An Anthropic model release reaches the API before it reaches your plan. Seven lines of Swift close that gap on a Mac.

There is a window, sometimes minutes, sometimes hours, where Anthropic flips the new alias on at the API and routing layer but a given user's Claude.ai plan has not yet been granted access to it. Inside Fazm that surfaces as a specific shape of agent error: the bridge subprocess returns an `agentError` whose lowercased message contains either `may not exist` and `not have access`, or `model` and `not found`, or `model` and `not available`. Those three substring pairs are exactly what `isModelAccessError(_:)` at /Users/matthewdi/fazm/Desktop/Sources/Providers/ChatProvider.swift lines 1362 to 1368 matches. Anything else is treated as an unrelated bridge error and surfaces normally.

Look at lines 2944 to 2954 of ChatProvider.swift. The catch branch is gated on three conditions stacked with commas: `bridgeMode == "personal"`, the error is a `BridgeError.agentError(let msg)`, and `Self.isModelAccessError(msg)` returns true. When all three are satisfied the branch sets `pendingBridgeModeSwitch = "builtin"`, `retryAfterModelFallback = true`, and `errorMessage = nil`. Setting `errorMessage` to nil is what suppresses the UI banner. The user sees no failure, only a brief delay while the bridge reboots in bundled-key mode and replays the query.

Because the catch is still inside the `do { try ... } catch` of an in-flight query. Tearing down the bridge mid-handler would race with the process-exit path. The actual switch is deferred: handlePostQuery (around line 2965) calls `await applyPendingBridgeModeSwitch()`, which reads `pendingBridgeModeSwitch`, clears it, and runs `await switchBridgeMode(to: pending)`. The deferral pattern is the same one used for the voice-toggle restart, so the bridge teardown is always sequenced after the current query has finished unwinding.

Two characters of environment. The bridge process is restarted by `createBridge()` at ChatProvider.swift lines 492 to 507. In `personal` mode it constructs `ACPBridge(mode: .personalOAuth)` and the `case .personalOAuth` branch at /Users/matthewdi/fazm/Desktop/Sources/Chat/ACPBridge.swift lines 348 to 350 calls `env.removeValue(forKey: "ANTHROPIC_API_KEY")`, forcing the agent SDK to fall back to OAuth. In `builtin` mode it constructs `ACPBridge(mode: .bundledKey(apiKey: apiKey))` and the matching `case .bundledKey(let apiKey)` branch at line 351 to 353 sets `env["ANTHROPIC_API_KEY"] = apiKey`. That single env var is what tells the underlying `@anthropic-ai/claude-agent-sdk` to bill the call against the Fazm Anthropic key instead of the user's OAuth session.

Replays it byte-for-byte. The query text was already stored in `pendingRetryMessage` by `sendMessage(_:)` near line 2305 before the bridge call. The catch branch leaves it in place explicitly (`pendingRetryMessage is already set from sendMessage() — keep it for auto-retry`). Then handlePostQuery at lines 2968 to 2974 reads `if retryAfterModelFallback, let retryText = pendingRetryMessage`, clears the field, logs `auto-retrying query after model access fallback to builtin`, and calls `await sendMessage(retryText)`. The user sees one bubble in the chat, one response back, and the model alias on the pill is the new one Anthropic just shipped.

ChatProvider.swift line 476 declares `static let builtinCostCapUsd: Double = 10.0`, and line 479 declares `@AppStorage("builtinCumulativeCostUsd") var builtinCumulativeCostUsd: Double = 0.0`. After every successful query in builtin mode, lines 2814 to 2816 add `queryResult.costUsd` to `builtinCumulativeCostUsd`, and when the running total crosses 10 dollars the bridge switches itself back to personal mode. Lines 1697 to 1701 also reseed the running total from the Firestore-backed server-side counter on launch, so the cap survives reinstalls. So the model-access fallback is bounded: it gets a user across the rollout window, not a permanent free tier.

Three log lines in sequence. First the bridge reports the model access failure: `ChatProvider: model access error in personal mode, falling back to builtin: model claude-opus-4-7 may not exist or you do not have access to it`. Second the deferred switch fires after handlePostQuery runs: `ChatProvider: applying deferred bridge mode switch to builtin` followed by `ChatProvider: switching bridge mode to builtin (current stored: personal)`. Third the auto-retry: `ChatProvider: auto-retrying query after model access fallback to builtin`. The whole sequence is in the log because every branch logs its own line, so it is easy to grep on a user's machine.

Anthropic's API and the various agent SDKs do not return a stable structured error code for `account does not have access to this model`. The text is human-readable and has shifted at least three times: an older surface returned `the model may not exist or you may not have access to it`, an SDK wrapper at one point returned `model not found`, and the most recent shape the bridge has observed is `model is not available on your account`. A single regex would miss the next phrasing on the next rename. Three independent substring pairs are what makes the matcher robust to the wording without ever needing an app update; it just has to remain `[some prefix] (may not exist + not have access | model + not found | model + not available)`.

Both, with a different ceiling. Free trial users hit the bundled key by default (the bridge boots in builtin mode), and the 10 dollar cap is what defines their trial budget. Paid Pro users on personal OAuth mode are the population this fallback was added for: they expect to use their own Claude.ai plan on the new model, and when the rollout window is open they get auto-routed to the bundled key for the duration of that query, with the 10 dollar cap as the bound. Once Anthropic propagates access to their personal plan, the next manual switch (or the next bridge restart) puts them back on personal OAuth; nothing in the auto-fallback path is sticky across launches.

Two break modes. First, if Anthropic returns the no-access error using a phrase that does not contain any of the three substring pairs, the matcher falls through and the user sees a generic agent error in the chat instead of an automatic fallback. The fix is a single line added to `isModelAccessError(_:)` and a Sparkle update; that is the warning sign. Second, if a future Anthropic release retires the bundled-key path entirely, `KeyService.shared.anthropicAPIKey` would return nil and `createBridge()` line 500 would log `No bundled key available, falling back to personal OAuth`, which means the fallback target itself is no longer available. That has not happened in any release through April 27, 2026.