@mjasnikovs/pi-task 0.38.31 → 0.38.32

package/dist/shared/reasoning-capability.d.ts

@@ -30,7 +30,7 @@
  * line-for-line identical to it, ladder included. Nothing here imports pi-ai, so
  * an upstream change will not fail a test — the two have to be re-compared.
  */
-import { type ReasoningGroup, type GroupSetting } from '../config/reasoning.js';
+import { type ChildGroup, type GroupSetting } from '../config/reasoning.js';
 /**
  * pi's own level ladder, in order — the same seven names, in the same sequence,
  * as `EXTENDED_THINKING_LEVELS` in pi-ai's models.js. The order IS the algorithm:
@@ -67,16 +67,36 @@ export declare function supportedThinkingLevels(model: ReasoningModelFacts): Lad
  * the model supports it — which is what makes the inequality a mismatch test.
  */
 export declare function clampToModel(model: ReasoningModelFacts, level: LadderLevel): LadderLevel;
-/** One group whose configured setting the connected model will not honour. */
+/** One group whose configured setting the model it runs on will not honour. */
 export interface ReasoningMismatch {
-    group: ReasoningGroup;
+    group: ChildGroup;
+    /**
+     * The model THIS GROUP runs on. Per-item, not per-warning, because groups no
+     * longer share one model: a line that opens `model "X" will not run …` while
+     * listing groups that run on Y is itself a lie about what it checked.
+     */
+    modelName: string;
     /** What /task-config says. Never `inherit` — an inherited group asks for nothing. */
     wanted: LadderLevel;
     /** What pi will send instead. */
     actual: LadderLevel;
 }
+/** What a group runs on, as much of it as this check needs. */
+export interface GroupModelFacts extends ReasoningModelFacts {
+    /** What to call it in the warning. */
+    name: string;
+    /** Where it is served from, for the `/props` probe. Absent ⇒ not probeable. */
+    baseUrl?: string;
+}
 /**
- * Every group whose setting the model will silently change.
+ * Every group whose setting the model IT RUNS ON will silently change.
+ *
+ * `modelFor` is a FUNCTION rather than a `Record`, for two reasons: a record
+ * would build eleven identical entries for the overwhelmingly common
+ * all-`inherit` case, and a function is drivable from a test with two literals.
+ * It answers `undefined` for a group whose model cannot be resolved — nothing is
+ * reported for those, because the run degrades to the session default and the
+ * separate model hint is what names them.
  *
  * `inherit` groups are skipped entirely, because an inherited group asks for
  * nothing. That is not the same as a quiet default: the shipped table is mostly
@@ -91,4 +111,4 @@ export interface ReasoningMismatch {
  * comparison. Warning about one direction while staying silent about the other
  * would ship this feature unable to see its own failure mode.
  */
-export declare function reasoningMismatches(model: ReasoningModelFacts | undefined, levels: Readonly<Record<ReasoningGroup, GroupSetting>>): ReasoningMismatch[];
+export declare function reasoningMismatches(modelFor: (group: ChildGroup) => GroupModelFacts | undefined, levels: Readonly<Record<ChildGroup, GroupSetting>>): ReasoningMismatch[];

