Model selection stays consistent across a conversation

Switching the model mid-conversation now sticks: regenerate, retry, summaries, and exports use the model you selected instead of reverting to the previous answer’s model. Opening a conversation or following a deep link sets the picker to that conversation’s model; if that model is no longer available, the picker falls back visibly with a notice rather than showing a blank selection. A secure or local PII fallback now applies to a single turn only and no longer rewrites the conversation’s model.

A request naming a missing, unknown, or disallowed model is refused with a clear error naming the model instead of quietly using the server default. When the answering model differs from the one requested — failover, secure fallback, or auto-routing — non-streaming API responses report it in a new switched_from field.

No action required.