diff --git a/MEMORY.md b/MEMORY.md
index 2c5fa4d..20a7b75 100644
--- a/MEMORY.md
+++ b/MEMORY.md
@@ -37,7 +37,10 @@
 
 ## 7) Model policy (current preference)
 - Historical temporary preference once was: all subagents **primary** = `openai-codex/gpt-5.2`, **fallback** = `github-copilot/claude-opus-4.6`.
-- Current important exception / newer rule: **codex_worker** should use **primary** = `openai-codex/gpt-5.4`, prefer high/extra/xhigh thinking when available, and should **not auto-fallback** to another model. If its primary model is unavailable, report to Tao and let Tao decide the replacement model.
+- Current important exception / newer rule: **execution agents** (esp. `codex_worker`, and by default other workers unless Tao says otherwise) must target **primary** = `openai-codex/gpt-5.4`.
+  - **No silent fallback:** if the system falls back to any other model (or if `openai-codex/gpt-5.4` becomes unknown/unavailable), main must **immediately notify Tao**.
+  - **No auto-fallback for execution agents:** if 5.4 is unavailable, workers should not continue on another model; main should report and wait for Tao’s model decision.
+  - If an execution agent is not responding, main must consider **model unavailability/fallback** as a first-class suspected cause and **tell Tao**.
 - Additional long-lived execution agents initialized locally for repeat use: **docs_worker**, **qa_worker**, **ops_worker**.
 - Execution-agent system needs a standardized dispatch/handoff layer: task input template, result format, blocker/escalation rules, and a **main-to-Tao forwarding rule**.
 - **Hard reporting/forwarding protocol (must-follow):**
diff --git a/memory/2026-03-08-model-fallback-rule.md b/memory/2026-03-08-model-fallback-rule.md
new file mode 100644
index 0000000..4d4446c
--- /dev/null
+++ b/memory/2026-03-08-model-fallback-rule.md
@@ -0,0 +1,8 @@
+# 2026-03-08 model fallback hard rule
+
+User reported: a previous PR to enable GPT-5.4 support was broken again; today gateway logs show `FailoverError: Unknown model: openai-codex/gpt-5.4`. Tao assumed main + workers were still running 5.4.
+
+New hard rule requested by Tao:
+- If main or any execution agent falls back from `openai-codex/gpt-5.4` (or 5.4 becomes unknown/unavailable), **main must notify Tao immediately**.
+- Execution agents must be fixed to 5.4 and **must not silently fall back**. If 5.4 is unavailable, pause and ask Tao for model decision.
+- If an execution agent is not responding, main must treat **fallback/unavailability** as a primary suspected cause and tell Tao (not just assume “stuck”).