Best possible solution:

Land the narrow heartbeat-aware persistence fix after redacted real runtime proof is added and protected-label handling clears; keep heartbeat cost attribution and CLI binding policy questions separate.

Do we have a high-confidence way to reproduce the issue?

Yes. Source inspection shows current main receives heartbeat state but persists the heartbeat modelUsed/providerUsed into the fields that display resolution prefers, and the posted before artifact fails the focused regression with the heartbeat model displayed.

Is this the best way to solve the issue?

Yes for the code shape. Passing the existing heartbeat flag into the shared persistence boundary is the narrow maintainable fix because it preserves display identity only for heartbeat runs while leaving usage, cost, context, and normal model updates unchanged.

Acceptance criteria:

• CI=1 node scripts/run-vitest.mjs src/auto-reply/reply/session.test.ts src/auto-reply/reply/followup-runner.test.ts
• pnpm exec oxfmt --check --threads=1 src/auto-reply/reply/session-usage.ts src/auto-reply/reply/session-run-accounting.ts src/auto-reply/reply/agent-runner.ts src/auto-reply/reply/followup-runner.ts src/auto-reply/reply/session.test.ts src/auto-reply/reply/followup-runner.test.ts
• pnpm check:changed
• Redacted real heartbeat/control UI, chat.history, terminal live output, or runtime log proof showing the displayed session model stays on the non-heartbeat model after a heartbeat run.

What I checked:

• Current main persistence gap: persistSessionUsageUpdate on current main accepts runtime model/provider values but no heartbeat discriminator, then writes params.providerUsed and params.modelUsed into the session entry in the usage branch. (src/auto-reply/reply/session-usage.ts:71, 16e5d6692dcc)
• Model/context-only branch has the same gap: The no-usage model/context update branch also writes the just-used provider/model into modelProvider and model, so the branch would need the same heartbeat preservation rule. (src/auto-reply/reply/session-usage.ts:176, 16e5d6692dcc)
• Main reply runner knows heartbeat state: runReplyAgent derives isHeartbeat, but the current-main persistRunSessionUsage call passes modelUsed and providerUsed without that state. (src/auto-reply/reply/agent-runner.ts:1099, 16e5d6692dcc)
• Follow-up runner has the same omission: createFollowupRunner already passes heartbeat state to preflight compaction, but its usage persistence call currently omits opts?.isHeartbeat === true. (src/auto-reply/reply/followup-runner.ts:266, 16e5d6692dcc)
• Display resolver consumes persisted fields: resolveSessionModelRef returns persisted entry.modelProvider and entry.model before falling back to configured defaults, so polluted persistence changes displayed session identity. (src/gateway/session-utils.ts:1412, 16e5d6692dcc)
• Existing shipped partial fix confirms intended behavior: Current main already has a separate preserveRuntimeModel path for agent-command heartbeat runs, and the docs/changelog state that heartbeats should preserve the shared session runtime model; this PR addresses the remaining auto-reply usage persistence path. (src/agents/command/session-store.ts:61, 16e5d6692dcc)

Likely related people:

• @zhangguiping-xydt: Commit 2c272e2 added the heartbeat preserveRuntimeModel behavior for the agent-command session-store path, establishing the same intended preservation behavior this PR extends to auto-reply persistence. (role: adjacent partial-fix author; confidence: high; commits: 2c272e271a3d; files: src/agents/agent-command.ts, src/agents/command/session-store.ts, src/agents/command/session-store.test.ts)
• @clay-datacurve: Commit 7b61ca1 substantially touched the central session management/dashboard files involved here, including auto-reply usage, main/follow-up runners, and gateway display utilities. (role: session management feature contributor; confidence: medium; commits: 7b61ca1b0615; files: src/auto-reply/reply/session-usage.ts, src/auto-reply/reply/agent-runner.ts, src/auto-reply/reply/followup-runner.ts)
• @steipete: Current-main blame/log for the central session persistence and display files points through recent Peter Steinberger commits, including the current checkout snapshot around these files. (role: recent area contributor; confidence: medium; commits: b5ba210fd5c6, 16e5d6692dcc; files: src/auto-reply/reply/session-usage.ts, src/auto-reply/reply/agent-runner.ts, src/auto-reply/reply/followup-runner.ts)
• @MrMiaigi: Commit 47bb5dd changed the same persistSessionUsageUpdate area and tests for cost snapshot semantics, which are intentionally preserved by this PR. (role: adjacent persistence-path contributor; confidence: medium; commits: 47bb5ddece21; files: src/auto-reply/reply/session-usage.ts, src/auto-reply/reply/session.test.ts, src/agents/command/session-store.ts)

Remaining risk / open question:

• The posted after-fix proof is still focused test/log evidence only; no real heartbeat run, control UI, chat.history, terminal live output, or runtime log shows the fixed behavior after the patch.
• One GitHub Actions check run was still in progress at inspection time, although the relevant completed checks shown by the API were successful.

Codex review notes: model gpt-5.5, reasoning high; reviewed against 16e5d6692dcc.