@opengsd/gsd-pi 1.5.0-dev.4fb2d460 → 1.5.0-dev.c4c8885f

package/dist/resources/extensions/gsd/auto-start.js

@@ -36,10 +36,10 @@ import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { queryJournal } from "./journal.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
-import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
+import { restoreHookState, resetHookState, reconcileRestoredHookDispatch } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
-import { isDbAvailable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
+import { isDbAvailable, probeDbWritable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
 import { getWorkflowDatabaseStatus, openExistingWorkflowDatabase, openWorkflowDatabase, resolveProjectRootDbPath, } from "./db-workspace.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
@@ -119,36 +119,42 @@ export function reconcileProjectMilestonesFromDisk(basePath) {
 export function reconcileMergedMilestonesFromJournal(basePath) {
     if (!isDbAvailable())
         return 0;
-    const mergedAtByMilestone = new Map();
-    for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
-        const data = entry.data ?? {};
-        const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
-        if (!milestoneId)
-            continue;
-        if (data.conflict === true)
-            continue;
-        const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
-        const previous = mergedAtByMilestone.get(milestoneId);
-        if (!previous || endedAt > previous)
-            mergedAtByMilestone.set(milestoneId, endedAt);
-    }
-    let closed = 0;
-    for (const [milestoneId, completedAt] of mergedAtByMilestone) {
-        const existing = getMilestone(milestoneId);
-        if (!existing) {
-            insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
-            updateMilestoneStatus(milestoneId, "complete", completedAt);
-            closed++;
-            continue;
-        }
-        if (!isClosedStatus(existing.status)) {
-            updateMilestoneStatus(milestoneId, "complete", completedAt);
-            closed++;
+    try {
+        const mergedAtByMilestone = new Map();
+        for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
+            const data = entry.data ?? {};
+            const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
+            if (!milestoneId)
+                continue;
+            if (data.conflict === true)
+                continue;
+            const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
+            const previous = mergedAtByMilestone.get(milestoneId);
+            if (!previous || endedAt > previous)
+                mergedAtByMilestone.set(milestoneId, endedAt);
+        }
+        let closed = 0;
+        for (const [milestoneId, completedAt] of mergedAtByMilestone) {
+            const existing = getMilestone(milestoneId);
+            if (!existing) {
+                insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
+                updateMilestoneStatus(milestoneId, "complete", completedAt);
+                closed++;
+                continue;
+            }
+            if (!isClosedStatus(existing.status)) {
+                updateMilestoneStatus(milestoneId, "complete", completedAt);
+                closed++;
+            }
         }
+        if (closed > 0)
+            invalidateAllCaches();
+        return closed;
+    }
+    catch (err) {
+        logWarning("bootstrap", `merged-milestone journal reconciliation failed: ${err instanceof Error ? err.message : String(err)}`);
+        return 0;
     }
-    if (closed > 0)
-        invalidateAllCaches();
-    return closed;
 }
 export function decideSurvivorAction(hasSurvivorBranch, phase) {
     if (!hasSurvivorBranch)
@@ -1254,6 +1260,10 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.unitLifetimeDispatches.clear();
         resetHookState();
         restoreHookState(base);
+        // A restored activeHook has no live dispatch (the sidecar queue is not
+        // persisted); re-enqueue it so the hook runs instead of blocking the next
+        // unrelated unit's close-out (#1246).
+        reconcileRestoredHookDispatch(base, s.sidecarQueue);
         resetProactiveHealing();
         // Notify user on health level transitions (green→yellow→red and back)
         setLevelChangeCallback((_from, to, summary) => {
@@ -1377,6 +1387,19 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             ctx.ui.notify(`SQLite database exists but failed to open: ${gsdDbPath}. ${phaseHint}${errorDetail}.${providerHint}`, "error");
             return releaseLockAndReturn();
         }
+        // Gate: confirm the handle is actually writable, not just open. A
+        // schema-current DB does zero writes during open, so a read-only /
+        // DBMOVED handle otherwise passes the check above and only fails much
+        // later at the first authoritative write (the uok-kernel-enter audit)
+        // with an opaque "readonly database" error (#1234).
+        if (existsSync(gsdDbPath) && isDbAvailable()) {
+            const writable = probeDbWritable();
+            if (!writable.ok) {
+                const detail = writable.detail ? ` (${writable.detail})` : "";
+                ctx.ui.notify(`SQLite database is not writable: ${gsdDbPath}.${detail} Check file/WAL permissions or reopen a stale handle before running auto-mode.`, "error");
+                return releaseLockAndReturn();
+            }
+        }
         // Initialize metrics
         initMetrics(s.basePath);
         // Initialize routing history

