agent-nuvira 2.7.2 → 3.0.0

package/dist/cli/chat.js

@@ -16,29 +16,35 @@ import { getMemoryManager } from '../memory/manager.js';
 import { logger } from '../utils/logger.js';
 import { printOrchestrationResult } from './execute.js';
 import { applyActiveModel } from './model.js';
-import { getProviderFallback, classifyFallbackError, isRetryableError, recordRegistrySuccess } from '../learning/provider-fallback.js';
-import { recordActionFailure, TRANSIENT_FAILURE_EXCLUSION_MS } from '../learning/failure-bookkeeping.js';
+import { getProviderFallback, classifyFallbackError, isRetryableError, isTransientForRetry, recordRegistrySuccess } from '../learning/provider-fallback.js';
+import { recordActionFailure } from '../learning/failure-bookkeeping.js';
+import { resolveThreadBudgetChars } from '../learning/context-budget.js';
 import { getAutoRouter, isAutoModel, isAutoProvider } from '../learning/auto-router.js';
 import { estimateTokens } from '../learning/cost-tracker.js';
 import { getModelRegistry } from '../learning/model-registry.js';
-import { refreshModelRegistry, spotCheckModel } from '../inference/model-probe.js';
+import { refreshModelRegistry } from '../inference/model-probe.js';
 import { recordRoutingDecision } from '../learning/routing-history.js';
 import { shouldConfirmFailover, promptFailoverChoice } from './failover-prompt.js';
 import { buildAutoResolveOptions } from '../learning/resolve-options.js';
+import { buildDeepFailoverPool, createFailoverExclusionFilter } from '../learning/resilient-call.js';
 import { parseRequestSync } from '../nlu/parser.js';
 import { PlanStore } from '../tools/plan-store.js';
 import { withLogCorrelation } from '../enterprise/log.js';
 import { recordMetricTime, getMetrics } from '../enterprise/metrics.js';
 import { resolveDispatch } from '../nlu/actions.js';
-import { isConversationalQuestion, hasCodingAction } from '../nlu/conversation-gate.js';
+import { hasCodingAction, resolveAskKind } from '../nlu/conversation-gate.js';
 import { runToolLoop, extractFallbackToolCalls } from '../tools/tool-loop.js';
-import { looksLikeConfusedScaffoldingReply } from '../inference/tool-call-utils.js';
+import { looksLikeConfusedScaffoldingReply, toUserFacingGenerationError, isToolCallingUnsupported, } from '../inference/tool-call-utils.js';
 import { beginTrace, endTrace, recordStep } from '../learning/reasoning-trace.js';
 import { getLoopExposureMode } from '../tools/toolsets.js';
+import { resolveModelHarnessProfile, shouldSkipNativeTools } from '../learning/model-harness.js';
+import { resolveAdapterDefault } from '../learning/model-selection.js';
 import { buildLoopProjectContext } from '../tools/loop-project-context.js';
+import { sweepTransientFailures, collectionRevivalStore } from '../learning/provider-revival.js';
 import { analyzeComplexity } from '../learning/hybrid-router.js';
 import { routingCacheSignature, withRoutingCache } from '../learning/routing-cache.js';
 import { getTool, TOOL_CONTRACT_JSON } from '../tools/registry.js';
+import { buildFollowupContinuationPrompt, isSuggestedFollowup, } from '../tools/followup-utils.js';
 // S2/S3 — the shared tool-call reliability helpers (salvage failed_generation,
 // compact fallback schemas). One copy for every tool-calling surface, not
 // chat-private (execute/plan/… inherit the fix).
@@ -167,7 +173,11 @@ export function resolvePipelineDispatch(parsed, opts) {
     //    NLU alone would misread it as chat ("how do I add JWT auth?" → explain
     //    → chat, but the user wants the auth added).
     if (opts?.text) {
-        if (isConversationalQuestion(opts.text)) {
+        // ONE shared rule for every surface (see resolveAskKind): a genuine
+        // question never dispatches; a coding verb in command position always
+        // does. Keeping the gateway on this same function is what stops the two
+        // from disagreeing about the same ask.
+        if (resolveAskKind(opts.text, parsed) === 'chat') {
             return { dispatch: false, needConfirm: false };
         }
         if (hasCodingAction(opts.text)) {
@@ -216,6 +226,41 @@ export async function runDeveloperMode(goal, configManager, options) {
  * (rules act only as the no-model fallback in the
  * caller, never to skip the loop).