package/dist/shared/reasoning-capability.js

@@ -30,7 +30,7 @@
  * line-for-line identical to it, ladder included. Nothing here imports pi-ai, so
  * an upstream change will not fail a test — the two have to be re-compared.
  */
-import { REASONING_GROUPS } from '../config/reasoning.js';
+import { CHILD_GROUPS } from '../config/reasoning.js';
 /**
  * pi's own level ladder, in order — the same seven names, in the same sequence,
  * as `EXTENDED_THINKING_LEVELS` in pi-ai's models.js. The order IS the algorithm:
@@ -87,7 +87,14 @@ export function clampToModel(model, level) {
     return available[0] ?? 'off';
 }
 /**
- * Every group whose setting the model will silently change.
+ * Every group whose setting the model IT RUNS ON will silently change.
+ *
+ * `modelFor` is a FUNCTION rather than a `Record`, for two reasons: a record
+ * would build eleven identical entries for the overwhelmingly common
+ * all-`inherit` case, and a function is drivable from a test with two literals.
+ * It answers `undefined` for a group whose model cannot be resolved — nothing is
+ * reported for those, because the run degrades to the session default and the
+ * separate model hint is what names them.
  *
  * `inherit` groups are skipped entirely, because an inherited group asks for
  * nothing. That is not the same as a quiet default: the shipped table is mostly
@@ -102,19 +109,21 @@ export function clampToModel(model, level) {
  * comparison. Warning about one direction while staying silent about the other
  * would ship this feature unable to see its own failure mode.
  */
-export function reasoningMismatches(model, levels) {
-    // No model resolved yet (session still starting, or none selected): say
-    // nothing. A warning naming no model is noise, not information.
-    if (!model)
-        return [];
+export function reasoningMismatches(modelFor, levels) {
     const out = [];
-    for (const group of REASONING_GROUPS) {
+    for (const group of CHILD_GROUPS) {
         const wanted = levels[group];
         if (wanted === 'inherit')
             continue;
+        // No model resolved for this group (session still starting, none
+        // selected, or a spec this machine cannot resolve): say nothing. A
+        // warning naming no model is noise, not information.
+        const model = modelFor(group);
+        if (!model)
+            continue;
         const actual = clampToModel(model, wanted);
         if (actual !== wanted)
-            out.push({ group, wanted, actual });
+            out.push({ group, modelName: model.name, wanted, actual });
     }
     return out;
 }

package/dist/task/child-runner.d.ts

@@ -63,10 +63,9 @@ export declare function guardKillError(name: string, r: PhaseRunResult, opts?: {
  * The dead-backend probe killed a phase child on its LAST attempt.
  *
  * Reaching this means every attempt found no endpoint answering, not one. The
- * single-probe verdict is not trusted on its own: `discoverModelEndpoints` reads
- * every provider in models.json rather than the one this child's model uses, so a
- * stopped local server can condemn a run against a healthy cloud backend. Three
- * failed probes cost ~15s; one wrong verdict costs the run.
+ * single-probe verdict is not trusted on its own, because one sample cannot tell
+ * a dead server from a blip. Three failed probes cost ~15s; one wrong verdict
+ * costs the run.
  */
 export declare class BackendDownError extends Error {
     readonly childName: string;
@@ -125,12 +124,16 @@ export interface PhaseRunResult {
 }
 export declare function childArgs(tools: string, extensions?: readonly string[], 
 /**
- * An already-resolved `['--thinking', level]`, or `[]` for "emit no flag".
- * Resolved by the CALLER, never here: the level is a property of the child's
- * ROLE, and this function is handed tools and extensions, not a name.
- * Omitted ⇒ byte-identical argv to the version before reasoning profiles.
+ * This child's group fragment: `--model` then `--thinking`, either half
+ * possibly absent. Resolved by the CALLER, never here — both are properties
+ * of the child's ROLE, and this function is handed tools and extensions, not
+ * a name. Omitted ⇒ byte-identical argv to the version before group profiles.
+ *
+ * ONE field rather than a `model` beside a `thinking`, because nothing may
+ * compose the two halves by hand: `groupChildArgs` is the only producer, so a
+ * doubled `--thinking` is unreachable rather than merely unlikely.
  */
-thinking?: readonly string[]): string[];
+groupArgs?: readonly string[]): string[];
 export declare const USER_CANCELLED = "__user_cancelled__";
 /**
  * Run a child pi process with JSON event-stream output, loop detection, and
@@ -175,10 +178,10 @@ export interface ChildRun {
      */
     contextWindow?: number;
     /**
-     * The resolved `['--thinking', level]` fragment for this child's reasoning
-     * group, or `[]`/omitted to inherit the session default as before.
+     * The resolved argv fragment for this child's group — `--model` then
+     * `--thinking` — or `[]`/omitted to inherit both defaults as before.
      */
-    thinking?: readonly string[];
+    groupArgs?: readonly string[];
     /**
      * This attempt's per-command ceiling, already halved for prior hangs by the
      * caller's strike loop. Omitted -> the `phase` row's full configured ceiling,
@@ -195,7 +198,7 @@ export interface ChildRun {
  * one — the mislabel class runDegradedFinalAttempt's own comment warns about.
  */
 export declare function phasePolicy(): WorkerGuardPolicy;
-export declare function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, thinking, commandCeilingMs }: ChildRun): Promise<PhaseRunResult>;
+export declare function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, groupArgs, commandCeilingMs }: ChildRun): Promise<PhaseRunResult>;
 export interface PhaseDeps {
     cwd: string;
     taskId: string;
@@ -337,15 +340,15 @@ export type PhaseSeams = Omit<PhaseDeps, 'cwd' | 'taskId' | 'signal' | 'onChildO
  * exit status describes our SIGTERM and says nothing about its verdict.
  */
 /**
- * The `--thinking` fragment for a named child, or `[]` when the name is unmapped.
+ * The group fragment for a named child, or `[]` when the name is unmapped.
  *
  * An unmapped name INHERITS rather than throwing: a child that reaches the model
  * with today's argv is always safe, and aborting a user's task over a missing
  * table row would be a worse failure than the one it reports. The guard that
- * makes the table complete is `reasoning-groups.test.ts`, which fails the BUILD —
+ * makes the table complete is `config/groups.test.ts`, which fails the BUILD —
  * where someone can actually fix it.
  */
-export declare function thinkingForChild(name: string): string[];
+export declare function groupArgsForChild(name: string): string[];
 export declare function runPhaseChild(deps: PhaseDeps, name: string, tools: string, prompt: string, opts?: PhaseChildOptions): Promise<string>;
 export declare function formatLoopHint(hit: LoopHit): string;
 /**

