gsd-pi 2.80.0 → 2.81.0

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -12,7 +12,7 @@ import { appendEvent } from "./workflow-events.js";
 import { atomicWriteSync } from "./atomic-write.js";
 import { clearParseCache } from "./files.js";
 import { parseRoadmap as parseLegacyRoadmap, parsePlan as parseLegacyPlan } from "./parsers-legacy.js";
-import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice, getMilestone, refreshOpenDatabaseFromDisk } from "./gsd-db.js";
+import { isDbAvailable, getTask, getSlice, getSliceTasks, getPendingGates, updateTaskStatus, updateSliceStatus, insertSlice, getMilestone, refreshOpenDatabaseFromDisk, getCompletedMilestoneTaskFileHints, getMilestoneCommitAttributionShas, recordMilestoneCommitAttribution } from "./gsd-db.js";
 import { isValidationTerminal } from "./state.js";
 import { getErrorMessage } from "./error-utils.js";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -30,7 +30,49 @@ import { getProjectResearchStatus } from "./project-research-policy.js";
 // Re-export so existing consumers of auto-recovery.ts keep working.
 export { resolveExpectedArtifactPath, diagnoseExpectedArtifact };
 export { classifyMilestoneSummaryContent, } from "./milestone-summary-classifier.js";
-// ─── Artifact Resolution & Verification ───────────────────────────────────────
+export function refreshRecoveryDbForArtifact(unitType, unitId) {
+    if (unitType !== "plan-slice" && unitType !== "execute-task")
+        return { ok: true };
+    if (!isDbAvailable())
+        return { ok: true };
+    if (!refreshOpenDatabaseFromDisk()) {
+        return {
+            ok: false,
+            fatal: unitType === "execute-task",
+            reason: `${unitType}-db-refresh-failed`,
+            message: `Stuck recovery found ${unitType} ${unitId} artifacts, but the DB refresh failed.`,
+        };
+    }
+    if (unitType !== "execute-task")
+        return { ok: true };
+    const { milestone: mid, slice: sid, task: tid } = parseUnitId(unitId);
+    if (!mid || !sid || !tid) {
+        return {
+            ok: false,
+            fatal: true,
+            reason: "execute-task-invalid-unit-id",
+            message: `Stuck recovery found execute-task ${unitId} artifacts, but the unit id could not be parsed for DB verification.`,
+        };
+    }
+    const task = getTask(mid, sid, tid);
+    if (!task) {
+        return {
+            ok: false,
+            fatal: true,
+            reason: "execute-task-artifact-db-missing",
+            message: `Stuck recovery found execute-task ${unitId} artifacts, but no matching DB task row exists after refresh.`,
+        };
+    }
+    if (!isClosedStatus(task.status)) {
+        return {
+            ok: false,
+            fatal: true,
+            reason: "execute-task-artifact-db-mismatch",
+            message: `Stuck recovery found execute-task ${unitId} artifacts, but the DB task status is still '${task.status}' after refresh.`,
+        };
+    }
+    return { ok: true };
+}
 function hasCapturedWorkflowPrefs(base) {
     const prefsPath = resolveExpectedArtifactPath("workflow-preferences", "WORKFLOW-PREFS", base);
     if (!prefsPath || !existsSync(prefsPath))
@@ -110,17 +152,32 @@ export function hasImplementationArtifacts(basePath, milestoneId) {
         // milestone commits instead of treating the self-diff as proof of no work.