  */
+/**
+ * Backoff schedule for a SAME-provider retry on a transient failure. Two extra
+ * attempts, deliberately short: a capacity spike at a shared endpoint clears in
+ * seconds, and the user is waiting in the foreground. Long/looping retries belong
+ * to the background runners, not the interactive turn.
+ */
+export const TRANSIENT_RETRY_DELAYS_MS = [1_000, 3_000];
+/**
+ * Run one provider attempt, retrying transient failures against the SAME
+ * provider before giving up.
+ *
+ * Why this exists next to the failover walk rather than inside it: the walk
+ * needs a DIFFERENT provider to exist, and it books the failure against the one
+ * that just failed. Verified live — a single configured provider plus a Gemini
+ * 503 meant no retry at all, the circuit breaker parked the provider for 120s,
+ * and the agent degraded to editing with zero gathered context. A transient
+ * spike must cost a few seconds, not the whole task.
+ *
+ * Never retries: non-transient classes (auth, rate-limit, model/harness faults),
+ * a cancelled turn, or once the schedule is exhausted.
+ */
+export async function generateWithTransientRetry(attempt, signal, onRetry) {
+    for (let i = 0;; i += 1) {
+        try {
+            return await attempt();
+        }
+        catch (err) {
+            const canRetry = i < TRANSIENT_RETRY_DELAYS_MS.length && isTransientForRetry(err);
+            if (!canRetry || signal?.aborted)
+                throw err;
+            onRetry?.(i + 1, err);
+            await new Promise((resolve) => setTimeout(resolve, TRANSIENT_RETRY_DELAYS_MS[i]));
+        }
+    }
+}
 function buildToolSystemPrompt(parsed) {
     return [
         "You are Nuvira, Agent-Nuvira's AI agent. You code, create, write, analyze, and automate — anything the user needs. You identify as Nuvira (never 'Buff').",
@@ -261,6 +306,17 @@ export class ChatCommand extends BaseCommand {
      * Cleared when the chat exits.
      */
     sessionFailedProviders = new Map();
+    /**
+     * `provider|model` → expiry of a MODEL-scoped session exclusion.
+     *
+     * A 429 on ONE model now records HERE rather than in sessionFailedProviders:
+     * free tiers meter per-model (RPD/TPM), so excluding the whole provider is
+     * what stopped chat from ever reaching a provider's 2nd-best model. Siblings
+     * of the failed model stay routable; the failure only escalates to the
+     * provider-wide map when several distinct models of that provider are
+     * rate-limited (a genuinely shared limit).
+     */
+    sessionFailedModels = new Map();
     // RATE_LIMIT_EXCLUSION_MS + TRANSIENT_FAILURE_EXCLUSION_MS now live in
     // src/learning/failure-bookkeeping.ts (shared with every action) — see
     // recordActionFailure. Behavior is identical: same values, same semantics.
@@ -296,7 +352,13 @@ export class ChatCommand extends BaseCommand {
      * carries prior turns so the dashboard threads a real conversation.
      */
     async answerOnce(message, opts = {}) {
-        const activeOpts = applyActiveModel({ provider: opts.provider, model: opts.model });
+        // `'default'` is the config SENTINEL for "use the provider's default
+        // model", never a real model id. Left in place it (a) disables auto routing
+        // (isAutoModel('default') is false) and (b) is truthy, so the adapter's
+        // `options?.model || requireAdapterModel(...)` fallback is skipped and the
+        // literal string 'default' reaches the provider → "model not found".
