gsd-pi 2.80.0-dev.cf9433f56 → 2.80.0-dev.d4fc28e6b

package/dist/resources/extensions/gsd/auto/workflow-dispatch-claim.js

@@ -1,7 +1,39 @@
 // Project/App: GSD-2
 // File Purpose: Best-effort unit dispatch claim adapter for auto-mode loop.
+export function ensureDispatchLease(s, milestoneId, deps, opts = {}) {
+    if (!s.workerId)
+        return { kind: "degraded", reason: "missing-worker" };
+    if (!milestoneId)
+        return { kind: "degraded", reason: "missing-milestone" };
+    if (!opts.forceReclaim && typeof s.milestoneLeaseToken === "number") {
+        return { kind: "ready", token: s.milestoneLeaseToken, recovered: false };
+    }
+    s.milestoneLeaseToken = null;
+    try {
+        const claim = deps.claimMilestoneLease(s.workerId, milestoneId);
+        if (!claim.ok) {
+            const reason = `Milestone ${milestoneId} is held by worker ${claim.byWorker} until ${claim.expiresAt}.`;
+            deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+            return { kind: "blocked", reason };
+        }
+        s.currentMilestoneId = milestoneId;
+        s.milestoneLeaseToken = claim.token;
+        deps.logLeaseRecovered({
+            milestoneId,
+            workerId: s.workerId,
+            token: claim.token,
+            recovered: opts.forceReclaim === true,
+        });
+        return { kind: "ready", token: claim.token, recovered: opts.forceReclaim === true };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        deps.logLeaseRecoveryFailed({ milestoneId, workerId: s.workerId, reason });
+        return { kind: "failed", reason };
+    }
+}
 export function openDispatchClaim(s, flowId, turnId, iterData, deps) {
-    if (!s.workerId || s.milestoneLeaseToken === null)
+    if (!s.workerId || typeof s.milestoneLeaseToken !== "number")
         return { kind: "degraded" };
     const mid = iterData.mid;
     if (!mid)

package/dist/resources/extensions/gsd/auto/workflow-worker-heartbeat.js

@@ -6,7 +6,15 @@ export function maintainWorkerHeartbeat(session, deps) {
     try {
         deps.heartbeatAutoWorker(session.workerId);
         if (session.currentMilestoneId && session.milestoneLeaseToken) {
-            deps.refreshMilestoneLease(session.workerId, session.currentMilestoneId, session.milestoneLeaseToken);
+            const refreshed = deps.refreshMilestoneLease(session.workerId, session.currentMilestoneId, session.milestoneLeaseToken);
+            if (!refreshed) {
+                deps.logLeaseRefreshMiss?.({
+                    workerId: session.workerId,
+                    milestoneId: session.currentMilestoneId,
+                    fencingToken: session.milestoneLeaseToken,
+                });
+                session.milestoneLeaseToken = null;
+            }
         }
     }
     catch (err) {

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -11,7 +11,6 @@ import { buildResearchSlicePrompt, buildResearchMilestonePrompt, buildPlanSliceP
 import { loadEffectiveGSDPreferences } from "./preferences.js";
 import { pauseAuto } from "./auto.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
-import { logWarning } from "./workflow-logger.js";
 import { getWorkflowTransportSupportError, getRequiredWorkflowToolsForAutoUnit, } from "./workflow-mcp.js";
 export async function dispatchDirectPhase(ctx, pi, phase, base) {
     const state = await deriveState(base);
@@ -231,36 +230,10 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
         return;
     }
     ctx.ui.notify(`Dispatching ${unitType} for ${unitId}...`, "info");
-    const originalCwd = process.cwd();
-    try {
-        // Ensure cwd matches dispatchBase BEFORE newSession() captures it. Synchronous —
-        // no awaits between chdir and newSession.
