Subscription-wide LLM lockout from workflow model inheritance + same-quota-pool fallback chain

An OpenClaw-based assistant on an Anthropic Claude subscription (session ~5h windows + weekly caps) suffered a 3.5h total mid-conversation outage: hitting the session limit locked out BOTH the primary model (claude-fable-5) and the configured fallback (claude-opus-4-8). Proximate cause: a 99-agent Claude Code Workflow fan-out consumed ~2.2M subagent tokens in 17 minutes because every agent() call left model unset and silently inherited the main session's top-tier model at high reasoning effort, on mostly mechanical finder/sweep work. Structural cause: the model fallback chain only walks other models on the SAME subscription, so fallback provides zero protection against limit events — it is decorative under a quota lockout.