pi-goal-list-loop-audit 0.34.139 → 0.35.4

package/README.md

@@ -10,7 +10,7 @@ This is a detached process, not a nested session in the main pi process. `comple
 
 On Windows, npm installs the `pi.cmd` shim rather than a directly executable `pi` binary. The auditor launches it through an explicitly quoted `cmd.exe` boundary; POSIX keeps direct shell-less execution. Protocol snapshots also tolerate transient Windows file-locks without deleting the last valid snapshot first.
 
-**Current package version:** `v0.34.139` — use `/glla version` to see the installed version and the command for comparing it with the registry latest. This checkout may contain unreleased changes; the npm registry is authoritative for published versions.
+**Current package version:** `v0.35.3` — use `/glla version` to see the installed version and the command for comparing it with the registry latest. This checkout may contain unreleased changes; the npm registry is authoritative for published versions.
 
 ## Why this exists
 
@@ -122,6 +122,26 @@ ONE confirmed batch, not 50 dialogs.
 Note: every list item is audited individually, so at hundreds of items the
 audit cost per item is the thing to think about.
 
+Long-running judgment is explicit: the drafter preserves the objective and
+verification contract, prefers a durable root-cause fix, allows a safe,
+reversible workaround when it is genuinely useful, and asks only at an actual
+scope/permission/irreversible-action decision boundary. If you want a design
+checkpoint before implementation, mark a goal, list item, or task-plan entry
+with `Agent: Designer` (also accepted: `Role: designer` or `Designer: yes`).
+The managed Designer is read-only; if it is unavailable, the main agent keeps
+the same checkpoint inline.
+
+Drafting can use a separate temporary agent configured in `/glla` under the
+**Drafter** tab (`Drafter agent`, `Drafter thinking`, and `Drafter fallback
+agents`).
+The thinking choice is derived from the selected model, applies only while the
+drafting agent is active, and restores the original session thinking level
+after confirmation or interruption. A drafting failure retries the existing
+interview through that agent's fallback chain. Main-agent and auditor-agent
+recovery chains remain separate. Provider recovery is intentionally blind:
+there is no live quota checking or reset inference; the generic retry envelope
+and the optional hourly `:00:30` probe remain the policy.
+
 **Drafting is the default for long-running things.** `/goal` and
 `/loop` with no arguments — and any vague `/list` dump — all start a
 grilling turn that ends in a Confirm dialog. For `/loop` specifically, the orchestrator **test-runs the proposed
@@ -231,13 +251,17 @@ A persistent `glla:` status segment + an above-editor widget show the current
 goal/list item/loop at all times: objective, durable state, elapsed time,
 tokens, next task or loop metric, pause reason, and live auditor progress
 during audits. If something is running, you can see it — no command needed.
+Goal cards label their total wall-clock age explicitly; it includes time parked
+for recovery or waiting on a verdict, so it should not be read as active model
+compute. Recovery cards call the timestamp `last host activity` for the same
+reason: a retry/error event is liveness evidence, not proof of useful work.
 
 The status bar is the single activity HUD. It uses compact state capsules plus
 an animated pulse waveform so live work is obvious at a glance without turning
 the line into a progress meter. Fresh stream age is the proof of live work:
 
 ```text
-glla: [▁▂▄▆█▆ LIVE · WORKING] 1m 09s · last stream 11s ago · 3 queued
+glla: [▁▂▄▆█▆ LIVE · WORKING] total 1m 09s · last stream 11s ago · 3 queued
 glla: [QUEUED] 44s · 18 queued
 ```
 
@@ -252,81 +276,62 @@ Activity is otherwise intentionally honest:
 | `QUEUED` | A continuation is waiting to start; no work is fabricated. |
 | `IDLE` | The durable item remains active, but no recent work is observed. |
 | `auditor …` | A detached, extension-less verifier is queued, running, quiet, or waiting for its verdict. |
-| `QUOTA WALL` | The provider rejected the request for a quota/plan window (by its own wording); saved work is waiting for a durable probe. |
-
-## Provider failures: one retry envelope, bounded (v0.34.51)
+| `RECOVERING` | A bounded automatic retry is pending; the status does not guess why the provider failed. |
 