-        try {
-            if (process.cwd() !== dispatchBase) {
-                process.chdir(dispatchBase);
-            }
-        }
-        catch (err) {
-            const msg = `Failed to chdir before direct-dispatch newSession (basePath: ${dispatchBase}): ${err instanceof Error ? err.message : String(err)}`;
-            logWarning("engine", msg, { file: "auto-direct-dispatch.ts", basePath: dispatchBase, error: err instanceof Error ? err.message : String(err) });
-            ctx.ui.notify(`${msg}. Cancelling dispatch to avoid running in the wrong directory.`, "error");
-            return;
-        }
-        const result = await ctx.newSession();
-        if (result.cancelled) {
-            ctx.ui.notify("Session creation cancelled.", "warning");
-            return;
-        }
-        pi.sendMessage({ customType: "gsd-dispatch", content: prompt, display: false }, { triggerTurn: true });
-    }
-    finally {
-        try {
-            if (process.cwd() !== originalCwd) {
-                process.chdir(originalCwd);
-            }
-        }
-        catch (err) {
-            logWarning("engine", `Failed to restore cwd after direct dispatch: ${err instanceof Error ? err.message : String(err)}`, { file: "auto-direct-dispatch.ts", basePath: originalCwd });
-        }
+    const result = await ctx.newSession({ workspaceRoot: dispatchBase });
+    if (result.cancelled) {
+        ctx.ui.notify("Session creation cancelled.", "warning");
+        return;
     }
+    pi.sendMessage({ customType: "gsd-dispatch", content: prompt, display: false }, { triggerTurn: true });
 }

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -791,6 +791,22 @@ export const DISPATCH_RULES = [
             const unitId = `${mid}/${sid}`;
             let priorPreExecFailure;
             if (session?.lastPreExecFailure?.unitId === unitId) {
+                // Circuit breaker: stop re-dispatching after 2 failed retries. The
+                // planner has had multiple attempts with injected failure context and
+                // still cannot produce a valid plan — human review is required.
+                const MAX_PRE_EXEC_RETRIES = 2;
+                const retryCount = session.preExecRetryCount?.get(unitId) ?? 0;
+                if (retryCount >= MAX_PRE_EXEC_RETRIES) {
+                    const findings = session.lastPreExecFailure.blockingFindings.join("; ");
+                    session.lastPreExecFailure = null;
+                    session.preExecRetryCount?.delete(unitId);
+                    return {
+                        action: "stop",
+                        reason: `Pre-execution checks failed ${retryCount} times for ${unitId} — manual intervention required. Blocking findings: ${findings}. Fix the plan manually, then run /gsd auto to resume.`,
+                        level: "error",
+                        matchedRule: "planning → plan-slice",
+                    };
+                }
                 priorPreExecFailure = {
                     blockingFindings: session.lastPreExecFailure.blockingFindings,
                     verdictExcerpt: session.lastPreExecFailure.verdictExcerpt,

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -1123,8 +1123,11 @@ export async function postUnitPostVerification(pctx) {
                     return;
                 }
                 const strictMode = prefs?.enhanced_verification_strict === true;
-                // Run pre-execution checks
-                const result = await runPreExecutionChecks(tasks, s.basePath);
+                // Run pre-execution checks against the canonical project root. In
+                // worktree isolation, s.basePath can point at a metadata-only worktree,
+                // while source files remain under the project root.
+                const preExecutionBasePath = s.canonicalProjectRoot;
+                const result = await runPreExecutionChecks(tasks, preExecutionBasePath);
                 // Log summary to stderr in existing verification output format
                 const emoji = result.status === "pass" ? "✅" : result.status === "warn" ? "⚠️" : "❌";
                 process.stderr.write(`gsd-pre-exec: ${emoji} Pre-execution checks ${result.status} for ${mid}/${sid} (${result.durationMs}ms)\n`);
@@ -1134,12 +1137,12 @@ export async function postUnitPostVerification(pctx) {
                     process.stderr.write(`gsd-pre-exec:   ${checkEmoji} [${check.category}] ${check.target}: ${check.message}\n`);
                 }
                 // Write evidence JSON to slice artifacts directory
-                const slicePath = resolveSlicePath(s.basePath, mid, sid);
+                const slicePath = resolveSlicePath(preExecutionBasePath, mid, sid);
                 const evidenceFileName = `${sid}-PRE-EXEC-VERIFY.json`;
                 let evidencePath = join(".gsd", "milestones", mid, "slices", sid, evidenceFileName);
                 if (slicePath) {
                     writePreExecutionEvidence(result, slicePath, mid, sid);
-                    evidencePath = relative(s.basePath, join(slicePath, evidenceFileName)) || evidenceFileName;
+                    evidencePath = relative(preExecutionBasePath, join(slicePath, evidenceFileName)) || evidenceFileName;
                 }
                 if (uokFlags.gates) {
                     const failedChecks = result.checks
@@ -1187,6 +1190,9 @@ export async function postUnitPostVerification(pctx) {
                         blockingFindings: blockingChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
                         verdictExcerpt: `status=${result.status}; ${blockingCount} blocking issue${blockingCount === 1 ? "" : "s"} detected`,
                     };
+                    // Track consecutive pre-exec failures per slice for loop detection.
