@mjasnikovs/pi-task 0.38.31 → 0.39.0

package/dist/shared/model-endpoint.d.ts

@@ -1,5 +1,58 @@
 /** Base URLs of every custom provider pi is configured with (possibly none). */
 export declare function discoverModelEndpoints(agentDir?: string): string[];
+/**
+ * The provider/id a child pi process will actually resolve.
+ *
+ * Children carry no `-m` (CHILD_BASE_ARGS), so they fall back to pi's saved
+ * default — which is this, not the host session's model. `undefined` means we
+ * could not read it, and every caller here treats that as "do not guess".
+ */
+export interface ModelRef {
+    provider: string;
+    id: string;
+}
+export declare function defaultModelRef(agentDir?: string): ModelRef | undefined;
+/**
+ * The base URL one model is served from, or `undefined` for "not configured on
+ * this machine".
+ *
+ * Two files, two shapes, and the difference is not cosmetic. `models.json` is
+ * hand-written and hangs `baseUrl` off the PROVIDER; `models-store.json` is the
+ * cached remote catalogue and hangs it off each MODEL — its provider objects are
+ * `{models, checkedAt, lastModified, etag}` with no `baseUrl` key at all. A
+ * reader that knows only the first shape sees one endpoint on a machine that has
+ * fifteen.
+ *
+ * `undefined` is the honest answer for a model pi serves from `@earendil-works/
+ * pi-ai`'s built-in catalogue, whose URLs live in that package rather than on
+ * disk. We do not import it — see the header of this file — so we say we do not
+ * know, and the caller declines to probe rather than probing something else.
+ */
+export declare function modelBaseUrl(ref: ModelRef, agentDir?: string): string | undefined;
+/**
+ * What to probe on behalf of one child — the endpoint that child's own model
+ * uses, not every endpoint on the machine.
+ *
+ * The bug this closes is `probeModelEndpoints`'s `.some(Boolean)`: with a live
+ * cloud provider and a dead local one, the OR answers "reachable" and the stall
+ * guard is disarmed for a child that will never speak again. Handing it ONE url
+ * makes the OR a no-op and the verdict exact.
+ *
+ * `spec` is the child's OWN `provider/id`, as carried by its argv. `undefined`
+ * means the child carries no `--model` and will resolve pi's saved default,
+ * which is then the right thing to probe. Reading the saved default for a child
+ * that IS pinned asks about the wrong server in BOTH directions: it can kill a
+ * child whose own backend is healthy, and it can leave the guard disarmed for
+ * one whose backend is dead.
+ *
+ * Two escapes, both toward never killing:
+ *  - model known, endpoint not on disk (a built-in provider) → `[]`, which
+ *    `probeModelEndpoints` reads as reachable. We cannot see that server, so we
+ *    do not get a vote. Probing some OTHER provider's url instead would import a
+ *    false positive, which is the one thing today's blind OR never does.
+ *  - no readable default → today's behaviour, unchanged.
+ */
+export declare function childModelEndpoints(spec?: string, agentDir?: string): string[];
 /**
  * true → at least one endpoint ANSWERED. Any HTTP status counts, because the
  * question is liveness, not correctness: probing a path that 404s still returns

package/dist/shared/model-endpoint.js

@@ -10,10 +10,15 @@
  * while it runs, so only "no output AND the endpoint does not answer" counts as
  * a dead backend.
  *
- * Discovery is generic — the custom providers pi is configured with, read from
- * models.json `providers.*.baseUrl`, with no provider or server name hardcoded.
+ * Discovery is generic — no provider or server name is hardcoded anywhere here.
  * No discoverable endpoint means nothing to probe, and the guard then NEVER
  * kills: a child on a backend we cannot see gets the benefit of the doubt.
+ *
+ * `childModelEndpoints` is what the guards call; `discoverModelEndpoints` is its
+ * last resort. The difference is the point. Discovery answers "every endpoint on
+ * this machine", and `probeModelEndpoints` ORs over it, so one healthy provider
+ * says "reachable" for a child stranded on a dead one. Resolving the child's OWN
+ * model first turns that OR into a single exact question.
