gsd-pi 2.80.0-dev.fbe7c8c6f → 2.81.0

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -21,6 +21,7 @@ import { assertGateCoverage, getGatesForTurn, } from "./gate-registry.js";
 import { formatDecisionsCompact, formatRequirementsCompact } from "./structured-data-formatter.js";
 import { readPhaseAnchor, formatAnchorForPrompt } from "./phase-anchor.js";
 import { composeContextModeInstructions, composeInlinedContext } from "./unit-context-composer.js";
+import { readCompactionSnapshot } from "./compaction-snapshot.js";
 import { logWarning } from "./workflow-logger.js";
 import { inlineGraphSubgraph } from "./graph-context.js";
 import { buildExtractionStepsBlock } from "./commands-extract-learnings.js";
@@ -28,12 +29,12 @@ import { resolveSkillManifest, warnIfManifestHasMissingSkills } from "./skill-ma
 import { classifyProject } from "./detection.js";
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
 /**
- * Historical static ceiling for the preamble cap. Kept as an upper bound even
+ * Static ceiling for the preamble cap. Kept as an upper bound even
  * after context-window-aware sizing so large-window users don't suddenly see
- * 10× looser caps than before. Small-window users get a tighter cap derived
+ * 10× looser caps than needed. Small-window users get a tighter cap derived
  * from their configured executor window.
  */
-const MAX_PREAMBLE_CHARS = 30_000;
+const MAX_PREAMBLE_CHARS = 20_000;
 /**
  * Resolve prompt budgets from the configured executor context window.
  *
@@ -162,8 +163,8 @@ function formatCloseoutReviewInstructions(validationContent, validationRel, curr
     ].join("\n");
 }
 function capPreamble(preamble) {
-    // Cap inlined context at min(historical 30K ceiling, scaled inline budget).
-    // The ceiling preserves pre-fix behavior for large-window users; the scaled
+    // Cap inlined context at min(static ceiling, scaled inline budget).
+    // The ceiling bounds repeated auto prompt payloads; the scaled
     // budget tightens the cap for small-window users whose true safe limit is
     // below 30K. `computeBudgets` allocates 40% of total chars to inline context.
     const budget = Math.min(MAX_PREAMBLE_CHARS, resolvePromptBudgets().inlineContextBudgetChars);
@@ -178,8 +179,19 @@ function renderContextModeForPrompt(unitType, base, renderMode = "standalone") {
         renderMode,
     });
 }
-function prependContextModeToBlock(unitType, base, block, renderMode = "standalone") {
+function renderContextModeBlockForPrompt(unitType, base, renderMode = "standalone") {
     const contextMode = renderContextModeForPrompt(unitType, base, renderMode);
+    if (!contextMode)
+        return "";
+    if (renderMode === "nested")
+        return contextMode;
+    const snapshot = readCompactionSnapshot(base);
+    if (!snapshot?.trim())
+        return contextMode;
+    return `${contextMode}\n\n## Context Snapshot\nSource: \`.gsd/last-snapshot.md\`\n\n${snapshot.trimEnd()}`;
+}
+function prependContextModeToBlock(unitType, base, block, renderMode = "standalone") {
+    const contextMode = renderContextModeBlockForPrompt(unitType, base, renderMode);
     if (!contextMode)
         return block;
     if (!block.trim())
@@ -559,9 +571,77 @@ export async function buildSliceSummaryExcerpt(absPath, relPath, sid) {
     }
     catch {
         // Defensive — any parse failure falls back to full inline.
