pi-goal-list-loop-audit 0.34.138 → 0.35.4

package/README.md

@@ -10,7 +10,7 @@ This is a detached process, not a nested session in the main pi process. `comple
 
 On Windows, npm installs the `pi.cmd` shim rather than a directly executable `pi` binary. The auditor launches it through an explicitly quoted `cmd.exe` boundary; POSIX keeps direct shell-less execution. Protocol snapshots also tolerate transient Windows file-locks without deleting the last valid snapshot first.
 
-**Current package version:** `v0.34.138` — use `/glla version` to see the installed version and the command for comparing it with the registry latest. This checkout may contain unreleased changes; the npm registry is authoritative for published versions.
+**Current package version:** `v0.35.3` — use `/glla version` to see the installed version and the command for comparing it with the registry latest. This checkout may contain unreleased changes; the npm registry is authoritative for published versions.
 
 ## Why this exists
 
@@ -122,6 +122,26 @@ ONE confirmed batch, not 50 dialogs.
 Note: every list item is audited individually, so at hundreds of items the
 audit cost per item is the thing to think about.
 
+Long-running judgment is explicit: the drafter preserves the objective and
+verification contract, prefers a durable root-cause fix, allows a safe,
+reversible workaround when it is genuinely useful, and asks only at an actual
+scope/permission/irreversible-action decision boundary. If you want a design
+checkpoint before implementation, mark a goal, list item, or task-plan entry
+with `Agent: Designer` (also accepted: `Role: designer` or `Designer: yes`).
+The managed Designer is read-only; if it is unavailable, the main agent keeps
+the same checkpoint inline.
+
+Drafting can use a separate temporary agent configured in `/glla` under the
+**Drafter** tab (`Drafter agent`, `Drafter thinking`, and `Drafter fallback
+agents`).
+The thinking choice is derived from the selected model, applies only while the
+drafting agent is active, and restores the original session thinking level
+after confirmation or interruption. A drafting failure retries the existing
+interview through that agent's fallback chain. Main-agent and auditor-agent
+recovery chains remain separate. Provider recovery is intentionally blind:
+there is no live quota checking or reset inference; the generic retry envelope
+and the optional hourly `:00:30` probe remain the policy.
+
 **Drafting is the default for long-running things.** `/goal` and
 `/loop` with no arguments — and any vague `/list` dump — all start a
 grilling turn that ends in a Confirm dialog. For `/loop` specifically, the orchestrator **test-runs the proposed
@@ -231,13 +251,17 @@ A persistent `glla:` status segment + an above-editor widget show the current
 goal/list item/loop at all times: objective, durable state, elapsed time,
 tokens, next task or loop metric, pause reason, and live auditor progress
 during audits. If something is running, you can see it — no command needed.
+Goal cards label their total wall-clock age explicitly; it includes time parked
+for recovery or waiting on a verdict, so it should not be read as active model
+compute. Recovery cards call the timestamp `last host activity` for the same
+reason: a retry/error event is liveness evidence, not proof of useful work.
 
 The status bar is the single activity HUD. It uses compact state capsules plus
 an animated pulse waveform so live work is obvious at a glance without turning
 the line into a progress meter. Fresh stream age is the proof of live work:
 
 ```text
-glla: [▁▂▄▆█▆ LIVE · WORKING] 1m 09s · last stream 11s ago · 3 queued
+glla: [▁▂▄▆█▆ LIVE · WORKING] total 1m 09s · last stream 11s ago · 3 queued
 glla: [QUEUED] 44s · 18 queued
 ```
 