  */
 import * as fs from 'node:fs';
 import * as os from 'node:os';
@@ -33,6 +38,97 @@ export function discoverModelEndpoints(agentDir = path.join(os.homedir(), '.pi',
         return [];
     }
 }
+/** A `provider/id` spec as a ref, splitting on the FIRST slash. */
+function specRef(spec) {
+    if (spec === undefined)
+        return undefined;
+    const i = spec.indexOf('/');
+    if (i <= 0 || i === spec.length - 1)
+        return undefined;
+    return { provider: spec.slice(0, i), id: spec.slice(i + 1) };
+}
+export function defaultModelRef(agentDir = path.join(os.homedir(), '.pi', 'agent')) {
+    try {
+        const j = JSON.parse(fs.readFileSync(path.join(agentDir, 'settings.json'), 'utf8'));
+        const provider = j.defaultProvider;
+        const id = j.defaultModel;
+        if (typeof provider !== 'string' || provider === '')
+            return undefined;
+        if (typeof id !== 'string' || id === '')
+            return undefined;
+        return { provider, id };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * The base URL one model is served from, or `undefined` for "not configured on
+ * this machine".
+ *
+ * Two files, two shapes, and the difference is not cosmetic. `models.json` is
+ * hand-written and hangs `baseUrl` off the PROVIDER; `models-store.json` is the
+ * cached remote catalogue and hangs it off each MODEL — its provider objects are
+ * `{models, checkedAt, lastModified, etag}` with no `baseUrl` key at all. A
+ * reader that knows only the first shape sees one endpoint on a machine that has
+ * fifteen.
+ *
+ * `undefined` is the honest answer for a model pi serves from `@earendil-works/
+ * pi-ai`'s built-in catalogue, whose URLs live in that package rather than on
+ * disk. We do not import it — see the header of this file — so we say we do not
+ * know, and the caller declines to probe rather than probing something else.
+ */
+export function modelBaseUrl(ref, agentDir = path.join(os.homedir(), '.pi', 'agent')) {
+    const url = (v) => typeof v === 'string' && v.length > 0 ? v : undefined;
+    try {
+        const j = JSON.parse(fs.readFileSync(path.join(agentDir, 'models.json'), 'utf8'));
+        const p = j.providers?.[ref.provider];
+        if (p) {
+            const own = p.models?.find(m => m.id === ref.id);
+            return url(own?.baseUrl) ?? url(p.baseUrl);
+        }
+    }
+    catch {
+        /* fall through to the store */
+    }
+    try {
+        const j = JSON.parse(fs.readFileSync(path.join(agentDir, 'models-store.json'), 'utf8'));
+        return url(j[ref.provider]?.models?.find(m => m.id === ref.id)?.baseUrl);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * What to probe on behalf of one child — the endpoint that child's own model
+ * uses, not every endpoint on the machine.
+ *
+ * The bug this closes is `probeModelEndpoints`'s `.some(Boolean)`: with a live
+ * cloud provider and a dead local one, the OR answers "reachable" and the stall
+ * guard is disarmed for a child that will never speak again. Handing it ONE url
+ * makes the OR a no-op and the verdict exact.
+ *
+ * `spec` is the child's OWN `provider/id`, as carried by its argv. `undefined`
+ * means the child carries no `--model` and will resolve pi's saved default,
+ * which is then the right thing to probe. Reading the saved default for a child
+ * that IS pinned asks about the wrong server in BOTH directions: it can kill a
+ * child whose own backend is healthy, and it can leave the guard disarmed for
+ * one whose backend is dead.
+ *
+ * Two escapes, both toward never killing:
+ *  - model known, endpoint not on disk (a built-in provider) → `[]`, which
+ *    `probeModelEndpoints` reads as reachable. We cannot see that server, so we
+ *    do not get a vote. Probing some OTHER provider's url instead would import a
+ *    false positive, which is the one thing today's blind OR never does.
+ *  - no readable default → today's behaviour, unchanged.
