fix(agent): harden fallback models after pre-landing review

Executor: hydrate the primary before the secret registries settle and fork
again, re-forking per fallback provider, so file provenance stays in the
result registry; project the fall-through warn against the failed attempt's
error registry and reinstate it before a post-skip rethrow; prime a
streaming candidate's first chunk when another candidate follows, so a
tool-loop startup failure still falls back; never fall back on a
deep-research follow-up turn; strip the sim-auto identity preamble from a
named fallback's messages; treat a row key still in {{VAR}} form as no key;
stop starting candidates after an abort; record failed models on every exit,
clearing them when a retry succeeds, and only when the names project safely.

Helpers: row tuning applies only while its field is shown; the editor's row
transforms are pure functions; changing a row's model to another provider
drops the key reference; Bedrock honors NEXT_PUBLIC_BEDROCK_DEFAULT_CREDENTIALS.

Editor: legacy Combobox to match the block editor, a row's own model is never
disabled in its own picker, move controls only for two or more rows, the
shared dashed add-row button, Create Secret wording, non-reference keys never
rendered. Trace: one Failed model row per fallback. Export sanitizer uses the
strict whole-reference check.

Author: mzxchandra

apps/sim/app/workspace/[workspaceId]/logs/components/log-details/components/trace-view/trace-view.tsx

@@ -694,8 +694,8 @@ const TraceDetailPane = memo(function TraceDetailPane({ span }: { span: TraceSpa
   if (span.tries !== undefined) metaEntries.push({ label: 'Tries', value: String(span.tries) })
   if (span.provider) metaEntries.push({ label: 'Provider', value: span.provider })
   if (span.model) metaEntries.push({ label: 'Model', value: span.model })
-  if (span.modelFallbacks?.length) {
-    metaEntries.push({ label: 'Fell back from', value: span.modelFallbacks.join(', ') })
+  for (const failedModel of span.modelFallbacks ?? []) {
+    metaEntries.push({ label: 'Failed model', value: failedModel })
   }
   if (span.finishReason) metaEntries.push({ label: 'Finish reason', value: span.finishReason })
   const ttftFormatted = formatTtft(span.ttft)

apps/sim/app/workspace/[workspaceId]/w/[workflowId]/components/panel/components/editor/components/sub-block/components/model-fallback-list/model-fallback-list.test.tsx

@@ -35,7 +35,7 @@ vi.mock('@sim/emcn', () => ({
       {children}
     </button>
   ),
-  ChipCombobox: ({
+  Combobox: ({
     options,
     value,
     placeholder,
@@ -155,23 +155,35 @@ describe('ModelFallbackList', () => {
     expect(html).toContain('3rd choice')
     expect(html).not.toContain('Auto')
     expect(html).not.toContain('denied-model')
-    /** The primary is never offered; a model already chosen is offered but disabled. */
+    /** The primary is never offered. A model another row holds is disabled there, never in its own row. */
     expect(html).not.toContain('>claude-sonnet-5<')
-    expect(html).toContain('data-disabled="true">gpt-5<')
+    expect(html.match(/data-disabled="true">gpt-5</g)).toHaveLength(1)
+    expect(html.match(/>gpt-5</g)).toHaveLength(2)
+    expect(html).toContain('aria-label="Move up"')
+  })
+
+  it('renders no move controls for a single row and never shows a non-reference key', () => {
+    subBlockValues.fallbackModels = [
+      { id: 'r1', model: 'openrouter/x', apiKey: 'sk-raw-through-socket' },
+    ]
+    const html = render()
+    expect(html).not.toContain('aria-label="Move up"')
+    expect(html).not.toContain('sk-raw-through-socket')
+    expect(html).toContain('data-combobox="Select a secret" data-value=""')
   })
 
   it('asks for an environment variable only when the row model needs its own key', () => {
     subBlockValues.fallbackModels = [{ id: 'r1', model: 'gpt-5' }]
-    expect(render()).not.toContain('data-combobox="Select an environment variable"')
+    expect(render()).not.toContain('data-combobox="Select a secret"')
 
     subBlockValues.fallbackModels = [
       { id: 'r1', model: 'openrouter/x', apiKey: '{{OPENROUTER_API_KEY}}' },
     ]
     const html = render()
-    expect(html).toContain('data-combobox="Select an environment variable"')
+    expect(html).toContain('data-combobox="Select a secret"')
     expect(html).toContain('data-value="{{OPENROUTER_API_KEY}}"')
     expect(html).toContain('OPENROUTER_API_KEY')
-    expect(html).toContain('Create variable')
+    expect(html).toContain('Create Secret')
   })
 
   it('shows a tuning field only for the knobs the helper says need one', () => {