@opengsd/gsd-pi 1.2.0-dev.fbdca60b → 1.3.0-dev.65546769

package/dist/resources/extensions/gsd/migrate-external.js

@@ -6,12 +6,13 @@
  * symlink replaces the original directory so all paths remain valid.
  */
 import { execFileSync } from "node:child_process";
-import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, cpSync, rmSync, symlinkSync } from "node:fs";
+import { existsSync, lstatSync, mkdirSync, readdirSync, realpathSync, renameSync, cpSync, rmSync, statSync, symlinkSync } from "node:fs";
 import { join } from "node:path";
 import { externalGsdRoot, isInsideWorktree } from "./repo-identity.js";
 import { getErrorMessage } from "./error-utils.js";
 import { hasGitTrackedGsdFiles } from "./gitignore.js";
 import { GIT_NO_PROMPT_ENV } from "./git-constants.js";
+import { gsdRoot, milestonesDir, resolveGsdRootFile } from "./paths.js";
 /**
  * Migrate a legacy in-project `.gsd/` directory to external storage.
  *
@@ -159,6 +160,9 @@ export function migrateToExternalState(basePath) {
             catch { /* best-effort restore */ }
             return { migrated: false, error: `Migration verification failed: ${getErrorMessage(verifyErr)}` };
         }
+        // Remove .gsd.migrating once the junction is verified. The git-index cleanup
+        // below is best-effort and does not need the staging copy to survive.
+        rmSync(migratingPath, { recursive: true, force: true });
         // Clean the git index — any .gsd/* files tracked before migration now
         // sit behind the symlink and git can't follow it, causing them to show
         // as deleted. Remove them from the index so the working tree stays clean.
@@ -174,8 +178,6 @@ export function migrateToExternalState(basePath) {
         catch {
             // Non-fatal — git may be unavailable or nothing was tracked
         }
-        // Remove .gsd.migrating only after symlink is verified and index is clean
-        rmSync(migratingPath, { recursive: true, force: true });
         return { migrated: true };
     }
     catch (err) {
@@ -194,17 +196,60 @@ export function migrateToExternalState(basePath) {
         };
     }
 }
+export function isCurrentGsdStateIntactForMigratingCleanup(basePath) {
+    try {
+        const stateFile = resolveGsdRootFile(basePath, "STATE");
+        const milestonesPath = milestonesDir(basePath);
+        const dbPath = join(gsdRoot(basePath), "gsd.db");
+        const hasDbFile = existsSync(dbPath);
+        const hasNonEmptyDb = hasDbFile && statSync(dbPath).size > 0;
+        return existsSync(stateFile) && existsSync(milestonesPath) && hasNonEmptyDb;
+    }
+    catch {
+        return false;
+    }
+}
+function normalizeResolvedPath(p) {
+    const normalized = p.replaceAll("\\", "/").replace(/\/+$/, "");
+    return process.platform === "win32" ? normalized.toLowerCase() : normalized;
+}
+function isLocalGsdExternalStateJunction(basePath, localGsd) {
+    try {
+        const stat = lstatSync(localGsd);
+        if (!stat.isSymbolicLink())
+            return false;
+        const resolved = normalizeResolvedPath(realpathSync(localGsd));
+        const resolvedExternal = normalizeResolvedPath(realpathSync(externalGsdRoot(basePath)));
+        return resolved === resolvedExternal;
+    }
+    catch {
+        return false;
+    }
+}
 /**
  * Recover from a failed migration (`.gsd.migrating` exists).
- * Moves `.gsd.migrating` back to `.gsd` if `.gsd` doesn't exist.
+ * Moves `.gsd.migrating` back to `.gsd` if `.gsd` doesn't exist, or removes an
+ * orphaned staging directory when `.gsd` is already a verified external state
+ * junction with intact current state.
  */
 export function recoverFailedMigration(basePath) {
     const localGsd = join(basePath, ".gsd");
     const migratingPath = join(basePath, ".gsd.migrating");
     if (!existsSync(migratingPath))
         return false;
-    if (existsSync(localGsd))
-        return false; // both exist -- ambiguous, don't touch
+    if (existsSync(localGsd)) {
+        if (!isLocalGsdExternalStateJunction(basePath, localGsd))
+            return false;
+        if (!isCurrentGsdStateIntactForMigratingCleanup(basePath))
+            return false;
+        try {
+            rmSync(migratingPath, { recursive: true, force: true });
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
     try {
         renameSync(migratingPath, localGsd);
         return true;