+        const requestedModel = opts.model && opts.model !== 'default' ? opts.model : undefined;
+        const activeOpts = applyActiveModel({ provider: opts.provider, model: requestedModel });
         const mergedOpts = { ...opts, provider: activeOpts.provider, model: activeOpts.model };
         let autoMode = isAutoModel(mergedOpts.model) || isAutoProvider(mergedOpts.provider);
         let { type, provider } = autoMode
@@ -333,7 +395,7 @@ export class ChatCommand extends BaseCommand {
         }
         const parsed = parseRequestSync(message);
         const dispatchDecision = resolvePipelineDispatch(parsed, { dev: opts.dev, text: message });
-        const answer = await this.runChatAnswer(message, opts.history ?? [], { type, provider, model }, { provider: mergedOpts.provider, model: mergedOpts.model, dev: mergedOpts.dev, cache: true }, true, { auto: autoMode }, parsed, { askUser: opts.askUser, onProgress: opts.onProgress, onToolCall: opts.onToolCall, onPlanChange: opts.onPlanChange, onGitDiff: opts.onGitDiff, onSkillDraft: opts.onSkillDraft, planStore: opts.planStore ?? this.planStore, gateway: opts.gateway, projectContext: opts.projectContext, recallContext: recallBlock, projectPath: opts.projectPath, onToken: opts.onToken, signal: opts.signal });
+        const answer = await this.runChatAnswer(message, opts.history ?? [], { type, provider, model }, { provider: mergedOpts.provider, model: mergedOpts.model, dev: mergedOpts.dev, cache: true }, true, { auto: autoMode }, parsed, { askUser: opts.askUser, onProgress: opts.onProgress, onToolCall: opts.onToolCall, onPlanChange: opts.onPlanChange, onGitDiff: opts.onGitDiff, onSkillDraft: opts.onSkillDraft, planStore: opts.planStore ?? this.planStore, gateway: opts.gateway, projectContext: opts.projectContext, recallContext: recallBlock, projectPath: opts.projectPath, onToken: opts.onToken, signal: opts.signal, continuation: opts.continuation });
         // No-model fallback: the tool loop could not generate a single response
         // AND the rules assessed a high-confidence pipeline intent — run the
         // pipeline directly (rules decide only when the model is unavailable; the
@@ -504,10 +566,14 @@ export class ChatCommand extends BaseCommand {
                 const picked = await this.renderFollowups(singleAnswer.followups ?? [], true);
                 if (!picked)
                     break;
-                const next = await this.runChatAnswer(picked, history, { type, provider, model }, options || {}, cacheEnabled, { auto: autoMode }, parseRequestSync(picked));
+                const next = await this.runChatAnswer(picked, history, { type, provider, model }, options || {}, cacheEnabled, { auto: autoMode }, parseRequestSync(picked), 
+                // P5 — a picked followup continues the previous execution.
+                { continuation: true });
                 if (next.content.trim()) {
                     console.log('\n' + next.content + '\n');
-                    history.push({ role: 'assistant', content: next.content });
+                    // NOTE: no history.push here — runChatAnswer already recorded the
+                    // assistant turn. The old duplicate push gave every subsequent turn
+                    // TWO copies of the previous answer (relevance noise).
                 }
                 singleAnswer = next;
             }
@@ -529,8 +595,13 @@ export class ChatCommand extends BaseCommand {
             await maybeRunBackgroundDuties(this.configManager).catch(() => { });
         }
         let pendingMessage;
+        // P5 — the followups the agent just suggested, so a message that MATCHES
+        // one of them (a clicked chip, or the user re-typing it on the gateway) is
+        // recognised as a continuation of the previous execution.
+        let lastFollowups = [];
         while (true) {
             // E3b: a chosen follow-up recommendation becomes the next message.
+            const pickedFollowup = pendingMessage !== undefined;
             const message = pendingMessage ?? (await this.readMultiLineInput('You:'));
             pendingMessage = undefined;
             if (!message)
@@ -584,7 +655,10 @@ export class ChatCommand extends BaseCommand {
             const parsed = recordMetricTime('rule.parse.ms', () => parseRequestSync(message));
             const dispatchDecision = recordMetricTime('rule.dispatch.ms', () => resolvePipelineDispatch(parsed, { dev: this.devModeAuto, text: message }));
             const session = { type, provider, model: effectiveModel };
-            const answer = await withLogCorrelation({ sessionId: chatSessionId }, () => recordMetricTime('llm.answer.ms', () => this.runChatAnswer(message, history, session, options || {}, cacheEnabled, { auto: autoMode }, parsed)));
+            const answer = await withLogCorrelation({ sessionId: chatSessionId }, () => recordMetricTime('llm.answer.ms', () => this.runChatAnswer(message, history, session, options || {}, cacheEnabled, { auto: autoMode }, parsed, 
+            // P5 — a picked followup (or a typed one that matches the last
+            // suggestions) is a continuation, not a fresh independent request.
+            { continuation: pickedFollowup || isSuggestedFollowup(message, lastFollowups) })));
             // No-model fallback: the tool loop could not generate a single response
             // AND the rules assessed a high-confidence pipeline intent — run the
             // pipeline directly (rules decide only when the model is unavailable).
