gsd-pi 2.80.0 → 2.81.0

package/src/resources/extensions/gsd/memory-store.ts

@@ -44,6 +44,8 @@ export interface Memory {
    * decisions table (Step 5) with the original scope/decision/choice/etc.
    */
   structured_fields: Record<string, unknown> | null;
+  /** ISO timestamp of the most recent memory_query hit. NULL until first hit. */
+  last_hit_at: string | null;
 }
 
 export type MemoryActionCreate = {
@@ -100,6 +102,27 @@ const CATEGORY_PRIORITY: Record<string, number> = {
   preference: 5,
 };
 
+// ─── Scoring Helpers ─────────────────────────────────────────────────────────
+
+/**
+ * Time-decay factor for memory relevance scoring.
+ * Returns 1.0 for never-hit or recently-hit memories, decaying linearly to
+ * 0.7 for memories not accessed in 90+ days. Floor at 0.7 keeps old-but-valid
+ * knowledge from being fully suppressed.
+ *
+ * Defensive parsing: invalid timestamp strings (NaN from Date.parse) are
+ * treated as "no decay" rather than propagating NaN into score arithmetic.
+ * Future timestamps (clock skew, manual DB edits) clamp to daysAgo=0 so the
+ * factor stays in the documented [0.7, 1.0] contract.
+ */
+export function memoryDecayFactor(lastHitAt: string | null): number {
+  if (!lastHitAt) return 1.0;
+  const ts = Date.parse(lastHitAt);
+  if (!Number.isFinite(ts)) return 1.0;
+  const daysAgo = Math.max(0, (Date.now() - ts) / 86_400_000);
+  return Math.max(0.7, 1.0 - 0.3 * Math.min(1.0, daysAgo / 90));
+}
+
 // ─── Row Mapping ────────────────────────────────────────────────────────────
 
 function rowToMemory(row: Record<string, unknown>): Memory {
@@ -118,6 +141,7 @@ function rowToMemory(row: Record<string, unknown>): Memory {
     scope: (row['scope'] as string) ?? 'project',
     tags: parseTags(row['tags']),
     structured_fields: parseStructuredFields(row['structured_fields']),
+    last_hit_at: (row['last_hit_at'] as string | null) ?? null,
   };
 }
 
@@ -233,15 +257,39 @@ export function queryMemoriesRanked(opts: QueryMemoriesOptions): RankedMemory[]
     : [];
 
   if (keywordHits.length === 0 && semanticHits.length === 0 && !trimmedQuery) {
-    // No query at all — fall back to the existing ranked-by-score listing.
-    return getActiveMemoriesRanked(k).map((memory) => ({
-      memory,
-      score: memory.confidence * (1 + memory.hit_count * 0.1),
-      keywordRank: null,
-      semanticRank: null,
-      confidenceBoost: memory.confidence * (1 + memory.hit_count * 0.1),
-      reason: 'ranked' as const,
-    })).filter((hit) => passesFilters(hit.memory, opts));
+    // No query at all — return top-k by decay-aware ranked score.
+    //
+    // Build the candidate pool from a direct SQL query that honors the
+    // request's activeClause (i.e. include_superseded). Using
+    // getActiveMemoriesRanked here would silently drop superseded rows even
+    // when the caller explicitly opted in, and would slice by raw score
+    // before decay/filters had a chance to reorder.
+    const candidatePool = Math.min(Math.max(k * 5, 50), 500);
+    const rows = adapter
+      .prepare(
+        `SELECT * FROM memories ${activeClause}
+         ORDER BY (confidence * (1.0 + hit_count * 0.1)) DESC
+         LIMIT :limit`,
+      )
+      .all({ ':limit': candidatePool });
+
+    const ranked: RankedMemory[] = [];
+    for (const row of rows) {
+      const memory = rowToMemory(row);
+      if (!passesFilters(memory, opts)) continue;
+      const decay = memoryDecayFactor(memory.last_hit_at);
+      const score = memory.confidence * (1 + memory.hit_count * 0.1) * decay;
+      ranked.push({
+        memory,
+        score,
+        keywordRank: null,
+        semanticRank: null,
+        confidenceBoost: score,
+        reason: 'ranked' as const,
+      });
+    }
+    ranked.sort((a, b) => b.score - a.score);
+    return ranked.slice(0, k);
   }
 
