gsd-pi 2.76.0-dev.355e107a0 → 2.76.0-dev.479ad0e78

package/src/resources/extensions/gsd/auto/loop.ts

@@ -50,6 +50,13 @@ function stuckStatePath(basePath: string): string {
 function loadStuckState(basePath: string): { recentUnits: Array<{ key: string }>; stuckRecoveryAttempts: number } {
   try {
     const data = JSON.parse(readFileSync(stuckStatePath(basePath), "utf-8"));
+    // Only load state written by a DIFFERENT process (real session restart).
+    // If the PID matches the current process, this state was written by an earlier
+    // autoLoop call in the same process (e.g., a test that completed before this
+    // one), not by a crashed session — skip it to prevent test state pollution.
+    if (data.pid === process.pid) {
+      return { recentUnits: [], stuckRecoveryAttempts: 0 };
+    }
     return {
       recentUnits: Array.isArray(data.recentUnits) ? data.recentUnits : [],
       stuckRecoveryAttempts: typeof data.stuckRecoveryAttempts === "number" ? data.stuckRecoveryAttempts : 0,
@@ -65,6 +72,7 @@ function saveStuckState(basePath: string, state: LoopState): void {
     const filePath = stuckStatePath(basePath);
     mkdirSync(join(gsdRoot(basePath), "runtime"), { recursive: true });
     writeFileSync(filePath, JSON.stringify({
+      pid: process.pid,
       recentUnits: state.recentUnits.slice(-20), // keep last 20 entries
       stuckRecoveryAttempts: state.stuckRecoveryAttempts,
       updatedAt: new Date().toISOString(),
@@ -590,6 +598,7 @@ export async function autoLoop(
       consecutiveCooldowns = 0;
       recentErrorMessages.length = 0;
       deps.emitJournalEvent({ ts: new Date().toISOString(), flowId, seq: nextSeq(), eventType: "iteration-end", data: { iteration } });
+      saveStuckState(s.basePath, loopState); // persist across session restarts (#4382)
       debugLog("autoLoop", { phase: "iteration-complete", iteration });
       finishTurn("completed");
     } catch (loopErr) {

package/src/resources/extensions/gsd/auto/phases.ts

@@ -81,7 +81,11 @@ export function resetSessionTimeoutState(): void {
  * Exported for testing as _resolveReportBasePath.
  */
 export function _resolveReportBasePath(s: Pick<AutoSession, "originalBasePath" | "basePath">): string {
-  return s.originalBasePath || s.basePath;
+  // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+  // originalBasePath is falsy — prevents reports landing in the worktree (#3729).
+  const resolved = s.originalBasePath || s.basePath;
+  const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+  return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 
 /**
@@ -92,7 +96,12 @@ export function _resolveReportBasePath(s: Pick<AutoSession, "originalBasePath" |
 export function _resolveDispatchGuardBasePath(
   s: Pick<AutoSession, "originalBasePath" | "basePath">,
 ): string {
-  return s.originalBasePath || s.basePath;
+  // Strip /.gsd/worktrees/ suffix when basePath is itself a worktree path and
+  // originalBasePath is falsy — prevents guard checks running against the
+  // worktree instead of the project root (#3729).
+  const resolved = s.originalBasePath || s.basePath;
+  const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+  return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
 }
 
