@opengsd/gsd-pi 1.5.0 → 1.6.0

package/dist/resources/extensions/gsd/auto-dispatch.js

@@ -1,5 +1,6 @@
 // Project/App: gsd-pi
 // File Purpose: Declarative auto-mode dispatch rules and dispatch resolver.
+import { renderLanguageDirectiveForPrompt } from "./preferences.js";
 import { loadFile, extractUatType, loadActiveOverrides } from "./files.js";
 import { getUatBrowserToolSupportError } from "./uat-policy.js";
 import { isDbAvailable, getMilestoneSlices, getMilestoneSliceSummaries, getClosedSliceIds, getPendingGatesForTurn, markPendingGatesOmittedForTurn, getMilestone, insertArtifact, insertAssessment, setSliceSketchFlag, transaction, getAssessment, getSliceRunUatAssessment, } from "./gsd-db.js";
@@ -11,8 +12,9 @@ import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync, readdir
 import { logWarning, logError } from "./workflow-logger.js";
 import { dirname, join, sep } from "node:path";
 import { hasImplementationArtifacts } from "./milestone-implementation-evidence.js";
-import { buildDiscussMilestonePrompt, buildDiscussProjectPrompt, buildDiscussRequirementsPrompt, buildResearchDecisionPrompt, buildResearchProjectPrompt, buildResearchMilestonePrompt, buildPlanMilestonePrompt, buildResearchSlicePrompt, buildPlanSlicePrompt, buildRefineSlicePrompt, buildExecuteTaskPrompt, buildCompleteSlicePrompt, buildCompleteMilestonePrompt, buildValidateMilestonePrompt, buildReplanSlicePrompt, buildRunUatPrompt, buildReassessRoadmapPrompt, buildRewriteDocsPrompt, buildReactiveExecutePrompt, buildGateEvaluatePrompt, buildParallelResearchSlicesPrompt, checkNeedsReassessment, checkNeedsRunUat, } from "./auto-prompts.js";
-import { resolveModelWithFallbacksForUnit, resolveThinkingLevelForUnit } from "./preferences-models.js";
+import { buildDiscussMilestonePrompt, buildDiscussProjectPrompt, buildDiscussRequirementsPrompt, buildResearchDecisionPrompt, buildResearchProjectPrompt, buildResearchMilestonePrompt, buildPlanMilestonePrompt, buildResearchSlicePrompt, buildPlanSlicePrompt, buildRefineSlicePrompt, buildExecuteTaskPrompt, buildCompleteSlicePrompt, buildCompleteMilestonePrompt, buildValidateMilestonePrompt, buildReplanSlicePrompt, buildRunUatPrompt, buildReassessRoadmapPrompt, buildRewriteDocsPrompt, buildReactiveExecutePrompt, buildGateEvaluatePrompt, buildParallelResearchSlicesPrompt, checkNeedsReassessment, loadRoadmapCompletedSliceCandidates, } from "./auto-prompts.js";
+import { checkNeedsRunUat } from "./uat-dispatch.js";
+import { normalizeModelFieldConfig, resolveModelWithFallbacksForUnit, resolveThinkingLevelForUnit } from "./preferences-models.js";
 import { resolveUokFlags } from "./uok/flags.js";
 import { selectReactiveDispatchBatch } from "./uok/execution-graph.js";
 import { getMilestonePipelineVariant } from "./milestone-scope-classifier.js";
@@ -141,12 +143,21 @@ export async function readUatGateVerdict(basePath, mid, sliceId) {
         if (assessmentScope === "roadmap") {
             return null;
         }
-        const assessmentVerdict = extractVerdict(assessmentContent);
-        if (assessmentVerdict) {
-            return {
-                verdict: assessmentVerdict,
-                uatType: uatType ?? extractUatType(assessmentContent),
-            };
+        // Backfilled assessments (#1258) are placeholders created during milestone
+        // validation for completed slices that never produced a real UAT ASSESSMENT
+        // (e.g. artifact-driven UAT that was never dispatched). Their fabricated
+        // verdict must not be treated as a genuine UAT sign-off — otherwise "never
+        // checked" is silently read as "passed". Skip the placeholder and fall
+        // through to the authoritative run-uat DB row (which stays null unless a
+        // real UAT was actually recorded).