@@ -605,7 +679,8 @@ export class ChatCommand extends BaseCommand {
             if (answer.content.trim()) {
                 console.log('\n' + answer.content + '\n');
             }
-            const followupPrompt = await this.renderFollowups(answer.followups ?? [], true);
+            lastFollowups = answer.followups ?? [];
+            const followupPrompt = await this.renderFollowups(lastFollowups, true);
             if (followupPrompt) {
                 pendingMessage = followupPrompt;
             }
@@ -685,9 +760,10 @@ export class ChatCommand extends BaseCommand {
     async runChatAnswer(message, history, session, options, cacheEnabled, mode, parsed, ctxOverrides) {
         // Cache check first (same as the legacy path).
         const cache = getCache();
+        const cacheModel = this.cacheModelFor(session);
         if (cacheEnabled) {
             try {
-                const cachedResult = await cache.get(message, session.model ?? 'default', session.type);
+                const cachedResult = await cache.get(message, cacheModel, session.type);
                 if (cachedResult) {
                     // NOTE: the cached answer is NOT printed here — the caller prints
                     // content AFTER runChatAnswer returns (answer-first ordering). A
@@ -789,7 +865,11 @@ export class ChatCommand extends BaseCommand {
                 role: (h.role === 'assistant' ? 'assistant' : 'user'),
                 content: h.content,
             })),
-            { role: 'user', content: message },
+            // P5 — a picked followup reaches the model WITH the continuation marker
+            // (the raw text stays in history), so "add a day in Hanoi" is resolved
+            // against the plan the previous turn just produced instead of being read
+            // as a brand-new request.
+            { role: 'user', content: ctxOverrides?.continuation ? buildFollowupContinuationPrompt(message) : message },
         ];
         // I3: one artifact session per TURN — every tool
         // deliverable in this turn lands in the same store folder.
@@ -922,13 +1002,26 @@ export class ChatCommand extends BaseCommand {
             }
         };
         try {
+            // R1 — the harness follows the MODEL, not only the config: config says
+            // what this deployment prefers, the profile decides what this model can
+            // actually use (a 0.5B local model must not get a 120B's surface).
+            const harness = resolveModelHarnessProfile({
+                model: session.model,
+                configExposure: getLoopExposureMode(this.configManager),
+            });
             result = await runToolLoop({
                 messages: thread,
                 context: toolContext,
                 maxSteps: 16,
-                // Tiered tool exposure — config-gated (tools.loopExposure), default
-                // 'all' = unchanged behavior until Phase 0 evals justify the flip.
-                toolExposure: getLoopExposureMode(this.configManager),
+                // Model-window-aware thread budget: a 1M-token model keeps its window
+                // instead of being trimmed to the fixed ~50K-token default. Undefined
+                // (unknown window) leaves the tool-loop default untouched.
+                threadBudgetChars: resolveThreadBudgetChars({ provider: session.type, model: session.model }),
+                // Tiered tool exposure — the tiered (core) set starts at ~16 schemas
+                // (~3.8K tokens/step); 'all' hands over the full set (~17K tokens/step)
+                // and is now additionally gated on the model having the context for it.
+                toolExposure: harness.exposure,
+                maxParallelReads: harness.maxParallelReads,
                 onToken: ctxOverrides?.onToken,
                 signal: ctxOverrides?.signal,
                 deps: {
@@ -959,7 +1052,9 @@ export class ChatCommand extends BaseCommand {
             logger.error(String(err));
             endTrace(chatTraceId, false);
             result = {
-                content: `I ran into a problem: ${err instanceof Error ? err.message : String(err)}`,
+                // Sanitized on purpose: this content is delivered verbatim by every
+                // surface (CLI print, dashboard bubble, gateway send).
+                content: toUserFacingGenerationError(err),
                 followups: [],
                 toolCalls: [],
                 steps: 0,
@@ -976,7 +1071,11 @@ export class ChatCommand extends BaseCommand {
         if (result.content.trim() && !result.generationFailed && !result.cancelled) {
             if (cacheEnabled) {
                 try {
-                    await cache.set(message, result.content, session.model ?? 'default', session.type);
+                    // Keyed by the model that ACTUALLY answered (tryGenerate records it
+                    // on success), so a weak model's reply is never replayed as a strong
+                    // model's. `cacheModel` is the pre-flight fallback for the paths that
+                    // never resolve one (e.g. a cached-hit turn).
+                    await cache.set(message, result.content, this.cacheModelFor(session) || cacheModel, session.type);
                 }
                 catch {
                     // Best-effort.
@@ -1008,13 +1107,83 @@ export class ChatCommand extends BaseCommand {
      * broken provider never crashes the turn (it answers from the next working
      * candidate, exactly like the legacy generation block).
      */
+    /**
+     * The model id used in the response-cache key.
+     *
+     * NEVER returns the `'default'` sentinel (or an empty string). Keying the
+     * cache on `'default'` — which is what `session.model ?? 'default'` did —
+     * collapsed EVERY model of a provider into a single entry (observed live:
+     * `cache.json` held `provider: gemini, model: "default"`). Two consequences,
+     * both real: an answer produced by a weak model was replayed as though a
+     * strong one had written it, and switching `nuvira model switch` could never
+     * take effect for a message already cached. Falls back to the provider's
+     * effective model, then to a provider-qualified marker so distinct providers
+     * still never collide.
