checkoutBranchWithStashGuard } from "./worktree-git-recovery.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { runWorktreePostCreateHook } from "./worktree-post-create-hook.js";
 import { classifyProject } from "./detection.js";
-import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeMergeRegular, nativeConflictFiles, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, nativeWorktreeList, nativeLsFiles, } from "./native-git-bridge.js";
-import { CLOSEOUT_CONSISTENCY_BLOCKED_REASON, checkCloseoutConsistencyGate, formatCloseoutConsistencyBlock, } from "./closeout-consistency-gate.js";
+import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeMergeRegular, nativeConflictFiles, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeWorktreeList, nativeLsFiles, } from "./native-git-bridge.js";
+import { CLOSEOUT_CONSISTENCY_BLOCKED_REASON, } from "./closeout-consistency-gate.js";
+import { formatCloseoutProofBlock, proveMilestoneCloseout, } from "./milestone-closeout-proof.js";
 import { gsdHome } from "./gsd-home.js";
 import { createWorkspace } from "./workspace.js";
-import { _finalizeProjectionForMergeImpl, _projectRootToWorktreeImpl, _projectWorktreeToRootImpl, } from "./worktree-state-projection.js";
+import { WorktreeStateProjection } from "./worktree-state-projection.js";
 const PROJECT_PREFERENCES_FILE = "PREFERENCES.md";
 const LEGACY_PROJECT_PREFERENCES_FILE = "preferences.md";
 const LEGACY_DEEP_SETUP_RUNTIME_UNIT_FILES = new Set([
@@ -59,111 +64,6 @@ const ROOT_STATE_FILES = [
     // Back-sync (worktree → main) must NEVER overwrite the project root's copy
     // because the project root is authoritative for preferences (#2684).
 ];
-/**
- * Pop a stash entry by tracking the unique marker embedded in its message so
- * concurrent stash operations against the same project root cannot cause us to
- * pop the wrong entry.
- *
- * If `stashMarker` is null or no longer present in the stash list (e.g. a
- * concurrent process popped/dropped it), leaves the stash list untouched and
- * returns null.
- *
- * Throws on pop failure so callers can handle conflict cases the same way
- * they would with the prior `git stash pop` form. When throwing after a
- * targeted pop attempt, the error is annotated with the targeted stash ref.
- *
- * (Issue #4980 HIGH-6)
- */
-function popStashByRef(basePath, stashMarker) {
-    let popArg = null;
-    if (stashMarker) {
-        try {
-            const list = execFileSync("git", ["stash", "list", "--format=%gd%x00%s"], {
-                cwd: basePath,
-                stdio: ["ignore", "pipe", "pipe"],
-                encoding: "utf-8",
-            }).trim().split("\n").filter(Boolean);
-            for (const entry of list) {
-                const [ref, subject] = entry.split("\0");
-                if (ref && subject?.includes(stashMarker)) {
-                    popArg = ref;
-                    break;
-                }
-            }
-        }
-        catch (err) {
-            logWarning("worktree", `stash list lookup failed; leaving stash untouched: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
-    if (!popArg) {
-        logWarning("worktree", "recorded stash entry could not be resolved; skipping automatic pop");
-        return null;
-    }
-    try {
-        execFileSync("git", ["stash", "pop", popArg], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-    }
-    catch (err) {
-        if (err && typeof err === "object") {
-            err.stashRef = popArg;
-        }
-        throw err;
-    }
-    return popArg;
-}
-/**
- * Extract a stash ref annotation injected by popStashByRef() when git stash
- * pop fails and we need to conditionally drop the exact stash entry later.
- */
-function stashRefFromError(err) {
-    if (!err || typeof err !== "object")
-        return null;
-    const stashRef = err.stashRef;
-    return typeof stashRef === "string" && stashRef.length > 0 ? stashRef : null;
-}
-function stashAlreadyExistsFilesFromError(err) {
-    if (!err || typeof err !== "object")
-        return [];
-    const stderr = err.stderr;
-    const stderrText = typeof stderr === "string"
-        ? stderr
-        : stderr instanceof Uint8Array
-            ? Buffer.from(stderr).toString("utf-8")
-            : "";
-    const message = err instanceof Error ? err.message : String(err);
-    const text = `${stderrText}\n${message}`;
-    const files = new Set();
-    for (const line of text.split("\n")) {
-        const m = line.match(/^(.*?)\s+already exists, no checkout\s*$/i);
-        if (!m)
-            continue;
-        const filePath = m[1]?.trim();
-        if (filePath)
-            files.add(filePath);
-    }
-    return [...files];
-}
-/**
- * Detect whether an on-disk file still contains unresolved merge conflict
- * markers from a failed stash-pop or merge attempt.
