gsd-pi 2.34.0 → 2.35.0-dev.30eec3f

package/src/resources/extensions/gsd/files.ts

@@ -590,7 +590,8 @@ export async function loadFile(path: string): Promise<string | null> {
   try {
     return await fs.readFile(path, 'utf-8');
   } catch (err: unknown) {
-    if ((err as NodeJS.ErrnoException).code === 'ENOENT') return null;
+    const code = (err as NodeJS.ErrnoException).code;
+    if (code === 'ENOENT' || code === 'EISDIR') return null;
     throw err;
   }
 }
@@ -804,7 +805,7 @@ export async function inlinePriorMilestoneSummary(mid: string, base: string): Pr
  * file not on disk) - callers can distinguish "no manifest" from "empty manifest".
  */
 export async function getManifestStatus(
-  base: string, milestoneId: string,
+  base: string, milestoneId: string, projectRoot?: string,
 ): Promise<ManifestStatus | null> {
   const resolvedPath = resolveMilestoneFile(base, milestoneId, 'SECRETS');
   if (!resolvedPath) return null;
@@ -814,9 +815,18 @@ export async function getManifestStatus(
 
   const manifest = parseSecretsManifest(content);
   const keys = manifest.entries.map(e => e.key);
+
+  // Check both the base path .env AND the project root .env (#1387).
+  // In worktree mode, base is the worktree path which may not have .env.
+  // The project root's .env is where the user actually defined their keys.
   const existingKeys = await checkExistingEnvKeys(keys, resolve(base, '.env'));
   const existingSet = new Set(existingKeys);
 
+  if (projectRoot && projectRoot !== base) {
+    const rootKeys = await checkExistingEnvKeys(keys, resolve(projectRoot, '.env'));
+    for (const k of rootKeys) existingSet.add(k);
+  }
+
   const result: ManifestStatus = {
     pending: [],
     collected: [],

package/src/resources/extensions/gsd/gitignore.ts

@@ -7,8 +7,8 @@
  */
 
 import { join } from "node:path";
-import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import { nativeRmCached } from "./native-git-bridge.js";
+import { existsSync, lstatSync, readFileSync, writeFileSync } from "node:fs";
+import { nativeRmCached, nativeLsFiles } from "./native-git-bridge.js";
 import { gsdRoot } from "./paths.js";
 
 /**
@@ -79,12 +79,47 @@ const BASELINE_PATTERNS = [
 ];
 
 /**
- * Ensure basePath/.gitignore contains a blanket `.gsd/` ignore.
- * Creates the file if missing; appends `.gsd/` if not present.
+ * Check whether `.gsd/` contains files tracked by git.
+ * If so, the project intentionally keeps `.gsd/` in version control
+ * and we must NOT add `.gsd` to `.gitignore` or attempt migration.
+ *
+ * Returns true if git tracks at least one file under `.gsd/`.
+ * Returns false (safe to ignore) if:
+ *   - Not a git repo
+ *   - `.gsd/` is a symlink (external state, should be ignored)
+ *   - `.gsd/` doesn't exist
+ *   - No tracked files found under `.gsd/`
+ */
+export function hasGitTrackedGsdFiles(basePath: string): boolean {
+  const localGsd = join(basePath, ".gsd");
+
+  // If .gsd doesn't exist or is already a symlink, no tracked files concern
+  if (!existsSync(localGsd)) return false;
+  try {
+    if (lstatSync(localGsd).isSymbolicLink()) return false;
+  } catch {
+    return false;
+  }
+
+  // Check if git tracks any files under .gsd/
+  try {
+    const tracked = nativeLsFiles(basePath, ".gsd");
+    return tracked.length > 0;
+  } catch {
+    // Not a git repo or git not available — safe to proceed
+    return false;
+  }
+}
+
+/**
+ * Ensure basePath/.gitignore contains baseline ignore patterns.
+ * Creates the file if missing; appends missing patterns.
  * Returns true if the file was created or modified, false if already complete.
  *
- * `.gsd/` state is managed externally (symlinked to `~/.gsd/projects/<hash>/`),
- * so the entire directory is always gitignored.
+ * **Safety check:** If `.gsd/` contains git-tracked files (i.e., the project
+ * intentionally keeps `.gsd/` in version control), the `.gsd` ignore pattern
+ * is excluded to prevent data loss. Only the `.gsd` pattern is affected —
+ * all other baseline patterns are still applied normally.
  */
 export function ensureGitignore(
   basePath: string,
@@ -108,8 +143,15 @@ export function ensureGitignore(
       .filter((l) => l && !l.startsWith("#")),
   );
 