-Error text is **not trusted** to pick a retry policy: we only know that an
-error came, and provider messages vary. Every main-model failure — quota,
-rate limit, billing/credits, auth, transient, or unclassifiable — rides the
-same durable recovery envelope. The normal unhinted wait is
-`base → 2×base → 4×base → 8×base → 16×base → 5h`, where `base` is the
-`mainModelRetryMinutes` setting (15 minutes by default). A factual provider
-`Retry-After` hint wins when it fits the five-hour probe budget; an over-budget
-hint falls back to the configured ladder. `hourlyQuotaProbe=on` adds a separate
-`:00:30` probe while recovery is parked. The automatic window is 24h, then an
-explicit `/goal resume`/`/list resume`/`/loop resume` starts a fresh window.
-The only failures that do not auto-retry are the ones identified by *positive
-evidence* as futile: context/output-token limits and user aborts
-(`non-recoverable`), plus auditor watchdog timeouts (a hanging verification
-command will hang again — the stored claim waits for an explicit resume).
-With global `autoResume=on`, pending probes survive a session reload.
-
-For continuous work, configure up to **10 ordered Main model backups** in
-`/glla` using models from different providers or billing/quota pools when
-possible — another model on the same exhausted plan is not a real fallback.
-The editor is the top row of the **Backups** settings tab (one place for
-main-session backup policy). It shows the actual try order as
-`current → backup 1 → backup 2 …`, shows each configured backup's rank, lets
-**Space** add/remove a backup, and **Tab** enters order mode where **↑/↓**
-moves the highlighted backup (brackets `[` `]` also reorder without leaving
-the list). On an account/plan/billing/auth provider failure, glla calls `setModel` for the
-first eligible backup only; the next supervised turn tests it. If that
-candidate fails, the next backup is tried in order. With the global
-`mainModelFallbackOnRateLimit=on` default, an explicit HTTP 429/request-rate
-failure also walks the ordered chain; set it off to keep 429s on the current
-model with the bounded cadence plus extra post-hour probe. A 429 remains a
-request-rate classification, not a token-limit failure. Forbidden,
-unavailable, and unauthenticated refs are skipped; a successful supervised
-turn clears the episode. The chain
-is global, durable, and its attempted cursor survives reload; after the chain
-is exhausted, bounded recovery probes continue rather than silently abandoning
-work. The Backups tab shows the `N/10` count and the numbered chain.
-
-**Quota walls engage fast** (v0.34.57): a surfaced long-lived failure
-(quota / billing / auth) records a 30-minute knowledge window; a send-rearm
-storm inside that window escalates into the recovery envelope after **3
-minutes** of failed sends instead of the generic 15 — a wedge right after a
-quota wall is almost always the same wall. Transient (5xx/stream/network)
-failures never record the signal and keep the fast error ladder. The
-envelope is armed by configuration: an empty `mainModelFallbacks` list means
-"park and probe the same model" rather than switching pools. The
-`mainModelFallbackOnRateLimit=off` setting is the explicit never-switch
-posture for non-empty chains.
-
-Classification still exists, but it only *labels*: the card and badge show
-what the provider said (quota wall, billing, rate limit) so the reason is
-diagnosable, and `QUOTA WALL` is only shown when the provider's own words say
-quota — ambiguous prose is never relabeled. The raw provider message stays in
-the ledger/durable state; the card shows the classified reason and recovery
-action. Detached-auditor failures get the same treatment: any infrastructure
-error on a stored completion claim pauses the goal with a durable bounded
-one-shot retry (`auditor retry: …`), and only the plan's 24h horizon stops
-automatic probes.
-
-The quota-specific card hides raw provider JSON while preserving it in durable
-state and the ledger:
+Detached-auditor elapsed time keeps advancing between worker events. A long
+tool call or hidden reasoning interval therefore remains visibly timed; after
+three minutes without worker activity the UI changes to `auditor quiet` and
+names the cancellation/recovery path instead of presenting a frozen live card.
 