- *
- * Returns false when the file cannot be read.
- */
-function hasConflictMarkers(filePath) {
-    try {
-        const content = readFileSync(filePath, "utf-8");
-        return content.includes("<<<<<<<") && content.includes("=======") && content.includes(">>>>>>>");
-    }
-    catch {
-        return false;
-    }
-}
-function gsdJsonlFilesWithConflictMarkers(basePath) {
-    return nativeLsFiles(basePath, ".gsd/*.jsonl").filter((f) => hasConflictMarkers(join(basePath, f)));
-}
 /**
  * Check if two filesystem paths resolve to the same real location.
  * Returns false if either path cannot be resolved (e.g. doesn't exist).
@@ -419,51 +319,6 @@ export const SAFE_AUTO_RESOLVE_PATTERNS = [
  * Covers `.gsd/` state files and common build artifacts. */
 export const isSafeToAutoResolve = (filePath) => filePath.startsWith(".gsd/") ||
     SAFE_AUTO_RESOLVE_PATTERNS.some((re) => re.test(filePath));
-function removeMergeStateFiles(basePath, contextLabel) {
-    try {
-        for (const f of ["SQUASH_MSG", "MERGE_MSG", "MERGE_MODE", "MERGE_HEAD", "AUTO_MERGE"]) {
-            const rawPath = execFileSync("git", ["rev-parse", "--git-path", f], {
-                cwd: basePath,
-                stdio: ["ignore", "pipe", "pipe"],
-                encoding: "utf-8",
-            }).trim();
-            const p = rawPath.length > 0
-                ? (isAbsolute(rawPath) ? rawPath : resolve(basePath, rawPath))
-                : join(resolveGitDir(basePath), f);
-            if (existsSync(p))
-                unlinkSync(p);
-        }
-    }
-    catch (err) {
-        logError("worktree", `${contextLabel} merge state cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-}
-function cleanupConflictState(basePath) {
-    // Merge conflicts can leave unmerged index entries; merge-abort alone is not
-    // enough for squash merges (MERGE_HEAD is never written). Reset the merge
-    // index, then remove merge message files that native/libgit2 paths may have
-    // created.
-    try {
-        nativeMergeAbort(basePath);
-    }
-    catch (err) {
-        // MERGE_HEAD absent (squash merge path) — abort is a no-op, which is fine.
-        debugLog("conflict-cleanup:merge-abort-skipped", {
-            error: err instanceof Error ? err.message : String(err),
-        });
-    }
-    try {
-        execFileSync("git", ["reset", "--merge"], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-    }
-    catch (err) {
-        logError("worktree", `git reset --merge failed after merge conflict: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    removeMergeStateFiles(basePath, "conflict");
-}
 // ─── Dispatch-Level Sync (project root ↔ worktree) ──────────────────────────
 /**
  * Sync milestone artifacts from project root INTO worktree before deriveState.
@@ -479,7 +334,7 @@ function cleanupConflictState(basePath) {
  * the bodies with raw paths.
  */
 export function syncProjectRootToWorktree(projectRoot, worktreePath_, milestoneId) {
-    _projectRootToWorktreeImpl(projectRoot, worktreePath_, milestoneId);
+    new WorktreeStateProjection().projectRootToWorktreePaths(projectRoot, worktreePath_, milestoneId);
 }
 /**
  * Path-string entry point to WorktreeStateProjection.projectWorktreeToRoot.
@@ -487,7 +342,7 @@ export function syncProjectRootToWorktree(projectRoot, worktreePath_, milestoneI
  * the projection-invariant tests can exercise the body with raw paths.
  */
 export function syncStateToProjectRoot(worktreePath_, projectRoot, milestoneId) {
-    _projectWorktreeToRootImpl(worktreePath_, projectRoot, milestoneId);
+    new WorktreeStateProjection().projectWorktreeToRootPaths(worktreePath_, projectRoot, milestoneId);
 }
 // ─── Resource Staleness ───────────────────────────────────────────────────
 /**
@@ -537,19 +392,12 @@ export function checkResourcesStale(versionOnStart) {
  * Returns the corrected base path.
