pi-goal-list-loop-audit 0.35.4 → 0.35.13

package/extensions/loops/goal-session.ts

@@ -104,6 +104,7 @@ import {
   writeGoalMd,
   writeQueueItemFile,
   readQueueFromDisk,
+  clearQueueItemFiles,
   deleteQueueItemFile,
   missingGllaTools,
   runPersistStep,
@@ -392,6 +393,11 @@ let extensionApiStale = false;
 // path must still ledger the stale handle, stop stale work, and preserve the
 // interrupt marker so a later fresh lifecycle can restore it.
 let staleTerminalDone = false;
+// v0.35.x: a silent host-handle death is a coalesced recovery boundary. Keep
+// the durable interrupt marker for an orphan with no successor, but remember
+// that the first genuinely fresh lifecycle/turn event may re-arm the goal
+// immediately instead of leaving it parked behind that marker.
+let staleContinuationRearmPending = false;
 // v0.34.19: delayed session-owned callbacks capture this generation. A
 // clearTimeout can race a callback already queued by Node; without a
 // generation check, an old compaction/refire callback can run after /reload
@@ -588,6 +594,10 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   // "invalidated without delivering a replacement" case the user keeps
   // hitting. The field distribution in the ledger now separates proper
   // session cycles from genuine host losses.
+  const invalidationReason = classifySessionHandleInvalidation({
+    sessionHandoffPending,
+    mainModelRecoveryActive: mainModelRecoveryActive(),
+  });
   appendLedger(ctx.cwd, "session_handle_invalidated", {
     where,
     kind: isLoopActive() ? "loop" : "goal",
@@ -596,6 +606,20 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
       mainModelRecoveryActive: mainModelRecoveryActive(),
     }),
   });
+  // A silent death is the coalescing boundary: retain the durable interrupt
+  // marker for an orphan with no successor, but let the first fresh host
+  // lifecycle/turn event consume it and re-arm the continuation. Provider
+  // disconnects and announced shutdowns keep their existing recovery policy.
+  staleContinuationRearmPending = invalidationReason === "silent_handle_death"
+    && state.goal?.status === "active"
+    && state.goal.autoContinue !== false;
+  if (staleContinuationRearmPending) {
+    appendLedger(ctx.cwd, "stale_continuation_rearm_armed", {
+      goalId: state.goal?.id,
+      where,
+      reason: invalidationReason,
+    });
+  }
   const guidance = "pi invalidated this session's extension handle without delivering a replacement session. glla stopped stale sends and kept the work safe in .pi-glla/. Use /new to create a fresh context; its session_start will resume the work. If /new does not create one, restart pi normally and glla will restore the saved work.";
   // v0.35.x: an orphaned detached completion audit is not allowed to leave
   // the durable goal in AUDITING. Release the MAIN-side wait immediately and
@@ -628,6 +652,28 @@ function goStaleTerminal(ctx: ExtensionContext, where: string): void {
   try { notifyExternal(ctx, `glla: extension api stale — waiting for a fresh session_start; restart pi normally only if no replacement arrives. (${where})`); } catch { /* stale notifier is best effort */ }
 }
 
+/** Consume the one-shot coalesced recovery armed by goStaleTerminal. The
+ * caller must already have a context that belongs to the fresh host and must
+ * schedule the appropriate continuation after this returns true. */
+function consumeStaleContinuationRearm(ctx: ExtensionContext, via: string): boolean {
+  if (!staleContinuationRearmPending) return false;
+  staleContinuationRearmPending = false;
+  const goal = state.goal;
+  if (!goal || goal.status !== "active" || goal.autoContinue === false) {
