gsd-pi 2.82.0 → 3.0.0-dev.8b8d129d7

package/dist/resources/extensions/gsd/provider-switch-observer.js

@@ -0,0 +1,146 @@
+// GSD-2 — ADR-005 Phase 3b: surface ProviderSwitchReport from pi-ai.
+//
+// pi-ai builds a ProviderSwitchReport on every cross-provider transform but
+// only logs it to stderr when GSD_VERBOSE=1. This module installs a
+// single-subscriber observer that surfaces non-empty reports through GSD's
+// three usual telemetry surfaces:
+//
+//   1. UOK audit event (category model-policy, type provider-switch) — only
+//      when an auto trace is active.
+//   2. Persistent notification (.gsd/notifications.jsonl, severity warning) —
+//      whenever the GSD basePath is known, so users see the loss in the
+//      dashboard / status surface without GSD_VERBOSE.
+//   3. In-memory counter, exposed via getProviderSwitchStats() so any
+//      caller (dashboard, doctor, tests) can read the rollup.
+import { setProviderSwitchObserver } from "@gsd/pi-ai";
+import { autoSession } from "./auto-runtime-state.js";
+import { appendNotification } from "./notification-store.js";
+import { buildAuditEnvelope, emitUokAuditEvent } from "./uok/audit.js";
+const INTERACTIVE_TRACE_KEY = "interactive";
+let installed = false;
+let totalSwitches = 0;
+const totals = {
+    thinkingBlocksDropped: 0,
+    thinkingBlocksDowngraded: 0,
+    toolCallIdsRemapped: 0,
+    syntheticToolResultsInserted: 0,
+    thoughtSignaturesDropped: 0,
+};
+const byTrace = new Map();
+let lastReport = null;
+let lastAt = null;
+/** Format a one-line summary suitable for a notification message. */
+function summarize(report) {
+    const parts = [];
+    if (report.thinkingBlocksDropped > 0)
+        parts.push(`${report.thinkingBlocksDropped} thinking dropped`);
+    if (report.thinkingBlocksDowngraded > 0)
+        parts.push(`${report.thinkingBlocksDowngraded} thinking downgraded`);
+    if (report.toolCallIdsRemapped > 0)
+        parts.push(`${report.toolCallIdsRemapped} tool ids remapped`);
+    if (report.syntheticToolResultsInserted > 0)
+        parts.push(`${report.syntheticToolResultsInserted} synthetic tool results`);
+    if (report.thoughtSignaturesDropped > 0)
+        parts.push(`${report.thoughtSignaturesDropped} thought signatures dropped`);
+    return `Provider switch ${report.fromApi} → ${report.toApi}: ${parts.join(", ")}`;
+}
+function recordReport(report) {
+    const now = new Date().toISOString();
+    totalSwitches += 1;
+    totals.thinkingBlocksDropped += report.thinkingBlocksDropped;
+    totals.thinkingBlocksDowngraded += report.thinkingBlocksDowngraded;
+    totals.toolCallIdsRemapped += report.toolCallIdsRemapped;
+    totals.syntheticToolResultsInserted += report.syntheticToolResultsInserted;
+    totals.thoughtSignaturesDropped += report.thoughtSignaturesDropped;
+    lastReport = report;
+    lastAt = now;
+    const traceKey = autoSession.currentTraceId ?? INTERACTIVE_TRACE_KEY;
