Changing Bot model leaves existing group sessions on old provider (MISSING_CREDENTIAL) #1127

Repro (prod owner home u-682b8a…, 2026-10-25 Asia/Shanghai)

1. Owner configures Bots (Data, Frontend, …) to opencsitool/DeepSeek-V4.1-Flash-1017 via Models; OPENCSITOOL_API_KEY is present; appliedModel matches; modelStale unset.
2. Owner home has no DEEPSEEK_API_KEY in .credentials.yaml.
3. In local group 研发组, Data (15:57) and Frontend (15:58) turns fail with:

llm-deepseek: no API key for provider route "deepseek-official"; … code MISSING_CREDENTIAL

Session transcripts for those group sessions still request provider: "deepseek-official", model: "deepseek-flash".

Chief/Architect group turns on the same home correctly use opencsitool/....

Expected

After Models (or equivalent) sets the Bot’s model, every Session that Bot uses for group turns must be re-selected onto that route before the next turn — including already-open room.sessions entries.

Actual

applyModel early-returns when appliedModel already equals desired and modelStale is false; re-open of an existing group session in room-participant.js only re-applies when modelStale. A sticky wrong DSH session route is never repaired, so Inbox shows a credential error for a provider the Bot is no longer supposed to use.

Acceptance

1. After changing a Bot’s model (or force-apply), existing group sessions for that Bot issue the next request on the new provider/model.
2. Automated test: seed a group session on provider A, set bot.model to B with appliedModel already B and modelStale false, trigger the path that should rebind, assert selectSessionModel (or equivalent) runs for that group session and the next request header uses B.
3. Negative: stranger/own-chat paths and Models: a group session whose model selection failed is never repaired (applyModel early return); old 'no model set up' lines stay in room history #289 modelStale repair still work.

Workaround (ops, not the fix)

Store DEEPSEEK_API_KEY on that home, or force-recreate the group session (remove/re-add Bot, toggle model away/back with force, drop room.sessions entry).

Owner deep-test; claim and fix immediately.