diff --git a/docs/settings.md b/docs/settings.md
index eafcad15f..5fa77110d 100644
--- a/docs/settings.md
+++ b/docs/settings.md
@@ -383,7 +383,7 @@ thinkingBudgets:
 | `thinkingBudgets.high` | number | `16384` | Token budget for `high`. |
 | `thinkingBudgets.xhigh` | number | `32768` | Token budget for `xhigh`. |
 | `thinkingBudgets.max` | number | `32768` | Token budget for `max`. |
-| `providers.autoThinkingMaxEffort` | enum | `xhigh` | Highest effort `defaultThinkingLevel: auto` may resolve. `xhigh` keeps the classifier one tier below the top, so only `ultrathink` reaches `max`; `max` lets the classifier bill the top tier on models that expose it. The local on-device classifier stays capped at `xhigh` either way. |
+| `providers.autoThinkingMaxEffort` | enum | `xhigh` | Highest effort `defaultThinkingLevel: auto` may resolve. `xhigh` keeps the classifier one tier below the top, so only `ultrathink` reaches `max`; `max` lets the classifier bill the top tier on models that expose it. The local on-device classifier stays capped at `xhigh` either way. This governs what `auto` *resolves*: a model whose ladder offers nothing under the ceiling gets no auto level at all, and one that also sets `thinking.requiresEffort` still receives its lowest supported effort from the transport — on a `["max"]` ladder that is `max`, because the model accepts nothing else. |
 
 ### Sampling
 
diff --git a/packages/coding-agent/CHANGELOG.md b/packages/coding-agent/CHANGELOG.md
index 6b2db974d..e08fc45d9 100644
--- a/packages/coding-agent/CHANGELOG.md
+++ b/packages/coding-agent/CHANGELOG.md
@@ -6,7 +6,7 @@
 
 - `omp usage` now surfaces auto-disabled credentials as red `✗` tombstone rows (identity, how long ago, the shortened upstream cause — e.g. `Refresh token expired` — and a re-login hint), including a provider section when no active credential remains. User-driven tombstones (`replaced by newer credential`, `deleted by user`) and API-key rows stay hidden. Requires a broker with `GET /v1/credentials/disabled`; older brokers degrade to no tombstone rows.
 - `omp usage` warns about Anthropic's ~30-day OAuth grant lifetime: accounts whose interactive login (`authorizedAt`) is within a week of the deadline get a yellow `⚠ re-login within <time>` line, and past-deadline accounts a red one. Grants die server-side exactly ~30 days after login regardless of refresh rotation, so this is the only warning before the broker auto-disables the row.
-- `providers.autoThinkingMaxEffort` (`xhigh` | `max`, default `xhigh`) raises the ceiling of the `auto` thinking classifier. `max` became a first-class effort tier after the classifier prompt was written, so `auto` could never reach it on models that expose the tier — only the `ultrathink` keyword could. Opting in adds `max` to the classifier's vocabulary, gated on the target model actually supporting it; the default keeps today's prompt byte-for-byte. A classification above the configured ceiling is clamped down before the model clamp, and the on-device 3-bucket classifier stays capped at `xhigh`.
+- `providers.autoThinkingMaxEffort` (`xhigh` | `max`, default `xhigh`) raises the ceiling of the `auto` thinking classifier. `max` became a first-class effort tier after the classifier prompt was written, so `auto` could never reach it on models that expose the tier — only the `ultrathink` keyword could. Opting in adds `max` to the classifier's vocabulary, gated on the target model actually supporting it; the default keeps today's prompt byte-for-byte. The ceiling is enforced inside the effort clamp rather than on the classifier's answer, so a sparse ladder cannot snap an excluded request back up, and the Low floor is still resolved against the model's own ladder. The on-device 3-bucket classifier stays capped at `xhigh` regardless of the setting. The ceiling governs what `auto` resolves: a ladder with nothing underneath it yields no auto level, and a `thinking.requiresEffort` model still gets its lowest supported effort from the transport.
 