+ */
+export function childModelEndpoints(spec, agentDir = path.join(os.homedir(), '.pi', 'agent')) {
+    const ref = specRef(spec) ?? defaultModelRef(agentDir);
+    if (!ref)
+        return discoverModelEndpoints(agentDir);
+    const url = modelBaseUrl(ref, agentDir);
+    return url === undefined ? [] : [url];
+}
 /**
  * true → at least one endpoint ANSWERED. Any HTTP status counts, because the
  * question is liveness, not correctness: probing a path that 404s still returns

package/dist/shared/reasoning-capability.d.ts

@@ -30,7 +30,7 @@
  * line-for-line identical to it, ladder included. Nothing here imports pi-ai, so
  * an upstream change will not fail a test — the two have to be re-compared.
  */
-import { type ReasoningGroup, type GroupSetting } from '../config/reasoning.js';
+import { type ChildGroup, type GroupSetting } from '../config/reasoning.js';
 /**
  * pi's own level ladder, in order — the same seven names, in the same sequence,
  * as `EXTENDED_THINKING_LEVELS` in pi-ai's models.js. The order IS the algorithm:
@@ -67,16 +67,36 @@ export declare function supportedThinkingLevels(model: ReasoningModelFacts): Lad
  * the model supports it — which is what makes the inequality a mismatch test.
  */
 export declare function clampToModel(model: ReasoningModelFacts, level: LadderLevel): LadderLevel;
-/** One group whose configured setting the connected model will not honour. */
+/** One group whose configured setting the model it runs on will not honour. */
 export interface ReasoningMismatch {
-    group: ReasoningGroup;
+    group: ChildGroup;
+    /**
+     * The model THIS GROUP runs on. Per-item, not per-warning, because groups no
+     * longer share one model: a line that opens `model "X" will not run …` while
+     * listing groups that run on Y is itself a lie about what it checked.
+     */
+    modelName: string;
     /** What /task-config says. Never `inherit` — an inherited group asks for nothing. */
     wanted: LadderLevel;
     /** What pi will send instead. */
     actual: LadderLevel;
 }
+/** What a group runs on, as much of it as this check needs. */
+export interface GroupModelFacts extends ReasoningModelFacts {
+    /** What to call it in the warning. */
+    name: string;
+    /** Where it is served from, for the `/props` probe. Absent ⇒ not probeable. */
+    baseUrl?: string;
+}
 /**
- * Every group whose setting the model will silently change.
+ * Every group whose setting the model IT RUNS ON will silently change.
+ *
+ * `modelFor` is a FUNCTION rather than a `Record`, for two reasons: a record
+ * would build eleven identical entries for the overwhelmingly common
+ * all-`inherit` case, and a function is drivable from a test with two literals.
+ * It answers `undefined` for a group whose model cannot be resolved — nothing is
+ * reported for those, because the run degrades to the session default and the
+ * separate model hint is what names them.
  *
  * `inherit` groups are skipped entirely, because an inherited group asks for
  * nothing. That is not the same as a quiet default: the shipped table is mostly
@@ -91,4 +111,4 @@ export interface ReasoningMismatch {
  * comparison. Warning about one direction while staying silent about the other
  * would ship this feature unable to see its own failure mode.
  */
-export declare function reasoningMismatches(model: ReasoningModelFacts | undefined, levels: Readonly<Record<ReasoningGroup, GroupSetting>>): ReasoningMismatch[];
+export declare function reasoningMismatches(modelFor: (group: ChildGroup) => GroupModelFacts | undefined, levels: Readonly<Record<ChildGroup, GroupSetting>>): ReasoningMismatch[];

package/dist/shared/reasoning-capability.js

@@ -30,7 +30,7 @@
  * line-for-line identical to it, ladder included. Nothing here imports pi-ai, so
  * an upstream change will not fail a test — the two have to be re-compared.
