@opengsd/gsd-pi 1.5.0-dev.553dc518 → 1.5.0-dev.c4c8885f

package/src/resources/extensions/gsd/auto.ts

@@ -116,7 +116,8 @@ import {
 } from "./auto-tool-tracking.js";
 import { closeoutUnit } from "./auto-unit-closeout.js";
 import { recoverTimedOutUnit } from "./auto-timeout-recovery.js";
-import { selectAndApplyModel, resolveModelId, clearToolBaseline } from "./auto-model-selection.js";
+import { selectAndApplyModel, resolveModelId, clearToolBaseline, isModelUnavailable, applyThinkingLevelForModel } from "./auto-model-selection.js";
+import { resolveModelWithFallbacksForUnit } from "./preferences-models.js";
 import { resetRoutingHistory, recordOutcome } from "./routing-history.js";
 import {
   checkPostUnitHooks,
@@ -127,6 +128,7 @@ import {
   runPreDispatchHooks,
   persistHookState,
   restoreHookState,
+  reconcileRestoredHookDispatch,
   clearPersistedHookState,
 } from "./post-unit-hooks.js";
 import { runGSDDoctor, rebuildState } from "./doctor.js";
@@ -615,11 +617,27 @@ export function startAutoDetached(
     milestoneLock?: string | null;
   },
 ): void {
-  void withDetachedAutoKeepalive(startAuto(ctx, pi, base, verboseMode, options)).catch((err) => {
+  void withDetachedAutoKeepalive(startAuto(ctx, pi, base, verboseMode, options)).catch(async (err) => {
     const message = getErrorMessage(err);
     ctx.ui.notify(`Auto-start failed: ${message}`, "error");
     logWarning("engine", `auto start error: ${message}`, { file: "auto.ts" });
     debugLog("auto-start-failed", { error: message });
+    // Backstop cleanup (#1235): if startAuto threw after auto-mode was activated
+    // (e.g. an exception during bootstrap, before the loop's try/finally could
+    // run cleanupAfterLoopExit), s.active and the on-disk auto lock leak, so the
+    // re-entry guard silently no-ops every later /gsd auto until restart. Clear
+    // the leaked activation here so a failed start is always recoverable.
+    if (s.active) {
+      try {
+        await cleanupAfterLoopExit(ctx);
+      } catch (cleanupErr) {
+        logWarning(
+          "engine",
+          `auto start cleanup failed: ${cleanupErr instanceof Error ? cleanupErr.message : String(cleanupErr)}`,
+          { file: "auto.ts" },
+        );
+      }
+    }
   });
 }
 
@@ -2827,6 +2845,10 @@ export async function startAuto(
       "info",
     );
     restoreHookState(s.basePath);
+    // A restored activeHook has no live dispatch (the sidecar queue is not
+    // persisted); re-enqueue it so the hook runs instead of blocking the next
+    // unrelated unit's close-out (#1246).
+    reconcileRestoredHookDispatch(s.basePath, s.sidecarQueue);
     // Re-sync managed resources on resume so long-lived auto sessions pick up
     // bundled extension updates before resume-time verification/state logic runs.
     // GSD_PKG_ROOT is set by loader.ts and points to the gsd-pi package root.
@@ -2895,15 +2917,18 @@ export async function startAuto(
       debugLog("resume-orchestration-resume", { error: err instanceof Error ? err.message : String(err) });
     }
     startAutoCommandPolling(s.basePath);
-    await runAutoLoopWithUok({
-      ctx,
-      pi,
-      s,
-      deps: loopDeps,
-      runKernelLoop: runUokKernelLoop,
-      runLegacyLoop: runLegacyAutoLoop,
-    });
-    await cleanupAfterLoopExit(ctx);
+    try {
+      await runAutoLoopWithUok({
+        ctx,
+        pi,
+        s,
+        deps: loopDeps,
+        runKernelLoop: runUokKernelLoop,
+        runLegacyLoop: runLegacyAutoLoop,
+      });
+    } finally {
+      await cleanupAfterLoopExit(ctx);
+    }
     return;
   }
 