         if (changedFiles.length === 0) {
             if (milestoneId && currentBranch === integrationBranch) {
-                const tagged = getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId);
-                if (!tagged.ok)
+                const milestoneEvidence = getChangedFilesFromMilestoneEvidence(basePath, milestoneId);
+                if (!milestoneEvidence.ok)
                     return "unknown";
-                if (tagged.matched)
-                    return classifyImplementationFiles(tagged.files);
+                if (milestoneEvidence.matched)
+                    return classifyImplementationFiles(milestoneEvidence.files);
             }
             if (currentBranch && currentBranch !== "HEAD")
                 return "absent";
             return "unknown";
         }
-        return classifyImplementationFiles(changedFiles);
+        const branchClassification = classifyImplementationFiles(changedFiles);
+        if (branchClassification === "present")
+            return "present";
+        // A completing milestone branch can have a non-empty diff containing only
+        // .gsd/ closeout files after implementation commits already landed on the
+        // recorded integration branch. In that topology, the branch diff alone is
+        // insufficient; use the same milestone-tagged evidence fallback as the
+        // self-diff retry path before declaring the milestone implementation-free.
+        if (milestoneId) {
+            const milestoneEvidence = getChangedFilesFromMilestoneEvidence(basePath, milestoneId);
+            if (!milestoneEvidence.ok)
+                return "unknown";
+            if (milestoneEvidence.matched)
+                return classifyImplementationFiles(milestoneEvidence.files);
+        }
+        return "absent";
     }
     catch (e) {
         // Non-fatal — if git operations fail, return unknown so callers can decide
@@ -148,6 +205,9 @@ function classifyImplementationFiles(files) {
 function isImplementationPath(file) {
     return !file.startsWith(".gsd/") && !file.startsWith(".gsd\\");
 }
+function normalizeRepoPath(file) {
+    return file.trim().replace(/\\/g, "/").replace(/^\.\/+/, "");
+}
 /**
  * Detect the main/master branch name.
  */
@@ -217,7 +277,7 @@ function getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId) {
     ]);
     if (!scoped.ok)
         return scoped;
-    if (scoped.matched)
+    if (scoped.matched && classifyImplementationFiles(scoped.files) === "present")
         return scoped;
     // Fallback (#5033): when .gsd/ is gitignored / external / untracked, the
     // path-scoped scan matches no commits even though GSD-tagged commits
@@ -228,9 +288,137 @@ function getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId) {
     // Intentionally unbounded — symmetric with the primary scan, and avoids
     // reintroducing the rolling-depth failure class removed in #4699 where
     // milestone evidence aged out behind unrelated activity.
-    return scanGsdTaggedCommits(basePath, milestoneId, [
+    const unscoped = scanGsdTaggedCommits(basePath, milestoneId, [
         "log", "--format=%H%x1f%B%x1e", "HEAD",
     ]);
+    if (!unscoped.ok)
+        return scoped.matched ? scoped : unscoped;
+    if (!unscoped.matched)
+        return scoped;
+    return {
+        ok: true,
+        matched: true,
+        files: [...new Set([...scoped.files, ...unscoped.files])],
+    };
+}
+function getChangedFilesFromMilestoneEvidence(basePath, milestoneId) {
+    const tagged = getChangedFilesFromMilestoneTaggedCommits(basePath, milestoneId);
+    if (!tagged.ok)
+        return tagged;
+    if (tagged.matched && classifyImplementationFiles(tagged.files) === "present")
+        return tagged;
+    const attributed = getChangedFilesFromAttributedMilestoneCommits(basePath, milestoneId);
+    if (!attributed.ok)
+        return tagged.matched ? tagged : attributed;
+    if (attributed.matched && classifyImplementationFiles(attributed.files) === "present")
+        return attributed;
+    const backfilled = backfillChangedFilesFromUntaggedMilestoneCommits(basePath, milestoneId);
+    if (!backfilled.ok)
+        return tagged.matched ? tagged : attributed.matched ? attributed : backfilled;
+    if (!backfilled.matched) {
+        if (tagged.matched)
+            return tagged;
+        return attributed.matched ? attributed : backfilled;
+    }
+    return {
