From 33bfc5e1ebe8501ebea09ff0e22043814e534585 Mon Sep 17 00:00:00 2001
From: Edwin <edwin@zarvis.ai>
Date: Sun, 2 Aug 2026 13:05:08 -0700
Subject: [PATCH] Fall back to the harness probe when smith can't name a
 session
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Auto-naming picks its generator by asking whether smith is available at
all — a question OAuth-only and Ollama-only machines answer "yes" while
title generation on them can only fail. Those users burned their one
naming attempt on a doomed one-shot and kept hash names, even though the
same-harness probe fallback (spec 0151) was written for exactly them.

Ask the narrower question instead: can title generation resolve a model?
That means an explicit pin naming a provider it can build, or one of the
direct API keys on its own ladder — deliberately narrower than the
session-startability check, whose extra rungs spec 0071 records as
intentional.

Second, a generator that runs and produces nothing no longer ends the
attempt. The per-session latch is one-way and only a daemon restart
clears it, so a network blip or a revoked key stranded the session on its
hash name for the rest of the run. A failed one-shot now hands off to the
probe. Generators distinguish "nothing to do" from "produced nothing":
a session deleted or renamed by hand mid-flight counts as settled, so
the handoff can never overwrite a title the user chose.

The feature-status/doctor row for auto-naming moves to the same narrow
predicate. It reports on the generator auto-naming actually uses, and
reporting Ok off the wider check promised a generator that never runs.
---
 crates/daemon/src/availability.rs             | 128 +++++++-
 crates/daemon/src/doctor.rs                   |   1 +
 crates/daemon/src/session.rs                  | 283 +++++++++++++-----
 ...151-ambient-feature-status-and-fallback.md |  35 ++-
 4 files changed, 365 insertions(+), 82 deletions(-)

diff --git a/crates/daemon/src/availability.rs b/crates/daemon/src/availability.rs
index 8ac89f39..d3cc2a58 100644
--- a/crates/daemon/src/availability.rs
+++ b/crates/daemon/src/availability.rs
@@ -202,6 +202,51 @@ pub async fn probe_smith(cache: &std::sync::Mutex<AvailabilityCache>) -> Availab
     Availability::missing("no API key or OAuth credential found")
 }
 
