@genesislcap/ai-assistant 15.23.2 → 15.24.0-FUI-2603.10

package/dist/custom-elements.json

@@ -1675,6 +1675,42 @@
       "declarations": [],
       "exports": []
     },
+    {
+      "kind": "javascript-module",
+      "path": "src/main/attachment-controller.ts",
+      "declarations": [],
+      "exports": []
+    },
+    {
+      "kind": "javascript-module",
+      "path": "src/main/budget-controller.ts",
+      "declarations": [],
+      "exports": []
+    },
+    {
+      "kind": "javascript-module",
+      "path": "src/main/composer-menu-controller.ts",
+      "declarations": [],
+      "exports": []
+    },
+    {
+      "kind": "javascript-module",
+      "path": "src/main/composer-resize-controller.ts",
+      "declarations": [],
+      "exports": []
+    },
+    {
+      "kind": "javascript-module",
+      "path": "src/main/context-gate-controller.ts",
+      "declarations": [],
+      "exports": []
+    },
+    {
+      "kind": "javascript-module",
+      "path": "src/main/cost-ledger-controller.ts",
+      "declarations": [],
+      "exports": []
+    },
     {
       "kind": "javascript-module",
       "path": "src/main/index.ts",
@@ -1787,6 +1823,59 @@
           "description": "Foundation AI Assistant component.",
           "name": "FoundationAiAssistant",
           "members": [
+            {
+              "kind": "field",
+              "name": "composerResize",
+              "privacy": "private",
+              "readonly": true,
+              "default": "new ComposerResizeController({\n    enabled: () => this.chatConfig.ui?.resizableInput !== false,\n    inputEl: () => this.chatInputEl,\n    messagesEl: () => this.messagesEl,\n  })"
+            },
+            {
+              "kind": "field",
+              "name": "composerMenus",
+              "privacy": "private",
+              "readonly": true,
+              "default": "new ComposerMenuController(this, {\n    agentPickerOpen: this.accessor('agentPickerOpen'),\n    sessionMenuOpen: this.accessor('sessionMenuOpen'),\n    focusInput: () => this.chatInputEl?.focus(),\n    resetSessionConfirmations: () => {\n      this.confirmingClear = false;\n      this.confirmingCompact = false;\n    },\n    logMeta: (type, detail) => this.logMeta(type, detail),\n  })"
+            },
+            {
+              "kind": "field",
+              "name": "attachmentCtrl",
+              "privacy": "private",
+              "readonly": true,
+              "default": "new AttachmentController(this, {\n    acceptedFiles: () => this.chatConfig.ui?.acceptedFiles,\n    logMeta: (type, detail) => this.logMeta(type, detail),\n  })"
+            },
+            {
+              "kind": "field",
+              "name": "contextGateCtrl",
+              "privacy": "private",
+              "readonly": true,
+              "default": "new ContextGateController({\n    chatConfig: () => this.chatConfig,\n    messages: () => this.messages,\n    contextTokens: () => this.contextTokens,\n    contextLimit: () => this.contextLimit,\n    gateContextTokens: () => this._gateContextTokens,\n    contextReserve: () => this.contextReserve,\n    preambleTokens: () => this.driver?.getPreambleTokens?.(),\n    compactionPlanFor: (options) => this.driver?.getCompactionPlan?.(options) ?? null,\n    bannerVisible: () => this.bannerVisible,\n    effectiveBlockedReason: () => this.effectiveBlockedReason,\n    flowOwnerAgentName: () => this.flowOwnerAgentName,\n  })",
+              "description": "Pure derivation — owns no state. Reaches the driver only through the two\ncallbacks below, so it stays clear of the stateful-agent surface (§11.2\nconstraint 2) and of redux entirely."
+            },
+            {
+              "kind": "field",
+              "name": "costLedger",
+              "privacy": "private",
+              "readonly": true,
+              "default": "new CostLedgerController({\n    chatConfig: () => this.chatConfig,\n    messages: () => this.messages,\n    sessionUsage: () => this.sessionUsage,\n    providerStatuses: () => this.providerStatuses,\n    persistenceActive: () => this.persistenceActive,\n    stateKey: () => this.getStateKey(),\n    headerTitle: () => this.headerTitle,\n    provider: () => this.persistence.provider,\n    elementId: () => this.id,\n  })",
+              "description": "Cost accounting and the persisted build-history ledger (GENC-1475). Reads the live\nsession through callbacks and owns the rows, the load/write latches and the debounce\ntimer — the element keeps only the names the settings modal binds."
+            },
+            {
+              "kind": "field",
+              "name": "budget",
+              "privacy": "private",
+              "readonly": true,
+              "default": "new BudgetController({\n    sessionRef: () => this._sessionRef,\n    providerStatuses: () => this.providerStatuses,\n    providerRegistry: () => this.providerRegistry,\n    chatConfig: () => this.chatConfig,\n  })",
+              "description": "The AI-spend budget: vendor walls, the derived composer lock, the banner copy\nand the settings meter (GENC-1464).\n\nTakes the session store itself rather than a callback per field — see\n`BudgetDeps` for why this one differs from its siblings."
+            },
+            {
+              "kind": "field",
+              "name": "settings",
+              "privacy": "private",
+              "readonly": true,
+              "default": "new SettingsModalController({\n    chatConfig: () => this.chatConfig,\n    contextTokens: () => this.contextTokens,\n    contextLimit: () => this.contextLimit,\n    budgetUsageVisible: () => this.budget.settingsUsageVisible,\n    costConfig: () => this.costLedger.config,\n    costHistoryLength: () => this.costLedger.history.length,\n    liveCostSessionTitle: () => this.costLedger.liveTitle,\n    providerStatusCount: () => this.providerStatuses.length,\n    sessionRef: () => this._sessionRef,\n    stateKey: () => this.getStateKey(),\n    popoutMode: () => this.popoutMode,\n    headerTitle: () => this.headerTitle,\n    appSettingsProvider: () => this.appSettingsProvider,\n    modal: () => this.settingsModal,\n    tabsEl: () => this.settingsTabsEl,\n    requestBudgetRefresh: () => this.requestBudgetRefresh(),\n    logMeta: (type, detail) => this.logMeta(type, detail),\n  })",
+              "description": "The settings modal (`docs/code-health.md` §3). Reaches the two design-system\nrefs through callbacks, because the template writes them by name — see\n`SettingsModalDeps`."
