gsd-pi 2.80.0-dev.2848d9009 → 2.80.0-dev.3065f7bfa

package/src/resources/extensions/gsd/auto-start.ts

@@ -65,6 +65,7 @@ import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
+import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
 
 import {
   debugLog,
@@ -332,6 +333,165 @@ export function auditOrphanedMilestoneBranches(
   return { recovered, warnings };
 }
 
+/**
+ * Pure decision function for picking which orphan milestone the auto-loop
+ * should resume the merge transition for. Extracted so it can be unit-tested
+ * without spinning up a git repo or a SQLite DB.
+ *
+ * Returns the lexicographically-greatest milestone id (e.g. "M002" beats
+ * "M001") whose branch is unmerged AND has commits ahead of main AND whose
+ * status is `complete`. Lex-ordering matches the project's M00x convention,
+ * which is the most-recently-completed milestone in practice.
+ * `isComplete` errors propagate; `commitsAhead` errors are treated as 0.
+ */
+export function _selectResumableMilestone(
+  branchNames: readonly string[],
+  mergedBranches: ReadonlySet<string>,
+  isComplete: (milestoneId: string) => boolean,
+  commitsAhead: (branch: string) => number,
+): string | null {
+  const candidates: string[] = [];
+  for (const branch of branchNames) {
+    if (!branch.startsWith("milestone/")) continue;
+    const milestoneId = branch.slice("milestone/".length);
+    if (mergedBranches.has(branch)) continue;
+    if (!isComplete(milestoneId)) continue;
+    let ahead = 0;
+    try {
+      ahead = commitsAhead(branch);
+    } catch {
+      continue;
+    }
+    if (ahead <= 0) continue;
+    candidates.push(milestoneId);
+  }
+  if (candidates.length === 0) return null;
+  candidates.sort();
+  return candidates[candidates.length - 1];
+}
+
+/**
+ * Find the most-recent completed milestone whose branch still has unmerged
+ * commits ahead of the integration branch. Used by `bootstrapAutoSession`
+ * to seed `s.currentMilestoneId` so the auto-loop's transition guard at
+ * `phases.ts:730` fires on the first iteration after a process restart —
+ * without this, the in-memory-only `s.currentMilestoneId` is `null` after
+ * restart, the guard short-circuits, and the orphaned milestone branch
+ * never gets merged into main (#5538-followup).
+ *
+ * Returns null when isolation is `none`, the DB is unavailable, or no
+ * orphan candidate exists. All git failures degrade silently — startup
+ * must never block on this defensive lookup.
+ */
+export function findUnmergedCompletedMilestone(
+  basePath: string,
+  isolationMode: "worktree" | "branch" | "none",
+): string | null {
+  if (isolationMode === "none") return null;
+  if (!isDbAvailable()) return null;
+
+  let milestoneBranches: string[];
+  try {
+    milestoneBranches = nativeBranchList(basePath, "milestone/*");
+  } catch {
+    return null;
+  }
+  if (milestoneBranches.length === 0) return null;
+
+  let mainBranch: string;
+  try {
+    mainBranch = nativeDetectMainBranch(basePath);
+  } catch {
+    mainBranch = "main";
+  }
+
+  let mergedBranches: Set<string>;
+  try {
+    mergedBranches = new Set(
+      nativeBranchListMerged(basePath, mainBranch, "milestone/*"),
+    );
+  } catch {
+    mergedBranches = new Set();
+  }
+
+  return _selectResumableMilestone(
+    milestoneBranches,
+    mergedBranches,
+    (milestoneId) => {
+      const row = getMilestone(milestoneId);
+      return !!row && row.status === "complete";
+    },
+    (branch) => nativeCommitCountBetween(basePath, mainBranch, branch),
+  );
+}
+
+/**
+ * Run `mergeAndExit` for a milestone whose worktree/branch finalization
+ * never completed in a prior session — the active-milestone in phase
+ * `complete` with a survivor `milestone/<id>` branch still around.
+ *
+ * Wraps the call in try/catch so a thrown error from `_mergeBranchMode`
+ * (made fail-loud in commit 68ef58a3c) is converted into a user-facing
+ * error notify instead of an unhandled exception that propagates through
+ * `bootstrapAutoSession` to the slash-command caller's `.catch` block.
+ *
+ * Returns `{ merged: true }` on success; `{ merged: false, error }` on
+ * throw — caller decides whether to abort bootstrap.
+ */
+export function _finalizeSurvivorBranch(
+  resolver: WorktreeResolver,
+  milestoneId: string,
+  ui: { notify: (msg: string, level?: "info" | "warning" | "error" | "success") => void },
+): { merged: boolean; error?: unknown } {
+  ui.notify(
+    `Milestone ${milestoneId} is complete but branch/worktree was not finalized. Running merge now.`,
+    "info",
+  );
+  try {
+    resolver.mergeAndExit(milestoneId, { notify: ui.notify.bind(ui) });
+    return { merged: true };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    ui.notify(
+      `Survivor-branch finalization for ${milestoneId} failed: ${msg}. Resolve manually and re-run /gsd auto.`,
+      "error",
+    );
+    return { merged: false, error: err };
+  }
+}
+
+/**
+ * Merge a milestone whose DB row is `complete` but whose branch is still
+ * unmerged into the integration branch. Called from `bootstrapAutoSession`
+ * for orphans surfaced by `findUnmergedCompletedMilestone`.
+ *
+ * Notifies the user before and after, swallowing errors so a transient git
+ * failure never blocks bootstrap. Returns `{ merged: true }` when the
+ * underlying `mergeAndExit` completes; `{ merged: false, error }` on throw.
+ *
+ * Extracted to keep `bootstrapAutoSession` testable: the merge call and the
+ * notify shape are exercised against a mock resolver in
+ * `tests/orphan-merge-bootstrap.test.ts`.
+ */
+export function _mergeOrphanCompletedMilestone(
+  resolver: WorktreeResolver,
+  orphanId: string,
+  ui: { notify: (msg: string, level?: "info" | "warning" | "error" | "success") => void },
+): { merged: boolean; error?: unknown } {
+  ui.notify(`Detected unmerged completed milestone ${orphanId}. Merging now.`, "info");
+  try {
+    resolver.mergeAndExit(orphanId, { notify: ui.notify.bind(ui) });
+    return { merged: true };
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    ui.notify(
+      `Could not merge orphan milestone ${orphanId}: ${msg}. Resolve manually and re-run /gsd auto.`,
+      "warning",
+    );
+    return { merged: false, error: err };
+  }
+}
+
 export async function bootstrapAutoSession(
   s: AutoSession,
   ctx: ExtensionCommandContext,
@@ -577,6 +737,39 @@ export async function bootstrapAutoSession(
       logWarning("bootstrap", `orphaned milestone branch audit failed: ${err instanceof Error ? err.message : String(err)}`);
     }
 
