Provider failover: remaining re-review P3s and test gaps (#68) #74

Follow-ups from the substitute re-review of #68 (automatic provider failover). Ledger key: r2/provider-fallback. None blocked the merge.

Behaviour

• P3-d: explicit picks move too. A message queued with an explicit pick of the failed instance before the failover still follows the thread to the fallback (queuedBeforeFailoverFrom in Orchestrator.ts). Queued runs don't record whether their model was an explicit pick, so this needs that recorded first.
• P3-e: queued slash commands switch back. A queued slash command for the failed instance is excluded from the move, so it switches the thread back to that instance and probably fails again.
• P3-f: misleading reservation id. A queued fresh-context run that moves to the fallback keeps its old pending: reservation id. It works; the id is just misleading.
• P3-g: repeated blocker at startup. The startup sweep (pending-failovers) can re-emit thread.blocker for an older stuck run, not only the latest.
• P3-h: share the "resendable" check. resendable in ProviderFailover.ts, the standing-message check in ContextHandoffService.ts and the queued-move exclusion each check message kinds on their own. They should share one predicate.

Test gaps

• The end-to-end incident test in ProviderSwitch.integration fails by timeout when no fallback is configured. It should assert that the claim is absent instead.
• A retry that is rejected and then succeeds: attempt 1's command is rejected and attempt 2 creates the run.
• Slash-command, queued-after-failover and standing-exclusion cases at the runtime-layer level. The standing check has a unit table now.
• A test that a skipped claim re-emits thread.blocker through McpEvents end to end.

Also open from the first review:

• A real Claude usage-limit rejection transcript, to confirm the frame whitelist.
• Hooks count as non-work.
• The in-use bypass trusts T3's own attempt records only.
• sourcePlanRef is not forwarded.
• A send during the pending window can start ahead of the failover.
• Rolling back to a build without feat(server): fail a run over to the fallback model when its account fails before any work #68 leaves a pending run.failover row unread.

🤖 Generated with Claude Code