[fly1d]

Problem and behavior

Fixes #62. On a fresh profile, a server configured with OPENAI_MODEL=compatible-model still receives the built-in gpt-5-mini from the UI. A controlled request-boundary reproduction using the actual translate/tokenize provider code returns the gateway's model-not-found response. Desktop-configured endpoint defaults are affected by the same initialization.

The UI now applies engine defaults to fields without a saved or explicit user choice. Persistence saves only provider choice and genuinely saved/edited model or endpoint fields, so refreshing before status resolves, after a status failure, or after an automatic default was applied cannot turn fallback/default values into user overrides. Existing saved values and edits made during a pending status request, including an edit back to a built-in value, remain intact. Legacy saved fields remain treated as explicit choices because the old storage format cannot identify which values were previously filled automatically. Applying server defaults still requires a successful engine-status response.

Web endpoint URLs are still server-owned. API keys are never restored or persisted. Provider request handling, endpoint validation, SSRF protections, credential storage, selection capture, and release workflows are unchanged.

Scope and risk

Five files: initialization/persistence helpers, App integration, eleven focused unit tests, six browser scenarios (desktop/mobile viewports), and one changelog entry. This is independent of #59's selection-settings race fix and #61's dependency alignment; it does not stack or duplicate those branches.

Treat as high risk because desktop endpoint initialization is affected. Required before merge: a security-aware human GitHub Review, affected integration/browser checks, manual macOS acceptance, a current branch, and resolved review conversations. Automated review is not a human approval. No release, signature, notarization, or artifact publishing is authorized by this PR.

Validation

• Final tree 7f02ce88ad0078022e2c6327e41cb3ddd5aae179, based on main 23f1e8c5428879318ca3298830692fb804ff6d4f.
• Vitest: 45/45 passed (34 existing + 11 new).
• Vite production build and staged diff check passed.
• New-head browser smoke: 17 passed, 1 existing viewport-specific skip. All 12/12 new settings cases executed and passed. The existing mobile-only overflow case is skipped in the desktop project and passes in the mobile project. Product-site smoke: 12/12 passed.
• Independent automated review caught and required correction of a refresh/restart persistence bug. Final independent reproduction confirms server defaults survive reopen, saved/provider/edit-back choices remain intact, and API keys remain excluded. No remaining code blocker was found.
• Actual provider request boundary sends compatible-model after the fix with network responses mocked; this is maintainer self-validation, not customer adoption.
• Local TypeScript execution was blocked by the compiler runtime's missing /proc/self/exe; local browser smoke was blocked by sandbox IPC/network-interface facilities. Neither was reported as a local pass. New-head GitHub CI now completes the typecheck and browser paths successfully.
• Final head f8565f334746093b02b1427d733ea3174dffd230: 5/5 checks succeeded. CI and Desktop logs confirm TypeScript/build, 45/45 Vitest, Rust fmt/Clippy/check, 21/21 Rust tests, macOS .app build and bundled Apple Events usage-description validation. CodeQL checks succeeded.
• The workflow did not upload a downloadable .app or perform signing/notarization. Machine build validation is not manual macOS acceptance. Manual macOS acceptance and security-aware human review remain outstanding.

AI-assisted implementation and independent automated review. No user-adoption claim.