arkaos 5.17.1 → 5.17.2

package/VERSION

@@ -1 +1 @@
-5.17.1
+5.17.2

package/arka/skills/costs/SKILL.md

@@ -70,10 +70,10 @@ Outside this skill's scope but worth surfacing alongside the summary:
 | Lever | Where | Effect |
 | --- | --- | --- |
 | `ARKAOS_LLM_PROVIDER` | env | Switch between Anthropic, OpenAI, Gemini adapters per the multi-LLM router. |
-| `fallbackModel` | `~/.claude/settings.json` (Claude Code 2.1.166+) | Up to three models tried in order when the primary is overloaded or unavailable. `npx arkaos install` / `update` seed `["claude-opus-5", "claude-sonnet-5"]` when the key is absent and never overwrite an operator chain; `/arka status` shows the configured chain. |
-| Schedule `model:` / `fallback_models:` | `~/.arkaos/schedules.yaml` | A pinned `model` goes to `claude --model`; without one the Model Fabric `strategy` role becomes `ANTHROPIC_DEFAULT_MODEL` (Claude Code 2.1.236+). `fallback_models` goes to `--fallback-model` (default `claude-opus-5 → claude-sonnet-5`) so one overload or model 404 no longer ends a nightly cycle. |
+| `fallbackModel` | `~/.claude/settings.json` (Claude Code 2.1.166+) | Up to three models tried in order when the primary is overloaded or unavailable. `npx arkaos install` / `update` seed `["claude-opus-5-5", "claude-sonnet-5"]` when the key is absent, upgrade a chain that is exactly a previous ArkaOS default, and never overwrite an operator chain; `/arka status` shows the configured chain. |
+| Schedule `model:` / `fallback_models:` | `~/.arkaos/schedules.yaml` | A pinned `model` goes to `claude --model`; without one the Model Fabric `strategy` role becomes `ANTHROPIC_DEFAULT_MODEL` (Claude Code 2.1.236+). `fallback_models` goes to `--fallback-model` (default `claude-opus-5-5 → claude-sonnet-5`) so one overload or model 404 no longer ends a nightly cycle. |
 | `ANTHROPIC_BEDROCK_SERVICE_TIER` | env (Claude Code 2.1.122+) | `default` / `flex` / `priority`. Only relevant when routing through AWS Bedrock — `flex` cuts cost ~50 % on non-urgent workloads at the price of higher tail latency. |
-| Agent `model:` field | `departments/*/agents/*.yaml` | Per-agent override per the model-routing matrix in CLAUDE.md. Mechanical roles default to `sonnet` at low effort, C-suite to `opus` (Opus 5); the Quality Gate row below lifts Marta / Eduardo / Francisca to the frontier tier. |
+| Agent `model:` field | `departments/*/agents/*.yaml` | Per-agent override per the model-routing matrix in CLAUDE.md. Mechanical roles default to `sonnet` at low effort, C-suite to `opus` (Opus 5.5); the Quality Gate row below lifts Marta / Eduardo / Francisca to the frontier tier. |
 | Quality Gate model | constitution `quality_gate.model_policy` | Marta / Eduardo / Francisca run on the best model available (frontier tier) regardless of the cost ceiling — review quality is never the place to save tokens. |
 
 ## Non-negotiables

package/config/cognition/schedules.yaml

@@ -5,10 +5,10 @@
 #
 # Model pin and fallback chain (Runtime Sync PR3) — per schedule, optional:
 #   model: claude-sonnet-5            # pinned: goes to `claude --model`
-#   fallback_models: [claude-opus-5]  # `--fallback-model a,b`; [] disables
+#   fallback_models: [claude-opus-5-5]  # `--fallback-model a,b`; [] disables
 # Without `model`, the Model Fabric `strategy` role (~/.arkaos/models.yaml)
 # becomes ANTHROPIC_DEFAULT_MODEL for the run. Without `fallback_models`,
-# the chain is claude-opus-5 → claude-sonnet-5. The runtime caps chains at
+# the chain is claude-opus-5-5 → claude-sonnet-5. The runtime caps chains at
 # three models after de-duplication, removes ids outside `availableModels`
 # before the walk and fails over past an id it cannot reach (a retired
 # model); the ArkaOS gateway plays no part in the chain.

