@opengsd/gsd-pi 1.5.0-dev.553dc518 → 1.5.0-dev.c4c8885f

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -8,7 +8,7 @@
  * utility.
  */
 import { loadFile, parseContinue, parseSummary, loadActiveOverrides, formatOverridesSection } from "./files.js";
-import { hasVerdict, extractVerdict } from "./verdict-parser.js";
+import { extractVerdict } from "./verdict-parser.js";
 import { loadPrompt, inlineTemplate } from "./prompt-loader.js";
 import { resolveMilestoneFile, resolveSliceFile, resolveSlicePath, resolveTasksDir, resolveTaskFiles, resolveTaskFile, relMilestoneFile, relSliceFile, relSlicePath, relMilestonePath, relTaskFile, resolveGsdRootFile, relGsdRootFile, resolveRuntimeFile, } from "./paths.js";
 import { resolveInlineLevel, loadEffectiveGSDPreferences } from "./preferences.js";
@@ -35,7 +35,8 @@ import { debugLog } from "./debug-logger.js";
 import { buildSkillActivationBlock, buildSkillDiscoveryVars } from "./skill-activation.js";
 import { findMilestoneIds } from "./milestone-ids.js";
 import { buildRunUatPresentationForType, RUN_UAT_TOOL_PRESENTATION_PLAN_ID } from "./tool-presentation-plan.js";
-import { classifyUatContentForRun, shouldDispatchUatForContent, } from "./uat-policy.js";
+import { classifyUatContentForRun } from "./uat-policy.js";
+import { checkNeedsRunUat as resolveNeedsRunUat } from "./uat-dispatch.js";
 import { buildWebAppUatGuidanceBlock } from "./web-app-uat.js";
 export { buildSkillActivationBlock, buildSkillDiscoveryVars };
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
@@ -1320,120 +1321,26 @@ export async function checkNeedsReassessment(base, mid, state) {
         return null;
     return { sliceId: lastDone };
 }
+export function getRoadmapCompletedSliceCandidates(roadmapContent) {
+    return parseRoadmap(roadmapContent)
+        .slices.filter((slice) => slice.done)
+        .map((slice) => ({ sliceId: slice.id }))
+        .reverse();
+}
+export async function loadRoadmapCompletedSliceCandidates(base, mid) {
+    const roadmapPath = resolveMilestoneFile(base, mid, "ROADMAP");
+    const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+    return roadmapContent ? getRoadmapCompletedSliceCandidates(roadmapContent) : [];
+}
 /**
- * Check if the most recently completed slice needs a UAT run.
- * Returns { sliceId, uatType } if UAT should be dispatched, null otherwise.
- *
- * Skips when:
- * - No roadmap or no completed slices
- * - uat_dispatch is not enabled and the UAT spec does not require runtime/browser evidence
- * - No UAT file exists for the slice
- * - UAT result file already exists (idempotent — already ran)
- */
-/**
- * Resolve the effective UAT mode for the dispatch gate the same way
- * `buildRunUatPrompt` does: classify the UAT body with the slice's SUMMARY as
- * supplemental context, so a `browser-executable` UAT whose slice references a
- * self-contained harness (`npm run test:uat`, `search-uat.mjs`, `npx
- * playwright test`) is promoted to `runtime-executable` for the gate too.
- *
- * Without this, `checkNeedsRunUat` returns `browser-executable` while the
- * prompt instructs runtime-only execution, causing the dispatch gate to
- * require browser tools / warm up the browser daemon (or stop dispatch when
- * browser MCP is unavailable) for UAT runs that never touch the browser. See
- * cursor[bot] review on PR #696 for the M007/S01 regression.
+ * Back-compat wrapper for callers that import UAT dispatch checks from the
+ * prompt module. UAT dispatch architecture lives in `uat-dispatch.ts`; the
+ * `state` parameter is intentionally ignored because DB/roadmap artifacts are
+ * the source of truth for completed-slice discovery.