+/// Model-spec prefixes the title-gen one-shot cannot build a provider for.
+/// OAuth subscriptions drive full smith sessions fine; `--title-mode` only
+/// knows the direct-API-key providers and bails loudly on these (spec
+/// 0071). Kept in sync with title-mode's own provider selection.
+const TITLE_GEN_UNSUPPORTED_PREFIXES: [&str; 4] =
+    ["claude-oauth", "codex-oauth", "grok-oauth", "kimi-oauth"];
+
+/// Whether the cheap `smith --title-mode` one-shot could actually resolve a
+/// model: an explicit `CONSTRUCT_SMITH_MODEL` pin naming a provider it can
+/// build, or one of the direct API keys on its ladder.
+///
+/// Deliberately narrower than [`probe_smith`], which answers "could a
+/// session start via *some* explicit choice" and therefore counts OAuth
+/// subscriptions and a reachable Ollama — the asymmetry spec 0071 records
+/// as intentional. Auto-title needs the narrower question: asking the wider
+/// one sends an OAuth-only machine into a one-shot that can only fail,
+/// instead of the same-harness probe fallback written for exactly that
+/// machine (spec 0151).
+pub fn smith_title_gen_available() -> bool {
+    title_gen_available_with(crate::daemon_env::var)
+}
+
+/// Pure core of [`smith_title_gen_available`], parameterized over the
+/// environment lookup so tests don't have to mutate process env.
+fn title_gen_available_with(lookup: impl Fn(&str) -> Option<String>) -> bool {
+    // A pin is an explicit user choice, so it wins over the key ladder the
+    // same way it does inside title-mode — but only when title-mode can
+    // actually honor it.
+    if let Some(pin) = lookup("CONSTRUCT_SMITH_MODEL") {
+        let prefix = pin.split(':').next().unwrap_or_default();
+        return !TITLE_GEN_UNSUPPORTED_PREFIXES.contains(&prefix);
+    }
+    [
+        "ANTHROPIC_API_KEY",
+        "OPENAI_API_KEY",
+        "GEMINI_API_KEY",
+        "GOOGLE_API_KEY",
+        "META_API_KEY",
+        "MODEL_API_KEY",
+        "DEEPSEEK_API_KEY",
+    ]
+    .iter()
+    .any(|k| lookup(k).is_some())
+}
+
 /// Existence-only mirror of `CredStore::locate` in
 /// `adapter-smith/src/provider/claude_oauth.rs`: explicit file override,
 /// then the default credentials file, then the macOS keychain item. No
@@ -503,6 +548,11 @@ pub async fn smith_auth_methods(
 pub struct FeatureInputs {
     /// smith's credential probe result ([`probe_smith`]).
     pub smith: Availability,
+    /// Whether the title-gen one-shot can resolve a model
+    /// ([`smith_title_gen_available`]). Narrower than `smith`: an
+    /// OAuth-only machine can run smith sessions but not `--title-mode`,
+    /// and the auto-title row must report what auto-title actually does.
+    pub title_gen: bool,
     /// `[suggest] enabled` from config.
     pub suggest_enabled: bool,
     /// The orchestrator's configured harness and that harness's
@@ -517,7 +567,11 @@ pub struct FeatureInputs {
 pub fn ambient_features(inputs: &FeatureInputs) -> Vec<construct_protocol::FeatureInfo> {
     use construct_protocol::{FeatureInfo, FeatureStatus};
     let smith_ok = inputs.smith.available;
-    let auto_title = if smith_ok {
+    // Auto-title keys off `title_gen`, not `smith_ok`: a machine with only
+    // an OAuth subscription runs smith sessions fine but cannot run the
+    // title one-shot, and reporting Ok there promises a generator that
+    // never runs.
+    let auto_title = if inputs.title_gen {
         FeatureInfo {
             id: "auto_title".to_string(),
             label: "Session auto-naming".to_string(),
@@ -529,9 +583,9 @@ pub fn ambient_features(inputs: &FeatureInputs) -> Vec<construct_protocol::Featu
             id: "auto_title".to_string(),
             label: "Session auto-naming".to_string(),
             status: FeatureStatus::Degraded,
-            detail: "no smith credential — sessions on model harnesses fall back to a \
-                     one-shot on their own harness; smith and shell sessions keep their \
-                     default (hash) names"
+            detail: "no title-capable smith credential — sessions on model harnesses fall \
+                     back to a one-shot on their own harness; smith and shell sessions keep \
+                     their default (hash) names"
                 .to_string(),
         }
     };
@@ -661,6 +715,7 @@ mod tests {
         use construct_protocol::FeatureStatus;
         let ok = ambient_features(&FeatureInputs {
             smith: Availability::ready("ready (Anthropic API key)"),
+            title_gen: true,
             suggest_enabled: true,
             orchestrator: Some((
                 "smith".to_string(),
@@ -671,6 +726,7 @@ mod tests {
 
         let missing = ambient_features(&FeatureInputs {
             smith: Availability::missing("no API key or OAuth credential found"),
+            title_gen: false,
             suggest_enabled: true,
             orchestrator: Some((
                 "smith".to_string(),
@@ -689,6 +745,7 @@ mod tests {
 
         let off = ambient_features(&FeatureInputs {
             smith: Availability::missing("no API key or OAuth credential found"),
+            title_gen: false,
             suggest_enabled: false,
             orchestrator: None,
         });
@@ -699,6 +756,7 @@ mod tests {
         // can't start at all — Off, not smith-style Degraded.
         let wrapper = ambient_features(&FeatureInputs {
             smith: Availability::missing("no API key or OAuth credential found"),
+            title_gen: false,
             suggest_enabled: true,
             orchestrator: Some((
                 "claude".to_string(),
@@ -708,6 +766,68 @@ mod tests {
         assert_eq!(wrapper[2].status, FeatureStatus::Off, "{wrapper:#?}");
     }
 
