pi-durable-subagents 1.0.8 → 1.0.10

package/CHANGELOG.md

@@ -1,5 +1,44 @@
 # Changelog
 
+## 1.0.10
+
+- Provider failover for a used-up usage window. An error such as `503 No
+  available accounts`, "usage limit" or "quota exceeded" (after pi's own
+  retries) marks the provider used up instead of counting as a lost
+  execution: a call in a pool continues in the same session on the pool's next
+  model, and new calls skip the provider. After `k.probeMs` (15 minutes) the
+  next call that wants it is admitted to it alone; when it answers, new calls
+  and new generations go back to it. A call with a single model waits for the
+  provider instead of failing. `status` lists used-up providers with their
+  next try. Billing errors (402, insufficient balance) still fail at once.
+  A short request rate limit ("429 … resets in 1 second") is not a used-up
+  window and is retried as before. A follow-up naming a model runs on it even
+  where the pool would start over.
+- After a call moved to another model by a relaunch, the orchestrator now
+  reads the session's model as pi restores it (from the last answer), so a
+  later relaunch holds the slot of the provider it actually uses.
+
+## 1.0.9
+
+- `status` shows the model a call actually uses: the model of its last
+  provider request. A requested switch not used yet shows as `switching`
+  (also in the brief status), a switch the subagent refused as
+  `switchFailed`. Before, `status` kept the model the execution started with,
+  so a switch that had worked looked as if it had not.
+- `send follow-up` with `model` runs the new generation on that model; it was
+  ignored, and the generation continued on the session's model. A send that
+  names a model replies with `model` and `effect`: `next-request` (a running
+  call switches at its next request), `next-execution` or `next-generation`.
+- `send model` to a call that is asking (hibernated) or still waiting for a
+  slot is recorded and applied when it runs again, instead of being refused
+  with `call-not-running`.
+  A requested model applies once: afterwards the session and the pool choose
+  as before. Withdrawing a follow-up that names a model withdraws the switch
+  too.
+- A provider's refusal of the content (terms of service, usage policy) fails
+  the call at once with that error. It was retried as a lost execution five
+  times and reported as `lost ×5`.
+
 ## 1.0.8
 
 - pi stays responsive with a long history: the extension's polling in pi's

package/README.md

@@ -55,6 +55,7 @@ the npx cache, so `install-service` refuses to run from there.
 | You steer a subagent while it is asking you a question | Your message reaches it, in order. Nothing is rejected or lost. |
 | Two steers arrive out of order and the second replaces the first | Only the second one applies. |
 | A step is refused, or a dependency fails | The workflow stops that branch cleanly. Nothing is retried in vain. |
+| A provider's usage window runs out (`No available accounts`, usage limit, quota exceeded) | A call in a pool continues **in the same session** on the pool's next model; new calls skip that provider. After 15 minutes the next call that wants it tries it once; when it answers, new calls and new generations use it again. A call with a single model waits for it instead of failing. Billing errors (402, insufficient balance) still fail at once. |
 | A subagent waits for an answer for a long time | It releases its model slot and memory, then resumes exactly once when you answer. |
 
 ## Use it
@@ -77,6 +78,12 @@ answer) or failed, and one line per finished workflow. `status` with a wid
 shows one workflow with outputs clipped; add `key` for one call's full result,
 or `full: true` for everything. When a run replies `{submitted: {rid}}`
 (its workflow was not created within 10 s), the rid works wherever a wid does.
+A call's `model` in `status` is the model its last provider request used; a
+requested switch not used yet shows as `switching`, a refused one as
+`switchFailed`. A send naming a model replies with `model` and `effect`
+(`next-request`, `next-execution` or `next-generation`).
+A provider's refusal of the content (terms of service, usage policy) fails the
+call at once with that error instead of retrying it.
 With `tasks` or `chain`, top-level `model`, `timeoutMs`, `budget`, `isolation`,
 `context`, `tools`, `skills` and `once` apply to every step that does not set
 its own; other call fields there, and any of them beside a workflow script,
@@ -90,9 +97,9 @@ it something. Each verb means one thing, and a refusal says what would work:
 |---|---|---|
 | `run` | — | Start one subagent, `tasks` in parallel, a `chain`, or a workflow script. An unknown agent name is refused before anything starts, with the list of agents. |
 | `send steer` | a running subagent | Reaches it at its next safe point. To a finished one: refused, use `follow-up`; To one waiting on its question: it interrupts the question, and the subagent usually asks again; `answer` answers it. |
-| `send follow-up` | a finished subagent | Continues the same session as a new generation (`key@2`). |
+| `send follow-up` | a finished subagent | Continues the same session as a new generation (`key@2`). With `model`, that generation runs on it. |
 | `send answer` | an open question | Answers it once. |
-| `send model` | any subagent | Switches its model at the next request. |
+| `send model` | any subagent | A running one switches at its next request; one asking, hibernated or waiting for a slot launches on it when it runs again. |
 | `stop` | a subagent or a workflow | Final: `stopped`, usage kept, edits left as they are. |
 | `drain` / `resume` | existing workflows | A reversible hold; runs started later are not held. |
 
@@ -266,7 +273,14 @@ State lives in `~/.pi/durable-subagents`; set `DSA_HOME` to move it.
 ```
 
 - **Pools:** a model can name a pool. The first candidate with a free slot is
-  used, and a candidate that keeps failing is skipped for 10 minutes.
+  used, and a candidate that keeps failing is skipped for 10 minutes. The
+  order is the preference: list the provider you want to use first.
+- **A used-up provider** is not sent new calls until its next try, 15 minutes
+  after it last refused (`"k": { "probeMs": 900000 }`). Then one call at a
+  time goes to it, so finding out costs no extra request. A call that moved to
+  another provider stays there for the rest of its generation (switching back
+  mid-task would lose the prompt cache); a follow-up starts on the first
+  candidate again. `status` lists each used-up provider with its next try.
 - **Provider slots:** never exceeded, including while a model switch is in
   progress.
 - **Memory:** new subagents wait while memory is short. Running ones are

package/dist/agent/main/tool.js

@@ -39,6 +39,13 @@ function call(value, cwd, where) {
     return spec;
 }
 /** v12 §2: Infer unambiguous runs and normalize controls into unchanged wire bodies. */
+/** P12: a send naming a model is answered with that model and when it applies — `next-request` (a running call switches
+ *  at its next provider request), `next-execution` (a call with no live execution launches on it) or `next-generation`
+ *  (a follow-up's new generation runs on it). From the orchestrator ledger's `send-note`. */
+export function sendReceipt(ledger, rid) {
+    const note = ledger.find(e => e.type === "send-note" && e.rid === rid);
+    return note ? { model: String(note.model), effect: String(note.effect) } : {};
+}
 export function request(args, cwd) {
     // v12 §2: Infer run only when one launch form is present; never guess a control verb.
     const launchForms = [args.agent !== undefined || args.task !== undefined, args.tasks !== undefined,
@@ -110,7 +117,9 @@ export function request(args, cwd) {
         const kind = string(args, "kind");
         if (!["steer", "follow-up", "answer", "model"].includes(kind))
             throw new Error("Unsupported send kind");
-        const body = { to: string(args, "to"), kind, ...(kind === "model" ? { model: string(args, "model") } : { message: string(args, "message") }), ...(args.by === "user" ? { by: "user" } : {}) };
+        // follow-up may name the model its continuation runs on (P37); other kinds ignore one.