+        ok: true,
+        matched: true,
+        files: [...new Set([...tagged.files, ...attributed.files, ...backfilled.files])],
+    };
+}
+function getChangedFilesFromAttributedMilestoneCommits(basePath, milestoneId) {
+    try {
+        const shas = getMilestoneCommitAttributionShas(milestoneId);
+        if (shas.length === 0)
+            return { ok: true, matched: false, files: [] };
+        const files = new Set();
+        let matched = false;
+        for (const sha of shas) {
+            if (!isFullCommitSha(sha))
+                continue;
+            const commitFiles = getChangedFilesForCommit(basePath, sha);
+            if (commitFiles.length === 0)
+                continue;
+            matched = true;
+            for (const file of commitFiles)
+                files.add(file);
+        }
+        return { ok: true, matched, files: [...files] };
+    }
+    catch (e) {
+        logWarning("recovery", `milestone attribution scan failed: ${e.message}`);
+        return { ok: false, matched: false, files: [] };
+    }
+}
+function backfillChangedFilesFromUntaggedMilestoneCommits(basePath, milestoneId) {
+    try {
+        const milestone = getMilestone(milestoneId);
+        const milestoneStartedAt = milestone?.created_at ? Math.floor(Date.parse(milestone.created_at) / 1000) * 1000 : NaN;
+        if (!Number.isFinite(milestoneStartedAt))
+            return { ok: true, matched: false, files: [] };
+        const taskFileHints = getCompletedMilestoneTaskFileHints(milestoneId);
+        if (taskFileHints.length === 0)
+            return { ok: true, matched: false, files: [] };
+        const hintSet = new Set(taskFileHints.map(normalizeRepoPath).filter(Boolean));
+        if (hintSet.size === 0)
+            return { ok: true, matched: false, files: [] };
+        const records = getCommitRecords(basePath);
+        const files = new Set();
+        let matched = false;
+        for (const record of records) {
+            if (!isFullCommitSha(record.hash))
+                continue;
+            if (Date.parse(record.committedAt) < milestoneStartedAt)
+                continue;
+            if (record.parents.trim().split(/\s+/).filter(Boolean).length > 1)
+                continue;
+            if (commitMessageHasGsdTrailer(record.message))
+                continue;
+            const commitFiles = getChangedFilesForCommit(basePath, record.hash);
+            const implementationFiles = commitFiles.map(normalizeRepoPath).filter(isImplementationPath);
+            if (implementationFiles.length === 0)
+                continue;
+            if (!implementationFiles.some((file) => hintSet.has(file)))
+                continue;
+            matched = true;
+            for (const file of implementationFiles)
+                files.add(file);
+            recordMilestoneCommitAttribution({
+                commitSha: record.hash,
+                milestoneId,
+                source: "backfill",
+                confidence: 0.8,
+                files: implementationFiles,
+                createdAt: new Date().toISOString(),
+            });
+        }
+        return { ok: true, matched, files: [...files] };
+    }
+    catch (e) {
+        logWarning("recovery", `milestone attribution backfill failed: ${e.message}`);
+        return { ok: false, matched: false, files: [] };
+    }
+}
+function getCommitRecords(basePath) {
+    const logOutput = execFileSync("git", ["log", "--format=%H%x1f%P%x1f%cI%x1f%B%x1e", "HEAD"], {
+        cwd: basePath,
+        stdio: ["ignore", "pipe", "pipe"],
+        encoding: "utf-8",
+    });
+    return logOutput
+        .split("\x1e")
+        .map((record) => record.trim())
+        .filter(Boolean)
+        .flatMap((record) => {
+        const parts = record.split("\x1f");
+        if (parts.length < 4)
+            return [];
+        const [hash, parents, committedAt, ...messageParts] = parts;
+        return [{ hash: hash.trim(), parents: parents.trim(), committedAt: committedAt.trim(), message: messageParts.join("\x1f") }];
+    });
+}
+function isFullCommitSha(value) {
+    return /^[0-9a-f]{40}$/i.test(value);
 }
 function scanGsdTaggedCommits(basePath, milestoneId, gitArgs) {
     try {

package/dist/resources/extensions/gsd/auto-start.js

@@ -1,3 +1,5 @@
+// Project/App: GSD-2
+// File Purpose: Auto-mode bootstrap, worktree recovery, and fresh-start initialization.
