feat(models): BYOK all the way down — factory pins deleted, per-need refusal gates

Owner decision 2026-09-22: 'it doesn't make sense to have any default
model configured anywhere; the application is bring your own keys.'

config.ts: MODELS deleted; ModelRole becomes an explicit 9-role union;
DEFAULT_THINKING_ORDER (medium, low, high, minimal, xhigh, max) bakes
the unset-level default — first entry the model supports; explicitly
set levels keep pi's native nearest-clamp.

core/settings-resolution: the factory layer dissolves — the chain is
role override → slot → NOTHING. resolveSettings(record) takes no
factory. Empty chains resolve to null/undefined; a thinkingLevel-only
slot is inert (stored, never run). resolveConversationSpec: chat.model
override over the strong slot, null when both empty. resolveRoleSpec
spans all nine roles for the job/extraction engines.

Refusal envelope (core/settings.ts): modelsNotConfigured(missing) —
{error, code: 'models_not_configured', missing: [slot tiers]} +
ModelsNotConfiguredError with .envelope. Per-need gates, each honest:
- chat-handler: universal turn gate (new + continuing turns) returns
  503 before beginTurn — no liveness, no write-ahead persist, no graph
  trigger before the gate fires.
- runner.runJob: unresolvable engine lands the job as error with the
  envelope wording; no phantom loop, no result steer.
- extraction: refuseIfStagesUnconfigured throws before any stage
  (turn-service info-skips so coverage retries next turn; the import
  route surfaces per-file code+missing); labeler-less runs skip
  cluster naming with a console line and still merge.

Write side: slot entries must carry a model — level-only slot writes
are 400s (absent slot key = clear). piEngineForSpec resolves unset
thinking levels via DEFAULT_THINKING_ORDER; piEngineFor now throws
honestly; thinkingLevelFor/modelIdFor deleted; teacher-agent, pi-run,
visual-maker, pdf-reader all read engine.level.

model-catalog: defaults/slots/rolePins null when the chain is empty
(contracts nullable) — no phantom ids in payloads. Stores drop
MODEL_PINS entirely.

Tests: pin-leaners converted to explicit injection (per-chat model
pins on scripted chats — exactly what the setup flow writes; faux
engines for agent-construction tests). New coverage: the 503 gate
envelope, the runner refusal, the extraction refusal + labeler skip.

Gates: typecheck, lint, 815/815, build.

src/core/contracts/models.ts

@@ -26,38 +26,46 @@ export interface ModelCatalogEntry {
 	maxTokens: number;
 }
 
-/** The conversation agents' config pin (config.ts MODELS prober/teacher —
- *  one controller, so one pin): what a chat without settings runs. */
+/** The conversation agents' resolved default (BYOK, owner 2026-09-22): the
+ *  chat's model override over the STRONG slot — one controller, so one
+ *  default. thinkingLevel is optional: unset resolves from the baked
+ *  DEFAULT_THINKING_ORDER at engine build. */
 export interface CatalogDefaults {
 	model: { provider: string; id: string };
-	thinkingLevel: ThinkingLevel;
+	thinkingLevel?: ThinkingLevel;
 }
 
-/** One background role's RESOLVED pin (settings interlude, 2026-09-19):
- *  the user's agent-models override falling back to the config.ts MODELS
- *  pin — what that role actually runs today. The settings UI shows each
- *  agent-role row's "Default: <this>" caption from it. */
+/** One background role's RESOLVED pin (BYOK, owner 2026-09-22): what that
+ *  role actually runs today — role override → tier slot → NOTHING. NULL
+ *  = the role's chain is empty (the per-need gates refuse its work); the
+ *  settings UI shows "not configured" from it. */
 export type RolePins = Record<
 	BackgroundModelRole,
-	{ model: { provider: string; id: string }; thinkingLevel?: ThinkingLevel }
+	{ model: { provider: string; id: string }; thinkingLevel?: ThinkingLevel } | null
 >;
 
-/** One slot tier's RESOLVED pin (model slots wave, 2026-09-20): the
- *  strong/cheap/vision tier's concrete model — slot override falling back
- *  to the factory rep pin. The settings UI captions each slot row with it
- *  and the picker pre-fills from it. */
-export type SlotPins = Record<ModelSlotName, { model: { provider: string; id: string }; thinkingLevel?: ThinkingLevel }>;
+/** One slot tier's RESOLVED pin (BYOK, owner 2026-09-22): NULL = the tier
+ *  holds no model. The settings UI captions each slot row with it and the
+ *  picker pre-fills from it. */
+export type SlotPins = Record<
+	ModelSlotName,
+	{ model: { provider: string; id: string }; thinkingLevel?: ThinkingLevel } | null
+>;
 
 /** GET /api/models response. */
 export interface ModelCatalogResponse {
 	models: ModelCatalogEntry[];
-	defaults: CatalogDefaults;
+	/** The conversation agents' resolved default — NULL when the
+	 *  conversation chain is empty (no factory floor; the turn gate
+	 *  refuses with 503 models_not_configured). */
+	defaults: CatalogDefaults | null;
 	/** The six background roles' resolved pins (same resolution the agent
-	 *  factories use — src/server/stores.ts effectiveSettings). */
+	 *  factories use — src/server/stores.ts effectiveSettings); NULL per
+	 *  role = chain empty. */
 	rolePins: RolePins;
-	/** The three slot tiers' resolved pins (model slots wave, 2026-09-20):
-	 *  same resolution chain — role override → slot → factory pin — reported
-	 *  at tier granularity; effectiveSettings().models verbatim. */
+	/** The three slot tiers' resolved pins: role override → slot at tier
+	 *  granularity; effectiveSettings().models verbatim, NULL per unset
+	 *  tier. */
 	slots: SlotPins;
 	/** Providers with a PRESENT key, and which env var gates each — the
 	 *  model slots wave's federation surface (2026-09-20): the picker lists