@@ -2931,7 +2956,15 @@ export async function startAuto(
     bootstrapDeps,
     freshStartAssessment,
   );
-  if (!ready) return;
+  if (!ready) {
+    // bootstrapAutoSession sets s.active = true (auto-start.ts) before several
+    // post-activation bail-outs return false without a loop ever running (e.g.
+    // the SQLite-unavailable gate). Without this, s.active and the auto lock
+    // leak and every later /gsd auto silently no-ops via the re-entry guard
+    // (#1235). Run the canonical cleanup so a failed bootstrap stays recoverable.
+    if (s.active) await cleanupAfterLoopExit(ctx);
+    return;
+  }
 
   // Build scope after bootstrap has populated s.basePath / s.originalBasePath /
   // s.currentMilestoneId (including worktree setup inside bootstrapAutoSession).
@@ -2957,15 +2990,18 @@ export async function startAuto(
   startAutoCommandPolling(s.basePath);
 
   // Dispatch the first unit
-  await runAutoLoopWithUok({
-    ctx,
-    pi,
-    s,
-    deps: loopDeps,
-    runKernelLoop: runUokKernelLoop,
-    runLegacyLoop: runLegacyAutoLoop,
-  });
-  await cleanupAfterLoopExit(ctx);
+  try {
+    await runAutoLoopWithUok({
+      ctx,
+      pi,
+      s,
+      deps: loopDeps,
+      runKernelLoop: runUokKernelLoop,
+      runLegacyLoop: runLegacyAutoLoop,
+    });
+  } finally {
+    await cleanupAfterLoopExit(ctx);
+  }
 }
 
 // describeNextUnit is imported from auto-dashboard.ts and re-exported
@@ -3123,19 +3159,56 @@ export async function dispatchHookUnit(
     workspaceRoot: s.basePath,
   });
 
-  if (hookModel) {
-    const availableModels = ctx.modelRegistry.getAvailable();
-    const match = resolveModelId(hookModel, availableModels, ctx.model?.provider);
-    if (match) {
+  // Resolve the hook's model honoring the configured `fallbacks[]` chain
+  // (#1229). The manual trigger path bypasses selectAndApplyModel, so resolve
+  // the primary→fallbacks order here and apply the first candidate available in
+  // the registry — a blocked or unconfigured primary then transparently drops
+  // to a fallback instead of silently reverting to the session model.
+  const availableModels = ctx.modelRegistry.getAvailable();
+  const availableModelIds = availableModels.map(
+    (m: { provider: string; id: string }) => `${m.provider}/${m.id}`,
+  );
+  const hookModelConfig = resolveModelWithFallbacksForUnit(
+    hookUnitType,
+    targetBasePath,
+    availableModelIds,
+  );
+  const modelCandidates = hookModelConfig
+    ? [hookModelConfig.primary, ...hookModelConfig.fallbacks]
+    : hookModel
+      ? [hookModel]
+      : [];
+  if (modelCandidates.length > 0) {
+    let applied = false;
+    for (const candidate of modelCandidates) {
+      const match = resolveModelId(candidate, availableModels, ctx.model?.provider);
+      if (!match) continue;
+      // Skip models the runtime has marked blocked or temporarily unavailable
+      // (e.g. a primary that just tripped a provider limit) so the configured
+      // fallbacks[] chain actually engages — parity with auto-mode's
+      // selectAndApplyModel, which consults the same blocked-models store (#1229).
+      if (isModelUnavailable(targetBasePath, match.provider, match.id)) continue;
       try {
-        await pi.setModel(match);
+        if (await pi.setModel(match)) {
+          // The manual trigger path bypasses selectAndApplyModel, so apply the
+          // hook's per-field `thinking` (from `post_unit_hooks[].model`'s object
+          // form) here against the just-set model rather than leaving the hook at
+          // the session level (#1269). Absent → session level, unchanged.
+          if (hookModelConfig?.thinking) {
+            applyThinkingLevelForModel(pi, hookModelConfig.thinking, match, ctx);
+          }
+          applied = true;
+          break;
+        }
       } catch (err) {
-        /* non-fatal */
-        logWarning("dispatch", `hook model set failed: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
+        /* non-fatal — try the next fallback */
+        logWarning("dispatch", `hook model set failed for ${candidate}: ${err instanceof Error ? err.message : String(err)}`, { file: "auto.ts" });
       }
-    } else {
+    }
+    if (!applied) {
       ctx.ui.notify(
-        `Hook model "${hookModel}" not found in available models. Falling back to current session model. ` +
+        `Hook model${modelCandidates.length > 1 ? "s" : ""} "${modelCandidates.join(", ")}" not available. ` +
+        `Falling back to current session model. ` +
         `Ensure the model is defined in models.json and has auth configured.`,
         "warning",
       );