   // 3) Reciprocal rank fusion — each hit contributes 1/(rrfK + rank).
@@ -275,7 +323,7 @@ export function queryMemoriesRanked(opts: QueryMemoriesOptions): RankedMemory[]
   const ranked: RankedMemory[] = [];
   for (const entry of fused.values()) {
     if (!passesFilters(entry.memory, opts)) continue;
-    const boost = entry.memory.confidence * (1 + entry.memory.hit_count * 0.1);
+    const boost = entry.memory.confidence * (1 + entry.memory.hit_count * 0.1) * memoryDecayFactor(entry.memory.last_hit_at);
     const reason: RankedMemory['reason'] =
       entry.kwRank != null && entry.semRank != null
         ? 'both'
@@ -313,6 +361,8 @@ function passesFilters(memory: Memory, filters: QueryMemoriesFilters): boolean {
   return true;
 }
 
+let ftsWarningEmitted = false;
+
 function keywordSearch(
   adapter: NonNullable<ReturnType<typeof _getAdapter>>,
   rawQuery: string,
@@ -340,14 +390,29 @@ function keywordSearch(
     }
   }
 
-  // LIKE fallback — scans the candidate pool.
+  // LIKE fallback — scans a capped candidate pool.
+  if (!ftsWarningEmitted) {
+    ftsWarningEmitted = true;
+    logWarning('memory-store', 'FTS5 unavailable — using LIKE fallback scan (consider enabling FTS5)');
+  }
+
   const terms = rawQuery
     .toLowerCase()
     .split(/[^a-z0-9_]+/)
     .filter((t) => t.length >= 2);
   if (terms.length === 0) return [];
 
-  const rows = adapter.prepare(`SELECT * FROM memories ${activeClause}`).all();
+  const preScanCap = Math.min(limit * 20, 2000);
+  // ORDER BY confidence-weighted hit_count DESC so the cap keeps the most
+  // valuable candidates instead of the oldest-by-rowid (which would silently
+  // exclude recently-stored memories on tables larger than preScanCap).
+  const rows = adapter
+    .prepare(
+      `SELECT * FROM memories ${activeClause}
+       ORDER BY (confidence * (1.0 + hit_count * 0.1)) DESC
+       LIMIT :preScanCap`,
+    )
+    .all({ ':preScanCap': preScanCap });
   const scored: Array<{ memory: Memory; score: number }> = [];
   for (const row of rows) {
     const memory = rowToMemory(row);

package/src/resources/extensions/gsd/migrate/command.ts

@@ -25,6 +25,50 @@ import {
 
 import type { MigrationPreview } from "./writer.js";
 import { homedir } from "node:os";
+import { ensureDbOpen } from "../bootstrap/dynamic-tools.js";
+import { clearEngineHierarchy, transaction } from "../gsd-db.js";
+import { migrateFromMarkdown } from "../md-importer.js";
+import { invalidateStateCache } from "../state.js";
+
+export type MigrationImportCounts = ReturnType<typeof migrateFromMarkdown>;
+
+function assertMigrationImportMatchesPreview(imported: MigrationImportCounts, preview: MigrationPreview): void {
+  const mismatches: string[] = [];
+  if (imported.hierarchy.milestones !== preview.milestoneCount) {
+    mismatches.push(`milestones ${imported.hierarchy.milestones}/${preview.milestoneCount}`);
+  }
+  if (imported.hierarchy.slices !== preview.totalSlices) {
+    mismatches.push(`slices ${imported.hierarchy.slices}/${preview.totalSlices}`);
+  }
+  if (imported.hierarchy.tasks !== preview.totalTasks) {
+    mismatches.push(`tasks ${imported.hierarchy.tasks}/${preview.totalTasks}`);
+  }
+  if (imported.requirements !== preview.requirements.total) {
+    mismatches.push(`requirements ${imported.requirements}/${preview.requirements.total}`);
+  }
+  if (mismatches.length > 0) {
+    throw new Error(`migration DB import verification failed: ${mismatches.join(", ")}`);
+  }
+}
+
+export async function importWrittenMigrationToDb(
+  basePath: string,
+  preview?: MigrationPreview,
+): Promise<MigrationImportCounts> {
+  const opened = await ensureDbOpen(basePath);
+  if (!opened) {
+    throw new Error(`failed to open or create the GSD database at ${basePath}`);
+  }
+
+  const counts = transaction(() => {
+    clearEngineHierarchy();
+    const imported = migrateFromMarkdown(basePath);
+    if (preview) assertMigrationImportMatchesPreview(imported, preview);
+    return imported;
+  });
+  invalidateStateCache();
+  return counts;
+}
 