+     */
+    cacheModelFor(session) {
+        if (session.model && session.model !== 'default')
+            return session.model;
+        try {
+            const providers = this.configManager.getAll().providers;
+            return resolveAdapterDefault(session.type, providers?.[session.type]?.model) ?? `${session.type}:unresolved`;
+        }
+        catch {
+            return `${session.type}:unresolved`;
+        }
+    }
     buildToolCallModel(message, session, options, mode, onToken, signal) {
         return async (messages, schemas, stepOnToken, stepSignal) => {
             // The effective token sink: the caller's stream wins; when a step-level
             // sink is also given (loop passthrough) they are the same channel.
             const sink = stepOnToken ?? onToken;
             const abort = stepSignal ?? signal;
+            /**
+             * The CONCRETE model an attempt will use.
+             *
+             * `session.model` is undefined or the `'default'` sentinel whenever the
+             * router picks a provider but no single model (which is the common auto
+             * case). That value used to flow into four places at once — the provider
+             * request, the reasoning trace, registry telemetry and the response
+             * cache key — so traces read `model: unknown`, the literal `default`
+             * reached provider APIs (`The model \`default\` does not exist`, observed
+             * live), and EVERY model of a provider shared one cache entry (a bad
+             * answer produced by a weak model was then replayed as if it came from a
+             * good one). Resolving here keeps all four on the same real model id.
+             * Falls back to undefined only when nothing can be resolved, which leaves
+             * the adapter's own last-resort resolution in charge.
+             */
+            /**
+             * Per-turn memo of candidates that REJECTED native tool calling, keyed by
+             * `provider|model`. Once a model has answered "tool calling is not
+             * supported", it can never start supporting it within this turn, so
+             * re-issuing the native call is pure waste — the live execute run paid 13
+             * failing native requests (one per step) before each fell back to the
+             * JSON transport, burning the provider's rate limit for nothing.
+             * Keyed per candidate on purpose: a DIFFERENT model that does support
+             * native tools must still get them, so a failover re-enables the fast
+             * path automatically.
+             */
+            const nativeToolsRejected = new Set();
+            const resolveEffectiveModel = (providerType, requested) => {
+                if (requested && requested !== 'default')
+                    return requested;
+                try {
+                    const providers = this.configManager.getAll().providers;
+                    return resolveAdapterDefault(providerType, providers?.[providerType]?.model);
+                }
+                catch {
+                    return undefined;
+                }
+            };
             const tryGenerate = async (prov, typ, mdl) => {
+                // One resolution per attempt — the request, the trace, the telemetry
+                // and the cache key all read the same value (see above).
+                const effectiveModel = resolveEffectiveModel(typ, mdl);
+                // Record the ATTEMPTED model immediately so a failed step's trace and
+                // telemetry name the model that failed, instead of "unknown".
+                if (effectiveModel)
+                    session.model = effectiveModel;
+                const nativeKey = `${typ}|${effectiveModel ?? ''}`;
                 // Answer-quality resilience: a CONFUSED reply — the model talking about
                 // the tool contract (e.g. apologizing that "the provided example call
                 // to suggest_followups is incomplete") instead of executing it — never
@@ -1030,22 +1199,35 @@ export class ChatCommand extends BaseCommand {
                         throw err;
                     }
                 };
-                if (typeof prov.generateTools === 'function' && schemas.length > 0) {
+                /** Mark the model that actually produced this response. */
+                const answered = (resp) => {
+                    if (effectiveModel)
+                        session.model = effectiveModel;
+                    return resp;
+                };
+                // R1 — deterministic transport. A tiny model cannot use a native tool
+                // API, and finding that out by trying cost a 400 on every turn (the
+                // refusal memo is per-call). Unknown families are untouched: they still
+                // try native and fall back, so nothing that works today stops working.
+                if (shouldSkipNativeTools({ model: effectiveModel })) {
+                    nativeToolsRejected.add(nativeKey);
+                }
+                if (!nativeToolsRejected.has(nativeKey) && typeof prov.generateTools === 'function' && schemas.length > 0) {
                     try {
                         // P4 — stream when the provider supports it AND a sink is wired
                         // (the dashboard); otherwise the one-shot path with the whole
                         // content delivered as a single chunk so the typewriter channel
                         // still receives the answer (appears at once — today's behavior).