+        if (assessmentScope !== BACKFILL_ASSESSMENT_SCOPE) {
+            const assessmentVerdict = extractVerdict(assessmentContent);
+            if (assessmentVerdict) {
+                return {
+                    verdict: assessmentVerdict,
+                    uatType: uatType ?? extractUatType(assessmentContent),
+                };
+            }
         }
     }
     if (uatContent) {
@@ -290,11 +301,20 @@ function stringField(row, key) {
 function stripGsdPrefix(path) {
     return path.startsWith(".gsd/") ? path.slice(".gsd/".length) : path;
 }
-function persistSliceAssessmentBackfill(assessmentRelPath, mid, sliceId, content) {
+// Scope marker for assessments fabricated by the milestone-validation backfill
+// (#1258). It keeps these placeholders distinguishable from genuine `run-uat`
+// sign-offs so `readUatGateVerdict` never mistakes "never checked" for "passed".
+const BACKFILL_ASSESSMENT_SCOPE = "backfill";
+function persistSliceAssessmentBackfill(assessmentRelPath, mid, sliceId, content, fabricated) {
     const artifactPath = stripGsdPrefix(assessmentRelPath);
     const existingAssessment = getAssessment(assessmentRelPath) ??
         getAssessment(artifactPath);
-    const scope = stringField(existingAssessment, "scope") ?? "run-uat";
+    // A newly fabricated placeholder is filed under a distinct scope; a pre-existing
+    // on-disk ASSESSMENT keeps its real scope (default `run-uat`) so genuine
+    // sign-offs are still honored.
+    const scope = fabricated
+        ? BACKFILL_ASSESSMENT_SCOPE
+        : stringField(existingAssessment, "scope") ?? "run-uat";
     const status = stringField(existingAssessment, "status") ??
         extractVerdict(content)?.toLowerCase() ??
         "unknown";
@@ -342,18 +362,24 @@ function backfillMissingAssessmentsFromSummaries(basePath, mid) {
             "---",
             `sliceId: ${sliceId}`,
             "verdict: PASS",
+            // Distinguishing marker (#1258): this ASSESSMENT was fabricated to satisfy
+            // the per-slice artifact requirement, NOT produced by a real UAT run. It
+            // must not be read as a genuine UAT sign-off.
+            "backfilled: true",
+            "verified: false",
             `date: ${now}`,
             "---",
             "",
             `# Assessment — ${sliceId}`,
             "",
             "Auto-created during milestone validation because this completed slice had a SUMMARY but no ASSESSMENT artifact.",
+            "This is a placeholder: no UAT was executed for this slice, so its verdict is not an independent sign-off.",
             "No additional reassessment changes were detected in this backfill step.",
             "",
         ].join("\n") : readFileSync(assessmentPath, "utf-8");
         if (isDbAvailable()) {
             try {
-                persistSliceAssessmentBackfill(assessmentRelPath, mid, sliceId, content);
+                persistSliceAssessmentBackfill(assessmentRelPath, mid, sliceId, content, didCreateAssessment);
             }
             catch (err) {
                 logWarning("dispatch", `failed to backfill assessment DB rows for ${mid}/${sliceId}: ${err.message}`);
@@ -533,7 +559,7 @@ export const DISPATCH_RULES = [
     {
         name: "run-uat (post-completion)",
         match: async ({ state, mid, basePath, prefs, sessionProvider, sessionAuthMode, activeTools, registeredTools, sessionBaseUrl, }) => {
-            const needsRunUat = await checkNeedsRunUat(basePath, mid, state, prefs);
+            const needsRunUat = await checkNeedsRunUat(basePath, mid, prefs, await loadRoadmapCompletedSliceCandidates(basePath, mid));
             if (!needsRunUat)
                 return null;
             const { sliceId, uatType } = needsRunUat;
@@ -1167,8 +1193,15 @@ export const DISPATCH_RULES = [
             if (resolveSliceFile(basePath, mid, sid, "REACTIVE-BLOCKER"))
                 return null;
             const maxParallel = reactiveConfig?.max_parallel ?? 2;
-            const subagentModel = reactiveConfig?.subagent_model ?? resolveModelWithFallbacksForUnit("subagent")?.primary;
-            const subagentThinking = resolveThinkingLevelForUnit("subagent");
+            // `subagent_model` accepts the phase-bucket object form (#1229); honor the
+            // full primary→fallbacks chain in the dispatch prompt (the reactive
+            // subagent model is embedded there rather than set as the session model).
+            const subagentModelConfig = normalizeModelFieldConfig(reactiveConfig?.subagent_model)
+                ?? resolveModelWithFallbacksForUnit("subagent");
+            const subagentModel = subagentModelConfig?.primary;
+            // Prefer the per-field `thinking` carried on `reactive_execution.subagent_model`'s
+            // object form over the phase-bucket `subagent` level (#1269).