+    // ── Orphaned preflight-stash audit (#5538-followup) ──
+    // Reapplies pre-merge stashes whose milestone is now complete but whose
+    // postflight pop was skipped by an interrupted merge in a prior session.
+    // Uses `git stash apply` (not pop) so the entry remains as a backup.
+    try {
+      if (isDbAvailable()) {
+        const stashAudit = auditOrphanedPreflightStashes(base, (milestoneId) => {
+          const row = getMilestone(milestoneId);
+          return !!row && isClosedStatus(row.status);
+        });
+        for (const entry of stashAudit.applied) {
+          ctx.ui.notify(
+            `Orphan audit: applied preflight stash ${entry.stashRef} for completed milestone ${entry.milestoneId}. The stash entry is preserved as a backup.`,
+            "info",
+          );
+        }
+        for (const msg of stashAudit.warnings) {
+          ctx.ui.notify(`Orphan audit: ${msg}`, "warning");
+        }
+        if (stashAudit.applied.length > 0) {
+          debugLog("orphan-stash-audit", {
+            applied: stashAudit.applied,
+            warnings: stashAudit.warnings,
+          });
+        }
+      }
+    } catch (err) {
+      logWarning(
+        "bootstrap",
+        `orphaned preflight-stash audit failed: ${err instanceof Error ? err.message : String(err)}`,
+      );
+    }
+
     let state = await deriveState(base);
 