  */
-import { REASONING_GROUPS } from '../config/reasoning.js';
+import { CHILD_GROUPS } from '../config/reasoning.js';
 /**
  * pi's own level ladder, in order — the same seven names, in the same sequence,
  * as `EXTENDED_THINKING_LEVELS` in pi-ai's models.js. The order IS the algorithm:
@@ -87,7 +87,14 @@ export function clampToModel(model, level) {
     return available[0] ?? 'off';
 }
 /**
- * Every group whose setting the model will silently change.
+ * Every group whose setting the model IT RUNS ON will silently change.
+ *
+ * `modelFor` is a FUNCTION rather than a `Record`, for two reasons: a record
+ * would build eleven identical entries for the overwhelmingly common
+ * all-`inherit` case, and a function is drivable from a test with two literals.
+ * It answers `undefined` for a group whose model cannot be resolved — nothing is
+ * reported for those, because the run degrades to the session default and the
+ * separate model hint is what names them.
  *
  * `inherit` groups are skipped entirely, because an inherited group asks for
  * nothing. That is not the same as a quiet default: the shipped table is mostly
@@ -102,19 +109,21 @@ export function clampToModel(model, level) {
  * comparison. Warning about one direction while staying silent about the other
  * would ship this feature unable to see its own failure mode.
  */
-export function reasoningMismatches(model, levels) {
-    // No model resolved yet (session still starting, or none selected): say
-    // nothing. A warning naming no model is noise, not information.
-    if (!model)
-        return [];
+export function reasoningMismatches(modelFor, levels) {
     const out = [];
-    for (const group of REASONING_GROUPS) {
+    for (const group of CHILD_GROUPS) {
         const wanted = levels[group];
         if (wanted === 'inherit')
             continue;
+        // No model resolved for this group (session still starting, none
+        // selected, or a spec this machine cannot resolve): say nothing. A
+        // warning naming no model is noise, not information.
+        const model = modelFor(group);
+        if (!model)
+            continue;
         const actual = clampToModel(model, wanted);
         if (actual !== wanted)
-            out.push({ group, wanted, actual });
+            out.push({ group, modelName: model.name, wanted, actual });
     }
     return out;
 }

package/dist/task/child-runner.d.ts

@@ -63,10 +63,9 @@ export declare function guardKillError(name: string, r: PhaseRunResult, opts?: {
  * The dead-backend probe killed a phase child on its LAST attempt.
  *
  * Reaching this means every attempt found no endpoint answering, not one. The
- * single-probe verdict is not trusted on its own: `discoverModelEndpoints` reads
- * every provider in models.json rather than the one this child's model uses, so a
- * stopped local server can condemn a run against a healthy cloud backend. Three
- * failed probes cost ~15s; one wrong verdict costs the run.
+ * single-probe verdict is not trusted on its own, because one sample cannot tell
+ * a dead server from a blip. Three failed probes cost ~15s; one wrong verdict
+ * costs the run.
  */
 export declare class BackendDownError extends Error {
     readonly childName: string;
@@ -125,12 +124,16 @@ export interface PhaseRunResult {
 }
 export declare function childArgs(tools: string, extensions?: readonly string[], 
 /**
- * An already-resolved `['--thinking', level]`, or `[]` for "emit no flag".
- * Resolved by the CALLER, never here: the level is a property of the child's
- * ROLE, and this function is handed tools and extensions, not a name.
- * Omitted ⇒ byte-identical argv to the version before reasoning profiles.
+ * This child's group fragment: `--model` then `--thinking`, either half
+ * possibly absent. Resolved by the CALLER, never here — both are properties
+ * of the child's ROLE, and this function is handed tools and extensions, not
+ * a name. Omitted ⇒ byte-identical argv to the version before group profiles.
+ *
+ * ONE field rather than a `model` beside a `thinking`, because nothing may
+ * compose the two halves by hand: `groupChildArgs` is the only producer, so a
+ * doubled `--thinking` is unreachable rather than merely unlikely.
  */
-thinking?: readonly string[]): string[];
+groupArgs?: readonly string[]): string[];
 export declare const USER_CANCELLED = "__user_cancelled__";
 /**
  * Run a child pi process with JSON event-stream output, loop detection, and
@@ -175,10 +178,10 @@ export interface ChildRun {
      */
     contextWindow?: number;
     /**
-     * The resolved `['--thinking', level]` fragment for this child's reasoning
-     * group, or `[]`/omitted to inherit the session default as before.