+    /// Title-gen's ladder is narrower than `probe_smith`'s. A machine whose
+    /// only credential is an OAuth subscription (or a Grok API key, or a
+    /// reachable Ollama) can start a smith session but cannot run
+    /// `--title-mode` (spec 0071) — counting those as title-capable spends
+    /// the session's single auto-title attempt on a process that can only
+    /// fail, instead of falling back to the same-harness probe.
+    #[test]
+    fn title_gen_availability_counts_only_what_title_mode_can_build() {
+        let lookup = |set: &'static [(&'static str, &'static str)]| {
+            move |name: &str| {
+                set.iter()
+                    .find(|(k, _)| *k == name)
+                    .map(|(_, v)| (*v).to_string())
+            }
+        };
+
+        assert!(!title_gen_available_with(lookup(&[])));
+        assert!(title_gen_available_with(lookup(&[(
+            "DEEPSEEK_API_KEY",
+            "sk-test"
+        )])));
+        assert!(title_gen_available_with(lookup(&[(
+            "GOOGLE_API_KEY",
+            "test"
+        )])));
+        // On `probe_smith`'s ladder but not title-mode's: reachable only
+        // through an explicit pin.
+        assert!(!title_gen_available_with(lookup(&[("GROK_API_KEY", "xai")])));
+        // A pin is an explicit choice and wins over the key ladder…
+        assert!(title_gen_available_with(lookup(&[(
+            "CONSTRUCT_SMITH_MODEL",
+            "openai:gpt-5-mini"
+        )])));
+        // …but not when it names a provider title-mode refuses to build.
+        assert!(!title_gen_available_with(lookup(&[(
+            "CONSTRUCT_SMITH_MODEL",
+            "codex-oauth:gpt-5.5"
+        )])));
+    }
+
+    /// An OAuth-only machine runs smith sessions fine — so suggestions and
+    /// the operator stay Ok — while auto-naming falls back to the
+    /// same-harness probe. Reporting it as Ok would promise a generator
+    /// that never runs.
+    #[test]
+    fn ambient_features_report_auto_title_on_its_own_generator() {
+        use construct_protocol::FeatureStatus;
+        let rows = ambient_features(&FeatureInputs {
+            smith: Availability::ready("ready (Codex subscription)"),
+            title_gen: false,
+            suggest_enabled: true,
+            orchestrator: Some((
+                "smith".to_string(),
+                Availability::ready("ready (Codex subscription)"),
+            )),
+        });
+        assert_eq!(rows[0].id, "auto_title");
+        assert_eq!(rows[0].status, FeatureStatus::Degraded, "{rows:#?}");
+        assert_eq!(rows[1].status, FeatureStatus::Ok, "{rows:#?}");
+        assert_eq!(rows[2].status, FeatureStatus::Ok, "{rows:#?}");
+    }
+
     #[test]
     fn probe_wrapper_cli_reports_missing_binary() {
         let unique = format!("construct-test-nonexistent-bin-{}", std::process::id());
diff --git a/crates/daemon/src/doctor.rs b/crates/daemon/src/doctor.rs
index ea297f84..d3dd352c 100644
--- a/crates/daemon/src/doctor.rs
+++ b/crates/daemon/src/doctor.rs
@@ -1054,6 +1054,7 @@ async fn features_section(
             };
             let features = availability::ambient_features(&FeatureInputs {
                 smith,
+                title_gen: availability::smith_title_gen_available(),
                 suggest_enabled: cfg.suggest.enabled,
                 orchestrator,
             });
diff --git a/crates/daemon/src/session.rs b/crates/daemon/src/session.rs
index 5fa44e00..3fcd36d9 100644
--- a/crates/daemon/src/session.rs
+++ b/crates/daemon/src/session.rs
@@ -2695,6 +2695,7 @@ impl SessionManager {
         construct_protocol::FeaturesStatusResult {
             features: crate::availability::ambient_features(&crate::availability::FeatureInputs {
                 smith,
+                title_gen: crate::availability::smith_title_gen_available(),
                 suggest_enabled: self.config.suggest.enabled,
                 orchestrator,
             }),
@@ -4597,13 +4598,16 @@ impl SessionManager {
     /// is the first *non-slash-command* message seen (leading
     /// `/model gpt-5.5`-style messages are ignored entirely).
     ///
-    /// Generator choice (spec 0151): a usable smith credential runs the
-    /// cheap `--title-mode` process one-shot; without one, sessions on
+    /// Generator choice (spec 0151): a *title-capable* smith credential runs
+    /// the cheap `--title-mode` process one-shot; without one, sessions on
     /// model harnesses fall back to a hidden probe session on their own
     /// harness — the same credentials/subscription the user's session
-    /// already proved work. smith and shell sessions have no fallback;
-    /// their skip is recorded via [`Self::note_ambient_degradation`] so
-    /// the gap is visible instead of silent.
+    /// already proved work. The probe is also where a one-shot that ran but
+    /// produced nothing lands, since the per-session attempt latch is spent
+    /// by then and would otherwise strand the session on its hash name until
+    /// a daemon restart. smith and shell sessions have no fallback; their
+    /// skip is recorded via [`Self::note_ambient_degradation`] so the gap is
+    /// visible instead of silent.
     async fn maybe_spawn_auto_title(&self, entry: Arc<SessionEntry>, prompt: String) {
         // Cheap checks first so we don't burn the per-session attempt
         // budget (the AtomicBool flip is one-way until a daemon
@@ -4617,80 +4621,101 @@ impl SessionManager {
         if entry.title_gen_attempted.load(Ordering::SeqCst) {
             return;
         }
-        let smith_available = crate::availability::probe_smith(&self.availability_cache)
-            .await
-            .available;
-        if smith_available {
-            let Some(smith_adapter) = self.config.adapters.get("smith").cloned() else {
-                return;
-            };
-            let binary_spec = smith_adapter
-                .binary
-                .clone()
-                .unwrap_or_else(|| "construct".to_string());
-            let prefix_args = smith_adapter.args.clone();
-            let Some(binary) = locate_binary(&binary_spec) else {
-                return;
-            };
-            // Now claim the attempt. `swap` is the one place we mark this
-            // session as "tried"; the user-renamed path is handled by
-            // `title_gen_attempted` being initialized to `title.is_some()`
-            // when the entry is constructed (both at create-time and when
