@opengsd/gsd-pi 1.5.0-dev.553dc518 → 1.5.0-dev.c4c8885f

package/dist/resources/extensions/gsd/bootstrap/register-hooks.js

@@ -1407,7 +1407,7 @@ export function registerHooks(pi, ecosystemHandlers) {
             }
         }
         if (!event.isError) {
-            recordToolCallLoopMutation(toolName);
+            recordToolCallLoopMutation(toolName, event.details);
             refreshSourceObservationAfterMutation(toolName, event.input, ctx);
             clearSourceObservationsAfterShell(toolName);
         }

package/dist/resources/extensions/gsd/bootstrap/tool-call-loop-guard.js

@@ -14,13 +14,16 @@
  * to stop tooling for the rest of that turn and answer in text.
  *
  * The per-tool-name check (#783 Brief C) tracks call counts within a
- * turn regardless of args, decaying after successful state-mutating tools.
+ * turn regardless of args, decaying after successful state-progressing tools.
  * This catches improvisation
  * loops where the model attempts the same missing workflow tool through
  * varied surfaces (bash → `node -e` → CLI), each with a different
  * signature, so the identical-args streak never trips, while allowing
- * tool-heavy turns that are making file-mutation progress. Whichever guard
- * trips first blocks.
+ * tool-heavy turns that are making progress. Progress means a successful file
+ * mutation (edit/write) or a successful shell/exec call (bg_shell,
+ * gsd_uat_exec, …) — so a local model running a legitimate iterative
+ * debugging loop (restart server, npm install, curl an endpoint) is not
+ * blocked as a false loop (#1206). Whichever guard trips first blocks.
  *
  * Thresholds, exempt tools, and enable flags are user-tunable (#1198) via the
  * `tool_call_loop_guard` key in `.gsd/PREFERENCES.md` and `GSD_TOOL_LOOP_*`
@@ -40,6 +43,52 @@ const DEFAULT_PER_TOOL_CAP_EXEMPT_TOOLS = ["find", "glob", "grep", "ls", "read",
 const STRICT_LOOP_TOOLS = new Set(["ask_user_questions"]);
 const MAX_CONSECUTIVE_STRICT = 1;
 const STATE_MUTATING_TOOL_SET = new Set(["edit", "write", "multi_edit", "notebook_edit"]);
+/**
+ * Successful shell/exec calls are state progression too (#1206), not just file
+ * mutations. A local model debugging a UAT scenario legitimately restarts
+ * servers, runs `npm install`, and curls endpoints via bg_shell / gsd_uat_exec
+ * with varied args — productive work that never touches a file, so Guard 2's
+ * per-tool cap would otherwise misfire as a false loop. Decaying on these
+ * successful calls keeps the guard from aborting a progressing turn.
+ *
+ * Only successful calls reach {@link recordToolCallLoopMutation}: the
+ * tool_result hook skips `isError` results, and the bash tool throws on
+ * non-zero exit, so a genuinely stuck improvisation loop of failing commands
+ * (#783) never decays and still trips the cap. `async_bash` is excluded
+ * because it only registers a background job; command success is reported
+ * later via `await_job`. `bg_shell` may return `isError: false` for failed
+ * `run`/`start` outcomes, so the hook passes `details` for validation.
+ */
+const STATE_PROGRESSING_EXEC_TOOL_SET = new Set([
+    "bash",
+    "bg_shell",
+    "shell",
+    "powershell",
+    "gsd_exec",
+    "gsd_uat_exec",
+]);
+function isSuccessfulBgShellLoopProgress(details) {
+    if (!details || typeof details !== "object")
+        return false;
+    const record = details;
+    switch (record.action) {
+        case "run":
+            return record.exitCode === 0 && record.timedOut !== true;
+        case "start":
+        case "restart": {
+            const process = record.process;
+            if (!process || typeof process !== "object")
+                return false;
+            return process.alive === true;
+        }
+        case "wait_for_ready":
+            return record.ready === true;
+        case "send_and_wait":
+            return record.matched === true;
+        default:
+            return true;
+    }
+}
 function defaultGuardConfig() {
     return {
         guardEnabled: true,
@@ -235,11 +284,23 @@ export function checkToolCallLoop(toolName, args) {
     }
     return { block: false, count: consecutiveCount };
 }
-/** Record successful mutation progress so Guard 2 can decay on the next count. */
-export function recordToolCallLoopMutation(toolName) {
+/**
+ * Record successful state progress so Guard 2 can decay on the next count.
+ * File mutations (edit/write/…) and successful shell/exec calls (bash,
+ * bg_shell, gsd_uat_exec, …) both count as progress (#1092, #1206). The caller
+ * only invokes this for non-error results, so failing improvisation loops
+ * (#783) never decay and still trip the per-tool cap.
+ */
+export function recordToolCallLoopMutation(toolName, details) {
     if (!enabled)
         return;
-    if (!STATE_MUTATING_TOOL_SET.has(toolName))
+    if (STATE_MUTATING_TOOL_SET.has(toolName)) {
+        mutationEpoch++;
+        return;
+    }
+    if (!STATE_PROGRESSING_EXEC_TOOL_SET.has(toolName))
+        return;
+    if (toolName === "bg_shell" && details !== undefined && !isSuccessfulBgShellLoopProgress(details))
         return;
     mutationEpoch++;
 }