+            },
             {
               "kind": "field",
               "name": "providerRegistry",
@@ -2189,7 +2278,7 @@
               "type": {
                 "text": "readonly AIProviderType[]"
               },
-              "description": "The distinct vendors the registry can currently reach, from the provider\nstatuses this element already loads on connect and refreshes on every\nobservable-registry change.\n\nThis is the element's answer to \"which vendor would the next turn use\" — a\nquestion that has **no** correct answer and deliberately gets no API. The\nprovider is resolved per turn AND per agent: `activeProviderInput` may be an\nasync function of the turn's context, an orchestrated turn picks its agent\nwith an LLM `classify()` call, and sub-agents resolve their own providers.\nAny pre-turn \"peek\" would therefore be a guess that is wrong precisely on the\nmulti-agent hosts per-vendor budgets exist for.\n\nAsking instead which vendors are REACHABLE is answerable, synchronous, and\nfree — and it is enough: the composer must stay live while any reachable\nvendor has headroom, and must lock when none does. It also makes vendor-switch\nrecovery a derivation rather than a mutation: a host that swaps its registry\nto another vendor fires the observable, the statuses reload, the walled vendor\ndrops out of this set, and `blocked` goes false with every latch left intact.",
+              "description": "The distinct vendors the registry can currently reach, from the provider\nstatuses this element already loads on connect and refreshes on every\nobservable-registry change — this element's answer to \"which vendor would the\nnext turn use\", a question that has no correct answer and deliberately gets\nno API. See `BudgetController.reachableVendors` for why reachability is\nthe answerable question and what deriving from it buys.",
               "readonly": true
             },
             {
@@ -2198,7 +2287,7 @@
               "type": {
                 "text": "readonly AIProviderType[]"
               },
-              "description": "Vendors currently walled by the AI-spend budget, in the order they were\nwalled. Empty for a host that never adopts the per-vendor API.\n\nMay include a vendor this registry cannot reach — either because the registry\nmoved on after the wall was latched, or because a 402's\n`otherVendorAvailable: false` walls every vendor the proxy meters (which is\nwhat that verdict is a statement about; see\nFoundationAiAssistant.latchBlockedFrom). Neither costs anything\ninternally — FoundationAiAssistant.blocked asks only about the\nreachable set, and the banner reads the reachability-filtered\nFoundationAiAssistant.relevantBlockedVendors — but a host rendering\nthis list itself should filter it against its own registry.\n\nRead-only on purpose: a settable array would let a host write a partial list\nand silently orphan the per-vendor banner copy.\nFoundationAiAssistant.setVendorBlocked is the write path.",
+              "description": "Vendors currently walled by the AI-spend budget, in the order they were\nwalled. Empty for a host that never adopts the per-vendor API.\n\nMay include a vendor this registry cannot reach — either because the registry\nmoved on after the wall was latched, or because a 402's\n`otherVendorAvailable: false` walls every vendor the proxy meters. Neither\ncosts anything internally — FoundationAiAssistant.blocked asks only\nabout the reachable set, and the banner reads the reachability-filtered\n`BudgetController.relevantBlockedVendors` — but a host rendering this\nlist itself should filter it against its own registry.\n\nRead-only on purpose: a settable array would let a host write a partial list\nand silently orphan the per-vendor banner copy.\nFoundationAiAssistant.setVendorBlocked is the write path.",
               "readonly": true
             },
             {
@@ -2248,35 +2337,7 @@
                   }
                 }
               ],
-              "description": "Wall (or release) one vendor's budget, optionally with banner copy for it.\nThe per-vendor mirror of FoundationAiAssistant.setBlocked.\n\nWalling a vendor does **not** on its own disable the composer: while another\nreachable vendor has headroom the assistant stays usable and the banner tells\nthe user to switch. Only when every reachable vendor is walled does `blocked`\nbecome true.\n\n`reason` is composed into the banner sentence for that vendor, **however many\nvendors are walled** — see FoundationAiAssistant.effectiveBlockedReason.\nIt is per-vendor copy, not a whole-banner override; FoundationAiAssistant.blockedReason\nis the override. Omitting it keeps whatever explanation that vendor already\ncarried, so a driver latch landing after a host one cannot blank it.\n\n`'none'` is rejected with a warning rather than accepted: it is the \"no\nprovider configured\" sentinel, not a vendor. Latching it would put the raw\nsentinel in the banner (\"none's AI usage limit is reached\") and could never\nbe undone by derivation, because `'none'` never appears in\nFoundationAiAssistant.reachableVendors — so `blocked` could never\nbecome derivable from it either. Use FoundationAiAssistant.setBlocked\nfor a vendor-agnostic block."
-            },
-            {
-              "kind": "field",
-              "name": "vendorBudgetWarningIssued",
-              "type": {
-                "text": "boolean"
-              },
-              "privacy": "private",
-              "default": "false",
-              "description": "One warning per element for garbage fed to\nFoundationAiAssistant.setVendorBudget. Once, not per call, because\nthe documented feed re-runs after every turn — a host bug would otherwise\nrepeat the same warning on every send for the life of the page."
-            },
-            {
-              "kind": "method",
-              "name": "warnVendorBudgetOnce",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "message",
-                  "type": {
-                    "text": "string"
-                  }
-                }
-              ]
+              "description": "Wall (or release) one vendor's budget, optionally with banner copy for it.\nThe per-vendor mirror of FoundationAiAssistant.setBlocked.\n\nWalling a vendor does **not** on its own disable the composer: while another\nreachable vendor has headroom the assistant stays usable and the banner tells\nthe user to switch. Only when every reachable vendor is walled does `blocked`\nbecome true.\n\n`reason` is composed into the banner sentence for that vendor, **however many\nvendors are walled** — see `BudgetController.effectiveBlockedReason`.\nIt is per-vendor copy, not a whole-banner override;\nFoundationAiAssistant.blockedReason is the override. Omitting it keeps\nwhatever explanation that vendor already carried, so a driver latch landing\nafter a host one cannot blank it.\n\n`'none'` is rejected with a warning rather than accepted — it is the \"no\nprovider configured\" sentinel, not a vendor, and a wall on it could never be\nundone by derivation. Use FoundationAiAssistant.setBlocked for a\nvendor-agnostic block."
             },
             {
               "kind": "method",
@@ -2308,8 +2369,7 @@
               "type": {
                 "text": "number | null"
               },
-              "default": "null",
-              "description": "When budget figures last arrived — from the host's FoundationAiAssistant.setVendorBudget\nor the wall latch's own feed — as epoch ms; `null` until the first feed.\n\nELEMENT state, not slice state, on purpose: the reducer is idempotent by\nvalue (an unchanged re-feed must not re-render the meter rows), but \"when\nwas this fetched\" must move on every feed, changed figures or not — a\nrefresh that confirms the same dollars is still a refresh. Only the\ntoolbar label observes this, so a stamp re-renders one span, not the rows."
+              "description": "When budget figures last arrived — from the host's\nFoundationAiAssistant.setVendorBudget or the wall latch's own feed —\nas epoch ms; `null` until the first feed.\n\nELEMENT state, not slice state, on purpose: the reducer is idempotent by\nvalue (an unchanged re-feed must not re-render the meter rows), but \"when\nwas this fetched\" must move on every feed, changed figures or not — a\nrefresh that confirms the same dollars is still a refresh. Only the\ntoolbar label observes this, so a stamp re-renders one span, not the rows."
             },
             {
               "kind": "field",
@@ -2330,25 +2390,6 @@
               },
               "description": "Ask the host to re-fetch budget figures now (GENC-1464 refresh affordance).\n\nThe element cannot fetch — the meter is host-fed by design — so this emits\n`budget-refresh-requested` and the host answers with the same fetch that\nalready feeds FoundationAiAssistant.setVendorBudget (Create's handler coalesces in-flight\nfetches, so a spammed button costs one request). Fired by the meter's\nrefresh button and on settings-modal open, so the figures are fresh exactly\nwhen someone is looking at them. Fires unconditionally: a host without a\nlistener simply keeps the per-turn cadence."
             },
-            {
-              "kind": "method",
-              "name": "isVendorSwept",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "boolean"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "vendor",
-                  "type": {
-                    "text": "AIProviderType"
-                  }
-                }
-              ],
-              "description": "Whether this vendor's wall came from the sweep alone — see the slice's `sweptVendors`."