+                    const retryKey = currentUnit.id;
+                    s.preExecRetryCount.set(retryKey, (s.preExecRetryCount.get(retryKey) ?? 0) + 1);
                     preExecPauseNeeded = true;
                 }
                 else if (result.status === "warn") {
@@ -1199,9 +1205,16 @@ export async function postUnitPostVerification(pctx) {
                             blockingFindings: warnChecks.map(c => `[${c.category}] ${c.target}: ${c.message}`),
                             verdictExcerpt: `status=${result.status} (strict mode); ${warnChecks.length} warning${warnChecks.length === 1 ? "" : "s"} treated as blocking`,
                         };
+                        const retryKey = currentUnit.id;
+                        s.preExecRetryCount.set(retryKey, (s.preExecRetryCount.get(retryKey) ?? 0) + 1);
                         preExecPauseNeeded = true;
                     }
                 }
+                // Reset the retry counter when checks pass — a successful re-plan
+                // should not carry over a stale failure count into future slices.
+                if (result.status === "pass") {
+                    s.preExecRetryCount.delete(currentUnit.id);
+                }
                 debugLog("postUnitPostVerification", {
                     phase: "pre-execution-checks",
                     status: result.status,

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -29,12 +29,12 @@ import { resolveSkillManifest, warnIfManifestHasMissingSkills } from "./skill-ma
 import { classifyProject } from "./detection.js";
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
 /**
- * Historical static ceiling for the preamble cap. Kept as an upper bound even
+ * Static ceiling for the preamble cap. Kept as an upper bound even
  * after context-window-aware sizing so large-window users don't suddenly see
- * 10× looser caps than before. Small-window users get a tighter cap derived
+ * 10× looser caps than needed. Small-window users get a tighter cap derived
  * from their configured executor window.
  */
-const MAX_PREAMBLE_CHARS = 30_000;
+const MAX_PREAMBLE_CHARS = 20_000;
 /**
  * Resolve prompt budgets from the configured executor context window.
  *
@@ -163,8 +163,8 @@ function formatCloseoutReviewInstructions(validationContent, validationRel, curr
     ].join("\n");
 }
 function capPreamble(preamble) {
-    // Cap inlined context at min(historical 30K ceiling, scaled inline budget).
-    // The ceiling preserves pre-fix behavior for large-window users; the scaled
+    // Cap inlined context at min(static ceiling, scaled inline budget).
+    // The ceiling bounds repeated auto prompt payloads; the scaled
     // budget tightens the cap for small-window users whose true safe limit is
     // below 30K. `computeBudgets` allocates 40% of total chars to inline context.
     const budget = Math.min(MAX_PREAMBLE_CHARS, resolvePromptBudgets().inlineContextBudgetChars);
@@ -571,9 +571,77 @@ export async function buildSliceSummaryExcerpt(absPath, relPath, sid) {
     }
     catch {
         // Defensive — any parse failure falls back to full inline.
