gsd-pi 2.80.0-dev.fbe7c8c6f → 2.81.0-dev.3cddbbba2

package/dist/resources/extensions/gsd/auto.js

@@ -1,3 +1,5 @@
+// Project/App: GSD-2
+// File Purpose: Auto-mode orchestration, session lifecycle, and stop handling.
 /**
  * GSD Auto Mode — Fresh Session Per Unit
  *
@@ -13,14 +15,14 @@ import { deriveState } from "./state.js";
 import { parseUnitId } from "./unit-id.js";
 import { assessInterruptedSession, readPausedSessionMetadata, PAUSED_SESSION_KV_KEY, } from "./interrupted-session.js";
 import { setRuntimeKv, deleteRuntimeKv, } from "./db/runtime-kv.js";
-import { getManifestStatus } from "./files.js";
+import { extractSection, getManifestStatus, splitFrontmatter, parseFrontmatterMap } from "./files.js";
 export { inlinePriorMilestoneSummary } from "./files.js";
 import { collectSecretsFromManifest } from "../get-secrets-from-user.js";
 import { gsdRoot, resolveMilestoneFile, resolveMilestonePath, resolveDir, milestonesDir, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { clearActivityLogState } from "./activity-log.js";
 import { synthesizeCrashRecovery, getDeepDiagnostic, readActiveMilestoneId, } from "./session-forensics.js";
-import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, } from "./crash-recovery.js";
+import { writeLock, clearLock, readCrashLock, isLockProcessAlive, formatCrashInfo, emitCrashRecoveredUnitEnd, emitOpenUnitEndForUnit, } from "./crash-recovery.js";
 import { acquireSessionLock, getSessionLockStatus, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { resolveAutoSupervisorConfig, loadEffectiveGSDPreferences, getIsolationMode, } from "./preferences.js";
 import { sendDesktopNotification } from "./notifications.js";
@@ -43,10 +45,10 @@ import { isAbsolute, join } from "node:path";
 import { pathToFileURL } from "node:url";
 import { readFileSync, existsSync, mkdirSync } from "node:fs";
 import { atomicWriteSync } from "./atomic-write.js";
-import { autoCommitCurrentBranch, captureIntegrationBranch, detectWorktreeName, getCurrentBranch, getMainBranch, setActiveMilestoneId, resolveProjectRoot, } from "./worktree.js";
+import { captureIntegrationBranch, detectWorktreeName, getCurrentBranch, getMainBranch, setActiveMilestoneId, resolveProjectRoot, } from "./worktree.js";
 import { GitServiceImpl } from "./git-service.js";
 import { getPriorSliceCompletionBlocker } from "./dispatch-guard.js";
-import { createAutoWorktree, enterAutoWorktree, enterBranchModeForMilestone, teardownAutoWorktree, isInAutoWorktree, getAutoWorktreePath, mergeMilestoneToMain, autoWorktreeBranch, syncWorktreeStateBack, syncProjectRootToWorktree, checkResourcesStale, escapeStaleWorktree, } from "./auto-worktree.js";
+import { createAutoWorktree, teardownAutoWorktree, isInAutoWorktree, getAutoWorktreePath, mergeMilestoneToMain, autoWorktreeBranch, checkResourcesStale, escapeStaleWorktree, } from "./auto-worktree.js";
 import { pruneQueueOrder } from "./queue-order.js";
 import { startCommandPolling as _startCommandPolling, isRemoteConfigured } from "../remote-questions/manager.js";
 import { debugLog, isDebugEnabled, writeDebugSummary } from "./debug-logger.js";
@@ -58,9 +60,11 @@ import { recoverFailedMigration } from "./migrate-external.js";
 import { initRegistry, convertDispatchRules } from "./rule-registry.js";
 import { emitJournalEvent as _emitJournalEvent } from "./journal.js";
 import { isClosedStatus } from "./status-guards.js";
-import { updateProgressWidget as _updateProgressWidget, updateSliceProgressCache, clearSliceProgressCache, } from "./auto-dashboard.js";
+import { updateProgressWidget as _updateProgressWidget, setCompletionProgressWidget, setAutoOutcomeWidget, updateSliceProgressCache, clearSliceProgressCache, unitVerb, } from "./auto-dashboard.js";
 import { registerSigtermHandler as _registerSigtermHandler, deregisterSigtermHandler as _deregisterSigtermHandler, } from "./auto-supervisor.js";
-import { isDbAvailable, getMilestone } from "./gsd-db.js";
+import { isDbAvailable, getMilestone, getMilestoneSlices } from "./gsd-db.js";
+import { markLatestActiveForWorkerCanceled } from "./db/unit-dispatches.js";
+import { writeUnitRuntimeRecord } from "./unit-runtime.js";
 import { countPendingCaptures } from "./captures.js";
 import { CMUX_CHANNELS } from "../shared/cmux-events.js";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
@@ -83,8 +87,24 @@ import { runAutoLoopWithUok } from "./uok/kernel.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { validateDirectory } from "./validate-directory.js";
 import { createAutoOrchestrator } from "./auto/orchestrator.js";
-import { WorktreeResolver, } from "./worktree-resolver.js";
+import { reconcileBeforeDispatch } from "./state-reconciliation.js";
+import { compileUnitToolContract } from "./tool-contract.js";
+import { createWorktreeSafetyModule } from "./worktree-safety.js";
+import { resolveManifest } from "./unit-context-manifest.js";
+import { classifyFailure } from "./recovery-classification.js";
+import { WorktreeLifecycle, } from "./worktree-lifecycle.js";
+import { WorktreeStateProjection } from "./worktree-state-projection.js";
 import { reorderForCaching } from "./prompt-ordering.js";
+import { initTokenCounter } from "./token-counter.js";
+// Warm the tiktoken encoder at extension startup so context-budget computations
+// can use accurate token counts via countTokensSync without paying the load
+// cost mid-prompt-build. Fire-and-forget — failure falls back to the
+// provider-aware char-ratio estimator already used by getCharsPerToken().
