fix: improve chat controls, tool recovery, and router presets

[Open-Squilla]

Chat controls now group execution modes and fit narrow composer layouts. Background commands remain visible with session-scoped logs and stop controls after a turn finishes, and complete but invalid tool-call batches can be corrected without executing valid siblings or double-counting usage.

Scope

Scope boundary:

• Update the composer, progress controls, provider readiness indicators, and workbench keyboard focus treatment.
• Add session-owned process list/log/stop RPCs and WebUI controls, with epoch checks and generated v4 contracts. Preserve authoritative POSIX empty-group confirmation when natural completion races with Stop.
• Recover completed rejected tool argument batches with at most two correction attempts; preserve earlier results, replay context, and physical request usage.
• Update OpenRouter and TokenRhythm C0-C3 presets. TokenRhythm C1 uses deepseek-flash; OpenRouter C1 uses deepseek/deepseek-v4-flash-0731. Keep Electron's displayed default, onboarding probe, and saved model aligned with C1.
• Refresh explicitly managed OpenRouter inline presets on load while preserving custom/legacy configuration ownership. Separate OpenRouter's published output capability from its automatic request reservation.
• Clarify that submitting a Plan saves a proposal for review and does not start implementation.

Non-goals: changing operator-owned model ladders or adding credentials/live test evidence to the repository.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: None

If None, reason: maintainer-requested integration of reviewed local changes and follow-up fixes.

Release Note

Release note: Improves chat controls, background-process visibility, invalid tool-argument recovery, and recommended model routing; fixes stale OpenRouter recommended presets after upgrades.

Tests

Ruff: ruff check src tests passed; git diff --check passed.

Pytest: focused offline suites passed for tool rejection/recovery, ensemble usage, session processes, router presets/upgrades, request payloads, capacity, onboarding, and Desktop configuration bridging. The Windows symlink persistence test fails at fixture setup with WinError 1314 on the unchanged base as well; the relevant persistence suite otherwise passed.

Build: Electron TypeScript build and desktop router configuration/normalization scripts passed. Six targeted WebUI files passed (298 tests). Plan presentation and task progress browser tests passed across desktop and narrow viewports; composer Stop retains its 44px hit target and pending cancellation state.

Contract verification: all 910 roles and 235 production roles passed; the 22 Node tooling tests passed. Follow-up Python suites passed 186 tests with 31 platform/integration skips.

Regression tests: added for managed preset upgrades, custom/legacy preservation, sparse saves, reactivation, foreign-provider protection, and TokenRhythm C1 request identity with no default thinking field, alongside the process/recovery coverage.

Follow-up validation: 293 router, usage, capacity, doctor, and stream golden tests passed (2 skips). After merging the latest main dependency updates, 181 startup, stream golden, and doctor checks passed; full Ruff passed. Full Electron onboarding E2E passed locally with isolated profiles and synthetic credentials.

Process lifecycle validation: the complete process-tree, session-process RPC, and shell-isolation test files passed on Windows (135 passed, 25 platform skips) and WSL/Linux (151 passed, 9 platform skips). Deterministic regressions ensure Stop signals surviving descendants before waiting and accepts an empty descendant capture only with independent group confirmation. The process RPC test waits for the public completion state within its original timeout budget.

Notes: local tests cover source behavior; fresh PR CI validates the combined branch with the latest main dependency updates. Live provider calls were not rerun for the final follow-up.

Maintainer Live Check

Maintainer live check: no

Surface: N/A

Safety

No secrets, local-only artifacts, private prompts/transcripts, channel identifiers, or AI session artifacts are included.

Third-Party Origin

Third-party origin: none

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown tables render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.

[github-actions]

Merge queue CI: success — run 35547682677, attempt 1.
Tested queue candidate: 66c38c28f0e5253234eacab416c8bfab39901147. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.