gsd-pi 2.78.1-dev.e9d88a536 → 2.78.1-dev.eccf86e27

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -9,7 +9,6 @@ import { existsSync, cpSync, readFileSync, readdirSync, mkdirSync, realpathSync,
 import { isAbsolute, join, sep as pathSep } from "node:path";
 import { GSDError, GSD_IO_ERROR, GSD_GIT_ERROR } from "./errors.js";
 import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, closeDatabase, openDatabase, getDbPath, } from "./gsd-db.js";
-import { atomicWriteSync } from "./atomic-write.js";
 import { execFileSync } from "node:child_process";
 import { safeCopy, safeCopyRecursive } from "./safe-fs.js";
 import { gsdRoot, resolveGsdPathContract } from "./paths.js";
@@ -23,6 +22,7 @@ import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
 import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeConflictFiles, nativeCheckoutTheirs, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, } from "./native-git-bridge.js";
 import { gsdHome } from "./gsd-home.js";
+import { createWorkspace } from "./workspace.js";
 const PROJECT_PREFERENCES_FILE = "PREFERENCES.md";
 const LEGACY_PROJECT_PREFERENCES_FILE = "preferences.md";
 const LEGACY_DEEP_SETUP_RUNTIME_UNIT_FILES = new Set([
@@ -195,13 +195,22 @@ function forceOverwriteAssessmentsWithVerdict(srcMilestoneDir, dstMilestoneDir)
     }
 }
 // ─── Module State ──────────────────────────────────────────────────────────
-/** Original project root before chdir into auto-worktree. */
-let originalBase = null;
+/** Active workspace registry — replaces the legacy `originalBase` singleton. */
+let activeWorkspace = null;
+function setActiveWorkspace(ws) {
+    activeWorkspace = ws;
+}
+function getActiveWorkspace() {
+    return activeWorkspace;
+}
 function clearProjectRootStateFiles(basePath, milestoneId) {
     const gsdDir = gsdRoot(basePath);
+    // Phase C pt 2: auto.lock removed from this list — the file is gone
+    // (migrated to the workers + unit_dispatches + runtime_kv tables). The
+    // remaining transient files (STATE.md, {MID}-META.json) are still
+    // worth removing on teardown.
     const transientFiles = [
         join(gsdDir, "STATE.md"),
-        join(gsdDir, "auto.lock"),
         join(gsdDir, "milestones", milestoneId, `${milestoneId}-META.json`),
     ];
     for (const file of transientFiles) {
@@ -275,6 +284,33 @@ export const isSafeToAutoResolve = (filePath) => filePath.startsWith(".gsd/") ||
  * gsd.db in the worktree so it rebuilds from fresh disk state (#853).
  * Non-fatal — sync failure should never block dispatch.
  */
+/**
+ * Scope-typed variant of syncProjectRootToWorktree.
+ *
+ * Takes an explicit (rootScope, worktreeScope) pair where rootScope is the
+ * project root and worktreeScope is the auto-worktree. Direction is encoded
+ * in argument order. Asserts both scopes belong to the same workspace identity
+ * to prevent silent mismatch bugs.
+ */
+export function syncProjectRootToWorktreeByScope(rootScope, worktreeScope) {
+    if (rootScope.workspace.identityKey !== worktreeScope.workspace.identityKey) {
+        throw new Error(`syncProjectRootToWorktreeByScope: scope identity mismatch — ` +
+            `rootScope.identityKey="${rootScope.workspace.identityKey}" ` +
+            `worktreeScope.identityKey="${worktreeScope.workspace.identityKey}"`);
+    }
+    if (rootScope.milestoneId !== worktreeScope.milestoneId) {
+        throw new Error(`syncProjectRootToWorktreeByScope: milestoneId mismatch — ` +
+            `rootScope.milestoneId="${rootScope.milestoneId}" worktreeScope.milestoneId="${worktreeScope.milestoneId}"`);
+    }
+    const projectRoot = rootScope.workspace.projectRoot;
+    const worktreePath_ = worktreeScope.workspace.worktreeRoot ?? worktreeScope.workspace.projectRoot;
+    const milestoneId = rootScope.milestoneId;
+    syncProjectRootToWorktree(projectRoot, worktreePath_, milestoneId);
+}
+/**
+ * @deprecated Use syncProjectRootToWorktreeByScope instead.