     // Stale worktree state recovery (#654)
@@ -649,20 +842,48 @@ export async function bootstrapAutoSession(
     // hasSurvivorBranch after a successful promotion.
     if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
       const mid = state.activeMilestone!.id;
-      ctx.ui.notify(
-        `Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`,
-        "info",
-      );
-      const resolver = buildResolver();
-      resolver.mergeAndExit(mid, {
-        notify: ctx.ui.notify.bind(ctx.ui),
-      });
+      // Commit 68ef58a3c made `_mergeBranchMode` throw on wrong-branch
+      // instead of returning false silently. Wrap the call so the throw is
+      // converted into an error notify + clean bootstrap abort, not an
+      // unhandled exception propagating to the slash-command caller (#5549
+      // post-merge audit, R2).
+      const finalize = _finalizeSurvivorBranch(buildResolver(), mid, ctx.ui);
+      if (!finalize.merged) {
+        return releaseLockAndReturn();
+      }
       invalidateAllCaches();
       state = await deriveState(base);
       // Clear survivor flag — finalization is done
       hasSurvivorBranch = false;
     }
 
+    // ── Orphan-completed-milestone merge (#5538-followup) ──
+    // A process killed between `complete-milestone` (DB flip + SUMMARY write)
+    // and the loop's transition-guard merge strands the milestone branch
+    // forever: `s.currentMilestoneId` is in-memory only, so on the next
+    // bootstrap the guard at phases.ts:730 sees `mid === s.currentMilestoneId`
+    // and short-circuits.
+    //
+    // The earlier attempt at this fix seeded `s.currentMilestoneId` to the
+    // orphan id pre-state-derivation, but the unconditional assignment at
+    // line 948 (`s.currentMilestoneId = state.activeMilestone?.id ?? null`)
+    // immediately overwrote the seed. Active-merge is the more durable fix:
+    // call `mergeAndExit` directly during bootstrap, then re-derive state so
+    // the loop's normal flow continues without an in-memory hint.
+    //
+    // Mirrors the survivor-finalize block above. Failures degrade to a
+    // warning notify so a transient git error doesn't block bootstrap.
+    {
+      const orphan = findUnmergedCompletedMilestone(base, getIsolationMode(base));
+      if (orphan && orphan !== state.activeMilestone?.id) {
+        const result = _mergeOrphanCompletedMilestone(buildResolver(), orphan, ctx.ui);
+        if (result.merged) {
+          invalidateAllCaches();
+          state = await deriveState(base);
+        }
+      }
+    }
+
     const effectivePrefs = loadEffectiveGSDPreferences(base)?.preferences;
     const { shouldRunDeepProjectSetup } = await import("./auto-dispatch.js");
     const deepProjectStagePending = shouldRunDeepProjectSetup(
@@ -790,7 +1011,7 @@ export async function bootstrapAutoSession(
     s.resourceVersionOnStart = readResourceVersion();
     s.pendingQuickTasks = [];
     s.currentUnit = null;
-    s.currentMilestoneId = deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
+    s.currentMilestoneId ??= deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
     s.originalModelId = startModelSnapshot?.id ?? ctx.model?.id ?? null;
     s.originalModelProvider = startModelSnapshot?.provider ?? ctx.model?.provider ?? null;
     s.originalThinkingLevel = startThinkingSnapshot ?? null;