+// Catch rejections explicitly: an unhandled rejection at module-import time
+// can destabilize startup before the engine logger is configured.
+void initTokenCounter().catch((err) => {
+    logWarning("engine", `token counter warm-up failed: ${err instanceof Error ? err.message : String(err)}`);
+});
 export { STUB_RECOVERY_THRESHOLD, NEW_SESSION_TIMEOUT_MS, } from "./auto/session.js";
 import { autoSession as s } from "./auto-runtime-state.js";
 import { gsdHome } from "./gsd-home.js";
@@ -112,11 +132,12 @@ const STATE_REBUILD_MIN_INTERVAL_MS = 30_000;
  * the DB is unavailable (e.g. fresh project before init) we skip registration
  * silently rather than blocking session start.
  */
-function registerAutoWorkerForSession(session) {
+function registerAutoWorkerForSession(session, projectRootOverride) {
     if (session.workerId)
         return; // already registered (e.g. resume re-runs)
     try {
-        const projectRootRealpath = normalizeRealPath(session.scope?.workspace.projectRoot
+        const projectRootRealpath = normalizeRealPath(projectRootOverride
+            ?? session.scope?.workspace.projectRoot
             ?? (session.originalBasePath || session.basePath));
         session.workerId = registerAutoWorker({ projectRootRealpath });
     }
@@ -148,6 +169,12 @@ function restoreProjectRootEnv() {
     s.hadProjectRootEnv = false;
     s.projectRootEnvCaptured = false;
 }
+export function _captureProjectRootEnvForTest(projectRoot) {
+    captureProjectRootEnv(projectRoot);
+}
+export function _restoreProjectRootEnvForTest() {
+    restoreProjectRootEnv();
+}
 function captureMilestoneLockEnv(milestoneId) {
     if (!s.milestoneLockEnvCaptured) {
         s.hadMilestoneLockEnv = Object.prototype.hasOwnProperty.call(process.env, "GSD_MILESTONE_LOCK");
@@ -225,6 +252,10 @@ function synthesizePausedSessionRecovery(basePath, unitType, unitId, sessionFile
 export function _synthesizePausedSessionRecoveryForTest(basePath, unitType, unitId, sessionFile) {
     return synthesizePausedSessionRecovery(basePath, unitType, unitId, sessionFile);
 }
+// `_resolvePausedResumeBasePathForTest` was retired in ADR-016 phase 2 / B3
+// (#5621). Production callers go through
+// `WorktreeLifecycle.resumeFromPausedSession`; the pure helper for tests is
+// `resolvePausedResumeBasePath` exported from `worktree-lifecycle.ts`.
 const DETACHED_AUTO_KEEPALIVE_INTERVAL_MS = 30_000;
 function withDetachedAutoKeepalive(run) {
     const keepAlive = setInterval(() => { }, DETACHED_AUTO_KEEPALIVE_INTERVAL_MS);
@@ -272,9 +303,50 @@ export function shouldUseWorktreeIsolation(basePath) {
  */
 // Re-export budget utilities for external consumers
 export { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, } from "./auto-budget.js";
+function closeOutSignalInterruptedUnit(currentBasePath) {
+    const currentUnit = s.currentUnit;
+    if (!currentUnit)
+        return;
+    const reason = "Auto-mode process received a termination signal";
+    const errorContext = {
+        message: reason,
+        category: "aborted",
+        isTransient: false,
+    };
+    const basePath = s.basePath || currentBasePath;
+    try {
+        emitOpenUnitEndForUnit(basePath, currentUnit.type, currentUnit.id, "cancelled", errorContext);
+    }
+    catch (err) {
+        logWarning("engine", `signal unit-end cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+    try {
+        writeUnitRuntimeRecord(basePath, currentUnit.type, currentUnit.id, currentUnit.startedAt, {
+            phase: "crashed",
+            lastProgressAt: Date.now(),
+            lastProgressKind: "signal",
+        });
+    }
+    catch (err) {
+        logWarning("engine", `signal runtime cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+    try {
+        if (s.workerId)
+            markLatestActiveForWorkerCanceled(s.workerId, "signal-exit");
+    }
+    catch (err) {
+        logWarning("engine", `signal dispatch cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+    try {
+        resolveAgentEndCancelled(errorContext);
+    }
+    catch (err) {
+        logWarning("engine", `signal resolve cleanup failed: ${getErrorMessage(err)}`, { file: "auto.ts" });
+    }
+}
 /** Wrapper: register SIGTERM handler and store reference. */
 function registerSigtermHandler(currentBasePath) {
-    s.sigtermHandler = _registerSigtermHandler(currentBasePath, s.sigtermHandler);
+    s.sigtermHandler = _registerSigtermHandler(currentBasePath, s.sigtermHandler, () => closeOutSignalInterruptedUnit(currentBasePath));
 }
 /** Wrapper: deregister SIGTERM handler and clear reference. */
 function deregisterSigtermHandler() {
@@ -341,6 +413,9 @@ export function getAutoDashboardData() {
 export function isAutoActive() {
     return s.active;
 }
+export function isAutoCompletionStopInProgress() {
+    return s.completionStopInProgress;
+}
 /** Test-only seam for validating auto-mode guards (#4704). Do not use in production code. */
 export function _setAutoActiveForTest(active) {
     s.active = active;
@@ -360,6 +435,20 @@ export function _warnIfWorktreeMissingForTest(worktreePath, milestoneId) {
 export function isAutoPaused() {
     return s.paused;
 }
+export async function refreshResumeResourcesAndDb(basePath, deps = {}) {
+    const env = deps.env ?? process.env;
+    const importModule = deps.importModule ?? ((specifier) => import(specifier));
+    const agentDir = env.GSD_CODING_AGENT_DIR || join(gsdHome(), "agent");
+    const pkgRoot = env.GSD_PKG_ROOT;
+    const resourceLoaderPath = pkgRoot
+        ? pathToFileURL(join(pkgRoot, "dist", "resource-loader.js")).href
+        : new URL("../../../resource-loader.js", import.meta.url).href;
+    const { initResources } = await importModule(resourceLoaderPath);
+    initResources(agentDir);
+    const { primeCache } = await importModule("./prompt-loader.js");
+    primeCache();
+    await (deps.openProjectDb ?? openProjectDbIfPresent)(basePath);
+}
 export function setActiveEngineId(id) {
     s.activeEngineId = id;
 }
@@ -523,6 +612,21 @@ function buildSnapshotOpts(_unitType, _unitId) {
         ...(s.currentUnitRouting ?? {}),
     };
 }
+function currentUnitLabel() {
+    if (!s.currentUnit)
+        return null;
+    return `${unitVerb(s.currentUnit.type)} ${s.currentUnit.id}`;
+}
+function setLifecycleOutcome(ctx, input) {
+    if (!ctx?.hasUI)
+        return;
+    const { unitLabel: unitLabelOverride, ...rest } = input;
+    setAutoOutcomeWidget(ctx, {
+        ...rest,
+        unitLabel: unitLabelOverride !== undefined ? unitLabelOverride : currentUnitLabel(),
+        startedAt: s.autoStartTime,
+    });
+}
 function handleLostSessionLock(ctx, lockStatus) {
     debugLog("session-lock-lost", {
         lockBase: lockBase(),
@@ -563,7 +667,21 @@ function handleLostSessionLock(ctx, lockStatus) {
  * the stale unit state, progress widget, status badge, and restores CWD so
  * the dashboard does not show an orphaned timer and the shell is usable.
