pi-crew 0.9.59 → 0.9.60

package/src/runtime/model/provider-quota.ts

@@ -0,0 +1,228 @@
+/**
+ * provider-quota.ts — track provider rate-limit / quota state from response
+ * headers so the model fallback chain can deprioritize providers that are
+ * near exhaustion.
+ *
+ * WHY: when a provider returns 429 or its `x-ratelimit-remaining` header
+ * drops to zero, every subsequent spawn to that provider wastes a child
+ * process + a full retry cycle before the fallback chain moves on. Recording
+ * the signal here lets `buildConfiguredModelRouting` push those providers to
+ * the back of the auto tail instead of trying them first.
+ *
+ * Data source: pi's `after_provider_response` event carries `status` and
+ * `headers`. Standard rate-limit headers (OpenAI, Anthropic, most proxies):
+ *   x-ratelimit-remaining-requests / x-ratelimit-remaining-tokens
+ *   x-ratelimit-reset-requests    / x-ratelimit-reset-tokens
+ *   retry-after (on 429)
+ *
+ * The tracker is process-local and best-effort: a missed event just means
+ * the cache is slightly stale, never a wrong routing decision.
+ */
+
+interface ProviderQuotaEntry {
+	/** Provider key (lowercase). */
+	provider: string;
+	/** Remaining requests from the most recent response header. */
+	remainingRequests?: number;
+	/** Remaining tokens from the most recent response header. */
+	remainingTokens?: number;
+	/** When the rate-limit window resets (epoch ms). */
+	resetAtMs?: number;
+	/** HTTP status of the last response (429 = rate-limited). */
+	lastStatus?: number;
+	/** When this entry was last updated (epoch ms). */
+	updatedAtMs: number;
+}
+
+/** How long a quota entry stays authoritative before we stop trusting it. */
+const QUOTA_TTL_MS = 5 * 60 * 1000; // 5 minutes
+
+/** Process-local cache keyed by lowercase provider name. */
+const quotaCache = new Map<string, ProviderQuotaEntry>();
+
+/**
+ * Parse a numeric header value, returning undefined for missing/invalid.
+ */
+function headerNumber(headers: Record<string, string>, ...names: string[]): number | undefined {
+	for (const name of names) {
+		const raw = headers[name] ?? headers[name.toLowerCase()];
+		if (raw === undefined) continue;
+		const parsed = Number.parseInt(raw, 10);
+		if (Number.isFinite(parsed) && parsed >= 0) return parsed;
+	}
+	return undefined;
+}
+
+/**
+ * Read a raw (unparsed) header value — first match wins, case-insensitive.
+ */
+function headerRaw(headers: Record<string, string>, ...names: string[]): string | undefined {
+	for (const name of names) {
+		const raw = headers[name] ?? headers[name.toLowerCase()];
+		if (raw !== undefined) return raw;
+	}
+	return undefined;
+}
+
+/** Regex: compact Go-duration like "6m0s", "1s", "1h30m", "120s". */
+const GO_DURATION_RE = /^(\d+[smh])+$/;
+/** Regex: extract individual (\d+)(unit) segments from a Go-duration string. */
+const GO_DURATION_SEG_RE = /(\d+)([smh])/g;
+
+/**
+ * Parse a reset-timestamp header value into epoch-ms.
+ *
+ * Three formats are supported (tried in order):
+ *   (c) RFC3339 absolute timestamp (Anthropic): Date.parse returns epoch-ms directly.
+ *   (a) Go-duration compact string (OpenAI): "6m0s", "1s", "1h30m", "120s".
