Cycling the model selector discards a resumable Claude binding, and the recorded invalidation cause is replaced by registry_miss

[code-yeongyu]

Summary

Two independent defects make a Claude session re-send its entire conversation after the user simply cycles the model selector, and then misreport why.

1. Selecting a non-Claude model destroys a resumable binding. The model_select handler treats "the new model is not this provider" as a reason to invalidate, even though the module already has a non-destructive path for exactly this situation.
2. The recorded invalidation cause never reaches the user. The cause is written to the ledger and then dropped, so the next turn's warning reports the generic no-binding default instead of what actually happened.

Field reports: two users in September 2026 saw a full-conversation re-send on Claude models (hundreds of KB per turn, one measured 226 messages / ~881 KB) with the cause shown as registry_miss, one of them after nothing more than moving between models and back. Downstream report: oh-my-openagent#8308.

Evidence

packages/coding-agent/src/core/extensions/builtin/claude-sdk-oauth/session-registry-wiring.ts, model_select:

if (event.model?.provider !== CLAUDE_SDK_OAUTH_PROVIDER_ID) {
  closeSession(sessionId, "model_selected");
  await invalidateBinding(pi, ctx, "model_selected");   // destroys the sidecar
  return;
}
if (!(await switchSessionModel(sessionId, event.model.id))) {
  keepBindingThenClose(sessionId, "model_selected");     // keeps it
}

keepBindingThenClose (same file) closes the live SDK session but keeps the binding, and thinking_level_select already uses it. So the module has both behaviors and picks the destructive one for a provider excursion.

invalidateBinding (same file) does three things: forgetBinding(sessionId), deleteStoredBinding(sessionFile), and appends a ledger record { schemaVersion: 1, invalidated: true, reason }. Nothing reads that reason back. With no binding left, the next turn cannot reach decideFromBinding in session-continuity.ts, so the user-visible reason is the no-binding default registry_miss (session-continuity.ts, the drift ?? "registry_miss" returns and the !binding.lastAssistantUuid flatten).

Expected (ideal state)

1. A provider switch keeps the binding. Leaving this provider closes the live session and keeps the binding, the same as a thinking-level change. Returning later reattaches at the recorded prefix and sends only the messages added while away — which is precisely what the reattach path is built for: sentPrefixHash / commonPrefixLength reattach with from: binding.sentCount. The existing safety nets stay in charge: identityDrift still flattens on model_changed, and an unconfirmed SDK id is still refused.
2. A genuine invalidation reports its own cause. When a binding was invalidated with a recorded reason, the next turn's continuity diagnostic names that reason (for example model_selected, compaction, tree_changed) instead of registry_miss. registry_miss should mean what it says: no record was ever found.

Acceptance criteria:

• Selecting a non-Claude model and then returning to the same Claude model reattaches; the turn sends the delta, not the full history.
• A binding invalidated for a recorded reason produces a user-visible cause equal to that reason; registry_miss appears only when nothing was recorded.
• Model identity drift, an unconfirmed SDK session id, a missing transcript and a diverged sent stream all keep flattening as they do today.

Scope

In: the model_select branch, carrying the recorded invalidation reason into the next continuity decision, and regression tests for both.

Out: the eval-summary clamp cause (#1472, addressed by #1498), compaction-driven invalidation, and account/root drift behavior.

Related

• [Bug]: eval summary clamping triggers assistant_rewritten with claude-sdk-oauth #1472 and fix(claude-sdk-oauth): canonicalize eval summary continuity #1498 — a different cause of the same symptom (harness argument normalization classified as assistant_rewritten).
• Earlier work in this area: claude-sdk-oauth: thinking-block timing fields flip commit-boundary hash → assistant_rewritten nearly every turn → repeated history re-send #691, claude-sdk-oauth: the continuity binding is never persisted, so every restart re-sends the full history (registry_miss) #808, Session continuity flattens on every turn with reason=account_changed, re-sending the whole conversation #1432, [Bug]: completed request cleanup closes healthy claude-sdk-oauth resumed query #1563, and the resume-first continuity core.
• Downstream report with the ledger excerpt and byte counts: oh-my-openagent#8308.

[code-yeongyu]

Fixed by #1749, merged as fef17495627b4590fed028c7b7b1ab3a3064993a.

Defect 1 — the excursion. model_select called closeSession + invalidateBinding("model_selected") whenever the newly selected model belonged to another provider, destroying the binding and its sidecar. It now calls keepBindingThenClose, the behavior the same module already used for a thinking-level change and for an in-provider switchSessionModel failure: the live SDK query closes, the binding survives, and the return trip resolves to reattach at from: binding.sentCount so only the messages added while away are sent. Identity drift still flattens on the way back, and an unconfirmed SDK session id is still refused, so nothing was traded away for this.

Defect 2 — the lost cause. The ledger invalidation record had one writer and zero readers. invalidationReasonFromBranch now reads the newest binding record, the wiring remembers it as it appends and re-reads it from the branch on session_start, and the decision input carries it so a cold seed reports the recorded cause instead of registry_miss. registry_miss now means literally what it says: no record was ever found. No decision kind moved and no other reason changed.

The cheaper alternative was rejected on purpose: the existing in-process close-cause channel is consumed at emit time, so it cannot survive the restart the field reports actually hit, and it never reaches the decision. The ledger is the durable cross-process carrier.

Evidence. RED at the test-only commit 094e0b8: 3 failed / 1 passed, each failure behavioral (expected { kind: 'bootstrap' } to match object { kind: 'reattach' }, reason: 'registry_miss' vs 'model_selected'), not a missing import. GREEN at 02d34a5: 21 test files, 155 tests, all passing — the two new regression files plus every existing claude-sdk-oauth continuity and session-registry suite, none of which were edited. Static gates at the same commit: biome clean with --error-on-warnings, tsc --noEmit exit 0. Final CI on the merge head: 25 checks, zero failing, zero pending. Tests ran on a second machine in a temp directory that was removed and verified gone.

Vocabulary note. Ledger reasons that are not themselves observation vocabulary map onto the closest existing member (compaction → tainted_compaction, tree_changed → branch_diverged, fork → tainted_fork) rather than growing the reason type, and an unknown ledger string is sanitized so it can never reach an observation.

This is the second cause of the same user-visible symptom. The first is #1472 (the eval summary clamp classified as assistant_rewritten), addressed by #1498, which is still open pending one requested change.