fix: harden partial 429 success, fallbacks, zh errors

Retry HTTP 429 with backoff; keep models beyond first 3 as
fallbacks; degrade agreement when some models fail; force-high
risk only if zero usable responses. Clearer zh-CN errors/docs for
dogfood uses: ./ rebase + workflow_dispatch re-run.

scripts/review.sh

@@ -151,7 +151,7 @@ json.dump({"system": system, "user": json.dumps(user, indent=2), "language": lan
 print(f"Prompt ready; floor={floor}; language={language}; plan={len(plan.get('models',[]))} models", flush=True)
 PY
 
-# Fire models in parallel (may be mixed providers)
+# Fire primary models in parallel (may be mixed providers)
 pids=()
 i=0
 while IFS= read -r line; do
@@ -173,6 +173,52 @@ for pid in "${pids[@]}"; do
 done
 echo "Parallel model calls finished (wait_ec=$ec)" >&2
 
+# On partial failure, try fallback_models from providers.yaml (beyond the first 3)
+python3 - "$MODELS_DIR" "$PLAN" <<'PY' >"$OUT/fallback-needed.txt"
+import json, pathlib, sys
+models_dir = pathlib.Path(sys.argv[1])
+plan = json.load(open(sys.argv[2]))
+failed = ok = 0
+for p in models_dir.glob("model-*.json"):
+    try:
+        j = json.loads(p.read_text())
+    except Exception:
+        failed += 1
+        continue
+    if j.get("error") or j.get("parse_error"):
+        failed += 1
+    else:
+        ok += 1
+fallbacks = plan.get("fallback_models") or []
+# Aim for ≥2 usable responses; if zero ok, try up to 3 reserves
+if ok == 0:
+    need = min(len(fallbacks), 3)
+elif ok < 2:
+    need = min(len(fallbacks), 2 - ok)
+else:
+    need = 0
+print(need)
+print(f"gatekeep: primary ok={ok} failed={failed} fallbacks={len(fallbacks)} need={need}", file=sys.stderr)
+PY
+NEED_FB=$(head -1 "$OUT/fallback-needed.txt" | tr -d '[:space:]')
+NEED_FB=${NEED_FB:-0}
+if [[ "$NEED_FB" -gt 0 ]]; then
+  echo "gatekeep: trying $NEED_FB fallback model(s) after partial failure" >&2
+  fb_i=0
+  while IFS= read -r line; do
+    fb_i=$((fb_i + 1))
+    [[ "$fb_i" -gt "$NEED_FB" ]] && break
+    provider=$(printf '%s' "$line" | python3 -c 'import json,sys; print(json.load(sys.stdin)["provider"])')
+    model=$(printf '%s' "$line" | python3 -c 'import json,sys; print(json.load(sys.stdin)["model"])')
+    protocol=$(printf '%s' "$line" | python3 -c 'import json,sys; print(json.load(sys.stdin)["protocol"])')
+    base_url=$(printf '%s' "$line" | python3 -c 'import json,sys; print(json.load(sys.stdin)["base_url"])')
+    safe=$(echo "fb_${provider}_${model}" | tr '/:' '__')
+    bash "$ACTION/scripts/call-model.sh" \
+      "$provider" "$model" "$protocol" "$base_url" \
+      "$OUT/prompt.json" "$MODELS_DIR/model-fb$fb_i-$safe.json" "$SECRETS_FILE" || true
+  done < <(python3 -c 'import json,sys; [print(json.dumps(m)) for m in json.load(open(sys.argv[1])).get("fallback_models") or []]' "$PLAN")
+fi
+
 # Scrub secrets file from workspace artifact path if present
 rm -f "$SECRETS_FILE"