@ngockhoale/ukit 3.4.46 → 3.4.48

package/template_project/.claude/ukit/runtime/stop-coordinator.mjs

@@ -585,6 +585,16 @@ function loadReviewPolicyModule() {
   return reviewPolicyModulePromise;
 }
 
+// One advisory line for a delegated feature run's acceptance verdict (null when nothing to say).
+function playbookExecutionNote(acceptance) {
+  if (!acceptance?.applicable) return null;
+  if (!acceptance.delegated && !(acceptance.reasons || []).includes('delegation-required-not-performed')) return null;
+  const parts = [`[ukit-stop-coordinator] playbook acceptance (advisory): ${acceptance.verdict}`];
+  if (acceptance.reasons?.length) parts.push(`reasons: ${acceptance.reasons.slice(0, 4).join('; ')}`);
+  if (acceptance.unsupported?.length) parts.push(`unsupported: ${acceptance.unsupported.join(', ')}`);
+  return parts.join(' — ');
+}
+
 let ledgerReceiptModulePromise = null;
 function loadLedgerReceiptModule() {
   if (!ledgerReceiptModulePromise) {
@@ -607,7 +617,7 @@ function loadLedgerReceiptModule() {
  * `completionKind` ('block'|'advisory'|'complete'|null) is the completion
  * evaluator's verdict, used only to mark which done criteria are evidenced.
  */
-export async function evaluateStopReviewPolicy({ projectRoot, completionKind = null } = {}) {
+export async function evaluateStopReviewPolicy({ projectRoot, completionKind = null, payload = {} } = {}) {
   try {
     const policyModule = await loadReviewPolicyModule();
     if (!policyModule || typeof policyModule.evaluateReviewPolicy !== 'function') return null;
@@ -647,6 +657,35 @@ export async function evaluateStopReviewPolicy({ projectRoot, completionKind = n
       : 0;
 
     const ledgerModule = await loadLedgerReceiptModule();
+    // Round 5: a feature-implementation run contributes its OWN facts (worker evidence,
+    // integration state, scope/conflict signals, retry history) as inputs to this one policy
+    // call — no second decision plane. Non-feature playbooks and non-delegated runs add nothing.
+    let featureReport = null;
+    try {
+      if (routeSummary.playbookId === 'feature-implementation' && typeof ledgerModule?.featureRunReport === 'function') {
+        const ledger = (await ledgerModule.readExecutionLedger(projectRoot, payload)) || {};
+        featureReport = ledgerModule.featureRunReport({ state, ledger, cwd: projectRoot });
+      }
+    } catch { featureReport = null; }
+    // The completion evaluator's stdout is `advisory` (not `complete`) whenever it attached the
+    // playbook acceptance note, so completionKind alone marks every route criterion 'missing' on a
+    // released feature run and pins review at run-targeted-check (acceptance NOT_PASS forever). The
+    // run's own contract-evidence facts come from the same receipt predicates the gate uses — a
+    // criterion they prove is verified; one they do not prove keeps the completionKind status.
+    const contractEvidence = featureReport?.acceptance?.facts?.contractEvidence;
+    if (contractEvidence?.known === true && Array.isArray(contractEvidence.required)) {
+      const unproven = new Set(Array.isArray(contractEvidence.missing) ? contractEvidence.missing : []);
+      for (const criterion of doneCriteria) {
+        if (criterion.status !== 'verified' && contractEvidence.required.includes(criterion.name) && !unproven.has(criterion.name)) {
+          criterion.status = 'verified';
+        }
+      }
+    }
+    const extra = featureReport?.reviewInputs?.applicable ? featureReport.reviewInputs : null;
+    if (extra) {
+      const known = new Set(doneCriteria.map((c) => c.name));
+      for (const criterion of extra.doneCriteria) if (!known.has(criterion.name)) doneCriteria.push(criterion);
+    }
     // The policy fires its calibration receipt without awaiting it; collect the promises so
     // the receipt is on disk before this evaluator returns (a loaded host otherwise leaves
     // the write racing the next reader).
@@ -660,10 +699,11 @@ export async function evaluateStopReviewPolicy({ projectRoot, completionKind = n
       : undefined;
 
