gsd-pi 2.82.0-dev.dfbc5f58f → 2.82.0-dev.e7a7f1ed5

package/README.md

@@ -503,7 +503,7 @@ On first run, GSD launches a branded setup wizard that walks you through LLM pro
 | `/gsd mcp`              | MCP server status and connectivity                                            |
 | `/gsd status`           | Progress dashboard                                                            |
 | `/gsd brief <mode>`     | Generate a visual HTML brief (diagram, plan, diff, recap, table, slides)      |
-| `/gsd queue`            | Queue future milestones (safe during auto mode)                               |
+| `/gsd queue`            | Queue/reorder future milestones (`pending`, `queued`, or legacy `planned`; safe during auto mode) |
 | `/gsd prefs`            | Model selection, timeouts, budget ceiling                                     |
 | `/gsd migrate`          | Migrate a v1 `.planning` directory to `.gsd` format                           |
 | `/gsd help`             | Categorized command reference for all GSD subcommands                         |

package/dist/resources/.managed-resources-content-hash

@@ -1 +1 @@
-5c0ebf59b3b9fce3
+68e342bd44fe9191

package/dist/resources/extensions/claude-code-cli/stream-adapter.js

@@ -269,7 +269,7 @@ function makeErrorMessage(model, errorMsg) {
 export function isClaudeCodeAbortErrorMessage(message) {
     if (!message)
         return false;
-    return /\b(?:claude code process aborted by user|request aborted by user|process aborted by user)\b/i.test(message);
+    return /\b(?:claude code process aborted by user|request aborted by user|process aborted by user|aborterror)\b/i.test(message);
 }
 function isBareClaudeCodeAbortErrorMessage(message) {
     if (!message)

