diff --git a/apps/desktop/src/main/__tests__/app-shell-session-settings-actions.test.ts b/apps/desktop/src/main/__tests__/app-shell-session-settings-actions.test.ts
index 6889c68786..287f5f5d74 100644
--- a/apps/desktop/src/main/__tests__/app-shell-session-settings-actions.test.ts
+++ b/apps/desktop/src/main/__tests__/app-shell-session-settings-actions.test.ts
@@ -71,6 +71,7 @@ function createHarness(options: {
   const permissionCalls: string[] = [];
   const thinkingCalls: string[] = [];
   const errors: string[] = [];
+  const errorDescriptions: Array<string | undefined> = [];
   const errorTargets: Array<{ sessionId: string } | undefined> = [];
   const successes: Array<{ title: string; description?: string }> = [];
   const newTaskPermissionModes: string[] = [];
@@ -121,8 +122,9 @@ function createHarness(options: {
     },
     toastApi: {
       success: (title, description) => successes.push({ title, description }),
-      error: (title, _description, _details, target) => {
+      error: (title, description, _details, target) => {
         errors.push(title);
+        errorDescriptions.push(description);
         errorTargets.push(target);
       },
       confirm: options.confirm ?? (async () => true),
@@ -133,6 +135,7 @@ function createHarness(options: {
     actions,
     activeIdRef,
     errors,
+    errorDescriptions,
     errorTargets,
     modelCalls,
     modelResult,
@@ -360,4 +363,19 @@ describe('AppShell session settings actions', () => {
     harness.modelResult.resolve(session('session-a'));
     await modelChange;
   });
+
+  it('points a failed account-and-model switch at credential recovery', async () => {
+    const harness = createHarness();
+
+    const modelChange = harness.actions.setSessionModel({
+      llmConnectionId: 'connection-1',
+      llmConnectionSlug: 'e2e',
+      model: 'claude-opus',
+    });
+    harness.modelResult.reject(new Error('fixture failure'));
+    await modelChange;
+
+    assert.match(harness.errorDescriptions[0] ?? '', /设置 · 模型/);
+    assert.match(harness.errorDescriptions[0] ?? '', /登录或 API Key/);
+  });
 });
diff --git a/apps/desktop/src/main/__tests__/chat-recovery-notice.test.ts b/apps/desktop/src/main/__tests__/chat-recovery-notice.test.ts
new file mode 100644
index 0000000000..50fb540aea
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/chat-recovery-notice.test.ts
@@ -0,0 +1,88 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { ChatRecoveryNotice } from '../../renderer/chat-recovery-notice.js';
+import { SessionHealthRecoveryNotice } from '../../renderer/chat-recovery-notice.js';
+
+test('composer recovery notices share one wrapper and secondary disabled action', () => {
+  const markup = renderToStaticMarkup(createElement(ChatRecoveryNotice, {
+    status: 'error',
+    title: 'Choose a model connection',
+    description: 'Choose the connection and model to use.',
+    actionLabel: 'Choose connection and model',
+    actionDisabled: true,
+    onAction: () => undefined,
+  }));
+
+  assert.match(markup, /class="maka-chat-recovery-notice"/);
+  assert.match(markup, /maka-chat-recovery-notice-alert/);
+  assert.match(markup, /Choose a model connection/);
+  assert.match(markup, /Choose the connection and model to use\./);
+  assert.match(markup, /Choose connection and model/);
+  assert.match(markup, /disabled=""/);
+  assert.match(markup, /secondary/);
+});
+
+test('composer recovery notices omit the action when no handler exists', () => {
+  const markup = renderToStaticMarkup(createElement(ChatRecoveryNotice, {
+    status: 'warning',
+    title: 'Workspace unavailable',
+    actionLabel: 'Open Settings',
+  }));
+
+  assert.doesNotMatch(markup, /<button/);
+});
+
+test('Session recovery disables only a hidden model-picker action', () => {
+  const markup = renderToStaticMarkup(createElement(SessionHealthRecoveryNotice, {
+    notice: {
+      tone: 'destructive',
+      label: 'Choose a model connection',
+      actionLabel: 'Choose connection and model',
+      actionDisabled: false,
+      onClickTarget: 'model_picker',
+      onClick: () => undefined,
+    },
+    fallbackActionLabel: 'Open model settings',
+    modelPickerAvailable: false,
+  }));
+
+  assert.match(markup, /disabled=""/);
+});
+
+test('a hidden model picker does not disable reload or Settings recovery', () => {
+  for (const onClickTarget of ['model_choices_refresh', 'models'] as const) {
+    const markup = renderToStaticMarkup(createElement(SessionHealthRecoveryNotice, {
+      notice: {
+        tone: 'destructive',
+        label: 'Connection unavailable',
+        actionLabel: 'Recover',
+        onClickTarget,
+        onClick: () => undefined,
+      },
+      fallbackActionLabel: 'Open model settings',
+      modelPickerAvailable: false,
+    }));
+    assert.doesNotMatch(markup, /disabled=""/);
+  }
+});
diff --git a/apps/desktop/src/main/__tests__/quote-companion-retry.test.ts b/apps/desktop/src/main/__tests__/quote-companion-retry.test.ts
index 6a26dfbca6..01bb9a1b35 100644
--- a/apps/desktop/src/main/__tests__/quote-companion-retry.test.ts
+++ b/apps/desktop/src/main/__tests__/quote-companion-retry.test.ts
@@ -23,10 +23,12 @@ import { parseHTML } from 'linkedom';
 import { act, createElement } from 'react';
 import { createRoot, type Root } from 'react-dom/client';
 import type { SessionEvent } from '@maka/core/events';
+import type { ChatModelChoice } from '@maka/core/chat-model-choice';
 import type { SessionChangedEvent, SessionSummary, TurnRecord } from '@maka/core/session';
 import {
   createFakeWorkbarServices,
   useQuoteCompanion,
+  sessionHasExactModelChoice,
   WorkbarServicesProvider,
   type CompanionQuoteSnapshot,
   type StagedCompanionQuote,
@@ -132,6 +134,7 @@ async function renderProbe(
   options: {
     ownership?: boolean;
     sourceSession?: SessionSummary;
+    modelChoices?: readonly ChatModelChoice[];
     ready?: (container: Element) => boolean;
     onSend?: (send: (text: string) => Promise<boolean>) => void;
     onSteer?: (steer: (text: string) => Promise<boolean>) => void;
@@ -160,8 +163,13 @@ async function renderProbe(
         onStop: options.onStop,
         pendingQuotes: options.pendingQuotes,
         onQuotesConsumed: options.onQuotesConsumed,
+        sourceSession: options.sourceSession,
+        modelChoices: options.modelChoices,
       })
-    : createElement(QuoteCompanionProbe, { sourceSession: options.sourceSession });
+    : createElement(QuoteCompanionProbe, {
+        sourceSession: options.sourceSession,
+        modelChoices: options.modelChoices,
+      });
 
   await act(async () => {
     root.render(createElement(WorkbarServicesProvider, { services, children }));
@@ -180,6 +188,8 @@ async function renderOwnershipProbe(
   options: {
     pendingQuotes?: readonly StagedCompanionQuote[];
     onQuotesConsumed?: (snapshot: CompanionQuoteSnapshot) => void;
+    sourceSession?: SessionSummary;
+    modelChoices?: readonly ChatModelChoice[];
   } = {},
 ) {
   let send!: (text: string) => Promise<boolean>;
@@ -334,6 +344,425 @@ test('does not restart foreground setup when the source Session object refreshes
   assert.equal(probe.getAttribute('data-preparing'), 'false');
 });
 
