gsd-pi 2.80.0-dev.96f4d89d5 → 2.80.0-dev.b0acf17e9

package/dist/resources/extensions/gsd/auto-start.js

@@ -1,3 +1,5 @@
+// Project/App: GSD-2
+// File Purpose: Auto-mode bootstrap, worktree recovery, and fresh-start initialization.
 /**
  * Auto-mode bootstrap — fresh-start initialization path.
  *
@@ -34,6 +36,7 @@ import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
+import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, } from "node:fs";
@@ -43,6 +46,11 @@ import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
 import { validateDirectory } from "./validate-directory.js";
 import { isCustomProvider, resolveDefaultSessionModel, resolveDynamicRoutingConfig, } from "./preferences-models.js";
 import { getSessionModelOverride } from "./session-model-override.js";
+export function resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo) {
+    if (!isRepo || isolationMode !== "none")
+        return null;
+    return currentBranch.startsWith("milestone/") ? integrationBranch : null;
+}
 /**
  * Bootstrap a fresh auto-mode session. Handles everything from git init
  * through secrets collection, returning when ready for the first
@@ -54,6 +62,12 @@ import { getSessionModelOverride } from "./session-model-override.js";
 // Guard constant for consecutive bootstrap attempts that found phase === "complete".
 // Counter moved to AutoSession.consecutiveCompleteBootstraps so s.reset() clears it.
 const MAX_CONSECUTIVE_COMPLETE_BOOTSTRAPS = 2;
+export function hasGitIndexLockForTest(basePath) {
+    return existsSync(join(basePath, ".git", "index.lock"));
+}
+export function _shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, dbAvailable, pathExists = existsSync) {
+    return pathExists(gsdDbPath) && !dbAvailable;
+}
 export async function openProjectDbIfPresent(basePath) {
     const gsdDbPath = resolveProjectRootDbPath(basePath);
     if (!existsSync(gsdDbPath) || isDbAvailable())
@@ -224,6 +238,139 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     }
     return { recovered, warnings };
 }
+/**
+ * Pure decision function for picking which orphan milestone the auto-loop
+ * should resume the merge transition for. Extracted so it can be unit-tested
+ * without spinning up a git repo or a SQLite DB.
+ *
+ * Returns the lexicographically-greatest milestone id (e.g. "M002" beats
+ * "M001") whose branch is unmerged AND has commits ahead of main AND whose
+ * status is `complete`. Lex-ordering matches the project's M00x convention,
+ * which is the most-recently-completed milestone in practice.
+ * `isComplete` errors propagate; `commitsAhead` errors are treated as 0.
+ */
+export function _selectResumableMilestone(branchNames, mergedBranches, isComplete, commitsAhead) {
+    const candidates = [];
+    for (const branch of branchNames) {
+        if (!branch.startsWith("milestone/"))
+            continue;
+        const milestoneId = branch.slice("milestone/".length);
+        if (mergedBranches.has(branch))
+            continue;
+        if (!isComplete(milestoneId))
+            continue;
+        let ahead = 0;
+        try {
+            ahead = commitsAhead(branch);
+        }
+        catch {
+            continue;
+        }
+        if (ahead <= 0)
+            continue;
+        candidates.push(milestoneId);
+    }
+    if (candidates.length === 0)
+        return null;
+    candidates.sort();
+    return candidates[candidates.length - 1];
+}
+/**
+ * Find the most-recent completed milestone whose branch still has unmerged
+ * commits ahead of the integration branch. Used by `bootstrapAutoSession`
+ * to seed `s.currentMilestoneId` so the auto-loop's transition guard at
+ * `phases.ts:730` fires on the first iteration after a process restart —
+ * without this, the in-memory-only `s.currentMilestoneId` is `null` after
+ * restart, the guard short-circuits, and the orphaned milestone branch
+ * never gets merged into main (#5538-followup).
+ *
+ * Returns null when isolation is `none`, the DB is unavailable, or no
+ * orphan candidate exists. All git failures degrade silently — startup
+ * must never block on this defensive lookup.
