@genesislcap/ai-assistant 15.23.3 → 15.24.0

package/dist/esm/main/main.js

@@ -22,7 +22,7 @@
 // =============================================================================
 var FoundationAiAssistant_1;
 import { __awaiter, __decorate, __rest } from "tslib";
-import { AIProviderRegistry, BUDGETED_VENDORS, DEFAULT_BUDGET_EXHAUSTED_MESSAGE, isObservableAIProviderRegistry, VENDOR_LABELS, vendorTypeOfLabel, } from '@genesislcap/foundation-ai';
+import { AIProviderRegistry, isObservableAIProviderRegistry } from '@genesislcap/foundation-ai';
 import { showNotificationDialog } from '@genesislcap/foundation-notifications';
 import { avoidTreeShaking } from '@genesislcap/foundation-utils';
 import { customElement, DOM, html, GenesisElement, observable, volatile, attr, } from '@genesislcap/web-core';
@@ -36,14 +36,15 @@ import { AiChatInteractionWrapper } from '../components/chat-interaction-wrapper
 import { AiChatMarkdown } from '../components/chat-markdown/chat-markdown';
 import { AiFlowingWavesIndicator } from '../components/flowing-waves-indicator';
 import { AiHaloOverlay } from '../components/halo-overlay';
-import { OrchestratingDriver } from '../components/orchestrating-driver/orchestrating-driver';
+import { asOrchestrator, OrchestratingDriver, } from '../components/orchestrating-driver/orchestrating-driver';
 import { AiPlasmaOrbIndicator } from '../components/plasma-orb-indicator';
+import { SettingsModalController, } from '../components/settings-modal';
 import { AiWavesIndicator } from '../components/waves-indicator';
 import { AssistantAppSettingsProvider, } from '../provider/assistant-app-settings';
 import { recordMetaEvent, getMetaEvents, clearSession as clearMetaSession, DEBUG_LOG_README, } from '../state/debug-event-log';
 import { getOrCreateDriver, getDriver, getDriverAgentsKey, deleteDriver, } from '../state/driver-registry';
 import { buildTimelineEntries } from '../state/persistence/build-timeline-entries';
-import { assembleDebugLog, configDigest, withFreshMetaSnapshot, } from '../state/persistence/diagnostics';
+import { assembleDebugLog, withFreshMetaSnapshot } from '../state/persistence/diagnostics';
 import { deleteDiagnosticsCursorsFor, resetDiagnosticsCursorsFor, } from '../state/persistence/diagnostics-cursors';
 import { getOrCreatePersister, getPersister, deletePersister, } from '../state/persistence/persister-registry';
 import { SessionPersister, } from '../state/persistence/session-persister';
@@ -51,25 +52,24 @@ import { lastUserMessageIndex } from '../state/persistence/session-snapshot';
 import { getSessionStore, hasSessionStore, deleteSessionStore, } from '../state/session-store';
 import { pinColourAt } from '../styles/ai-colours';
 import { ChatSuggestions } from '../suggestions/chat-suggestions';
-import { AnimatedPanelToggle } from '../utils/animated-panel-toggle';
 import { resolveExclusiveLoadingStyle } from '../utils/animation-exclusivity';
-import { deleteBankedBaseline, getBankedBaseline, setBankedBaseline, } from '../utils/banked-usage-baselines';
-import { collectSessionModels } from '../utils/collect-session-models';
+import { deleteBankedBaseline } from '../utils/banked-usage-baselines';
 import { estimateContextTokens, isContextMeasurable, } from '../utils/context-tokens';
-import { clearCostSessionHistory, isCostSessionRecord, loadCostSessionHistory, resolveBankedUsage, saveCostSessionHistory, sortRecordsByRecency, upsertRecord, } from '../utils/cost-session-history';
-import { deriveCostSessionTitleFromMessages, resolveCostSessionTitle, } from '../utils/derive-cost-session-title';
-import { formatUsd } from '../utils/format-usd';
 import { logger } from '../utils/logger';
 import { filterVisibleMessages, trailingInteractionRow } from '../utils/message-partition';
-import { CONTEXT_ABORT_MARGIN_TOKENS, resolveContextBudget, } from '../utils/resolve-context-budget';
-import { resolveCostHistoryConfig, } from '../utils/resolve-cost-history-config';
 import { resolvePreferenceBaseline } from '../utils/resolve-preference-baseline';
 import { stripAgentHandlers } from '../utils/strip-agent-handlers';
-import { addUsage, emptyUsage, sumUsage, totalTokens } from '../utils/sum-usage';
-import { expandToolTree } from '../utils/tool-fold';
+import { emptyUsage, sumUsage, totalTokens } from '../utils/sum-usage';
+import { AttachmentController } from './attachment-controller';
+import { BudgetController } from './budget-controller';
+import { ComposerMenuController } from './composer-menu-controller';
+import { ComposerResizeController } from './composer-resize-controller';
+import { ContextGateController } from './context-gate-controller';
+import { CostLedgerController } from './cost-ledger-controller';
 import { styles } from './main.styles';
 import { FoundationAiAssistantTemplate } from './main.template';
 import { AiAssistantEvent } from './main.types';
+import { buildMetaSnapshot } from './meta-snapshot';
 /** Context window sizes (in tokens) for known models. */
 // ─── Avatar icons ─────────────────────────────────────────────────────────────
 // Inline SVG bundled as strings — no runtime asset dependency. They use
@@ -91,83 +91,6 @@ export const genesisIconSvg = `<svg viewBox="-4 0 30 26" fill="none" xmlns="http
 function sanitizeIconMarkup(markup) {
     return DOMPurify.sanitize(markup, { USE_PROFILES: { svg: true, svgFilters: true } });
 }
-/**
- * Duration of a composer menu's close animation. Must stay in sync with the
- * `composer-menu-out` keyframe duration in `main.styles.ts` — the toggle strips
- * the `closing` class on a timer, so a shorter value here unmounts the panel
- * mid-animation and a longer one leaves it sitting invisible.