 /**
  * Auto-mode bootstrap — fresh-start initialization path.
  *
@@ -34,6 +36,7 @@ import { snapshotSkills } from "./skill-discovery.js";
 import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
+import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
 import { debugLog, enableDebug, isDebugEnabled, getDebugLogPath, } from "./debug-logger.js";
 import { logWarning, logError } from "./workflow-logger.js";
 import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, } from "node:fs";
@@ -43,6 +46,11 @@ import { resolveProjectRootDbPath } from "./bootstrap/dynamic-tools.js";
 import { validateDirectory } from "./validate-directory.js";
 import { isCustomProvider, resolveDefaultSessionModel, resolveDynamicRoutingConfig, } from "./preferences-models.js";
 import { getSessionModelOverride } from "./session-model-override.js";
+export function resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo) {
+    if (!isRepo || isolationMode !== "none")
+        return null;
+    return currentBranch.startsWith("milestone/") ? integrationBranch : null;
+}
 /**
  * Bootstrap a fresh auto-mode session. Handles everything from git init
  * through secrets collection, returning when ready for the first
@@ -54,6 +62,12 @@ import { getSessionModelOverride } from "./session-model-override.js";
 // Guard constant for consecutive bootstrap attempts that found phase === "complete".
 // Counter moved to AutoSession.consecutiveCompleteBootstraps so s.reset() clears it.
 const MAX_CONSECUTIVE_COMPLETE_BOOTSTRAPS = 2;
+export function hasGitIndexLockForTest(basePath) {
+    return existsSync(join(basePath, ".git", "index.lock"));
+}
+export function _shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, dbAvailable, pathExists = existsSync) {
+    return pathExists(gsdDbPath) && !dbAvailable;
+}
 export async function openProjectDbIfPresent(basePath) {
     const gsdDbPath = resolveProjectRootDbPath(basePath);
     if (!existsSync(gsdDbPath) || isDbAvailable())
@@ -224,8 +238,137 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     }
     return { recovered, warnings };
 }
+/**
+ * Pure decision function for picking which orphan milestone the auto-loop
+ * should resume the merge transition for. Extracted so it can be unit-tested
+ * without spinning up a git repo or a SQLite DB.
+ *
+ * Returns the lexicographically-greatest milestone id (e.g. "M002" beats
+ * "M001") whose branch is unmerged AND has commits ahead of main AND whose
+ * status is `complete`. Lex-ordering matches the project's M00x convention,
+ * which is the most-recently-completed milestone in practice.
+ * `isComplete` errors propagate; `commitsAhead` errors are treated as 0.
+ */
+export function _selectResumableMilestone(branchNames, mergedBranches, isComplete, commitsAhead) {
+    const candidates = [];
+    for (const branch of branchNames) {
+        if (!branch.startsWith("milestone/"))
+            continue;
+        const milestoneId = branch.slice("milestone/".length);
+        if (mergedBranches.has(branch))
+            continue;
+        if (!isComplete(milestoneId))
+            continue;
+        let ahead = 0;
+        try {
+            ahead = commitsAhead(branch);
+        }
+        catch {
+            continue;
+        }
+        if (ahead <= 0)
+            continue;
+        candidates.push(milestoneId);
+    }
+    if (candidates.length === 0)
+        return null;
+    candidates.sort();
+    return candidates[candidates.length - 1];
+}
+/**
+ * Find the most-recent completed milestone whose branch still has unmerged
+ * commits ahead of the integration branch. Used by `bootstrapAutoSession`
+ * to seed `s.currentMilestoneId` so the auto-loop's transition guard at
+ * `phases.ts:730` fires on the first iteration after a process restart —
+ * without this, the in-memory-only `s.currentMilestoneId` is `null` after
+ * restart, the guard short-circuits, and the orphaned milestone branch
+ * never gets merged into main (#5538-followup).