+    const existing = byTrace.get(traceKey);
+    if (existing) {
+        existing.switches += 1;
+        existing.lastReport = report;
+        existing.lastAt = now;
+    }
+    else {
+        byTrace.set(traceKey, { switches: 1, lastReport: report, lastAt: now });
+    }
+}
+function emitAudit(report) {
+    const traceId = autoSession.currentTraceId;
+    const basePath = autoSession.basePath;
+    if (!traceId || !basePath)
+        return;
+    try {
+        emitUokAuditEvent(basePath, buildAuditEnvelope({
+            traceId,
+            category: "model-policy",
+            type: "provider-switch",
+            payload: {
+                fromApi: report.fromApi,
+                toApi: report.toApi,
+                thinkingBlocksDropped: report.thinkingBlocksDropped,
+                thinkingBlocksDowngraded: report.thinkingBlocksDowngraded,
+                toolCallIdsRemapped: report.toolCallIdsRemapped,
+                syntheticToolResultsInserted: report.syntheticToolResultsInserted,
+                thoughtSignaturesDropped: report.thoughtSignaturesDropped,
+            },
+        }));
+    }
+    catch {
+        // Audit emission is best-effort. Counter + notification still fire.
+    }
+}
+function emitNotification(report) {
+    try {
+        appendNotification(summarize(report), "warning", "workflow-logger");
+    }
+    catch {
+        // Notification persistence is best-effort.
+    }
+}
+function handleReport(report) {
+    recordReport(report);
+    emitAudit(report);
+    emitNotification(report);
+}
+/**
+ * Install the pi-ai observer. Idempotent — calling more than once is a no-op
+ * after the first install.
+ */
+export function installProviderSwitchObserver() {
+    if (installed)
+        return;
+    setProviderSwitchObserver(handleReport);
+    installed = true;
+}
+/** Uninstall the observer. Intended for tests. */
+export function uninstallProviderSwitchObserver() {
+    setProviderSwitchObserver(undefined);
+    installed = false;
+}
+/** Read-only snapshot of the in-memory rollup. */
+export function getProviderSwitchStats() {
+    const trace = {};
+    for (const [key, value] of byTrace) {
+        trace[key] = { switches: value.switches, lastReport: { ...value.lastReport }, lastAt: value.lastAt };
+    }
+    return {
+        totalSwitches,
+        totals: { ...totals },
+        byTrace: trace,
+        lastReport: lastReport ? { ...lastReport } : null,
+        lastAt,
+    };
+}
+/** Reset the in-memory rollup. Intended for tests. */
+export function _resetProviderSwitchStats() {
+    totalSwitches = 0;
+    totals.thinkingBlocksDropped = 0;
+    totals.thinkingBlocksDowngraded = 0;
+    totals.toolCallIdsRemapped = 0;
+    totals.syntheticToolResultsInserted = 0;
+    totals.thoughtSignaturesDropped = 0;
+    byTrace.clear();
+    lastReport = null;
+    lastAt = null;
+}