     const decision = policyModule.evaluateReviewPolicy({
-      signals: routeSummary.suspicionSignals ?? {},
+      signals: extra ? { ...(routeSummary.suspicionSignals ?? {}), ...extra.signals } : (routeSummary.suspicionSignals ?? {}),
       doneCriteria,
       evidenceClasses: [],
-      fixLoopCount: Number.isFinite(historySignals.fixLoopCount) ? historySignals.fixLoopCount : 0,
+      fixLoopCount: Math.max(Number.isFinite(historySignals.fixLoopCount) ? historySignals.fixLoopCount : 0, extra?.fixLoopCount ?? 0),
+      ...(extra?.escalationDepth ? { escalationDepth: extra.escalationDepth } : {}),
       round,
       cap: policyModule.DEFAULT_REVIEW_ROUND_CAP,
       projectRoot,
@@ -684,6 +724,27 @@ export async function evaluateStopReviewPolicy({ projectRoot, completionKind = n
     };
     await writeJsonAtomicLocal(statePath, state);
 
+    // Round 5: persist the decision on the ledger (delegated runs only) and fold the final
+    // acceptance + dispatch hint + telemetry summary onto the returned decision. Advisory:
+    // none of this changes the completion gate's own verdict.
+    if (featureReport?.applicable) {
+      try {
+        if (featureReport.delegated) {
+          await ledgerModule.recordReviewDecision({ projectRoot, payload, decision });
+        }
+        const refreshed = (await ledgerModule.readExecutionLedger(projectRoot, payload)) || {};
+        const finalReport = ledgerModule.featureRunReport({
+          state, ledger: refreshed, cwd: projectRoot,
+          reviewDecision: { action: decision.action, namedCheck: decision.namedCheck ?? null, signalsHit: decision.signalsHit || [] },
+        });
+        decision.playbook = {
+          acceptance: finalReport.acceptance,
+          telemetry: finalReport.telemetry,
+          reviewDispatch: finalReport.reviewDispatch,
+        };
+      } catch { /* advisory */ }
+    }
+
     return decision;
   } catch {
     return null; // advisory lane: never wedge the coordinator
@@ -1939,13 +2000,27 @@ export async function runStopCoordinator({
   // the output and a review-policy receipt lands in decisions.tsv. The gate's
   // own block logic is unchanged — a non-finish verdict only surfaces as a
   // systemMessage note, never a block.
+  let playbookTelemetry = null;
   try {
     const reviewPolicy = await evaluateStopReviewPolicy({
       projectRoot,
       completionKind: completion?.kind ?? null,
+      payload,
     });
     if (reviewPolicy) {
       merged.reviewPolicy = reviewPolicy;
+      playbookTelemetry = reviewPolicy.playbook?.telemetry ?? null;
+      if (reviewPolicy.playbook?.acceptance?.applicable) {
+        merged.playbookAcceptance = reviewPolicy.playbook.acceptance;
+        const dispatch = reviewPolicy.playbook.reviewDispatch;
+        const notes = [
+          playbookExecutionNote(reviewPolicy.playbook.acceptance),
+          dispatch ? `review dispatch (advisory): Agent subagent_type=${dispatch.subagent_type} effort=${dispatch.effort} — ${dispatch.reason}. ${dispatch.brief}` : null,
+        ].filter(Boolean);
+        if (notes.length) {
+          merged.systemMessage = merged.systemMessage ? `${merged.systemMessage}\n${notes.join('\n')}` : notes.join('\n');
+        }
+      }
       if (reviewPolicy.action !== 'finish') {
         const note = `[ukit-stop-coordinator] review policy (advisory): ${reviewPolicy.action}`
           + (reviewPolicy.namedCheck ? ` — ${reviewPolicy.namedCheck}` : '')
@@ -1966,6 +2041,7 @@ export async function runStopCoordinator({
     await captureUsageShadow({ projectRoot, payload });
   } catch { /* advisory */ }
 