+test('waits for the source model to become available before forking', async () => {
+  let branchCount = 0;
+  const { container, root, services } = await renderProbe(
+    {
+      listTurns: async () => [settledTurn('settled-turn')],
+      branchFromTurn: async () => {
+        branchCount += 1;
+        return { ok: true as const, session: session('side-conversation') };
+      },
+    },
+    {
+      sourceSession: session('source-session'),
+      modelChoices: [],
+      ready: (current) =>
+        current.firstElementChild?.getAttribute('data-preparing') === 'false',
+    },
+  );
+  const probe = container.firstElementChild;
+  assert.ok(probe);
+  assert.equal(branchCount, 0);
+  assert.equal(probe.getAttribute('data-companion-id'), '');
+
+  await act(async () => {
+    root.render(
+      createElement(WorkbarServicesProvider, {
+        services,
+        children: createElement(QuoteCompanionProbe, {
+          sourceSession: session('source-session'),
+          modelChoices: [choiceFor(session('source-session'))],
+        }),
+      }),
+    );
+    await Promise.resolve();
+  });
+  await waitUntil(() => probe.getAttribute('data-companion-id') === 'side-conversation');
+
+  assert.equal(branchCount, 1);
+});
+
+test('replaces an empty companion whose exact model is no longer available', async () => {
+  const sourceA = session('source-session');
+  const sourceB = session('source-session', {
+    llmConnectionId: 'connection-2',
+    llmConnectionSlug: 'openai-2',
+    model: 'model-2',
+  });
+  const forkB = session('side-conversation-b', {
+    llmConnectionId: 'connection-2',
+    llmConnectionSlug: 'openai-2',
+    model: 'model-2',
+  });
+  let branchCount = 0;
+  const cleaned: string[] = [];
+  const { container, root, services } = await renderProbe(
+    {
+      branchFromTurn: async () => {
+        branchCount += 1;
+        return {
+          ok: true as const,
+          session: branchCount === 1 ? session('side-conversation-a') : forkB,
+        };
+      },
+      cleanupSessionCopy: async (sessionId) => {
+        cleaned.push(sessionId);
+      },
+    },
+    {
+      sourceSession: sourceA,
+      modelChoices: [choiceFor(sourceA)],
+      ready: (current) =>
+        current.firstElementChild?.getAttribute('data-companion-id') ===
+        'side-conversation-a',
+    },
+  );
+  const probe = container.firstElementChild;
+  assert.ok(probe);
+
+  await act(async () => {
+    root.render(
+      createElement(WorkbarServicesProvider, {
+        services,
+        children: createElement(QuoteCompanionProbe, {
+          sourceSession: sourceB,
+          modelChoices: [choiceFor(sourceB)],
+        }),
+      }),
+    );
+    await Promise.resolve();
+  });
+  await waitUntil(() => probe.getAttribute('data-companion-id') === forkB.id);
+
+  assert.equal(branchCount, 2);
+  assert.deepEqual(cleaned, ['side-conversation-a']);
+});
+
+test('does not commit a fork whose model becomes unavailable during setup', async () => {
+  const source = session('source-session');
+  const pendingFork = deferred<SessionSummary>();
+  const cleaned: string[] = [];
+  let branchCount = 0;
+  const { container, root, services } = await renderProbe(
+    {
+      branchFromTurn: async () => {
+        branchCount += 1;
+        return { ok: true as const, session: await pendingFork.promise };
+      },
+      cleanupSessionCopy: async (sessionId) => {
+        cleaned.push(sessionId);
+      },
+    },
+    {
+      sourceSession: source,
+      modelChoices: [choiceFor(source)],
+      ready: () => branchCount === 1,
+    },
+  );
+  const probe = container.firstElementChild;
+  assert.ok(probe);
+
+  await act(async () => {
+    root.render(
+      createElement(WorkbarServicesProvider, {
+        services,
+        children: createElement(QuoteCompanionProbe, {
+          sourceSession: source,
+          modelChoices: [],
+        }),
+      }),
+    );
+    pendingFork.resolve(session('side-conversation-a'));
+    await pendingFork.promise;
+  });
+  await waitUntil(() => probe.getAttribute('data-preparing') === 'false');
+
+  assert.equal(probe.getAttribute('data-companion-id'), '');
+  assert.deepEqual(cleaned, ['side-conversation-a']);
+});
+
+test('does not replace a fork while its send waits for observation readiness', async () => {
+  const sourceA = session('source-session');
+  const sourceB = session('source-session', {
+    llmConnectionId: 'connection-2',
+    llmConnectionSlug: 'openai-2',
+    model: 'model-2',
+  });
+  const forkB = session('side-conversation-b', {
+    llmConnectionId: 'connection-2',
+    llmConnectionSlug: 'openai-2',
+    model: 'model-2',
+  });
+  let branchCount = 0;
+  let seedA: (() => void) | undefined;
+  const cleaned: string[] = [];
+  const sendTargets: string[] = [];
+  let currentSend!: (text: string) => Promise<boolean>;
+  const rendered = await renderOwnershipProbe(
+    {
+      branchFromTurn: async () => {
+        branchCount += 1;
+        return {
+          ok: true as const,
+          session: branchCount === 1 ? session('side-conversation') : forkB,
+        };
+      },
+      subscribeEvents: (sessionId, _handler, onSeeded) => {
+        if (sessionId === 'side-conversation') seedA = onSeeded;
+        else onSeeded?.();
+        return () => undefined;
+      },
+      cleanupSessionCopy: async (sessionId) => {
+        cleaned.push(sessionId);
+      },
+      send: async (sessionId) => {
+        sendTargets.push(sessionId);
+        return { ok: false as const, reason: 'not configured' };
+      },
+    },
+    {
+      sourceSession: sourceA,
+      modelChoices: [choiceFor(sourceA)],
+    },
+  );
+  currentSend = rendered.send;
+
+  let firstSend!: Promise<boolean>;
+  await act(async () => {
+    firstSend = currentSend('waiting send');
+    await Promise.resolve();
+    rendered.root.render(
+      createElement(WorkbarServicesProvider, {
+        services: rendered.services,
+        children: createElement(QuoteCompanionOwnershipProbe, {
+          onSend: (send) => { currentSend = send; },
+          sourceSession: sourceB,
+          modelChoices: [choiceFor(sourceB)],
+        }),
+      }),
+    );
+    await Promise.resolve();
+  });
+  assert.deepEqual(cleaned, [], 'the send lock must retain its fork');
+
+  await act(async () => {
+    seedA?.();
+    assert.equal(await firstSend, false);
+  });
+  assert.deepEqual(sendTargets, ['side-conversation']);
+  const probe = rendered.container.firstElementChild;
+  assert.ok(probe);
+  await waitUntil(() => probe.getAttribute('data-companion-id') === forkB.id);
+  assert.deepEqual(cleaned, ['side-conversation']);
+  assert.equal(branchCount, 2);
+
+  await act(async () => {
+    assert.equal(await currentSend('retry after rebind'), false);
+  });
+  assert.deepEqual(sendTargets, ['side-conversation', 'side-conversation-b']);
+});
+
+test('replaces an empty stale fork after its pending admission is retracted', async () => {
+  const sourceA = session('source-session');
+  const sourceB = session('source-session', {
+    llmConnectionId: 'connection-2',
+    llmConnectionSlug: 'openai-2',
+    model: 'model-2',
+  });
+  const forkB = session('side-conversation-b', {
+    llmConnectionId: 'connection-2',
+    llmConnectionSlug: 'openai-2',
+    model: 'model-2',
+  });
+  const pendingSend = deferred<{
+    ok: true;
+    steered: true;
+    turnId: string;
+    messageId: string;
+  }>();
+  let admissionId: string | undefined;
+  let branchCount = 0;
+  const cleaned: string[] = [];
+  let currentSend!: (text: string) => Promise<boolean>;
+  const rendered = await renderOwnershipProbe(
+    {
+      branchFromTurn: async () => {
+        branchCount += 1;
+        return {
+          ok: true as const,
+          session: branchCount === 1 ? session('side-conversation') : forkB,
+        };
+      },
+      cleanupSessionCopy: async (sessionId) => {
+        cleaned.push(sessionId);
+      },
+      send: async (_sessionId, command) => {
+        admissionId = command.turnId;
+        return pendingSend.promise;
+      },
+    },
+    {
+      sourceSession: sourceA,
+      modelChoices: [choiceFor(sourceA)],
+    },
+  );
+  currentSend = rendered.send;
+
+  let sendResult!: Promise<boolean>;
+  await act(async () => {
+    sendResult = currentSend('pending send');
+    await Promise.resolve();
+  });
+  await waitUntil(() => admissionId !== undefined);
+  await act(async () => {
+    rendered.root.render(
+      createElement(WorkbarServicesProvider, {
+        services: rendered.services,
+        children: createElement(QuoteCompanionOwnershipProbe, {
+          onSend: (send) => { currentSend = send; },
+          sourceSession: sourceB,
+          modelChoices: [choiceFor(sourceB)],
+        }),
+      }),
+    );
+    await Promise.resolve();
+  });
+  assert.deepEqual(cleaned, [], 'pending admission must retain its fork');
+
+  await act(async () => {
+    rendered.emit({
+      type: 'message_admission',
+      id: 'retracted-after-rebind',
+      turnId: 'old-turn',
+      ts: 1,
+      messageId: admissionId as string,
+      outcome: 'retracted',
+    });
+    await Promise.resolve();
+  });
+  const probe = rendered.container.firstElementChild;
+  assert.ok(probe);
+  await waitUntil(() => probe.getAttribute('data-companion-id') === forkB.id);
+  assert.deepEqual(cleaned, ['side-conversation']);
+  assert.equal(branchCount, 2);
+
+  await act(async () => {
+    pendingSend.resolve({
+      ok: true,
+      steered: true,
+      turnId: 'old-turn',
+      messageId: admissionId as string,
+    });
+    assert.equal(await sendResult, false);
+  });
+});
+
+test('retains an admitted fork interrupted before send settles when its model changes', async () => {
+  const sourceA = session('source-session');
+  const sourceB = session('source-session', {
+    llmConnectionId: 'connection-2',
+    llmConnectionSlug: 'openai-2',
+    model: 'model-2',
+  });
+  const pendingSend = deferred<{ ok: true; turnId: string }>();
+  const pendingStop = deferred<undefined>();
+  const cleaned: string[] = [];
+  let admissionId: string | undefined;
+  let branchCount = 0;
+  let currentSend!: (text: string) => Promise<boolean>;
+  const rendered = await renderOwnershipProbe(
+    {
+      branchFromTurn: async () => {
+        branchCount += 1;
+        return { ok: true as const, session: session('side-conversation') };
+      },
+      cleanupSessionCopy: async (sessionId) => {
+        cleaned.push(sessionId);
+      },
+      send: async (_sessionId, command) => {
+        admissionId = command.turnId;
+        return pendingSend.promise;
+      },
+      stop: async (_sessionId, target) => {
+        assert.deepEqual(target, { kind: 'admission', messageId: admissionId });
+        return pendingStop.promise;
+      },
+    },
+    {
+      sourceSession: sourceA,
+      modelChoices: [choiceFor(sourceA)],
+    },
+  );
+  currentSend = rendered.send;
+
+  let sendResult!: Promise<boolean>;
+  await act(async () => {
+    sendResult = currentSend('persisted before interruption');
+    await Promise.resolve();
+  });
+  await waitUntil(() => admissionId !== undefined);
+  let stopResult!: Promise<void>;
+  await act(async () => {
+    stopResult = rendered.stop();
+    await Promise.resolve();
+    pendingSend.resolve({ ok: true, turnId: 'admitted-turn' });
+    await Promise.resolve();
+  });
+  const probe = rendered.container.firstElementChild;
+  assert.ok(probe);
+  await waitUntil(() => probe.getAttribute('data-live-turn-id') === 'admitted-turn');
+
+  await act(async () => {
+    pendingStop.resolve(undefined);
+    await stopResult;
+    assert.equal(await sendResult, false);
+  });
+  await act(async () => {
+    rendered.emit(completeEvent('interrupted-complete', 'admitted-turn', 1));
+    await Promise.resolve();
+  });
+  await waitUntil(() => probe.getAttribute('data-live-turn-id') === '');
+
+  await act(async () => {
+    rendered.root.render(
+      createElement(WorkbarServicesProvider, {
+        services: rendered.services,
+        children: createElement(QuoteCompanionOwnershipProbe, {
+          onSend: (send) => { currentSend = send; },
+          sourceSession: sourceB,
+          modelChoices: [choiceFor(sourceB)],
+        }),
+      }),
+    );
+    await Promise.resolve();
+  });
+  assert.equal(probe.getAttribute('data-companion-id'), 'side-conversation');
+  assert.deepEqual(cleaned, [], 'Host-admitted content must never be replaced implicitly');
+  assert.equal(branchCount, 1);
+});
+
+test('source model readiness requires the exact Connection id, slug, and model', () => {
+  const source = session('source-session');
+  assert.equal(sessionHasExactModelChoice(source, [choiceFor(source)]), true);
+  const legacy = { ...source };
+  delete legacy.llmConnectionId;
+  assert.equal(sessionHasExactModelChoice(legacy, [choiceFor(source)]), false);
+  assert.equal(sessionHasExactModelChoice(source, []), false);
+  assert.equal(
+    sessionHasExactModelChoice(source, [choiceFor(source, { connectionId: 'other' })]),
+    false,
+  );
+  assert.equal(
+    sessionHasExactModelChoice(source, [choiceFor(source, { connectionSlug: 'other' })]),
+    false,
+  );
+  assert.equal(
+    sessionHasExactModelChoice(source, [choiceFor(source, { model: 'other' })]),
+    false,
+  );
+});
+
 test('keeps Side Conversation events owned by the Host-admitted turn across an admission race', async () => {
   const pendingSend = deferred<{ ok: true; turnId: string }>();
   const { container, emit, send } = await renderOwnershipProbe({
@@ -1111,11 +1540,16 @@ test('releases a send waiting for observation when the Side Conversation is disp
   mountedRoot = undefined;
 });
 
-function QuoteCompanionProbe(props: { sourceSession?: SessionSummary }) {
+function QuoteCompanionProbe(props: {
+  sourceSession?: SessionSummary;
+  modelChoices?: readonly ChatModelChoice[];
+}) {
+  const sourceSession = props.sourceSession ?? SOURCE_SESSION;
   const companion = useQuoteCompanion({
     panelId: 'retry-panel',
     pendingQuotes: [],
-    sourceSession: props.sourceSession ?? SOURCE_SESSION,
+    sourceSession,
+    modelChoices: props.modelChoices ?? [choiceFor(sourceSession)],
     locale: 'en',
     onQuotesConsumed: () => undefined,
   });
@@ -1132,11 +1566,15 @@ function QuoteCompanionOwnershipProbe(props: {
   onStop?: (stop: () => Promise<void>) => void;
   pendingQuotes?: readonly StagedCompanionQuote[];
   onQuotesConsumed?: (snapshot: CompanionQuoteSnapshot) => void;
+  sourceSession?: SessionSummary;
+  modelChoices?: readonly ChatModelChoice[];
 }) {
+  const sourceSession = props.sourceSession ?? SOURCE_SESSION;
   const companion = useQuoteCompanion({
     panelId: 'ownership-panel',
     pendingQuotes: props.pendingQuotes ?? [],
-    sourceSession: SOURCE_SESSION,
+    sourceSession,
+    modelChoices: props.modelChoices ?? [choiceFor(sourceSession)],
     locale: 'en',
     onQuotesConsumed: props.onQuotesConsumed ?? (() => undefined),
   });
@@ -1153,7 +1591,7 @@ function QuoteCompanionOwnershipProbe(props: {
   });
 }
 
-function session(id: string): SessionSummary {
+function session(id: string, overrides: Partial<SessionSummary> = {}): SessionSummary {
   return {
     id,
     name: id,
@@ -1163,10 +1601,30 @@ function session(id: string): SessionSummary {
     hasUnread: false,
     status: 'active',
     backend: 'ai-sdk',
+    llmConnectionId: 'connection-1',
     llmConnectionSlug: 'test',
     connectionLocked: false,
     model: 'test-model',
     permissionMode: 'ask',
+    ...overrides,
+  };
+}
+
+function choiceFor(
+  source: SessionSummary,
+  overrides: Partial<ChatModelChoice> = {},
+): ChatModelChoice {
+  assert.ok(source.llmConnectionId);
+  return {
+    connectionId: source.llmConnectionId,
+    connectionSlug: source.llmConnectionSlug,
+    providerType: 'openai',
+    providerLabel: 'OpenAI',
+    model: source.model,
+    label: source.model,
+    isDefault: true,
+    thinkingLevels: [],
+    ...overrides,
   };
 }
 
