docs: integrate unavailable model switching on main

.project-docs/20-architecture/data-flow.md

@@ -6,6 +6,12 @@ Main 的 `.makelore/conversations.json` schema v2 是 Conversation 标题和归
 
 重命名、归档和恢复经现有 Host API 修改元数据；`conversation.metadata-changed` 在现有 SSE 上只传项目和会话身份，不伪造运行时 generation/seq。Renderer 合并列表刷新、在重连时重新读取列表，并拒绝跨项目或早于本地变更的旧结果。归档不 dispose runtime、不移动 JSONL；Main 阻止归档会话的新 prompt/steer/follow-up 与 fork，保留已接受请求、现有任务、审批与中止能力。
 
+## Code model replacement
+
+用户在现有 Conversation 中明确选择模型后，Main 先校验新选择。若目标尚无 worker，则先持久化新模型并清除失败准备留下的注册缓存，再沿原 session binding 准备 Pi；旧模型已下架不能成为更换模型的前置条件。已崩溃 worker 即使同账号也用新模型重建目标线程，恢复原历史；已有 worker 保留原来的 mutation/uncertainty 门禁。
+
+Provider catalog 的模型不可用错误投影为 `CODING_MODEL_UNAVAILABLE`，界面提示重新选择，不再误报通用运行时不可用。更换模型不会自动选择替代项、重发消息或为修复选择而强制停止运行任务。
+
 ## Cloud knowledge embedding
 
 MakeLore 知识库 → Yuxi 已启用 embedding 目录与知识库/发布快照 → Yuxi 直连供应商 → Milvus 索引或查询。向量费用由平台承担，不进入 one-api/Works Square 模型目录、用户用量、词元点数或智能体金额预算。下述既有受管模型能力链不作为云知识库 embedding 入口；聊天及其他原有网关能力保持。访问资格和实际运行时限仍由云执行检查。

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,16 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- 2026-09-21：任务 `20260921-merge-disabled-model-2209f56a` 经用户确认接管主目录，
+  将模型切换修复源 `0f7093d17338463c29f11e0d0b0d45bb9e2c2b52` 从 `d222d17`
+  无冲突快进合入本地 `main`。旧模型下架后可在原会话选择可用模型；尚无 worker
+  时先保存新选择再准备运行时，已崩溃目标使用新模型重建，保留历史与 session binding。
+  模型下架投影明确的 model-unavailable 提示，不自动选模、重发消息或强制停止运行任务。
+  产品树与已验证源一致，沿用 75 项相关单测、1 项 Electron 交互、标准类型检查、scoped lint
+  与 Vite 全目标构建；额外 Main 类型检查的 62 项既有诊断无新增。
+  源记录原样导入，3 份原有未跟踪文档保持；未推送、打包或部署。
+  详见[集成记录](tasks/20260921-merge-disabled-model-2209f56a.md)及[模型更换数据流](../20-architecture/data-flow.md#code-model-replacement)。
+
 - 2026-09-20：任务 `20260920-merge-coding-sessions-bfb69ebb` 经用户确认释放旧集成登记并接管主目录，
   将会话管理源 `fd0293fe3d94b5a7725cff992ca94f129a6ac889` 从 `d612265` 无冲突快进合入本地 `main`。
   Code 支持归档/恢复及共享重命名入口；新会话使用首条用户消息首行作为标题，不调用模型，