+ *
+ * Returns null when isolation is `none`, the DB is unavailable, or no
+ * orphan candidate exists. All git failures degrade silently — startup
+ * must never block on this defensive lookup.
+ */
+export function findUnmergedCompletedMilestone(basePath, isolationMode) {
+    if (isolationMode === "none")
+        return null;
+    if (!isDbAvailable())
+        return null;
+    let milestoneBranches;
+    try {
+        milestoneBranches = nativeBranchList(basePath, "milestone/*");
+    }
+    catch {
+        return null;
+    }
+    if (milestoneBranches.length === 0)
+        return null;
+    let mainBranch;
+    try {
+        mainBranch = nativeDetectMainBranch(basePath);
+    }
+    catch {
+        mainBranch = "main";
+    }
+    let mergedBranches;
+    try {
+        mergedBranches = new Set(nativeBranchListMerged(basePath, mainBranch, "milestone/*"));
+    }
+    catch {
+        mergedBranches = new Set();
+    }
+    return _selectResumableMilestone(milestoneBranches, mergedBranches, (milestoneId) => {
+        const row = getMilestone(milestoneId);
+        return !!row && row.status === "complete";
+    }, (branch) => nativeCommitCountBetween(basePath, mainBranch, branch));
+}
+/**
+ * Run `mergeAndExit` for a milestone whose worktree/branch finalization
+ * never completed in a prior session — the active-milestone in phase
+ * `complete` with a survivor `milestone/<id>` branch still around.
+ *
+ * Wraps the call in try/catch so a thrown error from `_mergeBranchMode`
+ * (made fail-loud in commit 68ef58a3c) is converted into a user-facing
+ * error notify instead of an unhandled exception that propagates through
+ * `bootstrapAutoSession` to the slash-command caller's `.catch` block.
+ *
+ * Returns `{ merged: true }` on success; `{ merged: false, error }` on
+ * throw — caller decides whether to abort bootstrap.
+ */
+export function _finalizeSurvivorBranch(lifecycle, milestoneId, ui) {
+    ui.notify(`Milestone ${milestoneId} is complete but branch/worktree was not finalized. Running merge now.`, "info");
+    const result = lifecycle.exitMilestone(milestoneId, { merge: true }, { notify: ui.notify.bind(ui) });
+    if (result.ok)
+        return { merged: true };
+    const err = result.cause instanceof Error ? result.cause : new Error(String(result.cause));
+    const msg = err.message;
+    ui.notify(`Survivor-branch finalization for ${milestoneId} failed: ${msg}. Resolve manually and re-run /gsd auto.`, "error");
+    return { merged: false, error: err };
+}
+/**
+ * Merge a milestone whose DB row is `complete` but whose branch is still
+ * unmerged into the integration branch. Called from `bootstrapAutoSession`
+ * for orphans surfaced by `findUnmergedCompletedMilestone`.
+ *
+ * Notifies the user before and after, swallowing errors so a transient git
+ * failure never blocks bootstrap. Returns `{ merged: true }` when the
+ * underlying `mergeAndExit` completes; `{ merged: false, error }` on throw.
+ *
+ * Extracted to keep `bootstrapAutoSession` testable: the merge call and the
+ * notify shape are exercised against a mock resolver in
+ * `tests/orphan-merge-bootstrap.test.ts`.
