From 1f4cdcbbbb4dc30f259c12e3dc751984d8394345 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89verton=20Toffanetto?= <evertondgn@hotmail.com>
Date: Sun, 26 Jul 2026 05:11:53 -0300
Subject: [PATCH] fix(coding-agent): cap the local classifier and keep the Low
 floor
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Two defects in the ceiling work, both found in review.

The local backend shared the online ceiling, so with `autoThinkingMaxEffort:
max` and a sparse ladder the clamp could snap a `hard` bucket up to `max` —
a tier the 3-bucket on-device classifier can never select. The local branch
now pins `xhigh`.

Applying the ceiling before the Low floor also broke the floor's contract:
on `["minimal", "max"]` under an `xhigh` ceiling the intersection hid `max`,
the code concluded the model "maxes out below Low", and it fell through to
`minimal`. The floor is now resolved against the model's own ladder first
and the ceiling filters that pool, so an excluded top tier yields no level
instead of a sub-Low one.

Docs and changelog now scope the guarantee to what `auto` resolves: a
`thinking.requiresEffort` model whose ladder holds nothing under the ceiling
still receives its lowest supported effort from the transport, because it
accepts nothing else. The test that claimed to prove billing is renamed to
say what it checks.

Prompt assertions now cover the `max` criteria and the tie-break exception,
not just the label, since the label alone is inert. Drops the duplicated
pool-level assertions in favour of the contract-level sparse-ladder case.
---
 docs/settings.md                              |  2 +-
 packages/coding-agent/CHANGELOG.md            |  2 +-
 .../src/auto-thinking/classifier.ts           | 11 +++--
 packages/coding-agent/src/thinking.ts         | 15 +++---
 .../test/auto-thinking-classifier.test.ts     | 47 +++++++++++++++----
 5 files changed, 54 insertions(+), 23 deletions(-)

diff --git a/docs/settings.md b/docs/settings.md
index eafcad15f..5fa77110d 100644
--- a/docs/settings.md
+++ b/docs/settings.md
@@ -383,7 +383,7 @@ thinkingBudgets:
 | `thinkingBudgets.high` | number | `16384` | Token budget for `high`. |
 | `thinkingBudgets.xhigh` | number | `32768` | Token budget for `xhigh`. |
 | `thinkingBudgets.max` | number | `32768` | Token budget for `max`. |
-| `providers.autoThinkingMaxEffort` | enum | `xhigh` | Highest effort `defaultThinkingLevel: auto` may resolve. `xhigh` keeps the classifier one tier below the top, so only `ultrathink` reaches `max`; `max` lets the classifier bill the top tier on models that expose it. The local on-device classifier stays capped at `xhigh` either way. |
+| `providers.autoThinkingMaxEffort` | enum | `xhigh` | Highest effort `defaultThinkingLevel: auto` may resolve. `xhigh` keeps the classifier one tier below the top, so only `ultrathink` reaches `max`; `max` lets the classifier bill the top tier on models that expose it. The local on-device classifier stays capped at `xhigh` either way. This governs what `auto` *resolves*: a model whose ladder offers nothing under the ceiling gets no auto level at all, and one that also sets `thinking.requiresEffort` still receives its lowest supported effort from the transport — on a `["max"]` ladder that is `max`, because the model accepts nothing else. |
 
 ### Sampling
 
diff --git a/packages/coding-agent/CHANGELOG.md b/packages/coding-agent/CHANGELOG.md
index 6b2db974d..e08fc45d9 100644
--- a/packages/coding-agent/CHANGELOG.md
+++ b/packages/coding-agent/CHANGELOG.md
@@ -6,7 +6,7 @@
 
 - `omp usage` now surfaces auto-disabled credentials as red `✗` tombstone rows (identity, how long ago, the shortened upstream cause — e.g. `Refresh token expired` — and a re-login hint), including a provider section when no active credential remains. User-driven tombstones (`replaced by newer credential`, `deleted by user`) and API-key rows stay hidden. Requires a broker with `GET /v1/credentials/disabled`; older brokers degrade to no tombstone rows.
 - `omp usage` warns about Anthropic's ~30-day OAuth grant lifetime: accounts whose interactive login (`authorizedAt`) is within a week of the deadline get a yellow `⚠ re-login within <time>` line, and past-deadline accounts a red one. Grants die server-side exactly ~30 days after login regardless of refresh rotation, so this is the only warning before the broker auto-disables the row.
-- `providers.autoThinkingMaxEffort` (`xhigh` | `max`, default `xhigh`) raises the ceiling of the `auto` thinking classifier. `max` became a first-class effort tier after the classifier prompt was written, so `auto` could never reach it on models that expose the tier — only the `ultrathink` keyword could. Opting in adds `max` to the classifier's vocabulary, gated on the target model actually supporting it; the default keeps today's prompt byte-for-byte. A classification above the configured ceiling is clamped down before the model clamp, and the on-device 3-bucket classifier stays capped at `xhigh`.
+- `providers.autoThinkingMaxEffort` (`xhigh` | `max`, default `xhigh`) raises the ceiling of the `auto` thinking classifier. `max` became a first-class effort tier after the classifier prompt was written, so `auto` could never reach it on models that expose the tier — only the `ultrathink` keyword could. Opting in adds `max` to the classifier's vocabulary, gated on the target model actually supporting it; the default keeps today's prompt byte-for-byte. The ceiling is enforced inside the effort clamp rather than on the classifier's answer, so a sparse ladder cannot snap an excluded request back up, and the Low floor is still resolved against the model's own ladder. The on-device 3-bucket classifier stays capped at `xhigh` regardless of the setting. The ceiling governs what `auto` resolves: a ladder with nothing underneath it yields no auto level, and a `thinking.requiresEffort` model still gets its lowest supported effort from the transport.
 