+            const subagentThinking = subagentModelConfig?.thinking ?? resolveThinkingLevelForUnit("subagent");
             // Default-on safety threshold: only activate reactive dispatch when at
             // least N tasks are ready. Users who explicitly enabled reactive_execution
             // keep the legacy threshold of 2 (matches the prior "any parallelism is
@@ -1228,7 +1261,13 @@ export const DISPATCH_RULES = [
                     action: "dispatch",
                     unitType: "reactive-execute",
                     unitId: `${mid}/${sid}/reactive+${batchSuffix}`,
-                    prompt: await buildReactiveExecutePrompt(mid, midTitle, sid, sTitle, selected, basePath, subagentModel, { sessionContextWindow, modelRegistry, sessionProvider, subagentThinking }),
+                    prompt: await buildReactiveExecutePrompt(mid, midTitle, sid, sTitle, selected, basePath, subagentModel, {
+                        sessionContextWindow,
+                        modelRegistry,
+                        sessionProvider,
+                        subagentThinking,
+                        subagentModelFallbacks: subagentModelConfig?.fallbacks,
+                    }),
                 };
             }
             catch (err) {
@@ -1500,6 +1539,19 @@ export const DISPATCH_RULES = [
     },
 ];
 import { getRegistry } from "./rule-registry.js";
+/**
+ * Prepend the configured response-language directive to a dispatched unit
+ * prompt so auto-execution units respond in the language set in PREFERENCES.md
+ * (#1210). No-op for non-dispatch actions or when no language is configured.
+ */
+function applyLanguageDirectiveToDispatch(action, prefs) {
+    if (action.action !== "dispatch" || !action.prompt)
+        return action;
+    const directive = renderLanguageDirectiveForPrompt(prefs);
+    if (!directive)
+        return action;
+    return { ...action, prompt: `${directive}\n\n${action.prompt}` };
+}
 // ─── Resolver ─────────────────────────────────────────────────────────────
 /**
  * Evaluate dispatch rules in order. Returns the first matching action,
@@ -1551,7 +1603,7 @@ export async function resolveDispatch(ctx) {
                 level: "error",
             };
         }
-        return action;
+        return applyLanguageDirectiveToDispatch(action, ctx.prefs);
     }
     catch (err) {
         // Registry not initialized — fall back to inline loop
@@ -1572,7 +1624,7 @@ export async function resolveDispatch(ctx) {
                     matchedRule: rule.name,
                 };
             }
-            return action;
+            return applyLanguageDirectiveToDispatch(action, ctx.prefs);
         }
     }
     // No rule matched — unhandled phase.

package/dist/resources/extensions/gsd/auto-model-selection.js

@@ -219,10 +219,37 @@ function buildModelPolicyBlockReasons(policyDenyReasons, availableModels, routin
             reason: `configured model(s) did not resolve against policy-eligible registry [${eligibleSummary}]`,
         }];
 }
-function isModelUnavailable(basePath, provider, id) {
+export function isModelUnavailable(basePath, provider, id) {
     return isModelBlocked(basePath, provider, id) ||
         isModelTemporarilyUnavailable(basePath, provider, id);
 }
+/** Apply `auto_supervisor.model`, walking configured fallbacks on unavailability (#1229). */
+export async function applySupervisorModelIfConfigured(ctx, pi, basePath) {
+    const modelConfig = resolveModelWithFallbacksForUnit("supervisor", basePath);
+    if (!modelConfig)
+        return;
+    const availableModels = ctx.modelRegistry.getAvailable();
+    for (const candidate of [modelConfig.primary, ...modelConfig.fallbacks]) {
+        const match = resolveModelId(candidate, availableModels, ctx.model?.provider);
+        if (!match)
+            continue;
+        if (isModelUnavailable(basePath, match.provider, match.id))
+            continue;
+        try {
+            if (await pi.setModel(match, { persist: false })) {
+                // Prefer the per-field `thinking` from `auto_supervisor.model`'s object
+                // form over the session level so a configured supervisor level actually
+                // applies (#1269).
+                applyThinkingLevelForModel(pi, modelConfig.thinking ?? pi.getThinkingLevel(), match, ctx);
+                return;
+            }
+        }
+        catch (err) {
+            // Non-fatal — try the next fallback.