package/dist/resources/extensions/gsd/migration-auto-check.js

@@ -1,9 +1,10 @@
-import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { existsSync, readFileSync } from "node:fs";
 import { ensureDbOpen } from "./bootstrap/dynamic-tools.js";
 import { getAllMilestones, getMilestoneSlices, getSliceTasks, isDbAvailable, } from "./gsd-db.js";
 import { refreshWorkflowDatabaseFromDisk } from "./db-workspace.js";
 import { parsePlan, parseRoadmap } from "./parsers-legacy.js";
-import { milestonesDir, resolveMilestoneFile, resolveSliceFile, } from "./paths.js";
+import { findMilestoneIds } from "./milestone-ids.js";
+import { resolveMilestoneFile, resolveSliceFile, } from "./paths.js";
 function zeroCounts() {
     return { milestones: 0, slices: 0, tasks: 0 };
 }
@@ -55,19 +56,9 @@ export function recoverWouldDeleteDbRows(basePath) {
     return scanHasExtraIdentities(scanDbHierarchy(), scanMarkdownHierarchy(basePath));
 }
 export function scanMarkdownHierarchy(basePath) {
-    const root = milestonesDir(basePath);
-    if (!existsSync(root))
-        return emptyScan();
     const scan = emptyScan();
-    for (const entry of readdirSync(root, { withFileTypes: true })) {
-        if (!entry.isDirectory() || !/^M\d+/.test(entry.name))
-            continue;
-        // Use the CANONICAL milestone id (e.g. "M001" or "M001-a1b2c3"), matching
-        // scanDbHierarchy's milestone.id — not the raw directory name, which may
-        // carry a legacy descriptor (e.g. "M001-some-descriptor"). The canonical id
-        // both keys the identity sets AND resolves files correctly: resolveFile's
-        // prefix/legacy-pattern matching handles the descriptor dir either way.
-        const milestoneId = entry.name.match(/^(M\d+(?:-[a-z0-9]{6})?)/)?.[1] ?? entry.name;
+    // findMilestoneIds handles both flat-phase (NN-slug) and legacy (M###) dirs.
+    for (const milestoneId of findMilestoneIds(basePath)) {
         scan.counts.milestones++;
         scan.milestones.add(milestoneId);
         const roadmapPath = resolveMilestoneFile(basePath, milestoneId, "ROADMAP");

package/dist/resources/extensions/gsd/milestone-actions.js

@@ -12,7 +12,7 @@
  */
 import { existsSync, rmSync, writeFileSync, readFileSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
-import { resolveMilestonePath, resolveMilestoneFile, buildMilestoneFileName, } from "./paths.js";
+import { resolveMilestonePath, resolveMilestoneFile, relMilestoneFile, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { loadQueueOrder, saveQueueOrder } from "./queue-order.js";
 import { deleteMilestone, getMilestone, isDbAvailable, updateMilestoneStatus } from "./gsd-db.js";
@@ -52,7 +52,8 @@ export function parkMilestone(basePath, milestoneId, reason) {
         if (summaryFile)
             return false;
     }
-    const parkedPath = join(mDir, buildMilestoneFileName(milestoneId, "PARKED"));
+    // Use relMilestoneFile for layout-aware path (legacy: M001-PARKED.md, flat-phase: 01-PARKED.md)
+    const parkedPath = join(basePath, relMilestoneFile(basePath, milestoneId, "PARKED"));
     if (existsSync(parkedPath))
         return false; // already parked
     const content = [
@@ -89,7 +90,8 @@ export function unparkMilestone(basePath, milestoneId) {
     const mDir = resolveMilestonePath(basePath, milestoneId);
     if (!mDir || !existsSync(mDir))
         return false;
-    const parkedPath = join(mDir, buildMilestoneFileName(milestoneId, "PARKED"));
+    // Use relMilestoneFile for layout-aware path (legacy: M001-PARKED.md, flat-phase: 01-PARKED.md)
+    const parkedPath = join(basePath, relMilestoneFile(basePath, milestoneId, "PARKED"));
     const hadParkedFile = existsSync(parkedPath);
     const dbThinksParked = isDbAvailable() && getMilestone(milestoneId)?.status === "parked";
     // Recover the reverse desync too: DB can still say "parked" even when the