 const PLAN_V2_GATE_PHASES: ReadonlySet<Phase> = new Set([

package/src/resources/extensions/gsd/auto/run-unit.ts

@@ -42,16 +42,25 @@ export async function runUnit(
   let sessionResult: { cancelled: boolean };
   let sessionTimeoutHandle: ReturnType<typeof setTimeout> | undefined;
   const mySessionSwitchGeneration = ++sessionSwitchGeneration;
+  // #3731: Cancellation controller for newSession(). When the session-creation
+  // timeout fires, we abort this controller so that the still-in-flight
+  // newSession() discards itself after await this.abort() completes, preventing
+  // it from capturing the (now-root) process.cwd() and rebuilding the tool
+  // runtime with the wrong cwd.
+  const sessionAbortController = new AbortController();
   _setSessionSwitchInFlight(true);
   try {
-    const sessionPromise = s.cmdCtx!.newSession().finally(() => {
+    const sessionPromise = s.cmdCtx!.newSession({ abortSignal: sessionAbortController.signal }).finally(() => {
       if (sessionSwitchGeneration === mySessionSwitchGeneration) {
         _setSessionSwitchInFlight(false);
       }
     });
     const timeoutPromise = new Promise<{ cancelled: true }>((resolve) => {
       sessionTimeoutHandle = setTimeout(
-        () => resolve({ cancelled: true }),
+        () => {
+          sessionAbortController.abort();
+          resolve({ cancelled: true });
+        },
         NEW_SESSION_TIMEOUT_MS,
       );
     });

package/src/resources/extensions/gsd/auto/session.ts

@@ -220,7 +220,12 @@ export class AutoSession {
   }
 
   get lockBasePath(): string {
-    return this.originalBasePath || this.basePath;
+    // Prefer originalBasePath (project root); fall back to basePath.
+    // Strip /.gsd/worktrees/ suffix if basePath is itself a worktree path
+    // to avoid reading/writing the lock inside the worktree (#3729).
+    const resolved = this.originalBasePath || this.basePath;
+    const markerIdx = resolved.indexOf("/.gsd/worktrees/");
+    return markerIdx !== -1 ? resolved.slice(0, markerIdx) : resolved;
   }
 
   reset(): void {

package/src/resources/extensions/gsd/auto-recovery.ts

@@ -13,7 +13,7 @@ import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice } from "./gsd-db.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -547,6 +547,16 @@ export function writeBlockerPlaceholder(
       try { updateSliceStatus(mid, sid, "complete", ts); } catch (e) { logWarning("recovery", `updateSliceStatus failed during context exhaustion: ${e instanceof Error ? e.message : String(e)}`); }
       try { appendEvent(base, { cmd: "complete-slice", params: { milestoneId: mid, sliceId: sid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" }); } catch (e) { logWarning("recovery", `appendEvent failed for slice recovery: ${e instanceof Error ? e.message : String(e)}`); }
     }
+    // Insert a placeholder complete slice so deriveState sees activeMilestoneSlices.length > 0
+    // and exits the pre-planning phase. Without this, activeMilestoneSlices stays empty
+    // after the blocker ROADMAP.md is written, causing deriveState to return phase:'pre-planning'
+    // indefinitely and re-dispatching plan-milestone in an infinite loop (#4378).
+    if (unitType === "plan-milestone" && mid) {
+      try {
+        insertSlice({ id: "S00-blocker", milestoneId: mid, title: "Blocker placeholder — planning failed", status: "complete", sequence: 0 });
+      } catch (e) { logWarning("recovery", `insertSlice placeholder failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`); }
+      try { appendEvent(base, { cmd: "plan-milestone", params: { milestoneId: mid }, ts, actor: "system", trigger_reason: "blocker-placeholder-recovery" }); } catch (e) { logWarning("recovery", `appendEvent failed for plan-milestone recovery: ${e instanceof Error ? e.message : String(e)}`); }
+    }
   }
 
   return diagnoseExpectedArtifact(unitType, unitId, base);

package/src/resources/extensions/gsd/auto.ts

@@ -1507,6 +1507,17 @@ export async function startAuto(
     s.stepMode = requestedStepMode;
     s.cmdCtx = ctx;
     s.basePath = base;
+    // ── Resume worktree: if the paused session was inside a milestone worktree,
+    // apply that path as the dispatch basePath immediately (#3723).
+    // This ensures the dispatch loop runs from the worktree directory even when
+    // enterMilestone guard conditions differ between the original and resumed
+    // session (e.g. isolation mode changed, detectWorktreeName differs across
+    // process restarts).  We guard with existsSync so a stale or deleted
+    // worktree directory safely falls back to the project root.
+    const resumeWorktreePath = freshStartAssessment.pausedSession?.worktreePath;
+    if (resumeWorktreePath && existsSync(resumeWorktreePath)) {
+      s.basePath = resumeWorktreePath;
+    }
     // Ensure the workflow-logger audit log is pinned to the project root
     // even when auto-mode is entered via a path that bypasses the
     // bootstrap/dynamic-tools ensureDbOpen() → setLogBasePath() chain