-```text
-glla: ⟦⏳ QUOTA WALL · next probe in 10m 48s⟧ · 1 queued
-├─ QUOTA WALL · Token Plan usage limit · 1 waiting in list
-├─ waiting — nothing for you to do · next probe in 10m 48s
-```
+## Provider failures: aggressive retry envelope, bounded (v0.35.0)
 
-Increasing pi's per-request retry count is usually the wrong fix for a
-multi-hour plan cap: it prolongs the 429 noise and delays the durable pause;
-it does not make the provider reset sooner. A provider that says "reset in a
-week" therefore does not cause a week of unattended probes.
+Error text is **not trusted** to pick a retry policy. The runtime does not
+query or infer provider quota state, and it does not use status codes, billing
+words, rate-limit words, or `Retry-After` hints to choose a branch. Those
+values are retained only as bounded diagnostics. Every recoverable main-model
+failure uses the same durable envelope: an eager 5-second retry, then
+`base → 2×base → 4×base → 8×base → 16×base → 5h`, where `base` is the
+`mainModelRetryMinutes` setting (15 minutes by default). `hourlyRetryProbe=on`
+adds a blind `:00:30` retry after each hour starts, so work can be picked up
+quickly after a possible provider-side change. The automatic window is 24h;
+explicit `/goal resume`, `/list resume`, or `/loop resume` starts a fresh
+window. With global `autoResume=on`, pending retries survive a session reload.
+
+Only failures identified by positive evidence as futile avoid automatic retry:
+context/output-token limits and user aborts (`non-recoverable`). Auditor
+watchdog timeouts are also kept separate because rerunning a hanging local
+verification command immediately would repeat the same local failure; the
+stored claim remains available for explicit resume.
+
+For continuous work, configure up to **10 ordered Main-agent fallback models**
+in `/glla` using independent model references when possible. The editor is in
+the **Main agent** settings tab (one role per tab, with the current agent,
+thinking level, and fallback chain together). It shows the actual try order as
+`current → fallback 1 → fallback 2 …`, shows each configured fallback's rank,
+lets **Space** add/remove a fallback, and **Tab** enters order mode where
+**↑/↓** moves the highlighted fallback (brackets `[` `]` also reorder without
+leaving the list). Every recoverable provider failure uses the same ordered
+chain: glla calls `setModel` for the first eligible fallback, the next
+supervised turn tests it, and later failures advance left-to-right. Forbidden,
+unavailable, and unauthenticated references are skipped; a successful
+supervised turn clears the episode. The chain is global, durable, and its
+attempted cursor survives reload. After the chain is exhausted, bounded
+retries continue on the active model rather than silently abandoning work.
+The Main agent tab shows the `N/10` count and numbered chain. The Drafter and
+Auditor tabs likewise show each selected model together with its requested
+thinking level; fallback rows show the effective/requested thinking level when
+the model registry exposes the capability map. Press `d` in the settings table
+to toggle the long descriptions and give the model/value column the available
+width.
+
+Provider payloads are never copied into chat cards or notifications. A bounded
+diagnostic may remain in the ledger and durable state for forensics, while
+user-facing surfaces use the same generic provider-error label for every
+failure family. The detached auditor follows the same rule: every retriable
+infrastructure failure gets one eager 5-second retry, then stored-claim
+retries at `:00:30` after each hour starts. Its existing 5-attempt/24-hour
+safety envelope prevents an unbounded worker storm; explicit resume starts a
+fresh window.
 
 For long-running `/list` work, the card adds a compact queue trail with the
 immediate next item and its truthful wait age while `/list` remains the
@@ -428,44 +433,48 @@ confirmation is intentionally not bypassed.
 Open `/glla` to edit these settings in the table (the rows show effective values and provenance):
 
 - Auditor model and thinking level
-- Auditor fallback model
+- Auditor fallback agent
 - Notify command, token limit, and wedge-alert minutes
 - Auto-resume, auto-accept drafts, decision popup, and carryover policy
-- Ordered main-session backups at the top of the Backups tab, plus recovery cadence (including the optional hourly probe)
+- Main-agent current model/thinking, fallback models, and recovery cadence in the Main agent tab
+- Drafter agent/thinking/fallback agents in the Drafter tab
+- Auditor agent/thinking/fallback agent in the Auditor tab
 - Forbidden model patterns and switch policy
-- Audit cap/report size, aggressive mode, quota retry, and stall brakes
+- Audit cap/report size, aggressive mode (ON by default), retry cadence, and
+  stall brakes
 