  */
-function cleanupAfterLoopExit(ctx) {
+export async function rerootCommandSession(cmdCtx, workspaceRoot) {
+    if (!cmdCtx || !workspaceRoot)
+        return { status: "skipped" };
+    try {
+        const result = await cmdCtx.newSession({ workspaceRoot });
+        return result.cancelled ? { status: "cancelled" } : { status: "ok" };
+    }
+    catch (err) {
+        return {
+            status: "failed",
+            error: err instanceof Error ? err.message : String(err),
+        };
+    }
+}
+export async function cleanupAfterLoopExit(ctx) {
     s.currentUnit = null;
     s.active = false;
     deactivateGSD();
@@ -588,30 +706,102 @@ function cleanupAfterLoopExit(ctx) {
     // visible so the user still has a resumable auto-mode signal on screen.
     if (!s.paused) {
         ctx.ui.setStatus("gsd-auto", undefined);
-        ctx.ui.setWidget("gsd-progress", undefined);
+        if (s.completionStopInProgress) {
+            s.completionStopInProgress = false;
+        }
         initHealthWidget(ctx);
     }
-    // Restore CWD out of worktree back to original project root
+    // ADR-016 phase 3 (#5693): the stop-path basePath restore routes through
+    // `Lifecycle.restoreToProjectRoot()`, the sole owner of `s.basePath`
+    // mutation. The verb assigns `s.basePath` before any throwable work
+    // (rebuildGitService, cache invalidation), so a thrown error still leaves
+    // basePath restored — no fallback assignment needed at the call site.
+    // The chdir stays here because `restoreToProjectRoot` is a pure
+    // session-state mutation.
     if (s.originalBasePath) {
-        s.basePath = s.originalBasePath;
         try {
-            process.chdir(s.basePath);
+            buildLifecycle().restoreToProjectRoot();
         }
         catch (err) {
-            /* best-effort */
-            logWarning("engine", `chdir failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+            logWarning("engine", `restore project root failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
         }
+        try {
+            process.chdir(s.originalBasePath);
+        }
+        catch (err) {
+            logWarning("engine", `basePath restore/chdir failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+        }
+    }
+    if (s.originalBasePath && s.cmdCtx) {
+        const result = await rerootCommandSession(s.cmdCtx, s.originalBasePath);
+        if (result.status === "cancelled") {
+            logWarning("engine", "post-loop session re-root was cancelled", { file: "auto.ts", basePath: s.originalBasePath });
+        }
+        else if (result.status === "failed") {
+            logWarning("engine", `post-loop session re-root failed: ${result.error ?? "unknown"}`, { file: "auto.ts", basePath: s.originalBasePath });
+        }
+    }
+}
+export function _cleanupAfterLoopExitForTest(ctx) {
+    return cleanupAfterLoopExit(ctx);
+}
+function normalizeFrontmatterList(value) {
+    if (!Array.isArray(value))
+        return [];
+    return value
+        .map(item => typeof item === "string" ? item.trim() : "")
+        .filter(item => item.length > 0 && item !== "(none)");
+}
+function firstBoldParagraph(body) {
+    const match = body.match(/\*\*([^*\n][\s\S]*?)\*\*/);
+    return match?.[1]?.replace(/\s+/g, " ").trim() || undefined;
+}
+function loadMilestoneCompletionRollup(basePath, milestoneId) {
+    if (!milestoneId)
+        return {};
+    const summaryPath = resolveMilestoneFile(basePath, milestoneId, "SUMMARY");
+    if (!summaryPath || !existsSync(summaryPath))
+        return {};
+    try {
+        const raw = readFileSync(summaryPath, "utf-8");
+        const [frontmatterLines, body] = splitFrontmatter(raw);
+        const frontmatter = frontmatterLines ? parseFrontmatterMap(frontmatterLines) : {};
+        return {
+            milestoneTitle: typeof frontmatter.title === "string" ? frontmatter.title : undefined,
+            oneLiner: firstBoldParagraph(body),
+            successCriteriaResults: extractSection(body, "Success Criteria Results") ?? undefined,
+            definitionOfDoneResults: extractSection(body, "Definition of Done Results") ?? undefined,
+            requirementOutcomes: extractSection(body, "Requirement Outcomes") ?? undefined,
+            deviations: extractSection(body, "Deviations") ?? undefined,
+            followUps: extractSection(body, "Follow-ups") ?? undefined,
+            keyDecisions: normalizeFrontmatterList(frontmatter.key_decisions),
+            keyFiles: normalizeFrontmatterList(frontmatter.key_files),
+            lessonsLearned: normalizeFrontmatterList(frontmatter.lessons_learned),
+        };
+    }
+    catch (err) {
+        logWarning("dashboard", `completion roll-up summary read failed: ${err instanceof Error ? err.message : String(err)}`);
+        return {};
     }
 }
-export async function stopAuto(ctx, pi, reason) {
+export function _resolveAutoWorktreeExitActionForTest(currentMilestoneId, milestoneMergedInPhases, milestoneComplete) {
+    const action = _selectStopAutoWorktreeExit({
+        currentMilestoneId: currentMilestoneId ?? null,
+        milestoneComplete,
+        milestoneMergedInPhases,
+    });
+    return action === "none" ? "skip" : action;
+}
+export async function stopAuto(ctx, pi, reason, options = {}) {
     if (!s.active && !s.paused)
         return;
     const loadedPreferences = loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences;
     const reasonSuffix = reason ? ` — ${reason}` : "";
-    // #4764 — telemetry: record the exit reason and whether the current milestone
-    // was merged before we entered stopAuto. This is the producer-side signal for
-    // the #4761 orphan class: milestoneMerged=false + currentMilestoneId present
-    // is exactly the pattern that strands work.
