knowledge: 3 insights — greedy-regex adjacent tokens in extractor fixtures (1 new page), subagent model-scoped 429 → per-invocation model override (+1 merge, 2 same-batch duplicates folded, Sonnet-limit drift fixed)

log.md

@@ -104,3 +104,5 @@ Append-only. Format: `## [YYYY-MM-DD] <ingest|revise|lint|gap|contradiction|drif
 ## [2026-08-30] revise | frontend/design/design-canvas-workflow — agent-gate Check 3 remediation (PR #164). The gate's fact finding was half right: its "no skill named `design` exists" conclusion is refuted by ground truth (the skill is listed in the authoring session's available-skills roster as `design: Create a design canvas…` and its bundled payload exists on the authoring machine's disk; the reviewer's CI environment lacks the preview, and it conflated the skill with the unrelated `/design-sync` component-upload tool) — but the verifiability objection stands: the skill is an early research preview absent from public docs, so a single un-fetchable in-session source cannot carry `confidence: verified`. Fixed per AGENTS.md: confidence downgraded to field-tested with the experience context stated in the body; two live-fetched public sources added (anthropic.com/news/claude-design-anthropic-labs — official Claude Design product announcement, research preview, Claude Code handoff; explainx.ai 2026 post — /design ships in Claude Code as a research-preview command producing editable artboards via the Artifacts runtime); the mandatory-routing directive and the frontend/index.md load-when line conditioned on the skill appearing in the session's available-skills list, with the existing no-skill edge case as the explicit fallback; the unverifiable "design-review skill" name-drop in the audit edge case generalized to session-provided audit tooling.
 ## [2026-09-03] ingest | databases/selection — new category: datastore selection by workload (4 pages: choosing-a-datastore-by-workload, relational-jsonb-vs-document-store, vector-search-engine-selection, graph-workloads-relational-vs-graph-db); brave-search research, sources cited per page
 ## [2026-09-04] ingest | infrastructure/agent-orchestration/code-graph-as-orientation-layer (field-tested — 1 new page). A locally built code knowledge graph (graphify) is a freshness-gated, lead-not-evidence orientation layer for planning and parallel task decomposition: gate on graph mtime vs git log, symbol-anchored explain/path only, CLI delivery with bounded output, graph-derived assumptions named in reports. Sources: Developers Digest, AQ Score, Autonoma, Tiare Balbi, graphify README + measurements on graphifyy 0.4.23.
+## [2026-09-14] ingest | testing-data-adjacent-tokens-in-extractor-fixtures (verified — 1 new page). Fixture text for a greedy regex extractor whose character class admits separators: class-member separators merge adjacent occurrences into one capped, malformed span, so assert the extractor's own spans first and separate per-occurrence fixtures with a character outside the class; lazy-quantifier "fix" truncates tokens (reproduced). Sources: Python `re` docs, MDN Quantifier, CPython reproduction 2026-09-14. Related links added both ways (test-data-and-isolation, tests-that-cannot-fail).
+## [2026-09-14] revise | infrastructure-agent-orchestration-usage-limit-paused-workers — merged 2 duplicate candidates: subagent call failing with a model-scoped 429 (Fable) → re-issue with a per-invocation `model` outside that family (step 7 + 4 edge cases + Instead-of row). Also corrected drift against the current errors doc: model-scoped limits now include Sonnet as well as Opus ("only the Opus limit" row updated). Sources added: sub-agents#choose-a-model, model-config#fable-and-usage-credits; field observation from two sessions. infrastructure/index.md load-when extended.

wiki/infrastructure/agent-orchestration/usage-limit-paused-workers.md

@@ -9,7 +9,9 @@ sources:
   - https://code.claude.com/docs/en/costs
   - https://github.com/anthropics/claude-code/issues/5977
   - https://code.claude.com/docs/en/interactive-mode#wait-for-a-usage-limit-to-reset
-last_verified: 2026-08-29
+  - https://code.claude.com/docs/en/sub-agents#choose-a-model
+  - https://code.claude.com/docs/en/model-config#fable-and-usage-credits
+last_verified: 2026-09-14
 related: [infrastructure-agent-orchestration-unattended-worker-questions, infrastructure-agent-orchestration-control-signals-vs-primary-artifacts, infrastructure-agent-orchestration-pane-delivery-confirmation, infrastructure-agent-orchestration-dispatching-after-a-completion-report, infrastructure-agent-orchestration-shared-run-state]
 ---
 
@@ -19,9 +21,10 @@ related: [infrastructure-agent-orchestration-unattended-worker-questions, infras
 
 Several agent workers billed to one account go quiet within minutes of each other,
 their diffs stop, and every liveness check still passes. Also when one worker's
-terminal tail carries a `You've hit your … limit · resets …` notice, or when you
+terminal tail carries a `You've hit your … limit · resets …` notice, when you
 are deciding whether to restart, replace, or wait on a worker that reports no
-task-level error.
+task-level error, or when a subagent call fails at once with a rate-limit error
+that names one model.
 
