feat: model + thinking control — the stats bar's picker, on pi-ai's catalog

The model-control wave (user-decided design, 2026-09-12): ONE controller
for the conversation agents (prober/teacher are functionally one agent);
background sub-agents stay config-pinned. pi-ai owns the registry — the
shipped 366-model OpenRouter catalog (cost, context, modality,
thinkingLevelMap), getSupportedThinkingLevels/clampThinkingLevel for the
per-model thinking truth, and streamSimple's automatic clamp. No second
registry to drift out of sync.

Seams:
- config.ts: ReasoningEffort retired for pi's ThinkingLevel
  (off|minimal|low|medium|high|xhigh|max). GLM roles go honest at "low" —
  pi's catalog says GLM-5.3-flash accepts exactly low|high|max, and the old
  "minimal" was silently clamped to low by streamSimple since the swap;
  nothing changes behaviorally. visualMaker → qwen/qwen3.8-flash (fixes
  the dead qwen/qwen3.8-max slug — the catalog only ships -0902; also the
  user's cost pick, 0.15/0.47 per-1M).
- src/agent/models.ts: piEngineFor(role, settings?) — provider+id resolved
  from the catalog, thinking level from settings ?? config, CLAMPED to the
  model's supported list (a settings change between models can never send
  an invalid level). PiEngine gains `level` (observability/tests).
- ChatRecord.settings {model?: {provider, id}, thinkingLevel?} — written
  by PUT /api/chats/[id]/settings (replace-whole, no updatedAt churn),
  read by chat-handler at turn composition: agents are stateless per turn,
  so the change is next-turn-effective by construction. The turns log
  still records the ACTUAL billed model (the honest witness).
- GET /api/models: the configured-provider catalog as client-safe DTOs
  (core/contracts/models.ts) + config defaults; a second provider joins
  the picker by registering it in piModels() — nothing else changes.
- PUT settings validation gate (src/server/model-catalog.ts): unknown
  provider/model or unsupported level → 400 carrying the supported list,
  never a silent clamp.
- scripts/sync-pricing.ts: regenerated PRICES/CONTEXT_LIMITS from pi-ai's
  shipped openrouter.json (offline; same source as the engine + picker).
  All 366 models priced; glm's stale 0.15/0.5 → pi's 0.075/0.25, limit
  1310720 → 1048576 — cost is inferred at read time, so history re-prices.
- UI (components/model-picker.tsx): stats-bar right side becomes model +
  thinking buttons; menus open ABOVE; fuzzy search over "provider id
  name" (core/fuzzy.ts — pi's /model pattern); model rows show name/id/
  price/context; the thinking menu lists exactly the chosen model's
  supported levels (GLM: low|high|max — no dead options, no "off").
  Model switch drops an incompatible pinned level (falls back to config,
  which clamps honestly) rather than carrying a 400.

Tests (350/350, +15): catalog projection + defaults, the settings gate,
pi thinking truth pinned against upgrades (glm low|high|max; minimal→low;
off→low — GLM cannot disable thinking), the engine factory's
override/fallback/clamp/throw matrix, fuzzy ranking, store round-trip,
and the re-priced folds (usage, stats bar, activity dock).

Live smoke (disposable driver, deleted): catalog route 366 + defaults;
glm+minimal → 400 + supported; turn 1 billed qwen/qwen3.8-flash under
the override; mid-session switch flipped turn 2 to glm; clear-overrides
restored the config pin. ALL CHECKS PASS on real OpenRouter.

src/server/chat-handler.ts

@@ -1,9 +1,10 @@
 import type { UIMessage } from "ai";
 import type { Usage } from "@earendil-works/pi-ai";
 import { createProberAgent, createTeacherAgent, type TeachingAgent } from "../agent/teacher-agent.ts";
+import { piEngineFor } from "../agent/models.ts";
 import { createJobRunner } from "../agent/subagents/runner.ts";
 import { createExtractionPipeline } from "../agent/subagents/extraction.ts";
-import { MODELS } from "../../config.ts";
+import type { ModelRole } from "../../config.ts";
 import { claimSteers, deliverJobResult, setJobRespawn, setTurnRunner } from "./jobs.ts";
 import { recordToPiMessages } from "./pi/record-adapter.ts";
 import { createPiTurnResponse } from "./pi/ui-stream.ts";
@@ -147,7 +148,13 @@ export async function handleChatRequest(
 	// Both share this whole composition (write-ahead persist, liveness,
 	// steers, usage, extraction) — only the agent differs.
 	const teaching = outgoing.some((m) => m.parts.some((p) => p.type === "tool-probe_done"));
-	const modelId = teaching ? MODELS.teacher.model : MODELS.prober.model;
+	const role: ModelRole = teaching ? "teacher" : "prober";
+	// The chat's model-control settings (prober/teacher only — one controller
+	// for the conversation agents; piEngineFor falls back to config on absent
+	// fields and clamps the thinking level to the model's supported list).
+	const settings = stores.chatStore.getChat(chatId)?.settings;
+	const engine = piEngineFor(role, settings);
+	const modelId = engine.model.id;
 	// Tests inject a factory: the agent is stateless per turn (docs/
 	// pi-engine-swap.md §2), so each request builds a fresh one off the
 	// transcript — the factory mirrors that seam exactly.
@@ -161,7 +168,7 @@ export async function handleChatRequest(
 						jobStore: stores.jobStore,
 						spawn: (job, input) => void jobRunner.runJob(job.id, input),
 					},
-					{ messages: recordToPiMessages(outgoing), onUsage: collectUsage },
+					{ engine, messages: recordToPiMessages(outgoing), onUsage: collectUsage },
 				)
 			: createProberAgent(
 					{
@@ -169,7 +176,7 @@ export async function handleChatRequest(
 						chatStore: stores.chatStore,
 						deliver: (steer) => void deliverJobResult(steer),
 					},
-					{ messages: recordToPiMessages(outgoing), onUsage: collectUsage },
+					{ engine, messages: recordToPiMessages(outgoing), onUsage: collectUsage },
 				);
 