+ */
+export function _mergeOrphanCompletedMilestone(lifecycle, orphanId, ui) {
+    ui.notify(`Detected unmerged completed milestone ${orphanId}. Merging now.`, "info");
+    const result = lifecycle.exitMilestone(orphanId, { merge: true }, { notify: ui.notify.bind(ui) });
+    if (result.ok)
+        return { merged: true };
+    const err = result.cause instanceof Error ? result.cause : new Error(String(result.cause));
+    const msg = err.message;
+    ui.notify(`Could not merge orphan milestone ${orphanId}: ${msg}. Resolve manually and re-run /gsd auto.`, "warning");
+    return { merged: false, error: err };
+}
 export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, deps, interrupted) {
-    const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildResolver, } = deps;
+    const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildLifecycle, } = deps;
     const dirCheck = validateDirectory(base);
     if (dirCheck.severity === "blocked") {
         ctx.ui.notify(dirCheck.reason, "error");
@@ -420,6 +563,33 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             // Non-fatal — the audit is defensive, never block bootstrap
             logWarning("bootstrap", `orphaned milestone branch audit failed: ${err instanceof Error ? err.message : String(err)}`);
         }
+        // ── Orphaned preflight-stash audit (#5538-followup) ──
+        // Reapplies pre-merge stashes whose milestone is now complete but whose
+        // postflight pop was skipped by an interrupted merge in a prior session.
+        // Uses `git stash apply` (not pop) so the entry remains as a backup.
+        try {
+            if (isDbAvailable()) {
+                const stashAudit = auditOrphanedPreflightStashes(base, (milestoneId) => {
+                    const row = getMilestone(milestoneId);
+                    return !!row && isClosedStatus(row.status);
+                });
+                for (const entry of stashAudit.applied) {
+                    ctx.ui.notify(`Orphan audit: applied preflight stash ${entry.stashRef} for completed milestone ${entry.milestoneId}. The stash entry is preserved as a backup.`, "info");
+                }
+                for (const msg of stashAudit.warnings) {
+                    ctx.ui.notify(`Orphan audit: ${msg}`, "warning");
+                }
+                if (stashAudit.applied.length > 0) {
+                    debugLog("orphan-stash-audit", {
+                        applied: stashAudit.applied,
+                        warnings: stashAudit.warnings,
+                    });
+                }
+            }
+        }
+        catch (err) {
+            logWarning("bootstrap", `orphaned preflight-stash audit failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
         let state = await deriveState(base);
         // Stale worktree state recovery (#654)
         if (state.activeMilestone &&
@@ -476,20 +646,68 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // hasSurvivorBranch after a successful promotion.
         if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
             const mid = state.activeMilestone.id;
-            ctx.ui.notify(`Milestone ${mid} is complete but branch/worktree was not finalized. Running merge now.`, "info");
-            const resolver = buildResolver();
-            resolver.mergeAndExit(mid, {
-                notify: ctx.ui.notify.bind(ctx.ui),
-            });
+            // Commit 68ef58a3c made `_mergeBranchMode` throw on wrong-branch
+            // instead of returning false silently. Wrap the call so the throw is
+            // converted into an error notify + clean bootstrap abort, not an
+            // unhandled exception propagating to the slash-command caller (#5549
+            // post-merge audit, R2).
+            const finalize = _finalizeSurvivorBranch(buildLifecycle(), mid, ctx.ui);
+            if (!finalize.merged) {
+                return releaseLockAndReturn();
+            }
             invalidateAllCaches();
             state = await deriveState(base);
             // Clear survivor flag — finalization is done
             hasSurvivorBranch = false;
         }
+        // ── Orphan-completed-milestone merge (#5538-followup) ──
+        // A process killed between `complete-milestone` (DB flip + SUMMARY write)
+        // and the loop's transition-guard merge strands the milestone branch
+        // forever: `s.currentMilestoneId` is in-memory only, so on the next
+        // bootstrap the guard at phases.ts:730 sees `mid === s.currentMilestoneId`
+        // and short-circuits.
+        //
+        // The earlier attempt at this fix seeded `s.currentMilestoneId` to the
+        // orphan id pre-state-derivation, but the unconditional assignment at
+        // line 948 (`s.currentMilestoneId = state.activeMilestone?.id ?? null`)
+        // immediately overwrote the seed. Active-merge is the more durable fix:
+        // call `mergeAndExit` directly during bootstrap, then re-derive state so
+        // the loop's normal flow continues without an in-memory hint.
+        //
+        // Mirrors the survivor-finalize block above. Failures degrade to a
+        // warning notify so a transient git error doesn't block bootstrap.