+  // Determine which patterns to apply. If .gsd/ has tracked files,
+  // exclude the ".gsd" pattern to prevent deleting tracked state.
+  const gsdIsTracked = hasGitTrackedGsdFiles(basePath);
+  const patternsToApply = gsdIsTracked
+    ? BASELINE_PATTERNS.filter((p) => p !== ".gsd")
+    : BASELINE_PATTERNS;
+
   // Find patterns not yet present
-  const missing = BASELINE_PATTERNS.filter((p) => !existingLines.has(p));
+  const missing = patternsToApply.filter((p) => !existingLines.has(p));
 
   if (missing.length === 0) return false;
 
@@ -135,6 +177,11 @@ export function ensureGitignore(
  * already in the index even after .gitignore is updated.
  *
  * Only removes from the index (`--cached`), never from disk. Idempotent.
+ *
+ * Note: These are strictly runtime/ephemeral paths (activity logs, lock files,
+ * metrics, STATE.md). They are always safe to untrack, even when the project
+ * intentionally keeps other `.gsd/` files (like PROJECT.md, milestones/) in
+ * version control.
  */
 export function untrackRuntimeFiles(basePath: string): void {
   const runtimePaths = GSD_RUNTIME_PATTERNS;

package/src/resources/extensions/gsd/guided-flow.ts

@@ -191,7 +191,7 @@ type UIContext = ExtensionContext;
  * This is the only way the wizard triggers work — everything else is the LLM's job.
  */
 function dispatchWorkflow(pi: ExtensionAPI, note: string, customType = "gsd-run"): void {
-  const workflowPath = process.env.GSD_WORKFLOW_PATH ?? join(process.env.HOME ?? "~", ".pi", "GSD-WORKFLOW.md");
+  const workflowPath = process.env.GSD_WORKFLOW_PATH ?? join(process.env.HOME ?? "~", ".gsd", "agent", "GSD-WORKFLOW.md");
   const workflow = readFileSync(workflowPath, "utf-8");
 
   pi.sendMessage(
@@ -788,9 +788,11 @@ export async function showSmartEntry(
   // ── Self-heal stale runtime records from crashed auto-mode sessions ──
   selfHealRuntimeRecords(basePath, ctx);
 
-  // Check for crash from previous auto-mode session
+  // Check for crash from previous auto-mode session.
+  // Skip if the lock was written by the current process — acquireSessionLock()
+  // writes to the same file, so we'd always false-positive (#1398).
   const crashLock = readCrashLock(basePath);
-  if (crashLock) {
+  if (crashLock && crashLock.pid !== process.pid) {
     clearLock(basePath);
 
     // Bootstrap crash with zero completed units = no work was lost.

