gsd-pi 2.82.0-dev.c22380fc3 → 2.82.0-dev.e7a7f1ed5

package/dist/resources/extensions/gsd/auto-start.js

@@ -21,10 +21,10 @@ import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
-import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, } from "./native-git-bridge.js";
+import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeBranchList, nativeBranchExists, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
-import { getAutoWorktreePath } from "./auto-worktree.js";
+import { getAutoWorktreePath, checkoutBranchWithStashGuard } from "./auto-worktree.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
 import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
@@ -33,7 +33,7 @@ import { initRoutingHistory } from "./routing-history.js";
 import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
-import { isDbAvailable, getMilestone, openDatabase, getDbStatus } from "./gsd-db.js";
+import { isDbAvailable, getMilestone, getAllMilestones, openDatabase, getDbStatus } from "./gsd-db.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
 import { auditOrphanedPreflightStashes } from "./orphan-stash-audit.js";
@@ -88,9 +88,11 @@ export function decideSurvivorAction(hasSurvivorBranch, phase) {
         return "finalize";
     return "none";
 }
-export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
+export function auditOrphanedMilestoneBranches(basePath, isolationMode, gitDeps = {}) {
     const recovered = [];
     const warnings = [];
+    const branchList = gitDeps.branchList ?? nativeBranchList;
+    const branchExists = gitDeps.branchExists ?? nativeBranchExists;
     // Skip in none mode — no milestone branches are created
     if (isolationMode === "none")
         return { recovered, warnings };
@@ -98,15 +100,16 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
     if (!isDbAvailable())
         return { recovered, warnings };
     let milestoneBranches;
+    let milestoneBranchListAvailable = true;
     try {
-        milestoneBranches = nativeBranchList(basePath, "milestone/*");
+        milestoneBranches = branchList(basePath, "milestone/*");
     }
     catch {
-        // git branch list failed — skip audit
-        return { recovered, warnings };
+        milestoneBranchListAvailable = false;
+        // git branch list failed — fall through with an empty branch set so the
+        // branch-less orphan pass can still run after per-milestone verification.
+        milestoneBranches = [];
     }
-    if (milestoneBranches.length === 0)
-        return { recovered, warnings };
     // Detect main branch for merge-check
     let mainBranch;
     try {
@@ -236,6 +239,71 @@ export function auditOrphanedMilestoneBranches(basePath, isolationMode) {
             }
         }
     }
+    // Second pass (#5879): catch worktree directories stranded by a previous
+    // audit that deleted the milestone/* branch but failed to remove the
+    // directory (or the dir was orphaned by a separate path entirely, e.g.
+    // postflight-stash-restore-failed during closeout). The branch-keyed loop
+    // above is invisible to these cases — `nativeBranchList` returns nothing
+    // for the milestone, so the dir-cleanup block at line ~310 is never
+    // reached.
+    //
+    // Keyed on milestones whose DB status is `complete`. We do not iterate
+    // over arbitrary directories under .gsd/worktrees/ to avoid touching
+    // dirs that belong to an in-progress milestone whose branch was deleted
+    // separately — those are handled by the in-progress orphan path above
+    // when the branch is present, and by `/gsd doctor` when it is not.
+    const seenMilestoneIds = new Set(milestoneBranches.map((branch) => branch.replace(/^milestone\//, "")));
+    let completedMilestones = [];
+    try {
+        completedMilestones = getAllMilestones();
+    }
+    catch {
+        // DB read failure — skip the second pass; the first pass is still useful.