package/dist/resources/extensions/gsd/milestone-closeout.js

@@ -18,6 +18,7 @@ import { logWarning } from "./workflow-logger.js";
 import { hasImplementationArtifacts } from "./milestone-implementation-evidence.js";
 import { buildCompleteMilestonePrompt } from "./auto-prompts.js";
 import { proveMilestoneCloseout } from "./milestone-closeout-proof.js";
+import { checkCloseoutConsistencyGate } from "./closeout-consistency-gate.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
 import { commitPendingMilestoneCloseoutChanges, findMissingSummaries, isVerificationNotApplicable, readUatGateVerdict, } from "./auto-dispatch.js";
 const COMPLETE_MILESTONE_DB_SETTLE_MS = 1500;
@@ -171,6 +172,15 @@ export async function evaluateCompleteMilestoneDispatch(ctx) {
             }
         }
     }
+    if (isDbAvailable()) {
+        // Repair only the missing-validation closeout case here; existing guards below
+        // and post-unit proof remain responsible for blocking incomplete closeouts.
+        checkCloseoutConsistencyGate(mid, {
+            allowOpenMilestone: true,
+            allowPassThroughValidation: true,
+            artifactBasePath: resolveCanonicalMilestoneRoot(basePath, mid),
+        });
+    }
     const validationFile = resolveMilestoneFile(basePath, mid, "VALIDATION");
     if (validationFile) {
         const validationContent = await loadFile(validationFile);
@@ -213,8 +223,8 @@ export async function evaluateCompleteMilestoneDispatch(ctx) {
                         const skippedByPreference = /skip(?:ped)?[\s\-]+(?:by|per|due to)\s+(?:preference|budget|profile)/i.test(validationContent);
                         const skippedByTrivialVariant = /trivial-scope pipeline variant/i.test(validationContent);
                         const structuredMatch = validationContent.includes("Operational") &&
-                            (validationContent.includes("MET") || validationContent.includes("N/A") || validationContent.includes("SATISFIED") || validationContent.includes("DEFERRED"));
-                        const proseMatch = /[Oo]perational[\s\S]{0,500}?(?:✅|pass|verified|confirmed|met|complete|true|yes|addressed|covered|satisfied|partially|deferred|n\/a|not[\s-]+applicable)/i.test(validationContent);
+                            (validationContent.includes("MET") || validationContent.includes("N/A") || validationContent.includes("SATISFIED") || validationContent.includes("DEFERRED") || validationContent.includes("PASS") || validationContent.includes("COVERED"));
+                        const proseMatch = /[Oo]perational[\s\S]{0,2000}?(?:✅|pass|verified|confirmed|met|complete|true|yes|addressed|covered|satisfied|partially|deferred|n\/a|not[\s-]+applicable)/i.test(validationContent);
                         const hasOperationalCheck = skippedByMarker ||
                             skippedByPreference ||
                             skippedByTrivialVariant ||