package/dist/resources/extensions/gsd/codebase-generator.js

@@ -506,9 +506,15 @@ export function ensureCodebaseMapFresh(basePath, options, ensureOptions) {
     }
     const metadata = parseCodebaseMapMetadata(existing);
     const existingDescriptions = parseCodebaseMap(existing);
+    // Compare against the truncated count: when the repository has more tracked
+    // files than maxFiles, the map only lists the first maxFiles entries, so a
+    // stored fileCount above the cap (e.g. from an older map that recorded the
+    // full count) still matches the current truncated listing. Comparing raw
+    // values would flag "file-count-changed" on every turn, rewriting the
+    // timestamp and invalidating the provider KV cache prefix.
     const staleReason = !metadata ? "missing-metadata"
         : metadata.fingerprint !== fingerprint ? "files-changed"
-            : metadata.fileCount !== listed.files.length ? "file-count-changed"
+            : Math.min(metadata.fileCount, resolved.maxFiles) !== listed.files.length ? "file-count-changed"
                 : metadata.truncated !== listed.truncated ? "truncation-changed"
                     : undefined;
     if (!staleReason) {

package/dist/resources/extensions/gsd/compat/compat-marker.js

@@ -98,6 +98,50 @@ export function writeCompatMarker(basePath, marker) {
     writeFileSync(tmp, JSON.stringify(marker, null, 2), "utf-8");
     renameSync(tmp, path);
 }
+/**
+ * Remove projection entries whose backing file no longer exists on disk.
+ *
+ * gsd-pi never deletes marker entries on its own: both drift detectors skip
+ * files missing from disk (`if (!existsSync(abs)) continue;`) and the write-time
+ * flush only ever adds or refreshes entries. So when a phase directory is
+ * renamed or removed (e.g. `phases/29-new-milestone-m029/` →
+ * `phases/29-frontend-code-debt-cleanup/`), the old projection paths linger in
+ * `.compat.json` forever as phantom entries pointing at directories that no
+ * longer exist (#1257). They never reconcile, and `.compat.json` keeps drifting
+ * from disk reality so `git status` stops being a reliable proxy for "did the
+ * engine touch my plans?".
+ *
+ * This prunes those orphaned entries across the `.gsd/` projections and the
+ * `.planning/` projections/passthrough maps. It is safe: a missing-file entry is
+ * inert (every detector already ignores it), and if the file is later
+ * re-projected the write-time flush / unseeded-file detection re-seeds an
+ * accurate baseline.
+ *
+ * Returns the number of entries removed; when nothing is orphaned the marker is
+ * left untouched (no needless write, no `lastProjectedAt` churn).
+ */
+export function pruneOrphanedProjectionEntries(basePath) {
+    if (!existsSync(compatMarkerPath(basePath)))
+        return 0;
+    const marker = readCompatMarker(basePath);
+    let removed = 0;
+    const pruneMap = (map, root) => {
+        for (const relPath of Object.keys(map)) {
+            if (!existsSync(join(basePath, root, relPath))) {
+                delete map[relPath];
+                removed++;
+            }
+        }
+    };
+    pruneMap(marker.projections, ".gsd");
+    if (marker.planning) {
+        pruneMap(marker.planning.projections, ".planning");
+        pruneMap(marker.planning.passthrough, ".planning");
+    }
+    if (removed > 0)
+        writeCompatMarker(basePath, marker);
+    return removed;
+}
 function quarantine(basePath, raw) {
     const path = compatMarkerPath(basePath);
     const badPath = `${path}.bad-${Date.now()}`;