+ */
+export function findUnmergedCompletedMilestone(basePath, isolationMode) {
+    if (isolationMode === "none")
+        return null;
+    if (!isDbAvailable())
+        return null;
+    let milestoneBranches;
+    try {
+        milestoneBranches = nativeBranchList(basePath, "milestone/*");
+    }
+    catch {
+        return null;
+    }
+    if (milestoneBranches.length === 0)
+        return null;
+    let mainBranch;
+    try {
+        mainBranch = nativeDetectMainBranch(basePath);
+    }
+    catch {
+        mainBranch = "main";
+    }
+    let mergedBranches;
+    try {
+        mergedBranches = new Set(nativeBranchListMerged(basePath, mainBranch, "milestone/*"));
+    }
+    catch {
+        mergedBranches = new Set();
+    }
+    return _selectResumableMilestone(milestoneBranches, mergedBranches, (milestoneId) => {
+        const row = getMilestone(milestoneId);
+        return !!row && row.status === "complete";
+    }, (branch) => nativeCommitCountBetween(basePath, mainBranch, branch));
+}
+/**
+ * Run `mergeAndExit` for a milestone whose worktree/branch finalization
+ * never completed in a prior session — the active-milestone in phase
+ * `complete` with a survivor `milestone/<id>` branch still around.
+ *
+ * Wraps the call in try/catch so a thrown error from `_mergeBranchMode`
+ * (made fail-loud in commit 68ef58a3c) is converted into a user-facing
+ * error notify instead of an unhandled exception that propagates through
+ * `bootstrapAutoSession` to the slash-command caller's `.catch` block.
+ *
+ * Returns `{ merged: true }` on success; `{ merged: false, error }` on
+ * throw — caller decides whether to abort bootstrap.
+ */
+export function _finalizeSurvivorBranch(resolver, milestoneId, ui) {
+    ui.notify(`Milestone ${milestoneId} is complete but branch/worktree was not finalized. Running merge now.`, "info");
+    try {
+        resolver.mergeAndExit(milestoneId, { notify: ui.notify.bind(ui) });
+        return { merged: true };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        ui.notify(`Survivor-branch finalization for ${milestoneId} failed: ${msg}. Resolve manually and re-run /gsd auto.`, "error");
+        return { merged: false, error: err };
+    }
+}
+/**
+ * Merge a milestone whose DB row is `complete` but whose branch is still
+ * unmerged into the integration branch. Called from `bootstrapAutoSession`
+ * for orphans surfaced by `findUnmergedCompletedMilestone`.
+ *
+ * Notifies the user before and after, swallowing errors so a transient git
+ * failure never blocks bootstrap. Returns `{ merged: true }` when the
+ * underlying `mergeAndExit` completes; `{ merged: false, error }` on throw.
+ *
+ * Extracted to keep `bootstrapAutoSession` testable: the merge call and the
+ * notify shape are exercised against a mock resolver in
+ * `tests/orphan-merge-bootstrap.test.ts`.
+ */
+export function _mergeOrphanCompletedMilestone(resolver, orphanId, ui) {
+    ui.notify(`Detected unmerged completed milestone ${orphanId}. Merging now.`, "info");
+    try {
+        resolver.mergeAndExit(orphanId, { notify: ui.notify.bind(ui) });
+        return { merged: true };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        ui.notify(`Could not merge orphan milestone ${orphanId}: ${msg}. Resolve manually and re-run /gsd auto.`, "warning");
+        return { merged: false, error: err };
+    }
+}
 export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, deps, interrupted) {
     const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildResolver, } = deps;
     const dirCheck = validateDirectory(base);
@@ -420,6 +567,33 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             // Non-fatal — the audit is defensive, never block bootstrap
             logWarning("bootstrap", `orphaned milestone branch audit failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // ── Orphaned preflight-stash audit (#5538-followup) ──
+        // Reapplies pre-merge stashes whose milestone is now complete but whose
+        // postflight pop was skipped by an interrupted merge in a prior session.