package/dist/resources/extensions/gsd/auto/phases.js

@@ -44,6 +44,7 @@ import { resolveManifest } from "../unit-context-manifest.js";
 import { createWorktreeSafetyModule } from "../worktree-safety.js";
 import { isSuspiciousGhostCompletion } from "../auto-unit-closeout.js";
 import { decideVerificationRetry, verificationRetryKey } from "./verification-retry-policy.js";
+import { buildPhaseHandoffOutcome, setAutoOutcomeWidget } from "../auto-dashboard.js";
 // ─── Path Comparison Helper ───────────────────────────────────────────────
 /** Compare two paths for physical identity, tolerating trailing slashes and symlinks. */
 function isSamePathLocal(a, b) {
@@ -103,6 +104,12 @@ function unitWritesSource(unitType) {
 function formatWorktreeSafetyFailure(result) {
     return `Worktree Safety failed (${result.kind}): ${result.reason} ${result.remediation}`;
 }
+function formatWorktreeSafetyStopReason(result) {
+    if (result.kind === "empty-worktree-with-project-content") {
+        return `Worktree Safety failed (${result.kind}). Run /gsd doctor fix, then /gsd auto.`;
+    }
+    return `Worktree Safety failed (${result.kind}).`;
+}
 function resolveEmptyWorktreeWithProjectContent(unitRoot, projectRoot) {
     if (isSamePathLocal(unitRoot, projectRoot))
         return false;
@@ -176,7 +183,7 @@ async function validateSourceWriteWorktreeSafety(ic, unitType, unitId, milestone
         projectRoot,
     });
     ctx.ui.notify(msg, "error");
-    await deps.stopAuto(ctx, pi, msg);
+    await deps.stopAuto(ctx, pi, formatWorktreeSafetyStopReason(result));
     return { action: "break", reason: result.kind };
 }
 // ─── Session timeout auto-resume state ────────────────────────────────────────
@@ -1331,35 +1338,8 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         s.currentUnit.type === unitType &&
         s.currentUnit.id === unitId);
     const previousTier = s.currentUnitRouting?.tier;
-    // Scope workflow-logger buffer to this unit so post-finalize drains are
-    // per-unit. Without this, the module-level _buffer accumulates across every
-    // unit in the same Node process (see workflow-logger.ts module header).
-    _resetLogs();
     const dispatchKey = `${unitType}/${unitId}`;
-    s.unitDispatchCount.set(dispatchKey, (s.unitDispatchCount.get(dispatchKey) ?? 0) + 1);
-    s.currentUnit = { type: unitType, id: unitId, startedAt: Date.now() };
-    s.lastGitActionFailure = null;
-    s.lastGitActionStatus = null;
-    s.lastUnitAgentEndMessages = null;
-    setCurrentPhase(unitType, {
-        basePath: s.basePath,
-        traceId: ic.flowId,
-        turnId: `iter-${ic.iteration}`,
-        causedBy: "unit-start",
-    });
-    s.lastToolInvocationError = null; // #2883: clear stale error from previous unit
-    const unitStartSeq = ic.nextSeq();
-    deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: unitStartSeq, eventType: "unit-start", data: { unitType, unitId } });
-    deps.captureAvailableSkills();
-    writeUnitRuntimeRecord(s.basePath, unitType, unitId, s.currentUnit.startedAt, {
-        phase: "dispatched",
-        wrapupWarningSent: false,
-        timeoutAt: null,
-        lastProgressAt: s.currentUnit.startedAt,
-        progressCount: 0,
-        lastProgressKind: "dispatch",
-        recoveryAttempts: 0, // Reset so re-dispatched units get full recovery budget (#2322)
-    });
+    const nextDispatchCount = (s.unitDispatchCount.get(dispatchKey) ?? 0) + 1;
     // Status bar (widget + preconditions deferred until after model selection — see #2899)
     ctx.ui.setStatus("gsd-auto", "auto");
     if (mid)
@@ -1413,7 +1393,7 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         finalPrompt = `${capped}\n\n---\n\n${finalPrompt}`;
         s.pendingCrashRecovery = null;
     }
-    else if ((s.unitDispatchCount.get(dispatchKey) ?? 0) > 1) {
+    else if (nextDispatchCount > 1) {
         const diagnostic = deps.getDeepDiagnostic(s.basePath);
         if (diagnostic) {
             const cappedDiag = diagnostic.length > MAX_RECOVERY_CHARS
@@ -1452,6 +1432,11 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
         logWarning("engine", "Prompt reorder failed", { error: msg });
     }
     // Select and apply model (with tier escalation on retry — normal units only)
+    const prevUnitRouting = s.currentUnitRouting;
+    const prevUnitModel = s.currentUnitModel;
+    const prevDispatchedModelId = s.currentDispatchedModelId;
+    const prevSessionModel = ctx.model;
+    const prevSessionThinkingLevel = pi.getThinkingLevel();
     const modelResult = await deps.selectAndApplyModel(ctx, pi, unitType, unitId, s.basePath, prefs, s.verbose, s.autoModeStartModel, sidecarItem ? undefined : { isRetry, previousTier }, undefined, s.manualSessionModelOverride, s.autoModeStartThinkingLevel);
     s.currentUnitRouting =
         modelResult.routing;
@@ -1495,12 +1480,58 @@ export async function runUnitPhase(ic, iterData, loopState, sidecarItem) {
                 ? ctx.modelRegistry.getProviderAuthMode(ctx.model.provider)
                 : undefined,
         baseUrl: s.currentUnitModel?.baseUrl ?? ctx.model?.baseUrl,
+        activeTools: typeof pi.getActiveTools === "function" ? pi.getActiveTools() : [],
     });
     if (compatibilityError) {
+        s.currentUnitRouting = prevUnitRouting;
+        s.currentUnitModel = prevUnitModel;
+        s.currentDispatchedModelId = prevDispatchedModelId;
+        if (s.checkpointSha) {
+            cleanupCheckpoint(s.basePath, unitId);
+            s.checkpointSha = null;
+        }
+        if (prevSessionModel) {
+            const ok = await pi.setModel(prevSessionModel, { persist: false });
+            if (!ok) {
+                ctx.ui.notify("Failed to restore previous session model after compatibility check failure.", "warning");
+            }
+            if (prevSessionThinkingLevel) {
+                pi.setThinkingLevel(prevSessionThinkingLevel);
+            }
+        }
         ctx.ui.notify(compatibilityError, "error");
         await deps.stopAuto(ctx, pi, compatibilityError);
         return { action: "break", reason: "workflow-capability" };
     }
+    // Scope workflow-logger buffer to this unit so post-finalize drains are
+    // per-unit. Without this, the module-level _buffer accumulates across every
+    // unit in the same Node process (see workflow-logger.ts module header).
+    _resetLogs();
+    const unitStartedAt = Date.now();
+    s.unitDispatchCount.set(dispatchKey, nextDispatchCount);
+    s.currentUnit = { type: unitType, id: unitId, startedAt: unitStartedAt };
+    s.lastGitActionFailure = null;
+    s.lastGitActionStatus = null;
+    s.lastUnitAgentEndMessages = null;
+    setCurrentPhase(unitType, {
+        basePath: s.basePath,
+        traceId: ic.flowId,
+        turnId: `iter-${ic.iteration}`,
+        causedBy: "unit-start",
+    });
+    s.lastToolInvocationError = null; // #2883: clear stale error from previous unit
+    const unitStartSeq = ic.nextSeq();
+    deps.emitJournalEvent({ ts: new Date().toISOString(), flowId: ic.flowId, seq: unitStartSeq, eventType: "unit-start", data: { unitType, unitId } });
+    deps.captureAvailableSkills();
+    writeUnitRuntimeRecord(s.basePath, unitType, unitId, unitStartedAt, {
+        phase: "dispatched",
+        wrapupWarningSent: false,
+        timeoutAt: null,
+        lastProgressAt: unitStartedAt,
+        progressCount: 0,
+        lastProgressKind: "dispatch",
+        recoveryAttempts: 0, // Reset so re-dispatched units get full recovery budget (#2322)
+    });
     // Progress widget + preconditions — deferred to after model selection so the
     // widget's first render tick shows the correct model (#2899).
     deps.updateProgressWidget(ctx, unitType, unitId, state);
@@ -1930,6 +1961,18 @@ export async function runFinalize(ic, iterData, loopState, sidecarItem) {
             lastProgressAt: Date.now(),
             lastProgressKind: "finalize-success",
         });
+        if (!preUnitSnapshot.type.startsWith("hook/") &&
+            preUnitSnapshot.type !== "custom-step" &&
+            preUnitSnapshot.type !== "complete-milestone") {
+            setAutoOutcomeWidget(ctx, {
+                ...buildPhaseHandoffOutcome({
+                    unitType: preUnitSnapshot.type,
+                    unitId: preUnitSnapshot.id,
+                    agentEndMessages: s.lastUnitAgentEndMessages,
+                }),
+                startedAt: s.autoStartTime,
+            });
+        }
     }
     s.currentUnit = null;
     clearCurrentPhase();