package/core/harness/drift.py

@@ -462,25 +462,36 @@ def _check_worktree(report: DriftReport, settings: dict[str, Any]) -> None:
         )
 
 
+def _fallback_finding(status: DriftStatus, detail: str) -> DriftFinding:
+    return DriftFinding("settings:fallbackModel", status, "fallbackModel", detail)
+
+
 def _check_fallback_model(report: DriftReport, settings: dict[str, Any]) -> None:
     """MISSING when the key is absent or JSON null (the seeder writes the
-    default in both cases); ADOPTED for any other value that is not the
-    default — an array, an empty array, or the legacy string form."""
-    from core.runtime.claude_code import DEFAULT_FALLBACK_MODELS
+    default in both cases); DIVERGED when the chain is exactly a default
+    ArkaOS seeded in an earlier release (assert upgrades it); ADOPTED for
+    any other value that is not the default — an array, an empty array,
+    or the legacy string form."""
+    from core.runtime.claude_code import (
+        DEFAULT_FALLBACK_MODELS,
+        is_previous_fallback_default,
+    )
 
     chain = settings.get("fallbackModel")
     if chain is None:
         report.findings.append(
-            DriftFinding(
-                "settings:fallbackModel", DriftStatus.MISSING, "fallbackModel",
-                "fallbackModel chain default not seeded",
-            )
+            _fallback_finding(DriftStatus.MISSING, "fallbackModel chain default not seeded")
+        )
+    elif is_previous_fallback_default(chain):
+        detail = (
+            f"previous ArkaOS default chain ({' → '.join(chain)}); "
+            f"`arka harness assert` upgrades it to {' → '.join(DEFAULT_FALLBACK_MODELS)}"
         )
+        report.findings.append(_fallback_finding(DriftStatus.DIVERGED, detail))
     elif chain != list(DEFAULT_FALLBACK_MODELS):
         report.findings.append(
-            DriftFinding(
-                "settings:fallbackModel", DriftStatus.ADOPTED, "fallbackModel",
-                "operator-configured fallback chain; seed policy adopts it",
+            _fallback_finding(
+                DriftStatus.ADOPTED, "operator-configured fallback chain; seed policy adopts it"
             )
         )
 

package/core/harness/manager.py

@@ -41,7 +41,10 @@ from pathlib import Path
 from core.harness import drift, json_store, paths
 from core.harness.manifest import OwnershipManifest
 from core.harness.spec import HookRegistration, spec_for
-from core.runtime.claude_code import DEFAULT_FALLBACK_MODELS
+from core.runtime.claude_code import (
+    DEFAULT_FALLBACK_MODELS,
+    is_previous_fallback_default,
+)
 
 
 @dataclass
@@ -49,8 +52,8 @@ class SurfaceAction:
     """One thing assert did (or deliberately did not do) to a surface."""
 
     surface: str
-    # created | repaired | unrepaired | reseeded | adopted-skip
-    # | refused | noop
+    # created | repaired | unrepaired | reseeded | upgraded
+    # | adopted-skip | refused | noop
     action: str
     detail: str = ""
 
@@ -353,13 +356,23 @@ class ClaudeConfigManager:
     def _assert_seed(
         self, settings: dict, report: AssertReport, reseed: bool
     ) -> None:
-        for surface, key, default, is_ours in _seed_surfaces(self):
+        for surface, key, default, is_ours, is_previous in _seed_surfaces(self):
             current = settings.get(key)
             if current is None:
                 settings[key] = default
                 report.actions.append(SurfaceAction(surface, "created"))
             elif is_ours(current):
                 report.actions.append(SurfaceAction(surface, "noop"))
+            elif is_previous(current):
+                # A chain ArkaOS itself seeded before is not an operator
+                # decision: move it to the current default.
+                settings[key] = default
+                report.actions.append(
+                    SurfaceAction(
+                        surface, "upgraded",
+                        "previous ArkaOS default; moved to the current default",
+                    )
+                )
             elif reseed:
                 settings[key] = default
                 report.actions.append(SurfaceAction(surface, "reseeded"))
@@ -531,20 +544,27 @@ def _user_deny_extensions(home: Path | None) -> list[str]:
     return [r for r in raw if isinstance(r, str) and r]
 