+        {
+            const orphan = findUnmergedCompletedMilestone(base, getIsolationMode(base));
+            if (orphan && orphan !== state.activeMilestone?.id) {
+                const priorBasePath = s.basePath;
+                const priorOriginalBasePath = s.originalBasePath;
+                s.originalBasePath = base;
+                s.basePath = getAutoWorktreePath(base, orphan) ?? base;
+                const result = _mergeOrphanCompletedMilestone(buildLifecycle(), orphan, ctx.ui);
+                if (!result.merged) {
+                    s.basePath = base;
+                    s.originalBasePath = base;
+                    try {
+                        process.chdir(base);
+                    }
+                    catch (err) {
+                        logWarning("bootstrap", `could not restore cwd after orphan merge failure: ${err instanceof Error ? err.message : String(err)}`);
+                    }
+                    return releaseLockAndReturn();
+                }
+                if (!s.active) {
+                    s.basePath = priorBasePath || base;
+                    s.originalBasePath = priorOriginalBasePath || base;
+                }
+                if (result.merged) {
+                    invalidateAllCaches();
+                    state = await deriveState(base);
+                }
+            }
+        }
         const effectivePrefs = loadEffectiveGSDPreferences(base)?.preferences;
-        const deepProjectStagePending = !hasSurvivorBranch
-            ? (await import("./auto-dispatch.js")).hasPendingDeepStage(effectivePrefs, base)
-            : false;
+        const { shouldRunDeepProjectSetup } = await import("./auto-dispatch.js");
+        const deepProjectStagePending = shouldRunDeepProjectSetup(state, effectivePrefs, base, { hasSurvivorBranch });
         if (deepProjectStagePending) {
             // Deep project-level setup runs before the first milestone exists. Let
             // the auto loop dispatch workflow-preferences / project / requirements
@@ -591,7 +809,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.resourceVersionOnStart = readResourceVersion();
         s.pendingQuickTasks = [];
         s.currentUnit = null;
-        s.currentMilestoneId = deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
+        s.currentMilestoneId ??= deepProjectStagePending ? null : state.activeMilestone?.id ?? null;
         s.originalModelId = startModelSnapshot?.id ?? ctx.model?.id ?? null;
         s.originalModelProvider = startModelSnapshot?.provider ?? ctx.model?.provider ?? null;
         s.originalThinkingLevel = startThinkingSnapshot ?? null;
@@ -607,13 +825,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Guard against stale milestone branch when isolation:none (#3613).
         // A prior session with isolation:branch/worktree may have left HEAD on
         // milestone/<MID>. Auto-checkout back to the integration branch.
-        if (getIsolationMode(base) === "none" && nativeIsRepo(base)) {
+        const isolationMode = getIsolationMode(base);
+        const isRepo = nativeIsRepo(base);
+        if (isolationMode === "none" && isRepo) {
             try {
                 const currentBranch = nativeGetCurrentBranch(base);
-                if (currentBranch.startsWith("milestone/")) {
-                    const integrationBranch = nativeDetectMainBranch(base);
-                    nativeCheckoutBranch(base, integrationBranch);
-                    logWarning("bootstrap", `Returned to "${integrationBranch}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
+                const integrationBranch = nativeDetectMainBranch(base);
+                const branchToCheckout = resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo);
+                if (branchToCheckout) {
+                    nativeCheckoutBranch(base, branchToCheckout);
+                    logWarning("bootstrap", `Returned to "${branchToCheckout}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
                 }
             }
             catch (err) {
@@ -638,9 +859,25 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             getIsolationMode(base) !== "none" &&
             !detectWorktreeName(base) &&
             !isUnderGsdWorktrees(base)) {
-            buildResolver().enterMilestone(s.currentMilestoneId, {
+            const enterResult = buildLifecycle().enterMilestone(s.currentMilestoneId, {
                 notify: ctx.ui.notify.bind(ctx.ui),
             });