package/dist/resources/extensions/gsd/config-overlay.js

@@ -121,8 +121,13 @@ function collectConfigSections(options) {
     if (prefs?.auto_supervisor) {
         const sup = resolveAutoSupervisorConfig();
         const supRows = [];
-        if (sup.model)
-            supRows.push({ label: "Model", value: sup.model });
+        if (sup.model) {
+            let modelVal = sup.model;
+            if (sup.modelFallbacks && sup.modelFallbacks.length > 0) {
+                modelVal += ` \u2192 ${sup.modelFallbacks.join(" \u2192 ")}`;
+            }
+            supRows.push({ label: "Model", value: modelVal });
+        }
         supRows.push({ label: "Soft timeout", value: `${sup.soft_timeout_minutes}m` });
         supRows.push({ label: "Idle timeout", value: `${sup.idle_timeout_minutes}m` });
         supRows.push({ label: "Stalled tool timeout", value: `${sup.stalled_tool_timeout_minutes}m` });

package/dist/resources/extensions/gsd/db/engine.js

@@ -801,3 +801,36 @@ export function getDb() {
 export function getDbOrNull() {
     return currentDb;
 }
+/**
+ * Confirm the open handle can actually write, not just that it opened.
+ *
+ * A schema-current database performs zero writes during open, so a handle that
+ * opened successfully but is not writable (read-only file, WAL/SHM permission
+ * mismatch, or a stale/moved handle → SQLITE_READONLY_DBMOVED) otherwise passes
+ * the open-only availability check and only fails much later at the first real
+ * write. The probe forces a genuine page write by re-writing the current
+ * `PRAGMA user_version` value back inside an IMMEDIATE transaction: a bare
+ * `BEGIN IMMEDIATE; ROLLBACK` is not sufficient because a moved handle does not
+ * fail until a page is actually dirtied. The value is unchanged, so the probe
+ * is idempotent, and the transaction is rolled back so nothing persists.
+ */
+export function probeDbWritable() {
+    const db = currentDb;
+    if (!db)
+        return { ok: false, detail: "No database is open." };
+    try {
+        const row = db.prepare("PRAGMA user_version").get();
+        const current = typeof row?.user_version === "number" ? row.user_version : 0;
+        db.exec("BEGIN IMMEDIATE");
+        try {
+            db.exec(`PRAGMA user_version = ${current}`);
+        }
+        finally {
+            db.exec("ROLLBACK");
+        }
+        return { ok: true };
+    }
+    catch (err) {
+        return { ok: false, detail: err.message };
+    }
+}