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -8,6 +8,8 @@ import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, verifyExpectedAr
 import { existsSync } from "node:fs";
 import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 import { finalizeProjectResearchTimeout } from "./project-research-policy.js";
+import { applySupervisorModelIfConfigured } from "./auto-model-selection.js";
+import { getInFlightToolCount } from "./auto-tool-tracking.js";
 export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rctx) {
     // Note on turn epoch: the bump is intentionally NOT unconditional at
     // function entry. Two branches below (the "steering retry" paths) keep
@@ -79,11 +81,15 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
                     "Immediately finish the required durable output for this unit.",
                     "If full completion is impossible, write the partial artifact/state needed for recovery and make the blocker explicit.",
                 ];
+            const recoveryTrigger = getInFlightToolCount() === 0;
+            if (recoveryTrigger) {
+                await applySupervisorModelIfConfigured(ctx, pi, basePath);
+            }
             pi.sendMessage({
                 customType: "gsd-auto-timeout-recovery",
                 display: verbose,
                 content: steeringLines.join("\n"),
-            }, { triggerTurn: true, deliverAs: "steer" });
+            }, { triggerTurn: recoveryTrigger, deliverAs: "steer" });
             ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: steering ${unitType} ${unitId} to finish durable output (attempt ${attemptNumber}, session ${recoveryAttempts + 1}/${maxRecoveryAttempts}).`, "warning");
             return "recovered";
         }
@@ -176,11 +182,15 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
                 "Write the required artifact now.",
                 "If blocked, write the partial artifact and explicitly record the blocker instead of going silent.",
             ];
+        const recoveryTrigger = getInFlightToolCount() === 0;
+        if (recoveryTrigger) {
+            await applySupervisorModelIfConfigured(ctx, pi, basePath);
+        }
         pi.sendMessage({
             customType: "gsd-auto-timeout-recovery",
             display: verbose,
             content: steeringLines.join("\n"),
-        }, { triggerTurn: true, deliverAs: "steer" });
+        }, { triggerTurn: recoveryTrigger, deliverAs: "steer" });
         ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: steering ${unitType} ${unitId} to produce ${expected} (attempt ${attemptNumber}, session ${recoveryAttempts + 1}/${maxRecoveryAttempts}).`, "warning");
         return "recovered";
     }

