feat: model + thinking control — the stats bar's picker, on pi-ai's catalog

The model-control wave (user-decided design, 2026-09-12): ONE controller
for the conversation agents (prober/teacher are functionally one agent);
background sub-agents stay config-pinned. pi-ai owns the registry — the
shipped 366-model OpenRouter catalog (cost, context, modality,
thinkingLevelMap), getSupportedThinkingLevels/clampThinkingLevel for the
per-model thinking truth, and streamSimple's automatic clamp. No second
registry to drift out of sync.

Seams:
- config.ts: ReasoningEffort retired for pi's ThinkingLevel
  (off|minimal|low|medium|high|xhigh|max). GLM roles go honest at "low" —
  pi's catalog says GLM-5.3-flash accepts exactly low|high|max, and the old
  "minimal" was silently clamped to low by streamSimple since the swap;
  nothing changes behaviorally. visualMaker → qwen/qwen3.8-flash (fixes
  the dead qwen/qwen3.8-max slug — the catalog only ships -0902; also the
  user's cost pick, 0.15/0.47 per-1M).
- src/agent/models.ts: piEngineFor(role, settings?) — provider+id resolved
  from the catalog, thinking level from settings ?? config, CLAMPED to the
  model's supported list (a settings change between models can never send
  an invalid level). PiEngine gains `level` (observability/tests).
- ChatRecord.settings {model?: {provider, id}, thinkingLevel?} — written
  by PUT /api/chats/[id]/settings (replace-whole, no updatedAt churn),
  read by chat-handler at turn composition: agents are stateless per turn,
  so the change is next-turn-effective by construction. The turns log
  still records the ACTUAL billed model (the honest witness).
- GET /api/models: the configured-provider catalog as client-safe DTOs
  (core/contracts/models.ts) + config defaults; a second provider joins
  the picker by registering it in piModels() — nothing else changes.
- PUT settings validation gate (src/server/model-catalog.ts): unknown
  provider/model or unsupported level → 400 carrying the supported list,
  never a silent clamp.
- scripts/sync-pricing.ts: regenerated PRICES/CONTEXT_LIMITS from pi-ai's
  shipped openrouter.json (offline; same source as the engine + picker).
  All 366 models priced; glm's stale 0.15/0.5 → pi's 0.075/0.25, limit
  1310720 → 1048576 — cost is inferred at read time, so history re-prices.
- UI (components/model-picker.tsx): stats-bar right side becomes model +
  thinking buttons; menus open ABOVE; fuzzy search over "provider id
  name" (core/fuzzy.ts — pi's /model pattern); model rows show name/id/
  price/context; the thinking menu lists exactly the chosen model's
  supported levels (GLM: low|high|max — no dead options, no "off").
  Model switch drops an incompatible pinned level (falls back to config,
  which clamps honestly) rather than carrying a 400.

Tests (350/350, +15): catalog projection + defaults, the settings gate,
pi thinking truth pinned against upgrades (glm low|high|max; minimal→low;
off→low — GLM cannot disable thinking), the engine factory's
override/fallback/clamp/throw matrix, fuzzy ranking, store round-trip,
and the re-priced folds (usage, stats bar, activity dock).

Live smoke (disposable driver, deleted): catalog route 366 + defaults;
glm+minimal → 400 + supported; turn 1 billed qwen/qwen3.8-flash under
the override; mid-session switch flipped turn 2 to glm; clear-overrides
restored the config pin. ALL CHECKS PASS on real OpenRouter.

src/agent/models.ts

@@ -1,4 +1,5 @@
 import {
+	clampThinkingLevel,
 	createModels,
 	type Api,
 	type Model,
@@ -8,6 +9,7 @@ import {
 import { openrouterProvider } from "@earendil-works/pi-ai/providers/openrouter";
 import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
 import { MODELS, type ModelRole } from "../../config.ts";
+import type { ChatSettings } from "../core/contracts/chat.ts";
 
 /**
  * The one engine factory every agent's model comes from (the pi-ai swap,
@@ -25,14 +27,17 @@ import { MODELS, type ModelRole } from "../../config.ts";
 export interface PiEngine {
 	model: Model<Api>;
 	streamFn: StreamFunction;
+	/** The resolved (config-or-settings, CLAMPED) thinking level —
+	 *  observability + tests; the streamFn pins it anyway. */
+	level?: ThinkingLevel;
 }
 
 export type { ThinkingLevel };
 
-/** config's effort scale maps 1:1 onto pi's thinking levels (none→off). */
+/** The role's config thinking level (config's scale IS pi's since the
+ * model-control wave — no mapping needed). */
 export function thinkingLevelFor(role: ModelRole): ThinkingLevel {
-	const effort = MODELS[role].effort as string;
-	return effort === "none" ? "off" : (effort as ThinkingLevel);
+	return MODELS[role].effort;
 }
 
 let collection: ReturnType<typeof createModels> | undefined;
@@ -51,18 +56,29 @@ export function openRouterApiKey(): string | undefined {
 	return process.env.OPENROUTER_API_KEY || undefined;
 }
 
-/** The production engine for one agent role (config.ts MODELS). */
-export function piEngineFor(role: ModelRole): PiEngine {
+/** The production engine for one agent role. `settings` is the chat's
+ * model-control override (prober/teacher only — sub-agent callers pass
+ * nothing and get config.ts's pin): any absent field falls back to the
+ * config spec, and the thinking level is CLAMPED to the model's supported
+ * list (pi's thinkingLevelMap — e.g. GLM-5.3-flash accepts low|high|max),
+ * so a settings change between models can never send an invalid level. */
+export function piEngineFor(role: ModelRole, settings?: ChatSettings): PiEngine {
 	const models: Models = piModels();
 	const spec = MODELS[role];
-	const model = models.getModel("openrouter", spec.model);
-	if (!model) throw new Error(`OpenRouter catalog has no model ${spec.model} (role ${role})`);
-	const level = thinkingLevelFor(role);
+	const modelId = settings?.model?.id ?? spec.model;
+	const providerId = settings?.model?.provider ?? "openrouter";
+	const model = models.getModel(providerId, modelId);
+	if (!model) {
+		throw new Error(`${providerId} catalog has no model ${modelId} (role ${role})`);
+	}
+	const requested = settings?.thinkingLevel ?? thinkingLevelFor(role);
+	const level = clampThinkingLevel(model, requested);
 	return {
 		model,
+		level,
 		// bound streamSimple: the agent loop forwards state.thinkingLevel as
-		// `reasoning` (undefined = off on pi-ai's scale); pin the role's level
-		// so a bare engine can never drift.
+		// `reasoning` (undefined = off on pi-ai's scale); the clamp above keeps
+		// the pin honest even when config or settings drift off the map.
 		streamFn: (requestModel, context, options) =>
 			models.streamSimple(requestModel, context, {
 				...options,