Offer explicit recovery choices during setup

.agents/skills/verify-open-pstack/features/setup.md

@@ -6,6 +6,7 @@ Setup discovers available access, recommends role assignments, and saves approve
 
 - `setup-selected`: check only providers selected for the final assignments.
 - `setup-persist`: confirm and read back the model sheet and parent integration.
+- `setup-recovery`: explicit fallback modes and independent same-route continuation choices on first setup and reruns.
 - `setup-failure`: preserve existing configuration on failed validation or writes.
 
 ## How to get to it (user POV)
@@ -20,6 +21,7 @@ Preconditions: Installation recipe passed in the parent being tested; dedicated
 - **Invoke:** enter `Use pstack:setup-pstack. Configure only inherit-parent roles, with two independent architect runners. Do not select external providers.` in the test parent. This selects the native-only scenario, not permission to rewrite a personal sheet.
 - **Drive:** answer access questions from known facts, review the proposed assignments, and confirm saving the disposable test configuration. Observe a real native marker probe, a worker, and a separate reviewer; capture native dispatch and terminal events, not just their summary text.
 - **Read back:** compare saved sheet and integration with the confirmed proposal. Require all documented role rows, two architect seats, and no external CLI probes for the native-only case. In Codex the instructions file is `AGENTS.md`; Claude uses `CLAUDE.md`. Record the actual paths chosen by setup.
+- **Recovery choices:** drive cases 16 and 17 in `tests/setup-selected-providers.md` in each parent. Capture the presented choices, current mode, accepted choice, confirmation, and independently read saved policy. Exercise broad, quota-only, disabled, and preserved custom fallback policies; independently opt in, keep, and disable continuation. Do not count synthetic policy events as real provider failure or continuation proof.
 - **Failure paths:** follow the named selected-provider failure and write-failure cases in `tests/setup-selected-providers.md`; retain before/after bytes and expect rollback. Record cases not exercised separately.
 
 ## Gotchas

.claude-plugin/marketplace.json

@@ -9,7 +9,7 @@
       "name": "pstack",
       "source": "./plugins/pstack",
       "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence.",
-      "version": "1.10.2",
+      "version": "1.10.3",
       "author": {
         "name": "Lauren Tan (original)"
       },

CHANGELOG.md

@@ -4,6 +4,12 @@ This file records what each version of the Open Pstack package changed. Versions
 
 Entries describe package versions. Published release checkpoints have tag links; installation follows `main` unless pinned. Validation belongs to the linked pull requests. Older reports remain available through immutable links.
 
+## 1.10.3 makes setup recovery choices explicit
+
+Cursor baseline: [0.15.5](https://github.com/cursor/plugins/tree/12d587dfb20741cafc376c42c696c5f6e2a64487/pstack). [Issue #108](https://github.com/arjitj2/open-pstack/issues/108). [PR #109](https://github.com/arjitj2/open-pstack/pull/109). Tag [v1.10.3](https://github.com/arjitj2/open-pstack/releases/tag/v1.10.3).
+
+Setup offers automatic backend recovery, usage exhaustion only, or no automatic fallback on first setup and reruns. Same-model continuation is a separate opt-in choice. Existing policies stay unchanged until accepted, and confirmation shows both recovery settings.
+
 ## 1.10.2 enables worker local checks
 
 Cursor baseline: [0.15.5](https://github.com/cursor/plugins/tree/12d587dfb20741cafc376c42c696c5f6e2a64487/pstack). [Issue #103](https://github.com/arjitj2/open-pstack/issues/103). [PR #104](https://github.com/arjitj2/open-pstack/pull/104). Tag [v1.10.2](https://github.com/arjitj2/open-pstack/releases/tag/v1.10.2).