  */
-async function resolveRunUatEffectiveType(base, mid, sliceId, uatContent) {
-    let summaryContent = "";
-    try {
-        const summaryPath = resolveSliceFile(base, mid, sliceId, "SUMMARY");
-        if (summaryPath) {
-            summaryContent = (await loadFile(summaryPath)) ?? "";
-        }
-    }
-    catch (err) {
-        logWarning("prompt", `resolveRunUatEffectiveType SUMMARY load failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    return classifyUatContentForRun(uatContent, summaryContent).effectiveType;
-}
 export async function checkNeedsRunUat(base, mid, state, prefs) {
-    // DB primary path — fall through to file-based when DB has no data for this milestone
-    try {
-        const { isDbAvailable, getMilestoneSlices } = await import("./gsd-db.js");
-        if (isDbAvailable()) {
-            const slices = getMilestoneSlices(mid);
-            if (slices.length > 0) {
-                const completedSlices = slices.filter(s => s.status === "complete");
-                if (completedSlices.length === 0)
-                    return null;
-                for (const completed of [...completedSlices].reverse()) {
-                    const sid = completed.id;
-                    const uatFile = resolveSliceFile(base, mid, sid, "UAT");
-                    if (!uatFile)
-                        continue;
-                    const uatContent = await loadFile(uatFile);
-                    if (!uatContent)
-                        continue;
-                    // If the UAT file already contains a verdict, UAT has been run — skip
-                    if (hasVerdict(uatContent))
-                        continue;
-                    // Also check the ASSESSMENT file — the run-uat prompt writes the verdict
-                    // there (via gsd_uat_result_save), not into the
-                    // UAT spec file. Without this check the unit re-dispatches indefinitely.
-                    const assessmentFile = resolveSliceFile(base, mid, sid, "ASSESSMENT");
-                    if (assessmentFile) {
-                        const assessmentContent = await loadFile(assessmentFile);
-                        if (assessmentContent && hasVerdict(assessmentContent))
-                            continue;
-                    }
-                    if (!shouldDispatchUatForContent(uatContent, prefs))
-                        continue;
-                    const uatType = await resolveRunUatEffectiveType(base, mid, sid, uatContent);
-                    return { sliceId: sid, uatType };
-                }
-                return null;
-            }
-        }
-    }
-    catch (err) {
-        logWarning("prompt", `checkNeedsRunUat DB lookup failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    // File-based fallback using roadmap checkboxes
-    const roadmapPath = resolveMilestoneFile(base, mid, "ROADMAP");
-    if (!roadmapPath)
-        return null;
-    const roadmapContent = await loadFile(roadmapPath);
-    if (!roadmapContent)
-        return null;
-    const parsed = parseRoadmap(roadmapContent);
-    const completedFileSlices = parsed.slices.filter(s => s.done);
-    if (completedFileSlices.length === 0)
-        return null;
-    for (const completed of [...completedFileSlices].reverse()) {
-        const uatSid = completed.id;
-        const uatFileFb = resolveSliceFile(base, mid, uatSid, "UAT");
-        if (!uatFileFb)
-            continue;
-        const uatContentFb = await loadFile(uatFileFb);
-        if (!uatContentFb)
-            continue;
-        // If the UAT file already contains a verdict, UAT has been run — skip
-        if (hasVerdict(uatContentFb))
-            continue;
-        // Also check the ASSESSMENT file for the file-based fallback path (same
-        // reason as the DB path above — verdict lives in ASSESSMENT, not UAT).
-        const assessmentFileFb = resolveSliceFile(base, mid, uatSid, "ASSESSMENT");
-        if (assessmentFileFb) {
-            const assessmentContentFb = await loadFile(assessmentFileFb);
-            if (assessmentContentFb && hasVerdict(assessmentContentFb))
-                continue;
-        }
-        if (!shouldDispatchUatForContent(uatContentFb, prefs))
-            continue;
-        const uatType = await resolveRunUatEffectiveType(base, mid, uatSid, uatContentFb);
-        return { sliceId: uatSid, uatType };
-    }
-    return null;
+    void state;
+    return resolveNeedsRunUat(base, mid, prefs, await loadRoadmapCompletedSliceCandidates(base, mid));
 }
 export async function buildDiscussMilestoneInlinedContext(mid, base) {
     const inlined = [];
@@ -3401,10 +3308,15 @@ export async function buildReassessRoadmapPrompt(mid, midTitle, completedSliceId
  * that instructs the coordinator how to dispatch a `subagent` call. Either or
  * both may be absent (ADR-026 / #508).