+
   // TASK-005 (FR-005): the coordinator's terminal verdict lands ONE
   // `outcome.observed` record per coordinated stop — the merged evaluator
   // decision is the session's honest outcome at this stop. Fire-and-forget:
@@ -2000,6 +2076,7 @@ export async function runStopCoordinator({
           evidenceIds: [],
           cost: { latencyMs: null, rounds: null },
           reviewActions: [],
+          ...(playbookTelemetry ? { playbook: playbookTelemetry } : {}),
         },
         projectRoot,
         payload: typeof payload?.session_id === 'string' && payload.session_id ? payload : outcomePayload,

package/template_project/.omp/agents/bug-debugger.md

@@ -2,6 +2,7 @@
 name: bug-debugger
 description: "Debugging specialist for reproducible errors, failing tests, and unexpected behavior. Use proactively when investigation will involve noisy logs, stack traces, or a self-contained reproduce-trace-fix-verify loop. Do not use for trivial obvious fixes or broad architecture ideation."
 model: "@default"
+thinking-level: medium
 tools: ["read","grep","glob","bash","edit","ast_edit"]
 ---
 

package/template_project/.omp/agents/code-reviewer.md

@@ -2,6 +2,7 @@
 name: code-reviewer
 description: "Independent reviewer for handoff Phase 3 and for spec/plan documents. For code (default): use after executor reports STATUS: DONE on a handoff task, MUST run with a model different from the executor (configured in .ukit/storage/config.json → handoff.reviewer.model, default unic-smart), produces a verdict: APPROVED | APPROVED-WITH-MINOR | CHANGES-REQUESTED | CRITICAL. For spec/plan documents (set REVIEW_TARGET_TYPE=spec or plan): reviews a docs/plans/*.md file for completeness/consistency/clarity/scope/YAGNI, produces Status: Approved | Issues Found."
 model: "@slow"
+thinking-level: medium
 tools: ["read","grep","glob","bash"]
 ---
 

package/template_project/.omp/agents/feature-implementer.md

@@ -2,6 +2,7 @@
 name: feature-implementer
 description: "Implementation specialist for clear, self-contained coding tasks. Use proactively when the approach is clear and the work can be completed in a bounded pass with a concise summary. Do not use for trivial one-file tweaks or tightly coupled exploratory work."
 model: "@default"
+thinking-level: medium
 tools: ["read","edit","write","ast_edit","grep","glob","bash"]
 ---
 

package/template_project/.omp/agents/handoff-planner.md

@@ -2,6 +2,7 @@
 name: handoff-planner
 description: "Handoff planning specialist for Phase 1+2. Use when creating a new handoff cycle: writes PLAN.md with full test plan, splits into TASK-xxx.md files with TDD-embedded test cases, and updates INDEX.md. Always use the strongest available model (Opus/unic-smart)."
 model: "@slow"
+thinking-level: medium
 tools: ["read","edit","write","ast_edit","glob","bash"]
 ---
 

package/template_project/.omp/agents/ukit-small-task-maintainer.md

@@ -2,6 +2,7 @@
 name: ukit-small-task-maintainer
 description: "Internal UKit maintenance subagent for low-risk, reversible UKit decisions. Use proactively when UKit needs to decide or perform safe cleanup such as pruning docs/TASKS.md, classifying queued work, choosing whether compact/summarization is appropriate, summarizing local docs/status, or maintaining small UKit runtime queues. Do not use for product implementation, security, release/publish, data-loss, architecture, or risky/shared code changes."
 model: "@smol"
+thinking-level: low
 tools: ["read","grep","glob","edit","write","ast_edit"]
 blocking: false
 ---

package/template_project/.omp/hooks/pre/ukit-bridge.js

@@ -31,10 +31,12 @@ import {
 import { resolveChainExecTimeoutMs } from '../../../.claude/ukit/runtime/hook-chain-budget.mjs';
 