+ *   (b) Pure-seconds integer (retry-after): "30" → nowMs + 30 000.
+ *
+ * Returns undefined if no format matches.
+ */
+function parseResetValue(value: string, nowMs: number): number | undefined {
+	const trimmed = value.trim();
+	// (b) Pure-seconds integer (retry-after / reset): "0", "30", "120".
+	// MUST precede RFC3339 — Date.parse("0") returns 946659600000 (Y2K) in V8,
+	// not NaN, so a numeric "0" would otherwise hijack the timestamp branch
+	// and yield a resetAtMs in the year 2000.
+	if (/^\d+$/.test(trimmed)) {
+		const secs = Number.parseInt(trimmed, 10);
+		if (Number.isFinite(secs) && secs >= 0) return nowMs + secs * 1000;
+	}
+	// (a) Go-duration compact: digits+unit pairs ("6m0s", "1s", "1h30m").
+	if (GO_DURATION_RE.test(trimmed)) {
+		let durationMs = 0;
+		for (const seg of trimmed.matchAll(GO_DURATION_SEG_RE)) {
+			const n = Number.parseInt(seg[1], 10);
+			const unit = seg[2];
+			durationMs += unit === "s" ? n * 1000 : unit === "m" ? n * 60_000 : n * 3_600_000;
+		}
+		return nowMs + durationMs;
+	}
+	// (c) RFC3339 absolute timestamp (Anthropic). Only non-numeric date-like
+	// strings reach here: pure-numeric is handled above, and Date.parse on
+	// Go-durations like "6m0s" returns NaN.
+	const parsed = Date.parse(trimmed);
+	if (Number.isFinite(parsed) && parsed > 0) return parsed;
+	return undefined;
+}
+
+/**
+ * Parse a reset timestamp from headers. Providers use different formats:
+ *   - OpenAI: Go-duration strings ("6m0s", "1s") in x-ratelimit-reset-requests.
+ *   - Anthropic: RFC3339 timestamps.
+ *   - retry-after: pure-seconds integer.
+ */
+function headerResetMs(headers: Record<string, string>, nowMs: number): number | undefined {
+	const resetRaw = headerRaw(headers, "x-ratelimit-reset-requests", "x-ratelimit-reset");
+	if (resetRaw !== undefined) {
+		const parsed = parseResetValue(resetRaw, nowMs);
+		if (parsed !== undefined) return parsed;
+	}
+	const retryRaw = headerRaw(headers, "retry-after");
+	if (retryRaw !== undefined) {
+		return parseResetValue(retryRaw, nowMs);
+	}
+	return undefined;
+}
+
+/**
+ * Record a provider response. Called from the `after_provider_response`
+ * event handler. The `provider` argument is the pi provider key (e.g.
+ * "anthropic", "openai-codex"); it is lowercased for consistent lookup.
+ */
+export function noteProviderResponse(provider: string, status: number, headers: Record<string, string>, nowMs: number = Date.now()): void {
+	const key = provider.toLowerCase();
+	const entry: ProviderQuotaEntry = {
+		provider: key,
+		remainingRequests: headerNumber(headers, "x-ratelimit-remaining-requests", "x-ratelimit-remaining"),
+		remainingTokens: headerNumber(headers, "x-ratelimit-remaining-tokens"),
+		resetAtMs: headerResetMs(headers, nowMs),
+		lastStatus: status,
+		updatedAtMs: nowMs,
+	};
+	quotaCache.set(key, entry);
+	// L1: evict entries older than 2 * QUOTA_TTL_MS (10 min) to bound cache growth.
+	const evictionCutoff = nowMs - 2 * QUOTA_TTL_MS;
+	for (const [cacheKey, cached] of quotaCache) {
+		if (cached.updatedAtMs < evictionCutoff) quotaCache.delete(cacheKey);
+	}
+}
+
+/**
+ * Whether a provider is currently deprioritized (near or at quota limit).