  */
 export function escapeStaleWorktree(base) {
-    // Direct layout: /.gsd/worktrees/
-    const directMarker = `${pathSep}.gsd${pathSep}worktrees${pathSep}`;
-    let idx = base.indexOf(directMarker);
-    if (idx === -1) {
-        // Symlink-resolved layout: /.gsd/projects/<hash>/worktrees/
-        const symlinkRe = new RegExp(`\\${pathSep}\\.gsd\\${pathSep}projects\\${pathSep}[a-f0-9]+\\${pathSep}worktrees\\${pathSep}`);
-        const match = base.match(symlinkRe);
-        if (!match || match.index === undefined)
-            return base;
-        idx = match.index;
-    }
-    // base is inside .gsd/worktrees/<something> — extract the project root
-    const projectRoot = base.slice(0, idx);
+    const segment = findWorktreeSegment(base.replaceAll("\\", "/"));
+    if (!segment)
+        return base;
+    // base is inside .gsd/worktrees/<something> — extract the project root.
+    // Normalization is 1:1 on characters, so the segment index is valid in `base`.
+    const projectRoot = base.slice(0, segment.gsdIdx);
     // Guard: If the candidate project root's .gsd IS the user-level ~/.gsd,
     // the string-slice heuristic matched the wrong /.gsd/ boundary. This happens
     // when .gsd is a symlink into ~/.gsd/projects/<hash> and process.cwd()
@@ -829,7 +677,7 @@ export function syncGsdStateToWorktree(mainBasePath, worktreePath_) {
  * the shared project DB or the pre-upgrade DB reconciliation path above.
  */
 export function syncWorktreeStateBack(mainBasePath, worktreePath, milestoneId) {
-    return _finalizeProjectionForMergeImpl(mainBasePath, worktreePath, milestoneId);
+    return new WorktreeStateProjection().finalizeProjectionForMergePaths(mainBasePath, worktreePath, milestoneId);
 }
 export { runWorktreePostCreateHook } from "./worktree-post-create-hook.js";
 // ─── Auto-Worktree Branch Naming ───────────────────────────────────────────
@@ -906,109 +754,6 @@ export function enterBranchModeForMilestone(basePath, milestoneId) {
     }
     checkoutBranchWithStashGuard(basePath, branch, `enter-branch-mode:${milestoneId}`);
 }
-export function checkoutBranchWithStashGuard(basePath, branch, reason) {
-    let stashMarker = null;
-    let stashed = false;
-    const status = nativeWorkingTreeStatus(basePath).trim();
-    if (status.length > 0) {
-        stashMarker = `gsd-checkout-stash:${reason}:${process.pid}:${Date.now()}:${process.hrtime.bigint().toString(36)}`;
-        const stashListBefore = execFileSync("git", ["stash", "list"], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: checkout stash [${stashMarker}]`], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        const stashListAfter = execFileSync("git", ["stash", "list"], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        stashed = stashListAfter !== stashListBefore;
-    }
-    // Checkout and stash-restore are split so we can distinguish two failure
-    // modes: (a) checkout failed → HEAD did not move, restore stash and rethrow;
-    // (b) checkout succeeded but stash pop failed → HEAD moved to `branch` but
-    // the working-tree changes remain in the stash list. We surface a distinct
-    // error in case (b) so callers don't assume the branch switch was rolled back.