+            logWarning("dispatch", `supervisor model set failed for ${candidate}: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+}
 function restoreToolBaseline(pi) {
     const key = pi;
     const baseline = TOOL_BASELINE.get(key);

package/dist/resources/extensions/gsd/auto-post-unit.js

@@ -17,7 +17,7 @@ import { logWarning, logError } from "./workflow-logger.js";
 import { loadFile, parseSummary, resolveAllOverrides } from "./files.js";
 import { loadPrompt } from "./prompt-loader.js";
 import { isAwaitingUserInput } from "./consent-question.js";
-import { resolveSliceFile, resolveSlicePath, relSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, resolveFile, relMilestoneFile, relSliceFile, relTaskFile, } from "./paths.js";
+import { resolveSliceFile, resolveSlicePath, relSlicePath, resolveTaskFile, resolveMilestoneFile, resolveTasksDir, resolveFile, relMilestoneFile, relSliceFile, relTaskFile, normalizeRealPath, } from "./paths.js";
 import { invalidateAllCaches } from "./cache.js";
 import { rebuildState } from "./doctor.js";
 import { parseUnitId } from "./unit-id.js";
@@ -770,7 +770,7 @@ function describeArtifactVerificationFailure(unitType, unitId, basePath, agentEn
     if (!artifactPath) {
         return `Artifact verification failed: ${unitType} "${unitId}" has no resolvable artifact path.`;
     }
-    const relPath = relative(basePath, artifactPath);
+    const relPath = relative(normalizeRealPath(basePath), artifactPath);
     if (!existsSync(artifactPath)) {
         const completionToolHint = unitType === "execute-task" && !hasTaskCompletionToolCall(agentEndMessages)
             ? " No completion tool call detected (`gsd_task_complete`/alias)."
@@ -1987,7 +1987,8 @@ export async function postUnitPostVerification(pctx) {
             persistHookState(s.basePath);
             const verdict = gateBlock.verdict ? ` verdict=${gateBlock.verdict};` : "";
             const artifact = gateBlock.artifact ? ` artifact=${gateBlock.artifact};` : "";
-            const message = `Post-unit gate "${gateBlock.hookName}" blocked ${gateBlock.triggerUnitType} ${gateBlock.triggerUnitId}:` +
+            const message = `Post-unit gate "${gateBlock.hookName}" blocked ${gateBlock.triggerUnitType} ${gateBlock.triggerUnitId} ` +
+                `(detected on completion of ${s.currentUnit.type} ${s.currentUnit.id}):` +
                 `${verdict}${artifact} ${gateBlock.reason}. Run /gsd status to inspect, then /gsd auto after recovery.`;
             ctx.ui.notify(message, "warning");
             await pauseAuto(ctx, pi);

package/dist/resources/extensions/gsd/auto-prompts.js

@@ -8,7 +8,7 @@
  * utility.
  */
 import { loadFile, parseContinue, parseSummary, loadActiveOverrides, formatOverridesSection } from "./files.js";
-import { hasVerdict, extractVerdict } from "./verdict-parser.js";
+import { extractVerdict } from "./verdict-parser.js";
 import { loadPrompt, inlineTemplate } from "./prompt-loader.js";
 import { resolveMilestoneFile, resolveSliceFile, resolveSlicePath, resolveTasksDir, resolveTaskFiles, resolveTaskFile, relMilestoneFile, relSliceFile, relSlicePath, relMilestonePath, relTaskFile, resolveGsdRootFile, relGsdRootFile, resolveRuntimeFile, } from "./paths.js";
 import { resolveInlineLevel, loadEffectiveGSDPreferences } from "./preferences.js";
@@ -35,7 +35,8 @@ import { debugLog } from "./debug-logger.js";
 import { buildSkillActivationBlock, buildSkillDiscoveryVars } from "./skill-activation.js";
 import { findMilestoneIds } from "./milestone-ids.js";
 import { buildRunUatPresentationForType, RUN_UAT_TOOL_PRESENTATION_PLAN_ID } from "./tool-presentation-plan.js";
-import { classifyUatContentForRun, shouldDispatchUatForContent, } from "./uat-policy.js";
+import { classifyUatContentForRun } from "./uat-policy.js";
+import { checkNeedsRunUat as resolveNeedsRunUat } from "./uat-dispatch.js";
 import { buildWebAppUatGuidanceBlock } from "./web-app-uat.js";
 export { buildSkillActivationBlock, buildSkillDiscoveryVars };
 // ─── Preamble Cap ─────────────────────────────────────────────────────────────
@@ -1320,120 +1321,26 @@ export async function checkNeedsReassessment(base, mid, state) {
         return null;
     return { sliceId: lastDone };
 }
+export function getRoadmapCompletedSliceCandidates(roadmapContent) {
+    return parseRoadmap(roadmapContent)
+        .slices.filter((slice) => slice.done)
+        .map((slice) => ({ sliceId: slice.id }))
+        .reverse();
+}
+export async function loadRoadmapCompletedSliceCandidates(base, mid) {
+    const roadmapPath = resolveMilestoneFile(base, mid, "ROADMAP");
+    const roadmapContent = roadmapPath ? await loadFile(roadmapPath) : null;
+    return roadmapContent ? getRoadmapCompletedSliceCandidates(roadmapContent) : [];
+}
 /**
- * Check if the most recently completed slice needs a UAT run.