-            },
             {
               "kind": "field",
               "name": "blockedReason",
@@ -2389,7 +2430,7 @@
                 "text": "string | undefined"
               },
               "privacy": "private",
-              "description": "Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall,\nor `undefined` to let the driver compose it per wall.\n\nA set `blockedReason` still wins — a white-labelled host must not read its\nown explanation in the banner and shipped copy directly below it, and the\nvendor-agnostic latch's `formatBlockedReason(budget)` form stays advice-free\nexactly as before.\n\n`undefined` (the usual case) is NOT the old `DEFAULT_BUDGET_EXHAUSTED_MESSAGE`\nfallback: it hands composition to the driver, which builds the bubble from\nEACH wall's own 402 — naming the exhausted vendor and advising a switch only\nwhen that refusal's `otherVendorAvailable` positively vouched for headroom\nelsewhere. That is immune to the staleness this getter used to guard against\nby freezing the copy: construction-time advice could outlive its truth\n(`getOrCreateDriver` re-runs on an agents swap and would have baked the\nsentence into every later bubble), but per-wall advice is derived from the\nrefusal it annotates and dies with the turn. Forcing the default here was\nalso what made the driver's composed bubble unreachable in every real\nmount — the banner advised switching while the bubble under it never did\n(the GENC-1464 tester finding, root cause).",
+              "description": "Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall,\nor `undefined` to let the driver compose it per wall — see\n`BudgetController.transcriptMessage`.",
               "readonly": true
             },
             {
@@ -2476,7 +2517,7 @@
               "type": {
                 "text": "CostSessionModelEntry[]"
               },
-              "description": "Distinct models the registry currently resolves to — the live session's model chips.\n\n`providerStatuses` carries one entry per registry SLOT, so a vendor configured across several\ntiers that happen to resolve to the same model reports it once per tier, and the chips\nrendered it once per tier too. Which tier a model came from is not what these chips are for.\n\nDeduped on the label actually displayed, not on `status.model`: a slot whose provider reports\nno model falls back to the slot's own name, and those are distinct per slot, so keying on the\nlabel keeps them from collapsing into one another.",
+              "description": "The cost ledger's derived surface (GENC-1475). Every member below delegates to\n`CostLedgerController` — the names are this element's public API and the\nsettings modal's bindings, so they stay put while the accounting moves.\n\nNone carries `@volatile`: the decorators live on the controller's getters, and they\nreach the binding observer from there — see `docs/code-health.md` §11.4.",
               "readonly": true
             },
             {
@@ -2485,7 +2526,7 @@
               "type": {
                 "text": "CostSessionRecord[]"
               },
-              "description": "Build history for display: most recently worked on first.\n\nThe stored order is insertion order (see `upsertRecord`), which leaves a project returned to\nsitting wherever it was first seen — so ordering is applied here, on read, where it also\ncovers rows a host provider supplied.",
+              "description": "Build history for display: most recently worked on first.",
               "readonly": true
             },
             {
@@ -2494,7 +2535,7 @@
               "type": {
                 "text": "AggregateUsage"
               },
-              "description": "Lifetime usage across every project in the history scope — cost and all four token\nbuckets. What the Usage tab's lifetime section renders.\n\nRows ONLY — deliberately not rows + live session. Each row holds a project's lifetime\nusage and the active project's row is kept current on every transcript change, so\nadding the live total would count this project's spend twice. That double-count is what\nmade the figure grow on every refresh: a page-hide banked a row while the restored\nsession still carried the same spend.",
+              "description": "Lifetime usage across every project in the history scope — rows only, never plus live.",
               "readonly": true
             },
             {
@@ -2512,7 +2553,7 @@
               "type": {
                 "text": "boolean"
               },
-              "description": "Whether the live session figures amount to this project's whole history, which is true\nexactly when the transcript is restored on load. Drives the Usage tab's live labels\n(\"Project cost\" vs \"Session cost\") so they state the scope rather than imply one.\n\nNote this is NOT what makes the *rows* lifetime — those bank their pre-transcript spend\n(see `CostSessionRecord.banked`) and are lifetime either way.",
+              "description": "Whether the live session figures amount to this project's whole history.",
               "readonly": true
             },
             {
@@ -2524,6 +2565,14 @@
               "description": "Resolved cost tab and build-history settings from `chatConfig.costHistory`.",
               "readonly": true
             },
+            {
+              "kind": "field",
+              "name": "costSessionHistory",
+              "type": {
+                "text": "CostSessionRecord[]"
+              },
+              "description": "Persisted finalized cost sessions shown on the Usage tab build history list.\n\nA get/set pair rather than a read-only projection: the banking tests seed rows to\nmodel a page load that found some, and a host provider's rows arrive the same way."
+            },
             {
               "kind": "field",
               "name": "sessionTokensConsumed",
@@ -2559,26 +2608,7 @@
                   }
                 }
               ],
-              "description": "Write this session's usage into persisted build history (`localStorage`) as a single\nrow keyed by the session key, replacing any existing row for that key.\n\n**Idempotent** — safe to call per turn, on tab close, and on a title change alike.\nThe name is historical: it does NOT end the session or reset the running totals.\nResetting them is what used to double-count spend, since the row was banked while the\npersisted transcript still carried the same usage, so a reload restored it and the\nUsage tab counted both.\n\nNo-op unless `chatConfig.costHistory.enabled` is `true`, when the live session has no\nusage yet, or when the session has no key to upsert against. Gating on the *live*\nfigures (not the banked total) means a reload that restores nothing rewrites nothing."
-            },
-            {
-              "kind": "method",
-              "name": "bankedUsageFor",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "AggregateUsage"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "projectKey",
-                  "type": {
-                    "text": "string"
-                  }
-                }
-              ],
-              "description": "Spend for `projectKey` that predates the current transcript, resolved once per SESSION and\nshared by every element instance wired to it (see `banked-usage-baselines`), so it cannot\ndrift as the row it came from is rewritten by our own upserts.\n\nThe two cases turn on whether the transcript is authoritative for this project:\n\n- **Transcript restored** (`persistenceActive`): it already accounts for everything after\n  the previous row's own banked figure, so carry that figure forward unchanged. Re-banking\n  `usage` here would add the restored history to itself on every reload.\n- **Transcript starts empty**: nothing on screen accounts for the previous total, so the\n  whole of it becomes banked. Without this the next turn would rewrite the row downwards\n  to just that turn, losing the project's earlier spend.\n\nThe baseline is deliberately NOT element state. This element is remounted repeatedly inside\na single session (the host re-rendering its layout, popping out, docking) and a fresh\ninstance re-deriving would take the second branch against rows that already hold the live\ntranscript — banking the session as its own baseline. Keying on the session instead means a\nremount inherits the baseline that transcript was paired with."
+              "description": "Write this session's usage into persisted build history as a single row keyed by the\nsession key, replacing any existing row for that key.\n\n**Idempotent** — safe to call per turn, on tab close, and on a title change alike. The\nname is historical: it does NOT end the session or reset the running totals. See\n`CostLedgerController.finalize` for the full contract and the no-op cases."
             },
             {
               "kind": "method",
@@ -2603,7 +2633,7 @@
                   }
                 }
               ],
-              "description": "Re-baseline this session against an emptied transcript: what came before, plus what the\ntranscript being discarded proved. `discarded` must be read BEFORE the live figures are\nreset, since that is the only record of the latter.\n\nNot the same as dropping the baseline. Dropping it re-derives through `persistenceActive`,\nand with persistence ON that carries the row's *old* banked figure forward — discarding\nevery turn between the last baseline and the clear. The transcript is gone either way, so\nthe branch that reads it as authoritative no longer applies.\n\nDerived from the memoised baseline and the live figure rather than from the project's row,\nbecause a row is only as current as the last `finalizeCostSession` — which skips its write\nwhile the ledger is unloaded, and while the session has no usage yet."
+              "description": "Re-baseline this session against an emptied transcript — see\n`CostLedgerController.rebaselineOnClearedTranscript`. `discarded` must be read\nBEFORE the live figures are reset, since that is the only record of the latter."
             },
             {
               "kind": "method",
@@ -2669,73 +2699,6 @@
               },
               "description": "Clear all persisted build history for this assistant scope."
             },
-            {
-              "kind": "method",
-              "name": "getCostHistoryScope",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "string"
-                }
-              }
-            },
-            {
-              "kind": "method",
-              "name": "reloadCostSessionHistory",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              }
-            },
-            {
-              "kind": "method",
-              "name": "costHistoryProvider",
-              "privacy": "private",
-              "description": "The persistence provider, but only when it implements BOTH cost-history methods.\n\nBoth or neither: a provider that can save but not load would silently accumulate a\nledger nobody ever reads back, so a partial implementation is treated as absent and\nfalls back to `localStorage`."
-            },
-            {
-              "kind": "method",
-              "name": "persistCostHistory",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "records",
-                  "type": {
-                    "text": "CostSessionRecord[]"
-                  }
-                }
-              ],
-              "description": "Adopt `records` as the live list, and schedule a write to whichever backend owns cost\nhistory — the provider when the host implements it, else `localStorage`.\n\nThe list is adopted synchronously because that is what the Usage tab renders; only the\n*write* is deferred. This runs on every usage change (about once per LLM call, plus once\nper sub-agent turn) and each write serialises the whole ledger, so coalescing cuts a\nper-turn `localStorage.setItem` or network round-trip down to one per quiet period. Safe\nbecause the write is a full replace of idempotent state: the newest call wins and no\nintermediate state is meaningful. Flushed on `pagehide` and disconnect so nothing is lost."
-            },
-            {
-              "kind": "method",
-              "name": "flushCostHistory",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              },
-              "description": "Write the pending ledger now. Safe to call when nothing is pending.\n\nProvider writes are fire-and-forget and best-effort: the ledger is accounting, not\nconversation content, so a failed write is logged and never surfaced into the chat. On\n`pagehide` the `localStorage` path completes synchronously; a provider write is subject to\nthe same unload race as every other network save the assistant makes."