package/src/resources/extensions/gsd/health-widget-core.ts

@@ -0,0 +1,129 @@
+/**
+ * Pure GSD health widget logic.
+ *
+ * Separates project-state detection and line rendering from the widget's
+ * runtime integrations so the regressions can be tested directly.
+ */
+
+import { existsSync, readdirSync } from "node:fs";
+import { gsdRoot } from "./paths.js";
+import { join } from "node:path";
+import type { GSDState, Phase } from "./types.js";
+
+export type HealthWidgetProjectState = "none" | "initialized" | "active";
+
+export interface HealthWidgetData {
+  projectState: HealthWidgetProjectState;
+  budgetCeiling: number | undefined;
+  budgetSpent: number;
+  providerIssue: string | null;
+  environmentErrorCount: number;
+  environmentWarningCount: number;
+  lastRefreshed: number;
+  executionPhase?: Phase;
+  executionStatus?: string;
+  executionTarget?: string;
+  nextAction?: string;
+  blocker?: string | null;
+  activeMilestoneId?: string;
+  activeSliceId?: string;
+  activeTaskId?: string;
+  progress?: GSDState["progress"];
+  eta?: string | null;
+}
+
+export function detectHealthWidgetProjectState(basePath: string): HealthWidgetProjectState {
+  const root = gsdRoot(basePath);
+  if (!existsSync(root)) return "none";
+
+  // Lightweight milestone count — avoids the full detectProjectState() scan
+  // (CI markers, Makefile targets, etc.) that is unnecessary on the 60s refresh.
+  try {
+    const milestonesDir = join(root, "milestones");
+    if (existsSync(milestonesDir)) {
+      const entries = readdirSync(milestonesDir, { withFileTypes: true });
+      if (entries.some(e => e.isDirectory())) return "active";
+    }
+  } catch { /* non-fatal */ }
+
+  return "initialized";
+}
+
+function formatCost(n: number): string {
+  return n >= 1 ? `$${n.toFixed(2)}` : `${(n * 100).toFixed(1)}¢`;
+}
+
+function formatProgress(progress?: GSDState["progress"]): string | null {
+  if (!progress) return null;
+
+  const parts: string[] = [];
+  parts.push(`M ${progress.milestones.done}/${progress.milestones.total}`);
+  if (progress.slices) parts.push(`S ${progress.slices.done}/${progress.slices.total}`);
+  if (progress.tasks) parts.push(`T ${progress.tasks.done}/${progress.tasks.total}`);
+  return parts.length > 0 ? `Progress: ${parts.join(" · ")}` : null;
+}
+
+function formatEnvironmentSummary(errorCount: number, warningCount: number): string | null {
+  if (errorCount <= 0 && warningCount <= 0) return null;
+
+  const parts: string[] = [];
+  if (errorCount > 0) parts.push(`${errorCount} error${errorCount > 1 ? "s" : ""}`);
+  if (warningCount > 0) parts.push(`${warningCount} warning${warningCount > 1 ? "s" : ""}`);
+  return `Env: ${parts.join(", ")}`;
+}
+
+function formatBudgetSummary(data: HealthWidgetData): string | null {
+  if (data.budgetCeiling !== undefined && data.budgetCeiling > 0) {
+    const pct = Math.min(100, (data.budgetSpent / data.budgetCeiling) * 100);
+    return `Budget: ${formatCost(data.budgetSpent)}/${formatCost(data.budgetCeiling)} (${pct.toFixed(0)}%)`;
+  }
+  if (data.budgetSpent > 0) {
+    return `Spent: ${formatCost(data.budgetSpent)}`;
+  }
+  return null;
+}
+
+function buildExecutionHeadline(data: HealthWidgetData): string {
+  const status = data.executionStatus ?? "Active project";
+  const target = data.executionTarget ?? data.blocker ?? "loading status…";
+  return `  GSD  ${status}${target ? ` - ${target}` : ""}`;
+}
+
+/**
+ * Build compact health lines for the widget.
+ * Returns a string array suitable for setWidget().
+ */
+export function buildHealthLines(data: HealthWidgetData): string[] {
+  if (data.projectState === "none") {
+    return ["  GSD  No project loaded — run /gsd to start"];
+  }
+
+  if (data.projectState === "initialized") {
+    return ["  GSD  Project initialized — run /gsd to continue setup"];
+  }
+
+  const lines = [buildExecutionHeadline(data)];
+  const details: string[] = [];
+
+  const progress = formatProgress(data.progress);
+  if (progress) details.push(progress);
+
+  if (data.providerIssue) details.push(data.providerIssue);
+
+  const environment = formatEnvironmentSummary(
+    data.environmentErrorCount,
+    data.environmentWarningCount,
+  );
+  if (environment) details.push(environment);
+
+  const budget = formatBudgetSummary(data);
+  if (budget) details.push(budget);
+
+  if (data.eta) details.push(data.eta);
+
+  if (details.length > 0) {
+    lines.push(`  ${details.join("  │  ")}`);
+  }
+
+  return lines;
+}

package/src/resources/extensions/gsd/health-widget.ts

@@ -9,41 +9,37 @@
  */
 
 import type { ExtensionContext } from "@gsd/pi-coding-agent";
+import type { GSDState } from "./types.js";
 import { runProviderChecks, summariseProviderIssues } from "./doctor-providers.js";
 import { runEnvironmentChecks } from "./doctor-environment.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { loadLedgerFromDisk, getProjectTotals } from "./metrics.js";
+import { describeNextUnit, estimateTimeRemaining, updateSliceProgressCache } from "./auto-dashboard.js";
 import { projectRoot } from "./commands.js";
-
-// ── Types ──────────────────────────────────────────────────────────────────────
-
-interface HealthWidgetData {
-  hasProject: boolean;
-  budgetCeiling: number | undefined;
-  budgetSpent: number;
-  providerIssue: string | null;      // compact summary from summariseProviderIssues()
-  environmentErrorCount: number;
-  environmentWarningCount: number;
-  lastRefreshed: number;
-}
+import { deriveState, invalidateStateCache } from "./state.js";
+import {
+  buildHealthLines,
+  detectHealthWidgetProjectState,
+  type HealthWidgetData,
+} from "./health-widget-core.js";
 