- * Returns { sliceId, uatType } if UAT should be dispatched, null otherwise.
- *
- * Skips when:
- * - No roadmap or no completed slices
- * - uat_dispatch is not enabled and the UAT spec does not require runtime/browser evidence
- * - No UAT file exists for the slice
- * - UAT result file already exists (idempotent — already ran)
- */
-/**
- * Resolve the effective UAT mode for the dispatch gate the same way
- * `buildRunUatPrompt` does: classify the UAT body with the slice's SUMMARY as
- * supplemental context, so a `browser-executable` UAT whose slice references a
- * self-contained harness (`npm run test:uat`, `search-uat.mjs`, `npx
- * playwright test`) is promoted to `runtime-executable` for the gate too.
- *
- * Without this, `checkNeedsRunUat` returns `browser-executable` while the
- * prompt instructs runtime-only execution, causing the dispatch gate to
- * require browser tools / warm up the browser daemon (or stop dispatch when
- * browser MCP is unavailable) for UAT runs that never touch the browser. See
- * cursor[bot] review on PR #696 for the M007/S01 regression.
+ * Back-compat wrapper for callers that import UAT dispatch checks from the
+ * prompt module. UAT dispatch architecture lives in `uat-dispatch.ts`; the
+ * `state` parameter is intentionally ignored because DB/roadmap artifacts are
+ * the source of truth for completed-slice discovery.
  */
-async function resolveRunUatEffectiveType(base, mid, sliceId, uatContent) {
-    let summaryContent = "";
-    try {
-        const summaryPath = resolveSliceFile(base, mid, sliceId, "SUMMARY");
-        if (summaryPath) {
-            summaryContent = (await loadFile(summaryPath)) ?? "";
-        }
-    }
-    catch (err) {
-        logWarning("prompt", `resolveRunUatEffectiveType SUMMARY load failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    return classifyUatContentForRun(uatContent, summaryContent).effectiveType;
-}
 export async function checkNeedsRunUat(base, mid, state, prefs) {
-    // DB primary path — fall through to file-based when DB has no data for this milestone
-    try {
-        const { isDbAvailable, getMilestoneSlices } = await import("./gsd-db.js");
-        if (isDbAvailable()) {
-            const slices = getMilestoneSlices(mid);
-            if (slices.length > 0) {
-                const completedSlices = slices.filter(s => s.status === "complete");
-                if (completedSlices.length === 0)
-                    return null;
-                for (const completed of [...completedSlices].reverse()) {
-                    const sid = completed.id;
-                    const uatFile = resolveSliceFile(base, mid, sid, "UAT");
-                    if (!uatFile)
-                        continue;
-                    const uatContent = await loadFile(uatFile);
-                    if (!uatContent)
-                        continue;
-                    // If the UAT file already contains a verdict, UAT has been run — skip
-                    if (hasVerdict(uatContent))
-                        continue;
-                    // Also check the ASSESSMENT file — the run-uat prompt writes the verdict
-                    // there (via gsd_uat_result_save), not into the
-                    // UAT spec file. Without this check the unit re-dispatches indefinitely.
-                    const assessmentFile = resolveSliceFile(base, mid, sid, "ASSESSMENT");
-                    if (assessmentFile) {
-                        const assessmentContent = await loadFile(assessmentFile);
-                        if (assessmentContent && hasVerdict(assessmentContent))
-                            continue;
-                    }
-                    if (!shouldDispatchUatForContent(uatContent, prefs))
-                        continue;
-                    const uatType = await resolveRunUatEffectiveType(base, mid, sid, uatContent);
-                    return { sliceId: sid, uatType };
-                }
-                return null;
-            }
-        }
-    }
-    catch (err) {
-        logWarning("prompt", `checkNeedsRunUat DB lookup failed: ${err instanceof Error ? err.message : String(err)}`);
-    }
-    // File-based fallback using roadmap checkboxes
-    const roadmapPath = resolveMilestoneFile(base, mid, "ROADMAP");
-    if (!roadmapPath)
-        return null;
-    const roadmapContent = await loadFile(roadmapPath);
-    if (!roadmapContent)
-        return null;
-    const parsed = parseRoadmap(roadmapContent);
-    const completedFileSlices = parsed.slices.filter(s => s.done);
-    if (completedFileSlices.length === 0)
-        return null;
-    for (const completed of [...completedFileSlices].reverse()) {
-        const uatSid = completed.id;
-        const uatFileFb = resolveSliceFile(base, mid, uatSid, "UAT");
-        if (!uatFileFb)
-            continue;
-        const uatContentFb = await loadFile(uatFileFb);
-        if (!uatContentFb)
-            continue;
-        // If the UAT file already contains a verdict, UAT has been run — skip
-        if (hasVerdict(uatContentFb))
-            continue;
-        // Also check the ASSESSMENT file for the file-based fallback path (same
-        // reason as the DB path above — verdict lives in ASSESSMENT, not UAT).
