@opengsd/gsd-pi 1.2.0-dev.84c56d87 → 1.2.0-dev.8e6112e9

package/src/resources/extensions/gsd/auto/workflow-unit-dispatch.ts

@@ -10,7 +10,7 @@ import type {
 } from "./types.js";
 import { ExecutionGraphScheduler } from "../uok/execution-graph.js";
 import type { UokGraphNode } from "../uok/contracts.js";
-import { runUnitPhase } from "./phases.js";
+import { runUnitPhase } from "./unit-phase.js";
 import { decideDispatchNodeKind } from "./workflow-kernel.js";
 
 export type DispatchContract = "legacy-direct" | "uok-scheduler";

package/src/resources/extensions/gsd/auto/worktree-safety-phase.ts

@@ -0,0 +1,149 @@
+// Project/App: gsd-pi
+// File Purpose: Worktree-safety helpers shared across auto-loop phase modules.
+
+import { classifyProject } from "../detection.js";
+import { resolveEffectiveUnitIsolationMode, getIsolationMode } from "../preferences.js";
+import { createWorktreeSafetyModule, type WorktreeSafetyResult } from "../worktree-safety.js";
+import { resolveWorktreeProjectRoot } from "../worktree-root.js";
+import { resolveManifest } from "../unit-context-manifest.js";
+import { debugLog } from "../debug-logger.js";
+import { isSamePathLocal } from "./phase-helpers.js";
+import { hasHeldMilestoneLease, reclaimMissingMilestoneLease } from "./milestone-lease-reclaim.js";
+import type { IterationContext } from "./types.js";
+
+export function shouldDegradeEmptyWorktreeToProjectRoot(
+  worktreeClassification: ReturnType<typeof classifyProject>,
+  projectRootClassification: ReturnType<typeof classifyProject>,
+): boolean {
+  return (
+    worktreeClassification.kind === "greenfield" &&
+    projectRootClassification.kind !== "greenfield" &&
+    projectRootClassification.kind !== "invalid-repo"
+  );
+}
+
+export function unitWritesSource(unitType: string): boolean | null {
+  if (unitType.startsWith("hook/")) return false;
+  // Backward compatibility: sidecar queues from older builds may persist
+  // prefixed unit types (e.g. "sidecar/quick-task").
+  const normalizedUnitType = unitType.startsWith("sidecar/")
+    ? unitType.slice("sidecar/".length)
+    : unitType;
+  const manifest = resolveManifest(normalizedUnitType);
+  if (!manifest) return null;
+  return manifest.tools.mode === "all" || manifest.tools.mode === "docs";
+}
+
+export function formatWorktreeSafetyFailure(result: Extract<WorktreeSafetyResult, { ok: false }>): string {
+  return `Worktree Safety failed (${result.kind}): ${result.reason} ${result.remediation}`;
+}
+
+export function formatWorktreeSafetyStopReason(result: Extract<WorktreeSafetyResult, { ok: false }>): string {
+  if (result.kind === "empty-worktree-with-project-content") {
+    return `Worktree Safety failed (${result.kind}). Run /gsd doctor fix, then /gsd auto.`;
+  }
+  return `Worktree Safety failed (${result.kind}).`;
+}
+
+export function resolveEmptyWorktreeWithProjectContent(
+  unitRoot: string,
+  projectRoot: string,
+): boolean {
+  if (isSamePathLocal(unitRoot, projectRoot)) return false;
+  const worktreeClassification = classifyProject(unitRoot);
+  if (worktreeClassification.kind !== "greenfield") return false;
+  const projectRootClassification = classifyProject(projectRoot);
+  return shouldDegradeEmptyWorktreeToProjectRoot(worktreeClassification, projectRootClassification);
+}
+
+export async function validateSourceWriteWorktreeSafety(
+  ic: IterationContext,
+  unitType: string,
+  unitId: string,
+  milestoneId: string | undefined,
+  phase: string,
+): Promise<{ action: "break"; reason: string } | null> {