 // ── Data loader ────────────────────────────────────────────────────────────────
 
-function loadHealthWidgetData(basePath: string): HealthWidgetData {
-  let hasProject = false;
+function loadBaseHealthWidgetData(basePath: string): HealthWidgetData {
   let budgetCeiling: number | undefined;
   let budgetSpent = 0;
   let providerIssue: string | null = null;
   let environmentErrorCount = 0;
   let environmentWarningCount = 0;
 
+  const projectState = detectHealthWidgetProjectState(basePath);
+
   try {
     const prefs = loadEffectiveGSDPreferences();
     budgetCeiling = prefs?.preferences?.budget_ceiling;
 
     const ledger = loadLedgerFromDisk(basePath);
     if (ledger) {
-      hasProject = true;
       const totals = getProjectTotals(ledger.units ?? []);
       budgetSpent = totals.cost;
     }
@@ -63,7 +59,7 @@ function loadHealthWidgetData(basePath: string): HealthWidgetData {
   } catch { /* non-fatal */ }
 
   return {
-    hasProject,
+    projectState,
     budgetCeiling,
     budgetSpent,
     providerIssue,
@@ -73,54 +69,88 @@ function loadHealthWidgetData(basePath: string): HealthWidgetData {
   };
 }
 
-// ── Rendering ──────────────────────────────────────────────────────────────────
-
-function formatCost(n: number): string {
-  return n >= 1 ? `$${n.toFixed(2)}` : `${(n * 100).toFixed(1)}¢`;
+function compactText(text: string, max = 64): string {
+  const trimmed = text.replace(/\s+/g, " ").trim();
+  if (trimmed.length <= max) return trimmed;
+  return `${trimmed.slice(0, max - 1).trimEnd()}…`;
 }
 
-/**
- * Build compact health lines for the widget.
- * Returns a string array suitable for setWidget().
- */
-export function buildHealthLines(data: HealthWidgetData): string[] {
-  if (!data.hasProject) {
-    return ["  GSD  No project loaded — run /gsd to start"];
+function summarizeExecutionStatus(state: GSDState): string {
+  switch (state.phase) {
+    case "blocked": return "Blocked";
+    case "paused": return "Paused";
+    case "complete": return "Complete";
+    case "executing": return "Executing";
+    case "planning": return "Planning";
+    case "pre-planning": return "Pre-planning";
+    case "summarizing": return "Summarizing";
+    case "validating-milestone": return "Validating";
+    case "completing-milestone": return "Completing";
+    case "needs-discussion": return "Needs discussion";
+    case "replanning-slice": return "Replanning";
+    default: return "Active";
   }
+}
 
-  const parts: string[] = [];
-
-  // System status signal
-  const totalIssues = data.environmentErrorCount + data.environmentWarningCount + (data.providerIssue ? 1 : 0);
-  if (totalIssues === 0) {
-    parts.push("● System OK");
-  } else if (data.environmentErrorCount > 0 || data.providerIssue?.includes("✗")) {
-    parts.push(`✗ ${totalIssues} issue${totalIssues > 1 ? "s" : ""}`);
-  } else {
-    parts.push(`⚠ ${totalIssues} warning${totalIssues > 1 ? "s" : ""}`);
+function summarizeExecutionTarget(state: GSDState): string {
+  switch (state.phase) {
+    case "needs-discussion":
+      return state.activeMilestone ? `Discuss ${state.activeMilestone.id}` : "Discuss milestone draft";
+    case "pre-planning":
+      return state.activeMilestone ? `Plan ${state.activeMilestone.id}` : "Research & plan milestone";
+    case "planning":
+      return state.activeSlice ? `Plan ${state.activeSlice.id}` : "Plan next slice";
+    case "executing":
+      return state.activeTask ? `Execute ${state.activeTask.id}` : "Execute next task";
+    case "summarizing":
+      return state.activeSlice ? `Complete ${state.activeSlice.id}` : "Complete current slice";
+    case "validating-milestone":
+      return state.activeMilestone ? `Validate ${state.activeMilestone.id}` : "Validate milestone";
+    case "completing-milestone":
+      return state.activeMilestone ? `Complete ${state.activeMilestone.id}` : "Complete milestone";
+    case "replanning-slice":
+      return state.activeSlice ? `Replan ${state.activeSlice.id}` : "Replan current slice";
+    case "blocked":
+      return `waiting on ${compactText(state.blockers[0] ?? state.nextAction, 56)}`;
+    case "paused":
+      return compactText(state.nextAction || "waiting to resume", 56);
+    case "complete":
+      return "All milestones complete";
+    default:
+      return compactText(describeNextUnit(state).label, 56);
   }
+}
 