package/dist/resources/extensions/gsd/auto-timers.js

@@ -11,6 +11,7 @@ import { resolveAutoSupervisorConfig } from "./preferences.js";
 import { computeBudgets, resolveExecutorContextWindow } from "./context-budget.js";
 import { getInFlightToolCount, getOldestInFlightToolStart, clearInFlightTools, hasInteractiveToolInFlight, } from "./auto-tool-tracking.js";
 import { detectWorkingTreeActivity } from "./auto-supervisor.js";
+import { applySupervisorModelIfConfigured } from "./auto-model-selection.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
 import { saveActivityLog } from "./activity-log.js";
 import { recoverTimedOutUnit } from "./auto-timeout-recovery.js";
@@ -113,7 +114,7 @@ export function startUnitSupervision(sctx) {
         ? supervisor.stalled_tool_timeout_minutes * 60 * 1000
         : idleTimeoutMs;
     // ── 1. Soft timeout warning ──
-    s.wrapupWarningHandle = setTimeout(() => {
+    s.wrapupWarningHandle = setTimeout(async () => {
         s.wrapupWarningHandle = null;
         if (!s.active || !s.currentUnit)
             return;
@@ -125,6 +126,9 @@ export function startUnitSupervision(sctx) {
         // Triggering during active tool calls causes tool results to be skipped
         // with "Skipped due to queued user message", leading to provider errors (#3512).
         const softTrigger = getInFlightToolCount() === 0;
+        if (softTrigger) {
+            await applySupervisorModelIfConfigured(ctx, pi, s.basePath);
+        }
         pi.sendMessage({
             customType: "gsd-auto-wrapup",
             display: s.verbose,
@@ -291,7 +295,7 @@ export function startUnitSupervision(sctx) {
     }
     const executorContextWindow = resolveExecutorContextWindow(ctx.modelRegistry, prefs, ctx.model?.contextWindow, ctx.model?.provider);
     const continueHereThreshold = computeBudgets(executorContextWindow).continueThresholdPercent;
-    s.continueHereHandle = setInterval(() => {
+    s.continueHereHandle = setInterval(async () => {
         if (!s.active || !s.currentUnit || !s.cmdCtx)
             return;
         const runtime = readUnitRuntimeRecord(s.basePath, unitType, unitId);
@@ -316,6 +320,9 @@ export function startUnitSupervision(sctx) {
         }
         // Only trigger a new turn if no tools are currently in flight (#3512).
         const contextTrigger = getInFlightToolCount() === 0;
+        if (contextTrigger) {
+            await applySupervisorModelIfConfigured(ctx, pi, s.basePath);
+        }
         pi.sendMessage({
             customType: "gsd-auto-wrapup",
             display: s.verbose,