package/src/resources/extensions/gsd/auto-supervisor.ts

@@ -32,6 +32,7 @@ let _currentSigtermHandler: (() => void) | null = null;
 export function registerSigtermHandler(
   currentBasePath: string,
   previousHandler: (() => void) | null,
+  onSignalCleanup?: () => void,
 ): () => void {
   // Remove the explicitly-passed previous handler
   if (previousHandler) {
@@ -43,6 +44,12 @@ export function registerSigtermHandler(
     for (const sig of CLEANUP_SIGNALS) process.off(sig, _currentSigtermHandler);
   }
   const handler = () => {
+    try {
+      onSignalCleanup?.();
+    } catch {
+      void 0;
+      // Signal cleanup is best-effort; lock cleanup and process exit still run.
+    }
     clearLock(currentBasePath);
     releaseSessionLock(currentBasePath);
     process.exit(0);

package/src/resources/extensions/gsd/auto-timeout-recovery.ts

@@ -71,14 +71,14 @@ export async function recoverTimedOutUnit(
       recovery: status,
     });
 
-    const durableComplete = status.summaryExists && status.taskChecked && status.nextActionAdvanced;
+    const durableComplete = status.dbComplete || (status.summaryExists && status.taskChecked && status.nextActionAdvanced);
     if (durableComplete) {
       writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
         phase: "finalized",
         recovery: status,
       });
       ctx.ui.notify(
-        `${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`,
+        `${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed. Continuing auto-mode. (attempt ${attemptNumber})`,
         "info",
       );
       unitRecoveryCount.delete(recoveryKey);

package/src/resources/extensions/gsd/auto-worktree.ts

@@ -78,6 +78,7 @@ import {
   nativeUpdateRef,
   nativeIsAncestor,
   nativeMergeAbort,
+  nativeWorktreeList,
 } from "./native-git-bridge.js";
 import { gsdHome } from "./gsd-home.js";
 import { type MilestoneScope, type GsdWorkspace, createWorkspace } from "./workspace.js";
@@ -1180,6 +1181,122 @@ export function enterBranchModeForMilestone(
  * (both formerly here) became dead.
  */
 
