pi-goal-list-loop-audit 0.35.4 → 0.35.13

package/extensions/loops/goal-tools.ts

@@ -39,6 +39,7 @@ import {
   workCommandRoot,
   appendLedger,
   claimRecoveryNotice,
+  assignQueueOrder,
   providerErrorPresentation,
   sanitizeProviderAuditReport,
   sanitizeProviderDisplayText,
@@ -59,10 +60,9 @@ import {
   computeListDepth,
   formatAuditLog,
   formatGoalAuditHistory,
-  runWithInfraRetry,
-  isRetriableInfraError,
   readAuditLog,
   bumpGoalRevision,
+  captureGoalRevision,
   stripThinkBlocks,
   type AuditLogEntry,
   ledgerPath,
@@ -177,13 +177,10 @@ import {
   tickLengthContinue,
 } from "../length-continue.js";
 import {
-  classifyMainModelFailure,
   mainModelAutoRetryUntil,
-  mainModelFailureDelayMs,
   mainModelRetryDelayMs,
   MAIN_MODEL_AUTO_RETRY_HORIZON_MS,
   modelRef,
-  nextUntriedModelRef,
   normalizeModelRefs,
   sendStormEscalateMs,
   splitModelRef,
@@ -221,6 +218,10 @@ import {
   runDetachedGoalCompletionAuditor,
   type AuditorProgress,
 } from "../goal-loop-auditor-process.js";
+import {
+  extractMechanicalCheckCommands,
+  runMechanicalPreAuditChecks,
+} from "../goal-loop-shield.js";
 import {
   REPETITION,
   isActuallyStuck,
@@ -339,6 +340,7 @@ import {
 import {
   addSingleItem,
   autoNotifyCmd,
+  hydrateListQueueFromDisk,
   cmdGoal,
   cmdList,
   cmdReview,
@@ -414,8 +416,26 @@ function registerAgentTools(pi: any): void {
     label: "Complete goal",
     description: "Mark the active goal as complete. Queues a detached auditor worker to verify without holding the main pi turn. Use only when the objective is genuinely satisfied.",
     parameters: Type.Object({
-      completionSummary: Type.Optional(Type.String({ description: "1-paragraph completion claim" })),
-      verificationSummary: Type.Optional(Type.String({ description: "Per-item evidence for the verification contract" })),
+      // v0.34.136: completionSummary adopts the six-label recap from
+      // audit/COMPLETION-SUMMARY-POLICY-2026-08-19.md (Outcome / Changed
+      // / Evidence / Tests / Unresolved / Next). Every label is present
+      // even when its value is `none`; the durable archive preserves all
+      // six lines verbatim and the display/widget projection does NOT
+      // fabricate an auditor verdict.
+      completionSummary: Type.Optional(Type.String({
+        description:
+          "Six-label recap — one line per label, every label required (use `none` when empty): " +
+          "Outcome: <what was delivered> · Changed: <files/behavior/decision> · Evidence: <key commit/report/result> · " +
+          "Tests: <bounded commands + pass/fail, or `not run — <reason>`> · Unresolved: <remaining risk, or `none`> · " +
+          "Next: <one follow-up hint, or `none`>. " +
+          "See audit/COMPLETION-SUMMARY-POLICY-2026-08-19.md. Free-form prose is allowed but discouraged.",
+      })),
+      verificationSummary: Type.Optional(Type.String({
+        description:
+          "Per-item evidence for the verification contract. " +
+          "Stays independent of completionSummary: the detached auditor receives both fields separately " +
+          "and cross-checks the verification claim against real artifacts (see audit/COMPLETION-SUMMARY-POLICY-2026-08-19.md).",
+      })),
       newObjective: Type.Optional(Type.String({ description: "v0.25.0 (contract item 15): when the work has legitimately shifted, pass the new objective here — it atomically replaces the goal objective AND the audit proceeds against the NEW objective in this same call. Do not use to dodge a legitimate disapproval; the auditor sees the change." })),
     }),
     async execute(_id, params, signal, _onUpdate, execCtx) {
@@ -649,11 +669,22 @@ function registerAgentTools(pi: any): void {
       // every state/UI access below rebinds through the generation guard.
       completionAuditInFlight = true;
       completionAuditGeneration = auditGeneration;
-      latestAuditProgress = { label: "queued", lastEventAt: Date.now() };
+      latestAuditProgress = {
+        label: "queued",
+        model: modelRef(auditorModel),
+        via: via ?? "unset",
+        lastEventAt: Date.now(),
+      };
       refreshUI(ctx);
       void (async () => {
-      const runAudit = (candidate: AuditorModelCandidate) =>
-        runDetachedGoalCompletionAuditor({
+      const runAudit = (candidate: AuditorModelCandidate) => {
+        latestAuditProgress = {
+          ...(latestAuditProgress ?? {}),