+        const model = kind === "model" || kind === "follow-up" && args.model !== undefined ? { model: string(args, "model") } : {};
+        const body = { to: string(args, "to"), kind, ...model, ...(kind === "model" ? {} : { message: string(args, "message") }), ...(args.by === "user" ? { by: "user" } : {}) };
         const cond = {};
         if (kind === "answer") {
             cond.qid = string(args, "qid");

package/dist/agent/main.js

@@ -13,7 +13,7 @@ import { dsaHome, orchInbox, orchLedger, orchLock, outboxRoot } from "../paths.j
 import { CT, JT } from "../types.js";
 import { attention, presentText, presented, resolved, unfinishedWorkflow } from "./main/snapshots.js";
 import { isLive, pausedElsewhere, statusBrief, statusCallDetail, statusCompactDetail, statusDetail, statusView, widOfRid } from "../orchestrator/snapshot.js";
-import { parameters, request } from "./main/tool.js";
+import { parameters, request, sendReceipt } from "./main/tool.js";
 import { discoverAgents } from "../compat/agents.js";
 let noteSink;
 /** P16: Queue a UI note for the next boundary without waking the model. */
@@ -303,8 +303,9 @@ export function registerMain(pi, ui) {
                 // The rid is returned so a later send can supersede this one (replaces: [rid]).
                 if (decision.type === "rejected")
                     return { applied: false, reason: sent.kind === "resume" && args.wid === undefined ? resumeElsewhere(String(decision.reason)) : decision.reason, rid: sent.rid };
-                if (sent.kind !== "run")
-                    return { applied: true, rid: sent.rid };
+                if (sent.kind !== "run") {
+                    return { applied: true, rid: sent.rid, ...sendReceipt(ledger(), sent.rid) };
+                }
             }
             if (performance.now() >= deadline || signal?.aborted)
                 break;
@@ -324,8 +325,8 @@ export function registerMain(pi, ui) {
             "Durable asynchronous subagents; run returns {wid} when created (or {submitted:{rid}} while pending). A finished workflow (its notice carries every agent's result) or a question wakes you, so after starting work end your turn: never poll with sleep or repeated status. Crash recovery resumes sessions, not external side effects. Background helper processes (orchestrator, evaluator) exit by themselves about 10 s after all work ends: never kill processes or delete files to 'clean up'. When the user quits pi, this session's running workflows pause (nothing is spent); resume continues them.",
             "run (action optional for exactly one launch form): agent+task; tasks:[call specs] parallel; chain:[call specs] sequential ({previous}); workflow:'./script.js' or source (runs.run(key,spec), runs.all([...]), emit(value), args, runs.input(name)). Optional name, cwd, usageBudget, maxCalls, inputs. With tasks/chain, top-level model, timeoutMs, budget, isolation, context, tools, skills, once are defaults for every step (a step's own value wins); a workflow/source script sets them per runs.run call. timeoutMs is milliseconds of active time (a number); omit it unless a hard limit is needed. Explicit unknown agents are rejected BEFORE creation, with available names; unknown script agents fail only their call.",
             "agents: list names, descriptions, default models and source for this cwd; use these names for run.",
-            "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model switches at next provider request. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
-            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, finished workflows one line each, provider slots held/limit and the config in effect; wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
+            "send to:'<wid>/<key>' (bare '<wid>' only for a single-call workflow): steer on a running call delivers at the next safe point (receipt in status/UI); a steer to a call waiting on its question interrupts the question and the subagent usually asks again — use answer to answer it; sealed → finished:<status> — use kind 'follow-up'. follow-up continues a sealed call as generation g+1 or queues after a running turn; follow-up model:'provider/id' runs that generation on it. answer: give the qid (or just the call, or nothing when one question is open); to and rev are filled in. A question that needs the user's decision goes to the user; if you answer one yourself, tell the user what you chose. model: a running call switches at its next provider request; an asking, hibernated or queued call launches on it when it runs again; the reply's model/effect (next-request|next-execution|next-generation) says which. status model = model actually used by the last request; switching = requested, not used yet; switchFailed = refused. A provider content refusal (ToS/usage policy) fails the call at once, not retried. Unknown targets list valid addresses. replaces:[rid] supersedes an earlier send.",
+            "stop target:<wid|<wid>/<key>> is terminal stopped (usage and partial edits kept); a sealed call → already-sealed:<status>, a finished workflow → terminal:<status>. drain holds existing workflows reversibly (new runs unaffected); resume [wid] releases held workflows. status: without wid, what runs, asks (with its answer address; hibernated:true holds no slot) or failed, finished workflows one line each, provider slots held/limit, the config in effect and providers whose usage window is used up (avoided until a probe finds them answering again); wid: one workflow, outputs clipped; wid+key: one call's full result; full:true: everything. A run's rid from {submitted:{rid}} works wherever a wid is expected. revise wid + workflow/source/args starts a revision.",
             "Control replies are {applied:true,rid} or {applied:false,reason,rid} when decided; otherwise {submitted:{rid}} after 10s.",
             ...(agents ? [`Available agents: ${agents}.`] : []),
             "User sees a summary line above the editor; ↓ on an empty editor (or /subagents) opens the list, Enter watches live OR finished calls (finished transcripts remain on disk) and expands finished workflows. List keys: s steer (paste-capable input), x stop (confirm y), m model, a answer when asked, f follow-up on finished calls; action feedback appears in footer.",

package/dist/cli/main.js

@@ -65,13 +65,13 @@ export function renderStatus(wf) {
 /** P25, T10: Render the compact status projection shared with the `subagents` tool. */
 export function renderView(view) {
     const lines = view.workflows.map(w => [`${w.wid}@${w.rev}${w.name ? ` ${w.name}` : ""}: ${w.status}${w.followUps ? " (follow-up running)" : ""}${w.error ? ` (${clip(w.error, 200)})` : ""} · ${w.done}/${w.planned ?? w.calls.length}${w.planned === undefined && w.status === "running" ? "+" : ""} done${w.usage.input || w.usage.output || w.usage.costUsd ? ` · ${formatUsage(w.usage)}` : ""}`,
-        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.hibernated ? " (hibernated, no slot)" : ""}${c.model ? ` ${c.model}` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}`),
+        ...w.calls.map(c => `  ${c.key}@${c.gen} ${c.status ?? c.phase}${c.hibernated ? " (hibernated, no slot)" : ""}${c.model ? ` ${c.model}` : ""}${c.switching ? ` → ${c.switching} (requested)` : ""}${c.switchFailed ? ` (switch refused: ${c.switchFailed})` : ""}${c.tools ? ` tools:${c.tools}` : ""}${c.usage ? ` ${formatUsage(c.usage)}` : ""}${c.lastLine ? ` ${JSON.stringify(c.lastLine)}` : c.error ? ` (${c.error})` : ""}`),
         ...w.attention.map(a => `  ${a.kind}: ${JSON.stringify(a.text.split("\n")[0])}`)].join("\n"));