@@ -252,63 +276,62 @@ Activity is otherwise intentionally honest:
 | `QUEUED` | A continuation is waiting to start; no work is fabricated. |
 | `IDLE` | The durable item remains active, but no recent work is observed. |
 | `auditor …` | A detached, extension-less verifier is queued, running, quiet, or waiting for its verdict. |
-| `QUOTA WALL` | The provider rejected the request for a quota/plan window (by its own wording); saved work is waiting for a durable probe. |
-
-## Provider failures: one retry envelope, bounded (v0.34.51)
-
-Error text is **not trusted** to pick a retry policy: we only know that an
-error came, and provider messages vary. Every main-model failure — quota,
-rate limit, billing/credits, auth, transient, or unclassifiable — rides the
-same durable recovery envelope `15m → 30m → 1h → 2h → 4h → 5h` (probe cap
-5h, automatic window 24h, then an explicit `/goal resume`/`/list resume`/
-`/loop resume` starts a fresh window). The only failures that do not auto-retry
-are the ones identified by *positive evidence* as futile: context/output-token
-limits and user aborts (`non-recoverable`), plus auditor watchdog timeouts
-(a hanging verification command will hang again — the stored claim waits for
-an explicit resume).
-A provider hint (`retry_after`/`reset_at`) is honored when it fits the
-five-hour probe budget; an over-budget hint (e.g. a week-long reset) never
-parks the goal — the bounded cadence owns the wait, and only the 24h horizon
-ends automatic probes (a `/goal resume`/`/list resume`/`/loop resume` then
-starts a fresh window). With global `autoResume=on`, pending
-probes survive a session reload. For continuous work, configure ordered
-**Main model backups** in `/glla` using a model from a different provider or
-billing/quota pool — another model on the same exhausted plan is not a real
-fallback.
-
-**Quota walls engage fast** (v0.34.57): a surfaced long-lived failure
-(quota / billing / auth) records a 30-minute knowledge window; a send-rearm
-storm inside that window escalates into the recovery envelope after **3
-minutes** of failed sends instead of the generic 15 — a wedge right after a
-quota wall is almost always the same wall. Transient (5xx/stream/network)
-failures never record the signal and keep the fast error ladder. The
-envelope is armed by configuration: an empty `mainModelFallbacks` list means
-"park and probe the same model" rather than switching pools — the
-never-switch posture is a first-class policy, not an accident.
-
-Classification still exists, but it only *labels*: the card and badge show
-what the provider said (quota wall, billing, rate limit) so the reason is
-diagnosable, and `QUOTA WALL` is only shown when the provider's own words say
-quota — ambiguous prose is never relabeled. The raw provider message stays in
-the ledger/durable state; the card shows the classified reason and recovery
-action. Detached-auditor failures get the same treatment: any infrastructure
-error on a stored completion claim pauses the goal with a durable bounded
-one-shot retry (`auditor retry: …`), and only the plan's 24h horizon stops
-automatic probes.
-
-The quota-specific card hides raw provider JSON while preserving it in durable
-state and the ledger:
-
-```text
-glla: ⟦⏳ QUOTA WALL · next probe in 10m 48s⟧ · 1 queued
-├─ QUOTA WALL · Token Plan usage limit · 1 waiting in list
-├─ waiting — nothing for you to do · next probe in 10m 48s
-```
-
-Increasing pi's per-request retry count is usually the wrong fix for a
-multi-hour plan cap: it prolongs the 429 noise and delays the durable pause;
-it does not make the provider reset sooner. A provider that says "reset in a
-week" therefore does not cause a week of unattended probes.
+| `RECOVERING` | A bounded automatic retry is pending; the status does not guess why the provider failed. |
+
+Detached-auditor elapsed time keeps advancing between worker events. A long
+tool call or hidden reasoning interval therefore remains visibly timed; after
+three minutes without worker activity the UI changes to `auditor quiet` and
+names the cancellation/recovery path instead of presenting a frozen live card.
+
+## Provider failures: aggressive retry envelope, bounded (v0.35.0)
+
+Error text is **not trusted** to pick a retry policy. The runtime does not
+query or infer provider quota state, and it does not use status codes, billing
+words, rate-limit words, or `Retry-After` hints to choose a branch. Those
+values are retained only as bounded diagnostics. Every recoverable main-model
+failure uses the same durable envelope: an eager 5-second retry, then
+`base → 2×base → 4×base → 8×base → 16×base → 5h`, where `base` is the
+`mainModelRetryMinutes` setting (15 minutes by default). `hourlyRetryProbe=on`
+adds a blind `:00:30` retry after each hour starts, so work can be picked up
+quickly after a possible provider-side change. The automatic window is 24h;
+explicit `/goal resume`, `/list resume`, or `/loop resume` starts a fresh
+window. With global `autoResume=on`, pending retries survive a session reload.
+
+Only failures identified by positive evidence as futile avoid automatic retry:
+context/output-token limits and user aborts (`non-recoverable`). Auditor
+watchdog timeouts are also kept separate because rerunning a hanging local
+verification command immediately would repeat the same local failure; the
+stored claim remains available for explicit resume.
+
+For continuous work, configure up to **10 ordered Main-agent fallback models**
+in `/glla` using independent model references when possible. The editor is in
+the **Main agent** settings tab (one role per tab, with the current agent,
+thinking level, and fallback chain together). It shows the actual try order as
+`current → fallback 1 → fallback 2 …`, shows each configured fallback's rank,
+lets **Space** add/remove a fallback, and **Tab** enters order mode where
+**↑/↓** moves the highlighted fallback (brackets `[` `]` also reorder without
+leaving the list). Every recoverable provider failure uses the same ordered
+chain: glla calls `setModel` for the first eligible fallback, the next
+supervised turn tests it, and later failures advance left-to-right. Forbidden,
+unavailable, and unauthenticated references are skipped; a successful
+supervised turn clears the episode. The chain is global, durable, and its
+attempted cursor survives reload. After the chain is exhausted, bounded
+retries continue on the active model rather than silently abandoning work.
+The Main agent tab shows the `N/10` count and numbered chain. The Drafter and
+Auditor tabs likewise show each selected model together with its requested
+thinking level; fallback rows show the effective/requested thinking level when
+the model registry exposes the capability map. Press `d` in the settings table
+to toggle the long descriptions and give the model/value column the available
+width.
+
+Provider payloads are never copied into chat cards or notifications. A bounded
+diagnostic may remain in the ledger and durable state for forensics, while
+user-facing surfaces use the same generic provider-error label for every
+failure family. The detached auditor follows the same rule: every retriable
+infrastructure failure gets one eager 5-second retry, then stored-claim
+retries at `:00:30` after each hour starts. Its existing 5-attempt/24-hour
+safety envelope prevents an unbounded worker storm; explicit resume starts a
+fresh window.
 