+    appendLedger(ctx.cwd, "stale_continuation_rearm_skipped", { via, reason: "goal-not-actionable" });
+    return false;
+  }
+  const wasInterrupted = Boolean(goal.interruptedAt);
+  if (wasInterrupted) updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);
+  appendLedger(ctx.cwd, "stale_continuation_rearmed", {
+    goalId: goal.id,
+    via,
+    clearedInterrupt: wasInterrupted,
+  });
+  postRestoreGraceTurns = 2;
+  return true;
+}
+
 /** v0.34.16: lifecycle handoff replaces terminal keystroke injection. A
  * stale extension cannot call pi, so recovery must cross the lifecycle
  * boundary: session_shutdown records durable resume debt, clears every timer
@@ -948,6 +994,7 @@ function emitIdInvalidation(ctx: ExtensionContext, oldId: string | null, newId:
  * between stale scenarios. Never called by production code. */
 export function __testOnlyResetStaleFlag(): void {
   extensionApiStale = false;
+  staleContinuationRearmPending = false;
 }
 
 /** TEST-ONLY hook (GitHub #4): the last draft dialog rendered through the
@@ -967,6 +1014,7 @@ export function __testOnlyLastConfirmDialog(): { title: string; body: string; op
  * when an earlier file latched them. Never called by production code. */
 export function __testOnlyResetTerminalFlags(): void {
   staleTerminalDone = false;
+  staleContinuationRearmPending = false;
   zombieStoodDown = false;
   sessionHandoffPending = false;
 }
@@ -1004,6 +1052,16 @@ export async function __testOnlyRunFanOutListAuditFindings(cwd: string): Promise
   await fanOutListAuditFindings(cwd, sessionGeneration);
 }
 
+function isCtxAlive(ctx: ExtensionContext | null | undefined): boolean {
+  if (!ctx) return false;
+  try {
+    ctx.isIdle();
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 /** v0.28.1 (S3): side-effect-free staleness probe — getSessionName()
  * routes through pi's assertActive() and throws the stale signature iff
  * pi invalidated this factory handle (session replacement). A positive
@@ -1014,6 +1072,11 @@ export async function __testOnlyRunFanOutListAuditFindings(cwd: string): Promise
  * (field: hegemon 2026-08-06 — one probe failure parked a live session for
  * 5 hours). */
 function probeExtensionApiStaleRaw(): boolean {
+  // The ExtensionAPI and ExtensionContext can disagree briefly: a live
+  // context does NOT prove that the captured `pi` can still send. In
+  // particular, a stale send can latch the API while ctx.isIdle() continues
+  // to succeed. Always probe the API itself here or the heartbeat will
+  // repeatedly "recover" and immediately fail the next continuation send.
   if (!extensionApi) return false;
   try {
     extensionApi.getSessionName();
@@ -1024,6 +1087,9 @@ function probeExtensionApiStaleRaw(): boolean {
 }
 
 function probeExtensionApiStale(): boolean {
+  // A stale ExtensionAPI is terminal for this factory instance. A healthy
+  // context probe must not clear this latch: the next send would still use
+  // the same captured API and throw again.
   if (extensionApiStale) return true;
   if (probeExtensionApiStaleRaw()) extensionApiStale = true;
   return extensionApiStale;
@@ -1182,10 +1248,17 @@ function resolveCarryover(ctx: ExtensionContext, trigger: "goal" | "loop" | "lis
   } else if (snap.pausedGoal) {
     waiting.push(`paused goal "${displaySlice(snap.pausedGoal, 60)}" (${workCommand(snap.pausedGoalPolicy, "resume")})`);
   }
-  if (snap.listCount > 0) {
+  if (snap.listCount > 0 || policy === "clear") {
     if (policy === "clear") {
+      // Carryover clear must remove the durable union, not only RAM. The
+      // stale-handle /list reader intentionally resurrects queue sidecars.