     if (view.paused)
         lines.unshift(`${view.paused} (pi-durable-subagents resume)`);
     if (view.olderFinished)
         lines.push(`(+${view.olderFinished} older finished workflows; status <wid> shows one in detail)`);
-    const footer = [view.slots?.length ? `slots: ${view.slots.join(", ")}` : "", view.config ? `config: ${view.config}` : "", view.configRejected ? `config.json rejected: ${view.configRejected}` : ""].filter(Boolean);
+    const footer = [view.slots?.length ? `slots: ${view.slots.join(", ")}` : "", view.config ? `config: ${view.config}` : "", view.configRejected ? `config.json rejected: ${view.configRejected}` : "", ...(view.exhausted ?? [])].filter(Boolean);
     if (!lines.length)
         lines.push("No workflows");
     return [...lines, ...footer].join("\n");

package/dist/orchestrator/config.js

@@ -9,7 +9,7 @@ import { join } from "node:path";
 import { contentHash } from "../kernel/ids.js";
 /** The keys the orchestrator reads; config.json also holds pi-side settings (ui, onQuit) that it ignores. */
 const KEYS = ["defaultModel", "pools", "providers", "memory", "k"];
-const K = ["lossBound", "checkpointMs", "stallMs", "progressMs", "switchTimeoutMs", "idleExitMs", "trackerMs", "hibernateMs", "spawnBudget"];
+const K = ["lossBound", "checkpointMs", "stallMs", "progressMs", "switchTimeoutMs", "idleExitMs", "trackerMs", "hibernateMs", "spawnBudget", "probeMs"];
 export const configPath = (home) => join(home, "config.json");
 /** The orchestrator's part of a parsed config.json. */
 export function orchestratorSettings(raw) {

package/dist/orchestrator/engine.js

@@ -22,6 +22,7 @@ import { EvaluatorClient } from "./evaluator-client.js";
 import { Store, revisionEntries, terminalEntry } from "./store.js";
 import { formatUsage, holdOf, refusedResult, snapshotFromEntries } from "./snapshot.js";
 import { validateCallSpec } from "../compat/spec.js";
+import { parseModel } from "../compat/model.js";
 const tail = (text, n) => text.length > n ? `…${text.slice(-(n - 1))}` : text;
 const charged = (u) => u && (u.input || u.output || u.costUsd) ? formatUsage(u) : undefined;
 const wakeStatus = (status) => {
@@ -330,12 +331,26 @@ export class Engine {
             const seal = wf.journal.entries().find(e => e.type === JT.sealed && e.call === from);
             if (seal && send.kind === 'steer')
                 return { action: 'reject', reason: `finished:${seal.result.status} — use kind "follow-up" to continue it` };
+            if (send.kind === 'follow-up' && send.model !== undefined) {
+                try {
+                    if (!parseModel(send.model).provider)
+                        throw new Error('missing provider');
+                }
+                catch {
+                    return { action: 'reject', reason: 'unknown-model' };
+                }
+            }
             if (seal && send.kind === 'follow-up') {
                 const gen = Math.max(0, ...wf.journal.entries().filter(e => ['call', 'generation'].includes(e.type) && e.key === entry.key).map(e => Number(e.gen))) + 1;
-                const opened = await wf.journal.append('generation', { rid: req.rid, key: entry.key, gen, from, spec: entry.spec, revision: wf.revision, opening: { rid: req.rid, kind: send.kind, message: send.message ?? '' } });
+                // A follow-up's model replaces the continued session's for this generation and those continuing it.
+                const spec = send.model !== undefined ? { ...entry.spec, model: send.model } : entry.spec;
+                if (send.model !== undefined)
+                    await this.note(req.rid, send.model, 'next-generation');
+                const opened = await wf.journal.append('generation', { rid: req.rid, key: entry.key, gen, from, spec, revision: wf.revision, opening: { rid: req.rid, kind: send.kind, message: send.message ?? '' }, ...(send.model !== undefined ? { model: send.model } : {}) });
                 this.dispatchGeneration(wf, opened);
                 return { action: 'apply' };
             }
+            // A follow-up naming a model, queued on unfinished work: the executor records its model request with the message.
             return this.executor.forward(req, this.context(wf, entry));
         }
         else if (req.kind === 'stop') {
@@ -504,6 +519,11 @@ export class Engine {
             this.background(async () => { throw error; });
         });
     }
+    /** The reply to a send that names a model says which model and when it applies (orchestrator ledger `send-note`). */
+    async note(rid, model, effect) {
+        if (!this.ledgers.orch.entries().some(e => e.type === 'send-note' && e.rid === rid))
+            await this.ledgers.orch.append('send-note', { rid, model, effect });
+    }
     ticket(st, entry) {
         const spec = entry.spec, agent = st.wf.pins.agents.find(a => a.name === spec.agent);
         if (!agent)
@@ -511,7 +531,8 @@ export class Engine {
         return { wid: st.wf.wid, widRev: `${st.wf.wid}@${st.wf.revision}`, key: entry.key, gen: entry.gen,
             callId: `${st.wf.wid}@${st.wf.revision}/${entry.key}@${entry.gen}`, spec, agent, workflowBudget: st.wf.pins.usageBudget, cwd: resolve(st.wf.cwd, spec.cwd ?? '.'), journal: st.wf.journal,
             ...(st.wf.pins.origin !== undefined ? { originSession: join(pinnedDir(this.ledgers.home, st.wf.wid), ...(st.wf.revision === 1 ? [] : [`r${st.wf.revision}`]), 'origin.jsonl') } : {}),
-            ...(entry.type === 'generation' ? { continueFrom: entry.from, opening: entry.opening } : {}) };
+            ...(entry.type === 'generation' ? { continueFrom: entry.from, opening: entry.opening } : {}),
+            ...(entry.type === 'generation' && typeof entry.model === 'string' ? { model: entry.model } : {}) };
     }
     sealed(st, entry) {
         if (entry.type === 'refused')

package/dist/orchestrator/executor/index.js

@@ -22,7 +22,8 @@ import { buildCallResult } from "../../compat/result.js";
 import createEffects from "./effects/index.js";
 import { continueSession } from "./generation.js";
 import { hibernation, openQuestion } from "./hibernate.js";
-import { evidence, fatalProviderError, forgetSession, readSessionState, receiptId, sessionModel } from "./session.js";
+import { foldExhaustion } from "../providers.js";
+import { evidence, fatalProviderError, quotaExhausted, refusedByProvider, forgetSession, readSessionState, receiptId, sessionModel } from "./session.js";
 import { activeTotal } from "./time.js";
 import { observeExecution } from "./observe.js";
 import { availableMemory } from "./memory.js";
@@ -41,6 +42,39 @@ const entriesFor = (journal, call) => journal.entries().filter(e => e.call === c
 const current = (journal, call) => entriesFor(journal, call).findLast(e => e.type === JT.exec)?.exec;
 const sealed = (journal, call) => entriesFor(journal, call).find(e => e.type === JT.sealed)?.result;
 const has = (journal, type, exec) => journal.entries().some(e => e.type === type && e.exec === exec);
+/** The rid of the model request a follow-up naming a model makes (P12): derived, so withdrawing or replacing the
+ *  follow-up withdraws its model request too. */
+export const modelRid = (rid) => contentHash([rid, "model"]);
+/** The model a call was asked to use and has not used yet: a follow-up's `model`, then each model send in order. One the
+ *  child rejected or that was withdrawn does not count; one already used does not either — the child applied it, or an
+ *  execution of the call answered with it — so the session's model and the pool's fallback rule again after that.
