Daniel Kinzler proposed in e-mail:

I would recommend to pull the code for changing the content model out of the API and/or EditPage. The new revision should be forced to have the same model as the old revision when editing via action=edit (in the UI or API).

It should only be done programmatically, in PHP, for special cases (which may or may not need special permissions [like editcontentmodel or T76793's flow-create-board]

... it should be specific cases, with specific conversion logic, purpose, and permissions. Not something that users may or may not be able to do in general.

Instead, WikiPage should get a doUpdateContentModel method, similar to doUpdateRestrictions, which would use insertProtectNullRevision resp Revision::newNullRevision. Content::convert should be used to perform the actual conversion. A special flag may force the conversion to be skipped (re-interpreting the content instead of converting it).

WikiPage::doEditContent could probably enforce that the new Content has the same model as the old Content. That would enforce this restriction on a pretty low level (though page moves still need extra checks if the model is not recorded in the database).

Were this to be implemented, Flow would have to be updated to call doUpdateContentModel(); it currently calls doEditContent() to add its revision that changes a page's content model to 'flow-board'.