package/src/resources/extensions/gsd/gitignore.ts

@@ -48,6 +48,7 @@ const BASELINE_PATTERNS = [
   // ── GSD state directory (symlink to external storage) ──
   ".gsd",
   ".gsd-id",
+  ".mcp.json",
   ".bg-shell/",
 
   // ── OS junk ──
@@ -319,4 +320,3 @@ custom_instructions:
   writeFileSync(preferencesPath, template, "utf-8");
   return true;
 }
-

package/src/resources/extensions/gsd/gsd-db.ts

@@ -2776,7 +2776,10 @@ export function reconcileWorktreeDb(
           FROM wt.artifacts
         `).run());
 
-        // Merge milestones — worktree may have updated status/planning fields
+        // Merge milestones — worktree may have updated status/planning fields.
+        // Never downgrade status: complete > active > pre-planning (#4372).
+        // A stale worktree may carry an older 'active' status for a milestone
+        // that the main DB has already marked 'complete'; preserve the higher status.
         merged.milestones = countChanges(adapter.prepare(`
           INSERT OR REPLACE INTO milestones (
             id, title, status, depends_on, created_at, completed_at,
@@ -2784,11 +2787,25 @@ export function reconcileWorktreeDb(
             verification_contract, verification_integration, verification_operational, verification_uat,
             definition_of_done, requirement_coverage, boundary_map_markdown
           )
-          SELECT id, title, status, depends_on, created_at, completed_at,
-                 vision, success_criteria, key_risks, proof_strategy,
-                 verification_contract, verification_integration, verification_operational, verification_uat,
-                 definition_of_done, requirement_coverage, boundary_map_markdown
-          FROM wt.milestones
+          SELECT w.id, w.title,
+                 CASE
+                   WHEN m.status IN ('complete', 'done') AND w.status NOT IN ('complete', 'done')
+                   THEN m.status ELSE w.status
+                 END,
+                 w.depends_on,
+                 CASE
+                   WHEN m.status IN ('complete', 'done') AND w.status NOT IN ('complete', 'done')
+                   THEN m.created_at ELSE w.created_at
+                 END,
+                 CASE
+                   WHEN m.status IN ('complete', 'done') AND w.status NOT IN ('complete', 'done')
+                   THEN m.completed_at ELSE w.completed_at
+                 END,
+                 w.vision, w.success_criteria, w.key_risks, w.proof_strategy,
+                 w.verification_contract, w.verification_integration, w.verification_operational, w.verification_uat,
+                 w.definition_of_done, w.requirement_coverage, w.boundary_map_markdown
+          FROM wt.milestones w
+          LEFT JOIN milestones m ON m.id = w.id
         `).run());
 
         // Merge slices — preserve worktree progress but never downgrade completed status (#2558).

package/src/resources/extensions/gsd/tests/auto-loop.test.ts

@@ -35,12 +35,15 @@ function makeMockSession(opts?: {
   newSessionDelayMs?: number;
   onNewSessionStart?: (session: any) => void;
   onNewSessionSettle?: (session: any) => void;
+  /** Called after the delay with the aborted state of any passed abortSignal.
+   *  Used to verify that runUnit passes an aborted signal on late resolution (#3731). */
+  onSignalCheck?: (aborted: boolean) => void;
 }) {
   const session = {
     active: true,
     verbose: false,
     cmdCtx: {
-      newSession: () => {
+      newSession: (options?: { abortSignal?: AbortSignal }) => {
         opts?.onNewSessionStart?.(session);
         if (opts?.newSessionThrows) {
           return Promise.reject(new Error(opts.newSessionThrows));
@@ -50,11 +53,17 @@ function makeMockSession(opts?: {
         if (delay > 0) {
           return new Promise<{ cancelled: boolean }>((res) =>
             setTimeout(() => {
+              // Simulate AgentSession.newSession() checking abortSignal after
+              // its internal async work (abort()) completes — this is where the
+              // real code captures process.cwd() and rebuilds the tool runtime.
+              // If the signal is aborted, the real code discards the session.
+              opts?.onSignalCheck?.(options?.abortSignal?.aborted ?? false);
               opts?.onNewSessionSettle?.(session);
               res(result);
             }, delay),
           );
         }
+        opts?.onSignalCheck?.(options?.abortSignal?.aborted ?? false);
         opts?.onNewSessionSettle?.(session);
         return Promise.resolve(result);
       },
@@ -465,6 +474,65 @@ test("runUnit proceeds when isProviderRequestReady throws (defensive) (#4555)",
   assert.equal(pi.calls.length, 0);
 });
 
+test("late-resolving newSession() after timeout receives aborted signal so tool runtime is not configured with root cwd (#3731)", async () => {
+  // When newSession() times out in runUnit(), auto-mode restores cwd to project
+  // root. If newSession() later resolves, it must NOT use process.cwd() to
+  // configure the tool runtime (which would give it root cwd, not worktree cwd).
+  //
+  // The fix: runUnit creates an AbortController, aborts it on timeout, and passes
+  // the signal to newSession(). AgentSession.newSession() checks the signal after
+  // its internal await this.abort() completes and returns early (discards) if aborted.
+  //
+  // This test uses mock.timers to control timing precisely.
+  _resetPendingResolve();
+  mock.timers.enable();
+
+  try {
+    let abortedWhenLateSessionSettled: boolean | null = null;
+
+    // newSession mock simulates AgentSession.newSession() behavior:
+    // after an internal delay (representing await this.abort()), it checks the
+    // abortSignal — that's where the real code would capture process.cwd() and
+    // call _buildRuntime. If aborted, the real code must discard the session.
+    const s = makeMockSession({
+      newSessionDelayMs: 200_000, // longer than NEW_SESSION_TIMEOUT_MS (120s)
+      onSignalCheck: (aborted) => {
+        abortedWhenLateSessionSettled = aborted;
+      },
+    });
+
+    const ctx = makeMockCtx();
+    const pi = makeMockPi();
+
+    const resultPromise = runUnit(ctx, pi, s, "task", "T01", "prompt");
+
+    // Tick past the 120s NEW_SESSION_TIMEOUT_MS — runUnit returns cancelled
+    mock.timers.tick(121_000);
+    await Promise.resolve();
+
+    const result = await resultPromise;
+    assert.equal(result.status, "cancelled", "runUnit must return cancelled on session timeout");
+
+    // Tick past the delayed newSession (200s total) — the late newSession resolves
+    mock.timers.tick(80_000);
+    // Drain microtask queue so the .finally() and setTimeout callbacks run
+    await Promise.resolve();
+    await Promise.resolve();
+
+    // The key assertion: when the late newSession() resolves, runUnit must have
+    // passed an aborted AbortSignal. Without the fix, no signal is passed and
+    // abortedWhenLateSessionSettled would be false (or null, if signal not passed at all).
+    assert.equal(
+      abortedWhenLateSessionSettled,
+      true,
+      "runUnit must pass an aborted AbortSignal to newSession() when it resolves after the session-creation timeout (#3731). " +
+      "Without this, AgentSession.newSession() captures root process.cwd() and rebuilds the tool runtime with wrong cwd.",
+    );
+  } finally {
+    mock.timers.reset();
+  }
+});
+
 // ─── Structural assertions ───────────────────────────────────────────────────
 
 test("auto-loop.ts exports autoLoop, runUnit, resolveAgentEnd", async () => {

package/src/resources/extensions/gsd/tests/integration/git-service.test.ts

@@ -1235,6 +1235,7 @@ describe('git-service', async () => {
     const content = readFileSync(join(repo, ".gitignore"), "utf-8");
     const lines = content.split("\n").map(l => l.trim()).filter(l => l && !l.startsWith("#"));
     assert.ok(lines.includes(".gsd"), "ensureGitignore: .gitignore contains .gsd");
+    assert.ok(lines.includes(".mcp.json"), "ensureGitignore: .gitignore contains .mcp.json");
 
     // Idempotent — calling again doesn't add duplicates
     const modified2 = ensureGitignore(repo);

package/src/resources/extensions/gsd/tests/integration/gitignore-tracked-gsd.test.ts

@@ -107,6 +107,7 @@ test("ensureGitignore does NOT add .gsd when .gsd/ has tracked files (#1364)", (
     // Other baseline patterns should still be present
     assert.ok(lines.includes(".DS_Store"), "Expected .DS_Store in .gitignore");
     assert.ok(lines.includes("node_modules/"), "Expected node_modules/ in .gitignore");
+    assert.ok(lines.includes(".mcp.json"), "Expected .mcp.json in .gitignore");
   } finally {
     cleanup(dir);
   }

package/src/resources/extensions/gsd/tests/integration/idle-recovery.test.ts

@@ -442,3 +442,33 @@ test('writeBlockerPlaceholder: updates DB slice status for complete-slice (#2653
     cleanup(base);
   }
 });
+
+test('writeBlockerPlaceholder: inserts placeholder slice for plan-milestone so deriveState exits pre-planning (#4378)', async () => {
+  const base = createFixtureBase();
+  try {
+    const { openDatabase, closeDatabase, insertMilestone, getMilestoneSlices, isDbAvailable } =
+      await import("../../gsd-db.ts");
+
+    const dbPath = join(base, ".gsd", "gsd.db");
+    mkdirSync(join(base, ".gsd", "milestones", "M001"), { recursive: true });
+
+    openDatabase(dbPath);
+    try {
+      insertMilestone({ id: "M001", title: "Test", status: "active" });
+
+      // Before fix: writeBlockerPlaceholder wrote the placeholder ROADMAP.md but
+      // never updated the DB, so activeMilestoneSlices.length === 0 on next deriveState
+      // call → state.phase stays 'pre-planning' → plan-milestone dispatches again → infinite loop
+      writeBlockerPlaceholder("plan-milestone", "M001", base, "idle recovery exhausted");
+
+      const slices = getMilestoneSlices("M001");
+      assert.ok(slices.length > 0,
+        "writeBlockerPlaceholder must insert a placeholder slice for plan-milestone so " +
+        "deriveState sees activeMilestoneSlices.length > 0 and exits pre-planning phase (#4378)");
+    } finally {
+      if (isDbAvailable()) closeDatabase();
+    }
+  } finally {
+    cleanup(base);
+  }
+});

package/src/resources/extensions/gsd/tests/memory-pressure-stuck-state.test.ts

@@ -51,4 +51,16 @@ describe("stuck detection persistence (#3704)", () => {
   test("stuck state file path uses runtime directory", () => {
     assert.match(loopSource, /stuck-state\.json/);
   });
+
+  test("saveStuckState called in standard dev path as well as custom engine path (#4382)", () => {
+    // Count all call-sites of saveStuckState (excluding the function definition itself).
+    // After the fix, both the custom-engine path and the standard dev path must each
+    // call saveStuckState so stuckRecoveryAttempts survives session restarts.
+    const callMatches = loopSource.match(/saveStuckState\(s\.basePath,\s*loopState\)/g) ?? [];
+    assert.ok(
+      callMatches.length >= 2,
+      `saveStuckState must be called in both the custom-engine path and the standard dev path ` +
+      `(found ${callMatches.length} call(s) — standard path is missing its call, #4382)`,
+    );
+  });
 });