package/dist/resources/extensions/gsd/queue-reorder-ui.js

@@ -24,6 +24,7 @@ export async function showQueueReorder(ctx, completed, pending) {
         const items = [...pending];
         let cursor = 0;
         let grabbed = false;
+        let scrollOffset = 0;
         let cachedLines;
         let validation;
         // Mutable deps map — tracks removals during this session
@@ -128,9 +129,11 @@ export async function showQueueReorder(ctx, completed, pending) {
                 return cachedLines;
             const ui = makeUI(theme, width);
             const lines = [];
+            const queueRows = [];
             const push = (...rows) => { for (const r of rows)
                 lines.push(...r); };
             const add = (s) => truncateToWidth(s, width);
+            let cursorQueueRow = 0;
             const headerText = grabbed ? "  Queue Reorder — Moving Item" : "  Queue Reorder";
             push(ui.bar(), ui.blank(), ui.header(headerText), ui.blank());
             // Completed milestones (dimmed)
@@ -153,13 +156,15 @@ export async function showQueueReorder(ctx, completed, pending) {
                 const num = i + 1;
                 const label = item.title && item.title !== item.id ? `${item.id}  ${item.title}` : item.id;
                 if (isCursor && grabbed) {
-                    lines.push(add(`  ${theme.fg("warning", `▸▸ ${num}. ${label}`)}`));
+                    cursorQueueRow = queueRows.length;
+                    queueRows.push(add(`  ${theme.fg("warning", `▸▸ ${num}. ${label}`)}`));
                 }
                 else if (isCursor) {
-                    lines.push(add(`  ${theme.fg("accent", `${GLYPH.cursor} ${num}. ${label}`)}`));
+                    cursorQueueRow = queueRows.length;
+                    queueRows.push(add(`  ${theme.fg("accent", `${GLYPH.cursor} ${num}. ${label}`)}`));
                 }
                 else {
-                    lines.push(add(`    ${theme.fg("text", `${num}. ${label}`)}`));
+                    queueRows.push(add(`    ${theme.fg("text", `${num}. ${label}`)}`));
                 }
                 // depends_on annotations
                 const deps = liveDeps.get(item.id) ?? [];
@@ -168,34 +173,35 @@ export async function showQueueReorder(ctx, completed, pending) {
                         continue;
                     const pairKey = `${item.id}:${dep}`;
                     if (violatedPairs.has(pairKey)) {
-                        lines.push(add(`       ${theme.fg("warning", `${GLYPH.statusWarning} depends_on: ${dep} — auto-removed on confirm`)}`));
+                        queueRows.push(add(`       ${theme.fg("warning", `${GLYPH.statusWarning} depends_on: ${dep} — auto-removed on confirm`)}`));
                     }
                     else if (redundantPairs.has(pairKey)) {
-                        lines.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep} (redundant)`)}`));
+                        queueRows.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep} (redundant)`)}`));
                     }
                     else {
-                        lines.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep}`)}`));
+                        queueRows.push(add(`       ${theme.fg("dim", `↳ depends_on: ${dep}`)}`));
                     }
                 }
                 // Missing deps
                 for (const v of validation.violations.filter(v => v.milestone === item.id && v.type === 'missing_dep')) {
-                    lines.push(add(`       ${theme.fg("error", `${GLYPH.statusWarning} depends_on: ${v.dependsOn} (does not exist)`)}`));
+                    queueRows.push(add(`       ${theme.fg("error", `${GLYPH.statusWarning} depends_on: ${v.dependsOn} (does not exist)`)}`));
                 }
             }
             // Removed deps feedback
+            const trailingLines = [];
             if (removedDeps.length > 0) {
-                push(ui.blank());
+                trailingLines.push(...ui.blank());
                 for (const r of removedDeps) {
-                    lines.push(add(`  ${theme.fg("success", `${GLYPH.statusDone} Removed: ${r.milestone} depends_on ${r.dep}`)}`));
+                    trailingLines.push(add(`  ${theme.fg("success", `${GLYPH.statusDone} Removed: ${r.milestone} depends_on ${r.dep}`)}`));
                 }
             }
             // Circular warning
             const circ = validation.violations.find(v => v.type === 'circular');
             if (circ) {
-                push(ui.blank());
-                lines.push(add(`  ${theme.fg("error", `${GLYPH.statusWarning} ${circ.message}`)}`));
+                trailingLines.push(...ui.blank());
+                trailingLines.push(add(`  ${theme.fg("error", `${GLYPH.statusWarning} ${circ.message}`)}`));
             }
-            push(ui.blank());
+            trailingLines.push(...ui.blank());
             // Hints — context-sensitive based on grab state
             const hints = [];
             if (grabbed) {
@@ -215,7 +221,18 @@ export async function showQueueReorder(ctx, completed, pending) {
                 hints.push("enter ok");
             }
             hints.push("esc");
-            push(ui.hints(hints), ui.bar());
+            trailingLines.push(...ui.hints(hints), ...ui.bar());
+            const maxOverlayRows = Math.max(10, process.stdout.rows ? Math.floor(process.stdout.rows * 0.8) : 24);
+            const availableQueueRows = Math.max(1, maxOverlayRows - lines.length - trailingLines.length);
+            const maxScroll = Math.max(0, queueRows.length - availableQueueRows);
+            if (cursorQueueRow < scrollOffset) {
+                scrollOffset = cursorQueueRow;
+            }
+            else if (cursorQueueRow >= scrollOffset + availableQueueRows) {
+                scrollOffset = cursorQueueRow - availableQueueRows + 1;
+            }
+            scrollOffset = Math.min(Math.max(scrollOffset, 0), maxScroll);
+            lines.push(...queueRows.slice(scrollOffset, scrollOffset + availableQueueRows), ...trailingLines);
             cachedLines = lines;
             return lines;
         }