-            // loaded from disk on daemon restart).
-            if entry.title_gen_attempted.swap(true, Ordering::SeqCst) {
-                return;
-            }
-            let replace_pending_title = entry.summary.read().await.auto_title_pending;
-            let storage = self.storage.clone();
-            let broadcast_tx = self.broadcast.clone();
-            tokio::spawn(async move {
-                generate_auto_title(
-                    binary,
-                    prefix_args,
-                    entry,
-                    prompt,
-                    replace_pending_title,
-                    storage,
-                    broadcast_tx,
-                )
-                .await;
-            });
-            return;
-        }
+        // Ask whether title-gen can resolve a model, not the broader
+        // `probe_smith` question of whether *a session* could start: the
+        // latter also counts OAuth subscriptions and Ollama, which
+        // `--title-mode` refuses (spec 0071). Using it here spent the latch
+        // on a one-shot that could only fail, so OAuth-only machines never
+        // reached the fallback below that exists for them.
+        let smith_cmd = if crate::availability::smith_title_gen_available() {
+            self.config.adapters.get("smith").and_then(|smith_adapter| {
+                let binary_spec = smith_adapter
+                    .binary
+                    .clone()
+                    .unwrap_or_else(|| "construct".to_string());
+                locate_binary(&binary_spec).map(|binary| (binary, smith_adapter.args.clone()))
+            })
+        } else {
+            None
+        };
         let (harness, kind) = {
             let s = entry.summary.read().await;
             (s.harness.clone(), s.kind)
         };
-        if harness == "smith" || harness == "shell" {
-            // No model to fall back to — smith sessions ARE the missing
-            // credential and shell has no model at all. Claim the attempt
-            // (same one-way semantics as the generating paths) and make
-            // the skip visible once instead of silently keeping the hash
-            // name (spec 0151).
-            if entry.title_gen_attempted.swap(true, Ordering::SeqCst) {
-                return;
-            }
-            self.note_ambient_degradation("auto_title").await;
-            return;
-        }
+        // No model to fall back to — smith sessions ARE the missing
+        // credential and shell has no model at all.
+        let harness_can_probe = harness != "smith" && harness != "shell";
         // Probe fallback only for user sessions: orchestrator/subagent/
         // probe sessions are normally titled by whatever created them, and
         // an automatic per-session harness spawn is too heavy to run for a
-        // whole fleet's worth of children.
-        if kind != construct_protocol::SessionKind::User {
-            return;
-        }
-        // Same-harness probe fallback. Needs the full manager to create /
-        // poll / delete the probe session; unbound self_ref (unit tests)
+        // whole fleet's worth of children. Needs the full manager to create
+        // / poll / delete the probe session; unbound self_ref (unit tests)
         // just skips — best-effort, like everything else on this path.
-        let Some(mgr) = self.self_ref.get().and_then(std::sync::Weak::upgrade) else {
+        let probe_eligible =
+            harness_can_probe && kind == construct_protocol::SessionKind::User;
+        let mgr = self.self_ref.get().and_then(std::sync::Weak::upgrade);
+
+        let Some((binary, prefix_args)) = smith_cmd else {
+            if !harness_can_probe {
+                // Claim the attempt (same one-way semantics as the
+                // generating paths) and make the skip visible once instead
+                // of silently keeping the hash name (spec 0151).
+                if entry.title_gen_attempted.swap(true, Ordering::SeqCst) {
+                    return;
+                }
+                self.note_ambient_degradation("auto_title").await;
+                return;
+            }
+            let Some(mgr) = mgr.filter(|_| probe_eligible) else {
+                return;
+            };
+            if entry.title_gen_attempted.swap(true, Ordering::SeqCst) {
+                return;
+            }
+            let replace_pending_title = entry.summary.read().await.auto_title_pending;
+            tokio::spawn(mgr.generate_auto_title_via_probe(entry, prompt, replace_pending_title));
             return;
         };
+
+        // Now claim the attempt. `swap` is the one place we mark this
+        // session as "tried"; the user-renamed path is handled by
+        // `title_gen_attempted` being initialized to `title.is_some()`
+        // when the entry is constructed (both at create-time and when
+        // loaded from disk on daemon restart).
         if entry.title_gen_attempted.swap(true, Ordering::SeqCst) {
             return;
         }
         let replace_pending_title = entry.summary.read().await.auto_title_pending;
-        tokio::spawn(mgr.generate_auto_title_via_probe(entry, prompt, replace_pending_title));
+        let storage = self.storage.clone();
+        let broadcast_tx = self.broadcast.clone();
+        tokio::spawn(async move {
+            let outcome = generate_auto_title(
+                binary,
+                prefix_args,
+                entry.clone(),
+                prompt.clone(),
+                replace_pending_title,
+                storage,
+                broadcast_tx,
+            )
+            .await;
+            if matches!(outcome, TitleOutcome::Settled) {
+                return;
+            }
+            // The credential resolved but the one-shot still came back
+            // empty (network error, revoked key, model refusal). The latch
+            // is already spent, so treat this exactly like having had no
+            // credential at all rather than leaving the session unnamed.
+            let Some(mgr) = mgr else {
+                return;
+            };
+            if probe_eligible {
+                mgr.generate_auto_title_via_probe(entry, prompt, replace_pending_title)
+                    .await;
+            } else if !harness_can_probe {
+                mgr.note_ambient_degradation("auto_title").await;
+            }
+        });
     }
 