+ * A provider is deprioritized when:
+ *   - its last response was 429, OR
+ *   - remaining requests/tokens dropped to 0, OR
+ *   - the reset window hasn't passed yet and remaining is very low (<10% of
+ *     a typical window, heuristic: remaining < 5)
+ */
+export function isProviderDeprioritized(provider: string, nowMs: number = Date.now()): boolean {
+	const entry = quotaCache.get(provider.toLowerCase());
+	if (!entry) return false;
+	// Stale entries are ignored — the provider may have recovered.
+	if (nowMs - entry.updatedAtMs > QUOTA_TTL_MS) return false;
+	// 429 = actively rate-limited right now.
+	if (entry.lastStatus === 429) return true;
+	// Explicit zero remaining.
+	if (entry.remainingRequests === 0 || entry.remainingTokens === 0) return true;
+	// Very low remaining with a future reset = approaching the wall.
+	if (entry.resetAtMs !== undefined && entry.resetAtMs > nowMs) {
+		if (entry.remainingRequests !== undefined && entry.remainingRequests < 5) return true;
+		if (entry.remainingTokens !== undefined && entry.remainingTokens < 1000) return true;
+	}
+	return false;
+}
+
+/**
+ * Build the `deprioritizedProviders` list for a set of candidate providers.
+ * Only providers with a fresh, deprioritized entry are included.
+ */
+export function deprioritizedProviders(providers: string[], nowMs: number = Date.now()): string[] {
+	return providers.filter((p) => isProviderDeprioritized(p, nowMs));
+}
+
+/**
+ * Build a `providerRank` map from quota data. Providers with more remaining
+ * capacity get a lower rank (tried earlier). Providers with no data get
+ * `Number.MAX_SAFE_INTEGER` (unknown = last). Providers that are
+ * deprioritized get `Number.MAX_SAFE_INTEGER - 1` (just above unknown).
+ */
+export function providerRankFromQuota(providers: string[], nowMs: number = Date.now()): Record<string, number> {
+	const rank: Record<string, number> = {};
+	for (const provider of providers) {
+		const key = provider.toLowerCase();
+		const entry = quotaCache.get(key);
+		if (!entry || nowMs - entry.updatedAtMs > QUOTA_TTL_MS) {
+			rank[key] = Number.MAX_SAFE_INTEGER;
+			continue;
+		}
+		if (isProviderDeprioritized(key, nowMs)) {
+			rank[key] = Number.MAX_SAFE_INTEGER - 1;
+			continue;
+		}
+		// Rank by remaining capacity: more remaining = lower rank = tried first.
+		// Use requests as primary signal; fall back to tokens.
+		const remaining = entry.remainingRequests ?? entry.remainingTokens;
+		rank[key] = remaining !== undefined ? Math.max(0, 1000 - remaining) : Number.MAX_SAFE_INTEGER;
+	}
+	return rank;
+}
+
+/**
+ * Clear the provider quota cache. Called on session switch to prevent
+ * stale quota data from a previous session leaking into the next.
+ */
+export function clearProviderQuotaCache(): void {
+	quotaCache.clear();
+}
+
+/** @internal Test seam — check if a provider has a cached entry. */
+export function __test_quotaCacheHasProvider(provider: string): boolean {
+	return quotaCache.has(provider.toLowerCase());
+}
+
+/** @internal Test seam — clear the quota cache. */
+export function __test_resetProviderQuota(): void {
+	clearProviderQuotaCache();
+}