 For long-running `/list` work, the card adds a compact queue trail with the
 immediate next item and its truthful wait age while `/list` remains the
@@ -410,31 +433,48 @@ confirmation is intentionally not bypassed.
 Open `/glla` to edit these settings in the table (the rows show effective values and provenance):
 
 - Auditor model and thinking level
-- Auditor fallback model
+- Auditor fallback agent
 - Notify command, token limit, and wedge-alert minutes
 - Auto-resume, auto-accept drafts, decision popup, and carryover policy
-- Ordered main-session backups and recovery cadence
-- Audit cap/report size, aggressive mode, quota retry, and stall brakes
+- Main-agent current model/thinking, fallback models, and recovery cadence in the Main agent tab
+- Drafter agent/thinking/fallback agents in the Drafter tab
+- Auditor agent/thinking/fallback agent in the Auditor tab
+- Forbidden model patterns and switch policy
+- Audit cap/report size, aggressive mode (ON by default), retry cadence, and
+  stall brakes
 
 The argument namespace is reserved for actions such as `/glla status`, `/glla
 resume`, `/glla cancel`, `/glla stats`, `/glla audits`, `/glla tooloverride`,
-and `/glla wipe`. Cancel stops the active objective; wipe clears all live state
-while preserving history.
+`/glla fallbacks clear`, and `/glla wipe`. `fallbacks clear` atomically removes
+the global main-agent fallback chain and cancels any pending fallback switch. Cancel stops the
+active objective; wipe clears all live state while preserving history.
 There is no top-level `/glla key=value` setting syntax.
 