+     * The resolved argv fragment for this child's group — `--model` then
+     * `--thinking` — or `[]`/omitted to inherit both defaults as before.
      */
-    thinking?: readonly string[];
+    groupArgs?: readonly string[];
     /**
      * This attempt's per-command ceiling, already halved for prior hangs by the
      * caller's strike loop. Omitted -> the `phase` row's full configured ceiling,
@@ -195,7 +198,7 @@ export interface ChildRun {
  * one — the mislabel class runDegradedFinalAttempt's own comment warns about.
  */
 export declare function phasePolicy(): WorkerGuardPolicy;
-export declare function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, thinking, commandCeilingMs }: ChildRun): Promise<PhaseRunResult>;
+export declare function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, groupArgs, commandCeilingMs }: ChildRun): Promise<PhaseRunResult>;
 export interface PhaseDeps {
     cwd: string;
     taskId: string;
@@ -337,15 +340,15 @@ export type PhaseSeams = Omit<PhaseDeps, 'cwd' | 'taskId' | 'signal' | 'onChildO
  * exit status describes our SIGTERM and says nothing about its verdict.
  */
 /**
- * The `--thinking` fragment for a named child, or `[]` when the name is unmapped.
+ * The group fragment for a named child, or `[]` when the name is unmapped.
  *
  * An unmapped name INHERITS rather than throwing: a child that reaches the model
  * with today's argv is always safe, and aborting a user's task over a missing
  * table row would be a worse failure than the one it reports. The guard that
- * makes the table complete is `reasoning-groups.test.ts`, which fails the BUILD —
+ * makes the table complete is `config/groups.test.ts`, which fails the BUILD —
  * where someone can actually fix it.
  */
-export declare function thinkingForChild(name: string): string[];
+export declare function groupArgsForChild(name: string): string[];
 export declare function runPhaseChild(deps: PhaseDeps, name: string, tools: string, prompt: string, opts?: PhaseChildOptions): Promise<string>;
 export declare function formatLoopHint(hit: LoopHit): string;
 /**

package/dist/task/child-runner.js

@@ -15,14 +15,15 @@ import { detectLeakedToolCall, leakedToolCallHint, MAX_LEAK_RETRIES } from '../s
 import { readSection, setTaskSection } from './task-io.js';
 import { streamStallCause } from '../shared/stream-watchdog.js';
 import { commandCeilingForAttempt, commandTimeoutHint, commandWatch } from '../shared/command-watchdog.js';
-import { discoverModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
+import { childModelEndpoints, probeModelEndpoints } from '../shared/model-endpoint.js';
+import { modelSpecFromArgs } from '../config/group-models.js';
 // VALUE import, and it is only safe because worker-profiles.ts reads its loop
 // constants from loop-detector.ts. Point those back at this file and the graph
 // closes into a TDZ ReferenceError that no compile step catches.
 import { workerPolicy } from '../workers/worker-profiles.js';
 import { getConfig } from '../config/config.js';
-import { groupThinkingArgs } from '../config/reasoning-args.js';
-import { reasoningGroupForChild } from '../config/reasoning.js';
+import { groupChildArgs, groupWindow } from '../config/group-args.js';
+import { groupForChild } from '../config/groups.js';
 // ─── Phase-child wall-clock cap ──────────────────────────────────────────────
 /**
  * Optional wall-clock bound on ONE spawn of a phase child. DEFAULT: OFF.
@@ -115,10 +116,11 @@ export function guardKillError(name, r, opts = {}) {
     if (r.commandKill)
         return new CommandTimeoutError(name, r.commandKill);
     // A dead-backend verdict is only trusted once every attempt has produced it.
-    // `discoverModelEndpoints` reads EVERY provider in models.json, not the one
-    // this child's model uses, so a stopped local server can condemn a run against
-    // a healthy cloud backend. The asymmetry settles it: a backend that really is
-    // down costs three 5s probes, a wrong verdict costs the whole run.
+    // The probe now asks about this child's own endpoint rather than ORing over
+    // every provider, so it is exact — but it is still one network call at one
+    // instant, and a blip is indistinguishable from a death in a single sample.
+    // The asymmetry settles it: a backend that really is down costs three 5s
+    // probes, a wrong verdict costs the whole run.
     if (r.stalled)
         return opts.finalAttempt === false ? null : new BackendDownError(name);
     return null;
@@ -127,10 +129,9 @@ export function guardKillError(name, r, opts = {}) {
  * The dead-backend probe killed a phase child on its LAST attempt.
  *
  * Reaching this means every attempt found no endpoint answering, not one. The
- * single-probe verdict is not trusted on its own: `discoverModelEndpoints` reads
- * every provider in models.json rather than the one this child's model uses, so a
- * stopped local server can condemn a run against a healthy cloud backend. Three
- * failed probes cost ~15s; one wrong verdict costs the run.
+ * single-probe verdict is not trusted on its own, because one sample cannot tell
+ * a dead server from a blip. Three failed probes cost ~15s; one wrong verdict
+ * costs the run.
  */
 export class BackendDownError extends Error {
     childName;
@@ -246,12 +247,16 @@ const defaultSleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
 // ─── Spawn helpers ───────────────────────────────────────────────────────────
 export function childArgs(tools, extensions = [], 
 /**
- * An already-resolved `['--thinking', level]`, or `[]` for "emit no flag".
- * Resolved by the CALLER, never here: the level is a property of the child's
- * ROLE, and this function is handed tools and extensions, not a name.
- * Omitted ⇒ byte-identical argv to the version before reasoning profiles.
+ * This child's group fragment: `--model` then `--thinking`, either half
+ * possibly absent. Resolved by the CALLER, never here — both are properties
+ * of the child's ROLE, and this function is handed tools and extensions, not
+ * a name. Omitted ⇒ byte-identical argv to the version before group profiles.
+ *
+ * ONE field rather than a `model` beside a `thinking`, because nothing may
+ * compose the two halves by hand: `groupChildArgs` is the only producer, so a
+ * doubled `--thinking` is unreachable rather than merely unlikely.
  */
-thinking = []) {
+groupArgs = []) {
     // `--mode json` puts the child into the structured event stream the
     // unified runner parses in `mode: 'json-events'`. Without it the child
     // emits plain text, every line fails JSON.parse, finalText stays empty,
@@ -273,7 +278,7 @@ thinking = []) {
     // one — the guards all hang off pi's `tool_call` hook.
     const toolFlags = tools === '' ? ['--no-tools'] : ['--tools', tools];
     const internal = tools === '' ? [] : extensions;
-    return [...childBaseArgs(internal), ...thinking, '--mode', 'json', ...toolFlags];
+    return [...childBaseArgs(internal), ...groupArgs, '--mode', 'json', ...toolFlags];
 }
 // Sentinel error thrown when the user dismisses a grill-me dialog.
 // Defined here (not in failure-classifier.ts) to avoid circular dependency.
@@ -292,8 +297,8 @@ export function phasePolicy() {
         streamInactivityMs: getConfig().streamInactivityMs
     });
 }
-export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, thinking, commandCeilingMs }) {
-    const invocation = getPiInvocation(childArgs(tools, extensions, thinking), prompt);
+export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUsage, onToolCall, spawn: spawnFn, extensions, onToolResult, contextWindow, groupArgs, commandCeilingMs }) {
+    const invocation = getPiInvocation(childArgs(tools, extensions, groupArgs), prompt);
     let loopHit;
     const guards = phasePolicy().guards;
     // Null when the user set the ceiling to `off`. Why a phase child needs this at
@@ -315,7 +320,7 @@ export async function runChild({ cwd, tools, prompt, signal, onLine, onContextUs
                     stall: {
                         afterMs: guards.stalled.afterMs,
                         probe: guards.stalled.probe
-                            ?? (() => probeModelEndpoints(discoverModelEndpoints()))
+                            ?? (() => probeModelEndpoints(childModelEndpoints(modelSpecFromArgs(groupArgs ?? []))))
                     }
                 }),
             onLine,
@@ -461,17 +466,17 @@ async function triageChildResult(deps, name, r, attempt, budget, verb) {
  * exit status describes our SIGTERM and says nothing about its verdict.