package/dist/resources/extensions/gsd/repository-registry.js

@@ -0,0 +1,44 @@
+// GSD-2 + Repository registry seam for parent workspace multi-repo resolution.
+import { isAbsolute, relative, resolve } from "node:path";
+import { resolveGsdPathContract } from "./paths.js";
+function assertInsideProjectRoot(projectRoot, candidateRoot, repoId) {
+    const rel = relative(projectRoot, candidateRoot);
+    if (rel === "")
+        return;
+    if (rel.startsWith("..") || isAbsolute(rel)) {
+        throw new Error(`workspace.repositories.${repoId}.path resolves outside project root: ${candidateRoot}`);
+    }
+}
+function resolveRepositoryRoot(projectRoot, repoId, repo) {
+    const root = resolve(projectRoot, repo.path);
+    assertInsideProjectRoot(projectRoot, root, repoId);
+    return {
+        id: repoId,
+        root,
+        role: repo.role,
+        verification: repo.verification,
+        commitPolicy: repo.commit_policy,
+    };
+}
+export function createRepositoryRegistry(basePath, workspacePrefs) {
+    const contract = resolveGsdPathContract(basePath);
+    const projectRoot = contract.projectRoot;
+    const mode = workspacePrefs?.mode ?? "project";
+    const repoMap = new Map();
+    // Backward-compatible default for single-repo projects.
+    // Explicit workspacePrefs?.repositories entries can override "project"
+    // via resolveRepositoryRoot to customize role/verification/commit policy.
+    repoMap.set("project", { id: "project", root: projectRoot });
+    for (const [repoId, repoConfig] of Object.entries(workspacePrefs?.repositories ?? {})) {
+        repoMap.set(repoId, resolveRepositoryRoot(projectRoot, repoId, repoConfig));
+    }
+    return {
+        projectRoot,
+        mode,
+        repositories: Array.from(repoMap.values()),
+        byId: repoMap,
+    };
+}
+export function createRepositoryRegistryFromPreferences(basePath, preferences) {
+    return createRepositoryRegistry(basePath, preferences?.workspace);
+}

package/dist/resources/extensions/gsd/safety/evidence-collector.js

@@ -17,6 +17,8 @@ import { randomBytes } from "node:crypto";
 const EXECUTION_TOOL_NAMES = new Set([
     "bash",
     "Bash",
+    "PowerShell",
+    "async_bash",
     "gsd_exec",
     "gsd_exec_search",
     "mcp__gsd-workflow__gsd_exec",