diff --git a/apps/desktop/src/main/__tests__/session-health-notice.test.ts b/apps/desktop/src/main/__tests__/session-health-notice.test.ts
new file mode 100644
index 0000000000..09e605d7db
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/session-health-notice.test.ts
@@ -0,0 +1,94 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import type { SessionSendProjection } from '@maka/core/session-send-projection';
+import { deriveSessionHealthNotice } from '../../renderer/session-health-notice.js';
+
+const legacySession = {
+  backend: 'ai-sdk',
+  llmConnectionSlug: 'openrouter',
+  model: 'openai/gpt-5',
+  connectionLocked: false,
+};
+
+function blocked(
+  reason: Extract<SessionSendProjection, { kind: 'blocked' }>['reason'],
+  hasModelChoices: boolean,
+  modelChoicesSettled = true,
+) {
+  return deriveSessionHealthNotice({
+    locale: 'en',
+    session: legacySession,
+    outcome: { kind: 'blocked', reason, connectionLocked: false },
+    connections: [],
+    hasModelChoices,
+    modelChoicesSettled,
+    modelPickerDisabled: false,
+    lastTestStatus: undefined,
+  });
+}
+
+test('legacy connection recovery opens the existing model picker when choices exist', () => {
+  const notice = blocked('legacy_connection_identity', true);
+  assert.equal(notice?.onClickTarget, 'model_picker');
+  assert.equal(notice?.label, 'Choose a model connection');
+  assert.equal(notice?.actionLabel, 'Choose connection and model');
+  assert.equal(
+    notice?.tooltip,
+    'This task comes from an older version. Choose the connection and model to use.',
+  );
+});
+
+test('legacy connection recovery falls back to Models settings only when no choice exists', () => {
+  const notice = blocked('legacy_connection_identity', false);
+  assert.equal(notice?.onClickTarget, 'models');
+  assert.equal(notice?.actionLabel, undefined);
+  assert.equal(
+    notice?.tooltip,
+    'No connections are currently available. Add or enable one in Settings · Models first.',
+  );
+});
+
+test('an unsettled connection snapshot offers a reload instead of an empty picker', () => {
+  const notice = blocked('legacy_connection_identity', false, false);
+  assert.equal(notice?.onClickTarget, 'model_choices_refresh');
+  assert.equal(notice?.actionLabel, 'Reload connections');
+  assert.equal(notice?.tooltip, 'The connection list has not loaded yet.');
+});
+
+test('a live turn disables connection selection until model switching is safe', () => {
+  const notice = deriveSessionHealthNotice({
+    locale: 'en',
+    session: legacySession,
+    outcome: { kind: 'blocked', reason: 'legacy_connection_identity', connectionLocked: false },
+    connections: [],
+    hasModelChoices: true,
+    modelChoicesSettled: true,
+    modelPickerDisabled: true,
+    lastTestStatus: undefined,
+  });
+  assert.equal(notice?.onClickTarget, 'model_picker');
+  assert.equal(notice?.actionDisabled, true);
+});
+
+test('credential repair remains owned by Models settings', () => {
+  assert.equal(blocked('missing_api_key', true)?.onClickTarget, 'models');
+});
diff --git a/apps/desktop/src/main/__tests__/session-health-recovery-flow.test.ts b/apps/desktop/src/main/__tests__/session-health-recovery-flow.test.ts
new file mode 100644
index 0000000000..0b159e2018
--- /dev/null
+++ b/apps/desktop/src/main/__tests__/session-health-recovery-flow.test.ts
@@ -0,0 +1,226 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import { afterEach, test } from 'node:test';
+import { parseHTML } from 'linkedom';
+import { act, createElement, Fragment, useRef } from 'react';
+import { createRoot, type Root } from 'react-dom/client';
+import type { ChatModelChoice } from '@maka/core/chat-model-choice';
+import type { IdentifiedLlmConnection } from '@maka/core/llm-connections';
+import type { SessionSummary } from '@maka/core/session';
+import { Composer, LocaleProvider, type ComposerHandle } from '@maka/ui';
+import { SessionHealthRecoveryNotice } from '../../renderer/chat-recovery-notice.js';
+import { useComposerModelPickerAdapter } from '../../renderer/composer-model-picker-adapter.js';
+import { useShellChatModel } from '../../renderer/use-shell-chat-model.js';
+
+const originalGlobals = {
+  document: globalThis.document,
+  window: globalThis.window,
+  HTMLElement: globalThis.HTMLElement,
+  HTMLIFrameElement: globalThis.HTMLIFrameElement,
+  Event: globalThis.Event,
+  Node: globalThis.Node,
+  matchMedia: globalThis.matchMedia,
+  requestAnimationFrame: globalThis.requestAnimationFrame,
+  cancelAnimationFrame: globalThis.cancelAnimationFrame,
+  IS_REACT_ACT_ENVIRONMENT: (globalThis as { IS_REACT_ACT_ENVIRONMENT?: boolean })
+    .IS_REACT_ACT_ENVIRONMENT,
+};
+
+const CONNECTION: IdentifiedLlmConnection = {
+  connectionId: 'connection-openrouter',
+  slug: 'openrouter',
+  providerType: 'openrouter',
+  name: 'OpenRouter',
+  enabled: true,
+  defaultModel: 'openai/gpt-5',
+  enabledModelIds: ['openai/gpt-5'],
+  createdAt: 1,
+  updatedAt: 1,
+};
+const CHOICE: ChatModelChoice = {
+  connectionId: CONNECTION.connectionId,
+  connectionSlug: CONNECTION.slug,
+  connectionName: CONNECTION.name,
+  providerType: CONNECTION.providerType,
+  providerLabel: CONNECTION.name,
+  model: CONNECTION.defaultModel,
+  label: 'GPT-5',
+  isDefault: true,
+  thinkingLevels: [],
+};
+const LEGACY_SESSION = {
+  id: 'legacy-session',
+  name: 'Legacy',
+  isFlagged: false,
+  isArchived: false,
+  labels: [],
+  hasUnread: false,
+  status: 'active',
+  backend: 'ai-sdk',
+  llmConnectionSlug: CONNECTION.slug,
+  connectionLocked: true,
+  model: CHOICE.model,
+  permissionMode: 'ask',
+} satisfies SessionSummary;
+
+let mountedRoot: Root | undefined;
+
+function RecoveryFlow(props: {
+  choices: readonly ChatModelChoice[];
+  snapshotReady: boolean;
+  pickerDisabled?: boolean;
+  onRefresh: () => void;
+  onOpenSettings: (section: string) => void;
+}) {
+  const composerRef = useRef<ComposerHandle>(null);
+  const openModelPicker = useComposerModelPickerAdapter(composerRef);
+  const { sessionHealthNotice } = useShellChatModel({
+    uiLocale: 'en',
+    connections: [CONNECTION],
+    chatModelChoices: [...props.choices],
+    sessionSendOutcome: {
+      kind: 'blocked',
+      reason: 'legacy_connection_identity',
+      connectionLocked: false,
+    },
+    defaultConnection: CONNECTION.slug,
+    newTaskKey: 'test-draft',
+    activeSession: LEGACY_SESSION,
+    persistedComposerDefaults: null,
+    usePersistedComposerDefaults: false,
+    connectionSnapshotReady: props.snapshotReady,
+    modelPickerDisabled: props.pickerDisabled ?? false,
+    openSettingsSection: props.onOpenSettings,
+    openModelPicker,
+    refreshModelChoices: props.onRefresh,
+  });
+  assert.ok(sessionHealthNotice);
+  return createElement(LocaleProvider, {
+    locale: 'en',
+    children: createElement(Fragment, null,
+      createElement(SessionHealthRecoveryNotice, {
+        notice: sessionHealthNotice,
+        fallbackActionLabel: 'Open model settings',
+        modelPickerAvailable: true,
+      }),
+      createElement(Composer, {
+        ref: composerRef,
+        activeSession: LEGACY_SESSION,
+        modelChoices: [...props.choices],
+        hideUnavailableCurrentModel: true,
+        onModelChange: () => undefined,
+        onSend: () => undefined,
+        onStop: () => undefined,
+      }),
+    ),
+  });
+}
+
+async function renderFlow(props: Parameters<typeof RecoveryFlow>[0]) {
+  const parsed = parseHTML('<html><body><div id="root"></div></body></html>');
+  const { document, window } = parsed;
+  window.getComputedStyle = () => ({
+    direction: 'ltr',
+    writingMode: 'horizontal-tb',
+    getPropertyValue: () => '',
+  }) as unknown as CSSStyleDeclaration;
+  Object.assign(globalThis, {
+    document,
+    window,
+    HTMLElement: window.HTMLElement,
+    HTMLIFrameElement: window.HTMLIFrameElement ?? class HTMLIFrameElement {},
+    Event: window.Event,
+    Node: window.Node,
+    matchMedia: () => ({ matches: false, addEventListener() {}, removeEventListener() {} }),
+    requestAnimationFrame: () => 1,
+    cancelAnimationFrame() {},
+    IS_REACT_ACT_ENVIRONMENT: true,
+  });
+  const container = document.querySelector('#root');
+  assert.ok(container);
+  mountedRoot = createRoot(container);
+  await act(() => mountedRoot?.render(createElement(RecoveryFlow, props)));
+  const action = [...document.querySelectorAll<HTMLButtonElement>('button')]
+    .find((button) => button.textContent?.includes(
+      props.snapshotReady
+        ? props.choices.length > 0 ? 'Choose connection and model' : 'Open model settings'
+        : 'Reload connections',
+    ));
+  assert.ok(action);
+  return { action, document, window };
+}
+
+test('recovery CTA opens the production Composer model picker', async () => {
+  const flow = await renderFlow({
+    choices: [CHOICE],
+    snapshotReady: true,
+    onRefresh: assert.fail,
+    onOpenSettings: assert.fail,
+  });
+  await act(() => flow.action.dispatchEvent(new flow.window.Event('click', { bubbles: true })));
+  assert.match(flow.document.documentElement.innerHTML, /aria-expanded="true"[^>]*aria-haspopup="menu"/);
+});
+
+test('unsettled recovery reloads the catalog without opening the picker', async () => {
+  let refreshCount = 0;
+  const flow = await renderFlow({
+    choices: [CHOICE],
+    snapshotReady: false,
+    onRefresh: () => { refreshCount += 1; },
+    onOpenSettings: assert.fail,
+  });
+  await act(() => flow.action.dispatchEvent(new flow.window.Event('click', { bubbles: true })));
+  assert.equal(refreshCount, 1);
+  assert.doesNotMatch(flow.document.documentElement.innerHTML, /aria-expanded="true"[^>]*aria-haspopup="menu"/);
+});
+
+test('empty recovery opens Models settings through the production route', async () => {
+  const settings: string[] = [];
+  const flow = await renderFlow({
+    choices: [],
+    snapshotReady: true,
+    onRefresh: assert.fail,
+    onOpenSettings: (section) => settings.push(section),
+  });
+  await act(() => flow.action.dispatchEvent(new flow.window.Event('click', { bubbles: true })));
+  assert.deepEqual(settings, ['models']);
+});
+
+test('a live-turn lock disables the recovery CTA and keeps the picker closed', async () => {
+  const flow = await renderFlow({
+    choices: [CHOICE],
+    snapshotReady: true,
+    pickerDisabled: true,
+    onRefresh: assert.fail,
+    onOpenSettings: assert.fail,
+  });
+  assert.equal(flow.action.disabled, true);
+  await act(() => flow.action.dispatchEvent(new flow.window.Event('click', { bubbles: true })));
+  assert.doesNotMatch(flow.document.documentElement.innerHTML, /aria-expanded="true"[^>]*aria-haspopup="menu"/);
+});
+
+afterEach(async () => {
+  if (mountedRoot) {
+    await act(() => mountedRoot?.unmount());
+  }
+  mountedRoot = undefined;
+  Object.assign(globalThis, originalGlobals);
+});
diff --git a/apps/desktop/src/main/__tests__/use-shell-connections.test.ts b/apps/desktop/src/main/__tests__/use-shell-connections.test.ts
index ab07836de5..3613999f73 100644
--- a/apps/desktop/src/main/__tests__/use-shell-connections.test.ts
+++ b/apps/desktop/src/main/__tests__/use-shell-connections.test.ts
@@ -37,10 +37,12 @@ function snapshot(defaultConnection: string): DesktopConnectionSnapshot {
 
 function deferred<T>() {
   let resolve!: (value: T) => void;
-  const promise = new Promise<T>((settle) => {
+  let reject!: (reason?: unknown) => void;
+  const promise = new Promise<T>((settle, fail) => {
     resolve = settle;
+    reject = fail;
   });
-  return { promise, resolve };
+  return { promise, reject, resolve };
 }
 
 test('keeps connection projections isolated and cached by owning Host', async () => {
@@ -176,6 +178,169 @@ test('reports connection refresh failures against their owning Host', async () =
   ]);
 });
 