+/**
+ * True when `branch` is checked out in any worktree listed by
+ * `git worktree list --porcelain`. Used to gate ref updates that would
+ * otherwise leave a concurrent worktree's HEAD inconsistent with its
+ * index/working tree (Codex peer-review of #5538-followup).
+ *
+ * Best-effort: a `nativeWorktreeList` failure returns true so we err on
+ * the side of NOT moving the ref. Better to skip a fast-forward than to
+ * silently corrupt another worktree.
+ */
+export function _isBranchCheckedOutElsewhere(
+  basePath: string,
+  branch: string,
+): boolean {
+  try {
+    const entries = nativeWorktreeList(basePath);
+    return entries.some((entry) => entry.branch === branch);
+  } catch {
+    return true;
+  }
+}
+
+/**
+ * Resolve the integration branch using the same 3-tier fallback as the
+ * fresh-create path: META.json → git.main_branch preference → detected
+ * main branch. Returns null when no usable target exists.
+ */
+function _resolveIntegrationBranchForReuse(
+  basePath: string,
+  milestoneId: string,
+): string | null {
+  const fromMeta = readIntegrationBranch(basePath, milestoneId);
+  if (fromMeta) return fromMeta;
+
+  const gitPrefs = loadEffectiveGSDPreferences()?.preferences?.git;
+  const fromPref = gitPrefs?.main_branch &&
+    typeof gitPrefs.main_branch === "string" &&
+    gitPrefs.main_branch.length > 0 &&
+    nativeBranchExists(basePath, gitPrefs.main_branch)
+    ? gitPrefs.main_branch
+    : null;
+  if (fromPref) return fromPref;
+
+  try {
+    return nativeDetectMainBranch(basePath);
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * When reusing an existing milestone branch, fast-forward it onto the
+ * integration branch when that's safe (branch is a strict ancestor of
+ * integration — no commits would be lost). Skips when the branch has its
+ * own commits ahead of integration, when the integration branch can't be
+ * resolved, or when any git operation fails — the merge gate at milestone
+ * completion will surface real divergence as a conflict.
+ *
+ * The previous behavior re-attached the worktree to whatever stale tip
+ * the branch held, which caused new milestone work to fork from a base
+ * missing prior milestones' merges (#5538-followup).
+ */
+export function fastForwardReusedMilestoneBranchIfSafe(
+  basePath: string,
+  milestoneId: string,
+  branch: string,
+): void {
+  try {
+    const integrationBranch = _resolveIntegrationBranchForReuse(basePath, milestoneId);
+    if (!integrationBranch || integrationBranch === branch) return;
+    if (!nativeBranchExists(basePath, integrationBranch)) return;
+
+    // Pure fast-forward only: branch must be a strict ancestor of integration.
+    // If the branch has its own commits ahead, leave it alone.
+    if (!nativeIsAncestor(basePath, branch, integrationBranch)) {
+      debugLog("createAutoWorktree", {
+        phase: "skip-ff-branch-not-ancestor",
+        milestoneId,
+        branch,
+        integration: integrationBranch,
+      });
+      return;
+    }
+
+    // Codex peer-review: `nativeUpdateRef` succeeds even when the branch is
+    // currently checked out in another worktree, leaving that worktree's HEAD
+    // inconsistent with its index/work tree. Skip the fast-forward if any
+    // listed worktree has this branch checked out — the merge gate at
+    // milestone-completion will surface stale-base divergence as a conflict
+    // instead of silently corrupting the other worktree's state.
+    if (_isBranchCheckedOutElsewhere(basePath, branch)) {
+      debugLog("createAutoWorktree", {
+        phase: "skip-ff-branch-checked-out-elsewhere",
+        milestoneId,
+        branch,
+      });
+      return;
+    }
+
+    nativeUpdateRef(basePath, `refs/heads/${branch}`, integrationBranch);
+    debugLog("createAutoWorktree", {
+      phase: "fast-forward-reused-branch",
+      milestoneId,
+      branch,
+      integration: integrationBranch,
+    });
+  } catch (err) {
+    debugLog("createAutoWorktree", {
+      phase: "fast-forward-reused-branch-failed",
+      milestoneId,
+      branch,
+      error: err instanceof Error ? err.message : String(err),
+    });
+  }
+}
+
 export function createAutoWorktree(
   basePath: string,
   milestoneId: string,
@@ -1206,6 +1323,12 @@ export function createAutoWorktree(
 
   let info: { name: string; path: string; branch: string; exists: boolean };
   if (branchExists) {
+    // #5538-followup: fast-forward the reused branch onto the integration
+    // branch when safe so the next milestone forks from up-to-date code.
+    // Without this, a milestone that was created before another milestone
+    // merged into main would carry a stale base into its worktree.
+    fastForwardReusedMilestoneBranchIfSafe(basePath, milestoneId, branch);
+
     // Re-attach worktree to the existing milestone branch (preserving commits)
     info = createWorktree(basePath, milestoneId, {
       branch,

package/src/resources/extensions/gsd/auto.ts

@@ -59,6 +59,7 @@ import {
   isLockProcessAlive,
   formatCrashInfo,
   emitCrashRecoveredUnitEnd,
+  emitOpenUnitEndForUnit,
 } from "./crash-recovery.js";
 import {
   acquireSessionLock,
@@ -150,6 +151,7 @@ import {
   resolveProjectRoot,
 } from "./worktree.js";
 import { GitServiceImpl } from "./git-service.js";
+import { nativeCheckoutBranch } from "./native-git-bridge.js";
 import { getPriorSliceCompletionBlocker } from "./dispatch-guard.js";
 import {
   createAutoWorktree,
@@ -200,6 +202,8 @@ import {
   detectWorkingTreeActivity,
 } from "./auto-supervisor.js";
 import { isDbAvailable, getMilestone } from "./gsd-db.js";
+import { markLatestActiveForWorkerCanceled } from "./db/unit-dispatches.js";
+import { writeUnitRuntimeRecord } from "./unit-runtime.js";
 import { countPendingCaptures } from "./captures.js";
 import { CMUX_CHANNELS, type CmuxLogLevel } from "../shared/cmux-events.js";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
@@ -242,6 +246,20 @@ import {
   type WorktreeResolverDeps,
 } from "./worktree-resolver.js";
 import { reorderForCaching } from "./prompt-ordering.js";
+import { initTokenCounter } from "./token-counter.js";
+
+// Warm the tiktoken encoder at extension startup so context-budget computations
+// can use accurate token counts via countTokensSync without paying the load
+// cost mid-prompt-build. Fire-and-forget — failure falls back to the
+// provider-aware char-ratio estimator already used by getCharsPerToken().
+// Catch rejections explicitly: an unhandled rejection at module-import time
+// can destabilize startup before the engine logger is configured.
+void initTokenCounter().catch((err) => {
+  logWarning(
+    "engine",
+    `token counter warm-up failed: ${err instanceof Error ? err.message : String(err)}`,
+  );
+});
 