 ## Do this
 
@@ -32,7 +35,7 @@ task-level error.
 |------------|----|
 | `You've hit your session limit · resets <time>` | Wait until the stated time — the window is shared across all models, so switching models does not restore access |
 | `You've hit your weekly limit · resets <day time>` | Wait until the stated day and time; the same model-independence applies |
-| `You've hit your Opus limit · resets <time>` | Send `/model` and switch to another model — this limit scopes to Opus only, and the worker keeps working now |
+| `You've hit your Opus limit` / `You've hit your Sonnet limit · resets <time>` | Send `/model` and switch to a model outside that family — each limit scopes to its own family, and the worker keeps working now |
 | No limit marker | This is a different stall — classify it with [infrastructure-agent-orchestration-unattended-worker-questions] |
 
 2. **Read a synchronized multi-worker stop as one shared allowance, not N
@@ -57,6 +60,14 @@ task-level error.
    rather than resuming the interrupted step.
 6. **Confirm the resume prompt was consumed by the worker's own effect**, not by
    the pane changing ([infrastructure-agent-orchestration-pane-delivery-confirmation]).
+7. **When a subagent call fails immediately with a model-scoped limit
+   (`rate_limit`, HTTP 429, the error naming a model such as `claude-fable-5-1`),
+   re-issue the identical call with a per-invocation `model` outside that family**
+   (`model: "sonnet"`). A subagent definition's `model` frontmatter (`model: fable`)
+   pins it independently of the session's model, so the session keeps working while
+   every call to that subagent fails; the per-invocation parameter ranks first in
+   Claude Code's subagent model order. Treat the failure as infrastructure noise,
+   not as the subagent's verdict, and record which model the rerun used.
 
 ## Edge cases
 
@@ -65,23 +76,32 @@ task-level error.
 | The session limit resets but the worker is blocked again immediately | The weekly allowance is also exhausted; both count at once. Read the new marker — it names the weekly reset day, which can be days out |
 | You need the reset time and the marker scrolled away | Have the worker run `/usage`, which reports the plan limits and when each resets |
 | The run must finish before the reset | `/usage-credits` buys usage past the allowance on Pro and Max, or requests it from an admin on Team and Enterprise; the reset time is otherwise the earliest resume |
-| Only one worker of several stopped | A per-seat allowance is per account — a single stopped worker points at a model-scoped Opus limit or a different stall, not the shared window |
+| Only one worker of several stopped | A per-seat allowance is per account — a single stopped worker points at a model-scoped Opus or Sonnet limit or a different stall, not the shared window |
 | The orchestrator's own session is billed to the same account | It hits the wall too, so schedule the resume outside the run (a wake-up at the reset time), not from inside the blocked session |
 | Automatic resume is expected from the CLI | Implemented since v2.1.234 (`autoContinueAtUsageLimit`, on by default) for an interactive session signed in with a claude.ai subscription, when the reset is under 24 hours out. It does not self-start for a weekly-limit reset days out, for Remote Control or agent-team teammate sessions, for background/`-p` runs, or for API-key/cloud-provider billing — any of which still needs the orchestrator to start the wait (`/rate-limit-options` → "Wait here, then continue automatically") or re-drive the worker after the reset |
+| The subagent rerun with a model override fails the same way | The limit is the shared session or weekly window, or the substitute family is limited too; read the marker and wait for the reset (steps 1 and 4) |
+| The marker names Fable (`Fable limit reached · continuing on Fable 5.1 uses usage credits … nothing was sent`) in a background, Remote Control, or teammate session | Fable can bill to usage credits behind a consent prompt only the session's own terminal shows; answer it there, or `/model` (subagent: per-invocation `model`) to a model that does not bill credits |
+| `CLAUDE_CODE_SUBAGENT_MODEL` is set on a CLI older than v2.1.251 | The environment variable ranked first then and overrode the per-invocation parameter; change or unset it for the rerun |
+| The subagent is a reviewer or auditor whose definition picks its model on purpose | Record the substituted model beside its verdict; rerun on the defined model after the reset when the gate requires that model |
+| An organization `availableModels` allowlist blocks the override | Claude Code substitutes another model for the subagent; `/tasks` names the model each subagent row runs on (v2.1.242+) |
 