-Resolution per key: **project > global > defaults** — EXCEPT `autoResume`,
-which is **global-only** (v0.29.5): per-project opt-ins from old versions
+Resolution per key: **project > global > defaults** — EXCEPT `autoResume` and
+agent recovery settings (`mainModelFallbacks`, `mainModelRetryMinutes`,
+`drafterModel`, `drafterThinkingLevel`, `drafterModelFallbacks`,
+`hourlyRetryProbe`),
+which are **global-only**: per-project opt-ins from old versions
 silently overrode the global hold at launch (the junk-runner incident), so
 the launch-restore gate and the reviewer-enqueue gate read only the global
-file now. Main-session backups are global and ordered: a quota/provider error
-switches to the next authenticated candidate before another supervised turn;
-when every candidate is down, glla cancels the provider-held retry and uses a
-bounded `15m → 30m → 1h → 2h → 4h → 5h` probe ladder. Automatic recovery stops
-at 24h (or earlier when the provider supplies a reset beyond the five-hour
-budget), preserves the saved work, and requires an explicit `/goal resume`,
-`/list resume`, or `/loop resume` to start a fresh window. A quota window
-returning within that horizon therefore resumes saved work without manual
-intervention; no blind 50ms resend loop is introduced. The detached auditor uses an explicit cascade: primary
+file now. Main-session recovery policy is likewise one global chain/cadence
+for the active session. Main-agent fallback models are global and ordered (up to 10): a provider
+failure selects fallback 1, then fallback 2, and so on, one supervised turn at a
+time. The Main agent tab leads with the ordered-chain editor — a multi-select
+picker where Space toggles membership, Tab enters order mode (↑/↓ moves a
+chain row), and clearing the selection removes the global key. Forbidden,
+unavailable, and unauthenticated refs are skipped. When every candidate is
+down, glla stops the current send attempt and uses the configured
+`base → 2×base → 4×base → 8×base → 16×base → 5h` ladder (`base` defaults to
+15m). `hourlyRetryProbe=on` adds a blind :00:30 retry after each hour starts.
+No provider availability or quota check is made before any retry; all
+recoverable failures walk the ordered fallbacks and then continue on the active
+model through the bounded retry policy. Automatic recovery stops at 24h,
+preserves the saved work, and requires an explicit
+`/goal resume`, `/list resume`, or `/loop resume` to start a fresh window. A
+provider becoming available within that horizon therefore resumes saved work
+without manual intervention; no blind 50ms resend loop is introduced. The
+detached auditor uses an explicit cascade: primary
 `auditorModel` → optional fallback pin → the pi session model. If a selected
 model fails after launch, the worker retries it once and then advances through
 that same cascade; every candidate is still audited in a detached,
@@ -501,7 +541,10 @@ in-session warning + your configured notify push, once per interval while
 it persists. Tune Wedge alert minutes in the `/glla` settings table (0 = off).
 
 Every other wait is bounded too: continuation retries are milliseconds,
-stuck backoff caps at 5 minutes then pauses, measure commands get a 10m
+nudge accounting counts consecutive unproductive turns (substantive text
+or tool calls reset the counter) and pauses the goal / stops the loop after
+3 — provider-error and user-abort turns are exempt (v0.27.3+). Measure
+commands get a 10m
 hard timeout, and the detached auditor aborts after 10m with no activity while no
 an auditor tool is running. A long-running verification tool is allowed to
 finish, but each tool has an independent five-minute ceiling and the worker

package/docs/DESIGN.md

@@ -189,21 +189,40 @@ architectural decisions that changed the SHAPE of the system:
 
