The degradation ladder's startup mode-pick decision: caps + env -> which PaintAuthority profile a session renders through.

This is a PURE function. It never calls System.get_env/1 or does any I/O itself -- callers (the assembled harness's assembler, or a mix run entry point) are responsible for gathering the env map and passing it in, exactly the same discipline Raxol.Terminal.Capabilities.Classifier.classify/3 already uses for its own env seed (env sniffing is only ever a free first-pass seed). Keeping the decision pure is what makes the full mode-pick matrix table-testable without a pty or a real tmux session.

The three tiers

• :inline_log — the default: InlineAuthority (the append path + the footer viewport), full DECSTBM-pinned footer + scrolling history.
• :tmux_conservative — NOT a separate authority module. The tmux tier assumes no OSC marks are consumed, clamps caps, and possibly uses a transient-region algorithm; the capability ladder already clamps %Capabilities{} for a detected multiplexer before it ever reaches InlineAuthority.new/5 (reflow_capable?/1 is conservatively false for anything that isn't measured, and tmux is never on that allowlist); ModeSelect only picks the TIER NAME so a caller knows to route through that same InlineAuthority with the already-clamped capability record it fetched from Capabilities. There is no TmuxConservativeAuthority module and this unit does not add one.
• :flat — FlatAuthority (this unit, sibling module): append-only, zero regions, zero cursor jumps. The screen-reader answer, the CI/pipe answer, the block-hater answer.

Rule order

Mode-pick happens in two passes: first a CANDIDATE mode is resolved (from an explicit override or from auto-detection), then a degenerate-geometry FLOOR is applied to whatever that candidate is. The floor runs LAST, after the candidate is chosen, not as one more item in the override/auto-detect priority list -- see "Why the degenerate floor applies after override resolution" below for why that distinction is load-bearing.

Pass 1: resolve a candidate mode

1. Explicit env override (RAXOL_HARNESS_MODE=flat|tmux|inline, case- and whitespace-insensitive) is the candidate, when recognized. An unrecognized non-empty value does NOT win -- it falls through to auto-detection below, and is surfaced separately via select_with_reason/3's :override_unrecognized reason so a caller can warn instead of silently guessing what the operator meant.
2. Otherwise, auto-detect: a. Headless (TERM=dumb, not a tty, or CI truthy AND not a tty) -> :flat. This has to run before the tmux check: a CI runner piping output through TERM=dumb (or no tty at all) is not a place any cursor-positioning tier belongs, tmux-flavored or not. b. tmux/screen multiplexer detected -> :tmux_conservative. c. Otherwise -> :inline_log.

Pass 2: the degenerate-geometry floor

Degenerate geometry (ScrollRegionManager.degenerate?/2: the terminal is too short to hold a footer plus a 1-row history region) clamps ANY non-:flat candidate down to :flat, regardless of whether that candidate came from an override or from auto-detection. A candidate that is already :flat (override or auto-detected) is left alone -- the floor is a one-way clamp, never a way to escape :flat.

Why the degenerate floor applies after override resolution

This ordering is load-bearing, not cosmetic: a degenerate geometry (too few rows to hold a footer plus a 1-row history region, e.g. rows: 2, footer_rows: 2) means ScrollRegionManager cannot carve out a real history region, so region_top pins at row 1. Every subsequent InlineAuthority seal then issues its append CUP to that same pinned row 1 BEFORE the terminal has scrolled -- each new block overwrites the previous one instead of accumulating (traced on real bytes: L1... then M1..., with L1 clobbered, never reaching scrollback).

That clobber has nothing to do with WHY InlineAuthority was picked -- it fires identically whether the route there was auto-detected tmux (this unit's original regression: a tmux-detected session at degenerate geometry must not fall through to :tmux_conservative, since that tier still reaches the same clobbering InlineAuthority append path) or an operator-supplied RAXOL_HARNESS_MODE=inline/=tmux override picked the same authority explicitly. An override that special-cased itself to skip the floor would reproduce the EXACT byte-traced clobber above, just reached via an exported env var instead of auto-detection -- there is no additional safety purchased by letting an override outrank the floor, only a broken transcript once the geometry turns out to be degenerate at runtime (which the operator setting the override at shell-startup time cannot always know in advance). :flat sidesteps the whole failure mode: it never positions a cursor, so there is no pinned row to clobber, and every sealed line survives in order. That is strictly safer than any cursor-positioning tier at degenerate geometry, for a candidate reached by ANY path, which is why the floor applies uniformly AFTER candidate resolution rather than being folded into the override-vs-auto-detect priority order. A :flat override is always honored -- it is already the floor's own target, so clamping is a no-op -- and a session with ADEQUATE geometry has no pinning problem and keeps whatever candidate it resolved to (override or auto-detected) as before.