package/dist/resources/extensions/gsd/db/writers/cascades.js

@@ -24,6 +24,17 @@ function requireDb() {
  * completion timestamps cleared, in one commit. Folds the hand-rolled
  * transaction-plus-cascade previously in tools/reopen-slice.ts. Guards run
  * inside the transaction (TOCTOU-safe).
+ *
+ * A closed slice is always reopenable. An open slice is only reopenable when it
+ * carries a completed-task state desync (#1205): a UAT→planning fallback can
+ * leave the slice "pending" while *all* its tasks stay "complete", which
+ * deadlocks every recovery path (plan-slice/replan-slice/complete-task all
+ * reject the still-closed tasks, and slice_reopen historically rejected the
+ * still-open slice). Resetting those tasks to pending gives the planner the
+ * clean slate it needs. An open slice that still has any unfinished
+ * (pending/in-progress) task is a normal in-flight slice, not the desync, and
+ * stays rejected as "slice-not-complete" so a full reset can't wipe its
+ * legitimate progress.
  */
 export function reopenSliceCascade(milestoneId, sliceId) {
     requireDb();
@@ -43,11 +54,18 @@ export function reopenSliceCascade(milestoneId, sliceId) {
             outcome = { ok: false, reason: "slice-not-found" };
             return;
         }
-        if (!isClosedStatus(slice.status)) {
+        const tasks = getSliceTasks(milestoneId, sliceId);
+        // A closed slice is always reopenable. An open slice is only the #1205
+        // desync when EVERY task is already closed (a UAT→planning fallback left the
+        // slice open with all tasks still "complete"). Requiring *all* tasks closed
+        // (not merely one) means a normal in-flight slice — which keeps at least one
+        // pending/in-progress task — is rejected, so a full reset can't wipe its
+        // legitimate progress.
+        const allTasksClosed = tasks.length > 0 && tasks.every((t) => isClosedStatus(t.status));
+        if (!isClosedStatus(slice.status) && !allTasksClosed) {
             outcome = { ok: false, reason: "slice-not-complete", status: slice.status };
             return;
         }
-        const tasks = getSliceTasks(milestoneId, sliceId);
         getDbOrNull().prepare(`UPDATE slices SET status = 'in_progress', completed_at = NULL WHERE milestone_id = :mid AND id = :sid`).run({ ":mid": milestoneId, ":sid": sliceId });
         getDbOrNull().prepare(`UPDATE tasks SET status = 'pending', completed_at = NULL WHERE milestone_id = :mid AND slice_id = :sid`).run({ ":mid": milestoneId, ":sid": sliceId });
         outcome = { ok: true, tasksReset: tasks.length };

package/dist/resources/extensions/gsd/db-adapter.js

@@ -11,19 +11,46 @@ export function normalizeDbRow(row) {
 export function normalizeDbRows(rows) {
     return rows.map((row) => normalizeDbRow(row));
 }
+function isPlainObject(value) {
+    if (value === null || typeof value !== "object")
+        return false;
+    const proto = Object.getPrototypeOf(value);
+    return proto === Object.prototype || proto === null;
+}
+// node:sqlite accepts binding-object keys with or without the ':'/'@'/'$'
+// prefix, but better-sqlite3 accepts only bare keys — strip the prefix so
+// call sites written against node:sqlite also work on the fallback provider.
+function normalizeBindParams(params) {
+    return params.map((param) => {
+        if (!isPlainObject(param))
+            return param;
+        let changed = false;
+        const normalized = {};
+        for (const [key, value] of Object.entries(param)) {
+            if (key.length > 1 && (key[0] === ":" || key[0] === "@" || key[0] === "$")) {
+                normalized[key.slice(1)] = value;
+                changed = true;
+            }
+            else {
+                normalized[key] = value;
+            }
+        }
+        return changed ? normalized : param;
+    });
+}
 export function createDbAdapter(rawDb) {
     const db = rawDb;
     const stmtCache = new Map();
     function wrapStmt(raw) {
         return {
             run(...params) {
-                return raw.run(...params);
+                return raw.run(...normalizeBindParams(params));
             },
             get(...params) {
-                return normalizeDbRow(raw.get(...params));
+                return normalizeDbRow(raw.get(...normalizeBindParams(params)));
             },
             all(...params) {
-                return normalizeDbRows(raw.all(...params));
+                return normalizeDbRows(raw.all(...normalizeBindParams(params)));
             },
         };
     }

package/dist/resources/extensions/gsd/docs/preferences-reference.md

@@ -138,7 +138,7 @@ Diagnostics record the file path, scope (global/project), severity (error/warnin
   - `off` — skill discovery is disabled entirely.
 