package/dist/resources/extensions/gsd/auto.js

@@ -30,9 +30,10 @@ import { playNotificationBell, sendDesktopNotification } from "./notifications.j
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, HARD_CONTEXT_REROOT_THRESHOLD_PERCENT, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, shouldWarnStepSessionForContext, } from "./auto-budget.js";
 import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
-import { selectAndApplyModel, resolveModelId, clearToolBaseline } from "./auto-model-selection.js";
+import { selectAndApplyModel, resolveModelId, clearToolBaseline, isModelUnavailable, applyThinkingLevelForModel } from "./auto-model-selection.js";
+import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
 import { resetRoutingHistory, recordOutcome } from "./routing-history.js";
-import { resetHookState, runPreDispatchHooks, restoreHookState, clearPersistedHookState, } from "./post-unit-hooks.js";
+import { resetHookState, runPreDispatchHooks, restoreHookState, reconcileRestoredHookDispatch, clearPersistedHookState, } from "./post-unit-hooks.js";
 import { runGSDDoctor, rebuildState } from "./doctor.js";
 import { preDispatchHealthGate, resetProactiveHealing, setLevelChangeCallback, } from "./doctor-proactive.js";
 import { clearSkillSnapshot } from "./skill-discovery.js";
@@ -332,11 +333,24 @@ function withDetachedAutoKeepalive(run) {
 }
 export const _withDetachedAutoKeepaliveForTest = withDetachedAutoKeepalive;
 export function startAutoDetached(ctx, pi, base, verboseMode, options) {
-    void withDetachedAutoKeepalive(startAuto(ctx, pi, base, verboseMode, options)).catch((err) => {
+    void withDetachedAutoKeepalive(startAuto(ctx, pi, base, verboseMode, options)).catch(async (err) => {
         const message = getErrorMessage(err);
         ctx.ui.notify(`Auto-start failed: ${message}`, "error");
         logWarning("engine", `auto start error: ${message}`, { file: "auto.ts" });
         debugLog("auto-start-failed", { error: message });
+        // Backstop cleanup (#1235): if startAuto threw after auto-mode was activated
+        // (e.g. an exception during bootstrap, before the loop's try/finally could
+        // run cleanupAfterLoopExit), s.active and the on-disk auto lock leak, so the
+        // re-entry guard silently no-ops every later /gsd auto until restart. Clear
+        // the leaked activation here so a failed start is always recoverable.
+        if (s.active) {
+            try {
+                await cleanupAfterLoopExit(ctx);
+            }
+            catch (cleanupErr) {
+                logWarning("engine", `auto start cleanup failed: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`, { file: "auto.ts" });
+            }
+        }
     });
 }
 /** Returns true if the project is configured for `isolation:worktree` mode. */
@@ -2175,6 +2189,10 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         ctx.ui.setWidget("gsd-health", undefined);
         ctx.ui.notify(s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "info");
         restoreHookState(s.basePath);
+        // A restored activeHook has no live dispatch (the sidecar queue is not
+        // persisted); re-enqueue it so the hook runs instead of blocking the next
+        // unrelated unit's close-out (#1246).
+        reconcileRestoredHookDispatch(s.basePath, s.sidecarQueue);
         // Re-sync managed resources on resume so long-lived auto sessions pick up
         // bundled extension updates before resume-time verification/state logic runs.
         // GSD_PKG_ROOT is set by loader.ts and points to the gsd-pi package root.
@@ -2228,15 +2246,19 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             debugLog("resume-orchestration-resume", { error: err instanceof Error ? err.message : String(err) });
         }
         startAutoCommandPolling(s.basePath);
-        await runAutoLoopWithUok({
-            ctx,
-            pi,
-            s,
-            deps: loopDeps,
-            runKernelLoop: runUokKernelLoop,
-            runLegacyLoop: runLegacyAutoLoop,
-        });
-        await cleanupAfterLoopExit(ctx);
+        try {
+            await runAutoLoopWithUok({
+                ctx,
+                pi,
+                s,
+                deps: loopDeps,
+                runKernelLoop: runUokKernelLoop,
+                runLegacyLoop: runLegacyAutoLoop,
+            });
+        }
+        finally {
+            await cleanupAfterLoopExit(ctx);
+        }
         return;
     }
     // ── Fresh start path — delegated to auto-start.ts ──
@@ -2252,8 +2274,16 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     // for crash-recovery fidelity (#5405).
     registerAutoWorkerForSession(s, base);
     const ready = await bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, bootstrapDeps, freshStartAssessment);
-    if (!ready)
+    if (!ready) {
+        // bootstrapAutoSession sets s.active = true (auto-start.ts) before several
+        // post-activation bail-outs return false without a loop ever running (e.g.
+        // the SQLite-unavailable gate). Without this, s.active and the auto lock
+        // leak and every later /gsd auto silently no-ops via the re-entry guard
+        // (#1235). Run the canonical cleanup so a failed bootstrap stays recoverable.
+        if (s.active)
+            await cleanupAfterLoopExit(ctx);
         return;
+    }
     // Build scope after bootstrap has populated s.basePath / s.originalBasePath /
     // s.currentMilestoneId (including worktree setup inside bootstrapAutoSession).
     rebuildScope(s.basePath, s.currentMilestoneId);
@@ -2277,15 +2307,19 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     }
     startAutoCommandPolling(s.basePath);
     // Dispatch the first unit
-    await runAutoLoopWithUok({
-        ctx,
-        pi,
-        s,
-        deps: loopDeps,
-        runKernelLoop: runUokKernelLoop,
-        runLegacyLoop: runLegacyAutoLoop,
-    });
-    await cleanupAfterLoopExit(ctx);
+    try {
+        await runAutoLoopWithUok({
+            ctx,
+            pi,
+            s,
+            deps: loopDeps,
+            runKernelLoop: runUokKernelLoop,
+            runLegacyLoop: runLegacyAutoLoop,
+        });
+    }
+    finally {
+        await cleanupAfterLoopExit(ctx);
+    }
 }
 // describeNextUnit is imported from auto-dashboard.ts and re-exported
 export { describeNextUnit } from "./auto-dashboard.js";
@@ -2402,20 +2436,52 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         startedAt: hookStartedAt,
         workspaceRoot: s.basePath,
     });
-    if (hookModel) {
-        const availableModels = ctx.modelRegistry.getAvailable();
-        const match = resolveModelId(hookModel, availableModels, ctx.model?.provider);
-        if (match) {
+    // Resolve the hook's model honoring the configured `fallbacks[]` chain
+    // (#1229). The manual trigger path bypasses selectAndApplyModel, so resolve
+    // the primary→fallbacks order here and apply the first candidate available in
+    // the registry — a blocked or unconfigured primary then transparently drops
+    // to a fallback instead of silently reverting to the session model.
+    const availableModels = ctx.modelRegistry.getAvailable();
+    const availableModelIds = availableModels.map((m) => `${m.provider}/${m.id}`);
+    const hookModelConfig = resolveModelWithFallbacksForUnit(hookUnitType, targetBasePath, availableModelIds);
+    const modelCandidates = hookModelConfig
+        ? [hookModelConfig.primary, ...hookModelConfig.fallbacks]
+        : hookModel
+            ? [hookModel]
+            : [];
+    if (modelCandidates.length > 0) {
+        let applied = false;
+        for (const candidate of modelCandidates) {
+            const match = resolveModelId(candidate, availableModels, ctx.model?.provider);
+            if (!match)
+                continue;
+            // Skip models the runtime has marked blocked or temporarily unavailable
+            // (e.g. a primary that just tripped a provider limit) so the configured
+            // fallbacks[] chain actually engages — parity with auto-mode's
+            // selectAndApplyModel, which consults the same blocked-models store (#1229).
+            if (isModelUnavailable(targetBasePath, match.provider, match.id))
+                continue;
             try {
-                await pi.setModel(match);
+                if (await pi.setModel(match)) {
+                    // The manual trigger path bypasses selectAndApplyModel, so apply the
+                    // hook's per-field `thinking` (from `post_unit_hooks[].model`'s object
+                    // form) here against the just-set model rather than leaving the hook at
+                    // the session level (#1269). Absent → session level, unchanged.
+                    if (hookModelConfig?.thinking) {
+                        applyThinkingLevelForModel(pi, hookModelConfig.thinking, match, ctx);
+                    }
+                    applied = true;
+                    break;
+                }
             }
             catch (err) {
-                /* non-fatal */
-                logWarning("dispatch", `hook model set failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                /* non-fatal — try the next fallback */
+                logWarning("dispatch", `hook model set failed for ${candidate}: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
             }
         }
-        else {
-            ctx.ui.notify(`Hook model "${hookModel}" not found in available models. Falling back to current session model. ` +
+        if (!applied) {
+            ctx.ui.notify(`Hook model${modelCandidates.length > 1 ? "s" : ""} "${modelCandidates.join(", ")}" not available. ` +
+                `Falling back to current session model. ` +
                 `Ensure the model is defined in models.json and has auth configured.`, "warning");
         }
     }

