@opengsd/gsd-pi 1.2.0-dev.955e4da0 → 1.2.0-dev.9ad8ae33

package/dist/resources/extensions/gsd/auto-start.js

@@ -18,6 +18,7 @@ import { ensureGsdSymlink, isInheritedRepo, validateProjectId } from "./repo-ide
 import { migrateToExternalState, recoverFailedMigration } from "./migrate-external.js";
 import { collectSecretsFromManifest } from "../get-secrets-from-user.js";
 import { gsdRoot, resolveMilestoneFile } from "./paths.js";
+import { milestoneEntryBlockedGuidance } from "./guidance.js";
 import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock, readCrashLock, isLockProcessAlive } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
@@ -25,7 +26,8 @@ import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
 import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeBranchList, nativeBranchExists, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, nativeHasChanges, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
-import { getAutoWorktreePath, checkoutBranchWithStashGuard } from "./auto-worktree.js";
+import { getAutoWorktreePath } from "./auto-worktree.js";
+import { checkoutBranchWithStashGuard } from "./worktree-git-recovery.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
 import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
@@ -740,12 +742,14 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     // phase-specific planning model for a discuss turn (#2829).
     //
     // Precedence:
-    // 1) Explicit session override via /gsd model (this session)
-    // 2) Current session model from settings/session restore (if provider ready)
-    // 3) GSD model preferences from PREFERENCES.md (validated against live auth)
+    // 1) Explicit session override via /gsd model or /gsd auto --model (this session)
+    // 2) GSD model preferences from PREFERENCES.md (validated against live auth)
+    // 3) Current session model from settings/session restore (if provider ready)
     //
-    // This preserves #3517 defaults while honoring explicit runtime model
-    // selection for subsequent /gsd runs in the same session.
+    // PREFERENCES.md wins over the ambient session default (#3517) so /gsd auto
+    // does not stick on claude-code/claude-sonnet-4-6 when the user configured
+    // models via /gsd workflow-preferences or PREFERENCES.md. Custom providers
+    // still skip PREFERENCES.md entirely (#4122).
     //
     // Exception (#4122): when the session provider is a custom provider declared
     // in ~/.gsd/agent/models.json (Ollama, vLLM, OpenAI-compatible proxy, etc.),
@@ -757,7 +761,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
     const sessionProviderIsCustom = isCustomProvider(ctx.model?.provider);
     const preferredModel = sessionProviderIsCustom
         ? null
-        : resolveDefaultSessionModel(ctx.model?.provider);
+        : resolveDefaultSessionModel(ctx.model?.provider, base);
     // Validate the preferred model against the live registry + provider auth so
     // an unconfigured PREFERENCES.md entry (no API key / OAuth) can't become the
     // start-model snapshot. Without this, every subsequent unit would try to
@@ -780,8 +784,8 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         : null;
     const startThinkingSnapshot = pi.getThinkingLevel();
     const startModelSnapshot = manualSessionOverride
-        ?? currentSessionModel
         ?? validatedPreferredModel
+        ?? currentSessionModel
         ?? null;
     try {
         // Validate GSD_PROJECT_ID early so the user gets immediate feedback
@@ -972,9 +976,26 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 state = await deriveState(wtPath);
             }
         }
-        const blockingStrandedRecoveryAction = state.activeMilestone
-            ? strandedRecoveryActions.find((action) => action.milestoneId !== state.activeMilestone?.id) ?? strandedRecoveryAction
-            : strandedRecoveryAction;
+        const requestedMilestoneLock = process.env.GSD_MILESTONE_LOCK?.trim() || null;
+        const lockedActiveMilestone = requestedMilestoneLock && state.activeMilestone?.id === requestedMilestoneLock;
+        let blockingStrandedRecoveryAction;
+        if (lockedActiveMilestone) {
+            // Parallel worker or explicit `/gsd auto Mxxx`: sibling milestones'
+            // stranded work must not block this milestone's resumption, and the
+            // downstream `strandedRecoveryAction` (used for currentMilestoneId,
+            // setActiveMilestoneId, and adoptStrandedMilestone) must be scoped to
+            // the locked milestone only. Falling back to the first sibling action
+            // would mis-target adoption (#742).