 ## Addendum v0.34.31 (main-session model recovery)
 
-- **Ordered global backups**: `mainModelFallbacks` is an explicit ordered list
-  of `provider/model` references. A provider/quota error can rotate the MAIN
-  session through authenticated candidates; the detached auditor's model
-  cascade remains a separate subsystem.
+> Historical rollout note: this section records the older reason-aware
+> recovery implementation. The active policy is the v0.34.142 addendum below;
+> quota/rate-limit wording no longer selects fallback or retry timing.
+
+- **Global recovery policy**: `mainModelFallbacks`,
+  `mainModelFallbackOnRateLimit`, `mainModelRetryMinutes`, and
+  `hourlyQuotaProbe` are global-only, so the runtime and settings provenance
+  cannot disagree about which recovery policy is active.
+- **Ordered global fallback agents**: `mainModelFallbacks` is an explicit ordered list
+  of up to 10 `provider/model` references. A provider/quota error selects the
+  first eligible authenticated candidate for account/plan/billing/auth failures,
+  calls `setModel`, and lets the next supervised turn test it; later failures
+  walk the list left-to-right. Explicit HTTP 429/request-rate failures also
+  walk the list when global `mainModelFallbackOnRateLimit` is on (default); off
+  keeps them on the current model with bounded retry + hourly probe cadence.
+  The detached auditor's model cascade remains a separate subsystem. The
+  ordered-chain editor lives in the **Main agent** settings tab: Space toggles
+  membership, Tab enters an explicit order mode where ↑/↓ moves a chain row,
+  and clearing the list removes the global key. The attempted cursor is durable, so a reload cannot
+  restart at an already-failed rung.
 - **No accepted-send inference**: model rotation occurs only after a provider
   failure is observed (or after a 15-minute, five-minute-silent provider-held
   retry storm). A successful `sendMessage()` return is never treated as a
   started turn.
 - **Durable recovery instead of abandonment**: when all candidates fail,
   `.pi-glla/active.jsonl` stores the primary, active candidate, attempted set,
-  retry time, and supervisor kind. Recovery probes back off 15m → 30m →
-  hourly forever (configurable base), while a paused goal/held loop remains
-  resumable. A fresh startup obeys the existing `autoResume` consent gate.
+  retry time, and supervisor kind. Unhinted recovery waits use the configured
+  `mainModelRetryMinutes` base and double per attempt up to 5h; factual
+  provider hints win when in budget, while `hourlyQuotaProbe` is a separate
+  optional :00:30 ticker. A paused goal/held loop remains resumable. A fresh
+  startup obeys the existing `autoResume` consent gate.
 - **Successful-turn reset**: a real non-error agent end clears the recovery
-  cycle. Manual model selection cancels it; goal/list/loop cancellation clears
+  cycle. Manual model selection cancels it; host restore selections do not, and
+  user aborts do not masquerade as success. Goal/list/loop cancellation clears
   its timer and durable state.
 
 ## Addendum v0.34.48–v0.34.56 (lifecycle/recovery hardening — the stale-handle era)
@@ -240,16 +259,23 @@ replacement without delivering a successor `session_start`:
   counterpart are represented as explicitly unmatched facts, never falsely paired —
   the report surface stays truthful (the AuditProgress/AuditorProgress dual-interface
   rule: display evidence-gates on `unmatchedStarts + unmatchedEnds > 0`).
-- **Uniform retry envelope, no text-trust** (v0.34.51): error text is not trusted to
-  pick a retry policy. Quota, billing, auth, transient, and unknown failures all ride
-  ONE bounded durable envelope `15m → 30m → 1h → 2h → 4h → 5h` (cap 5h, automatic
-  window 24h); classification only labels the display. The billing-hold special case
-  is removed (`main_model_billing_hold` is legacy). Positive-evidence futile classes
-  (context/output-token limits, user aborts) plus auditor watchdog timeouts never
-  auto-retry; provider hints are honored only within the 5h probe budget.
+- **Uniform retry envelope, no text-trust** (v0.34.51 historical baseline): error
+  text was not trusted to pick a retry policy. The current ordered-fallback policy
+  supersedes that baseline: account/plan/billing/auth failures may walk the configured
+  chain, while explicit HTTP 429/request-rate failures walk it when
+  `mainModelFallbackOnRateLimit` is on (default), or remain on the current model
+  when it is off. Both paths use the configured bounded ladder plus optional
+  hourly ticker. Positive-
+  evidence futile classes (context/output-token limits, user aborts) plus auditor
+  watchdog timeouts never auto-retry; provider hints are honored only within the
+  5h probe budget.
 