package/src/runtime/model/session-model.ts

@@ -0,0 +1,135 @@
+/**
+ * session-model.ts — track the MAIN session's live model + thinking level.
+ *
+ * WHY: `ctx.model` from the pi extension API is the session's *saved* model,
+ * not necessarily the one currently in use. A session that restored stale
+ * state can report `anthropic/claude-sonnet-4-5` while actually running
+ * `minimax/MiniMax-M3` (the value shown in the footer). Subagents that
+ * inherit the parent model (`model: false`, which every builtin agent uses)
+ * therefore "jumped" to whatever a previous session had saved.
+ *
+ * Pi emits `model_select` (with the real `Model` object) on every set / cycle
+ * / restore, and `thinking_level_select` for the thinking level. Recording
+ * those gives an authoritative view of what the main session is running right
+ * now, which is what a subagent should inherit.
+ *
+ * This module is process-local state with no I/O. `register.ts` feeds it from
+ * the pi events; the spawn paths read it through {@link resolveParentModel}.
+ */
+
+import type { RunModelContext } from "../../state/types.ts";
+import { availableModelInfosFromRegistry, modelRefToString } from "./model-fallback.ts";
+
+export type SessionModelSource = "model_select" | "session_start" | "none";
+
+interface SessionModelState {
+	model?: string;
+	thinking?: string;
+	source: SessionModelSource;
+	updatedAt?: number;
+}
+
+const state: SessionModelState = { source: "none" };
+
+/**
+ * Record the model the main session is running. Accepts pi's `Model` object
+ * (`{ provider, id }`) or a `"provider/id"` string; anything unrecognized is
+ * ignored so a pi API change can never blank out a known-good value.
+ */
+export function noteSessionModel(model: unknown, source: SessionModelSource = "model_select"): void {
+	const normalized = modelRefToString(model);
+	if (!normalized) return;
+	// `session_start` only seeds: pi may emit `model_select` (source "restore")
+	// before session_start, and that value is authoritative. Letting the seed
+	// overwrite it would put the stale saved model back.
+	if (source === "session_start" && state.source === "model_select") return;
+	state.model = normalized;
+	state.source = source;
+	state.updatedAt = Date.now();
+}
+
+/**
+ * Record the main session's thinking level. An explicit `"off"`/`""` clears it;
+ * a non-string (e.g. `ctx.thinkingLevel` on a context that does not expose one)
+ * is ignored so seeding cannot erase a tracked value.
+ */
+export function noteSessionThinking(level: unknown): void {
+	if (typeof level !== "string") return;
+	const value = level.trim();
+	state.thinking = value && value !== "off" ? value : undefined;
+}
+
+/** The main session's live model as `"provider/id"`, when known. */
+export function currentSessionModel(): string | undefined {
+	return state.model;
+}
+
+/** The main session's live thinking level, when known. */
+export function currentSessionThinking(): string | undefined {
+	return state.thinking;
+}
+
+/**
+ * Resolve the model a subagent should inherit. The live `model_select` value
+ * wins over `ctx.model` because the latter can be stale session state; the
+ * caller's value is the fallback for contexts that never saw the event
+ * (e.g. a fresh headless run).
+ */
+export function resolveParentModel(ctxModel: unknown): string | undefined {
+	return state.model ?? modelRefToString(ctxModel);
+}
+
+/**
+ * Snapshot everything the model router needs, for a run that will execute
+ * outside this process (background/async). Returns undefined when there is
+ * nothing worth persisting, so old manifests stay byte-identical.
+ */
+export function captureRunModelContext(
+	ctx: { model?: unknown; modelRegistry?: unknown; thinkingLevel?: unknown },
+	override?: string,
+): RunModelContext | undefined {
+	const parentModel = resolveParentModel(ctx.model);
+	const registryModels = availableModelInfosFromRegistry(ctx.modelRegistry);
+	const availableModels = registryModels && registryModels.length > 0 ? registryModels.map((model) => model.fullId) : undefined;
+	const parentThinking = currentSessionThinking() ?? (typeof ctx.thinkingLevel === "string" ? ctx.thinkingLevel : undefined);
+	const trimmedOverride = override?.trim() || undefined;
+	if (!parentModel && !availableModels && !parentThinking && !trimmedOverride) return undefined;
+	return {
+		...(trimmedOverride ? { override: trimmedOverride } : {}),
+		...(parentModel ? { parentModel } : {}),
+		...(parentThinking && parentThinking !== "off" ? { parentThinking } : {}),
+		...(availableModels ? { availableModels } : {}),
+	};
+}
+
+/**
+ * Rebuild a minimal `ModelRegistry`-shaped object from a persisted catalogue,
+ * so the background path feeds `buildConfiguredModelRouting` the same
+ * auth-filtered list the caller had instead of falling back to raw models.json.
+ */
+export function registryFromModelContext(context: RunModelContext | undefined): { getAvailable: () => unknown[] } | undefined {
+	const models = context?.availableModels;
+	if (!models || models.length === 0) return undefined;
+	const entries = models
+		.map((fullId) => {
+			const slashIdx = fullId.indexOf("/");
+			if (slashIdx <= 0) return undefined;
+			return { provider: fullId.slice(0, slashIdx), id: fullId.slice(slashIdx + 1) };
+		})
+		.filter((entry): entry is { provider: string; id: string } => entry !== undefined);
+	if (entries.length === 0) return undefined;
+	return { getAvailable: () => entries };
+}
+
+/** Diagnostic snapshot for `team doctor`. */
+export function sessionModelSnapshot(): Readonly<Required<Pick<SessionModelState, "source">> & SessionModelState> {
+	return { ...state };
+}
+
+/** @internal Test seam — reset tracked state between cases. */
+export function __test_resetSessionModel(): void {
+	state.model = undefined;
+	state.thinking = undefined;
+	state.source = "none";
+	state.updatedAt = undefined;
+}