+        completedMilestones = [];
+    }
+    for (const m of completedMilestones) {
+        if (m.status !== "complete")
+            continue;
+        if (seenMilestoneIds.has(m.id))
+            continue; // already processed in the branch loop
+        if (!milestoneBranchListAvailable) {
+            try {
+                if (branchExists(basePath, `milestone/${m.id}`))
+                    continue;
+            }
+            catch (err) {
+                warnings.push(`Could not verify whether milestone/${m.id} still exists; skipping branch-less worktree cleanup for safety: ${err instanceof Error ? err.message : String(err)}`);
+                continue;
+            }
+        }
+        const wtDir = getWorktreeDir(basePath, m.id);
+        if (!existsSync(wtDir))
+            continue;
+        if (!isInsideWorktreesDir(basePath, wtDir)) {
+            warnings.push(`Orphaned worktree directory for ${m.id} is outside .gsd/worktrees/ — skipping removal for safety.`);
+            continue;
+        }
+        // Try `git worktree remove` first in case the dir is still registered
+        // (defensive — usually it is not when we reach this branch-less pass).
+        try {
+            nativeWorktreeRemove(basePath, wtDir, true);
+        }
+        catch (e) {
+            logWarning("engine", `worktree remove failed (expected for branch-less orphans): ${e instanceof Error ? e.message : String(e)}`);
+        }
+        if (existsSync(wtDir)) {
+            try {
+                rmSync(wtDir, { recursive: true, force: true });
+                recovered.push(`Removed orphaned worktree directory for ${m.id} (branch already deleted).`);
+            }
+            catch (err) {
+                warnings.push(`Failed to remove orphaned worktree directory for ${m.id}: ${err instanceof Error ? err.message : String(err)}`);
+            }
+        }
+        else {
+            recovered.push(`Removed orphaned worktree directory for ${m.id} (branch already deleted).`);
+        }
+    }
     return { recovered, warnings };
 }
 /**
@@ -368,7 +436,7 @@ export function _mergeOrphanCompletedMilestone(lifecycle, orphanId, ui) {
     return { merged: false, error: err };
 }
 export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, deps, interrupted) {
-    const { shouldUseWorktreeIsolation, registerSigtermHandler, lockBase, buildLifecycle, } = deps;
+    const { shouldUseWorktreeIsolation, registerSigtermHandler, registerAutoWorkerForSession, lockBase, buildLifecycle, } = deps;
     const dirCheck = validateDirectory(base);
     if (dirCheck.severity === "blocked") {
         ctx.ui.notify(dirCheck.reason, "error");
@@ -523,6 +591,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // consult DB status and avoid clearing runtime units for milestones that
         // only have a failure-path SUMMARY on disk (#4663).
         await openProjectDbIfPresent(base);
+        registerAutoWorkerForSession(base);
         // Clean stale runtime unit files for completed milestones (#887).
         // DB-authoritative: when DB is available, require DB status to be closed
         // before clearing runtime units. A SUMMARY file alone is no longer
@@ -606,12 +675,16 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // worktree cleanup) was never run — the survivor branch must be merged.
         // Applies to both worktree and branch isolation modes.
         let hasSurvivorBranch = false;
-        if (state.activeMilestone &&
+        let survivorMilestoneId = state.activeMilestone?.id ?? null;
+        if (!survivorMilestoneId && state.phase === "complete") {
+            survivorMilestoneId = findUnmergedCompletedMilestone(base, getIsolationMode(base));
+        }
+        if (survivorMilestoneId &&
             (state.phase === "pre-planning" || state.phase === "complete") &&
             getIsolationMode(base) !== "none" &&
             !detectWorktreeName(base) &&
             !base.includes(`${pathSep}.gsd${pathSep}worktrees${pathSep}`)) {
-            const milestoneBranch = `milestone/${state.activeMilestone.id}`;
+            const milestoneBranch = `milestone/${survivorMilestoneId}`;
             const { nativeBranchExists } = await import("./native-git-bridge.js");
             hasSurvivorBranch = nativeBranchExists(base, milestoneBranch);
             if (hasSurvivorBranch) {
@@ -645,7 +718,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         // Re-evaluate via the helper — the discuss branch above may have cleared
         // hasSurvivorBranch after a successful promotion.