+    const preserveCompletionSurface = Boolean(options.completionWidget);
+    s.completionStopInProgress = preserveCompletionSurface;
+    // #4764 — telemetry: record the exit reason, isolation mode, whether an auto
+    // worktree was active, and whether the current milestone was merged before
+    // stopAuto. The unmerged-work warning is only meaningful for real worktrees.
     try {
         const { emitAutoExit } = await import("./worktree-telemetry.js");
         // Normalize the free-form reason to a closed set so the telemetry
@@ -633,10 +823,13 @@ export async function stopAuto(ctx, pi, reason) {
                                 : rawReason === "stop" || rawReason === "pause"
                                     ? rawReason
                                     : "other";
-        emitAutoExit(s.originalBasePath || s.basePath, {
+        const telemetryBase = s.originalBasePath || s.basePath;
+        emitAutoExit(telemetryBase, {
             reason: normalizedReason,
             milestoneId: s.currentMilestoneId ?? undefined,
             milestoneMerged: s.milestoneMergedInPhases === true,
+            isolationMode: getIsolationMode(telemetryBase),
+            worktreeActive: isInAutoWorktree(s.basePath),
         });
     }
     catch (err) {
@@ -666,6 +859,8 @@ export async function stopAuto(ctx, pi, reason) {
             if (s.workerId) {
                 markWorkerStopping(s.workerId);
             }
+            s.workerId = null;
+            s.milestoneLeaseToken = null;
         }
         catch (e) {
             debugLog("stop-cleanup-coordination", { error: e instanceof Error ? e.message : String(e) });
@@ -709,7 +904,7 @@ export async function stopAuto(ctx, pi, reason) {
                 const notifyCtx = ctx
                     ? { notify: ctx.ui.notify.bind(ctx.ui) }
                     : { notify: () => { } };
-                const resolver = buildResolver();
+                const lifecycle = buildLifecycle();
                 // Check if the milestone is complete. DB status is the authoritative
                 // signal — only a successful gsd_complete_milestone call flips it to
                 // "complete" (tools/complete-milestone.ts). SUMMARY file presence is
@@ -740,19 +935,27 @@ export async function stopAuto(ctx, pi, reason) {
                     // Non-fatal — fall through to preserveBranch path
                     logWarning("engine", `milestone summary check failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
                 }
-                if (milestoneComplete) {
+                const exitAction = _selectStopAutoWorktreeExit({
+                    currentMilestoneId: s.currentMilestoneId,
+                    milestoneComplete,
+                    milestoneMergedInPhases: s.milestoneMergedInPhases,
+                });
+                if (exitAction === "merge") {
                     // Milestone is complete — merge worktree branch back to main
-                    resolver.mergeAndExit(s.currentMilestoneId, notifyCtx);
+                    const r = lifecycle.exitMilestone(s.currentMilestoneId, { merge: true }, notifyCtx);
+                    if (!r.ok && r.cause instanceof Error)
+                        throw r.cause;
                 }
-                else {
+                else if (exitAction === "preserve") {
                     // Milestone still in progress — preserve branch for later resumption
-                    resolver.exitMilestone(s.currentMilestoneId, notifyCtx, {
-                        preserveBranch: true,
-                    });
+                    const r = lifecycle.exitMilestone(s.currentMilestoneId, { merge: false, preserveBranch: true }, notifyCtx);
+                    if (!r.ok && r.cause instanceof Error)
+                        throw r.cause;
                 }
             }
         }
         catch (e) {
+            ctx?.ui.notify(`Worktree cleanup failed for ${s.currentMilestoneId ?? "current milestone"}: ${e instanceof Error ? e.message : String(e)}. Resolve the preserved branch/worktree and run /gsd auto to resume.`, "warning");
             debugLog("stop-cleanup-worktree", { error: e instanceof Error ? e.message : String(e) });
         }
         // ── Step 5: Rebuild state while DB is still open (#3599) ──
@@ -770,6 +973,21 @@ export async function stopAuto(ctx, pi, reason) {
                 });
             }
         }
+        // Pre-compute completion widget slice counts while the DB is still open.
+        // Step 8 runs after closeDatabase(), so DB-backed slice lookups must happen here.