package/dist/resources/extensions/gsd/compat/compat-marker.js

@@ -98,6 +98,50 @@ export function writeCompatMarker(basePath, marker) {
     writeFileSync(tmp, JSON.stringify(marker, null, 2), "utf-8");
     renameSync(tmp, path);
 }
+/**
+ * Remove projection entries whose backing file no longer exists on disk.
+ *
+ * gsd-pi never deletes marker entries on its own: both drift detectors skip
+ * files missing from disk (`if (!existsSync(abs)) continue;`) and the write-time
+ * flush only ever adds or refreshes entries. So when a phase directory is
+ * renamed or removed (e.g. `phases/29-new-milestone-m029/` →
+ * `phases/29-frontend-code-debt-cleanup/`), the old projection paths linger in
+ * `.compat.json` forever as phantom entries pointing at directories that no
+ * longer exist (#1257). They never reconcile, and `.compat.json` keeps drifting
+ * from disk reality so `git status` stops being a reliable proxy for "did the
+ * engine touch my plans?".
+ *
+ * This prunes those orphaned entries across the `.gsd/` projections and the
+ * `.planning/` projections/passthrough maps. It is safe: a missing-file entry is
+ * inert (every detector already ignores it), and if the file is later
+ * re-projected the write-time flush / unseeded-file detection re-seeds an
+ * accurate baseline.
+ *
+ * Returns the number of entries removed; when nothing is orphaned the marker is
+ * left untouched (no needless write, no `lastProjectedAt` churn).
+ */
+export function pruneOrphanedProjectionEntries(basePath) {
+    if (!existsSync(compatMarkerPath(basePath)))
+        return 0;
+    const marker = readCompatMarker(basePath);
+    let removed = 0;
+    const pruneMap = (map, root) => {
+        for (const relPath of Object.keys(map)) {
+            if (!existsSync(join(basePath, root, relPath))) {
+                delete map[relPath];
+                removed++;
+            }
+        }
+    };
+    pruneMap(marker.projections, ".gsd");
+    if (marker.planning) {
+        pruneMap(marker.planning.projections, ".planning");
+        pruneMap(marker.planning.passthrough, ".planning");
+    }
+    if (removed > 0)
+        writeCompatMarker(basePath, marker);
+    return removed;
+}
 function quarantine(basePath, raw) {
     const path = compatMarkerPath(basePath);
     const badPath = `${path}.bad-${Date.now()}`;

