--reuse-from is refused when an already-reused step's model is unavailable, so a dead credential blocks a resume it would never touch

[khaliqgant]

Summary

flows run --reuse-from <run-id> refuses the whole run when a step's declared model is unavailable — even when that step is going to be reused and will never execute. An exhausted or revoked credential therefore blocks a resume that would not have touched it.

What happened

A 67-step flow had 56 steps completed across earlier runs. The Codex credential then exhausted, and the one remaining Codex step died worker_error exit=1. Relaunching with --reuse-from to finish the last few steps was refused before anything ran:

REFUSED [model_unavailable] Step "codex-fix-1" declares model "gpt-5.5" for CLI "codex", but its
model-scoped "codex exec --ephemeral --sandbox read-only --skip-git-repo-check --model gpt-5.5
\"Reply with exactly RELAYFLOWS_MODEL_READY and nothing else.\"" probe exited non-zero; verify the
model name and this credential's access.

codex-fix-1, codex-review-1 and codex-fix-2 had already completed in the run being reused from. They were reuse-eligible by hash and would never have been dispatched. Preflight probed their models anyway and refused the run.

Why the obvious workaround does not work

Moving the affected agents to a different CLI rewrites the hash of every step they own, because step_spec_hash is computed over the NORMALIZED step and the kernel resolves a named agent into inline cli/model before hashing. The journal stores cli: "codex", model: "gpt-5.5" where the authored spec said agent: "codex-impl".

So the author's choices are:

• keep the dead CLI declared, and be refused at preflight; or
• switch CLI, and replay every step that CLI owned — here roughly an hour of completed review and fix work.

Neither preserves what reuse exists to preserve. Splitting the agents so only not-yet-run steps divert hits the same wall, because preflight still probes the pinned ones.

What to change

Skip capability probes for steps that --reuse-from has already satisfied. The reuse set is computed from the journal, so it is known before the probes run; probing a step whose result is already in hand has no diagnostic value and actively prevents recovery.

If probing everything is deliberate — for instance to fail fast on a spec that could not complete from scratch — then it should degrade rather than refuse: warn that the CLI is unusable, and refuse only if a step that actually needs dispatch declares it.

Acceptance

• --reuse-from completes a run whose remaining steps are all satisfiable, regardless of credentials required only by already-reused steps.
• A step that will genuinely be dispatched on an unusable CLI is still refused, with the current message.
• A test pins the reuse-with-dead-credential case.

Related

• --reuse-from silently reuses steps whose real output is on disk, resurrecting stale evidence; no way to declare external effects #523 — reuse silently carrying stale evidence. Same area, opposite failure: there reuse is too eager, here its preconditions are too strict.
• relayflowd run.get times out under CPU load and kills the run: a flow's own test suite can destroy 30 steps of journaled work #522 — the run-killing read timeout that made --reuse-from load-bearing for this campaign in the first place.

Environment

CLI 2.0.22, macOS arm64. Eligibility read from kernel/relayflowd-core/src/memoization.rs; probe text from packages/sdk/src/preflight.ts.