 The argument namespace is reserved for actions such as `/glla status`, `/glla
 resume`, `/glla cancel`, `/glla stats`, `/glla audits`, `/glla tooloverride`,
 `/glla fallbacks clear`, and `/glla wipe`. `fallbacks clear` atomically removes
-the global backup chain and cancels any pending backup switch. Cancel stops the
+the global main-agent fallback chain and cancels any pending fallback switch. Cancel stops the
 active objective; wipe clears all live state while preserving history.
 There is no top-level `/glla key=value` setting syntax.
 
 Resolution per key: **project > global > defaults** — EXCEPT `autoResume` and
-main-session recovery settings (`mainModelFallbacks`,
-`mainModelFallbackOnRateLimit`, `mainModelRetryMinutes`, `hourlyQuotaProbe`),
+agent recovery settings (`mainModelFallbacks`, `mainModelRetryMinutes`,
+`drafterModel`, `drafterThinkingLevel`, `drafterModelFallbacks`,
+`hourlyRetryProbe`),
 which are **global-only**: per-project opt-ins from old versions
 silently overrode the global hold at launch (the junk-runner incident), so
 the launch-restore gate and the reviewer-enqueue gate read only the global
 file now. Main-session recovery policy is likewise one global chain/cadence
-for the active session. Main-session backups are global and ordered (up to 10): a provider
-failure selects backup 1, then backup 2, and so on, one supervised turn at a
-time. The Backups tab leads with the ordered-chain editor — a multi-select
+for the active session. Main-agent fallback models are global and ordered (up to 10): a provider
+failure selects fallback 1, then fallback 2, and so on, one supervised turn at a
+time. The Main agent tab leads with the ordered-chain editor — a multi-select
 picker where Space toggles membership, Tab enters order mode (↑/↓ moves a
 chain row), and clearing the selection removes the global key. Forbidden,
 unavailable, and unauthenticated refs are skipped. When every candidate is
-down, glla cancels the provider-held retry and uses the configured
+down, glla stops the current send attempt and uses the configured
 `base → 2×base → 4×base → 8×base → 16×base → 5h` ladder (`base` defaults to
-15m). `hourlyQuotaProbe=on` adds a separate :00:30 probe after each hour
-starts. Explicit HTTP 429/rate-limit errors remain request-rate failures, not
-token-limit labels. With `mainModelFallbackOnRateLimit=on` (default) they
-walk the ordered backups; with it off they stay on the current model through
-the bounded retry policy. Automatic recovery stops at 24h, preserves the saved
-work, and requires an explicit
+15m). `hourlyRetryProbe=on` adds a blind :00:30 retry after each hour starts.
+No provider availability or quota check is made before any retry; all
+recoverable failures walk the ordered fallbacks and then continue on the active
+model through the bounded retry policy. Automatic recovery stops at 24h,
+preserves the saved work, and requires an explicit
 `/goal resume`, `/list resume`, or `/loop resume` to start a fresh window. A
-quota window returning within that horizon therefore resumes saved work without
-manual intervention; no blind 50ms resend loop is introduced. The detached auditor uses an explicit cascade: primary
+provider becoming available within that horizon therefore resumes saved work
+without manual intervention; no blind 50ms resend loop is introduced. The
+detached auditor uses an explicit cascade: primary
 `auditorModel` → optional fallback pin → the pi session model. If a selected
 model fails after launch, the worker retries it once and then advances through
 that same cascade; every candidate is still audited in a detached,
@@ -532,7 +541,10 @@ in-session warning + your configured notify push, once per interval while
 it persists. Tune Wedge alert minutes in the `/glla` settings table (0 = off).
 
