What
A new model_refusal_fallback system event is now emitted over the SDK protocol whenever the primary model returns a safety refusal and the session automatically retries on a fallback model.
Details
- Event fields:
trigger: "refusal",direction: "retry" | "revert" | "sticky",original_model,fallback_model,request_id,api_refusal_category(e.g."cyber","bio"),api_refusal_explanation,retracted_message_uuids retracted_message_uuidslists the wire UUIDs of messages that were rolled back by the fallback — SDK consumers should evict these from transcript state on receipt- The
supersedesfield on incoming messages was also updated: it can now include tombstonedtool_resultframes from the refused leg, not only assistant frames refusalFallbackLaneEnabledandrefusalFallbackSettingToggleVisibleare now communicated from the daemon to the main process at startup rather than read directly from a feature flag, making these states available to SDK consumers via init
Evidence
New schema definition (search for "model_refusal_fallback" and "retracted_message_uuids")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.