+ * TODO(C-future): remove once all callers migrated.
+ */
 export function syncProjectRootToWorktree(projectRoot, worktreePath_, milestoneId) {
     if (!worktreePath_ || !projectRoot || worktreePath_ === projectRoot)
         return;
@@ -343,12 +379,36 @@ export function syncProjectRootToWorktree(projectRoot, worktreePath_, milestoneI
         logWarning("worktree", `worktree DB cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 }
+/**
+ * Scope-typed variant of syncStateToProjectRoot.
+ *
+ * Takes an explicit (worktreeScope, rootScope) pair. Direction is encoded in
+ * argument order (worktree → root). Asserts both scopes belong to the same
+ * workspace identity to prevent silent mismatch bugs.
+ */
+export function syncStateToProjectRootByScope(worktreeScope, rootScope) {
+    if (worktreeScope.workspace.identityKey !== rootScope.workspace.identityKey) {
+        throw new Error(`syncStateToProjectRootByScope: scope identity mismatch — ` +
+            `worktreeScope.identityKey="${worktreeScope.workspace.identityKey}" ` +
+            `rootScope.identityKey="${rootScope.workspace.identityKey}"`);
+    }
+    if (worktreeScope.milestoneId !== rootScope.milestoneId) {
+        throw new Error(`syncStateToProjectRootByScope: milestoneId mismatch — ` +
+            `worktreeScope.milestoneId="${worktreeScope.milestoneId}" rootScope.milestoneId="${rootScope.milestoneId}"`);
+    }
+    const worktreePath_ = worktreeScope.workspace.worktreeRoot ?? worktreeScope.workspace.projectRoot;
+    const projectRoot = rootScope.workspace.projectRoot;
+    const milestoneId = worktreeScope.milestoneId;
+    syncStateToProjectRoot(worktreePath_, projectRoot, milestoneId);
+}
 /**
  * Sync worktree diagnostics from worktree to project root.
  * Only runs when inside an auto-worktree (worktreePath differs from projectRoot).
  * DB/project-root state remains authoritative; markdown projections are not
  * copied from the worktree back to the project root.
  * Non-fatal — sync failure should never block dispatch.
+ * @deprecated Use syncStateToProjectRootByScope instead.
+ * TODO(C-future): remove once all callers migrated.
  */
 export function syncStateToProjectRoot(worktreePath_, projectRoot, milestoneId) {
     if (!worktreePath_ || !projectRoot || worktreePath_ === projectRoot)
@@ -520,6 +580,24 @@ export function cleanStaleRuntimeUnits(gsdRootPath, hasMilestoneSummary) {
     return cleaned;
 }
 // ─── Worktree ↔ Main Repo Sync (#1311) ──────────────────────────────────────
+/**
+ * Scope-typed variant of syncGsdStateToWorktree.
+ *
+ * Takes an explicit (rootScope, worktreeScope) pair. Note: milestoneId is not
+ * used by syncGsdStateToWorktree — this variant only requires workspace
+ * identity. Asserts both scopes belong to the same workspace identity to
+ * prevent silent mismatch bugs.
+ */
+export function syncGsdStateToWorktreeByScope(rootScope, worktreeScope) {
+    if (rootScope.workspace.identityKey !== worktreeScope.workspace.identityKey) {
+        throw new Error(`syncGsdStateToWorktreeByScope: scope identity mismatch — ` +
+            `rootScope.identityKey="${rootScope.workspace.identityKey}" ` +
+            `worktreeScope.identityKey="${worktreeScope.workspace.identityKey}"`);
+    }
+    const mainBasePath = rootScope.workspace.projectRoot;
+    const worktreePath_ = worktreeScope.workspace.worktreeRoot ?? worktreeScope.workspace.projectRoot;
+    return syncGsdStateToWorktree(mainBasePath, worktreePath_);
+}
 /**
  * Sync .gsd/ state from the main repo into the worktree.