 ## Addendum v0.34.57 (quota walls engage recovery fast)
 
+> Historical rollout note: the knowledge-window and quota-specific branches
+> described here are retained for design history only and are not active in
+> v0.34.142.
+
 - **Knowledge-window escalation**: a surfaced long-lived failure (quota /
   billing / auth) records a 30-minute knowledge window. A send-rearm storm
   inside that window escalates into the recovery envelope after 3 minutes of
@@ -261,7 +287,25 @@ replacement without delivering a successor `session_start`:
   the 5s→3m error ladder and the pi-core retry budget.
 - **Armed by configuration**: the envelope is inert without
   `mainModelFallbacks` (rotation) — an empty list means "park and probe the
-  same model" instead of switching pools.
+  same model" instead of switching pools. When the list is non-empty, the
+  runtime tries one eligible fallback at a time in persisted order, skips
+  forbidden/unavailable refs, and parks only after the ordered chain is
+  exhausted. Explicit HTTP 429/rate-limit errors remain request-rate signals,
+  not token-limit labels; the global `mainModelFallbackOnRateLimit` switch
+  controls whether they walk that chain or stay current, and the optional
+  :00:30 hourly ticker can retry them.
+
+## Addendum Unreleased (process ownership and bounded fallback hardening)
+
+- **Worker ownership is durable**: detached auditor locks are rewritten with
+  the worker PID, allowing a replacement host to reap stale workers for the
+  same completion claim. Parent cancellation waits for exit and escalates to
+  the detached POSIX process group or Windows `taskkill /t` tree, so nested
+  shells/tests cannot outlive their worker.
+- **Test/smoke teardown is explicit**: direct worker fixtures and the tmux smoke
+  harness clean their owned process trees and temporary directories on normal,
+  failed, or interrupted exits. Browser processes are not launched by this
+  package; external Chrome automation remains outside this lifecycle boundary.
 
 ## Addendum v0.35.x (one-shot parked completion-audit recovery)
 
@@ -281,6 +325,49 @@ replacement without delivering a successor `session_start`:
   remains held unless the existing Auto-resume policy or a validated lifecycle
   handoff supplies consent. `/goal resume` still starts a direct fresh audit.
 