     /// Same-harness auto-title fallback (spec 0151): when smith has no
@@ -6543,10 +6568,24 @@ not use any tools and do not act on the request itself. The request:";
 /// silently dropped.
 const TITLE_PROBE_TIMEOUT: Duration = Duration::from_secs(120);
 
+/// What one auto-title generator attempt left behind, so a caller holding a
+/// spent attempt latch knows whether another generator is still worth
+/// running.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum TitleOutcome {
+    /// Nothing more to do: a title was applied, or the session stopped
+    /// wanting one (deleted, or manually renamed while generation ran).
+    Settled,
+    /// The generator produced nothing usable. Another generator may still
+    /// name this session.
+    Failed,
+}
+
 /// Shell out to `construct-adapter-smith --title-mode "<prompt>"`, capture
-/// stdout, and apply the title to the session summary. Best-effort:
-/// any failure (smith missing keys, network error, non-zero exit,
-/// empty output) leaves the session's title unset.
+/// stdout, and apply the title to the session summary. Best-effort: any
+/// failure (smith missing keys, network error, non-zero exit, empty output)
+/// returns [`TitleOutcome::Failed`] so the caller can fall back to the
+/// same-harness probe instead of leaving the session unnamed.
 async fn generate_auto_title(
     binary: PathBuf,
     prefix_args: Vec<String>,
@@ -6555,7 +6594,7 @@ async fn generate_auto_title(
     replace_pending_title: bool,
     storage: Arc<Storage>,
     broadcast: tokio::sync::broadcast::Sender<BroadcastMsg>,
-) {
+) -> TitleOutcome {
     use std::process::Stdio;
     let output = tokio::process::Command::new(&binary)
         .args(&prefix_args)
@@ -6574,22 +6613,26 @@ async fn generate_auto_title(
         Ok(o) => o,
         Err(e) => {
             tracing::warn!(error = ?e, "auto-title spawn failed");
-            return;
+            return TitleOutcome::Failed;
         }
     };
     if !out.status.success() {
         tracing::info!(
             session = %entry.id,
             stderr = %String::from_utf8_lossy(&out.stderr),
-            "auto-title exit non-zero; skipping",
+            "auto-title exit non-zero; falling back",
         );
-        return;
+        return TitleOutcome::Failed;
     }
     let title = String::from_utf8_lossy(&out.stdout).trim().to_string();
     if title.is_empty() {
-        return;
+        return TitleOutcome::Failed;
     }
+    // Settled either way: `apply_auto_title` declining means the session no
+    // longer wants a generated title (deleted, or renamed mid-flight), which
+    // a second generator must not override either.
     apply_auto_title(&entry, title, replace_pending_title, &storage, &broadcast).await;
+    TitleOutcome::Settled
 }
 