 Every other wait is bounded too: continuation retries are milliseconds,
-stuck backoff caps at 5 minutes then pauses, measure commands get a 10m
+nudge accounting counts consecutive unproductive turns (substantive text
+or tool calls reset the counter) and pauses the goal / stops the loop after
+3 — provider-error and user-abort turns are exempt (v0.27.3+). Measure
+commands get a 10m
 hard timeout, and the detached auditor aborts after 10m with no activity while no
 an auditor tool is running. A long-running verification tool is allowed to
 finish, but each tool has an independent five-minute ceiling and the worker

package/docs/DESIGN.md

@@ -189,11 +189,15 @@ architectural decisions that changed the SHAPE of the system:
 
 ## Addendum v0.34.31 (main-session model recovery)
 
+> Historical rollout note: this section records the older reason-aware
+> recovery implementation. The active policy is the v0.34.142 addendum below;
+> quota/rate-limit wording no longer selects fallback or retry timing.
+
 - **Global recovery policy**: `mainModelFallbacks`,
   `mainModelFallbackOnRateLimit`, `mainModelRetryMinutes`, and
   `hourlyQuotaProbe` are global-only, so the runtime and settings provenance
   cannot disagree about which recovery policy is active.
-- **Ordered global backups**: `mainModelFallbacks` is an explicit ordered list
+- **Ordered global fallback agents**: `mainModelFallbacks` is an explicit ordered list
   of up to 10 `provider/model` references. A provider/quota error selects the
   first eligible authenticated candidate for account/plan/billing/auth failures,
   calls `setModel`, and lets the next supervised turn test it; later failures
@@ -201,7 +205,7 @@ architectural decisions that changed the SHAPE of the system:
   walk the list when global `mainModelFallbackOnRateLimit` is on (default); off
   keeps them on the current model with bounded retry + hourly probe cadence.
   The detached auditor's model cascade remains a separate subsystem. The
-  ordered-chain editor leads the **Backups** settings tab: Space toggles
+  ordered-chain editor lives in the **Main agent** settings tab: Space toggles
   membership, Tab enters an explicit order mode where ↑/↓ moves a chain row,
   and clearing the list removes the global key. The attempted cursor is durable, so a reload cannot
   restart at an already-failed rung.
@@ -256,7 +260,7 @@ replacement without delivering a successor `session_start`:
   the report surface stays truthful (the AuditProgress/AuditorProgress dual-interface
   rule: display evidence-gates on `unmatchedStarts + unmatchedEnds > 0`).
 - **Uniform retry envelope, no text-trust** (v0.34.51 historical baseline): error
-  text was not trusted to pick a retry policy. The current ordered-backup policy
+  text was not trusted to pick a retry policy. The current ordered-fallback policy
   supersedes that baseline: account/plan/billing/auth failures may walk the configured
   chain, while explicit HTTP 429/request-rate failures walk it when
   `mainModelFallbackOnRateLimit` is on (default), or remain on the current model
@@ -268,6 +272,10 @@ replacement without delivering a successor `session_start`:
 
 ## Addendum v0.34.57 (quota walls engage recovery fast)
 
+> Historical rollout note: the knowledge-window and quota-specific branches
+> described here are retained for design history only and are not active in
+> v0.34.142.
+
 - **Knowledge-window escalation**: a surfaced long-lived failure (quota /
   billing / auth) records a 30-minute knowledge window. A send-rearm storm
   inside that window escalates into the recovery envelope after 3 minutes of
@@ -280,7 +288,7 @@ replacement without delivering a successor `session_start`:
 - **Armed by configuration**: the envelope is inert without
   `mainModelFallbacks` (rotation) — an empty list means "park and probe the
   same model" instead of switching pools. When the list is non-empty, the
-  runtime tries one eligible backup at a time in persisted order, skips
+  runtime tries one eligible fallback at a time in persisted order, skips
   forbidden/unavailable refs, and parks only after the ordered chain is
   exhausted. Explicit HTTP 429/rate-limit errors remain request-rate signals,
   not token-limit labels; the global `mainModelFallbackOnRateLimit` switch
@@ -317,6 +325,49 @@ replacement without delivering a successor `session_start`:
   remains held unless the existing Auto-resume policy or a validated lifecycle
   handoff supplies consent. `/goal resume` still starts a direct fresh audit.
 
