Deploying dee76b1 proved a raw durable append insufficient: the 07:54 dispatch recorded the wandering selection, yet the request assembled half a second later still carried the deepseek header, because prompt assembly reads the Session Controller's in-memory selection and the internal Agent controller caches one per Agent. Call its own selectForNextRequest primitive — append plus cache refresh, still without saving the deployment default — and fall back to the public selectModel if the surface moves. Fixture gains the Controller; two cases pin fast-path and fallback.
A role model only seeded brand-new Sessions, so Workers created before a settings change kept their old route forever — the operator's complaint that the default model 'did not take effect'. On dispatch, ensure() now compares the durable selection or header of an existing Session against the configured role model and appends a model/selection event when they drift, leaving the deployment default alone. Seven unit cases cover drift, idempotence, effort, and precedence.
Ensure() only registered a Workspace when the Session was new, so Sessions restored from disk never entered the Workspace record and stayed invisible in the panel. Always create (idempotent) and attach an unaccounted Session; warn on attach failure. Tests gain a shared Workspace fixture.
The panel could show the DSH default model but not change it, so an operator
who wanted a different Executor or Assessor model had to edit the profile by
hand. PUT default-model routes a switch through the Session Controller, which
is the same path the DSH picker uses: it retargets the master Session and lets
agent-default-model persist the choice into the profile through configEditor.
switchDefaultModel refuses a provider the catalog cannot route and a model its
group does not offer, and reports unchanged rather than writing the same value
again. selectModel saves the default in the background, so the switch polls the
catalog until the saved selection appears instead of assuming the write landed;
effort is compared against the selection the Controller resolved, because it
fills in a default effort the caller never sent.
The refusal carries its reason as a code, which ApiError now keeps so the panel
can word it in the operator's language instead of showing host English.
wandering1
dev