+  const { ctx, pi, s, deps } = ic;
+  if (!s.basePath) return null;
+
+  // Custom engine workflows (graph-driven, registered via run dirs) define
+  // their own step ids that are not in the GSD UnitContextManifest. Don't
+  // fail closed for those — the custom engine owns its own dispatch
+  // contract. The fail-closed safety check applies only to built-in GSD
+  // units whose Tool Contract is registered in the manifest. Use a truthy
+  // check so undefined (test sessions that never set the field) routes
+  // through the safety check, matching the regression test contract.
+  if (s.activeEngineId) return null;
+
+  const writesSource = unitWritesSource(unitType);
+  if (writesSource === null) {
+    const msg = `Worktree Safety failed (missing-tool-contract): missing Tool Contract for ${unitType}. Add a UnitContextManifest entry before dispatching this Unit.`;
+    debugLog("worktreeSafety", {
+      phase,
+      unitType,
+      unitId,
+      milestoneId,
+      result: { ok: false, kind: "missing-tool-contract", reason: msg },
+      basePath: s.basePath,
+    });
+    ctx.ui.notify(msg, "error");
+    await deps.stopAuto(ctx, pi, msg);
+    return { action: "break", reason: "missing-tool-contract" };
+  }
+  if (!writesSource) return null;
+
+  const projectRoot = s.canonicalProjectRoot ?? resolveWorktreeProjectRoot(s.basePath, s.originalBasePath);
+  // A degraded session already fell back to the milestone branch in the
+  // project root — validating against the canonical worktree root there
+  // would fail every dispatch with a false invalid-root. The same applies
+  // to a stranded-recovery session that adopted the milestone branch.
+  const isolationMode = resolveEffectiveUnitIsolationMode(
+    deps.getIsolationMode(projectRoot),
+    s.isolationDegraded,
+    s.strandedRecoveryIsolationMode,
+  );
+  reclaimMissingMilestoneLease(s, milestoneId, isolationMode, phase);
+  const safety = createWorktreeSafetyModule();
+  const result = safety.validateUnitRoot({
+    unitType,
+    unitId,
+    writeScope: "source-writing",
+    projectRoot,
+    unitRoot: s.basePath,
+    milestoneId,
+    isolationMode,
+    expectedBranch:
+      isolationMode !== "none" && milestoneId ? deps.autoWorktreeBranch(milestoneId) : null,
+    emptyWorktreeWithProjectContent: resolveEmptyWorktreeWithProjectContent(s.basePath, projectRoot),
+    // The milestone lease coordinates concurrent workers on an isolated
+    // milestone worktree/branch, which is established by enterMilestone in
+    // worktree/branch modes. `none` mode has no per-milestone isolation and
+    // does not reliably claim a lease (e.g. a fresh headless resume of an
+    // already-active milestone never re-enters it), so requiring a held lease
+    // there would falsely fail dispatch. Enforce the lease only in isolated
+    // modes; none-mode safety still validates the unit root.
+    lease: s.workerId
+      ? {
+          required: isolationMode !== "none",
+          held: hasHeldMilestoneLease(s, milestoneId),
+          owner: s.workerId,
+        }
+      : undefined,
+  });
+
+  if (result.ok) return null;
+
+  const msg = formatWorktreeSafetyFailure(result);
+  debugLog("worktreeSafety", {
+    phase,
+    unitType,
+    unitId,
+    milestoneId,
+    result,
+    basePath: s.basePath,
+    projectRoot,
+  });
+  ctx.ui.notify(msg, "error");
+  await deps.stopAuto(ctx, pi, formatWorktreeSafetyStopReason(result));
+  return { action: "break", reason: result.kind };
+}