 ### Fixed
 
diff --git a/packages/coding-agent/src/auto-thinking/classifier.ts b/packages/coding-agent/src/auto-thinking/classifier.ts
index 62e922e47..70a00f3a3 100644
--- a/packages/coding-agent/src/auto-thinking/classifier.ts
+++ b/packages/coding-agent/src/auto-thinking/classifier.ts
@@ -90,11 +90,12 @@ export async function classifyDifficulty(
 ): Promise<Effort | undefined> {
 	const backend = deps.settings.get("providers.autoThinkingModel");
 	const input = preprocessTinyMessage(promptText);
-	const ceiling = autoEffortCeiling(deps);
-	const effort =
-		backend === ONLINE_AUTO_THINKING_MODEL_KEY
-			? await classifyOnline(input, deps, ceiling)
-			: await classifyLocal(input, backend, deps);
+	const online = backend === ONLINE_AUTO_THINKING_MODEL_KEY;
+	// The 3-bucket local classifier cannot select `max`, so its ceiling stays at
+	// XHigh whatever the setting says — otherwise a sparse ladder would snap its
+	// `hard` bucket up to a tier it never chose.
+	const ceiling = online ? autoEffortCeiling(deps) : Effort.XHigh;
+	const effort = online ? await classifyOnline(input, deps, ceiling) : await classifyLocal(input, backend, deps);
 	// The ceiling goes into the clamp itself: capping the request alone is not
 	// enough, because a sparse ladder snaps an excluded request back up.
 	return clampAutoThinkingEffort(deps.model, effort, ceiling);
diff --git a/packages/coding-agent/src/thinking.ts b/packages/coding-agent/src/thinking.ts
index 9ef31c328..18f206362 100644
--- a/packages/coding-agent/src/thinking.ts
+++ b/packages/coding-agent/src/thinking.ts
@@ -199,9 +199,10 @@ export function parseCliThinkingLevel(value: string | null | undefined): Configu
  * exceeding it, or the pool minimum when the request is below the pool.
  * `ceiling` bounds the pool from above, so a policy ceiling survives the model
  * clamp: a sparse ladder such as `["max"]` must not snap an `xhigh` request up
- * to `max`. When no supported tier sits at or below the ceiling there is
- * nothing legal to pick and the result is `undefined` — auto leaves the current
- * level alone rather than billing a tier the caller excluded.
+ * to `max`. The Low floor is resolved against the model's own ladder *before*
+ * the ceiling applies — a ceiling that hides every tier at or above Low means
+ * there is nothing legal to pick (`undefined`), not a licence to fall through
+ * to a sub-Low tier the model happens to expose.
  *
  * Returns `undefined` for reasoning-capable models without a controllable
  * effort surface (`thinking.efforts` empty — e.g. devin-agent models, where
@@ -219,10 +220,10 @@ export function clampAutoThinkingEffort(
 	if (supported.length === 0) return undefined;
 	const lowIndex = THINKING_EFFORTS.indexOf(Effort.Low);
 	const ceilingIndex = THINKING_EFFORTS.indexOf(ceiling);
-	const withinCeiling = supported.filter(level => THINKING_EFFORTS.indexOf(level) <= ceilingIndex);
-	if (withinCeiling.length === 0) return undefined;
-	const eligible = withinCeiling.filter(level => THINKING_EFFORTS.indexOf(level) >= lowIndex);
-	const pool = eligible.length > 0 ? eligible : withinCeiling;
+	const atOrAboveLow = supported.filter(level => THINKING_EFFORTS.indexOf(level) >= lowIndex);
+	const floored = atOrAboveLow.length > 0 ? atOrAboveLow : supported;
+	const pool = floored.filter(level => THINKING_EFFORTS.indexOf(level) <= ceilingIndex);
+	if (pool.length === 0) return undefined;
 	const requestedIndex = THINKING_EFFORTS.indexOf(effort);
 	let chosen = pool[0];
 	for (const candidate of pool) {
diff --git a/packages/coding-agent/test/auto-thinking-classifier.test.ts b/packages/coding-agent/test/auto-thinking-classifier.test.ts
index 829c1a4b2..e3c793a0f 100644
--- a/packages/coding-agent/test/auto-thinking-classifier.test.ts
+++ b/packages/coding-agent/test/auto-thinking-classifier.test.ts
@@ -116,6 +116,34 @@ describe("auto thinking classifier helpers", () => {
 		}
 	});
 