  *
@@ -534,6 +612,8 @@ export function cleanStaleRuntimeUnits(gsdRootPath, hasMilestoneSummary) {
  * Only adds missing content — never overwrites existing files in the worktree.
  * Worktree files are compatibility projections; DB/project root remains
  * authoritative for runtime state.
+ * @deprecated Use syncGsdStateToWorktreeByScope instead.
+ * TODO(C-future): remove once all callers migrated.
  */
 export function syncGsdStateToWorktree(mainBasePath, worktreePath_) {
     const contract = resolveGsdPathContract(worktreePath_, mainBasePath);
@@ -890,94 +970,13 @@ export function enterBranchModeForMilestone(basePath, milestoneId) {
  * Forward-merge plan checkbox state from the project root into a freshly
  * re-attached worktree (#778).
  *
- * When auto-mode stops via crash (not graceful stop), the milestone branch
- * HEAD may be behind the filesystem state at the project root because
- * syncStateToProjectRoot() runs after every task completion but the final
- * git commit may not have happened before the crash. On restart the worktree
- * is re-attached to the branch HEAD, which has [ ] for the crashed task,
- * causing verifyExpectedArtifact() to fail and triggering an infinite
- * dispatch/skip loop.
- *
- * Fix: after re-attaching, read every *.md plan file in the milestone
- * directory at the project root and apply any [x] checkbox states that are
- * ahead of the worktree version (forward-only: never downgrade [x] → [ ]).
- *
- * This is forward-only compatibility for legacy projection copies. The DB
- * remains authoritative; this never downgrades checked boxes in a local
- * worktree projection.
+ * Phase C: deleted. Writers in workflow-projections.ts, triage-resolution.ts,
+ * rule-registry.ts, and auto-post-unit.ts now route through
+ * s.canonicalProjectRoot, so non-symlinked worktrees no longer need a local
+ * .gsd/ projection — the project-root .gsd/ is the only authoritative source
+ * for both reads and writes. copyPlanningArtifacts and reconcilePlanCheckboxes
+ * (both formerly here) became dead.
  */
-function reconcilePlanCheckboxes(projectRoot, wtPath, milestoneId) {
-    const srcMilestone = join(projectRoot, ".gsd", "milestones", milestoneId);
-    const dstMilestone = join(wtPath, ".gsd", "milestones", milestoneId);
-    if (!existsSync(srcMilestone) || !existsSync(dstMilestone))
-        return;
-    // Walk all markdown files in the milestone directory (plans, summaries, etc.)
-    function walkMd(dir) {
-        const results = [];
-        try {
-            for (const entry of readdirSync(dir, { withFileTypes: true })) {
-                const full = join(dir, entry.name);
-                if (entry.isDirectory()) {
-                    results.push(...walkMd(full));
-                }
-                else if (entry.isFile() && entry.name.endsWith(".md")) {
-                    results.push(full);
-                }
-            }
-        }
-        catch (err) {
-            /* non-fatal */
-            logWarning("worktree", `walkMd directory read failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-        return results;
-    }
-    for (const srcFile of walkMd(srcMilestone)) {
-        const rel = srcFile.slice(srcMilestone.length);
-        const dstFile = dstMilestone + rel;
-        if (!existsSync(dstFile))
-            continue; // only reconcile existing files
-        let srcContent;
-        let dstContent;
-        try {
-            srcContent = readFileSync(srcFile, "utf-8");
-            dstContent = readFileSync(dstFile, "utf-8");
-        }
-        catch (e) {
-            logWarning("worktree", `reconcilePlanCheckboxes read failed: ${e.message}`);
-            continue;
-        }
-        if (srcContent === dstContent)
-            continue;
-        // Extract all checked task IDs from the source (project root)
-        // Pattern: - [x] **T<id>: or - [x] **S<id>: (case-insensitive x)
-        const checkedRe = /^- \[[xX]\] \*\*([TS]\d+):/gm;
-        const srcChecked = new Set();
-        for (const m of srcContent.matchAll(checkedRe))
-            srcChecked.add(m[1]);
