Fix: keep each tab's model across a restart

[DevMando]

Summary

An agent whose model you had switched could come back on the default model after restarting the app, with the switch permanently lost. This holds each tab's model across a restart.

What was happening

Restoring a workspace starts every tab initializing at the same time, and each tab boots on the default model before being moved onto the model it was saved with.

The workspace file records the current model of every tab, not just the one that changed — and it gets written constantly during startup, because ordinary UI refreshes (connection status, model validation, MCP startup) all funnel into a save. A save landing in that window wrote the default over the model of every tab that had not switched yet.

The saved value was then gone. That tab came back on the default on the next launch, and the launch after that, with nothing left to recover from.

This is why it only appeared after a restart, and why it could look intermittent: whether the damage stuck depended on which tab won the race.

What changed

• Workspace writes are held until every tab has finished restoring. The tab that finishes last performs a single save, at which point every tab reports its real model.
• A tab whose restore never finishes keeps its saved model. If restoration is interrupted — the window is closed during startup, or a tab errors part way through — that tab is still sitting on the default it was seeded with. Writing that would discard the user's choice, so the saved model is kept until the tab has actually settled.

Scope and risk

Low, and confined to workspace persistence at startup. No change to how models are chosen, applied, or validated; per-agent settings and the saved default were already correct and are untouched. The worst case if the new guard misbehaved is a workspace write being skipped, which leaves the previous saved state in place rather than losing anything.

Verification

• 303 Desktop tests pass; build clean with no warnings.
• Verified by hand: two tabs on different non-default models, restart, both return on their own models.

Not covered by automated tests — this needs a live window and a real workspace file, which no test harness creates. It was checked manually instead, including watching the workspace file during startup to confirm a single write occurs after the tabs settle rather than several with defaults in them.

Note for reviewers

Investigation ruled out the more obvious suspect: per-agent config is deep-cloned from the defaults, only one class may write the config file, and the model field on the defaults is never assigned anywhere in Desktop. Switching a model in one agent has never affected the saved default or any other agent. The bug was entirely in what the workspace file recorded during restore.