+            const lockMatch = strandedRecoveryActions.find((action) => action.milestoneId === requestedMilestoneLock) ?? null;
+            blockingStrandedRecoveryAction = lockMatch;
+            strandedRecoveryAction = lockMatch;
+        }
+        else if (state.activeMilestone) {
+            blockingStrandedRecoveryAction = strandedRecoveryActions.find((action) => action.milestoneId !== state.activeMilestone?.id) ?? strandedRecoveryAction;
+        }
+        else {
+            blockingStrandedRecoveryAction = strandedRecoveryAction;
+        }
         if (blockingStrandedRecoveryAction) {
             if (!state.activeMilestone) {
                 ctx.ui.notify(formatStrandedWorkBlockerMessage(blockingStrandedRecoveryAction, null), "error");
@@ -987,6 +1008,9 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             strandedRecoveryAction = blockingStrandedRecoveryAction;
             ctx.ui.notify(formatStrandedWorkRecoveryMessage(strandedRecoveryAction), "info");
         }
+        else if (lockedActiveMilestone) {
+            strandedRecoveryAction = null;
+        }
         if (process.env.GSD_HEADLESS === "1" &&
             orphanAuditRecovered &&
             !state.activeMilestone &&
@@ -1249,8 +1273,10 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             const normalized = p.replaceAll("\\", "/");
             if (findWorktreeSegment(normalized) !== null)
                 return true;
-            // The container directory itself (no trailing worktree name).
-            return normalized.endsWith("/.gsd/worktrees") || normalized.endsWith("/.gsd-worktrees");
+            // The container directory itself (no trailing worktree name), in any layout.
+            return normalized.endsWith("/.gsd/worktrees")
+                || normalized.endsWith("/.gsd-worktrees")
+                || /\/\.gsd\/projects\/[^/]+\/worktrees$/.test(normalized);
         };
         if (s.currentMilestoneId &&
             (getIsolationMode(base) !== "none" || strandedRecoveryAction?.recoveryMode) &&
@@ -1267,11 +1293,8 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 if (enterResult.reason === "lease-conflict") {
                     ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: lease is held by another worker.`, "error");
                 }
-                else if (enterResult.reason === "creation-failed") {
-                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: worktree/branch creation failed. Isolation is degraded.`, "error");
-                }
-                else if (enterResult.reason === "isolation-degraded") {
-                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: isolation is degraded from a prior worktree failure. Close processes locking the worktree and retry, or run /gsd doctor fix.`, "error");
+                else if (enterResult.reason === "creation-failed" || enterResult.reason === "isolation-degraded") {
+                    ctx.ui.notify(milestoneEntryBlockedGuidance(s.currentMilestoneId, enterResult.reason), "error");
                 }
                 else if (enterResult.reason === "invalid-milestone-id") {
                     ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: milestone id is invalid.`, "error");

package/dist/resources/extensions/gsd/auto-tool-tracking.js

@@ -4,6 +4,7 @@
  * can distinguish "waiting for tool completion" from "truly idle".
  */
 import { stripMcpToolPrefix } from "@gsd/pi-ai";
+import { TOOL_SURFACE_NOT_READY } from "./tool-surface-readiness.js";
 const inFlightTools = new Map();
 /**
  * Tools that block waiting for human input by design.
@@ -117,6 +118,14 @@ export function clearInFlightTools() {
  */
 const TOOL_INVOCATION_ERROR_RE = /Validation failed for tool|Input validation error|Invalid arguments for tool|MCP error -32602|No such tool available|Expected ',' or '\}'(?: after property value)?(?: in JSON)?|Unexpected end of JSON|Unexpected token.*in JSON|does not provide an export named|Named export .* not found|Cannot find module|ERR_MODULE_NOT_FOUND|ERR_MODULE_NOT_EXPORTED|ERR_PACKAGE_PATH_NOT_EXPORTED/i;
 const DETERMINISTIC_POLICY_ERROR_RE = /(?:^|\b)(?:HARD BLOCK:|Blocked: \/gsd queue is a planning tool|Direct writes to \.gsd\/STATE\.md and \.gsd\/gsd\.db are blocked|This is a mechanical gate)/i;
+/**
+ * Matches the runtime's "tool not registered" error. Unlike the deterministic
+ * invocation failures above, this one is usually transient: the workflow MCP
+ * server registers its tool surface asynchronously after session start, so a
+ * Unit's first tool call can race the registration. Callers should retry
+ * (bounded) instead of breaking the loop.