package/dist/resources/extensions/gsd/config-overlay.js

@@ -121,8 +121,13 @@ function collectConfigSections(options) {
     if (prefs?.auto_supervisor) {
         const sup = resolveAutoSupervisorConfig();
         const supRows = [];
-        if (sup.model)
-            supRows.push({ label: "Model", value: sup.model });
+        if (sup.model) {
+            let modelVal = sup.model;
+            if (sup.modelFallbacks && sup.modelFallbacks.length > 0) {
+                modelVal += ` \u2192 ${sup.modelFallbacks.join(" \u2192 ")}`;
+            }
+            supRows.push({ label: "Model", value: modelVal });
+        }
         supRows.push({ label: "Soft timeout", value: `${sup.soft_timeout_minutes}m` });
         supRows.push({ label: "Idle timeout", value: `${sup.idle_timeout_minutes}m` });
         supRows.push({ label: "Stalled tool timeout", value: `${sup.stalled_tool_timeout_minutes}m` });

package/dist/resources/extensions/gsd/db/engine.js

@@ -801,3 +801,36 @@ export function getDb() {
 export function getDbOrNull() {
     return currentDb;
 }
+/**
+ * Confirm the open handle can actually write, not just that it opened.
+ *
+ * A schema-current database performs zero writes during open, so a handle that
+ * opened successfully but is not writable (read-only file, WAL/SHM permission
+ * mismatch, or a stale/moved handle → SQLITE_READONLY_DBMOVED) otherwise passes
+ * the open-only availability check and only fails much later at the first real
+ * write. The probe forces a genuine page write by re-writing the current
+ * `PRAGMA user_version` value back inside an IMMEDIATE transaction: a bare
+ * `BEGIN IMMEDIATE; ROLLBACK` is not sufficient because a moved handle does not
+ * fail until a page is actually dirtied. The value is unchanged, so the probe
+ * is idempotent, and the transaction is rolled back so nothing persists.
+ */
+export function probeDbWritable() {
+    const db = currentDb;
+    if (!db)
+        return { ok: false, detail: "No database is open." };
+    try {
+        const row = db.prepare("PRAGMA user_version").get();
+        const current = typeof row?.user_version === "number" ? row.user_version : 0;
+        db.exec("BEGIN IMMEDIATE");
+        try {
+            db.exec(`PRAGMA user_version = ${current}`);
+        }
+        finally {
+            db.exec("ROLLBACK");
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, detail: err.message };
+    }
+}

package/dist/resources/extensions/gsd/db-adapter.js

@@ -11,19 +11,46 @@ export function normalizeDbRow(row) {
 export function normalizeDbRows(rows) {
     return rows.map((row) => normalizeDbRow(row));
 }
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+// node:sqlite accepts binding-object keys with or without the ':'/'@'/'$'
+// prefix, but better-sqlite3 accepts only bare keys — strip the prefix so
+// call sites written against node:sqlite also work on the fallback provider.
+function normalizeBindParams(params) {
+    return params.map((param) => {
+        if (!isPlainObject(param))
+            return param;
+        let changed = false;
+        const normalized = {};
+        for (const [key, value] of Object.entries(param)) {
+            if (key.length > 1 && (key[0] === ":" || key[0] === "@" || key[0] === "$")) {
+                normalized[key.slice(1)] = value;
+                changed = true;
+            }
+            else {
+                normalized[key] = value;
+            }
+        }
+        return changed ? normalized : param;
+    });
+}
 export function createDbAdapter(rawDb) {
     const db = rawDb;
     const stmtCache = new Map();
     function wrapStmt(raw) {
         return {
             run(...params) {
-                return raw.run(...params);
+                return raw.run(...normalizeBindParams(params));
             },
             get(...params) {
-                return normalizeDbRow(raw.get(...params));
+                return normalizeDbRow(raw.get(...normalizeBindParams(params)));
             },
             all(...params) {
-                return normalizeDbRows(raw.all(...params));
+                return normalizeDbRows(raw.all(...normalizeBindParams(params)));
             },
         };
     }