 /** Format preview stats for embedding in the review prompt. */
 function formatPreviewStats(preview: MigrationPreview): string {
@@ -182,9 +226,10 @@ export async function handleMigrate(
 
   const result = await writeGSDDirectory(project, process.cwd());
   const gsdPath = gsdRoot(process.cwd());
+  const imported = await importWrittenMigrationToDb(process.cwd(), preview);
 
   ctx.ui.notify(
-    `✓ Migration complete — ${result.paths.length} file(s) written to .gsd/`,
+    `✓ Migration complete — ${result.paths.length} file(s) written to .gsd/ and ${imported.hierarchy.milestones}M/${imported.hierarchy.slices}S/${imported.hierarchy.tasks}T imported to the database`,
     "info",
   );
 
@@ -193,6 +238,7 @@ export async function handleMigrate(
     title: "Migration written",
     summary: [
       `${result.paths.length} files written to .gsd/`,
+      `${imported.hierarchy.milestones} milestone(s), ${imported.hierarchy.slices} slice(s), and ${imported.hierarchy.tasks} task(s) imported to gsd.db`,
       "",
       "The agent can now review the migrated output against GSD-2 standards —",
       "checking structure, content quality, deriveState() round-trip, and",

package/src/resources/extensions/gsd/migration-auto-check.ts

@@ -0,0 +1,129 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+
+import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
+import {
+  clearEngineHierarchy,
+  getAllMilestones,
+  getMilestoneSlices,
+  getSliceTasks,
+  isDbAvailable,
+  transaction,
+} from "./gsd-db.js";
+import { migrateHierarchyToDb } from "./md-importer.js";
+import { parsePlan, parseRoadmap } from "./parsers-legacy.js";
+import {
+  milestonesDir,
+  resolveMilestoneFile,
+  resolveSliceFile,
+} from "./paths.js";
+import { invalidateStateCache } from "./state.js";
+
+export interface HierarchyCounts {
+  milestones: number;
+  slices: number;
+  tasks: number;
+}
+
+export interface MigrationAutoCheckResult {
+  action: "none" | "imported";
+  reason: "no-markdown" | "in-sync" | "db-empty" | "count-mismatch";
+  markdown: HierarchyCounts;
+  beforeDb: HierarchyCounts;
+  afterDb: HierarchyCounts;
+}
+
+function zeroCounts(): HierarchyCounts {
+  return { milestones: 0, slices: 0, tasks: 0 };
+}
+
+function sameCounts(a: HierarchyCounts, b: HierarchyCounts): boolean {
+  return a.milestones === b.milestones && a.slices === b.slices && a.tasks === b.tasks;
+}
+
+export function countMarkdownHierarchy(basePath: string): HierarchyCounts {
+  const root = milestonesDir(basePath);
+  if (!existsSync(root)) return zeroCounts();
+
+  const counts = zeroCounts();
+  for (const entry of readdirSync(root, { withFileTypes: true })) {
+    if (!entry.isDirectory() || !/^M\d+/.test(entry.name)) continue;
+    counts.milestones++;
+
+    const roadmapPath = resolveMilestoneFile(basePath, entry.name, "ROADMAP");
+    if (!roadmapPath || !existsSync(roadmapPath)) continue;
+
+    const roadmap = parseRoadmap(readFileSync(roadmapPath, "utf-8"));
+    counts.slices += roadmap.slices.length;
+
+    for (const slice of roadmap.slices) {
+      const planPath = resolveSliceFile(basePath, entry.name, slice.id, "PLAN");
+      if (!planPath || !existsSync(planPath)) continue;
+      const plan = parsePlan(readFileSync(planPath, "utf-8"));
+      counts.tasks += plan.tasks.length;
+    }
+  }
+
+  return counts;
+}
+
+export function countDbHierarchy(): HierarchyCounts {
+  if (!isDbAvailable()) return zeroCounts();
+  const counts = zeroCounts();
+  const milestones = getAllMilestones();
+  counts.milestones = milestones.length;
+
+  for (const milestone of milestones) {
+    const slices = getMilestoneSlices(milestone.id);
+    counts.slices += slices.length;
+    for (const slice of slices) {
+      counts.tasks += getSliceTasks(milestone.id, slice.id).length;
+    }
+  }
+
+  return counts;
+}
+
+export async function autoImportMarkdownHierarchyIfDbMismatch(
+  basePath: string,
+): Promise<MigrationAutoCheckResult> {
+  const markdown = countMarkdownHierarchy(basePath);
+  if (sameCounts(markdown, zeroCounts())) {
+    return {
+      action: "none",
+      reason: "no-markdown",
+      markdown,
+      beforeDb: zeroCounts(),
+      afterDb: zeroCounts(),
+    };
+  }
+
+  const opened = await ensureDbOpen(basePath);
+  if (!opened || !isDbAvailable()) {
+    throw new Error(`failed to open or create the GSD database at ${basePath}`);
+  }
+
+  const beforeDb = countDbHierarchy();
+  if (sameCounts(markdown, beforeDb)) {
+    return { action: "none", reason: "in-sync", markdown, beforeDb, afterDb: beforeDb };
+  }
+
+  const reason = sameCounts(beforeDb, zeroCounts()) ? "db-empty" : "count-mismatch";
+  const imported = transaction(() => {
+    clearEngineHierarchy();
+    return migrateHierarchyToDb(basePath);
+  });
+  invalidateStateCache();
+
+  const afterDb = {
+    milestones: imported.milestones,
+    slices: imported.slices,
+    tasks: imported.tasks,
+  };
+  if (!sameCounts(markdown, afterDb)) {
+    throw new Error(
+      `migration auto-import verification failed: markdown ${markdown.milestones}M/${markdown.slices}S/${markdown.tasks}T, db ${afterDb.milestones}M/${afterDb.slices}S/${afterDb.tasks}T`,
+    );
+  }
+
+  return { action: "imported", reason, markdown, beforeDb, afterDb };
+}