  */
-function subagentCallSuffix(model, thinking) {
+function subagentCallSuffix(model, thinking, fallbacks) {
     const parts = [];
-    if (model)
-        parts.push(`model: "${model}"`);
+    if (model) {
+        let modelHint = `model: "${model}"`;
+        if (fallbacks && fallbacks.length > 0) {
+            modelHint += ` (fallbacks, in order: ${fallbacks.map((f) => `"${f}"`).join(", ")})`;
+        }
+        parts.push(modelHint);
+    }
     if (thinking)
         parts.push(`thinking: "${thinking}"`);
     return parts.length > 0 ? ` with ${parts.join(" and ")}` : "";
@@ -3490,7 +3402,7 @@ opts) {
             "",
             `When done, say: "Task ${tid} complete."`,
         ].join("\n");
-        const modelSuffix = subagentCallSuffix(subagentModel, opts?.subagentThinking);
+        const modelSuffix = subagentCallSuffix(subagentModel, opts?.subagentThinking, opts?.subagentModelFallbacks);
         subagentSections.push([
             `### ${tid}: ${tTitle}`,
             "",

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -149,12 +149,56 @@ export function refreshRecoveryDbForArtifact(unitType, unitId, basePath) {
         };
     }
     if (!isClosedStatus(task.status)) {
-        return {
-            ok: false,
-            fatal: true,
-            reason: "execute-task-artifact-db-mismatch",
-            message: `Stuck recovery found execute-task ${unitId} artifacts, but the DB task status is still '${task.status}' after refresh.`,
-        };
+        // The artifact was already confirmed on disk by verifyExpectedArtifact
+        // upstream (Gate 1 accepts a checked disk checkbox as proof of completion),
+        // but the DB task row is still open. A bare refreshWorkflowDatabaseFromDisk
+        // never promotes the disk checkbox into task status (the checkbox is
+        // rendered *from* the DB, never *into* it), so this divergence can never
+        // self-heal. Promote the task to align the DB with disk instead of failing
+        // shut — otherwise the lowest-pending derivation re-picks the same task
+        // forever and execute-task hard-stops with "state did not advance" (#1204).
+        // Mirrors the promotion pattern used by the context-exhaustion and
+        // reactive-execute-blocker recovery paths.
+        const ts = new Date().toISOString();
+        // Only the DB promotion is load-bearing: if it throws, nothing advanced
+        // and failing shut is correct. The plan checkbox rewrite and cache clears
+        // are best-effort follow-ups — a throw there must NOT abort recovery, or
+        // the DB is left complete without ever emitting the stuck-artifact-recovery
+        // event (#1221), stranding worktree reconciliation.
+        try {
+            updateTaskStatus(mid, sid, tid, "complete", ts);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                fatal: true,
+                reason: "execute-task-artifact-db-promote-failed",
+                message: `Stuck recovery found execute-task ${unitId} artifacts, but promoting the DB task status from '${task.status}' failed: ${getErrorMessage(e)}`,
+            };
+        }
+        try {
+            const artifactBase = resolveArtifactVerificationBase(unitId, basePath);
+            const planPath = resolveExpectedArtifactPath("plan-slice", `${mid}/${sid}`, artifactBase);
+            if (planPath && existsSync(planPath)) {
+                const planContent = readFileSync(planPath, "utf-8");
+                const updatedPlan = planContent.replace(new RegExp(`^(\\s*-\\s+)\\[ \\]\\s+\\*\\*${tid}:`, "m"), `$1[x] **${tid}:`);
+                if (updatedPlan !== planContent) {
+                    atomicWriteSync(planPath, updatedPlan);
+                }
+            }
+            clearPathCache();
+            clearParseCache();
+        }
+        catch (e) {
+            logWarning("recovery", `stuck-artifact plan checkbox sync failed after DB promotion of ${unitId}: ${getErrorMessage(e)}`);
+        }
+        // Append event so worktree reconciliation can replay this recovery completion.