 	// A test-injected agent gets no usage collector (tests assert the

src/server/index.ts

@@ -11,3 +11,4 @@ export * from "./jobs.ts";
 export * from "./stores.ts";
 export * from "./turn-liveness.ts";
 export * from "./observability.ts";
+export * from "./model-catalog.ts";

src/server/model-catalog.ts

@@ -0,0 +1,108 @@
+/**
+ * The model catalog's server surface (model-control wave, 2026-09-12):
+ * pi-ai's shipped OpenRouter catalog projected to client-safe DTOs for the
+ * picker (GET /api/models), plus the validation gate for per-chat settings
+ * (PUT /api/chats/[id]/settings).
+ *
+ * pi-ai owns ALL the data: the catalog (id/name/cost/context/modality/
+ * thinkingLevelMap) and the per-model thinking truth
+ * (getSupportedThinkingLevels / clampThinkingLevel). This module only
+ * projects and validates — no second registry to drift out of sync.
+ *
+ * Multi-provider future: `getModels()` is called per configured provider,
+ * so a second provider (pi-ai ships ~30) appears in the picker by adding
+ * it to piModels() in src/agent/models.ts — nothing here changes.
+ */
+
+import { getSupportedThinkingLevels, type Api, type Model } from "@earendil-works/pi-ai";
+import type { ThinkingLevel } from "@earendil-works/pi-agent-core";
+import { MODELS } from "../../config.ts";
+import { piModels } from "../agent/models.ts";
+import type { ChatSettings } from "../core/contracts/chat.ts";
+import type {
+	CatalogDefaults,
+	ModelCatalogEntry,
+	ModelCatalogResponse,
+} from "../core/contracts/models.ts";
+
+/** The picker's client-safe model entry (contract: core/contracts/models.ts). */
+export type ModelDto = ModelCatalogEntry;
+
+/** The conversation agents' config pin — what a settings-less chat runs. */
+export function catalogDefaults(): CatalogDefaults {
+	return {
+		model: { provider: "openrouter", id: MODELS.prober.model },
+		thinkingLevel: MODELS.prober.effort as ThinkingLevel,
+	};
+}
+
+/** Project one catalog model to the client DTO. */
+export function toModelDto(model: Model<Api>): ModelDto {
+	return {
+		id: model.id,
+		name: model.name,
+		provider: model.provider,
+		reasoning: model.reasoning,
+		input: [...model.input],
+		supportedLevels: getSupportedThinkingLevels(model),
+		cost: {
+			input: model.cost.input,
+			output: model.cost.output,
+			cacheRead: model.cost.cacheRead,
+			cacheWrite: model.cost.cacheWrite,
+		},
+		contextWindow: model.contextWindow,
+		maxTokens: model.maxTokens,
+	};
+}
+
+/** The full picker payload: every model of every configured provider
+ *  (sorted by provider then id — stable, diff-friendly) + the config
+ *  defaults a settings-less chat runs. */
+export function modelCatalog(): ModelCatalogResponse {
+	const models = piModels()
+		.getProviders()
+		.flatMap((p) => piModels().getModels(p.id))
+		.map(toModelDto)
+		.sort((a, b) => (a.provider === b.provider ? a.id.localeCompare(b.id) : a.provider.localeCompare(b.provider)));
+	return { models, defaults: catalogDefaults() };
+}
+
+/** One validated outcome for a settings write. */
+export type SettingsValidation =
+	| { ok: true }
+	| { ok: false; error: string; supported?: ThinkingLevel[] };
+
+/** Validate a picker write against the catalog (the settings route's gate).
+ *  `settings` is replace-whole: absent fields mean "config default".
+ *  - model: provider must be configured, id must exist in its catalog.
+ *  - thinkingLevel: must be in the resolved model's supported list —
+ *    the model the picker writes against (settings.model, else config's
+ *    prober/teacher pin; one controller, so the two specs share it). */
+export function validateChatSettings(settings: ChatSettings): SettingsValidation {
+	const providers = piModels().getProviders().map((p) => p.id);
+	if (settings.model) {
+		const { provider, id } = settings.model;
+		if (!providers.includes(provider)) {
+			return { ok: false, error: `Unknown provider "${provider}" — configured: ${providers.join(", ")}` };
+		}
+		if (!piModels().getModel(provider, id)) {
+			return { ok: false, error: `No model "${id}" in the ${provider} catalog` };
+		}
+	}
+	if (settings.thinkingLevel !== undefined) {
+		const provider = settings.model?.provider ?? "openrouter";
+		const id = settings.model?.id ?? MODELS.prober.model;
+		const model = piModels().getModel(provider, id);
+		if (!model) return { ok: false, error: `No model "${id}" in the ${provider} catalog` };
+		const supported = getSupportedThinkingLevels(model);
+		if (!supported.includes(settings.thinkingLevel)) {
+			return {
+				ok: false,
+				error: `${id} does not support thinking level "${settings.thinkingLevel}"`,
+				supported,
+			};
+		}
+	}
+	return { ok: true };
+}