-    try {
-        nativeCheckoutBranch(basePath, branch);
-    }
-    catch (checkoutErr) {
-        if (stashed) {
-            try {
-                popStashByRef(basePath, stashMarker);
-            }
-            catch (restoreErr) {
-                logWarning("worktree", `git stash pop failed during checkout restore: ${restoreErr instanceof Error ? restoreErr.message : String(restoreErr)}`);
-            }
-        }
-        throw checkoutErr;
-    }
-    if (stashed) {
-        try {
-            popStashByRef(basePath, stashMarker);
-        }
-        catch (popErr) {
-            const msg = popErr instanceof Error ? popErr.message : String(popErr);
-            const stderr = popErr && typeof popErr === "object"
-                ? popErr.stderr
-                : undefined;
-            const stderrText = typeof stderr === "string"
-                ? stderr
-                : stderr instanceof Uint8Array
-                    ? Buffer.from(stderr).toString("utf-8")
-                    : "";
-            const stashPopMessage = `${stderrText}\n${msg}`.trim();
-            const alreadyExists = stashAlreadyExistsFilesFromError(popErr);
-            const gsdAlreadyExists = alreadyExists.filter((f) => f.startsWith(".gsd/"));
-            const nonGsdAlreadyExists = alreadyExists.filter((f) => !f.startsWith(".gsd/"));
-            const isUntrackedRestoreFailure = stashPopMessage.includes("could not restore untracked files from stash");
-            const stashRefForDrop = stashRefFromError(popErr);
-            const nonGsdUnmerged = nativeConflictFiles(basePath).filter((f) => !f.startsWith(".gsd/"));
-            const gsdContentConflicts = isUntrackedRestoreFailure
-                ? gsdJsonlFilesWithConflictMarkers(basePath)
-                : [];
-            const gsdConflictFiles = [...new Set([...gsdAlreadyExists, ...gsdContentConflicts])];
-            if (isUntrackedRestoreFailure &&
-                gsdConflictFiles.length > 0 &&
-                nonGsdAlreadyExists.length === 0 &&
-                nonGsdUnmerged.length === 0) {
-                for (const f of gsdConflictFiles) {
-                    execFileSync("git", ["checkout", "HEAD", "--", f], {
-                        cwd: basePath,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    nativeAddPaths(basePath, [f]);
-                }
-                if (stashRefForDrop) {
-                    try {
-                        execFileSync("git", ["stash", "drop", stashRefForDrop], {
-                            cwd: basePath,
-                            stdio: ["ignore", "pipe", "pipe"],
-                            encoding: "utf-8",
-                        });
-                    }
-                    catch (err) { /* stash may already be consumed */
-                        logWarning("worktree", `git stash drop failed: ${err instanceof Error ? err.message : String(err)}`);
-                    }
-                }
-                else {
-                    logWarning("worktree", "recorded stash entry could not be resolved; skipping automatic drop");
-                }
-                return;
-            }
-            const wrapped = new Error(`checkout to '${branch}' succeeded but stash restore failed; working tree changes remain in the stash list. Original error: ${msg}`);
-            if (stashRefForDrop)
-                wrapped.stashRef = stashRefForDrop;
-            throw wrapped;
-        }
-    }
-}
 // ─── Public API ────────────────────────────────────────────────────────────
 /**
  * Create a new auto-worktree for a milestone, chdir into it, and store
@@ -1519,10 +1264,10 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         const worktreeDbPath = join(contract.worktreeGsd ?? join(worktreeCwd, ".gsd"), "gsd.db");
         const mainDbPath = contract.projectDb;
         try {
-            const activeDbPath = getDbPath();
+            const activeDbPath = getWorkflowDatabasePath();
             if (activeDbPath && _shouldReconcileWorktreeDb(activeDbPath, mainDbPath)) {
-                closeDatabase();
-                if (!openDatabase(mainDbPath)) {
+                closeWorkflowDatabase();
+                if (!openWorkflowDatabasePath(mainDbPath)) {
                     throw new Error(`cannot open project DB at ${mainDbPath}`);
                 }
             }
@@ -1535,9 +1280,9 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             logError("worktree", message);
             throw new GSDError(GSD_GIT_ERROR, `${message}. Recovery reason: ${CLOSEOUT_CONSISTENCY_BLOCKED_REASON}.`);
         }
-        const closeoutGate = checkCloseoutConsistencyGate(milestoneId);
-        if (!closeoutGate.ok) {
-            throw new GSDError(GSD_GIT_ERROR, formatCloseoutConsistencyBlock(closeoutGate));
+        const closeoutProof = proveMilestoneCloseout(milestoneId);
+        if (!closeoutProof.ok) {
+            throw new GSDError(GSD_GIT_ERROR, formatCloseoutProofBlock(closeoutProof));
         }
     }
     // 2. Get completed slices for commit message
@@ -1840,10 +1585,10 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     // stashing so Windows releases the handles; reopen after. No-op on
     // POSIX, where advisory locks don't block git.