-        if (srcChecked.size === 0)
-            continue;
-        // Forward-apply: replace [ ] → [x] for any IDs that are checked in src
-        let updated = dstContent;
-        let changed = false;
-        for (const id of srcChecked) {
-            const escapedId = id.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-            const uncheckedRe = new RegExp(`^(- )\\[ \\]( \\*\\*${escapedId}:)`, "gm");
-            if (uncheckedRe.test(updated)) {
-                updated = updated.replace(new RegExp(`^(- )\\[ \\]( \\*\\*${escapedId}:)`, "gm"), "$1[x]$2");
-                changed = true;
-            }
-        }
-        if (changed) {
-            try {
-                atomicWriteSync(dstFile, updated, "utf-8");
-            }
-            catch (err) {
-                /* non-fatal */
-                logWarning("worktree", `plan checkbox reconcile write failed: ${err instanceof Error ? err.message : String(err)}`);
-            }
-        }
-    }
-}
 export function createAutoWorktree(basePath, milestoneId) {
     basePath = resolveWorktreeProjectRoot(basePath);
     // Check if repo has commits — git worktree requires a valid HEAD
@@ -1023,33 +1022,15 @@ export function createAutoWorktree(basePath, milestoneId) {
             startPoint,
         });
     }
-    // Copy .gsd/ planning artifacts from the source repo into the new worktree.
-    // Worktrees are fresh git checkouts — untracked files don't carry over.
-    // Planning artifacts may be untracked if the project's .gitignore had a
-    // blanket .gsd/ rule (pre-v2.14.0). Without this copy, auto-mode loops
-    // on plan-slice because the plan file doesn't exist in the worktree.
-    //
-    // IMPORTANT: Skip when re-attaching to an existing branch (#759).
-    // The branch checkout already has committed artifacts with correct state
-    // (e.g. [x] for completed slices). Copying from the project root would
-    // overwrite them with stale data ([ ] checkboxes) because the root is
-    // not always fully synced.
-    if (!branchExists) {
-        copyPlanningArtifacts(basePath, info.path);
-    }
-    else {
-        // Re-attaching to an existing branch: forward-merge any plan checkpoint
-        // state from the project root into the worktree (#778).
-        //
-        // If auto-mode stopped via crash, the milestone branch HEAD may lag behind
-        // the project root filesystem because syncStateToProjectRoot() ran after
-        // task completion but the auto-commit never fired. On restart the worktree
-        // is re-created from the branch HEAD (which has [ ] for the crashed task),
-        // causing verifyExpectedArtifact() to return false → stale-key eviction →
-        // infinite dispatch/skip loop. Reconciling here ensures the worktree sees
-        // the same [x] state that syncStateToProjectRoot() wrote to the root.
-        reconcilePlanCheckboxes(basePath, info.path, milestoneId);
-    }
+    // Phase C: copyPlanningArtifacts and reconcilePlanCheckboxes were
+    // deleted. Both addressed the same problem (worktree-local .gsd/
+    // projection lagging behind project-root state) by maintaining a stale
+    // copy. Now that auto-mode writers in workflow-projections.ts,
+    // triage-resolution.ts, rule-registry.ts, and auto-post-unit.ts route
+    // through s.canonicalProjectRoot, the worktree never needs a local
+    // .gsd/ — both reads and writes converge on the project-root .gsd/.
+    // The original concerns (#759, #778) no longer apply because there is
+    // no second copy to drift.
     // Run user-configured post-create hook (#597) — e.g. copy .env, symlink assets
     const hookError = runWorktreePostCreateHook(basePath, info.path);
     if (hookError) {
@@ -1059,61 +1040,23 @@ export function createAutoWorktree(basePath, milestoneId) {
     const previousCwd = process.cwd();
     try {
         process.chdir(info.path);
-        originalBase = basePath;
+        setActiveWorkspace(createWorkspace(basePath));
     }
     catch (err) {
         // If chdir fails, the worktree was created but we couldn't enter it.