 // OMP-3 (TASK-002): pi.exec forwards only {cwd, signal, timeout} to its spawn —
-// an `env` option is dropped (verified against the bundled omp exec). The only
-// channel that reaches the chain runner AND its in-proc .mjs steps is the host
-// environment, so the bridge stamps the harness here: record-execution.mjs
-// reads env.UKIT_HARNESS (default 'claude-code') when journaling receipts.
+// an environment option is dropped (verified against the bundled omp exec), and the host's
+// Bun.spawn inherits the launch-time snapshot, so this runtime write does NOT reach hook
+// children (live omp run: ledger harness 'claude-code', tier read from .claude/settings.json).
+// It only stamps this in-proc bridge; hook children get the stamp from the `ukit_harness` payload
+// field (buildHookPayload) that hook-chain-runner exports before any step runs. Receipts,
+// resolveMainTier and the Claude-only delegation gate all read UKIT_HARNESS (default 'claude-code').
 process.env.UKIT_HARNESS = 'omp';
 
 export const HOOK_EVENT_MAP = {
@@ -45,16 +47,19 @@ export const HOOK_EVENT_MAP = {
       'stale-spec-guard.sh',
       'pre-edit-backup.sh',
       'skill-router.sh',
+      'delegation-gate.mjs',
       'handoff-model-guard.sh',
       'context-hardcap-gate.sh',
     ],
-    // Delegation + multi-file mutation tools. Only the create-scope guard applies: it denies
+    // Delegation + multi-file mutation tools. The create-scope guard applies (the delegation gate is
+    // Claude Code-only and no-ops here: omp has no verifiable worker identity): it denies
     // implementation-capable subagents / source writes while a handoff-create session is live.
-    'MultiEdit|NotebookEdit|Agent|Task': ['handoff-model-guard.sh'],
+    'MultiEdit|NotebookEdit|Agent|Task': ['delegation-gate.mjs', 'handoff-model-guard.sh'],
     Bash: [
       'auto-allow-bash.sh',
       'block-dangerous.mjs',
       'sensitive-data-guard.mjs',
+      'delegation-gate.mjs',
       'handoff-model-guard.sh',
       'context-hardcap-gate.sh',
       'verification-guard.sh',
@@ -241,6 +246,18 @@ function redactDiagnosticText(text, maxChars = 500) {
     : redacted;
 }
 
+// Host-written session header: a subagent session carries `parentSession` (the main session file);
+// a main session never does. This is SESSION-level descent only — it names no agent type and
+// correlates no tool call, so it cannot attribute work to a particular task() entry.
+export function isSubagentSession(context = {}) {
+  try {
+    const header = context?.sessionManager?.getHeader?.();
+    return typeof header?.parentSession === 'string' && header.parentSession !== '';
+  } catch {
+    return false;
+  }
+}
+
 function runtimeMetadata(event = {}, context = {}) {
   const sessionManager = context?.sessionManager;
   const transcriptPath = event.transcriptPath ?? event.transcript_path ?? sessionManager?.getSessionFile?.();
@@ -255,11 +272,12 @@ function runtimeMetadata(event = {}, context = {}) {
     sessionId: event.sessionId ?? event.session_id ?? sessionManager?.getSessionId?.() ?? transcriptPath,
     cwd: context?.cwd ?? event.cwd,
     transcriptPath,
+    subagentSession: isSubagentSession(context) ? true : undefined,
   };
 }
 
 function buildHookPayload(hookEventName, fields = {}) {
-  const payload = { hook_event_name: hookEventName };
+  const payload = { hook_event_name: hookEventName, ukit_harness: 'omp' };
   const mappings = [
     ['toolName', 'tool_name'],
     ['toolInput', 'tool_input'],
@@ -272,6 +290,7 @@ function buildHookPayload(hookEventName, fields = {}) {
     ['prompt', 'prompt'],
     ['transcriptPath', 'transcript_path'],
     ['source', 'source'],
+    ['subagentSession', 'ukit_subagent_session'],
   ];
   for (const [field, payloadField] of mappings) {
     if (fields[field] !== undefined && fields[field] !== null) {
@@ -951,6 +970,14 @@ export async function runToolResult(pi, event, { projectRoot, context: extension
 }
 