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -138,7 +138,7 @@ Diagnostics record the file path, scope (global/project), severity (error/warnin
   - `off` — skill discovery is disabled entirely.
 
 - `auto_supervisor`: configures the auto-mode supervisor that monitors agent progress and enforces timeouts. Keys:
-  - `model`: model ID to use for the supervisor process (defaults to the currently active model).
+  - `model`: model to use for the supervisor process (defaults to the currently active model). Accepts a bare model ID **or** the same `{ model, provider?, fallbacks? }` object form as `models.<phase>`, so it honors `fallbacks[]` on a transient provider trip.
   - `soft_timeout_minutes`: minutes before the supervisor issues a soft warning (default: 20).
   - `idle_timeout_minutes`: minutes of inactivity before the supervisor intervenes (default: 10).
   - `hard_timeout_minutes`: minutes before the supervisor forces termination (default: 30).
@@ -228,7 +228,7 @@ In `"parent"` mode, slice/task `targetRepositories` default to the declared chil
   - `enabled`: boolean — set `false` to force sequential task execution. Default: `true`.
   - `max_parallel`: number — maximum tasks to dispatch in one batch, range `1`-`8`. Default: `2`.
   - `isolation_mode`: `"same-tree"` — currently the only supported value.
-  - `subagent_model`: string — optional model override for reactive task subagents. Falls back to the `models.subagent` routing when omitted.
+  - `subagent_model`: optional model override for reactive task subagents. Accepts a bare model ID **or** the `{ model, provider?, fallbacks? }` object form (parity with `models.<phase>`). Falls back to the `models.subagent` routing when omitted.
 
 - `remote_questions`: route interactive questions to Slack/Discord for headless auto-mode. Keys:
   - `channel`: `"slack"` or `"discord"` — channel type.
@@ -326,7 +326,7 @@ In `"parent"` mode, slice/task `targetRepositories` default to the declared chil
   - `after`: string[] — unit types that trigger this hook (e.g., `["execute-task"]`).
   - `prompt`: string — prompt sent to the LLM. Supports `{milestoneId}`, `{sliceId}`, `{taskId}` substitutions.
   - `max_cycles`: number — max times this hook fires per trigger (default: 1, max: 10).
-  - `model`: string — optional model override.
+  - `model`: optional model override. Accepts a bare model ID **or** the same `{ model, provider?, fallbacks? }` object form as `models.<phase>`. With `fallbacks[]`, a transient trip of the primary provider falls back to the next entry instead of hard-failing the hook — which, for a `blocking` hook with `on_block: { action: pause }`, would otherwise pause the whole run.
   - `artifact`: string — expected output file name (relative to task/slice dir). Hook is skipped if file already exists (idempotent).
   - `criticality`: `"advisory"` or `"blocking"` — advisory preserves current best-effort behavior; blocking requires clean hook completion plus a valid outcome verdict before auto-mode advances. Default: `"advisory"`.
   - `retry_on`: string — if this file is produced instead of the artifact, re-run the trigger unit then re-run hooks.

package/dist/resources/extensions/gsd/journal.js

@@ -51,7 +51,7 @@ export function emitJournalEvent(basePath, entry) {
     catch {
         // Silent failure — journal must never break auto-mode
     }
-    if (!isUnifiedAuditEnabled())
+    if (!isUnifiedAuditEnabled(basePath))
         return;
     try {
         const causedBy = entry.causedBy