-        return `### ${sid} Summary\nSource: \`${relPath}\`\n\n${content.trim()}`;
+        return `### ${sid} Summary\nSource: \`${relPath}\`\n\n${capMalformedSummary(content, relPath)}`;
     }
 }
+export async function buildTaskSummaryExcerpt(absPath, relPath, tid, options) {
+    const label = options?.blocker ? "Blocker Task Summary" : "Task Summary";
+    const header = `### ${label}: ${tid} (excerpt)\nSource: \`${relPath}\``;
+    const content = absPath ? await loadFile(absPath) : null;
+    if (!content) {
+        return `${header}\n\n_(not found — file does not exist yet)_`;
+    }
+    try {
+        const s = parseSummary(content);
+        if (!s.frontmatter.id) {
+            return `### ${label}: ${tid}\nSource: \`${relPath}\`\n\n${capMalformedSummary(content, relPath)}`;
+        }
+        const lines = [header, ""];
+        if (s.title)
+            lines.push(`**Title:** ${s.title}`);
+        if (s.oneLiner)
+            lines.push(`**One-liner:** ${s.oneLiner}`);
+        if (s.frontmatter.verification_result) {
+            lines.push(`**Verification:** \`${s.frontmatter.verification_result}\``);
+        }
+        lines.push(`**Blocker discovered:** ${s.frontmatter.blocker_discovered ? "yes — read full summary if blocker details are insufficient" : "no"}`);
+        if (s.frontmatter.provides.length > 0)
+            lines.push(`**Provides:** ${s.frontmatter.provides.slice(0, 4).join("; ")}`);
+        if (s.frontmatter.key_decisions.length > 0)
+            lines.push(`**Key decisions:** ${s.frontmatter.key_decisions.slice(0, 4).join("; ")}`);
+        if (s.frontmatter.patterns_established.length > 0)
+            lines.push(`**Patterns established:** ${s.frontmatter.patterns_established.slice(0, 4).join("; ")}`);
+        if (s.frontmatter.key_files.length > 0) {
+            const files = s.frontmatter.key_files.slice(0, 6);
+            const more = s.frontmatter.key_files.length > files.length ? ` (+${s.frontmatter.key_files.length - files.length} more)` : "";
+            lines.push(`**Key files:** ${files.join(", ")}${more}`);
+        }
+        const SECTION_CAP_CHARS = 500;
+        const capSection = (body) => {
+            const trimmed = body.trim();
+            if (trimmed.length <= SECTION_CAP_CHARS)
+                return trimmed;
+            return `${trimmed.slice(0, SECTION_CAP_CHARS)}\n… (truncated — see full \`${relPath}\`)`;
+        };
+        const verification = extractMarkdownSection(content, "Verification");
+        const diagnostics = extractMarkdownSection(content, "Diagnostics");
+        const knownIssues = extractMarkdownSection(content, "Known Issues");
+        if (verification && verification.trim()) {
+            lines.push("", "#### Verification", capSection(verification));
+        }
+        if (diagnostics && diagnostics.trim()) {
+            lines.push("", "#### Diagnostics", capSection(diagnostics));
+        }
+        if (s.deviations && s.deviations.trim()) {
+            lines.push("", "#### Deviations", capSection(s.deviations));
+        }
+        if (knownIssues && knownIssues.trim()) {
+            lines.push("", "#### Known issues", capSection(knownIssues));
+        }
+        lines.push("", `> **On-demand:** read \`${relPath}\` only when this excerpt is absent/truncated or you need fuller blocker, implementation, or file-change evidence.`);
+        return lines.join("\n");
+    }
+    catch {
+        return `### ${label}: ${tid}\nSource: \`${relPath}\`\n\n${capMalformedSummary(content, relPath)}`;
+    }
+}
+function capMalformedSummary(content, relPath) {
+    const trimmed = content.trim();
+    const limit = 1_500;
+    if (trimmed.length <= limit)
+        return trimmed;
+    return `${trimmed.slice(0, limit).trimEnd()}\n\n[Truncated malformed summary — read \`${relPath}\` for full details.]`;
+}
 /**
  * Load and inline dependency slice summaries (full content, not just paths).
  */
@@ -826,12 +894,12 @@ export async function inlineKnowledgeScoped(base, keywords) {
  * plan-milestone, complete-slice, complete-milestone, validate-milestone,
  * reassess-roadmap) previously injected the full KNOWLEDGE.md (~226KB for a
  * real project) on every invocation. This helper scopes by caller-supplied
- * keywords and caps the payload at `maxChars` (default 30,000 chars).
+ * keywords and caps the payload at `maxChars` (default 12,000 chars).
  *
  * Returns null when no KNOWLEDGE.md exists or no entries match any keyword.