 ### Fixed
 
diff --git a/packages/coding-agent/src/auto-thinking/classifier.ts b/packages/coding-agent/src/auto-thinking/classifier.ts
index 62e922e47..70a00f3a3 100644
--- a/packages/coding-agent/src/auto-thinking/classifier.ts
+++ b/packages/coding-agent/src/auto-thinking/classifier.ts
@@ -90,11 +90,12 @@ export async function classifyDifficulty(
 ): Promise<Effort | undefined> {
 	const backend = deps.settings.get("providers.autoThinkingModel");
 	const input = preprocessTinyMessage(promptText);
-	const ceiling = autoEffortCeiling(deps);
-	const effort =
-		backend === ONLINE_AUTO_THINKING_MODEL_KEY
-			? await classifyOnline(input, deps, ceiling)
-			: await classifyLocal(input, backend, deps);
+	const online = backend === ONLINE_AUTO_THINKING_MODEL_KEY;
+	// The 3-bucket local classifier cannot select `max`, so its ceiling stays at
+	// XHigh whatever the setting says — otherwise a sparse ladder would snap its
+	// `hard` bucket up to a tier it never chose.
+	const ceiling = online ? autoEffortCeiling(deps) : Effort.XHigh;
+	const effort = online ? await classifyOnline(input, deps, ceiling) : await classifyLocal(input, backend, deps);
 	// The ceiling goes into the clamp itself: capping the request alone is not
 	// enough, because a sparse ladder snaps an excluded request back up.
 	return clampAutoThinkingEffort(deps.model, effort, ceiling);
diff --git a/packages/coding-agent/src/thinking.ts b/packages/coding-agent/src/thinking.ts
index 9ef31c328..18f206362 100644
--- a/packages/coding-agent/src/thinking.ts
+++ b/packages/coding-agent/src/thinking.ts
@@ -199,9 +199,10 @@ export function parseCliThinkingLevel(value: string | null | undefined): Configu
  * exceeding it, or the pool minimum when the request is below the pool.
  * `ceiling` bounds the pool from above, so a policy ceiling survives the model
  * clamp: a sparse ladder such as `["max"]` must not snap an `xhigh` request up
- * to `max`. When no supported tier sits at or below the ceiling there is
- * nothing legal to pick and the result is `undefined` — auto leaves the current
- * level alone rather than billing a tier the caller excluded.
+ * to `max`. The Low floor is resolved against the model's own ladder *before*
+ * the ceiling applies — a ceiling that hides every tier at or above Low means
+ * there is nothing legal to pick (`undefined`), not a licence to fall through
+ * to a sub-Low tier the model happens to expose.
  *
  * Returns `undefined` for reasoning-capable models without a controllable
  * effort surface (`thinking.efforts` empty — e.g. devin-agent models, where
@@ -219,10 +220,10 @@ export function clampAutoThinkingEffort(
 	if (supported.length === 0) return undefined;
 	const lowIndex = THINKING_EFFORTS.indexOf(Effort.Low);
 	const ceilingIndex = THINKING_EFFORTS.indexOf(ceiling);
-	const withinCeiling = supported.filter(level => THINKING_EFFORTS.indexOf(level) <= ceilingIndex);
-	if (withinCeiling.length === 0) return undefined;
-	const eligible = withinCeiling.filter(level => THINKING_EFFORTS.indexOf(level) >= lowIndex);
-	const pool = eligible.length > 0 ? eligible : withinCeiling;
+	const atOrAboveLow = supported.filter(level => THINKING_EFFORTS.indexOf(level) >= lowIndex);
+	const floored = atOrAboveLow.length > 0 ? atOrAboveLow : supported;
+	const pool = floored.filter(level => THINKING_EFFORTS.indexOf(level) <= ceilingIndex);
+	if (pool.length === 0) return undefined;
 	const requestedIndex = THINKING_EFFORTS.indexOf(effort);
 	let chosen = pool[0];
 	for (const candidate of pool) {
diff --git a/packages/coding-agent/test/auto-thinking-classifier.test.ts b/packages/coding-agent/test/auto-thinking-classifier.test.ts
index 829c1a4b2..e3c793a0f 100644
--- a/packages/coding-agent/test/auto-thinking-classifier.test.ts
+++ b/packages/coding-agent/test/auto-thinking-classifier.test.ts
@@ -116,6 +116,34 @@ describe("auto thinking classifier helpers", () => {
 		}
 	});
 