                         if (sink && typeof prov.generateToolsStream === 'function') {
-                            const result = await prov.generateToolsStream(messages, schemas, { ...options, model: mdl, signal: abort }, sink);
+                            const result = await prov.generateToolsStream(messages, schemas, { ...options, model: effectiveModel, signal: abort }, sink);
                             confuseCheck(result.content);
-                            return result;
+                            return answered(result);
                         }
-                        const result = await prov.generateTools(messages, schemas, { ...options, model: mdl, signal: abort });
+                        const result = await prov.generateTools(messages, schemas, { ...options, model: effectiveModel, signal: abort });
                         confuseCheck(result.content);
                         if (sink && result.content)
                             sink(result.content);
-                        return result;
+                        return answered(result);
                     }
                     catch (err) {
                         // S3: a tool-call 400 often carries the model's COMPLETE answer in
@@ -1064,9 +1246,23 @@ export class ChatCommand extends BaseCommand {
                             const toolCalls = salvaged.followups?.length
                                 ? [{ id: 'call_salvage_1', name: 'suggest_followups', arguments: { followups: salvaged.followups } }]
                                 : [];
-                            return { content: salvaged.content, toolCalls };
+                            return answered({ content: salvaged.content, toolCalls });
+                        }
+                        // The MODEL itself cannot do native tool calling — Groq answers
+                        // 400 "`tool calling` is not supported with this model". That is
+                        // not a reason to lose the turn: the loop already ships a transport
+                        // that needs no provider tool support, and the system prompt
+                        // carries the tool contract for it. Fall THROUGH to it (no throw)
+                        // so an otherwise-good model still answers.
+                        if (isToolCallingUnsupported(err)) {
+                            // Remember it for the REST of this turn so later steps go straight
+                            // to the JSON transport instead of re-paying the failing call.
+                            nativeToolsRejected.add(nativeKey);
+                            logger.warn('   ⚠️ Model does not support native tool calling — retrying this step over the JSON tool transport.');
+                        }
+                        else {
+                            throw err;
                         }
-                        throw err;
                     }
                 }
                 // JSON fallback transport: flatten the thread into one prompt with
@@ -1076,18 +1272,22 @@ export class ChatCommand extends BaseCommand {
                 let raw;
                 if (typeof prov.generateStream === 'function') {
                     const chunks = [];
-                    await prov.generateStream(prompt, { ...options, model: mdl, signal: abort }, (t) => chunks.push(t));
+                    await prov.generateStream(prompt, { ...options, model: effectiveModel, signal: abort }, (t) => chunks.push(t));
                     raw = chunks.join('');
                 }
                 else {
-                    raw = await prov.generate(prompt, { ...options, model: mdl, signal: abort });
+                    raw = await prov.generate(prompt, { ...options, model: effectiveModel, signal: abort });
                 }
                 const { text, calls } = extractFallbackToolCalls(raw);
                 confuseCheck(text);
-                return { content: text, toolCalls: calls };
+                return answered({ content: text, toolCalls: calls });
             };
             try {
-                return await tryGenerate(session.provider, session.type, session.model);
+                // Same-provider transient retry FIRST (see the helper's contract): a
+                // 503 spike at a shared endpoint must not become a dead run. Failover
+                // only helps if a DIFFERENT provider exists — and it also hides the real
+                // failure from the user while parking a healthy provider for 120s.
+                return await generateWithTransientRetry(() => tryGenerate(session.provider, session.type, session.model), abort, (attempt, err) => logger.warn(`   ⏳ ${session.provider.name} transient failure (attempt ${attempt}) — retrying shortly: ${err instanceof Error ? err.message.split('\n')[0] : String(err)}`));
             }
             catch (err) {
                 // Auto mode: fail over across the ranked candidates (never stuck).
@@ -1131,7 +1331,11 @@ export class ChatCommand extends BaseCommand {
                             const resp = await tryGenerate(next.provider, next.type, next.model);
                             session.type = next.type;
                             session.provider = next.provider;
-                            session.model = next.model;
+                            // Keep the model that actually answered: `next.model` is often
+                            // undefined ("provider default"), and assigning it here used to
+                            // erase the resolved id that tryGenerate just recorded.
+                            if (next.model && next.model !== 'default')
+                                session.model = next.model;
                             logger.success(`✅ Auto failover: answered from ${next.provider.name} (${next.model}) after ${firstType} failed`);
                             return resp;
                         }
@@ -1166,10 +1370,22 @@ export class ChatCommand extends BaseCommand {
                 // deliver THAT instead of failing the whole turn. A confusing answer
                 // still beats an error banner in a messaging app; the confusion is
                 // now also visible in the chat trace for post-mortem.
