[arjitj2]

Why

Allow a saved alternate model on the same provider to recover model capacity without retrying an exhausted account.

What changed

• Accept different-model fallback attempts on one provider. Keep duplicate-model rejection and the three-attempt limit.
• Skip all later models on an exhausted provider. Validate quota history and preserve exact native Codex model selection.
• Distinguish Codex capacity and Claude 529 overload diagnostics from usage exhaustion. Keep existing policy outcomes, quota-only defaults, funding, and API-spend rules.
• Update provider dispatch, setup guidance, and recovery verification recipes.

Verification

• bun run test: 1,044 passed, five platform skips, no failures. bun run typecheck passed.
• Static invariants, documentation checks, maintenance tests, manifest parsing, and claude plugin validate ./plugins/pstack passed.
• The exact candidate (head 1eaecfd) was installed in isolated Codex 0.166.0 and Claude Code 2.1.306 homes and matched the PR tree file-for-file.
• Live route-unavailable recovery passed from a real Codex parent and a real Claude parent (codex:nonexistent -> codex:gpt-6-sol@high ran natively). Quota and capacity receipts verified with labeled fixtures; genuine backend capacity could not be forced and remains unobserved.

The shipped policy CLI validates the three-attempt chain and selects the exact second native Codex model for synthetic capacity and unavailable-route events. Quota skips to Claude. A quota-only sheet stops on capacity. Synthetic executable fixtures verify both providers' receipt diagnostics and success precedence.

Statechart typecheck passed. Its full suite initially had 79 failures: 74 renderer cache errors and five process-cleanup failures. All 74 renderer tests passed with a writable cache. A cleanup failure also reproduces on untouched origin/main, where the killed child remains a zombie under PID 1. The full Statechart suite is not green in this environment.

Documentation impact

Updated provider-dispatch.md, setup-pstack/SKILL.md, and the routing verification recipe. Existing sheets and spending choices are preserved.

Draft blockers

• Installed Codex and Claude recovery evidence remains unavailable. CLI and fixture results do not replace it.
• The package remains at 1.17.8 pending exact-version approval. Proposed 1.18.0 is a minor increment for expanded fallback chains across the shared provider subsystem.

Release

Owner approved 1.18.0 (Nov 3, 2026). Version mirrors bumped to 1.18.0 with a CHANGELOG entry; tag v1.18.0 follows merge. The version bump commit changes only version metadata and the changelog.