Provider/model setup and auto-switching feel under-baked

[Hmbown]

Symptom

While running, the agent auto-switched provider deepseek → zai (model deepseek-v4-pro → GLM-5.2, endpoint api.z.ai); overall model/route setup does not feel deliberate.

Task

Assess when/why the runtime switches providers/models, whether switches are surfaced clearly and intentional vs. incidental, default model/route selection quality across providers, and the first-run provider setup flow. Produce a written assessment first, THEN propose concrete fixes as issues/PRs. Keep every provider first-class (none privileged).
Full repro, entry points, and provider-free acceptance in /Volumes/VIXinSSD/CW/backups/v091-tui-fix-mission-20260722.md

[Hmbown]

Assessment against local candidate 634d9f692c68b99b3e0ed2d7125548d7083661fb (not yet merged):

• A provider change is not a silent field assignment: switch_provider resolves and validates the complete target route before mutating state, respawns the engine only after validation, and emits a Provider switched: old → new transcript summary. A missing key returns the user to a focused provider picker and preserves the previous route.
• The durable model-selection seam is provider-scoped: Settings::set_provider_model_selection(..., false) updates only provider_models; it deliberately does not rewrite default_provider or the DeepSeek fallback. This is the regression boundary for a Z.ai/GLM session being dragged back to a DeepSeek model.
• The remaining confusion was presentation: the DeepSeek-only fallback was visible on unrelated routes. The v0.9.1 candidate hides it when unset for non-DeepSeek providers and labels a saved leftover as Legacy fallback model (DeepSeek routes only) for cleanup.
• Picker readiness is now honest for self-hosted/custom routes: a provider is shown as configured only when active, explicitly configured, named custom, or key-backed where a key is meaningful.

Disposition: no evidence in this review of an autonomous DeepSeek → Z.ai switch without an explicit picker/onboarding/fallback path. The route-selection behavior is safer than its presentation made it feel. The larger first-run/provider-model UX redesign is deliberately deferred to the post-release design-spine audit (no new issue per maintainer direction). This issue stays open until the local candidate is normally merged and its source/QA receipt is posted.

[Hmbown]

The written assessment is the 2026-07-23 comment and the fixes it called for are on main — validated switch_provider with a Provider switched: old → new receipt (provider_routes.rs:601), no silent external-CLI credential adoption (#5772), live catalog authority (#5783), honest Ollama default (#5795); closing, with the deeper provider/model audit tracked in the ops ledger.

Triage: codewhale-ops evidence/ISSUE-TRIAGE-20260901.md (verified against main 88ba3cd).