package/src/runtime/task-runner/child-executor.ts

@@ -51,6 +51,10 @@ import {
 	formatModelAttemptNote,
 	isRetryableModelFailure,
 	type ModelAttemptSummary,
+	type ModelFallbackPolicy,
+	resolveDefaultSubagentModel,
+	resolveModelFallbackPolicy,
+	warnOutOfScopeSoft,
 } from "../model/model-fallback.ts";
 import { readEnabledModelsPatterns } from "../model/model-scope.ts";
 import { type ParsedPiJsonOutput, parsePiJsonOutput } from "../output/pi-json-output.ts";
@@ -144,6 +148,27 @@ export function computeSpawnBudgetMax(attemptModelsCount: number, configuredMaxA
 	return attemptModelsCount * (configuredMaxAttempts + 1);
 }
 
+/**
+ * Resolve the model fallback policy from crew config + env. Best-effort: any
+ * config read failure returns undefined (legacy unbounded/unordered behaviour).
+ */
+function resolveTaskModelFallbackPolicy(cwd: string): ModelFallbackPolicy | undefined {
+	try {
+		return resolveModelFallbackPolicy(loadConfig(cwd).config.runtime?.modelFallback);
+	} catch {
+		return undefined;
+	}
+}
+
+/** Resolve the default subagent model from crew config + env. */
+function resolveTaskDefaultSubagentModel(cwd: string): string | undefined {
+	try {
+		return resolveDefaultSubagentModel(loadConfig(cwd).config.runtime?.modelFallback);
+	} catch {
+		return undefined;
+	}
+}
+
 /**
  * 429/rate-limit detection (PI_CREW_TOOLING_429_NOTE.md).
  *
@@ -256,19 +281,46 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 	let terminalEvidence: OperationTerminalEvidence[] = [];
 	let startupEvidence = ctx.startupEvidence;
 
