[AbirAbbas]

Summary

On a local terminal launch whose configured model is not in the listed catalog (for example no key for its provider while a local Ollama is running), the terminal picks the first listed model so the conversation can run. It did not write the profile's talk row, but it switched through the ordinary model setter, so the fallback became the conversation's saved model. The agent then reopened on it (in the desktop app too, where the configured provider worked), and errand routes that fall to the conversation's own model reported it. The chat manual already said "Automatic replacements do not overwrite your saved preference."

Change: a fallback is for that run only.

• session.Agent.UseModelForNow / ConfiguredModel (new, additive): requests use the fallback while the saved model, provider, ModelIdentity.Selected/Models and any main/fallback pair keep naming the configured choice. Execution receipts (requested/active/last) still record what actually ran. An explicit SetModel / SetConversationModels clears the run-only model and saves as before, including when the person chooses the fallback that is already running.
• The linked-local wire carries the new door (internal/remote); an older engine without it keeps the old setter behaviour, and no other wire error falls back to a saving write.
• Terminal (internal/tui3): the availability reconcile and the move after disconnecting the running model's service use the run-only door, asked through the ordered off-loop door line like every engine door. The surface shows the replacement at once and holds nothing; every engine call that starts a turn (plain, attachment, follow-up and errand sends, held and replayed ones included) waits inside its own command for that agent's switch still on the line, so the engine always sees the switch before the message. A refused switch still lets the message go and the next reconcile retries; an explicit pick queued behind it supersedes it. A hidden chat reconciles when it comes back to the front, as before. Renaming a service relabels the saved choice and a run-only model separately, so a rename never saves the fallback; a deferred rename stays with its own chat and a later explicit pick retires it. Every later reconcile (catalog arrival, connection, turn end) prefers the configured model and returns to it as soon as it is listed. A fresh service connect still moves the conversation onto that service and saves it; that is the person's intent, and TestConnectingAServiceMovesTheConversationOntoItsPreferredModel / TestTheMovedModelIsTheOneTheNextLaunchOpensOn are unchanged.
• The linked-local provider-source refresh no longer re-applies the live (fallback) model through the saving setter.
• An explicit choice also clears a run-only model word still queued for the next request.
• start_chat without a model gives the new chat its parent's configured model; the new chat applies its own availability reconcile.
• The implicit credit-default follow (an untouched chat following the build's free/paid default) is unchanged: it is the default moving, not an availability fallback.
• The app reports the configured model for an agent (agents.list / agents.open).
• Unchanged: provider fallback-chain rescue (never persisted), remote --host doors, and the continued-chat replacement for a chat opened on another computer where its model is not set up (that one is persisted by design; later local opens rely on it).

No profile row, tier, role, task-model or app setup write was fed by an availability decision; the trace is in the PR's tests (profile bytes unchanged).

Validation contract → tests

Contract	Tests
C1 the fallback serves requests; after save/close/reopen the saved model, provider, identity and pair are the configured ones	TestRunOnlyModelSurvivesSavingAsTheConfiguredChoice, TestRunOnlyModelKeepsConfiguredProviderWhenDisconnected, TestRunOnlyModelCrossesTheWireWithoutReplacingTheSavedPair, TestCatalogRecoveryUsesConfiguredModelOnTheNextRequest, TestDisconnectMoveStaysTemporaryUntilExplicitlyChosen, TestLinkedLocalSourceRefreshKeepsRunOnlyModelTemporary, TestAppReopensConfiguredModelAfterRunOnlyReplacement
C2 no profile or app-state write (file bytes compared)	TestListedModelReplacementKeepsProfileAndReturnsToConfiguredModel, TestSetupCanExplicitlyChooseTheRunOnlyModel, TestServiceRenamePreservesConfiguredAndRunOnlySelections, TestDeferredRenameStaysWithItsConversationAcrossASwitch, TestLaterExplicitChoiceRetiresTheDeferredRename, TestRunOnlyModelFailureDoesNotCallThePersistentSetter, TestAppReopensConfiguredModelAfterRunOnlyReplacement
C3 the app reports the configured model; the reopened title route follows it	TestAppReopensConfiguredModelAfterRunOnlyReplacement, TestRunOnlyModelSurvivesSavingAsTheConfiguredChoice
C4 the configured model returns as soon as it is listed, with no person action	TestCatalogRecoveryUsesConfiguredModelOnTheNextRequest, TestListedModelReplacementKeepsProfileAndReturnsToConfiguredModel, TestExplicitModelChoiceClearsRunOnlyModel
C5 explicit choices persist as before, including choosing the running fallback; a fresh connect persists	TestExplicitChoiceSupersedesQueuedRunOnlyModel, TestExplicitPickSupersedesAnUnacknowledgedRunOnlySelection, TestPendingExplicitPickSavesAfterLeavingTheConversation, TestStartChatInheritsConfiguredModelFromTemporaryParent, TestRequestedChatSavesConfiguredModelBeforeItsOwnAvailabilityReconcile, TestExplicitModelChoiceClearsRunOnlyModel, TestExplicitPairSelectionClearsTheRunOnlyMain, TestSetupCanExplicitlyChooseTheRunOnlyModel, TestServiceConnectionPersistsIdleAndDeferredMoves
C6 remote doors, older engines, credit follow and rescue unchanged; no engine door asked on the update loop; no send lost or sent ahead of its switch	TestRemoteCatalogDoesNotSelectARunOnlyModel, TestRunOnlyModelFallsBackToTheOlderEngineSetter, TestLegacyRunOnlySelectionUsesTheOffLoopDoor, TestRunOnlySelectionOrdersTheSendOffTheLoop, TestParkedMessageFollowsItsOrderedModelAtStreamClose, TestReplayDeferredSendFollowsItsOrderedModel, TestHeldSendFollowsItsOwnOrderedModel, TestIdleFollowUpFollowsTheOrderedSelection, TestAlternateTurnStartFollowsTheOrderedSelection, TestRefusedRunOnlySelectionStillSendsOnce, TestCancelingSendEndsTheModelWait, TestHiddenChatReconcilesAvailabilityOnlyWhenItReturns, TestCreditDefaultSurvivesListedModelSubmission, existing TestNoEngineDoorIsAskedFromTheUpdateLoop (unchanged, same debt)

Existing tests changed

No assertion changed. Because the run-only switch now lands asynchronously, a few existing tests that drive a replacement add one step that lets it land before their unchanged assertions (modeldefault_test.go, modelservices_test.go disconnect, provideraccess_test.go). TestConnectingAServiceMovesTheConversationOntoItsPreferredModel and TestTheMovedModelIsTheOneTheNextLaunchOpensOn keep their assertions: a fresh connect still saves.

Review round

A fresh review found one blocker (the new door was asked from the update loop, which TestNoEngineDoorIsAskedFromTheUpdateLoop forbids) and four majors (a service rename saved the fallback; a queued run-only word outlived an explicit pick; the credit-default follow fought the reconcile; start_chat inherited the live fallback). All fixed as above; the credit follow is restored to its old behaviour rather than made run-only. Review 2 found two majors in a send gate the fix had added (parked sends, deferred renames across chats); review 3 found two more send roads that gate missed (replay-deferred sends, hidden chats). The gate was replaced by per-agent send ordering, which needs no surface state.

🤖 Generated with Claude Code