feat: improve model selection, capsule actions, and macOS maintenance

[GCWing]

Summary

Model selection can wait on catalog refreshes, future-default writes, and historical session restoration. Keep valid catalog snapshots available during background refresh, share device-scoped frontend reads, and persist session selectors without loading cold transcripts.

• Commit the current session selection before remembering future defaults; avoid redundant configuration writes, runtime invalidation, and context-window reads.
• Preserve session writer ownership, unknown persisted state fields, legacy metadata-only sessions, and state/metadata rollback across Desktop, CLI peer, and Remote Connect adapters.
• Add the public Capsule component and shared circular glass actions for tabs, selected tags, and model/provider controls, including keyboard, touch, reduced-transparency, and high-contrast behavior. Standardize compact edit icons and update Design Lab examples.
• Clean up macOS/Tao compiler warnings and deprecated atomic calls while retaining validated icon data and legacy filename-list drag semantics.

Type and Areas

Type: bug fix, performance, UI/UX, maintenance, tests, and documentation.

Areas: design system and Design Lab; Web UI model configuration and chat selectors; Rust Core session persistence/configuration; models.dev integration; Desktop/Tauri; CLI peer host; runtime IPC; vendored Tao.

Motivation / Impact

Warm model selectors remain usable while catalogs refresh. Changing a historical session's model edits its persisted header without restoring transcript history or reserving active-session capacity. Shared capsule actions float over intact labels with consistent geometry and accessible sibling controls.

Existing persisted and wire shapes remain unchanged. Tests cover legacy sessions, preservation of unknown state, failed writes, no-op configuration, and omitted/null/explicit reasoning request deserialization.

Verification

AI-assisted. Testing level: lightly tested through focused automated checks; native visuals and live remote scenarios remain unverified.

Passed:

• pnpm run check:web
• pnpm run check:core-boundaries
• pnpm run i18n:audit
• pnpm run theme:color-audit:all
• pnpm --dir src/web-ui run icons:check
• pnpm run motion:audit (review inventory, not a gate)
• pnpm --dir src/web-ui run test:run src/infrastructure/config/services/ModelCatalogStore.test.ts src/infrastructure/config/services/ConfigManager.test.ts src/flow_chat/components/ModelSelectorProviderLevels.test.tsx src/flow_chat/components/ModelSelectorExternal.test.tsx src/flow_chat/components/ModelSelectorAcpMode.test.tsx src/flow_chat/utils/modelResolution.test.ts src/flow_chat/services/flow-chat-manager/MessageModule.test.ts src/flow_chat/services/flow-chat-manager/SessionModule.test.ts src/app/scenes/settings/pages/ai/ModelSettingsPage.loading.test.tsx src/infrastructure/config/components/common/SettingsControlSizing.test.ts — 237 tests.
• pnpm --dir src/web-ui run test:run src/infrastructure/design-system/IconUsageIntegration.test.tsx src/app/startup/startupPreload.test.ts src/infrastructure/config/components/ModelTagsField.test.tsx src/flow_chat/components/HostPendingQueuePanel.test.tsx src/app/scenes/settings/pages/ai/ModelSettingsPage.presentation.test.ts src/infrastructure/config/components/ModelSettingsDialog.presentation.test.ts — 38 tests.
• node --test design-system/apps/design-lab/vite/component-detail-contract.test.mjs design-system/apps/design-lab/vite/component-preview-render.test.mjs design-system/packages/ui/tests/icon.test.mjs design-system/packages/ui/tests/icon-slots.test.mjs design-system/packages/ui/tests/capsule.test.mjs design-system/packages/ui/tests/tab-group.test.mjs — 81 tests.
• cargo test --locked -p openbitfun-services-integrations --no-default-features --features models-dev --lib models_dev::tests — 10 tests.
• cargo test --locked -p openbitfun-core --no-default-features --features model-catalog --lib infrastructure::ai::reasoning_catalog::tests — 14 tests.
• cargo test --locked -p openbitfun-core --no-default-features --lib service::config:: — 59 tests.
• cargo test --locked -p openbitfun-core --no-default-features --features agent-runtime,git --lib session_model_update — 4 tests.
• cargo test --locked -p openbitfun-core --no-default-features --features remote-connect,git --lib remote_attach_and_mutation_paths_preserve_workspace_ownership_facts — 1 contract test.
• cargo check --locked -p openbitfun-desktop
• cargo test --locked -p openbitfun-desktop --lib update_session_model_distinguishes_omitted_null_and_explicit_reasoning_presets — 1 test.
• cargo test --locked -p openbitfun-desktop --lib backend_effect_routing_is_owned_by_the_control_transaction — 1 test.
• cargo test --locked -p openbitfun-cli --bin openbitfun peer_host:: — 102 tests.
• node scripts/test-computer-use-context.mjs — 39 tests passed; real-browser fixture ignored.
• git diff --check origin/main...HEAD
• node scripts/check-git-object-sizes.mjs --base origin/main --head HEAD — 94 blobs checked.

Known failures:

• pnpm run design-system:check: package/Design Lab build passed, UI package tests passed (330), then two unchanged Flow Chat catalog assertions failed. The production adapter includes legacy AgentDelete/AgentInterrupt names that the presentation catalog excludes; backend registration also includes Task, AgentControl, and ListWorkspaces outside the catalog. The compared registry, adapters, backend registration, and test source are unchanged by this PR.
• pnpm --filter @openbitfun/design-lab run test: 70 passed, one existing user-bubble background mismatch failed (action-quiet-hover versus transparent). Both CSS sources and the assertion are unchanged by this PR.
• cargo test --locked -p openbitfun-agent-runtime-ipc: 67 passed; two non-UTF-8 filesystem fixtures failed with macOS Illegal byte sequence while creating their directories.

Reviewer Notes

Local storage, DOM/source contracts, device-activation isolation, CLI peer protocol fixtures, and remote routing guards were exercised. No live remote workspace, Remote Control, Peer Device Mode, or Detached Dispatch connection was exercised. Native UI/browser validation and screenshots were not performed, following the repository instruction.

Checklist

• Current requested changes are committed without generated build output, temporary prompts, or secrets.
• Verification outcomes and remaining failures are recorded above.
• User-facing strings, component documentation, and owning verification guides are updated.