+	it("keeps the local classifier capped at xhigh even when opted in to max", async () => {
+		// The local backend only ever emits trivial/moderate/hard, so a sparse
+		// ladder must not let the opt-in ceiling snap `hard` up to a tier the
+		// on-device model never selected. `max` is the model's only tier at or
+		// above Low, and the local ceiling hides it, so nothing is eligible —
+		// falling through to `minimal` would breach the Low floor.
+		const fixture = await createLocalClassifierFixture("qwen3-1.7b");
+		const sparse = buildLadderModel("mock-minimal-max", [Effort.Minimal, Effort.Max]);
+		vi.spyOn(tinyModelClient, "complete").mockResolvedValue("hard");
+
+		try {
+			const settings = Settings.isolated({
+				"providers.autoThinkingModel": "qwen3-1.7b",
+				"providers.autoThinkingMaxEffort": "max",
+			});
+
+			expect(
+				await classifyDifficulty("cut over the storage layer", {
+					settings,
+					registry: fixture.registry,
+					model: sparse,
+				}),
+			).toBeUndefined();
+		} finally {
+			fixture.cleanup();
+		}
+	});
+
 	it("uses a larger local non-reasoning classifier floor", async () => {
 		let maxTokens: number | undefined;
 		const fixture = await createLocalClassifierFixture("qwen2.5-1.5b");
@@ -253,7 +281,11 @@ describe("auto thinking classifier helpers", () => {
 		const optedIn = createOnlineFixture(buildLadderModel("mock-max", MAX_LADDER), "high", "max");
 		await classifyDifficulty("refactor the scheduler", optedIn.deps);
 		const optedInRequest = optedIn.completeSimpleMock.mock.calls[0]?.[1] as { systemPrompt: string[] };
+		// The label alone is inert: the criteria and the tie-break exception are
+		// what make the tier reachable, so all three must ship together.
 		expect(optedInRequest.systemPrompt[0]).toContain("`max`");
+		expect(optedInRequest.systemPrompt[0]).toContain("no reproduction to work from");
+		expect(optedInRequest.systemPrompt[0]).toContain("except between `xhigh` and `max`");
 
 		vi.restoreAllMocks();
 
@@ -265,6 +297,7 @@ describe("auto thinking classifier helpers", () => {
 		// The tie-break exception is what makes the top tier reachable, so it must
 		// not leak into the prompt of a user who did not opt in.
 		expect(defaultedRequest.systemPrompt[0]).toContain("choose the lower one.");
+		expect(defaultedRequest.systemPrompt[0]).not.toContain("no reproduction to work from");
 
 		vi.restoreAllMocks();
 
@@ -272,6 +305,7 @@ describe("auto thinking classifier helpers", () => {
 		await classifyDifficulty("refactor the scheduler", unsupported.deps);
 		const unsupportedRequest = unsupported.completeSimpleMock.mock.calls[0]?.[1] as { systemPrompt: string[] };
 		expect(unsupportedRequest.systemPrompt[0]).not.toMatch(/\bmax\b/);
+		expect(unsupportedRequest.systemPrompt[0]).toContain("choose the lower one.");
 	});
 
 	it("resolves max only when opted in, and snaps it to the ceiling otherwise", async () => {
@@ -306,7 +340,7 @@ describe("auto thinking classifier helpers", () => {
 		expect(await classifyDifficulty("untangle this cross-service race", fixture.deps)).toBe(Effort.XHigh);
 	});
 
-	it("never bills a max-only ladder without opt-in", async () => {
+	it("resolves no level on a max-only ladder without opt-in", async () => {
 		// `["max"]` has nothing at or below the default ceiling, so the model clamp
 		// must not snap the request back up — auto yields nothing and the session
 		// keeps its current level.
@@ -323,14 +357,9 @@ describe("auto thinking classifier helpers", () => {
 		expect(resolveProvisionalAutoLevel(buildLadderModel("mock-max-only", [Effort.Max]))).toBeUndefined();
 	});
 
-	it("keeps the ceiling out of the pool for sparse ladders", () => {
-		const maxOnly = buildLadderModel("mock-max-only", [Effort.Max]);
-
-		expect(clampAutoThinkingEffort(maxOnly, Effort.XHigh, Effort.XHigh)).toBeUndefined();
-		expect(clampAutoThinkingEffort(maxOnly, Effort.Max)).toBe(Effort.Max);
-		expect(
-			clampAutoThinkingEffort(buildLadderModel("mock-hm", [Effort.High, Effort.Max]), Effort.Max, Effort.XHigh),
-		).toBe(Effort.High);
+	it("stops at the highest tier under the ceiling on a sparse ladder", async () => {
+		const fixture = createOnlineFixture(buildLadderModel("mock-hm", [Effort.High, Effort.Max]), "max");
+		expect(await classifyDifficulty("cut over the storage layer", fixture.deps)).toBe(Effort.High);
 	});
 
 	it("keeps the provisional auto level below max even when the model defaults to it", () => {