gsd-pi 2.77.0 → 2.78.0

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -159,7 +159,7 @@ Setting `prefer_skills: []` does **not** disable skill discovery — it just mea
 
 - `phases`: fine-grained control over which phases run. Usually set by `token_profile`, but can be overridden. Keys:
   - `skip_research`: boolean — skip milestone-level research. Default: `false`.
-  - `reassess_after_slice`: boolean — run roadmap reassessment after each completed slice. Default: `true`.
+  - `reassess_after_slice`: boolean — run a dedicated roadmap-reassessment unit after each completed slice. Default: `false` (per ADR-003 §4). The plan-slice agent for the next slice performs JIT reassessment via a prompt preamble at zero additional token cost; a dedicated reassess session is opt-in. Set to `true` (e.g. via the `burn-max` profile) if you want the explicit session.
   - `skip_reassess`: boolean — force-disable roadmap reassessment even if `reassess_after_slice` is enabled. Default: `false`.
   - `skip_slice_research`: boolean — skip per-slice research. Default: `false`.
 

package/dist/resources/extensions/gsd/file-lock.js

@@ -1,11 +1,19 @@
 import { existsSync } from "node:fs";
+import { createRequire } from "node:module";
+import { join } from "node:path";
+// The file-lock module is loaded in both CJS builds and ESM sources. Under ESM
+// the bare `require` identifier is not defined, so we always go through
+// createRequire. We try the current module's resolution context first and fall
+// back to the installed gsd-pi package if we are running from a consumer
+// project that does not hoist proper-lockfile.
+const localRequire = createRequire(import.meta.url);
 function _require(name) {
     try {
-        return require(name);
+        return localRequire(name);
     }
     catch {
         try {
-            const gsdPiRequire = require("module").createRequire(require("path").join(process.cwd(), "node_modules", "gsd-pi", "index.js"));
+            const gsdPiRequire = createRequire(join(process.cwd(), "node_modules", "gsd-pi", "index.js"));
             return gsdPiRequire(name);
         }
         catch {
@@ -13,14 +21,44 @@ function _require(name) {
         }
     }
 }
-export function withFileLockSync(filePath, fn) {
+const DEFAULT_RETRIES = 5;
+const DEFAULT_STALE_MS = 10000;
+const SYNC_RETRY_DELAY_MS = 50;
+// Block the thread for `ms` milliseconds without spinning the CPU.
+// Used by the sync lock retry loop, since proper-lockfile's lockSync does not
+// accept a `retries` option (only the async `lock` does).
+function sleepSync(ms) {
+    if (ms <= 0)
+        return;
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireLockSyncWithRetry(lockfile, filePath, retries, stale) {
+    let lastErr;
+    for (let attempt = 0; attempt <= retries; attempt++) {
+        try {
+            return lockfile.lockSync(filePath, { stale });
+        }
+        catch (err) {
+            lastErr = err;
+            if (err?.code !== "ELOCKED")
+                throw err;
+            if (attempt < retries)
+                sleepSync(SYNC_RETRY_DELAY_MS);
+        }
+    }
+    throw lastErr;
+}
+export function withFileLockSync(filePath, fn, opts = {}) {
     const lockfile = _require("proper-lockfile");
     if (!lockfile)
         return fn();
     if (!existsSync(filePath))
         return fn();
+    const retries = opts.retries ?? DEFAULT_RETRIES;
+    const stale = opts.stale ?? DEFAULT_STALE_MS;
+    const onLocked = opts.onLocked ?? "fail";
     try {
-        const release = lockfile.lockSync(filePath, { retries: 5, stale: 10000 });
+        const release = acquireLockSyncWithRetry(lockfile, filePath, retries, stale);
         try {
             return fn();
         }
@@ -29,21 +67,23 @@ export function withFileLockSync(filePath, fn) {
         }
     }
     catch (err) {
-        if (err.code === "ELOCKED") {
-            // Could not get lock after retries, let's fallback to un-locked instead of crashing the whole state machine
+        if (err?.code === "ELOCKED" && onLocked === "skip") {
             return fn();
         }
         throw err;
     }
 }
-export async function withFileLock(filePath, fn) {
+export async function withFileLock(filePath, fn, opts = {}) {
     const lockfile = _require("proper-lockfile");
     if (!lockfile)
         return await fn();
     if (!existsSync(filePath))
         return await fn();
+    const retries = opts.retries ?? DEFAULT_RETRIES;
+    const stale = opts.stale ?? DEFAULT_STALE_MS;
+    const onLocked = opts.onLocked ?? "fail";
     try {
-        const release = await lockfile.lock(filePath, { retries: 5, stale: 10000 });
+        const release = await lockfile.lock(filePath, { retries, stale });
         try {
             return await fn();
         }
@@ -52,7 +92,7 @@ export async function withFileLock(filePath, fn) {
         }
     }
     catch (err) {
-        if (err.code === "ELOCKED") {
+        if (err?.code === "ELOCKED" && onLocked === "skip") {
             return await fn();
         }
         throw err;