-        return `### ${sid} Summary\nSource: \`${relPath}\`\n\n${content.trim()}`;
+        return `### ${sid} Summary\nSource: \`${relPath}\`\n\n${capMalformedSummary(content, relPath)}`;
     }
 }
+export async function buildTaskSummaryExcerpt(absPath, relPath, tid, options) {
+    const label = options?.blocker ? "Blocker Task Summary" : "Task Summary";
+    const header = `### ${label}: ${tid} (excerpt)\nSource: \`${relPath}\``;
+    const content = absPath ? await loadFile(absPath) : null;
+    if (!content) {
+        return `${header}\n\n_(not found — file does not exist yet)_`;
+    }
+    try {
+        const s = parseSummary(content);
+        if (!s.frontmatter.id) {
+            return `### ${label}: ${tid}\nSource: \`${relPath}\`\n\n${capMalformedSummary(content, relPath)}`;
+        }
+        const lines = [header, ""];
+        if (s.title)
+            lines.push(`**Title:** ${s.title}`);
+        if (s.oneLiner)
+            lines.push(`**One-liner:** ${s.oneLiner}`);
+        if (s.frontmatter.verification_result) {
+            lines.push(`**Verification:** \`${s.frontmatter.verification_result}\``);
+        }
+        lines.push(`**Blocker discovered:** ${s.frontmatter.blocker_discovered ? "yes — read full summary if blocker details are insufficient" : "no"}`);
+        if (s.frontmatter.provides.length > 0)
+            lines.push(`**Provides:** ${s.frontmatter.provides.slice(0, 4).join("; ")}`);
+        if (s.frontmatter.key_decisions.length > 0)
+            lines.push(`**Key decisions:** ${s.frontmatter.key_decisions.slice(0, 4).join("; ")}`);
+        if (s.frontmatter.patterns_established.length > 0)
+            lines.push(`**Patterns established:** ${s.frontmatter.patterns_established.slice(0, 4).join("; ")}`);
+        if (s.frontmatter.key_files.length > 0) {
+            const files = s.frontmatter.key_files.slice(0, 6);
+            const more = s.frontmatter.key_files.length > files.length ? ` (+${s.frontmatter.key_files.length - files.length} more)` : "";
+            lines.push(`**Key files:** ${files.join(", ")}${more}`);
+        }
+        const SECTION_CAP_CHARS = 500;
+        const capSection = (body) => {
+            const trimmed = body.trim();
+            if (trimmed.length <= SECTION_CAP_CHARS)
+                return trimmed;
+            return `${trimmed.slice(0, SECTION_CAP_CHARS)}\n… (truncated — see full \`${relPath}\`)`;
+        };
+        const verification = extractMarkdownSection(content, "Verification");
+        const diagnostics = extractMarkdownSection(content, "Diagnostics");
+        const knownIssues = extractMarkdownSection(content, "Known Issues");
+        if (verification && verification.trim()) {
+            lines.push("", "#### Verification", capSection(verification));
+        }
+        if (diagnostics && diagnostics.trim()) {
+            lines.push("", "#### Diagnostics", capSection(diagnostics));
+        }
+        if (s.deviations && s.deviations.trim()) {
+            lines.push("", "#### Deviations", capSection(s.deviations));
+        }
+        if (knownIssues && knownIssues.trim()) {
+            lines.push("", "#### Known issues", capSection(knownIssues));
+        }
+        lines.push("", `> **On-demand:** read \`${relPath}\` only when this excerpt is absent/truncated or you need fuller blocker, implementation, or file-change evidence.`);
+        return lines.join("\n");
+    }
+    catch {
+        return `### ${label}: ${tid}\nSource: \`${relPath}\`\n\n${capMalformedSummary(content, relPath)}`;
+    }
+}
+function capMalformedSummary(content, relPath) {
+    const trimmed = content.trim();
+    const limit = 1_500;
+    if (trimmed.length <= limit)
+        return trimmed;
+    return `${trimmed.slice(0, limit).trimEnd()}\n\n[Truncated malformed summary — read \`${relPath}\` for full details.]`;
+}
 /**
  * Load and inline dependency slice summaries (full content, not just paths).