- */
-const AGENT_PICKER_CLOSE_MS = 200;
-const SESSION_MENU_CLOSE_MS = 200;
-/**
- * Floor for an open menu's height, applied when the assistant is too short to
- * give it the room it wants. Below this a menu is more frustrating than a
- * scrollbar is, so it overhangs instead.
- */
-const COMPOSER_MENU_MIN_HEIGHT = 140;
-/**
- * How long cost-ledger writes coalesce. Comfortably longer than the gap between the turns of a
- * tool loop, so a multi-step run writes once rather than per turn, and short enough that a flush
- * has landed well before a user could close the tab. Nothing reads the stored ledger while the
- * assistant is running — the Usage tab renders the in-memory list — so the delay is invisible.
- */
-const LEDGER_FLUSH_DEBOUNCE_MS = 2000;
-/**
- * The image types BOTH vendors accept, and therefore the only ones sent as image blocks.
- *
- * A host's `acceptedFiles` may well say `image/*`, which covers HEIC, BMP, TIFF, AVIF and SVG —
- * none of which the APIs take. Sending one fails the whole turn the user is waiting on, so
- * anything outside this set falls through to the text branch instead: harmless for a binary, and
- * genuinely useful for SVG, which is text a model can read.
- *
- * `image/jpg` is absent on purpose — `normalizeImageMime` rewrites it to `image/jpeg` at the
- * transport, but a file arriving with that spelling is still a real JPEG, so it is accepted here.
- */
-const VENDOR_IMAGE_MIME_TYPES = new Set([
-    'image/jpeg',
-    'image/jpg',
-    'image/png',
-    'image/gif',
-    'image/webp',
-]);
-/**
- * Ceiling on ONE image attachment, under Anthropic's ~5MB-per-image limit with room for the ~33%
- * base64 overhead. Refused here, with the size named, rather than at the vendor: a 400 arrives
- * only after the user has waited out the turn.
- *
- * A VENDOR guard, and only that. An earlier version of this comment also claimed it protected the
- * session's storage quota — it does not, and the arithmetic says so: one file at this ceiling is
- * ~4.7MB of base64, which alone can exceed a 5MB `localStorage` budget before the transcript is
- * counted. Attachments riding into persisted storage is a real and separate problem; it is not
- * this constant's to solve, and saying otherwise hid it.
- */
-const MAX_IMAGE_ATTACHMENT_BYTES = 3500000;
-/**
- * Ceiling on ALL attachments carried by one message, across every type and every successive pick.
- *
- * The per-file check above is blind to the total: the picker APPENDS (`loadSelectedFiles`), so ten
- * files each just under the per-image limit are ten passes and one ~34MB request. Sized against
- * the vendors' request ceilings — comfortably inside the smaller of them with room for the
- * transcript itself — so a turn that would be rejected wholesale is refused here, where the user
- * can still act on it, naming the file that crossed the line.
- *
- * Like its sibling, this does NOT make attachments safe to persist — 8MB of attachments is still
- * ~10.7MB of base64. What a persisted session should keep of its images is GENC-1531; note the
- * transports also REPLAY history attachments on every later call, so it is a recurring cost as
- * well as a storage one.
- */
-const MAX_ATTACHMENTS_TOTAL_BYTES = 8000000;
-/** Base64 carries 3 bytes in every 4 characters, so decoded size is 3/4 of the encoded length. */
-const BASE64_DECODED_RATIO = 0.75;
-/** A rough byte size for an already-accepted attachment, for budgeting against the total cap. */
-function attachmentBytes(a) {
-    var _a, _b, _c, _d;
-    return a.kind === 'image'
-        ? Math.ceil(((_b = (_a = a.data) === null || _a === void 0 ? void 0 : _a.length) !== null && _b !== void 0 ? _b : 0) * BASE64_DECODED_RATIO)
-        : ((_d = (_c = a.content) === null || _c === void 0 ? void 0 : _c.length) !== null && _d !== void 0 ? _d : 0);
-}
-/** Bytes per megabyte, for the size the refusal message quotes back to the user. */
-const BYTES_PER_MB = 1000000;
 /**
  * Reporter id for this element's OWN session persister in `brokenSources` (GENC-1511).
  *
@@ -181,11 +104,6 @@ const SESSION_PERSISTENCE_SOURCE = 'session';
  * store; a host owning several should name each, so one recovering does not withdraw the others.
  */
 const DEFAULT_PERSISTENCE_SOURCE = 'host';
-/** Drag-to-resize bounds for the chat input (composer), in px. */
-const COMPOSER_MIN_HEIGHT_PX = 48;
-const COMPOSER_MAX_HEIGHT_PX = 400;
-/** Keep at least this much of the message list visible while growing the composer. */
-const COMPOSER_MIN_MESSAGES_PX = 80;
 /**
  * Composer placeholder while the assistant is blocked (GENC-1464). Deliberately
  * fixed and short, and NOT host-overridable — the banner directly above it
@@ -196,108 +114,13 @@ const COMPOSER_MIN_MESSAGES_PX = 80;
  */
 const BLOCKED_PLACEHOLDER = 'AI usage limit reached';
 /**
- * Closing sentence for a wall the user cannot route around. Singular/plural
- * variants because the banner names one vendor or several.
- */
-const RAISE_LIMIT_ACTION = 'Contact your administrator to raise it.';
-const RAISE_LIMITS_ACTION = 'Contact your administrator to raise them.';
-/**
- * Banner copy built from the figures a 402 actually reported, or `undefined`
- * when the proxy sent none.
- *
- * `undefined` is the meaningful return, not a fallback: paired with the
- * slice's "a re-latch without a reason keeps the existing explanation" rule, it
- * makes a figureless driver latch leave a host-supplied reason intact rather
- * than blanking it back to the default at the exact moment the wall is hit.
- *
- * Exported for the unit test that pins the formatting; not part of the element
- * API.