 // ─── Session State ─────────────────────────────────────────────────────────
 
@@ -293,11 +311,15 @@ const STATE_REBUILD_MIN_INTERVAL_MS = 30_000;
  * the DB is unavailable (e.g. fresh project before init) we skip registration
  * silently rather than blocking session start.
  */
-function registerAutoWorkerForSession(session: AutoSession): void {
+function registerAutoWorkerForSession(
+  session: AutoSession,
+  projectRootOverride?: string,
+): void {
   if (session.workerId) return; // already registered (e.g. resume re-runs)
   try {
     const projectRootRealpath = normalizeRealPath(
-      session.scope?.workspace.projectRoot
+      projectRootOverride
+        ?? session.scope?.workspace.projectRoot
         ?? (session.originalBasePath || session.basePath),
     );
     session.workerId = registerAutoWorker({ projectRootRealpath });
@@ -501,9 +523,54 @@ export {
   getBudgetEnforcementAction,
 } from "./auto-budget.js";
 
+function closeOutSignalInterruptedUnit(currentBasePath: string): void {
+  const currentUnit = s.currentUnit;
+  if (!currentUnit) return;
+
+  const reason = "Auto-mode process received a termination signal";
+  const errorContext: ErrorContext = {
+    message: reason,
+    category: "aborted",
+    isTransient: false,
+  };
+  const basePath = s.basePath || currentBasePath;
+
+  try {
+    emitOpenUnitEndForUnit(basePath, currentUnit.type, currentUnit.id, "cancelled", errorContext);
+  } catch (err) {
+    logWarning("engine", `signal unit-end cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+  }
+
+  try {
+    writeUnitRuntimeRecord(basePath, currentUnit.type, currentUnit.id, currentUnit.startedAt, {
+      phase: "crashed",
+      lastProgressAt: Date.now(),
+      lastProgressKind: "signal",
+    });
+  } catch (err) {
+    logWarning("engine", `signal runtime cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+  }
+
+  try {
+    if (s.workerId) markLatestActiveForWorkerCanceled(s.workerId, "signal-exit");
+  } catch (err) {
+    logWarning("engine", `signal dispatch cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+  }
+
+  try {
+    resolveAgentEndCancelled(errorContext);
+  } catch (err) {
+    logWarning("engine", `signal resolve cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+  }
+}
+
 /** Wrapper: register SIGTERM handler and store reference. */
 function registerSigtermHandler(currentBasePath: string): void {
-  s.sigtermHandler = _registerSigtermHandler(currentBasePath, s.sigtermHandler);
+  s.sigtermHandler = _registerSigtermHandler(
+    currentBasePath,
+    s.sigtermHandler,
+    () => closeOutSignalInterruptedUnit(currentBasePath),
+  );
 }
 
