Live model switch check prevents model fallback from working

Summary

When the heartbeat is configured with a different model than the agent's primary (e.g. heartbeat on claude-haiku-4-5, primary on claude-opus-4-6), the live model switch mechanism intercepts every fallback candidate and forces it back to the primary model. This defeats model fallback entirely — if the primary is overloaded, no fallback candidate ever gets a real attempt.

Steps to reproduce

1. Configure primary model as anthropic/claude-opus-4-6
2. Configure heartbeat with a cheaper model:

   {
     "heartbeat": {
       "every": "30m",
       "model": "anthropic/claude-haiku-4-5",
       "lightContext": true,
       "isolatedSession": true
     }
   }

3. Configure fallbacks: ["openrouter/auto", "anthropic/claude-sonnet-4-6", "google/gemini-2.5-flash"]
4. Wait for the primary model to return overloaded_error

Expected behavior

The fallback chain should try each candidate in order (OpenRouter, Sonnet, Gemini Flash) when the primary is overloaded.

Actual behavior

Every fallback candidate is rejected by the live model switch check before it can make an API call:

[agent/embedded] live session model switch detected before attempt for 65ea85b7: openrouter/openrouter/auto -> anthropic/claude-opus-4-6
[model-fallback/decision] candidate_failed requested=anthropic/claude-haiku-4-5 candidate=openrouter/openrouter/auto reason=unknown
[agent/embedded] live session model switch detected before attempt for 65ea85b7: anthropic/claude-sonnet-4-6 -> anthropic/claude-opus-4-6
[model-fallback/decision] candidate_failed requested=anthropic/claude-haiku-4-5 candidate=anthropic/claude-sonnet-4-6 reason=unknown
[agent/embedded] live session model switch detected before attempt for 65ea85b7: google/gemini-2.5-flash -> anthropic/claude-opus-4-6
[model-fallback/decision] candidate_failed requested=anthropic/claude-haiku-4-5 candidate=google/gemini-2.5-flash reason=unknown

All candidates are switched to Opus, which is the model that's overloaded, so the entire chain fails.

Root cause

In src/agents/pi-embedded-runner/run.ts at line 452, before every attempt the runner calls resolvePersistedLiveSelection(). This reads the agent's configured default model via resolveDefaultModelForAgent() in src/agents/live-model-switch.ts:41-46. When there is no session-level modelOverride/providerOverride, it returns the agent's primary model (Opus).

When the fallback loop runs a non-primary candidate (e.g. Sonnet), the pre-attempt check compares the candidate (Sonnet) against the persisted live selection (Opus), sees they differ, and throws LiveSessionModelSwitchError. This happens for every fallback candidate except Opus itself.

The LiveSessionModelSwitchError is not recognized as a failover reason, so it gets logged as reason=unknown.

Suggested fix

The live model switch check should be skipped or aware of model fallback context. When the embedded runner is being invoked as part of the fallback loop with a non-primary candidate, the pre-attempt live selection comparison should not override the candidate selection. The fallback loop has already decided to try a different model — the live switch check shouldn't fight that decision.

Environment

• OpenClaw 2026.3.28 (f9b1079)
• Node 22 on Debian (Hetzner ARM64)
• Docker via Coolify