  */
@@ -814,12 +894,12 @@ export async function inlineKnowledgeScoped(base, keywords) {
  * plan-milestone, complete-slice, complete-milestone, validate-milestone,
  * reassess-roadmap) previously injected the full KNOWLEDGE.md (~226KB for a
  * real project) on every invocation. This helper scopes by caller-supplied
- * keywords and caps the payload at `maxChars` (default 30,000 chars).
+ * keywords and caps the payload at `maxChars` (default 12,000 chars).
  *
  * Returns null when no KNOWLEDGE.md exists or no entries match any keyword.
  */
 export async function inlineKnowledgeBudgeted(base, keywords, options) {
-    const DEFAULT_MAX_CHARS = 30_000;
+    const DEFAULT_MAX_CHARS = 12_000;
     const HARD_MAX_CHARS = 100_000;
     const raw = Number(options?.maxChars ?? DEFAULT_MAX_CHARS);
     const maxChars = Number.isFinite(raw)
@@ -1812,8 +1892,17 @@ export async function buildPlanSlicePrompt(mid, _midTitle, sid, sTitle, base, le
             `The previous plan-slice attempt was blocked by pre-execution validation.\n` +
             `Gate verdict: ${verdictExcerpt}\n\n` +
             `Blocked references that must be resolved in this plan:\n${findingsList}\n\n` +
-            `Revise the plan so that every reference listed above is satisfied before execution begins. ` +
-            `Do not reproduce the same file paths, package names, or task ordering that caused these failures.`);
+            `**How to fix each type of issue:**\n` +
+            `- **"[file] X doesn't exist and isn't created by prior or same-task outputs"**: ` +
+            `Either (a) add an earlier task that creates X on disk before the task that needs it, ` +
+            `or (b) if this task IS the one that creates X, move X from inputs to expected_output. ` +
+            `Do NOT put X in a task's expected_output if that task only reads or verifies X — only tasks that actually write X to disk should list it in expected_output.\n` +
+            `- **"[file] X: Task T_early reads X but it's created by task T_late (sequence violation)"**: ` +
+            `Either (a) reorder tasks so T_late (the creator) runs before T_early (the reader), ` +
+            `or (b) if T_late doesn't actually create X (it only reads/tests it), remove X from T_late's expected_output entirely.\n` +
+            `- **"[package] P not found on npm"**: Either remove the npm install for P, or use the correct package name.\n\n` +
+            `Every file listed in a task's inputs must either exist on disk already or appear in an earlier task's expected_output. ` +
+            `A task's expected_output must only list files it actually writes to disk.`);
     }
     return renderSlicePrompt({
         mid, sid, sTitle, base,
@@ -2036,11 +2125,9 @@ export async function buildCompleteSlicePrompt(mid, midTitle, sid, sTitle, base,
                 const blocks = [];
                 for (const file of summaryFiles) {
                     const absPath = join(tDir, file);
-                    const content = await loadFile(absPath);
-                    if (!content)
-                        continue;
                     const relPath = `${sRel}/tasks/${file}`;
-                    blocks.push(`### Task Summary: ${file.replace(/-SUMMARY\.md$/i, "")}\nSource: \`${relPath}\`\n\n${content.trim()}`);
+                    const taskId = file.replace(/-SUMMARY\.md$/i, "");
+                    blocks.push(await buildTaskSummaryExcerpt(absPath, relPath, taskId));
                 }
                 return blocks.length > 0 ? blocks.join("\n\n---\n\n") : null;
             }
@@ -2387,7 +2474,7 @@ export async function buildReplanSlicePrompt(mid, midTitle, sid, sTitle, base) {
             const relPath = `${sRel}/tasks/${file}`;
             if (summary.frontmatter.blocker_discovered) {
                 blockerTaskId = summary.frontmatter.id || file.replace(/-SUMMARY\.md$/i, "");
-                inlined.push(`### Blocker Task Summary: ${blockerTaskId}\nSource: \`${relPath}\`\n\n${content.trim()}`);
+                inlined.push(await buildTaskSummaryExcerpt(absPath, relPath, blockerTaskId, { blocker: true }));
             }
         }
     }

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -30,7 +30,49 @@ import { getProjectResearchStatus } from "./project-research-policy.js";
 // Re-export so existing consumers of auto-recovery.ts keep working.