package/dist/task/child-runner.js

@@ -15,14 +15,15 @@ import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../s
 import { readSection, setTaskSection } from './task-io.js';
 import { streamStallCause } from '../shared/stream-watchdog.js';
 import { commandCeilingForAttempt, commandTimeoutHint, commandWatch } from '../shared/command-watchdog.js';
-import { discoverModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
+import { childModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
+import { modelSpecFromArgs } from '../config/group-models.js';
 // VALUE import, and it is only safe because worker-profiles.ts reads its loop
 // constants from loop-detector.ts. Point those back at this file and the graph
 // closes into a TDZ ReferenceError that no compile step catches.
 import { workerPolicy } from '../workers/worker-profiles.js';
 import { getConfig } from '../config/config.js';
-import { groupThinkingArgs } from '../config/reasoning-args.js';
-import { reasoningGroupForChild } from '../config/reasoning.js';
+import { groupChildArgs, groupWindow } from '../config/group-args.js';
+import { groupForChild } from '../config/groups.js';
 // ─── Phase-child wall-clock cap ──────────────────────────────────────────────
 /**
  * Optional wall-clock bound on ONE spawn of a phase child. DEFAULT: OFF.
@@ -115,10 +116,11 @@ export function guardKillError(name, r, opts = {}) {
     if (r.commandKill)
         return new CommandTimeoutError(name, r.commandKill);
     // A dead-backend verdict is only trusted once every attempt has produced it.
-    // `discoverModelEndpoints` reads EVERY provider in models.json, not the one
-    // this child's model uses, so a stopped local server can condemn a run against
-    // a healthy cloud backend. The asymmetry settles it: a backend that really is
-    // down costs three 5s probes, a wrong verdict costs the whole run.
+    // The probe now asks about this child's own endpoint rather than ORing over
+    // every provider, so it is exact — but it is still one network call at one
+    // instant, and a blip is indistinguishable from a death in a single sample.
+    // The asymmetry settles it: a backend that really is down costs three 5s
+    // probes, a wrong verdict costs the whole run.
     if (r.stalled)
         return opts.finalAttempt === false ? null : new BackendDownError(name);
     return null;
@@ -127,10 +129,9 @@ export function guardKillError(name, r, opts = {}) {
  * The dead-backend probe killed a phase child on its LAST attempt.
  *
  * Reaching this means every attempt found no endpoint answering, not one. The
- * single-probe verdict is not trusted on its own: `discoverModelEndpoints` reads
- * every provider in models.json rather than the one this child's model uses, so a
- * stopped local server can condemn a run against a healthy cloud backend. Three
- * failed probes cost ~15s; one wrong verdict costs the run.
+ * single-probe verdict is not trusted on its own, because one sample cannot tell
+ * a dead server from a blip. Three failed probes cost ~15s; one wrong verdict
+ * costs the run.
  */
 export class BackendDownError extends Error {
     childName;
@@ -246,12 +247,16 @@ const defaultSleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 // ─── Spawn helpers ───────────────────────────────────────────────────────────
 export function childArgs(tools, extensions = [], 
 /**
- * An already-resolved `['--thinking', level]`, or `[]` for "emit no flag".
- * Resolved by the CALLER, never here: the level is a property of the child's
- * ROLE, and this function is handed tools and extensions, not a name.
- * Omitted ⇒ byte-identical argv to the version before reasoning profiles.
+ * This child's group fragment: `--model` then `--thinking`, either half
+ * possibly absent. Resolved by the CALLER, never here — both are properties
+ * of the child's ROLE, and this function is handed tools and extensions, not
+ * a name. Omitted ⇒ byte-identical argv to the version before group profiles.