+        // Uses `git stash apply` (not pop) so the entry remains as a backup.
+        try {
+            if (isDbAvailable()) {
+                const stashAudit = auditOrphanedPreflightStashes(base, (milestoneId) => {
+                    const row = getMilestone(milestoneId);
+                    return !!row && isClosedStatus(row.status);
+                });
+                for (const entry of stashAudit.applied) {
+                    ctx.ui.notify(`Orphan audit: applied preflight stash ${entry.stashRef} for completed milestone ${entry.milestoneId}. The stash entry is preserved as a backup.`, "info");
+                }
+                for (const msg of stashAudit.warnings) {
+                    ctx.ui.notify(`Orphan audit: ${msg}`, "warning");
+                }
+                if (stashAudit.applied.length > 0) {
+                    debugLog("orphan-stash-audit", {
+                        applied: stashAudit.applied,
+                        warnings: stashAudit.warnings,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            logWarning("bootstrap", `orphaned preflight-stash audit failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         let state = await deriveState(base);
         // Stale worktree state recovery (#654)
         if (state.activeMilestone &&
@@ -476,20 +650,68 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // hasSurvivorBranch after a successful promotion.
         if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
-            ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
-            const resolver = buildResolver();
-            resolver.mergeAndExit(mid, {
-                notify: ctx.ui.notify.bind(ctx.ui),
-            });
+            // Commit 68ef58a3c made `_mergeBranchMode` throw on wrong-branch
+            // instead of returning false silently. Wrap the call so the throw is
+            // converted into an error notify + clean bootstrap abort, not an
+            // unhandled exception propagating to the slash-command caller (#5549
+            // post-merge audit, R2).
+            const finalize = _finalizeSurvivorBranch(buildResolver(), mid, ctx.ui);
+            if (!finalize.merged) {
+                return releaseLockAndReturn();
+            }
             invalidateAllCaches();
             state = await deriveState(base);
             // Clear survivor flag — finalization is done
             hasSurvivorBranch = false;
         }
+        // ── Orphan-completed-milestone merge (#5538-followup) ──
+        // A process killed between `complete-milestone` (DB flip + SUMMARY write)
+        // and the loop's transition-guard merge strands the milestone branch
+        // forever: `s.currentMilestoneId` is in-memory only, so on the next
+        // bootstrap the guard at phases.ts:730 sees `mid === s.currentMilestoneId`
+        // and short-circuits.
+        //
+        // The earlier attempt at this fix seeded `s.currentMilestoneId` to the
+        // orphan id pre-state-derivation, but the unconditional assignment at
+        // line 948 (`s.currentMilestoneId = state.activeMilestone?.id ?? null`)
+        // immediately overwrote the seed. Active-merge is the more durable fix:
+        // call `mergeAndExit` directly during bootstrap, then re-derive state so
+        // the loop's normal flow continues without an in-memory hint.
+        //
+        // Mirrors the survivor-finalize block above. Failures degrade to a
+        // warning notify so a transient git error doesn't block bootstrap.