+	it("keeps the local classifier capped at xhigh even when opted in to max", async () => {
+		// The local backend only ever emits trivial/moderate/hard, so a sparse
+		// ladder must not let the opt-in ceiling snap `hard` up to a tier the
+		// on-device model never selected. `max` is the model's only tier at or
+		// above Low, and the local ceiling hides it, so nothing is eligible —
+		// falling through to `minimal` would breach the Low floor.
+		const fixture = await createLocalClassifierFixture("qwen3-1.7b");
+		const sparse = buildLadderModel("mock-minimal-max", [Effort.Minimal, Effort.Max]);
+		vi.spyOn(tinyModelClient, "complete").mockResolvedValue("hard");
+
+		try {
+			const settings = Settings.isolated({
+				"providers.autoThinkingModel": "qwen3-1.7b",
+				"providers.autoThinkingMaxEffort": "max",
+			});
+
+			expect(
+				await classifyDifficulty("cut over the storage layer", {
+					settings,
+					registry: fixture.registry,
+					model: sparse,
+				}),
+			).toBeUndefined();
+		} finally {
+			fixture.cleanup();
+		}
+	});
+
 	it("uses a larger local non-reasoning classifier floor", async () => {
 		let maxTokens: number | undefined;
 		const fixture = await createLocalClassifierFixture("qwen2.5-1.5b");
@@ -253,7 +281,11 @@ describe("auto thinking classifier helpers", () => {
 		const optedIn = createOnlineFixture(buildLadderModel("mock-max", MAX_LADDER), "high", "max");
 		await classifyDifficulty("refactor the scheduler", optedIn.deps);
 		const optedInRequest = optedIn.completeSimpleMock.mock.calls[0]?.[1] as { systemPrompt: string[] };
+		// The label alone is inert: the criteria and the tie-break exception are
+		// what make the tier reachable, so all three must ship together.
 		expect(optedInRequest.systemPrompt[0]).toContain("`max`");
+		expect(optedInRequest.systemPrompt[0]).toContain("no reproduction to work from");
+		expect(optedInRequest.systemPrompt[0]).toContain("except between `xhigh` and `max`");
 
 		vi.restoreAllMocks();
 
@@ -265,6 +297,7 @@ describe("auto thinking classifier helpers", () => {
 		// The tie-break exception is what makes the top tier reachable, so it must
 		// not leak into the prompt of a user who did not opt in.
 		expect(defaultedRequest.systemPrompt[0]).toContain("choose the lower one.");
+		expect(defaultedRequest.systemPrompt[0]).not.toContain("no reproduction to work from");
 
 		vi.restoreAllMocks();
 
@@ -272,6 +305,7 @@ describe("auto thinking classifier helpers", () => {
 		await classifyDifficulty("refactor the scheduler", unsupported.deps);
 		const unsupportedRequest = unsupported.completeSimpleMock.mock.calls[0]?.[1] as { systemPrompt: string[] };
 		expect(unsupportedRequest.systemPrompt[0]).not.toMatch(/\bmax\b/);
+		expect(unsupportedRequest.systemPrompt[0]).toContain("choose the lower one.");
 	});
 
 	it("resolves max only when opted in, and snaps it to the ceiling otherwise", async () => {
@@ -306,7 +340,7 @@ describe("auto thinking classifier helpers", () => {
 		expect(await classifyDifficulty("untangle this cross-service race", fixture.deps)).toBe(Effort.XHigh);
 	});
 
-	it("never bills a max-only ladder without opt-in", async () => {
+	it("resolves no level on a max-only ladder without opt-in", async () => {
 		// `["max"]` has nothing at or below the default ceiling, so the model clamp
 		// must not snap the request back up — auto yields nothing and the session
 		// keeps its current level.
@@ -323,14 +357,9 @@ describe("auto thinking classifier helpers", () => {
 		expect(resolveProvisionalAutoLevel(buildLadderModel("mock-max-only", [Effort.Max]))).toBeUndefined();
 	});
 
-	it("keeps the ceiling out of the pool for sparse ladders", () => {
-		const maxOnly = buildLadderModel("mock-max-only", [Effort.Max]);
-
-		expect(clampAutoThinkingEffort(maxOnly, Effort.XHigh, Effort.XHigh)).toBeUndefined();
-		expect(clampAutoThinkingEffort(maxOnly, Effort.Max)).toBe(Effort.Max);
-		expect(
-			clampAutoThinkingEffort(buildLadderModel("mock-hm", [Effort.High, Effort.Max]), Effort.Max, Effort.XHigh),
-		).toBe(Effort.High);
+	it("stops at the highest tier under the ceiling on a sparse ladder", async () => {
+		const fixture = createOnlineFixture(buildLadderModel("mock-hm", [Effort.High, Effort.Max]), "max");
+		expect(await classifyDifficulty("cut over the storage layer", fixture.deps)).toBe(Effort.High);
 	});
 
 	it("keeps the provisional auto level below max even when the model defaults to it", () => {