package/dist/resources/extensions/gsd/milestone-ids.js

@@ -5,9 +5,11 @@
  * Consumed by 15+ modules across the GSD extension. Zero side-effects.
  */
 import { randomInt } from "node:crypto";
+import { join } from "node:path";
 import { logWarning } from "./workflow-logger.js";
 import { readdirSync, existsSync } from "node:fs";
-import { milestonesDir } from "./paths.js";
+import { milestonesDir, gsdProjectionRoot } from "./paths.js";
+import { LAYOUT_SEGMENTS } from "./layout-policy.js";
 import { loadQueueOrder, sortByQueueOrder } from "./queue-order.js";
 import { getErrorMessage } from "./error-utils.js";
 // ─── Regex ──────────────────────────────────────────────────────────────────
@@ -121,26 +123,55 @@ export function clearReservedMilestoneIds() {
     reservedMilestoneIds.clear();
 }
 // ─── Discovery ──────────────────────────────────────────────────────────────
+function scanMilestoneIdsFromDir(dir) {
+    return readdirSync(dir, { withFileTypes: true })
+        .filter((d) => d.isDirectory())
+        .map((d) => {
+        // Legacy layout: exact M001 or M001-abcdef directory name
+        if (MILESTONE_ID_RE.test(d.name)) {
+            return d.name;
+        }
+        // Legacy layout: M001-abcdef-slug descriptor directories
+        const legacyMatch = d.name.match(/^(M\d{3}(?:-[a-z0-9]{6})?)-/);
+        if (legacyMatch) {
+            return legacyMatch[1];
+        }
+        // Flat-phase layout: NN-slug → M00N (slug may encode M00N or M00N-abcdef)
+        const flatMatch = d.name.match(/^(\d+)-(.+)$/);
+        if (flatMatch) {
+            const phaseNum = parseInt(flatMatch[1], 10);
+            const fromSlug = normalizeDiscussMilestoneId(flatMatch[2]);
+            if (MILESTONE_ID_RE.test(fromSlug)) {
+                return fromSlug;
+            }
+            return `M${String(phaseNum).padStart(3, "0")}`;
+        }
+        return null;
+    })
+        .filter((id) => id !== null);
+}
 /** Scan the milestones directory and return IDs sorted by queue order (or numeric fallback). */
 export function findMilestoneIds(basePath) {
-    const dir = milestonesDir(basePath);
-    try {
-        const ids = readdirSync(dir, { withFileTypes: true })
-            .filter((d) => d.isDirectory())
-            .map((d) => {
-            const match = d.name.match(/^(M\d+(?:-[a-z0-9]{6})?)/);
-            return match ? match[1] : null;
-        })
-            .filter((id) => id !== null);
-        // Apply custom queue order if available, else fall back to numeric sort
-        const customOrder = loadQueueOrder(basePath);
-        return sortByQueueOrder(ids, customOrder);
-    }
-    catch (err) {
-        // Log why milestone scanning failed — silent [] here causes infinite loops (#456)
-        if (existsSync(dir)) {
-            logWarning("engine", `findMilestoneIds: .gsd/milestones/ exists but readdirSync failed — ${getErrorMessage(err)}`);
+    const root = gsdProjectionRoot(basePath);
+    const dirs = [milestonesDir(basePath)];
+    const legacyDir = join(root, "milestones");
+    if (legacyDir !== dirs[0] && existsSync(legacyDir))
+        dirs.push(legacyDir);
+    const phasesDir = join(root, LAYOUT_SEGMENTS.level1);
+    if (phasesDir !== dirs[0] && existsSync(phasesDir))
+        dirs.push(phasesDir);
+    const ids = new Set();
+    for (const dir of dirs) {
+        try {
+            for (const id of scanMilestoneIdsFromDir(dir))
+                ids.add(id);
+        }
+        catch (err) {
+            if (existsSync(dir)) {
+                logWarning("engine", `findMilestoneIds: ${dir} exists but readdirSync failed — ${getErrorMessage(err)}`);
+            }
         }
-        return [];
     }
+    const customOrder = loadQueueOrder(basePath);
+    return sortByQueueOrder([...ids], customOrder);
 }