+test('invalidates stale connection choices until the current refresh succeeds', async () => {
+  const { root } = installReactRenderer();
+  const sessionId = desktopSessionKey({ hostId: 'host-a', sessionId: 'session-a' });
+  const refreshes: Array<ReturnType<typeof deferred<DesktopConnectionSnapshot>>> = [];
+  (globalThis.window as unknown as { maka: unknown }).maka = {
+    connections: {
+      getSnapshot: async () => {
+        const pending = deferred<DesktopConnectionSnapshot>();
+        refreshes.push(pending);
+        return pending.promise;
+      },
+    },
+  };
+  let current!: ReturnType<typeof useShellConnections>;
+
+  function Probe() {
+    current = useShellConnections({
+      toastApi: { error: () => undefined },
+      uiLocale: 'en',
+      target: { kind: 'session', sessionId },
+    });
+    return null;
+  }
+
+  await act(async () => {
+    root.render(createElement(Probe));
+    await Promise.resolve();
+  });
+  assert.equal(refreshes.length, 1);
+  await act(async () => {
+    refreshes[0]?.resolve(snapshot('stale-connection'));
+    await refreshes[0]?.promise;
+  });
+  assert.equal(current.hasSnapshot, true);
+  assert.equal(current.snapshot.defaultConnection, 'stale-connection');
+
+  let failedRefresh!: Promise<void>;
+  await act(async () => {
+    failedRefresh = current.refreshConnections();
+    await Promise.resolve();
+  });
+  assert.equal(current.hasSnapshot, false, 'a pending refresh must hide stale choices');
+  assert.deepEqual(current.snapshot, EMPTY);
+  await act(async () => {
+    current.seedSnapshot(snapshot('stale-onboarding-seed'));
+    await Promise.resolve();
+  });
+  assert.equal(
+    current.hasSnapshot,
+    false,
+    'an onboarding seed must not repopulate a projection invalidated by refresh',
+  );
+  await act(async () => {
+    refreshes[1]?.reject(new Error('refresh failed'));
+    await failedRefresh;
+  });
+  assert.equal(current.hasSnapshot, false, 'a failed refresh must remain unsettled');
+
+  let recoveredRefresh!: Promise<void>;
+  await act(async () => {
+    recoveredRefresh = current.refreshConnections();
+    await Promise.resolve();
+    refreshes[2]?.resolve(snapshot('replacement-connection'));
+    await recoveredRefresh;
+  });
+  assert.equal(current.hasSnapshot, true);
+  assert.equal(current.snapshot.defaultConnection, 'replacement-connection');
+});
+
+test('an older failed refresh cannot erase a newer successful snapshot', async () => {
+  const { root } = installReactRenderer();
+  const sessionId = desktopSessionKey({ hostId: 'host-a', sessionId: 'session-a' });
+  const refreshes: Array<ReturnType<typeof deferred<DesktopConnectionSnapshot>>> = [];
+  (globalThis.window as unknown as { maka: unknown }).maka = {
+    connections: {
+      getSnapshot: async () => {
+        const pending = deferred<DesktopConnectionSnapshot>();
+        refreshes.push(pending);
+        return pending.promise;
+      },
+    },
+  };
+  let current!: ReturnType<typeof useShellConnections>;
+
+  function Probe() {
+    current = useShellConnections({
+      toastApi: { error: () => undefined },
+      uiLocale: 'en',
+      target: { kind: 'session', sessionId },
+    });
+    return null;
+  }
+
+  await act(async () => {
+    root.render(createElement(Probe));
+    await Promise.resolve();
+  });
+  let older!: Promise<void>;
+  let newer!: Promise<void>;
+  await act(async () => {
+    older = current.refreshConnections();
+    newer = current.refreshConnections();
+    await Promise.resolve();
+  });
+  assert.equal(refreshes.length, 3);
+  await act(async () => {
+    refreshes[2]?.resolve(snapshot('newest-connection'));
+    await newer;
+  });
+  assert.equal(current.snapshot.defaultConnection, 'newest-connection');
+
+  await act(async () => {
+    refreshes[1]?.reject(new Error('older refresh failed'));
+    await older;
+  });
+  assert.equal(current.hasSnapshot, true);
+  assert.equal(current.snapshot.defaultConnection, 'newest-connection');
+
+  await act(async () => {
+    refreshes[0]?.resolve(snapshot('initial-late'));
+    await refreshes[0]?.promise;
+  });
+  assert.equal(current.snapshot.defaultConnection, 'newest-connection');
+});
+
+test('a previous Host refresh failure cannot erase the current Host snapshot', async () => {
+  const { root } = installReactRenderer();
+  const sessionA = desktopSessionKey({ hostId: 'host-a', sessionId: 'session-a' });
+  const sessionB = desktopSessionKey({ hostId: 'host-b', sessionId: 'session-b' });
+  const pendingA = deferred<DesktopConnectionSnapshot>();
+  (globalThis.window as unknown as { maka: unknown }).maka = {
+    connections: {
+      getSnapshot: async (sessionId?: string) =>
+        sessionId === sessionA ? pendingA.promise : snapshot('connection-b'),
+    },
+  };
+  let current!: ReturnType<typeof useShellConnections>;
+
+  function Probe(props: { sessionId: string }) {
+    current = useShellConnections({
+      toastApi: { error: () => undefined },
+      uiLocale: 'en',
+      target: { kind: 'session', sessionId: props.sessionId },
+    });
+    return null;
+  }
+
+  await act(async () => {
+    root.render(createElement(Probe, { sessionId: sessionA }));
+    await Promise.resolve();
+    root.render(createElement(Probe, { sessionId: sessionB }));
+    await Promise.resolve();
+  });
+  assert.equal(current.snapshot.defaultConnection, 'connection-b');
+
+  await act(async () => {
+    pendingA.reject(new Error('old Host failed'));
+    await pendingA.promise.catch(() => undefined);
+  });
+  assert.equal(current.hasSnapshot, true);
+  assert.equal(current.snapshot.defaultConnection, 'connection-b');
+});
+
 afterEach(() => {
   cleanupFakeDom();
   delete (globalThis as { window?: unknown }).window;
diff --git a/apps/desktop/src/renderer/app-shell-session-settings-actions.ts b/apps/desktop/src/renderer/app-shell-session-settings-actions.ts
index 1b01820dce..8c85df64b7 100644
--- a/apps/desktop/src/renderer/app-shell-session-settings-actions.ts
+++ b/apps/desktop/src/renderer/app-shell-session-settings-actions.ts
@@ -209,9 +209,10 @@ export function createAppShellSessionSettingsActions(deps: {
       await refreshSessions();
     } catch (error) {
       if (activeIdRef.current === sessionId) {
+        const detail = localizedShellErrorMessage(error, copy.modelFallback, uiLocale);
         toastApi.error(
           copy.modelFailedTitle,
-          localizedShellErrorMessage(error, copy.modelFallback, uiLocale),
+          `${detail} ${copy.modelRecoveryHint}`,
           undefined,
           { sessionId },
         );
diff --git a/apps/desktop/src/renderer/app-shell.tsx b/apps/desktop/src/renderer/app-shell.tsx
index d532b01bdb..d656389610 100644
--- a/apps/desktop/src/renderer/app-shell.tsx
+++ b/apps/desktop/src/renderer/app-shell.tsx
@@ -72,6 +72,7 @@ import { Button } from '@astryxdesign/core/Button';
 import { useKeyboardHelp } from './keyboard-help';
 import { useCommandPalette } from './command-palette';
 import { ChatMessageSurface } from './chat-message-surface';
+import { useComposerModelPickerAdapter } from './composer-model-picker-adapter';
 import { useTaskSubmissionReadiness } from './use-task-submission-readiness';
 import {
   deriveTaskReadinessNotice,
@@ -552,7 +553,7 @@ function AppShellContent({
   if (!newTaskConnections.hasSnapshot && newTaskUsesDefaultHost) {
     newTaskConnectionSnapshot = defaultHostConnections.hasSnapshot
       ? defaultHostConnections.snapshot
-      : startupConnectionSnapshot
+      : !defaultHostConnections.hasProjectionState && startupConnectionSnapshot
         ? {
             connections: startupConnectionSnapshot.connections,
             defaultConnection: startupConnectionSnapshot.defaultSlug,
@@ -758,6 +759,7 @@ function AppShellContent({
   const [helpOpen, closeHelp, openHelp] = useKeyboardHelp();
   const [paletteOpen, openPalette, closePalette] = useCommandPalette();
   const composerRef = useRef<ComposerHandle>(null);
+  const openComposerModelPicker = useComposerModelPickerAdapter(composerRef);
   const retractedWorkspaceReferencesRef = useRef<Record<string, InlineReference[]>>({});
   const [revisionDraft, setRevisionDraft] = useState<TurnRevisionDraft | null>(null);
   const revisionDraftRef = useRef<TurnRevisionDraft | null>(null);
@@ -883,7 +885,17 @@ function AppShellContent({
     persistedComposerDefaults,
     usePersistedComposerDefaults: modelSettingsOwnsComposerHost,
     defaultThinkingLevel: taskEntry.selectors.selectedHost?.chatDefaults.thinkingLevel,
+    connectionSnapshotReady: activeId ? sessionHostConnections.hasSnapshot : true,
+    modelPickerDisabled: Boolean(
+      turnActive ||
+      activeStreamingLive ||
+      activeSession?.status === 'running' ||
+      activeSession?.status === 'waiting_for_user' ||
+      (activeId && pendingSessionModelBySession[activeId] === true)
+    ),
     openSettingsSection,
+    openModelPicker: openComposerModelPicker,
+    refreshModelChoices: sessionHostConnections.refreshConnections,
   });
   const newChatProviderType = newChatModel
     ? connections.find((connection) => connection.slug === newChatModel.llmConnectionSlug)?.providerType
@@ -2930,6 +2942,7 @@ function AppShellContent({
                   activeProviderType={activeConnection?.providerType}
                   modelChoices={chatModelChoices}
                   modelSwitchHasHistory={modelSwitchHasHistory}
+                  hideUnavailableCurrentModel={sessionHealthNotice?.onClickTarget === 'model_picker'}
                   renderProviderMark={(type) => <ProviderBrandMark type={type} />}
                   modelChangePending={activeId ? pendingSessionModelBySession[activeId] === true : false}
                   onModelChange={(input) => setSessionModel(input)}
@@ -3105,6 +3118,9 @@ function AppShellContent({
                   });
                 }}
                 sessionHealthNotice={sessionHealthNotice}
+                sessionHealthModelPickerAvailable={
+                  activeBoundarySurface.localInteractionAvailable
+                }
                 workspaceReadinessRecovery={workspaceReadinessRecovery}
                 taskReadinessNotice={taskReadinessNotice}
                 onTaskReadinessAction={
diff --git a/apps/desktop/src/renderer/chat-message-surface.tsx b/apps/desktop/src/renderer/chat-message-surface.tsx
index 6ce3ac5611..e729d67ac9 100644
--- a/apps/desktop/src/renderer/chat-message-surface.tsx
+++ b/apps/desktop/src/renderer/chat-message-surface.tsx
@@ -24,8 +24,6 @@ import { type OnboardingState } from '@maka/core/onboarding';
 import { type SettingsSection } from '@maka/core/settings';
 import { Skeleton } from '@astryxdesign/core';
 import {
-  Banner,
-  Button,
   ChatView,
   useUiLocale,
   type LiveContentActivationSnapshot,
@@ -41,6 +39,7 @@ import { getDesktopConversationCopy } from './locales/conversation-copy';
 import { selectLiveTurn } from './use-app-shell-session-ui-reads';
 import { useAppShellSessionUiSelector } from './use-app-shell-session-ui-selector';
 import { useDeepResearchRun } from './use-deep-research-run';
+import { ChatRecoveryNotice, SessionHealthRecoveryNotice } from './chat-recovery-notice';
 
 const selectShellRunRecord = (state: AppShellSessionUiState, sessionId: string | undefined) =>
   sessionId ? state.shellRunUpdatesBySession[sessionId] : undefined;
@@ -75,6 +74,7 @@ interface ChatMessageSurfaceProps extends Omit<
   /** Advances after the active session's current observation generation finishes seeding. */
   liveContentSeedRevision: number;
   sessionHealthNotice?: SessionHealthNoticeView;
+  sessionHealthModelPickerAvailable: boolean;
   workspaceReadinessRecovery?: WorkspaceReadinessRecovery;
   taskReadinessNotice?: TaskReadinessNotice;
   onTaskReadinessAction?: () => void;
@@ -113,6 +113,7 @@ export function ChatMessageSurface({
   activeSessionId,
   liveContentSeedRevision,
   sessionHealthNotice,
+  sessionHealthModelPickerAvailable,
   workspaceReadinessRecovery,
   taskReadinessNotice,
   onTaskReadinessAction,
@@ -136,8 +137,8 @@ export function ChatMessageSurface({
   const locale = useUiLocale();
   const copy = getShellCopy(locale).app;
   const transcriptCopy = getDesktopConversationCopy(locale).actions;
-  // Every session-health-notice CTA routes to 设置 · 模型 (U1); this is the
-  // action button's visible label.
+  // Configuration notices share the Settings label; identity recovery supplies
+  // its own label because it opens the composer's connection-and-model picker.
   const goToModelsLabel = copy.goToModels;
   const handleWorkspaceRecovery = () => {
     const target = workspaceReadinessRecovery?.target;
@@ -256,53 +257,29 @@ export function ChatMessageSurface({
         } : undefined}
       />
       {taskReadinessNotice && (
-        <div className="maka-workspace-readiness-notice">
-          <Banner
-            status={taskReadinessNotice.tone === 'destructive' ? 'error' : 'warning'}
-            className="maka-workspace-readiness-notice-alert"
-            role="status"
-            title={taskReadinessNotice.title}
-            description={taskReadinessNotice.description}
-            endContent={onTaskReadinessAction ? <Button
-              label={taskReadinessNotice.actionLabel}
-              variant="ghost"
-              size="sm"
-              onClick={onTaskReadinessAction}
-            /> : undefined} />
-        </div>
+        <ChatRecoveryNotice
+          status={taskReadinessNotice.tone === 'destructive' ? 'error' : 'warning'}
+          title={taskReadinessNotice.title}
+          description={taskReadinessNotice.description}
+          actionLabel={taskReadinessNotice.actionLabel}
+          onAction={onTaskReadinessAction}
+        />
       )}
       {workspaceReadinessRecovery && (
-        <div className="maka-workspace-readiness-notice">
-          <Banner
-            status={workspaceReadinessRecovery.tone === 'destructive' ? 'error' : 'warning'}
-            className="maka-workspace-readiness-notice-alert"
-            role="status"
-            title={workspaceReadinessRecovery.title}
-            description={workspaceReadinessRecovery.description}
-            endContent={<Button
-              label={workspaceReadinessRecovery.actionLabel}
-              variant="ghost"
-              size="sm"
-              onClick={handleWorkspaceRecovery}
-            />} />
-        </div>
+        <ChatRecoveryNotice
+          status={workspaceReadinessRecovery.tone === 'destructive' ? 'error' : 'warning'}
+          title={workspaceReadinessRecovery.title}
+          description={workspaceReadinessRecovery.description}
+          actionLabel={workspaceReadinessRecovery.actionLabel}
+          onAction={handleWorkspaceRecovery}
+        />
       )}
       {sessionHealthNotice && (
-        <div className="maka-session-health-notice">
-          <Banner
-            status={sessionHealthNotice.tone === 'destructive' ? 'error' : sessionHealthNotice.tone === 'warning' ? 'warning' : 'info'}
-            className="maka-session-health-notice-alert"
-            role="status"
-            aria-label={sessionHealthNotice.tooltip ?? sessionHealthNotice.label}
-            title={sessionHealthNotice.label}
-            description={sessionHealthNotice.tooltip}
-            endContent={<Button
-              label={goToModelsLabel}
-              variant="ghost"
-              size="sm"
-              onClick={sessionHealthNotice.onClick}
-            />} />
-        </div>
+        <SessionHealthRecoveryNotice
+          notice={sessionHealthNotice}
+          fallbackActionLabel={goToModelsLabel}
+          modelPickerAvailable={sessionHealthModelPickerAvailable}
+        />
       )}
     </>
   );
diff --git a/apps/desktop/src/renderer/chat-recovery-notice.tsx b/apps/desktop/src/renderer/chat-recovery-notice.tsx
new file mode 100644
index 0000000000..3d86a75ca4
--- /dev/null
+++ b/apps/desktop/src/renderer/chat-recovery-notice.tsx
@@ -0,0 +1,75 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import type { ReactNode } from 'react';
+import { Banner, Button } from '@maka/ui';
+import type { SessionHealthNoticeView } from './use-shell-chat-model';
+
+/** One composer-adjacent recovery surface: shared placement and action hierarchy. */
+export function ChatRecoveryNotice(props: {
+  status: 'error' | 'warning' | 'info';
+  title: ReactNode;
+  description?: ReactNode;
+  actionLabel?: string;
+  actionDisabled?: boolean;
+  onAction?: () => void;
+}) {
+  return (
+    <div className="maka-chat-recovery-notice">
+      <Banner
+        status={props.status}
+        className="maka-chat-recovery-notice-alert"
+        role="status"
+        title={props.title}
+        description={props.description}
+        endContent={props.actionLabel && props.onAction ? (
+          <Button
+            label={props.actionLabel}
+            variant="secondary"
+            size="sm"
+            isDisabled={props.actionDisabled}
+            onClick={props.onAction}
+          />
+        ) : undefined}
+      />
+    </div>
+  );
+}
+
+/** Production adapter from Session health routing to the shared notice surface. */
+export function SessionHealthRecoveryNotice(props: {
+  notice: SessionHealthNoticeView;
+  fallbackActionLabel: string;
+  modelPickerAvailable: boolean;
+}) {
+  const { notice } = props;
+  const actionDisabled =
+    notice.actionDisabled ||
+    (notice.onClickTarget === 'model_picker' && !props.modelPickerAvailable);
+  return (
+    <ChatRecoveryNotice
+      status={notice.tone === 'destructive' ? 'error' : notice.tone}
+      title={notice.label}
+      description={notice.tooltip}
+      actionLabel={notice.actionLabel ?? props.fallbackActionLabel}
+      actionDisabled={actionDisabled}
+      onAction={notice.onClick}
+    />
+  );
+}
diff --git a/apps/desktop/src/renderer/composer-model-picker-adapter.ts b/apps/desktop/src/renderer/composer-model-picker-adapter.ts
new file mode 100644
index 0000000000..0c655499bf
--- /dev/null
+++ b/apps/desktop/src/renderer/composer-model-picker-adapter.ts
@@ -0,0 +1,30 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import { useCallback, type RefObject } from 'react';
+import type { ComposerHandle } from '@maka/ui';
+
+/** The single Desktop adapter from recovery actions to the mounted Composer picker. */
+export function useComposerModelPickerAdapter(
+  composerRef: RefObject<ComposerHandle | null>,
+): () => void {
+  return useCallback(() => {
+    composerRef.current?.openModelPicker();
+  }, [composerRef]);
+}
diff --git a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-core.ts b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-core.ts
index 57a195c98b..8616c95d58 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-core.ts
+++ b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-core.ts
@@ -26,6 +26,7 @@ import {
   type LiveTurnProjection,
 } from '@maka/ui';
 import type { PermissionMode } from '@maka/core/permission';
+import type { ChatModelChoice } from '@maka/core/chat-model-choice';
 import type { QuoteRef, SessionEvent } from '@maka/core/events';
 import type { SessionSummary, TurnRecord } from '@maka/core/session';
 import type { UiLocale } from '@maka/core/ui-locale';
@@ -56,6 +57,21 @@ export type CompanionErrorCode =
   | 'send_failed'
   | 'send_rejected';
 