+        try {
+            appendEvent(basePath, { cmd: "complete-task", params: { milestoneId: mid, sliceId: sid, taskId: tid }, ts, actor: "system", trigger_reason: "stuck-artifact-recovery" });
+        }
+        catch (e) {
+            logWarning("recovery", `appendEvent failed for stuck-artifact task promotion: ${getErrorMessage(e)}`);
+        }
     }
     return { ok: true };
 }

package/dist/resources/extensions/gsd/auto-start.js

@@ -36,10 +36,10 @@ import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { queryJournal } from "./journal.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
-import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
+import { restoreHookState, resetHookState, reconcileRestoredHookDispatch } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
-import { isDbAvailable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
+import { isDbAvailable, probeDbWritable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
 import { getWorkflowDatabaseStatus, openExistingWorkflowDatabase, openWorkflowDatabase, resolveProjectRootDbPath, } from "./db-workspace.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
@@ -119,36 +119,42 @@ export function reconcileProjectMilestonesFromDisk(basePath) {
 export function reconcileMergedMilestonesFromJournal(basePath) {
     if (!isDbAvailable())
         return 0;
-    const mergedAtByMilestone = new Map();
-    for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
-        const data = entry.data ?? {};
-        const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
-        if (!milestoneId)
-            continue;
-        if (data.conflict === true)
-            continue;
-        const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
-        const previous = mergedAtByMilestone.get(milestoneId);
-        if (!previous || endedAt > previous)
-            mergedAtByMilestone.set(milestoneId, endedAt);
-    }
-    let closed = 0;
-    for (const [milestoneId, completedAt] of mergedAtByMilestone) {
-        const existing = getMilestone(milestoneId);
-        if (!existing) {
-            insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
-            updateMilestoneStatus(milestoneId, "complete", completedAt);
-            closed++;
-            continue;
-        }
-        if (!isClosedStatus(existing.status)) {
-            updateMilestoneStatus(milestoneId, "complete", completedAt);
-            closed++;
+    try {
+        const mergedAtByMilestone = new Map();
+        for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
+            const data = entry.data ?? {};
+            const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
+            if (!milestoneId)
+                continue;
+            if (data.conflict === true)
+                continue;
+            const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
+            const previous = mergedAtByMilestone.get(milestoneId);
+            if (!previous || endedAt > previous)
+                mergedAtByMilestone.set(milestoneId, endedAt);
+        }
+        let closed = 0;
+        for (const [milestoneId, completedAt] of mergedAtByMilestone) {
+            const existing = getMilestone(milestoneId);
+            if (!existing) {
+                insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
+                updateMilestoneStatus(milestoneId, "complete", completedAt);
+                closed++;
+                continue;
+            }
+            if (!isClosedStatus(existing.status)) {
+                updateMilestoneStatus(milestoneId, "complete", completedAt);
+                closed++;
+            }
         }
+        if (closed > 0)
+            invalidateAllCaches();
+        return closed;
+    }
+    catch (err) {
+        logWarning("bootstrap", `merged-milestone journal reconciliation failed: ${err instanceof Error ? err.message : String(err)}`);
+        return 0;
     }
-    if (closed > 0)
-        invalidateAllCaches();
-    return closed;
 }
 export function decideSurvivorAction(hasSurvivorBranch, phase) {
     if (!hasSurvivorBranch)
@@ -1254,6 +1260,10 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.unitLifetimeDispatches.clear();
         resetHookState();
         restoreHookState(base);
+        // A restored activeHook has no live dispatch (the sidecar queue is not
+        // persisted); re-enqueue it so the hook runs instead of blocking the next
+        // unrelated unit's close-out (#1246).
+        reconcileRestoredHookDispatch(base, s.sidecarQueue);
         resetProactiveHealing();
         // Notify user on health level transitions (green→yellow→red and back)
         setLevelChangeCallback((_from, to, summary) => {
@@ -1377,6 +1387,19 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             ctx.ui.notify(`SQLite database exists but failed to open: ${gsdDbPath}. ${phaseHint}${errorDetail}.${providerHint}`, "error");
             return releaseLockAndReturn();
         }
+        // Gate: confirm the handle is actually writable, not just open. A
+        // schema-current DB does zero writes during open, so a read-only /
+        // DBMOVED handle otherwise passes the check above and only fails much
+        // later at the first authoritative write (the uok-kernel-enter audit)
+        // with an opaque "readonly database" error (#1234).
