[iamnbutler]

Settings → Providers kept reading "Saved in Keychain" for a key that Check had just reported as "OpenAI rejected this API key." Now Ace Helper remembers when a provider rejects a key during a Check. While the key stays the same, the row reads "Saved in Keychain, but OpenAI rejected it", and with an environment override, "OPENAI_API_KEY overrides Keychain, but OpenAI rejected it". Saving, replacing or removing the key clears the warning, and so does a Check that passes. Clients only reload settings when the verdict changes.

Smoke-tested on a loopback source host (own ACE_HOME, keychain service ace-fixw7, port 4377, and a login shell with no provider keys) in headless Chromium:

• I stored a bogus key with ace key set OPENAI_API_KEY, which doesn't check the key. The row read "Saved in Keychain".
• Check → "OpenAI rejected this API key." The row now reads "Saved in Keychain, but OpenAI rejected it".
• Replace → Check and save with a real key → "Key saved." The row reads "Saved in Keychain" again, and Check → "Connection verified."

Map: ^53. Part of #626: this fixes the rejected-key status. Refresh already says "Read the keys again." Still open in #626:

• ^17: Restart doesn't warn about running work. I didn't change this, because only the real Ace Helper can show or smoke it, and fix-train workers mustn't restart it.
• Any of the issue's menu and window items that are still open.

Built in Ace

No. Claude Code (fix-train worker) made this outside Ace, running against a loopback source host. It used headless Chromium to smoke the web client. Dogfooding gaps are tracked in #5.