+          model: modelRef(candidate.model),
+          via: candidate.via,
+        };
+        refreshUI(ctx);
+        return runDetachedGoalCompletionAuditor({
           cwd: ctx.cwd,
           goal: auditGoal,
           completionSummary: finalSummary,
@@ -673,6 +704,7 @@ function registerAgentTools(pi: any): void {
             appendLedger(current.cwd, "auditor_stalled", { goalId: auditGoalId, attemptId: auditAttemptId, ...info });
           },
         });
+      };
       // v0.25.4 (post-audit fix): a retriable infra failure (stream error,
       // auth blip — NOT user abort, NOT missing model) gets ONE automatic
       // retry with backoff before we report "auditor infrastructure error
@@ -681,29 +713,53 @@ function registerAgentTools(pi: any): void {
       let result: Awaited<ReturnType<typeof runAudit>>;
       let retriedOnce = false;
       let fallbackUsed = false;
-      try {
-        ({ result, retriedOnce, fallbackUsed } = await runDetachedCompletionWithFallback(auditorCandidates, runAudit, {
-          shouldRetry: () => detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId) !== null,
-          onRetry: (candidate: AuditorModelCandidate, err: string) => {
-            const current = detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId);
-            if (!current) return;
-            const failureCopy = providerErrorPresentation(err, "completion");
-            latestAuditProgress = { label: `${failureCopy.display} — retrying once`, lastEventAt: Date.now() };
-            refreshUI(current);
-            appendLedger(current.cwd, "audit_infra_retry", { goalId: auditGoalId, model: auditorCandidateLabel(candidate), error: failureCopy.diagnostic.slice(0, 200), diagnostic: failureCopy.diagnostic });
-          },
-          onFallback: (from: AuditorModelCandidate, to: AuditorModelCandidate, err: string) => {
-            const current = detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId);
-            if (!current) return;
-            appendLedger(current.cwd, "auditor_runtime_model_fallback", { goalId: auditGoalId, from: auditorCandidateLabel(from), to: auditorCandidateLabel(to), error: err.slice(0, 200) });
-            current.ui.notify(`Detached auditor failed on ${auditorCandidateLabel(from)} — retrying with ${auditorCandidateLabel(to)}. This is infrastructure, not a verdict.`, "warning");
-          },
-        }));
-      } finally {
-        if (ownsDetachedAudit(auditGeneration, auditGoalId, auditAttemptId)) {
-          clearDetachedAuditProgress(auditGeneration, auditGoalId, auditAttemptId);
-          completionAuditInFlight = false;
-          completionAuditGeneration = null;
+      // v0.35.7: Deterministic Fast-Fail Pre-Audit — if mechanical contract checks fail,
+      // fail in 200ms with raw output rather than burning 45s on an LLM audit pass.
+      const mechanicalCmds = extractMechanicalCheckCommands(auditGoal.verificationContract ?? "");
+      const mechanicalResult = runMechanicalPreAuditChecks(ctx.cwd, mechanicalCmds);
+      if (!mechanicalResult.passed) {
+        result = {
+          approved: false,
+          disapproved: true,
+          impossible: false,
+          output: `<disapproved/>\n\nDeterministic Pre-Audit Fast-Fail: Mechanical contract check failed: \`${mechanicalResult.failedCommand}\` (exit code ${mechanicalResult.exitCode})\n\n<evidence>\n${mechanicalResult.output}\n</evidence>`,
+          model: "deterministic-pre-audit",
+          regressionShieldPassed: true,
+          goalRevision: captureGoalRevision(auditGoal) ?? undefined,
+        };
+      } else {
+        try {
+          ({ result, retriedOnce, fallbackUsed } = await runDetachedCompletionWithFallback(auditorCandidates, runAudit, {
+            shouldRetry: () => detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId) !== null,
+            forbiddenRefs: settings.forbiddenModels,
+            retryBaseMinutes: settings.mainModelRetryMinutes,
+            onRetry: (candidate: AuditorModelCandidate, err: string) => {
+              const current = detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId);
+              if (!current) return;
+              const failureCopy = providerErrorPresentation(err, "completion");
+              latestAuditProgress = {
+                ...(latestAuditProgress ?? {}),
+                model: modelRef(candidate.model),
+                via: candidate.via,
+                label: `${failureCopy.display} — retrying once`,