-            },
-            {
-              "kind": "method",
-              "name": "syncActiveCostSessionTitle",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              },
-              "description": "Finalize the previous session when the host-provided title changes — a rename should land on\nthe row under its old name rather than silently relabelling accrued spend.\n\nOnly when the session key still matches the one that title accrued under. Hosts change\n`costHistory.title` on project SWITCH too, and if the key has already flipped, this would\nupsert the outgoing project's live usage onto the incoming project's row as\n`banked + old live`, inflating it. Under the old append model a mis-keyed write left a stray\nrow; with the upsert it overwrites a real one."
-            },
             {
               "kind": "field",
               "name": "activeModel",
@@ -2782,7 +2745,7 @@
               "type": {
                 "text": "ChatAttachment[]"
               },
-              "default": "[]"
+              "description": "Attachments pending on the next message."
             },
             {
               "kind": "field",
@@ -2790,7 +2753,7 @@
               "type": {
                 "text": "string[]"
               },
-              "default": "[]"
+              "description": "Rejection messages for files the last pick refused."
             },
             {
               "kind": "field",
@@ -2807,7 +2770,6 @@
               "type": {
                 "text": "number"
               },
-              "default": "0",
               "description": "Bump to re-render app settings toggles when the host provider notifies a change."
             },
             {
@@ -2816,7 +2778,6 @@
               "type": {
                 "text": "boolean"
               },
-              "default": "false",
               "description": "Whether the settings modal is open."
             },
             {
@@ -2834,7 +2795,6 @@
               "type": {
                 "text": "SettingsModalTab"
               },
-              "default": "'settings'",
               "description": "Active tab inside the settings modal."
             },
             {
@@ -2970,41 +2930,28 @@
               "type": {
                 "text": "HTMLElement[]"
               },
-              "default": "[]",
-              "description": "Light-DOM nodes assigned to settings modal slots (via `slotted()` bindings)."
+              "description": "Light-DOM nodes assigned to settings modal slots. The template's `slotted()`\nbindings write these by property NAME, so each needs a real setter here even\nthough the controller owns the arrays."
             },
             {
               "kind": "field",
               "name": "settingsAppSlotted",
               "type": {
                 "text": "HTMLElement[]"
-              },
-              "default": "[]"
+              }
             },
             {
               "kind": "field",
               "name": "settingsCostCurrentSlotted",
               "type": {
                 "text": "HTMLElement[]"
-              },
-              "default": "[]"
+              }
             },
             {
               "kind": "field",
               "name": "settingsCostHistorySlotted",
               "type": {
                 "text": "HTMLElement[]"
-              },
-              "default": "[]"
-            },
-            {
-              "kind": "field",
-              "name": "costSessionHistory",
-              "type": {
-                "text": "CostSessionRecord[]"
-              },
-              "default": "[]",
-              "description": "Persisted finalized cost sessions shown on the Usage tab build history list."
+              }
             },
             {
               "kind": "field",
@@ -3023,6 +2970,16 @@
               },
               "privacy": "private"
             },
+            {
+              "kind": "field",
+              "name": "orchestrator",
+              "type": {
+                "text": "OrchestratingDriver | undefined"
+              },
+              "privacy": "private",
+              "description": "This element's driver as an orchestrator, or `undefined` when the session is\nrunning a bare `ChatDriver`.\n\nThe five call sites that used to test the type themselves now read this\n(§11.2 constraint 3 of `docs/code-health.md`): the agent pin, the flow-owner\nlock, the wire-up in `wireDriver`, and the two `driverKind` diagnostics. The\ntype test itself lives in `asOrchestrator`, shared with the session\npersister.",
+              "readonly": true
+            },
             {
               "kind": "field",
               "name": "driverCleanup",
@@ -3065,72 +3022,6 @@
               "privacy": "private",
               "description": "Unsubscribe handle for the provider-registry change listener (observable registries only)."
             },
-            {
-              "kind": "field",
-              "name": "unsubAppSettingsProvider",
-              "type": {
-                "text": "() => void | undefined"
-              },
-              "privacy": "private",
-              "description": "Unsubscribe handle for (AssistantAppSettingsProvider:interface).subscribe."
-            },
-            {
-              "kind": "field",
-              "name": "_activeCostSessionTitle",
-              "type": {
-                "text": "string"
-              },
-              "privacy": "private",
-              "default": "''",
-              "description": "Title tracked for the in-flight cost session (used when `header-title` changes)."
-            },
-            {
-              "kind": "field",
-              "name": "_activeCostSessionKey",
-              "type": {
-                "text": "string | undefined"
-              },
-              "privacy": "private",
-              "description": "Session key `_activeCostSessionTitle` was captured under, so a title change can tell a rename\n(same key) from a project switch (key already flipped) — see `syncActiveCostSessionTitle`."
-            },
-            {
-              "kind": "field",
-              "name": "_costHistoryLoaded",
-              "type": {
-                "text": "boolean"
-              },
-              "privacy": "private",
-              "default": "false",
-              "description": "Whether the row list reflects storage yet. Gates cost writes so a project's banked\nspend is never derived from a ledger that simply hasn't arrived."
-            },
-            {
-              "kind": "field",
-              "name": "_ledgerUnreadable",
-              "type": {
-                "text": "boolean"
-              },
-              "privacy": "private",
-              "default": "false",
-              "description": "Set when a provider read failed. Latches writes off for this page-load: `saveCostHistory`\nreplaces the whole stored list, so writing anything derived from the empty list we fell back\nto would destroy rows we never managed to read."
-            },
-            {
-              "kind": "field",
-              "name": "_ledgerDirty",
-              "type": {
-                "text": "boolean"
-              },
-              "privacy": "private",
-              "default": "false",
-              "description": "Pending (adopted but unwritten) ledger changes — see `persistCostHistory`."
-            },
-            {
-              "kind": "field",
-              "name": "_ledgerFlushTimer",
-              "type": {
-                "text": "ReturnType<typeof setTimeout> | undefined"
-              },
-              "privacy": "private"
-            },
             {
               "kind": "field",
               "name": "_handlePageHide",
@@ -3171,52 +3062,31 @@
               "description": "Bound to the rapid-text-area chat input via the template ref."
             },
             {
-              "kind": "field",
-              "name": "composerHeightPx",
-              "type": {
-                "text": "number | null"
-              },
-              "default": "null",
-              "description": "Explicit composer height (px) once the user has dragged the resize handle;\n`null` keeps the default auto-grow behaviour. Written into the\n`--composer-height` custom property via the `composerHeightStyle` getter."
-            },
-            {
-              "kind": "field",
-              "name": "_resizeStartY",
-              "type": {
-                "text": "number"
-              },
+              "kind": "method",
+              "name": "accessor",
               "privacy": "private",
-              "default": "0",
-              "description": "Pointer Y and composer height captured at the start of a resize drag."
-            },
-            {
-              "kind": "field",
-              "name": "_resizeStartHeight",
-              "type": {
-                "text": "number"
+              "return": {
+                "type": {
+                  "text": "Accessor<this[K]>"
+                }
               },
-              "privacy": "private",
-              "default": "0"
+              "parameters": [
+                {
+                  "name": "key",
+                  "type": {
+                    "text": "K"
+                  }
+                }
+              ],
+              "description": "A get/set pair over one of this element's own properties, for a controller\nthat drives state it does not own. Written as a helper rather than two inline\nclosures per call: a pair of same-typed closures is easy to transpose by\naccident, and a single object cannot be."
             },
             {
               "kind": "field",
-              "name": "_composerNaturalHeight",
+              "name": "composerHeightPx",
               "type": {
-                "text": "number"
+                "text": "number | null"
               },
-              "privacy": "private",
-              "default": "0",
-              "description": "The composer's natural (un-resized) height, measured on first drag — used\nas the lower bound so the box can't be dragged smaller than it started."
-            },
-            {
-              "kind": "field",
-              "name": "_resizeMaxHeight",
-              "privacy": "private",
-              "default": "400",
-              "description": "Upper bound for the current drag — capped to the headroom above so growing\nthe composer never pushes the input row's buttons off the bottom.",
-              "type": {
-                "text": "number"
-              }
+              "description": "Explicit composer height once dragged; `null` keeps the default auto-grow."
