fix(bin): select and verify the OpenCode model the installed build accepts

.agents/skills/harness-adapters/references/harness/opencode.md

@@ -13,8 +13,8 @@ On 2026-10-15 the dual-export primary plugins loaded once each and the turn-end
 | Interrupt | Double Escape; it is known to be flaky while a long shell command runs, so use `../../../bin/fm-control.sh <task-id> relaunch` for a wedged pane. |
 | Skill invocation | No separate verified form beyond normal slash-command behavior; use natural language when the exact command is uncertain. |
 | Resume | Relaunch with `--continue` to resume the most recent session for the current directory, then send the next instruction after the TUI is ready because `--prompt` does not auto-submit alongside `--continue`. |
-| Model flag | Version-sensitive, keyed to the detected major. OpenCode 2.0.21 has no interactive top-level `--model` (`opencode run --model` remains only on the non-interactive path), so Firstmate pins the interactive model through `OPENCODE_CONFIG_CONTENT` as global `model` plus `agent.build.model`. OpenCode 1.x still takes the interactive `--model` flag, so there Firstmate passes `--model` and does not write the 2.x global/build model pin. An undetected or unparseable version (opencode unresolvable, or `--version` without a parseable x.y.z) falls back to the 1.x shape, so only a parsed major >= 2 takes the 2.x pin. |
-| Effort flag | None for Firstmate's interactive `opencode --prompt` launch; `opencode run` has model variant syntax, but that is not this path. The effort instead rides the launch's `OPENCODE_CONFIG_CONTENT` JSON as the `build` agent's `variant` keyed to the resolved model. It is emitted only when the resolved model's provider is known to expose that effort as a variant (`anthropic/*`: high, max; `openai/*`: low, medium, high, xhigh); with no model resolved, another provider, or an effort outside its family's list, the variant is omitted. On 2.x the global/build model pin remains even when the variant is omitted; on 1.x, where the model arrives via `--model`, omitting the variant leaves the permission-only config. |
+| Model selection | When `--model` is requested, Firstmate resolves the installed `opencode` executable, probes its `--version` and top-level `--help`, and then uses the top-level `--model` flag when that build advertises one or writes `.opencode/opencode.jsonc` in the worker's worktree when it does not. An unreadable version or help surface refuses the launch with the build's own identity instead of running its default model. A project-owned config is never overwritten: one that already selects the requested model is kept as it is and is never recorded as Firstmate's, and one selecting anything else refuses. On the project-config path the write is verified through that build's own `opencode debug config` readback before launch; every model-pinned launch then asserts the model recorded on the worker's first assistant message after its own launch timestamp, and an absent, unreadable, or different observation refuses the spawn and closes the endpoint, retaining recovery records when that close cannot be confirmed. The pin file is git-excluded, recorded per task, and retired with the task, so a reused pool slot cannot inherit it. `provider/model#variant` is unsupported; use `provider/model` with `--effort`, and model-axis coverage plus its remaining live evidence are recorded in `docs/verification/runtime-backends.md`. |
+| Effort | Effort is supplied with Firstmate's `--effort` option, not inline in the model identifier. For known provider variants (`anthropic/*`: high, max; `openai/*`: low, medium, high, xhigh), Firstmate includes the variant beside the model in project-config selection or in the launch config for a flag-based build. For other providers or unsupported effort values it omits the variant rather than guessing. |
 | Model discovery | Run `opencode models` to list available provider/model identifiers; OpenCode 2.0.21 no longer accepts a provider positional argument. |
 | Trust dialog | None. |
 | Marker | None; OpenCode publishes no identity marker, so `../../../bin/fm-harness.sh` identifies it from process ancestry. |

.github/workflows/ci.yml

@@ -217,7 +217,7 @@ jobs:
       # Every shard reports so one failure never hides another shard's result.
       fail-fast: false
       matrix:
-        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10]
+        shard: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12]
     steps:
       - uses: actions/checkout@v6
         with:

bin/fm-control-lib.sh

@@ -503,7 +503,9 @@ fm_control_endpoint_absence_verdict() {  # <backend> <target> [meta]
 # table for Polytoken; both consumers preserve git-tracked Polytoken layers.
 # Prints zero or more absolute paths, one per line: worktree-resident
 # hook files and firstmate-owned state tokens only, never a harness's own
-# managed config.
+# managed config. An OpenCode model pin follows the same ownership rule: only
+# the pin this task's own record names is returned, so a project's own
+# .opencode/opencode.jsonc is never listed.
 fm_control_harness_wiring_paths() {  # <harness> <worktree> <state-dir> <id> [kind]
   local harness=${1-} wt=${2-} state=${3-} id=${4-} kind=${5-}
   [ -n "$wt" ] && [ -n "$state" ] && [ -n "$id" ] || return 1
@@ -520,7 +522,21 @@ fm_control_harness_wiring_paths() {  # <harness> <worktree> <state-dir> <id> [ki
         printf '%s\n' "$wt/.claude/settings.local.json"
       fi
       ;;
-    opencode) printf '%s\n' "$wt/.opencode/plugins/fm-busy-state.js" ;;
+    opencode)
+      printf '%s\n' "$wt/.opencode/plugins/fm-busy-state.js"
+      # A build without the top-level --model flag is pinned through the
+      # worktree's project configuration, and that file is retired only while
+      # this task's own record names it: a project's own
+      # .opencode/opencode.jsonc predates firstmate and is never its to remove.
+      # A stale pin must not outlive the task either, because a returned pool
+      # slot is reused and a later launch that names no model would silently
+      # inherit it.
+      if [ -f "$state/$id.opencode-model-config" ] &&
+        [ "$(cat "$state/$id.opencode-model-config" 2>/dev/null)" = "$wt/.opencode/opencode.jsonc" ]; then
+        printf '%s\n' "$wt/.opencode/opencode.jsonc"
+        printf '%s\n' "$state/$id.opencode-model-config"
+      fi
+      ;;
     pi|pi-signed) printf '%s\n' "$state/$id.pi-ext.ts" ;;
     omp) printf '%s\n' "$state/$id.omp-ext.ts" ;;
     grok)
@@ -623,3 +639,12 @@ fm_control_harness_turnend_auth_path() {  # <harness> <token>
     *) return 0 ;;
   esac
 }
+
+fm_control_retire_opencode_model_pin() {
+  local id=$1 state=$3 record="$3/$1.opencode-model-config" pin="$2/.opencode/opencode.jsonc" owned
+  [ -e "$record" ] || [ -L "$record" ] || return 0
+  owned=$(cat "$record") || return 1
+  [ "$owned" = "$pin" ] || return 1
+  rm -f -- "$pin" || return 1
+  rm -f -- "$state/$id.opencode-model-config"
+}