pi-goal-list-loop-audit 0.38.0 → 0.38.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 0.38.1 — drafter/auditor fallback parity with Main (2026-09-02)
+
+### Fixed
+  Drafter model selection now emits the same `model_fallback_select` ledger as Main (`scope: drafter`) for every forbidden/unregistered skip, so `forbiddenModels` edits mid-interview are honored even when the user edits settings while the interview is open.
+
+  Drafter recovery after a provider failure now walks the dedicated 0-10 chain via `ModelSelector` with the bounded ladder (`5s → base*2^(n-1) cap 5h`, base `mainModelRetryMinutes` default 15) and `forbiddenModels` re-check, instead of an immediate unbounded loop over the lease candidates. Same-model pin (drafter pinned to the session model) remains a same-model retry and is preserved.
+
+  Auditor `model_fallback_select` ledger (`scope: auditor`) now fires for both the settings-time `resolveAuditorModel` walk and the detached audit fallback (`runAuditorFallbackWithPolicy` via `runDetachedCompletionWithFallback`), closing the gap where detached retries skipped forbidden/unregistered refs silently. `forbiddenRefs` and `retryBaseMinutes` were already wired; `onSelection` is now forwarded.
+
+### Changed
+  `Drafter fallback agents` menu row → `Drafter fallback models (up to 10)` with count prefix `N/10 · 1. ref → 2. ref` and the shared `ordered and deselectable: current drafter → fallback 1 → fallback 2…` description, matching Main and Auditor rows. Prompt title and notification strings updated to `models` vocabulary. Watchdog budgets (`auditorToolTimeoutMs 5m`, `auditorStallMs 10m` x2 cap 4x) remain independent of the ladder and unchanged.
+
 ## 0.38.0 — event-driven supervision and drafting discipline (2026-09-02)
 
 ### Fixed

package/docs/INDEX.md

@@ -18,7 +18,7 @@ For shipped docs, the relevant entry points are:
   failback; v0.35.9 hardened cross-version npm tarball checks; v0.35.10
   handles multi-entry npm dry-run reports; v0.35.11 accepts both npm report
   shapes; v0.35.12 supports npm 12's keyed pack reports; v0.35.13 fixes stale-API recovery loops.
-  v0.35.14–v0.38.0 continue through the supervisor freeze (`/glla pause`),
+  v0.35.14–v0.38.1 continue through the supervisor freeze (`/glla pause`),
   load hold, auditor picker parity, Windows launch fix, zombie-watchdog
   subagent carve-out, due-wait backstop, the `/glla agents` visibility panel,
   durable state-root selection, blank-until-resume auditor context, frozen

package/extensions/drafter-model.ts

@@ -7,7 +7,7 @@
 
 import type { ExtensionContext } from "@earendil-works/pi-coding-agent";
 
-import { isForbiddenModel } from "./goal-loop-core.js";
+import { appendLedger, isForbiddenModel } from "./goal-loop-core.js";
 import { MAX_MAIN_MODEL_FALLBACKS, modelRef, normalizeMainModelFallbackRefs } from "./main-model-recovery.js";
 import { ModelSelector } from "./model-selector.js";
 import type { Settings } from "./goal-settings.js";
@@ -63,15 +63,22 @@ export function resolveDrafterModel(ctx: ExtensionContext, settings: Pick<Settin
     getChain: () => configuredRefs,
     resolve: (ref) => resolveDrafterModelRef(ctx, ref),
     isForbidden: forbidden,
+    record: (event) => {
+      appendLedger(ctx.cwd, "model_fallback_select", {
+        scope: event.scope.kind,
+        fromRef: event.fromRef,
+        toRef: event.toRef,
+        reason: event.reason,
+      });
+    },
   });
   const attempted: string[] = [];
   const candidates: DrafterModelCandidate[] = [];
 
-  // ModelSelector deliberately skips the current model so the main recovery
-  // walker never selects the model that just failed. Drafting is different:
-  // its configured primary may intentionally be the current session model,
-  // and that primary still needs a lease so its later fallbacks remain
-  // available if the first drafting turn fails.
+  // KEEP: drafting intentionally leases the current model when pinned (unlike
+  // Main which skips `current` via nextUntriedModelRef because it just failed).
+  // Align ledger to Main but keep this lease gate — removing it would force a
+  // needless setModel when the user pinned the drafter to the session model.
   const configuredPrimary = configuredRefs[0];
   if (
     configuredPrimary &&

package/extensions/loops/goal-activation.ts

@@ -2023,8 +2023,8 @@ export function registerGoalRuntime(pi: ExtensionAPI): void {
     // an interview must retry that chain before the main-goal recovery path;
     // otherwise a drafting failure would silently consume main-model backups.
     if (lastA?.stopReason === "error" && draftingTarget !== null) {
-      const retryDrafting = (globalThis as any).handleDrafterModelFailure as ((context: ExtensionContext) => Promise<boolean>) | undefined;
-      if (retryDrafting) await retryDrafting(ctx);
+      const retryDrafting = (globalThis as any).handleDrafterModelFailure as ((context: ExtensionContext, error?: string) => Promise<boolean>) | undefined;
+      if (retryDrafting) await retryDrafting(ctx, (rawLastA as any)?.errorMessage ?? (rawLastA as any)?.error ?? lastA.text);
       // Whether a configured fallback was available or not, drafting owns
       // this error. Leave the interview open for an explicit user retry and
       // never pass the same failure into main-goal recovery.

package/extensions/loops/goal-auditor-hooks.ts

@@ -904,6 +904,7 @@ export async function runDetachedCompletionWithFallback(
     onFallback?: (from: AuditorModelCandidate, to: AuditorModelCandidate, error: string) => void;
     forbiddenRefs?: readonly string[];
     retryBaseMinutes?: number;
+    onSelection?: (event: { scope: { kind: string }; fromRef?: string; toRef?: string; reason: string }) => void;
   } = {},
 ): Promise<{ result: DetachedAuditResult; retriedOnce: boolean; fallbackUsed: boolean; via: string }> {
   return runAuditorFallbackWithPolicy(candidates, run, {
@@ -911,6 +912,7 @@ export async function runDetachedCompletionWithFallback(
     shouldRetry: opts.shouldRetry,
     sleep: opts.sleep,
     retryBaseMinutes: opts.retryBaseMinutes,
+    onSelection: opts.onSelection,
     resumeCandidateRef: opts.resumeCandidateRef,
     attemptedRefs: opts.attemptedRefs,
     retryCandidateRef: opts.retryCandidateRef,
@@ -1101,6 +1103,7 @@ async function retryStoredCompletionAudit(origin: CompletionAuditOrigin = "provi
         shouldRetry: () => detachedAuditContext(generation, goalId, claim.attemptId!) !== null,
         forbiddenRefs: settings.forbiddenModels,
         retryBaseMinutes: settings.mainModelRetryMinutes,
+        onSelection: (event: { scope: { kind: string }; fromRef?: string; toRef?: string; reason: string }) => appendLedger(liveCtx.cwd, "model_fallback_select", { scope: "auditor", fromRef: event.fromRef, toRef: event.toRef, reason: event.reason }),
         resumeCandidateRef: persistedAuditorCandidateRef,
         attemptedRefs: persistedAuditorAttemptedRefs,
         retryCandidateRef: persistedAuditorRetryCandidateRef,

package/extensions/loops/goal-list-queue.ts

@@ -371,6 +371,7 @@ import {
   resolveDrafterModel,
   type DrafterModelCandidate,
 } from "../drafter-model.js";
+import { ModelSelector } from "../model-selector.js";
 import {
   assessSuspiciousObjective,
   deriveObjectiveFromContract,
@@ -553,25 +554,57 @@ async function restoreDrafterModel(): Promise<void> {
 }
 
 /**
- * Generic drafting recovery: walk the dedicated chain after any provider
- * error and replay a continuation of the existing interview. No error text
- * is classified and the main-model recovery chain is never consulted.
+ * Generic drafting recovery: walk the dedicated chain via ModelSelector so
+ * forbidden/unregistered refs are skipped with the same ledger as Main,
+ * and provider retries use the bounded ladder (5s → base*2^(n-1) cap 5h).
+ * The session model remains the last resort; same-model lease is preserved.
  */
-async function handleDrafterModelFailure(ctx: ExtensionContext): Promise<boolean> {
+async function handleDrafterModelFailure(ctx: ExtensionContext, error?: string): Promise<boolean> {
   const lease = draftingModelLease;
   if (!lease || draftingTarget === null || lease.generation !== sessionGeneration || !extensionApi) return false;
-  for (const candidate of lease.candidates) {
-    if (lease.attempted.some((ref) => ref.toLowerCase() === candidate.ref.toLowerCase())) continue;
-    lease.attempted.push(candidate.ref);
+  const settings = loadSettings(ctx.cwd);
+  const failure = classifyMainModelFailure(error);
+  if (failure.kind === "non-recoverable") return false;
+  const configuredRefs = lease.candidates.filter((candidate) => candidate.via === "configured").map((candidate) => candidate.ref);
+  const selector = new ModelSelector({
+    getChain: () => configuredRefs,
+    resolve: (ref) => lease.candidates.find((candidate) => candidate.ref.toLowerCase() === ref.toLowerCase())?.model,
+    isForbidden: (ref) => isForbiddenModel(ref, settings.forbiddenModels),
+    record: (event) =>
+      appendLedger(ctx.cwd, "model_fallback_select", {
+        scope: "drafter",
+        fromRef: event.fromRef,
+        toRef: event.toRef,
+        reason: event.reason,
+      }),
+  });
+  let attempt = lease.attempted.length;
+  for (;;) {
+    const pick = selector.selectNextValid({ kind: "drafter" }, lease.activeRef, lease.attempted);
+    for (const visited of selector.lastVisitedRefs) {
+      if (!lease.attempted.some((ref) => ref.toLowerCase() === visited.toLowerCase())) lease.attempted.push(visited);
+    }
+    if (!("model" in pick)) break;
+    const delayMs = mainModelFailureDelayMs(failure, ++attempt, (settings as any).mainModelRetryMinutes ?? 15);
+    if (delayMs > 5_000) await new Promise<void>((resolve) => setTimeout(resolve, delayMs));
     let switched = false;
-    try { switched = await extensionApi.setModel(candidate.model); } catch { switched = false; }
-    const alreadyActive = candidate.ref.toLowerCase() === lease.activeRef.toLowerCase();
+    try {
+      switched = await extensionApi.setModel(pick.model);
+    } catch {
+      switched = false;
+    }
+    const alreadyActive = pick.ref.toLowerCase() === lease.activeRef.toLowerCase();
     if (!switched && !alreadyActive) continue;
     const previous = lease.activeRef;
-    lease.activeRef = candidate.ref;
+    lease.activeRef = pick.ref;
     lease.activeThinkingLevel = applyDrafterThinkingLevel(ctx, lease.requestedThinkingLevel);
-    appendLedger(ctx.cwd, alreadyActive ? "drafter_model_retry" : "drafter_model_fallback", { from: previous, to: candidate.ref, attempted: lease.attempted });
-    ctx.ui.notify(`Drafting provider failed; retrying the existing interview on ${candidate.ref}.`, "warning");
+    appendLedger(ctx.cwd, alreadyActive ? "drafter_model_retry" : "drafter_model_fallback", {
+      from: previous,
+      to: pick.ref,
+      attempted: lease.attempted.slice(),
+      delayMs,
+    });
+    ctx.ui.notify(`Drafting provider failed; retrying the existing interview on ${pick.ref} after ${Math.round(delayMs / 1000)}s.`, "warning");
     const safeSteer = (globalThis as any).safeSteerUser as ((context: ExtensionContext, text: string) => boolean) | undefined;
     if (!safeSteer || !safeSteer(ctx, DRAFTER_RECOVERY_PROMPT)) return false;
     draftingSeedInFlight = true;