package/dist/resources/extensions/gsd/forensics.js

@@ -29,6 +29,7 @@ import { getAutoWorktreePath } from "./auto-worktree.js";
 import { loadEffectiveGSDPreferences, loadGlobalGSDPreferences, getGlobalGSDPreferencesPath } from "./preferences.js";
 import { showNextAction } from "../shared/tui.js";
 import { ensurePreferencesFile, serializePreferencesToFrontmatter } from "./commands-prefs-wizard.js";
+import { summarizeWorktreeTelemetry, percentile } from "./worktree-telemetry.js";
 // ─── Duplicate Detection ──────────────────────────────────────────────────────
 const DEDUP_PROMPT_SECTION = `
 ## Pre-Investigation: Duplicate Check (REQUIRED)
@@ -214,6 +215,16 @@ export async function buildForensicReport(basePath) {
     detectCrash(crashLock, anomalies);
     detectDoctorIssues(doctorIssues, anomalies);
     detectErrorTraces(unitTraces, anomalies);
+    // 11b. #4764 — worktree lifecycle telemetry
+    let worktreeTelemetry = null;
+    try {
+        worktreeTelemetry = summarizeWorktreeTelemetry(basePath);
+        detectWorktreeOrphans(worktreeTelemetry, anomalies);
+    }
+    catch {
+        // Telemetry is best-effort — do not let an aggregator failure block the
+        // rest of the forensic report.
+    }
     detectJournalAnomalies(journalSummary, anomalies);
     return {
         gsdVersion,
@@ -232,6 +243,7 @@ export async function buildForensicReport(basePath) {
         recentUnits,
         journalSummary,
         activityLogMeta,
+        worktreeTelemetry,
     };
 }
 // ─── Activity Log Scanner ─────────────────────────────────────────────────────
@@ -630,6 +642,45 @@ function detectMissingArtifacts(completedKeys, basePath, activeMilestone, anomal
         }
     }
 }
+/**
+ * #4764 — surface worktree lifecycle and orphan signals in the forensic report.
+ *
+ * Consumes only the aggregated summary (not raw journal events) to respect
+ * the forensics memory-bloat guard in forensics-journal.test.ts — per-event
+ * detail stays in the journal itself where the LLM can query it on demand.
+ */
+function detectWorktreeOrphans(summary, anomalies) {
+    // 1. Orphan aggregate — severity depends on reason. In-progress orphans are
+    // the #4761 consumer-side signal (live work sitting on an unmerged branch).
+    for (const [reason, count] of Object.entries(summary.orphansByReason)) {
+        if (count <= 0)
+            continue;
+        const severity = reason === "in-progress-unmerged" ? "warning" : "info";
+        anomalies.push({
+            type: "worktree-orphan",
+            severity,
+            summary: `${count} worktree orphan(s) detected (${reason})`,
+            details: reason === "in-progress-unmerged"
+                ? "Auto-mode exited without completing a milestone; live work sits on an unmerged milestone branch. Run `/gsd auto` to resume, or merge manually."
+                : reason === "complete-unmerged"
+                    ? "A completed milestone's branch was never merged back to main. Run `/gsd health --fix` to resolve."
+                    : `Reason: ${reason}.`,
+        });
+    }
+    // 2. Auto-exit producer signal — #4761's upstream cause.
+    if (summary.exitsWithUnmergedWork > 0) {
+        const reasonBreakdown = Object.entries(summary.exitsByReason)
+            .filter(([, n]) => n > 0)
+            .map(([r, n]) => `${r}=${n}`)
+            .join(", ");
+        anomalies.push({
+            type: "worktree-unmerged-exit",
+            severity: "warning",
+            summary: `${summary.exitsWithUnmergedWork} auto-exit(s) left milestone work unmerged`,
+            details: `Exit reasons: ${reasonBreakdown || "(none)"} · Producer-side signal for #4761-class orphans. Inspect .gsd/journal/*.jsonl with eventType:"auto-exit" for per-exit detail.`,
+        });
+    }
+}
 function detectCrash(crashLock, anomalies) {
     if (!crashLock)
         return;
@@ -808,6 +859,39 @@ function saveForensicReport(basePath, report, problemDescription) {
             sections.push(`- Newest: ${meta.newestFile}`);
         sections.push(``);
     }
+    // #4764 — Worktree telemetry summary
+    if (report.worktreeTelemetry) {
+        const t = report.worktreeTelemetry;
+        const p50 = percentile(t.mergeDurationsMs, 0.5);
+        const p95 = percentile(t.mergeDurationsMs, 0.95);
+        sections.push(`## Worktree Telemetry`, ``);
+        sections.push(`- Worktrees created: ${t.worktreesCreated}`);
+        sections.push(`- Worktrees merged: ${t.worktreesMerged}`);
+        sections.push(`- Orphans detected: ${t.orphansDetected}`);
+        if (t.orphansDetected > 0) {
+            const breakdown = Object.entries(t.orphansByReason)
+                .map(([r, n]) => `${r}=${n}`).join(", ");
+            sections.push(`  - By reason: ${breakdown}`);
+        }
+        sections.push(`- Merge conflicts: ${t.mergeConflicts}`);
+        if (t.mergeDurationsMs.length > 0) {
+            sections.push(`- Merge duration p50 / p95: ${p50 ?? "-"} / ${p95 ?? "-"} ms (n=${t.mergeDurationsMs.length})`);
+        }
+        sections.push(`- Auto-exits leaving unmerged work: ${t.exitsWithUnmergedWork}`);
+        if (Object.keys(t.exitsByReason).length > 0) {
+            const breakdown = Object.entries(t.exitsByReason)
+                .sort((a, b) => b[1] - a[1])
+                .map(([r, n]) => `${r}=${n}`).join(", ");
+            sections.push(`  - Exit reasons: ${breakdown}`);
+        }
+        sections.push(`- Canonical-root redirects (#4761 fix fired): ${t.canonicalRedirects}`);
+        // #4765 slice-cadence counters
+        if (t.slicesMerged + t.sliceMergeConflicts + t.milestoneResquashes > 0) {
+            sections.push(`- Slices merged: ${t.slicesMerged} · Slice merge conflicts: ${t.sliceMergeConflicts}`);
+            sections.push(`- Milestone re-squashes: ${t.milestoneResquashes}`);
+        }
+        sections.push(``);
+    }
     // Journal summary
     if (report.journalSummary) {
         const js = report.journalSummary;
@@ -940,6 +1024,28 @@ function formatReportForPrompt(report) {
         sections.push(`- Total duration: ${formatDuration(totals.duration)}`);
         sections.push("");
     }
+    // #4764 — worktree telemetry (compact prompt form)
+    if (report.worktreeTelemetry) {
+        const t = report.worktreeTelemetry;
+        const hasSignal = t.worktreesCreated + t.worktreesMerged + t.orphansDetected +
+            t.exitsWithUnmergedWork + t.canonicalRedirects +
+            t.slicesMerged + t.milestoneResquashes > 0;
+        if (hasSignal) {
+            sections.push("### Worktree Telemetry");
+            sections.push(`- Created: ${t.worktreesCreated} · Merged: ${t.worktreesMerged} · Conflicts: ${t.mergeConflicts}`);
+            sections.push(`- Orphans: ${t.orphansDetected} · Unmerged exits: ${t.exitsWithUnmergedWork} · Redirects (#4761): ${t.canonicalRedirects}`);
+            if (t.orphansDetected > 0) {
+                const breakdown = Object.entries(t.orphansByReason)
+                    .map(([r, n]) => `${r}=${n}`).join(", ");
+                sections.push(`- Orphan reasons: ${breakdown}`);
+            }
+            // #4765 — slice-cadence counters (only shown when the feature was exercised)
+            if (t.slicesMerged + t.sliceMergeConflicts + t.milestoneResquashes > 0) {
+                sections.push(`- Slices merged: ${t.slicesMerged} · Slice conflicts: ${t.sliceMergeConflicts} · Re-squashes: ${t.milestoneResquashes}`);
+            }
+            sections.push("");
+        }
+    }
     // Activity log metadata
     if (report.activityLogMeta) {
         const meta = report.activityLogMeta;

package/dist/resources/extensions/gsd/gate-registry.js

@@ -37,9 +37,9 @@ export const GATE_REGISTRY = {
         id: "Q4",
         scope: "slice",
         ownerTurn: "gate-evaluate",
-        question: "What existing promises does this break?",
+        question: "Which existing requirements (R-IDs) does this slice touch, and which must be re-tested?",
         guidance: [
-            "List which existing requirements (R001, R003, etc.) are touched by this slice.",
+            "List the R-IDs (e.g. R001, R003) touched by this slice; see the milestone requirements artifact at .gsd/milestones/<id>/REQUIREMENTS.md.",
             "Identify what must be re-tested after shipping.",
             "Flag decisions that should be revisited given the new scope.",
             "If no existing requirements are affected, return verdict 'omitted'.",

package/dist/resources/extensions/gsd/git-constants.js

@@ -1,9 +1,36 @@
 /**
  * Shared git constants used across git-service and native-git-bridge.
  */
+/**
+ * Parent process env vars that, if leaked into a git child process, can
+ * silently redirect every operation to a different repo or index.
+ *
+ * Stripped from GIT_NO_PROMPT_ENV so a GSD invoked from inside a git hook,
+ * a different worktree's terminal, or any context that pre-set these vars
+ * cannot redirect GSD's git operations to the wrong target.
+ * (Issue #4980 NEW-1)
+ */
+const LEAKING_GIT_ENV_VARS = [
+    "GIT_DIR",
+    "GIT_WORK_TREE",
+    "GIT_INDEX_FILE",
+    "GIT_OBJECT_DIRECTORY",
+    "GIT_ALTERNATE_OBJECT_DIRECTORIES",
+    "GIT_COMMON_DIR",
+    "GIT_NAMESPACE",
+];
+function buildSafeParentEnv() {
+    const safe = {};
+    for (const [k, v] of Object.entries(process.env)) {
+        if (!LEAKING_GIT_ENV_VARS.includes(k)) {
+            safe[k] = v;
+        }
+    }
+    return safe;
+}
 /** Env overlay that suppresses interactive git credential prompts and git-svn noise. */
 export const GIT_NO_PROMPT_ENV = {
-    ...process.env,
+    ...buildSafeParentEnv(),
     GIT_TERMINAL_PROMPT: "0",
     GIT_ASKPASS: "",
     GIT_SVN_ID: "",

package/dist/resources/extensions/gsd/git-self-heal.js

@@ -9,12 +9,25 @@
  * what actions were taken. `formatGitError` maps raw git errors to
  * user-friendly messages suggesting `/gsd doctor`.
  */
+import { execFileSync } from "node:child_process";
 import { existsSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
 import { MergeConflictError } from "./git-service.js";
 import { nativeMergeAbort, nativeRebaseAbort, nativeResetHard } from "./native-git-bridge.js";
 // Re-export for consumers
 export { MergeConflictError };
+function hasWorkingTreeChanges(cwd) {
+    try {
+        return execFileSync("git", ["status", "--porcelain"], {
+            cwd,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim().length > 0;
+    }
+    catch {
+        return true;
+    }
+}
 /**
  * Detect and clean up leftover merge/rebase state, then hard-reset.
  *
@@ -60,6 +73,20 @@ export function abortAndReset(cwd) {
             cleaned.push("rebase abort attempted (may have failed)");
         }
     }
+    // Preserve any staged or untracked user work before the hard reset.
+    // Reset --hard discards staged changes (reflog only covers committed
+    // state), so a labeled stash gives the user a recovery handle if their
+    // in-flight inspection work would otherwise be silently lost.
+    // (Issue #4980 HIGH-5)
+    if (hasWorkingTreeChanges(cwd)) {
+        try {
+            execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: pre-self-heal-reset ${new Date().toISOString()}`], { cwd, stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+            cleaned.push("stashed working tree before reset");
+        }
+        catch {
+            /* nothing to stash, or stash refused (e.g. unresolved conflicts) — proceed */
+        }
+    }
     // Always hard-reset to HEAD
     try {
         nativeResetHard(cwd);

package/dist/resources/extensions/gsd/git-service.js

@@ -7,7 +7,7 @@
  * This module centralizes the GitPreferences interface, runtime exclusion
  * paths, commit type inference, and the runGit shell helper.
  */
-import { execFileSync, execSync } from "node:child_process";
+import { execFileSync } from "node:child_process";
 import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
 import { gsdRoot } from "./paths.js";
@@ -84,6 +84,7 @@ export class MergeConflictError extends GSDError {
  */
 export const RUNTIME_EXCLUSION_PATHS = [
     ".gsd/activity/",
+    ".gsd/audit/",
     ".gsd/forensics/",
     ".gsd/runtime/",
     ".gsd/worktrees/",
@@ -242,6 +243,107 @@ export function resolveMilestoneIntegrationBranch(basePath, milestoneId, prefs =
         reason: `Recorded integration branch "${recordedBranch}" for milestone ${milestoneId} no longer exists, and no safe fallback branch could be determined.`,
     };
 }
+// ─── Pre-Merge Command Tokenizer ──────────────────────────────────────────
+/**
+ * Tokenize a user-supplied pre-merge command string into argv form, with
+ * minimal support for double- and single-quoted strings. Designed to be
+ * sufficient for typical commands ("npm test", `npm run lint:ci`,
+ * `pnpm run tsc --noEmit`) without spawning a shell.
+ *
+ * Returns [] when the input is empty or whitespace-only.
+ * Throws when quoting is malformed.
+ *
+ * Used by GitServiceImpl.runPreMergeCheck to eliminate the shell-injection
+ * surface that running an arbitrary user string through a shell would create.
+ * (Issue #4980 HIGH-2)
+ */
+export function tokenizePreMergeCommand(input) {
+    const tokens = [];
+    let current = "";
+    let i = 0;
+    let quote = "";
+    let hasContent = false;
+    while (i < input.length) {
+        const ch = input[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = "";
+            }
+            else if (ch === "\\" && quote === '"' && i + 1 < input.length) {
+                current += input[i + 1];
+                i += 2;
+                continue;
+            }
+            else {
+                current += ch;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            hasContent = true;
+            i++;
+            continue;
+        }
+        if (ch === " " || ch === "\t") {
+            if (hasContent) {
+                tokens.push(current);
+                current = "";
+                hasContent = false;
+            }
+            i++;
+            continue;
+        }
+        if (ch === "\\" && i + 1 < input.length) {
+            current += input[i + 1];
+            i += 2;
+            hasContent = true;
+            continue;
+        }
+        current += ch;
+        hasContent = true;
+        i++;
+    }
+    if (quote) {
+        throw new Error(`Unterminated ${quote === '"' ? "double" : "single"} quote in pre-merge command`);
+    }
+    if (hasContent)
+        tokens.push(current);
+    return tokens;
+}
+function containsUnquotedShellControl(input) {
+    let i = 0;
+    let quote = "";
+    while (i < input.length) {
+        const ch = input[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = "";
+            }
+            else if (ch === "\\" && quote === '"' && i + 1 < input.length) {
+                i += 2;
+                continue;
+            }
+            i++;
+            continue;
+        }
+        if (ch === '"' || ch === "'") {
+            quote = ch;
+            i++;
+            continue;
+        }
+        if (ch === "\\" && i + 1 < input.length) {
+            i += 2;
+            continue;
+        }
+        if (ch === ";" || ch === "&" || ch === "|" || ch === "`" || ch === "$" || ch === "<" || ch === ">") {
+            return true;
+        }
+        i++;
+    }
+    return false;
+}
 // ─── Git Helper ────────────────────────────────────────────────────────────
 /**
  * Strip git-svn noise from error messages.
@@ -600,8 +702,31 @@ export class GitServiceImpl {
                 return { passed: true, skipped: true };
             }
         }
+        // Tokenize and run via execFileSync (no shell). Shell metacharacters in
+        // user-supplied prefs.pre_merge_check would otherwise be interpreted as
+        // chaining/redirection (e.g. `;`, `&&`, `|`, backticks) — a privesc
+        // surface in repos with a checked-in `.gsd/PREFERENCES.md`.
+        // (Issue #4980 HIGH-2)
+        if (containsUnquotedShellControl(command)) {
+            return {
+                passed: false,
+                skipped: false,
+                command,
+                error: "pre_merge_check contains shell metacharacters (;, &&, |, $, backticks, redirects). " +
+                    "Put complex commands in a script file (e.g. './scripts/pre-merge.sh') and reference the script path instead.",
+            };
+        }
+        const tokens = tokenizePreMergeCommand(command);
+        if (tokens.length === 0) {
+            return { passed: true, skipped: true };
+        }
         try {
-            execSync(command, { cwd: this.basePath, stdio: "pipe", encoding: "utf-8" });
+            execFileSync(tokens[0], tokens.slice(1), {
+                cwd: this.basePath,
+                stdio: "pipe",
+                encoding: "utf-8",
+                env: GIT_NO_PROMPT_ENV,
+            });
             return { passed: true, skipped: false, command };
         }
         catch (err) {

package/dist/resources/extensions/gsd/gitignore.js

@@ -24,6 +24,7 @@ import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
  */
 const GSD_RUNTIME_PATTERNS = [
     ".gsd/activity/",
+    ".gsd/audit/",
     ".gsd/forensics/",
     ".gsd/runtime/",
     ".gsd/worktrees/",

package/dist/resources/extensions/gsd/gsd-db.js

@@ -135,7 +135,7 @@ function openRawDb(path) {
     const Database = providerModule;
     return new Database(path);
 }
-const SCHEMA_VERSION = 22;
+export const SCHEMA_VERSION = 22;
 function indexExists(db, name) {
     return !!db.prepare("SELECT 1 as present FROM sqlite_master WHERE type = 'index' AND name = ?").get(name);
 }
@@ -2556,6 +2556,9 @@ export function insertReplanHistory(entry) {
 export function insertAssessment(entry) {
     if (!currentDb)
         throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
+    // Idempotent: PRIMARY KEY is `path`, which is deterministic given (milestone_id, scope) per
+    // the artifact-path resolver. Retrying the same reassess-roadmap silently overwrites the row
+    // instead of accumulating duplicates.
     currentDb.prepare(`INSERT OR REPLACE INTO assessments (path, milestone_id, slice_id, task_id, status, scope, full_content, created_at)
      VALUES (:path, :milestone_id, :slice_id, :task_id, :status, :scope, :full_content, :created_at)`).run({
         ":path": entry.path,
@@ -2655,7 +2658,7 @@ function rowToGate(row) {
         scope: row["scope"],
         task_id: row["task_id"] ?? "",
         status: row["status"],
-        verdict: row["verdict"] || "",
+        verdict: row["status"] === "pending" ? null : row["verdict"],
         rationale: row["rationale"] || "",
         findings: row["findings"] || "",
         evaluated_at: row["evaluated_at"] ?? null,
@@ -2739,7 +2742,7 @@ export function getGateResults(milestoneId, sliceId, scope) {
 export function markAllGatesOmitted(milestoneId, sliceId) {
     if (!currentDb)
         return;
-    currentDb.prepare(`UPDATE quality_gates SET status = 'omitted', verdict = 'omitted', evaluated_at = :now
+    currentDb.prepare(`UPDATE quality_gates SET status = 'complete', verdict = 'omitted', evaluated_at = :now
      WHERE milestone_id = :mid AND slice_id = :sid AND status = 'pending'`).run({
         ":mid": milestoneId,
         ":sid": sliceId,

package/dist/resources/extensions/gsd/guided-flow-queue.js

@@ -13,6 +13,7 @@ import { deriveState } from "./state.js";
 import { invalidateAllCaches } from "./cache.js";
 import { gsdRoot, resolveMilestoneFile, resolveGsdRootFile, relGsdRootFile, } from "./paths.js";
 import { readFileSync, writeFileSync, existsSync } from "node:fs";
+import { atomicWriteSync } from "./atomic-write.js";
 import { nativeAddPaths, nativeCommit } from "./native-git-bridge.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { saveQueueOrder } from "./queue-order.js";
@@ -361,5 +362,7 @@ function syncProjectMdSequence(basePath, registry, newOrder) {
     const separatorLine = lines[tableStart + 1];
     const newTable = [headerLine, separatorLine, ...newRows];
     lines.splice(tableStart, tableEnd - tableStart, ...newTable);
-    writeFileSync(projectPath, lines.join("\n"), "utf-8");
+    // Atomic write: tmp+rename avoids a torn PROJECT.md appearing dirty in
+    // another worktree's working tree during a concurrent /gsd auto merge.
+    atomicWriteSync(projectPath, lines.join("\n"), "utf-8");
 }