docs: record model selector deployment

PROJECT_STATE.md

@@ -1,6 +1,6 @@
 # ThothII — Project State
 
-> Starting-point snapshot for new sessions. Last updated: 2026-07-14 (workflow/UI regressions fixed live).
+> Starting-point snapshot for new sessions. Last updated: 2026-07-14 (Pi-enabled model selector live).
 > Point a fresh session here ("read PROJECT_STATE.md") before substantial work.
 
 ## Deployment — Docker locale (Profile A, co-located) — LIVE 2026-07-12
@@ -60,6 +60,27 @@ ThothII gira in Docker sul server co-locato, **embedded nel portale omics_portal
   Running image ids: core `sha256:55acef2f12151ea97144c2f5e9164d63f2ca734bc2746fef553df94849e3fb3f`;
   frontend `sha256:1043f79392420149655cc63d70461e2ca2005b2290a1e3e21dcf845ec3bd1c81`.
 
+### Pi-enabled model selector — LIVE 2026-07-14
+
+- **Pi is the allowlist authority.** `/models` reads the mounted Pi `enabledModels`, intersects
+  it with models currently available from Pi, and preserves the configured order. Enumeration
+  does not require `PI_PROVIDER`, does not inject generic/provider credentials, and fails closed
+  for missing or malformed scope.
+- **Live scope:** exactly `deepseek/deepseek-v4-flash`, `zai/glm-5.2`, and
+  `local-qwen/qwen3.6-35b-a3b`. The live endpoint returned those three composite IDs once each and
+  in that order; `zai/glm-5v-turbo` and all other authenticated Pi models are hidden.
+- **Validation/process smoke:** live settings updates returned 200 for DeepSeek Flash and local
+  Qwen, while hidden GLM-5V returned 400; a post-restore equality check confirmed the original app
+  settings were restored. The real `PiProcessManager` configure path succeeded for DeepSeek and
+  local Qwen without sending a prompt or starting a DWH operation; local Qwen required no hosted
+  provider key. Unknown and compound providers remain fail-closed in the verified backend suite.
+- **Verification/deploy (`2026-07-14T18:55:53+02:00`):** backend **154/154** and frontend
+  **251/251** passed; both TypeScript gates and `git diff --check` were green. Compose built and
+  force-recreated only `core`; container start was `2026-07-14T16:54:55.573274537Z`, health was
+  `healthy`, and sanitized post-recreate logs contained only the backend listen line. Rebuilt image
+  ID and running container image ID both equal
+  `sha256:65d0188ba6aa39d96a3d1e4c347cc8e4e6324f0634e6b0bc51cb03430b26083c`.
+
 ## What ThothII is
 
 A **human-in-the-loop datamart builder**: it turns a natural-language question into
@@ -114,7 +135,7 @@ All three layers' deps installed (`npm install` in each, `python -m venv + pip i
 - frontend: `cd frontend && npm run dev` (Vite; `VITE_BACKEND_URL` → backend)
 - harness install: `cd harness && python -m venv .venv && pip install -e ".[dev]"` → `tht` on PATH
 
-## How to test (green 2026-07-14: harness pytest 798 / gate JS 126 / backend 143 / frontend 250)
+## How to test (green 2026-07-14: harness pytest 798 / gate JS 126 / backend 154 / frontend 251)
 - harness: `cd harness && .venv/bin/pytest -q` (5 L2/real-DB tests are deselected by default)
 - backend: `cd backend && npx vitest run` · typecheck `npx tsc --noEmit -p .`
 - frontend: `cd frontend && npx vitest run` · typecheck `npx tsc -b` · e2e `npm run e2e` (Playwright)