 ## Instead of
 
 | If you are about to | Do this instead | Why |
 |---------------------|-----------------|-----|
 | Restart or replace a worker that went silent with no error | Read its terminal tail for the limit marker, then wait for the stated reset | A rate-limited worker is idle-waiting with its work intact; restarting discards completed work to solve a problem waiting solves |
 | Send "continue" once the reset passes | Send a prompt naming the state re-check, the remaining done-criteria, and the completion signal | Context does not survive the boundary; a bare continue was reported to re-analyze the plan, misread its state, and redo work already done |
-| Switch the worker's model to get it moving | Identify which limit the marker names first | Session and weekly limits are shared across all models; only the Opus limit is cleared by `/model` |
+| Switch the worker's model to get it moving | Identify which limit the marker names first | Session and weekly limits are shared across all models; only the model-scoped Opus and Sonnet limits are cleared by switching outside the family |
 | Send the resume prompt as soon as you notice the stall | Wait until the time printed in the marker, then send | Requests inside the blocked window return the same limit message and delay the real resume |
+| Wait out, or record as a failed audit, a subagent call that returned a model-named 429 | Re-issue the same call with a per-invocation `model` outside that family | The limit scopes to the model the subagent's definition chose, not to the session |
 
 ## Sources
 
-- https://code.claude.com/docs/en/errors — the three marker forms verbatim (`You've hit your session limit · resets 3:45pm`, `You've hit your weekly limit · resets Mon 12:00am`, `You've hit your Opus limit · resets 3:45pm`); "Claude Code **blocks further requests** until the reset time shown in the message"; "The session and weekly limits are **shared across all models**, so switching models doesn't restore access"; "The Opus limit **applies only to Opus requests**, so switching to another model with `/model` keeps you working"; "Usage counts against the session and weekly allowances at the same time"; `/usage` and `/usage-credits` as the remaining moves
+- https://code.claude.com/docs/en/errors — the marker forms verbatim (`You've hit your session limit · resets 3:45pm`, `You've hit your weekly limit · resets Mon 12:00am`, `You've hit your Opus limit · resets 3:45pm`, `You've hit your Sonnet limit · resets 3:45pm`); "Claude Code **blocks further requests** until the reset time shown in the message"; "The session and weekly limits are **shared across all models**, so switching models doesn't restore access. The Opus and Sonnet limits each apply only to requests to that model family, so switching to a model outside the family with `/model` keeps you working"; "Usage counts against the session and weekly allowances at the same time"; `/usage` and `/usage-credits` as the remaining moves; "The prompt to confirm went unanswered": `Fable limit reached · continuing on Fable 5.1 uses usage credits, and the prompt to confirm went unanswered — nothing was sent · answer it where this session is running, or /model to change`, raised in Remote Control, background, and agent-team teammate sessions
 - https://code.claude.com/docs/en/costs — "each member's Claude Code usage draws from a per-seat allowance that resets on a rolling five-hour window and a weekly window. The allowance is shared with Claude chat and Cowork, and its size depends on the member's seat tier"; agent teams spawn multiple Claude Code instances whose usage scales with the number of active teammates and how long each one runs
 - https://github.com/anthropics/claude-code/issues/5977 — a long task interrupted by "Claude usage limit reached. Your limit will reset at 2pm (America/New_York)": the CLI stops cleanly rather than crashing, and after the reset a "continue" loses context, re-reads and misinterprets the plan, and redoes completed work instead of resuming the interrupted step. Closed as duplicate
 - https://code.claude.com/docs/en/interactive-mode#wait-for-a-usage-limit-to-reset — "Claude Code waits in the open session and continues the task on its own after the limit resets. Automatic continue is on by default in interactive sessions signed in with a claude.ai subscription. Requires Claude Code v2.1.234 or later"; it does not self-start for a reset more than 24 hours away, for Remote Control or agent-team teammate sessions, or for background sessions and `-p` runs. (issue #36320, the feature request this replaced, was closed 2026-03-23 as a duplicate of #35744 once the feature shipped)
+- https://code.claude.com/docs/en/sub-agents#choose-a-model — "When Claude invokes a subagent, it can also pass a `model` parameter for that specific invocation. Claude Code resolves the subagent's model in this order: 1. The per-invocation `model` parameter 2. The subagent definition's `model` frontmatter … 3. The `CLAUDE_CODE_SUBAGENT_MODEL` environment variable … 4. The main conversation's model"; "Before v2.1.251, `CLAUDE_CODE_SUBAGENT_MODEL` came first in this order"; blocked values under `availableModels` are substituted; `/tasks` names the subagent's model (v2.1.242+); the per-invocation value persists across resume (v2.1.211+)
+- https://code.claude.com/docs/en/model-config#fable-and-usage-credits — "Depending on your plan and seat tier, Fable usage can bill to usage credits instead of drawing on your plan's included limits"; interactive sessions show a consent prompt before a Fable request bills usage credits
 - Field observation 2026-08-06 (dev-loop Wave 1, three tmux workers): all three stopped within minutes of one another on the same reset time with the identical marker in each pane tail and every liveness check passing; a state-re-check prompt sent after the reset resumed all three at their interrupted step (re-running the task's tests)
+- Field observation 2026-09-14 (two independent orchestrated worker sessions, dev-loop 1.21.0 whose `test-quality-auditor` agent declares `model: fable`): each first `dev-loop:test-quality-auditor` call failed with `rate_limit, HTTP 429` — "You've reached your Fable limit … model sent to the API: claude-fable-5-1" — while the session itself kept working; re-issuing the identical call with `model: "sonnet"` succeeded and completed the audit in both sessions

