Bind sessions to their selected model

docs/USER_GUIDE.md

@@ -196,12 +196,11 @@ stored per model; the custom system prompt is shared across profiles. Other
 sections control A2UI, permission defaults, endpoint settings, Git diff display,
 Dev Brain, extensions, checkpoint storage, and diagnostics.
 
-A session remains model-independent until its first tool call. That call locks
-the session to its model so persisted tool syntax is never mixed. Continuing a
-locked session while another model is active asks before switching back. Legacy
-sessions recover the exact model from their checkpoint when available; a legacy
-tool session whose exact model can no longer be identified remains viewable but
-cannot be continued.
+A new draft uses the currently selected model when its first turn is persisted.
+From then on the session keeps that exact model, so opening it immediately selects
+the same model and that model's thinking choices. Legacy sessions recover the
+exact model from their checkpoint when available; a legacy session whose
+exact model can no longer be identified remains viewable but cannot be continued.
 
 ### Main views, sidebar, and branches
 
@@ -232,7 +231,9 @@ restarts the local listener.
 accepts `none`, `high`, or `max`; GLM 5.3 Flash accepts `low`, `high`, or `max`.
 Omitting it uses the upstream model default: `low` for DeepSeek and `max` for
 both GLM models. Unsupported values and conflicting thinking controls return a
-400 error instead of being converted to another effort.
+400 error instead of being converted to another effort. This per-model thinking
+selection is intentionally part of the DS4Server agent harness, not a DS4 parity
+surface; do not replace it with mapped, hidden, or shared choices.
 
 ### Data and recovery