+ */
+const TOOL_UNAVAILABLE_ERROR_RE = new RegExp(`No such tool available|${TOOL_SURFACE_NOT_READY}`, "i");
 /**
  * Returns true if the error message indicates a deterministic invocation or
  * policy failure (as opposed to a normal tool execution error).
@@ -126,6 +135,15 @@ export function isToolInvocationError(errorMsg) {
         return false;
     return TOOL_INVOCATION_ERROR_RE.test(errorMsg) || isDeterministicPolicyError(errorMsg);
 }
+/**
+ * Returns true if the error message indicates the called tool was not on the
+ * session's tool surface (MCP startup race — see TOOL_UNAVAILABLE_ERROR_RE).
+ */
+export function isToolUnavailableError(errorMsg) {
+    if (!errorMsg)
+        return false;
+    return TOOL_UNAVAILABLE_ERROR_RE.test(errorMsg);
+}
 /**
  * Returns true if the error message indicates the tool was skipped because
  * a queued user message interrupted the turn (#3595).  Retrying will produce

package/dist/resources/extensions/gsd/auto-unit-closeout.js

@@ -36,17 +36,17 @@ export function isSuspiciousGhostCompletion(ctx, startedAt, maxElapsedMs = GHOST
         activity.assistantMessages === 0);
 }
 /**
- * Snapshot metrics, save activity log, and fire-and-forget memory extraction
- * for a completed unit. Returns the activity log file path (if any).
+ * Snapshot metrics, save activity log, extract memories, and record the git
+ * transaction for a completed auto-mode unit.
  */
-export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
-    const modelId = ctx.model?.id ?? "unknown";
-    snapshotUnitMetrics(ctx, unitType, unitId, startedAt, modelId, opts);
-    const activityFile = saveActivityLog(ctx, basePath, unitType, unitId);
+export async function closeoutAutoUnit(request) {
+    const modelId = request.ctx.model?.id ?? "unknown";
+    snapshotUnitMetrics(request.ctx, request.unitType, request.unitId, request.startedAt, modelId, request.opts);
+    const activityFile = saveActivityLog(request.ctx, request.basePath, request.unitType, request.unitId);
     if (activityFile) {
         try {
-            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import('./memory-extractor.js');
-            const llmCallFn = buildMemoryLLMCall(ctx);
+            const { buildMemoryLLMCall, extractMemoriesFromUnit } = await import("./memory-extractor.js");
+            const llmCallFn = buildMemoryLLMCall(request.ctx);
             if (llmCallFn) {
                 // Awaited: a fire-and-forget here lets memory-extractor writes land in
                 // .gsd/ after closeoutUnit returns but before the milestone merge
@@ -55,10 +55,10 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
                 // bounded by the extractor's LLM call, which is the acceptable price
                 // for not racing the merge boundary.