+ *
+ * ONE field rather than a `model` beside a `thinking`, because nothing may
+ * compose the two halves by hand: `groupChildArgs` is the only producer, so a
+ * doubled `--thinking` is unreachable rather than merely unlikely.
  */
-thinking = []) {
+groupArgs = []) {
     // `--mode json` puts the child into the structured event stream the
     // unified runner parses in `mode: 'json-events'`. Without it the child
     // emits plain text, every line fails JSON.parse, finalText stays empty,
@@ -273,7 +278,7 @@ thinking = []) {
     // one — the guards all hang off pi's `tool_call` hook.
     const toolFlags = tools === '' ? ['--no-tools'] : ['--tools', tools];
     const internal = tools === '' ? [] : extensions;
-    return [...childBaseArgs(internal), ...thinking, '--mode', 'json', ...toolFlags];
+    return [...childBaseArgs(internal), ...groupArgs, '--mode', 'json', ...toolFlags];
 }
 // Sentinel error thrown when the user dismisses a grill-me dialog.
 // Defined here (not in failure-classifier.ts) to avoid circular dependency.
@@ -292,8 +297,8 @@ export function phasePolicy() {
         streamInactivityMs: getConfig().streamInactivityMs
     });
 }
-export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, thinking, commandCeilingMs }) {
-    const invocation = getPiInvocation(childArgs(tools, extensions, thinking), prompt);
+export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, groupArgs, commandCeilingMs }) {
+    const invocation = getPiInvocation(childArgs(tools, extensions, groupArgs), prompt);
     let loopHit;
     const guards = phasePolicy().guards;
     // Null when the user set the ceiling to `off`. Why a phase child needs this at
@@ -315,7 +320,7 @@ export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUs
                     stall: {
                         afterMs: guards.stalled.afterMs,
                         probe: guards.stalled.probe
-                            ?? (() => probeModelEndpoints(discoverModelEndpoints()))
+                            ?? (() => probeModelEndpoints(childModelEndpoints(modelSpecFromArgs(groupArgs ?? []))))
                     }
                 }),
             onLine,
@@ -461,17 +466,17 @@ async function triageChildResult(deps, name, r, attempt, budget, verb) {
  * exit status describes our SIGTERM and says nothing about its verdict.
  */
 /**
- * The `--thinking` fragment for a named child, or `[]` when the name is unmapped.
+ * The group fragment for a named child, or `[]` when the name is unmapped.
  *
  * An unmapped name INHERITS rather than throwing: a child that reaches the model
  * with today's argv is always safe, and aborting a user's task over a missing
  * table row would be a worse failure than the one it reports. The guard that
- * makes the table complete is `reasoning-groups.test.ts`, which fails the BUILD —
+ * makes the table complete is `config/groups.test.ts`, which fails the BUILD —
  * where someone can actually fix it.
  */
-export function thinkingForChild(name) {
-    const group = reasoningGroupForChild(name);
-    return group ? groupThinkingArgs(group) : [];
+export function groupArgsForChild(name) {
+    const group = groupForChild(name);
+    return group ? groupChildArgs(group) : [];
 }
 /**
  * What a PHASE child's invocation carries, said once.
@@ -482,14 +487,29 @@ export function thinkingForChild(name) {
  * which is what the degrade's own comment ("the degrade changes the TOOLS, not
  * the role") claimed while three bare `undefined`s quietly made it false.
  */
-function phaseChildRun(deps, over) {
+/**
+ * The context window a child of this group runs against.
+ *
+ * The GROUP's window when this session resolved one, else the run's. Too small a
+ * window makes the churn rule fire early and kill a healthy child, so an
+ * `inherit` or unresolved group keeps the parent's number rather than a guess.
+ */
+function childContextWindow(deps, group) {
+    return (group === undefined ? undefined : groupWindow(group)) ?? deps.contextWindow;