 export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
 export { classifyMilestoneSummaryContent, } from "./milestone-summary-classifier.js";
-// ─── Artifact Resolution & Verification ───────────────────────────────────────
+export function refreshRecoveryDbForArtifact(unitType, unitId) {
+    if (unitType !== "plan-slice" && unitType !== "execute-task")
+        return { ok: true };
+    if (!isDbAvailable())
+        return { ok: true };
+    if (!refreshOpenDatabaseFromDisk()) {
+        return {
+            ok: false,
+            fatal: unitType === "execute-task",
+            reason: `${unitType}-db-refresh-failed`,
+            message: `Stuck recovery found ${unitType} ${unitId} artifacts, but the DB refresh failed.`,
+        };
+    }
+    if (unitType !== "execute-task")
+        return { ok: true };
+    const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
+    if (!mid || !sid || !tid) {
+        return {
+            ok: false,
+            fatal: true,
+            reason: "execute-task-invalid-unit-id",
+            message: `Stuck recovery found execute-task ${unitId} artifacts, but the unit id could not be parsed for DB verification.`,
+        };
+    }
+    const task = getTask(mid, sid, tid);
+    if (!task) {
+        return {
+            ok: false,
+            fatal: true,
+            reason: "execute-task-artifact-db-missing",
+            message: `Stuck recovery found execute-task ${unitId} artifacts, but no matching DB task row exists after refresh.`,
+        };
+    }
+    if (!isClosedStatus(task.status)) {
+        return {
+            ok: false,
+            fatal: true,
+            reason: "execute-task-artifact-db-mismatch",
+            message: `Stuck recovery found execute-task ${unitId} artifacts, but the DB task status is still '${task.status}' after refresh.`,
+        };
+    }
+    return { ok: true };
+}
 function hasCapturedWorkflowPrefs(base) {
     const prefsPath = resolveExpectedArtifactPath("workflow-preferences", "WORKFLOW-PREFS", base);
     if (!prefsPath || !existsSync(prefsPath))

package/dist/resources/extensions/gsd/auto-start.js

@@ -1,3 +1,5 @@
+// Project/App: GSD-2
+// File Purpose: Auto-mode bootstrap, worktree recovery, and fresh-start initialization.
 /**
  * Auto-mode bootstrap — fresh-start initialization path.
  *
@@ -34,6 +36,7 @@ import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
+import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, } from "node:fs";
@@ -43,6 +46,11 @@ import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
 import { validateDirectory } from "./validate-directory.js";
 import { isCustomProvider, resolveDefaultSessionModel, resolveDynamicRoutingConfig, } from "./preferences-models.js";
 import { getSessionModelOverride } from "./session-model-override.js";
+export function resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo) {
+    if (!isRepo || isolationMode !== "none")
+        return null;
+    return currentBranch.startsWith("milestone/") ? integrationBranch : null;
+}
 /**
  * Bootstrap a fresh auto-mode session. Handles everything from git init
  * through secrets collection, returning when ready for the first
@@ -54,6 +62,12 @@ import { getSessionModelOverride } from "./session-model-override.js";
 // Guard constant for consecutive bootstrap attempts that found phase === "complete".
 // Counter moved to AutoSession.consecutiveCompleteBootstraps so s.reset() clears it.
 const MAX_CONSECUTIVE_COMPLETE_BOOTSTRAPS = 2;
+export function hasGitIndexLockForTest(basePath) {
+    return existsSync(join(basePath, ".git", "index.lock"));
+}
+export function _shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, dbAvailable, pathExists = existsSync) {
+    return pathExists(gsdDbPath) && !dbAvailable;
+}
 export async function openProjectDbIfPresent(basePath) {
     const gsdDbPath = resolveProjectRootDbPath(basePath);
     if (!existsSync(gsdDbPath) || isDbAvailable())
@@ -224,8 +238,137 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     }
     return { recovered, warnings };
 }
+/**
+ * Pure decision function for picking which orphan milestone the auto-loop
+ * should resume the merge transition for. Extracted so it can be unit-tested
+ * without spinning up a git repo or a SQLite DB.