  */
 export async function inlineKnowledgeBudgeted(base, keywords, options) {
-    const DEFAULT_MAX_CHARS = 30_000;
+    const DEFAULT_MAX_CHARS = 12_000;
     const HARD_MAX_CHARS = 100_000;
     const raw = Number(options?.maxChars ?? DEFAULT_MAX_CHARS);
     const maxChars = Number.isFinite(raw)
@@ -1824,8 +1892,17 @@ export async function buildPlanSlicePrompt(mid, _midTitle, sid, sTitle, base, le
             `The previous plan-slice attempt was blocked by pre-execution validation.\n` +
             `Gate verdict: ${verdictExcerpt}\n\n` +
             `Blocked references that must be resolved in this plan:\n${findingsList}\n\n` +
-            `Revise the plan so that every reference listed above is satisfied before execution begins. ` +
-            `Do not reproduce the same file paths, package names, or task ordering that caused these failures.`);
+            `**How to fix each type of issue:**\n` +
+            `- **"[file] X doesn't exist and isn't created by prior or same-task outputs"**: ` +
+            `Either (a) add an earlier task that creates X on disk before the task that needs it, ` +
+            `or (b) if this task IS the one that creates X, move X from inputs to expected_output. ` +
+            `Do NOT put X in a task's expected_output if that task only reads or verifies X — only tasks that actually write X to disk should list it in expected_output.\n` +
+            `- **"[file] X: Task T_early reads X but it's created by task T_late (sequence violation)"**: ` +
+            `Either (a) reorder tasks so T_late (the creator) runs before T_early (the reader), ` +
+            `or (b) if T_late doesn't actually create X (it only reads/tests it), remove X from T_late's expected_output entirely.\n` +
+            `- **"[package] P not found on npm"**: Either remove the npm install for P, or use the correct package name.\n\n` +
+            `Every file listed in a task's inputs must either exist on disk already or appear in an earlier task's expected_output. ` +
+            `A task's expected_output must only list files it actually writes to disk.`);
     }
     return renderSlicePrompt({
         mid, sid, sTitle, base,
@@ -2048,11 +2125,9 @@ export async function buildCompleteSlicePrompt(mid, midTitle, sid, sTitle, base,
                 const blocks = [];
                 for (const file of summaryFiles) {
                     const absPath = join(tDir, file);
-                    const content = await loadFile(absPath);
-                    if (!content)
-                        continue;
                     const relPath = `${sRel}/tasks/${file}`;
-                    blocks.push(`### Task Summary: ${file.replace(/-SUMMARY\.md$/i, "")}\nSource: \`${relPath}\`\n\n${content.trim()}`);
+                    const taskId = file.replace(/-SUMMARY\.md$/i, "");
+                    blocks.push(await buildTaskSummaryExcerpt(absPath, relPath, taskId));
                 }
                 return blocks.length > 0 ? blocks.join("\n\n---\n\n") : null;
             }
@@ -2399,7 +2474,7 @@ export async function buildReplanSlicePrompt(mid, midTitle, sid, sTitle, base) {
             const relPath = `${sRel}/tasks/${file}`;
             if (summary.frontmatter.blocker_discovered) {
                 blockerTaskId = summary.frontmatter.id || file.replace(/-SUMMARY\.md$/i, "");
-                inlined.push(`### Blocker Task Summary: ${blockerTaskId}\nSource: \`${relPath}\`\n\n${content.trim()}`);
+                inlined.push(await buildTaskSummaryExcerpt(absPath, relPath, blockerTaskId, { blocker: true }));
             }
         }
     }

package/dist/resources/extensions/gsd/auto-start.js

@@ -34,6 +34,7 @@ import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
+import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, } from "node:fs";
@@ -224,6 +225,139 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     }
     return { recovered, warnings };
 }
+/**
+ * Pure decision function for picking which orphan milestone the auto-loop
+ * should resume the merge transition for. Extracted so it can be unit-tested
+ * without spinning up a git repo or a SQLite DB.
+ *
+ * Returns the lexicographically-greatest milestone id (e.g. "M002" beats
+ * "M001") whose branch is unmerged AND has commits ahead of main AND whose
+ * status is `complete`. Lex-ordering matches the project's M00x convention,
+ * which is the most-recently-completed milestone in practice.
+ * `isComplete` errors propagate; `commitsAhead` errors are treated as 0.
+ */
+export function _selectResumableMilestone(branchNames, mergedBranches, isComplete, commitsAhead) {
+    const candidates = [];
+    for (const branch of branchNames) {
+        if (!branch.startsWith("milestone/"))
+            continue;
+        const milestoneId = branch.slice("milestone/".length);
+        if (mergedBranches.has(branch))
+            continue;
+        if (!isComplete(milestoneId))
+            continue;
+        let ahead = 0;
+        try {
+            ahead = commitsAhead(branch);
+        }
+        catch {
+            continue;
+        }
+        if (ahead <= 0)
+            continue;
+        candidates.push(milestoneId);
+    }
+    if (candidates.length === 0)
+        return null;
+    candidates.sort();
+    return candidates[candidates.length - 1];
+}
+/**
+ * Find the most-recent completed milestone whose branch still has unmerged
+ * commits ahead of the integration branch. Used by `bootstrapAutoSession`
+ * to seed `s.currentMilestoneId` so the auto-loop's transition guard at
+ * `phases.ts:730` fires on the first iteration after a process restart —
+ * without this, the in-memory-only `s.currentMilestoneId` is `null` after
+ * restart, the guard short-circuits, and the orphaned milestone branch
+ * never gets merged into main (#5538-followup).