+}
+function phaseChildRun(deps, 
+/** This child's group, for the window. Undefined ⇒ the run's own window. */
+group, over) {
     return {
         cwd: deps.cwd,
         onLine: deps.onChildOutput,
         onContextUsage: deps.onContextUsage,
         spawn: deps.spawn,
         extensions: deps.childExtensions,
-        contextWindow: deps.contextWindow,
+        // The GROUP's window when this session resolved one, else the run's.
+        // Too small a window makes the churn rule fire early and kill a healthy
+        // child, so an unresolved group keeps the parent's number.
+        contextWindow: (group === undefined ? undefined : groupWindow(group)) ?? deps.contextWindow,
         ...over
     };
 }
@@ -500,8 +520,9 @@ export async function runPhaseChild(deps, name, tools, prompt, opts = {}) {
     // between a loop-kill and its retry would otherwise make the two attempts
     // different experiments, and the retry exists to repeat the first one with a
     // hint. An unmapped name inherits, which is today's argv — the build-time
-    // guard for that is reasoning-groups.test.ts, not a throw in a user's run.
-    const thinking = thinkingForChild(name);
+    // guard for that is config/groups.test.ts, not a throw in a user's run.
+    const groupArgs = groupArgsForChild(name);
+    const group = groupForChild(name);
     const verb = opts.verb ?? 'retry';
     let hint = null;
     const loopHistory = [];
@@ -528,15 +549,21 @@ export async function runPhaseChild(deps, name, tools, prompt, opts = {}) {
         // context WINDOW, so a detector that waited to be told one would sit at 0,
         // and the churn rule returns false on a non-positive window. The parent
         // knows the value at spawn time — say it then, not later.
-        stall?.noteContext(deps.contextWindow ?? 0);
+        //
+        // The SAME number the child is handed below. Arming it from the run's
+        // window while the child runs on a bigger model's would judge the child
+        // against a window it does not have, for exactly the stretch before the
+        // first `context_usage` event corrects it — which is the stretch this
+        // line exists to cover.
+        stall?.noteContext(childContextWindow(deps, group) ?? 0);
         const clock = phaseTimeout(deps.signal, budgetMs);
         let r;
         try {
-            r = await runChild(phaseChildRun(deps, {
+            r = await runChild(phaseChildRun(deps, group, {
                 tools,
                 prompt: prependHint(hint, prompt),
                 signal: clock.signal,
-                thinking,
+                groupArgs,
                 onContextUsage: snapshot => {
                     // Real window or nothing: `noteContext` ignores 0, which is
                     // why the parent's value must be supplied at spawn — a
@@ -691,14 +718,15 @@ async function runDegradedFinalAttempt(deps, name, prompt, hit, loopHistory) {
     const clock = phaseTimeout(deps.signal, deps.timeoutMs ?? PHASE_CHILD_TIMEOUT_MS);
     let r;
     try {
-        r = await runChild(phaseChildRun(deps, {
+        r = await runChild(phaseChildRun(deps, groupForChild(name), {
             tools: '', // --no-tools: the model cannot read/grep/list, only answer
             prompt: prependHint(formatDegradeHint(hit), prompt),
             signal: clock.signal,
             // Same group as the attempts that led here. The degrade changes the
-            // TOOLS, not the role — running it at a different thinking level would
-            // make the fallback a different experiment from the thing it rescues.
-            thinking: thinkingForChild(name)
+            // TOOLS, not the role — running it on a different model, or at a
+            // different thinking level, would make the fallback a different
+            // experiment from the thing it rescues.
+            groupArgs: groupArgsForChild(name)
         }));
     }
     finally {