 
+def _never_previous(_value: object) -> bool:
+    """Surfaces with no history of ArkaOS-authored defaults to upgrade."""
+    return False
+
+
 def _seed_surfaces(manager: ClaudeConfigManager):
     statusline = _statusline_default(manager)
     return (
         (
             "settings:statusLine", "statusLine", statusline,
-            drift._is_arkaos_statusline,
+            drift._is_arkaos_statusline, _never_previous,
         ),
         (
             "settings:worktree", "worktree", {"baseRef": "head"},
             lambda v: isinstance(v, dict) and v.get("baseRef") == "head",
+            _never_previous,
         ),
         (
             "settings:fallbackModel", "fallbackModel", list(DEFAULT_FALLBACK_MODELS),
             lambda v: v == list(DEFAULT_FALLBACK_MODELS),
+            is_previous_fallback_default,
         ),
     )
 

package/core/runtime/claude_code.py

@@ -108,7 +108,19 @@ _PROBE_TIMEOUT_SECONDS = 10
 # model is overloaded or unavailable; the runtime caps chains at three after
 # de-duplication. installer/fallback-model.js carries the same list —
 # tests/python/test_scheduler_daemon.py pins the two to each other.
-DEFAULT_FALLBACK_MODELS: tuple[str, ...] = ("claude-opus-5", "claude-sonnet-5")
+DEFAULT_FALLBACK_MODELS: tuple[str, ...] = ("claude-opus-5-5", "claude-sonnet-5")
+# Chains ArkaOS ITSELF seeded in earlier releases. A settings.json holding one
+# of these byte for byte is not an operator decision, so the seeder and
+# `arka harness assert` upgrade it to DEFAULT_FALLBACK_MODELS; any other
+# present value is the operator's and stays. Append, never edit — the JS twin
+# in installer/fallback-model.js is pinned to this list by the same test.
+PREVIOUS_FALLBACK_DEFAULTS: tuple[tuple[str, ...], ...] = (("claude-opus-5", "claude-sonnet-5"),)
+
+
+def is_previous_fallback_default(chain: object) -> bool:
+    """True when ``chain`` is exactly a chain ArkaOS seeded in the past."""
+    return isinstance(chain, list) and tuple(chain) in PREVIOUS_FALLBACK_DEFAULTS
+
 
 # Cache for the `claude --version` probe, keyed by the binary probed ("" =
 # the PATH lookup). In-memory only: a disk cache would let one session

package/core/runtime/gateway/litellm_config.py

@@ -51,10 +51,11 @@ _SLOT_ROLE: dict[str, str] = {
 
 # runtime-tier tokens -> real Anthropic model ids the proxy calls upstream.
 # Real ids (claude-fable-5-1, claude-*) pass straight through.
-# Runtime Sync 2026-09-03: `best` is Fable 5.1, `opus` is Opus 5, and the
-# weakest lane (`haiku`/`fast`) is Sonnet 5 — ArkaOS never routes to Haiku.
+# Runtime Sync 2026-09-03 (+ Opus 5.5 sweep 2026-09-22): `best` is Fable 5.1,
+# `opus` is Opus 5.5 (the id the Claude Code 2.1.280 alias resolves to), and
+# the weakest lane (`haiku`/`fast`) is Sonnet 5 — ArkaOS never routes to Haiku.
 _RUNTIME_TO_ANTHROPIC: dict[str, str] = {
-    "opus": "claude-opus-5",
+    "opus": "claude-opus-5-5",
     "best": "claude-fable-5-1",
     "fable": "claude-fable-5-1",
     "sonnet": "claude-sonnet-5",

package/core/runtime/model_router.py

@@ -55,18 +55,23 @@ KNOWN_EFFORTS = ("low", "medium", "high", "max")
 
 _ALIAS_NAMES = frozenset({"best", "default", "fast"})
 
