feat: use managed model capabilities for reasoning and image input

.project-docs/30-worklog/tasks/20260912-model-capabilities-c48271f9.md

@@ -12,47 +12,36 @@
 
 ## Scope
 
-- Read-only assessment of Makelore imported model capabilities, local profiles, model UI and Pi runtime capability resolution.
-- Product source, test suites, main checkout and other task records remain unchanged.
-- Maintain only this task record.
+- Implement authoritative managed-model v2 import and persistence, provider input metadata, durable native reasoning choices, Main validation/frozen request context, Pi hook and child-worker propagation, runtime/image UI and focused unit/Electron coverage.
 
 ## Intent And Constraints
 
-- User requested independent assessment across Works Square, one-api and Makelore; no subagents were created.
-- Concurrent Task Gate: Passed. Bundled check/start/status verified this task ID, feature mode, branch, exact base and owned isolated worktree. The original checkout had unrelated uncommitted task documents.
-- Project Context Loaded: read entry/memory index, active task, positioning/current-state, decision index, system/module/data-flow documents, domain/success criteria, relevant evidence/reflection/commitment/stale indexes; also AGENTS.md, README and ADR-006 Pi hard cutover.
-- Goal and focus: Makelore provides Code/Canvas/Robot with Main-owned providers and Pi 0.84.2.
-- Planning Gate: Passed for assessment only. Proposals do not enact architecture changes or promote canonical memory.
-- Peer scopes were read via registry task-record paths only. Numerous historical owners and placeholder scopes remain; these are unknown coordination state, not authority to adopt work. Assessment is confined to a fixed committed baseline and task-owned records, so there is no shared source writer or conflicting implementation decision.
-- Relevant established boundary: Works already owns optional per-model reasoning metadata; client local profiles supply fallback and provider wire adaptations. Replacing this authority is a proposal requiring agreement, not a presumed accepted ADR.
-- Stale/unknown context: client positioning contains placeholders, so current README/AGENTS/ADR-006 bound the assessment; historical OpenCode/gateway notes are not runtime truth. Installed/deployed state, live provider/account coverage, and one-api internals are unverified.
-- Diagnosis scope: no production failure or provider response was supplied. Used real source functions to reproduce concrete contract gaps; no speculative runtime root cause, temporary instrumentation, or remediation loop is claimed.
+- The user approved the detailed design and requested implementation. Concurrent Task Gate and Planning Gate passed in this exact owned feature worktree before edits; start/status matched task/branch/base and peer records were read. Numerous historical placeholder peers remain unknown coordination state, with no unresolved concrete dependency blocking these isolated changes.
+- Applied maintain-project-docs from C:/Users/7brot/.codex/skills/maintain-project-docs. Relevant entry, task, positioning/decisions/architecture/domain/evidence and commitments were loaded. No subagents, main-checkout changes, canonical-memory promotion, deployment or paid inference calls.
+- Related task IDs: Works 20260912-model-capabilities-a7e194c2; one-api 20260912-model-capabilities-b6392e1d; Makelore 20260912-model-capabilities-c48271f9.
 
 ## Outcome
 
-- Confirmed server reasoning override exists, but low/high/max normalization drops other efforts and modalities. Model labels depend on local profiles, runtime image support combines other local sources, and live effort controls use Main/Pi snapshots. No product change. Cross-project one-api inspection remains blocked pending user exception.
-- Detailed evidence: D:\Datas\PythonProjects\.codex-worktrees\works-square-server\20260912-model-capabilities-a7e194c2\.project-docs\50-evidence\topics\20260912-model-capabilities-a7e194c2__model-capability-assessment.md
-- Recommended provider/channel capability catalog -> Works business-filtered projection -> one resolved client UI/runtime capability. This remains a recommendation.
-- one-api gate exception request remains pending; no inference from elapsed time.
+- Managed niancode-user-models consumes only server v2 facts for image/reasoning capabilities. Missing/malformed capabilities stay unknown instead of borrowing local profiles; BYOK retains existing behavior. V2 public aliases and arbitrary native effort strings are preserved.
+- ProductModelRef durably stores default/disabled/enabled+native effort separately from the Pi carrier enum. Model switches reset managed choice to default; refresh-invalid choices and unsupported image submissions are rejected by Main before prompt acceptance.
+- Main writes a prepared managed request into the existing worker context, including child workers. The materialized Pi before_provider_request hook removes SDK-injected thinking controls and applies the frozen fields on each request/tool continuation. Default omits controls instead of accidentally disabling thinking.
+- Renderer menus show model default, switch options and original effort strings (including xhigh/new values). Main/provider descriptor and image attachment UI agree; the project model cards display authoritative capability summaries. Existing Web Search and provider refresh coordination are retained.
+- The legacy snapshot reducer rejected empty availableThinkingLevels, discovered by the new runtime test; managed snapshots now carry the separate capability field without emitting an invalid empty legacy enum list.
 