UPSTREAM.md

@@ -12,7 +12,7 @@ This page records the current Cursor baseline and the maintainer procedure for r
 | Path | `pstack/` |
 | Commit | `12d587dfb20741cafc376c42c696c5f6e2a64487` |
 | Upstream version | `0.15.5` |
-| open-pstack version | `1.10.2` |
+| open-pstack version | `1.10.3` |
 
 The table records the packaged version on `main` and the Cursor content it incorporates, minus the exclusions below. Detecting or reviewing a newer Cursor commit does not advance this baseline. Cursor's version identifies the imported content. The open-pstack version identifies the cross-harness package, and its numbers are independent of Cursor and Eric's port.
 

plugins/pstack/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "pstack",
   "displayName": "pstack",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence. Ported from cursor/plugins/pstack for Claude Code and Codex.",
   "author": {
     "name": "Lauren Tan"

plugins/pstack/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "pstack",
-  "version": "1.10.2",
+  "version": "1.10.3",
   "description": "if you want to go fast, go deep first. pstack helps you write less, but higher quality code. rigorous agent workflows you can parallelize with confidence. Codex port of the Claude Code plugin; skills are shared, tool names resolve via skills/poteto-mode/references/codex-tools.md.",
   "author": {
     "name": "Lauren Tan"

plugins/pstack/skills/poteto-mode/references/provider-dispatch.md

@@ -264,7 +264,7 @@ The runner and native tool envelopes classify failures; the helper owns every ro
 # fallback: {"on":["usage-exhausted","route-unavailable","terminal-failure","deadline-exceeded"]}
 ```
 
-The `on` list is a closed union over exactly those four policy outcomes, with no duplicates and no unknown keys; a second `# fallback:` line anywhere in the sheet (preamble, between rows, or footer) is malformed and rejected. A sheet without the line keeps quota-only behavior — `{"on":["usage-exhausted"]}` — so existing sheets advance only on proven exhaustion. Declaring the line makes the sheet policy-enabled in the same sense as saved access facts and chains: required role rows must be present rather than defaulting, and every configured route needs an access fact. The policy declares which terminal outcomes *may* advance; it never adds an attempt, a provider, a model, an effort, or an `apiSpend` approval beyond what the saved chain already authorizes. Setup may recommend a broader policy on a new sheet and must show its effect in the candidate; it never edits an existing sheet's policy without explicit acceptance.
+The `on` list is a closed union over exactly those four policy outcomes, with no duplicates and no unknown keys; a second `# fallback:` line anywhere in the sheet (preamble, between rows, or footer) is malformed and rejected. An explicit `# fallback: {"on":[]}` disables automatic fallback while retaining any saved chains. Removing the line does not disable fallback. A sheet without the line keeps quota-only behavior — `{"on":["usage-exhausted"]}` — so existing sheets advance only on proven exhaustion. Declaring the line makes the sheet policy-enabled in the same sense as saved access facts and chains: required role rows must be present rather than defaulting, and every configured route needs an access fact. The policy declares which terminal outcomes *may* advance; it never adds an attempt, a provider, a model, an effort, or an `apiSpend` approval beyond what the saved chain already authorizes. Setup may recommend a broader policy on a new sheet and must show its effect in the candidate; it never edits an existing sheet's policy without explicit acceptance.
 
 The receipt boundary is deterministic: `bun scripts/model-policy/pstack-model-policy normalize --sheet <path> --role <role> --parent <p> --lane <n> --attempt <i> --receipt <path> --mode <read-only|isolated-write> [--contract <legacy|strict>]` reads the actual runner receipt, checks that its parent/provider/model/effort match the frozen sheet's attempt `i` on lane `n`, that its recorded access mode equals the requested `--mode`, its contract equals `--contract` (legacy by default), and its recorded `apiSpend` equals the attempt's saved access fact, checks internal consistency (a not-started receipt can only fail in preflight, a preflight failure cannot be started, postprocess requires a clean exit), and prints the policy `AttemptOutcome` (plus the receipt path as evidence) or exits nonzero. Agents never reimplement the mapping. The total mapping over receipt statuses: