Scheduled tasks pinned to model: haiku dispatch with permissionMode "default", ignoring permissionMode "auto" in scheduled-tasks.json

Summary

Scheduled tasks whose SKILL.md frontmatter pins model: haiku are dispatched with permissionMode: "default" even though their record in scheduled-tasks.json has "permissionMode": "auto". Tasks pinned to sonnet or opus honor the same flag correctly. The result is that haiku-pinned scheduled tasks silently stall on permission prompts during unattended runs.

Environment

• Claude Desktop for Windows (MSIX install), observed on app versions 2.1.205 and 2.1.209
• Windows 11 Home 10.0.26200
• Scheduled-task registry: %LOCALAPPDATA%\Packages\Claude_pzs8sxrjxfjjc\LocalCache\Roaming\Claude\claude-code-sessions\<id>\<id>\scheduled-tasks.json

Evidence

Registry record (excerpt) — the task is flagged auto:

{
  "id": "bet-daily-summary",
  "cronExpression": "5 12 * * *",
  "enabled": true,
  "permissionMode": "auto",
  ...
}

Run transcripts (~/.claude/projects/<cwd-slug>/*.jsonl) stamp the actual mode on each fire. Two fires from the SAME day (2026-07-16) on the SAME app version (2.1.209):

Haiku-pinned task (model: haiku in SKILL.md frontmatter) — auto flag ignored:

"model":"claude-haiku-4-5-20251001" ... "permissionMode":"default" ... "version":"2.1.209"

Sonnet-pinned task (model: sonnet) — auto flag honored:

"permissionMode":"auto" ... "version":"2.1.209"

A 3-day census (2026-07-13 → 2026-07-16, ~90 fires across 20+ distinct tasks) shows the split is perfectly clean: every fire of every haiku-pinned task ran default; every fire of every sonnet/opus-pinned task ran auto. All of these tasks carry "permissionMode": "auto" in the registry.

Impact

Unattended haiku tasks block on permission prompts and can die mid-run:

• One task's run on 2026-07-15 sat 83 minutes on a shell-command prompt and died without completing (its final tool call never returned; the task's own heartbeat log line was never written).
• Another task stalled 24.5 minutes the same evening on a Write approval for a file path not covered by a settings.json allow rule.

The failure is silent — nothing distinguishes "stalled on a prompt" from "still running" until a human opens the app.

Expected

permissionMode from the scheduled-task record is applied to the run regardless of the model: frontmatter pin.

Workaround in use

Treat haiku-pinned scheduled tasks as if they run in default mode: cover their entire toolset with exact permissions.allow rules in settings.json and forbid ad-hoc shell in their prompts.