+                lastEventAt: Date.now(),
+              };
+              refreshUI(current);
+              appendLedger(current.cwd, "audit_infra_retry", { goalId: auditGoalId, model: auditorCandidateLabel(candidate), error: failureCopy.diagnostic.slice(0, 200), diagnostic: failureCopy.diagnostic });
+            },
+            onFallback: (from: AuditorModelCandidate, to: AuditorModelCandidate, err: string) => {
+              const current = detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId);
+              if (!current) return;
+              appendLedger(current.cwd, "auditor_runtime_model_fallback", { goalId: auditGoalId, from: auditorCandidateLabel(from), to: auditorCandidateLabel(to), error: err.slice(0, 200) });
+              current.ui.notify(`Detached auditor failed on ${auditorCandidateLabel(from)} — retrying with ${auditorCandidateLabel(to)}. This is infrastructure, not a verdict.`, "warning");
+            },
+          }));
+        } finally {
+          if (ownsDetachedAudit(auditGeneration, auditGoalId, auditAttemptId)) {
+            clearDetachedAuditProgress(auditGeneration, auditGoalId, auditAttemptId);
+            completionAuditInFlight = false;
+            completionAuditGeneration = null;
+          }
         }
       }
       const auditContextAfterRun = freshCtxForGeneration(auditGeneration);
@@ -1376,6 +1432,19 @@ function registerAgentTools(pi: any): void {
       while (queue.length > 0) {
         const t = queue.shift();
         if (t.id === p.id && t.status !== "complete") {
+          if (t.verificationContract) {
+            const checkCmds = extractMechanicalCheckCommands(t.verificationContract);
+            const checkRes = runMechanicalPreAuditChecks(ctx.cwd, checkCmds);
+            if (!checkRes.passed) {
+              return {
+                content: [{
+                  type: "text",
+                  text: `Task ${p.id} milestone verification FAILED for command \`${checkRes.failedCommand}\` (exit code ${checkRes.exitCode}):\n\n${checkRes.output}\n\nTask ${p.id} remains in_progress. Fix the failure before marking complete.`,
+                }],
+                details: {},
+              };
+            }
+          }
           t.status = "complete";
           updateGoal({ taskList: tl }, ctx);
           return { content: [{ type: "text", text: `Task ${p.id} marked complete.` }], details: {} };
@@ -1603,20 +1672,24 @@ function registerAgentTools(pi: any): void {
             };
           }
         }
+        hydrateListQueueFromDisk(liveCtx);
         const extracted = parseListItemDeclaration(full);
-        const item = {
+        const item = assignQueueOrder([{
           id: newGoalId(),
           objective: extracted.objective,
           ...(extracted.agentRole ? { agentRole: extracted.agentRole } : {}),
           verificationContract: extracted.verificationContract || undefined,
           ...(extracted.parallelSafe === undefined ? {} : { parallelSafe: extracted.parallelSafe }),
           addedAt: nowIso(),
-        };
+        }], listQueue())[0]!;
         // v0.34.61: disk-first — same invariant as addSingleItem. The list
         // draft path was the second-missed place: previously the in-memory
         // state mutated without a sidecar, so a torn-rename or post-mutation
         // crash could drop the drafted item.
-        writeQueueItemFile(liveCtx.cwd, item);
+        const written = writeQueueItemFile(liveCtx.cwd, item);
+        if (written.failed) {
+          return { content: [{ type: "text", text: "The list draft could not be persisted; no in-memory queue mutation was applied. Fix disk access and retry." }], details: {} };
+        }
         replaceState({ ...state, list: [...listQueue(), item] });
         persistState(liveCtx);
         appendLedger(liveCtx.cwd, "list_added", { id: item.id, objective: item.objective, drafted: true });
@@ -2016,6 +2089,7 @@ function registerAgentTools(pi: any): void {
       tasks: Type.Array(Type.Object({
         title: Type.String(),
         agentRole: Type.Optional(Type.Literal("designer", { description: "Route this task through the read-only Designer subagent before implementation." })),
+        verificationContract: Type.Optional(Type.String({ description: "Optional verification gate command for this milestone before it can be marked complete." })),
         subtasks: Type.Optional(Type.Array(Type.String())),
       })),
     }),

package/extensions/loops/goal-ui.ts

@@ -224,7 +224,7 @@ import {
   textFingerprint,
   pushCapped as pushRepetitionCapped,
 } from "../goal-loop-repetition.js";
-import { buildStatusText, buildWidgetLines, type AuditDisplayProgress } from "../goal-loop-display.js";
+import { buildStatusText, buildWidgetLines, type AuditDisplayProgress, type ModelProvenanceDisplay } from "../goal-loop-display.js";
 import {
   defaultAgentDir,
   resolveEffectiveSubagentModel,
@@ -474,6 +474,8 @@ function isSupervising(): boolean {
 
 let latestAuditProgress: AuditDisplayProgress | null = null;
 let uiTicker: NodeJS.Timeout | null = null;
+let deferredUIRefresh: NodeJS.Timeout | null = null;
+const UI_REFRESH_SETTLE_MS = 50;
 const LIVE_STREAM_PROOF_MS = 15_000;
 
 /**
@@ -502,6 +504,11 @@ function publishDetachedAuditProgress(
   const current = detachedAuditContext(generation, goalId, attemptId);
   if (!current) return false;
   latestAuditProgress = {
+    // Candidate identity is marked by the parent before the worker starts;
+    // preserve it across progress-file snapshots so the card never loses
+    // which model actually handled the audit.
+    model: latestAuditProgress?.model,
+    via: latestAuditProgress?.via,
     currentTool: progress.currentTool,
     currentToolArgs: progress.currentToolArgs,
     currentToolStartedAt: progress.currentToolStartedAt,
@@ -634,7 +641,36 @@ function refreshUI(ctx: ExtensionContext): void {
     const width = process.stdout.columns || 80;
     const activity = displayActivityFor(ctx);
     const settings = loadSettings(ctx.cwd);
-    const extras = { stalls: consecutiveStalls, recent: recentActions, ...activity, turnPending: pendingContinuationDispatchRef() !== null, auditorSilent: loadSettings(ctx.cwd).auditorSilent !== false, auditorProgressSignals: settings.auditorProgressSignals !== false, mainModelFallbacks: settings.mainModelFallbacks ?? [] };
+    const sessionRef = modelRef(ctx.model);
+    const recovery = state.mainModelRecovery;
+    const fallbackRefs = settings.mainModelFallbacks ?? [];
+    const skippedForbiddenRefs = [
+      ...fallbackRefs.filter((ref) => isForbiddenModel(ref, settings.forbiddenModels)),
+      ...(recovery?.skipped ?? []).filter((entry) => entry.reason === "forbidden").map((entry) => entry.ref),
+    ];
+    const modelProvenance: ModelProvenanceDisplay = {
+      // Main-model pins are session-owned today; an explicit goal pin will be
+      // able to set primarySource:"pinned" without changing the renderer.
+      primary: recovery?.primary ?? sessionRef,
+      primarySource: "inherited",
+      fallbackRefs,
+      skippedForbiddenRefs,
+      handledTurn: state.lastModelRef ?? recovery?.active ?? sessionRef,
+      ...(latestAuditProgress?.model ? {
+        handledAudit: latestAuditProgress.model,
+        handledAuditSource: latestAuditProgress.via,
+      } : {}),
+    };
+    const extras = {
+      stalls: consecutiveStalls,
+      recent: recentActions,
+      ...activity,
+      turnPending: pendingContinuationDispatchRef() !== null,
+      auditorSilent: loadSettings(ctx.cwd).auditorSilent !== false,
+      auditorProgressSignals: settings.auditorProgressSignals !== false,
+      mainModelFallbacks: fallbackRefs,
+      modelProvenance,
+    };
     // Settings are loaded once for the remaining projections; the explicit
     // auditorSilent expression preserves the source-level contract.
     ctx.ui.setStatus("pi-glla", buildStatusText(state, latestAuditProgress, Date.now(), theme, extras));
@@ -644,6 +680,26 @@ function refreshUI(ctx: ExtensionContext): void {
   }
 }
 