     const needsDbCycle = process.platform === "win32" && isDbAvailable();
-    const dbPathToReopen = needsDbCycle ? getDbPath() : null;
+    const dbPathToReopen = needsDbCycle ? getWorkflowDatabasePath() : null;
     if (needsDbCycle) {
         try {
-            closeDatabase();
+            closeWorkflowDatabase();
         }
         catch (err) {
             logWarning("worktree", `pre-stash db close failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -1888,7 +1633,7 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         : nativeMergeSquash(originalBasePath_, milestoneBranch);
     if (needsDbCycle && dbPathToReopen) {
         try {
-            openDatabase(dbPathToReopen);
+            openWorkflowDatabasePath(dbPathToReopen);
         }
         catch (err) {
             logWarning("worktree", `post-merge db reopen failed: ${err instanceof Error ? err.message : String(err)}`);
@@ -2213,7 +1958,7 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
                         stdio: ["ignore", "pipe", "pipe"],
                         encoding: "utf-8",
                     });
-                    const prEvidence = buildPrEvidence({
+                    const prEvidence = buildPullRequestEvidence({
                         milestoneId,
                         milestoneTitle,
                         changeType: "feat",
@@ -2222,7 +1967,7 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
                         rollbackNotes: ["Close the draft PR or revert the merge commit if review finds a behavior regression."],
                         how: "Generated by git.auto_pr after the milestone branch was pushed and merged locally.",
                     });
-                    const prUrl = createDraftPR(originalBasePath_, milestoneId, prEvidence.title, prEvidence.body, {
+                    const prUrl = createDraftPullRequestFromEvidence(originalBasePath_, milestoneId, prEvidence, {
                         head: milestoneBranch,
                         base: prTarget,
                     });

package/dist/resources/extensions/gsd/auto.js

@@ -25,7 +25,7 @@ import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
 import { writeLock, clearLock, clearStaleWorkerLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, emitOpenUnitEndForUnit, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
-import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
+import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, resolveEffectiveUnitIsolationMode, } from "./preferences.js";
 import { playNotificationBell, sendDesktopNotification } from "./notifications.js";
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, } from "./auto-budget.js";
 import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
@@ -54,6 +54,7 @@ import { getPriorSliceCompletionBlocker } from "./dispatch-guard.js";
 import { createAutoWorktree, teardownAutoWorktree, isInAutoWorktree, getAutoWorktreePath, mergeMilestoneToMain, autoWorktreeBranch, checkResourcesStale, escapeStaleWorktree, } from "./auto-worktree.js";
 import { pruneQueueOrder } from "./queue-order.js";
 import { startCommandPolling as _startCommandPolling, isRemoteConfigured } from "../remote-questions/manager.js";
+import { createMilestoneMergeTransaction } from "./milestone-merge-transaction.js";
 import { debugLog, isDebugEnabled, writeDebugSummary } from "./debug-logger.js";
 import { reconcileMergeState, verifyExpectedArtifact, } from "./auto-recovery.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
@@ -67,6 +68,7 @@ import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { updateProgressWidget as _updateProgressWidget, setCompletionProgressWidget, setAutoOutcomeWidget, setAutoActiveStatus, updateSliceProgressCache, clearSliceProgressCache, unitVerb, } from "./auto-dashboard.js";
 import { registerSigtermHandler as _registerSigtermHandler, deregisterSigtermHandler as _deregisterSigtermHandler, } from "./auto-supervisor.js";
 import { isDbAvailable, getMilestone, getMilestoneSlices, } from "./gsd-db.js";
+import { closeWorkflowDatabase } from "./db-workspace.js";
 import { markLatestActiveForWorkerCanceled } from "./db/unit-dispatches.js";
 import { writeUnitRuntimeRecord } from "./unit-runtime.js";
 import { countPendingCaptures } from "./captures.js";
@@ -109,7 +111,7 @@ void initTokenCounter().catch((err) => {
     logWarning("engine", `token counter warm-up failed: ${err instanceof Error ? err.message : String(err)}`);
 });
 export { STUB_RECOVERY_THRESHOLD, NEW_SESSION_TIMEOUT_MS, } from "./auto/session.js";