         if (decideSurvivorAction(hasSurvivorBranch, state.phase) === "finalize") {
-            const mid = state.activeMilestone.id;
+            const mid = survivorMilestoneId;
             // Commit 68ef58a3c made `_mergeBranchMode` throw on wrong-branch
             // instead of returning false silently. Wrap the call so the throw is
             // converted into an error notify + clean bootstrap abort, not an
@@ -828,7 +901,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 const integrationBranch = nativeDetectMainBranch(base);
                 const branchToCheckout = resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo);
                 if (branchToCheckout) {
-                    nativeCheckoutBranch(base, branchToCheckout);
+                    checkoutBranchWithStashGuard(base, branchToCheckout, "isolation-none-recovery");
                     logWarning("bootstrap", `Returned to "${branchToCheckout}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
                 }
             }

package/dist/resources/extensions/gsd/auto-verification.js

@@ -18,9 +18,7 @@ import { join } from "node:path";
 import { resolveUokFlags } from "./uok/flags.js";
 import { UokGateRunner } from "./uok/gate-runner.js";
 import { verificationRetryKey } from "./auto/verification-retry-policy.js";
-function isInfraVerificationFailure(stderr) {
-    return /\b(ENOENT|ENOTFOUND|ETIMEDOUT|ECONNRESET|EAI_AGAIN|spawn\s+\S+\s+ENOENT|command not found)\b/i.test(stderr);
-}
+import { decideVerificationVerdict } from "./verification-verdict.js";
 /**
  * Post-unit guard for `validate-milestone` units (#4094).
  *
@@ -67,12 +65,25 @@ async function runValidateMilestonePostCheck(vctx, pauseAuto) {
     const { milestone: mid } = parseUnitId(s.currentUnit.id);
     if (!mid)
         return "continue";
+    const setToolFailureRetry = (message) => {
+        const retryKey = verificationRetryKey(s.currentUnit.type, s.currentUnit.id);
+        const attempt = (s.verificationRetryCount.get(retryKey) ?? 0) + 1;
+        s.verificationRetryCount.set(retryKey, attempt);
+        s.pendingVerificationRetry = {
+            unitId: s.currentUnit.id,
+            failureContext: message,
+            attempt,
+        };
+        return "retry";
+    };
     const validationFile = resolveMilestoneFile(s.basePath, mid, "VALIDATION");
-    if (!validationFile)
-        return "continue";
+    if (!validationFile) {
+        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. No VALIDATION.md was created.");
+    }
     const validationContent = await loadFile(validationFile);
-    if (!validationContent)
-        return "continue";
+    if (!validationContent) {
+        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. VALIDATION.md exists but is empty.");
+    }
     const verdict = extractVerdict(validationContent);
     if (verdict !== "needs-remediation") {
         await persistMilestoneValidationGate("pass", "none", `milestone validation verdict is ${verdict}; no remediation loop risk`, "", mid);
@@ -128,7 +139,7 @@ async function countIncompleteSlices(basePath, milestoneId) {
 /**
  * Run the verification gate for the current execute-task unit.
  * Returns:
- * - "continue" — gate passed (or no checks configured), proceed normally
+ * - "continue" — host-owned verification passed, proceed normally
  * - "retry" — gate failed with retries remaining, s.pendingVerificationRetry set for loop re-iteration
  * - "pause" — gate failed with retries exhausted, pauseAuto already called
  */
@@ -178,6 +189,10 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                 process.stderr.write(`  [${w.severity}] ${w.name}: ${w.title}\n`);
             }
         }
+        const verdict = decideVerificationVerdict(s.currentUnit.type, result);
+        if (!verdict.passed) {
+            result.passed = false;
+        }
         if (uokFlags.gates) {
             const gateRunner = new UokGateRunner();
             gateRunner.register({
@@ -190,10 +205,12 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                         : "verification",
                     rationale: result.passed
                         ? "verification checks passed"
-                        : "verification checks failed",
+                        : verdict.reason === "no-host-checks"
+                            ? "no runnable host-owned verification checks discovered"
+                            : "verification checks failed",
                     findings: result.passed
                         ? ""
-                        : formatFailureContext(result),
+                        : verdict.failureContext || formatFailureContext(result),
                 }),
             });