package/src/resources/extensions/gsd/model-router.ts

@@ -1,6 +1,5 @@
-// GSD Extension — Dynamic Model Router
-// Maps complexity tiers to models, enforcing downgrade-only semantics.
-// The user's configured model is always the ceiling.
+// Project/App: GSD-2
+// File Purpose: Routes work to appropriate models while preserving configured ceilings.
 
 import type { ComplexityTier, ClassificationResult, TaskMetadata } from "./complexity-classifier.js";
 import { tierOrdinal } from "./complexity-classifier.js";
@@ -8,6 +7,7 @@ import type { ResolvedModelConfig } from "./preferences.js";
 import { getProviderCapabilities, type ProviderCapabilities } from "@gsd/pi-ai";
 import { getToolCompatibility, getAllToolCompatibility } from "@gsd/pi-coding-agent";
 import type { ToolCompatibility } from "@gsd/pi-coding-agent";
+import { incrementLegacyTelemetry } from "./legacy-telemetry.js";
 
 // ─── Types ───────────────────────────────────────────────────────────────────
 
@@ -641,14 +641,18 @@ export function resolveModelForTier(
 
   // No available models known — return canonical fallback
   if (availableModelIds.length === 0) {
+    incrementLegacyTelemetry("legacy.providerDefaultUsed");
     return canonicalModelForTier(tier);
   }
 
   // Cross-provider tier search
   const resolved = findModelForTier(tier, routingConfig, availableModelIds, allowCrossProvider);
-  return resolved
-    ? normalizeResolvedTierModelId(resolved, tier, routingConfig)
-    : canonicalModelForTier(tier);
+  if (resolved) {
+    return normalizeResolvedTierModelId(resolved, tier, routingConfig);
+  }
+
+  incrementLegacyTelemetry("legacy.providerDefaultUsed");
+  return canonicalModelForTier(tier);
 }
 
 // ─── Internal ────────────────────────────────────────────────────────────────

package/src/resources/extensions/gsd/native-git-bridge.ts

@@ -1183,6 +1183,33 @@ export function nativeRmForce(basePath: string, paths: string[]): void {
   }
 }
 