 export async function runBeforeAgentStart(pi, event, { projectRoot, context: extensionContext = {} }) {
+  // Route currency: refresh the owner session's observed main model before the chain runs so
+  // resolveMainTier reads the model the host reports NOW, not the one at session creation.
+  // Observation-only (see observeMainModel): foreign/legacy records untouched, never promotes.
+  try {
+    await observeMainModel({ projectRoot, context: extensionContext, observedVia: 'before_agent_start' });
+  } catch {
+    // advisory refresh — routing continues on the previously recorded model
+  }
   const metadata = runtimeMetadata(event, extensionContext);
   const payload = buildHookPayload('UserPromptSubmit', {
     prompt: event.prompt,
@@ -970,7 +997,224 @@ export async function runSessionCompacting(pi, event, { projectRoot, context: ex
   return result.context.length > 0 ? { context: result.context } : undefined;
 }
 
+// ── Main orchestrator (Tier 3 / `slow`) ─────────────────────────────────────────────────────
+// UKit-managed omp sessions orchestrate on the `slow` role while `modelRoles.default` stays the
+// Tier 2 worker model. The only host-native way to pick the ACTIVE model from an extension is
+// pi.setModel(model) (session-scoped, never persisted); it is applied once, on a FRESH session
+// that is still on the `default` role model — a resumed session (omp restores its recorded model),
+// an explicit --model, or a model the user already switched to is left untouched. What was
+// observed/decided is recorded for route-task (resolveMainTier) under .ukit/storage/cache.
+const SESSION_MAIN_MODEL_FILE = path.join('.ukit', 'storage', 'cache', 'session-main-model.json');
+
+function projectModelRole(projectRoot, role) {
+  try {
+    const text = fs.readFileSync(path.join(projectRoot, '.omp', 'config.yml'), 'utf8');
+    const block = text.match(/^modelRoles:[ \t]*\r?\n((?:[ \t]+.*(?:\r?\n|$))+)/m);
+    const line = block?.[1].match(new RegExp(`^[ \\t]+${role}:[ \\t]*([^\\s#]+)`, 'm'));
+    return line ? line[1].replace(/^["']|["']$/g, '') : null;
+  } catch {
+    return null;
+  }
+}
+
+function findRegistryModel(registry, value) {
+  const wanted = String(value ?? '').replace(/:(off|minimal|low|medium|high|xhigh|max|auto)$/i, '');
+  if (!wanted || typeof registry?.getAvailable !== 'function') return null;
+  const matches = registry.getAvailable().filter((m) => m?.id === wanted || `${m?.provider}/${m?.id}` === wanted);
+  return matches.length === 1 ? matches[0] : null;
+}
+
+function readSessionMainModel(projectRoot) {
+  try {
+    return JSON.parse(fs.readFileSync(path.join(projectRoot, SESSION_MAIN_MODEL_FILE), 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+// Provenance closure for the shared single-slot record (observed real run 2026-10-18: the child's
+// post-promotion rewrite at 17:28:43.915 carried no writer id, so a child overwrite of the main
+// session's record was unattributable). Every write stamps `session` = the writer's OWN host
+// sessionManager id (never invented, never env-derived; the key is absent — not null — when the
+// host gives no id). Ownership POLICY lives with the callers: selectOrchestratorModel's skip paths
+// never erase another session's live promotion, and selectWorkerModel pins only for the owner.
+function recordSessionMainModel(projectRoot, record, { sessionId = null } = {}) {
+  try {
+    const file = path.join(projectRoot, SESSION_MAIN_MODEL_FILE);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify({ harness: 'omp', ts: new Date().toISOString(), session: sessionId ?? undefined, ...record })}\n`);
+  } catch {
+    // advisory telemetry only — never fail session start
+  }
+  return record;
+}
+
+// Owner match on host data only: a record without a session stamp (legacy pre-provenance write)
+// is owned by nobody and must not be claimed by a reader that happens to be alive.
+function recordOwnedBySession(record, sessionId) {
+  return typeof sessionId === 'string' && sessionId !== ''
+    && typeof record?.session === 'string' && record.session !== ''