- *
- * @internal
- */
-export function formatBlockedReason(
-// `Partial`, so the store's `VendorBudgetFigures` satisfies it as well as a live
-// 402's payload: the banner composes from stored figures and the latch from the
-// fresh ones, and both carry the same dollars. One formatter for both means a
-// remembered wall and a just-hit one cannot word themselves differently.
-budget, vendor) {
-    if (!budget || (budget.budgetUsd == null && budget.spentUsd == null))
-        return undefined;
-    const money = (v) => (v == null ? 'an unknown amount' : formatUsd(v));
-    const figures = `(${money(budget.spentUsd)} of ${money(budget.budgetUsd)})`;
-    // No "you have $0.00 left" clause here, deliberately: "limit is reached" already
-    // says the allowance is gone, and a remainder clamped at zero CONTRADICTS the
-    // figures beside it — spend overshoots the cap on the last allowed call, so the
-    // words would read "$0.00 left" next to numbers showing $12.34 past it.
-    // A per-vendor statement carries NO action clause, because the right action is
-    // not knowable at latch time: whether "switch vendor" or "contact your
-    // administrator" is the honest advice depends on whether any OTHER vendor still
-    // has headroom, which only the composing getter can see. The vendor-agnostic
-    // form keeps its historical trailing sentence — nothing composes onto it.
-    if (!vendor)
-        return `AI usage limit reached ${figures}. Contact your administrator to raise it.`;
-    return `${vendorDisplayName(vendor)}'s AI usage limit is reached ${figures}.`;
-}
-/**
- * Human-readable name for a vendor, falling back to its raw type.
- *
- * `'none'` needs no special case: it is the "no provider configured" sentinel,
- * it is filtered out of {@link FoundationAiAssistant.reachableVendors}, the latch
- * refuses to attribute a wall to it, and
- * {@link FoundationAiAssistant.setVendorBlocked} rejects it at the boundary — so
- * nothing can put it in front of this function. The `?? vendor` fallback is for a
- * vendor type added to `AIProviderType` without a label, which would print the
- * type rather than nothing.
- */
-function vendorDisplayName(vendor) {
-    var _a;
-    return (_a = VENDOR_LABELS[vendor]) !== null && _a !== void 0 ? _a : vendor;
-}
-/**
- * `a`, `a and b`, `a, b and c`.
- *
- * The general joiner is kept rather than hardcoded to a pair because the list
- * is `BUDGETED_VENDORS`-shaped, and that list is a cross-repo contract owned by
- * the proxy (today `anthropic` and `gemini`; `openai` is refused up front with
- * 400 UNSUPPORTED_PROVIDER and can never be walled) — a vendor added there must
- * not require an edit here. Its upper bound is not an assertion in a comment — it is
- * the key count of `VENDOR_LABELS`, since every element of every list passed here
- * comes from `blockedVendors` or `reachableVendors`, both of which hold
- * `AIProviderType` values, and the type has five members of which `'none'` is
- * excluded from both.
- */
-function formatVendorList(vendors) {
-    return joinList(vendors.map(vendorDisplayName));
-}
-/**
- * `"A"`, `"A and B"`, `"A, B and C"` — over already-rendered labels, so a caller
- * can annotate each name (the multi-vendor banner appends each vendor's figures)
- * without duplicating the joining rules.
+ * Budget formatting helpers, re-exported so they stay on this module's public
+ * surface (`src/index.ts` does `export * from './main/main'`). They live in
+ * `budget-controller.ts` with the code that composes them; moving them without
+ * this line would have quietly dropped two `@internal` exports from the package
+ * entry point, and broken the two test files that import them from here.
  */
-function joinList(names) {
-    var _a;
-    if (names.length <= 1)
-        return (_a = names[0]) !== null && _a !== void 0 ? _a : '';
-    return `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
-}
-/**
- * Whole-number percentage of a budget consumed, for the meter (GENC-1464).
- *
- * Deliberately unclamped — spend can genuinely overshoot the cap (the last
- * allowed call may cross it), and the meter's TEXT shows the truth; only the
- * bar clamps, at the render site. The one special case is a `$0` cap, which the
- * platform treats as "no spend allowed" (not "unlimited"): it has no headroom
- * by definition, so the meter reads full rather than dividing by zero.
- *
- * Exported for the unit test that pins the arithmetic; not element API.
- *
- * @internal
- */
-export function budgetPercentOf(figures) {
-    if (figures.budgetUsd <= 0)
-        return 100;
-    return Math.round((figures.spentUsd / figures.budgetUsd) * 100);
-}
+export { budgetPercentOf, formatBlockedReason } from './budget-controller';
 // Register supporting components when the main component module is imported.
 avoidTreeShaking(AiChatMarkdown, AiChatInteractionWrapper, AiHaloOverlay, AiWavesIndicator, AiFlowingWavesIndicator, AiPlasmaOrbIndicator, AiChatBubble, AiActivityHalo, ChatSuggestions, AgentPicker);
 /**
@@ -328,7 +151,111 @@ avoidTreeShaking(AiChatMarkdown, AiChatInteractionWrapper, AiHaloOverlay, AiWave
  */
 let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistant extends GenesisElement {
     constructor() {
+        // ─── Controllers ────────────────────────────────────────────────────────────
+        //
+        // DECLARED FIRST, and that is load-bearing. FAST fires a `<field>Changed` hook from
+        // the field's own initializer, so `@observable chatConfig = {}` below runs
+        // `chatConfigChanged` — which reaches two of these — while the class body is still
+        // initializing. A controller declared after the observable it serves is `undefined`
+        // at that moment, and the hook throws inside `document.createElement`, before any
+        // test or host code can catch it. Field initializers run in declaration order, so
+        // putting them here is the fix; keep new controllers in this block.
