docs: integrate unavailable model switching on main

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,16 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- 2026-09-21：任务 `20260921-merge-disabled-model-2209f56a` 经用户确认接管主目录，
+  将模型切换修复源 `0f7093d17338463c29f11e0d0b0d45bb9e2c2b52` 从 `d222d17`
+  无冲突快进合入本地 `main`。旧模型下架后可在原会话选择可用模型；尚无 worker
+  时先保存新选择再准备运行时，已崩溃目标使用新模型重建，保留历史与 session binding。
+  模型下架投影明确的 model-unavailable 提示，不自动选模、重发消息或强制停止运行任务。
+  产品树与已验证源一致，沿用 75 项相关单测、1 项 Electron 交互、标准类型检查、scoped lint
+  与 Vite 全目标构建；额外 Main 类型检查的 62 项既有诊断无新增。
+  源记录原样导入，3 份原有未跟踪文档保持；未推送、打包或部署。
+  详见[集成记录](tasks/20260921-merge-disabled-model-2209f56a.md)及[模型更换数据流](../20-architecture/data-flow.md#code-model-replacement)。
+
 - 2026-09-20：任务 `20260920-merge-coding-sessions-bfb69ebb` 经用户确认释放旧集成登记并接管主目录，
   将会话管理源 `fd0293fe3d94b5a7725cff992ca94f129a6ac889` 从 `d612265` 无冲突快进合入本地 `main`。
   Code 支持归档/恢复及共享重命名入口；新会话使用首条用户消息首行作为标题，不调用模型，

.project-docs/30-worklog/tasks/20260921-merge-disabled-model-2209f56a.md

@@ -0,0 +1,45 @@
+# Task: Integrate unavailable model switching into main
+
+## Identity
+
+- Task ID: 20260921-merge-disabled-model-2209f56a
+- Mode: Integration
+- Branch: main
+- Worktree: D:\Datas\OthersProjects\makelore
+- Base commit: d222d175000008bad5f344577679256d22a636c2
+- Owner: codex
+- Status: Ready for Integration
+
+## Scope
+
+- Integrate completed source 0f7093d17338463c29f11e0d0b0d45bb9e2c2b52 into local main and promote the removed-model replacement behavior.
+
+## Intent And Constraints
+
+- User explicitly approved releasing completed owner 20260920-merge-coding-sessions-bfb69ebb and adopting the three existing untracked documents unchanged. Official release/start/status passed; this task owns main and the exclusive integration lock at the recorded base.
+- Concurrent Task Gate and Planning Gate Passed. Read the entry, own task, same-base integrated context, accepted ADR-006/model-capability authority, architecture/domain/success criteria and relevant evidence/reflection/commitment context. Read all 149 peer Scope/Intent/Promotion sections; historical placeholder scopes remain unknown/read-only without a concrete conflicting dependency. Updated audio work is independent; model-list sync and Windows shell remain separate branches.
+- Plan: fast-forward the exact completed source, promote consistent recovery semantics, verify source-tree/document identity and documentation boundaries, then complete the integration. Reuse exact-source tests if no product changes are needed.
+- Preserve active/uncertain work, explicit model choice, history and session identity. Source task records stay read-only. No subagents, remote push, packaging, installation or deployment.
+
+## Outcome
+
+- Fast-forwarded local main from d222d175000008bad5f344577679256d22a636c2 to 0f7093d17338463c29f11e0d0b0d45bb9e2c2b52 without conflicts. The exact completed source result is now on main.
+- Promoted explicit dormant/crashed model replacement and actionable model-unavailable errors to data-flow, business-rules and current-state. These implement existing Main/metadata/Pi ownership and preserve active/uncertain work; no architecture reversal or conflicting source was selected.
+- Original untracked documents 20260901-package-122-c5e8.md, 20260901-package-123-d7f3.md and 20260902-client-hang-diagnosis-a47c9e2b.md remain unchanged and outside the commit. Source task record imported unchanged.
+
+## Verification
+
+- Verified source branch/HEAD/readiness and clean source worktree, plus direct fast-forward ancestry. After merge, git diff --exit-code 0f7093d HEAD passed; product files and source record match the validated source exactly.
+- Reuse exact-source verification because no product changes were made during integration: 75 relevant unit tests, 1 isolated Electron unavailable-model replacement scenario, standard typecheck, scoped ESLint and Vite Renderer/Main/Preload/utility build passed.
+- Source comparison found 62 existing Main TypeScript errors and no additional diagnostics. Real provider inference, installed-client verification, installer smoke and full suite were not performed.
+- Review and task-aware documentation drift check cover source import provenance, canonical changes and unchanged adopted files.
+
+## Follow-ups
+
+- User explicitly approved source cleanup. Before retirement, verified its exact resolved path, clean status, ready/managed ownership, committed task record, branch and latest HEAD included in main. Bundled task_context.py retire failed with Git "Directory not empty" at D:\Datas\OthersProjects\.codex-worktrees\makelore\20260921-disabled-model-switch-0e02d13a. Git removed the worktree registration but left partial files (including dependencies/reports and source files); task ownership remains because the script stopped before unregistering it. Branch codex/20260921-disabled-model-switch-0e02d13a-disabled-model-switch still points to 0f7093d and is preserved. Cleanup is blocked by the bundled lifecycle tool, not awaiting user permission; no manual registry edit, forced residual deletion, or simulated ownership recovery was attempted.
+- Publish/install a client build to deliver the fix to installed users; this task only integrates local source. Earlier model-list and Windows shell tasks remain separate branches.
+
+## Promotion Candidates
+
+- Accepted and promoted the source model-replacement flow into data-flow/business-rules/current-state. The user authorized this fix's main integration; accepted Pi and provider capability authority remain unchanged. No remaining promotion candidate.
+- Maintenance follow-up: bundled retire needs an explicit recovery protocol for Windows Git partial-removal failures; evidence and affected state are recorded in this task's reflection case. No skill change was made.