.project-docs/30-worklog/tasks/20260921-merge-disabled-model-2209f56a.md

@@ -0,0 +1,45 @@
+# Task: Integrate unavailable model switching into main
+
+## Identity
+
+- Task ID: 20260921-merge-disabled-model-2209f56a
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: d222d175000008bad5f344577679256d22a636c2
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate completed source 0f7093d17338463c29f11e0d0b0d45bb9e2c2b52 into local main and promote the removed-model replacement behavior.
+
+## Intent And Constraints
+
+- User explicitly approved releasing completed owner 20260920-merge-coding-sessions-bfb69ebb and adopting the three existing untracked documents unchanged. Official release/start/status passed; this task owns main and the exclusive integration lock at the recorded base.
+- Concurrent Task Gate and Planning Gate Passed. Read the entry, own task, same-base integrated context, accepted ADR-006/model-capability authority, architecture/domain/success criteria and relevant evidence/reflection/commitment context. Read all 149 peer Scope/Intent/Promotion sections; historical placeholder scopes remain unknown/read-only without a concrete conflicting dependency. Updated audio work is independent; model-list sync and Windows shell remain separate branches.
+- Plan: fast-forward the exact completed source, promote consistent recovery semantics, verify source-tree/document identity and documentation boundaries, then complete the integration. Reuse exact-source tests if no product changes are needed.
+- Preserve active/uncertain work, explicit model choice, history and session identity. Source task records stay read-only. No subagents, remote push, packaging, installation or deployment.
+
+## Outcome
+
+- Fast-forwarded local main from d222d175000008bad5f344577679256d22a636c2 to 0f7093d17338463c29f11e0d0b0d45bb9e2c2b52 without conflicts. The exact completed source result is now on main.
+- Promoted explicit dormant/crashed model replacement and actionable model-unavailable errors to data-flow, business-rules and current-state. These implement existing Main/metadata/Pi ownership and preserve active/uncertain work; no architecture reversal or conflicting source was selected.
+- Original untracked documents 20260901-package-122-c5e8.md, 20260901-package-123-d7f3.md and 20260902-client-hang-diagnosis-a47c9e2b.md remain unchanged and outside the commit. Source task record imported unchanged.
+
+## Verification
+
+- Verified source branch/HEAD/readiness and clean source worktree, plus direct fast-forward ancestry. After merge, git diff --exit-code 0f7093d HEAD passed; product files and source record match the validated source exactly.
+- Reuse exact-source verification because no product changes were made during integration: 75 relevant unit tests, 1 isolated Electron unavailable-model replacement scenario, standard typecheck, scoped ESLint and Vite Renderer/Main/Preload/utility build passed.
+- Source comparison found 62 existing Main TypeScript errors and no additional diagnostics. Real provider inference, installed-client verification, installer smoke and full suite were not performed.
+- Review and task-aware documentation drift check cover source import provenance, canonical changes and unchanged adopted files.
+
+## Follow-ups
+
+- User explicitly approved source cleanup. Before retirement, verified its exact resolved path, clean status, ready/managed ownership, committed task record, branch and latest HEAD included in main. Bundled task_context.py retire failed with Git "Directory not empty" at D:\Datas\OthersProjects\.codex-worktrees\makelore\20260921-disabled-model-switch-0e02d13a. Git removed the worktree registration but left partial files (including dependencies/reports and source files); task ownership remains because the script stopped before unregistering it. Branch codex/20260921-disabled-model-switch-0e02d13a-disabled-model-switch still points to 0f7093d and is preserved. Cleanup is blocked by the bundled lifecycle tool, not awaiting user permission; no manual registry edit, forced residual deletion, or simulated ownership recovery was attempted.
+- Publish/install a client build to deliver the fix to installed users; this task only integrates local source. Earlier model-list and Windows shell tasks remain separate branches.
+
+## Promotion Candidates
+
+- Accepted and promoted the source model-replacement flow into data-flow/business-rules/current-state. The user authorized this fix's main integration; accepted Pi and provider capability authority remain unchanged. No remaining promotion candidate.
+- Maintenance follow-up: bundled retire needs an explicit recovery protocol for Windows Git partial-removal failures; evidence and affected state are recorded in this task's reflection case. No skill change was made.