 ## Verification
 
-- Bundled check_project_docs/start/status passed for this owned worktree.
-- Actual shared TypeScript modules transpiled in memory and executed: low/medium/xhigh reduced to low, modality removed, gpt-4.1-mini label = text; intentional preservation assertion exited 1.
-- Official Alibaba/Anthropic/OpenAI/Google docs were checked for metadata availability; no paid model/network API probe.
-- No full application build or broad tests: no product behavior changed. Documentation drift and final Git boundary check are the completion checks.
+- Task Documentation Gate: source changes reviewed and bundled task-aware documentation drift check passed. The result and this Ready for Integration record are committed together; registry completion follows the commit.
+
+- 70 tests passed in 11 focused files covering managed normalization/options and actual Pi HTTP payload, provider projection/import, runtime persistence/invalid selection rejection, session registry, project config, extension host/bundle, provider refresh and composer behavior. The updated provider import test also passed separately after adding v2 persistence coverage.
+- Actual Electron E2E passed: v2 exposes native xhigh, submits {mode: enabled, effort: xhigh}, offers model-default/disabled, and disables image attachment for a text-only model.
+- pnpm run typecheck and pnpm run build:vite passed. Additional full Main tsc reported 61 diagnostics; an in-memory TypeScript baseline comparison against recorded base found the same 61 and zero additions. The temporary comparison script was removed.
+- HTTP serialization uses a local server and actual Pi 0.84.2 provider plus the materialized extension, covering default/disabled/enabled/low/medium/xhigh/max/future-native with Qwen and DeepSeek controls. No paid inference request was sent.
+- Git working and committed changes since the recorded base were inspected. Documentation drift and final committed ownership completion recorded below.
 
 ## Follow-ups
 
-- Finish one-api read-only source tracing only after user permission or a functioning task gate.
-- Agree capability ownership and contract, then implement coordinated server/client/gateway changes with end-to-end fixture coverage and provider serialization tests.
-- Actual deployment, refresh and account-specific provider metadata coverage require later verification.
+- Integrate alongside one-api and Works. Deployment acceptance must verify the real account catalog/group and provider HTTP responses. Existing 61 Main type errors are outside this change. Budget DTO is preserved with no first-delivery budget editor.
 
 ## Promotion Candidates
 
-- Target: canonical model/provider architecture and data-flow docs.
-- Proposal: centralize platform-managed effective capability in a provider-aware one-api catalog and project it through Works Square to Main/Pi and UI; distinguish unknown, unsupported, switch-only, effort and budget.
-- Evidence: source functions and dated official references in the assessment.
-- Future impact: model onboarding, UI labels, attachments, reasoning selection and wire serialization.
-- Semantic conflict: existing canonical rules currently make Works server static metadata authoritative with client local fallback; no canonical edit is made.
-- Human confirmation required: yes, before accepting the architecture and implementing the cross-repository behavior.
+- Promote v2 authority for managed modalities/reasoning, durable native product choice and Main-owned Pi payload preparation to canonical architecture/ADR/current-state during integration. Evidence: new actual HTTP test, runtime regression, Electron E2E and server/gateway linked tasks. User approved the design and implementation; BYOK and existing Web Search remain separate, with v1 reserved for older client support.