# Model fallback

Recover from provider errors without losing your prompt.

When a turn fails because of a recoverable provider error — expired token (401), permission denied (403), rate limit (429), provider outage (502/503/504), or a transient network failure — zot opens an inline rescue picker over the chat instead of just painting a red banner.

The picker is the same UI as `/model`, but only shows models from providers you are currently logged in to. The failed model is excluded. Pick one and `enter` retries the same prompt on the new model; `esc` dismisses.

Before the picker fires, every provider client does up to two silent retries with short backoff on 502/503/504 and connection-reset errors, so most edge-proxy blips disappear without you seeing it.

A rescue retry intentionally drops launch-time `--api-key` and `--base-url` overrides before rebuilding the agent (those are usually the cause) and re-resolves credentials from env vars, `auth.json`, and provider defaults. Use `/model` when you want overrides to stick.

Bad-request, context-length, and serialization errors are not routed to the picker because switching models will not fix them.