package/src/resources/extensions/gsd/tests/resume-dispatch-worktree.test.ts

@@ -0,0 +1,230 @@
+/**
+ * Tests for fix of #3723: auto-mode resume/crash-recovery dispatches
+ * from project root instead of milestone worktree.
+ *
+ * During resume, the paused-session metadata may record `worktreePath` that
+ * was active when the session paused. The resume path must use that path (or
+ * derive the worktree path via filesystem lookup) to set the dispatch context
+ * (`s.basePath`), rather than defaulting to the project root.
+ *
+ * The fix adds an early worktree-path resolution step in the paused-session
+ * resume block of auto.ts — immediately after `s.basePath = base` — so that
+ * the correct dispatch directory is used before the dispatch loop runs.
+ */
+
+import test from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync, mkdirSync, rmSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { randomUUID } from "node:crypto";
+import { fileURLToPath } from "node:url";
+import { dirname } from "node:path";
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const autoSrc = readFileSync(join(__dirname, "..", "auto.ts"), "utf-8");
+
+// ── Source-structure tests ────────────────────────────────────────────────────
+
+/**
+ * Extract the paused-session resume block from auto.ts.
+ *
+ * The block we care about is the `if (s.paused) { ... }` section inside
+ * startAuto, which contains `s.basePath = base` (line ~1473) followed by the
+ * `enterMilestone` call.
+ *
+ * We find it by locating the `s.basePath = base` assignment that appears
+ * WITHIN the s.paused branch (there's only one: all other basePath assignments
+ * use originalBasePath or a different value). We extract from that assignment
+ * up to just before `enterMilestone(`.
+ */
+function getBasepathToEnterMilestoneSegment(): string {
+  // Find `s.basePath = base;` in the s.paused branch
+  // This assignment appears uniquely inside the resume block
+  const assignPattern = "s.basePath = base;";
+  const assignIdx = autoSrc.indexOf(assignPattern);
+  assert.ok(
+    assignIdx > -1,
+    `auto.ts must contain '${assignPattern}' in the resume block`,
+  );
+
+  // Find the next enterMilestone call after this assignment
+  const enterMilestoneIdx = autoSrc.indexOf("enterMilestone(", assignIdx);
+  assert.ok(
+    enterMilestoneIdx > assignIdx,
+    "auto.ts must call enterMilestone after the s.basePath = base assignment",
+  );
+
+  // Return the code between the assignment and enterMilestone
+  return autoSrc.slice(assignIdx, enterMilestoneIdx);
+}
+
+test("auto.ts resume block resolves paused-session worktreePath and applies it to s.basePath before entering worktree (fixes #3723)", () => {
+  // The segment between `s.basePath = base` and `enterMilestone(` must
+  // contain logic that resolves the paused-session worktreePath and applies
+  // it to s.basePath when the worktree exists on disk.
+  //
+  // The fix reads the worktree path from freshStartAssessment.pausedSession
+  // (since `meta` is out of scope at this point in startAuto) and assigns
+  // it to s.basePath, guarded by existsSync.
+  //
+  // Without this fix, the dispatch loop runs from `base` (project root)
+  // instead of the worktree, causing split-brain execution (#3723).
+  const segment = getBasepathToEnterMilestoneSegment();
+
+  // The fix uses freshStartAssessment.pausedSession?.worktreePath via a
+  // local variable (resumeWorktreePath) and assigns to s.basePath.
+  const hasWorktreePathResolution =
+    segment.includes("worktreePath") &&
+    segment.includes("existsSync") &&
+    segment.includes("s.basePath =");
+
+  assert.ok(
+    hasWorktreePathResolution,
+    "auto.ts must resolve the paused-session worktreePath, check existsSync, and assign " +
+    "s.basePath before enterMilestone — crash-recovery currently dispatches from project root " +
+    "instead of milestone worktree (issue #3723). The fix belongs between `s.basePath = base` " +
+    "and the enterMilestone call.",
+  );
+});
+
+test("auto.ts worktreePath assignment in resume block guards against non-existent path (fixes #3723)", () => {
+  // The assignment to s.basePath from the paused-session worktreePath must
+  // be guarded by existsSync to avoid setting an invalid basePath if the
+  // worktree was cleaned up between pause and resume.
+  const segment = getBasepathToEnterMilestoneSegment();
+
+  // Must have existsSync guard AND a worktreePath reference AND s.basePath assignment
+  const hasGuardedAssignment =
+    segment.includes("existsSync") &&
+    segment.includes("worktreePath") &&
+    segment.includes("s.basePath =");
+
+  assert.ok(
+    hasGuardedAssignment,