                 try {
-                    await extractMemoriesFromUnit(activityFile, unitType, unitId, llmCallFn);
+                    await extractMemoriesFromUnit(activityFile, request.unitType, request.unitId, llmCallFn);
                 }
                 catch (err) {
-                    logWarning("engine", `memory extraction failed for ${unitType}/${unitId}: ${err.message}`);
+                    logWarning("engine", `memory extraction failed for ${request.unitType}/${request.unitId}: ${err.message}`);
                 }
             }
         }
@@ -66,22 +66,46 @@ export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, o
             logWarning("engine", `operation failed: ${err instanceof Error ? err.message : String(err)}`);
         }
     }
-    if (opts?.traceId && opts.turnId && opts.gitAction && opts.gitStatus) {
+    const gitTransaction = resolveGitTransactionOptions(request.opts);
+    if (gitTransaction) {
         writeTurnGitTransaction({
-            basePath,
-            traceId: opts.traceId,
-            turnId: opts.turnId,
-            unitType,
-            unitId,
+            basePath: request.basePath,
+            traceId: gitTransaction.traceId,
+            turnId: gitTransaction.turnId,
+            unitType: request.unitType,
+            unitId: request.unitId,
             stage: "record",
-            action: opts.gitAction,
-            push: opts.gitPush === true,
-            status: opts.gitStatus,
-            error: opts.gitError,
+            action: gitTransaction.gitAction,
+            push: gitTransaction.gitPush === true,
+            status: gitTransaction.gitStatus,
+            error: gitTransaction.gitError,
             metadata: {
                 activityFile,
             },
         });
     }
-    return activityFile ?? undefined;
+    return {
+        ...(activityFile ? { activityFile } : {}),
+        gitTransactionRecorded: Boolean(gitTransaction),
+    };
+}
+function resolveGitTransactionOptions(opts) {
+    if (!opts?.traceId || !opts.turnId || !opts.gitAction || !opts.gitStatus)
+        return null;
+    return {
+        traceId: opts.traceId,
+        turnId: opts.turnId,
+        gitAction: opts.gitAction,
+        gitStatus: opts.gitStatus,
+        gitPush: opts.gitPush,
+        gitError: opts.gitError,
+    };
+}
+/**
+ * Compatibility wrapper for existing auto-loop callers. New code should prefer
+ * closeoutAutoUnit so the closeout request and result stay explicit.
+ */
+export async function closeoutUnit(ctx, basePath, unitType, unitId, startedAt, opts) {
+    const result = await closeoutAutoUnit({ ctx, basePath, unitType, unitId, startedAt, opts });
+    return result.activityFile;
 }

package/dist/resources/extensions/gsd/auto-unit-tool-scope.js

@@ -1,22 +1,14 @@
 import { parseUnitId } from "./unit-id.js";
 import { AUTO_UNIT_SCOPED_TOOLS, getForbiddenGsdToolReason, } from "./unit-tool-contracts.js";
-import { WORKFLOW_TOOL_ALIAS_PAIRS, canonicalWorkflowSurfaceToolName, isWorkflowSurfaceAliasTool, stripMcpToolPrefix, } from "./workflow-tool-surface.js";
+import { WORKFLOW_TOOL_ALIAS_PAIRS, isWorkflowSurfaceAliasTool, stripMcpToolPrefix, } from "./workflow-tool-surface.js";
+import { canonicalWorkflowToolName } from "./engine-hook-contract.js";
 export { AUTO_UNIT_SCOPED_TOOLS, RUN_UAT_BROWSER_TOOL_NAMES, } from "./unit-tool-contracts.js";
-const EXECUTE_TASK_UNIT_TYPES = new Set([
-    "execute-task",
-    "execute-task-simple",
-    "reactive-execute",
-]);
-// These units own quality gates, but their completion handlers persist verdicts
-// from artifact sections. gsd_save_gate_result belongs to gate-evaluate, so keep
-// blocking it here with a calm redirect to the section-write path.
-const SECTION_CLOSE_GATE_UNIT_TYPES = new Set([
-    "execute-task",
-    "execute-task-simple",
-    "reactive-execute",
-    "complete-slice",
-    "validate-milestone",
-]);
+// Scope-class membership is declared per unit in the Unit Registry (ADR-033).
+// EXECUTE_TASK_UNIT_TYPES = scopeClass "execute-task"; the section-close gate
+// Set additionally includes scopeClass "section-close" — units whose completion
+// handlers persist gate verdicts from artifact sections (gsd_save_gate_result
+// belongs to gate-evaluate, so it is soft-blocked with a redirect below).