package/dist/resources/extensions/gsd/auto-dashboard.js

@@ -27,6 +27,19 @@ export function extractUatSliceId(unitId) {
         return slice;
     return null;
 }
+export function buildPhaseHandoffOutcome(input) {
+    const phase = unitPhaseLabel(input.unitType);
+    const detail = extractLastAssistantSummary(input.agentEndMessages) ??
+        `Completed ${unitVerb(input.unitType)} ${input.unitId}.`;
+    return {
+        status: "complete",
+        title: `${phase} complete`,
+        detail,
+        unitLabel: `${unitVerb(input.unitType)} ${input.unitId}`,
+        nextAction: "Preparing the next phase. Review this handoff while the next session starts.",
+        commands: ["/gsd status for overview", "/gsd visualize to inspect", "/gsd notifications for history"],
+    };
+}
 // ─── Unit Description Helpers ─────────────────────────────────────────────────
 export function unitVerb(unitType) {
     if (unitType.startsWith("hook/"))
@@ -464,7 +477,6 @@ export function _resetWidgetModeForTests() {
 export function updateProgressWidget(ctx, unitType, unitId, state, accessors, tierBadge) {
     if (!ctx.hasUI)
         return;
-    ctx.ui.setWidget("gsd-outcome", undefined);
     // Welcome header is a startup-only banner — permanently suppress it once
     // auto-mode activates. The dashboard widget owns all status from here.
     // Note: setHeader(undefined) restores the built-in header (logo +
@@ -927,3 +939,56 @@ function normalizeRollupText(value) {
         return null;
     return clean;
 }
+function isAssistantMessage(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const record = value;
+    if (record.role === "assistant")
+        return true;
+    const message = record.message;
+    if (message && typeof message === "object") {
+        return message.role === "assistant";
+    }
+    return false;
+}
+function extractLastAssistantSummary(messages) {
+    if (!messages || messages.length === 0)
+        return null;
+    for (let i = messages.length - 1; i >= 0; i--) {
+        if (!isAssistantMessage(messages[i]))
+            continue;
+        const text = extractMessageText(messages[i]);
+        const clean = normalizeRollupText(text);
+        if (clean)
+            return truncateToWidth(clean, 220, "…");
+    }
+    return null;
+}
+function extractMessageText(value) {
+    if (typeof value === "string")
+        return value;
+    if (!value || typeof value !== "object")
+        return null;
+    const record = value;
+    if (typeof record.content === "string")
+        return record.content;
+    const message = record.message;
+    if (message && typeof message === "object") {
+        return extractMessageText(message);
+    }
+    const content = record.content;
+    if (Array.isArray(content)) {
+        const parts = content
+            .map((part) => {
+            if (typeof part === "string")
+                return part;
+            if (!part || typeof part !== "object")
+                return "";
+            const partRecord = part;
+            return typeof partRecord.text === "string" ? partRecord.text : "";
+        })
+            .filter(Boolean);
+        return parts.length > 0 ? parts.join(" ") : null;
+    }
+    return null;
+}