+ *
+ * Returns the lexicographically-greatest milestone id (e.g. "M002" beats
+ * "M001") whose branch is unmerged AND has commits ahead of main AND whose
+ * status is `complete`. Lex-ordering matches the project's M00x convention,
+ * which is the most-recently-completed milestone in practice.
+ * `isComplete` errors propagate; `commitsAhead` errors are treated as 0.
+ */
+export function _selectResumableMilestone(branchNames, mergedBranches, isComplete, commitsAhead) {
+    const candidates = [];
+    for (const branch of branchNames) {
+        if (!branch.startsWith("milestone/"))
+            continue;
+        const milestoneId = branch.slice("milestone/".length);
+        if (mergedBranches.has(branch))
+            continue;
+        if (!isComplete(milestoneId))
+            continue;
+        let ahead = 0;
+        try {
+            ahead = commitsAhead(branch);
+        }
+        catch {
+            continue;
+        }
+        if (ahead <= 0)
+            continue;
+        candidates.push(milestoneId);
+    }
+    if (candidates.length === 0)
+        return null;
+    candidates.sort();
+    return candidates[candidates.length - 1];
+}
+/**
+ * Find the most-recent completed milestone whose branch still has unmerged
+ * commits ahead of the integration branch. Used by `bootstrapAutoSession`
+ * to seed `s.currentMilestoneId` so the auto-loop's transition guard at
+ * `phases.ts:730` fires on the first iteration after a process restart —
+ * without this, the in-memory-only `s.currentMilestoneId` is `null` after
+ * restart, the guard short-circuits, and the orphaned milestone branch
+ * never gets merged into main (#5538-followup).
+ *
+ * Returns null when isolation is `none`, the DB is unavailable, or no
+ * orphan candidate exists. All git failures degrade silently — startup
+ * must never block on this defensive lookup.
+ */
+export function findUnmergedCompletedMilestone(basePath, isolationMode) {
+    if (isolationMode === "none")
+        return null;
+    if (!isDbAvailable())
+        return null;
+    let milestoneBranches;
+    try {
+        milestoneBranches = nativeBranchList(basePath, "milestone/*");
+    }
+    catch {
+        return null;
+    }
+    if (milestoneBranches.length === 0)
+        return null;
+    let mainBranch;
+    try {
+        mainBranch = nativeDetectMainBranch(basePath);
+    }
+    catch {
+        mainBranch = "main";
+    }
+    let mergedBranches;
+    try {
+        mergedBranches = new Set(nativeBranchListMerged(basePath, mainBranch, "milestone/*"));
+    }
+    catch {
+        mergedBranches = new Set();
+    }
+    return _selectResumableMilestone(milestoneBranches, mergedBranches, (milestoneId) => {
+        const row = getMilestone(milestoneId);
+        return !!row && row.status === "complete";
+    }, (branch) => nativeCommitCountBetween(basePath, mainBranch, branch));
+}
+/**
+ * Run `mergeAndExit` for a milestone whose worktree/branch finalization
+ * never completed in a prior session — the active-milestone in phase
+ * `complete` with a survivor `milestone/<id>` branch still around.
+ *
+ * Wraps the call in try/catch so a thrown error from `_mergeBranchMode`
+ * (made fail-loud in commit 68ef58a3c) is converted into a user-facing
+ * error notify instead of an unhandled exception that propagates through
+ * `bootstrapAutoSession` to the slash-command caller's `.catch` block.
+ *
+ * Returns `{ merged: true }` on success; `{ merged: false, error }` on
+ * throw — caller decides whether to abort bootstrap.