+        const completionMilestoneId = options.completionWidget?.milestoneId ?? s.currentMilestoneId;
+        let completedSlices = null;
+        let totalSlices = null;
+        if (preserveCompletionSurface && options.completionWidget && completionMilestoneId && isDbAvailable()) {
+            try {
+                const slices = getMilestoneSlices(completionMilestoneId);
+                completedSlices = slices.filter(slice => isClosedStatus(slice.status)).length;
+                totalSlices = slices.length;
+            }
+            catch (err) {
+                logWarning("dashboard", `completion slice stats lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
         // ── Step 6: DB cleanup ──
         if (isDbAvailable()) {
             try {
@@ -782,36 +1000,112 @@ export async function stopAuto(ctx, pi, reason) {
                 });
             }
         }
-        // ── Step 7: Restore basePath and chdir ──
-        try {
-            if (s.originalBasePath) {
-                s.basePath = s.originalBasePath;
-                try {
-                    process.chdir(s.basePath);
-                }
-                catch (err) {
-                    /* best-effort */
-                    logWarning("engine", `chdir failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
-                }
+        // ── Step 7: Restore basePath and chdir (ADR-016 phase 3, #5693) ──
+        // `restoreToProjectRoot` assigns s.basePath before any throwable work;
+        // no fallback assignment is needed at the call site.
+        if (s.originalBasePath) {
+            try {
+                buildLifecycle().restoreToProjectRoot();
+            }
+            catch (e) {
+                debugLog("stop-cleanup-basepath", { error: e instanceof Error ? e.message : String(e) });
+            }
+            try {
+                process.chdir(s.basePath);
+            }
+            catch (err) {
+                /* best-effort */
+                logWarning("engine", `chdir failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
             }
         }
-        catch (e) {
-            debugLog("stop-cleanup-basepath", { error: e instanceof Error ? e.message : String(e) });
+        // Re-root the active command session/tool runtime after worktree teardown.
+        // mergeAndExit restores process.cwd(), but AgentSession has already captured
+        // its own cwd for tools and system prompt; refresh it before returning to the
+        // user so follow-up commands do not target a removed milestone worktree.
+        if (s.originalBasePath && ctx && s.cmdCtx) {
+            const result = await rerootCommandSession(s.cmdCtx, s.originalBasePath);
+            if (result.status === "cancelled") {
+                logWarning("engine", "post-stop session re-root was cancelled", { file: "auto.ts", basePath: s.originalBasePath });
+            }
+            else if (result.status === "failed") {
+                logWarning("engine", `post-stop session re-root failed: ${result.error ?? "unknown"}`, { file: "auto.ts", basePath: s.originalBasePath });
+            }
         }
         // ── Step 8: Ledger notification ──
         try {
             const ledger = getLedger();
+            const isAllComplete = reason === "All milestones complete";
+            const isMilestoneComplete = /^Milestone\s+\S+\s+complete$/i.test(reason ?? "");
+            const notificationPrefix = isAllComplete
+                ? "All milestones complete"
+                : isMilestoneComplete
+                    ? `${reason}. Auto-mode finished this milestone`
+                    : `Auto-mode stopped${reasonSuffix}`;
             if (ledger && ledger.units.length > 0) {
                 const totals = getProjectTotals(ledger.units);
-                ctx?.ui.notify(`Auto-mode stopped${reasonSuffix}. Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${ledger.units.length} units`, "info");
+                ctx?.ui.notify(`${notificationPrefix}. Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${ledger.units.length} units`, "info");
             }
             else {
-                ctx?.ui.notify(`Auto-mode stopped${reasonSuffix}.`, "info");
+                ctx?.ui.notify(`${notificationPrefix}.`, "info");
             }
         }
         catch (e) {
             debugLog("stop-cleanup-ledger", { error: e instanceof Error ? e.message : String(e) });
         }
+        if (preserveCompletionSurface && ctx && options.completionWidget) {
+            const ledger = getLedger();
+            const units = ledger?.units ?? [];
+            const totals = units.length > 0 ? getProjectTotals(units) : null;
+            let totalInput = 0;
+            let totalCacheRead = 0;
+            try {
+                for (const entry of s.cmdCtx?.sessionManager?.getEntries?.() ?? []) {
+                    if (entry.type === "message") {
+                        const msgEntry = entry;
+                        if (msgEntry.message?.role === "assistant") {
+                            const usage = msgEntry.message.usage;
+                            if (usage) {
+                                totalInput += usage.input || 0;
+                                totalCacheRead += usage.cacheRead || 0;
+                            }
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                logWarning("dashboard", `completion stats lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+            }
+            const contextUsage = s.cmdCtx?.getContextUsage?.();
+            const milestoneId = completionMilestoneId;
+            const rollup = loadMilestoneCompletionRollup(s.originalBasePath || s.basePath, milestoneId);
+            setCompletionProgressWidget(ctx, {
+                milestoneId,
+                milestoneTitle: options.completionWidget.milestoneTitle ?? rollup.milestoneTitle,
+                oneLiner: rollup.oneLiner,
+                successCriteriaResults: rollup.successCriteriaResults,
+                definitionOfDoneResults: rollup.definitionOfDoneResults,
+                requirementOutcomes: rollup.requirementOutcomes,
+                deviations: rollup.deviations,
+                followUps: rollup.followUps,
+                keyDecisions: rollup.keyDecisions,
+                keyFiles: rollup.keyFiles,
+                lessonsLearned: rollup.lessonsLearned,
+                reason: reason ?? "Milestone complete",
+                startedAt: s.autoStartTime,
+                totalCost: totals?.cost ?? 0,
+                totalTokens: totals?.tokens.total ?? 0,
+                unitCount: units.length,
+                cacheHitRate: totalCacheRead + totalInput > 0
+                    ? (totalCacheRead / (totalCacheRead + totalInput)) * 100
+                    : null,
+                contextPercent: contextUsage?.percent ?? null,
+                contextWindow: contextUsage?.contextWindow ?? s.cmdCtx?.model?.contextWindow ?? null,
+                completedSlices,
+                totalSlices,
+                allMilestonesComplete: options.completionWidget.allMilestonesComplete,
+                basePath: s.originalBasePath || s.basePath || null,
+            });
+        }
         // ── Step 9: Cmux sidebar / event log ──
         try {
             pi?.events.emit(CMUX_CHANNELS.SIDEBAR, { action: "clear", preferences: loadedPreferences });
@@ -902,9 +1196,21 @@ export async function stopAuto(ctx, pi, reason) {
         resetProactiveHealing();
         // UI cleanup
         ctx?.ui.setStatus("gsd-auto", undefined);
-        ctx?.ui.setWidget("gsd-progress", undefined);
-        if (ctx)
-            initHealthWidget(ctx);
+        if (!preserveCompletionSurface) {
+            ctx?.ui.setWidget("gsd-progress", undefined);
+            const status = reason?.startsWith("Blocked:") ? "blocked" : reason?.toLowerCase().includes("fail") ? "failed" : "stopped";
+            setLifecycleOutcome(ctx, {
+                status,
+                title: status === "blocked" ? "Auto-mode blocked" : status === "failed" ? "Auto-mode stopped with an issue" : "Auto-mode stopped",
+                detail: reason ?? "Auto-mode stopped.",
+                nextAction: status === "blocked"
+                    ? "Fix the blocker, then run /gsd auto to resume."