             },
             {
               "kind": "field",
@@ -3617,16 +3487,6 @@
               },
               "description": "Push the mid-loop context guard down to the driver (GENC-1567).\n\nCalled wherever the inputs can change — the resolved provider status, and a\nfreshly built driver. A driver that never receives one simply runs without\nthe guard, which is the right default: it fires only when a real context\nwindow is known."
             },
-            {
-              "kind": "field",
-              "name": "contextGuardPolicy",
-              "type": {
-                "text": "ContextGuardPolicy | undefined"
-              },
-              "privacy": "private",
-              "description": "Guard policy pushed to the driver, or `undefined` when the host has switched\nthe gate off — so `enabled: false` really does mean no local blocking of any\nkind, UI or mid-loop.\n\nA MARGIN, not a threshold: the driver resolves the window of the provider\neach call actually goes to. The fallback window rides along because the\ndriver cannot learn it any other way — without it, a host that knows its\nwindow while its provider does not report one had `fallbackContextLimit`\nprotecting the composer and nothing else.",
-              "readonly": true
-            },
             {
               "kind": "method",
               "name": "loadProviderStatuses",
@@ -3815,203 +3675,133 @@
               "description": "Record a meta/lifecycle event onto this session's debug-log timeline\n(exported via FoundationAiAssistant.getDebugLog). Every event\nauto-carries `placement` so a session emitted from both the bubble and the\nlayout panel stays disambiguated. Keyed by `stateKey` so the timeline is\nshared across pop-in/pop-out and survives driver rebuilds."
             },
             {
-              "kind": "field",
-              "name": "_dismissPointerHandler",
-              "type": {
-                "text": "(e: Event) => void | undefined"
-              },
-              "privacy": "private",
+              "kind": "method",
+              "name": "toggleAgentPicker",
               "description": "Document-level dismissal for whichever composer menu is open. Bound only\nwhile one IS open — a permanently-attached listener on a component that can\nbe mounted twice (bubble + popout panel) is a cost every click on the page\npays for a menu that is usually closed.\n\nUses `composedPath()` rather than `event.target`: the click lands on a node\ninside this element's shadow root, which retargets to the host, so a plain\n`contains()` check cannot tell \"clicked the menu\" from \"clicked the\ntranscript\". The path crosses the boundary and carries both."
             },
             {
               "kind": "field",
-              "name": "_dismissKeyHandler",
+              "name": "confirmingClear",
               "type": {
-                "text": "(e: KeyboardEvent) => void | undefined"
+                "text": "boolean"
               },
-              "privacy": "private"
+              "default": "false",
+              "description": "Two-step confirm for the destructive Clear action; reset whenever the menu toggles."
             },
             {
               "kind": "field",
-              "name": "_dismissResizeHandler",
+              "name": "confirmingCompact",
               "type": {
-                "text": "() => void | undefined"
-              },
-              "privacy": "private"
-            },
-            {
-              "kind": "method",
-              "name": "closeOpenComposerMenus",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              }
-            },
-            {
-              "kind": "method",
-              "name": "positionComposerMenu",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
+                "text": "boolean"
               },
-              "parameters": [
-                {
-                  "name": "panelSelector",
-                  "type": {
-                    "text": "string"
-                  }
-                },
-                {
-                  "name": "triggerSelector",
-                  "type": {
-                    "text": "string"
-                  }
-                }
-              ],
-              "description": "Places an open composer menu directly above the control that opened it.\n\nCSS alone cannot: the menu is a child of `.composer` — which is what lets its\nwidth be capped against the composer rather than against a button — while its\nanchor is a button several levels down the bar, and no selector can read a\nsibling's offset. So the left edge is measured on open and written as a\ncustom property.\n\nClamped to the composer, so a menu opened from a control near the right edge\nof a narrow panel slides back inside instead of overhanging. The animation\norigin is written separately and keeps pointing at the button's centre even\nafter such a shift — the menu still grows out of the thing that opened it,\nwhich is the whole point of anchoring it there."
+              "default": "false"
             },
             {
-              "kind": "method",
-              "name": "repositionOpenComposerMenu",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
+              "kind": "field",
+              "name": "sessionMenuEnabled",
+              "type": {
+                "text": "boolean"
               },
-              "description": "Re-place whichever menu is open. Cheap enough to run from a resize."
-            },
-            {
-              "kind": "method",
-              "name": "syncComposerMenuDismissal",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              }
-            },
-            {
-              "kind": "method",
-              "name": "teardownComposerMenuDismissal",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              }
+              "description": "Whether the lifecycle-menu button shows. It occupies the stop-button slot,\nso it only appears when idle (mutually exclusive with Stop). Gated on\npersistence — the menu's actions (Compact, Clear, the \"remember chat\" toggle)\nonly make sense with a provider configured, so it's hidden entirely without\none. A host can additionally force it off via `chatConfig.ui.showSessionMenu:\nfalse` even when a provider is present (e.g. a guided onboarding flow where\nclearing/compacting mid-journey would be disruptive).",
+              "readonly": true
             },
             {
               "kind": "field",
-              "name": "MENU_HEADROOM_RESERVE",
+              "name": "persistenceToggleable",
               "type": {
-                "text": "number"
+                "text": "boolean"
               },
-              "privacy": "private",
-              "static": true,
-              "readonly": true,
-              "default": "20",
-              "description": "Vertical space an open menu must leave free above the button, covering BOTH\nthe gap the menu sits off the button by (8px, declared in design units in\nmain.styles.ts) and the breathing room wanted above it. The two are lumped\ntogether because only the second half is a free choice: the first is fixed by\nthe stylesheet and simply has to be subtracted from the headroom, and a\nconstant named for only one of them invites someone to \"fix\" a gap that is\ndoing exactly what it should."
+              "description": "The persistence toggle row renders only when a provider is configured.",
+              "readonly": true
             },
             {
               "kind": "field",
-              "name": "_agentPickerToggle",
-              "privacy": "private",
-              "readonly": true,
-              "default": "new AnimatedPanelToggle(\n    this,\n    '.agent-picker-panel',\n    AGENT_PICKER_CLOSE_MS,\n    () => this.agentPickerOpen,\n    (v) => {\n      this.agentPickerOpen = v;\n    },\n  )"
-            },
-            {
-              "kind": "method",
-              "name": "toggleAgentPicker"
+              "name": "persistenceActive",
+              "type": {
+                "text": "boolean"
+              },
+              "description": "Whether persistence is currently active (on + a provider) for this session.",
+              "readonly": true
             },
             {
               "kind": "field",
-              "name": "confirmingClear",
+              "name": "contextBudget",
               "type": {
-                "text": "boolean"
+                "text": "ResolvedContextBudget"
               },
-              "default": "false",
-              "description": "Two-step confirm for the destructive Clear action; reset whenever the menu toggles."