+    && record.session === sessionId;
+}
+
+export async function selectOrchestratorModel(pi, { projectRoot, context = {} } = {}) {
+  // A subagent session loads this same bridge and sees a fresh default-role session. Its header
+  // carries the host-set parentSession; promoting it would run the Tier 2 worker on `slow` (observed
+  // live: worker model_change unic-code -> unic-smart 4 ms after spawn). Skip WITHOUT recording —
+  // the record describes the main session and selectWorkerModel reads it for later spawns.
+  if (isSubagentSession(context)) return { action: 'skipped', reason: 'subagent-session' };
+  const active = context.model ?? null;
+  const activeId = active?.id ?? null;
+  // Provenance: every record names the writer session (host sessionManager id, never env or an
+  // invented identity) so any foreign write would be attributable; skip paths preserve a live
+  // promotion instead of overwriting the shared single-slot record (see recordSessionMainModel).
+  const ownSessionId = context.sessionManager?.getSessionId?.() ?? null;
+  const record = (extra) => recordSessionMainModel(projectRoot, { model: activeId, ...extra }, { sessionId: ownSessionId });
+  // Skip paths must not erase another main session's live promotion (the record is a single
+  // per-project slot): preserve it and say so. ONE exception, same owner only: if THIS session's
+  // host-reported active model no longer matches the model UKit selected for it, an explicit
+  // model change was observed (no model_select extension event exists in omp 18.10.4 — the
+  // active model at the next bridge observation is the only host signal). Recording it here is
+  // what keeps resolveMainTier from reporting a stale slow role after the user switched models.
+  // A record owned by nobody (legacy, no stamp) or by a different session is always preserved.
+  const skip = (reason, extra = {}) => {
+    const existing = readSessionMainModel(projectRoot);
+    if (existing?.selected === true) {
+      if (recordOwnedBySession(existing, ownSessionId) && activeId && activeId !== existing.model) {
+        recordSessionMainModel(
+          projectRoot,
+          { model: activeId, selected: false, reason: 'observed-active-model-changed', observedVia: reason },
+          { sessionId: ownSessionId },
+        );
+        return { action: 'skipped', reason, recordCorrected: true };
+      }
+      return { action: 'skipped', reason, preservedRecord: true };
+    }
+    record({ selected: false, reason, ...extra });
+    return { action: 'skipped', reason };
+  };
+  const slow = projectModelRole(projectRoot, 'slow');
+  const def = projectModelRole(projectRoot, 'default');
+  if (!slow || !def || typeof pi?.setModel !== 'function' || !context.modelRegistry) return skip('unsupported');
+  const entries = context.sessionManager?.getEntries?.();
+  if (!Array.isArray(entries)) return skip('resume-state-unknown');
+  if (entries.some((e) => e?.type === 'message')) return skip('resumed-session');
+  const defaultModel = findRegistryModel(context.modelRegistry, def);
+  if (!active || !defaultModel || activeId !== defaultModel.id || active.provider !== defaultModel.provider) return skip('active-model-not-default-role');
+  const slowModel = findRegistryModel(context.modelRegistry, slow);
+  if (!slowModel) return skip('slow-role-model-unavailable');
+  if (slowModel.id === activeId && slowModel.provider === active.provider) {
+    return skip('already-orchestrator', { role: 'slow' });
+  }
+  let ok = false;
+  try {
+    ok = (await pi.setModel(slowModel)) === true;
+  } catch {
+    ok = false;
+  }
+  if (!ok) return skip('set-model-rejected');
+  recordSessionMainModel(projectRoot, { model: slowModel.id, selected: true, role: 'slow', reason: 'fresh-session-default-role' }, { sessionId: ownSessionId });
+  return { action: 'selected', model: slowModel.id };
+}
+
+// omp resolves a subagent whose frontmatter says `model: "@default"` as "inherit the parent's ACTIVE
+// model" (not as `modelRoles.default`). Once selectOrchestratorModel has moved the session to the