+/**
+ * Repaint once more after the current event/tool turn yields back to pi.
+ *
+ * `refreshUI()` is called synchronously when state is persisted, but pi can
+ * repaint the transcript/editor after that callback and restore the previous
+ * extension widget. The regular ticker is intentionally best-effort and can
+ * also be between session contexts at that boundary. A debounced next-turn
+ * repaint makes the durable state transition win without making the detached
+ * auditor or the main turn wait for UI work.
+ */
+function scheduleUIRefresh(): void {
+  if (deferredUIRefresh) return;
+  deferredUIRefresh = setTimeout(() => {
+    deferredUIRefresh = null;
+    const ctx = freshCtx();
+    if (ctx) refreshUI(ctx);
+  }, UI_REFRESH_SETTLE_MS);
+  deferredUIRefresh.unref?.();
+}
+
 function startUITicker(): void {
   if (uiTicker) return;
   uiTicker = setInterval(() => {
@@ -815,6 +871,7 @@ defineGoalRuntimeGlobal("noteToolCall", { get: () => noteToolCall });
 defineGoalRuntimeGlobal("noteToolResult", { get: () => noteToolResult });
 defineGoalRuntimeGlobal("displayActivityFor", { get: () => displayActivityFor });
 defineGoalRuntimeGlobal("refreshUI", { get: () => refreshUI });
+defineGoalRuntimeGlobal("scheduleUIRefresh", { get: () => scheduleUIRefresh });
 defineGoalRuntimeGlobal("startUITicker", { get: () => startUITicker });
 defineGoalRuntimeGlobal("loopRearmStreak", { get: () => loopRearmStreak, set: (v) => { loopRearmStreak = v as any; } });
 defineGoalRuntimeGlobal("compactionGraceUntil", { get: () => compactionGraceUntil, set: (v) => { compactionGraceUntil = v as any; } });

package/extensions/main-model-recovery.ts

@@ -7,11 +7,30 @@
 
 export const MAIN_MODEL_MAX_RETRY_DELAY_MS = 5 * 60 * 60_000;
 export const MAIN_MODEL_AUTO_RETRY_HORIZON_MS = 24 * 60 * 60_000;
+export const DEFAULT_MAIN_MODEL_PRIMARY_PROBE_MINUTES = 15;
 /** Keep a fallback chain useful and bounded even when settings are edited
  * outside the UI. Ten alternatives is enough to cross providers/model pools
  * without turning one failure into an unbounded registry walk. */
 export const MAX_MAIN_MODEL_FALLBACKS = 10;
 