+                // The old behavior here — DELIVER the confused reply as if it were the
+                // answer (`return { content: confusedReply }`) — was the worst of both
+                // worlds. It shipped contract meta-talk to the sender ("Sure, I can
+                // help you with suggestions and followups. Please provide me with more
+                // details…") AND marked the turn a SUCCESS, so the loop cached it for
+                // an hour and every retry inside that window replayed the same
+                // deflection. Live evidence: that exact string sat in
+                // ~/.nuvira/cache.json with `model: "default"`.
+                //
+                // Now it stays a FAILURE: rethrow so the tool loop surfaces the
+                // sanitized, user-facing line with `generationFailed: true` (never
+                // cached, never persisted), while the raw reply is preserved in the
+                // log and the reasoning trace for post-mortem.
                 const confusedReply = err.confusedReply;
                 if (typeof confusedReply === 'string' && confusedReply.trim()) {
-                    logger.warn('   ⚠️ No alternative model answered — delivering the raw reply (contract-confusion fallback).');
-                    return { content: confusedReply, toolCalls: [] };
+                    logger.warn(`   ⚠️ No alternative model answered — contract-confusion reply suppressed (${confusedReply.length} chars, kept in the trace): ${confusedReply.slice(0, 160)}`);
                 }
                 throw err;
             }
@@ -1260,6 +1476,9 @@ export class ChatCommand extends BaseCommand {
         recordActionFailure({
             sessionFailedProviders: this.sessionFailedProviders,
             sessionTransientFailedProviders: this.sessionTransientFailedProviders,
+            // Model tracking ON: a rate-limit on one model excludes THAT model and
+            // leaves the provider's siblings routable (per-model RPD/TPM limits).
+            sessionFailedModels: this.sessionFailedModels,
         }, providerType, err, this.configManager, { model, action: 'chat', apiKey });
     }
     async showModelPicker() {
@@ -1377,37 +1596,15 @@ export class ChatCommand extends BaseCommand {
         // registry may still mark it unavailable (learned from the failure), and
         // blindly re-admitting would fail again on the very next message. Recovery
         // is discovered in SECONDS (a 1-token spot-check), not by re-failing.
-        // NOTE: iterate a SNAPSHOT — the loop mutates the set (delete + re-add),
-        // and Set iteration can revisit a re-added key, double-spot-checking.
-        // Bounded: at most one spot-check per provider per 60s (the exclusion is
-        // re-armed on failure), and only for registry-blocked providers.
-        for (const providerType of [...this.sessionTransientFailedProviders]) {
-            const expiresAt = this.sessionFailedProviders.get(providerType);
-            // Skip still-active exclusions and already-cleared providers.
-            if (expiresAt !== undefined && expiresAt > exclusionTime)
-                continue;
-            this.sessionTransientFailedProviders.delete(providerType);
-            this.sessionFailedProviders.delete(providerType);
-            try {
-                const registry = getModelRegistry();
-                // Only re-verify when the registry still believes the provider is dead
-                // (unavailable/parked) — a healthy entry means it recovered already.
-                if (!registry.getBlockedProviders().includes(providerType))
-                    continue;
-                const desired = getAutoRouter().resolveModel(providerType, 'chat', this.configManager);
-                const outcome = await spotCheckModel(providerType, desired, this.configManager);
-                // 'skipped' = the model was VERIFIED recently (within the spot-check
-                // throttle) — that's healthy, so treat it as a pass too.
-                if (outcome !== 'verified' && outcome !== 'skipped') {
-                    // Still down — keep it excluded for another transient window.
-                    this.sessionFailedProviders.set(providerType, Date.now() + TRANSIENT_FAILURE_EXCLUSION_MS);
-                    this.sessionTransientFailedProviders.add(providerType);
-                }
-            }
-            catch {
-                // Best-effort — re-verification must never break routing.
-            }
-        }
+        // The sweep itself now lives in `learning/provider-revival.ts` so every
+        // entry path shares ONE implementation (chat was previously the only path
+        // that read the transient-failure marker at all — the orchestrator, edit,
+        // execute, plan and resilient-call allocated it and never acted on it, so a
+        // recovered provider stayed excluded for the rest of their runs).
