Fleet members over-pin their model, so nothing follows the provider when a vendor retires an id

[Hmbown]

The design is already right; the written data is not

FleetMember (crates/tui/src/fleet/store.rs:125) already supports everything needed:

• model: Option<String> — "Absent with provider absent = inherit the session route (the operator route when the Fleet has one)."
• shortlist: bool — "A role-less model choice, not an executable roster member."

So a member that omits model already follows the provider automatically. No new mechanism is required.

What a real machine actually contains

~/.codewhale/fleets/default.toml, 27 members:

	count	consequence
explicit model pin	20	can never follow the provider
inherits the session route	7	follows correctly
shortlist = true	0	the role-less form is unused

When DeepSeek released V4.1 Flash as deepseek-flash and dropped deepseek-v4-flash from the account roster, the main session moved but every pinned member stayed on the retired id — visible in the Agents panel as three workers on deepseek-v4-flash while the parent ran deepseek-flash.

Note the old id is still served (those workers produced 277k/142k/270k tokens), so this is soft-deprecation, not breakage. And deepseek-v4-flash legitimately still exists for third-party hosts (Fireworks, OpenCode Zen, SiliconFlow, Together), which are unaffected by a first-party roster change. Any fix must be per route, never a global purge of an id.

Test fixtures are in a real user's shipped fleet

Four members are not roles at all — and they are executable role members, not shortlist rows:

orgcustom-router-id, model-a, model-b, legacy-saved-model

Finding how these reached a user's default fleet matters independently of the rest: something is writing test data into shipped defaults.

Work

1. Find what writes the pins. /fleet add, the ⇧F path from /model, and whatever generated the default fleet all appear to write an explicit provider + model even when inheriting would be correct. Default to inheritance; make the pin the deliberate opt-out it is documented to be.
2. Use shortlist: true for role-less model choices. Twenty pinned members and zero shortlist rows suggests the flag is never set by the code paths users actually take.
3. Surface drift, do not silently rewrite. When a pinned (provider, model) no longer appears in that provider's live roster, say so in /status and the fleet view, and offer a scoped migration. A silent route rewrite is forbidden by C04 and AGENTS.md, and a pin is a deliberate choice.
4. Trace the fixture leak and remove the residue from shipped defaults.

Not in scope

Do not remove the fleet concept or the agents profile layer. Both were examined and both are load-bearing — see the sibling issue on that question. This is a data and defaults problem, not a modelling one.