+function runGitWorktreeAdd(
+  basePath: string,
+  wtPath: string,
+  branch: string,
+  createBranch?: boolean,
+  startPoint?: string,
+): void {
+  if (createBranch) {
+    const branchRef = gitExec(basePath, ["show-ref", "--verify", `refs/heads/${branch}`], true);
+    if (branchRef) {
+      gitExec(basePath, ["worktree", "add", wtPath, branch]);
+      return;
+    }
+    gitExec(basePath, ["worktree", "add", "-b", branch, wtPath, startPoint ?? "HEAD"]);
+  } else {
+    gitExec(basePath, ["worktree", "add", wtPath, branch]);
+  }
+}
+
+export function assertWorktreeMaterialized(wtPath: string): void {
+  if (existsSync(join(wtPath, ".git"))) return;
+  throw new GSDError(
+    GSD_GIT_ERROR,
+    `git worktree add did not materialize a valid worktree at ${wtPath}: missing .git file`,
+  );
+}
+
 /**
  * Add a new git worktree.
  * Native: libgit2 worktree API.
@@ -1198,14 +1225,20 @@ export function nativeWorktreeAdd(
   const native = loadNative();
   if (native) {
     native.gitWorktreeAdd(basePath, wtPath, branch, createBranch, startPoint);
-    return;
+    try {
+      assertWorktreeMaterialized(wtPath);
+      return;
+    } catch {
+      rmSync(wtPath, { recursive: true, force: true });
+      gitExec(basePath, ["worktree", "prune"], true);
+      runGitWorktreeAdd(basePath, wtPath, branch, createBranch, startPoint);
+      assertWorktreeMaterialized(wtPath);
+      return;
+    }
   }
 
-  if (createBranch) {
-    gitExec(basePath, ["worktree", "add", "-b", branch, wtPath, startPoint ?? "HEAD"]);
-  } else {
-    gitExec(basePath, ["worktree", "add", wtPath, branch]);
-  }
+  runGitWorktreeAdd(basePath, wtPath, branch, createBranch, startPoint);
+  assertWorktreeMaterialized(wtPath);
 }
 
 /**

package/src/resources/extensions/gsd/notification-widget.ts

@@ -27,9 +27,13 @@ export function buildNotificationWidgetLines(): string[] {
 }
 
 const REFRESH_INTERVAL_MS = 30_000;
+let notificationWidgetCleanup: (() => void) | undefined;
 
-export function initNotificationWidget(ctx: ExtensionContext): void {
-  if (!ctx.hasUI) return;
+export function initNotificationWidget(ctx: ExtensionContext): () => void {
+  notificationWidgetCleanup?.();
+  notificationWidgetCleanup = undefined;
+
+  if (!ctx.hasUI) return () => {};
 
   const push = () => {
     const chip = buildNotificationChip();
@@ -37,6 +41,23 @@ export function initNotificationWidget(ctx: ExtensionContext): void {
   };
   push();
 
-  onNotificationStoreChange(push);
-  setInterval(push, REFRESH_INTERVAL_MS).unref?.();
+  const unsubscribe = onNotificationStoreChange(push);
+  const interval = setInterval(push, REFRESH_INTERVAL_MS);
+  interval.unref?.();
+
+  const cleanup = () => {
+    unsubscribe();
+    clearInterval(interval);
+    if (notificationWidgetCleanup === cleanup) {
+      ctx.ui.setStatus(STATUS_KEY, undefined);
+      notificationWidgetCleanup = undefined;
+    }
+  };
+  notificationWidgetCleanup = cleanup;
+  return cleanup;
+}
+
+export function _resetNotificationWidgetForTests(): void {
+  notificationWidgetCleanup?.();
+  notificationWidgetCleanup = undefined;
 }