+ *  Its next execution launches on it (P12, P37). */
+export function requestedModel(journal, call, followUp) {
+    const all = journal.entries(), execs = new Set(all.filter(e => e.type === JT.exec && e.call === call).map(e => String(e.exec)));
+    const same = (a, b) => b?.provider === a.provider && b?.id === a.id;
+    const usedAfter = (m, index) => all.some((e, i) => i > index && (e.type === "selected" || e.type === "model-used") && execs.has(String(e.exec)) && same(m, e.model));
+    let wanted;
+    if (followUp) {
+        const m = parseModel(followUp);
+        if (!usedAfter(m, -1))
+            wanted = m;
+    }
+    for (const [index, e] of all.entries()) {
+        if (e.type !== "forward" || e.dest !== call || e.envelope?.kind !== "model")
+            continue;
+        const delivered = all.find(r => r.type === "forward-delivered" && r.call === call && r.rid2 === e.rid2);
+        if (delivered) {
+            wanted = undefined;
+            continue;
+        } // applied by the child (now the session's model) or refused by it
+        if (all.some(r => r.type === "forward" && r.dest === call && r.envelope.kind === "withdraw" && r.envelope.body.rids?.includes(String(e.rid2))))
+            continue;
+        const body = e.envelope.body;
+        const m = { provider: body.provider, id: body.model, ...(body.thinking ? { thinking: body.thinking } : {}) };
+        wanted = usedAfter(m, index) ? undefined : m;
+    }
+    return wanted;
+}
 function address(call) {
     const match = /^(.*)@(\d+)\/(.*)@(\d+)$/.exec(call);
     if (!match)
@@ -82,7 +116,7 @@ export default function createExecutor(ledgers, options = {}) {
     const wake = () => { for (const fn of waiters)
         fn(); waiters.clear(); };
     // F3: fold only orchestrator entries appended since the last fold (holdings, observed switches, K7 skips).
-    const ledger = { seen: 0, held: new Map(), observed: new Set(), skips: new Map() };
+    const ledger = { seen: 0, held: new Map(), observed: new Set(), skips: new Map(), exhausted: new Map() };
     const folded = () => {
         const entries = orch.entries();
         for (; ledger.seen < entries.length; ledger.seen++) {
@@ -95,11 +129,17 @@ export default function createExecutor(ledgers, options = {}) {
                 ledger.observed.add(`${e.exec}\n${e.rid}`);
             else if (e.type === "skip")
                 ledger.skips.set(`${e.pool}\n${e.model}`, Math.max(Number(e.until), ledger.skips.get(`${e.pool}\n${e.model}`) ?? 0));
+            foldExhaustion(ledger.exhausted, e);
         }
         return ledger;
     };
     const holdings = () => [...folded().held.values()];
     const skipped = (pool, model) => (folded().skips.get(`${pool}\n${model.provider}/${model.id}`) ?? 0) > Date.now();
+    /** A provider whose usage window is used up admits no call until its next try, and then one probe at a time. */
+    const unavailable = (provider) => {
+        const x = provider ? folded().exhausted.get(provider) : undefined;
+        return !!x && (Date.now() < x.nextTry || x.probe !== undefined);
+    };
     async function release(exec) {
         await serial(async () => { for (const h of holdings().filter(e => e.exec === exec))
             await orch.append("release", { pool: h.pool, slot: h.slot, exec }); });
@@ -261,6 +301,11 @@ export default function createExecutor(ledgers, options = {}) {
         }
     }
     /** P7, P27: Record forward-delivered once when a forward's child receipt is first observed; serial sections only. */
+    /** The reply to a model send says which model and when it applies (orchestrator ledger `send-note`, once per rid). */
+    async function note(rid, model, effect) {
+        if (!orch.entries().some(e => e.type === "send-note" && e.rid === rid))
+            await orch.append("send-note", { rid, model, effect });
+    }
     async function forwardsDelivered(journal, call, entries) {
         const all = journal.entries();
         const open = all.filter(e => e.type === "forward" && e.dest === call &&
@@ -405,6 +450,9 @@ export default function createExecutor(ledgers, options = {}) {
                     if (!continuation && pool && skipped(pool, model))
                         continue;
                     const provider = model.provider;
+                    if (unavailable(provider))
+                        continue;
+                    const probe = provider !== undefined && folded().exhausted.has(provider);
                     const holders = holdings().filter(e => e.pool === provider);
                     const limit = config.providers?.[provider ?? ""]?.slots ?? Infinity;
                     if (!capacity({ kind: "provider", holders: holders.length, capacity: limit }))
@@ -432,6 +480,10 @@ export default function createExecutor(ledgers, options = {}) {
                         while (holders.some(e => e.slot === slot))
                             slot++;
                         await orch.append("hold", { pool: provider, slot, exec });
+                        // After its next try, the first call admitted to a used-up provider is its probe: its first request
+                        // either goes through (the provider is available again) or is refused, which uses no quota.