package/src/resources/extensions/gsd/auto-direct-dispatch.ts

@@ -10,10 +10,9 @@ import type {
 
 import { deriveState } from "./state.js";
 import { loadFile } from "./files.js";
-import { isDbAvailable, getMilestoneSlices } from "./gsd-db.js";
-import { parseRoadmap } from "./parsers-legacy.js";
+import { isDbAvailable, getClosedSliceIds } from "./gsd-db.js";
 import {
-  resolveMilestoneFile, resolveSliceFile, relSliceFile,
+  resolveSliceFile, relSliceFile,
 } from "./paths.js";
 import {
   buildResearchSlicePrompt,
@@ -32,10 +31,7 @@ import { loadEffectiveGSDPreferences } from "./preferences.js";
 import type { MinimalModelRegistry } from "./context-budget.js";
 import { pauseAuto } from "./auto.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
-import {
-  getWorkflowTransportSupportError,
-  getRequiredWorkflowToolsForAutoUnit,
-} from "./workflow-mcp.js";
+import { getUnitWorkflowDispatchReadinessError } from "./tool-contract.js";
 
 export async function dispatchDirectPhase(
   ctx: ExtensionCommandContext,
@@ -182,21 +178,9 @@ export async function dispatchDirectPhase(
 
     case "reassess":
     case "reassess-roadmap": {
-      // DB primary path — get completed slices, fall back to file parsing when DB has no data
-      let completedSliceIds: string[] = [];
-      if (isDbAvailable()) {
-        completedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-      }
-      if (completedSliceIds.length === 0) {
-        // File-based fallback: parse roadmap checkboxes
-        const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-        if (roadmapPath) {
-          const roadmapContent = await loadFile(roadmapPath);
-          if (roadmapContent) {
-            completedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-          }
-        }
-      }
+      // DB-authoritative read (ADR-017) — markdown projections are never
+      // consulted for dispatch decisions. No DB rows means no completed slices.
+      const completedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
       if (completedSliceIds.length === 0) {
         ctx.ui.notify("Cannot dispatch reassess-roadmap: no completed slices.", "warning");
         return;
@@ -222,20 +206,9 @@ export async function dispatchDirectPhase(
       // incomplete) slice. After slice completion, state.activeSlice advances
       // to the next incomplete slice, so we find the last done slice from the
       // roadmap instead (#1693).
-      let uatCompletedSliceIds: string[] = [];
-      if (isDbAvailable()) {
-        uatCompletedSliceIds = getMilestoneSlices(mid).filter(s => s.status === "complete").map(s => s.id);
-      }
-      if (uatCompletedSliceIds.length === 0) {
-        // File-based fallback: parse roadmap checkboxes
-        const roadmapPath = resolveMilestoneFile(dispatchBase, mid, "ROADMAP");
-        if (roadmapPath) {
-          const roadmapContent = await loadFile(roadmapPath);
-          if (roadmapContent) {
-            uatCompletedSliceIds = parseRoadmap(roadmapContent).slices.filter(s => s.done).map(s => s.id);
-          }
-        }
-      }
+      // DB-authoritative read (ADR-017) — no markdown fallback for dispatch
+      // decisions.
+      const uatCompletedSliceIds = isDbAvailable() ? getClosedSliceIds(mid) : [];
       if (uatCompletedSliceIds.length === 0) {
         ctx.ui.notify("Cannot dispatch run-uat: no completed slices.", "warning");
         return;
@@ -280,18 +253,15 @@ export async function dispatchDirectPhase(
       return;
   }
 
-  const compatibilityError = getWorkflowTransportSupportError(
-    ctx.model?.provider,
-    getRequiredWorkflowToolsForAutoUnit(unitType),
-    {
-      projectRoot,
-      surface: "direct phase dispatch",
-      unitType,
-      authMode: ctx.model?.provider ? ctx.modelRegistry.getProviderAuthMode(ctx.model.provider) : undefined,
-      baseUrl: ctx.model?.baseUrl,
-      activeTools: typeof pi.getActiveTools === "function" ? pi.getActiveTools() : [],
-    },
-  );
+  const compatibilityError = getUnitWorkflowDispatchReadinessError({
+    provider: ctx.model?.provider,
+    projectRoot,
+    surface: "direct phase dispatch",
+    unitType,
+    authMode: ctx.model?.provider ? ctx.modelRegistry.getProviderAuthMode(ctx.model.provider) : undefined,
+    baseUrl: ctx.model?.baseUrl,
+    activeTools: typeof pi.getActiveTools === "function" ? pi.getActiveTools() : [],
+  });
   if (compatibilityError) {
     ctx.ui.notify(compatibilityError, "error");
     return;