 - `auto_supervisor`: configures the auto-mode supervisor that monitors agent progress and enforces timeouts. Keys:
-  - `model`: model ID to use for the supervisor process (defaults to the currently active model).
+  - `model`: model to use for the supervisor process (defaults to the currently active model). Accepts a bare model ID **or** the same `{ model, provider?, fallbacks? }` object form as `models.<phase>`, so it honors `fallbacks[]` on a transient provider trip.
   - `soft_timeout_minutes`: minutes before the supervisor issues a soft warning (default: 20).
   - `idle_timeout_minutes`: minutes of inactivity before the supervisor intervenes (default: 10).
   - `hard_timeout_minutes`: minutes before the supervisor forces termination (default: 30).
@@ -228,7 +228,7 @@ In `"parent"` mode, slice/task `targetRepositories` default to the declared chil
   - `enabled`: boolean — set `false` to force sequential task execution. Default: `true`.
   - `max_parallel`: number — maximum tasks to dispatch in one batch, range `1`-`8`. Default: `2`.
   - `isolation_mode`: `"same-tree"` — currently the only supported value.
-  - `subagent_model`: string — optional model override for reactive task subagents. Falls back to the `models.subagent` routing when omitted.
+  - `subagent_model`: optional model override for reactive task subagents. Accepts a bare model ID **or** the `{ model, provider?, fallbacks? }` object form (parity with `models.<phase>`). Falls back to the `models.subagent` routing when omitted.
 
 - `remote_questions`: route interactive questions to Slack/Discord for headless auto-mode. Keys:
   - `channel`: `"slack"` or `"discord"` — channel type.
@@ -326,7 +326,7 @@ In `"parent"` mode, slice/task `targetRepositories` default to the declared chil
   - `after`: string[] — unit types that trigger this hook (e.g., `["execute-task"]`).
   - `prompt`: string — prompt sent to the LLM. Supports `{milestoneId}`, `{sliceId}`, `{taskId}` substitutions.
   - `max_cycles`: number — max times this hook fires per trigger (default: 1, max: 10).
-  - `model`: string — optional model override.
+  - `model`: optional model override. Accepts a bare model ID **or** the same `{ model, provider?, fallbacks? }` object form as `models.<phase>`. With `fallbacks[]`, a transient trip of the primary provider falls back to the next entry instead of hard-failing the hook — which, for a `blocking` hook with `on_block: { action: pause }`, would otherwise pause the whole run.
   - `artifact`: string — expected output file name (relative to task/slice dir). Hook is skipped if file already exists (idempotent).
   - `criticality`: `"advisory"` or `"blocking"` — advisory preserves current best-effort behavior; blocking requires clean hook completion plus a valid outcome verdict before auto-mode advances. Default: `"advisory"`.
   - `retry_on`: string — if this file is produced instead of the artifact, re-run the trigger unit then re-run hooks.

package/dist/resources/extensions/gsd/flat-phase-migration.js

@@ -78,15 +78,33 @@ function rollbackPartialMigration(basePath, backupDir, migratingPath) {
     catch (removeErr) {
         logWarning("migration", `rollback: could not remove partial ${LAYOUT_SEGMENTS.level1}/: ${removeErr.message}`);
     }
+    // Only the standalone .gsd-backups/migrate-<ts>/ copy is disposable once the
+    // restore succeeds. When resuming an interrupted migration, backupDir IS the
+    // preserved migrating tree (the sole surviving data source) and must never be
+    // removed here. Deleting the backup after a successful rollback keeps the gate
+    // from leaking one .gsd-backups/migrate-<ts>/ per session_start.
+    const isDisposableBackup = Boolean(backupDir) && backupDir !== migratingPath;
+    const cleanupBackup = () => {
+        if (!isDisposableBackup || !existsSync(backupDir))
+            return;
+        try {
+            removePathWithRetries(backupDir);
+        }
+        catch (cleanupErr) {
+            logWarning("migration", `rollback: could not clean backup ${backupDir}: ${cleanupErr.message}`);
+        }
+    };
     // Restore milestones/ — prefer renaming the preserved migrating copy back.
     const milestonesPath = join(basePath, ".gsd", "milestones");
     try {
         if (migratingPath && existsSync(migratingPath) && !existsSync(milestonesPath)) {
             movePathWithCopyDeleteFallback(migratingPath, milestonesPath);
+            cleanupBackup();
             return;
         }
         if (existsSync(backupDir)) {
             cpSync(backupDir, milestonesPath, { recursive: true });
+            cleanupBackup();
         }
         if (migratingPath && existsSync(migratingPath)) {
             removePathWithRetries(migratingPath);