+              "description": "The context gate's derived surface (GENC-1567). Every member below delegates to\n`ContextGateController` — the names are this element's public API and the\ntemplate's bindings, so they stay put while the derivation moves.\n\nThe per-agent `contextReserve` IS folded in, via the driver (GENC-1582). It\nused to be described here as a separate, later check made when an agent took\nownership of a flow — but there is no such check, and by flow entry the send\nhas already been allowed. Resolving it before the send is what makes it a gate\nrather than a label.\n\nNone carries `@volatile`: the decorators live on the controller's getters, and\nthey reach the binding observer from there — see `docs/code-health.md` §11.4.",
+              "readonly": true
             },
             {
               "kind": "field",
-              "name": "confirmingCompact",
+              "name": "compactionPlan",
               "type": {
-                "text": "boolean"
+                "text": "CompactionProjection | null"
               },
-              "default": "false"
+              "readonly": true
             },
             {
               "kind": "field",
-              "name": "_sessionMenuToggle",
-              "privacy": "private",
-              "readonly": true,
-              "default": "new AnimatedPanelToggle(\n    this,\n    '.session-menu-panel',\n    SESSION_MENU_CLOSE_MS,\n    () => this.sessionMenuOpen,\n    (v) => {\n      this.sessionMenuOpen = v;\n    },\n  )"
+              "name": "contextGate",
+              "type": {
+                "text": "'ok' | 'warn' | 'blocked'"
+              },
+              "readonly": true
             },
             {
               "kind": "field",
-              "name": "sessionMenuEnabled",
+              "name": "contextGateReason",
               "type": {
-                "text": "boolean"
+                "text": "string"
               },
-              "description": "Whether the lifecycle-menu button shows. It occupies the stop-button slot,\nso it only appears when idle (mutually exclusive with Stop). Gated on\npersistence — the menu's actions (Compact, Clear, the \"remember chat\" toggle)\nonly make sense with a provider configured, so it's hidden entirely without\none. A host can additionally force it off via `chatConfig.ui.showSessionMenu:\nfalse` even when a provider is present (e.g. a guided onboarding flow where\nclearing/compacting mid-journey would be disruptive).",
               "readonly": true
             },
             {
               "kind": "field",
-              "name": "persistenceToggleable",
+              "name": "contextGateLabel",
               "type": {
-                "text": "boolean"
+                "text": "string"
               },
-              "description": "The persistence toggle row renders only when a provider is configured.",
               "readonly": true
             },
             {
               "kind": "field",
-              "name": "persistenceActive",
+              "name": "compactHint",
               "type": {
-                "text": "boolean"
+                "text": "string"
               },
-              "description": "Whether persistence is currently active (on + a provider) for this session.",
               "readonly": true
             },
             {
               "kind": "field",
-              "name": "contextBudget",
+              "name": "compactable",
               "type": {
-                "text": "ResolvedContextBudget"
+                "text": "boolean"
               },
-              "description": "Context-headroom thresholds for the active model (GENC-1567) — the warning\nand block lines, plus the tail budget compaction aims at.\n\nThe per-agent `contextReserve` IS folded in, via the driver (GENC-1582). It\nused to be described here as a separate, later check made when an agent took\nownership of a flow — but there is no such check, and by flow entry the send\nhas already been allowed. Resolving it here, before the send, is what makes it\na gate rather than a label.\n\nOverhead is read off `messages` (the Redux mirror) rather than the driver's\nown history, which the compaction plan uses. That is safe rather than sloppy:\n`estimateSystemOverhead` only looks at messages BEFORE the first usage-bearing\none, and the two lists agree completely that early — the drift between mirror\nand driver history is only ever at the tail.",
               "readonly": true
             },
             {
               "kind": "field",
-              "name": "compactionPlan",
+              "name": "composerNoticeVisible",
               "type": {
-                "text": "CompactionProjection | null"
+                "text": "boolean"
               },
-              "description": "What compacting right now would reclaim, or `null` when it would not be\nworth it (GENC-1567). Sized against FoundationAiAssistant.contextBudget,\nso the plan aims at this model's window rather than a fixed default.\n\nReads `messages` to stay reactive as the conversation grows: the driver's\nhistory is not a tracked observable, so every consumer of this keys its\nre-evaluation off the Redux mirror.",
               "readonly": true
             },
             {
               "kind": "field",
-              "name": "contextGate",
+              "name": "composerNoticeText",
               "type": {
-                "text": "'ok' | 'warn' | 'blocked'"
+                "text": "string"
               },
               "readonly": true
             },
             {
               "kind": "field",
-              "name": "compactable",
+              "name": "composerNoticeSrOnly",
               "type": {
                 "text": "boolean"
               },
-              "description": "Whether the menu's \"Compact\" action would do anything (GENC-1351 §5.7,\nGENC-1567). Delegates to the driver's plan so the gate uses the exact same\nhistory `compact()` acts on, judged against the same budget — one source of\ntruth for both whether a cut is legal and whether it reclaims enough.",
               "readonly": true
             },
             {
@@ -4130,7 +3920,7 @@
               "type": {
                 "text": "boolean"
               },
-              "description": "Whether the settings modal AI Model section has slotted app content, context usage or budget figures.",
+              "description": "The settings modal's derived surface. Every member below delegates to\n`SettingsModalController` — the names are this element's public API and the\n943-line template's bindings, so they stay put while the logic moves into the\n`settings-modal.ts` that folder never had (`docs/code-health.md` §3).\n\nNone carries `@volatile`: the decorators live on the controller's getters, and\nthey reach the binding observer from there — see `docs/code-health.md` §11.4.",
               "readonly": true
             },
             {
@@ -4193,41 +3983,21 @@
                 "type": {
                   "text": "void"
                 }
-              },
-              "parameters": [
-                {
-                  "name": "id",
-                  "type": {
-                    "text": "string"
-                  }
-                },
-                {
-                  "name": "value",
-                  "type": {
-                    "text": "boolean"
-                  }
-                }
-              ]
-            },
-            {
-              "kind": "method",
-              "name": "wireAppSettingsProvider",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              }
-            },
-            {
-              "kind": "method",
-              "name": "unwireAppSettingsProvider",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
+              },
+              "parameters": [
+                {
+                  "name": "id",
+                  "type": {
+                    "text": "string"
+                  }
+                },
+                {
+                  "name": "value",
+                  "type": {
+                    "text": "boolean"
+                  }
                 }
-              }
+              ]
             },
             {
               "kind": "field",
@@ -4243,7 +4013,7 @@
               "type": {
                 "text": "boolean"
               },
-              "description": "Whether the build-history section has anything in it — the built-in row list, or a host's own\nmarkup in the `settings-cost-history` slot.\n\nSlotted content is checked FIRST, ahead of `enabled`. That flag governs the *built-in* ledger:\nit gates the row writes, the reload, and the lifetime sum — and it defaults to `false`\n(`cost?.enabled === true`), while the Usage tab itself shows for `showCost`/`showTokens`, which\ndefault true. So a host can legitimately render its own build history into the slot and never\nopt into our `localStorage` ledger. Short-circuiting on `enabled` above the slot check hid that\nhost's markup outright, since the slot is the only thing in the container.",
+              "description": "Whether the build-history section has anything in it — the built-in row list, or a host's own\nmarkup in the `settings-cost-history` slot. See\n`SettingsModalController.costHistorySectionVisible` for why slotted content is\nchecked ahead of `enabled`.",
               "readonly": true
             },
             {
@@ -4252,7 +4022,7 @@
               "type": {
                 "text": "boolean"
               },
-              "description": "Whether the \"Build history\" heading has anything under it.\n\nBroader than FoundationAiAssistant.settingsCostHistorySectionVisible because the\nheading also covers the lifetime total, which renders before the first row exists (rows are\nwritten as spend accrues, the lifetime section only needs history switched on). Gating the\nheading on the rows alone left that total sitting under nothing.",
+              "description": "Whether the \"Build history\" heading has anything under it — broader than\nFoundationAiAssistant.settingsCostHistorySectionVisible, because the\nheading also covers the lifetime total, which renders before the first row exists.",
               "readonly": true
             },
             {
@@ -4270,7 +4040,7 @@
               "type": {
                 "text": "boolean"
               },
-              "description": "Whether the lifetime-usage section has anything to say.\n\nRequires build history: with it off there are no rows, so `cumulativeUsage` falls back to\nthe live session and the section would restate the block directly below it under a\n\"lifetime\" heading it hasn't earned.",
+              "description": "Whether the lifetime-usage section has anything to say. Requires build history\nAND a resolvable state key — see `SettingsModalController.costLifetimeVisible`.",
               "readonly": true
             },
             {
@@ -4362,45 +4132,6 @@
               ],
               "description": "Sync the active settings modal tab when the design-system tab bar changes."
             },
-            {
-              "kind": "method",
-              "name": "resetSettingsModalTabsOnOpen",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              },
-              "description": "Ensure the settings tab is selected when the modal opens."
-            },
-            {
-              "kind": "method",
-              "name": "resetSettingsModalTabsOnClose",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              },
-              "description": "Return to the settings tab when the modal closes on Cost."
-            },
-            {
-              "kind": "method",
-              "name": "snapSettingsModalTabIndicator",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "void"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "retry",
-                  "default": "true"
-                }
-              ],
-              "description": "Snap the tab underline to the settings tab without animating from Cost.\nUsed after hide/show when aria state is correct but the indicator drifted."