+    "auto.ts must guard the s.basePath = worktreePath assignment with existsSync (fixes #3723)",
+  );
+});
+
+// ── Functional tests ──────────────────────────────────────────────────────────
+
+function makeTmpBase(): string {
+  const base = join(tmpdir(), `gsd-resume-wt-${randomUUID()}`);
+  mkdirSync(join(base, ".gsd", "runtime"), { recursive: true });
+  return base;
+}
+
+function cleanup(base: string): void {
+  try { rmSync(base, { recursive: true, force: true }); } catch { /* */ }
+}
+
+function writePausedSession(
+  base: string,
+  milestoneId: string,
+  worktreePath: string | null,
+): void {
+  writeFileSync(
+    join(base, ".gsd", "runtime", "paused-session.json"),
+    JSON.stringify({
+      milestoneId,
+      originalBasePath: base,
+      stepMode: false,
+      worktreePath,
+      pausedAt: new Date().toISOString(),
+    }, null, 2),
+    "utf-8",
+  );
+}
+
+function makeWorktreePath(base: string, milestoneId: string): string {
+  return join(base, ".gsd", "worktrees", milestoneId);
+}
+
+function setupWorktreeOnDisk(wt: string): void {
+  mkdirSync(wt, { recursive: true });
+  // Simulate a git worktree: .git file with gitdir pointer
+  writeFileSync(
+    join(wt, ".git"),
+    "gitdir: /project/.git/worktrees/M001-test\n",
+    "utf-8",
+  );
+}
+
+function writeRoadmap(base: string, milestoneId = "M001-test"): void {
+  const milestoneDir = join(base, ".gsd", "milestones", milestoneId);
+  mkdirSync(join(milestoneDir, "slices", "S01", "tasks"), { recursive: true });
+  writeFileSync(
+    join(milestoneDir, `${milestoneId}-ROADMAP.md`),
+    [
+      `# ${milestoneId}: Test Milestone`,
+      "",
+      "## Slices",
+      "",
+      "- [ ] **S01: Test slice** `risk:low`",
+      "  After this: Demo",
+    ].join("\n"),
+    "utf-8",
+  );
+}
+
+test("readPausedSessionMetadata round-trips worktreePath from paused-session.json", () => {
+  // Verify that the paused-session metadata correctly stores and reads back
+  // the worktreePath field — this is what the resume path in auto.ts uses
+  // to determine the dispatch basePath (#3723).
+  //
+  // Implemented inline to avoid slow import chain from interrupted-session.ts.
+  const base = makeTmpBase();
+  const wt = makeWorktreePath(base, "M001-test");
+  try {
+    setupWorktreeOnDisk(wt);
+    writePausedSession(base, "M001-test", wt);
+
+    // Simulate readPausedSessionMetadata without importing the full module
+    const pausedPath = join(base, ".gsd", "runtime", "paused-session.json");
+    const meta = JSON.parse(readFileSync(pausedPath, "utf-8"));
+
+    assert.ok(meta, "paused-session metadata must be readable");
+    assert.equal(meta.milestoneId, "M001-test");
+    assert.equal(meta.worktreePath, wt, "worktreePath must round-trip through paused-session.json");
+  } finally {
+    cleanup(base);
+  }
+});
+
+test("auto.ts resume block uses worktreePath from freshStartAssessment.pausedSession as dispatch basePath when worktree exists (#3723)", () => {
+  // End-to-end structural verification: the auto.ts source must contain code
+  // that reads the worktreePath from freshStartAssessment.pausedSession AND
+  // applies it to s.basePath (guarded by existsSync) between the
+  // `s.basePath = base` assignment and `enterMilestone`.
+  //
+  // This is the core of the #3723 fix. Without this check, a session that
+  // paused while operating inside a worktree will resume dispatching from the
+  // project root, not the worktree — causing split-brain execution where some
+  // operations target the worktree and others target the project root.
+  const segment = getBasepathToEnterMilestoneSegment();
+
+  // Must reference freshStartAssessment.pausedSession?.worktreePath or
+  // equivalent local variable, AND contain an existsSync guard
+  const hasAssessmentWorktreePath =
+    segment.includes("freshStartAssessment.pausedSession") &&
+    segment.includes("worktreePath");
+
+  assert.ok(
+    hasAssessmentWorktreePath,
+    "auto.ts must read worktreePath from freshStartAssessment.pausedSession between " +
+    "s.basePath=base and enterMilestone",
+  );
+  assert.ok(
+    segment.includes("existsSync"),
+    "auto.ts must guard worktreePath usage with existsSync",
+  );
+  // The actual basePath re-assignment must be present in the segment
+  // (note: there are multiple `s.basePath =` assignments — we need one after
+  // the initial `s.basePath = base` assignment within this segment)
+  const worktreeAssignIdx = segment.lastIndexOf("s.basePath =");
+  const baseAssignIdx = segment.indexOf("s.basePath = base");
+  assert.ok(
+    worktreeAssignIdx > baseAssignIdx,
+    "auto.ts must assign s.basePath to the worktree path after `s.basePath = base` in the resume block",
+  );
+});

