Pre-send key guards: no orphan error-shell chats on first send

The owner's asymmetry find (interlude over the zero-keys wave): the
models-unconfigured case guards BEFORE send — no request, no chat
created, setup opens — but the key cases only reacted to the 503 after
POST /api/chats had already created the record, leaving orphan error-shell
chats in the sidebar. The guards now twin the models mechanism on BOTH
creation paths (home start(), /chat/new send()):

- Zero keys (useZeroKeys reuse): no provider key present -> skip creation
  and send entirely, open SetupDialog (stage 1 first-key screen).
- Strong-provider key missing (owner-approved extension): keys exist
  generally but the strong slot's pinned provider has none — the original
  deleted-key scenario. New pure strongKeyless(catalog) in setup-cta.tsx:
  slots.strong resolved pin + providers[] (present-key only, the catalog's
  own federation surface), false when unconfigured (the models guard owns
  that case) or catalog not loaded (the server 503 gate remains the belt).
  useStrongKeyless rides useModelCatalog, re-reading on the 'keys' AND
  'models' signals (a deleted key or a re-pinned slot flips it live).

Both guards run after the configured check, same
skip-everything-and-open-setup treatment; 'force' (setup's onDone replay)
bypasses both — completing setup implies a keyed provider. /chat/[id]
sessions keep the 503 revert-draft interception unchanged: those chats
legitimately exist.

Pins: strongKeyless fires on a keyless strong pin (keys elsewhere or
none), never fires with the pin's key present (incl. the keyPresent=false
belt), false on unset pin / unloaded catalog. Normal-path pins ride the
existing startDraftSession contract suite. Live-verified on :3001 under
LH_IGNORE_ENV_KEYS=1 with a file-key anthropic + openrouter-pinned strong:
both guards on both pages (setup opens stage-1 / stage-2 respectively,
draft preserved, 154 chats unchanged, zero sidebar entries), normal path
with a keyed strong provider still creates and lands the prompt redirect.
929/929, tsc/lint/build green.

tests/zero-keys.test.tsx

@@ -10,7 +10,8 @@ import assert from "node:assert/strict";
 import { describe, it } from "node:test";
 import { createElement } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
-import { hasProviderKey, ZeroKeysPill } from "../components/setup-cta.tsx";
+import { hasProviderKey, strongKeyless, ZeroKeysPill } from "../components/setup-cta.tsx";
+import type { ModelCatalogResponse } from "../src/core/index.ts";
 import { SetupKeysBody } from "../components/setup-dialog.tsx";
 import { DICTATION_KEYLESS, DEEPGRAM_KEY_ID } from "../components/dictation.tsx";
 import type { AuthKeyStatus } from "../src/core/auth-keys.ts";
@@ -115,4 +116,41 @@ describe("the dictation keyless seam (owner dictation trio)", () => {
 	it("the Deepgram row id matches the keys store (KeysSection openRow)", () => {
 		assert.equal(DEEPGRAM_KEY_ID, "DEEPGRAM_API_KEY");
 	});
-});
+});
+/** A minimal catalog double — only the two halves the strong-keyless guard
+ *  reads: the strong pin and the present-key providers list. */
+const catalog = (strongProvider: string | null, ...keyedProviders: string[]): ModelCatalogResponse => ({
+	models: [],
+	defaults: null,
+	rolePins: { researcher: null, demoBuilder: null, visualMaker: null, extractor: null, auditor: null },
+	slots: {
+		strong: strongProvider
+			? { model: { provider: strongProvider, id: `${strongProvider}/model` }, thinkingLevel: "low" }
+			: null,
+		cheap: null,
+		vision: null,
+	},
+	providers: keyedProviders.map((id) => ({ id, envVar: `${id.toUpperCase()}_API_KEY`, keyPresent: true })),
+});
+
+describe("strongKeyless — the pre-send guard's truth (owner interlude, no-orphan-chats)", () => {
+	it("strong pinned to a provider whose key is gone: the guard FIRES", () => {
+		// keys exist generally (anthropic), but the strong slot pins openrouter
+		assert.equal(strongKeyless(catalog("openrouter", "anthropic")), true);
+		// no keys at all with a strong pin: also keyless (guard case 1 fires too)
+		assert.equal(strongKeyless(catalog("openrouter")), true);
+	});
+
+	it("strong provider's key present: the guard does NOT fire — the normal send path stays open", () => {
+		assert.equal(strongKeyless(catalog("openrouter", "openrouter", "anthropic")), false);
+		// belt check: a provider row never counts when keyPresent is false
+		const lying = catalog("openrouter", "openrouter", "anthropic");
+		lying.providers[0]!.keyPresent = false;
+		assert.equal(strongKeyless(lying), true);
+	});
+
+	it("no strong pin (the models guard owns that case) or catalog not loaded: false — the server gate remains the belt", () => {
+		assert.equal(strongKeyless(catalog(null, "openrouter")), false);
+		assert.equal(strongKeyless(undefined), false);
+	});
+});