+import { EXECUTE_TASK_UNIT_TYPES, SECTION_CLOSE_GATE_UNIT_TYPES, } from "./unit-registry.js";
 const EXTRA_SCOPED_GSD_LIFECYCLE_TOOLS = [
     "gsd_skip_slice",
     "gsd_slice_reopen",
@@ -31,9 +23,9 @@ const SCOPED_GSD_LIFECYCLE_TOOLS = new Set([
     .map(canonicalWorkflowToolName));
 export const GSD_PHASE_SCOPE_DISPLAY_REASON = "This GSD phase only allows its scoped workflow tools.";
 export const GSD_SECTION_CLOSE_GATE_DISPLAY_REASON = "Gates here close by writing summary sections — gsd_save_gate_result isn't needed.";
-export function canonicalWorkflowToolName(toolName) {
-    return canonicalWorkflowSurfaceToolName(toolName);
-}
+// Normalizer seam lives in engine-hook-contract.ts; re-exported here for
+// existing scope importers.
+export { canonicalWorkflowToolName };
 export function isWorkflowAliasTool(toolName) {
     return isWorkflowSurfaceAliasTool(toolName);
 }
@@ -74,7 +66,7 @@ function allowedGsdToolsForUnit(unitType) {
 function isNativeWorkflowTool(toolName) {
     return stripMcpToolPrefix(toolName) === "Workflow";
 }
-function readStringField(input, camel, snake) {
+export function readStringField(input, camel, snake) {
     if (!input || typeof input !== "object")
         return undefined;
     const record = input;

package/dist/resources/extensions/gsd/auto-verification.js

@@ -1,7 +1,7 @@
 // Project/App: gsd-pi
 // File Purpose: Post-unit verification gate for GSD auto-mode units.
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
-import { gsdProjectionRoot, resolveSlicePath, resolveMilestoneFile } from "./paths.js";
+import { gsdProjectionRoot, resolveSlicePath } from "./paths.js";
 import { resolveMilestoneValidationVerdict } from "./milestone-validation-verdict.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
 import { parseUnitId } from "./unit-id.js";
@@ -9,8 +9,6 @@ import { isDbAvailable, getTask, getSliceTasks, getMilestoneSlices } from "./gsd
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { isClosedStatus } from "./status-guards.js";
 import { loadFile } from "./files.js";
-import { parseRoadmap } from "./parsers-legacy.js";
-import { isMilestoneComplete } from "./state.js";
 import { runVerificationGate, runVerificationGateForTargets, formatFailureContext, captureRuntimeErrors, runDependencyAudit, } from "./verification-gate.js";
 import { writeVerificationJSON } from "./verification-evidence.js";
 import { logWarning } from "./workflow-logger.js";
@@ -25,6 +23,7 @@ import { getSlice } from "./gsd-db.js";
 import { getLedger } from "./metrics.js";
 import { getUnitCostSpikeAction, resolveUnitCostSpikeMultiplier } from "./auto-budget.js";
 import { formatPostUnitStatusCard } from "./auto-status-message.js";
+import { detectWebApp } from "./web-app-uat.js";
 function getCurrentUnitCostStats(unitId) {
     const ledger = getLedger();
     if (!ledger || !Array.isArray(ledger.units) || ledger.units.length === 0) {
@@ -274,32 +273,15 @@ async function runValidateMilestonePostCheck(vctx, pauseAuto) {
  * DB-backed projects are authoritative (#4094 peer review); falls back to
  * roadmap parsing only when the DB is unavailable.
  */
-async function countIncompleteSlices(basePath, milestoneId) {
-    if (isDbAvailable()) {
-        const slices = getMilestoneSlices(milestoneId);
-        if (slices.length === 0) {
-            // No DB rows — treat as "unknown", do not pause.
-            return 1;
-        }
-        return slices.filter((slice) => !isClosedStatus(slice.status)).length;
-    }
-    // Filesystem fallback: parse the roadmap markdown.
-    try {
-        const roadmapFile = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");
-        if (!roadmapFile)
-            return 1;
-        const roadmapContent = await loadFile(roadmapFile);
-        if (!roadmapContent)
-            return 1;
-        const roadmap = parseRoadmap(roadmapContent);
-        if (roadmap.slices.length === 0)
-            return 1;
-        return isMilestoneComplete(roadmap) ? 0 : 1;
-    }
-    catch {
-        // Parsing failures should not cause false-positive pauses.