+        if (existsSync(gsdDbPath) && isDbAvailable()) {
+            const writable = probeDbWritable();
+            if (!writable.ok) {
+                const detail = writable.detail ? ` (${writable.detail})` : "";
+                ctx.ui.notify(`SQLite database is not writable: ${gsdDbPath}.${detail} Check file/WAL permissions or reopen a stale handle before running auto-mode.`, "error");
+                return releaseLockAndReturn();
+            }
+        }
         // Initialize metrics
         initMetrics(s.basePath);
         // Initialize routing history
@@ -1410,7 +1433,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // Snapshot installed skills
         if (resolveSkillDiscoveryMode(base) !== "off") {
-            snapshotSkills();
+            snapshotSkills({ cwd: s.basePath });
         }
         setAutoActiveStatus(ctx, s.stepMode ? "next" : "auto");
         ctx.ui.setWidget("gsd-health", undefined);

package/dist/resources/extensions/gsd/auto-timeout-recovery.js

@@ -8,6 +8,8 @@ import { resolveExpectedArtifactPath, diagnoseExpectedArtifact, verifyExpectedAr
 import { existsSync } from "node:fs";
 import { bumpAndResolveSynthetic } from "./auto/resolve.js";
 import { finalizeProjectResearchTimeout } from "./project-research-policy.js";
+import { applySupervisorModelIfConfigured } from "./auto-model-selection.js";
+import { getInFlightToolCount } from "./auto-tool-tracking.js";
 export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rctx) {
     // Note on turn epoch: the bump is intentionally NOT unconditional at
     // function entry. Two branches below (the "steering retry" paths) keep
@@ -79,11 +81,15 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
                     "Immediately finish the required durable output for this unit.",
                     "If full completion is impossible, write the partial artifact/state needed for recovery and make the blocker explicit.",
                 ];
+            const recoveryTrigger = getInFlightToolCount() === 0;
+            if (recoveryTrigger) {
+                await applySupervisorModelIfConfigured(ctx, pi, basePath);
+            }
             pi.sendMessage({
                 customType: "gsd-auto-timeout-recovery",
                 display: verbose,
                 content: steeringLines.join("\n"),
-            }, { triggerTurn: true, deliverAs: "steer" });
+            }, { triggerTurn: recoveryTrigger, deliverAs: "steer" });
             ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: steering ${unitType} ${unitId} to finish durable output (attempt ${attemptNumber}, session ${recoveryAttempts + 1}/${maxRecoveryAttempts}).`, "warning");
             return "recovered";
         }
@@ -176,11 +182,15 @@ export async function recoverTimedOutUnit(ctx, pi, unitType, unitId, reason, rct
                 "Write the required artifact now.",
                 "If blocked, write the partial artifact and explicitly record the blocker instead of going silent.",
             ];
+        const recoveryTrigger = getInFlightToolCount() === 0;
+        if (recoveryTrigger) {
+            await applySupervisorModelIfConfigured(ctx, pi, basePath);
+        }
         pi.sendMessage({
             customType: "gsd-auto-timeout-recovery",
             display: verbose,
             content: steeringLines.join("\n"),
-        }, { triggerTurn: true, deliverAs: "steer" });
+        }, { triggerTurn: recoveryTrigger, deliverAs: "steer" });
         ctx.ui.notify(`${reason === "idle" ? "Idle" : "Timeout"} recovery: steering ${unitType} ${unitId} to produce ${expected} (attempt ${attemptNumber}, session ${recoveryAttempts + 1}/${maxRecoveryAttempts}).`, "warning");
         return "recovered";
     }

package/dist/resources/extensions/gsd/auto-timers.js

@@ -11,6 +11,7 @@ import { resolveAutoSupervisorConfig } from "./preferences.js";
 import { computeBudgets, resolveExecutorContextWindow } from "./context-budget.js";
 import { getInFlightToolCount, getOldestInFlightToolStart, clearInFlightTools, hasInteractiveToolInFlight, } from "./auto-tool-tracking.js";
 import { detectWorkingTreeActivity } from "./auto-supervisor.js";
+import { applySupervisorModelIfConfigured } from "./auto-model-selection.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
 import { saveActivityLog } from "./activity-log.js";
 import { recoverTimedOutUnit } from "./auto-timeout-recovery.js";
@@ -113,7 +114,7 @@ export function startUnitSupervision(sctx) {
         ? supervisor.stalled_tool_timeout_minutes * 60 * 1000
         : idleTimeoutMs;
     // ── 1. Soft timeout warning ──
-    s.wrapupWarningHandle = setTimeout(() => {
+    s.wrapupWarningHandle = setTimeout(async () => {
         s.wrapupWarningHandle = null;
         if (!s.active || !s.currentUnit)
             return;
@@ -125,6 +126,9 @@ export function startUnitSupervision(sctx) {
         // Triggering during active tool calls causes tool results to be skipped
         // with "Skipped due to queued user message", leading to provider errors (#3512).