package/src/resources/extensions/gsd/auto-dispatch.ts

@@ -20,6 +20,8 @@ import { getUatBrowserToolSupportError, type UatType } from "./uat-policy.js";
 import {
   isDbAvailable,
   getMilestoneSlices,
+  getMilestoneSliceSummaries,
+  getClosedSliceIds,
   getPendingGatesForTurn,
   markPendingGatesOmittedForTurn,
   getMilestone,
@@ -47,7 +49,6 @@ import {
   buildTaskFileName,
   gsdProjectionRoot,
 } from "./paths.js";
-import { parseRoadmap } from "./parsers-legacy.js";
 import { validateArtifact } from "./schemas/validate.js";
 import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, readdirSync } from "node:fs";
 import { logWarning, logError } from "./workflow-logger.js";
@@ -84,13 +85,15 @@ import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
 import { getMilestonePipelineVariant } from "./milestone-scope-classifier.js";
 import { EXECUTION_ENTRY_PHASES, hasFinalizedMilestoneContext } from "./uok/plan-v2.js";
 import { isAutoActive } from "./auto.js";
-import { markDepthVerified } from "./bootstrap/write-gate.js";
+// Host adapter explicitly: auto-dispatch runs in the extension host, and the
+// ambient write-gate exports env-sniff the adapter per call (they are reserved
+// for the workflow MCP child's dynamic-import surface).
+import { hostWriteGateAdapter } from "./bootstrap/write-gate.js";
 import { ensureWorkflowPreferencesCaptured } from "./planning-depth.js";
 import { MILESTONE_ID_RE } from "./milestone-ids.js";
-import {
-  getWorkflowTransportSupportError,
-  getRequiredWorkflowToolsForAutoUnit,
-} from "./workflow-mcp.js";
+import { resolveWorkflowMcpProjectRoot } from "./workflow-mcp.js";
+import { getUnitWorkflowDispatchReadinessError } from "./tool-contract.js";
+import { prepareBrowserDaemonForUat } from "./browser-daemon-auto-prep.js";
 import {
   PROJECT_RESEARCH_INFLIGHT_MARKER,
 } from "./project-research-policy.js";
@@ -490,27 +493,12 @@ function persistSliceAssessmentBackfill(
 }
 
 function backfillMissingAssessmentsFromSummaries(basePath: string, mid: string): void {
-  const completedSliceIds = new Set<string>();
-  if (isDbAvailable()) {
-    for (const slice of getMilestoneSlices(mid)) {
-      if (slice.status === "complete" || slice.status === "done") {
-        completedSliceIds.add(slice.id);
-      }
-    }
-  } else {
-    const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-    if (!roadmapFile) return;
-    try {
-      const roadmap = parseRoadmap(readFileSync(roadmapFile, "utf-8"));
-      for (const slice of roadmap.slices) {
-        if (slice.done) completedSliceIds.add(slice.id);
-      }
-    } catch {
-      return;
-    }
-  }
-
-  for (const sliceId of completedSliceIds) {
+  // DB-authoritative (ADR-017): no markdown fallback. Without DB rows there
+  // is nothing to backfill.
+  if (!isDbAvailable()) return;
+  // Canonical closed vocabulary (complete/done/skipped/closed) — a skipped or
+  // closed slice with a SUMMARY gets the same assessment backfill treatment.
+  for (const sliceId of getClosedSliceIds(mid)) {
     const summaryPath = resolveSliceFile(basePath, mid, sliceId, "SUMMARY");
     if (!summaryPath || !existsSync(summaryPath)) continue;
 