+ *
+ * Returns null when isolation is `none`, the DB is unavailable, or no
+ * orphan candidate exists. All git failures degrade silently — startup
+ * must never block on this defensive lookup.
+ */
+export function findUnmergedCompletedMilestone(basePath, isolationMode) {
+    if (isolationMode === "none")
+        return null;
+    if (!isDbAvailable())
+        return null;
+    let milestoneBranches;
+    try {
+        milestoneBranches = nativeBranchList(basePath, "milestone/*");
+    }
+    catch {
+        return null;
+    }
+    if (milestoneBranches.length === 0)
+        return null;
+    let mainBranch;
+    try {
+        mainBranch = nativeDetectMainBranch(basePath);
+    }
+    catch {
+        mainBranch = "main";
+    }
+    let mergedBranches;
+    try {
+        mergedBranches = new Set(nativeBranchListMerged(basePath, mainBranch, "milestone/*"));
+    }
+    catch {
+        mergedBranches = new Set();
+    }
+    return _selectResumableMilestone(milestoneBranches, mergedBranches, (milestoneId) => {
+        const row = getMilestone(milestoneId);
+        return !!row && row.status === "complete";
+    }, (branch) => nativeCommitCountBetween(basePath, mainBranch, branch));
+}
+/**
+ * Run `mergeAndExit` for a milestone whose worktree/branch finalization
+ * never completed in a prior session — the active-milestone in phase
+ * `complete` with a survivor `milestone/<id>` branch still around.
+ *
+ * Wraps the call in try/catch so a thrown error from `_mergeBranchMode`
+ * (made fail-loud in commit 68ef58a3c) is converted into a user-facing
+ * error notify instead of an unhandled exception that propagates through
+ * `bootstrapAutoSession` to the slash-command caller's `.catch` block.
+ *
+ * Returns `{ merged: true }` on success; `{ merged: false, error }` on
+ * throw — caller decides whether to abort bootstrap.
+ */
+export function _finalizeSurvivorBranch(resolver, milestoneId, ui) {
+    ui.notify(`Milestone ${milestoneId} is complete but branch/worktree was not finalized. Running merge now.`, "info");
+    try {
+        resolver.mergeAndExit(milestoneId, { notify: ui.notify.bind(ui) });
+        return { merged: true };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        ui.notify(`Survivor-branch finalization for ${milestoneId} failed: ${msg}. Resolve manually and re-run /gsd auto.`, "error");
+        return { merged: false, error: err };
+    }
+}
+/**
+ * Merge a milestone whose DB row is `complete` but whose branch is still
+ * unmerged into the integration branch. Called from `bootstrapAutoSession`
+ * for orphans surfaced by `findUnmergedCompletedMilestone`.
+ *
+ * Notifies the user before and after, swallowing errors so a transient git
+ * failure never blocks bootstrap. Returns `{ merged: true }` when the
+ * underlying `mergeAndExit` completes; `{ merged: false, error }` on throw.
+ *
+ * Extracted to keep `bootstrapAutoSession` testable: the merge call and the
+ * notify shape are exercised against a mock resolver in
+ * `tests/orphan-merge-bootstrap.test.ts`.
+ */
+export function _mergeOrphanCompletedMilestone(resolver, orphanId, ui) {
+    ui.notify(`Detected unmerged completed milestone ${orphanId}. Merging now.`, "info");
+    try {
+        resolver.mergeAndExit(orphanId, { notify: ui.notify.bind(ui) });
+        return { merged: true };
+    }
+    catch (err) {
+        const msg = err instanceof Error ? err.message : String(err);
+        ui.notify(`Could not merge orphan milestone ${orphanId}: ${msg}. Resolve manually and re-run /gsd auto.`, "warning");
+        return { merged: false, error: err };
+    }
+}
 export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, deps, interrupted) {
     const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildResolver, } = deps;
     const dirCheck = validateDirectory(base);
@@ -420,6 +554,33 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             // Non-fatal — the audit is defensive, never block bootstrap
             logWarning("bootstrap", `orphaned milestone branch audit failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // ── Orphaned preflight-stash audit (#5538-followup) ──
+        // Reapplies pre-merge stashes whose milestone is now complete but whose
+        // postflight pop was skipped by an interrupted merge in a prior session.