+                    : "Run /gsd status for the current project state, or /gsd auto to continue.",
+                commands: ["/gsd status for overview", "/gsd auto to run", "/gsd visualize to inspect", "/gsd notifications for history"],
+            });
+            if (ctx)
+                initHealthWidget(ctx);
+        }
         restoreProjectRootEnv();
         restoreMilestoneLockEnv();
         // Drop the active-tool baseline so a subsequent /gsd auto run on the
@@ -920,9 +1226,14 @@ export async function stopAuto(ctx, pi, reason) {
             debugLog("stop-orchestration-stop", { error: err instanceof Error ? err.message : String(err) });
         }
         // Reset all session state in one call
-        s.reset();
+        s.resetAfterStop({ preserveCompletionSurface });
     }
 }
+export function _selectStopAutoWorktreeExit(args) {
+    if (!args.currentMilestoneId || args.milestoneMergedInPhases)
+        return "none";
+    return args.milestoneComplete ? "merge" : "preserve";
+}
 /**
  * Pause auto-mode without destroying state. Context is preserved.
  * The user can interact with the agent, then `/gsd auto` resumes
@@ -976,6 +1287,7 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
         // Non-fatal — resume will still work via full bootstrap, just without worktree context
         logWarning("engine", `paused-session DB write failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
     }
+    const pausedUnitLabel = currentUnitLabel();
     // Close out the current unit so its runtime record doesn't stay at "dispatched"
     if (s.currentUnit && ctx) {
         try {
@@ -1023,45 +1335,55 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     s.verificationRetryCount.clear();
     ctx?.ui.setStatus("gsd-auto", "paused");
     ctx?.ui.setWidget("gsd-progress", undefined);
+    const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
+    setLifecycleOutcome(ctx, {
+        status: "paused",
+        title: `${s.stepMode ? "Step" : "Auto"}-mode paused`,
+        detail: _errorContext?.message ?? "Paused by user request.",
+        nextAction: `Type to steer, or run ${resumeCmd} to resume.`,
+        commands: [resumeCmd, "/gsd status for overview", "/gsd notifications for history"],
+        unitLabel: pausedUnitLabel,
+    });
     if (ctx)
         initHealthWidget(ctx);
-    const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";
     ctx?.ui.notify(`${s.stepMode ? "Step" : "Auto"}-mode paused (Escape). Type to interact, or ${resumeCmd} to resume.`, "info");
 }
 /**
- * Build a WorktreeResolverDeps from auto.ts private scope.
- * Shared by buildResolver() and buildLoopDeps().
+ * Build a WorktreeLifecycle Module wrapping the current session.
+ *
+ * Per ADR-016, the Lifecycle Module is the typed-Interface owner of milestone
+ * entry/exit/merge verbs and calls Projection on lifecycle transitions. The
+ * deps bag is intentionally focused — Lifecycle does not see the wider auto-
+ * mode dependency graph.
+ */
+/**
+ * Construct a `WorktreeLifecycleDeps` bag without binding to any session.
+ *
+ * Exported so session-less callers (currently `parallel-merge.ts`) can build
+ * the same deps and call `mergeMilestoneStandalone` through the Worktree
+ * Lifecycle Module instead of bypassing it (ADR-016 phase 2 / A2).
  */
-function buildResolverDeps() {
+export function buildWorktreeLifecycleDeps() {
+    // ADR-016 phase 2 / C-track close-out:
+    //   C1 (#5624) — fs + git-CLI primitives inlined
+    //   C2 (#5625) — worktree-manager helpers inlined
+    //   C3 (#5626) — cache + preferences + paths inlined
+    //   C4 (#5627) — GitServiceImpl constructor → gitServiceFactory
+    //
+    // Final WorktreeLifecycleDeps shape: 3 fields (gitServiceFactory,
+    // worktreeProjection, mergeMilestoneToMain). Down from 18 at slice-7
+    // closure.
     return {
-        isInAutoWorktree,
-        shouldUseWorktreeIsolation,
-        getIsolationMode,
+        gitServiceFactory: (basePath) => {
+            const gitConfig = loadEffectiveGSDPreferences()?.preferences?.git ?? {};
+            return new GitServiceImpl(basePath, gitConfig);
+        },
+        worktreeProjection: new WorktreeStateProjection(),
         mergeMilestoneToMain,
-        syncWorktreeStateBack,
-        teardownAutoWorktree,
-        createAutoWorktree,
-        enterAutoWorktree,
-        enterBranchModeForMilestone,
-        getAutoWorktreePath,
-        autoCommitCurrentBranch,
-        getCurrentBranch,
-        autoWorktreeBranch,
-        resolveMilestoneFile,
-        readFileSync: (path, encoding) => readFileSync(path, encoding),
-        GitServiceImpl: GitServiceImpl,
-        loadEffectiveGSDPreferences: loadEffectiveGSDPreferences,
-        invalidateAllCaches,
-        captureIntegrationBranch,
     };
 }
-/**
- * Build a WorktreeResolver wrapping the current session.
- * Cheap to construct — it's just a thin wrapper over `s` + deps.
- * Used by stopAuto(), resume path, and buildLoopDeps().