             await gateRunner.run("verification-gate", {
@@ -251,7 +268,11 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                     }
                     else {
                         const nextAttempt = attempt + 1;
-                        writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id, nextAttempt, maxRetries);
+                        const includeRetryMetadata = !result.passed &&
+                            verdict.retryable &&
+                            autoFixEnabled &&
+                            nextAttempt <= maxRetries;
+                        writeVerificationJSON(result, tasksDir, tid, s.currentUnit.id, includeRetryMetadata ? nextAttempt : undefined, includeRetryMetadata ? maxRetries : undefined);
                     }
                 }
             }
@@ -259,18 +280,6 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
                 logWarning("engine", `verification-evidence write error: ${evidenceErr.message}`);
             }
         }
-        const advisoryFailure = !result.passed &&
-            (result.discoverySource === "package-json" ||
-                result.checks.some((check) => isInfraVerificationFailure(check.stderr)));
-        if (advisoryFailure) {
-            s.verificationRetryCount.delete(retryKey);
-            s.verificationRetryFailureHashes.delete(retryKey);
-            s.pendingVerificationRetry = null;
-            ctx.ui.notify(result.discoverySource === "package-json"
-                ? "Verification failed in auto-discovered package.json checks — treating as advisory."
-                : "Verification failed due to infrastructure/runtime environment issues — treating as advisory.", "warning");
-            return "continue";
-        }
         // ── Post-execution checks (run after main verification passes for execute-task units) ──
         let postExecChecks;
         let postExecBlockingFailure = false;
@@ -430,6 +439,15 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
             s.pendingVerificationRetry = null;
             return "continue";
         }
+        else if (verdict.reason === "no-host-checks") {
+            s.verificationRetryCount.delete(retryKey);
+            s.verificationRetryFailureHashes.delete(retryKey);
+            s.pendingVerificationRetry = null;
+            ctx.ui.notify("Verification gate FAILED — no runnable host-owned verification checks were discovered. Pausing for human review.", "error");
+            process.stderr.write(`verification-gate: ${verdict.failureContext}\n`);
+            await pauseAuto(ctx, pi);
+            return "pause";
+        }
         else if (postExecBlockingFailure) {
             // Post-execution failures are cross-task consistency issues — retrying the same task won't fix them.
             // Skip retry and pause immediately for human review.
@@ -445,7 +463,7 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
             s.verificationRetryCount.set(retryKey, nextAttempt);
             s.pendingVerificationRetry = {
                 unitId: s.currentUnit.id,
-                failureContext: formatFailureContext(result),
+                failureContext: verdict.failureContext || formatFailureContext(result),
                 attempt: nextAttempt,
             };
             const failedCmds = result.checks
@@ -475,9 +493,10 @@ export async function runPostUnitVerification(vctx, pauseAuto) {
         }
     }
     catch (err) {
-        // Gate errors are non-fatal
         logWarning("engine", `verification-gate error: ${err.message}`);
-        return "continue";
+        ctx.ui.notify(`Verification gate errored before producing an authoritative verdict: ${err.message}`, "error");
+        await pauseAuto(ctx, pi);
+        return "pause";
     }
 }
 /**

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -173,7 +173,18 @@ function gitPathspecForWorktreePath(basePath, targetPath) {
     let base = basePath;
     let target = targetPath;
     try {
-        base = realpathSync.native(basePath);
+        base = execFileSync("git", ["rev-parse", "--show-toplevel"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "ignore"],
+            encoding: "utf-8",
+        }).trim() || basePath;
+    }
+    catch {
+        /* keep original */
+        void base;
+    }
+    try {
+        base = realpathSync.native(base);
     }
     catch {
         /* keep original */
@@ -191,6 +202,9 @@ function gitPathspecForWorktreePath(basePath, targetPath) {
         return null;
     return rel.replaceAll("\\", "/");
 }
+export function _gitPathspecForWorktreePath(basePath, targetPath) {
+    return gitPathspecForWorktreePath(basePath, targetPath);
+}
 function gitRemoteExists(basePath, remote) {
