feat(models): BYOK all the way down — factory pins deleted, per-need refusal gates

Owner decision 2026-09-22: 'it doesn't make sense to have any default
model configured anywhere; the application is bring your own keys.'

config.ts: MODELS deleted; ModelRole becomes an explicit 9-role union;
DEFAULT_THINKING_ORDER (medium, low, high, minimal, xhigh, max) bakes
the unset-level default — first entry the model supports; explicitly
set levels keep pi's native nearest-clamp.

core/settings-resolution: the factory layer dissolves — the chain is
role override → slot → NOTHING. resolveSettings(record) takes no
factory. Empty chains resolve to null/undefined; a thinkingLevel-only
slot is inert (stored, never run). resolveConversationSpec: chat.model
override over the strong slot, null when both empty. resolveRoleSpec
spans all nine roles for the job/extraction engines.

Refusal envelope (core/settings.ts): modelsNotConfigured(missing) —
{error, code: 'models_not_configured', missing: [slot tiers]} +
ModelsNotConfiguredError with .envelope. Per-need gates, each honest:
- chat-handler: universal turn gate (new + continuing turns) returns
  503 before beginTurn — no liveness, no write-ahead persist, no graph
  trigger before the gate fires.
- runner.runJob: unresolvable engine lands the job as error with the
  envelope wording; no phantom loop, no result steer.
- extraction: refuseIfStagesUnconfigured throws before any stage
  (turn-service info-skips so coverage retries next turn; the import
  route surfaces per-file code+missing); labeler-less runs skip
  cluster naming with a console line and still merge.

Write side: slot entries must carry a model — level-only slot writes
are 400s (absent slot key = clear). piEngineForSpec resolves unset
thinking levels via DEFAULT_THINKING_ORDER; piEngineFor now throws
honestly; thinkingLevelFor/modelIdFor deleted; teacher-agent, pi-run,
visual-maker, pdf-reader all read engine.level.

model-catalog: defaults/slots/rolePins null when the chain is empty
(contracts nullable) — no phantom ids in payloads. Stores drop
MODEL_PINS entirely.

Tests: pin-leaners converted to explicit injection (per-chat model
pins on scripted chats — exactly what the setup flow writes; faux
engines for agent-construction tests). New coverage: the 503 gate
envelope, the runner refusal, the extraction refusal + labeler skip.

Gates: typecheck, lint, 815/815, build.

src/server/stores.ts

@@ -6,12 +6,11 @@
  * file (and the adapter implementations in src/store/).
  */
 
-import { MODELS } from "../../config.ts";
 import { chatStore } from "../store/chats.ts";
 import { graphStore } from "../store/graph.ts";
 import { jobStore } from "../store/jobs.ts";
 import { settingsStore } from "../store/settings.ts";
-import { resolveSettings, type EffectiveSettings, type ModelRoleSpecs } from "../core/settings-resolution.ts";
+import { resolveSettings, type EffectiveSettings } from "../core/settings-resolution.ts";
 /** The wired adapters. Satisfies core/graph.ts's GraphDeps structurally. */
 export const stores = {
 	chatStore,
@@ -22,32 +21,14 @@ export const stores = {
 
 export type Stores = typeof stores;
 
-/** config.ts's MODELS as the compiled factory layer the resolution reads —
- *  ALL NINE roles since the model-slots wave (2026-09-20): the strong
- *  slot's factory fallback IS the prober pin. core stays pure (it takes
- *  this as a parameter, never imports config at runtime). Per-role
- *  OVERRIDES stay background-only (the conversation pair is
- *  chat-settings-controlled) — that split lives in core's
- *  BACKGROUND_MODEL_ROLES, unchanged. */
-const MODEL_PINS: ModelRoleSpecs = {
-	prober: MODELS.prober,
-	teacher: MODELS.teacher,
-	researcher: MODELS.researcher,
-	demoBuilder: MODELS.demoBuilder,
-	visualMaker: MODELS.visualMaker,
-	pdfReader: MODELS.pdfReader,
-	extractor: MODELS.extractor,
-	auditor: MODELS.auditor,
-	labeler: MODELS.labeler,
-};
-export { MODEL_PINS };
-
 /**
  * The resolved view of the settings record (core/settings-resolution.ts):
- * every knob concrete, record overrides over config.ts factory pins. Read
+ * every knob concrete over its factory default — EXCEPT MODELS (BYOK all
+ * the way down, owner 2026-09-22): no factory pins exist, so unset model
+ * slots resolve to null and per-need refusal gates fire downstream. Read
  * fresh on every call — the record is a small file and turns are rare, so
  * no caching layer (stale toggles after a settings PUT would be worse).
  */
 export function effectiveSettings(): EffectiveSettings {
-	return resolveSettings(settingsStore.readSettings(), MODEL_PINS);
+	return resolveSettings(settingsStore.readSettings());
 }