Assert the empty catalog path recovers live models and writes a cache once discovery is available again, including the real pi extension entrypoint used by /reload.
Persist the last valid Command Code model catalog and use it when live model discovery fails. Keep first-time offline startup non-fatal, surface clear warnings, and cover cached model selection with unit and pi integration regression tests.