package/dist/resources/extensions/gsd/milestone-planning-persistence.js

@@ -99,6 +99,14 @@ function writePlanRows(params) {
 async function renderPlanArtifacts(basePath, params) {
     try {
         const renderResult = await renderRoadmapFromDb(basePath, params.milestoneId);
+        // renderRoadmapFromDb only skips for unplanned milestones (zero slices +
+        // empty vision); persistMilestonePlan always populates both via writePlanRows
+        // before this render, so the skipped branch is unreachable here. Fall back to
+        // resolving the projected path so a future invariant still surfaces a clear
+        // render failure rather than an undefined dereference.
+        if ("skipped" in renderResult) {
+            return { error: `render skipped: milestone ${params.milestoneId} has no planned slices` };
+        }
         return renderResult.roadmapPath;
     }
     catch (renderErr) {

package/dist/resources/extensions/gsd/milestone-validation-verdict.js

@@ -5,7 +5,7 @@ import { join } from "node:path";
 import { resolveExpectedArtifactPath } from "./auto-artifact-paths.js";
 import { loadFile } from "./files.js";
 import { getLatestAssessmentByScope, isDbAvailable } from "./gsd-db.js";
-import { gsdProjectionRoot } from "./paths.js";
+import { relMilestoneFile } from "./paths.js";
 import { extractVerdict, isValidMilestoneVerdict, } from "./verdict-parser.js";
 import { resolveCanonicalMilestoneRoot } from "./worktree-manager.js";
 import { resolveWorktreeProjectRoot } from "./worktree-root.js";
@@ -50,8 +50,11 @@ export async function resolveMilestoneValidationVerdict(basePath, milestoneId) {
         if (projectVerdict)
             return projectVerdict;
     }
-    // Last resort: direct canonical projection path even when resolveDir helpers
-    // have not materialized the milestone directory yet.
-    const directPath = join(gsdProjectionRoot(canonicalBase), "milestones", milestoneId, `${milestoneId}-VALIDATION.md`);
+    // Last resort: layout-aware fallback path when resolveDir helpers
+    // haven't materialized the milestone directory yet. relMilestoneFile()
+    // builds the canonical NN-VALIDATION.md path for flat-phase and the
+    // legacy MID-VALIDATION.md path for projects that haven't migrated.
+    // See open-gsd/gsd-pi#876.
+    const directPath = join(canonicalBase, relMilestoneFile(canonicalBase, milestoneId, "VALIDATION"));
     return verdictFromValidationPath(directPath);
 }