+ */
+export function _finalizeSurvivorBranch(lifecycle, milestoneId, ui) {
+    ui.notify(`Milestone ${milestoneId} is complete but branch/worktree was not finalized. Running merge now.`, "info");
+    const result = lifecycle.exitMilestone(milestoneId, { merge: true }, { notify: ui.notify.bind(ui) });
+    if (result.ok)
+        return { merged: true };
+    const err = result.cause instanceof Error ? result.cause : new Error(String(result.cause));
+    const msg = err.message;
+    ui.notify(`Survivor-branch finalization for ${milestoneId} failed: ${msg}. Resolve manually and re-run /gsd auto.`, "error");
+    return { merged: false, error: err };
+}
+/**
+ * Merge a milestone whose DB row is `complete` but whose branch is still
+ * unmerged into the integration branch. Called from `bootstrapAutoSession`
+ * for orphans surfaced by `findUnmergedCompletedMilestone`.
+ *
+ * Notifies the user before and after, swallowing errors so a transient git
+ * failure never blocks bootstrap. Returns `{ merged: true }` when the
+ * underlying `mergeAndExit` completes; `{ merged: false, error }` on throw.
+ *
+ * Extracted to keep `bootstrapAutoSession` testable: the merge call and the
+ * notify shape are exercised against a mock resolver in
+ * `tests/orphan-merge-bootstrap.test.ts`.
+ */
+export function _mergeOrphanCompletedMilestone(lifecycle, orphanId, ui) {
+    ui.notify(`Detected unmerged completed milestone ${orphanId}. Merging now.`, "info");
+    const result = lifecycle.exitMilestone(orphanId, { merge: true }, { notify: ui.notify.bind(ui) });
+    if (result.ok)
+        return { merged: true };
+    const err = result.cause instanceof Error ? result.cause : new Error(String(result.cause));
+    const msg = err.message;
+    ui.notify(`Could not merge orphan milestone ${orphanId}: ${msg}. Resolve manually and re-run /gsd auto.`, "warning");
+    return { merged: false, error: err };
+}
 export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, deps, interrupted) {
-    const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildResolver, } = deps;
+    const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildLifecycle, } = deps;
     const dirCheck = validateDirectory(base);
     if (dirCheck.severity === "blocked") {
         ctx.ui.notify(dirCheck.reason, "error");
@@ -420,6 +563,33 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             // Non-fatal — the audit is defensive, never block bootstrap
             logWarning("bootstrap", `orphaned milestone branch audit failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // ── Orphaned preflight-stash audit (#5538-followup) ──
+        // Reapplies pre-merge stashes whose milestone is now complete but whose
+        // postflight pop was skipped by an interrupted merge in a prior session.
+        // Uses `git stash apply` (not pop) so the entry remains as a backup.
+        try {
+            if (isDbAvailable()) {
+                const stashAudit = auditOrphanedPreflightStashes(base, (milestoneId) => {
+                    const row = getMilestone(milestoneId);
+                    return !!row && isClosedStatus(row.status);
+                });
+                for (const entry of stashAudit.applied) {
+                    ctx.ui.notify(`Orphan audit: applied preflight stash ${entry.stashRef} for completed milestone ${entry.milestoneId}. The stash entry is preserved as a backup.`, "info");
+                }
+                for (const msg of stashAudit.warnings) {
+                    ctx.ui.notify(`Orphan audit: ${msg}`, "warning");
+                }
+                if (stashAudit.applied.length > 0) {
+                    debugLog("orphan-stash-audit", {
+                        applied: stashAudit.applied,
+                        warnings: stashAudit.warnings,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            logWarning("bootstrap", `orphaned preflight-stash audit failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         let state = await deriveState(base);
         // Stale worktree state recovery (#654)
         if (state.activeMilestone &&
@@ -476,16 +646,65 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // hasSurvivorBranch after a successful promotion.
         if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
-            ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
-            const resolver = buildResolver();
-            resolver.mergeAndExit(mid, {
-                notify: ctx.ui.notify.bind(ctx.ui),
-            });
+            // Commit 68ef58a3c made `_mergeBranchMode` throw on wrong-branch
+            // instead of returning false silently. Wrap the call so the throw is
+            // converted into an error notify + clean bootstrap abort, not an
+            // unhandled exception propagating to the slash-command caller (#5549
+            // post-merge audit, R2).