- */
-function buildResolver() {
-    return new WorktreeResolver(s, buildResolverDeps());
+function buildLifecycle() {
+    return new WorktreeLifecycle(s, buildWorktreeLifecycleDeps());
 }
 /**
  * Thin entry glue for the new Auto Orchestration module.
@@ -1074,9 +1396,26 @@ export function createWiredAutoOrchestrationModule(ctx, _pi, dispatchBasePath, r
     const flowId = `auto-orchestrator-${Date.now()}`;
     let seq = 0;
     const deps = {
+        stateReconciliation: {
+            async reconcileBeforeDispatch() {
+                const result = await reconcileBeforeDispatch(dispatchBasePath);
+                if (!result.ok) {
+                    return {
+                        ok: false,
+                        reason: result.reason,
+                        stateSnapshot: result.stateSnapshot,
+                    };
+                }
+                return {
+                    ok: true,
+                    reason: result.repaired.join(", "),
+                    stateSnapshot: result.stateSnapshot,
+                };
+            },
+        },
         dispatch: {
-            async decideNextUnit() {
-                const state = await deriveState(dispatchBasePath);
+            async decideNextUnit(input) {
+                const state = input.stateSnapshot;
                 const active = state.activeMilestone;
                 if (!active)
                     return null;
@@ -1100,12 +1439,48 @@ export function createWiredAutoOrchestrationModule(ctx, _pi, dispatchBasePath, r
         },
         recovery: {
             async classifyAndRecover(input) {
-                const reason = input.error instanceof Error ? input.error.message : String(input.error ?? "unknown auto error");
-                return { action: "escalate", reason };
+                const recovery = classifyFailure(input);
+                return { action: recovery.action, reason: recovery.reason };
+            },
+        },
+        toolContract: {
+            async compileUnitToolContract(unitType) {
+                const result = compileUnitToolContract(unitType);
+                if (!result.ok)
+                    return { ok: false, reason: result.detail };
+                return { ok: true, reason: result.contract.validationRules.join(", ") };
             },
         },
         worktree: {
-            async prepareForUnit() { },
+            async prepareForUnit(unitType, unitId) {
+                const manifest = resolveManifest(unitType);
+                if (!manifest) {
+                    return {
+                        ok: false,
+                        reason: `No Unit manifest is registered for ${unitType}`,
+                    };
+                }
+                const writeScope = manifest.tools.mode === "all" || manifest.tools.mode === "docs"
+                    ? "source-writing"
+                    : "planning-only";
+                const safety = createWorktreeSafetyModule();
+                const snapshot = await deriveState(dispatchBasePath);
+                const milestoneId = snapshot.activeMilestone?.id ?? null;
+                const expectedBranch = milestoneId ? autoWorktreeBranch(milestoneId) : null;
+                const result = safety.validateUnitRoot({
+                    unitType,
+                    unitId,
+                    writeScope,
+                    projectRoot: runtimeBasePath,
+                    unitRoot: dispatchBasePath,
+                    milestoneId,
+                    expectedBranch,
+                });
+                if (!result.ok) {
+                    return { ok: false, reason: `${result.kind}: ${result.reason}` };
+                }
+                return { ok: true, reason: result.kind };
+            },
             async syncAfterUnit() { },
             async cleanupOnStop() { },
         },
@@ -1199,6 +1574,7 @@ function buildLoopDeps(pi) {
     // (resolveDispatch, runPreDispatchHooks, etc.) delegate to the registry.
     initRegistry(convertDispatchRules(DISPATCH_RULES));
     const cmux = makeCmuxEmitters(pi);
+    const worktreeProjection = new WorktreeStateProjection();
     return {
         lockBase,
         buildSnapshotOpts,
@@ -1218,8 +1594,8 @@ function buildLoopDeps(pi) {
         loadEffectiveGSDPreferences,
         // Pre-dispatch health gate
         preDispatchHealthGate,
-        // Worktree sync
-        syncProjectRootToWorktree,
+        // Worktree state projection (ADR-016 — single Module Interface)
+        worktreeProjection,
         // Resource version guard
         checkResourcesStale,
         // Session lock
@@ -1231,7 +1607,6 @@ function buildLoopDeps(pi) {
         pruneQueueOrder,
         isInAutoWorktree,
         shouldUseWorktreeIsolation,
-        mergeMilestoneToMain,
         teardownAutoWorktree,
         createAutoWorktree,
         captureIntegrationBranch,
@@ -1280,8 +1655,9 @@ function buildLoopDeps(pi) {
         atomicWriteSync,
         // Git
         GitServiceImpl: GitServiceImpl,
-        // WorktreeResolver
-        resolver: buildResolver(),
+        // Worktree Lifecycle Module (ADR-016 — single Module Interface for the
+        // milestone create/enter/exit/merge verbs)
+        lifecycle: buildLifecycle(),
         // Post-unit processing
         postUnitPreVerification,
         runPostUnitVerification,
@@ -1500,7 +1876,12 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         s.verbose = verboseMode;
         s.stepMode = requestedStepMode;
         s.cmdCtx = ctx;
-        s.basePath = base;
+        // ADR-016 phase 2 / B2 (#5620): bootstrap basePath transition before
+        // the resume path consults persisted worktree state. Defensive about
+        // s.originalBasePath — the meta-restore above (line 2003 / 2055) may
+        // have already populated it from paused metadata; the verb preserves
+        // that value.
+        buildLifecycle().adoptSessionRoot(base);
         // ── Resume worktree: if the paused session was inside a milestone worktree,
         // apply that path as the dispatch basePath immediately (#3723).
         // This ensures the dispatch loop runs from the worktree directory even when
@@ -1512,9 +1893,8 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         if (resumeWorktreePath && !existsSync(resumeWorktreePath)) {
             logWarning("session", `Worktree was expected at ${resumeWorktreePath} but is missing. Continuing in project-root mode. To restart with a fresh worktree, run /gsd-debug or recreate the milestone.`, { file: "auto.ts", milestoneId: s.currentMilestoneId ?? "" });
         }
-        if (resumeWorktreePath && existsSync(resumeWorktreePath)) {
-            s.basePath = resumeWorktreePath;
-        }
+        // ADR-016 phase 2 / B3 (#5621): paused-resume worktree-path adoption.