+      const clearedSidecars = clearQueueItemFiles(ctx.cwd);
       replaceState({ ...state, list: [] });
-      done.push(`dropped ${snap.listCount} waiting list item(s)`);
+      if (snap.listCount > 0) done.push(`dropped ${snap.listCount} waiting list item(s)`);
+      if (clearedSidecars.removed > 0) done.push(`removed ${clearedSidecars.removed} durable queue sidecar(s)`);
+      if (clearedSidecars.failed.length > 0) {
+        waiting.push(`${clearedSidecars.failed.length} queue sidecar(s) could not be removed — clear is incomplete`);
+      }
     } else {
       waiting.push(`${snap.listCount} waiting list item(s) (/list next)`);
     }
@@ -1363,6 +1436,10 @@ function tryAbsorbHostSuccessor(ctx: ExtensionContext, via: string): boolean {
   ctx.ui.notify("glla: pi replaced this session without delivering session_start — absorbed the live replacement as the goal-plane owner (in-memory subagent sessions stay refused).", "info");
   startHeartbeat();
   heartbeatStaleStreak = 0;
+  const staleRearmed = consumeStaleContinuationRearm(ctx, via);
+  if (staleRearmed) {
+    ctx.ui.notify(`glla: fresh host event re-armed ${state.goal?.policy === "list" ? "the list item" : "the goal"} continuation after the stale-handle boundary.`, "info");
+  }
   if (state.goal && state.goal.status === "active") {
     const wasInterrupted = Boolean(state.goal.interruptedAt);
     if (wasInterrupted) {
@@ -1407,9 +1484,11 @@ function selfHealStaleSameSession(ctx: ExtensionContext): boolean {
   if (owner && owner.pid === process.pid && typeof owner.instanceId === "string" && owner.instanceId !== instanceId) {
     return false; // a successor module instance owns this cwd — never re-claim
   }
-  // The handle must actually be healthy NOW — the fresh probe, not the
-  // latched cache. A null api means we cannot send anything anyway.
-  if (!extensionApi || probeExtensionApiStaleRaw()) return false;
+  // Both handles must actually be healthy NOW. A live ExtensionContext does
+  // not prove that the captured ExtensionAPI can send; Pi can leave ctx
+  // probes answering while the API has already latched stale. Reclaim only
+  // when the exact API used by continuation sends also passes its probe.
+  if (!isCtxAlive(ctx) || !extensionApi || probeExtensionApiStaleRaw()) return false;
   const was = extensionApiStale ? "extension_api_stale" : sessionHandoffPending ? "session_handoff_pending" : "stale_terminal_done";
   extensionApiStale = false;
   sessionHandoffPending = false;
@@ -1425,6 +1504,13 @@ function selfHealStaleSameSession(ctx: ExtensionContext): boolean {
   appendLedger(ctx.cwd, "stale_self_healed", { was, via: "same-session command", generation: sessionGeneration });
   startHeartbeat();
   startUITicker();
+  const staleRearmed = consumeStaleContinuationRearm(ctx, "same-session command");
+  if (staleRearmed) {
+    ctx.ui.notify(`glla: the healthy handle re-armed ${state.goal?.policy === "list" ? "the list item" : "the goal"} continuation after the stale-handle boundary.`, "info");
+    if (state.goal?.status === "active" && !continuationTimerPending() && !pendingContinuationDispatchRef()) {
+      scheduleContinuation(ctx, true);
+    }
+  }
   const auditRetryStarted = state.goal?.status === "paused"
     && state.goal.pendingCompletion?.phase === "recovery-pending"
     && typeof maybeAutoRetryParkedCompletionAudit === "function"
@@ -1432,23 +1518,16 @@ function selfHealStaleSameSession(ctx: ExtensionContext): boolean {
   if (auditRetryStarted) {
     ctx.ui.notify("glla: the stale handle recovered in place — retrying the stored no-verdict completion audit once.", "info");
   } else if (state.goal && state.goal.status === "active" && state.goal.interruptedAt) {
-    // Mirror the session-load restore gate: autoResume=on (unattended rigs)
-    // resumes; the hold-everything default keeps the interrupt marker and
-    // asks for an explicit resume.
-    const autoResumeSetting = resolveEffectiveAggressiveSettings(loadGlobalSettings()).autoResume;
-    if (autoResumeSetting) {
-      updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);
-      ctx.ui.notify(
-        `Recovered from the stale-handle park — the handle is healthy again. Resuming ${state.goal.policy === "list" ? "list item" : "goal"}: ${displaySlice(state.goal.objective, 70)}`,
-        "info",
-      );
-      postRestoreGraceTurns = 2;
+    // A live context from the same session proves the session was not lost.
+    // Clear the spurious interrupt marker so the UI does not show 'host session lost'.