package/dist/resources/extensions/gsd/model-router.js

@@ -223,10 +223,12 @@ export function scoreEligibleModels(eligibleModelIds, requirements, capabilityOv
 }
 /**
  * Return all models eligible for a given tier, sorted cheapest first.
+ * A runtime preferred model (the user's selected/session model) is returned
+ * first when it is available and satisfies the requested tier.
  * If routingConfig.tier_models[tier] is set and available, returns only that
  * model. Otherwise filters availableModelIds by tier from MODEL_CAPABILITY_TIER.
  */
-export function getEligibleModels(tier, availableModelIds, routingConfig) {
+export function getEligibleModels(tier, availableModelIds, routingConfig, preferredModelId) {
     // 1. Check explicit tier_models config
     const explicitModel = routingConfig.tier_models?.[tier];
     if (explicitModel) {
@@ -240,13 +242,17 @@ export function getEligibleModels(tier, availableModelIds, routingConfig) {
             return [match];
     }
     // 2. Auto-detect: filter by tier, sort cheapest first
-    return availableModelIds
+    const tierMatches = availableModelIds
         .filter(id => getModelTier(id) === tier)
         .sort((a, b) => {
         const costA = getModelCost(a);
         const costB = getModelCost(b);
         return costA - costB;
     });
+    const preferred = findPreferredModelForTier(tier, availableModelIds, preferredModelId);
+    if (!preferred)
+        return tierMatches;
+    return [preferred, ...tierMatches.filter(id => id !== preferred)];
 }
 /**
  * Build a fallback chain for a selected model: [selectedModel, ...configuredFallbacks, configuredPrimary]
@@ -294,7 +300,7 @@ export function loadCapabilityOverrides(prefs) {
  * @param taskMetadata        Task metadata for refined requirement vectors (optional)
  * @param capabilityOverrides User-provided capability overrides (deep-merged with built-in profiles, optional)
  */
-export function resolveModelForComplexity(classification, phaseConfig, routingConfig, availableModelIds, unitType, taskMetadata, capabilityOverrides) {
+export function resolveModelForComplexity(classification, phaseConfig, routingConfig, availableModelIds, unitType, taskMetadata, capabilityOverrides, preferredModelId) {
     // If no phase config or routing disabled, pass through
     if (!phaseConfig || !routingConfig.enabled) {
         return {
@@ -340,7 +346,7 @@ export function resolveModelForComplexity(classification, phaseConfig, routingCo
         // Configured primary is unavailable (e.g. Anthropic model configured but
         // running on a non-Anthropic provider). Find the best available model at
         // the same capability tier so routing still works cross-provider.
-        const crossProviderEquivalent = findModelForTier(configuredTier, routingConfig, availableModelIds, routingConfig.cross_provider !== false);
+        const crossProviderEquivalent = findModelForTier(configuredTier, routingConfig, availableModelIds, routingConfig.cross_provider !== false, preferredModelId);
         return {
             modelId: crossProviderEquivalent ?? configuredPrimary,
             fallbacks: crossProviderEquivalent
@@ -355,7 +361,7 @@ export function resolveModelForComplexity(classification, phaseConfig, routingCo
         };
     }
     // STEP 1: Get all eligible models for the requested tier
-    const eligible = getEligibleModels(requestedTier, availableModelIds, routingConfig);
+    const eligible = getEligibleModels(requestedTier, availableModelIds, routingConfig, preferredModelId);
     if (eligible.length === 0) {
         // No suitable model found — use configured primary
         return {
@@ -367,6 +373,18 @@ export function resolveModelForComplexity(classification, phaseConfig, routingCo
             selectionMethod: "tier-only",
         };
     }
+    const preferred = findPreferredModelForTier(requestedTier, availableModelIds, preferredModelId);
+    if (preferred && eligible.includes(preferred)) {
+        const fallbacks = buildFallbackChain(preferred, phaseConfig);
+        return {
+            modelId: preferred,
+            fallbacks,
+            tier: requestedTier,
+            wasDowngraded: !isModelAvailable(configuredPrimary, [preferred]),
+            reason: `preferred session model ${preferred} satisfies ${requestedTier} tier`,
+            selectionMethod: "tier-only",
+        };
+    }
     // STEP 2: Capability scoring (when enabled and multiple eligible models exist)
     if (routingConfig.capability_routing !== false && eligible.length > 1 && unitType) {
         const requirements = computeTaskRequirements(unitType, taskMetadata);
@@ -428,15 +446,15 @@ export function defaultRoutingConfig() {
 }
 // ─── Tier-Based Model Resolution (for profile defaults) ─────────────────────
 /**
- * Fallback-only canonical model IDs per tier. Returned when the
+ * Fallback-only canonical model IDs per tier. Returned only when the
  * available-model list is empty (e.g., preferences are loaded before the
- * model registry is populated at bootstrap), or when a non-empty registry has
- * no model at the requested tier.
+ * model registry is populated at bootstrap).
  *
  * Precedence (resolveModelForTier):
  *   1. configured `tier_models[tier]` (via getEligibleModels) — exact/bare match
- *   2. cheapest available model whose tier matches `tier`
- *   3. CANONICAL_TIER_MODELS[tier] as last-resort fallback
+ *   2. preferred/session model when it is available and satisfies `tier`