+            const finalize = _finalizeSurvivorBranch(buildLifecycle(), mid, ctx.ui);
+            if (!finalize.merged) {
+                return releaseLockAndReturn();
+            }
             invalidateAllCaches();
             state = await deriveState(base);
             // Clear survivor flag — finalization is done
             hasSurvivorBranch = false;
         }
+        // ── Orphan-completed-milestone merge (#5538-followup) ──
+        // A process killed between `complete-milestone` (DB flip + SUMMARY write)
+        // and the loop's transition-guard merge strands the milestone branch
+        // forever: `s.currentMilestoneId` is in-memory only, so on the next
+        // bootstrap the guard at phases.ts:730 sees `mid === s.currentMilestoneId`
+        // and short-circuits.
+        //
+        // The earlier attempt at this fix seeded `s.currentMilestoneId` to the
+        // orphan id pre-state-derivation, but the unconditional assignment at
+        // line 948 (`s.currentMilestoneId = state.activeMilestone?.id ?? null`)
+        // immediately overwrote the seed. Active-merge is the more durable fix:
+        // call `mergeAndExit` directly during bootstrap, then re-derive state so
+        // the loop's normal flow continues without an in-memory hint.
+        //
+        // Mirrors the survivor-finalize block above. Failures degrade to a
+        // warning notify so a transient git error doesn't block bootstrap.
+        {
+            const orphan = findUnmergedCompletedMilestone(base, getIsolationMode(base));
+            if (orphan && orphan !== state.activeMilestone?.id) {
+                const priorBasePath = s.basePath;
+                const priorOriginalBasePath = s.originalBasePath;
+                s.originalBasePath = base;
+                s.basePath = getAutoWorktreePath(base, orphan) ?? base;
+                const result = _mergeOrphanCompletedMilestone(buildLifecycle(), orphan, ctx.ui);
+                if (!result.merged) {
+                    s.basePath = base;
+                    s.originalBasePath = base;
+                    try {
+                        process.chdir(base);
+                    }
+                    catch (err) {
+                        logWarning("bootstrap", `could not restore cwd after orphan merge failure: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    return releaseLockAndReturn();
+                }
+                if (!s.active) {
+                    s.basePath = priorBasePath || base;
+                    s.originalBasePath = priorOriginalBasePath || base;
+                }
+                if (result.merged) {
+                    invalidateAllCaches();
+                    state = await deriveState(base);
+                }
+            }
+        }
         const effectivePrefs = loadEffectiveGSDPreferences(base)?.preferences;
         const { shouldRunDeepProjectSetup } = await import("./auto-dispatch.js");
         const deepProjectStagePending = shouldRunDeepProjectSetup(state, effectivePrefs, base, { hasSurvivorBranch });
@@ -590,7 +809,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.resourceVersionOnStart = readResourceVersion();
         s.pendingQuickTasks = [];
         s.currentUnit = null;
-        s.currentMilestoneId = deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
+        s.currentMilestoneId ??= deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
         s.originalModelId = startModelSnapshot?.id ?? ctx.model?.id ?? null;
         s.originalModelProvider = startModelSnapshot?.provider ?? ctx.model?.provider ?? null;
         s.originalThinkingLevel = startThinkingSnapshot ?? null;
@@ -606,13 +825,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Guard against stale milestone branch when isolation:none (#3613).
         // A prior session with isolation:branch/worktree may have left HEAD on
         // milestone/<MID>. Auto-checkout back to the integration branch.