+export function sessionHasExactModelChoice(
+  session: SessionSummary | undefined,
+  choices: readonly ChatModelChoice[],
+): boolean {
+  return Boolean(
+    session?.llmConnectionId &&
+    choices.some(
+      (choice) =>
+        choice.connectionId === session.llmConnectionId &&
+        choice.connectionSlug === session.llmConnectionSlug &&
+        choice.model === session.model,
+    ),
+  );
+}
+
 export type EnsureCompanionForkResult =
   | { status: 'ready'; session: SessionSummary }
   | { status: 'disposed' }
diff --git a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
index b6a1ae9b9b..bd75465d0a 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
+++ b/apps/desktop/src/renderer/features/workbar/tools/side-chat/quote-companion-panel.tsx
@@ -102,6 +102,7 @@ export function QuoteCompanionPanel(props: {
     panelId: props.panelId,
     pendingQuotes: props.quotes,
     sourceSession: props.sourceSession,
+    modelChoices: props.modelChoices,
     locale,
     onQuotesConsumed: props.onQuotesConsumed,
     onForkVisibilityChange: props.onForkVisibilityChange,
@@ -133,6 +134,7 @@ export function QuoteCompanionPanel(props: {
     if (
       !props.active ||
       companion.preparing ||
+      !companion.modelReady ||
       !prompt ||
       initialPromptStartedRef.current
     ) {
@@ -162,6 +164,7 @@ export function QuoteCompanionPanel(props: {
     props.onInitialPromptStarted,
     props.onPromptAccepted,
     props.panelId,
+    companion.modelReady,
   ]);
 
   // The companion inherits the source model and does not switch it; look up a
@@ -264,7 +267,7 @@ export function QuoteCompanionPanel(props: {
               streaming={companion.streaming}
               processing={companion.processing}
               draftKey={draftKey}
-              disabled={!props.sourceSession || companion.preparing}
+              disabled={!companion.modelReady || companion.preparing}
               onPickAttachments={pickAttachments}
               onAttachFilePaths={attachFilePaths}
               pendingAttachments={pendingAttachments}
diff --git a/apps/desktop/src/renderer/features/workbar/tools/side-chat/use-quote-companion.ts b/apps/desktop/src/renderer/features/workbar/tools/side-chat/use-quote-companion.ts
index 68e8ea592a..2c6244eb18 100644
--- a/apps/desktop/src/renderer/features/workbar/tools/side-chat/use-quote-companion.ts
+++ b/apps/desktop/src/renderer/features/workbar/tools/side-chat/use-quote-companion.ts
@@ -37,6 +37,7 @@ import type { SandboxBoundaryResponse } from '@maka/core/sandbox-boundary';
 import type { PermissionMode } from '@maka/core/permission';
 import type { SessionSummary, StoredMessage } from '@maka/core/session';
 import type { UiLocale } from '@maka/core/ui-locale';
+import type { ChatModelChoice } from '@maka/core/chat-model-choice';
 import type { UserQuestionResponse } from '@maka/core/user-question';
 import { useWorkbarServices } from '../../services-context.js';
 import type { WorkbarIngestInput } from '../../ports.js';
@@ -49,6 +50,7 @@ import {
   deriveCompanionComposerState,
   ensureCompanionFork,
   performCompanionTurn,
+  sessionHasExactModelChoice,
   type CompanionErrorCode,
   type EnsureCompanionForkResult,
 } from './quote-companion-core.js';
@@ -102,6 +104,8 @@ export interface UseQuoteCompanionInput {
    *  branchFromTurn) so it inherits the full conversation context + model / cwd —
    *  Codex `/side` style. */
   sourceSession: SessionSummary | undefined;
+  /** Latest Host-authorized choices used to validate both source and fork. */
+  modelChoices: readonly ChatModelChoice[];
   locale: UiLocale;
   /** Called once a send has consumed the staged quotes, so the host clears them. */
   onQuotesConsumed: (snapshot: CompanionQuoteSnapshot) => void;
@@ -122,6 +126,8 @@ export interface UseQuoteCompanionResult {
   streaming: boolean;
   processing: boolean;
   preparing: boolean;
+  /** Whether the source and any committed companion can execute their exact model. */
+  modelReady: boolean;
   permissionMode: PermissionMode | undefined;
   permissionModePending: boolean;
   regeneratePendingTurnId: string | null;
@@ -171,6 +177,7 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
     panelId,
     locale,
     sourceSession,
+    modelChoices,
     pendingQuotes,
     onQuotesConsumed,
     onForkVisibilityChange,
@@ -184,6 +191,9 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
   const pendingForkIdRef = useRef<string | null>(null);
   const sourceSessionRef = useRef(sourceSession);
   sourceSessionRef.current = sourceSession;
+  const modelChoicesRef = useRef(modelChoices);
+  modelChoicesRef.current = modelChoices;
+  const sourceModelReady = sessionHasExactModelChoice(sourceSession, modelChoices);
   const sourceSessionId = sourceSession?.id;
   const sourceSessionIdRef = useRef(sourceSession?.id);
   sourceSessionIdRef.current = sourceSessionId;
@@ -194,6 +204,7 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
   const reconcilingAdmissionRef = useRef<PendingAdmission | null>(null);
   const subscriptionReadyRef = useRef<Promise<void>>(Promise.resolve());
   const submitLockRef = useRef(false);
+  const [submitLocked, setSubmitLockedState] = useState(false);
   const settlingTurnIdsRef = useRef<Set<string>>(new Set());
   const onForkVisibilityChangeRef = useRef(onForkVisibilityChange);
   onForkVisibilityChangeRef.current = onForkVisibilityChange;
@@ -220,6 +231,8 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
     null,
   );
   const [hasContent, setHasContent] = useState(false);
+  const hasContentRef = useRef(hasContent);
+  hasContentRef.current = hasContent;
   const [error, setError] = useState<string | null>(null);
   const [forkRetryPending, setForkRetryPending] = useState(false);
   // Bumped whenever the own-turn set changes so the render picks up the new
@@ -236,6 +249,10 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
     pendingAdmissionRef.current = admission;
     setPendingAdmissionState(admission);
   }, []);
+  const setSubmitLocked = useCallback((locked: boolean) => {
+    submitLockRef.current = locked;
+    setSubmitLockedState(locked);
+  }, []);
 
   const applyOwnedEvent = useCallback(
     (forkId: string, event: SessionEvent) => {
@@ -294,6 +311,11 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
       const admission = pendingAdmissionRef.current;
       if (!admission) return;
       setPendingAdmission(null);
+      // Host admission is the durable-content boundary. Even if a concurrent
+      // Stop interrupts the Run before send() settles, this fork now owns a
+      // persisted user message and must never be replaced as an empty copy.
+      hasContentRef.current = true;
+      setHasContent(true);
       activeTurnIdRef.current = turnId;
       ownTurnIdsRef.current.add(turnId);
       admission.consumeOnAdmission?.();
@@ -465,40 +487,103 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
       name: string,
       options: { readonly showPreparing?: boolean } = {},
     ): Promise<EnsureCompanionForkResult> => {
-      const existing = companionRef.current;
-      if (existing) return Promise.resolve({ status: 'ready', session: existing });
       if (forkSetupPromiseRef.current) return forkSetupPromiseRef.current;
       const currentSourceSession = sourceSessionRef.current;
-      if (!currentSourceSession) {
+      if (
+        !currentSourceSession ||
+        !sessionHasExactModelChoice(currentSourceSession, modelChoicesRef.current)
+      ) {
+        return Promise.resolve({ status: 'error', code: 'fork_setup_failed' });
+      }
+      const existing = companionRef.current;
+      if (existing && sessionHasExactModelChoice(existing, modelChoicesRef.current)) {
+        return Promise.resolve({ status: 'ready', session: existing });
+      }
+      // Never discard an accepted side conversation implicitly. An unavailable
+      // empty fork can be recreated from the repaired source; a fork with its
+      // own content stays inspectable until the user closes the panel.
+      if (
+        existing &&
+        (hasContentRef.current ||
+          submitLockRef.current ||
+          pendingAdmissionRef.current !== null ||
+          activeTurnIdRef.current !== null)
+      ) {
         return Promise.resolve({ status: 'error', code: 'fork_setup_failed' });
       }
 
       const showPreparing = options.showPreparing ?? true;
       if (showPreparing) setPreparing(true);
-      const promise = ensureCompanionFork({
-        api: sideChat,
-        sourceSession: currentSourceSession,
-        panelId,
-        name,
-        isDisposed: () => !mountedRef.current,
-        onForkCreated: (session) => {
-          pendingForkIdRef.current = session.id;
-          onForkVisibilityChangeRef.current?.({
-            type: 'fork-created',
-            sessionId: session.id,
-          });
-        },
-        onForkCleanupSucceeded: (sessionId) => {
-          if (pendingForkIdRef.current === sessionId) {
-            pendingForkIdRef.current = null;
-          }
+      const promise = (async (): Promise<EnsureCompanionForkResult> => {
+        if (existing) {
+          const sourceId = sourceSessionIdRef.current;
+          if (!sourceId) return { status: 'error', code: 'fork_setup_failed' };
+          const cleaned = await dismissCompanionCopy(sideChat, sourceId, panelId, existing.id);
+          if (!cleaned) return { status: 'error', code: 'fork_setup_failed' };
+          unsubscribeRef.current?.();
+          unsubscribeRef.current = null;
+          subscriptionReadyRef.current = Promise.resolve();
+          companionIdRef.current = null;
+          companionRef.current = undefined;
+          setCompanion(undefined);
+          setAllMessages([]);
           onForkVisibilityChangeRef.current?.({
             type: 'cleanup-succeeded',
-            sessionId,
+            sessionId: existing.id,
           });
-        },
-      })
-        .then((result) => {
+        }
+
+        const latestSource = sourceSessionRef.current;
+        if (
+          !latestSource ||
+          !sessionHasExactModelChoice(latestSource, modelChoicesRef.current)
+        ) {
+          return { status: 'error', code: 'fork_setup_failed' };
+        }
+        return ensureCompanionFork({
+          api: sideChat,
+          sourceSession: latestSource,
+          panelId,
+          name,
+          isDisposed: () => !mountedRef.current,
+          onForkCreated: (session) => {
+            pendingForkIdRef.current = session.id;
+            onForkVisibilityChangeRef.current?.({
+              type: 'fork-created',
+              sessionId: session.id,
+            });
+          },
+          onForkCleanupSucceeded: (sessionId) => {
+            if (pendingForkIdRef.current === sessionId) {
+              pendingForkIdRef.current = null;
+            }
+            onForkVisibilityChangeRef.current?.({
+              type: 'cleanup-succeeded',
+              sessionId,
+            });
+          },
+        });
+      })()
+        .then(async (result): Promise<EnsureCompanionForkResult> => {
+          if (
+            result.status === 'ready' &&
+            !sessionHasExactModelChoice(result.session, modelChoicesRef.current)
+          ) {
+            const sourceId = sourceSessionIdRef.current;
+            const cleaned = sourceId
+              ? await dismissCompanionCopy(sideChat, sourceId, panelId, result.session.id)
+              : false;
+            if (pendingForkIdRef.current === result.session.id) {
+              pendingForkIdRef.current = null;
+            }
+            if (cleaned) {
+              onForkVisibilityChangeRef.current?.({
+                type: 'cleanup-succeeded',
+                sessionId: result.session.id,
+              });
+            }
+            return { status: 'error', code: 'fork_setup_failed' };
+          }
           if (result.status === 'ready' && mountedRef.current) {
             setForkRetryPending(false);
             setError(null);
@@ -526,9 +611,25 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
     [commitFork, mountedRef, panelId, sideChat],
   );
 