+            if (!enterResult.ok) {
+                s.active = false;
+                if (enterResult.reason === "lease-conflict") {
+                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: lease is held by another worker.`, "error");
+                }
+                else if (enterResult.reason === "creation-failed") {
+                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: worktree/branch creation failed. Isolation is degraded.`, "error");
+                }
+                else if (enterResult.reason === "invalid-milestone-id") {
+                    ctx.ui.notify(`Cannot enter milestone ${s.currentMilestoneId}: milestone id is invalid.`, "error");
+                }
+                else {
+                    ctx.ui.notify(`Auto-mode bootstrap stopped: failed to enter milestone ${s.currentMilestoneId} (${enterResult.reason}).`, "error");
+                }
+                return releaseLockAndReturn();
+            }
             if (s.basePath !== base) {
                 // Successfully entered worktree — re-register SIGTERM handler at original base
                 registerSigtermHandler(s.originalBasePath);
@@ -658,7 +895,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 logError("engine", `failed to initialize project database: ${err.message}`);
             }
         }
-        if (existsSync(gsdDbPath) && !isDbAvailable()) {
+        if (_shouldAbortBootstrapForUnavailableDbForTest(gsdDbPath, isDbAvailable())) {
             try {
                 const { openDatabase: openDb } = await import("./gsd-db.js");
                 openDb(gsdDbPath);

package/dist/resources/extensions/gsd/auto-supervisor.js

@@ -24,7 +24,7 @@ let _currentSigtermHandler = null;
  *
  * Returns the new handler so the caller can store and deregister it later.
  */
-export function registerSigtermHandler(currentBasePath, previousHandler) {
+export function registerSigtermHandler(currentBasePath, previousHandler, onSignalCleanup) {
     // Remove the explicitly-passed previous handler
     if (previousHandler) {
         for (const sig of CLEANUP_SIGNALS)
@@ -37,6 +37,13 @@ export function registerSigtermHandler(currentBasePath, previousHandler) {
             process.off(sig, _currentSigtermHandler);
     }
     const handler = () => {
+        try {
+            onSignalCleanup?.();
+        }
+        catch {
+            void 0;
+            // Signal cleanup is best-effort; lock cleanup and process exit still run.
+        }
         clearLock(currentBasePath);
         releaseSessionLock(currentBasePath);
         process.exit(0);

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -35,13 +35,13 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
         writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
             recovery: status,
         });
-        const durableComplete = status.summaryExists && status.taskChecked && status.nextActionAdvanced;
+        const durableComplete = status.dbComplete || (status.summaryExists && status.taskChecked && status.nextActionAdvanced);
         if (durableComplete) {
             writeUnitRuntimeRecord(basePath, unitType, unitId, currentUnitStartedAt, {
                 phase: "finalized",
                 recovery: status,
             });
-            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed on disk. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
+            ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: ${unitType} ${unitId} already completed. Continuing auto-mode. (attempt ${attemptNumber})`, "info");
             unitRecoveryCount.delete(recoveryKey);
             bumpAndResolveSynthetic(`timeout-recovery:${reason}:${unitType}/${unitId}`);
             return "recovered";

package/dist/resources/extensions/gsd/auto-verification.js

@@ -1,14 +1,5 @@
-/**
- * Post-unit verification gate for auto-mode.
- *
- * Runs typecheck/lint/test checks, captures runtime errors, performs
- * dependency audits, handles auto-fix retry logic, and writes
- * verification evidence JSON.
- *
- * Extracted from the pre-loop agent_end handler in auto.ts. Returns a
- * sentinel value instead of calling return/pauseAuto directly — the
- * caller checks the result and handles control flow.
- */
+// Project/App: GSD-2
+// File Purpose: Post-unit verification gate for GSD auto-mode units.
 import { mkdirSync, writeFileSync } from "node:fs";
 import { resolveSlicePath, resolveMilestoneFile } from "./paths.js";
 import { parseUnitId } from "./unit-id.js";