package/dist/task/context-usage.d.ts

@@ -5,6 +5,8 @@
  * directly, because its state is the whole-run `WidgetState`, not one child's.
  */
 import type { ContextSnapshot } from '../shared/child-process.js';
+import { type PiTaskConfig } from '../config/config.js';
+import type { ChildGroup } from '../config/groups.js';
 /**
  * The parent session's context window, or 0 when the model doesn't expose it.
  *
@@ -22,6 +24,50 @@ export declare function getParentContextWindow(ctx: {
         contextWindow?: number;
     };
 }): number;
+/**
+ * The window for the model ONE GROUP's children will actually run on.
+ *
+ * This number drives the widget and, more importantly, `StallDetector`'s
+ * context-churn rule, and the two error directions are not symmetric. A parent
+ * window LARGER than the child's makes churn fire late — degraded, and the
+ * no-new-ground rule still covers it. A parent window SMALLER makes churn fire
+ * early and KILL A HEALTHY CHILD. A big-context research model under a small
+ * host model is a real false positive, which is why this exists at all.
+ *
+ * For the same reason there is no `min(parent, group)`: that would import the
+ * dangerous direction on purpose.
+ *
+ * `inherit`, an unresolvable spec, or a model with no declared window all return
+ * exactly `getParentContextWindow(ctx)` — byte-identical to the behaviour before
+ * per-group models existed.
+ *
+ * Callers WITHOUT a ctx read `groupWindow` from config/group-args.ts instead,
+ * which the session pass fills from this. One producer, so the two views cannot
+ * describe different models.
+ */
+export declare function contextWindowForGroup(ctx: {
+    model?: {
+        contextWindow?: number;
+    };
+    modelRegistry?: {
+        find: (p: string, i: string) => unknown;
+    };
+}, group: ChildGroup, cfg?: PiTaskConfig): number;
+/**
+ * The same answer for a spec the caller already has.
+ *
+ * The session pass needs this: it walks an INJECTED spec table, and reaching for
+ * `getConfig()` here would let the window it stores describe a different model
+ * from the one it just checked.
+ */
+export declare function contextWindowForSpec(ctx: {
+    model?: {
+        contextWindow?: number;
+    };
+    modelRegistry?: {
+        find: (p: string, i: string) => unknown;
+    };
+}, spec: string): number;
 /**
  * Fold a raw context snapshot into a display snapshot: prefer the child's own
  * contextWindow, else the last known one, else the parent session's; then derive

package/dist/task/context-usage.js

@@ -4,6 +4,8 @@
  * the planning and gate children; the single-task widget (TaskRunner) calls it
  * directly, because its state is the whole-run `WidgetState`, not one child's.
  */
+import { getConfig } from '../config/config.js';
+import { MODEL_INHERIT, splitSpec } from '../config/group-models.js';
 /**
  * The parent session's context window, or 0 when the model doesn't expose it.
  *
@@ -19,6 +21,45 @@
 export function getParentContextWindow(ctx) {
     return ctx.model?.contextWindow ?? 0;
 }
+/**
+ * The window for the model ONE GROUP's children will actually run on.
+ *
+ * This number drives the widget and, more importantly, `StallDetector`'s
+ * context-churn rule, and the two error directions are not symmetric. A parent
+ * window LARGER than the child's makes churn fire late — degraded, and the
+ * no-new-ground rule still covers it. A parent window SMALLER makes churn fire
+ * early and KILL A HEALTHY CHILD. A big-context research model under a small
+ * host model is a real false positive, which is why this exists at all.
+ *
+ * For the same reason there is no `min(parent, group)`: that would import the
+ * dangerous direction on purpose.
+ *
+ * `inherit`, an unresolvable spec, or a model with no declared window all return
+ * exactly `getParentContextWindow(ctx)` — byte-identical to the behaviour before
+ * per-group models existed.
+ *
+ * Callers WITHOUT a ctx read `groupWindow` from config/group-args.ts instead,
+ * which the session pass fills from this. One producer, so the two views cannot
+ * describe different models.
+ */
+export function contextWindowForGroup(ctx, group, cfg = getConfig()) {
+    return contextWindowForSpec(ctx, cfg.groupModels[group]);
+}
+/**
+ * The same answer for a spec the caller already has.
+ *
+ * The session pass needs this: it walks an INJECTED spec table, and reaching for
+ * `getConfig()` here would let the window it stores describe a different model
+ * from the one it just checked.
+ */
+export function contextWindowForSpec(ctx, spec) {
+    if (spec === MODEL_INHERIT)
+        return getParentContextWindow(ctx);
+    const parts = splitSpec(spec);
+    const found = parts && ctx.modelRegistry?.find(parts.provider, parts.id);
+    const window = found?.contextWindow ?? 0;
+    return window > 0 ? window : getParentContextWindow(ctx);
+}
 /**
  * Fold a raw context snapshot into a display snapshot: prefer the child's own
  * contextWindow, else the last known one, else the parent session's; then derive