+        // ─── Composer controllers ───────────────────────────────────────────────────
+        // Three separable concerns that share only the `.composer` DOM region: the
+        // drag-to-resize geometry, the two anchored menus, and file attachments. Each
+        // receives callbacks rather than this element, so none of them can reach back
+        // into element API — and none of them touches the driver.
         super(...arguments);
+        this.composerResize = new ComposerResizeController({
+            enabled: () => { var _a; return ((_a = this.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.resizableInput) !== false; },
+            inputEl: () => this.chatInputEl,
+            messagesEl: () => this.messagesEl,
+        });
+        this.composerMenus = new ComposerMenuController(this, {
+            agentPickerOpen: this.accessor('agentPickerOpen'),
+            sessionMenuOpen: this.accessor('sessionMenuOpen'),
+            focusInput: () => { var _a; return (_a = this.chatInputEl) === null || _a === void 0 ? void 0 : _a.focus(); },
+            resetSessionConfirmations: () => {
+                this.confirmingClear = false;
+                this.confirmingCompact = false;
+            },
+            logMeta: (type, detail) => this.logMeta(type, detail),
+        });
+        this.attachmentCtrl = new AttachmentController(this, {
+            acceptedFiles: () => { var _a; return (_a = this.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.acceptedFiles; },
+            logMeta: (type, detail) => this.logMeta(type, detail),
+        });
+        /**
+         * Pure derivation — owns no state. Reaches the driver only through the two
+         * callbacks below, so it stays clear of the stateful-agent surface (§11.2
+         * constraint 2) and of redux entirely.
+         */
+        this.contextGateCtrl = new ContextGateController({
+            chatConfig: () => this.chatConfig,
+            messages: () => this.messages,
+            contextTokens: () => this.contextTokens,
+            contextLimit: () => this.contextLimit,
+            gateContextTokens: () => this._gateContextTokens,
+            contextReserve: () => this.contextReserve,
+            preambleTokens: () => { var _a, _b; return (_b = (_a = this.driver) === null || _a === void 0 ? void 0 : _a.getPreambleTokens) === null || _b === void 0 ? void 0 : _b.call(_a); },
+            compactionPlanFor: (options) => { var _a, _b, _c; return (_c = (_b = (_a = this.driver) === null || _a === void 0 ? void 0 : _a.getCompactionPlan) === null || _b === void 0 ? void 0 : _b.call(_a, options)) !== null && _c !== void 0 ? _c : null; },
+            bannerVisible: () => this.bannerVisible,
+            effectiveBlockedReason: () => this.effectiveBlockedReason,
+            flowOwnerAgentName: () => this.flowOwnerAgentName,
+        });
+        /**
+         * Cost accounting and the persisted build-history ledger (GENC-1475). Reads the live
+         * session through callbacks and owns the rows, the load/write latches and the debounce
+         * timer — the element keeps only the names the settings modal binds.
+         */
+        this.costLedger = new CostLedgerController({
+            chatConfig: () => this.chatConfig,
+            messages: () => this.messages,
+            sessionUsage: () => this.sessionUsage,
+            providerStatuses: () => this.providerStatuses,
+            persistenceActive: () => this.persistenceActive,
+            stateKey: () => this.getStateKey(),
+            headerTitle: () => this.headerTitle,
+            provider: () => this.persistence.provider,
+            elementId: () => this.id,
+        });
+        /**
+         * The AI-spend budget: vendor walls, the derived composer lock, the banner copy
+         * and the settings meter (GENC-1464).
+         *
+         * Takes the session store itself rather than a callback per field — see
+         * `BudgetDeps` for why this one differs from its siblings.
+         */
+        this.budget = new BudgetController({
+            sessionRef: () => this._sessionRef,
+            providerStatuses: () => this.providerStatuses,
+            providerRegistry: () => this.providerRegistry,
+            chatConfig: () => this.chatConfig,
+        });
+        /**
+         * The settings modal (`docs/code-health.md` §3). Reaches the two design-system
+         * refs through callbacks, because the template writes them by name — see
+         * `SettingsModalDeps`.
+         */
+        this.settings = new SettingsModalController({
+            chatConfig: () => this.chatConfig,
+            contextTokens: () => this.contextTokens,
+            contextLimit: () => this.contextLimit,
+            budgetUsageVisible: () => this.budget.settingsUsageVisible,
+            costConfig: () => this.costLedger.config,
+            costHistoryLength: () => this.costLedger.history.length,
+            liveCostSessionTitle: () => this.costLedger.liveTitle,
+            providerStatusCount: () => this.providerStatuses.length,
+            sessionRef: () => this._sessionRef,
+            stateKey: () => this.getStateKey(),
+            popoutMode: () => this.popoutMode,
+            headerTitle: () => this.headerTitle,
+            appSettingsProvider: () => this.appSettingsProvider,
+            modal: () => this.settingsModal,
+            tabsEl: () => this.settingsTabsEl,
+            requestBudgetRefresh: () => this.requestBudgetRefresh(),
+            logMeta: (type, detail) => this.logMeta(type, detail),
+        });
         this.designSystemPrefix = 'rapid';
         this.headerTitle = 'Genesis Assistant';
         /** Sanitized `assistantIcon`, or the default sparkle mark; bound into the template. @internal */
@@ -348,34 +275,10 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         this.persistence = {};
         /** When set, enables Redux DevTools for this instance's session store. */
         this.debugRedux = false;
-        /**
-         * One warning per element for garbage fed to
-         * {@link FoundationAiAssistant.setVendorBudget}. Once, not per call, because
-         * the documented feed re-runs after every turn — a host bug would otherwise
-         * repeat the same warning on every send for the life of the page.
-         */
-        this.vendorBudgetWarningIssued = false;
-        /**
-         * When budget figures last arrived — from the host's {@link FoundationAiAssistant.setVendorBudget}
-         * or the wall latch's own feed — as epoch ms; `null` until the first feed.
-         *
-         * ELEMENT state, not slice state, on purpose: the reducer is idempotent by
-         * value (an unchanged re-feed must not re-render the meter rows), but "when
-         * was this fetched" must move on every feed, changed figures or not — a
-         * refresh that confirms the same dollars is still a refresh. Only the
-         * toolbar label observes this, so a stamp re-renders one span, not the rows.