+export type MainModelFailbackPolicy = "auto" | "sticky";
+
+/** Failback is deliberately opt-out: a configured fallback is temporary cover
+ * unless the user explicitly keeps it sticky. Invalid/missing JSON values use
+ * the safe default rather than disabling recovery by accident. */
+export function isMainModelFailbackAuto(policy: unknown): boolean {
+  return policy !== "sticky";
+}
+
+/** Convert the preferred-primary probe cadence to a timer delay. The settings
+ * UI accepts positive minutes; the runtime still clamps hand-edited values to
+ * a useful bounded default. */
+export function mainModelPrimaryProbeDelayMs(minutes: unknown = DEFAULT_MAIN_MODEL_PRIMARY_PROBE_MINUTES): number {
+  const value = typeof minutes === "number" ? minutes : Number(minutes);
+  const safeMinutes = Number.isFinite(value) && value > 0 ? value : DEFAULT_MAIN_MODEL_PRIMARY_PROBE_MINUTES;
+  return Math.max(1_000, Math.round(safeMinutes * 60_000));
+}
+
 export type MainModelFailureKind = "rate-limit" | "quota" | "billing" | "auth" | "transient" | "unknown" | "non-recoverable" | "context-overflow";
 
 export interface MainModelFailure {
@@ -109,7 +128,11 @@ export function classifyMainModelFailure(error: string | undefined, opts?: { isC
   const raw = typeof error === "string" ? error.trim() : "";
   const text = raw.toLowerCase();
   if (!raw) return { kind: "unknown", raw };
-  if (/aborted|cancelled|canceled|user interrupt/.test(text)) {
+  // Auditor timeouts / watchdog stalls are transient infrastructure failures, not user aborts.
+  if (/^(?:auditor (?:exceeded|stalled)|.*(?:timed?\s*out|timeout|inactivity|no session activity))/i.test(raw)) {
+    return { kind: "transient", raw };
+  }
+  if (/^(?:auditor aborted\.?$|user (?:interrupt|abort)|cancelled by user)/i.test(raw) || /user interrupt/.test(text)) {
     return { kind: "non-recoverable", raw };
   }
   if (/context|output[ -]?token|max_?tokens|length limit|too many tokens|prompt too large|context window/.test(text)) {

package/extensions/model-picker.ts

@@ -21,7 +21,7 @@
 import { fuzzyFilter, truncateToWidth, visibleWidth } from "@earendil-works/pi-tui";
 import type { SettingsMenuTheme, KeybindingsManagerLike } from "./settings-menu.ts";
 
-export type ModelPickKind = "session" | "model" | "manual";
+export type ModelPickKind = "session" | "inherit" | "model" | "manual";
 
 export interface ModelPickItem {
   kind: ModelPickKind;
@@ -33,6 +33,8 @@ export interface ModelPickItem {
   searchText: string;
   /** A preserved configured ref that cannot currently be selected. */
   disabledReason?: string;
+  /** True for the explicit dynamic session-inheritance choice. */
+  inheritFromSession?: boolean;
 }
 
 export interface RegistryModelLike {

package/extensions/model-selector.ts

@@ -41,7 +41,8 @@ import {
 export type ModelScope =
   | { kind: "session" }
   | { kind: "subagent"; agentName: string }
-  | { kind: "drafter" };
+  | { kind: "drafter" }
+  | { kind: "auditor" };
 
 export interface ModelSelectorDeps {
   /** Read the fallback chain for a scope (returns the configured list of

package/extensions/multi-model-picker.ts

@@ -14,7 +14,8 @@
 // UX:
 //   • Space (" ") toggles the highlighted item. Models are toggleable;
 //     session-row and manual-row both render but pressing space on them
-//     is a no-op (they're not model refs to pick).
+//     is a no-op (they're not model refs to pick). An optional explicit
+//     inherit-from-session row is a dynamic choice, distinct from both.
 //   • Tab enters/exits ORDER MODE: while active, ↑/↓ moves the highlighted
 //     chain row earlier/later in the try order (membership unchanged). The
 //     active chain row is highlighted in the summary pane. Browsing/search
@@ -47,13 +48,26 @@ export interface MultiModelPickerDeps {
   maxVisibleRows?: number;
   /** Maximum number of model refs that may be selected. Undefined = no cap. */
   maxSelections?: number;
+  /** Add a distinct dynamic "inherit from session" choice row. */
+  includeInheritOption?: boolean;
+  /** Initial state for the explicit inherit choice. */
+  initialInheritFromSession?: boolean;
 }
 