-# Runtime Sync 2026-09-03 — ids that no longer exist, or lanes ArkaOS no
-# longer routes to (Opus 4.x → Opus 5, Fable 5 → Fable 5.1, Haiku → Sonnet 5).
-# Normalised when a role is RESOLVED; the operator's models.yaml is never
-# rewritten. One stderr notice per process per id, so a stale pin is
-# visible without becoming noise.
+# Runtime Sync 2026-09-03 (Opus 4.x → Opus 5, Fable 5 → Fable 5.1, Haiku →
+# Sonnet 5) and the Opus 5.5 sweep 2026-09-22 (Opus 5 → Opus 5.5) — ids that
+# no longer exist, or lanes ArkaOS no longer routes to. Normalised when a
+# role is RESOLVED; the operator's models.yaml is never rewritten. One
+# stderr notice per process per id, so a stale pin is visible without
+# becoming noise. Legacy ids map straight to the CURRENT lane — the lookup
+# is a single dict read, not a transitive walk, so no value may be a key.
+LEGACY_SYNC_DATE = "2026-09-22"
 LEGACY_MODEL_IDS: dict[str, str] = {
     "claude-fable-5": "claude-fable-5-1",
     "claude-fable-5[1m]": "claude-fable-5-1[1m]",
-    "claude-opus-4-8": "claude-opus-5",
-    "claude-opus-4-8[1m]": "claude-opus-5[1m]",
-    "claude-opus-4-7": "claude-opus-5",
-    "claude-opus-4-6": "claude-opus-5",
+    "claude-opus-5": "claude-opus-5-5",
+    "claude-opus-5[1m]": "claude-opus-5-5[1m]",
+    "claude-opus-4-8": "claude-opus-5-5",
+    "claude-opus-4-8[1m]": "claude-opus-5-5[1m]",
+    "claude-opus-4-7": "claude-opus-5-5",
+    "claude-opus-4-6": "claude-opus-5-5",
     "claude-haiku-4-5-20251001": "claude-sonnet-5",
     "claude-haiku-4-5": "claude-sonnet-5",
     "haiku": "sonnet",
@@ -89,7 +94,8 @@ def normalise_model_id(model: str, source: str = "models.yaml") -> str:
         _LEGACY_NOTICED.add((source, model))
         print(
             f"[arka:warn] {source} pins legacy model {model!r}; resolving as "
-            f"{current!r} (Runtime Sync 2026-09-03). Update the pin to silence this.",
+            f"{current!r} (retired lane; last sweep {LEGACY_SYNC_DATE}). "
+            "Update the pin to silence this.",
             file=sys.stderr,
         )
     return current

package/core/runtime/pricing.py

@@ -6,7 +6,8 @@ their public per-token pricing. It is used to compute an optional
 any model-selection logic — that is explicitly forbidden by the
 LLM-agnostic contract.
 
-Snapshot 2026-09-03 (Runtime Sync PR-2): values sourced from the public
+Snapshot 2026-09-03 (Runtime Sync PR-2), Opus 5.5 rows added 2026-09-22:
+values sourced from the public
 Anthropic pricing page (https://platform.claude.com/docs/en/about-claude/pricing) and
 OpenAI (https://openai.com/api/pricing). Refresh when model families
 change. Unknown models return `None` from `estimate_cost_usd` and are
@@ -61,11 +62,32 @@ PRICING: dict[str, dict[str, float]] = {
         "cache_read": 1.00,
         "cache_write": 12.50,
     },
-    # Snapshot 2026-08-09 (Gate Economy PR-8): drop-in at Opus 4.8's
-    # rates per the official model catalog — 1M context is the default
-    # with NO long-context premium, so the [1m] alias prices the same.
-    # This row was missing while claude-opus-5 carried 28% of weekly
+    # Snapshot 2026-09-22 (Opus 5.5 sweep): $4 / $20 per MTok and cache
+    # reads at $0.20 (0.05x input) per the public pricing page; the Claude
+    # Code 2.1.280 alias `opus` resolves here, so this is the lane every
+    # `model: opus` agent runs on. cache_write is NOT published yet: 5.00
+    # is the standard 1.25x five-minute multiplier — the same assumption
+    # the Fable 5.1 row shipped with — replace it when the page lists it.
+    # 1M context is native; the [1m] alias prices the same.
+    "claude-opus-5-5": {
+        "input": 4.00,
+        "output": 20.00,
+        "cache_read": 0.20,
+        "cache_write": 5.00,
+    },
+    "claude-opus-5-5[1m]": {
+        "input": 4.00,
+        "output": 20.00,
+        "cache_read": 0.20,
+        "cache_write": 5.00,
+    },
+    # History — snapshot 2026-08-09 (Gate Economy PR-8): drop-in at Opus
+    # 4.8's rates per the official model catalog — 1M context is the
+    # default with NO long-context premium, so the [1m] alias prices the
+    # same. The row was missing while claude-opus-5 carried 28% of weekly
     # input tokens, pricing them at $0.00 and blinding the CostGovernor.
+    # Retained so 2026-08/09 sessions stay priced; the live lane is
+    # claude-opus-5-5 above.
     "claude-opus-5": {
         "input": 5.00,
         "output": 25.00,