+async function countIncompleteSlices(_basePath, milestoneId) {
+    // DB-authoritative (ADR-017): no markdown fallback. DB unavailable or no
+    // rows means "unknown" — do not pause.
+    if (!isDbAvailable())
         return 1;
-    }
+    const slices = getMilestoneSlices(milestoneId);
+    if (slices.length === 0)
+        return 1;
+    return slices.filter((slice) => !isClosedStatus(slice.status)).length;
 }
 /**
  * Run the verification gate for the current execute-task unit.
@@ -636,14 +618,25 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
             s.pendingVerificationRetry = null;
             return "continue";
         }
+        else if (verdict.reason === "no-host-checks" &&
+            taskAlreadyComplete &&
+            detectWebApp(s.basePath) &&
+            !result.runtimeErrors?.some((e) => e.blocking)) {
+            s.verificationRetryCount.delete(retryKey);
+            s.verificationRetryFailureHashes.delete(retryKey);
+            s.pendingVerificationRetry = null;
+            ctx.ui.notify("No task-level host verification command was found for a completed browser-facing task; continuing so slice UAT can verify the UI with browser tools.", "warning");
+            return "continue";
+        }
         else if (verdict.reason === "no-host-checks") {
             s.verificationRetryCount.delete(retryKey);
             s.verificationRetryFailureHashes.delete(retryKey);
             s.pendingVerificationRetry = null;
-            ctx.ui.notify("Verification gate FAILED — no runnable host-owned verification checks were discovered. Pausing for human review.", "error");
+            const pauseMessage = `Verification failed: ${verdict.failureContext}`;
+            ctx.ui.notify(`Verification gate FAILED — ${verdict.failureContext}`, "error");
             process.stderr.write(`verification-gate: ${verdict.failureContext}\n`);
             await pauseAuto(ctx, pi, {
-                message: "Verification failed: no runnable host-owned verification checks were discovered.",
+                message: pauseMessage,
                 category: "unknown",
             });
             return "pause";

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -15,16 +15,15 @@ import { closeWorkflowDatabase, getWorkflowDatabasePath, openWorkflowDatabasePat
 import { execFileSync } from "node:child_process";
 import { gsdRoot, resolveGsdPathContract } from "./paths.js";
 import { createWorktree, removeWorktree, worktreePath, isInsideWorktreesDir, } from "./worktree-manager.js";
+import { worktreePathFor } from "./worktree-placement.js";
 import { detectWorktreeName, nudgeGitBranchCache, } from "./worktree.js";
-import { findWorktreeSegment, isGsdWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
+import { isGsdWorktreePath, projectRootFromWorktreePath, normalizeWorktreePathForCompare, resolveWorktreeProjectRoot, } from "./worktree-root.js";
 import { autoResolveSafeConflictPaths } from "./git-conflict-resolve.js";
 import { MergeConflictError, readIntegrationBranch, resolveMilestoneIntegrationBranch, RUNTIME_EXCLUSION_PATHS } from "./git-service.js";
-import { buildPullRequestEvidence, createDraftPullRequestFromEvidence, } from "./pull-request-process.js";
+import { publishMilestone } from "./publication.js";
 import { debugLog } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { checkoutBranchWithStashGuard, cleanupConflictState, gsdJsonlFilesWithConflictMarkers, hasConflictMarkers, popStashByRef, removeMergeStateFiles, stashAlreadyExistsFilesFromError, stashRefFromError, } from "./worktree-git-recovery.js";
-// Re-export for existing callers/tests (auto-start.ts, checkout-branch-stash-guard.test.ts).
-export { checkoutBranchWithStashGuard } from "./worktree-git-recovery.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { runWorktreePostCreateHook } from "./worktree-post-create-hook.js";
@@ -184,19 +183,6 @@ function gitPathspecForWorktreePath(basePath, targetPath) {
 export function _gitPathspecForWorktreePath(basePath, targetPath) {
     return gitPathspecForWorktreePath(basePath, targetPath);
 }
-function gitRemoteExists(basePath, remote) {
-    try {
-        execFileSync("git", ["remote", "get-url", remote], {
-            cwd: basePath,
-            stdio: ["ignore", "pipe", "pipe"],
-            encoding: "utf-8",
-        });
-        return true;
-    }
-    catch {
-        return false;
-    }
-}
 function findRegularMergeChangedPaths(basePath, milestoneBranch, mainBranch) {
     const changedPaths = new Set();
     let mergeLog = "";
@@ -392,12 +378,9 @@ export function checkResourcesStale(versionOnStart) {
  * Returns the corrected base path.