-         */
-        this.budgetMeterLastFedAt = null;
         // ---- Transient UI state (stays as @observable on the component) ----
         this._suggestionsGeneration = 0;
-        this.attachments = [];
-        this.attachmentErrors = [];
         /** Whether the loading spinner is currently visible. Controlled by the loading delay timer. */
         this.showLoadingIndicator = false;
-        /** Bump to re-render app settings toggles when the host provider notifies a change. */
-        this.appSettingsRevision = 0;
-        /** Whether the settings modal is open. */
-        this.settingsOpen = false;
         /**
          * True while `downloadDebugLog` is building the log (GENC-1351 §5.8). Drives the
          * download button's disabled + spinner state — the lifetime-stitch path is async
@@ -384,8 +287,6 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
          * element has its own settings modal.
          */
         this.downloadingDebugLog = false;
-        /** Active tab inside the settings modal. */
-        this.settingsModalTab = 'settings';
         /**
          * GENC-1511 — persistence has failed repeatedly and it is no longer saving. Drives a BLOCKING
          * modal with a single Reload action: the whole failure class this ticket exists for is one the
@@ -419,33 +320,8 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         this.brokenSources = new Map();
         /** Swallows the native dialog's Escape route. Stored, not inline, so it can be removed again. */
         this.onPersistenceModalCancel = (e) => e.preventDefault();
-        /** Light-DOM nodes assigned to settings modal slots (via `slotted()` bindings). */
-        this.settingsModelSlotted = [];
-        this.settingsAppSlotted = [];
-        this.settingsCostCurrentSlotted = [];
-        this.settingsCostHistorySlotted = [];
-        /** Persisted finalized cost sessions shown on the Usage tab build history list. */
-        this.costSessionHistory = [];
         /** Whether the splash overlay is currently showing (no messages and showSplash is enabled). Reflected as a boolean attribute on the host. */
         this.showingSplash = false;
-        /** Title tracked for the in-flight cost session (used when `header-title` changes). */
-        this._activeCostSessionTitle = '';
-        // NOTE: the pre-transcript ("banked") spend is deliberately NOT held here. It is keyed by
-        // session in `banked-usage-baselines` so the many element instances a single session sees —
-        // layout re-renders, popout, docking — share one baseline. See `bankedUsageFor`.
-        /**
-         * Whether the row list reflects storage yet. Gates cost writes so a project's banked
-         * spend is never derived from a ledger that simply hasn't arrived.
-         */
-        this._costHistoryLoaded = false;
-        /**
-         * Set when a provider read failed. Latches writes off for this page-load: `saveCostHistory`
-         * replaces the whole stored list, so writing anything derived from the empty list we fell back
-         * to would destroy rows we never managed to read.
-         */
-        this._ledgerUnreadable = false;
-        /** Pending (adopted but unwritten) ledger changes — see `persistCostHistory`. */
-        this._ledgerDirty = false;
         // No once-guard for cost-session writes: the write is an upsert keyed by the session
         // key, so repeat calls (pagehide, title change, per-turn) replace the same row and are
         // idempotent. The old flag existed only because the write appended and reset.
@@ -453,26 +329,11 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         // the cost session on tab close — there is no hidden twin to defer to, so this fires
         // unconditionally (the old bubble-vs-docked gating flag is gone with the two-view model).
         this._handlePageHide = () => {
-            this.finalizeCostSession();
+            this.costLedger.finalize();
             // Straight to storage: the debounce timer will never fire once the page is going away.
-            this.flushCostHistory();
+            this.costLedger.flush();
         };
         this.haloStartPublished = false;
-        /**
-         * Explicit composer height (px) once the user has dragged the resize handle;
-         * `null` keeps the default auto-grow behaviour. Written into the
-         * `--composer-height` custom property via the `composerHeightStyle` getter.
-         */
-        this.composerHeightPx = null;
-        /** Pointer Y and composer height captured at the start of a resize drag. */
-        this._resizeStartY = 0;
-        this._resizeStartHeight = 0;
-        /** The composer's natural (un-resized) height, measured on first drag — used
-         * as the lower bound so the box can't be dragged smaller than it started. */
-        this._composerNaturalHeight = 0;
-        /** Upper bound for the current drag — capped to the headroom above so growing
-         * the composer never pushes the input row's buttons off the bottom. */
-        this._resizeMaxHeight = COMPOSER_MAX_HEIGHT_PX;
         /**
          * True when the user's last interaction (pointer or keyboard focus) was inside
          * the assistant. Defaults to true so the assistant claims focus on first mount.
@@ -536,16 +397,10 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         // one session (bubble + popped-out panel) and must share cursors, or they'd
         // double-append the stream.
         this.showHalo = 'no';
-        this._agentPickerToggle = new AnimatedPanelToggle(this, '.agent-picker-panel', AGENT_PICKER_CLOSE_MS, () => this.agentPickerOpen, (v) => {
-            this.agentPickerOpen = v;
-        });
         // ── Session lifecycle menu (GENC-1351 §5.5) ─────────────────────────────────
         /** Two-step confirm for the destructive Clear action; reset whenever the menu toggles. */
         this.confirmingClear = false;
         this.confirmingCompact = false;
-        this._sessionMenuToggle = new AnimatedPanelToggle(this, '.session-menu-panel', SESSION_MENU_CLOSE_MS, () => this.sessionMenuOpen, (v) => {
-            this.sessionMenuOpen = v;
-        });
     }
     assistantIconChanged() {
         this.assistantIconSafe = this.assistantIcon
@@ -838,7 +693,13 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
     set agentPickerOpen(value) {
         var _a;
         (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setAgentPickerOpen(value);
-        this.syncComposerMenuDismissal();
+        // The sync belongs HERE, not in the controller, because this setter is the
+        // bottom of every write path: the controller drives the flag through an
+        // `Accessor` over this property, so its writes land here too — and so does a
+        // host's `el.agentPickerOpen = true`. Syncing in the controller instead left a
+        // host write opening the panel with no outside-click dismissal, no Escape and
+        // no reposition-on-resize (PR #2503 review).