+## Addendum v0.34.142 (generic provider recovery)
+
+- **No quota availability check exists in the live policy**: provider text,
+  status codes, billing/rate-limit words, and upstream retry hints do not
+  select a recovery branch, fallback gate, or delay. They may remain as
+  bounded diagnostics for forensics and redaction only.
+- **One retry envelope covers every recoverable provider failure**: the first
+  retry is eager at 5 seconds, later retries use the configured bounded
+  ladder, and the optional `hourlyRetryProbe` adds a blind `:00:30` retry
+  after every hour starts. Main-model recovery and detached-auditor recovery
+  use this same reason-agnostic rule, with existing context/user-abort and
+  safety-horizon exceptions.
+- **Legacy state is inert**: old `quota-waiting` phases, quota-named retry
+  counters, and provider-hint fields are accepted only long enough to load
+  and normalize old files. Canonical persisted state uses `retry-waiting`,
+  `retryAttempts`, `retryFirstAt`, and `retryUntil`.
+
+## Addendum v0.35.0 (long-running judgment, Designer, and drafting chain)
+
+- **Judgment is a prompt-level contract**: drafting and continuation preserve
+  the objective and verification contract, prefer durable root-cause fixes,
+  allow only safe/reversible/testable in-scope workarounds, and ask one focused
+  question only at a genuine scope, priority, permission, or irreversible-action
+  boundary. The unattended fallback is explicit and never infers provider or
+  quota state.
+- **Designer routing is explicit, persisted, and read-only**: `Agent: Designer`,
+  `Role: designer`, and `Designer: yes` are declarations rather than natural
+  language classification. The role is carried by goals, queue items, and task
+  plans; continuation injects the hand-off; a managed `Designer.md` uses only
+  read/search tools; unavailable role/provider falls back to an inline design
+  checkpoint.
+- **Drafting owns a temporary agent lease**: the `/goal`, `/list`, and `/loop`
+  interviews resolve a separate primary/fallback chain, select a model-specific
+  thinking level, retry the existing interview after generic provider errors,
+  and restore the original model and thinking level after confirmation or
+  interruption. A current-session last resort is bounded and does not enter
+  main-goal recovery. A generation fence and serialized restore prevent
+  stale-session or overlapping-draft agent changes.
+- **Host replacement remains host-owned**: Pi event contexts do not expose the
+  command-only `newSession`/`fork`/`switchSession` operations. glla therefore
+  persists the work and truthfully asks for `/new` when no replacement boundary
+  arrives; the proposed event-safe host API is recorded in the audit docs.
+
 ## Addendum v0.4.0 (completion)
 
 - **Auditor compaction enabled** (flaw #3 — the last open one). Safety:

package/docs/RELEASING.md

@@ -18,10 +18,13 @@ the repository.
 ## Release checklist
 
 Accumulated changes since the last release live under an `## Unreleased`
-section at the top of `CHANGELOG.md` (with the in-repo milestone labels such
-as `### 0.34.51`); the release commit renames that section to the released
-version. Do not invent version headers for work that was never tagged —
-untagged work stays under `Unreleased` until the release commit.
+section at the top of `CHANGELOG.md`; each milestone gets its own
+`## <version> — <one-line title> (<date>)` header plus `###` topic
+subsections (e.g. `## 0.35.3 — live auditor clock and clearer recovery
+timing (2026-08-15)`). The release commit renames the `Unreleased` section
+to the released version. Do not invent version headers for work that was
+never tagged — untagged work stays under `Unreleased` until the release
+commit.
 
 ```bash
 npm version <major.minor.patch> --no-git-tag-version

package/extensions/drafter-model.ts

@@ -0,0 +1,97 @@
+// Drafting-only model resolution and fallback selection.
+//
+// Drafting runs in the main pi session, so the selected model is a temporary
+// lease: the caller must restore the original session model when drafting
+// ends. This module only resolves an ordered candidate list; lifecycle and
+// retries remain in goal-list-queue.ts.
+
+import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
+
+import { isForbiddenModel } from "./goal-loop-core.js";
+import { MAX_MAIN_MODEL_FALLBACKS, modelRef, normalizeMainModelFallbackRefs } from "./main-model-recovery.js";
+import { ModelSelector } from "./model-selector.js";
+import type { Settings } from "./goal-settings.js";
+
+export const MAX_DRAFTER_FALLBACKS = MAX_MAIN_MODEL_FALLBACKS;
+
+export interface DrafterModelCandidate {
+  ref: string;
+  model: any;
+  via: "configured" | "session-last-resort";
+}
+
+export interface DrafterModelResolution {
+  configuredRefs: string[];
+  candidates: DrafterModelCandidate[];
+  selected?: DrafterModelCandidate;
+}
+
+/** Resolve a provider/model ref without making a provider request. */
+export function resolveDrafterModelRef(ctx: Pick<ExtensionContext, "modelRegistry">, ref: string): any | undefined {
+  const trimmed = ref.trim();
+  if (!trimmed) return undefined;
+  const slash = trimmed.indexOf("/");
+  try {
+    if (slash > 0) {
+      const model = ctx.modelRegistry.find(trimmed.slice(0, slash), trimmed.slice(slash + 1));
+      if (!model || !ctx.modelRegistry.hasConfiguredAuth(model)) return undefined;
+      return model;
+    }
+    return ctx.modelRegistry
+      .getAvailable()
+      .filter((candidate: any) => candidate.id === trimmed || candidate.name === trimmed)
+      .find((candidate: any) => ctx.modelRegistry.hasConfiguredAuth(candidate));
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Resolve the dedicated drafter chain. The current session model is always a
+ * final in-process fallback, even when every configured candidate is missing
+ * auth or forbidden. No error text, quota state, or retry hint is inspected.
+ */
+export function resolveDrafterModel(ctx: ExtensionContext, settings: Pick<Settings, "drafterModel" | "drafterModelFallbacks" | "forbiddenModels">): DrafterModelResolution {
+  const primary = typeof settings.drafterModel === "string" ? settings.drafterModel.trim() : "";
+  const configuredRefs = normalizeMainModelFallbackRefs([
+    ...(primary ? [primary] : []),
+    ...normalizeMainModelFallbackRefs(settings.drafterModelFallbacks),
+  ]).slice(0, MAX_DRAFTER_FALLBACKS);
+  const currentRef = modelRef(ctx.model);
+  const forbidden = (ref: string) => isForbiddenModel(ref, settings.forbiddenModels);
+  const selector = new ModelSelector({
+    getChain: () => configuredRefs,
+    resolve: (ref) => resolveDrafterModelRef(ctx, ref),
+    isForbidden: forbidden,
+  });
+  const attempted: string[] = [];
+  const candidates: DrafterModelCandidate[] = [];
+
+  // ModelSelector deliberately skips the current model so the main recovery
+  // walker never selects the model that just failed. Drafting is different:
+  // its configured primary may intentionally be the current session model,
+  // and that primary still needs a lease so its later fallbacks remain
+  // available if the first drafting turn fails.
+  const configuredPrimary = configuredRefs[0];
+  if (
+    configuredPrimary &&
+    currentRef &&
+    configuredPrimary.toLowerCase() === currentRef.toLowerCase() &&
+    !forbidden(configuredPrimary) &&
+    ctx.model
+  ) {
+    candidates.push({ ref: configuredPrimary, model: ctx.model, via: "configured" });
+    attempted.push(configuredPrimary);
+  }
+
+  for (;;) {
+    const selected = selector.selectNextValid({ kind: "drafter" }, currentRef, attempted);
+    if (!("model" in selected) || typeof selected.ref !== "string") break;
+    attempted.push(selected.ref);
+    candidates.push({ ref: selected.ref, model: selected.model, via: "configured" });
+  }
+  if (ctx.model && currentRef && !candidates.some((candidate) => candidate.ref.toLowerCase() === currentRef.toLowerCase())) {
+    candidates.push({ ref: currentRef, model: ctx.model, via: "session-last-resort" });
+  }
+  return { configuredRefs, candidates, selected: candidates[0] };
+}