[bug] `--model` is silently ignored on the default (TUI) entry path: an unresolvable id runs the configured default model with no warning

Description

--model is validated on the opencode run path but silently discarded on the default (TUI) entry
path. opencode --model <unresolvable-id> --prompt ... creates the session on the configured
default model and provider, completes the turn normally, and never mentions the requested id — no
warning, no error, no failure.

Both observables report the substitute as though it had been requested: the session record logs
model.id=<default> and the TUI footer shows the default model. Nothing anywhere records what was
asked for. Automation that pins a model on the command line therefore cannot determine which model
actually ran, and cannot detect that a pin stopped being honoured.

Plugins

None — reproduced with --pure and an empty XDG_CONFIG_HOME.

OpenCode version

1.18.27. Also reproduced on 1.18.26 and 1.18.25.

Operating System

NixOS, Linux 6.18 x86_64

Terminal

xterm-256color, run non-interactively inside a PTY

Steps to reproduce

Same unresolvable model id, two entry paths.

1. Scratch project:

mkdir -p /tmp/oc-repro && cd /tmp/oc-repro && git init -q

2. run path — behaves correctly:

cd /tmp/oc-repro && opencode run --pure --print-logs --log-level INFO \
  --model opencode/totally-bogus-model-zzz "Reply with the single word OK."
echo "exit=$?"

Result: exit=1, and the log carries the provider error:

level=ERROR message=failed ref=err_... error="ProviderModelNotFoundError: Model not found: opencode/totally-bogus-model-zzz."

3. Default (TUI) path, same id — the bug. Needs a TTY:

cd /tmp/oc-repro && opencode --pure --agent build --auto \
  --model opencode/totally-bogus-model-zzz --prompt "Reply with the single word OK."

Result: the prompt is answered normally. The footer reads
Build auto · Muse Spark 1.3 Contributor OpenCode Go — the configured default, not the requested
model. The session record for that run:

message=created ... version=1.18.27 agent=build model.id=muse-spark-1.3-contributor model.providerID=opencode-go

Grepping that run's log lines for the requested id (totally-bogus) returns 0 matches, and the
run logs no WARN or ERROR about the model.

Additional observations

These change the shape of the bug, so they are worth stating explicitly.

1. Any unresolvable id substitutes, not just a garbage one. Tested both a nonsense id (above) and
   an id that had been retired from the provider's live roster (opencode/x-preview-f-free, still
   listed in an older cached catalog); both behave identically.
2. The substitute is simply the configured default: an invocation with no --model at all
   produces the same model.id and model.providerID. The flag is inert on this path rather than
   resolving to a nearest match.
3. The substitution crosses providers. The request named provider opencode; the run used
   provider opencode-go. A pinned provider is not honoured either.
4. --model is honoured on this path when the id resolves: --model opencode/mimo-v2.5-free
   produced model.id=mimo-v2.5-free model.providerID=opencode. So the gap is missing validation,
   not broken selection.

Suggested shape of a fix

On the default entry path, resolve --model through the same resolution run uses and fail loudly.
At minimum, emit a WARN naming both the requested id and the substitute instead of falling through to
the default silently.

Related

• #47162 covers the error shape on the run path (generic 500 rather than a 404 with the
  "did you mean" message). The run path at least fails. This report is that the default path does
  not fail at all.
• #37797 is the same family on a different surface (the Task tool ignoring a subagent model field).

Posted on behalf of @schickling

field	value
agent_identity	dev3.misc-lead
session	dev3.1788b94d
agent_persona	teamlead
agent_supervisor	dev3.cos
agent_tool	OMP
agent_tool_version	18.1.2
agent_runtime	OMP 18.1.2
tooling_profile	dotfiles@3fdc95b-dirty