+        {
+            const orphan = findUnmergedCompletedMilestone(base, getIsolationMode(base));
+            if (orphan && orphan !== state.activeMilestone?.id) {
+                const priorBasePath = s.basePath;
+                const priorOriginalBasePath = s.originalBasePath;
+                s.originalBasePath = base;
+                s.basePath = getAutoWorktreePath(base, orphan) ?? base;
+                const result = _mergeOrphanCompletedMilestone(buildResolver(), orphan, ctx.ui);
+                if (!result.merged) {
+                    s.basePath = base;
+                    s.originalBasePath = base;
+                    try {
+                        process.chdir(base);
+                    }
+                    catch (err) {
+                        logWarning("bootstrap", `could not restore cwd after orphan merge failure: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    return releaseLockAndReturn();
+                }
+                if (!s.active) {
+                    s.basePath = priorBasePath || base;
+                    s.originalBasePath = priorOriginalBasePath || base;
+                }
+                if (result.merged) {
+                    invalidateAllCaches();
+                    state = await deriveState(base);
+                }
+            }
+        }
         const effectivePrefs = loadEffectiveGSDPreferences(base)?.preferences;
-        const deepProjectStagePending = !hasSurvivorBranch
-            ? (await import("./auto-dispatch.js")).hasPendingDeepStage(effectivePrefs, base)
-            : false;
+        const { shouldRunDeepProjectSetup } = await import("./auto-dispatch.js");
+        const deepProjectStagePending = shouldRunDeepProjectSetup(state, effectivePrefs, base, { hasSurvivorBranch });
         if (deepProjectStagePending) {
             // Deep project-level setup runs before the first milestone exists. Let
             // the auto loop dispatch workflow-preferences / project / requirements
@@ -591,7 +813,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.resourceVersionOnStart = readResourceVersion();
         s.pendingQuickTasks = [];
         s.currentUnit = null;
-        s.currentMilestoneId = deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
+        s.currentMilestoneId ??= deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
         s.originalModelId = startModelSnapshot?.id ?? ctx.model?.id ?? null;
         s.originalModelProvider = startModelSnapshot?.provider ?? ctx.model?.provider ?? null;
         s.originalThinkingLevel = startThinkingSnapshot ?? null;
@@ -607,13 +829,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Guard against stale milestone branch when isolation:none (#3613).
         // A prior session with isolation:branch/worktree may have left HEAD on
         // milestone/<MID>. Auto-checkout back to the integration branch.
-        if (getIsolationMode(base) === "none" && nativeIsRepo(base)) {
+        const isolationMode = getIsolationMode(base);
+        const isRepo = nativeIsRepo(base);
+        if (isolationMode === "none" && isRepo) {
             try {
                 const currentBranch = nativeGetCurrentBranch(base);
-                if (currentBranch.startsWith("milestone/")) {
-                    const integrationBranch = nativeDetectMainBranch(base);
-                    nativeCheckoutBranch(base, integrationBranch);
-                    logWarning("bootstrap", `Returned to "${integrationBranch}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
+                const integrationBranch = nativeDetectMainBranch(base);
+                const branchToCheckout = resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo);
+                if (branchToCheckout) {
+                    nativeCheckoutBranch(base, branchToCheckout);
+                    logWarning("bootstrap", `Returned to "${branchToCheckout}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
                 }
             }
             catch (err) {
@@ -658,7 +883,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 logError("engine", `failed to initialize project database: ${err.message}`);
             }
         }
-        if (existsSync(gsdDbPath) && !isDbAvailable()) {
+        if (_shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, isDbAvailable())) {
             try {
                 const { openDatabase: openDb } = await import("./gsd-db.js");
                 openDb(gsdDbPath);

package/dist/resources/extensions/gsd/auto-supervisor.js

@@ -24,7 +24,7 @@ let _currentSigtermHandler = null;
  *
  * Returns the new handler so the caller can store and deregister it later.
  */
-export function registerSigtermHandler(currentBasePath, previousHandler) {
+export function registerSigtermHandler(currentBasePath, previousHandler, onSignalCleanup) {
     // Remove the explicitly-passed previous handler
     if (previousHandler) {
         for (const sig of CLEANUP_SIGNALS)
@@ -37,6 +37,13 @@ export function registerSigtermHandler(currentBasePath, previousHandler) {
             process.off(sig, _currentSigtermHandler);
     }
     const handler = () => {
+        try {
+            onSignalCleanup?.();
+        }
+        catch {
+            void 0;
+            // Signal cleanup is best-effort; lock cleanup and process exit still run.
