Review

Summary

Clean, well-scoped fix that does exactly what the title says — unload_model() gains an optional model_name so RAG's embedder refresh stops evicting the co-resident chat model. The signature is widened consistently across the ABC, the Lemonade provider, and the concrete client; the no-arg global form is preserved so every existing caller (init, chat preflight, UI eviction) is untouched. Removing the two except Exception: … continue swallows in _load_embedder is the right call under the no-silent-fallbacks rule, and tests cover both the scoped-vs-global payload and the cold-start regression. The one thing worth confirming before merge is below.

Issues

🟡 Cold-start scoped unload depends on Lemonade /unload being idempotent for a non-resident model (src/gaia/rag/sdk.py:492)

On a cold start the embedder slot is empty, yet _load_embedder() now issues unload_model(self.config.embedding_model) against a model that isn't loaded — and with the old try/except … continue gone, any error from that call propagates and breaks RAG entirely. The new regression test mocks unload_model, so it proves the call is scoped but can't prove a real Lemonade returns success when asked to unload a model it isn't holding. Your on-machine eval is the only evidence this case is safe.

Can you confirm the M2 Max eval actually exercised the empty-embedder-slot path (first RAG call after a fresh server start, nothing pre-loaded)? If Lemonade 4xx's on "unload a non-resident model" on any supported version, this turns a previously-tolerated no-op into a hard cold-start failure. If you've already seen it return success there, a one-line note in the PR is enough — no code change needed.

Strengths

• Signature widened everywhere it needs to be — base_client.py, providers/lemonade.py, and lemonade_client.py all match, and the model is None or self.model == model_name guard correctly scopes the self.model clear so a scoped unload of the embedder doesn't wrongly null out the chat model handle.
• Removing the swallows is correct, not just convenient — the old code set self.embedder = self.llm_client even after a load failure, deferring the error to encode time with a worse message; failing fast at load time is the better behavior and aligns with CLAUDE.md's no-silent-fallbacks rule.
• Tests pin the actual regression — test_unload_model_scoped_vs_global asserts the request body shape directly, and assert_called_once_with(config.embedding_model) doubly guards that the bare global form is never used on the RAG path. Docstrings and the corrected _load_embedder comment explain the why ([Bug][P0]: RAG embedder load issues a global /unload that evicts the chat model → 100s+ cold reloads & eval timeout #1544) without rotting.

Verdict

Approve with suggestions — no blocking code changes; just confirm the cold-start (embedder-not-yet-loaded) unload was exercised on real hardware, since the mocked test can't cover it. Nice, surgical fix.

Good catch — confirmed empirically. On a running Lemonade server, a scoped unload of a non-resident model returns 404 {"error":"Model not loaded: ..."}, so with the try/except gone this would have hard-failed RAG on a cold start. You also correctly guessed my eval never exercised it: nomic was already co-resident before the run, so every scoped unload hit a loaded model (200), never the cold 404.

Pushed a fix (fix(rag): don't break RAG cold start on empty embedder slot):

• unload_model() gains a keyword-only ignore_if_not_loaded=False. When set, it treats only Lemonade's 404 "Model not loaded" as a no-op ({"status": "not_loaded"}); a global unload, auth error, 500, or outage still raises. Default stays strict, so init / chat-preflight / UI-eviction callers are untouched.
• _load_embedder() opts in with ignore_if_not_loaded=True — it reloads on the next line, so an empty slot is benign here.
• Added test_unload_model_ignore_if_not_loaded covering all three branches: 404-tolerated (flag on), 404-raises (flag off / default), and 500-still-raises (flag on). RAG cold-start regression updated for the new kwarg.

This stays within the no-silent-fallbacks rule — it's the explicit opt-in exception (one named benign condition), not a blanket swallow.