package/dist/resources/extensions/gsd/safety/evidence-cross-ref.js

@@ -15,7 +15,7 @@
 export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
     const bashCalls = actualEvidence.filter((e) => e.kind === "bash");
     const mismatches = [];
-    for (const claimed of claimedEvidence) {
+    for (const claimed of latestClaimBatch(claimedEvidence)) {
         // Skip coerced entries — they're already flagged with exitCode: -1
         // and verdict: "unknown (coerced from string)" by db-tools.ts
         if (claimed.verdict?.includes("coerced from string"))
@@ -25,9 +25,11 @@ export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
         // Skip entries with empty or generic commands
         if (!claimed.command || claimed.command.length < 3)
             continue;
-        // Find matching bash call by command substring match
-        const match = findBestMatch(claimed.command, bashCalls);
-        if (!match) {
+        // Find matching bash calls by command similarity. A command may be retried
+        // after a failed first run; the newest matching execution is the one that
+        // supports or rejects a claimed pass.
+        const matches = findMatches(claimed.command, bashCalls);
+        if (matches.length === 0) {
             mismatches.push({
                 severity: "warning",
                 claimed,
@@ -37,6 +39,7 @@ export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
             continue;
         }
         // Exit code mismatch: LLM claims success but actual command failed
+        const match = latestMatch(matches);
         if (claimed.exitCode === 0 && match.exitCode !== 0) {
             mismatches.push({
                 severity: "error",
@@ -50,34 +53,55 @@ export function crossReferenceEvidence(claimedEvidence, actualEvidence) {
 }
 // ─── Internals ──────────────────────────────────────────────────────────────
 /**
- * Find the best matching bash evidence entry for a claimed command.
+ * Verification evidence rows are append-only across retries, but a task
+ * completion inserts one batch at a single created_at timestamp. When that
+ * timestamp is present, safety should judge the newest completion claim only.
+ */
+function latestClaimBatch(claimedEvidence) {
+    const dated = claimedEvidence
+        .map((claim) => ({
+        claim,
+        time: typeof claim.createdAt === "string" ? Date.parse(claim.createdAt) : Number.NaN,
+    }))
+        .filter((entry) => Number.isFinite(entry.time));
+    if (dated.length === 0)
+        return claimedEvidence;
+    const latestTime = Math.max(...dated.map((entry) => entry.time));
+    return claimedEvidence.filter((claim) => (typeof claim.createdAt === "string" && Date.parse(claim.createdAt) === latestTime));
+}
+/**
+ * Find bash evidence entries matching a claimed command.
  * Uses substring matching — the claimed command may be a shortened version
  * of the actual command, or vice versa.
  */
-function findBestMatch(claimedCommand, bashCalls) {
+function findMatches(claimedCommand, bashCalls) {
     const normalized = claimedCommand.trim();
-    // Exact match first
-    const exact = bashCalls.find(b => b.command.trim() === normalized);
-    if (exact)
+    // Exact matches first
+    const exact = bashCalls.filter(b => b.command.trim() === normalized);
+    if (exact.length > 0)
         return exact;
     // Substring match: claimed is contained in actual or actual in claimed
-    const substring = bashCalls.find(b => b.command.includes(normalized) || normalized.includes(b.command));
-    if (substring)
+    const substring = bashCalls.filter(b => b.command.includes(normalized) || normalized.includes(b.command));
+    if (substring.length > 0)
         return substring;
     // Token match: split on whitespace and check significant overlap
     const claimedTokens = normalized.split(/\s+/).filter(t => t.length > 2);
     if (claimedTokens.length === 0)
-        return null;
-    let bestMatch = null;
-    let bestScore = 0;
+        return [];
+    const scoredMatches = [];
     for (const call of bashCalls) {
         const callTokens = new Set(call.command.split(/\s+/));
         const matchCount = claimedTokens.filter(t => callTokens.has(t)).length;
         const score = matchCount / claimedTokens.length;
-        if (score > bestScore && score >= 0.5) {
-            bestScore = score;
-            bestMatch = call;
+        if (score >= 0.5) {
+            scoredMatches.push({ call, score });
         }
     }
-    return bestMatch;
+    const bestScore = Math.max(0, ...scoredMatches.map((match) => match.score));
+    return scoredMatches
+        .filter((match) => match.score === bestScore)
+        .map((match) => match.call);
+}
+function latestMatch(matches) {
+    return matches.reduce((latest, match) => (match.timestamp > latest.timestamp ? match : latest));
 }

