No model fallback within a submission: retries always go back to the same model

Version: @flue/runtime 2.0.4 (source checked). Cloudflare target.

Summary

useModel(model, { thinkingLevel }) takes exactly one model id, and a transient provider failure is retried against that same model. There is no candidate list and no hook to pick a different model for the next attempt.

Impact

When one upstream model is degraded — not erroring cleanly, just slow or repeatedly failing — the submission burns its attempt budget on it and fails, even though an equivalent model would have answered. We implemented switching inside our own provider, which means our fallback logic lives below flue and is invisible to flue's own retry accounting and telemetry.

Proposal

Either accept an ordered candidate list in useModel, or expose a hook that runs before a re-attempt and may return a different model id. Attribution would need to follow (the response metadata should say which model actually answered).