+        this.composerMenus.syncDismissal();
     }
     /**
      * Whether the lifecycle (session) menu slide-out panel is open. Like the
@@ -851,7 +712,8 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
     set sessionMenuOpen(value) {
         var _a;
         (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setSessionMenuOpen(value);
-        this.syncComposerMenuDismissal();
+        // See `agentPickerOpen`'s setter — same invariant, same reason.
+        this.composerMenus.syncDismissal();
     }
     /**
      * Whether a manual compaction is in flight (GENC-1351 §5.7). On the session
@@ -922,77 +784,23 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * @beta
      */
     get blocked() {
-        var _a;
-        const session = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant;
-        if (!session)
-            return false;
-        if (session.blocked)
-            return true;
-        // Byte-identical to the old stored read for every host that never adopts the
-        // per-vendor API — which is what makes this derivation non-breaking.
-        if (session.blockedVendors.length === 0)
-            return false;
-        // Unknown reachability (statuses not loaded yet, or providers that report no
-        // status) fails SAFE — any wall blocks everything, exactly today's semantics —
-        // and needs no clause of its own: `every` on the empty set is vacuously true.
-        return this.reachableVendors.every((v) => session.blockedVendors.includes(v));
+        return this.budget.blocked;
     }
     set blocked(value) {
-        var _a;
-        (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setBlocked({ blocked: value });
+        this.budget.blocked = value;
     }
     /**
      * The distinct vendors the registry can currently reach, from the provider
      * statuses this element already loads on connect and refreshes on every
-     * observable-registry change.
-     *
-     * This is the element's answer to "which vendor would the next turn use" — a
-     * question that has **no** correct answer and deliberately gets no API. The
-     * provider is resolved per turn AND per agent: `activeProviderInput` may be an
-     * async function of the turn's context, an orchestrated turn picks its agent
-     * with an LLM `classify()` call, and sub-agents resolve their own providers.
-     * Any pre-turn "peek" would therefore be a guess that is wrong precisely on the
-     * multi-agent hosts per-vendor budgets exist for.
-     *
-     * Asking instead which vendors are REACHABLE is answerable, synchronous, and
-     * free — and it is enough: the composer must stay live while any reachable
-     * vendor has headroom, and must lock when none does. It also makes vendor-switch
-     * recovery a derivation rather than a mutation: a host that swaps its registry
-     * to another vendor fires the observable, the statuses reload, the walled vendor
-     * drops out of this set, and `blocked` goes false with every latch left intact.
+     * observable-registry change — this element's answer to "which vendor would the
+     * next turn use", a question that has no correct answer and deliberately gets
+     * no API. See `BudgetController.reachableVendors` for why reachability is
+     * the answerable question and what deriving from it buys.
      *
      * @beta
      */
     get reachableVendors() {
-        var _a, _b;
-        const seen = new Set();
-        for (const entry of this.providerStatuses) {
-            const provider = (_a = entry.status) === null || _a === void 0 ? void 0 : _a.provider;
-            if (!provider || provider === 'none')
-                continue;
-            // Reachable means "can serve the next turn", and `chat()` is OPTIONAL on
-            // `AIProvider` — the shipped `ChromeProvider` and `OpenAIProvider`
-            // implement `getStatus()` only. Counting a chat-less provider here made
-            // every consumer wrong at once: it was headroom for the `blocked`
-            // derivation (so `otherVendorAvailable: false` failed to lock the
-            // composer and each send burned another doomed 402), and it was a switch
-            // target for the banner ("Switch to Chrome to keep going" toward a
-            // provider that cannot chat).
-            //
-            // The gate is CAPABILITY, not vendor identity, so a host's custom
-            // chat-capable OpenAI provider still counts — the same distinction
-            // `validate-providers.ts` already enforces by throwing. And it drops a
-            // vendor only on positive evidence: statuses normally come from
-            // `providerRegistry.listStatuses()`, whose `name` always resolves, but a
-            // host (or test) that assigns `providerStatuses` directly may have no
-            // matching registry entry, and an unresolvable name must not silently
-            // erase a vendor the status layer vouched for.
-            const registered = (_b = this.providerRegistry) === null || _b === void 0 ? void 0 : _b.get(entry.name);
-            if (registered && typeof registered.chat !== 'function')
-                continue;
-            seen.add(provider);
-        }
-        return [...seen];
+        return this.budget.reachableVendors;
     }
     /**
      * Vendors currently walled by the AI-spend budget, in the order they were
@@ -1000,13 +808,11 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      *
      * May include a vendor this registry cannot reach — either because the registry
      * moved on after the wall was latched, or because a 402's
-     * `otherVendorAvailable: false` walls every vendor the proxy meters (which is
-     * what that verdict is a statement about; see
-     * {@link FoundationAiAssistant.latchBlockedFrom}). Neither costs anything
-     * internally — {@link FoundationAiAssistant.blocked} asks only about the
-     * reachable set, and the banner reads the reachability-filtered
-     * {@link FoundationAiAssistant.relevantBlockedVendors} — but a host rendering
-     * this list itself should filter it against its own registry.
+     * `otherVendorAvailable: false` walls every vendor the proxy meters. Neither
+     * costs anything internally — {@link FoundationAiAssistant.blocked} asks only
+     * about the reachable set, and the banner reads the reachability-filtered
+     * `BudgetController.relevantBlockedVendors` — but a host rendering this
+     * list itself should filter it against its own registry.
      *
      * Read-only on purpose: a settable array would let a host write a partial list
      * and silently orphan the per-vendor banner copy.
@@ -1015,8 +821,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * @beta
      */
     get blockedVendors() {
-        var _a, _b;
-        return (_b = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.blockedVendors) !== null && _b !== void 0 ? _b : [];
+        return this.budget.blockedVendors;
     }
     /**
      * Whether this specific vendor's budget is walled — regardless of whether any
@@ -1025,7 +830,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * @beta
      */
     isVendorBlocked(vendor) {
-        return this.blockedVendors.includes(vendor);
+        return this.budget.isVendorBlocked(vendor);
     }
     /**
      * Wall (or release) one vendor's budget, optionally with banner copy for it.