         const softTrigger = getInFlightToolCount() === 0;
+        if (softTrigger) {
+            await applySupervisorModelIfConfigured(ctx, pi, s.basePath);
+        }
         pi.sendMessage({
             customType: "gsd-auto-wrapup",
             display: s.verbose,
@@ -291,7 +295,7 @@ export function startUnitSupervision(sctx) {
     }
     const executorContextWindow = resolveExecutorContextWindow(ctx.modelRegistry, prefs, ctx.model?.contextWindow, ctx.model?.provider);
     const continueHereThreshold = computeBudgets(executorContextWindow).continueThresholdPercent;
-    s.continueHereHandle = setInterval(() => {
+    s.continueHereHandle = setInterval(async () => {
         if (!s.active || !s.currentUnit || !s.cmdCtx)
             return;
         const runtime = readUnitRuntimeRecord(s.basePath, unitType, unitId);
@@ -316,6 +320,9 @@ export function startUnitSupervision(sctx) {
         }
         // Only trigger a new turn if no tools are currently in flight (#3512).
         const contextTrigger = getInFlightToolCount() === 0;
+        if (contextTrigger) {
+            await applySupervisorModelIfConfigured(ctx, pi, s.basePath);
+        }
         pi.sendMessage({
             customType: "gsd-auto-wrapup",
             display: s.verbose,

package/dist/resources/extensions/gsd/auto.js

@@ -30,9 +30,10 @@ import { playNotificationBell, sendDesktopNotification } from "./notifications.j
 import { getBudgetAlertLevel, getNewBudgetAlertLevel, getBudgetEnforcementAction, HARD_CONTEXT_REROOT_THRESHOLD_PERCENT, resolveCompactionThresholdPercent, shouldRerootStepSessionForContext, shouldWarnStepSessionForContext, } from "./auto-budget.js";
 import { markToolStart as _markToolStart, markToolEnd as _markToolEnd, getOldestInFlightToolAgeMs as _getOldestInFlightToolAgeMs, clearInFlightTools, isToolInvocationError, isQueuedUserMessageSkip, isDeterministicPolicyError, } from "./auto-tool-tracking.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
-import { selectAndApplyModel, resolveModelId, clearToolBaseline } from "./auto-model-selection.js";
+import { selectAndApplyModel, resolveModelId, clearToolBaseline, isModelUnavailable, applyThinkingLevelForModel } from "./auto-model-selection.js";
+import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
 import { resetRoutingHistory, recordOutcome } from "./routing-history.js";
-import { resetHookState, runPreDispatchHooks, restoreHookState, clearPersistedHookState, } from "./post-unit-hooks.js";
+import { resetHookState, runPreDispatchHooks, restoreHookState, reconcileRestoredHookDispatch, clearPersistedHookState, } from "./post-unit-hooks.js";
 import { runGSDDoctor, rebuildState } from "./doctor.js";
 import { preDispatchHealthGate, resetProactiveHealing, setLevelChangeCallback, } from "./doctor-proactive.js";
 import { clearSkillSnapshot } from "./skill-discovery.js";
@@ -332,11 +333,24 @@ function withDetachedAutoKeepalive(run) {
 }
 export const _withDetachedAutoKeepaliveForTest = withDetachedAutoKeepalive;
 export function startAutoDetached(ctx, pi, base, verboseMode, options) {
-    void withDetachedAutoKeepalive(startAuto(ctx, pi, base, verboseMode, options)).catch((err) => {
+    void withDetachedAutoKeepalive(startAuto(ctx, pi, base, verboseMode, options)).catch(async (err) => {
         const message = getErrorMessage(err);
         ctx.ui.notify(`Auto-start failed: ${message}`, "error");
         logWarning("engine", `auto start error: ${message}`, { file: "auto.ts" });
         debugLog("auto-start-failed", { error: message });
+        // Backstop cleanup (#1235): if startAuto threw after auto-mode was activated
+        // (e.g. an exception during bootstrap, before the loop's try/finally could
+        // run cleanupAfterLoopExit), s.active and the on-disk auto lock leak, so the
+        // re-entry guard silently no-ops every later /gsd auto until restart. Clear
+        // the leaked activation here so a failed start is always recoverable.