wiki/infrastructure/index.md

@@ -18,7 +18,7 @@ Match your situation to a "load when" line; load only matching pages.
 | [session-completion-gates](agent-orchestration/session-completion-gates.md) | Writing a Stop/completion hook that blocks a worker session from ending while its phase is non-terminal; the gate fires on a worker that followed its own prompt; deciding the terminal phase set, the unknown-phase default, and how the gate bounds its own repetition; you are the worker the gate repeats on at an instructed pause and are deciding whether to advance your phase to silence it |
 | [dispatching-after-a-completion-report](agent-orchestration/dispatching-after-a-completion-report.md) | A worker reported completion and the orchestrator wants to hand that same terminal or runtime slot its next task; a start/dispatch call fails with a runtime-unavailable-class error moments after a completion report; a task reached a terminal `failed` status with no worker having worked on it; deciding a settled dispatch's next owner (transfer, release, or retain) and how to retry a failed start without spending the task's attempt budget |
 | [unattended-worker-questions](agent-orchestration/unattended-worker-questions.md) | A worker agent raises a question through its own interactive UI (a numbered chooser, a confirmation/trust/re-auth screen) with no human at that terminal; a worker is flagged stalled with a live terminal and no task-level error; a worker reports a decision it assumed rather than asked; designing the channel a worker uses to ask its coordinator for a decision |
-| [usage-limit-paused-workers](agent-orchestration/usage-limit-paused-workers.md) | Several workers billed to one account go quiet within minutes of each other while every liveness check passes; a worker's terminal shows a `You've hit your session/weekly/Opus limit · resets …` notice; deciding whether to restart, replace, or wait on a worker with no task-level error; writing the prompt that resumes a worker after a usage window resets |
+| [usage-limit-paused-workers](agent-orchestration/usage-limit-paused-workers.md) | Several workers billed to one account go quiet within minutes of each other while every liveness check passes; a worker's terminal shows a `You've hit your session/weekly/Opus/Sonnet limit · resets …` notice; deciding whether to restart, replace, or wait on a worker with no task-level error; writing the prompt that resumes a worker after a usage window resets; a subagent call (auditor, reviewer) fails at once with `rate_limit`/HTTP 429 naming one model (e.g. a Fable limit) while the session keeps working |
 | [worktree-isolated-workers](agent-orchestration/worktree-isolated-workers.md) | Authoring the brief/output contract for parallel workers each confined to its own git worktree; workers stall at the same phase with no task-level error; deciding where shared or produced artifacts live and which direction (read vs write) a worktree guardrail stops; a guardrail escalates on read-only access to another worktree; the isolation guard is a Bash-command hook while workers also edit files with native Edit/Write tools |
 | [autonomous-decision-rulings](agent-orchestration/autonomous-decision-rulings.md) | An unattended agent hits a decision its plan does not answer and must choose between stopping to ask and proceeding; a run stalls on questions no human needed to see; deciding which decision categories require a human; recording autonomous decisions for audit; resuming after interruption/compaction without re-dispatching completed work |
 | [session-context-token-budget](agent-orchestration/session-context-token-budget.md) | Planning or running long-lived coordinator/worker agent sessions and deciding when to compact or clear context; a run's cost is dominated by cache reads; screenshots or large file reads are entering a long-lived session; choosing slot counts / per-phase token budgets for an orchestrated run |