feat: choose a separate model for Pro compaction

[JulianZJN]

Summary

Adds an optional model choice for the summary step of automatic Pro compaction:

Setting	Summary execution
Follow main (default)	Existing behavior
GPT-5.6 Extra High	GPT-5.6 at Extra High
GPT-5.6 Pro	GPT-5.6 at Pro
GPT-5.5 Pro	GPT-5.5 at Pro

Ordinary task turns keep their original model. Zero Risk, Luna, non-Pro tasks, context thresholds, and the five-minute handoff budget are unchanged.

Implementation

• The setting is read when a new logical compaction starts. Reconnects join the same run; changing the setting does not retarget work already in progress.
• Source lookup, deduplication, cancellation, and retirement remain keyed to the original Pro request. Only the summary execution receives the override.
• The daemon and browser helper negotiate an exact compaction-execution contract. Older helpers reject the request instead of ignoring the setting.
• The browser pins the requested family and effort, then checks the live family, spoken state, and numeric picker position again immediately before sending. Missing or contradictory state fails before submission; no fallback model is chosen.
• Multipart preparation for an explicit choice stays below Pro effort. An indivisible record that needs the larger Pro envelope fails before sending rather than using an extra Pro staging message.
• The launcher writes the preference through its authenticated control channel. Production reads it without a restart; an existing DEV named-chat process must be reopened.

The detailed boundary and compatibility notes are in docs/compaction-model-selection.md.

Selector follow-up — 2026-09-14

Updated in 1291cc4:

• Reuse only a unique, exact, explicitly checked family row inside the composer-owned menu. Latest rendering 5.6 at lower effort does not prove an explicit 5.6 pin.
• Expand a collapsed model trigger before clicking: its advanced rows can have visible geometry while still being inert. Keep normal Playwright actionability checks; no force-click or global-menu fallback.
• Allow up to one second of read-only settling for checked state and spoken family/effort after changing controls. Immediate pre-send verification remains strict; no accepted-prompt retry or compaction-timeout extension.

Current branch validation

• bun test ./tests: 817 passed, 5 skipped, 0 failed.
• Compaction-selector targeted tests: 71 passed, 0 failed.
• Root TypeScript check, runtime bundle build, and relocatable runtime smoke passed.
• Offline Chromium DOM regression: 2 passed, 0 failed on each standalone branch. The test uses a new unauthenticated context, blocks network requests, and is explicitly opt-in via CHATGPT_PICKER_TEST_CHROME.
• No paid ChatGPT prompt, GPT-6 Pro call, launcher replacement, or installed-profile change was made during this follow-up. Launcher packaging and a full authenticated end-to-end run of these standalone branches were not repeated.

Separate earlier installed evidence comes from a local-enhanced integration: an actual 5.6 selector-only probe changed from a five-second intercepted-click failure to success in 2.16 seconds without submitting a prompt; after that installation an ordinary task passed selection and reached submission acceptance. This is not evidence that its entire task completed or that all model versions were live-tested.

No aggregate bun run verify or cross-platform packaging success is claimed for this follow-up.

Earlier feature validation (before this selector follow-up)

• bun test ./tests: 807 passed, 1 skipped, 0 failed.
• bun run launcher:test: 300 passed, 1 skipped, 0 failed.
• Root and launcher TypeScript checks, renderer build, version check, notice generation, runtime bundle build, and relocatable release smoke passed.
• Installed signed-in validation now covers both fixed Pro choices: GPT-5.6 Pro and GPT-5.5 Pro each completed compaction. The earlier GPT-5.6 Extra High prototype also completed a fresh-history compaction; that run was narrower than a full retained-task workload.
• The final cleanup commit removes duplicated model mapping and tightens the internal configuration command. The touched modules pass a focused TypeScript check and policy smoke test.

The earlier dependency-audit note is superseded: the pre-follow-up b344682 CI run passed both dependency audits and Ubuntu verification, but Windows had test timeouts/a helper IPC EPIPE failure, and macOS failed packaged signature verification. This selector-only follow-up does not claim to repair those separate failures; the new CI run must be evaluated independently.

Scope

This selector follow-up adds no dependency, lockfile, routing, statistics, main-task model, compaction-threshold, or timeout changes. It preserves the dependency fixes already on the branch. This is separate from #439, which proposes model selection for ordinary Pro turns.

[JulianZJN]

Follow-up is in 8fe8ffb. Both fixed Pro choices have now completed compaction in the installed signed-in flow. I also removed the duplicated model mapping, made the launcher-only config command accept one exact form, and tightened the documentation. Marked this ready for review.

[JulianZJN]

Updated this existing PR in 1291cc4 with the installed selector repair, adapted to this branch's own API.

The fix distinguishes an explicitly checked family from Latest's rendered low-effort model, expands collapsed inert model rows before an actionable click, and bounds post-change state settling to one second. Pre-send model/effort checks still fail closed; no force-click, model fallback, accepted-prompt resend, or longer compaction budget was added.

Validation on this branch: 817 root tests passed, 5 skipped, 0 failed; 71 compaction-selector tests passed; 2 offline real-Chromium DOM tests passed; TypeScript, runtime build, and relocatable smoke passed. The opt-in DOM reproduction and evidence boundaries are documented in the PR.

The earlier live success was on the local-enhanced integration, not a new paid end-to-end run of this standalone branch. No paid prompts or installed app/profile changes were made in this update. I also refreshed the PR description to separate current verification from earlier feature testing and correct the stale dependency-audit CI note. New GitHub CI results remain separate from these local checks.