+                        if (probe)
+                            await orch.append("provider-probe", { provider, exec });
                     }
                     await a.ticket.journal.append("selected", { exec, model, ...(pool ? { pool } : {}) });
                     return model;
@@ -460,7 +512,16 @@ export default function createExecutor(ledgers, options = {}) {
         const pool = raw && config.pools?.[raw] ? raw : undefined;
         const candidates = raw ? resolveModel(raw, config.pools) : [{ id: "" }];
         const candidate = recorded && candidates.some(m => m.provider === recorded.provider && m.id === recorded.id);
-        const skip = previous && ownSegment && pool && candidate && skipped(pool, recorded);
+        // Leave the session's model for the pool's others when its pool skips it after losses, or its provider's usage
+        // window is used up; and at a new generation, go back to the pool's order of preference.
+        const skip = pool && candidate && (previous && ownSegment && skipped(pool, recorded) || unavailable(recorded.provider) || !ownSegment && !!t.continueFrom);
+        // A model the call was asked to use replaces the session's: launched with it, and holding its provider's slot.
+        const wanted = requestedModel(t.journal, t.callId, t.model);
+        // It outranks the pool's order at a new generation too, also when it names the model the session already has.
+        if (wanted)
+            return recorded && !freshFork && recorded.provider === wanted.provider && recorded.id === wanted.id
+                ? { candidates: [recorded], continuation: true, pool: undefined }
+                : { candidates: [wanted], continuation: false, pool: undefined };
         if (recorded && !freshFork && !skip)
             return { candidates: [recorded], continuation: true, pool: candidate ? pool : undefined };
         return { candidates, continuation: false, pool };
@@ -487,11 +548,26 @@ export default function createExecutor(ledgers, options = {}) {
             }
         });
     }
-    async function switched(exec, event) {
-        const provider = event.message?.provider;
+    /** The model each execution last answered with (`selected`, then `model-used`), cached per execution. */
+    const inUse = new Map();
+    async function switched(exec, journal, event) {
+        const message = event.message, provider = message?.provider;
         if (!provider)
             return;
         await serial(async () => {
+            // Evidence of the model in use: the provider and model of each assistant message, recorded when it changes.
+            if (message.role === "assistant" && message.model) {
+                const name = `${provider}/${message.model}`;
+                if (!inUse.has(exec)) {
+                    const last = journal.entries().findLast(e => (e.type === "selected" || e.type === "model-used") && e.exec === exec)?.model;
+                    if (last)
+                        inUse.set(exec, `${last.provider}/${last.id}`);
+                }
+                if (inUse.get(exec) !== name) {
+                    await journal.append("model-used", { exec, model: { provider, id: message.model } });
+                    inUse.set(exec, name);
+                }
+            }
             const target = holdings().find(h => h.exec === exec && h.pool === provider && h.reserved);
             if (!target)
                 return;
@@ -503,6 +579,32 @@ export default function createExecutor(ledgers, options = {}) {
         });
         wake();
     }
+    /** The model an execution last answered with, or was launched on. */
+    function modelOf(journal, exec) {
+        return journal.entries().findLast(e => (e.type === "selected" || e.type === "model-used") && e.exec === exec)?.model;
+    }
+    /** Record a used-up provider once per window: again only when its probe (or any call after the next try) is refused. */
+    async function recordExhausted(provider, exec, error) {
+        const x = folded().exhausted.get(provider), now = Date.now();
+        // While a probe runs, its outcome alone decides: a late refusal of an execution admitted earlier changes nothing.
+        if (x && (x.probe ? x.probe !== exec : now < x.nextTry))
+            return;
+        if (orch.entries().some(e => e.type === "provider-exhausted" && e.exec === exec))
+            return;
+        await orch.append("provider-exhausted", { provider, exec, since: x?.since ?? now, nextTry: now + (config.k?.probeMs ?? 900_000), error: error.slice(0, 300) });
+    }
+    /** An answer from a used-up provider, requested after it was found used up: available again. */
+    async function answered(exec, event) {
+        const message = event.message, provider = message?.provider;
+        if (message?.role !== "assistant" || !provider || message.stopReason === "error")
+            return;
+        await serial(async () => {
+            const x = folded().exhausted.get(provider);
+            if (x && (x.probe === exec || Number(message.timestamp) > x.since))
+                await orch.append("provider-available", { provider, exec });
+        });
+        wake();
+    }
     function pendingSwitch(exec) {
         return holdings().find(h => h.exec === exec && h.reserved && !folded().observed.has(`${exec}\n${h.rid}`));
     }
@@ -579,11 +681,20 @@ export default function createExecutor(ledgers, options = {}) {
                         return finish(journal, t.callId, exec, makeResult("unknown", "", `Unknown tool outcomes: ${dangling.join(", ")}`));
                     if (has(journal, "settled", exec) && !ev.text && ev.error && fatalProviderError(ev.error))
                         return finish(journal, t.callId, exec, makeResult("failed", "", `Provider error: ${ev.error}`));
-                    await serial(async () => {
-                        if (!has(journal, "loss", exec))
-                            await journal.append("loss", { exec });
-                        await skipLostCandidate(journal, orch, exec);
-                    });
+                    // A refusal of the content is deterministic: the same request is refused again, so it is reported, not retried.
+                    if (has(journal, "settled", exec) && !ev.text && ev.error && refusedByProvider(ev.error))
+                        return finish(journal, t.callId, exec, makeResult("failed", "", `Refused by the provider (not retried): ${ev.error.slice(0, 500)}`));
+                    // A used-up usage window is no loss: the provider is avoided until a probe finds it accepting requests again,
+                    // and the call goes on with the pool's next model, or waits for that provider.
+                    const exhausted = has(journal, "settled", exec) && !ev.text && ev.error && quotaExhausted(ev.error) ? modelOf(journal, exec)?.provider : undefined;
+                    if (exhausted)
+                        await serial(() => recordExhausted(exhausted, exec, ev.error));
+                    else
+                        await serial(async () => {
+                            if (!has(journal, "loss", exec))
+                                await journal.append("loss", { exec });
+                            await skipLostCandidate(journal, orch, exec);
+                        });
                     const losses = journal.entries().filter(e => e.type === "loss" && String(e.exec).startsWith(`${t.callId}#`)).length;
                     if (losses >= (config.k?.lossBound ?? 5))
                         return finish(journal, t.callId, exec, makeResult("failed", "", `lost ×${losses}${ev.error ? `; last error: ${ev.error.slice(0, 300)}` : ""}`));
@@ -679,7 +790,7 @@ export default function createExecutor(ledgers, options = {}) {
                             }
                         });
                     }, recordUsage: values => recordUsage(t, values),
-                    switched: event => switched(exec, event), pendingSwitch: () => pendingSwitch(exec),
+                    switched: event => switched(exec, journal, event), answered: event => answered(exec, event), pendingSwitch: () => pendingSwitch(exec),
                 });
             }
             finally {
@@ -716,6 +827,9 @@ export default function createExecutor(ledgers, options = {}) {
                 finally {
                     active.delete(ticket.callId);
                     collected.delete(ticket.callId);
+                    for (const e of inUse.keys())
+                        if (callOf(e) === ticket.callId)
+                            inUse.delete(e);
                     forgetSession(callSession(home, ticket.wid, ticket.key, ticket.gen));
                     wake();
                 }
@@ -763,28 +877,70 @@ export default function createExecutor(ledgers, options = {}) {
                         return { action: "apply" };
                     }
                 }
+                /** P12: a model request to this call, recorded with the rid given; a reject has no effect. */
+                const requestModel = async (rid, model, hash, cond) => {
+                    let body;
+                    try {
+                        const m = parseModel(model);
+                        if (!m.provider)
+                            throw new Error("Missing provider");
+                        body = { provider: m.provider, model: m.id, ...(m.thinking ? { thinking: m.thinking } : {}) };
+                    }
+                    catch {
+                        return { action: "reject", reason: "unknown-model" };
+                    }
+                    const envelope = { to: dest, kind: "model", body, ...(cond && Object.keys(cond).length ? { cond } : {}) };
+                    const rid2 = forwardRid(rid, ctx.widRev, ctx.key, hash);
+                    const exec = current(ctx.journal, dest), provider = body.provider;
+                    // P28: with no live execution (not started yet, between executions, hibernated while asking) the model is
+                    // recorded and the next execution launches on it (`requestedModel`); its slot is acquired then, as for any launch.
