[santoshkumarradha]

Automatic memory capture could stop when both its configured helper and its configured fallback were unavailable. It now recovers through distinct helper → small-work → current-chat models within the existing 45-second budget. Invalid model IDs are skipped for that chat, successful substitution is disclosed once, and saved model preferences stay unchanged. External helper-setting edits take effect on the next call without restarting the engine.

An updated window can still be served by an older background engine. The startup notice now explains that reopening one window is insufficient, gives a safe close-all-workspace-windows path, and supplies a correctly quoted targeted restart command with an interruption warning. /status shows separate window and engine builds and refreshes after reconnection.

Validation: make build, make pr-ready, and actual terminal workflows using only mock memories. Every real model role used OpenRouter deepseek/deepseek-v4.1-flash; unavailable-model faults were injected locally, not sent to a substitute provider/model.

Actual terminal scenario	Verified result
Primary 404 + fallback invalid-model 400	Automatic save, fresh-chat recall, correction, and a real JSON file using the corrected convention; 26 real model requests, 31.46 seconds
External settings edit during the same chat	New helper setting attempted; automatic capture recovered with the same engine process
Two stalled memory calls	Background recovery, fresh-chat recall, correction, and actual file application; 24 real requests, 76.03 seconds
Older engine + newer window	Older engine retained while attached; clear guidance; explicit restart reconnected to the new build; original mock file preserved, 23.52 seconds

Observed /status output before restart:

window build  3bcb07f6c built 2026-10-22 20:18
engine build  ed7fe43d5 built 2026-10-20 20:00

After reconnection:

window build  3bcb07f6c built 2026-10-22 20:18
engine build  3bcb07f6c built 2026-10-22 20:18

Memory and upgrade acceptance ran on clean runtime revision 3bcb07f6c; timeout acceptance ran on de4fd64b9 with the same memory implementation. Tests assert stored origin and actual file contents rather than trusting the model's claims. Test engines and terminal sessions were cleaned up.

Recovery remains bounded; it does not bypass authentication, billing, quota, or policy refusals. Pending background retries remain limited to the open chat's lifetime.