package/dist/resources/extensions/gsd/auto-direct-dispatch.js

@@ -224,6 +224,7 @@ export async function dispatchDirectPhase(ctx, pi, phase, base) {
         unitType,
         authMode: ctx.model?.provider ? ctx.modelRegistry.getProviderAuthMode(ctx.model.provider) : undefined,
         baseUrl: ctx.model?.baseUrl,
+        activeTools: typeof pi.getActiveTools === "function" ? pi.getActiveTools() : [],
     });
     if (compatibilityError) {
         ctx.ui.notify(compatibilityError, "error");

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -299,9 +299,7 @@ export const DISPATCH_RULES = [
             const attempts = incrementUatCount(basePath, mid, sliceId);
             if (attempts > MAX_UAT_ATTEMPTS) {
                 return {
-                    action: "stop",
-                    reason: `run-uat for ${mid}/${sliceId} has been dispatched ${attempts - 1} times without producing a verdict. Verification commands may be broken — fix the UAT spec or manually write an ASSESSMENT verdict.`,
-                    level: "warning",
+                    action: "skip",
                 };
             }
             const uatFile = resolveSliceFile(basePath, mid, sliceId, "UAT");
@@ -1098,16 +1096,16 @@ export const DISPATCH_RULES = [
                     return { action: "skip" };
                 }
             }
-            // Safety guard (#2675, #5747): block completion when VALIDATION
-            // verdict is non-passing. The state machine treats these verdicts as
-            // terminal, but completing-milestone should NOT proceed — remediation
-            // or human attention is needed.
+            // Safety guard (#2675, #5747, #5920): block completion when VALIDATION
+            // verdict is anything other than pass. The state machine treats these
+            // verdicts as terminal, but completing-milestone should NOT proceed —
+            // remediation or human attention is needed.
             const validationFile = resolveMilestoneFile(basePath, mid, "VALIDATION");
             if (validationFile) {
                 const validationContent = await loadFile(validationFile);
                 if (validationContent) {
                     const verdict = extractVerdict(validationContent);
-                    if (verdict === "needs-remediation" || verdict === "needs-attention") {
+                    if (verdict !== "pass") {
                         return {
                             action: "stop",
                             reason: `Cannot complete milestone ${mid}: VALIDATION verdict is "${verdict}". Address the validation findings and re-run validation, or update the verdict manually.`,
@@ -1125,16 +1123,12 @@ export const DISPATCH_RULES = [
                     level: "error",
                 };
             }
-            // Safety guard (#1703): verify the milestone produced implementation
-            // artifacts (non-.gsd/ files). A milestone with only plan files and
-            // zero implementation code should not be marked complete.
+            // Safety signal (#1703, #5097): detect milestones with only .gsd/
+            // artifacts. This no longer hard-blocks completion because some
+            // milestones are intentionally planning/documentation-only.
             const artifactCheck = hasImplementationArtifacts(basePath, mid);
             if (artifactCheck === "absent") {
-                return {
-                    action: "stop",
-                    reason: `Cannot complete milestone ${mid}: no implementation files found outside .gsd/. The milestone has only plan files — actual code changes are required.`,
-                    level: "error",
-                };
+                logWarning("dispatch", `Milestone ${mid} has no implementation files outside .gsd/ — continuing complete-milestone dispatch (planning-only/documentation-only milestone).`);
             }
             if (artifactCheck === "unknown") {
                 logWarning("dispatch", `Implementation artifact check inconclusive for ${mid} — proceeding (git context unavailable)`);

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -162,9 +162,16 @@ export function hasImplementationArtifacts(basePath, milestoneId) {
         // Strategy: check `git diff --name-only` against the merge-base with the
         // main branch. This captures ALL files changed during the milestone's
         // lifetime while running on a milestone branch.
-        const integrationBranch = milestoneId
-            ? readIntegrationBranch(basePath, milestoneId) ?? detectMainBranch(basePath)
-            : detectMainBranch(basePath);
+        const recordedIntegrationBranch = milestoneId
+            ? readIntegrationBranch(basePath, milestoneId)
+            : null;
+        let integrationBranch;
+        if (recordedIntegrationBranch?.startsWith("milestone/")) {
+            integrationBranch = detectMainBranch(basePath);
+        }
+        else {
+            integrationBranch = recordedIntegrationBranch ?? detectMainBranch(basePath);
+        }
         const currentBranch = getCurrentBranch(basePath);
         const branchDiff = getChangedFilesSinceBranch(basePath, integrationBranch);
         if (!branchDiff.ok)
@@ -496,29 +503,49 @@ function commitMatchesMilestone(basePath, message, milestoneId, files) {
     // rather than Mxx/Sxx/Tyy. Bind those commits back to the milestone when
     // either the commit touched this milestone's artifacts, or — for projects
     // where .gsd/ is gitignored/external (#5033) — the message explicitly
-    // names the milestone or local GSD state proves the task belongs here.
+    // names the milestone, local GSD state proves the task belongs here, or the
+    // commit is implementation-bearing evidence itself (#5100).
     if (/^GSD-Task:\s*S[^/\s]+\/T\S+/m.test(message)) {
         if (files.some((file) => isMilestoneArtifactPath(file, milestoneId)))
             return true;
         if (commitMessageMentionsMilestone(message, milestoneId))
             return true;
-        if (commitTaskTrailerBelongsToMilestone(basePath, message, milestoneId))
+        const taskTrailerOwnership = getTaskOwnershipStatus(basePath, message, milestoneId);
+        if (taskTrailerOwnership === true)
+            return true;
+        if (taskTrailerOwnership === false)
+            return false;
+        // taskTrailerOwnership === null: unknown ownership. Apply fallback only
+        // in this case to avoid cross-milestone attribution.
+        if (MILESTONE_ID_RE.test(milestoneId) && classifyImplementationFiles(files) === "present")
             return true;
     }
     return false;
 }
-function commitTaskTrailerBelongsToMilestone(basePath, message, milestoneId) {
+/**
+ * Tri-state task ownership probe.
+ * true => DB or local files confirm this milestone owns the task.
+ * false => DB is available and this milestone is registered, but task is absent.
+ * null => ownership unknown (milestone not in DB yet, or no DB + no local files).
+ */
+function getTaskOwnershipStatus(basePath, message, milestoneId) {
     const match = message.match(/^GSD-Task:\s*(S[^/\s]+)\/(T[^\s]+)/m);
     if (!match)
-        return false;
+        return null;
     const [, sliceId, taskId] = match;
-    if (getTask(milestoneId, sliceId, taskId))
-        return true;
+    if (isDbAvailable()) {
+        if (!getMilestone(milestoneId))
+            return null;
+        return getTask(milestoneId, sliceId, taskId) ? true : false;
+    }
+    // DB unavailable: fallback to local task-file presence.
     const tasksDir = resolveTasksDir(basePath, milestoneId, sliceId);
-    if (!tasksDir)
-        return false;
-    return existsSync(join(tasksDir, `${taskId}-PLAN.md`))
-        || existsSync(join(tasksDir, `${taskId}-SUMMARY.md`));
+    if (tasksDir
+        && (existsSync(join(tasksDir, `${taskId}-PLAN.md`))
+            || existsSync(join(tasksDir, `${taskId}-SUMMARY.md`)))) {
+        return true;
+    }
+    return null;
 }
 function commitMessageMentionsMilestone(message, milestoneId) {
     if (!MILESTONE_ID_RE.test(milestoneId))

package/dist/resources/extensions/gsd/auto-start.js

@@ -21,10 +21,10 @@ import { invalidateAllCaches } from "./cache.js";
 import { writeLock, clearLock } from "./crash-recovery.js";
 import { acquireSessionLock, releaseSessionLock, updateSessionLock, } from "./session-lock.js";
 import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
-import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeCheckoutBranch, nativeBranchList, nativeBranchExists, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, } from "./native-git-bridge.js";
+import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeBranchList, nativeBranchExists, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
-import { getAutoWorktreePath } from "./auto-worktree.js";
+import { getAutoWorktreePath, checkoutBranchWithStashGuard } from "./auto-worktree.js";
 import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
 import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
@@ -901,7 +901,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
                 const integrationBranch = nativeDetectMainBranch(base);
                 const branchToCheckout = resolveIsolationNoneBranchCheckout(currentBranch, integrationBranch, isolationMode, isRepo);
                 if (branchToCheckout) {
-                    nativeCheckoutBranch(base, branchToCheckout);
+                    checkoutBranchWithStashGuard(base, branchToCheckout, "isolation-none-recovery");
                     logWarning("bootstrap", `Returned to "${branchToCheckout}" — HEAD was on stale milestone branch "${currentBranch}" (isolation: none does not use milestone branches).`);
                 }
             }

package/dist/resources/extensions/gsd/auto-verification.js

@@ -65,12 +65,25 @@ async function runValidateMilestonePostCheck(vctx, pauseAuto) {
     const { milestone: mid } = parseUnitId(s.currentUnit.id);
     if (!mid)
         return "continue";
+    const setToolFailureRetry = (message) => {
+        const retryKey = verificationRetryKey(s.currentUnit.type, s.currentUnit.id);
+        const attempt = (s.verificationRetryCount.get(retryKey) ?? 0) + 1;
+        s.verificationRetryCount.set(retryKey, attempt);
+        s.pendingVerificationRetry = {
+            unitId: s.currentUnit.id,
+            failureContext: message,
+            attempt,
+        };
+        return "retry";
+    };
     const validationFile = resolveMilestoneFile(s.basePath, mid, "VALIDATION");
-    if (!validationFile)
-        return "continue";
+    if (!validationFile) {
+        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. No VALIDATION.md was created.");
+    }
     const validationContent = await loadFile(validationFile);
-    if (!validationContent)
-        return "continue";
+    if (!validationContent) {
+        return setToolFailureRetry("You must call gsd_validate_milestone to persist the validation results. VALIDATION.md exists but is empty.");
+    }
     const verdict = extractVerdict(validationContent);
     if (verdict !== "needs-remediation") {
         await persistMilestoneValidationGate("pass", "none", `milestone validation verdict is ${verdict}; no remediation loop risk`, "", mid);