     try {
         execFileSync("git", ["remote", "get-url", remote], {
@@ -204,6 +218,52 @@ function gitRemoteExists(basePath, remote) {
         return false;
     }
 }
+function findRegularMergeChangedPaths(basePath, milestoneBranch, mainBranch) {
+    const changedPaths = new Set();
+    let mergeLog = "";
+    try {
+        mergeLog = execFileSync("git", ["rev-list", "--merges", "--parents", mainBranch], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        }).trim();
+    }
+    catch (err) {
+        logWarning("worktree", `regular merge lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+        return changedPaths;
+    }
+    for (const line of mergeLog.split("\n").filter(Boolean)) {
+        const [mergeCommit, firstParent, ...otherParents] = line.split(" ");
+        if (!mergeCommit || !firstParent || otherParents.length === 0)
+            continue;
+        const mergedMilestone = otherParents.some((parent) => {
+            try {
+                return nativeIsAncestor(basePath, milestoneBranch, parent);
+            }
+            catch {
+                return false;
+            }
+        });
+        if (!mergedMilestone)
+            continue;
+        try {
+            const output = execFileSync("git", ["diff", "--name-only", firstParent, mergeCommit], {
+                cwd: basePath,
+                stdio: ["ignore", "pipe", "pipe"],
+                encoding: "utf-8",
+            }).trim();
+            for (const path of output.split("\n").filter(Boolean)) {
+                if (!path.startsWith(".gsd/"))
+                    changedPaths.add(path);
+            }
+        }
+        catch (err) {
+            logWarning("worktree", `regular merge diff lookup failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return changedPaths;
+    }
+    return changedPaths;
+}
 function clearProjectRootStateFiles(basePath, milestoneId) {
     const gsdDir = gsdRoot(basePath);
     // Phase C pt 2: auto.lock removed from this list — the file is gone
@@ -810,7 +870,63 @@ export function enterBranchModeForMilestone(basePath, milestoneId) {
             reused: true,
         });
     }
-    nativeCheckoutBranch(basePath, branch);
+    checkoutBranchWithStashGuard(basePath, branch, `enter-branch-mode:${milestoneId}`);
+}
+export function checkoutBranchWithStashGuard(basePath, branch, reason) {
+    let stashMarker = null;
+    let stashed = false;
+    const status = nativeWorkingTreeStatus(basePath).trim();
+    if (status.length > 0) {
+        stashMarker = `gsd-checkout-stash:${reason}:${process.pid}:${Date.now()}:${process.hrtime.bigint().toString(36)}`;
+        const stashListBefore = execFileSync("git", ["stash", "list"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: checkout stash [${stashMarker}]`], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        const stashListAfter = execFileSync("git", ["stash", "list"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        stashed = stashListAfter !== stashListBefore;
+    }
+    // Checkout and stash-restore are split so we can distinguish two failure
+    // modes: (a) checkout failed → HEAD did not move, restore stash and rethrow;
+    // (b) checkout succeeded but stash pop failed → HEAD moved to `branch` but
+    // the working-tree changes remain in the stash list. We surface a distinct
+    // error in case (b) so callers don't assume the branch switch was rolled back.
+    try {
+        nativeCheckoutBranch(basePath, branch);
+    }
+    catch (checkoutErr) {
+        if (stashed) {
+            try {
+                popStashByRef(basePath, stashMarker);
+            }
+            catch (restoreErr) {
+                logWarning("worktree", `git stash pop failed during checkout restore: ${restoreErr instanceof Error ? restoreErr.message : String(restoreErr)}`);
+            }
+        }
+        throw checkoutErr;
+    }
+    if (stashed) {
+        try {
+            popStashByRef(basePath, stashMarker);
+        }
+        catch (popErr) {
+            const msg = popErr instanceof Error ? popErr.message : String(popErr);
+            const wrapped = new Error(`checkout to '${branch}' succeeded but stash restore failed; working tree changes remain in the stash list. Original error: ${msg}`);
+            const ref = popErr?.stashRef;
+            if (ref)
+                wrapped.stashRef = ref;
+            throw wrapped;
+        }
+    }
 }
 // ─── Public API ────────────────────────────────────────────────────────────
 /**
@@ -1482,6 +1598,56 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
             });
         }
     }
+    // Already regular-merged milestones can skip the squash path and proceed to cleanup (#5831).