+        await sweepTransientFailures({
+            ...collectionRevivalStore(this.sessionFailedProviders, this.sessionTransientFailedProviders),
+            resolveProbeModel: (provider) => getAutoRouter().resolveModel(provider, 'chat', this.configManager),
+        }, this.configManager, { agentType: 'chat' });
         const excluded = new Set([
             ...excludeProviders,
             ...[...this.sessionFailedProviders.keys()].filter((p) => isActiveExclusion(p)),
@@ -1424,30 +1621,79 @@ export class ChatCommand extends BaseCommand {
         catch {
             // Best-effort — registry bookkeeping must never break routing
         }
-        const candidates = [
-            decision.provider,
-            ...decision.ranked
-                .filter((r) => r.provider !== decision.provider)
-                .map((r) => r.provider),
-        ].filter((p) => !excluded.has(p) && !registryBlocked.has(p));
-        for (const candidate of candidates) {
+        // ── DEEP FAILOVER candidate list: {provider, model} PAIRS ──────────────
+        // Several models PER PROVIDER, so a 429 on one model retries the SAME
+        // provider's next-best model before abandoning it. The previous
+        // provider-only list meant chat could only ever reach a single model per
+        // provider no matter how many that provider actually served (free tiers
+        // meter per-model, so the siblings were very often usable).
+        // Model-scoped exclusions come from the SAME predicate the orchestrator's
+        // resilient walk uses. Cross-pipeline persistence is OFF here (chat's own
+        // session accounting is the authority for an interactive turn) and the
+        // registry check is OFF because `resolveWorkingModel` below OWNS per-model
+        // repair; the provider-wide `registryBlocked` pre-filter above already
+        // removes dead providers.
+        const isModelExcluded = createFailoverExclusionFilter({
+            sessionFailedModels: this.sessionFailedModels,
+            crossPipelineMemory: false,
+            registryCheck: false,
+        });
+        const chatCandidates = [];
+        const seenPairs = new Set();
+        const pushCandidate = (prov, mdl) => {
+            if (!prov || excluded.has(prov) || registryBlocked.has(prov))
+                return;
+            const model = mdl && mdl !== 'default' ? mdl : 'default';
+            // Model-scoped session exclusion — only THIS model, never its siblings.
+            if (isModelExcluded(prov, model))
+                return;
+            const key = `${prov}|${model}`;
+            if (seenPairs.has(key))
+                return;
+            // NOTE: deliberately NO registry-usability skip here. `resolveWorkingModel`
+            // below OWNS model health — it repairs a dead/parked model to a live one
+            // on the SAME provider. Filtering the candidate out first would skip the
+            // whole provider and bypass that repair (observed: a stale gemini pin made
+            // chat jump straight to local without ever trying gemini). The chain
+            // already ranks healthy models first, so the parked pick is only ever a
+            // last resort that the repair then fixes.
+            seenPairs.add(key);
+            chatCandidates.push({ provider: prov, model });
+        };
+        // The pool itself is the SAME one the orchestrator/tool/sub-agent path
+        // walks: primary → model-first TIERED pool (same model on other providers,
+        // same tier, escalate/de-escalate, local) → router chain (deep pairs +
+        // reserve) → ranked placeholders → config fallback. Chat used to build a
+        // shallower list here, which is why it reached strictly fewer models than
+        // the orchestrator could.
+        const pool = buildDeepFailoverPool(decision, {
+            taskDescription: message,
+            complexity: decision.complexity,
+            configManager: this.configManager,
+        });
+        for (const c of pool)
+            pushCandidate(c.provider, c.model);
+        // Unique provider list (what callers use for their own failover) — derived
+        // from the pair list so it stays consistent with what is actually tried.
+        const candidates = [...new Set(chatCandidates.map((c) => c.provider))];
+        for (const candidate of chatCandidates) {
             try {
-                const resolved = resolveProvider(this.configManager, candidate);
+                const resolved = resolveProvider(this.configManager, candidate.provider);
                 if (await resolved.provider.isAvailable()) {
-                    const desired = candidate === decision.provider
-                        ? decision.model
-                        : getAutoRouter().resolveModel(candidate, 'chat', this.configManager);
+                    const desired = candidate.model !== 'default'
+                        ? candidate.model
+                        : getAutoRouter().resolveModel(candidate.provider, 'chat', this.configManager);
                     // Model health: only use models that actually exist on the provider.
                     // A provider's pinned config.model can be deprecated or a placeholder
                     // (e.g. gemini-2.0-flash-exp → 404) — repair to a live model.
-                    const model = await resolveWorkingModel(resolved.provider, candidate, desired);
+                    const model = await resolveWorkingModel(resolved.provider, candidate.provider, desired);
                     // Record the actually-used route for the dashboard audit trail
                     recordRoutingDecision({
                         source: 'chat',
                         agentType: 'chat',
                         task: message,
                         complexity: decision.complexity,
-                        provider: candidate,
+                        provider: candidate.provider,
                         model,
                         score: decision.score,
                     });