package/dist/resources/extensions/gsd/gsd-db.js

@@ -352,17 +352,17 @@ export function insertTask(t) {
     ON CONFLICT(milestone_id, slice_id, id) DO UPDATE SET
       title = CASE WHEN NULLIF(:title, '') IS NOT NULL THEN :title ELSE tasks.title END,
       status = :status,
-      one_liner = :one_liner,
-      narrative = :narrative,
-      verification_result = :verification_result,
-      duration = :duration,
-      completed_at = :completed_at,
-      blocker_discovered = :blocker_discovered,
-      deviations = :deviations,
-      known_issues = :known_issues,
-      key_files = :key_files,
-      key_decisions = :key_decisions,
-      full_summary_md = :full_summary_md,
+      one_liner = CASE WHEN :preserve_completion = 1 AND NULLIF(:one_liner, '') IS NULL THEN tasks.one_liner ELSE :one_liner END,
+      narrative = CASE WHEN :preserve_completion = 1 AND NULLIF(:narrative, '') IS NULL THEN tasks.narrative ELSE :narrative END,
+      verification_result = CASE WHEN :preserve_completion = 1 AND NULLIF(:verification_result, '') IS NULL THEN tasks.verification_result ELSE :verification_result END,
+      duration = CASE WHEN :preserve_completion = 1 AND NULLIF(:duration, '') IS NULL THEN tasks.duration ELSE :duration END,
+      completed_at = CASE WHEN :preserve_completion = 1 AND tasks.completed_at IS NOT NULL THEN tasks.completed_at ELSE :completed_at END,
+      blocker_discovered = CASE WHEN :preserve_completion = 1 AND :blocker_discovered = 0 THEN tasks.blocker_discovered ELSE :blocker_discovered END,
+      deviations = CASE WHEN :preserve_completion = 1 AND NULLIF(:deviations, '') IS NULL THEN tasks.deviations ELSE :deviations END,
+      known_issues = CASE WHEN :preserve_completion = 1 AND NULLIF(:known_issues, '') IS NULL THEN tasks.known_issues ELSE :known_issues END,
+      key_files = CASE WHEN :preserve_completion = 1 AND NULLIF(:key_files, '[]') IS NULL THEN tasks.key_files ELSE :key_files END,
+      key_decisions = CASE WHEN :preserve_completion = 1 AND NULLIF(:key_decisions, '[]') IS NULL THEN tasks.key_decisions ELSE :key_decisions END,
+      full_summary_md = CASE WHEN :preserve_completion = 1 AND NULLIF(:full_summary_md, '') IS NULL THEN tasks.full_summary_md ELSE :full_summary_md END,
       description = CASE WHEN NULLIF(:description, '') IS NOT NULL THEN :description ELSE tasks.description END,
       estimate = CASE WHEN NULLIF(:estimate, '') IS NOT NULL THEN :estimate ELSE tasks.estimate END,
       files = CASE WHEN NULLIF(:files, '[]') IS NOT NULL THEN :files ELSE tasks.files END,
@@ -401,6 +401,7 @@ export function insertTask(t) {
         ":observability_impact": t.planning?.observabilityImpact ?? "",
         ":full_plan_md": t.planning?.fullPlanMd ?? "",
         ":sequence": t.sequence ?? 0,
+        ":preserve_completion": t.preserveCompletionMetadata && (t.status === "complete" || t.status === "done") ? 1 : 0,
         ":target_repositories": JSON.stringify(t.planning?.targetRepositories ?? []),
         ":raw_target_repositories": t.planning && "targetRepositories" in t.planning
             ? JSON.stringify(t.planning.targetRepositories ?? [])