-        // Don't store originalBase -- caller can retry or clean up.
+        // Don't set activeWorkspace -- caller can retry or clean up.
         throw new GSDError(GSD_IO_ERROR, `Auto-worktree created at ${info.path} but chdir failed: ${err instanceof Error ? err.message : String(err)}`);
     }
     nudgeGitBranchCache(previousCwd);
     return info.path;
 }
-/**
- * Copy .gsd/ planning artifacts from source repo to a new worktree.
- * Copies milestones/, DECISIONS.md, REQUIREMENTS.md, PROJECT.md, QUEUE.md,
- * STATE.md, KNOWLEDGE.md, and OVERRIDES.md.
- * Skips runtime files (auto.lock, metrics.json, etc.) and the worktrees/ dir.
- * Best-effort — failures are non-fatal since auto-mode can recreate artifacts.
- */
-function copyPlanningArtifacts(srcBase, wtPath) {
-    const srcGsd = join(srcBase, ".gsd");
-    const dstGsd = join(wtPath, ".gsd");
-    if (!existsSync(srcGsd))
-        return;
-    if (isSamePath(srcGsd, dstGsd))
-        return;
-    // Copy milestones/ directory (planning files, roadmaps, plans, research)
-    safeCopyRecursive(join(srcGsd, "milestones"), join(dstGsd, "milestones"), {
-        force: true,
-        filter: (src) => !src.endsWith("-META.json"),
-    });
-    // Copy top-level planning files
-    for (const file of [
-        "DECISIONS.md",
-        "REQUIREMENTS.md",
-        "PROJECT.md",
-        "QUEUE.md",
-        "STATE.md",
-        "KNOWLEDGE.md",
-        "OVERRIDES.md",
-        "mcp.json",
-    ]) {
-        safeCopy(join(srcGsd, file), join(dstGsd, file), { force: true });
-    }
-    // Seed canonical PREFERENCES.md when available; fall back to legacy lowercase.
-    if (existsSync(join(srcGsd, PROJECT_PREFERENCES_FILE))) {
-        safeCopy(join(srcGsd, PROJECT_PREFERENCES_FILE), join(dstGsd, PROJECT_PREFERENCES_FILE), { force: true });
-    }
-    else if (existsSync(join(srcGsd, LEGACY_PROJECT_PREFERENCES_FILE))) {
-        safeCopy(join(srcGsd, LEGACY_PROJECT_PREFERENCES_FILE), join(dstGsd, LEGACY_PROJECT_PREFERENCES_FILE), { force: true });
-    }
-    // Shared WAL (R012): worktrees use the project root's DB directly.
-    // No longer copy gsd.db into the worktree — the DB path resolver in
-    // ensureDbOpen() detects the worktree location and opens the root DB.
-    // Compat note: reconcileWorktreeDb() in mergeMilestoneToMain handles
-    // worktrees that already have a local gsd.db from before this change.
-}
+// Phase C: copyPlanningArtifacts removed. Planning artifacts now live
+// only at the project root .gsd/; auto-mode writers (workflow-projections,
+// triage-resolution, rule-registry, regenerateIfMissing,
+// resolveHookArtifactPath) all route through s.canonicalProjectRoot.
+// Worktrees are pure git checkouts — they no longer maintain a parallel
+// .gsd/ projection. The gsd.db has always lived at the project root via
+// the shared-WAL R012 contract; that is unchanged.
 /**
  * Teardown an auto-worktree: chdir back to original base, then remove
  * the worktree and its branch.
@@ -1123,41 +1066,79 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
     const branch = autoWorktreeBranch(milestoneId);
     const { preserveBranch = false } = opts;
     const previousCwd = process.cwd();
+    // Wrap the entire teardown body in a single try/finally so activeWorkspace
+    // is ALWAYS cleared — even if process.chdir throws (e.g. originalBasePath
+    // was deleted before teardown ran). Previously the finally only covered
+    // removeWorktree, leaving the registry stale on a chdir failure (H3 fix).
     try {
-        process.chdir(originalBasePath);
-        originalBase = null;
-    }
-    catch (err) {
-        throw new GSDError(GSD_IO_ERROR, `Failed to chdir back to ${originalBasePath} during teardown: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    nudgeGitBranchCache(previousCwd);
-    removeWorktree(originalBasePath, milestoneId, {
-        branch,
-        deleteBranch: !preserveBranch,
-    });
-    // Verify cleanup succeeded — warn if the worktree directory is still on disk.