-export type MultiModelPickerResult = string[] | undefined;
+export interface MultiModelPickerSelection {
+  refs: string[];
+  inheritFromSession: boolean;
+}
+
+/** The legacy string[] result remains the default; enabling the inherit row
+ * returns a selection object so callers cannot confuse inheritance with the
+ * old session-clear or manual-entry rows. */
+export type MultiModelPickerResult = string[] | MultiModelPickerSelection | undefined;
 
 export class MultiModelPickerComponent {
   private readonly title: string;
   private readonly items: ModelPickItem[];
+  private readonly includeInheritOption: boolean;
   private readonly maxRows: number;
   private readonly maxSelections: number | undefined;
   private readonly currentRef: string | undefined;
@@ -66,6 +80,8 @@ export class MultiModelPickerComponent {
   private selectedIdx = 0;
   /** Ordered list of selected refs — toggle order, not list order. */
   private readonly selection: string[];
+  /** Explicit dynamic choice; it never becomes a fake provider/model ref. */
+  private inheritFromSession: boolean;
   /** Order mode: ↑/↓ move the chain instead of navigating the list. */
   private orderMode = false;
   /** Chain index the order-mode cursor sits on (follows the moved row). */
@@ -79,7 +95,16 @@ export class MultiModelPickerComponent {
     done: (result: MultiModelPickerResult) => void,
   ) {
     this.title = deps.title;
-    this.items = deps.items;
+    this.includeInheritOption = deps.includeInheritOption === true || deps.items.some((item) => item.kind === "inherit");
+    const inheritItem: ModelPickItem = {
+      kind: "inherit",
+      label: "inherit from session — use the live session model",
+      searchText: "inherit from session live session model",
+      inheritFromSession: true,
+    };
+    this.items = this.includeInheritOption && !deps.items.some((item) => item.kind === "inherit")
+      ? [inheritItem, ...deps.items]
+      : deps.items;
     this.maxRows = deps.maxVisibleRows ?? 12;
     this.maxSelections = deps.maxSelections !== undefined && Number.isInteger(deps.maxSelections) && deps.maxSelections >= 0
       ? deps.maxSelections
@@ -106,6 +131,7 @@ export class MultiModelPickerComponent {
       initial.push(itemRef.get(key) ?? ref);
     }
     this.selection = this.maxSelections === undefined ? initial : initial.slice(0, this.maxSelections);
+    this.inheritFromSession = this.includeInheritOption && deps.initialInheritFromSession === true;
   }
 
   /** Current search query. Exposed for tests. */
@@ -123,6 +149,11 @@ export class MultiModelPickerComponent {
     return [...this.selection];
   }
 
+  /** Whether the explicit inherit choice is enabled. Exposed for tests. */
+  getInheritFromSession(): boolean {
+    return this.inheritFromSession;
+  }
+
   /** Filtered items for the current query. Exposed for tests. */
   filteredItems(): ModelPickItem[] {
     if (!this.query.trim()) return this.items;
@@ -162,7 +193,15 @@ export class MultiModelPickerComponent {
 
   private toggle(): void {
     const it = this.selectedItem();
-    if (!it || it.kind !== "model" || !it.ref) return;
+    if (!it) return;
+    if (it.kind === "inherit") {
+      if (this.includeInheritOption) {
+        this.inheritFromSession = !this.inheritFromSession;
+        this.refresh();
+      }
+      return;
+    }
+    if (it.kind !== "model" || !it.ref) return;
     const idx = this.selectionIndex(it.ref);
     if (idx >= 0) {
       // Removing a stale/blocked ref is always allowed: the user is fixing
@@ -234,6 +273,16 @@ export class MultiModelPickerComponent {
     return idx >= 0 ? `[${idx + 1}]` : "[ ]";
   }
 
