[witbrock]

Merge decision: ready — changing or reloading model settings preserves the browser's valid model choice without re-enrolment or an implicit Ollama switch.

User outcome

Settings previously cleared premium use while scoped eligibility was loading and restored the server primary ahead of the saved browser preference. Keep rendering read-only with respect to browser selection, prefer the saved browser model on reload, and leave an unallowed editor draft separate from the active model. Selecting another allowed model on the active provider takes effect locally without an allow-list write. Probing a model does not change the browser choice.

Material changes

Update settingsPage.js and the Settings help text. Derive the checkbox from the actual selected browser model and show explicit replacement/restoration guidance when the effective scope no longer allows it. Retain the existing scoped persistence and server authority boundaries. Add event-path regression tests and a reusable Playwright fixture against the actual template and modules.

Evidence

• 32 tests pass across seven focused settings/preference suites; 24 neighbouring model-pool tests pass.
• The remaining model-pool test, only the latest actor-scoped reload can repopulate state and enable Save, fails with pending.get(...) is not a function on both unchanged baseline 421551e and the candidate. This pre-existing asynchronous fixture failure does not change the merge decision.
• 13 Playwright checks pass: initial browser/server disagreement, allowed model selection, reasoning edit, explicit scoped save, reload, checkbox off/on, unallowed draft, second allowed selection/reload, failed availability probe, effective-scope removal, and explicit recovery. Only the explicit scoped Save writes the allow list.
• Changed-file frontend static lint and git diff --check pass. Screenshots reviewed. Local receipts: .run/settings-model-preference/results.json and screenshots, with source SHA-256.

Ship boundary

Tier 1 frontend state claim. The browser run uses the real candidate UI with synthetic API responses and no model calls or live mutations; it is not authenticated DGX or live-provider acceptance. Existing host fixtures belong to other tasks. The task text is sufficient despite the unavailable original conversation/screenshots. No backend authorisation, model routing, migrations or deployment changes are included. No deployment was requested.