+    updateGoal({ interruptedAt: undefined, interruptedReason: undefined }, ctx);
+    ctx.ui.notify(
+      `Recovered from the stale-handle park — the handle is healthy again. Resuming ${state.goal.policy === "list" ? "list item" : "goal"}: ${displaySlice(state.goal.objective, 70)}`,
+      "info",
+    );
+    postRestoreGraceTurns = 2;
+    if (!staleRearmed && !continuationTimerPending() && !pendingContinuationDispatchRef() && state.goal.autoContinue !== false) {
       scheduleContinuation(ctx, true);
-    } else {
-      ctx.ui.notify(
-        `Recovered from the stale-handle park — the handle is healthy again. ${activeGoalSurfaceCommand("resume")} continues the interrupted ${state.goal.policy === "list" ? "list item" : "goal"}.`,
-        "info",
-      );
     }
   } else {
     ctx.ui.notify("glla: recovered from the stale-handle park — the handle is healthy again; the goal plane is live.", "info");
@@ -1585,6 +1664,7 @@ defineGoalRuntimeGlobal("writeOwnerFile", { get: () => writeOwnerFile });
 defineGoalRuntimeGlobal("readOwnerFile", { get: () => readOwnerFile });
 defineGoalRuntimeGlobal("absorbStaleIfSuperseded", { get: () => absorbStaleIfSuperseded });
 defineGoalRuntimeGlobal("goStaleTerminal", { get: () => goStaleTerminal });
+defineGoalRuntimeGlobal("consumeStaleContinuationRearm", { get: () => consumeStaleContinuationRearm });
 defineGoalRuntimeGlobal("SESSION_HANDOFF_FILE", { get: () => SESSION_HANDOFF_FILE });
 defineGoalRuntimeGlobal("SESSION_HANDOFF_VERSION", { get: () => SESSION_HANDOFF_VERSION });
 defineGoalRuntimeGlobal("SESSION_HANDOFF_FRESH_MS", { get: () => SESSION_HANDOFF_FRESH_MS });

package/extensions/loops/goal-settings-ui.ts

@@ -173,19 +173,10 @@ import {
   tickLengthContinue,
 } from "../length-continue.js";
 import {
-  classifyMainModelFailure,
-  mainModelAutoRetryUntil,
-  mainModelFailureDelayMs,
-  mainModelRetryDelayMs,
-  MAIN_MODEL_AUTO_RETRY_HORIZON_MS,
   MAX_MAIN_MODEL_FALLBACKS,
   modelRef,
-  nextUntriedModelRef,
   normalizeModelRefs,
   normalizeMainModelFallbackRefs,
-  sendStormEscalateMs,
-  splitModelRef,
-  type MainModelFailure,
 } from "../main-model-recovery.js";
 import {
   globalSettingsPath,
@@ -196,6 +187,7 @@ import {
   settingsProvenance,
   type Settings,
 } from "../goal-settings.js";
+import { ModelSelector } from "../model-selector.js";
 import {
   curateAuditReviewSources,
   normalizeObjective,
@@ -372,7 +364,7 @@ import {
 } from "../goal-loop.js";
 import { defineGoalRuntimeGlobal } from "./goal-runtime-globals.js";
 
-type AuditorModelCandidate = any;
+type AuditorModelCandidate = { ref?: string; model: any; via: string };
 
 function auditorThinkingLevels(model: any): string[] {
   const ALL = ["off", "minimal", "low", "medium", "high", "xhigh", "max"];
@@ -449,77 +441,110 @@ const THINKING_DESCR: Record<string, string> = {
   max: "maximum reasoning",
 };
 
-function resolveAuditorModel(ctx: ExtensionContext, ref?: string, fallbackRef?: string, sameSessionSwap = true): { model: any; error?: string; via?: string; fallbackModels?: AuditorModelCandidate[] } {
+export function resolveAuditorModel(
+  ctx: ExtensionContext,
+  ref?: string,
+  fallbackRef?: string,
+  sameSessionSwap = true,
+): { model: any; error?: string; via?: string; fallbackModels?: AuditorModelCandidate[] } {
   const sessionModel = ctx.model as any;
+  const currentRef = modelRef(sessionModel);
   const tryRef = (trimmed: string): { model?: any; reason?: string } => {
     const slash = trimmed.indexOf("/");
     if (slash > 0) {
       const provider = trimmed.slice(0, slash);
       const model = ctx.modelRegistry.find(provider, trimmed.slice(slash + 1));
       if (!model) return { reason: "model not found" };
-      // v0.29.17: an unkeyed provider counts as unavailable. This is a
-      // registry/auth distinction only; recovery itself remains generic.