+        if (s.active) {
+            try {
+                await cleanupAfterLoopExit(ctx);
+            }
+            catch (cleanupErr) {
+                logWarning("engine", `auto start cleanup failed: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`, { file: "auto.ts" });
+            }
+        }
     });
 }
 /** Returns true if the project is configured for `isolation:worktree` mode. */
@@ -2175,6 +2189,10 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
         ctx.ui.setWidget("gsd-health", undefined);
         ctx.ui.notify(s.stepMode ? "Step-mode resumed." : "Auto-mode resumed.", "info");
         restoreHookState(s.basePath);
+        // A restored activeHook has no live dispatch (the sidecar queue is not
+        // persisted); re-enqueue it so the hook runs instead of blocking the next
+        // unrelated unit's close-out (#1246).
+        reconcileRestoredHookDispatch(s.basePath, s.sidecarQueue);
         // Re-sync managed resources on resume so long-lived auto sessions pick up
         // bundled extension updates before resume-time verification/state logic runs.
         // GSD_PKG_ROOT is set by loader.ts and points to the gsd-pi package root.
@@ -2228,15 +2246,19 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
             debugLog("resume-orchestration-resume", { error: err instanceof Error ? err.message : String(err) });
         }
         startAutoCommandPolling(s.basePath);
-        await runAutoLoopWithUok({
-            ctx,
-            pi,
-            s,
-            deps: loopDeps,
-            runKernelLoop: runUokKernelLoop,
-            runLegacyLoop: runLegacyAutoLoop,
-        });
-        await cleanupAfterLoopExit(ctx);
+        try {
+            await runAutoLoopWithUok({
+                ctx,
+                pi,
+                s,
+                deps: loopDeps,
+                runKernelLoop: runUokKernelLoop,
+                runLegacyLoop: runLegacyAutoLoop,
+            });
+        }
+        finally {
+            await cleanupAfterLoopExit(ctx);
+        }
         return;
     }
     // ── Fresh start path — delegated to auto-start.ts ──
@@ -2252,8 +2274,16 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     // for crash-recovery fidelity (#5405).
     registerAutoWorkerForSession(s, base);
     const ready = await bootstrapAutoSession(s, ctx, pi, base, verboseMode, requestedStepMode, bootstrapDeps, freshStartAssessment);
-    if (!ready)
+    if (!ready) {
+        // bootstrapAutoSession sets s.active = true (auto-start.ts) before several
+        // post-activation bail-outs return false without a loop ever running (e.g.
+        // the SQLite-unavailable gate). Without this, s.active and the auto lock
+        // leak and every later /gsd auto silently no-ops via the re-entry guard
+        // (#1235). Run the canonical cleanup so a failed bootstrap stays recoverable.