+                    // Launching (`selected`, not `tracked` yet): the child may start on the old model; ask again in a moment.
+                    const idle = !exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "selected", exec);
+                    if (!idle && !has(ctx.journal, "tracked", exec))
+                        return { action: "reject", reason: "call-starting" };
+                    if (!idle && pendingSwitch(exec))
+                        return { action: "reject", reason: "switch-pending" };
+                    if (!idle) {
+                        const held = holdings().filter(h => h.exec === exec);
+                        if (!held.some(h => h.pool === provider)) {
+                            const target = holdings().filter(h => h.pool === provider);
+                            if (!capacity({ kind: "provider", holders: target.length, capacity: config.providers?.[provider]?.slots ?? Infinity }))
+                                return { action: "reject", reason: "provider-full" };
+                            let slot = 0;
+                            while (target.some(h => h.slot === slot))
+                                slot++;
+                            await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid });
+                        }
+                    }
+                    await note(req.rid, model, idle ? "next-execution" : "next-request");
+                    const entry = await ctx.journal.append("forward", { rid, rid2, dest, hash, envelope });
+                    await replayForward(entry);
+                    if (idle) {
+                        active.get(dest)?.wake();
+                        wake();
+                    }
+                    return undefined;
+                };
                 let kind, body;
+                if (req.kind === "send" && req.body.kind === "follow-up" && req.body.model !== undefined) {
+                    // A follow-up naming a model, queued on unfinished work: the model request and the message are recorded in one
+                    // section, so a seal cannot come between them (both or neither). A replay finds the model request recorded.
+                    const mrid = modelRid(req.rid);
+                    if (!ctx.journal.entries().some(e => e.type === "forward" && e.rid === mrid && e.dest === dest)) {
+                        const refused = await requestModel(mrid, req.body.model, contentHash([hash, "model"]));
+                        if (refused)
+                            return { action: "reject", reason: `model: ${refused.reason}` };
+                    }
+                }
                 if (req.kind === "withdraw") {
                     kind = "withdraw";
-                    const targets = req.body.rids;
+                    const targets = req.body.rids.flatMap(rid => [rid, modelRid(rid)]);
                     body = { rids: ctx.journal.entries().filter(e => e.type === "forward" && e.dest === dest && targets.includes(String(e.rid))).map(e => String(e.rid2)) };
                 }
                 else if (req.kind === "send") {
                     const send = req.body;
                     kind = send.kind;
-                    if (kind === "model") {
-                        try {
-                            const m = parseModel(send.model ?? "");
-                            if (!m.provider)
-                                throw new Error("Missing provider");
-                            body = { provider: m.provider, model: m.id, ...(m.thinking ? { thinking: m.thinking } : {}) };
-                        }
-                        catch {
-                            return { action: "reject", reason: "unknown-model" };
-                        }
-                    }
-                    else
-                        body = { message: send.message ?? "" };
+                    body = kind === "model" ? undefined : { message: send.message ?? "" };
                 }
                 else
                     return { action: "reject", reason: "unsupported" };
@@ -797,30 +953,15 @@ export default function createExecutor(ledgers, options = {}) {
                     else
                         delete cond.after;
                 }
+                if (kind === "model")
+                    return (await requestModel(req.rid, req.body.model ?? "", hash, cond)) ?? { action: "apply" };
                 const envelope = { to: dest, kind, body, ...(Object.keys(cond).length ? { cond } : {}) };
                 const rid2 = forwardRid(req.rid, ctx.widRev, ctx.key, hash);
-                if (kind === "model") {
-                    const exec = current(ctx.journal, dest), provider = body.provider;
-                    if (!exec || has(ctx.journal, JT.fenced, exec) || !has(ctx.journal, "tracked", exec))
-                        return { action: "reject", reason: "call-not-running" };
-                    if (pendingSwitch(exec))
-                        return { action: "reject", reason: "switch-pending" };
-                    const held = holdings().filter(h => h.exec === exec);
-                    if (!held.some(h => h.pool === provider)) {
-                        const target = holdings().filter(h => h.pool === provider);
-                        if (!capacity({ kind: "provider", holders: target.length, capacity: config.providers?.[provider]?.slots ?? Infinity }))
-                            return { action: "reject", reason: "provider-full" };
-                        let slot = 0;
-                        while (target.some(h => h.slot === slot))
-                            slot++;
-                        await orch.append("hold", { pool: provider, slot, exec, reserved: true, rid: req.rid });
-                    }
-                }
                 const entry = await ctx.journal.append("forward", { rid: req.rid, rid2, dest, hash, envelope });
                 await replayForward(entry);
                 if (kind === "withdraw") {
                     const exec = current(ctx.journal, dest), reservation = exec && pendingSwitch(exec);
-                    if (reservation && req.body.rids.includes(String(reservation.rid)))
+                    if (reservation && req.body.rids.some(rid => rid === reservation.rid || modelRid(rid) === reservation.rid))
                         active.get(dest)?.wake();
                 }
                 return { action: "apply" };

package/dist/orchestrator/executor/observe.js

@@ -110,8 +110,10 @@ export async function observeExecution(d) {
                 await serial(() => t.journal.append("observation", { exec, event: slim }));
                 if (event.type === "message_start")
                     await d.switched(event);
-                if (event.type === "message_end")
+                if (event.type === "message_end") {
                     await d.recordUsage([{ id: String(slim.id), usage: slim.usage }]);
+                    await d.answered?.(event);
+                }
             }
             await limits();
             await stall();

package/dist/orchestrator/executor/session.js

@@ -107,12 +107,43 @@ export function evidence(entries, exec) {
     const error = last?.stopReason === "error" ? last.errorMessage : undefined;
     return { report, budget, text, error, dangling: [...tools].map(([id, name]) => `${name} (${id})`), usage };
 }
-/** Only explicit quota/payment failures are terminal; rate limits, overload and transport errors still retry. */
+/** Only explicit payment failures are terminal; rate limits, overload and transport errors still retry, and a used-up
+ *  usage window (`quotaExhausted`) waits for the provider or moves to another one. */
 export function fatalProviderError(text) {
-    return /\b402\b|insufficient[_ ]?(quota|balance|funds)|quota (exceeded|exhausted)|billing|credit balance|额度|余额|usage limit/i.test(text);
+    return /\b402\b|insufficient[_ ]?(quota|balance|funds)|billing|credit balance|余额/i.test(text);
 }
-/** P13, C8: Restore the effective provider from the native session's model changes. */
+/** A provider's usage window is used up: its requests are refused (and not counted) until the window resets, hours
+ *  later. Seen as a gateway's `503 No available accounts` once pi's own retries are spent, or a usage-limit message.