+// `slow` role, a `@default` Tier 2 coding worker would therefore run on the Tier 3 model. The host's
+// before_subagent_spawn event lets an extension pin the model: when UKit itself switched this session
+// (recorded selected:true), the agent binds `@default` and the host resolved it to that active model,
+// the worker is pinned back to the project's `default` role model. An explicit caller/user model, a
+// session UKit did not switch, and agents bound to any other role are left to the host.
+export function selectWorkerModel(event, { projectRoot, context = {} } = {}) {
+  try {
+    const agent = String(event?.agent ?? '');
+    if (!/^[A-Za-z0-9._-]+$/.test(agent)) return undefined;
+    const ownSessionId = context.sessionManager?.getSessionId?.() ?? null;
+    const record = readSessionMainModel(projectRoot);
+    if (record?.selected !== true || !record.model) return undefined;
+    // Owner match: the pin describes the session UKit itself switched. A record written by a
+    // DIFFERENT main session (two mains per project) or by a pre-provenance bridge (no stamp)
+    // must never let this session inherit the pin — without this check the second main would
+    // silently run its @default workers off the first main's promotion.
+    if (!recordOwnedBySession(record, ownSessionId)) return undefined;
+    // Respect explicit switches: the pin exists only while this session is still on the model
+    // UKit itself selected. A mismatch means the owner changed models after promotion (omp has
+    // no model_select extension event; the spawn-time active model is the host signal): correct
+    // the same-owner record so resolveMainTier stops reporting the stale role, and leave the
+    // spawn to host inheritance semantics — the explicit model wins.
+    const activeNow = context.model;
+    if (!activeNow || String(activeNow.id ?? '') !== record.model) {
+      recordSessionMainModel(
+        projectRoot,
+        { model: activeNow?.id ?? null, selected: false, reason: 'observed-active-model-changed', observedVia: 'before_subagent_spawn' },
+        { sessionId: ownSessionId },
+      );
+      return undefined;
+    }
+    const agentFile = fs.readFileSync(path.join(projectRoot, '.omp', 'agents', `${agent}.md`), 'utf8');
+    const bound = agentFile.match(/^---\r?\n([\s\S]*?)\r?\n---/)?.[1].match(/^model:\s*["']?([^"'#\s]+)/m)?.[1];
+    if (bound !== '@default') return undefined;
+    const active = context.model;
+    const patterns = Array.isArray(event?.patterns) ? event.patterns.map((p) => String(p).replace(/:(off|minimal|low|medium|high|xhigh|max|auto)$/i, '')) : [];
+    if (!active || patterns.length !== 1 || (patterns[0] !== active.id && patterns[0] !== `${active.provider}/${active.id}`)) return undefined;
+    const def = projectModelRole(projectRoot, 'default');
+    const defaultModel = def ? findRegistryModel(context.modelRegistry, def) : null;
+    if (!defaultModel || (defaultModel.id === active.id && defaultModel.provider === active.provider)) return undefined;
+    return { model: `${defaultModel.provider}/${defaultModel.id}`, note: 'ukit: @default coding worker pinned to modelRoles.default (session orchestrator is on slow)' };
+  } catch {
+    return undefined; // never block a subagent spawn on model bookkeeping
+  }
+}
+
+// Switch/prompt-time OBSERVATION, never initialization: session_switch (and every
+// before_agent_start, for route currency) may only record what the host now reports as the OWNER
+// session's active model. omp 18.10.4 has no model_select extension event, so the active model at
+// these observations is the only host signal that the user explicitly switched models after a
+// promotion; recording it keeps resolveMainTier from reporting a stale slow role. A foreign or
+// legacy (unstamped) record is never claimed and never erased, and NO promotion can happen here —
+// initialization (pi.setModel) stays exclusive to session_start, so a fresh session reached via a
+// switch can never be re-promoted behind the user's back.
+export async function observeMainModel({ projectRoot, context = {}, observedVia = 'observation' } = {}) {