package/src/resources/extensions/gsd/bootstrap/register-hooks.ts

@@ -1725,7 +1725,7 @@ export function registerHooks(
       }
     }
     if (!event.isError) {
-      recordToolCallLoopMutation(toolName);
+      recordToolCallLoopMutation(toolName, event.details);
       refreshSourceObservationAfterMutation(toolName, event.input, ctx);
       clearSourceObservationsAfterShell(toolName);
     }

package/src/resources/extensions/gsd/bootstrap/tool-call-loop-guard.ts

@@ -14,13 +14,16 @@
  * to stop tooling for the rest of that turn and answer in text.
  *
  * The per-tool-name check (#783 Brief C) tracks call counts within a
- * turn regardless of args, decaying after successful state-mutating tools.
+ * turn regardless of args, decaying after successful state-progressing tools.
  * This catches improvisation
  * loops where the model attempts the same missing workflow tool through
  * varied surfaces (bash → `node -e` → CLI), each with a different
  * signature, so the identical-args streak never trips, while allowing
- * tool-heavy turns that are making file-mutation progress. Whichever guard
- * trips first blocks.
+ * tool-heavy turns that are making progress. Progress means a successful file
+ * mutation (edit/write) or a successful shell/exec call (bg_shell,
+ * gsd_uat_exec, …) — so a local model running a legitimate iterative
+ * debugging loop (restart server, npm install, curl an endpoint) is not
+ * blocked as a false loop (#1206). Whichever guard trips first blocks.
  *
  * Thresholds, exempt tools, and enable flags are user-tunable (#1198) via the
  * `tool_call_loop_guard` key in `.gsd/PREFERENCES.md` and `GSD_TOOL_LOOP_*`
@@ -45,6 +48,52 @@ const MAX_CONSECUTIVE_STRICT = 1;
 
 const STATE_MUTATING_TOOL_SET = new Set(["edit", "write", "multi_edit", "notebook_edit"]);
 
+/**
+ * Successful shell/exec calls are state progression too (#1206), not just file
+ * mutations. A local model debugging a UAT scenario legitimately restarts
+ * servers, runs `npm install`, and curls endpoints via bg_shell / gsd_uat_exec
+ * with varied args — productive work that never touches a file, so Guard 2's
+ * per-tool cap would otherwise misfire as a false loop. Decaying on these
+ * successful calls keeps the guard from aborting a progressing turn.
+ *
+ * Only successful calls reach {@link recordToolCallLoopMutation}: the
+ * tool_result hook skips `isError` results, and the bash tool throws on
+ * non-zero exit, so a genuinely stuck improvisation loop of failing commands
+ * (#783) never decays and still trips the cap. `async_bash` is excluded
+ * because it only registers a background job; command success is reported
+ * later via `await_job`. `bg_shell` may return `isError: false` for failed
+ * `run`/`start` outcomes, so the hook passes `details` for validation.
+ */
+const STATE_PROGRESSING_EXEC_TOOL_SET = new Set([
+  "bash",
+  "bg_shell",
+  "shell",
+  "powershell",
+  "gsd_exec",
+  "gsd_uat_exec",
+]);
+
+function isSuccessfulBgShellLoopProgress(details: unknown): boolean {
+  if (!details || typeof details !== "object") return false;
+  const record = details as Record<string, unknown>;
+  switch (record.action) {
+    case "run":
+      return record.exitCode === 0 && record.timedOut !== true;
+    case "start":
+    case "restart": {
+      const process = record.process;
+      if (!process || typeof process !== "object") return false;
+      return (process as Record<string, unknown>).alive === true;
+    }
+    case "wait_for_ready":
+      return record.ready === true;
+    case "send_and_wait":
+      return record.matched === true;
+    default:
+      return true;
+  }
+}
+
 /**
  * User-tunable configuration shape for the loop guard (#1198).
  *
@@ -295,10 +344,21 @@ export function checkToolCallLoop(
   return { block: false, count: consecutiveCount };
 }
 