  */
 /**
- * The `--thinking` fragment for a named child, or `[]` when the name is unmapped.
+ * The group fragment for a named child, or `[]` when the name is unmapped.
  *
  * An unmapped name INHERITS rather than throwing: a child that reaches the model
  * with today's argv is always safe, and aborting a user's task over a missing
  * table row would be a worse failure than the one it reports. The guard that
- * makes the table complete is `reasoning-groups.test.ts`, which fails the BUILD —
+ * makes the table complete is `config/groups.test.ts`, which fails the BUILD —
  * where someone can actually fix it.
  */
-export function thinkingForChild(name) {
-    const group = reasoningGroupForChild(name);
-    return group ? groupThinkingArgs(group) : [];
+export function groupArgsForChild(name) {
+    const group = groupForChild(name);
+    return group ? groupChildArgs(group) : [];
 }
 /**
  * What a PHASE child's invocation carries, said once.
@@ -482,14 +487,29 @@ export function thinkingForChild(name) {
  * which is what the degrade's own comment ("the degrade changes the TOOLS, not
  * the role") claimed while three bare `undefined`s quietly made it false.
  */
-function phaseChildRun(deps, over) {
+/**
+ * The context window a child of this group runs against.
+ *
+ * The GROUP's window when this session resolved one, else the run's. Too small a
+ * window makes the churn rule fire early and kill a healthy child, so an
+ * `inherit` or unresolved group keeps the parent's number rather than a guess.
+ */
+function childContextWindow(deps, group) {
+    return (group === undefined ? undefined : groupWindow(group)) ?? deps.contextWindow;
+}
+function phaseChildRun(deps, 
+/** This child's group, for the window. Undefined ⇒ the run's own window. */
+group, over) {
     return {
         cwd: deps.cwd,
         onLine: deps.onChildOutput,
         onContextUsage: deps.onContextUsage,
         spawn: deps.spawn,
         extensions: deps.childExtensions,
-        contextWindow: deps.contextWindow,
+        // The GROUP's window when this session resolved one, else the run's.
+        // Too small a window makes the churn rule fire early and kill a healthy
+        // child, so an unresolved group keeps the parent's number.
+        contextWindow: (group === undefined ? undefined : groupWindow(group)) ?? deps.contextWindow,
         ...over
     };
 }
@@ -500,8 +520,9 @@ export async function runPhaseChild(deps, name, tools, prompt, opts = {}) {
     // between a loop-kill and its retry would otherwise make the two attempts
     // different experiments, and the retry exists to repeat the first one with a
     // hint. An unmapped name inherits, which is today's argv — the build-time
-    // guard for that is reasoning-groups.test.ts, not a throw in a user's run.
-    const thinking = thinkingForChild(name);
+    // guard for that is config/groups.test.ts, not a throw in a user's run.
+    const groupArgs = groupArgsForChild(name);
+    const group = groupForChild(name);
     const verb = opts.verb ?? 'retry';
     let hint = null;
     const loopHistory = [];
@@ -528,15 +549,21 @@ export async function runPhaseChild(deps, name, tools, prompt, opts = {}) {
         // context WINDOW, so a detector that waited to be told one would sit at 0,
         // and the churn rule returns false on a non-positive window. The parent
         // knows the value at spawn time — say it then, not later.
-        stall?.noteContext(deps.contextWindow ?? 0);
+        //
+        // The SAME number the child is handed below. Arming it from the run's
+        // window while the child runs on a bigger model's would judge the child
+        // against a window it does not have, for exactly the stretch before the
+        // first `context_usage` event corrects it — which is the stretch this
+        // line exists to cover.