+  // A child session (header.parentSession) never observes, never writes, never claims the slot.
+  if (isSubagentSession(context)) return { action: 'skipped', reason: 'subagent-session' };
+  const active = context.model ?? null;
+  const activeId = active?.id ?? null;
+  const ownSessionId = context.sessionManager?.getSessionId?.() ?? null;
+  const existing = readSessionMainModel(projectRoot);
+  if (!existing || existing.harness !== 'omp') return { action: 'unchanged' };
+  // Refresh ANY same-owner record whose model no longer matches the host-reported active model —
+  // not just a live promotion. Otherwise the FIRST observed switch (smart→code) freezes the
+  // record on code and a later switch (code→smart) would leave it stale forever. The refresh
+  // always records selected:false: an observed model change means the recorded UKit selection is
+  // no longer the session state, so the pin must NOT re-arm here (only session_start promotes).
+  if (!recordOwnedBySession(existing, ownSessionId)) return { action: 'unchanged' };
+  if (!activeId || activeId === existing.model) return { action: 'unchanged' };
+  recordSessionMainModel(
+    projectRoot,
+    { model: activeId, selected: false, reason: 'observed-active-model-changed', observedVia },
+    { sessionId: ownSessionId },
+  );
+  return { action: 'corrected', model: activeId };
+}
+
+// omp emits session_start only at session CREATION; switching sessions dispatches the separate
+// session_switch extension event (verified against omp 18.10.4: the extension host's
+// handler-timeout map lists {session_start, session_switch, session_branch}). The switch lane is
+// observation-only (see observeMainModel) — no setModel, no context chain (exact-once, TASK-042).
+export async function runSessionSwitch(pi, event, { projectRoot, context: extensionContext = {} }) {
+  try {
+    await observeMainModel({ projectRoot, context: extensionContext, observedVia: 'session_switch' });
+  } catch {
+    // switch-time observation must never break the switch
+  }
+  return undefined;
+}
+
 export async function runSessionStart(pi, event, { projectRoot, context: extensionContext = {} }) {
+  try {
+    await selectOrchestratorModel(pi, { projectRoot, context: extensionContext });
+  } catch {
+    // orchestrator selection must never block session start
+  }
   const metadata = runtimeMetadata(event, extensionContext);
   const payload = buildHookPayload('SessionStart', metadata);
   const result = await runScriptChain(pi, HOOK_EVENT_MAP.session_start, payload, { projectRoot });
@@ -1116,6 +1360,7 @@ export async function runSessionStop(
     sessionId: event?.sessionId ?? event?.session_id,
     cwd: extensionContext?.cwd ?? event?.cwd,
     transcriptPath: event?.transcriptPath ?? event?.transcript_path ?? event?.session_file,
+    subagentSession: isSubagentSession(extensionContext) ? true : undefined,
   };
   const payload = buildHookPayload('Stop', metadata);
 
@@ -1273,6 +1518,8 @@ export default function hook(pi) {
   pi.on('before_agent_start', (event, context) => runBeforeAgentStart(pi, event, { projectRoot, context }));
   pi.on('session.compacting', (event, context) => runSessionCompacting(pi, event, { projectRoot, context }));
   pi.on('session_start', (event, context) => runSessionStart(pi, event, { projectRoot, context }));
+  pi.on('session_switch', (event, context) => runSessionSwitch(pi, event, { projectRoot, context }));
   pi.on('session_compact', (event, context) => runSessionCompact(pi, event, { projectRoot, context }));
   pi.on('session_stop', (event, context) => runSessionStop(pi, event, { projectRoot, context }));
+  pi.on('before_subagent_spawn', (event, context) => selectWorkerModel(event, { projectRoot, context }));
 }

package/template_project/ukit/storage/config.json

@@ -155,7 +155,7 @@
   },
   "orchestration": {
     "enabled": true,
-    "orchestratorModel": "claude-sonnet-5",
+    "orchestratorModel": "claude-opus-5",
     "permissionMode": "unattended",
     "allowUnsafeEval": false,
     "contracts": {