package/src/resources/extensions/gsd/orphan-stash-audit.ts

@@ -0,0 +1,117 @@
+// GSD-2 + src/resources/extensions/gsd/orphan-stash-audit.ts
+// Startup sweep for orphaned gsd-preflight-stash entries left behind by
+// interrupted milestone merges (#5538-followup).
+
+import { execFileSync } from "node:child_process";
+import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
+
+export interface OrphanPreflightStashAuditResult {
+  applied: Array<{ milestoneId: string; stashRef: string }>;
+  warnings: string[];
+}
+
+/**
+ * Recognize the "already restored" failure mode of `git stash apply`.
+ *
+ * When a preflight stash captured untracked files via `--include-untracked`
+ * and those files are now present in the working tree (e.g. a prior audit
+ * run already applied this stash), `git stash apply` aborts with
+ * `<path> already exists, no checkout` and exits non-zero. That is the
+ * idempotent steady state for this audit, not a recovery failure — treat
+ * it as a no-op so repeated GSD startups stop spamming the user with
+ * warnings about stashes that have already been restored (#5538-followup
+ * peer-review feedback).
+ */
+function _isAlreadyRestoredApplyError(err: unknown): boolean {
+  if (!err || typeof err !== "object") return false;
+  const stderr = (err as { stderr?: unknown }).stderr;
+  const stderrText = typeof stderr === "string" ? stderr : stderr instanceof Uint8Array ? Buffer.from(stderr).toString("utf-8") : "";
+  if (stderrText && /already exists, no checkout/i.test(stderrText)) return true;
+  const message = err instanceof Error ? err.message : String(err);
+  return /already exists, no checkout/i.test(message);
+}
+
+export { _isAlreadyRestoredApplyError };
+
+/**
+ * Audit `git stash list` for orphaned `gsd-preflight-stash:M00x:*` entries.
+ *
+ * The matching merge code in `phases.ts` previously skipped the postflight
+ * pop whenever `mergeAndExit` threw, leaking the user's pre-merge working
+ * tree into the stash list. For every preflight-stash entry whose milestone
+ * is now complete (per the supplied callback), `git stash apply` is invoked —
+ * NOT `pop`. The stash entry stays in the list so the user retains a backup
+ * if the apply produces unexpected merge results. Idempotent across repeated
+ * startup runs.
+ *
+ * Failures are best-effort: a list error (no repo, git unavailable) returns
+ * an empty result. An apply error becomes a warning the user sees alongside
+ * the existing orphan-branch audit messages — startup continues.
+ */
+export function auditOrphanedPreflightStashes(
+  basePath: string,
+  isMilestoneComplete: (milestoneId: string) => boolean,
+): OrphanPreflightStashAuditResult {
+  const result: OrphanPreflightStashAuditResult = { applied: [], warnings: [] };
+
+  let listOutput: string;
+  try {
+    listOutput = execFileSync(
+      "git",
+      ["stash", "list", "--format=%gd%x00%s"],
+      {
+        cwd: basePath,
+        stdio: ["ignore", "pipe", "pipe"],
+        encoding: "utf-8",
+        env: GIT_NO_PROMPT_ENV,
+      },
+    );
+  } catch {
+    return result;
+  }
+
+  const MARKER_RE = /\bgsd-preflight-stash:([A-Za-z0-9_-]+):/;
+  for (const line of listOutput.split("\n")) {
+    const sep = line.indexOf("\x00");
+    if (sep < 0) continue;
+    const ref = line.slice(0, sep);
+    const subject = line.slice(sep + 1);
+    if (!ref || !subject) continue;
+
+    const match = MARKER_RE.exec(subject);
+    if (!match) continue;
+    const milestoneId = match[1];
+
+    let complete = false;
+    try {
+      complete = isMilestoneComplete(milestoneId);
+    } catch (err) {
+      result.warnings.push(
+        `Could not determine completion status for ${milestoneId} during preflight-stash audit: ${err instanceof Error ? err.message : String(err)}.`,
+      );
+      continue;
+    }
+    if (!complete) continue;
+
+    try {
+      execFileSync("git", ["stash", "apply", "--quiet", ref], {
+        cwd: basePath,
+        stdio: ["ignore", "pipe", "pipe"],
+        encoding: "utf-8",
+        env: GIT_NO_PROMPT_ENV,
+      });
+      result.applied.push({ milestoneId, stashRef: ref });
+    } catch (err) {
+      // Idempotent steady state: stash was already applied in a prior audit
+      // run; the files exist and `git stash apply` refuses to overwrite.
+      // Skip silently so repeat runs are no-ops.
+      if (_isAlreadyRestoredApplyError(err)) continue;
+      result.warnings.push(
+        `Could not apply orphaned preflight stash ${ref} (milestone ${milestoneId}): ${err instanceof Error ? err.message : String(err)}. ` +
+          `Run \`git stash apply ${ref}\` manually to restore your pre-merge changes.`,
+      );
+    }
+  }
+
+  return result;
+}