-/** Record successful mutation progress so Guard 2 can decay on the next count. */
-export function recordToolCallLoopMutation(toolName: string): void {
+/**
+ * Record successful state progress so Guard 2 can decay on the next count.
+ * File mutations (edit/write/…) and successful shell/exec calls (bash,
+ * bg_shell, gsd_uat_exec, …) both count as progress (#1092, #1206). The caller
+ * only invokes this for non-error results, so failing improvisation loops
+ * (#783) never decay and still trip the per-tool cap.
+ */
+export function recordToolCallLoopMutation(toolName: string, details?: unknown): void {
   if (!enabled) return;
-  if (!STATE_MUTATING_TOOL_SET.has(toolName)) return;
+  if (STATE_MUTATING_TOOL_SET.has(toolName)) {
+    mutationEpoch++;
+    return;
+  }
+  if (!STATE_PROGRESSING_EXEC_TOOL_SET.has(toolName)) return;
+  if (toolName === "bg_shell" && details !== undefined && !isSuccessfulBgShellLoopProgress(details)) return;
   mutationEpoch++;
 }
 

package/src/resources/extensions/gsd/codebase-generator.ts

@@ -675,10 +675,16 @@ export function ensureCodebaseMapFresh(
 
   const metadata = parseCodebaseMapMetadata(existing);
   const existingDescriptions = parseCodebaseMap(existing);
+  // Compare against the truncated count: when the repository has more tracked
+  // files than maxFiles, the map only lists the first maxFiles entries, so a
+  // stored fileCount above the cap (e.g. from an older map that recorded the
+  // full count) still matches the current truncated listing. Comparing raw
+  // values would flag "file-count-changed" on every turn, rewriting the
+  // timestamp and invalidating the provider KV cache prefix.
   const staleReason =
     !metadata ? "missing-metadata"
     : metadata.fingerprint !== fingerprint ? "files-changed"
-    : metadata.fileCount !== listed.files.length ? "file-count-changed"
+    : Math.min(metadata.fileCount, resolved.maxFiles) !== listed.files.length ? "file-count-changed"
     : metadata.truncated !== listed.truncated ? "truncation-changed"
     : undefined;
 

package/src/resources/extensions/gsd/compat/compat-marker.ts

@@ -148,6 +148,53 @@ export function writeCompatMarker(basePath: string, marker: CompatMarker): void
   renameSync(tmp, path);
 }
 
+/**
+ * Remove projection entries whose backing file no longer exists on disk.
+ *
+ * gsd-pi never deletes marker entries on its own: both drift detectors skip
+ * files missing from disk (`if (!existsSync(abs)) continue;`) and the write-time
+ * flush only ever adds or refreshes entries. So when a phase directory is
+ * renamed or removed (e.g. `phases/29-new-milestone-m029/` →
+ * `phases/29-frontend-code-debt-cleanup/`), the old projection paths linger in
+ * `.compat.json` forever as phantom entries pointing at directories that no
+ * longer exist (#1257). They never reconcile, and `.compat.json` keeps drifting
+ * from disk reality so `git status` stops being a reliable proxy for "did the
+ * engine touch my plans?".
+ *
+ * This prunes those orphaned entries across the `.gsd/` projections and the
+ * `.planning/` projections/passthrough maps. It is safe: a missing-file entry is
+ * inert (every detector already ignores it), and if the file is later
+ * re-projected the write-time flush / unseeded-file detection re-seeds an
+ * accurate baseline.
+ *
+ * Returns the number of entries removed; when nothing is orphaned the marker is
+ * left untouched (no needless write, no `lastProjectedAt` churn).
+ */
+export function pruneOrphanedProjectionEntries(basePath: string): number {
+  if (!existsSync(compatMarkerPath(basePath))) return 0;
+
+  const marker = readCompatMarker(basePath);
+  let removed = 0;
+
+  const pruneMap = (map: Record<string, ProjectionEntry>, root: string): void => {
+    for (const relPath of Object.keys(map)) {
+      if (!existsSync(join(basePath, root, relPath))) {
+        delete map[relPath];
+        removed++;
+      }
+    }
+  };
+
+  pruneMap(marker.projections, ".gsd");
+  if (marker.planning) {
+    pruneMap(marker.planning.projections, ".planning");
+    pruneMap(marker.planning.passthrough, ".planning");
+  }
+
+  if (removed > 0) writeCompatMarker(basePath, marker);
+  return removed;
+}
+
 function quarantine(basePath: string, raw: string): void {
   const path = compatMarkerPath(basePath);
   const badPath = `${path}.bad-${Date.now()}`;