+  const companionModelReady =
+    companion === undefined || sessionHasExactModelChoice(companion, modelChoices);
   useEffect(() => {
-    if (sourceSessionId) void ensureFork(copyRef.current.defaultName);
-  }, [ensureFork, sourceSessionId]);
+    if (!sourceSessionId) return;
+    if (!sourceModelReady) {
+      setPreparing(false);
+      return;
+    }
+    void ensureFork(copyRef.current.defaultName);
+  }, [
+    companionModelReady,
+    ensureFork,
+    hasContent,
+    pendingAdmission,
+    sourceModelReady,
+    sourceSessionId,
+    streaming,
+    submitLocked,
+  ]);
 
   useEffect(() => {
     if (!sourceSessionId || !forkRetryPending) return;
@@ -610,14 +711,14 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
         return false;
       }
       // Close the same-frame double-submit window before fork readiness can yield.
-      submitLockRef.current = true;
+      setSubmitLocked(true);
       setError(null);
       const turnId = crypto.randomUUID();
       const quoteSnapshot = snapshotCompanionQuotes(panelId, pendingQuotes);
       const label = (quoteSnapshot.quotes[0]?.text ?? trimmed).slice(0, 24);
       const fork = await ensureFork(`${copyRef.current.namePrefix}${label}`);
       if (fork.status !== 'ready') {
-        submitLockRef.current = false;
+        setSubmitLocked(false);
         return false;
       }
       try {
@@ -628,11 +729,11 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
           subscriptionReadyRef.current = subscribeToFork(fork.session.id);
           setError(copyRef.current.errors.sendFailed);
         }
-        submitLockRef.current = false;
+        setSubmitLocked(false);
         return false;
       }
       if (!mountedRef.current) {
-        submitLockRef.current = false;
+        setSubmitLocked(false);
         return false;
       }
       let sendAdmission: PendingAdmission | undefined;
@@ -664,7 +765,7 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
           };
           sendAdmission = admission;
           setPendingAdmission(admission);
-          submitLockRef.current = false;
+          setSubmitLocked(false);
           setLiveTurn(armLiveTurn(turnId));
         },
       });
@@ -722,7 +823,7 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
         setLiveTurn(undefined);
       }
       // 'disposed' → the panel unmounted mid-create; nothing to update.
-      submitLockRef.current = false;
+      setSubmitLocked(false);
       return false;
     },
     [
@@ -737,6 +838,7 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
       releaseAdmission,
       resolveAdmission,
       setPendingAdmission,
+      setSubmitLocked,
     ],
   );
 
@@ -952,6 +1054,7 @@ export function useQuoteCompanion(input: UseQuoteCompanionInput): UseQuoteCompan
     streaming,
     processing,
     preparing,
+    modelReady: sourceModelReady && companionModelReady,
     permissionMode,
     permissionModePending,
     regeneratePendingTurnId,
diff --git a/apps/desktop/src/renderer/locales/conversation-copy.ts b/apps/desktop/src/renderer/locales/conversation-copy.ts
index 9bc8aed938..b4ca8b28ca 100644
--- a/apps/desktop/src/renderer/locales/conversation-copy.ts
+++ b/apps/desktop/src/renderer/locales/conversation-copy.ts
@@ -323,8 +323,14 @@ export interface DesktopConversationCopy {
   health: {
     blocked: Record<
       Extract<SessionSendProjection, { kind: 'blocked' }>['reason'],
-      { label: string; tooltip: (connection: string, model: string) => string }
+      {
+        label: string;
+        tooltip: (connection: string, model: string) => string;
+        actionLabel?: string;
+        settingsTooltip?: (connection: string, model: string) => string;
+      }
     >;
+    connectionChoicesLoading: { tooltip: string; actionLabel: string };
     reauth: { label: string; tooltip: string };
     testError: { label: string; tooltip: string };
   };
@@ -631,9 +637,9 @@ const COPY = {
         fake_backend: { label: '任务已过期 · 请先配置真实模型', tooltip: () => '原任务使用旧的本地模拟连接，需要先到 设置 · 模型 添加并启用一个真实模型才能发送。' },
         provider_retired: { label: '登录方式已停用', tooltip: (name) => `任务绑定的连接 "${name}" 使用的登录方式已从 Maka 移除，发送会失败。请到 设置 · 模型 改用其他连接。` },
         missing_default_connection: { label: '未配置可用模型', tooltip: () => '当前任务没有可用的模型连接，发送会失败。请到 设置 · 模型 添加并启用一个模型。' },
-        legacy_connection_identity: { label: '需要选择账号', tooltip: () => '此任务创建于账号实体绑定之前。请显式选择一个账号后再继续。' },
-        connection_missing: { label: '原账号已删除', tooltip: () => '此任务绑定的原账号已被删除。只有显式选择新账号后才能继续。' },
-        connection_identity_mismatch: { label: '账号身份不匹配', tooltip: () => '此任务保存的账号身份与当前连接不一致。请显式选择一个账号后再继续。' },
+        legacy_connection_identity: { label: '需要选择模型连接', tooltip: () => '此任务来自旧版本，请选择要使用的连接和模型。', actionLabel: '选择连接和模型', settingsTooltip: () => '当前没有可用连接，请先到 设置 · 模型 添加或启用连接。' },
+        connection_missing: { label: '原连接已删除', tooltip: () => '请选择新的连接和模型后继续。', actionLabel: '选择连接和模型', settingsTooltip: () => '当前没有可用连接，请先到 设置 · 模型 添加或启用连接。' },
+        connection_identity_mismatch: { label: '连接身份不匹配', tooltip: () => '请重新选择要使用的连接和模型。', actionLabel: '选择连接和模型', settingsTooltip: () => '当前没有可用连接，请先到 设置 · 模型 添加或启用连接。' },
         connection_disabled: { label: '连接已禁用', tooltip: (name) => `任务绑定的连接 "${name}" 已禁用，发送会失败。请到 设置 · 模型 启用它或选择其他连接。` },
         missing_api_key: { label: '连接缺少密钥', tooltip: (name) => `连接 "${name}" 未填写 API key 或未完成登录，发送会失败。请到 设置 · 模型 补齐凭据。` },
         missing_model: { label: '连接未选择模型', tooltip: (name) => `连接 "${name}" 没有默认模型，发送会失败。请到 设置 · 模型 选择一个模型。` },
@@ -641,6 +647,7 @@ const COPY = {
         model_not_enabled: { label: '任务模型未启用', tooltip: (name, model) => `模型 "${model}" 不在连接 "${name}" 的启用列表中，发送会失败。请到 设置 · 模型 重新选择。` },
         model_not_chat_capable: { label: '任务模型不支持聊天', tooltip: (name, model) => `模型 "${model}" 不能用于聊天，发送会失败。请到 设置 · 模型 选择支持聊天的模型。` },
       },
+      connectionChoicesLoading: { tooltip: '连接列表尚未加载完成。', actionLabel: '重新加载连接' },
       reauth: { label: '上次连接测试鉴权失败', tooltip: '最近一次连接测试返回鉴权失败（401 / 403），密钥可能已过期或被吊销。这不会拦截发送，但若发送失败请到 设置 · 模型 重新登录。' },
       testError: { label: '上次连接测试失败', tooltip: '最近一次连接测试因网络 / 超时 / 5xx 失败。这不会拦截发送，但若问题持续请到 设置 · 模型 检查 Base URL / 代理。' },
     },
@@ -864,9 +871,9 @@ const COPY = {
         fake_backend: { label: 'Stale task · Configure a real model', tooltip: () => 'This task used the retired local simulation. Add and enable a real model in Settings · Models before sending.' },
         provider_retired: { label: 'Sign-in retired', tooltip: (name) => `The sign-in that connection "${name}" uses was removed from Maka, so sending fails. Switch to another connection in Settings · Models.` },
         missing_default_connection: { label: 'No model configured', tooltip: () => 'This task has no available model connection. Add and enable one in Settings · Models.' },
-        legacy_connection_identity: { label: 'Choose an account', tooltip: () => 'This task predates account entity binding. Explicitly choose an account to continue.' },
-        connection_missing: { label: 'Original account deleted', tooltip: () => 'The original account bound to this task was deleted. Explicitly choose a new account to continue.' },
-        connection_identity_mismatch: { label: 'Account identity mismatch', tooltip: () => 'This task\'s saved account identity no longer matches its connection. Explicitly choose an account to continue.' },
+        legacy_connection_identity: { label: 'Choose a model connection', tooltip: () => 'This task comes from an older version. Choose the connection and model to use.', actionLabel: 'Choose connection and model', settingsTooltip: () => 'No connections are currently available. Add or enable one in Settings · Models first.' },
+        connection_missing: { label: 'Original connection deleted', tooltip: () => 'Choose a new connection and model to continue.', actionLabel: 'Choose connection and model', settingsTooltip: () => 'No connections are currently available. Add or enable one in Settings · Models first.' },
+        connection_identity_mismatch: { label: 'Connection identity mismatch', tooltip: () => 'Choose the connection and model to use again.', actionLabel: 'Choose connection and model', settingsTooltip: () => 'No connections are currently available. Add or enable one in Settings · Models first.' },
         connection_disabled: { label: 'Connection disabled', tooltip: (name) => `Connection "${name}" is disabled. Enable it or choose another connection in Settings · Models.` },
         missing_api_key: { label: 'Connection credentials missing', tooltip: (name) => `Connection "${name}" has no API key or completed sign-in. Add credentials in Settings · Models.` },
         missing_model: { label: 'No model selected', tooltip: (name) => `Connection "${name}" has no default model. Select one in Settings · Models.` },
@@ -874,6 +881,7 @@ const COPY = {
         model_not_enabled: { label: 'Task model disabled', tooltip: (name, model) => `Model "${model}" is not enabled for connection "${name}". Choose another model in Settings · Models.` },
         model_not_chat_capable: { label: 'Task model cannot chat', tooltip: (_name, model) => `Model "${model}" cannot be used for chat. Choose a chat-capable model in Settings · Models.` },
       },
+      connectionChoicesLoading: { tooltip: 'The connection list has not loaded yet.', actionLabel: 'Reload connections' },
       reauth: { label: 'Last connection test failed authentication', tooltip: 'The latest test returned 401 / 403. Sending is not blocked, but sign in again under Settings · Models if it fails.' },
       testError: { label: 'Last connection test failed', tooltip: 'The latest test failed because of a network, timeout, or 5xx error. Sending is not blocked; check Base URL or proxy settings if it persists.' },
     },
diff --git a/apps/desktop/src/renderer/locales/shell-copy.ts b/apps/desktop/src/renderer/locales/shell-copy.ts
index 3f350ad037..855143e079 100644
--- a/apps/desktop/src/renderer/locales/shell-copy.ts
+++ b/apps/desktop/src/renderer/locales/shell-copy.ts
@@ -337,6 +337,7 @@ type ShellCopy = {
     modelSwitchedDescription(from: string, to: string): string;
     modelFailedTitle: string;
     modelFallback: string;
+    modelRecoveryHint: string;
     thinkingUpdatedTitle: string;
     thinkingDefault: string;
     thinkingLabels: Record<ThinkingLevel, string>;
@@ -1001,6 +1002,7 @@ const SHELL_COPY_BY_LOCALE = {
       modelSwitchedDescription: (from, to) => `${from} → ${to}`,
       modelFailedTitle: '切换模型失败',
       modelFallback: '模型暂时无法切换，请稍后重试。',
+      modelRecoveryHint: '如果所选连接需要登录或 API Key，请到 设置 · 模型 补齐后重试。',
       thinkingUpdatedTitle: '已更新思考级别',
       thinkingDefault: '默认',
       thinkingLabels: {
@@ -1527,6 +1529,7 @@ const SHELL_COPY_BY_LOCALE = {
       modelSwitchedDescription: (from, to) => `${from} → ${to}`,
       modelFailedTitle: 'Could not change model',
       modelFallback: 'The model could not be changed. Try again later.',
+      modelRecoveryHint: 'If the selected connection needs sign-in or an API key, complete it in Settings · Models and try again.',
       thinkingUpdatedTitle: 'Thinking level updated',
       thinkingDefault: 'Default',
       thinkingLabels: {
diff --git a/apps/desktop/src/renderer/session-health-notice.ts b/apps/desktop/src/renderer/session-health-notice.ts
index fc137033ca..94657a5d91 100644
--- a/apps/desktop/src/renderer/session-health-notice.ts
+++ b/apps/desktop/src/renderer/session-health-notice.ts
@@ -21,16 +21,17 @@
  * Derivation of the session health notice shown above the composer.
  *
  * #1038 — the notice answers exactly one question: "will the next send
- * fail for a recoverable connection/session reason, and where should the
- * user go?". The answer comes from `projectSessionSendOutcome`, already
+ * fail for a recoverable connection/session reason, and what should the
+ * user do?". The answer comes from `projectSessionSendOutcome`, already
  * resolved by main and carried in the onboarding snapshot. Runtime Host
  * remains the submission authority; the renderer only maps this
  * compatibility projection to copy:
  *
  *   - `ready` / `rebind` → no notice (`rebind` supplies a compatible
  *     target for renderer readiness checks, #1032).
- *   - `blocked` → destructive notice whose copy names the failing
- *     connection and points at the matching Settings section.
+ *   - `blocked` → destructive notice whose copy names the recovery action;
+ *     identity repair opens the exact model picker, configuration repair opens
+ *     the matching Settings section.
  *
  * `lastTestStatus` is an intentional pre-send reminder (product contract
  * decided in #1038). E4 locks that it must NOT gate send, so here it
@@ -62,6 +63,12 @@ export interface SessionHealthNoticeInput {
   outcome: SessionSendProjection | undefined;
   /** Persisted connections are used only to name a blocked session's own connection. */
   connections: readonly IdentifiedLlmConnection[];
+  /** Whether the current surface can offer an exact account-and-model choice. */
+  hasModelChoices: boolean;
+  /** False while the active Host's first connection snapshot is still loading. */
+  modelChoicesSettled: boolean;
+  /** True while the existing model switcher cannot safely mutate this Session. */
+  modelPickerDisabled: boolean;
   /**
    * The session's own connection's most recent credential test result.
    * Advisory reminder only — never interpreted as a send block (E4).
@@ -69,10 +76,10 @@ export interface SessionHealthNoticeInput {
   lastTestStatus: 'verified' | 'needs_reauth' | 'error' | undefined;
 }
 
-// #1209 (U1): every health-notice CTA points at 设置 · 模型 — the single
-// place that manages model connections, credentials, and OAuth. The former
-// 'account' target routed to a redundant page that has since been retired.
-export type SessionHealthNoticeTarget = 'models';
+// Configuration failures remain owned by 设置 · 模型. Identity recovery is
+// different: an existing catalog choice is selected from the composer's exact
+// model picker. Loading retries here; credential repair remains in Settings.
+export type SessionHealthNoticeTarget = 'models' | 'model_picker' | 'model_choices_refresh';
 
 export interface SessionHealthNotice {
   tone: 'info' | 'warning' | 'destructive';
@@ -80,7 +87,11 @@ export interface SessionHealthNotice {
   label: string;
   /** Longer explanation for tooltip / assistive text. */
   tooltip?: string;
-  /** Which Settings section the click handler should navigate to. */
+  /** Optional action-specific label; Settings actions use the shared fallback. */
+  actionLabel?: string;
+  /** A live Turn or pending switch keeps the recovery action visible but inert. */
+  actionDisabled?: boolean;
+  /** Which recovery surface the click handler should open. */
   onClickTarget: SessionHealthNoticeTarget;
 }
 