-  // Budget
-  if (data.budgetCeiling !== undefined && data.budgetCeiling > 0) {
-    const pct = Math.min(100, (data.budgetSpent / data.budgetCeiling) * 100);
-    parts.push(`Budget: ${formatCost(data.budgetSpent)}/${formatCost(data.budgetCeiling)} (${pct.toFixed(0)}%)`);
-  } else if (data.budgetSpent > 0) {
-    parts.push(`Spent: ${formatCost(data.budgetSpent)}`);
-  }
+async function enrichHealthWidgetData(basePath: string, baseData: HealthWidgetData): Promise<HealthWidgetData> {
+  if (baseData.projectState !== "active") return baseData;
 
-  // Provider issue (if any)
-  if (data.providerIssue) {
-    parts.push(data.providerIssue);
-  }
+  try {
+    invalidateStateCache();
+    const state = await deriveState(basePath);
 
-  // Environment issues
-  if (data.environmentErrorCount > 0) {
-    parts.push(`Env: ${data.environmentErrorCount} error${data.environmentErrorCount > 1 ? "s" : ""}`);
-  } else if (data.environmentWarningCount > 0) {
-    parts.push(`Env: ${data.environmentWarningCount} warning${data.environmentWarningCount > 1 ? "s" : ""}`);
-  }
+    if (state.activeMilestone) {
+      // Warm the slice-progress cache so estimateTimeRemaining() has data
+      updateSliceProgressCache(basePath, state.activeMilestone.id, state.activeSlice?.id);
+    }
 
-  return [`  ${parts.join("  │  ")}`];
+    return {
+      ...baseData,
+      executionPhase: state.phase,
+      executionStatus: summarizeExecutionStatus(state),
+      executionTarget: summarizeExecutionTarget(state),
+      nextAction: state.nextAction,
+      blocker: state.blockers[0] ?? null,
+      activeMilestoneId: state.activeMilestone?.id,
+      activeSliceId: state.activeSlice?.id,
+      activeTaskId: state.activeTask?.id,
+      progress: state.progress,
+      eta: state.phase === "blocked" || state.phase === "paused" || state.phase === "complete"
+        ? null
+        : estimateTimeRemaining(),
+    };
+  } catch {
+    return baseData;
+  }
 }
 
 // ── Widget init ────────────────────────────────────────────────────────────────
@@ -137,20 +167,34 @@ export function initHealthWidget(ctx: ExtensionContext): void {
   const basePath = projectRoot();
 
   // String-array fallback — used in RPC mode (factory is a no-op there)
-  const initialData = loadHealthWidgetData(basePath);
+  const initialData = loadBaseHealthWidgetData(basePath);
   ctx.ui.setWidget("gsd-health", buildHealthLines(initialData), { placement: "belowEditor" });
 
   // Factory-based widget for TUI mode — replaces the string-array above
   ctx.ui.setWidget("gsd-health", (_tui, _theme) => {
     let data = initialData;
     let cachedLines: string[] | undefined;
+    let refreshInFlight = false;
 
-    const refreshTimer = setInterval(() => {
+    const refresh = async () => {
+      if (refreshInFlight) return;
+      refreshInFlight = true;
       try {
-        data = loadHealthWidgetData(basePath);
+        const baseData = loadBaseHealthWidgetData(basePath);
+        data = await enrichHealthWidgetData(basePath, baseData);
         cachedLines = undefined;
         _tui.requestRender();
-      } catch { /* non-fatal */ }
+      } catch { /* non-fatal */ } finally {
+        refreshInFlight = false;
+      }
+    };
+
+    // Fire first enrichment immediately. requestRender() inside is a no-op
+    // if the widget has not yet rendered, so this is safe before factory return.
+    void refresh();
+
+    const refreshTimer = setInterval(() => {
+      void refresh();
     }, REFRESH_INTERVAL_MS);
 