+	const modelFallbackPolicy = resolveTaskModelFallbackPolicy(task.cwd);
+	const defaultSubagentModel = resolveTaskDefaultSubagentModel(task.cwd);
 	const modelRoutingPlan = buildConfiguredModelRouting({
 		overrideModel: input.modelOverride,
 		stepModel: input.step.model,
 		teamRoleModel: input.teamRoleModel,
+		teamRoleFallbackModels: input.teamRoleFallbackModels,
 		agentModel: input.agent.model,
+		defaultSubagentModel,
 		fallbackModels: input.agent.fallbackModels,
 		parentModel: input.parentModel,
 		modelRegistry: input.modelRegistry,
 		cwd: task.cwd,
+		policy: modelFallbackPolicy,
 		scopeModelsPatterns: await resolveTaskScopeModelsPatterns(task.cwd),
 	});
 	const candidates = modelRoutingPlan.candidates;
-	const attemptModels = candidates.length > 0 ? candidates : [undefined];
+	// Surface a warning when the caller's requested model was silently replaced.
+	if (modelRoutingPlan.droppedRequested) {
+		void appendEventAsync(manifest.eventsPath, {
+			type: "task.model_dropped",
+			runId: manifest.runId,
+			taskId: task.id,
+			message: `Requested model "${modelRoutingPlan.droppedRequested}" is not available; using "${candidates[0] ?? "default"}" instead.`,
+			data: {
+				requested: modelRoutingPlan.droppedRequested,
+				resolved: candidates[0],
+				fallbackChain: candidates,
+			},
+		}).catch(() => {
+			/* no-op: best-effort diagnostic append, ignore delivery errors */
+		});
+	}
+	// F2: surface a non-silent warning when the INITIAL routing resolved an
+	// out-of-scope soft-sourced model (mirrors live-session-runtime.ts). Caller
+	// sources already throw inside buildConfiguredModelRouting.
+	warnOutOfScopeSoft(modelRoutingPlan.scopeVerdict, "child-executor.initial-out-of-scope");
+	// Mutable: the one-shot re-resolve below appends a late-discovered model so
+	// the loop actually retries it (see FIX 1 at the end of the attempt loop).
+	const attemptModels: (string | undefined)[] = candidates.length > 0 ? [...candidates] : [undefined];
 	// CORE-3: auto-compute per-task spawn budget on first entry.
 	// Budget = attemptModels.length × (maxAttempts + 1) — always one
 	// full attempt-worth above the theoretical maximum of
@@ -283,6 +335,9 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 	}
 	const logs: string[] = [];
 	let finalStderr = "";
+	// One-shot: the re-resolve is a safety net for a chain that was computed
+	// before the registry was complete, not a retry loop of its own.
+	let reResolveUsed = false;
 	modelAttempts = [];
 	let finalCheckpointWritten = false;
 	let lastAgentRecordPersistedAt = 0;
@@ -440,6 +495,7 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				excludeContextBash: input.runtimeConfig?.excludeContextBash,
 				sessionId: manifest.sessionId,
 				role: task.role,
+				thinkingOverride: input.teamRoleThinking,
 				runId: manifest.runId,
 				agentId: task.id,
 				artifactsRoot: manifest.artifactsRoot,
@@ -666,7 +722,8 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 		// after the precompute, or the precompute ran before the parent
 		// model was known). If a different candidate is found, use it as
 		// nextModel; otherwise fall through to the existing break.
-		if (!nextModel && isRetryableModelFailure(error)) {
+		if (!nextModel && !reResolveUsed && isRetryableModelFailure(error)) {
+			reResolveUsed = true;
 			const reResolved = buildConfiguredModelRouting({
 				overrideModel: undefined,
 				stepModel: undefined,
@@ -676,10 +733,29 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 				parentModel: attempt.model,
 				modelRegistry: input.modelRegistry,
 				cwd: task.cwd,
+				policy: modelFallbackPolicy,
 				scopeModelsPatterns: await resolveTaskScopeModelsPatterns(task.cwd),
 			});
-			const alt = reResolved.candidates.find((c) => c !== attempt.model);
-			if (alt) nextModel = alt;
+			// Sec-M1: surface a non-silent warning when a soft-sourced re-resolved
+			// model is out-of-scope. Only non-caller sources (frontmatter /
+			// resolved) reach here — caller sources already throw inside
+			// buildConfiguredModelRouting.
+			warnOutOfScopeSoft(reResolved.scopeVerdict, "child-executor.re-resolve-out-of-scope", "Re-resolved model");
+			// Must exclude EVERY model already tried, not just the last one —
+			// otherwise the "alternative" is one that already failed.
+			const tried = new Set(modelAttempts.map((a) => a.model));
+			const alt = reResolved.candidates.find((candidate) => !tried.has(candidate));
+			if (alt) {
+				// Append so the loop reaches it. Without this the log claimed a
+				// retry that never happened: `nextModel` alone only gates `break`,
+				// the next iteration reads `attemptModels[i + 1]`.
+				attemptModels.push(alt);
+				nextModel = alt;
+				// Keep the budget consistent with the extended chain (one extra
+				// model = one extra attempt-worth), otherwise the spawn-budget
+				// guard aborts the very attempt we just queued.
+				if (input.spawnBudget) input.spawnBudget.max += 1;
+			}
 		}
 		if (!nextModel || !isRetryableModelFailure(error)) break;
 		logs.push(formatModelAttemptNote(attempt, nextModel), "");
@@ -762,6 +838,8 @@ export async function runChildProcessTask(ctx: TaskExecutionContext): Promise<Ta
 			fallbackChain: candidates,
 			reason: fallbackReason ?? modelRoutingPlan.reason,
 			usedAttempt,
+			droppedRequested: modelRoutingPlan.droppedRequested,
+			autoFallbackCount: modelRoutingPlan.autoFallbackCount,
 		},
 	};
 	tasks = updateTask(tasks, task);