package/dist/resources/extensions/gsd/auto-worktree.js

@@ -870,7 +870,63 @@ export function enterBranchModeForMilestone(basePath, milestoneId) {
             reused: true,
         });
     }
-    nativeCheckoutBranch(basePath, branch);
+    checkoutBranchWithStashGuard(basePath, branch, `enter-branch-mode:${milestoneId}`);
+}
+export function checkoutBranchWithStashGuard(basePath, branch, reason) {
+    let stashMarker = null;
+    let stashed = false;
+    const status = nativeWorkingTreeStatus(basePath).trim();
+    if (status.length > 0) {
+        stashMarker = `gsd-checkout-stash:${reason}:${process.pid}:${Date.now()}:${process.hrtime.bigint().toString(36)}`;
+        const stashListBefore = execFileSync("git", ["stash", "list"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        execFileSync("git", ["stash", "push", "--include-untracked", "-m", `gsd: checkout stash [${stashMarker}]`], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        const stashListAfter = execFileSync("git", ["stash", "list"], {
+            cwd: basePath,
+            stdio: ["ignore", "pipe", "pipe"],
+            encoding: "utf-8",
+        });
+        stashed = stashListAfter !== stashListBefore;
+    }
+    // Checkout and stash-restore are split so we can distinguish two failure
+    // modes: (a) checkout failed → HEAD did not move, restore stash and rethrow;
+    // (b) checkout succeeded but stash pop failed → HEAD moved to `branch` but
+    // the working-tree changes remain in the stash list. We surface a distinct
+    // error in case (b) so callers don't assume the branch switch was rolled back.
+    try {
+        nativeCheckoutBranch(basePath, branch);
+    }
+    catch (checkoutErr) {
+        if (stashed) {
+            try {
+                popStashByRef(basePath, stashMarker);
+            }
+            catch (restoreErr) {
+                logWarning("worktree", `git stash pop failed during checkout restore: ${restoreErr instanceof Error ? restoreErr.message : String(restoreErr)}`);
+            }
+        }
+        throw checkoutErr;
+    }
+    if (stashed) {
+        try {
+            popStashByRef(basePath, stashMarker);
+        }
+        catch (popErr) {
+            const msg = popErr instanceof Error ? popErr.message : String(popErr);
+            const wrapped = new Error(`checkout to '${branch}' succeeded but stash restore failed; working tree changes remain in the stash list. Original error: ${msg}`);
+            const ref = popErr?.stashRef;
+            if (ref)
+                wrapped.stashRef = ref;
+            throw wrapped;
+        }
+    }
 }
 // ─── Public API ────────────────────────────────────────────────────────────
 /**
@@ -1727,14 +1783,6 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
         // report the dirty tree if it fails.
         logWarning("worktree", `git stash failed: ${err instanceof Error ? err.message : String(err)}`);
     }
-    if (needsDbCycle && dbPathToReopen) {
-        try {
-            openDatabase(dbPathToReopen);
-        }
-        catch (err) {
-            logWarning("worktree", `post-stash db reopen failed: ${err instanceof Error ? err.message : String(err)}`);
-        }
-    }
     // 7b. Clean up stale merge state before attempting squash merge (#2912).
     // A leftover MERGE_HEAD (from a previous failed merge, libgit2 native path,
     // or interrupted operation) causes `git merge --squash` to refuse with
@@ -1743,6 +1791,14 @@ export function mergeMilestoneToMain(originalBasePath_, milestoneId, roadmapCont
     removeMergeStateFiles(originalBasePath_, "pre-merge");
     // 8. Squash merge — auto-resolve .gsd/ state file conflicts (#530)
     const mergeResult = nativeMergeSquash(originalBasePath_, milestoneBranch);
+    if (needsDbCycle && dbPathToReopen) {
+        try {
+            openDatabase(dbPathToReopen);
+        }
+        catch (err) {
+            logWarning("worktree", `post-merge db reopen failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
     if (!mergeResult.success) {
         // Dirty working tree — the merge was rejected before it started (e.g.
         // untracked .gsd/ files left by syncStateToProjectRoot).  Preserve the

package/dist/resources/extensions/gsd/auto.js

@@ -127,6 +127,12 @@ import { normalizeRealPath } from "./paths.js";
 // ─────────────────────────────────────────────────────────────────────────────
 /** Throttle STATE.md rebuilds — at most once per 30 seconds */
 const STATE_REBUILD_MIN_INTERVAL_MS = 30_000;
+export function formatAutoStopNotification(prefix, totals, unitCount) {
+    return [
+        `${prefix}.`,
+        `Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${unitCount} units`,
+    ].join("\n");
+}
 /**
  * Phase B — register this auto-mode process in the workers table so other
  * workers and janitors can detect liveness via heartbeat. Best-effort: if
@@ -1030,7 +1036,7 @@ export async function stopAuto(ctx, pi, reason, options = {}) {
                     : `Auto-mode stopped${reasonSuffix}`;
             if (ledger && ledger.units.length > 0) {
                 const totals = getProjectTotals(ledger.units);
-                ctx?.ui.notify(`${notificationPrefix}. Session: ${formatCost(totals.cost)} · ${formatTokenCount(totals.tokens.total)} tokens · ${ledger.units.length} units`, "info");
+                ctx?.ui.notify(formatAutoStopNotification(notificationPrefix, totals, ledger.units.length), "info");
             }
             else {
                 ctx?.ui.notify(`${notificationPrefix}.`, "info");
@@ -1319,7 +1325,6 @@ export async function pauseAuto(ctx, _pi, _errorContext) {
     restoreProjectRootEnv();
     restoreMilestoneLockEnv();
     s.pendingVerificationRetry = null;
-    s.verificationRetryCount.clear();
     ctx?.ui.setStatus("gsd-auto", "paused");
     ctx?.ui.setWidget("gsd-progress", undefined);
     const resumeCmd = s.stepMode ? "/gsd next" : "/gsd auto";