package/src/resources/extensions/gsd/tests/worktree-db.test.ts

@@ -10,6 +10,8 @@ import {
   insertDecision,
   insertRequirement,
   insertArtifact,
+  insertMilestone,
+  getMilestone,
   getDecisionById,
   getRequirementById,
   _getAdapter,
@@ -442,4 +444,37 @@ console.log('\n=== worktree-db: reconcileWorktreeDb ===');
   cleanup(mainDir, wtDir);
 }
 
+// Test: reconcileWorktreeDb must NOT downgrade milestone status complete→active (#4372)
+{
+  const mainDir = tempDir();
+  const wtDir = tempDir();
+  const mainDb = path.join(mainDir, 'gsd.db');
+  const wtDb = path.join(wtDir, 'gsd.db');
+
+  // Seed main with a milestone already marked complete
+  seedMainDb(mainDb);
+  const mainAdapter = _getAdapter()!;
+  insertMilestone({ id: 'M-COMP', title: 'Completed Milestone', status: 'complete' });
+  // Manually mark completed_at so it's a realistic complete record
+  mainAdapter.prepare(`UPDATE milestones SET completed_at = '2025-06-01T00:00:00.000Z' WHERE id = 'M-COMP'`).run();
+  closeDatabase();
+
+  // Copy to worktree — the worktree has the milestone as 'active' (stale / older snapshot)
+  copyWorktreeDb(mainDb, wtDb);
+  openDatabase(wtDb);
+  const wtAdapter = _getAdapter()!;
+  wtAdapter.prepare(`UPDATE milestones SET status = 'active', completed_at = NULL WHERE id = 'M-COMP'`).run();
+  closeDatabase();
+
+  // Reconcile: main should win and keep 'complete'
+  openDatabase(mainDb);
+  reconcileWorktreeDb(mainDb, wtDb);
+
+  const m = getMilestone('M-COMP');
+  assert.ok(m !== null, 'milestone M-COMP still exists after reconcile');
+  assert.strictEqual(m!.status, 'complete', 'complete milestone must not be downgraded to active by stale worktree');
+
+  cleanup(mainDir, wtDir);
+}
+
 // ─── Final Report ──────────────────────────────────────────────────────────