package/src/resources/extensions/gsd/config-overlay.ts

@@ -150,7 +150,13 @@ function collectConfigSections(options?: CollectConfigOptions): ConfigSection[]
   if (prefs?.auto_supervisor) {
     const sup = resolveAutoSupervisorConfig();
     const supRows: ConfigSection["rows"] = [];
-    if (sup.model) supRows.push({ label: "Model", value: sup.model });
+    if (sup.model) {
+      let modelVal = sup.model;
+      if (sup.modelFallbacks && sup.modelFallbacks.length > 0) {
+        modelVal += ` \u2192 ${sup.modelFallbacks.join(" \u2192 ")}`;
+      }
+      supRows.push({ label: "Model", value: modelVal });
+    }
     supRows.push({ label: "Soft timeout", value: `${sup.soft_timeout_minutes}m` });
     supRows.push({ label: "Idle timeout", value: `${sup.idle_timeout_minutes}m` });
     supRows.push({ label: "Stalled tool timeout", value: `${sup.stalled_tool_timeout_minutes}m` });

package/src/resources/extensions/gsd/db/engine.ts

@@ -860,3 +860,39 @@ export function getDb(): DbAdapter {
 export function getDbOrNull(): DbAdapter | null {
   return currentDb;
 }
+
+export interface DbWritableProbeResult {
+  ok: boolean;
+  detail?: string;
+}
+
+/**
+ * Confirm the open handle can actually write, not just that it opened.
+ *
+ * A schema-current database performs zero writes during open, so a handle that
+ * opened successfully but is not writable (read-only file, WAL/SHM permission
+ * mismatch, or a stale/moved handle → SQLITE_READONLY_DBMOVED) otherwise passes
+ * the open-only availability check and only fails much later at the first real
+ * write. The probe forces a genuine page write by re-writing the current
+ * `PRAGMA user_version` value back inside an IMMEDIATE transaction: a bare
+ * `BEGIN IMMEDIATE; ROLLBACK` is not sufficient because a moved handle does not
+ * fail until a page is actually dirtied. The value is unchanged, so the probe
+ * is idempotent, and the transaction is rolled back so nothing persists.
+ */
+export function probeDbWritable(): DbWritableProbeResult {
+  const db = currentDb;
+  if (!db) return { ok: false, detail: "No database is open." };
+  try {
+    const row = db.prepare("PRAGMA user_version").get() as { user_version?: number } | undefined;
+    const current = typeof row?.user_version === "number" ? row.user_version : 0;
+    db.exec("BEGIN IMMEDIATE");
+    try {
+      db.exec(`PRAGMA user_version = ${current}`);
+    } finally {
+      db.exec("ROLLBACK");
+    }
+    return { ok: true };
+  } catch (err) {
+    return { ok: false, detail: (err as Error).message };
+  }
+}

package/src/resources/extensions/gsd/db/writers/cascades.ts

@@ -38,6 +38,17 @@ export type ReopenSliceOutcome =
  * completion timestamps cleared, in one commit. Folds the hand-rolled
  * transaction-plus-cascade previously in tools/reopen-slice.ts. Guards run
  * inside the transaction (TOCTOU-safe).
+ *
+ * A closed slice is always reopenable. An open slice is only reopenable when it
+ * carries a completed-task state desync (#1205): a UAT→planning fallback can
+ * leave the slice "pending" while *all* its tasks stay "complete", which
+ * deadlocks every recovery path (plan-slice/replan-slice/complete-task all
+ * reject the still-closed tasks, and slice_reopen historically rejected the
+ * still-open slice). Resetting those tasks to pending gives the planner the
+ * clean slate it needs. An open slice that still has any unfinished
+ * (pending/in-progress) task is a normal in-flight slice, not the desync, and
+ * stays rejected as "slice-not-complete" so a full reset can't wipe its
+ * legitimate progress.
  */
 export function reopenSliceCascade(milestoneId: string, sliceId: string): ReopenSliceOutcome {
   requireDb();
@@ -48,9 +59,20 @@ export function reopenSliceCascade(milestoneId: string, sliceId: string): Reopen
     if (isClosedStatus(milestone.status)) { outcome = { ok: false, reason: "milestone-closed", status: milestone.status }; return; }
     const slice = getSlice(milestoneId, sliceId);
     if (!slice) { outcome = { ok: false, reason: "slice-not-found" }; return; }
-    if (!isClosedStatus(slice.status)) { outcome = { ok: false, reason: "slice-not-complete", status: slice.status }; return; }
 