+      // An unkeyed provider is unavailable to the detached worker even when
+      // the registry knows the model. Keep this check at the resolver edge;
+      // runtime failures are handled by the shared retry walker.
       if (!ctx.modelRegistry.hasConfiguredAuth(model)) return { reason: `no configured auth for ${provider}` };
       return { model };
     }
     const matches = ctx.modelRegistry.getAvailable().filter((m: any) => m.id === trimmed || m.name === trimmed);
-    return matches[0] ? { model: matches[0] } : { reason: "no available model matching" };
-  };
-  const isSession = (m: any) => sessionModel && m.provider === sessionModel.provider && m.id === sessionModel.id;
-  const modelKey = (m: any): string => {
-    if (!m || typeof m !== "object") return String(m ?? "(unset)");
-    return `${m.provider ?? ""}/${m.id ?? ""}`;
+    const model = matches.find((candidate: any) => ctx.modelRegistry.hasConfiguredAuth(candidate));
+    return model ? { model } : { reason: "no available model matching" };
   };
+  const configuredRefs = normalizeMainModelFallbackRefs([
+    ...(ref?.trim() ? [ref.trim()] : []),
+    ...(fallbackRef?.trim() ? [fallbackRef.trim()] : []),
+  ]);
+  const settings = loadSettings(ctx.cwd);
+  const forbidden = (candidate: string): boolean => isForbiddenModel(candidate, settings.forbiddenModels);
+  const selector = new ModelSelector({
+    getChain: () => configuredRefs,
+    resolve: (candidate) => tryRef(candidate).model,
+    isForbidden: forbidden,
+    record: (event) => {
+      if (event.reason === "forbidden" && event.toRef) {
+        // Forbidden is an explicit user gate, not an unavailable-model
+        // warning. Keep the forensic ledger entry but do not nudge the UI.
+        appendLedger(ctx.cwd, "auditor_model_fallback", { configured: event.toRef, reason: "forbidden" });
+        return;
+      }
+      if (event.reason !== "unregistered" || !event.toRef) return;
+      const reason = tryRef(event.toRef).reason ?? "model unavailable";
+      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: event.toRef, reason });
+      const display = providerErrorPresentation(reason, "completion").display;
+      ctx.ui.notify(`Auditor model "${event.toRef}" is unavailable (${display}) — trying the next fallback pin. Fix via /glla → Auditor model.`, "warning");
+    },
+  });
   const candidates: AuditorModelCandidate[] = [];
-  const seen = new Set<string>();
-  const addCandidate = (model: any, via: string): void => {
-    const key = modelKey(model);
-    if (seen.has(key)) return;
-    seen.add(key);
-    candidates.push({ model, via });
+  const attempted: string[] = [];
+  const seenModels = new Set<string>();
+  const addCandidate = (candidateRef: string, model: any, via: string): void => {
+    const key = modelRef(model)?.toLowerCase() ?? candidateRef.toLowerCase();
+    if (seenModels.has(key)) return;
+    seenModels.add(key);
+    candidates.push({ ref: candidateRef, model, via });
   };
-  // v0.32.0: per-pin source labels — when the primary is unset, pins[0] IS
-  // the fallback and the old i===0→"setting" map mislabeled it.
-  const pins: Array<{ pin: string; src: "setting" | "fallback-pin" }> = [];
-  if (ref?.trim()) pins.push({ pin: ref.trim(), src: "setting" });
-  if (fallbackRef?.trim()) pins.push({ pin: fallbackRef.trim(), src: "fallback-pin" });
-  for (let i = 0; i < pins.length; i++) {
-    const { pin } = pins[i]!;
-    const r = tryRef(pin);
-    if (!r.model) {
-      // Unavailable pin → cascade: next pin, then the session model (LOUD).