@@ -1037,35 +842,21 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * become true.
      *
      * `reason` is composed into the banner sentence for that vendor, **however many
-     * vendors are walled** — see {@link FoundationAiAssistant.effectiveBlockedReason}.
-     * It is per-vendor copy, not a whole-banner override; {@link FoundationAiAssistant.blockedReason}
-     * is the override. Omitting it keeps whatever explanation that vendor already
-     * carried, so a driver latch landing after a host one cannot blank it.
+     * vendors are walled** — see `BudgetController.effectiveBlockedReason`.
+     * It is per-vendor copy, not a whole-banner override;
+     * {@link FoundationAiAssistant.blockedReason} is the override. Omitting it keeps
+     * whatever explanation that vendor already carried, so a driver latch landing
+     * after a host one cannot blank it.
      *
-     * `'none'` is rejected with a warning rather than accepted: it is the "no
-     * provider configured" sentinel, not a vendor. Latching it would put the raw
-     * sentinel in the banner ("none's AI usage limit is reached") and could never
-     * be undone by derivation, because `'none'` never appears in
-     * {@link FoundationAiAssistant.reachableVendors} — so `blocked` could never
-     * become derivable from it either. Use {@link FoundationAiAssistant.setBlocked}
-     * for a vendor-agnostic block.
+     * `'none'` is rejected with a warning rather than accepted — it is the "no
+     * provider configured" sentinel, not a vendor, and a wall on it could never be
+     * undone by derivation. Use {@link FoundationAiAssistant.setBlocked} for a
+     * vendor-agnostic block.
      *
      * @beta
      */
     setVendorBlocked(vendor, blocked, reason) {
-        var _a;
-        if (vendor === 'none') {
-            logger.warn("FoundationAiAssistant.setVendorBlocked: 'none' is the no-provider sentinel, not a vendor — " +
-                'ignoring. Use setBlocked() for a vendor-agnostic block.');
-            return;
-        }
-        (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setVendorBlocked({ vendor, blocked, reason });
-    }
-    warnVendorBudgetOnce(message) {
-        if (this.vendorBudgetWarningIssued)
-            return;
-        this.vendorBudgetWarningIssued = true;
-        logger.warn(`FoundationAiAssistant.setVendorBudget: ${message}`);
+        this.budget.setVendorBlocked(vendor, blocked, reason);
     }
     /**
      * Feed (or clear) one vendor's AI-spend figures for the settings-modal budget
@@ -1125,45 +916,28 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * @beta
      */
     setVendorBudget(vendor, figures) {
-        if (!BUDGETED_VENDORS.includes(vendor)) {
-            this.warnVendorBudgetOnce(`'${vendor}' is not a budgeted vendor — ignoring. Only the proxy-metered vendors ` +
-                `(${BUDGETED_VENDORS.join(', ')}) can carry budget figures.`);
-            return false;
-        }
-        // Nullish, not `!== null`: an untyped host's missing lookup arrives as
-        // `undefined`, and dereferencing it here would throw at a boundary whose
-        // whole contract is to return false instead. `undefined` clears, like null.
-        if (figures != null) {
-            const validUsd = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
-            if (!validUsd(figures.budgetUsd) || !validUsd(figures.spentUsd)) {
-                this.warnVendorBudgetOnce(`invalid figures for '${vendor}' — ignoring. budgetUsd and spentUsd must both be ` +
-                    `finite numbers >= 0 (got budgetUsd: ${figures.budgetUsd}, spentUsd: ${figures.spentUsd}).`);
-                return false;
-            }
-        }
-        const session = this._sessionRef;
-        // No store yet (fed before the first append, or mid pop-out remount): there
-        // is nowhere to write, so say so rather than returning an accepted the
-        // caller would never retry. Not warned — this is a lifecycle window, not
-        // bad input, and the documented per-turn re-feed lands the figures as soon
-        // as the store exists.
-        if (!session)
-            return false;
-        session.actions.aiAssistant.setVendorBudget({
-            vendor: vendor,
-            // A fresh literal, never the caller's object — see the reducer, which
-            // must not adopt (and potentially freeze) state the host still owns.
-            figures: figures == null ? null : { budgetUsd: figures.budgetUsd, spentUsd: figures.spentUsd },
-        });
-        if (figures != null)
-            this.budgetMeterLastFedAt = Date.now();
-        return true;
+        return this.budget.setVendorBudget(vendor, figures);
+    }
+    /**
+     * When budget figures last arrived — from the host's
+     * {@link FoundationAiAssistant.setVendorBudget} or the wall latch's own feed —
+     * as epoch ms; `null` until the first feed.
+     *
+     * ELEMENT state, not slice state, on purpose: the reducer is idempotent by
+     * value (an unchanged re-feed must not re-render the meter rows), but "when
+     * was this fetched" must move on every feed, changed figures or not — a
+     * refresh that confirms the same dollars is still a refresh. Only the
+     * toolbar label observes this, so a stamp re-renders one span, not the rows.
+     */
+    get budgetMeterLastFedAt() {
+        return this.budget.meterLastFedAt;
+    }
+    set budgetMeterLastFedAt(value) {
+        this.budget.meterLastFedAt = value;
     }
     /** "Updated HH:MM:SS" for the meter toolbar, or `undefined` before any feed. */
     get settingsBudgetUpdatedLabel() {
-        if (this.budgetMeterLastFedAt == null)
-            return undefined;
-        return `Updated ${new Date(this.budgetMeterLastFedAt).toLocaleTimeString()}`;
+        return this.budget.updatedLabel;
     }
     /**
      * Ask the host to re-fetch budget figures now (GENC-1464 refresh affordance).