-        if (getIsolationMode(base) === "none" && nativeIsRepo(base)) {
+        const isolationMode = getIsolationMode(base);
+        const isRepo = nativeIsRepo(base);
+        if (isolationMode === "none" && isRepo) {
             try {
                 const currentBranch = nativeGetCurrentBranch(base);
-                if (currentBranch.startsWith("milestone/")) {
-                    const integrationBranch = nativeDetectMainBranch(base);
-                    nativeCheckoutBranch(base, integrationBranch);
-                    logWarning("bootstrap", `Returned to "${integrationBranch}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
+                const integrationBranch = nativeDetectMainBranch(base);
+                const branchToCheckout = resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo);
+                if (branchToCheckout) {
+                    nativeCheckoutBranch(base, branchToCheckout);
+                    logWarning("bootstrap", `Returned to "${branchToCheckout}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
                 }
             }
             catch (err) {
@@ -637,9 +859,25 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             getIsolationMode(base) !== "none" &&
             !detectWorktreeName(base) &&
             !isUnderGsdWorktrees(base)) {
-            buildResolver().enterMilestone(s.currentMilestoneId, {
+            const enterResult = buildLifecycle().enterMilestone(s.currentMilestoneId, {
                 notify: ctx.ui.notify.bind(ctx.ui),
             });
+            if (!enterResult.ok) {
+                s.active = false;
+                if (enterResult.reason === "lease-conflict") {
+                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: lease is held by another worker.`, "error");
+                }
+                else if (enterResult.reason === "creation-failed") {
+                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: worktree/branch creation failed. Isolation is degraded.`, "error");
+                }
+                else if (enterResult.reason === "invalid-milestone-id") {
+                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: milestone id is invalid.`, "error");
+                }
+                else {
+                    ctx.ui.notify(`Auto-mode bootstrap stopped: failed to enter milestone ${s.currentMilestoneId} (${enterResult.reason}).`, "error");
+                }
+                return releaseLockAndReturn();
+            }
             if (s.basePath !== base) {
                 // Successfully entered worktree — re-register SIGTERM handler at original base
                 registerSigtermHandler(s.originalBasePath);
@@ -657,7 +895,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 logError("engine", `failed to initialize project database: ${err.message}`);
             }
         }
-        if (existsSync(gsdDbPath) && !isDbAvailable()) {
+        if (_shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, isDbAvailable())) {
             try {
                 const { openDatabase: openDb } = await import("./gsd-db.js");
                 openDb(gsdDbPath);

package/dist/resources/extensions/gsd/auto-supervisor.js

@@ -24,7 +24,7 @@ let _currentSigtermHandler = null;
  *
  * Returns the new handler so the caller can store and deregister it later.
  */
-export function registerSigtermHandler(currentBasePath, previousHandler) {
+export function registerSigtermHandler(currentBasePath, previousHandler, onSignalCleanup) {
     // Remove the explicitly-passed previous handler
     if (previousHandler) {
         for (const sig of CLEANUP_SIGNALS)
@@ -37,6 +37,13 @@ export function registerSigtermHandler(currentBasePath, previousHandler) {
             process.off(sig, _currentSigtermHandler);
     }
     const handler = () => {
+        try {
+            onSignalCleanup?.();
+        }
+        catch {
+            void 0;
+            // Signal cleanup is best-effort; lock cleanup and process exit still run.
+        }
         clearLock(currentBasePath);
         releaseSessionLock(currentBasePath);
         process.exit(0);

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -35,13 +35,13 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
             recovery: status,
         });
-        const durableComplete = status.summaryExists && status.taskChecked && status.nextActionAdvanced;
+        const durableComplete = status.dbComplete || (status.summaryExists && status.taskChecked && status.nextActionAdvanced);
         if (durableComplete) {
             writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
                 phase: "finalized",
                 recovery: status,
             });
-            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
+            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
             bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";