-        const assessmentFileFb = resolveSliceFile(base, mid, uatSid, "ASSESSMENT");
-        if (assessmentFileFb) {
-            const assessmentContentFb = await loadFile(assessmentFileFb);
-            if (assessmentContentFb && hasVerdict(assessmentContentFb))
-                continue;
-        }
-        if (!shouldDispatchUatForContent(uatContentFb, prefs))
-            continue;
-        const uatType = await resolveRunUatEffectiveType(base, mid, uatSid, uatContentFb);
-        return { sliceId: uatSid, uatType };
-    }
-    return null;
+    void state;
+    return resolveNeedsRunUat(base, mid, prefs, await loadRoadmapCompletedSliceCandidates(base, mid));
 }
 export async function buildDiscussMilestoneInlinedContext(mid, base) {
     const inlined = [];
@@ -3401,10 +3308,15 @@ export async function buildReassessRoadmapPrompt(mid, midTitle, completedSliceId
  * that instructs the coordinator how to dispatch a `subagent` call. Either or
  * both may be absent (ADR-026 / #508).
  */
-function subagentCallSuffix(model, thinking) {
+function subagentCallSuffix(model, thinking, fallbacks) {
     const parts = [];
-    if (model)
-        parts.push(`model: "${model}"`);
+    if (model) {
+        let modelHint = `model: "${model}"`;
+        if (fallbacks && fallbacks.length > 0) {
+            modelHint += ` (fallbacks, in order: ${fallbacks.map((f) => `"${f}"`).join(", ")})`;
+        }
+        parts.push(modelHint);
+    }
     if (thinking)
         parts.push(`thinking: "${thinking}"`);
     return parts.length > 0 ? ` with ${parts.join(" and ")}` : "";
@@ -3490,7 +3402,7 @@ opts) {
             "",
             `When done, say: "Task ${tid} complete."`,
         ].join("\n");
-        const modelSuffix = subagentCallSuffix(subagentModel, opts?.subagentThinking);
+        const modelSuffix = subagentCallSuffix(subagentModel, opts?.subagentThinking, opts?.subagentModelFallbacks);
         subagentSections.push([
             `### ${tid}: ${tTitle}`,
             "",

package/dist/resources/extensions/gsd/auto-recovery.js

@@ -149,12 +149,56 @@ export function refreshRecoveryDbForArtifact(unitType, unitId, basePath) {
         };
     }
     if (!isClosedStatus(task.status)) {
-        return {
-            ok: false,
-            fatal: true,
-            reason: "execute-task-artifact-db-mismatch",
-            message: `Stuck recovery found execute-task ${unitId} artifacts, but the DB task status is still '${task.status}' after refresh.`,
-        };
+        // The artifact was already confirmed on disk by verifyExpectedArtifact
+        // upstream (Gate 1 accepts a checked disk checkbox as proof of completion),
+        // but the DB task row is still open. A bare refreshWorkflowDatabaseFromDisk
+        // never promotes the disk checkbox into task status (the checkbox is
+        // rendered *from* the DB, never *into* it), so this divergence can never
+        // self-heal. Promote the task to align the DB with disk instead of failing
+        // shut — otherwise the lowest-pending derivation re-picks the same task
+        // forever and execute-task hard-stops with "state did not advance" (#1204).
+        // Mirrors the promotion pattern used by the context-exhaustion and
+        // reactive-execute-blocker recovery paths.
+        const ts = new Date().toISOString();
+        // Only the DB promotion is load-bearing: if it throws, nothing advanced
+        // and failing shut is correct. The plan checkbox rewrite and cache clears
+        // are best-effort follow-ups — a throw there must NOT abort recovery, or
+        // the DB is left complete without ever emitting the stuck-artifact-recovery
+        // event (#1221), stranding worktree reconciliation.