package/dist/resources/extensions/gsd/slice-parallel-orchestrator.js

@@ -14,8 +14,8 @@
  */
 import { execFileSync, spawn } from "node:child_process";
 import { randomUUID } from "node:crypto";
-import { appendFileSync, existsSync, writeFileSync, readFileSync, mkdirSync, renameSync, unlinkSync, } from "node:fs";
-import { join, dirname } from "node:path";
+import { appendFileSync, existsSync, lstatSync, rmSync, writeFileSync, readFileSync, mkdirSync, renameSync, unlinkSync, } from "node:fs";
+import { isAbsolute, join, dirname, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import { gsdRoot } from "./paths.js";
 import { createWorktree, worktreePath, removeWorktree } from "./worktree-manager.js";
@@ -46,6 +46,44 @@ export function _buildSliceWorkerEnvForTest(basePath, milestoneId, sliceId, work
         GSD_SLICE_WORKER_TOKEN: workerToken,
     };
 }
+function isValidSliceWorktreePath(basePath, wtPath) {
+    if (!existsSync(wtPath))
+        return false;
+    const gitPath = join(wtPath, ".git");
+    if (!existsSync(gitPath))
+        return false;
+    try {
+        if (!lstatSync(gitPath).isFile())
+            return false;
+        const content = readFileSync(gitPath, "utf8").trim();
+        if (!content.startsWith("gitdir: "))
+            return false;
+        const rawGitdir = content.slice("gitdir: ".length).trim();
+        if (!rawGitdir)
+            return false;
+        const resolvedGitdir = isAbsolute(rawGitdir) ? rawGitdir : resolve(wtPath, rawGitdir);
+        const expectedPrefix = join(basePath, ".git", "worktrees").replaceAll("\\", "/");
+        const normalized = resolvedGitdir.replaceAll("\\", "/");
+        return normalized === expectedPrefix || normalized.startsWith(`${expectedPrefix}/`);
+    }
+    catch {
+        return false;
+    }
+}
+function isWorkerPidAlive(pid) {
+    if (!Number.isFinite(pid) || pid <= 0)
+        return false;
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch (err) {
+        const code = err?.code;
+        if (code === "ESRCH")
+            return false;
+        return true;
+    }
+}
 function sliceStateFilePath(basePath) {
     return join(gsdRoot(basePath), SLICE_ORCHESTRATOR_STATE_FILE);
 }
@@ -318,6 +356,9 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
             const wtBranch = `slice/${milestoneId}/${slice.id}`;
             const wtName = `${milestoneId}-${slice.id}`;
             const wtPath = worktreePath(basePath, wtName);
+            if (existsSync(wtPath) && !isValidSliceWorktreePath(basePath, wtPath)) {
+                rmSync(wtPath, { recursive: true, force: true });
+            }
             if (!existsSync(wtPath)) {
                 createWorktree(basePath, wtName, { branch: wtBranch });
             }
@@ -361,6 +402,22 @@ export async function startSliceParallel(basePath, milestoneId, eligibleSlices,
             catch { /* ignore cleanup failures */ }
         }
     }
+    // Guard: if workers died immediately, treat as failed start so callers
+    // don't exit auto-mode and re-dispatch in a rapid loop.
+    for (let i = started.length - 1; i >= 0; i--) {
+        const sid = started[i];
+        const worker = sliceState.workers.get(sid);
+        if (worker && isWorkerPidAlive(worker.pid))
+            continue;
+        started.splice(i, 1);
+        errors.push({ sid, error: "Worker exited immediately after spawn" });
+        sliceState.workers.delete(sid);
+        const wtName = `${milestoneId}-${sid}`;
+        try {
+            removeWorktree(basePath, wtName, { deleteBranch: true, force: true });
+        }
+        catch { /* ignore cleanup failures */ }
+    }
     // If nothing started, deactivate
     if (started.length === 0) {
         sliceState.active = false;

package/dist/resources/extensions/gsd/smart-entry-routing.js

@@ -0,0 +1,36 @@
+// GSD-2 — Smart entry routing decisions.
+// Pure route selection for /gsd guided wizard choices.
+export function resolveGuidedExecuteLaunchMode(isolationMode) {
+    return isolationMode === "worktree" ? "auto-step" : "guided-dispatch";
+}
+export function resolveActiveTaskChoiceRoute(input) {
+    if (input.choice === "auto") {
+        return {
+            kind: "auto-bootstrap",
+            verboseMode: false,
+        };
+    }
+    if (input.choice === "execute") {
+        if (resolveGuidedExecuteLaunchMode(input.isolationMode) === "auto-step") {
+            return {
+                kind: "auto-bootstrap",
+                verboseMode: false,
+                options: {
+                    step: true,
+                    milestoneLock: input.milestoneId,
+                },
+            };
+        }
+        return {
+            kind: "guided-dispatch",
+            unitType: "execute-task",
+        };
+    }
+    if (input.choice === "status") {
+        return { kind: "status" };
+    }
+    if (input.choice === "milestone_actions") {
+        return { kind: "milestone-actions" };
+    }
+    throw new Error(`Invalid ActiveTaskChoice: ${input.choice}`);
+}