@@ -696,7 +684,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // deadlock. Deep planning is still user-driven even inside auto-mode,
       // so it must wait for explicit approval instead of taking this bypass.
       if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-        markDepthVerified(mid, basePath);
+        hostWriteGateAdapter.markDepthVerified(mid, basePath);
       }
       return {
         action: "dispatch",
@@ -754,11 +742,15 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // Transport preflight: verify required MCP tools are actually connected
       // before consuming a retry attempt. Fixes tool-starved sessions burning
       // all MAX_UAT_ATTEMPTS before stopping (#477).
-      const transportError = getWorkflowTransportSupportError(
-        sessionProvider,
-        getRequiredWorkflowToolsForAutoUnit("run-uat"),
-        { projectRoot: basePath, surface: "auto-mode", unitType: "run-uat", authMode: sessionAuthMode, baseUrl: sessionBaseUrl, activeTools },
-      );
+      const transportError = getUnitWorkflowDispatchReadinessError({
+        provider: sessionProvider,
+        projectRoot: basePath,
+        surface: "auto-mode",
+        unitType: "run-uat",
+        authMode: sessionAuthMode,
+        baseUrl: sessionBaseUrl,
+        activeTools,
+      });
       if (transportError) {
         return { action: "stop" as const, reason: transportError, level: "warning" as const };
       }
@@ -772,6 +764,16 @@ export const DISPATCH_RULES: DispatchRule[] = [
       if (browserToolError) {
         return { action: "stop" as const, reason: browserToolError, level: "warning" as const };
       }
+      const browserDaemonError = prepareBrowserDaemonForUat({
+        uatType,
+        sessionProvider,
+        sessionAuthMode,
+        sessionBaseUrl,
+        projectRoot: resolveWorkflowMcpProjectRoot(basePath),
+      });
+      if (browserDaemonError) {
+        return { action: "stop" as const, reason: browserDaemonError, level: "warning" as const };
+      }
 
       // Cap run-uat dispatch attempts to prevent infinite replay (#3624).
       // Check before incrementing so an exhausted counter cannot create a
@@ -808,23 +810,10 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // Only applies when UAT dispatch is enabled
       if (!prefs?.uat_dispatch) return null;
 
-      // DB-first: prefer closed slices from DB; fall back to ROADMAP on disk.
-      let closedSliceIds: string[];
-      if (isDbAvailable()) {
-        closedSliceIds = getMilestoneSlices(mid)
-          .filter(s => isClosedStatus(s.status))
-          .map(s => s.id);
-      } else {
-        // Filesystem fallback for degraded / unmigrated projects.
-        // `slice.done` in the parsed ROADMAP is the disk-level closed signal.
-        const roadmapFile = resolveMilestoneFile(basePath, mid, "ROADMAP");
-        const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-        if (!roadmapContent) return null;
-        const roadmap = parseRoadmap(roadmapContent);
-        closedSliceIds = roadmap.slices.filter(s => s.done).map(s => s.id);
-      }
-
-      for (const sliceId of closedSliceIds) {
+      // DB-authoritative (ADR-017): closed slices come from the DB only; the
+      // ROADMAP projection is never parsed for gate decisions.
+      if (!isDbAvailable()) return null;
+      for (const sliceId of getClosedSliceIds(mid)) {
         const result = await readUatGateVerdict(basePath, mid, sliceId);
         if (!result) continue;
         const { verdict, uatType } = result;
@@ -879,7 +868,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
       // pre-verify deep planning's user-facing milestone approval gate.
       if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-        markDepthVerified(mid, basePath);
+        hostWriteGateAdapter.markDepthVerified(mid, basePath);
       }
       return {
         action: "dispatch",
@@ -1050,7 +1039,7 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // H6 fix (#4973): keep the non-deep auto-mode bypass, but do not
       // pre-verify deep planning's user-facing milestone approval gate.
       if (shouldBypassMilestoneDepthGateInAuto(prefs)) {
-        markDepthVerified(mid, basePath);
+        hostWriteGateAdapter.markDepthVerified(mid, basePath);
       }
       return {
         action: "dispatch",
@@ -1128,13 +1117,11 @@ export const DISPATCH_RULES: DispatchRule[] = [
       // behavior.
       if (await getMilestonePipelineVariant(mid) === "trivial") return null;
 
-      // Load roadmap to find all slices
-      const roadmapFile =
-        resolveExistingExpectedArtifact("plan-milestone", mid, basePath) ??
-        resolveMilestoneFile(basePath, mid, "ROADMAP");
-      const roadmapContent = roadmapFile ? await loadFile(roadmapFile) : null;
-      if (!roadmapContent) return null;
-      const roadmap = parseRoadmap(roadmapContent);
+      // DB-authoritative slice list (ADR-017): the ROADMAP projection is
+      // never parsed for dispatch decisions. No DB / no rows → skip this rule.
+      if (!isDbAvailable()) return null;
+      const dbSlices = getMilestoneSliceSummaries(mid);
+      if (dbSlices.length === 0) return null;
 
       // Find slices that need research (no RESEARCH file, dependencies done)
       const milestoneResearchFile =
@@ -1142,14 +1129,14 @@ export const DISPATCH_RULES: DispatchRule[] = [
         resolveMilestoneFile(basePath, mid, "RESEARCH");
       const researchReadySlices: Array<{ id: string; title: string }> = [];
 
-      for (const slice of roadmap.slices) {
+      for (const slice of dbSlices) {
         if (slice.done) continue;
         // Skip S01 when milestone research exists
         if (milestoneResearchFile && slice.id === "S01") continue;
         // Skip if already has research
         if (resolveExistingExpectedArtifact("research-slice", `${mid}/${slice.id}`, basePath)) continue;
         // Skip if dependencies aren't done (check for SUMMARY files)
-        const depsComplete = (slice.depends ?? []).every((depId) =>
+        const depsComplete = slice.depends.every((depId) =>
           !!resolveExistingExpectedArtifact("complete-slice", `${mid}/${depId}`, basePath),
         );
         if (!depsComplete) continue;

package/src/resources/extensions/gsd/auto-model-selection.ts

@@ -18,7 +18,7 @@ import { getSessionModelOverride } from "./session-model-override.js";
 import { logWarning } from "./workflow-logger.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { applyModelPolicyFilter } from "./uok/model-policy.js";
-import { isModelBlocked } from "./blocked-models.js";
+import { isModelBlocked, isModelTemporarilyUnavailable } from "./blocked-models.js";
 import { getRequiredWorkflowToolsForAutoUnit, isWorkflowMcpSurfaceTool } from "./workflow-mcp.js";
 
 /**
@@ -272,6 +272,15 @@ function buildModelPolicyBlockReasons(
   }];
 }
 
+function isModelUnavailable(
+  basePath: string,
+  provider: string | undefined,
+  id: string | undefined,
+): boolean {
+  return isModelBlocked(basePath, provider, id) ||
+    isModelTemporarilyUnavailable(basePath, provider, id);
+}
+
 function restoreToolBaseline(pi: ExtensionAPI): void {
   const key = pi as unknown as object;
   const baseline = TOOL_BASELINE.get(key);
@@ -817,9 +826,9 @@ export async function selectAndApplyModel(
       // (issue #4513).  The block is persisted in .gsd/runtime/blocked-models.json
       // so it survives /gsd auto restarts — without this, the same dead model
       // gets reselected after every restart.
-      if (isModelBlocked(basePath, model.provider, model.id)) {
+      if (isModelUnavailable(basePath, model.provider, model.id)) {
         ctx.ui.notify(
-          `Skipping blocked model ${model.provider}/${model.id} (provider rejected it for this account).`,
+          `Skipping unavailable model ${model.provider}/${model.id}.`,
           "warning",
         );
         continue;
@@ -896,7 +905,7 @@ export async function selectAndApplyModel(
       for (const model of buildPolicyEligibleFallbackOrder(ctx, routingEligibleModels, autoModeStartModel)) {
         const key = `${model.provider.toLowerCase()}/${model.id.toLowerCase()}`;
         if (!policyAllowedModelKeys.has(key)) continue;
-        if (isModelBlocked(basePath, model.provider, model.id)) continue;
+        if (isModelUnavailable(basePath, model.provider, model.id)) continue;
         const ok = await pi.setModel(model, { persist: false });
         if (!ok) continue;
         appliedModel = model;
@@ -926,10 +935,10 @@ export async function selectAndApplyModel(
       autoModeStartModel,
       effectiveSessionModelOverride,
     );
-    const startBlocked = isModelBlocked(basePath, autoModeStartModel.provider, autoModeStartModel.id);
+    const startBlocked = isModelUnavailable(basePath, autoModeStartModel.provider, autoModeStartModel.id);
     if (startBlocked) {
       ctx.ui.notify(
-        `Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is blocked for this account. Using current session model instead.`,
+        `Auto-mode start model ${autoModeStartModel.provider}/${autoModeStartModel.id} is unavailable. Using current session model instead.`,
         "warning",
       );
     } else {
@@ -940,7 +949,7 @@ export async function selectAndApplyModel(
         const ok = await pi.setModel(startModel, { persist: false });
         if (!ok) {
           const byId = availableModels.find(
-            m => m.id === autoModeStartModel.id && !isModelBlocked(basePath, m.provider, m.id),
+            m => m.id === autoModeStartModel.id && !isModelUnavailable(basePath, m.provider, m.id),
           );
           if (byId) {
             const fallbackOk = await pi.setModel(byId, { persist: false });
@@ -1041,16 +1050,36 @@ export function resolveModelId<T extends { id: string; provider: string }>(
     if (providerMatch) return providerMatch;
   }
 
-  // Prefer "anthropic" as the canonical provider for Anthropic models.
-  // Transport-specific tiebreaker (ADR-012): intentionally keys on provider,
-  // not api — we want the plain Anthropic transport when multiple are available.
-  const anthropicMatch = candidates.find(m => m.provider === "anthropic");
-  if (anthropicMatch) return anthropicMatch;
+  // Subscription/OAuth routes beat pay-per-token API when the same model ID
+  // exists on multiple providers. Order matters — first match wins.
+  for (const provider of BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE) {
+    const match = candidates.find(m => m.provider === provider);
+    if (match) return match;
+  }
 
   // Fall back to first non-extension candidate, or any candidate
   return candidates.find(m => !EXTENSION_PROVIDERS.has(m.provider)) ?? candidates[0];
 }
 
+/**
+ * When a bare model ID exists on multiple providers, prefer subscription/OAuth
+ * routes over pay-per-token API keys. Matches PROVIDER_ROUTES in doctor-providers
+ * but applies when *both* sides are authenticated.
+ *
+ * Order rationale:
+ * - openai-codex before github-copilot: ChatGPT-native for shared GPT IDs
+ * - google-gemini-cli before github-copilot: first-party Gemini CLI
+ * - anthropic before github-copilot: first-party Claude API/OAuth over Copilot
+ * - github-copilot before openai/google: Copilot OAuth over platform API keys
+ */
+export const BARE_ID_SUBSCRIPTION_PROVIDER_PRECEDENCE = [
+  "openai-codex",
+  "google-gemini-cli",
+  "anthropic",
+  "github-copilot",
+  "google-antigravity",
+] as const;
+
 /**
  * Flat-rate providers charge the same per request regardless of model.
  * Dynamic routing provides no cost benefit — it only degrades quality (#3453).