     const tasks = getSliceTasks(milestoneId, sliceId);
+    // A closed slice is always reopenable. An open slice is only the #1205
+    // desync when EVERY task is already closed (a UAT→planning fallback left the
+    // slice open with all tasks still "complete"). Requiring *all* tasks closed
+    // (not merely one) means a normal in-flight slice — which keeps at least one
+    // pending/in-progress task — is rejected, so a full reset can't wipe its
+    // legitimate progress.
+    const allTasksClosed = tasks.length > 0 && tasks.every((t) => isClosedStatus(t.status));
+    if (!isClosedStatus(slice.status) && !allTasksClosed) {
+      outcome = { ok: false, reason: "slice-not-complete", status: slice.status };
+      return;
+    }
+
     getDbOrNull()!.prepare(
       `UPDATE slices SET status = 'in_progress', completed_at = NULL WHERE milestone_id = :mid AND id = :sid`,
     ).run({ ":mid": milestoneId, ":sid": sliceId });

package/src/resources/extensions/gsd/db-adapter.ts

@@ -25,6 +25,32 @@ export function normalizeDbRows(rows: unknown[]): Record<string, unknown>[] {
   return rows.map((row) => normalizeDbRow(row)!);
 }
 
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  if (value === null || typeof value !== "object") return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
+// node:sqlite accepts binding-object keys with or without the ':'/'@'/'$'
+// prefix, but better-sqlite3 accepts only bare keys — strip the prefix so
+// call sites written against node:sqlite also work on the fallback provider.
+function normalizeBindParams(params: unknown[]): unknown[] {
+  return params.map((param) => {
+    if (!isPlainObject(param)) return param;
+    let changed = false;
+    const normalized: Record<string, unknown> = {};
+    for (const [key, value] of Object.entries(param)) {
+      if (key.length > 1 && (key[0] === ":" || key[0] === "@" || key[0] === "$")) {
+        normalized[key.slice(1)] = value;
+        changed = true;
+      } else {
+        normalized[key] = value;
+      }
+    }
+    return changed ? normalized : param;
+  });
+}
+
 export function createDbAdapter(rawDb: unknown): DbAdapter {
   const db = rawDb as {
     exec(sql: string): void;
@@ -45,13 +71,13 @@ export function createDbAdapter(rawDb: unknown): DbAdapter {
   }): DbStatement {
     return {
       run(...params: unknown[]): unknown {
-        return raw.run(...params);
+        return raw.run(...normalizeBindParams(params));
       },
       get(...params: unknown[]): Record<string, unknown> | undefined {
-        return normalizeDbRow(raw.get(...params));
+        return normalizeDbRow(raw.get(...normalizeBindParams(params)));
       },
       all(...params: unknown[]): Record<string, unknown>[] {
-        return normalizeDbRows(raw.all(...params));
+        return normalizeDbRows(raw.all(...normalizeBindParams(params)));
       },
     };
   }

package/src/resources/extensions/gsd/docs/preferences-reference.md

@@ -138,7 +138,7 @@ Diagnostics record the file path, scope (global/project), severity (error/warnin
   - `off` — skill discovery is disabled entirely.
 