+  private itemMarker(item: ModelPickItem): string {
+    if (item.kind === "inherit") return this.inheritFromSession ? "[inherit]" : "[ ]";
+    return this.orderLabel(item.ref);
+  }
+
+  private result(): MultiModelPickerResult {
+    if (!this.includeInheritOption) return [...this.selection];
+    return { refs: [...this.selection], inheritFromSession: this.inheritFromSession };
+  }
+
   private itemForRef(ref: string): ModelPickItem | undefined {
     const key = ref.toLowerCase();
     return this.items.find((item) => item.kind === "model" && item.ref?.toLowerCase() === key);
@@ -249,6 +298,11 @@ export class MultiModelPickerComponent {
     } else {
       lines.push(this.theme.fg("muted", "configured try order (first eligible ref wins):"));
     }
+    if (this.includeInheritOption) {
+      const inheritedRef = this.currentRef ?? "current session model";
+      const state = this.inheritFromSession ? "on" : "off";
+      lines.push(truncateToWidth(`  inherit session  ${inheritedRef} · ${state}`, w, "…"));
+    }
     if (this.selection.length === 0) {
       lines.push(this.theme.fg("dim", this.currentRef
         ? "  — no backups; keep probing the current model"
@@ -276,6 +330,9 @@ export class MultiModelPickerComponent {
       const count = `${this.selection.length}/${this.maxSelections}`;
       lines.push(this.theme.fg(this.selection.length >= this.maxSelections ? "warning" : "muted", `selected: ${count}`));
     }
+    if (this.includeInheritOption) {
+      lines.push(this.theme.fg("muted", `inherit from session: ${this.inheritFromSession ? "selected" : "not selected"}`));
+    }
     lines.push(this.theme.fg("dim", this.orderMode
       ? "↑/↓ moves the highlighted backup · tab returns to browsing"
       : "selected rows are tried top-to-bottom · tab = order mode"));
@@ -292,7 +349,7 @@ export class MultiModelPickerComponent {
       for (let i = 0; i < window.length; i++) {
         const idx = start + i;
         const it = window[i]!;
-        const marker = this.orderLabel(it.ref);
+        const marker = this.itemMarker(it);
         const disabledReason = this.effectiveDisabledReason(it);
         const disabled = disabledReason && !this.isSelected(it.ref) ? ` · ${disabledReason}` : "";
         const row = truncateToWidth(`${marker} ${it.label}${disabled}`, w - 2, "…");
@@ -346,7 +403,7 @@ export class MultiModelPickerComponent {
         return;
       }
       if (this.keybindings.matches(data, "tui.select.confirm")) {
-        this.done([...this.selection]);
+        this.done(this.result());
         return;
       }
       if (this.keybindings.matches(data, "tui.select.cancel") || data === "\x1b") {
@@ -356,7 +413,7 @@ export class MultiModelPickerComponent {
       return;
     }
     if (this.keybindings.matches(data, "tui.select.confirm")) {
-      this.done([...this.selection]);
+      this.done(this.result());
       return;
     }
     if (this.keybindings.matches(data, "tui.select.cancel") || data === "\x1b") {

package/extensions/settings-menu.ts

@@ -263,6 +263,22 @@ export function buildSettingsRows(
       sourceText: src("hourlyRetryProbe"),
       description: "adds a probe at :00:30 while any main-model recovery is parked; off disables only this extra ticker, not the configured retry ladder"
     },
+    {
+      id: "mainModelFailback",
+      section: "main-agent",
+      label: "Primary failback policy",
+      valueText: show("mainModelFailback", "auto"),
+      sourceText: src("mainModelFailback"),
+      description: "auto: a healthy fallback periodically tests the preferred primary · sticky: stay on the fallback until manually changed",
+    },
+    {
+      id: "mainModelPrimaryProbeMinutes",
+      section: "main-agent",
+      label: "Primary probe minutes",
+      valueText: show("mainModelPrimaryProbeMinutes", "15"),
+      sourceText: src("mainModelPrimaryProbeMinutes"),
+      description: "minutes between preferred-primary failback probes while the fallback is serving",
+    },
   );
 
   // ── Drafter ──

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.35.4",
+  "version": "0.35.13",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",
@@ -33,7 +33,10 @@
     "schemas",
     "scripts",
     "docs",
+    "examples",
     "README.md",
+    "INSTALL.md",
+    "CHANGELOG.md",
     "LICENSE"
   ],
   "pi": {