package/dist/resources/extensions/gsd/guided-flow.js

@@ -27,7 +27,7 @@ import { readSessionLockData, isSessionLockProcessAlive } from "./session-lock.j
 import { nativeAddAll, nativeCommit, nativeHasCommittedHead, nativeIsRepo, nativeInit } from "./native-git-bridge.js";
 import { isInheritedRepo } from "./repo-identity.js";
 import { ensureGitignore, ensurePreferences, untrackRuntimeFiles } from "./gitignore.js";
-import { getIsolationMode, loadEffectiveGSDPreferences } from "./preferences.js";
+import { getIsolationMode, loadEffectiveGSDPreferences, renderLanguageDirectiveForPrompt } from "./preferences.js";
 import { getAutoWorktreePath } from "./auto-worktree-path-resolution.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { ensurePlanV2Graph, isMissingFinalizedContextResult } from "./uok/plan-v2.js";
@@ -642,7 +642,7 @@ function resolveAvailableModel(modelId, availableModels, currentProvider) {
  * Build the discuss-and-plan prompt for a new milestone.
  * Used by all three "new milestone" paths (first ever, no active, all complete).
  */
-function buildDiscussPrompt(nextId, preamble, _basePath, pi, ctx, preparationContext) {
+function buildDiscussPrompt(nextId, preamble, basePath, pi, ctx, preparationContext) {
     const milestoneRel = `.gsd/milestones/${nextId}`;
     const structuredQuestionsAvailable = getStructuredQuestionsAvailability(pi, ctx);
     const inlinedTemplates = [
@@ -652,7 +652,7 @@ function buildDiscussPrompt(nextId, preamble, _basePath, pi, ctx, preparationCon
         inlineTemplate("roadmap", "Roadmap"),
         inlineTemplate("decisions", "Decisions"),
     ].join("\n\n---\n\n");
-    return loadPrompt("discuss", {
+    return prependLanguageDirective(basePath, loadPrompt("discuss", {
         milestoneId: nextId,
         preamble,
         preparationContext: preparationContext ?? "",
@@ -662,13 +662,22 @@ function buildDiscussPrompt(nextId, preamble, _basePath, pi, ctx, preparationCon
         inlinedTemplates,
         commitInstruction: buildDocsCommitInstruction(`docs(${nextId}): context, requirements, and roadmap`),
         multiMilestoneCommitInstruction: buildDocsCommitInstruction("docs: project plan — N milestones"),
-    });
+    }));
+}
+/**
+ * Prepend the configured response-language directive to a dispatched discuss
+ * prompt so the discuss/QA conversation is held in the language set in
+ * PREFERENCES.md (#1210). No-op when no language is configured.
+ */
+function prependLanguageDirective(basePath, prompt) {
+    const directive = renderLanguageDirectiveForPrompt(loadEffectiveGSDPreferences(basePath)?.preferences);
+    return directive ? `${directive}\n\n${prompt}` : prompt;
 }
 /**
  * Build the discuss prompt for headless milestone creation.
  * Uses the discuss-headless prompt template with seed context injected.
  */
-function buildHeadlessDiscussPrompt(nextId, seedContext, _basePath) {
+function buildHeadlessDiscussPrompt(nextId, seedContext, basePath) {
     const milestoneRel = `.gsd/milestones/${nextId}`;
     const inlinedTemplates = [
         inlineTemplate("project", "Project"),
@@ -677,7 +686,7 @@ function buildHeadlessDiscussPrompt(nextId, seedContext, _basePath) {
         inlineTemplate("roadmap", "Roadmap"),
         inlineTemplate("decisions", "Decisions"),
     ].join("\n\n---\n\n");
-    return loadPrompt("discuss-headless", {
+    return prependLanguageDirective(basePath, loadPrompt("discuss-headless", {
         milestoneId: nextId,
         seedContext,
         contextPath: `${milestoneRel}/${nextId}-CONTEXT.md`,
@@ -685,7 +694,7 @@ function buildHeadlessDiscussPrompt(nextId, seedContext, _basePath) {
         inlinedTemplates,
         commitInstruction: buildDocsCommitInstruction(`docs(${nextId}): context, requirements, and roadmap`),
         multiMilestoneCommitInstruction: buildDocsCommitInstruction("docs: project plan — N milestones"),
-    });
+    }));
 }
 /**
  * Run preparation phase if enabled, then build the discuss prompt.

package/dist/resources/extensions/gsd/journal.js

@@ -51,7 +51,7 @@ export function emitJournalEvent(basePath, entry) {
     catch {
         // Silent failure — journal must never break auto-mode
     }
-    if (!isUnifiedAuditEnabled())
+    if (!isUnifiedAuditEnabled(basePath))
         return;
     try {
         const causedBy = entry.causedBy