+ *   3. cheapest available model whose tier matches `tier`
+ *   4. CANONICAL_TIER_MODELS[tier] when the registry is empty
  */
 const CANONICAL_TIER_MODELS = {
     light: "claude-haiku-4-5",
@@ -448,16 +466,17 @@ export function canonicalModelForTier(tier) {
 }
 /**
  * Single source of truth for tier-based model selection.
- * Returns the cheapest available model whose capability tier matches `tier`,
- * honoring `routingConfig.tier_models[tier]` when set. Returns undefined when
- * no available model matches the tier.
+ * Returns the preferred/session model when it satisfies `tier`, otherwise the
+ * cheapest available model whose capability tier matches `tier`, honoring
+ * `routingConfig.tier_models[tier]` when set. Returns undefined when no
+ * available model satisfies the tier.
  *
  * `crossProvider`: when false, restricts the search to models that share the
  * canonical (Anthropic) provider for the tier. When true, any provider is
  * eligible.
  */
-function findModelForTier(tier, routingConfig, availableModelIds, crossProvider) {
-    const eligible = getEligibleModels(tier, availableModelIds, routingConfig);
+function findModelForTier(tier, routingConfig, availableModelIds, crossProvider, preferredModelId) {
+    const eligible = getEligibleModels(tier, availableModelIds, routingConfig, preferredModelId);
     if (eligible.length === 0)
         return undefined;
     if (crossProvider) {
@@ -469,29 +488,69 @@ function findModelForTier(tier, routingConfig, availableModelIds, crossProvider)
         const bare = bareModelId(id);
         return MODEL_CAPABILITY_TIER[bare] === tier && bare.startsWith("claude-");
     });
+    // Honor the preferred/session model only when it is itself a same-provider
+    // (Anthropic/Claude) model. A non-Anthropic session model must not bypass
+    // the cross_provider:false restriction.
+    const preferred = findPreferredModelForTier(tier, availableModelIds, preferredModelId);
+    if (preferred && sameProvider.includes(preferred))
+        return preferred;
     return sameProvider[0];
 }
-export function resolveModelForTier(tier, availableModelIds, routingConfigOrCrossProvider = defaultRoutingConfig(), crossProvider) {
+export function resolveModelForTier(tier, availableModelIds, routingConfigOrCrossProvider = defaultRoutingConfig(), crossProvider, preferredModelId) {
     const routingConfig = typeof routingConfigOrCrossProvider === "boolean"
         ? defaultRoutingConfig()
         : { ...defaultRoutingConfig(), ...routingConfigOrCrossProvider };
     const allowCrossProvider = typeof routingConfigOrCrossProvider === "boolean"
         ? routingConfigOrCrossProvider
         : crossProvider ?? routingConfig.cross_provider !== false;
-    // No available models known — return canonical fallback
+    // No available models known — prefer the session model when provided, else canonical
     if (availableModelIds.length === 0) {
+        if (preferredModelId) {
+            return normalizeResolvedTierModelId(preferredModelId, tier, routingConfig);
+        }
         incrementLegacyTelemetry("legacy.providerDefaultUsed");
         return canonicalModelForTier(tier);
     }
     // Cross-provider tier search
-    const resolved = findModelForTier(tier, routingConfig, availableModelIds, allowCrossProvider);
+    const resolved = findModelForTier(tier, routingConfig, availableModelIds, allowCrossProvider, preferredModelId);
     if (resolved) {
         return normalizeResolvedTierModelId(resolved, tier, routingConfig);
     }
-    incrementLegacyTelemetry("legacy.providerDefaultUsed");
-    return canonicalModelForTier(tier);
+    const providerLocalFallback = findAvailableModelId(preferredModelId, availableModelIds)
+        ?? availableModelIds[0]
+        ?? canonicalModelForTier(tier);
+    return normalizeResolvedTierModelId(providerLocalFallback, tier, routingConfig);
 }
 // ─── Internal ────────────────────────────────────────────────────────────────
+function modelProvider(modelId) {
+    const slash = modelId.indexOf("/");
+    return slash > 0 ? modelId.slice(0, slash) : undefined;
+}
+function findAvailableModelId(preferredModelId, availableModelIds) {
+    if (!preferredModelId)
+        return undefined;
+    if (availableModelIds.includes(preferredModelId))
+        return preferredModelId;
+    const preferredBare = bareModelId(preferredModelId);
+    if (!preferredBare)
+        return undefined;
+    const preferredProvider = modelProvider(preferredModelId)?.toLowerCase();
+    if (preferredProvider) {
+        const providerMatch = availableModelIds.find(id => modelProvider(id)?.toLowerCase() === preferredProvider && bareModelId(id) === preferredBare);
+        if (providerMatch)
+            return providerMatch;
+    }
+    return availableModelIds.find(id => bareModelId(id) === preferredBare);
+}
+function modelSatisfiesTier(modelId, tier) {
+    return tierOrdinal(getModelTier(modelId)) >= tierOrdinal(tier);
+}
+function findPreferredModelForTier(tier, availableModelIds, preferredModelId) {
+    const preferred = findAvailableModelId(preferredModelId, availableModelIds);
+    if (!preferred)
+        return undefined;
+    return modelSatisfiesTier(preferred, tier) ? preferred : undefined;
+}
 /**
  * Check whether a model ID is present in the available models list.
  * Handles bare IDs ("claude-opus-4-6") and provider-prefixed IDs ("anthropic/claude-opus-4-6").