+        buildLifecycle().resumeFromPausedSession(base, resumeWorktreePath);
         // Rebuild scope now that s.basePath reflects the actual worktree (or project root).
         rebuildScope(s.basePath, s.currentMilestoneId);
         // Ensure the workflow-logger audit log is pinned to the project root
@@ -1540,9 +1920,14 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             !isInAutoWorktree(s.basePath) &&
             !detectWorktreeName(s.basePath) &&
             !detectWorktreeName(s.originalBasePath)) {
-            buildResolver().enterMilestone(s.currentMilestoneId, {
+            const enterResult = buildLifecycle().enterMilestone(s.currentMilestoneId, {
                 notify: ctx.ui.notify.bind(ctx.ui),
             });
+            if (!enterResult.ok && enterResult.reason === "lease-conflict") {
+                ctx.ui.notify(`Cannot resume milestone ${s.currentMilestoneId}: lease is held by another worker.`, "error");
+                await stopAuto(ctx, pi, "lease-conflict during resume");
+                return;
+            }
             // s.basePath may have been updated to a worktree path by enterMilestone.
             rebuildScope(s.basePath, s.currentMilestoneId);
         }
@@ -1559,16 +1944,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         // tree; deployed extensions live at ~/.gsd/agent/extensions/gsd/ where the
         // relative path resolves to ~/.gsd/agent/resource-loader.js which doesn't exist.
         // Using GSD_PKG_ROOT constructs a correct absolute path in both contexts (#3949).
-        const agentDir = process.env.GSD_CODING_AGENT_DIR || join(gsdHome(), "agent");
-        const pkgRoot = process.env.GSD_PKG_ROOT;
-        const resourceLoaderPath = pkgRoot
-            ? pathToFileURL(join(pkgRoot, "dist", "resource-loader.js")).href
-            : new URL("../../../resource-loader.js", import.meta.url).href;
-        const { initResources } = await import(resourceLoaderPath);
-        initResources(agentDir);
-        // Open the project DB before rebuild/derive so resume uses DB-backed
-        // state instead of falling back to stale markdown parsing (#2940).
-        await openProjectDbIfPresent(s.basePath);
+        await refreshResumeResourcesAndDb(s.basePath);
         try {
             await rebuildState(s.basePath);
             pi.events.emit(CMUX_CHANNELS.SIDEBAR, { action: "sync", preferences: loadEffectiveGSDPreferences(s.basePath || undefined)?.preferences, state: await deriveState(s.basePath) });
@@ -1621,7 +1997,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             runKernelLoop: runUokKernelLoop,
             runLegacyLoop: runLegacyAutoLoop,
         });
-        cleanupAfterLoopExit(ctx);
+        await cleanupAfterLoopExit(ctx);
         return;
     }
     // ── Fresh start path — delegated to auto-start.ts ──
@@ -1629,8 +2005,12 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         shouldUseWorktreeIsolation,
         registerSigtermHandler,
         lockBase,
-        buildResolver,
+        buildLifecycle,
     };
+    // Register the worker before bootstrap enters a milestone worktree.
+    // This ensures enterMilestone can claim a lease and seed dispatch claims
+    // for crash-recovery fidelity (#5405).
+    registerAutoWorkerForSession(s, base);
     const ready = await bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, bootstrapDeps, freshStartAssessment);
     if (!ready)
         return;
@@ -1664,7 +2044,7 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         runKernelLoop: runUokKernelLoop,
         runLegacyLoop: runLegacyAutoLoop,
     });
-    cleanupAfterLoopExit(ctx);
+    await cleanupAfterLoopExit(ctx);
 }
 // describeNextUnit is imported from auto-dashboard.ts and re-exported
 export { describeNextUnit } from "./auto-dashboard.js";
@@ -1737,7 +2117,12 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         s.currentUnit = null;
         s.pendingQuickTasks = [];
     }
-    s.basePath = targetBasePath;
+    // ADR-016 phase 2 / B2 (#5620): hook-trigger basePath transition. Treats
+    // the trigger as a bootstrap variant — if the session is fresh,
+    // `originalBasePath` gets set to `targetBasePath`; if the session was
+    // already active with an established `originalBasePath`, the verb
+    // preserves it.
+    buildLifecycle().adoptSessionRoot(targetBasePath);
     if (!s.orchestration) {
         ensureOrchestrationModule(ctx, pi, s.basePath);
     }
@@ -1748,28 +2133,7 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         id: triggerUnitId,
         startedAt: hookStartedAt,
     };
-    // Ensure cwd matches basePath BEFORE newSession() captures it (#1389).
-    // newSession() snapshots process.cwd() during construction; chdir-ing
-    // afterward leaves the session rooted to whatever cwd was when the call
-    // was made. Must be synchronous — no awaits between chdir and newSession.
-    try {
-        if (process.cwd() !== s.basePath)
-            process.chdir(s.basePath);
-    }
-    catch (err) {
-        const msg = `Failed to chdir before hook newSession (basePath: ${s.basePath}): ${err instanceof Error ? err.message : String(err)}`;
-        logWarning("engine", msg, { file: "auto.ts", basePath: s.basePath, error: err instanceof Error ? err.message : String(err) });
-        ctx.ui.notify(`${msg}. Cancelling hook dispatch to avoid running in the wrong directory.`, "error");
-        if (wasActive) {
-            s.basePath = previousBasePath;
-            s.currentUnit = previousCurrentUnit;
-        }
-        else {
-            s.reset();
-        }
-        return false;
-    }
-    const result = await s.cmdCtx.newSession();
+    const result = await s.cmdCtx.newSession({ workspaceRoot: s.basePath });
     if (result.cancelled) {
         await stopAuto(ctx, pi);
         return false;