-    // On Windows, bash-based cleanup can silently fail when paths contain
-    // backslashes (#1436), leaving ~1 GB+ orphaned directories.
-    const wtDir = worktreePath(originalBasePath, milestoneId);
-    if (existsSync(wtDir)) {
-        logWarning("reconcile", `Worktree directory still exists after teardown: ${wtDir}. ` +
-            `This is likely an orphaned directory consuming disk space. ` +
-            `Remove it manually with: rm -rf "${wtDir.replaceAll("\\", "/")}"`, { worktree: milestoneId });
-        // Attempt a direct filesystem removal as a fallback — but ONLY if the
-        // path is safely inside .gsd/worktrees/ to prevent #2365 data loss.
-        if (isInsideWorktreesDir(originalBasePath, wtDir)) {
+        try {
+            process.chdir(originalBasePath);
+        }
+        catch (err) {
+            throw new GSDError(GSD_IO_ERROR, `Failed to chdir back to ${originalBasePath} during teardown: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        // Mirror cleanup steps from mergeMilestoneToMain abort path:
+        // 1. Remove transient state files (STATE.md, auto.lock, {MID}-META.json).
+        //    Non-fatal — must not block teardown.
+        try {
+            clearProjectRootStateFiles(originalBasePath, milestoneId);
+        }
+        catch (err) {
+            logWarning("worktree", `clearProjectRootStateFiles failed during teardown: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        // 2. Reconcile worktree-local gsd.db into project root DB if both exist.
+        //    Non-fatal — handles legacy worktrees that have a local copy.
+        if (isDbAvailable()) {
             try {
-                rmSync(wtDir, { recursive: true, force: true });
+                const contract = resolveGsdPathContract(previousCwd, originalBasePath);
+                const worktreeDbPath = join(contract.worktreeGsd ?? join(previousCwd, ".gsd"), "gsd.db");
+                const mainDbPath = contract.projectDb;
+                if (existsSync(worktreeDbPath) && !isSamePath(worktreeDbPath, mainDbPath)) {
+                    reconcileWorktreeDb(mainDbPath, worktreeDbPath);
+                }
             }
             catch (err) {
-                // Non-fatal — the warning above tells the user how to clean up
-                logWarning("worktree", `worktree directory removal failed: ${err instanceof Error ? err.message : String(err)}`);
+                /* non-fatal */
+                logError("worktree", `DB reconciliation failed during teardown: ${err instanceof Error ? err.message : String(err)}`);
             }
         }
-        else {
-            console.error(`[GSD] REFUSING fallback rmSync — path is outside .gsd/worktrees/: ${wtDir}`);
+        nudgeGitBranchCache(previousCwd);
+        // 3. Remove the worktree. Errors propagate naturally — the outer finally
+        //    ensures activeWorkspace is cleared regardless.
+        removeWorktree(originalBasePath, milestoneId, {
+            branch,
+            deleteBranch: !preserveBranch,
+        });
+        // Verify cleanup succeeded — warn if the worktree directory is still on disk.
+        // On Windows, bash-based cleanup can silently fail when paths contain
+        // backslashes (#1436), leaving ~1 GB+ orphaned directories.
+        const wtDir = worktreePath(originalBasePath, milestoneId);
+        if (existsSync(wtDir)) {
+            logWarning("reconcile", `Worktree directory still exists after teardown: ${wtDir}. ` +
+                `This is likely an orphaned directory consuming disk space. ` +
+                `Remove it manually with: rm -rf "${wtDir.replaceAll("\\", "/")}"`, { worktree: milestoneId });
+            // Attempt a direct filesystem removal as a fallback — but ONLY if the
+            // path is safely inside .gsd/worktrees/ to prevent #2365 data loss.