package/core/runtime/runtime_models.py

@@ -3,14 +3,16 @@
 The Model Fabric ``runtime`` provider shells out to the active CLI. This
 module lists the concrete models that CLI accepts, with human labels and
 tier, so the dashboard dropdown and ``/arka-fusion`` can offer real
-choices (Fable 5.1, Opus 5, Sonnet 5) instead of only the abstract
+choices (Fable 5.1, Opus 5.5, Sonnet 5) instead of only the abstract
 best/default/fast aliases. Haiku is deliberately absent: the weakest
 lane ArkaOS routes to is Sonnet 5 (operator decision, Runtime Sync 2026-09-03).
 
-Model IDs verified against the Claude Code changelog 2.1.257 (2026-09-01)
-and the model-config reference (2026-09). This is the single place they
-are hand-listed — update HERE when the runtime
-ships new models; the dashboard and CLI read from this module. Codex /
+Model IDs verified against the Claude Code 2.1.280 alias table (2026-09-22:
+`opus` → claude-opus-5-5) and the model-config reference (2026-09). This is the single place
+the picker catalogue is hand-listed — update HERE when the runtime ships new
+models; the dashboard and CLI read from this module. The ids also live in
+pricing.py, model_router.py, claude_code.py, gateway/litellm_config.py and
+installer/fallback-model.js (one sweep touches all six). Codex /
 Gemini / Cursor models are left empty on purpose: we do not hardcode
 another vendor's catalogue, and the UI falls back to a free-text field
 so the user types the exact id their runtime accepts.
@@ -24,8 +26,8 @@ from __future__ import annotations
 CLAUDE_CODE_MODELS: list[dict[str, str]] = [
     {"value": "claude-fable-5-1", "label": "Fable 5.1", "tier": "frontier",
      "note": "most capable — 1M context, cache reads $0.25/MTok"},
-    {"value": "opus", "label": "Opus 5", "tier": "frontier",
-     "note": "frontier"},
+    {"value": "opus", "label": "Opus 5.5", "tier": "frontier",
+     "note": "frontier — $4/$20 per MTok, cache reads $0.20"},
     {"value": "sonnet", "label": "Sonnet 5", "tier": "balanced",
      "note": "balanced speed/quality — also the mechanical lane"},
 ]

package/dashboard/app/pages/models.vue

@@ -128,7 +128,7 @@ const targetOptions = computed(() => {
   const o = overview.value
   if (!o) return []
   const options: { label: string, value: string }[] = []
-  // Concrete runtime models first (Fable 5.1, Opus 5, Sonnet 5) so the
+  // Concrete runtime models first (Fable 5.1, Opus 5.5, Sonnet 5) so the
   // operator picks a real model, not just an abstract alias.
   for (const m of o.runtime?.models ?? []) {
     options.push({ label: `runtime / ${m.label} · ${m.note}`, value: `runtime/${m.value}` })

package/installer/fallback-model.js

@@ -5,64 +5,115 @@
 // unavailable (the runtime de-duplicates and caps the chain at three).
 // Without it a single overload or model 404 ends the session — the
 // scheduler's nightly cycles died exactly that way. ArkaOS seeds the
-// chain Opus 5 → Sonnet 5, the lanes below Fable 5.1 in the Model Fabric.
+// chain Opus 5.5 → Sonnet 5, the lanes below Fable 5.1 in the Model Fabric.
 //
 // Behaviour (same contract as worktree-baseref.js):
 //   - No-op when runtime is not Claude Code.
-//   - Only sets the value when the key is absent or JSON null. An operator
-//     chain — an array, an explicit empty array, or the legacy string form
-//     — is preserved byte for byte (a default the operator may replace).
+//   - Sets the value when the key is absent or JSON null, and UPGRADES a
+//     chain that is exactly a default ArkaOS itself seeded in an earlier
+//     release (PREVIOUS_FALLBACK_DEFAULTS). Any other operator chain — an
+//     array, an explicit empty array, or the legacy string form — is
+//     preserved byte for byte.
 //   - Atomic write via .tmp + rename.
 //   - Never raises — failures are non-fatal.
 //
-// core/runtime/claude_code.py:DEFAULT_FALLBACK_MODELS carries the same
-// list; tests/python/test_scheduler_daemon.py pins the two to each other.
+// core/runtime/claude_code.py carries the same DEFAULT_FALLBACK_MODELS and
+// PREVIOUS_FALLBACK_DEFAULTS; tests/python/test_scheduler_daemon.py pins
+// the two files to each other.
 