package/src/runtime/task-runner/live-executor.ts

@@ -35,6 +35,8 @@ export interface RunLiveTaskInput {
 	modelRegistry?: unknown;
 	modelOverride?: string;
 	teamRoleModel?: string;
+	teamRoleFallbackModels?: string[];
+	teamRoleThinking?: string;
 	isCurrent?: () => boolean;
 	/** Workspace where this task run was initiated — used for session-scoped live-agent visibility. */
 	workspaceId: string;
@@ -134,6 +136,8 @@ export async function runLiveTask(input: RunLiveTaskInput): Promise<RunLiveTaskO
 		modelRegistry: input.modelRegistry,
 		modelOverride: input.modelOverride,
 		teamRoleModel: input.teamRoleModel,
+		teamRoleFallbackModels: input.teamRoleFallbackModels,
+		teamRoleThinking: input.teamRoleThinking,
 		isCurrent,
 		workspaceId: input.workspaceId,
 		// Phase 2: Pass output schema for yield validation
@@ -181,6 +185,14 @@ export async function runLiveTask(input: RunLiveTaskInput): Promise<RunLiveTaskO
 			usage: liveResult.usage,
 			agentProgress: applyUsageToProgress(task.agentProgress, liveResult.usage),
 		};
+	if (liveResult.modelRouting)
+		task = {
+			...task,
+			modelRouting: {
+				...liveResult.modelRouting,
+				usedAttempt: 0,
+			},
+		};
 	persistLiveProgress({ type: "attempt_finished" }, true);
 	const resultArtifact = writeArtifact(manifest.artifactsRoot, {
 		kind: "result",

package/src/runtime/task-runner.ts

@@ -52,6 +52,9 @@ export interface TaskRunnerInput {
 	modelRegistry?: unknown;
 	modelOverride?: string;
 	teamRoleModel?: string;
+	teamRoleFallbackModels?: string[];
+	/** Per-role thinking level override (teamRole.thinking). Takes precedence over agent.thinking. */
+	teamRoleThinking?: string;
 	teamRoleSkills?: string[] | false;
 	skillOverride?: string[] | false;
 	limits?: CrewLimitsConfig;
@@ -152,6 +155,8 @@ export async function runTeamTask(input: TaskRunnerInput): Promise<{ manifest: T
 				modelRegistry: input.modelRegistry,
 				modelOverride: input.modelOverride,
 				teamRoleModel: input.teamRoleModel,
+				teamRoleFallbackModels: input.teamRoleFallbackModels,
+				teamRoleThinking: input.teamRoleThinking,
 				workspaceId: input.workspaceId,
 			});
 			task = live.task;

