[HoloNova]

Problem

Settings → Models stores the selection in Pi's shared enabledModels. Signing out of a provider removes its models from getAvailable(), but does not make the saved selection invalid.

Previously, the same signed-out entries:

• produced per-model chat scope warnings;
• counted as unmatched entries in Settings; and
• were deleted by “Remove unmatched entries”, along with actual typos or removed models.

The original version of this PR addressed only the first symptom. This revision uses a shared catalog classification for chat diagnostics, Settings and cleanup instead. There is no separate preference file, no new setting, and no background or bidirectional synchronization.

Reproduction on main

1. Select models from two authenticated providers in Settings → Models.
2. Sign out of one provider, retaining its model entries in enabledModels.
3. Start a new chat: the signed-out entries produce No models match pattern "provider/model" warnings even though the other provider works.
4. Open Settings → Models: these entries count as unmatched. Click “Remove unmatched entries”: the signed-out provider's selections are deleted, so signing back in cannot restore them.

Fix

resolveUnavailableModelPatterns() classifies entries that match no available model against the full catalog, using Pi's resolver for the existing pattern syntax (including globs, fuzzy patterns, nested IDs and thinking pins). Ambiguous bare exact IDs and malformed entries are not classified as known picks.

State	Chat	Settings / cleanup
Known catalog model, provider has no configured auth	No per-model invalidity warning	Separate neutral unavailable count and visible sign-in/credential note; retained during cleanup
Known catalog model, configured but unavailable	Keep the existing exact-reference diagnostic	Unavailable, not invalid; retained during cleanup
Unrecognized entry / typo / removed model	Existing diagnostics, including #770's glob-warning policy	Counted as unmatched; removed only by explicit cleanup
Entire scope belongs to signed-out providers	Explain the fallback to all available models once	Keep the saved selection; the existing “Enable all models” action can explicitly clear it

Auth classification uses getProviderAuthStatus().configured, not the availability-only hasConfiguredAuth(), so stored-but-failing credentials are not silently treated as a sign-out.

The Models API carries unavailablePatterns separately from stalePatterns. Reads and authentication/catalog changes do not rewrite enabledModels. Explicit cleanup preserves unavailable entries' original spelling, order and thinking pins, including when none of the selected models is available. Existing global/project precedence, project read-only controls, known rename handling and SDK scope fallback remain intact. Signing back in makes the saved entries usable again.

No Pi CLI behavior or configuration format changes. Its own diagnostics are unchanged. A catalog miss is not proof of permanent deletion (it may be another machine's entry); removal remains a deliberate user action. UI notes are translated in English, Simplified Chinese and Traditional Chinese.

Related work

• fix: hide leftover enabledModels warnings when other models still match #770: preserve the existing partial-scope glob-warning behavior; do not blanket-hide diagnostics.
• Model dialog doesn't clean up enabledModels in settings.json when a connector/models are removed → persistent 'No models match pattern' warnings #560 / After model deletion, the pi-web UI still displays "Model scope warnings," and the newly added Kimi K3 is not in the model dropdown list. #640: related unmatched-selection behavior. This PR does not add implicit pruning or a second preference store.

Validation

• 101 targeted tests passed across scope resolution, editor/runtime, cleanup and rendered Settings banner.
• npm test: 2,884 passed, 1 skipped, 0 failed (the skipped test is Windows-junction-only).
• npx tsc --noEmit: passed.
• npx eslint .: passed.
• Coverage includes signed-out and configured-but-unavailable models; catalog globs and fuzzy patterns; sign-in recovery; typo/removed/malformed entries; pins/order preservation; signed-out-only scope cleanup/fallback; persistent settings retaining unrelated keys; no preference file; separate UI counts and cleanup action; and project read-only controls.
• Additional isolated real-SDK/settings check verifies that chat, panel and persisted cleanup agree: the known signed-out selection and pin survive, the typo is removed only by explicit cleanup, and unrelated settings remain unchanged. No model request was sent.

Local checks ran serially in a CPU/memory-limited scope, without Linux DAC-override capabilities for the existing read-only-directory test. No production service was modified or restarted.