fix: allow replacing unavailable conversation models

Persist the selected model before opening dormant sessions, and reconfigure crashed workers on the same account. Preserve session history and report model removal through the model-unavailable contract instead of a generic runtime failure.

electron/coding-runtime/pi/provider-config.ts

@@ -149,11 +149,20 @@ export interface PiWorkerCredentialProjectionSummary {
 }
 
 export class PiProviderConfigError extends Error {
+  readonly publicError?: { code: 'CODING_MODEL_UNAVAILABLE'; message: string; recoverable: true };
+
   constructor(
     public readonly code: 'PROVIDER_INVALID' | 'PROVIDER_AUTH_REQUIRED' | 'MODEL_UNAVAILABLE',
     message: string,
   ) {
     super(message);
+    if (code === 'MODEL_UNAVAILABLE') {
+      this.publicError = {
+        code: 'CODING_MODEL_UNAVAILABLE',
+        message: '所选模型当前不可用，请重新选择。',
+        recoverable: true,
+      };
+    }
   }
 }
 

electron/coding-runtime/pi/runtime.ts

@@ -945,7 +945,8 @@ export class PiConversationRuntime implements CodingConversationRuntime {
       },
       modelResolution: 'resolved',
     };
-    if (snapshot.conversation.model.model?.accountId !== selection.accountId) {
+    if (snapshot.conversation.model.model?.accountId !== selection.accountId
+      || this.pool.getState(input.conversationId)?.state === 'crashed') {
       const persisted = await this.registry.setModel(input.conversationId, model);
       this.replaceModel(input.conversationId, persisted);
       try {