 - `auto_supervisor`: configures the auto-mode supervisor that monitors agent progress and enforces timeouts. Keys:
-  - `model`: model ID to use for the supervisor process (defaults to the currently active model).
+  - `model`: model to use for the supervisor process (defaults to the currently active model). Accepts a bare model ID **or** the same `{ model, provider?, fallbacks? }` object form as `models.<phase>`, so it honors `fallbacks[]` on a transient provider trip.
   - `soft_timeout_minutes`: minutes before the supervisor issues a soft warning (default: 20).
   - `idle_timeout_minutes`: minutes of inactivity before the supervisor intervenes (default: 10).
   - `hard_timeout_minutes`: minutes before the supervisor forces termination (default: 30).
@@ -228,7 +228,7 @@ In `"parent"` mode, slice/task `targetRepositories` default to the declared chil
   - `enabled`: boolean — set `false` to force sequential task execution. Default: `true`.
   - `max_parallel`: number — maximum tasks to dispatch in one batch, range `1`-`8`. Default: `2`.
   - `isolation_mode`: `"same-tree"` — currently the only supported value.
-  - `subagent_model`: string — optional model override for reactive task subagents. Falls back to the `models.subagent` routing when omitted.
+  - `subagent_model`: optional model override for reactive task subagents. Accepts a bare model ID **or** the `{ model, provider?, fallbacks? }` object form (parity with `models.<phase>`). Falls back to the `models.subagent` routing when omitted.
 
 - `remote_questions`: route interactive questions to Slack/Discord for headless auto-mode. Keys:
   - `channel`: `"slack"` or `"discord"` — channel type.
@@ -326,7 +326,7 @@ In `"parent"` mode, slice/task `targetRepositories` default to the declared chil
   - `after`: string[] — unit types that trigger this hook (e.g., `["execute-task"]`).
   - `prompt`: string — prompt sent to the LLM. Supports `{milestoneId}`, `{sliceId}`, `{taskId}` substitutions.
   - `max_cycles`: number — max times this hook fires per trigger (default: 1, max: 10).
-  - `model`: string — optional model override.
+  - `model`: optional model override. Accepts a bare model ID **or** the same `{ model, provider?, fallbacks? }` object form as `models.<phase>`. With `fallbacks[]`, a transient trip of the primary provider falls back to the next entry instead of hard-failing the hook — which, for a `blocking` hook with `on_block: { action: pause }`, would otherwise pause the whole run.
   - `artifact`: string — expected output file name (relative to task/slice dir). Hook is skipped if file already exists (idempotent).
   - `criticality`: `"advisory"` or `"blocking"` — advisory preserves current best-effort behavior; blocking requires clean hook completion plus a valid outcome verdict before auto-mode advances. Default: `"advisory"`.
   - `retry_on`: string — if this file is produced instead of the artifact, re-run the trigger unit then re-run hooks.

package/src/resources/extensions/gsd/flat-phase-migration.ts

@@ -108,15 +108,35 @@ function rollbackPartialMigration(
       `rollback: could not remove partial ${LAYOUT_SEGMENTS.level1}/: ${(removeErr as Error).message}`,
     );
   }
+  // Only the standalone .gsd-backups/migrate-<ts>/ copy is disposable once the
+  // restore succeeds. When resuming an interrupted migration, backupDir IS the
+  // preserved migrating tree (the sole surviving data source) and must never be
+  // removed here. Deleting the backup after a successful rollback keeps the gate
+  // from leaking one .gsd-backups/migrate-<ts>/ per session_start.
+  const isDisposableBackup = Boolean(backupDir) && backupDir !== migratingPath;
+  const cleanupBackup = (): void => {
+    if (!isDisposableBackup || !existsSync(backupDir)) return;
+    try {
+      removePathWithRetries(backupDir);
+    } catch (cleanupErr) {
+      logWarning(
+        "migration",
+        `rollback: could not clean backup ${backupDir}: ${(cleanupErr as Error).message}`,
+      );
+    }
+  };
+
   // Restore milestones/ — prefer renaming the preserved migrating copy back.
   const milestonesPath = join(basePath, ".gsd", "milestones");
   try {
     if (migratingPath && existsSync(migratingPath) && !existsSync(milestonesPath)) {
       movePathWithCopyDeleteFallback(migratingPath, milestonesPath);
+      cleanupBackup();
       return;
     }
     if (existsSync(backupDir)) {
       cpSync(backupDir, milestonesPath, { recursive: true });
+      cleanupBackup();
     }
     if (migratingPath && existsSync(migratingPath)) {
       removePathWithRetries(migratingPath);