+ *  The provider is then avoided until a probe finds it accepting requests again. */
+export function quotaExhausted(text) {
+    if (fatalProviderError(text))
+        return false;
+    if (/no available accounts?/i.test(text))
+        return true;
+    // A request rate limit clears in seconds ("rate limit exceeded; resets in 1 second", "quota exceeded for requests
+    // per minute"): pi's retries and the lost-execution path handle it; it must not take the provider out for minutes.
+    if (/rate.?limit|too many requests|request limit|per (second|minute)|\b[RT]PM\b|resets? in \d+ ?(ms|s|secs?|seconds?|minutes?)\b/i.test(text))
+        return false;
+    return /usage limit|quota (exceeded|exhausted)|exceeded your (current )?(usage|quota)|limit (reached|exceeded)[^.]*resets?\b|额度/i.test(text);
+}
+/** A refusal of the request's content (terms of service, usage or content policy): the same request is refused again,
+ *  on this provider and usually on another, so it is reported at once instead of retried as a lost execution. */
+export function refusedByProvider(text) {
+    // A content filter that is down ("temporarily unavailable, please retry") is a transient failure, not a refusal.
+    if (/temporar|unavailable|try again|retry|timed? ?out|overloaded/i.test(text))
+        return false;
+    return /terms of service|usage polic(y|ies)|acceptable use|content[_ ]?(policy|filter|management policy)|safety (system|filter)|flagged as (unsafe|harmful)/i.test(text);
+}
+/** P13, C8: Restore the effective provider as pi does: from the last model change or assistant message. */
 export function sessionModel(entries) {
-    const last = entries.findLast(e => e.type === "model_change" && e.provider && e.modelId);
-    return last ? { provider: last.provider, id: last.modelId } : undefined;
+    // pi restores the model of the last model change or assistant message: a relaunch with `--model` on an existing
+    // session records no model change, so only the answer tells which model the session went on with.
+    const last = entries.findLast(e => e.type === "model_change" && e.provider && e.modelId
+        || e.type === "message" && e.message?.role === "assistant" && !!e.message.provider && !!e.message.model);
+    if (!last)
+        return undefined;
+    if (last.type === "model_change")
+        return { provider: last.provider, id: last.modelId };
+    const m = last.message;
+    return { provider: m.provider, id: m.model };
 }

package/dist/orchestrator/providers.js

@@ -0,0 +1,21 @@
+/** Apply one orchestrator ledger entry to the map of used-up providers. */
+export function foldExhaustion(exhausted, e) {
+    const provider = String(e.provider ?? e.pool ?? "");
+    if (e.type === "provider-exhausted") {
+        // A refusal of the probe ends it; any other execution's (the executor records none while a probe runs) keeps it.
+        const probe = exhausted.get(provider)?.probe;
+        exhausted.set(provider, { since: Number(e.since), nextTry: Number(e.nextTry), error: String(e.error ?? ""), ...(probe && probe !== e.exec ? { probe } : {}) });
+    }
+    else if (e.type === "provider-available")
+        exhausted.delete(provider);
+    else if (e.type === "provider-probe") {
+        const x = exhausted.get(provider);
+        if (x)
+            x.probe = String(e.exec);
+    }
+    else if (e.type === "release") {
+        const x = exhausted.get(provider);
+        if (x && x.probe === e.exec)
+            delete x.probe;
+    }
+}

package/dist/orchestrator/snapshot.js

@@ -6,6 +6,7 @@ import { compileFanout } from "../compat/fanout.js";
 import { readJournalSnapshot } from "../kernel/journal.js";
 import { journalPath, orchLedger, pinnedDir, workflowDir } from "../paths.js";
 import { JT } from "../types.js";
+import { foldExhaustion } from "./providers.js";
 /** A workflow has live work: it runs, or follow-ups opened on it after it finished have not ended yet. */
 export function isLive(wf) {
     return wf.status === "running" || (wf.followUps ?? 0) > 0;
@@ -152,6 +153,12 @@ function snapshotReducer(wid, entries) {
                 if (call && call.phase === "queued")
                     call.phase = "running";
             }
+            else if (e.type === "model-used") {
+                // Evidence of a switch: the execution answered with another model than it launched with.
+                const call = byExec.get(String(e.exec)), m = e.model;
+                if (call && m)
+                    call.model = m.provider ? `${m.provider}/${m.id}` : m.id;
+            }
             else if (e.type === "observation") {
                 // Only what the agent did counts as activity; tracker scans and time checkpoints are bookkeeping.
                 const call = byExec.get(String(e.exec));
@@ -195,6 +202,13 @@ function snapshotReducer(wid, entries) {
                 const list = sends.get(String(e.dest)) ?? [];
                 list.push(send);
                 sends.set(String(e.dest), list);
+                // A withdrawn model request no longer stands (the executor ignores it for the next launch as well).