 /** Wrapper: deregister SIGTERM handler and clear reference. */
@@ -968,6 +1035,8 @@ export async function stopAuto(
       if (s.workerId) {
         markWorkerStopping(s.workerId);
       }
+      s.workerId = null;
+      s.milestoneLeaseToken = null;
     } catch (e) {
       debugLog("stop-cleanup-coordination", { error: e instanceof Error ? e.message : String(e) });
     }
@@ -1105,6 +1174,21 @@ export async function stopAuto(
       debugLog("stop-cleanup-basepath", { error: e instanceof Error ? e.message : String(e) });
     }
 
+    // Re-root the active command session/tool runtime after worktree teardown.
+    // mergeAndExit restores process.cwd(), but AgentSession has already captured
+    // its own cwd for tools and system prompt; refresh it before returning to the
+    // user so follow-up commands do not target a removed milestone worktree.
+    if (s.originalBasePath && ctx && s.cmdCtx) {
+      try {
+        const result = await s.cmdCtx.newSession({ workspaceRoot: s.basePath });
+        if (result.cancelled) {
+          logWarning("engine", "post-stop session re-root was cancelled", { file: "auto.ts", basePath: s.basePath });
+        }
+      } catch (err) {
+        logWarning("engine", `post-stop session re-root failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts", basePath: s.basePath });
+      }
+    }
+
     // ── Step 8: Ledger notification ──
     try {
       const ledger = getLedger();
@@ -1368,6 +1452,7 @@ function buildResolverDeps(): WorktreeResolverDeps {
     getAutoWorktreePath,
     autoCommitCurrentBranch,
     getCurrentBranch,
+    checkoutBranch: nativeCheckoutBranch,
     autoWorktreeBranch,
     resolveMilestoneFile,
     readFileSync: (path: string, encoding: string) =>
@@ -1971,6 +2056,10 @@ export async function startAuto(
       : new URL("../../../resource-loader.js", import.meta.url).href;
     const { initResources } = await import(resourceLoaderPath);
     initResources(agentDir);
+    // initResources() uses synchronous fs APIs, so the prompt-template cache
+    // can be primed immediately — no need for the legacy 1s setTimeout deferral.
+    const { primeCache } = await import("./prompt-loader.js");
+    primeCache();
     // Open the project DB before rebuild/derive so resume uses DB-backed
     // state instead of falling back to stale markdown parsing (#2940).
     await openProjectDbIfPresent(s.basePath);
@@ -2057,6 +2146,11 @@ export async function startAuto(
     buildResolver,
   };
 
+  // Register the worker before bootstrap enters a milestone worktree.
+  // This ensures enterMilestone can claim a lease and seed dispatch claims
+  // for crash-recovery fidelity (#5405).
+  registerAutoWorkerForSession(s, base);
+
   const ready = await bootstrapAutoSession(
     s,
     ctx,
@@ -2224,24 +2318,7 @@ export async function dispatchHookUnit(
     startedAt: hookStartedAt,
   };
 
-  // Ensure cwd matches basePath BEFORE newSession() captures it (#1389).
-  // newSession() snapshots process.cwd() during construction; chdir-ing
-  // afterward leaves the session rooted to whatever cwd was when the call
-  // was made. Must be synchronous — no awaits between chdir and newSession.
-  try { if (process.cwd() !== s.basePath) process.chdir(s.basePath); } catch (err) {
-    const msg = `Failed to chdir before hook newSession (basePath: ${s.basePath}): ${err instanceof Error ? err.message : String(err)}`;
-    logWarning("engine", msg, { file: "auto.ts", basePath: s.basePath, error: err instanceof Error ? err.message : String(err) });
-    ctx.ui.notify(`${msg}. Cancelling hook dispatch to avoid running in the wrong directory.`, "error");
-    if (wasActive) {
-      s.basePath = previousBasePath;
-      s.currentUnit = previousCurrentUnit;
-    } else {
-      s.reset();
-    }
-    return false;
-  }
-
-  const result = await s.cmdCtx!.newSession();
+  const result = await s.cmdCtx!.newSession({ workspaceRoot: s.basePath });
   if (result.cancelled) {
     await stopAuto(ctx, pi);
     return false;