+        }
         clearLock(currentBasePath);
         releaseSessionLock(currentBasePath);
         process.exit(0);

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -35,13 +35,13 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
             recovery: status,
         });
-        const durableComplete = status.summaryExists && status.taskChecked && status.nextActionAdvanced;
+        const durableComplete = status.dbComplete || (status.summaryExists && status.taskChecked && status.nextActionAdvanced);
         if (durableComplete) {
             writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
                 phase: "finalized",
                 recovery: status,
             });
-            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
+            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
             bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -10,7 +10,7 @@
 import { existsSync, cpSync, readFileSync, readdirSync, mkdirSync, realpathSync, rmSync, unlinkSync, statSync, lstatSync as lstatSyncFn, } from "node:fs";
 import { isAbsolute, join, relative, sep as pathSep } from "node:path";
 import { GSDError, GSD_IO_ERROR, GSD_GIT_ERROR } from "./errors.js";
-import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, closeDatabase, openDatabase, getDbPath, } from "./gsd-db.js";
+import { reconcileWorktreeDb, isDbAvailable, getMilestone, getMilestoneSlices, getSliceTasks, closeDatabase, openDatabase, getDbPath, } from "./gsd-db.js";
 import { execFileSync } from "node:child_process";
 import { safeCopy, safeCopyRecursive } from "./safe-fs.js";
 import { gsdRoot, resolveGsdPathContract } from "./paths.js";
@@ -23,7 +23,7 @@ import { debugLog } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
-import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeConflictFiles, nativeCheckoutTheirs, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, } from "./native-git-bridge.js";
+import { nativeGetCurrentBranch, nativeDetectMainBranch, nativeWorkingTreeStatus, nativeAddAllWithExclusions, nativeCommit, nativeCheckoutBranch, nativeMergeSquash, nativeConflictFiles, nativeCheckoutTheirs, nativeAddPaths, nativeRmForce, nativeBranchDelete, nativeBranchForceReset, nativeBranchExists, nativeDiffNumstat, nativeUpdateRef, nativeIsAncestor, nativeMergeAbort, nativeWorktreeList, } from "./native-git-bridge.js";
 import { gsdHome } from "./gsd-home.js";
 import { createWorkspace } from "./workspace.js";
 const PROJECT_PREFERENCES_FILE = "PREFERENCES.md";
@@ -135,6 +135,35 @@ function isSamePath(a, b) {
         return false;
     }
 }
+export function _isSamePathForTest(a, b) {
+    return isSamePath(a, b);
+}
+export function _resolveAutoWorktreeStartPointForTest(integrationBranch, gitMainBranch, branchExists) {
+    if (integrationBranch)
+        return integrationBranch;
+    return gitMainBranch &&
+        typeof gitMainBranch === "string" &&
+        gitMainBranch.length > 0 &&
+        branchExists(gitMainBranch)
+        ? gitMainBranch
+        : undefined;
+}
+export function _shouldReconcileWorktreeDbForTest(worktreeDbPath, mainDbPath, pathExists = existsSync, samePath = isSamePath) {
+    return pathExists(worktreeDbPath) && !samePath(worktreeDbPath, mainDbPath);
+}
+export function _isExpectedWorktreeUnlinkErrorForTest(code) {
+    return code === "ENOENT" || code === "EISDIR";
+}
+function stripGsdDisplayPrefix(value, id) {
+    const raw = String(value ?? "").trim();
+    if (!raw)
+        return undefined;
+    const lower = raw.toLowerCase();
+    const idLower = id.toLowerCase();
+    if (lower.startsWith(`${idLower}:`))
+        return raw.slice(id.length + 1).trim() || undefined;
+    return raw;
+}
 // ─── ASSESSMENT Force-Sync Helper (#2821) ─────────────────────────────────
 /** Regex matching YAML frontmatter `verdict:` field. */
 const VERDICT_RE = /verdict:\s*[\w-]+/i;
@@ -288,7 +317,7 @@ function clearProjectRootStateFiles(basePath, milestoneId) {
                         catch (err) {
                             // ENOENT/EISDIR are expected for already-removed or directory entries (#3597)
                             const code = err.code;
-                            if (code !== "ENOENT" && code !== "EISDIR") {
+                            if (!_isExpectedWorktreeUnlinkErrorForTest(code)) {
                                 logWarning("worktree", `untracked file unlink failed: ${err instanceof Error ? err.message : String(err)}`);
                             }
                         }
@@ -945,17 +974,7 @@ export function enterBranchModeForMilestone(basePath, milestoneId) {
         // Create the milestone branch from the integration branch start-point.
         const integrationBranch = readIntegrationBranch(basePath, milestoneId) ?? undefined;
         const gitPrefs = loadEffectiveGSDPreferences()?.preferences?.git;
-        // Validate main_branch preference exists in the repo before using it —
-        // a stale preference (e.g. "master" when repo uses "main") would cause
-        // nativeBranchForceReset to fail with a bad start-point reference.