+                if (envelope?.kind === "withdraw")
+                    for (const rid2 of envelope.body?.rids ?? []) {
+                        const target = byRid2.get(`${e.dest}\n${rid2}`);
+                        if (target?.kind === "model" && target.state === "pending")
+                            target.reason = "withdrawn";
+                    }
                 byRid2.set(`${e.dest}\n${e.rid2}`, send);
                 byRid2.set(String(e.rid2), send);
             }
@@ -239,9 +253,11 @@ function snapshotReducer(wid, entries) {
                 const pending = forwarded.filter(pendingMessage).length;
                 if (pending)
                     c.pending = pending;
-                const switching = c.phase !== "sealed" ? forwarded.findLast(s => s.kind === "model" && s.state === "pending")?.model : undefined;
-                if (switching && switching !== c.model?.replace(/:(off|minimal|low|medium|high|xhigh|max)$/, ""))
-                    c.switching = switching;
+                const last = c.phase !== "sealed" && !retired.has(c.callId) ? forwarded.findLast(s => s.kind === "model" && s.reason !== "withdrawn") : undefined;
+                if (last?.reason !== undefined)
+                    c.switchFailed = `${last.model} (${last.reason})`;
+                else if (last && last.state !== "retired" && last.model !== c.model?.replace(/:(off|minimal|low|medium|high|xhigh|max)$/, ""))
+                    c.switching = last.model;
             }
         }
         const after = done ? list.filter(c => generations.has(c.callId) && c.phase !== "sealed" && !retired.has(c.callId)) : [];
@@ -404,7 +420,7 @@ export function compactWorkflow(wf) {
         calls: wf.calls.map(c => {
             const r = c.result, last = r?.output?.split("\n").map(l => l.trim()).filter(Boolean).at(-1);
             return { key: c.key, gen: c.gen, callId: c.callId, phase: c.phase, ...(r ? { status: r.status, ok: r.ok } : {}),
-                ...(c.model ? { model: c.model } : {}), ...(c.tools ? { tools: c.tools } : {}), ...(c.pending ? { pending: c.pending } : {}), ...(c.switching ? { switching: c.switching } : {}), ...(nonzero(c.usage) ? { usage: c.usage } : {}),
+                ...(c.model ? { model: c.model } : {}), ...(c.tools ? { tools: c.tools } : {}), ...(c.pending ? { pending: c.pending } : {}), ...(c.switching ? { switching: c.switching } : {}), ...(c.switchFailed ? { switchFailed: c.switchFailed } : {}), ...(nonzero(c.usage) ? { usage: c.usage } : {}),
                 ...(last ? { lastLine: clip(last, 200) } : {}), ...(r?.error ? { error: clip(r.error, 300) } : {}), ...(c.hibernated ? { hibernated: true } : {}) };
         }),
         attention: wf.attention.map(a => ({ id: a.id, rev: a.rev, kind: a.kind, text: clip(a.text, 300), ...(a.call ? { call: a.call } : {}), ...(a.qid ? { qid: a.qid } : {}) })),
@@ -454,7 +470,7 @@ const latestCalls = (wf) => [...new Map(wf.calls.map(c => [c.key, c])).values()]
 /** Provider slots from the orchestrator ledger: holders per provider (hold/release{pool,slot,exec}) and the limits of
  *  the settings in effect (the latest config{hash,config}); config-rejected after it is reported too. */
 export function slotsView(home, now = Date.now()) {
-    const held = new Map();
+    const held = new Map(), used = new Map();
     let config, rejected;
     for (const e of readJournalSnapshot(orchLedger(home))) {
         if (e.type === "hold")
@@ -467,7 +483,10 @@ export function slotsView(home, now = Date.now()) {
         }
         else if (e.type === "config-rejected")
             rejected = e;
+        foldExhaustion(used, e);
     }
+    const exhausted = [...used].sort(([a], [b]) => a.localeCompare(b)).map(([p, x]) => `${p} exhausted since ${age(now - x.since)} ago (${clip(x.error, 80)}), ` +
+        (x.probe ? `probing with ${x.probe.split("#")[0]}` : x.nextTry > now ? `next try in ${age(x.nextTry - now)}` : "next call probes it"));
     const limits = (config?.config?.providers) ?? {};
     const holders = new Map();
     for (const e of held.values())
@@ -476,6 +495,7 @@ export function slotsView(home, now = Date.now()) {
     const names = [...new Set([...Object.keys(limits), ...holders.keys()])].sort();
     const slots = names.map(p => { const n = holders.get(p) ?? 0, limit = limits[p]?.slots; return typeof limit === "number" ? `${p} ${n}/${limit}` : `${p} ${n} (no limit)`; });
     return { ...(slots.length ? { slots } : {}), ...(config ? { config: `${String(config.hash)} since ${age(now - config.ts)} ago` } : {}),
+        ...(exhausted.length ? { exhausted } : {}),
         ...(rejected ? { configRejected: `${clip(String(rejected.error), 200)} (${age(now - rejected.ts)} ago); ${config ? String(config.hash) : "the start settings"} stay in effect` } : {}) };
 }
 /** Tool status without a wid: what runs, what waits for an answer and what failed, with finished workflows one line each.
@@ -498,7 +518,8 @@ export function statusBrief(home, options = {}) {
                 ...(live && c.phase !== "asking" && quiet !== undefined && quiet >= 60_000 ? { quiet: age(quiet) } : {}),
                 ...(live && c.startedAt !== undefined ? { tokens: tokens(c.usage) } : {}),
                 ...(c.result ? { status: c.result.status, ...(c.result.error ? { error: clip(c.result.error, 200) } : {}) } : {}),
-                ...(c.hibernated ? { hibernated: true } : {}) };
+                ...(c.hibernated ? { hibernated: true } : {}),
+                ...(live && c.switching ? { switching: c.switching } : {}), ...(live && c.switchFailed ? { switchFailed: c.switchFailed } : {}) };
         });
         const asking = open.filter(a => a.kind === "question" && a.call).map(a => ({ to: `${w.wid}/${callKey(a.call)}`, ...(a.qid ? { qid: a.qid } : {}),
             ...(w.calls.some(c => c.callId === a.call && c.hibernated) ? { hibernated: true } : {}), question: clip(a.text, 300) }));

package/dist/ui/screen.js

@@ -565,7 +565,7 @@ export class SubagentScreen {
         const facts = this.data.facts.get(c.callId), active = w.calls.filter(c => c.phase !== "sealed"), done = w.calls.length - active.length;
         const tabs = size.width < 60 ? `${c.key} ${w.calls.indexOf(c) + 1}/${w.calls.length}` : `${[...active.map(c => c.key), ...(done ? [`${done} done`] : [])].join(" · ")}    ← → switch`;
         const tools = toolCount(facts?.tools), pending = pendingText(c.pending), rule = this.theme.fg("borderMuted", "─".repeat(size.width));
-        const switching = c.switching ? ` → ${this.name(c.switching)} (at the end of this step)` : "";
+        const switching = c.switching ? ` → ${this.name(c.switching)} (requested)` : "";
         const head = [tabs, `${label(c)} · ${this.name(facts?.model ?? c.model)} ▾${switching} · ${facts?.thinking ?? "off"} ▾${tools ? ` · ${tools}` : ""}${pending ? ` · ${pending}` : ""}`,
             this.theme.fg("dim", this.spend(c, facts)), rule];
         const asking = w.attention.some(a => a.kind === "question" && a.call === c.callId);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-durable-subagents",
-  "version": "1.0.8",
+  "version": "1.0.10",
   "description": "Subagents for pi that never lose work and never do it twice. Crash-safe workflows, automatic recovery, and a live view just like the main agent.",
   "type": "module",
   "license": "MIT",