+        // Uses `git stash apply` (not pop) so the entry remains as a backup.
+        try {
+            if (isDbAvailable()) {
+                const stashAudit = auditOrphanedPreflightStashes(base, (milestoneId) => {
+                    const row = getMilestone(milestoneId);
+                    return !!row && isClosedStatus(row.status);
+                });
+                for (const entry of stashAudit.applied) {
+                    ctx.ui.notify(`Orphan audit: applied preflight stash ${entry.stashRef} for completed milestone ${entry.milestoneId}. The stash entry is preserved as a backup.`, "info");
+                }
+                for (const msg of stashAudit.warnings) {
+                    ctx.ui.notify(`Orphan audit: ${msg}`, "warning");
+                }
+                if (stashAudit.applied.length > 0) {
+                    debugLog("orphan-stash-audit", {
+                        applied: stashAudit.applied,
+                        warnings: stashAudit.warnings,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            logWarning("bootstrap", `orphaned preflight-stash audit failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         let state = await deriveState(base);
         // Stale worktree state recovery (#654)
         if (state.activeMilestone &&
@@ -476,16 +637,46 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // hasSurvivorBranch after a successful promotion.
         if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
-            ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
-            const resolver = buildResolver();
-            resolver.mergeAndExit(mid, {
-                notify: ctx.ui.notify.bind(ctx.ui),
-            });
+            // Commit 68ef58a3c made `_mergeBranchMode` throw on wrong-branch
+            // instead of returning false silently. Wrap the call so the throw is
+            // converted into an error notify + clean bootstrap abort, not an
+            // unhandled exception propagating to the slash-command caller (#5549
+            // post-merge audit, R2).
+            const finalize = _finalizeSurvivorBranch(buildResolver(), mid, ctx.ui);
+            if (!finalize.merged) {
+                return releaseLockAndReturn();
+            }
             invalidateAllCaches();
             state = await deriveState(base);
             // Clear survivor flag — finalization is done
             hasSurvivorBranch = false;
         }
+        // ── Orphan-completed-milestone merge (#5538-followup) ──
+        // A process killed between `complete-milestone` (DB flip + SUMMARY write)
+        // and the loop's transition-guard merge strands the milestone branch
+        // forever: `s.currentMilestoneId` is in-memory only, so on the next
+        // bootstrap the guard at phases.ts:730 sees `mid === s.currentMilestoneId`
+        // and short-circuits.
+        //
+        // The earlier attempt at this fix seeded `s.currentMilestoneId` to the
+        // orphan id pre-state-derivation, but the unconditional assignment at
+        // line 948 (`s.currentMilestoneId = state.activeMilestone?.id ?? null`)
+        // immediately overwrote the seed. Active-merge is the more durable fix:
+        // call `mergeAndExit` directly during bootstrap, then re-derive state so
+        // the loop's normal flow continues without an in-memory hint.
+        //
+        // Mirrors the survivor-finalize block above. Failures degrade to a
+        // warning notify so a transient git error doesn't block bootstrap.
+        {
+            const orphan = findUnmergedCompletedMilestone(base, getIsolationMode(base));
+            if (orphan && orphan !== state.activeMilestone?.id) {
+                const result = _mergeOrphanCompletedMilestone(buildResolver(), orphan, ctx.ui);
+                if (result.merged) {
+                    invalidateAllCaches();
+                    state = await deriveState(base);
+                }
+            }
+        }
         const effectivePrefs = loadEffectiveGSDPreferences(base)?.preferences;
         const { shouldRunDeepProjectSetup } = await import("./auto-dispatch.js");
         const deepProjectStagePending = shouldRunDeepProjectSetup(state, effectivePrefs, base, { hasSurvivorBranch });
@@ -590,7 +781,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.resourceVersionOnStart = readResourceVersion();
         s.pendingQuickTasks = [];
         s.currentUnit = null;
-        s.currentMilestoneId = deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
+        s.currentMilestoneId ??= deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
         s.originalModelId = startModelSnapshot?.id ?? ctx.model?.id ?? null;
         s.originalModelProvider = startModelSnapshot?.provider ?? ctx.model?.provider ?? null;
         s.originalThinkingLevel = startThinkingSnapshot ?? null;