  */
 export function escapeStaleWorktree(base) {
-    const segment = findWorktreeSegment(base.replaceAll("\\", "/"));
-    if (!segment)
+    const projectRoot = projectRootFromWorktreePath(base);
+    if (projectRoot === null)
         return base;
-    // base is inside .gsd/worktrees/<something> — extract the project root.
-    // Normalization is 1:1 on characters, so the segment index is valid in `base`.
-    const projectRoot = base.slice(0, segment.gsdIdx);
     // Guard: If the candidate project root's .gsd IS the user-level ~/.gsd,
     // the string-slice heuristic matched the wrong /.gsd/ boundary. This happens
     // when .gsd is a symlink into ~/.gsd/projects/<hash> and process.cwd()
@@ -817,6 +800,14 @@ function _resolveIntegrationBranchForReuse(basePath, milestoneId) {
         return null;
     }
 }
+function safeCwd(fallback) {
+    try {
+        return process.cwd();
+    }
+    catch {
+        return fallback;
+    }
+}
 /**
  * When reusing an existing milestone branch, fast-forward it onto the
  * integration branch when that's safe (branch is a strict ancestor of
@@ -966,7 +957,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
     originalBasePath = resolveWorktreeProjectRoot(originalBasePath);
     const branch = autoWorktreeBranch(milestoneId);
     const { preserveBranch = false, preserveWorktree = false } = opts;
-    const previousCwd = process.cwd();
+    const previousCwd = safeCwd(originalBasePath);
     // Wrap the entire teardown body in a single try/finally so activeWorkspace
     // is ALWAYS cleared — even if process.chdir throws (e.g. originalBasePath
     // was deleted before teardown ran). Previously the finally only covered
@@ -1078,7 +1069,9 @@ export function isInAutoWorktree(basePath) {
  */
 export function getAutoWorktreePath(basePath, milestoneId) {
     basePath = resolveWorktreeProjectRoot(basePath);
-    const p = worktreePath(basePath, milestoneId);
+    // basePath is already the resolved project root — go straight to placement
+    // instead of worktreePath(), which would re-resolve the root.
+    const p = worktreePathFor(basePath, milestoneId);
     if (!existsSync(p))
         return null;
     // Validate this is a real git worktree, not a stray directory.
@@ -1738,8 +1731,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             const isUntrackedRestoreFailure = stashPopMessage.includes("could not restore untracked files from stash");
             const gsdContentConflicts = [];
             const alreadyExists = stashAlreadyExistsFilesFromError(e);
-            const gsdAlreadyExists = alreadyExists.filter((f) => f.startsWith(".gsd/"));
-            const nonGsdAlreadyExists = alreadyExists.filter((f) => !f.startsWith(".gsd/"));
             // Untracked-file restore failures can leave marker conflicts in tracked
             // .gsd JSONL files without producing `U` status entries.
             if (isUntrackedRestoreFailure) {
@@ -1800,10 +1791,11 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             }
             else if (gsdUU.length === 0 &&
                 nonGsdUU.length === 0 &&
-                gsdAlreadyExists.length > 0 &&
-                nonGsdAlreadyExists.length === 0) {
-                // Untracked-file restore failure from stash pop where all collided
-                // paths are .gsd/ artifacts that already exist after merge.
