fix: stop on detected model fallback via stream detection, not a model whitelist

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code

[Tryanks]

Summary

Revises how abort_on_model_fallback (#277) works. The previous implementation injected an availableModels whitelist + switchModelsOnFlag:false into Claude Code's --settings, which had an unacceptable side effect: subagents could no longer freely choose their models.

This removes all settings injection and stops the session at the conversation level when a fallback is detected in the stream:

• Detection (two signals, both live-verified shapes): the authoritative system/model_refusal_fallback notice (carries category + refused-message checkpoint), plus a fast served-model family check on every assistant message (Fable → any Opus, Opus 5 → Opus 4.8; Sonnet/Haiku subagents and <synthetic> never match, at most one fire per turn). The fast path also covers resuming a session already stuck on the fallback model, where no new notice is emitted.
• Stop: on detection (setting on + active session), the runtime clears the queue, marks the turn idle, and shuts the provider process down — the same proven stop used by orchestrate cancel. The next send auto-restarts from the resume cursor with the originally selected --model, undoing Claude Code's session-sticky fallback without a manual /model.
• No spawn-side coupling left:SessionOptions::abort_on_model_fallback is removed; the recovery card, blocked-turn handling, and review advisor are unchanged. Setting descriptions (en/zh-CN) updated — subagents are unaffected.

Verification

• cargo fmt --all --check, cargo clippy --workspace --all-targets --locked -- -D warnings, full cargo test --workspace --locked all pass.
• New tests: the family-rule matrix, one-emission-per-turn mapper test, and a runtime test asserting queue cleared + idle timeline + provider shutdown.
• grep -rn 'availableModels|switchModelsOnFlag|fallback_guard' crates/ returns nothing.

🤖 Generated with Claude Code