package/dist/resources/extensions/gsd/state-reconciliation/drift/merge-state.js

@@ -10,6 +10,7 @@ import { isAbsolute, join, resolve } from "node:path";
 import { getErrorMessage } from "../../error-utils.js";
 import { nativeAddPaths, nativeCheckoutTheirs, nativeCommit, nativeConflictFiles, nativeMergeAbort, nativeRebaseAbort, nativeResetHard, } from "../../native-git-bridge.js";
 import { logError, logWarning } from "../../workflow-logger.js";
+import { isGsdWorktreePath } from "../../worktree-root.js";
 const SILENT_NOTIFY = () => { };
 function resolveGitDir(basePath) {
     try {
@@ -23,7 +24,11 @@ function resolveGitDir(basePath) {
         }
     }
     catch (err) {
-        logWarning("recovery", `gitdir resolution failed: ${getErrorMessage(err)}`);
+        const message = getErrorMessage(err);
+        logWarning("recovery", `gitdir resolution failed: ${message}`);
+        if (isGsdWorktreePath(basePath)) {
+            throw new Error(`Worktree integrity failure: ${basePath} is not a valid git worktree (git rev-parse failed: ${message.split("\n")[0]}). Repair or recreate the worktree before retrying.`);
+        }
     }
     return join(basePath, ".git");
 }

package/dist/resources/extensions/gsd/state-reconciliation/drift/project-md.js

@@ -1,12 +1,11 @@
 // Project/App: GSD-2
 // File Purpose: ADR-017 unregistered-milestone drift handler. Detects
 // milestones whose on-disk directory has meaningful content (ROADMAP/
-// CONTEXT/SUMMARY) but no DB row, then runs the markdown importer to
-// reconcile. PROJECT.md is the human-facing index — the importer's source
-// of truth is the .gsd/milestones/ directory tree.
+// CONTEXT/SUMMARY) but no DB row, then fails closed with an explicit recovery
+// instruction. Markdown hierarchy import is reserved for operator-controlled
+// migration/recovery commands, not automatic runtime reconciliation.
 import { existsSync } from "node:fs";
 import { getMilestone, isDbAvailable } from "../../gsd-db.js";
-import { migrateHierarchyToDb } from "../../md-importer.js";
 import { findMilestoneIds } from "../../milestone-ids.js";
 import { resolveMilestoneFile } from "../../paths.js";
 function milestoneHasContent(basePath, milestoneId) {
@@ -31,17 +30,13 @@ export function detectUnregisteredMilestoneDrift(_state, ctx) {
     return drifts;
 }
 /**
- * Repair: invoke the markdown importer. migrateHierarchyToDb walks the same
- * findMilestoneIds list the detector uses and INSERTs OR IGNOREs every
- * missing milestone (and its slices/tasks) — idempotent under cap=2 retry.
- *
- * Note: even though we receive one record at a time, the importer is a
- * project-wide operation. Repeated invocation across multiple drift records
- * in the same pass is wasteful but safe; a future optimization could
- * coalesce by checking whether the importer has already run this pass.
+ * Repair intentionally fails closed. The project-root DB is authoritative at
+ * runtime; markdown-only milestones must be imported through an explicit
+ * migration/recovery command so operators opt into changing canonical state.
  */
-export function repairUnregisteredMilestone(_record, ctx) {
-    migrateHierarchyToDb(ctx.basePath);
+export function repairUnregisteredMilestone(record, _ctx) {
+    throw new Error(`Milestone ${record.milestoneId} exists only as markdown projection. ` +
+        "Runtime reconciliation will not import markdown into the authoritative DB; run explicit GSD recovery/migration if this markdown should repopulate the database.");
 }
 export const unregisteredMilestoneHandler = {
     kind: "unregistered-milestone",