-        const validatedPrefBranch = gitPrefs?.main_branch &&
-            typeof gitPrefs.main_branch === "string" &&
-            gitPrefs.main_branch.length > 0 &&
-            nativeBranchExists(basePath, gitPrefs.main_branch)
-            ? gitPrefs.main_branch
-            : undefined;
-        const startPoint = integrationBranch ??
-            validatedPrefBranch ??
+        const startPoint = _resolveAutoWorktreeStartPointForTest(integrationBranch, gitPrefs?.main_branch, (branchName) => nativeBranchExists(basePath, branchName)) ??
             nativeDetectMainBranch(basePath);
         // TOCTOU ancestry guard (Issue #4980 HIGH-3).
         //
@@ -1018,6 +1037,111 @@ export function enterBranchModeForMilestone(basePath, milestoneId) {
  * for both reads and writes. copyPlanningArtifacts and reconcilePlanCheckboxes
  * (both formerly here) became dead.
  */
+/**
+ * True when `branch` is checked out in any worktree listed by
+ * `git worktree list --porcelain`. Used to gate ref updates that would
+ * otherwise leave a concurrent worktree's HEAD inconsistent with its
+ * index/working tree (Codex peer-review of #5538-followup).
+ *
+ * Best-effort: a `nativeWorktreeList` failure returns true so we err on
+ * the side of NOT moving the ref. Better to skip a fast-forward than to
+ * silently corrupt another worktree.
+ */
+export function _isBranchCheckedOutElsewhere(basePath, branch) {
+    try {
+        const entries = nativeWorktreeList(basePath);
+        return entries.some((entry) => entry.branch === branch);
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Resolve the integration branch using the same 3-tier fallback as the
+ * fresh-create path: META.json → git.main_branch preference → detected
+ * main branch. Returns null when no usable target exists.
+ */
+function _resolveIntegrationBranchForReuse(basePath, milestoneId) {
+    const fromMeta = readIntegrationBranch(basePath, milestoneId);
+    if (fromMeta)
+        return fromMeta;
+    const gitPrefs = loadEffectiveGSDPreferences()?.preferences?.git;
+    const fromPref = gitPrefs?.main_branch &&
+        typeof gitPrefs.main_branch === "string" &&
+        gitPrefs.main_branch.length > 0 &&
+        nativeBranchExists(basePath, gitPrefs.main_branch)
+        ? gitPrefs.main_branch
+        : null;
+    if (fromPref)
+        return fromPref;
+    try {
+        return nativeDetectMainBranch(basePath);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * When reusing an existing milestone branch, fast-forward it onto the
+ * integration branch when that's safe (branch is a strict ancestor of
+ * integration — no commits would be lost). Skips when the branch has its
+ * own commits ahead of integration, when the integration branch can't be
+ * resolved, or when any git operation fails — the merge gate at milestone
+ * completion will surface real divergence as a conflict.
+ *
+ * The previous behavior re-attached the worktree to whatever stale tip
+ * the branch held, which caused new milestone work to fork from a base
+ * missing prior milestones' merges (#5538-followup).
+ */
+export function fastForwardReusedMilestoneBranchIfSafe(basePath, milestoneId, branch) {
+    try {
+        const integrationBranch = _resolveIntegrationBranchForReuse(basePath, milestoneId);
+        if (!integrationBranch || integrationBranch === branch)
+            return;
+        if (!nativeBranchExists(basePath, integrationBranch))
+            return;
+        // Pure fast-forward only: branch must be a strict ancestor of integration.