 import { existsSync, readFileSync, writeFileSync, renameSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
 
-export const DEFAULT_FALLBACK_MODELS = ["claude-opus-5", "claude-sonnet-5"];
+export const DEFAULT_FALLBACK_MODELS = ["claude-opus-5-5", "claude-sonnet-5"];
+// Chains ArkaOS itself seeded before — upgraded, not preserved. Append only;
+// keep each literal on one line (the Python parity test JSON-parses it).
+export const PREVIOUS_FALLBACK_DEFAULTS = [["claude-opus-5", "claude-sonnet-5"]];
 
+function sameChain(a, b) {
+  return Array.isArray(a) && Array.isArray(b) && a.length === b.length
+    && a.every((id, i) => id === b[i]);
+}
 
-export function seedFallbackModel({
-  runtime = "claude-code",
-  home = homedir(),
-  defaultValue = DEFAULT_FALLBACK_MODELS,
-} = {}) {
-  if (runtime !== "claude-code") {
-    return { skipped: "runtime-not-claude-code", action: null };
-  }
-  const settingsPath = join(home, ".claude", "settings.json");
+function isPreviousDefault(value) {
+  return PREVIOUS_FALLBACK_DEFAULTS.some((prev) => sameChain(prev, value));
+}
+
+
+// The settings object, or the `skipped` reason the seeder reports as-is.
+function readSettingsObject(settingsPath) {
   if (!existsSync(settingsPath)) {
-    return { skipped: "claude-settings-not-found", action: null };
+    return { skipped: "claude-settings-not-found" };
   }
   let settings;
   try {
     settings = JSON.parse(readFileSync(settingsPath, "utf-8"));
   } catch {
-    return { skipped: "settings-not-parseable", action: null };
+    return { skipped: "settings-not-parseable" };
   }
   if (typeof settings !== "object" || settings === null || Array.isArray(settings)) {
-    return { skipped: "settings-not-object", action: null };
+    return { skipped: "settings-not-object" };
   }
-  const existing = settings.fallbackModel;
-  if (existing !== undefined && existing !== null) {
-    // Present in any non-null shape is the operator's choice: an array, an
-    // empty array (chain disabled on purpose) or the legacy single string.
-    // JSON null reads as unset (the runtime, drift and the config manager
-    // agree), so it is seeded like an absent key.
-    return { skipped: null, action: "noop", value: existing };
+  return { settings };
+}
+
+// What the seeder does with the value already under `fallbackModel`:
+//   created  — key absent or JSON null (the runtime, drift and the config
+//              manager all read null as unset);
+//   upgraded — exactly a chain ArkaOS itself seeded before, and not the
+//              chain being seeded now (a custom defaultValue may equal it):
+//              written by us, not by the operator, so it moves on;
+//   noop     — any other present value is the operator's choice: an array,
+//              an empty array (chain disabled on purpose) or the legacy
+//              single string, preserved byte for byte.
+function seedAction(existing, defaultValue) {
+  if (existing === undefined || existing === null) {
+    return "created";
   }
-  const value = [...defaultValue];
-  settings.fallbackModel = value;
+  if (isPreviousDefault(existing) && !sameChain(existing, defaultValue)) {
+    return "upgraded";
+  }
+  return "noop";
+}
+
+// Atomic write via .tmp + rename; false on any failure (the seeder never raises).
+function writeSettingsAtomic(settingsPath, settings) {
   const tmp = `${settingsPath}.tmp-${process.pid}`;
   try {
     writeFileSync(tmp, JSON.stringify(settings, null, 2) + "\n");
     renameSync(tmp, settingsPath);
+    return true;
   } catch {
+    return false;
+  }
+}
+
+export function seedFallbackModel({
+  runtime = "claude-code",
+  home = homedir(),
+  defaultValue = DEFAULT_FALLBACK_MODELS,
+} = {}) {
+  if (runtime !== "claude-code") {
+    return { skipped: "runtime-not-claude-code", action: null };
+  }
+  const settingsPath = join(home, ".claude", "settings.json");
+  const loaded = readSettingsObject(settingsPath);
+  if (loaded.skipped) {
+    return { skipped: loaded.skipped, action: null };
+  }
+  const { settings } = loaded;
+  const existing = settings.fallbackModel;
+  const action = seedAction(existing, defaultValue);
+  if (action === "noop") {
+    return { skipped: null, action, value: existing };
+  }
+  const value = [...defaultValue];
+  settings.fallbackModel = value;
+  if (!writeSettingsAtomic(settingsPath, settings)) {
     return { skipped: "write-failed", action: null };
   }
-  return { skipped: null, action: "created", value };
+  return action === "upgraded"
+    ? { skipped: null, action, value, previous: existing }
+    : { skipped: null, action, value };
 }