 /// Apply a generated title to the session — if the eligibility that
@@ -7371,6 +7414,100 @@ mod tests {
         );
     }
 
+    /// A one-shot that ran but produced nothing has to be distinguishable
+    /// from one that named the session: the per-session attempt latch is
+    /// already spent by the time this returns, so the caller's decision to
+    /// fall back to the same-harness probe rests entirely on this outcome.
+    #[tokio::test]
+    async fn generate_auto_title_separates_failure_from_a_named_session() {
+        use tempfile::tempdir;
+
+        let tmp = tempdir().expect("tempdir");
+        let storage =
+            Arc::new(crate::storage::Storage::new(tmp.path().join("data")).expect("storage"));
+        let (tx, _rx) = tokio::sync::broadcast::channel(16);
+        let sh = which::which("sh").expect("sh on PATH");
+
+        // Non-zero exit — what a missing/rejected credential looks like.
+        let failed = synthetic_entry("t-fail", construct_protocol::SessionKind::User, 0);
+        let outcome = generate_auto_title(
+            sh.clone(),
+            vec!["-c".into(), "echo boom >&2; exit 1".into()],
+            failed.clone(),
+            "fix the login bug".into(),
+            false,
+            storage.clone(),
+            tx.clone(),
+        )
+        .await;
+        assert_eq!(outcome, TitleOutcome::Failed);
+        assert!(failed.summary.read().await.title.is_none());
+
+        // Empty stdout on a clean exit is just as unusable.
+        let empty = synthetic_entry("t-empty", construct_protocol::SessionKind::User, 1);
+        let outcome = generate_auto_title(
+            sh.clone(),
+            vec!["-c".into(), "printf ''".into()],
+            empty.clone(),
+            "fix the login bug".into(),
+            false,
+            storage.clone(),
+            tx.clone(),
+        )
+        .await;
+        assert_eq!(outcome, TitleOutcome::Failed);
+        assert!(empty.summary.read().await.title.is_none());
+
+        let ok = synthetic_entry("t-ok", construct_protocol::SessionKind::User, 2);
+        let outcome = generate_auto_title(
+            sh,
+            vec!["-c".into(), "echo 'Fix The Login Bug'".into()],
+            ok.clone(),
+            "fix the login bug".into(),
+            false,
+            storage,
+            tx,
+        )
+        .await;
+        assert_eq!(outcome, TitleOutcome::Settled);
+        assert_eq!(
+            ok.summary.read().await.title.as_deref(),
+            Some("Fix The Login Bug")
+        );
+    }
+
+    /// A rename that lands while the one-shot is in flight settles the
+    /// session: the caller must not read "no title applied" as licence to
+    /// spawn a probe that would overwrite the user's choice.
+    #[tokio::test]
+    async fn generate_auto_title_settles_when_the_user_renamed_mid_flight() {
+        use tempfile::tempdir;
+
+        let tmp = tempdir().expect("tempdir");
+        let storage =
+            Arc::new(crate::storage::Storage::new(tmp.path().join("data")).expect("storage"));
+        let (tx, _rx) = tokio::sync::broadcast::channel(16);
+        let sh = which::which("sh").expect("sh on PATH");
+
+        let entry = synthetic_entry("t-renamed", construct_protocol::SessionKind::User, 0);
+        entry.summary.write().await.title = Some("Chosen By Hand".to_string());
+        let outcome = generate_auto_title(
+            sh,
+            vec!["-c".into(), "echo 'Generated Title'".into()],
+            entry.clone(),
+            "fix the login bug".into(),
+            false,
+            storage,
+            tx,
+        )
+        .await;
+        assert_eq!(outcome, TitleOutcome::Settled);
+        assert_eq!(
+            entry.summary.read().await.title.as_deref(),
+            Some("Chosen By Hand")
+        );
+    }
+
     /// A probe session persisted at startup is a leftover from a daemon
     /// restart that interrupted generation mid-run; startup must reap it
     /// instead of resuming, while other kinds stay untouched.
diff --git a/specs/0151-ambient-feature-status-and-fallback.md b/specs/0151-ambient-feature-status-and-fallback.md
index fa982ad5..3c352015 100644
--- a/specs/0151-ambient-feature-status-and-fallback.md
+++ b/specs/0151-ambient-feature-status-and-fallback.md
@@ -19,11 +19,20 @@ sessions, the operator session) — follow three rules:
    output) render these rows verbatim rather than re-deriving the
    dependency themselves.
 