package/dist/resources/extensions/gsd/notification-store.js

@@ -270,43 +270,36 @@ function _atomicWrite(basePath, content) {
 /**
  * Acquire an exclusive lockfile for rewrite operations.
  * Uses O_CREAT|O_EXCL for atomic creation — if the file exists, another
- * process holds the lock. Retries briefly, then proceeds anyway (best-effort)
- * to avoid deadlocking the UI on a stale lock.
+ * process holds the lock. Clears stale locks, then proceeds anyway
+ * (best-effort) to avoid blocking the UI.
  */
 function _withLock(basePath, fn) {
     const lockPath = join(basePath, ".gsd", LOCKFILE);
     let fd = null;
-    const maxAttempts = 5;
-    const retryMs = 20;
-    for (let i = 0; i < maxAttempts; i++) {
-        try {
-            mkdirSync(join(basePath, ".gsd"), { recursive: true });
-            fd = openSync(lockPath, "wx");
-            break;
-        }
-        catch (err) {
-            if (err?.code === "EEXIST") {
-                // Check if lock is stale (older than 5s)
-                try {
-                    const stat = readFileSync(lockPath, "utf-8");
-                    const lockTime = parseInt(stat, 10);
-                    if (Date.now() - lockTime > 5000) {
-                        try {
-                            unlinkSync(lockPath);
-                        }
-                        catch { /* race ok */ }
-                        continue;
+    try {
+        mkdirSync(join(basePath, ".gsd"), { recursive: true });
+        fd = openSync(lockPath, "wx");
+    }
+    catch (err) {
+        if (err?.code === "EEXIST") {
+            // Check if lock is stale (older than 5s)
+            try {
+                const stat = readFileSync(lockPath, "utf-8");
+                const lockTime = parseInt(stat, 10);
+                if (Date.now() - lockTime > 5000) {
+                    try {
+                        unlinkSync(lockPath);
+                    }
+                    catch { /* race ok */ }
+                    try {
+                        fd = openSync(lockPath, "wx");
                     }
+                    catch { /* race ok */ }
                 }
-                catch { /* can't read lock, retry */ }
-                // Wait and retry
-                const start = Date.now();
-                while (Date.now() - start < retryMs) { /* spin */ }
-                continue;
             }
-            // Other error — proceed without lock
-            break;
+            catch { /* proceed without lock */ }
         }
+        // Any lock acquisition error leaves fd null; proceed without lock.
     }
     // Best-effort: mutation runs regardless of lock status (idempotent overwrites).
     // createdLock gates cleanup only — never skip fn() on lock failure.