@@ -105,12 +116,31 @@ function blockedNotice(
       connection.slug === session.llmConnectionSlug,
   );
   const name = own?.name ?? session.llmConnectionSlug;
-  const copy = getDesktopConversationCopy(input.locale).health.blocked[outcome.reason];
+  const healthCopy = getDesktopConversationCopy(input.locale).health;
+  const copy = healthCopy.blocked[outcome.reason];
+  const identityRecovery =
+    outcome.reason === 'legacy_connection_identity' ||
+    outcome.reason === 'connection_missing' ||
+    outcome.reason === 'connection_identity_mismatch';
+  if (identityRecovery && !input.modelChoicesSettled) {
+    return {
+      tone: 'destructive',
+      label: copy.label,
+      tooltip: healthCopy.connectionChoicesLoading.tooltip,
+      actionLabel: healthCopy.connectionChoicesLoading.actionLabel,
+      onClickTarget: 'model_choices_refresh',
+    };
+  }
+  const opensModelPicker = identityRecovery && input.hasModelChoices;
   return {
     tone: 'destructive',
     label: copy.label,
-    tooltip: copy.tooltip(name, session.model),
-    onClickTarget: 'models',
+    tooltip: opensModelPicker
+      ? copy.tooltip(name, session.model)
+      : (copy.settingsTooltip?.(name, session.model) ?? copy.tooltip(name, session.model)),
+    ...(opensModelPicker && copy.actionLabel ? { actionLabel: copy.actionLabel } : {}),
+    ...(opensModelPicker && input.modelPickerDisabled ? { actionDisabled: true } : {}),
+    onClickTarget: opensModelPicker ? 'model_picker' : 'models',
   };
 }
 
diff --git a/apps/desktop/src/renderer/styles/chat-header.css b/apps/desktop/src/renderer/styles/chat-header.css
index 0008e86830..c88f3d25b6 100644
--- a/apps/desktop/src/renderer/styles/chat-header.css
+++ b/apps/desktop/src/renderer/styles/chat-header.css
@@ -41,12 +41,10 @@
 
    #1629: the boundary-unreadable notice stands in for the composer it replaces,
    so it is the same kind of peer and shares the formula rather than restating
-   it. `.maka-session-health-notice` stays last in each group — the
-   session-health-notice layout contract reads its rule body by matching the
-   selector immediately before the brace. */
+   it. Composer-adjacent recovery notices share one wrapper and Banner action
+   treatment so task, workspace, and Session recovery cannot drift. */
 .maka-boundary-unreadable-notice,
-.maka-workspace-readiness-notice,
-.maka-session-health-notice {
+.maka-chat-recovery-notice {
   width: min(
     var(--maka-reading-measure),
     calc(100% - (2 * var(--space-6)) - (2 * var(--space-3)))
@@ -57,8 +55,7 @@
 }
 
 .maka-boundary-unreadable-notice-alert,
-.maka-workspace-readiness-notice-alert,
-.maka-session-health-notice-alert {
+.maka-chat-recovery-notice-alert {
   width: 100%;
   box-sizing: border-box;
 }
diff --git a/apps/desktop/src/renderer/use-shell-chat-model.ts b/apps/desktop/src/renderer/use-shell-chat-model.ts
index 01d578ddfc..7c7deb42ae 100644
--- a/apps/desktop/src/renderer/use-shell-chat-model.ts
+++ b/apps/desktop/src/renderer/use-shell-chat-model.ts
@@ -30,20 +30,25 @@ import {
   pickNewChatModel,
   type NewChatModel,
   type NewChatModelCandidate,
-} from './shell-chat-model-selection';
-import { deriveSessionHealthNotice } from './session-health-notice';
-import type { ComposerDefaults } from './composer-defaults';
+} from './shell-chat-model-selection.js';
+import {
+  deriveSessionHealthNotice,
+  type SessionHealthNoticeTarget,
+} from './session-health-notice.js';
+import type { ComposerDefaults } from './composer-defaults.js';
 import { getDesktopConversationCopy } from './locales/conversation-copy.js';
 import { useNewTaskChoice } from './use-new-task-choice.js';
 
-export type { NewChatModel } from './shell-chat-model-selection';
+export type { NewChatModel } from './shell-chat-model-selection.js';
 
 export type SessionHealthNoticeView = {
   tone: 'info' | 'warning' | 'destructive';
   label: string;
   tooltip?: string;
+  actionLabel?: string;
+  actionDisabled?: boolean;
   onClick(): void;
-  onClickTarget: 'models';
+  onClickTarget: SessionHealthNoticeTarget;
 };
 
 /**
@@ -70,7 +75,11 @@ export function useShellChatModel(options: {
   usePersistedComposerDefaults: boolean;
   /** Settings → 通用 → 默认思考级别; undefined means "no preference". */
   defaultThinkingLevel?: ThinkingLevel;
+  connectionSnapshotReady: boolean;
+  modelPickerDisabled: boolean;
   openSettingsSection: (section: SettingsSection) => void;
+  openModelPicker(): void;
+  refreshModelChoices(): void | Promise<void>;
 }): {
   chatModelChoices: ChatModelChoice[];
   activeConnection: IdentifiedLlmConnection | undefined;
@@ -89,7 +98,7 @@ export function useShellChatModel(options: {
   setPendingNewChatThinkingLevel: (next: ThinkingLevel | null) => void;
   sessionHealthNotice: SessionHealthNoticeView | undefined;
 } {
-  const { uiLocale, connections, defaultConnection, activationCandidate, activeSession, persistedComposerDefaults, openSettingsSection } = options;
+  const { uiLocale, connections, defaultConnection, activationCandidate, activeSession, persistedComposerDefaults, openSettingsSection, openModelPicker } = options;
   const conversationCopy = getDesktopConversationCopy(uiLocale);
   const [pendingNewChatModelChoice, setPendingNewChatModel] = useNewTaskChoice<
     NewChatModelCandidate | null
@@ -216,14 +225,18 @@ export function useShellChatModel(options: {
     newChatModel?.model,
   );
 
-  // Notice derivation is a pure function (see `session-health-notice.ts`); we
-  // wrap the returned `onClickTarget` here with the Settings-jump action.
+  // Notice derivation is a pure function (see `session-health-notice.ts`); this
+  // adapter routes configuration repair to Settings, catalog retries to the
+  // existing Host snapshot read, and identity recovery to the exact picker.
   const sessionHealthNotice = useMemo<SessionHealthNoticeView | undefined>(() => {
     const derived = deriveSessionHealthNotice({
       locale: uiLocale,
       session: activeSession,
       outcome: options.sessionSendOutcome,
       connections,
+      hasModelChoices: chatModelChoices.length > 0,
+      modelChoicesSettled: options.connectionSnapshotReady,
+      modelPickerDisabled: options.modelPickerDisabled,
       lastTestStatus: activeConnection?.lastTestStatus,
     });
     if (!derived) return undefined;
@@ -232,8 +245,14 @@ export function useShellChatModel(options: {
       tone: derived.tone,
       label: derived.label,
       ...(derived.tooltip ? { tooltip: derived.tooltip } : {}),
+      ...(derived.actionLabel ? { actionLabel: derived.actionLabel } : {}),
+      ...(derived.actionDisabled ? { actionDisabled: true } : {}),
       onClickTarget: target,
-      onClick: () => openSettingsSection(target),
+      onClick: target === 'model_picker'
+        ? openModelPicker
+        : target === 'model_choices_refresh'
+          ? () => void options.refreshModelChoices()
+          : () => openSettingsSection(target),
     };
     // openSettingsSection is stable enough for our purposes — main.tsx
     // doesn't depend on it changing, and including it would force the
@@ -245,8 +264,13 @@ export function useShellChatModel(options: {
     activeSession?.model,
     options.sessionSendOutcome,
     connections,
+    chatModelChoices.length,
+    options.connectionSnapshotReady,
+    options.modelPickerDisabled,
+    options.refreshModelChoices,
     activeConnection?.lastTestStatus,
     uiLocale,
+    openModelPicker,
   ]);
 
   return {
diff --git a/apps/desktop/src/renderer/use-shell-connections.ts b/apps/desktop/src/renderer/use-shell-connections.ts
index c2f2c06413..2254b81766 100644
--- a/apps/desktop/src/renderer/use-shell-connections.ts
+++ b/apps/desktop/src/renderer/use-shell-connections.ts
@@ -63,6 +63,7 @@ export function useShellConnections(options: {
 }): {
   snapshot: DesktopConnectionSnapshot;
   hasSnapshot: boolean;
+  hasProjectionState: boolean;
   seedSnapshot: (next: DesktopConnectionSnapshot) => void;
   refreshConnections: () => Promise<void>;
   handleConnectionEvent: (event: ConnectionEvent) => void;
@@ -75,7 +76,7 @@ export function useShellConnections(options: {
     currentKey.current = snapshotKey;
   }, [snapshotKey]);
   const [snapshots, setSnapshots] = useState(
-    () => new Map<string, DesktopConnectionSnapshot>(),
+    () => new Map<string, DesktopConnectionSnapshot | null>(),
   );
   const refreshSequence = useRef(new Map<string, number>());
 
@@ -95,6 +96,10 @@ export function useShellConnections(options: {
     if (key === NO_HOST_KEY) return;
     const sequence = (refreshSequence.current.get(key) ?? 0) + 1;
     refreshSequence.current.set(key, sequence);
+    // A refresh means the Host catalog may already have changed. Stop exposing
+    // its previous mutation targets immediately; only a successful current read
+    // may make this key settled again.
+    setSnapshots((previous) => new Map(previous).set(key, null));
     try {
       let next: DesktopConnectionSnapshot;
       if (target.kind === 'session' && target.sessionId) {
@@ -139,7 +144,8 @@ export function useShellConnections(options: {
 
   return {
     snapshot: snapshots.get(snapshotKey) ?? EMPTY_SNAPSHOT,
-    hasSnapshot: snapshots.has(snapshotKey),
+    hasSnapshot: snapshots.get(snapshotKey) != null,
+    hasProjectionState: snapshots.has(snapshotKey),
     seedSnapshot,
     refreshConnections,
     handleConnectionEvent,
diff --git a/docs/astryx-surface-file-inventory.md b/docs/astryx-surface-file-inventory.md
index 095ad32765..b7a5007f19 100644
--- a/docs/astryx-surface-file-inventory.md
+++ b/docs/astryx-surface-file-inventory.md
@@ -5,7 +5,7 @@ Each row is one on-disk product surface file. Regenerated inventory must stay in
 
 Wiki bar: Design Conventions · API Use-the-System · Theming · Container Padding.
 
-**Totals:** 218 files — blocker 0, polish 1, aligned 217.
+**Totals:** 219 files — blocker 0, polish 1, aligned 218.
 
 ## Exclusions (explicit)
 
@@ -34,7 +34,8 @@ Wiki bar: Design Conventions · API Use-the-System · Theming · Container Paddi
 | `apps/desktop/src/renderer/app.tsx` | other | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `apps/desktop/src/renderer/cascade-layers.css` | styles | n/a (css) | aligned — no off-rhythm control heights flagged | aligned |
 | `apps/desktop/src/renderer/chat-composer-region.tsx` | shell-chrome-or-panel | Banner, Button | aligned — uses Astryx (Banner, Button) | aligned |
-| `apps/desktop/src/renderer/chat-message-surface.tsx` | shell-chrome-or-panel | Banner, Button | aligned — uses Astryx (Banner, Button) | aligned |
+| `apps/desktop/src/renderer/chat-message-surface.tsx` | shell-chrome-or-panel | none | aligned — no raw controls; no Astryx JSX usage | aligned |
+| `apps/desktop/src/renderer/chat-recovery-notice.tsx` | shell-chrome-or-panel | Banner, Button | aligned — uses Astryx (Banner, Button) | aligned |
 | `apps/desktop/src/renderer/command-palette.tsx` | dialog-overlay | EmptyState | aligned — uses Astryx (EmptyState) | aligned |
 | `apps/desktop/src/renderer/custom-pet-companion.tsx` | other | none | aligned — no raw controls; no Astryx JSX usage | aligned |
 | `apps/desktop/src/renderer/error-boundary.tsx` | other | Button, Card | aligned — uses Astryx (Button, Card) | aligned |
diff --git a/docs/astryx-surface-file-inventory.paths b/docs/astryx-surface-file-inventory.paths
index 60e42249bf..7130755727 100644
--- a/docs/astryx-surface-file-inventory.paths
+++ b/docs/astryx-surface-file-inventory.paths
@@ -7,6 +7,7 @@ apps/desktop/src/renderer/app.tsx
 apps/desktop/src/renderer/cascade-layers.css
 apps/desktop/src/renderer/chat-composer-region.tsx
 apps/desktop/src/renderer/chat-message-surface.tsx
+apps/desktop/src/renderer/chat-recovery-notice.tsx
 apps/desktop/src/renderer/command-palette.tsx
 apps/desktop/src/renderer/custom-pet-companion.tsx
 apps/desktop/src/renderer/error-boundary.tsx
diff --git a/packages/cli/src/__tests__/pi-tui-runner.test.ts b/packages/cli/src/__tests__/pi-tui-runner.test.ts
index f21001be00..c75a66cb43 100644
--- a/packages/cli/src/__tests__/pi-tui-runner.test.ts
+++ b/packages/cli/src/__tests__/pi-tui-runner.test.ts
@@ -7238,6 +7238,49 @@ describe('Maka Pi TUI runner', () => {
     await run;
   });
 