-2. **Auto-naming falls back to the session's own harness.** When smith has
-   no credential, a session on a model-backed harness gets its title from a
-   hidden one-shot probe session on that same harness — the credential the
-   user's session already proved works. smith and shell sessions have no
-   fallback and keep their default names.
+2. **Auto-naming falls back to the session's own harness.** When the smith
+   title generator cannot name a session, a session on a model-backed
+   harness gets its title from a hidden one-shot probe session on that same
+   harness — the credential the user's session already proved works. smith
+   and shell sessions have no fallback and keep their default names.
+
+   "Cannot name a session" is decided by what the *title generator* can
+   resolve, not by whether a smith session could start: those are different
+   questions on a machine whose only credential is one the title generator
+   doesn't accept (spec 0071). It also covers a generator that ran and came
+   back empty — a credential that exists but fails is indistinguishable, to
+   the user, from one that was never there. Since a session gets one
+   auto-naming attempt per daemon run, a generator that fails must hand off
+   to the remaining one rather than spend the attempt.
 
 3. **A degradation that actually bites is announced once.** The first time
    an ambient feature skips work for lack of a smith credential in a daemon
@@ -53,6 +62,14 @@ logged-in claude CLI.
 - Title generation now has two generators (smith one-shot, same-harness
   probe) that must stay behaviorally aligned: same sanitization, same
   eligibility rules for applying the result.
+- Each generator owes its caller the difference between "this session is
+  named, or has stopped wanting a name" and "I produced nothing". Only the
+  second hands off. A session deleted or manually renamed mid-generation
+  falls in the first group — the handoff must never overwrite a title the
+  user chose.
+- The feature-status row for auto-naming reports on the generator
+  auto-naming would actually use. It cannot be derived from general smith
+  availability without promising a generator that never runs.
 - The fallback spawns a short-lived hidden session on the user's harness;
   that cost is accepted in exchange for titles working without smith.
 
@@ -71,6 +88,14 @@ logged-in claude CLI.
   still get auto-titles (via a hidden claude probe), the features surface
   shows auto-naming as degraded with the reason, and no notice appears
   unless a smith/shell feature actually skips.
+- A user's only credential is an OAuth subscription, pinned as smith's
+  model. smith sessions run fine, but the title generator cannot use that
+  credential, so auto-naming goes straight to the same-harness probe rather
+  than spending the session's one attempt on a generator that must fail.
+- A user has an API key that has since been revoked: the title generator
+  starts, errors, and hands the session to the same-harness probe, which
+  names it. The session does not sit on its hash name until the daemon
+  restarts.
 - A user opens the suggestion orb in a shell session on a credential-less
   machine: generation is skipped, the daemon latches and broadcasts the
   degradation, and the client shows a clickable notice that opens the