+## Addendum v0.34.142 (generic provider recovery)
+
+- **No quota availability check exists in the live policy**: provider text,
+  status codes, billing/rate-limit words, and upstream retry hints do not
+  select a recovery branch, fallback gate, or delay. They may remain as
+  bounded diagnostics for forensics and redaction only.
+- **One retry envelope covers every recoverable provider failure**: the first
+  retry is eager at 5 seconds, later retries use the configured bounded
+  ladder, and the optional `hourlyRetryProbe` adds a blind `:00:30` retry
+  after every hour starts. Main-model recovery and detached-auditor recovery
+  use this same reason-agnostic rule, with existing context/user-abort and
+  safety-horizon exceptions.
+- **Legacy state is inert**: old `quota-waiting` phases, quota-named retry
+  counters, and provider-hint fields are accepted only long enough to load
+  and normalize old files. Canonical persisted state uses `retry-waiting`,
+  `retryAttempts`, `retryFirstAt`, and `retryUntil`.
+
+## Addendum v0.35.0 (long-running judgment, Designer, and drafting chain)
+
+- **Judgment is a prompt-level contract**: drafting and continuation preserve
+  the objective and verification contract, prefer durable root-cause fixes,
+  allow only safe/reversible/testable in-scope workarounds, and ask one focused
+  question only at a genuine scope, priority, permission, or irreversible-action
+  boundary. The unattended fallback is explicit and never infers provider or
+  quota state.
+- **Designer routing is explicit, persisted, and read-only**: `Agent: Designer`,
+  `Role: designer`, and `Designer: yes` are declarations rather than natural
+  language classification. The role is carried by goals, queue items, and task
+  plans; continuation injects the hand-off; a managed `Designer.md` uses only
+  read/search tools; unavailable role/provider falls back to an inline design
+  checkpoint.
+- **Drafting owns a temporary agent lease**: the `/goal`, `/list`, and `/loop`
+  interviews resolve a separate primary/fallback chain, select a model-specific
+  thinking level, retry the existing interview after generic provider errors,
+  and restore the original model and thinking level after confirmation or
+  interruption. A current-session last resort is bounded and does not enter
+  main-goal recovery. A generation fence and serialized restore prevent
+  stale-session or overlapping-draft agent changes.
+- **Host replacement remains host-owned**: Pi event contexts do not expose the
+  command-only `newSession`/`fork`/`switchSession` operations. glla therefore
+  persists the work and truthfully asks for `/new` when no replacement boundary
+  arrives; the proposed event-safe host API is recorded in the audit docs.
+
 ## Addendum v0.4.0 (completion)
 
 - **Auditor compaction enabled** (flaw #3 — the last open one). Safety:

package/docs/RELEASING.md

@@ -18,10 +18,13 @@ the repository.
 ## Release checklist
 
 Accumulated changes since the last release live under an `## Unreleased`
-section at the top of `CHANGELOG.md` (with the in-repo milestone labels such
-as `### 0.34.51`); the release commit renames that section to the released
-version. Do not invent version headers for work that was never tagged —
-untagged work stays under `Unreleased` until the release commit.
+section at the top of `CHANGELOG.md`; each milestone gets its own
+`## <version> — <one-line title> (<date>)` header plus `###` topic
+subsections (e.g. `## 0.35.3 — live auditor clock and clearer recovery
+timing (2026-08-15)`). The release commit renames the `Unreleased` section
+to the released version. Do not invent version headers for work that was
+never tagged — untagged work stays under `Unreleased` until the release
+commit.
 
 ```bash
 npm version <major.minor.patch> --no-git-tag-version

package/extensions/drafter-model.ts

@@ -0,0 +1,97 @@
+// Drafting-only model resolution and fallback selection.
+//
+// Drafting runs in the main pi session, so the selected model is a temporary
+// lease: the caller must restore the original session model when drafting
+// ends. This module only resolves an ordered candidate list; lifecycle and
+// retries remain in goal-list-queue.ts.
+
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+import { isForbiddenModel } from "./goal-loop-core.js";
+import { MAX_MAIN_MODEL_FALLBACKS, modelRef, normalizeMainModelFallbackRefs } from "./main-model-recovery.js";
+import { ModelSelector } from "./model-selector.js";
+import type { Settings } from "./goal-settings.js";
+
+export const MAX_DRAFTER_FALLBACKS = MAX_MAIN_MODEL_FALLBACKS;
+
+export interface DrafterModelCandidate {
+  ref: string;
+  model: any;
+  via: "configured" | "session-last-resort";
+}
+
+export interface DrafterModelResolution {
+  configuredRefs: string[];
+  candidates: DrafterModelCandidate[];
+  selected?: DrafterModelCandidate;
+}
+
+/** Resolve a provider/model ref without making a provider request. */
+export function resolveDrafterModelRef(ctx: Pick<ExtensionContext, "modelRegistry">, ref: string): any | undefined {
+  const trimmed = ref.trim();
+  if (!trimmed) return undefined;
+  const slash = trimmed.indexOf("/");
+  try {
+    if (slash > 0) {
+      const model = ctx.modelRegistry.find(trimmed.slice(0, slash), trimmed.slice(slash + 1));
+      if (!model || !ctx.modelRegistry.hasConfiguredAuth(model)) return undefined;
+      return model;
+    }
+    return ctx.modelRegistry
+      .getAvailable()
+      .filter((candidate: any) => candidate.id === trimmed || candidate.name === trimmed)
+      .find((candidate: any) => ctx.modelRegistry.hasConfiguredAuth(candidate));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Resolve the dedicated drafter chain. The current session model is always a
+ * final in-process fallback, even when every configured candidate is missing
+ * auth or forbidden. No error text, quota state, or retry hint is inspected.
+ */
+export function resolveDrafterModel(ctx: ExtensionContext, settings: Pick<Settings, "drafterModel" | "drafterModelFallbacks" | "forbiddenModels">): DrafterModelResolution {
+  const primary = typeof settings.drafterModel === "string" ? settings.drafterModel.trim() : "";
+  const configuredRefs = normalizeMainModelFallbackRefs([
+    ...(primary ? [primary] : []),
+    ...normalizeMainModelFallbackRefs(settings.drafterModelFallbacks),
+  ]).slice(0, MAX_DRAFTER_FALLBACKS);
+  const currentRef = modelRef(ctx.model);
+  const forbidden = (ref: string) => isForbiddenModel(ref, settings.forbiddenModels);
+  const selector = new ModelSelector({
+    getChain: () => configuredRefs,
+    resolve: (ref) => resolveDrafterModelRef(ctx, ref),
+    isForbidden: forbidden,
+  });
+  const attempted: string[] = [];
+  const candidates: DrafterModelCandidate[] = [];
+
+  // ModelSelector deliberately skips the current model so the main recovery
+  // walker never selects the model that just failed. Drafting is different:
+  // its configured primary may intentionally be the current session model,
+  // and that primary still needs a lease so its later fallbacks remain
+  // available if the first drafting turn fails.
+  const configuredPrimary = configuredRefs[0];
+  if (
+    configuredPrimary &&
+    currentRef &&
+    configuredPrimary.toLowerCase() === currentRef.toLowerCase() &&
+    !forbidden(configuredPrimary) &&
+    ctx.model
+  ) {
+    candidates.push({ ref: configuredPrimary, model: ctx.model, via: "configured" });
+    attempted.push(configuredPrimary);
+  }
+
+  for (;;) {
+    const selected = selector.selectNextValid({ kind: "drafter" }, currentRef, attempted);
+    if (!("model" in selected) || typeof selected.ref !== "string") break;
+    attempted.push(selected.ref);
+    candidates.push({ ref: selected.ref, model: selected.model, via: "configured" });
+  }
+  if (ctx.model && currentRef && !candidates.some((candidate) => candidate.ref.toLowerCase() === currentRef.toLowerCase())) {
+    candidates.push({ ref: currentRef, model: ctx.model, via: "session-last-resort" });
+  }
+  return { configuredRefs, candidates, selected: candidates[0] };
+}

package/extensions/faulty-objective-recovery.ts

@@ -185,6 +185,10 @@ function proposalFrom(
 function approvedCompletionContext(goal: Goal): string | null {
   const latest = goal.auditHistory?.at(-1);
   if (!latest?.approved || latest.disapproved || latest.regressionShieldPassed === false) return null;
+  // A completion summary approved for an older contract is not saved intent
+  // for the current objective. Legacy verdicts without a revision retain the
+  // historical compatibility policy; revisioned verdicts must match exactly.
+  if (latest.revision !== undefined && goal.revision !== undefined && latest.revision !== goal.revision) return null;
   return usableCandidate(goal.completionSummary);
 }