+            if (isInsideWorktreesDir(originalBasePath, wtDir)) {
+                try {
+                    rmSync(wtDir, { recursive: true, force: true });
+                }
+                catch (err) {
+                    // Non-fatal — the warning above tells the user how to clean up
+                    logWarning("worktree", `worktree directory removal failed: ${err instanceof Error ? err.message : String(err)}`);
+                }
+            }
+            else {
+                console.error(`[GSD] REFUSING fallback rmSync — path is outside .gsd/worktrees/: ${wtDir}`);
+            }
         }
     }
+    finally {
+        // Clear module state unconditionally — regardless of which step above
+        // failed. A stale activeWorkspace causes getActiveAutoWorktreeContext()
+        // to return wrong data for subsequent operations.
+        setActiveWorkspace(null);
+    }
 }
 /**
  * Detect if the process is currently inside an auto-worktree.
@@ -1168,8 +1149,9 @@ export function isInAutoWorktree(basePath) {
     const targetPath = isGsdWorktreePath(basePath) ? basePath : process.cwd();
     if (!isGsdWorktreePath(targetPath))
         return false;
-    const projectRoot = resolveWorktreeProjectRoot(basePath, originalBase);
-    const targetProjectRoot = resolveWorktreeProjectRoot(targetPath, originalBase);
+    const storedBase = getAutoWorktreeOriginalBase();
+    const projectRoot = resolveWorktreeProjectRoot(basePath, storedBase);
+    const targetProjectRoot = resolveWorktreeProjectRoot(targetPath, storedBase);
     if (normalizeWorktreePathForCompare(projectRoot) !==
         normalizeWorktreePathForCompare(targetProjectRoot)) {
         return false;
@@ -1242,7 +1224,7 @@ export function enterAutoWorktree(basePath, milestoneId) {
     const previousCwd = process.cwd();
     try {
         process.chdir(p);
-        originalBase = basePath;
+        setActiveWorkspace(createWorkspace(basePath));
     }
     catch (err) {
         throw new GSDError(GSD_IO_ERROR, `Failed to enter auto-worktree at ${p}: ${err instanceof Error ? err.message : String(err)}`);
@@ -1255,14 +1237,16 @@ export function enterAutoWorktree(basePath, milestoneId) {
  * Returns null if not currently in an auto-worktree.
  */
 export function getAutoWorktreeOriginalBase() {
-    return originalBase;
+    return getActiveWorkspace()?.projectRoot ?? null;
 }
 export function _resetAutoWorktreeOriginalBaseForTests() {
-    originalBase = null;
+    setActiveWorkspace(null);
 }
 export function getActiveAutoWorktreeContext() {
-    if (!originalBase)
+    const ws = getActiveWorkspace();
+    if (!ws)
         return null;
+    const originalBase = ws.projectRoot;
     const cwd = process.cwd();
     if (!isGsdWorktreePath(cwd))
         return null;
@@ -1332,11 +1316,11 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     //    integration branch captures dirty files from OTHER milestones under a
     //    misleading commit message, contaminating the main branch (#2929).
     //
-    //    When originalBase is null (branch mode, no worktree), autoCommitDirtyState
+    //    When activeWorkspace is null (branch mode, no worktree), autoCommitDirtyState
     //    runs unconditionally — the caller is responsible for cwd placement.
     {
         let shouldAutoCommit = true;
-        if (originalBase !== null) {
+        if (getActiveWorkspace() !== null) {
             try {
                 const currentBranch = nativeGetCurrentBranch(worktreeCwd);
                 shouldAutoCommit = currentBranch === milestoneBranch;
@@ -2020,7 +2004,7 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         logWarning("worktree", `git branch-delete failed: ${err instanceof Error ? err.message : String(err)}`);
     }
     // 14. Clear module state
-    originalBase = null;
+    setActiveWorkspace(null);
     nudgeGitBranchCache(previousCwd);
     // 15. Anchor cwd at the project root on success-return. Step 12 removed
     // the worktree dir; if cwd was inside it, every subsequent process.cwd()