+    if (nativeIsAncestor(originalBasePath_, milestoneBranch, mainBranch)) {
+        const codeChanges = nativeDiffNumstat(originalBasePath_, mainBranch, milestoneBranch).filter((entry) => !entry.path.startsWith(".gsd/"));
+        if (codeChanges.length > 0) {
+            const regularMergeChangedPaths = findRegularMergeChangedPaths(originalBasePath_, milestoneBranch, mainBranch);
+            const unanchoredCodeChanges = codeChanges.filter((entry) => regularMergeChangedPaths.has(entry.path));
+            if (unanchoredCodeChanges.length > 0) {
+                process.chdir(previousCwd);
+                throw new GSDError(GSD_GIT_ERROR, `Milestone branch "${milestoneBranch}" is reachable from "${mainBranch}" ` +
+                    `but has ${unanchoredCodeChanges.length} milestone-touched code file(s) not on current "${mainBranch}". ` +
+                    `Aborting worktree teardown to prevent data loss.`);
+            }
+        }
+        debugLog("mergeMilestoneToMain", {
+            action: "skip-squash-already-merged",
+            milestoneId,
+            milestoneBranch,
+            mainBranch,
+        });
+        try {
+            clearProjectRootStateFiles(originalBasePath_, milestoneId);
+        }
+        catch (err) {
+            logWarning("worktree", `clearProjectRootStateFiles failed during already-merged cleanup: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        try {
+            removeWorktree(originalBasePath_, milestoneId, {
+                branch: milestoneBranch,
+                deleteBranch: false,
+            });
+        }
+        catch (err) {
+            logWarning("worktree", `worktree removal failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        try {
+            nativeBranchDelete(originalBasePath_, milestoneBranch);
+        }
+        catch (err) {
+            logWarning("worktree", `git branch-delete failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        setActiveWorkspace(null);
+        nudgeGitBranchCache(previousCwd);
+        try {
+            process.chdir(originalBasePath_);
+        }
+        catch (err) {
+            logWarning("worktree", `chdir to project root after already-merged cleanup failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+        return { commitMessage, pushed: false, prCreated: false, codeFilesChanged: true };
+    }
     // 7. Shelter queued milestone directories before the squash merge (#2505).
     // The milestone branch may contain copies of queued milestone dirs (via
     // copyPlanningArtifacts), so `git merge --squash` rejects when those same
@@ -1617,14 +1783,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         // report the dirty tree if it fails.
         logWarning("worktree", `git stash failed: ${err instanceof Error ? err.message : String(err)}`);
     }
-    if (needsDbCycle && dbPathToReopen) {
-        try {
-            openDatabase(dbPathToReopen);
-        }
-        catch (err) {
-            logWarning("worktree", `post-stash db reopen failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
     // 7b. Clean up stale merge state before attempting squash merge (#2912).
     // A leftover MERGE_HEAD (from a previous failed merge, libgit2 native path,
     // or interrupted operation) causes `git merge --squash` to refuse with
@@ -1633,6 +1791,14 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     removeMergeStateFiles(originalBasePath_, "pre-merge");
     // 8. Squash merge — auto-resolve .gsd/ state file conflicts (#530)
     const mergeResult = nativeMergeSquash(originalBasePath_, milestoneBranch);
+    if (needsDbCycle && dbPathToReopen) {
+        try {
+            openDatabase(dbPathToReopen);
+        }
+        catch (err) {
+            logWarning("worktree", `post-merge db reopen failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     if (!mergeResult.success) {
         // Dirty working tree — the merge was rejected before it started (e.g.
         // untracked .gsd/ files left by syncStateToProjectRoot).  Preserve the