+        try {
+            updateTaskStatus(mid, sid, tid, "complete", ts);
+        }
+        catch (e) {
+            return {
+                ok: false,
+                fatal: true,
+                reason: "execute-task-artifact-db-promote-failed",
+                message: `Stuck recovery found execute-task ${unitId} artifacts, but promoting the DB task status from '${task.status}' failed: ${getErrorMessage(e)}`,
+            };
+        }
+        try {
+            const artifactBase = resolveArtifactVerificationBase(unitId, basePath);
+            const planPath = resolveExpectedArtifactPath("plan-slice", `${mid}/${sid}`, artifactBase);
+            if (planPath && existsSync(planPath)) {
+                const planContent = readFileSync(planPath, "utf-8");
+                const updatedPlan = planContent.replace(new RegExp(`^(\\s*-\\s+)\\[ \\]\\s+\\*\\*${tid}:`, "m"), `$1[x] **${tid}:`);
+                if (updatedPlan !== planContent) {
+                    atomicWriteSync(planPath, updatedPlan);
+                }
+            }
+            clearPathCache();
+            clearParseCache();
+        }
+        catch (e) {
+            logWarning("recovery", `stuck-artifact plan checkbox sync failed after DB promotion of ${unitId}: ${getErrorMessage(e)}`);
+        }
+        // Append event so worktree reconciliation can replay this recovery completion.
+        try {
+            appendEvent(basePath, { cmd: "complete-task", params: { milestoneId: mid, sliceId: sid, taskId: tid }, ts, actor: "system", trigger_reason: "stuck-artifact-recovery" });
+        }
+        catch (e) {
+            logWarning("recovery", `appendEvent failed for stuck-artifact task promotion: ${getErrorMessage(e)}`);
+        }
     }
     return { ok: true };
 }

package/dist/resources/extensions/gsd/auto-start.js

@@ -27,18 +27,19 @@ import { ensureGitignore, untrackRuntimeFiles } from "./gitignore.js";
 import { nativeIsRepo, nativeInit, nativeAddAll, nativeCommit, nativeGetCurrentBranch, nativeDetectMainBranch, nativeBranchList, nativeBranchExists, nativeBranchListMerged, nativeBranchDelete, nativeWorktreeRemove, nativeCommitCountBetween, nativeHasChanges, } from "./native-git-bridge.js";
 import { GitServiceImpl } from "./git-service.js";
 import { captureIntegrationBranch, detectWorktreeName, setActiveMilestoneId, } from "./worktree.js";
-import { getAutoWorktreePath } from "./auto-worktree.js";
+import { getAutoWorktreePath } from "./auto-worktree-path-resolution.js";
 import { checkoutBranchWithStashGuard } from "./worktree-git-recovery.js";
-import { readResourceVersion, cleanStaleRuntimeUnits } from "./auto-worktree.js";
+import { cleanStaleRuntimeUnits } from "./auto-worktree-runtime-cleanup.js";
+import { readResourceVersion } from "./auto-worktree-resource-version.js";
 import { worktreePath as getWorktreeDir, isInsideWorktreesDir } from "./worktree-manager.js";
 import { emitWorktreeOrphaned } from "./worktree-telemetry.js";
 import { queryJournal } from "./journal.js";
 import { initMetrics } from "./metrics.js";
 import { initRoutingHistory } from "./routing-history.js";
-import { restoreHookState, resetHookState } from "./post-unit-hooks.js";
+import { restoreHookState, resetHookState, reconcileRestoredHookDispatch } from "./post-unit-hooks.js";
 import { resetProactiveHealing, setLevelChangeCallback } from "./doctor-proactive.js";
 import { snapshotSkills } from "./skill-discovery.js";
-import { isDbAvailable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
+import { isDbAvailable, probeDbWritable, getMilestone, getAllMilestones, insertMilestone, updateMilestoneStatus } from "./gsd-db.js";
 import { getWorkflowDatabaseStatus, openExistingWorkflowDatabase, openWorkflowDatabase, resolveProjectRootDbPath, } from "./db-workspace.js";
 import { isClosedStatus } from "./status-guards.js";
 import { classifyMilestoneSummaryContent } from "./milestone-summary-classifier.js";
@@ -118,36 +119,42 @@ export function reconcileProjectMilestonesFromDisk(basePath) {
 export function reconcileMergedMilestonesFromJournal(basePath) {
     if (!isDbAvailable())
         return 0;
-    const mergedAtByMilestone = new Map();
-    for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
-        const data = entry.data ?? {};
-        const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
-        if (!milestoneId)
-            continue;
-        if (data.conflict === true)
-            continue;
-        const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
-        const previous = mergedAtByMilestone.get(milestoneId);