package/dist/task/gate-child.d.ts

@@ -75,15 +75,26 @@ export interface GateChildDeps {
     /** Hung-stream bound; the probe-based stall guard cannot supply it. */
     streamInactivityMs: number;
     /**
-     * The resolved `['--thinking', level]` fragment for the `gate` reasoning
-     * group, or `[]` to inherit the session default.
+     * The resolved argv fragment for the `gate` group — its model and its
+     * thinking level — or `[]` to inherit both.
      *
      * REQUIRED, like its two neighbours above: gate-child takes resolved config
      * values and gate-deps supplies them. Optional-with-a-default would let a new
-     * gate wiring silently run at a level nobody chose, which is the failure the
+     * gate wiring silently run on a model nobody chose, which is the failure the
      * whole profile feature exists to end.
      */
-    thinking: readonly string[];
+    groupArgs: readonly string[];
+    /**
+     * The context window of the model THESE children run on, for the churn rule.
+     *
+     * Not `status.parentContextWindow`, which is a per-RUN value and a run spans
+     * several groups. The direction matters: a window smaller than the child's
+     * real one makes churn fire early and kill a healthy child, so this follows
+     * the `gate` group's model and falls back to the host's.
+     *
+     * REQUIRED, like its neighbours: gate-child takes resolved config values.
+     */
+    contextWindow: number;
     /**
      * The live widget state this child feeds and its loader reads. SHARED with
      * the caller — the verify gate's own loader reads the same status while this

package/dist/task/gate-child.js

@@ -98,7 +98,7 @@ export function makeGateChild(deps) {
                         commandTimeoutMs: deps.commandTimeoutMs,
                         streamInactivityMs: deps.streamInactivityMs
                     },
-                    thinking: deps.thinking,
+                    groupArgs: deps.groupArgs,
                     // A discarded attempt is otherwise invisible: the returned
                     // exitCode/text describe the FINAL attempt, so a child that
                     // burned two attempts reads exactly like one that ran clean.
@@ -125,7 +125,7 @@ export function makeGateChild(deps) {
                     // stream — what `--mode json` emits — carries token counts but
                     // no context window; `contextWindow` appears nowhere in
                     // agent-session.d.ts.
-                    contextWindow: deps.status.parentContextWindow
+                    contextWindow: deps.contextWindow
                 });
             }
             finally {

package/dist/task/gate-deps.js

@@ -48,7 +48,8 @@ import { assessRunnerGlobs, runnerGlobVerifyFindings } from './runner-globs.js';
 import { captureGitState, reconcileGitState } from './git-state-guard.js';
 import { runWorker } from '../workers/pi-worker-core.js';
 import { getConfig } from '../config/config.js';
-import { groupThinkingArgs } from '../config/reasoning-args.js';
+import { groupChildArgs } from '../config/group-args.js';
+import { contextWindowForGroup } from './context-usage.js';
 import { makeDebugAppender } from './debug-log.js';
 import { startAutoLoader } from './widget.js';
 import { ChildStatus } from './child-status.js';
@@ -602,7 +603,11 @@ export function buildGateDeps(params) {
         streamInactivityMs: getConfig().streamInactivityMs,
         // Read per gateChild() call, like its two neighbours, so a
         // /task-config change lands on the next gate without a restart.
-        thinking: groupThinkingArgs('gate'),
+        groupArgs: groupChildArgs('gate'),
+        // `gateCtx` rather than the run's own window: a run spans several
+        // groups, and a window smaller than the child's real one makes the
+        // churn rule fire early and kill a healthy child.
+        contextWindow: contextWindowForGroup(gateCtx, 'gate'),
         status,
         runWorker,
         makeDebugAppender,