-      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pin, reason: r.reason });
-      // v0.32.0: the last pin no longer pre-announces the session fallback —
-      // the post-loop block does that (it notified twice before).
-      const modelFailureCopy = providerErrorPresentation(r.reason, "completion");
-      ctx.ui.notify(`Auditor model "${pin}" is unavailable (${modelFailureCopy.display})${i + 1 < pins.length ? " — trying the fallback pin" : ""}. Fix via /glla → Auditor model.`, "warning");
-      continue;
-    }
-    if (sameSessionSwap && isSession(r.model) && i + 1 < pins.length) {
-      // The pin IS the session model — the verifier would be the executor's
-      // own model; auto-swap down the chain (the user's move).
-      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: pins[i + 1]!.pin });
-      ctx.ui.notify(`Session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — auditor auto-swapped to ${pins[i + 1]!.pin} so the verifier differs.`, "info");
-      continue;
+  const primaryRef = ref?.trim() && ref.trim().toLowerCase() !== "unset" ? configuredRefs[0] : undefined;
+  // Unlike main recovery, the auditor may deliberately use the session model
+  // when same-model swapping is disabled. Seed that configured primary before
+  // asking the selector to walk the remaining chain.
+  if (
+    !sameSessionSwap
+    && primaryRef
+    && currentRef
+    && primaryRef.toLowerCase() === currentRef.toLowerCase()
+    && !forbidden(primaryRef)
+    && sessionModel
+  ) {
+    addCandidate(primaryRef, sessionModel, "setting");
+    attempted.push(primaryRef);
+  }
+  for (;;) {
+    const selected = selector.selectNextValid(
+      { kind: "auditor" },
+      sameSessionSwap ? currentRef : undefined,
+      attempted,
+    );
+    for (const visited of selector.lastVisitedRefs) {
+      if (!attempted.some((entry) => entry.toLowerCase() === visited.toLowerCase())) attempted.push(visited);
     }
-    // v0.32.0: the nudge must fire when the LAST pin stands on the session
-    // model — the old `!fallbackRef` guard went SILENT when the fallback pin
-    // itself resolved to the session model (verifier == executor, and hop 0's
-    // notify had just claimed "auto-swapped so the verifier differs" — false).
-    if (sameSessionSwap && isSession(r.model) && i + 1 >= pins.length) {
-      // Last resort reached and it IS the session model, with no fallback
-      // ever pinned — the model stands (the session IS the last resort);
-      // one loud nudge so the user can wire the swap.
-      appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: `${r.model.provider}/${r.model.id}`, fallback: null });
-      ctx.ui.notify(`The session model IS the pinned auditor (${r.model.provider}/${r.model.id}) — pin a different /glla → Auditor fallback agent so the verifier can differ.`, "warning");
+    if (!("model" in selected) || typeof selected.ref !== "string") break;
+    const via = primaryRef && selected.ref.toLowerCase() === primaryRef.toLowerCase() ? "setting" : "fallback-pin";
+    addCandidate(selected.ref, selected.model, via);
+    if (!attempted.some((entry) => entry.toLowerCase() === selected.ref.toLowerCase())) attempted.push(selected.ref);
+  }
+  if (sessionModel && currentRef) addCandidate(currentRef, sessionModel, candidates.length > 0 ? "session-fallback" : "session");
+
+  const currentPinned = sameSessionSwap && currentRef
+    ? configuredRefs.find((candidate) => candidate.toLowerCase() === currentRef.toLowerCase())
+    : undefined;
+  if (currentPinned && currentRef) {
+    const replacement = candidates.find((candidate) => candidate.via === "fallback-pin" && candidate.ref?.toLowerCase() !== currentRef.toLowerCase());
+    appendLedger(ctx.cwd, "auditor_model_same_as_session", { model: currentRef, fallback: replacement?.ref ?? null });
+    if (replacement?.ref) {
+      ctx.ui.notify(`Session model IS the pinned auditor (${currentRef}) — auditor auto-swapped to ${replacement.ref} so the verifier differs.`, "info");
+    } else {
+      ctx.ui.notify(`The session model IS the pinned auditor (${currentRef}) — pin a different /glla → Auditor fallback agent so the verifier can differ.`, "warning");
     }
-    addCandidate(r.model, pins[i]!.src);
   }
-  if (sessionModel) addCandidate(sessionModel, pins.length > 0 ? "session-fallback" : "session");
   if (candidates.length > 0) {
     const first = candidates[0]!;
     if (first.via === "session-fallback") {
-      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: pins.map((p) => p.pin).join(" → ") || "(none)", reason: "all pins exhausted" });
+      appendLedger(ctx.cwd, "auditor_model_fallback", { configured: configuredRefs.join(" → ") || "(none)", reason: "all pins exhausted" });
       ctx.ui.notify("All pinned auditor models are unavailable — falling back to the session model. Fix via /glla → Auditor model.", "warning");
     }
     return { model: first.model, via: first.via, fallbackModels: candidates.slice(1) };
@@ -750,8 +775,12 @@ async function promptModelRefs(
   // an invoked factory returning undefined is a genuine user cancel.