package/src/resources/extensions/gsd/parallel-orchestrator.ts

@@ -21,7 +21,7 @@ import { join, dirname } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gsdRoot } from "./paths.js";
 import { createWorktree, worktreePath } from "./worktree-manager.js";
-import { autoWorktreeBranch, runWorktreePostCreateHook, syncGsdStateToWorktree } from "./auto-worktree.js";
+import { autoWorktreeBranch, fastForwardReusedMilestoneBranchIfSafe, runWorktreePostCreateHook, syncGsdStateToWorktree } from "./auto-worktree.js";
 import { nativeBranchExists } from "./native-git-bridge.js";
 import { readIntegrationBranch } from "./git-service.js";
 import { resolveParallelConfig } from "./preferences.js";
@@ -471,7 +471,7 @@ export async function startParallel(
       // Create the worktree (without chdir — coordinator stays in project root)
       let wtPath: string;
       try {
-        wtPath = createMilestoneWorktree(basePath, mid);
+        wtPath = _createMilestoneWorktree(basePath, mid);
       } catch (e) {
         logWarning("parallel", `createMilestoneWorktree fallback for ${mid}: ${(e as Error).message}`);
         wtPath = worktreePath(basePath, mid);
@@ -532,13 +532,23 @@ export async function startParallel(
 /**
  * Create a git worktree for a milestone without changing the coordinator's cwd.
  * Uses milestone/<MID> branch naming (same as auto-worktree.ts).
+ *
+ * Exported with the `_` prefix purely for tests — production callers stay on
+ * the closure-private name `createMilestoneWorktree` below.
  */
-function createMilestoneWorktree(basePath: string, milestoneId: string): string {
+export function _createMilestoneWorktree(basePath: string, milestoneId: string): string {
   const branch = autoWorktreeBranch(milestoneId);
   const branchExists = nativeBranchExists(basePath, branch);
 
   let info: { name: string; path: string; branch: string; exists: boolean };
   if (branchExists) {
+    // #5549 post-merge audit (R3): match the fast-forward behavior added to
+    // `createAutoWorktree` in commit 8996cb68e. When a worker reuses an
+    // existing milestone branch, fast-forward it onto the integration branch
+    // when safe so per-worker worktrees don't fork from a stale base after a
+    // sibling milestone has merged. Same `nativeIsAncestor` + worktree-list
+    // safety guards apply.
+    fastForwardReusedMilestoneBranchIfSafe(basePath, milestoneId, branch);
     info = createWorktree(basePath, milestoneId, { branch, reuseExistingBranch: true });
   } else {
     const integrationBranch = readIntegrationBranch(basePath, milestoneId) ?? undefined;

package/src/resources/extensions/gsd/planning-path-scope.ts

@@ -0,0 +1,35 @@
+import { isAbsolute, relative, resolve } from "node:path";
+import { normalizePlannedFileReference } from "./files.js";
+
+export interface PlanningPathScopeField {
+  field: string;
+  values: string[];
+}
+
+function isInsideBase(basePath: string, candidate: string): boolean {
+  const base = resolve(basePath);
+  const abs = resolve(candidate);
+  const rel = relative(base, abs);
+  return rel === "" || (!!rel && !rel.startsWith("..") && !isAbsolute(rel));
+}
+
+/**
+ * Planning IO fields are execution contracts. Absolute paths are only safe when
+ * they stay inside the active working directory; in worktree mode, an absolute
+ * path to the original checkout makes executors edit the wrong tree.
+ */
+export function validatePlanningPathScope(
+  basePath: string,
+  fields: PlanningPathScopeField[],
+): string | null {
+  for (const { field, values } of fields) {
+    for (const raw of values) {
+      const candidate = normalizePlannedFileReference(raw);
+      if (!isAbsolute(candidate)) continue;
+      if (isInsideBase(basePath, candidate)) continue;
+      return `${field} contains absolute path outside working directory: ${candidate}. Use a path relative to ${basePath}.`;
+    }
+  }
+
+  return null;
+}