-            },
             {
               "kind": "field",
               "name": "pinnedAgentHint",
@@ -4513,7 +4244,7 @@
                   "text": "DiagnosticEntry"
                 }
               },
-              "description": "The single `meta-snapshot` entry for right now — the export-time `meta` block\n(agent summary, active prompt/state, context + cost) plus the `dedupSignature`\nthe forward-capture delta keys on.\n\nSeparate from `buildDiagnosticEntries` because the download path needs a\nFRESH one on its own: the persisted stream only re-appends this block when the\nnear-static config changes, so the newest stored snapshot's volatile half — the\n`context` figures especially — is typically frozen at the session's first flush."
+              "description": "The `meta-snapshot` entry for right now. The assembly is a pure transformation\nin `buildMetaSnapshot`; this gathers what it reports.\n\nThe live agent comes from the DRIVER, not `this.activeAgent` (the redux-stripped\nprojection, no functions) and not a lookup in `this.agents` (which may mint\nfresh, never-activated configs) — only the driver holds the instance whose\n`onActivate` ran, so only its `getDebugSnapshot` closure holds state."
             },
             {
               "kind": "method",
@@ -4735,101 +4466,6 @@
                 }
               ]
             },
-            {
-              "kind": "method",
-              "name": "isAcceptedFile",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "boolean"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "file",
-                  "type": {
-                    "text": "File"
-                  }
-                }
-              ]
-            },
-            {
-              "kind": "method",
-              "name": "readFileAsText",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "Promise<string>"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "file",
-                  "type": {
-                    "text": "File"
-                  }
-                }
-              ]
-            },
-            {
-              "kind": "method",
-              "name": "readFileAsBase64",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "Promise<string>"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "file",
-                  "type": {
-                    "text": "File"
-                  }
-                }
-              ],
-              "description": "The base64 payload of a file, without any `data:` prefix — the raw form\n`ChatImageAttachment.data` specifies (transports add their own framing)."
-            },
-            {
-              "kind": "method",
-              "name": "processFiles",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "Promise<{ attachments: ChatAttachment[]; errors: string[] }>"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "files",
-                  "type": {
-                    "text": "File[]"
-                  }
-                },
-                {
-                  "name": "existingBytes",
-                  "default": "0"
-                }
-              ]
-            },
-            {
-              "kind": "method",
-              "name": "loadSelectedFiles",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "Promise<void>"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "e",
-                  "type": {
-                    "text": "Event"
-                  }
-                }
-              ]
-            },
             {
               "kind": "method",
               "name": "handleSendClick"
@@ -4949,7 +4585,7 @@
               "type": {
                 "text": "boolean"
               },
-              "description": "Whether the message input shows a drag handle to resize its height.\nOn by default; hosts opt out via `chatConfig.ui.resizableInput: false`.",
+              "description": "Whether the message input shows a drag handle to resize its height.",
               "readonly": true
             },
             {
@@ -4958,7 +4594,7 @@
               "type": {
                 "text": "string"
               },
-              "description": "Inline style for the chat input: writes the chosen height into the\n`--composer-height` custom property (read by `.chat-input` + its control in\n`main.styles.ts`). Empty until the user drags (or when resizing is disabled),\nso the default applies.",
+              "description": "Inline style carrying the dragged height into `--composer-height`.",
               "readonly": true
             },
             {
@@ -4976,8 +4612,7 @@
                     "text": "PointerEvent"
                   }
                 }
-              ],
-              "description": "Begin a composer resize drag. Captures the pointer so move/up keep firing\non the handle even when the cursor leaves its 7px band."
+              ]
             },
             {
               "kind": "method",
@@ -4994,8 +4629,7 @@
                     "text": "PointerEvent"
                   }
                 }
-              ],
-              "description": "Resize while dragging. Dragging up (clientY decreases) grows the composer;\nthe result is clamped between the natural height (lower) and the available\nheadroom/max (upper). No-op unless a drag is active (the handle holds pointer\ncapture), so plain hover-moves are ignored."
+              ]
             },
             {
               "kind": "method",
@@ -5012,8 +4646,7 @@
                     "text": "PointerEvent"
                   }
                 }
-              ],
-              "description": "End a resize drag and release the pointer capture."
+              ]
             }
           ],
           "events": [
@@ -5127,6 +4760,22 @@
             "module": "src/main/main.ts"
           }
         },
+        {
+          "kind": "js",
+          "name": "budgetPercentOf",
+          "declaration": {
+            "name": "budgetPercentOf",
+            "module": "./budget-controller"
+          }
+        },
+        {
+          "kind": "js",
+          "name": "formatBlockedReason",
+          "declaration": {
+            "name": "formatBlockedReason",
+            "module": "./budget-controller"
+          }
+        },
         {
           "kind": "js",
           "name": "FoundationAiAssistant",
@@ -5221,6 +4870,12 @@
         }
       ]
     },
+    {
+      "kind": "javascript-module",
+      "path": "src/main/meta-snapshot.ts",
+      "declarations": [],
+      "exports": []
+    },
     {
       "kind": "javascript-module",
       "path": "src/provider/ai-provider-switcher.ts",
@@ -9484,6 +9139,32 @@
               ],
               "description": "Build the `done` loop result, carrying the typed failure reason when the turn\nbailed (PTC-0). The discriminant stays `'done'` either way — the same value a\nclean turn returns — so consumers matching on `reason === 'done'` are unchanged;\n`failureReason` is simply present on a failure and absent on success. Omitted\n(rather than set to `undefined`) so a happy-path result stays byte-identical to\nthe historical `{ reason: 'done' }`."
             },
+            {
+              "kind": "method",
+              "name": "endTurnWithFailure",
+              "privacy": "private",
+              "return": {
+                "type": {
+                  "text": "ChatDriverResult"
+                }
+              },
+              "parameters": [
+                {
+                  "name": "exit",
+                  "type": {
+                    "text": "TurnFailureExit"
+                  }
+                },
+                {
+                  "name": "overrides",
+                  "optional": true,
+                  "type": {
+                    "text": "{\n      copy?: string;\n      budget?: BudgetDetail;\n      providerRefused?: ProviderRefusedDetail;\n    }"
+                  }
+                }
+              ],
+              "description": "End the turn on a terminal failure: fail upward when this driver is a sub-agent, speak\nto the user when it is not, and hand the reason to the caller either way.\n\nOnly that fork lives here. Each exit keeps its own `recordTurnError` call, because the\ntelemetry payload is what legitimately differs between them — attempt counts, token\nfigures, tool names — and folding it in would mean one optional field per condition.\n\n`overrides.copy` serves the two walls whose prose is composed per occurrence:\n`budgetExhaustedBubble` names the vendor and can offer another, `providerRefusedBubble`\nprefers a host-supplied message. Every other exit reads its copy from the table.\n\nOne exit stays out: the `BudgetExhaustedError` catch. Not because its shape differs —\nits two telemetry payloads are field-for-field identical — but because its main-turn\nbranch calls `reportBudgetExhausted`, which is public and also serves\n`OrchestratingDriver`'s classification phase, where no tool loop is running. That\nmethod has to survive either way, so routing the catch through here would relocate the\nduplication rather than remove it."
+            },
             {
               "kind": "method",
               "name": "reportBudgetExhausted",
@@ -9519,25 +9200,6 @@
               },
               "description": "The sentence shown when the upstream provider refuses (GENC-1506).\n\nDeliberately far simpler than `budgetExhaustedBubble`: no vendor name, no figures, no\nswitch-provider advice, and no branching on `kind`. The copy is cause-free by design — a user who\ncan see their own remaining spend must not be told about a limit, and we must not imply the bill\nhas gone unpaid — so there is nothing here to compose. A host override wins verbatim."
             },
-            {
-              "kind": "method",
-              "name": "reportProviderRefused",
-              "privacy": "private",
-              "return": {
-                "type": {
-                  "text": "ChatDriverResult"
-                }
-              },
-              "parameters": [
-                {
-                  "name": "e",
-                  "type": {
-                    "text": "ProviderRefusedError"
-                  }
-                }
-              ],
-              "description": "Terminal provider-refusal outcome. Mirrors `reportBudgetExhausted` so the two walls behave\nidentically from the caller's side, while keeping their diagnostics distinct.\n\n`kind` reaches the debug log and the result but never the transcript: it is what lets an operator\ntell \"top up the account\" from \"rotate the key\", and with cause-free user copy this is the only\nplace that distinction survives."