     return {

package/src/resources/extensions/gsd/index.ts

@@ -175,7 +175,16 @@ export default function (pi: ExtensionAPI) {
         // Pipe closed — nothing we can write; just exit cleanly
         process.exit(0);
       }
-      // Re-throw anything that isn't EPIPE so real crashes still surface
+      if ((err as NodeJS.ErrnoException).code === "ENOENT" &&
+          (err as any).syscall?.startsWith("spawn")) {
+        // spawn ENOENT — command not found (e.g., npx on Windows).
+        // This surfaces as an uncaught exception from child_process but
+        // is not a fatal process error. Log and continue instead of
+        // crashing auto-mode (#1384).
+        process.stderr.write(`[gsd] spawn ENOENT: ${(err as any).path ?? "unknown"} — command not found\n`);
+        return;
+      }
+      // Re-throw anything that isn't EPIPE/ENOENT so real crashes still surface
       throw err;
     };
     process.on("uncaughtException", _gsdEpipeGuard);

package/src/resources/extensions/gsd/migrate-external.ts

@@ -6,10 +6,11 @@
  * symlink replaces the original directory so all paths remain valid.
  */
 
-import { existsSync, lstatSync, mkdirSync, readdirSync, renameSync, cpSync, rmSync, symlinkSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, cpSync, rmSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { externalGsdRoot } from "./repo-identity.js";
 import { getErrorMessage } from "./error-utils.js";
+import { hasGitTrackedGsdFiles } from "./gitignore.js";
 
 export interface MigrationResult {
   migrated: boolean;
@@ -51,6 +52,28 @@ export function migrateToExternalState(basePath: string): MigrationResult {
     return { migrated: false, error: `Cannot stat .gsd: ${getErrorMessage(err)}` };
   }
 
+  // Skip if .gsd/ contains git-tracked files — the project intentionally
+  // keeps .gsd/ in version control and migration would destroy that.
+  if (hasGitTrackedGsdFiles(basePath)) {
+    return { migrated: false };
+  }
+
+  // Skip if .gsd/worktrees/ has active worktree directories (#1337).
+  // On Windows, active git worktrees hold OS-level directory handles that
+  // prevent rename/delete. Attempting migration causes EBUSY and data loss.
+  const worktreesDir = join(localGsd, "worktrees");
+  if (existsSync(worktreesDir)) {
+    try {
+      const entries = readdirSync(worktreesDir, { withFileTypes: true });
+      if (entries.some(e => e.isDirectory())) {
+        return { migrated: false };
+      }
+    } catch {
+      // Can't read worktrees dir — skip migration to be safe
+      return { migrated: false };
+    }
+  }
+
   const externalPath = externalGsdRoot(basePath);
   const migratingPath = join(basePath, ".gsd.migrating");
 
@@ -99,7 +122,29 @@ export function migrateToExternalState(basePath: string): MigrationResult {
     // Create symlink .gsd -> external path
     symlinkSync(externalPath, localGsd, "junction");
 
-    // Remove .gsd.migrating
+    // Verify the symlink resolves correctly before removing the backup (#1377).
+    // On Windows, junction creation can silently succeed but resolve to the wrong
+    // target, or the external dir may not be accessible. If verification fails,
+    // restore from the backup.
+    try {
+      const resolved = realpathSync(localGsd);
+      const resolvedExternal = realpathSync(externalPath);
+      if (resolved !== resolvedExternal) {
+        // Symlink points to wrong target — restore backup
+        try { rmSync(localGsd, { force: true }); } catch { /* may not exist */ }
+        renameSync(migratingPath, localGsd);
+        return { migrated: false, error: `Migration verification failed: symlink resolves to ${resolved}, expected ${resolvedExternal}` };
+      }
+      // Verify we can read through the symlink
+      readdirSync(localGsd);
+    } catch (verifyErr) {
+      // Symlink broken or unreadable — restore backup
+      try { rmSync(localGsd, { force: true }); } catch { /* may not exist */ }
+      try { renameSync(migratingPath, localGsd); } catch { /* best-effort restore */ }
+      return { migrated: false, error: `Migration verification failed: ${getErrorMessage(verifyErr)}` };
+    }
+
+    // Remove .gsd.migrating only after symlink is verified
     rmSync(migratingPath, { recursive: true, force: true });
 
     return { migrated: true };