Pre-send key guards: no orphan error-shell chats on first send

The owner's asymmetry find (interlude over the zero-keys wave): the
models-unconfigured case guards BEFORE send — no request, no chat
created, setup opens — but the key cases only reacted to the 503 after
POST /api/chats had already created the record, leaving orphan error-shell
chats in the sidebar. The guards now twin the models mechanism on BOTH
creation paths (home start(), /chat/new send()):

- Zero keys (useZeroKeys reuse): no provider key present -> skip creation
  and send entirely, open SetupDialog (stage 1 first-key screen).
- Strong-provider key missing (owner-approved extension): keys exist
  generally but the strong slot's pinned provider has none — the original
  deleted-key scenario. New pure strongKeyless(catalog) in setup-cta.tsx:
  slots.strong resolved pin + providers[] (present-key only, the catalog's
  own federation surface), false when unconfigured (the models guard owns
  that case) or catalog not loaded (the server 503 gate remains the belt).
  useStrongKeyless rides useModelCatalog, re-reading on the 'keys' AND
  'models' signals (a deleted key or a re-pinned slot flips it live).

Both guards run after the configured check, same
skip-everything-and-open-setup treatment; 'force' (setup's onDone replay)
bypasses both — completing setup implies a keyed provider. /chat/[id]
sessions keep the 503 revert-draft interception unchanged: those chats
legitimately exist.

Pins: strongKeyless fires on a keyless strong pin (keys elsewhere or
none), never fires with the pin's key present (incl. the keyPresent=false
belt), false on unset pin / unloaded catalog. Normal-path pins ride the
existing startDraftSession contract suite. Live-verified on :3001 under
LH_IGNORE_ENV_KEYS=1 with a file-key anthropic + openrouter-pinned strong:
both guards on both pages (setup opens stage-1 / stage-2 respectively,
draft preserved, 154 chats unchanged, zero sidebar entries), normal path
with a keyed strong provider still creates and lands the prompt redirect.
929/929, tsc/lint/build green.

components/setup-cta.tsx

@@ -18,6 +18,8 @@
 import { useCallback, useEffect, useState } from "react";
 import type { AuthKeyStatus } from "@/src/core";
 import { classifyKeys, type ProviderKeyInfo } from "@/components/settings/keys-section";
+import { useModelCatalog } from "@/components/model-picker";
+import type { ModelCatalogResponse } from "@/src/core";
 import { useSettingsSaved } from "@/components/settings-signal";
 
 /** Pure: does a MODEL-PROVIDER key exist among the statuses? Reuses
@@ -72,4 +74,29 @@ export function ZeroKeysPill({ onOpen }: { onOpen: () => void }) {
 			</button>
 		</div>
 	);
-}
+}
+/** Pure: the strong slot is pinned to a provider whose key is GONE (owner
+ *  interlude, 2026-09-25 — the original deleted-key scenario). The catalog
+ *  already knows both halves: slots.strong is the resolved pin, providers[]
+ *  lists only PRESENT-key providers (keyless ones are absent, the same
+ *  discipline as the search engines). False when the strong slot is unset
+ *  (the models guard owns that case — this check only runs when slots ARE
+ *  configured) or the catalog hasn't loaded (the server gate remains the
+ *  belt). Exported for pins. */
+export function strongKeyless(catalog: ModelCatalogResponse | undefined): boolean {
+	const strong = catalog?.slots.strong;
+	if (!strong) return false;
+	return !catalog.providers.some((p) => p.id === strong.model.provider && p.keyPresent);
+}
+
+/** The strong-slot keyless truth for the PRE-SEND guard (home / /chat/new):
+ *  the catalog seam with re-reads on BOTH signals that can flip it — "keys"
+ *  (a provider key saved or deleted) and "models" (the strong slot
+ *  re-pinned). Live-updates with the page, never mid-send. */
+export function useStrongKeyless(): boolean {
+	const { catalog, refresh } = useModelCatalog();
+	useSettingsSaved((section) => {
+		if (section === "keys" || section === "models") refresh();
+	});
+	return strongKeyless(catalog);
+}