The fromPersisted-by-call-site marker kept getting misapplied because those
sites carry both storage restores and fresh live edits, and the cold-cache
park/revalidate raced the load path. Replace it with per-value provenance: each
GPU pick carries the index space it was made under, and reconcile drops it only
when that stamp no longer matches the backend.
- use-gpu-info: currentGpuIndexKind() (from /api/system gguf_devices); drop the
session-global gpuIndexSpaceChanged marker machinery.
- PerModelConfig gains selectedGpuIdsIndexKind (persisted); the runtime store
gains selectedGpuIdsKind, stamped wherever a pick is set (live picker = current
kind, load echo = current kind, config apply = the config's stamp).
- reconcilePersistedGpuIds(ids, savedKind): drop when savedKind != current kind
(both known); unstamped picks default to physical (pre-Vulkan).
- Run settings stamps the current kind when the user edits the GPU picker, so an
edited pick is never treated as a stale cross-space restore; an unedited
stored pick keeps its saved kind.
- No more park-null / async revalidate / fromPersisted: a same-backend refresh
keeps the saved subset (kinds match), a cross-space pin is dropped, and the
load snapshot carries the stamp so it can't send a wrong-space pin.
Fixes the three Codex findings (cold-cache saved-pick loss, model-generation
race, unedited run-settings treated as live). Contract tests updated; typecheck
+ build + tests/studio contracts green.
00c4ef762e