package/src/runtime/team-runner.ts

@@ -1102,6 +1102,10 @@ interface SchedulerContext {
 	queueIndex: TaskGraphIndex;
 	wfMachine: WorkflowStateMachine;
 	pendingUnits: Map<string, PendingUnit>;
+	/** Task ids ever dispatched (grows monotonically; never removed). Used by
+	 * terminaliseRunWithDrain to cancel — not skip — tasks that were in-flight
+	 * even after their dispatch unit settled + left pendingUnits (RT-NEW-2 race). */
+	dispatchedTaskIds: Set<string>;
 	runController: AbortController;
 	runtimeKind: CrewRuntimeKind;
 	adaptivePlanInjected: boolean;
@@ -1266,10 +1270,13 @@ async function terminaliseRunWithDrain(
 	ctx: SchedulerContext,
 	opts: { cancelMessage: string; blockedMessage: string; failedReason: string },
 ): Promise<{ manifest: TeamRunManifest; tasks: TeamTaskState[] }> {
-	const inflightTaskIds = new Set<string>();
-	for (const unit of ctx.pendingUnits.values()) {
-		for (const id of unit.taskIds) inflightTaskIds.add(id);
-	}
+	// Ever-dispatched tasks (monotonic set populated at dispatch). Using this
+	// instead of a pendingUnits snapshot closes the RT-NEW-2 race where a task
+	// whose unit settled + left pendingUnits before the abort — but whose task
+	// status isn't terminal yet — would otherwise fall through to markBlocked
+	// and be clobbered to "skipped" (observed CI flake: 02_b skipped on
+	// team-runner-budget-abort-inflight across v0.9.59 / cfd68d06 / 12386af2).
+	const inflightTaskIds = ctx.dispatchedTaskIds;
 	const outcomes = await drainPendingUnits(ctx.pendingUnits, ctx.runController);
 	const validResults: { manifest: TeamRunManifest; tasks: TeamTaskState[] }[] = [];
 	for (const outcome of outcomes) {
@@ -1729,6 +1736,8 @@ async function dispatchBatch(ctx: SchedulerContext, decision: DispatchBatchDecis
 			modelRegistry: input.modelRegistry,
 			modelOverride: input.modelOverride,
 			teamRoleModel: teamRole?.model,
+			teamRoleThinking: teamRole?.thinking,
+			teamRoleFallbackModels: teamRole?.fallbackModels,
 			teamRoleSkills: teamRole?.skills,
 			skillOverride: input.skillOverride,
 			limits: input.limits,
@@ -1926,6 +1935,10 @@ async function dispatchBatch(ctx: SchedulerContext, decision: DispatchBatchDecis
 			promise: rawPromise,
 			wrapped,
 		});
+		// RT-NEW-2 race fix: record ever-dispatched task ids so terminaliseRunWithDrain
+		// cancels (not skips) tasks whose unit settled + left pendingUnits before
+		// the abort fired but whose task status isn't terminal yet.
+		for (const id of unitTaskIds) ctx.dispatchedTaskIds.add(id);
 	}
 }
 
@@ -2462,6 +2475,7 @@ async function executeTeamRunCore(
 		queueIndex,
 		wfMachine,
 		pendingUnits,
+		dispatchedTaskIds: new Set(),
 		runController,
 		runtimeKind,
 		adaptivePlanInjected,

package/src/schema/config-schema.ts

@@ -42,6 +42,17 @@ export const PiTeamsLimitsConfigSchema = Type.Object(
 	{ additionalProperties: false },
 );
 
+export const PiTeamsModelFallbackConfigSchema = Type.Object(
+	{
+		maxAutoFallbacks: Type.Optional(Type.Integer({ minimum: 0 })),
+		order: Type.Optional(Type.Union([Type.Literal("parentFirst"), Type.Literal("asIs")])),
+		requireCredentials: Type.Optional(Type.Boolean()),
+		quotaAwareOrdering: Type.Optional(Type.Boolean()),
+		defaultSubagentModel: Type.Optional(Type.String({ minLength: 1 })),
+	},
+	{ additionalProperties: false },
+);
+
 export const PiTeamsRuntimeConfigSchema = Type.Object(
 	{
 		mode: Type.Optional(
@@ -82,6 +93,7 @@ export const PiTeamsRuntimeConfigSchema = Type.Object(
 				{ additionalProperties: false },
 			),
 		),
+		modelFallback: Type.Optional(PiTeamsModelFallbackConfigSchema),
 	},
 	{ additionalProperties: false },
 );