-            },
             {
               "kind": "method",
               "name": "failureReasonOf",
@@ -10709,6 +10371,57 @@
         }
       ]
     },
+    {
+      "kind": "javascript-module",
+      "path": "src/components/chat-driver/turn-failures.ts",
+      "declarations": [
+        {
+          "kind": "variable",
+          "name": "TURN_FAILURE_EXITS",
+          "type": {
+            "text": "object"
+          },
+          "default": "{\n  contextGuard: {\n    subReason: 'context_exhausted',\n    resultReason: 'context-exhausted',\n    copy:\n      'I had to stop here — this conversation has filled the available context. ' +\n      'Compact it to free up room, then ask me to continue.',\n  },\n  contextOverflow: {\n    subReason: 'context_exhausted',\n    resultReason: 'context-exhausted',\n    copy: DEFAULT_CONTEXT_OVERFLOW_MESSAGE,\n  },\n  malformedToolCall: {\n    subReason: 'malformed_tool_call',\n    // Not `malformed-tool-call`: the main-turn reason is named after the provider finish\n    // reason (`MALFORMED_FUNCTION_CALL`) that produces it, and is part of the published\n    // TurnFailureReason union, so the two names cannot be brought into line here.\n    resultReason: 'malformed-function-call',\n    copy: 'While working on your request, I repeatedly called my tools incorrectly. This often works on a second try — would you like me to try again? If it happens again, try breaking your request into smaller steps.',\n  },\n  responseTruncated: {\n    subReason: 'response_truncated',\n    resultReason: 'response-truncated',\n    copy: 'My response was cut off because a single step reached the model output limit. This usually means one step tried to produce too much at once — try breaking your request into smaller steps.',\n  },\n  timeout: {\n    subReason: 'timeout',\n    // There is no `timeout` member of TurnFailureReason, so the main turn reports the\n    // generic `exception`. A sub-agent gets the specific reason because its parent\n    // branches on it to decide whether a retry is worth attempting.\n    resultReason: 'exception',\n    copy: 'The request timed out. You can ask me to try again, or break this into a smaller step.',\n  },\n  unknownToolLimit: {\n    subReason: 'unknown_tool_limit',\n    resultReason: 'unknown-tool-limit',\n    copy: \"I'm sorry, I repeatedly tried to use tools that aren't available to me, so I couldn't complete that. If a 'Download agent log' option appears in the Settings (cog) menu, you can download the log and share it with whoever set up this assistant to help fix the issue.\",\n  },\n  maxIterations: {\n    subReason: 'max_iterations',\n    resultReason: 'max-iterations',\n    copy: \"I've reached my limit for this response. You can ask me to continue and I'll pick up where I left off.\",\n  },\n  refusal: {\n    subReason: 'refusal',\n    resultReason: 'refusal',\n    copy: 'This request was declined. Try rephrasing it, or breaking it into smaller steps.',\n  },\n  emptyResponse: {\n    subReason: 'empty_response',\n    resultReason: 'empty-response',\n    copy: 'While working on your request, I repeatedly generated a blank response. This often works on a second try — would you like me to try again? If it happens again, try breaking your request into smaller steps.',\n  },\n  providerRefused: {\n    subReason: 'provider_refused',\n    resultReason: 'provider-refused',\n    // Overridden per wall by `ChatDriver.providerRefusedBubble`, which prefers a\n    // host-supplied message; this is the fallback that method returns.\n    copy: DEFAULT_PROVIDER_REFUSED_MESSAGE,\n  },\n  budgetExhausted: {\n    subReason: 'budget_exhausted',\n    resultReason: 'budget-exhausted',\n    // Overridden per wall by `ChatDriver.budgetExhaustedBubble`, which upgrades this with\n    // \"switch to another AI\" when a second vendor is reachable.\n    copy: DEFAULT_BUDGET_EXHAUSTED_MESSAGE,\n  },\n  // `satisfies`, not an annotation: an annotation would widen `resultReason` to\n  // `TurnFailureReason` and cost the literal types that let `turn-failures.test.ts` pin the\n  // two deliberate divergences at compile time instead of at runtime.\n}",
+          "description": "The terminal outcomes of a tool loop.\n\n`contextGuard` and `contextOverflow` share a `subReason` because one failure is reached\ntwo ways the user experiences differently: the guard stops at the edge of the window with\nthe transcript intact, so its copy can point at compaction, while an overflow means the\nprovider has already rejected the request.\n\nThree entries take their copy from `@genesislcap/foundation-ai`, which owns the default\nmessage for every failure it also exports an error class for. The rest is for conditions\nthis driver detects itself, which have no upstream home."
+        },
+        {
+          "kind": "variable",
+          "name": "satisfies",
+          "description": "The terminal outcomes of a tool loop.\n\n`contextGuard` and `contextOverflow` share a `subReason` because one failure is reached\ntwo ways the user experiences differently: the guard stops at the edge of the window with\nthe transcript intact, so its copy can point at compaction, while an overflow means the\nprovider has already rejected the request.\n\nThree entries take their copy from `@genesislcap/foundation-ai`, which owns the default\nmessage for every failure it also exports an error class for. The rest is for conditions\nthis driver detects itself, which have no upstream home."
+        },
+        {
+          "kind": "variable",
+          "name": "Record",
+          "description": "The terminal outcomes of a tool loop.\n\n`contextGuard` and `contextOverflow` share a `subReason` because one failure is reached\ntwo ways the user experiences differently: the guard stops at the edge of the window with\nthe transcript intact, so its copy can point at compaction, while an overflow means the\nprovider has already rejected the request.\n\nThree entries take their copy from `@genesislcap/foundation-ai`, which owns the default\nmessage for every failure it also exports an error class for. The rest is for conditions\nthis driver detects itself, which have no upstream home."
+        }
+      ],
+      "exports": [
+        {
+          "kind": "js",
+          "name": "TURN_FAILURE_EXITS",
+          "declaration": {
+            "name": "TURN_FAILURE_EXITS",
+            "module": "src/components/chat-driver/turn-failures.ts"
+          }
+        },
+        {
+          "kind": "js",
+          "name": "satisfies",
+          "declaration": {
+            "name": "satisfies",
+            "module": "src/components/chat-driver/turn-failures.ts"
+          }
+        },
+        {
+          "kind": "js",
+          "name": "Record",
+          "declaration": {
+            "name": "Record",
+            "module": "src/components/chat-driver/turn-failures.ts"
+          }
+        }
+      ]
+    },
     {
       "kind": "javascript-module",
       "path": "src/components/chat-interaction-wrapper/chat-interaction-wrapper.styles.ts",
@@ -12023,6 +11736,46 @@
       "path": "src/components/settings-modal/index.ts",
       "declarations": [],
       "exports": [
+        {
+          "kind": "js",
+          "name": "SettingsModalController",
+          "declaration": {
+            "name": "SettingsModalController",
+            "module": "./settings-modal"
+          }
+        },
+        {
+          "kind": "js",
+          "name": "type",
+          "declaration": {
+            "name": "type",
+            "module": "./settings-modal"
+          }
+        },
+        {
+          "kind": "js",
+          "name": "SettingsModalDeps",
+          "declaration": {
+            "name": "SettingsModalDeps",
+            "module": "./settings-modal"
+          }
+        },
+        {
+          "kind": "js",
+          "name": "type",
+          "declaration": {
+            "name": "type",
+            "module": "./settings-modal"
+          }
+        },
+        {
+          "kind": "js",
+          "name": "SettingsModalTabsElement",
+          "declaration": {
+            "name": "SettingsModalTabsElement",
+            "module": "./settings-modal"
+          }
+        },
         {
           "kind": "js",
           "name": "SettingsModalTemplate",
@@ -12113,6 +11866,12 @@
         }
       ]
     },
+    {
+      "kind": "javascript-module",
+      "path": "src/components/settings-modal/settings-modal.ts",
+      "declarations": [],
+      "exports": []
+    },
     {
       "kind": "javascript-module",
       "path": "src/state/persistence/build-timeline-entries.ts",