package/extensions/loops/goal-settings-ui.ts

@@ -554,9 +554,13 @@ export function resolveAuditorModel(
     resolve: (candidate) => tryRef(candidate).model,
     isForbidden: forbidden,
     record: (event) => {
+      appendLedger(ctx.cwd, "model_fallback_select", {
+        scope: "auditor",
+        fromRef: event.fromRef,
+        toRef: event.toRef,
+        reason: event.reason,
+      });
       if (event.reason === "forbidden" && event.toRef) {
-        // Forbidden is an explicit user gate, not an unavailable-model
-        // warning. Keep the forensic ledger entry but do not nudge the UI.
         appendLedger(ctx.cwd, "auditor_model_fallback", { configured: event.toRef, reason: "forbidden" });
         return;
       }
@@ -1222,13 +1226,13 @@ export async function handleSettingChoice(id: string, ctx: ExtensionContext): Pr
       const current = normalizeMainModelFallbackRefs(global.drafterModelFallbacks);
       const refs = await promptModelRefs(
         ctx,
-        `Drafter fallback agents — ordered, up to ${MAX_MAIN_MODEL_FALLBACKS}; the session agent is the last resort; forbidden models are hidden`,
+        `Drafter fallback models (up to ${MAX_MAIN_MODEL_FALLBACKS}) — ordered; the session model is the last resort; forbidden models are hidden`,
         current,
         { excludeRefs: normalizeModelRefs(loadSettings(ctx.cwd).forbiddenModels), maxSelections: MAX_MAIN_MODEL_FALLBACKS, currentRef: modelRef(ctx.model) },
       );
       if (refs === undefined) return;
       saveSettings("global", ctx.cwd, { drafterModelFallbacks: refs.length ? refs : undefined });
-      ctx.ui.notify(refs.length ? `Drafter fallback agents saved: ${refs.join(" → ")}.` : "Drafter fallback agents cleared — the session model remains the last resort.", "info");
+      ctx.ui.notify(refs.length ? `Drafter fallback models saved: ${refs.join(" → ")}.` : "Drafter fallback models cleared — the session model remains the last resort.", "info");
       return;
     }
     case "forbiddenModels": {

package/extensions/loops/goal-tools.ts

@@ -889,6 +889,7 @@ function registerAgentTools(pi: any): void {
             shouldRetry: () => detachedAuditContext(auditGeneration, auditGoalId, auditAttemptId) !== null,
             forbiddenRefs: settings.forbiddenModels,
             retryBaseMinutes: settings.mainModelRetryMinutes,
+            onSelection: (event: { scope: { kind: string }; fromRef?: string; toRef?: string; reason: string }) => appendLedger(ctx.cwd, "model_fallback_select", { scope: "auditor", fromRef: event.fromRef, toRef: event.toRef, reason: event.reason }),
             resumeCandidateRef: persistedAuditorCandidateRef,
             attemptedRefs: persistedAuditorAttemptedRefs,
             retryCandidateRef: persistedAuditorRetryCandidateRef,

package/extensions/settings-menu.ts

@@ -322,12 +322,12 @@ export function buildSettingsRows(
     {
       id: "drafterModelFallbacks",
       section: "drafter",
-      label: "Drafter fallback agents",
+      label: `Drafter fallback models (up to ${MAX_MAIN_MODEL_FALLBACKS})`,
       valueText: settings.drafterModelFallbacks?.length
-        ? modelChainText(settings.drafterModelFallbacks, drafterThinking, subagent)
-        : "none (session last resort)",
+        ? `${settings.drafterModelFallbacks.length}/${MAX_MAIN_MODEL_FALLBACKS} · ${settings.drafterModelFallbacks.map((ref, index) => `${index + 1}. ${modelThinkingText(ref, drafterThinking, subagent)}`).join(" → ")}`
+        : `0/${MAX_MAIN_MODEL_FALLBACKS} · ${sessionRef} · ${drafterThinking} (last resort)`,
       sourceText: src("drafterModelFallbacks"),
-      description: "ordered drafting-only fallback agents; each shows its effective/requested thinking level when the model registry exposes capabilities",
+      description: "ordered and deselectable: current drafter → fallback 1 → fallback 2…; every recoverable provider failure switches one eligible fallback at a time",
     },
   );
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pi-goal-list-loop-audit",
-  "version": "0.38.0",
+  "version": "0.38.1",
   "description": "Mission control for autonomous pi: interview-drafted goals, an audited task queue, and forever-loops (metric, spec, project-audit) that run for hours. A detached extension-less auditor process re-verifies every completion with raw evidence without holding the main pi turn; confirmed drafts, decision pauses and consent gates keep you in charge.",
   "license": "AGPL-3.0-only",
   "author": "dracon",