fix(ui): identify a model row by the model, not by its array position

[argszero]

Summary

modelsToView() (ui/js/app.js) adapted /api/models rows for the UI and minted a per-row identity from the row's array index (id: i). That index was used as the model's identity in two places that outlive the render which produced it:

1. it is persisted — markRecentUsed(id) writes it to localStorage["atp-recent-models"] ("recently used" chips);
2. it is resolved again in another array — renderRecent() / openChat() / consumeModel() look it up in Live.models ? modelsToView(Live.models) : D.MARKET, and for a guest session D.MARKET (ui/js/data.js) is a different table (7 rows, ids 1..7, different order and length) that merely looks like the same space; the backend also serves /api/models ORDER BY provider, model, so adding/removing/renaming any model shifts every index after it.

Because the two spaces overlap numerically, the failure is silent and looks like real data:

face	reproduction	what the screen shows
points at another model	live, click "use" on xai/grok-4.6 (index 5) → log out → guest market	chip reads google/gemini-3.1-pro — a model this user never used
the entry disappears	same, but on the first live row anthropic/claude-opus-5 (index 0)	the guest table is 1-based ⇒ nothing resolves ⇒ the chip vanishes silently
catalog drift	use a model → an admin lists a model that sorts earlier → next session	chip reads moonshot/kimi-k3 (index 5 after the shift)
the lie becomes an action	click that chip after the drift	the chat that opens is kimi-k3 (openChat resolves the same index)

This is a defect, not a trade-off: the same file already identifies models by name elsewhere (Live.models.find((x) => x.model === model), the shares form's <option value="m.model">), and the host has already ruled on the same family once (session caches must be keyed by identity, not by the slot they happen to sit in).

Related Issue

(no linked issue — this change was driven by a jsdom instrument plus an A/B; the evidence is below)

Changes

• ui/js/app.js: new modelKey(m) = provider + "/" + model; modelsToView() no longer emits a position (the .map( callback takes one parameter, the row object has no id); the three identity carriers (data-mk-expand, data-use-model, data-recent-model) are rendered from esc(modelKey(m)); the click sites pass the identity string through unchanged (no more Number(...)); getRecentKeys() accepts identity strings only — a value stored by an older version is an index, which cannot be honestly resolved back to a model, so it is dropped once (deliberate).
• src/state_gate.rs: new static gate the_model_row_identity_is_the_model_not_its_position, four rules each with its own tooth — ① the .map( callback takes one parameter and the row object declares no id field; ② the three data-* carriers are produced by modelKey( and no click site re-wraps them in Number(; ③ modelKey is defined exactly once, mentions provider and model, never id; ④ every markRecentUsed(...) call site writes a modelKey(...) expression — plus extractor self-checks (the_model_identity_extractors_have_teeth, with synthetic and negative controls).
• ui/README.md: new convention section ("cross-render / cross-session / cross-array model identity goes through modelKey(); an array index is only meaningful inside the array that produced it"), including the discriminator note that renders_attr must require both attr= and "this line is not a selector query" (the first version of the gate read the consumer's querySelector('[data-use-model="' + id + '"]') as a render site).
• ui/index.html: cache-bust app.js?v=20260915-10.

Measured (jsdom boots the real ui/index.html + all four real scripts; only fetch is stubbed and logged)

tmp/c2138_probe.js — 17 checks, expect declared per check. Fixtures: two /api/models payloads, both ordered provider, model (W1 six rows; W2 = W1 plus anthropic/gpt-9, so every index from 1 shifts by one).

Before (6be548a, ui/js/app.js md5 7171e11f…) — exactly the 5 axis legs red:

leg	reading
B1 (guest market)	chips=["gemini-3.1-pro"] store=[5] — the chip names a model that was never used
D1 (catalog drift)	chips=["kimi-k3"] store=[5]
D2 (same, clicking it)	chat title="Use kimi-k3" — the display error becomes an action error
C2 (mechanism)	store=[5] — the persisted identity is a position
E1 (row #1)	store=[0] chips=[] — the entry is lost against the 1-based guest table

After — 17/17, store=["xai/grok-4.6"], chat title Use grok-4.6.

A competing fix (hand-aligning D.MARKET's ids to today's catalog order, app.js untouched) satisfies the two guest faces (B1/E1 turn green) but is rejected by the drift and mechanism legs (D1/D2/C2 stay red) — 15/17 as declared.

Why this needs a static gate

The instrument can only prove "the screen no longer shows a foreign payload". It cannot distinguish "the identity is now the model" from "somebody hand-aligned the two tables once". The gate pins the shape, and its A/B (in-place mutation, byte-for-byte restore checked by md5) shows each rule failing on its own leg:

leg	mutation	gate red on
b0	the tree before the fix (6be548a)	rule ① (index parameter)
m1a	re-add the index parameter	rule ① (two parameters)
m1b	put id: i back in the row object	rule ① (field id)
m2a	render data-use-model from m.model	rule ② (not from modelKey()
m2b	consumeModel(Number(b.dataset.useModel))	rule ② (re-numbered)
m3a	modelKey drops provider	rule ③
m3b	modelKey appends m.id	rule ③ (id)
m4	store m.model instead of modelKey(m)	rule ④

Tests

• cargo test — 279 → 281 passed
• cargo fmt --check clean
• cargo clippy — no new warnings (only the pre-existing src/protocol.rs:662 false positive)
• new unit tests: the gate (four rules) + extractor self-checks with synthetic inputs

Checklist

• Branch naming follows the convention (fix/…)
• Commit message uses Conventional Commits
• Single purpose, minimal diff (4 files, +420/−25)