.project-docs/40-domain/business-rules.md

@@ -144,7 +144,7 @@
 - 模块置灰/路由阻断不是 API 授权边界。每个 Works/模块服务端 API 仍必须独立执行身份与权限检查；`/api/auth/me` 返回终止性 `401` 时必须清理 Main 和 Renderer 会话，不得以默认全开继续。
 - Makelore Code 的唯一 production runtime 是精确 pin 的 Pi `0.84.2`。不得恢复 OpenCode fallback、RPC/SDK 双轨、兼容执行路径或 Renderer runtime 直连；产品公共合同必须保持 project/Agent/Conversation/Snapshot/Patch 中立，Pi wire 只属于 Main。
 - project、Agent、Conversation 使用 `.makelore/project.json` 与 `.makelore/conversations.json` schema v2。Agent id、名称、原始 prompt、Skills 与 archive 状态必须稳定保存；不得从 `.niancode` 或 `.opencode` 读取或迁移项目元数据，也不得作为顺带清理删除这些用户内容。
-- 每条 active/warm Conversation 在同一个长驻父 Agent Server 内绑定独立 Pi Runtime/Session/channel。首次本地 Conversation 创建和 Composer 编辑不得等待逻辑线程；未解析 Conversation 第一次选模必须先验证模型、持久化 resolved metadata，再 prepare。已解析且同账号的模型变化复用 target `set_model`，跨账号变化等 active run settled 后只重建目标逻辑线程。
+- 每条 active/warm Conversation 在同一个长驻父 Agent Server 内绑定独立 Pi Runtime/Session/channel。首次本地 Conversation 创建和 Composer 编辑不得等待逻辑线程；未解析或尚无 worker 的 Conversation 选模必须先验证新模型、持久化 resolved metadata，再 prepare，不能要求旧模型仍可用。已有正常 worker 的同账号模型变化复用 target `set_model`；已崩溃 worker 用新选择重建，跨账号变化等 active run settled 后只重建目标逻辑线程。模型下架提示重新选择，显式更换保留原会话与历史，不自动选模或重发消息。
 - 正式包中的父 Agent Server 必须从显式 staged `pi-runtime` manifest/root 定位 Pi 包及其导入入口，并验证入口仍位于目标包目录内；不得从脚本相邻资源目录、应用 `node_modules`、系统 npm 或网络下载回退解析。
 - prompt、steer、follow-up、compact 等 mutation 必须先获得目标 Conversation 的 `202` acceptance/dedupe 结果。confirmation timeout 只表示 uncertain，不得自动重发，也不得释放 run permit、Agent Server/child process ownership 或 Main background lease；迟到 success/failure/exit/abort 必须单调、exactly-once 收敛。线程级失败只影响目标 Conversation；整个 Agent Server 退出时所有旧父 channel 一起 fail closed，但 Main/Renderer 继续存活且下次恢复只启动一个新 Server。
 - Renderer 只消费 Snapshot-first 与 `patch-batch` SSE。每条 Conversation 的 generation/seq 独立；stale generation 丢弃，gap/reconnect 只恢复目标 Snapshot 并应用严格连续的缓冲 tail，不重放 mutation，也不改变乐观消息的 UI identity。

.project-docs/60-reflection/cases/20260921-merge-disabled-model-2209f56a__partial-worktree-retire.md

@@ -0,0 +1,7 @@
+# Windows partial worktree retirement
+
+- Date: 2026-09-21. Status: observed; cleanup blocked. Source: authorized retire invocation for task 20260921-disabled-model-switch-0e02d13a.
+- Preconditions passed: exact target path, clean managed linked worktree, ready committed record, retained source branch and latest source result in main.
+- Bundled retire invoked git worktree remove --force, which failed with Directory not empty. The Git worktree registration disappeared, but the directory retained source/dependency/report files and project-docs ownership remained. Main and the source branch retain commit 0f7093d.
+- This repeats the partial-removal shape already recorded by earlier integrations. Ordinary retire cannot simply resume after Git has removed its registration; release-missing cannot apply while the directory remains.
+- Candidate: add a bundled, explicit partial-retirement recovery protocol that checks retained source identity and handles residual cleanup and ownership coherently. Until available, keep this state visible and do not emulate ownership or bypass the lifecycle script. The user already authorized removing this exact directory; the remaining block is mechanical.