Opened on behalf of Onur Solmaz (osolmaz). Follow-up refactor issue; not a blocker request for the narrow fix in #87893 unless maintainers decide otherwise.

Problem

Session model/auth state is currently interpreted in several places. That makes it easy for one path to treat "what ran last time" as "what should run next time".

This showed up in #85126: a stale auto fallback runtime/auth selection could make Control UI/WebChat sessions appear or start on the fallback provider instead of the configured primary provider.

Related work:

• Bug: Control UI (TUI/WebChat) sessions auto-select wrong authProfileOverride (deepseek instead of minimax) at creation #85126
• fix(auth-profiles): break self-reinforcing session auth override loop (#85126) #85311
• fix(auth-profiles): repair stale auto runtime auth selection #87893

Current split

The important decision points are currently separate:

• src/auto-reply/reply/model-selection.ts decides what model a run should use.
• src/gateway/server-methods/sessions.ts decides what model/auth state a new child session inherits.
• src/gateway/session-utils.ts decides what model UI/status/list/describe surfaces display.

These paths should share one interpretation of persisted session state instead of each reading raw fields independently.

Refactor plan

Create an internal resolver for session model/auth state. It should return separate, explicit meanings for:

• selected model: what should run now
• runtime model: what ran last time
• display model: what UI/status should show
• auth profile: selected profile and source
• stale runtime/auth state: whether persisted runtime fields should be ignored or repaired

Then migrate callers so raw fields like modelProvider, model, providerOverride, modelOverride, and authProfileOverride are treated as storage details, not local decision logic.

Acceptance criteria

• One shared stale-runtime/auth predicate is used by run selection, child-session inheritance, and display/read surfaces.
• UI/list/describe and run dispatch agree on stale fallback state.
• Explicit user model/auth choices are preserved.
• Healthy auto auth profile rotation is preserved.
• Runtime-equivalent aliases, such as OpenAI/OpenAI Codex, are preserved.
• No new config value.
• No plugin SDK or plugin interface change.
• Focused regression tests cover selected, inherited, display, and stale-runtime cases.

Non-goals

• Do not redesign auth profile storage.
• Do not introduce a migration unless the refactor changes persisted data shape.
• Do not broaden provider/plugin contracts.
• Do not turn temporary fallback state into a durable user preference.

Suggested proof

Start with focused unit tests around the resolver, then cover the three call sites:

• run model selection
• sessions.create inheritance
• sessions.list / sessions.describe display

Live MiniMax/DeepSeek provider proof would be useful if credentials are available, but the refactor should be provable with synthetic session-store fixtures first.