diff --git a/.gitignore b/.gitignore
index f231c22c..fbab4ac0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -91,4 +91,7 @@ graphify-out/*
 .kiro/
 
 # CommandCode CLI local state (auth/taste/projects)
-.commandcode/
\ No newline at end of file
+.commandcode/
+
+# Pi subagent run artifacts
+.pi-subagents/
\ No newline at end of file
diff --git a/open-sse/providers/capabilities.js b/open-sse/providers/capabilities.js
index 14c996da..999779f6 100644
--- a/open-sse/providers/capabilities.js
+++ b/open-sse/providers/capabilities.js
@@ -476,6 +476,9 @@ export function getCapabilitiesForModel(provider, model) {
     }
   }
 
-  // 4. Floor
+  // 4. Floor (upstream-validated gateways keep vision on for unknown models)
+  if (provider && TRUST_UPSTREAM_VISION.has(provider)) {
+    return { ...refine(null, provider, model), vision: true };
+  }
   return refine(null, provider, model);
 }
diff --git a/src/sse/handlers/chat.js b/src/sse/handlers/chat.js
index a0dea5d8..23141522 100644
--- a/src/sse/handlers/chat.js
+++ b/src/sse/handlers/chat.js
@@ -10,8 +10,9 @@ import {
   isModelAllowedForKey,
 } from "../services/auth.js";
 import { handleAntigravityQuotaError, clearAntigravityStrikes } from "../services/antigravityQuota.js";
-import { getSettings } from "@/lib/localDb";
+import { getSettings, getCustomModels } from "@/lib/localDb";
 import { getModelInfo, getComboModels } from "../services/model.js";
+import { capabilitiesFromServiceKind } from "open-sse/providers/capabilities.js";
 import { handleChatCore } from "open-sse/handlers/chatCore.js";
 import { DEFAULT_HEADROOM_URL } from "@/lib/headroom/detect";
 import { getTransform as getPxpipeTransform } from "@/lib/pxpipe/loader.js";
diff --git a/tests/unit/chat-connection-pin.test.js b/tests/unit/chat-connection-pin.test.js
index 523019e5..d4d367e3 100644
--- a/tests/unit/chat-connection-pin.test.js
+++ b/tests/unit/chat-connection-pin.test.js
@@ -16,6 +16,7 @@ const authMocks = vi.hoisted(() => ({
   clearAccountError: vi.fn(async () => {}),
   extractApiKey: vi.fn(() => null),
   isValidApiKey: vi.fn(async () => true),
+  isModelAllowedForKey: vi.fn(() => true),
 }));
 const tokenMocks = vi.hoisted(() => ({
   checkAndRefreshToken: vi.fn(async (_p, creds) => creds),