+        stall?.noteContext(childContextWindow(deps, group) ?? 0);
         const clock = phaseTimeout(deps.signal, budgetMs);
         let r;
         try {
-            r = await runChild(phaseChildRun(deps, {
+            r = await runChild(phaseChildRun(deps, group, {
                 tools,
                 prompt: prependHint(hint, prompt),
                 signal: clock.signal,
-                thinking,
+                groupArgs,
                 onContextUsage: snapshot => {
                     // Real window or nothing: `noteContext` ignores 0, which is
                     // why the parent's value must be supplied at spawn — a
@@ -691,14 +718,15 @@ async function runDegradedFinalAttempt(deps, name, prompt, hit, loopHistory) {
     const clock = phaseTimeout(deps.signal, deps.timeoutMs ?? PHASE_CHILD_TIMEOUT_MS);
     let r;
     try {
-        r = await runChild(phaseChildRun(deps, {
+        r = await runChild(phaseChildRun(deps, groupForChild(name), {
             tools: '', // --no-tools: the model cannot read/grep/list, only answer
             prompt: prependHint(formatDegradeHint(hit), prompt),
             signal: clock.signal,
             // Same group as the attempts that led here. The degrade changes the
-            // TOOLS, not the role — running it at a different thinking level would
-            // make the fallback a different experiment from the thing it rescues.
-            thinking: thinkingForChild(name)
+            // TOOLS, not the role — running it on a different model, or at a
+            // different thinking level, would make the fallback a different
+            // experiment from the thing it rescues.
+            groupArgs: groupArgsForChild(name)
         }));
     }
     finally {

package/dist/task/context-usage.d.ts

@@ -5,6 +5,8 @@
  * directly, because its state is the whole-run `WidgetState`, not one child's.
  */
 import type { ContextSnapshot } from '../shared/child-process.js';
+import { type PiTaskConfig } from '../config/config.js';
+import type { ChildGroup } from '../config/groups.js';
 /**
  * The parent session's context window, or 0 when the model doesn't expose it.
  *
@@ -22,6 +24,50 @@ export declare function getParentContextWindow(ctx: {
         contextWindow?: number;
     };
 }): number;
+/**
+ * The window for the model ONE GROUP's children will actually run on.
+ *
+ * This number drives the widget and, more importantly, `StallDetector`'s
+ * context-churn rule, and the two error directions are not symmetric. A parent
+ * window LARGER than the child's makes churn fire late — degraded, and the
+ * no-new-ground rule still covers it. A parent window SMALLER makes churn fire
+ * early and KILL A HEALTHY CHILD. A big-context research model under a small
+ * host model is a real false positive, which is why this exists at all.
+ *
+ * For the same reason there is no `min(parent, group)`: that would import the
+ * dangerous direction on purpose.
+ *
+ * `inherit`, an unresolvable spec, or a model with no declared window all return
+ * exactly `getParentContextWindow(ctx)` — byte-identical to the behaviour before
+ * per-group models existed.
+ *
+ * Callers WITHOUT a ctx read `groupWindow` from config/group-args.ts instead,
+ * which the session pass fills from this. One producer, so the two views cannot
+ * describe different models.
+ */
+export declare function contextWindowForGroup(ctx: {
+    model?: {
+        contextWindow?: number;
+    };
+    modelRegistry?: {
+        find: (p: string, i: string) => unknown;
+    };
+}, group: ChildGroup, cfg?: PiTaskConfig): number;
+/**
+ * The same answer for a spec the caller already has.
+ *
+ * The session pass needs this: it walks an INJECTED spec table, and reaching for
+ * `getConfig()` here would let the window it stores describe a different model
+ * from the one it just checked.
+ */
+export declare function contextWindowForSpec(ctx: {
+    model?: {
+        contextWindow?: number;
+    };
+    modelRegistry?: {
+        find: (p: string, i: string) => unknown;
+    };
+}, spec: string): number;
 /**
  * Fold a raw context snapshot into a display snapshot: prefer the child's own
  * contextWindow, else the last known one, else the parent session's; then derive