-        if (!previous || endedAt > previous)
-            mergedAtByMilestone.set(milestoneId, endedAt);
-    }
-    let closed = 0;
-    for (const [milestoneId, completedAt] of mergedAtByMilestone) {
-        const existing = getMilestone(milestoneId);
-        if (!existing) {
-            insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
-            updateMilestoneStatus(milestoneId, "complete", completedAt);
-            closed++;
-            continue;
-        }
-        if (!isClosedStatus(existing.status)) {
-            updateMilestoneStatus(milestoneId, "complete", completedAt);
-            closed++;
+    try {
+        const mergedAtByMilestone = new Map();
+        for (const entry of queryJournal(basePath, { eventType: "worktree-merged" })) {
+            const data = entry.data ?? {};
+            const milestoneId = typeof data.milestoneId === "string" ? data.milestoneId : null;
+            if (!milestoneId)
+                continue;
+            if (data.conflict === true)
+                continue;
+            const endedAt = typeof data.endedAt === "string" ? data.endedAt : entry.ts;
+            const previous = mergedAtByMilestone.get(milestoneId);
+            if (!previous || endedAt > previous)
+                mergedAtByMilestone.set(milestoneId, endedAt);
+        }
+        let closed = 0;
+        for (const [milestoneId, completedAt] of mergedAtByMilestone) {
+            const existing = getMilestone(milestoneId);
+            if (!existing) {
+                insertMilestone({ id: milestoneId, title: milestoneId, status: "complete" });
+                updateMilestoneStatus(milestoneId, "complete", completedAt);
+                closed++;
+                continue;
+            }
+            if (!isClosedStatus(existing.status)) {
+                updateMilestoneStatus(milestoneId, "complete", completedAt);
+                closed++;
+            }
         }
+        if (closed > 0)
+            invalidateAllCaches();
+        return closed;
+    }
+    catch (err) {
+        logWarning("bootstrap", `merged-milestone journal reconciliation failed: ${err instanceof Error ? err.message : String(err)}`);
+        return 0;
     }
-    if (closed > 0)
-        invalidateAllCaches();
-    return closed;
 }
 export function decideSurvivorAction(hasSurvivorBranch, phase) {
     if (!hasSurvivorBranch)
@@ -1253,6 +1260,10 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         s.unitLifetimeDispatches.clear();
         resetHookState();
         restoreHookState(base);
+        // A restored activeHook has no live dispatch (the sidecar queue is not
+        // persisted); re-enqueue it so the hook runs instead of blocking the next
+        // unrelated unit's close-out (#1246).
+        reconcileRestoredHookDispatch(base, s.sidecarQueue);
         resetProactiveHealing();
         // Notify user on health level transitions (green→yellow→red and back)
         setLevelChangeCallback((_from, to, summary) => {
@@ -1376,6 +1387,19 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
             ctx.ui.notify(`SQLite database exists but failed to open: ${gsdDbPath}. ${phaseHint}${errorDetail}.${providerHint}`, "error");
             return releaseLockAndReturn();
         }
+        // Gate: confirm the handle is actually writable, not just open. A
+        // schema-current DB does zero writes during open, so a read-only /
+        // DBMOVED handle otherwise passes the check above and only fails much
+        // later at the first authoritative write (the uok-kernel-enter audit)
+        // with an opaque "readonly database" error (#1234).
+        if (existsSync(gsdDbPath) && isDbAvailable()) {
+            const writable = probeDbWritable();
+            if (!writable.ok) {
+                const detail = writable.detail ? ` (${writable.detail})` : "";
+                ctx.ui.notify(`SQLite database is not writable: ${gsdDbPath}.${detail} Check file/WAL permissions or reopen a stale handle before running auto-mode.`, "error");
+                return releaseLockAndReturn();
+            }
+        }
         // Initialize metrics
         initMetrics(s.basePath);
         // Initialize routing history
@@ -1409,7 +1433,7 @@ export async function bootstrapAutoSession(s, ctx, pi, base, verboseMode, reques
         }
         // Snapshot installed skills
         if (resolveSkillDiscoveryMode(base) !== "off") {
-            snapshotSkills();
+            snapshotSkills({ cwd: s.basePath });
         }
         setAutoActiveStatus(ctx, s.stepMode ? "next" : "auto");
         ctx.ui.setWidget("gsd-health", undefined);