package/src/resources/extensions/gsd/gsd-db.ts

@@ -454,6 +454,14 @@ export function insertTask(t: {
   fullSummaryMd?: string;
   sequence?: number;
   planning?: Partial<TaskPlanningRecord>;
+  // #1222 (metadata half): when re-importing from markdown, the caller only
+  // knows the plan/status — not the execution prose that gsd_task_complete
+  // wrote to the DB. Setting this preserves the existing row's execution
+  // columns (and completed_at) whenever the incoming value is empty/default,
+  // so a re-import cannot silently blank a completed task's summary metadata
+  // or refresh its completion timestamp. Off by default: callers that own the
+  // execution metadata (gsd_task_complete, planning) keep overwrite semantics.
+  preserveCompletionMetadata?: boolean;
 }): void {
   if (!getDbOrNull()!) throw new GSDError(GSD_STALE_STATE, "gsd-db: No database open");
   getDbOrNull()!.prepare(
@@ -473,17 +481,17 @@ export function insertTask(t: {
     ON CONFLICT(milestone_id, slice_id, id) DO UPDATE SET
       title = CASE WHEN NULLIF(:title, '') IS NOT NULL THEN :title ELSE tasks.title END,
       status = :status,
-      one_liner = :one_liner,
-      narrative = :narrative,
-      verification_result = :verification_result,
-      duration = :duration,
-      completed_at = :completed_at,
-      blocker_discovered = :blocker_discovered,
-      deviations = :deviations,
-      known_issues = :known_issues,
-      key_files = :key_files,
-      key_decisions = :key_decisions,
-      full_summary_md = :full_summary_md,
+      one_liner = CASE WHEN :preserve_completion = 1 AND NULLIF(:one_liner, '') IS NULL THEN tasks.one_liner ELSE :one_liner END,
+      narrative = CASE WHEN :preserve_completion = 1 AND NULLIF(:narrative, '') IS NULL THEN tasks.narrative ELSE :narrative END,
+      verification_result = CASE WHEN :preserve_completion = 1 AND NULLIF(:verification_result, '') IS NULL THEN tasks.verification_result ELSE :verification_result END,
+      duration = CASE WHEN :preserve_completion = 1 AND NULLIF(:duration, '') IS NULL THEN tasks.duration ELSE :duration END,
+      completed_at = CASE WHEN :preserve_completion = 1 AND tasks.completed_at IS NOT NULL THEN tasks.completed_at ELSE :completed_at END,
+      blocker_discovered = CASE WHEN :preserve_completion = 1 AND :blocker_discovered = 0 THEN tasks.blocker_discovered ELSE :blocker_discovered END,
+      deviations = CASE WHEN :preserve_completion = 1 AND NULLIF(:deviations, '') IS NULL THEN tasks.deviations ELSE :deviations END,
+      known_issues = CASE WHEN :preserve_completion = 1 AND NULLIF(:known_issues, '') IS NULL THEN tasks.known_issues ELSE :known_issues END,
+      key_files = CASE WHEN :preserve_completion = 1 AND NULLIF(:key_files, '[]') IS NULL THEN tasks.key_files ELSE :key_files END,
+      key_decisions = CASE WHEN :preserve_completion = 1 AND NULLIF(:key_decisions, '[]') IS NULL THEN tasks.key_decisions ELSE :key_decisions END,
+      full_summary_md = CASE WHEN :preserve_completion = 1 AND NULLIF(:full_summary_md, '') IS NULL THEN tasks.full_summary_md ELSE :full_summary_md END,
       description = CASE WHEN NULLIF(:description, '') IS NOT NULL THEN :description ELSE tasks.description END,
       estimate = CASE WHEN NULLIF(:estimate, '') IS NOT NULL THEN :estimate ELSE tasks.estimate END,
       files = CASE WHEN NULLIF(:files, '[]') IS NOT NULL THEN :files ELSE tasks.files END,
@@ -523,6 +531,7 @@ export function insertTask(t: {
     ":observability_impact": t.planning?.observabilityImpact ?? "",
     ":full_plan_md": t.planning?.fullPlanMd ?? "",
     ":sequence": t.sequence ?? 0,
+    ":preserve_completion": t.preserveCompletionMetadata && (t.status === "complete" || t.status === "done") ? 1 : 0,
     ":target_repositories": JSON.stringify(t.planning?.targetRepositories ?? []),
     ":raw_target_repositories":
       t.planning && "targetRepositories" in t.planning