fix(coding): preserve runtime model and failure contracts

.project-docs/30-worklog/tasks/20260823-pi-core-host-api-a17f6c2e.md

@@ -96,6 +96,17 @@
   cleanup, and stable fixed Host error projection including storage failures.
 - PI-105 remains closed; its vendor-neutral project seam and live target
   `get_commands` seam were accepted structurally.
+- Planner re-review of cumulative HEAD `52b2467` again concluded `NEEDS FIX`
+  and kept the Ready Frontier at `{PI-100}`. The three remaining P1 gaps were
+  resolved/active Conversation model switching bypassing `runtime.setModel()`,
+  credential-refresh rejection escaping the auth-required contract, and
+  unmapped thinking/session-binding/runtime-model persistence failures.
+- The incremental correction keeps unresolved first-model selection on the
+  validate/persist/initial-prepare path, restores target-only runtime model
+  switching for resolved Conversations without disposal, types every
+  production credential-refresh failure as authentication failure, and maps
+  Pi session registry binding/model writes plus service thinking writes to the
+  stable storage failure contract.
 
 ## Outcome
 
@@ -118,30 +129,37 @@
 - Provider changes advance the Pi provider revision, project config/knowledge
   changes advance the resource revision and invalidate cached Agent resources,
   and deactivating a project disposes its Conversation workers/interactions.
+- Resolved model changes reuse the target runtime's `setModel` operation and do
+  not dispose an active worker; unresolved Conversations still persist the
+  validated first model before lazy preparation. Provider refresh rejection is
+  projected as `CODING_PROVIDER_AUTH_REQUIRED`, while authoritative
+  Conversation/session write failures are projected as
+  `CODING_STORAGE_WRITE_FAILED`.
 - No Renderer route was migrated here; PI-110 remains the next consumer of the
   new Main contract. Old `/api/opencode` removal remains PI-140 scope.
 
 ## Verification
 
 - `pnpm install --frozen-lockfile` — Passed using the repository-pinned pnpm.
-- `pnpm run typecheck` — Passed after final implementation changes.
+- `pnpm run typecheck` — Passed after the latest review corrections.
 - `pnpm run lint:check` — Passed with zero errors; six existing Renderer
   warnings remain outside PI-100-owned files.
-- Focused PI/coding/provider suites — Passed: 7 files / 53 tests.
-- In-memory Conversation contract plus PI-100 Host/SSE suite — Passed: 2 files /
-  23 tests. Coverage includes local-only create, one Main composition, concurrent
-  dedupe, uncertain no-resend, global and target snapshot-first streams, real
-  HTTP SSE ordering, interaction route ID correlation, command degradation, and
-  runtime error redaction.
-- `pnpm test` — Passed: 208 files / 2247 tests passed, 2 skipped.
+- Latest review-focused suites — Passed: 4 files / 26 tests. Coverage adds
+  resolved active-run target-only model switching without disposal,
+  credential-refresh rejection and missing refreshed Works credentials,
+  first session-binding write failure, runtime model metadata write failure,
+  and service thinking metadata write failure.
+- `pnpm test` — Passed after the latest corrections: 209 files / 2263 tests
+  passed, 2 skipped (2265 total).
 - `pnpm run build:vite` — Passed for Renderer, Electron Main, Preload, and
   utility worker. Existing dynamic-import/chunk-size warnings remain.
-- `pnpm run test:e2e` — Production build passed and 27/28 Windows Electron tests
-  passed. The pre-existing OpenCode slash-command assertion failed because its
-  legacy `/command` request omitted `model`; isolated rerun reproduced it. This
-  task changes no Renderer file, OpenCode command route, or slash-command spec,
-  and the new composition performs no runtime/provider/project read before a
-  coding Snapshot/execution request, so no causal PI-100 path was found.
+- `pnpm run test:e2e` — Earlier cumulative PI-100 verification built the
+  production app and passed 27/28 Windows Electron tests. The pre-existing
+  OpenCode slash-command assertion failed because its legacy `/command` request
+  omitted `model`; isolated rerun reproduced it. The latest correction changes
+  only target model/auth/storage failure paths plus unit tests, so this legacy
+  E2E was not rerun. No Renderer, OpenCode command route, or slash-command spec
+  is changed by PI-100.
 - Real external Provider turns remain **Explicitly Waived / Accepted Risk**;
   `realTurnVerified=false`. This is not Pass evidence.
 - macOS x64/arm64 validation remains skipped by user direction and mandatory at