+  test('tells a legacy Session exactly how to choose an account', async () => {
+    const terminal = new FakeTerminal(160, 24);
+    const { llmConnectionId: _legacyConnectionId, ...legacy } = fakeSessionSummary('session-2');
+    const driver = new SlashCommandDriver([legacy]);
+    const run = runMakaPiTui({
+      title: 'Maka',
+      locale: 'en',
+      driver,
+      cwd: '/repo',
+      model: legacy.model,
+      connectionSlug: legacy.llmConnectionSlug,
+      connectionIdentities: [
+        { connectionId: 'connection-openrouter', connectionSlug: 'openrouter', enabled: true },
+      ],
+      modelChoices: [
+        {
+          connectionId: 'connection-openrouter',
+          connectionSlug: 'openrouter',
+          connectionName: 'OpenRouter',
+          providerType: 'openrouter',
+          model: legacy.model,
+          isDefaultConnection: true,
+        },
+      ],
+      permissionMode: 'ask',
+      terminal,
+      resumeSessionId: legacy.id,
+    });
+
+    await waitFor(() => driver.sessionIds.length === 1);
+    await waitForTuiPaint(terminal);
+    await waitFor(() =>
+      plainTerminalOutput(terminal.screenOutput()).includes('one-time account confirmation'),
+    );
+    const output = plainTerminalOutput(terminal.screenOutput());
+    assert.match(output, /one-time account confirmation/);
+    assert.match(output, /Run \/model/);
+    assert.match(output, /run \/setup for API-key connections/);
+
+    exitMaka(terminal);
+    await run;
+  });
+
   test('reports a deleted original account and recovers only through an exact model pick', async () => {
     const terminal = new FakeTerminal();
     const deleted = {
@@ -7278,6 +7321,9 @@ describe('Maka Pi TUI runner', () => {
     await waitFor(() =>
       plainTerminalOutput(terminal.screenOutput()).includes('The original account was deleted'),
     );
+    const recoveryNotice = plainTerminalOutput(terminal.screenOutput());
+    assert.match(recoveryNotice, /Run \/model/);
+    assert.match(recoveryNotice, /run \/setup for API-key connections/);
     terminal.input('/model');
     terminal.input('\r');
     await waitFor(() => terminal.output().includes('Replacement'));
diff --git a/packages/cli/src/pi-tui-runner.ts b/packages/cli/src/pi-tui-runner.ts
index d5db8c0568..1ec9656c44 100644
--- a/packages/cli/src/pi-tui-runner.ts
+++ b/packages/cli/src/pi-tui-runner.ts
@@ -330,26 +330,30 @@ function sessionConnectionIdentityNotice(
   locale: UiLocale,
 ): string | undefined {
   if (!identities) return undefined;
+  const emptyChoiceRecovery =
+    locale === 'zh'
+      ? '如果 /model 没有可选项，请先添加或启用连接（API Key 连接可运行 /setup）。'
+      : 'If /model has no choices, add or enable a connection first (run /setup for API-key connections).';
   if (!session.llmConnectionId) {
     return locale === 'zh'
-      ? '此任务尚未绑定具体账号，请显式选择账号后继续。'
-      : 'This task is not bound to an exact account. Explicitly choose an account to continue.';
+      ? `此任务来自旧版本，需要确认一次账号。运行 /model 选择现有账号和模型。${emptyChoiceRecovery}`
+      : `This task comes from an older version and needs a one-time account confirmation. Run /model and choose an existing account and model. ${emptyChoiceRecovery}`;
   }
   const identified = identities.find((entry) => entry.connectionId === session.llmConnectionId);
   if (!identified) {
     return locale === 'zh'
-      ? '原账号已删除；请显式选择新账号后继续。'
-      : 'The original account was deleted. Explicitly choose a new account to continue.';
+      ? `原账号已删除；运行 /model 选择新账号和模型后继续。${emptyChoiceRecovery}`
+      : `The original account was deleted. Run /model and choose a new account and model to continue. ${emptyChoiceRecovery}`;
   }
   if (identified.connectionSlug !== session.llmConnectionSlug) {
     return locale === 'zh'
-      ? '任务保存的账号身份与当前连接不一致，请显式重新选择账号。'
-      : 'The saved account identity no longer matches its connection. Explicitly choose an account.';
+      ? `任务保存的账号身份与当前连接不一致；运行 /model 重新选择账号和模型。${emptyChoiceRecovery}`
+      : `The saved account identity no longer matches its connection. Run /model and choose an account and model again. ${emptyChoiceRecovery}`;
   }
   if (!identified.enabled) {
     return locale === 'zh'
-      ? '原账号已停用；请启用该账号或显式选择新账号后继续。'
-      : 'The original account is disabled. Enable it or explicitly choose a new account.';
+      ? `原账号已停用；请启用该账号，或运行 /model 选择新账号和模型。${emptyChoiceRecovery}`
+      : `The original account is disabled. Enable it, or run /model and choose a new account and model. ${emptyChoiceRecovery}`;
   }
   return undefined;
 }
diff --git a/packages/ui/src/__tests__/composer-model-picker-recovery.test.tsx b/packages/ui/src/__tests__/composer-model-picker-recovery.test.tsx
new file mode 100644
index 0000000000..2d874780c8
--- /dev/null
+++ b/packages/ui/src/__tests__/composer-model-picker-recovery.test.tsx
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { act, createRef } from 'react';
+import { createRoot } from 'react-dom/client';
+import { parseHTML } from 'linkedom';
+import type { ChatModelChoice } from '@maka/core/chat-model-choice';
+import type { SessionSummary } from '@maka/core/session';
+import { Composer, type ComposerHandle } from '../composer.js';
+import { LocaleProvider } from '../locale-context.js';
+
+test('the recovery handle opens the existing exact account-and-model picker', async () => {
+  const original = {
+    document: globalThis.document,
+    window: globalThis.window,
+    matchMedia: globalThis.matchMedia,
+    requestAnimationFrame: globalThis.requestAnimationFrame,
+    cancelAnimationFrame: globalThis.cancelAnimationFrame,
+    IS_REACT_ACT_ENVIRONMENT: (globalThis as typeof globalThis & {
+      IS_REACT_ACT_ENVIRONMENT?: boolean;
+    }).IS_REACT_ACT_ENVIRONMENT,
+  };
+  const { document, window } = parseHTML('<div id="root"></div>');
+  window.getComputedStyle = () => ({
+    direction: 'ltr',
+    writingMode: 'horizontal-tb',
+    getPropertyValue: () => '',
+  }) as unknown as CSSStyleDeclaration;
+  Object.assign(globalThis, {
+    document,
+    window,
+    matchMedia: () => ({ matches: false, addEventListener() {}, removeEventListener() {} }),
+    requestAnimationFrame: () => 1,
+    cancelAnimationFrame() {},
+    IS_REACT_ACT_ENVIRONMENT: true,
+  });
+  const container = document.querySelector('#root');
+  assert.ok(container);
+  const root = createRoot(container);
+  const composer = createRef<ComposerHandle>();
+  let selected: {
+    llmConnectionId: string;
+    llmConnectionSlug: string;
+    model: string;
+  } | undefined;
+  const choice: ChatModelChoice = {
+    connectionId: 'connection-openrouter',
+    connectionSlug: 'openrouter',
+    connectionName: 'OpenRouter',
+    providerType: 'openrouter',
+    providerLabel: 'OpenRouter',
+    model: 'openai/gpt-5',
+    label: 'GPT-5',
+    isDefault: true,
+    thinkingLevels: [],
+  };
+
+  try {
+    await act(() => root.render(
+      <LocaleProvider locale="en">
+        <Composer
+          ref={composer}
+          activeSession={{
+            id: 'legacy-session',
+            llmConnectionSlug: 'openrouter',
+            model: 'openai/gpt-5',
+          } as SessionSummary}
+          modelChoices={[choice]}
+          hideUnavailableCurrentModel
+          onModelChange={(input) => {
+            selected = input;
+          }}
+          onSend={() => undefined}
+          onStop={() => undefined}
+        />
+      </LocaleProvider>,
+    ));
+    assert.match(document.documentElement.innerHTML, /aria-expanded="false"[^>]*aria-haspopup="menu"/);
+
+    await act(() => composer.current?.openModelPicker());
+
+    assert.match(document.documentElement.innerHTML, /aria-expanded="true"[^>]*aria-haspopup="menu"/);
+    assert.match(document.documentElement.innerHTML, /GPT-5/);
+    const items = [...document.querySelectorAll<HTMLElement>('[role="menuitem"]')];
+    assert.equal(items.length, 1, 'the stale legacy target is not a selectable current row');
+
+    await act(() => items[0]?.dispatchEvent(new window.Event('click', { bubbles: true })));
+
+    assert.deepEqual(selected, {
+      llmConnectionId: 'connection-openrouter',
+      llmConnectionSlug: 'openrouter',
+      model: 'openai/gpt-5',
+    });
+    assert.match(document.documentElement.innerHTML, /aria-expanded="false"[^>]*aria-haspopup="menu"/);
+  } finally {
+    await act(() => root.unmount());
+    Object.assign(globalThis, original);
+  }
+});
diff --git a/packages/ui/src/chat-model-switcher.tsx b/packages/ui/src/chat-model-switcher.tsx
index 79f72f4e45..17de8ccaa4 100644
--- a/packages/ui/src/chat-model-switcher.tsx
+++ b/packages/ui/src/chat-model-switcher.tsx
@@ -211,6 +211,11 @@ export function ChatModelSwitcher(props: {
   hasConversationHistory?: boolean;
   pending?: boolean;
   disabledReason?: string;
+  /** Optional controlled open state used by an external recovery action. */
+  isMenuOpen?: boolean;
+  onMenuOpenChange?(open: boolean): void;
+  /** Hide a stale display-only row while the Session requires identity recovery. */
+  hideUnavailableCurrentOption?: boolean;
   renderProviderMark?(type: ProviderType): ReactNode;
   onChange?(input: {
     llmConnectionId: string;
@@ -229,7 +234,12 @@ export function ChatModelSwitcher(props: {
       )
     : undefined;
   const pending = Boolean(props.pending);
-  const [menuOpen, setMenuOpen] = useState(false);
+  const [internalMenuOpen, setInternalMenuOpen] = useState(false);
+  const menuOpen = props.isMenuOpen ?? internalMenuOpen;
+  const setMenuOpen = (open: boolean) => {
+    if (props.isMenuOpen === undefined) setInternalMenuOpen(open);
+    props.onMenuOpenChange?.(open);
+  };
   const disabled = pending || Boolean(props.disabledReason) || !props.onChange || props.choices.length === 0;
   const grouped = modelMenuGroups(props.choices, locale);
   const currentKnownChoice = props.choices.some(
@@ -246,6 +256,7 @@ export function ChatModelSwitcher(props: {
   return (
     <>
       <DropdownMenu
+        {...(props.isMenuOpen === undefined ? {} : { isMenuOpen: props.isMenuOpen })}
         placement="above"
         hasChevron={false}
         className="maka-composer-quiet-menu"
@@ -271,7 +282,11 @@ export function ChatModelSwitcher(props: {
         <ModelMenuItems
           groups={grouped}
           currentValue={currentValue}
-          leadingOption={!currentKnownChoice ? { label: displayLabel, providerType: props.currentProviderType } : undefined}
+          leadingOption={
+            !currentKnownChoice && !props.hideUnavailableCurrentOption
+              ? { label: displayLabel, providerType: props.currentProviderType }
+              : undefined
+          }
           renderProviderMark={props.renderProviderMark}
           disabled={disabled}
           onPick={async (next) => {
diff --git a/packages/ui/src/composer.tsx b/packages/ui/src/composer.tsx
index 8340af48c9..2d03c1b2c0 100644
--- a/packages/ui/src/composer.tsx
+++ b/packages/ui/src/composer.tsx
@@ -21,6 +21,7 @@ import {
   forwardRef,
   useEffect,
   useImperativeHandle,
+  useLayoutEffect,
   useMemo,
   useRef,
   useState,
@@ -208,6 +209,8 @@ export interface ComposerHandle {
   appendDraft?(draftKey: string, text: string): void;
   /** Move focus to the input without changing its content. */
   focus(): void;
+  /** Open the active Session's existing account-and-model picker. */
+  openModelPicker(): void;
 }
 
 export interface ComposerSendMetadata {
@@ -310,6 +313,8 @@ export const Composer = forwardRef<
     modelChoices?: ChatModelChoice[];
     /** Whether this Session already has conversation history whose provider prompt cache may be rebuilt by a switch. */
     modelSwitchHasHistory?: boolean;
+    /** Identity recovery must not present the stale target as a checked, selectable row. */
+    hideUnavailableCurrentModel?: boolean;
     /** Renders the provider brand mark beside each model option;
      *  injected by the desktop app to keep the provider SVG library out of @maka/ui. */
     renderProviderMark?(type: ProviderType): ReactNode;
@@ -482,6 +487,8 @@ export const Composer = forwardRef<
   }
   const [dragActive, setDragActive] = useState(false);
   const [sendPending, setSendPending] = useState(false);
+  const [modelPickerOpen, setModelPickerOpen] = useState(false);
+  useLayoutEffect(() => setModelPickerOpen(false), [props.activeSession?.id]);
   const [pendingImportAction, setPendingImportAction] = useState<ComposerImportActionId | null>(null);
   const composerMountedRef = useMountedRef();
   const sendPendingRef = useRef(false);
@@ -1136,6 +1143,9 @@ export const Composer = forwardRef<
       focus() {
         focusInput();
       },
+      openModelPicker() {
+        setModelPickerOpen(true);
+      },
     }),
     [],
   );
@@ -1966,6 +1976,9 @@ export const Composer = forwardRef<
                     hasConversationHistory={props.modelSwitchHasHistory}
                     pending={props.modelChangePending}
                     disabledReason={modelSwitcherDisabledReason}
+                    isMenuOpen={modelPickerOpen}
+                    onMenuOpenChange={setModelPickerOpen}
+                    hideUnavailableCurrentOption={props.hideUnavailableCurrentModel}
                     renderProviderMark={props.renderProviderMark}
                     onChange={props.onModelChange}
                   />