+        // If the branch has its own commits ahead, leave it alone.
+        if (!nativeIsAncestor(basePath, branch, integrationBranch)) {
+            debugLog("createAutoWorktree", {
+                phase: "skip-ff-branch-not-ancestor",
+                milestoneId,
+                branch,
+                integration: integrationBranch,
+            });
+            return;
+        }
+        // Codex peer-review: `nativeUpdateRef` succeeds even when the branch is
+        // currently checked out in another worktree, leaving that worktree's HEAD
+        // inconsistent with its index/work tree. Skip the fast-forward if any
+        // listed worktree has this branch checked out — the merge gate at
+        // milestone-completion will surface stale-base divergence as a conflict
+        // instead of silently corrupting the other worktree's state.
+        if (_isBranchCheckedOutElsewhere(basePath, branch)) {
+            debugLog("createAutoWorktree", {
+                phase: "skip-ff-branch-checked-out-elsewhere",
+                milestoneId,
+                branch,
+            });
+            return;
+        }
+        nativeUpdateRef(basePath, `refs/heads/${branch}`, integrationBranch);
+        debugLog("createAutoWorktree", {
+            phase: "fast-forward-reused-branch",
+            milestoneId,
+            branch,
+            integration: integrationBranch,
+        });
+    }
+    catch (err) {
+        debugLog("createAutoWorktree", {
+            phase: "fast-forward-reused-branch-failed",
+            milestoneId,
+            branch,
+            error: err instanceof Error ? err.message : String(err),
+        });
+    }
+}
 export function createAutoWorktree(basePath, milestoneId) {
     basePath = resolveWorktreeProjectRoot(basePath);
     // Check if repo has commits — git worktree requires a valid HEAD
@@ -1035,6 +1159,11 @@ export function createAutoWorktree(basePath, milestoneId) {
     const branchExists = nativeBranchExists(basePath, branch);
     let info;
     if (branchExists) {
+        // #5538-followup: fast-forward the reused branch onto the integration
+        // branch when safe so the next milestone forks from up-to-date code.
+        // Without this, a milestone that was created before another milestone
+        // merged into main would carry a stale base into its worktree.
+        fastForwardReusedMilestoneBranchIfSafe(basePath, milestoneId, branch);
         // Re-attach worktree to the existing milestone branch (preserving commits)
         info = createWorktree(basePath, milestoneId, {
             branch,
@@ -1051,13 +1180,7 @@ export function createAutoWorktree(basePath, milestoneId) {
         // would fork worktrees from the wrong (stale) branch.
         const integrationBranch = readIntegrationBranch(basePath, milestoneId) ?? undefined;
         const gitPrefs = loadEffectiveGSDPreferences()?.preferences?.git;
-        const validatedPrefBranch = gitPrefs?.main_branch &&
-            typeof gitPrefs.main_branch === "string" &&
-            gitPrefs.main_branch.length > 0 &&
-            nativeBranchExists(basePath, gitPrefs.main_branch)
-            ? gitPrefs.main_branch
-            : undefined;
-        const startPoint = integrationBranch ?? validatedPrefBranch ?? undefined;
+        const startPoint = _resolveAutoWorktreeStartPointForTest(integrationBranch, gitPrefs?.main_branch, (branchName) => nativeBranchExists(basePath, branchName));
         info = createWorktree(basePath, milestoneId, {
             branch,
             startPoint,
@@ -1134,7 +1257,7 @@ export function teardownAutoWorktree(originalBasePath, milestoneId, opts = {}) {
                 const contract = resolveGsdPathContract(previousCwd, originalBasePath);
                 const worktreeDbPath = join(contract.worktreeGsd ?? join(previousCwd, ".gsd"), "gsd.db");