+        if (s.active)
+            await cleanupAfterLoopExit(ctx);
         return;
+    }
     // Build scope after bootstrap has populated s.basePath / s.originalBasePath /
     // s.currentMilestoneId (including worktree setup inside bootstrapAutoSession).
     rebuildScope(s.basePath, s.currentMilestoneId);
@@ -2277,15 +2307,19 @@ export async function startAuto(ctx, pi, base, verboseMode, options) {
     }
     startAutoCommandPolling(s.basePath);
     // Dispatch the first unit
-    await runAutoLoopWithUok({
-        ctx,
-        pi,
-        s,
-        deps: loopDeps,
-        runKernelLoop: runUokKernelLoop,
-        runLegacyLoop: runLegacyAutoLoop,
-    });
-    await cleanupAfterLoopExit(ctx);
+    try {
+        await runAutoLoopWithUok({
+            ctx,
+            pi,
+            s,
+            deps: loopDeps,
+            runKernelLoop: runUokKernelLoop,
+            runLegacyLoop: runLegacyAutoLoop,
+        });
+    }
+    finally {
+        await cleanupAfterLoopExit(ctx);
+    }
 }
 // describeNextUnit is imported from auto-dashboard.ts and re-exported
 export { describeNextUnit } from "./auto-dashboard.js";
@@ -2402,20 +2436,52 @@ export async function dispatchHookUnit(ctx, pi, hookName, triggerUnitType, trigg
         startedAt: hookStartedAt,
         workspaceRoot: s.basePath,
     });
-    if (hookModel) {
-        const availableModels = ctx.modelRegistry.getAvailable();
-        const match = resolveModelId(hookModel, availableModels, ctx.model?.provider);
-        if (match) {
+    // Resolve the hook's model honoring the configured `fallbacks[]` chain
+    // (#1229). The manual trigger path bypasses selectAndApplyModel, so resolve
+    // the primary→fallbacks order here and apply the first candidate available in
+    // the registry — a blocked or unconfigured primary then transparently drops
+    // to a fallback instead of silently reverting to the session model.
+    const availableModels = ctx.modelRegistry.getAvailable();
+    const availableModelIds = availableModels.map((m) => `${m.provider}/${m.id}`);
+    const hookModelConfig = resolveModelWithFallbacksForUnit(hookUnitType, targetBasePath, availableModelIds);
+    const modelCandidates = hookModelConfig
+        ? [hookModelConfig.primary, ...hookModelConfig.fallbacks]
+        : hookModel
+            ? [hookModel]
+            : [];
+    if (modelCandidates.length > 0) {
+        let applied = false;
+        for (const candidate of modelCandidates) {
+            const match = resolveModelId(candidate, availableModels, ctx.model?.provider);
+            if (!match)
+                continue;
+            // Skip models the runtime has marked blocked or temporarily unavailable
+            // (e.g. a primary that just tripped a provider limit) so the configured
+            // fallbacks[] chain actually engages — parity with auto-mode's
+            // selectAndApplyModel, which consults the same blocked-models store (#1229).
+            if (isModelUnavailable(targetBasePath, match.provider, match.id))
+                continue;
             try {
-                await pi.setModel(match);
+                if (await pi.setModel(match)) {
+                    // The manual trigger path bypasses selectAndApplyModel, so apply the
+                    // hook's per-field `thinking` (from `post_unit_hooks[].model`'s object
+                    // form) here against the just-set model rather than leaving the hook at
+                    // the session level (#1269). Absent → session level, unchanged.
+                    if (hookModelConfig?.thinking) {
+                        applyThinkingLevelForModel(pi, hookModelConfig.thinking, match, ctx);
+                    }
+                    applied = true;
+                    break;
+                }
             }
             catch (err) {
-                /* non-fatal */
-                logWarning("dispatch", `hook model set failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+                /* non-fatal — try the next fallback */
+                logWarning("dispatch", `hook model set failed for ${candidate}: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
             }
         }
-        else {
-            ctx.ui.notify(`Hook model "${hookModel}" not found in available models. Falling back to current session model. ` +
+        if (!applied) {
+            ctx.ui.notify(`Hook model${modelCandidates.length > 1 ? "s" : ""} "${modelCandidates.join(", ")}" not available. ` +
+                `Falling back to current session model. ` +
                 `Ensure the model is defined in models.json and has auth configured.`, "warning");
         }
     }