package/installer/index.js

@@ -433,15 +433,18 @@ export async function install({ runtime, path, force, skipSystem, withOllama, pr
     detail(`         Warning: could not seed worktree.baseRef (${err.message})`);
   }
 
-  // Runtime Sync PR3 — seed fallbackModel = ["claude-opus-5", "claude-sonnet-5"]
-  // so an overloaded or unavailable primary degrades instead of failing the
-  // session. If-absent only: an operator chain (array or legacy string) is
-  // never touched.
+  // Runtime Sync PR3 — seed fallbackModel = DEFAULT_FALLBACK_MODELS (see
+  // fallback-model.js) so an overloaded or unavailable primary degrades
+  // instead of failing the session. Absent keys are seeded and a chain that
+  // is exactly a previous ArkaOS default is upgraded; an operator chain
+  // (array or legacy string) is never touched.
   try {
     const { seedFallbackModel } = await import("./fallback-model.js");
     const fbResult = seedFallbackModel({ runtime });
     if (!fbResult.skipped && fbResult.action === "created") {
       detail(`         fallbackModel set to ${JSON.stringify(fbResult.value)}.`);
+    } else if (!fbResult.skipped && fbResult.action === "upgraded") {
+      detail(`         fallbackModel upgraded from ${JSON.stringify(fbResult.previous)} to ${JSON.stringify(fbResult.value)}.`);
     }
   } catch (err) {
     detail(`         Warning: could not seed fallbackModel (${err.message})`);

package/installer/update.js

@@ -244,13 +244,16 @@ export async function update({ skillsFlag = "" } = {}) {
     warn(`Output style update failed (${err.message})`);
   }
   // Runtime Sync PR3 — seed fallbackModel on update too, so machines that
-  // installed before the chain existed get it. If-absent only: an operator
-  // chain (array, empty array or legacy string) is never touched.
+  // installed before the chain existed get it, and a chain that is exactly
+  // a previous ArkaOS default moves to the current one. An operator chain
+  // (array, empty array or legacy string) is never touched.
   try {
     const { seedFallbackModel } = await import("./fallback-model.js");
     const fbResult = seedFallbackModel({ runtime: manifest.runtime || "claude-code" });
     if (!fbResult.skipped && fbResult.action === "created") {
       ok(`fallbackModel set to ${JSON.stringify(fbResult.value)}`);
+    } else if (!fbResult.skipped && fbResult.action === "upgraded") {
+      ok(`fallbackModel upgraded from ${JSON.stringify(fbResult.previous)} to ${JSON.stringify(fbResult.value)}`);
     }
   } catch (err) {
     warn(`fallbackModel seed failed (${err.message})`);

package/knowledge/skills-manifest.json

@@ -1,7 +1,7 @@
 {
   "_meta": {
     "generator": "scripts/marketplace_gen.py",
-    "version": "5.17.1",
+    "version": "5.17.2",
     "marketplace": "arkaos"
   },
   "structural": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "arkaos",
-  "version": "5.17.1",
+  "version": "5.17.2",
   "description": "The Operating System for AI Agent Teams",
   "type": "module",
   "bin": {

package/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "arkaos-core"
-version = "5.17.1"
+version = "5.17.2"
 description = "Core engine for ArkaOS — The Operating System for AI Agent Teams"
 readme = "README.md"
 license = {text = "MIT"}