                 const mainDbPath = contract.projectDb;
-                if (existsSync(worktreeDbPath) && !isSamePath(worktreeDbPath, mainDbPath)) {
+                if (_shouldReconcileWorktreeDbForTest(worktreeDbPath, mainDbPath)) {
                     reconcileWorktreeDb(mainDbPath, worktreeDbPath);
                 }
             }
@@ -1384,7 +1507,7 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             const contract = resolveGsdPathContract(worktreeCwd, originalBasePath_);
             const worktreeDbPath = join(contract.worktreeGsd ?? join(worktreeCwd, ".gsd"), "gsd.db");
             const mainDbPath = contract.projectDb;
-            if (existsSync(worktreeDbPath) && !isSamePath(worktreeDbPath, mainDbPath)) {
+            if (_shouldReconcileWorktreeDbForTest(worktreeDbPath, mainDbPath)) {
                 reconcileWorktreeDb(mainDbPath, worktreeDbPath);
             }
         }
@@ -1398,14 +1521,21 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     if (isDbAvailable()) {
         completedSlices = getMilestoneSlices(milestoneId)
             .filter(s => s.status === "complete")
-            .map(s => ({ id: s.id, title: s.title }));
+            .map(s => ({
+            id: s.id,
+            title: stripGsdDisplayPrefix(s.title, s.id) ?? s.id,
+            tasks: getSliceTasks(milestoneId, s.id).map((task) => ({
+                id: task.id,
+                title: stripGsdDisplayPrefix(task.title, task.id) ?? task.id,
+            })),
+        }));
     }
     // Fallback: parse roadmap content when DB is unavailable
     if (completedSlices.length === 0 && roadmapContent) {
         const sliceRe = /- \[x\] \*\*(\w+):\s*(.+?)\*\*/gi;
         let m;
         while ((m = sliceRe.exec(roadmapContent)) !== null) {
-            completedSlices.push({ id: m[1], title: m[2] });
+            completedSlices.push({ id: m[1], title: m[2], tasks: [] });
         }
     }
     // 3. chdir to original base
@@ -1462,7 +1592,7 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     }
     // 6. Build rich commit message
     const dbMilestone = getMilestone(milestoneId);
-    let milestoneTitle = (dbMilestone?.title ?? "").replace(/^M\d+:\s*/, "").trim();
+    let milestoneTitle = stripGsdDisplayPrefix(dbMilestone?.title, milestoneId) ?? "";
     // Fallback: parse title from roadmap content header (e.g. "# M020: Backend foundation")
     if (!milestoneTitle && roadmapContent) {
         const titleMatch = roadmapContent.match(new RegExp(`^#\\s+${milestoneId}:\\s*(.+)`, "m"));
@@ -1471,15 +1601,22 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     }
     milestoneTitle = milestoneTitle || milestoneId;
     const subject = `feat: ${milestoneTitle}`;
+    const milestoneContext = milestoneTitle === milestoneId
+        ? `Milestone: ${milestoneId}`
+        : `Milestone: ${milestoneId} - ${milestoneTitle}`;
     let body = "";
     if (completedSlices.length > 0) {
         const sliceLines = completedSlices
             .map((s) => `- ${s.id}: ${s.title}`)
             .join("\n");
-        body = `\n\nCompleted slices:\n${sliceLines}\n\nGSD-Milestone: ${milestoneId}\nBranch: ${milestoneBranch}`;
+        const taskLines = completedSlices
+            .flatMap((s) => s.tasks.map((task) => `- ${s.id}/${task.id}: ${task.title}`))
+            .join("\n");
+        const taskBlock = taskLines ? `\n\nCompleted tasks:\n${taskLines}` : "";
+        body = `\n\nCompleted slices:\n${sliceLines}${taskBlock}\n\n${milestoneContext}\nGSD-Milestone: ${milestoneId}\nBranch: ${milestoneBranch}`;
     }
     else {
-        body = `\n\nGSD-Milestone: ${milestoneId}\nBranch: ${milestoneBranch}`;
+        body = `\n\n${milestoneContext}\nGSD-Milestone: ${milestoneId}\nBranch: ${milestoneBranch}`;
     }
     const commitMessage = subject + body;
     // 6b. Reconcile worktree HEAD with milestone branch ref (#1846).