   if (pick === undefined && !factoryInvoked) return inputFallback();
   if (pick === undefined) return undefined;
-  const normalizedPick = normalizeSelection(pick);
-  const omitted = pick.filter((ref) => !normalizedPick.some((kept) => kept.toLowerCase() === ref.toLowerCase()));
+  // The picker keeps its legacy string[] result by default, but its optional
+  // inherit row returns a structured selection so inheritance is never
+  // mistaken for a provider/model ref at this boundary.
+  const pickedRefs = Array.isArray(pick) ? pick : pick.refs;
+  const normalizedPick = normalizeSelection(pickedRefs);
+  const omitted = pickedRefs.filter((ref) => !normalizedPick.some((kept) => kept.toLowerCase() === ref.toLowerCase()));
   const omittedCurrent: string[] = opts.currentRef
     ? omitted.filter((ref) => ref.toLowerCase() === opts.currentRef!.toLowerCase())
     : [];
@@ -908,6 +937,36 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       }
       return;
     }
+    case "mainModelFailback": {
+      const v = await ctx.ui.select("Primary failback — what happens after a fallback turn succeeds", [
+        "auto — periodically probe the preferred primary and fail back when it works (default)",
+        "sticky — stay on the fallback until a manual model selection",
+      ]);
+      if (v) {
+        const sticky = v.startsWith("sticky");
+        saveSettings("global", ctx.cwd, { mainModelFailback: sticky ? "sticky" : undefined });
+        if (sticky && state.mainModelRecovery && (state.mainModelRecovery.primaryProbeAt || state.mainModelRecovery.primaryProbeInFlight)) {
+          clearMainModelRecoveryTimer();
+          state.mainModelRecovery = undefined;
+          persistState(ctx);
+        } else if (!sticky && state.mainModelRecovery?.primaryProbeAt) {
+          scheduleMainModelRecoveryTimer(ctx, Math.max(0, Date.parse(state.mainModelRecovery.primaryProbeAt) - Date.now()));
+        }
+        ctx.ui.notify(sticky ? "Primary failback STICKY — the current fallback stays selected until you switch manually." : "Primary failback AUTO — a healthy fallback will periodically test the preferred primary.", "info");
+      }
+      return;
+    }
+    case "mainModelPrimaryProbeMinutes": {
+      const v = await ctx.ui.input("Preferred-primary failback probe cadence", "positive integer minutes; empty = default 15");
+      if (v !== undefined) {
+        const raw = v.trim();
+        const n = Number.parseInt(raw, 10);
+        if (Number.isInteger(n) && n > 0) saveSettings("global", ctx.cwd, { mainModelPrimaryProbeMinutes: n });
+        else if (!raw) saveSettings("global", ctx.cwd, { mainModelPrimaryProbeMinutes: undefined });
+        else ctx.ui.notify(`primary probe minutes must be a positive integer, got: ${v}`, "warning");
+      }
+      return;
+    }
     case "drafterModel": {
       const pick = await promptModelRef(ctx, "Drafter agent — temporary agent for drafting only", "provider/model-id — empty keeps the current session model");
       if (pick === undefined) return;