-import { autoSession as s } from "./auto-runtime-state.js";
+import { autoSession as s, getAutoRuntimeSnapshot } from "./auto-runtime-state.js";
 import { gsdHome } from "./gsd-home.js";
 import { createWorkspace, scopeMilestone } from "./workspace.js";
 import { registerAutoWorker, markWorkerStopping, } from "./db/auto-workers.js";
@@ -344,14 +346,11 @@ export function startAutoDetached(ctx, pi, base, verboseMode, options) {
 export function shouldUseWorktreeIsolation(basePath) {
     return getIsolationMode(basePath) === "worktree";
 }
-function resolveEffectiveUnitIsolationMode(configuredMode, isolationDegraded) {
-    return configuredMode === "worktree" && isolationDegraded ? "branch" : configuredMode;
-}
-export function _resolveEffectiveUnitIsolationModeForTest(configuredMode, isolationDegraded) {
-    return resolveEffectiveUnitIsolationMode(configuredMode, isolationDegraded);
+export function _resolveEffectiveUnitIsolationModeForTest(configuredMode, isolationDegraded, strandedRecoveryIsolationMode = null) {
+    return resolveEffectiveUnitIsolationMode(configuredMode, isolationDegraded, strandedRecoveryIsolationMode);
 }
 function getEffectiveUnitIsolationMode(basePath) {
-    return resolveEffectiveUnitIsolationMode(getIsolationMode(basePath), s.isolationDegraded);
+    return resolveEffectiveUnitIsolationMode(getIsolationMode(basePath), s.isolationDegraded, s.strandedRecoveryIsolationMode);
 }
 /** Crash recovery prompt — set by startAuto, consumed by the main loop */
 /** Pending verification retry — set when gate fails with retries remaining, consumed by autoLoop */
@@ -463,6 +462,7 @@ function stopAutoCommandPolling() {
 }
 export function getAutoDashboardData() {
     const ledger = getLedger();
+    const runtimeSnapshot = getAutoRuntimeSnapshot();
     const totals = ledger ? getProjectTotals(ledger.units) : null;
     const sessionId = s.cmdCtx?.sessionManager?.getSessionId?.() ?? null;
     const rtkSavings = sessionId && s.basePath
@@ -495,6 +495,7 @@ export function getAutoDashboardData() {
         pendingCaptureCount,
         rtkSavings,
         rtkEnabled,
+        toolSurface: runtimeSnapshot.toolSurface,
     };
 }
 // ─── Public API ───────────────────────────────────────────────────────────────
@@ -1003,12 +1004,13 @@ export async function stopAuto(ctx, pi, reason, options = {}) {
     // worktree was active, and whether the current milestone was merged before
     // stopAuto. The unmerged-work warning is only meaningful for real worktrees.
     try {
-        const { emitAutoExit, normalizeAutoExitReason } = await import("./worktree-telemetry.js");
+        const { autoExitReasonForTerminalOutcome, emitAutoExit, normalizeAutoExitReason, } = await import("./worktree-telemetry.js");
         // Normalize the free-form reason to a closed set so the telemetry
         // aggregator buckets stably. Raw detail is preserved in the phases.ts
         // notification and the notify'd error string.
         const rawReason = reason ?? "stop";
-        const normalizedReason = normalizeAutoExitReason(rawReason);
+        const normalizedReason = autoExitReasonForTerminalOutcome(options.terminalOutcome)
+            ?? normalizeAutoExitReason(rawReason);
         const telemetryBase = s.originalBasePath || s.basePath;
         emitAutoExit(telemetryBase, {
             reason: normalizedReason,
@@ -1184,8 +1186,7 @@ export async function stopAuto(ctx, pi, reason, options = {}) {
         // ── Step 6: DB cleanup ──
         if (isDbAvailable()) {
             try {
-                const { closeDatabase } = await import("./gsd-db.js");
-                closeDatabase();
+                closeWorkflowDatabase();
             }
             catch (e) {
                 debugLog("db-close-failed", {
@@ -1622,7 +1623,7 @@ export function buildWorktreeLifecycleDeps() {
     //   C4 (#5627) — GitServiceImpl constructor → gitServiceFactory
     //
     // Final WorktreeLifecycleDeps shape: 3 fields (gitServiceFactory,
-    // worktreeProjection, mergeMilestoneToMain). Down from 18 at slice-7
+    // worktreeProjection, mergeMilestoneToMain transaction runner). Down from 18 at slice-7
     // closure.
     return {
         gitServiceFactory: (basePath) => {
@@ -1630,7 +1631,7 @@ export function buildWorktreeLifecycleDeps() {
             return new GitServiceImpl(basePath, gitConfig);
         },
         worktreeProjection: new WorktreeStateProjection(),
-        mergeMilestoneToMain,
+        mergeMilestoneToMain: createMilestoneMergeTransaction(mergeMilestoneToMain),
     };
 }
 function buildLifecycle() {