+                alreadyExists.length > 0) {
+                // Untracked-file restore failure from stash pop where all collided paths
+                // already exist after merge (committed on target). Safe to drop the stash
+                // for the full alreadyExists set — they were untracked on source by
+                // definition of the "already exists, no checkout" failure.
                 if (stashRefForDrop) {
                     try {
                         execFileSync("git", ["stash", "drop", stashRefForDrop], {
@@ -1826,11 +1818,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
                     files: nonGsdUU.join(", "),
                 });
             }
-            else if (nonGsdAlreadyExists.length > 0) {
-                logWarning("reconcile", "Stash pop restore collision on non-.gsd files after merge", {
-                    files: nonGsdAlreadyExists.join(", "),
-                });
-            }
             else {
                 logWarning("worktree", "git stash pop failed without resolvable conflict files; leaving stash for manual recovery");
             }
@@ -1922,66 +1909,32 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         }
         catch (err) {
             logWarning("worktree", `chdir to project root after merge failed: ${err instanceof Error ? err.message : String(err)}`);
+            debugLog("mergeMilestoneToMain", {
+                phase: "post-merge-chdir-failed",
+                target: originalBasePath_,
+                error: err instanceof Error ? err.message : String(err),
+            });
         }
     };
     let shouldCleanup = false;
-    let pushed = false;
-    let prCreated = false;
     try {
-        // 10. Auto-push if enabled
-        if (prefs.auto_push === true && prefs.auto_pr !== true && !nothingToCommit) {
-            const remote = prefs.remote ?? "origin";
-            if (gitRemoteExists(originalBasePath_, remote)) {
-                try {
-                    execFileSync("git", ["push", remote, mainBranch], {
-                        cwd: originalBasePath_,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    pushed = true;
-                }
-                catch (err) {
-                    // Push failure is non-fatal
-                    logWarning("worktree", `git push failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
-        // 9b. Auto-create PR if enabled (#2302: no longer gated on pushed/auto_push)
-        if (prefs.auto_pr === true && !nothingToCommit) {
-            const remote = prefs.remote ?? "origin";
-            const prTarget = prefs.pr_target_branch ?? mainBranch;
-            if (gitRemoteExists(originalBasePath_, remote)) {
-                try {
-                    // Push the milestone branch to remote first
-                    execFileSync("git", ["push", remote, milestoneBranch], {
-                        cwd: originalBasePath_,
-                        stdio: ["ignore", "pipe", "pipe"],
-                        encoding: "utf-8",
-                    });
-                    const prEvidence = buildPullRequestEvidence({
-                        milestoneId,
-                        milestoneTitle,
-                        changeType: "feat",
-                        summaries: completedSlices.map((slice) => `### ${slice.id}\n${slice.title}`),
-                        testsRun: ["Auto-created after milestone merge. Run `npm run verify:merge` before marking this draft ready."],
-                        rollbackNotes: ["Close the draft PR or revert the merge commit if review finds a behavior regression."],
-                        how: "Generated by git.auto_pr after the milestone branch was pushed and merged locally.",
-                    });
-                    const prUrl = createDraftPullRequestFromEvidence(originalBasePath_, milestoneId, prEvidence, {
-                        head: milestoneBranch,
-                        base: prTarget,
-                    });
-                    if (!prUrl) {
-                        throw new Error("gh pr create returned no URL");
-                    }
-                    prCreated = true;
-                }
-                catch (err) {
-                    // PR creation failure is non-fatal — gh may not be installed or authenticated
-                    logWarning("worktree", `PR creation failed: ${err instanceof Error ? err.message : String(err)}`);
-                }
-            }
-        }
+        // 10/9b. Publication (auto-push / draft PR) — Publication module seam (ADR-034).
+        const publication = publishMilestone({
+            basePath: originalBasePath_,
+            milestoneId,
+            milestoneTitle,
+            integrationBranch: mainBranch,
+            milestoneBranch,
+            sliceSummaries: completedSlices.map((slice) => `### ${slice.id}\n${slice.title}`),
+            nothingToCommit,
+            prefs: {
+                autoPush: prefs.auto_push === true,
+                autoPr: prefs.auto_pr === true,
+                remote: prefs.remote,
+                prTargetBranch: prefs.pr_target_branch,
+            },
+        });
+        const { pushed, prCreated } = publication;
         // 11. Guard removed — step 9b (#1792) now handles this with a smarter check:
         //     throws only when the milestone has unanchored code changes, passes
         //     through when the code is genuinely already on the integration branch.