@@ -1185,113 +959,27 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         // gc-assistant's), and a delegation-based host must still see the request.
         this.dispatchEvent(new CustomEvent('budget-refresh-requested', { bubbles: true, composed: true }));
     }
-    /** Whether this vendor's wall came from the sweep alone — see the slice's `sweptVendors`. */
-    isVendorSwept(vendor) {
-        var _a, _b;
-        return ((_b = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.sweptVendors) !== null && _b !== void 0 ? _b : []).includes(vendor);
-    }
-    /**
-     * The walled vendors the user can still be routed to — i.e.
-     * {@link FoundationAiAssistant.blockedVendors} narrowed to the reachable set,
-     * which is the only set the banner may name.
-     *
-     * A wall the registry can no longer reach is not news: it cannot be hit, and
-     * naming it puts a vendor in front of the user that is not theirs. The concrete
-     * failure this exists to stop: a host ships Anthropic-only, Anthropic walls, the
-     * host swaps its registry to Gemini, Gemini walls — and the banner reads "AI
-     * usage limits are reached for Anthropic and Gemini" to a user who has never
-     * had an Anthropic key. The spurious second name also flips the copy onto the
-     * plural branch, so even the closing sentence is wrong.
-     *
-     * When nothing is reachable YET (the statuses are still loading — the exact
-     * window the pre-flight and the cross-tab bus latch into), the fallback keeps
-     * every wall for LOCKING (`blocked` still derives true) but names only the
-     * vendors walled by a REFUSAL, dropping the ones the `otherVendorAvailable`
-     * sweep added. A refusal is a fact about a vendor this user just used; a sweep
-     * entry is the proxy's headroom verdict about a vendor the host may not even
-     * ship — naming it here reproduced the exact failure above from the other
-     * direction ("Gemini's AI usage limit is reached" to an Anthropic-only user),
-     * and flipped the copy onto the plural branch with it. Self-corrects when the
-     * statuses land: from then on reachability, not provenance, decides.
-     *
-     * @internal
-     */
-    get relevantBlockedVendors() {
-        var _a, _b;
-        const walled = this.blockedVendors;
-        const reachable = this.reachableVendors;
-        if (reachable.length === 0) {
-            const swept = (_b = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.sweptVendors) !== null && _b !== void 0 ? _b : [];
-            return walled.filter((v) => !swept.includes(v));
-        }
-        return walled.filter((v) => reachable.includes(v));
-    }
     /**
      * Whether the blocked banner has anything to say — a vendor-agnostic block, or
-     * a partial wall that the NEXT send would actually hit.
-     *
-     * Partial exhaustion is announced only while the ACTIVE vendor (the registry
-     * default the next send resolves to) is among the walled ones. A user who has
-     * switched to a vendor with headroom has already acted on the advice —
-     * keeping the banner up past that point nagged about a vendor they just left
-     * (GENC-1464 tester feedback), while switching BACK to the walled vendor
-     * brings the banner straight back. Two conservative fallbacks keep it
-     * fail-informative: while the statuses are still loading the active vendor is
-     * unknowable, so any reachable-and-walled vendor still announces; and a
-     * vendor-agnostic block announces always, exactly as before.
-     *
-     * Reads the reachability-filtered list for the same reason the copy does — a
-     * host that has swapped its registry away from the walled vendor has nothing
-     * left to announce, and would otherwise get a banner that falls through to the
-     * generic default copy over a perfectly usable composer.
+     * a partial wall that the NEXT send would actually hit. See
+     * `BudgetController.bannerVisible` for why partial exhaustion is
+     * announced only while the active vendor is among the walled ones.
      *
      * @internal
      */
     get bannerVisible() {
-        if (this.blocked)
-            return true;
-        const walled = this.relevantBlockedVendors;
-        if (walled.length === 0)
-            return false;
-        const active = this.activeVendor;
-        if (!active)
-            return true;
-        return walled.includes(active);
+        return this.budget.bannerVisible;
     }
     /**
-     * Whether a suggestions fetch would hit a wall.
-     *
-     * Unlike a chat turn, this one CAN be resolved exactly: both suggestion paths
-     * go to the registry **default** and never to a per-agent override
-     * (`ChatDriver.getSuggestions` calls `providerRegistry.default()`, and
-     * `OrchestratingDriver.getSuggestions` just delegates to it). So the vendor a
-     * suggestions call would use is knowable, and this is the one place in the
-     * feature where that is true.
-     *
-     * Same rationale as the guard it replaces: a doomed suggestions call burns a
-     * `suggestions.failed` meta event and parks a raw transport error in
-     * `suggestionsState` for hosts to find.
+     * Whether a suggestions fetch would hit a wall — the one place in this feature
+     * where the vendor a call would use is exactly knowable, because both
+     * suggestion paths go to the registry default. See
+     * `BudgetController.suggestionsBlocked`.
      *
      * @internal
      */
     get suggestionsBlocked() {
-        if (this.blocked)
-            return true;
-        const active = this.activeVendor;
-        return !!active && this.isVendorBlocked(active);
-    }
-    /**
-     * The vendor the NEXT send resolves to — the registry default's provider, as
-     * reported through `providerStatuses`. `undefined` while the statuses are
-     * still loading (or when the default reports the `'none'` sentinel), which
-     * every consumer treats conservatively.
-     *
-     * @internal
-     */
-    get activeVendor() {
-        var _a, _b;
-        const vendor = (_b = (_a = this.providerStatuses.find((e) => e.isDefault)) === null || _a === void 0 ? void 0 : _a.status) === null || _b === void 0 ? void 0 : _b.provider;
-        return vendor && vendor !== 'none' ? vendor : undefined;
+        return this.budget.suggestionsBlocked;
     }
     /**
      * Explanation shown in the blocked banner, or `null` for the element's default
@@ -1308,185 +996,10 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * @beta
      */
     get blockedReason() {
-        var _a, _b;
-        return (_b = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.blockedReason) !== null && _b !== void 0 ? _b : null;
+        return this.budget.blockedReason;
     }
     set blockedReason(value) {
-        var _a;
-        // Deliberately NOT `setBlocked({ blocked: this.blocked, reason })`: `blocked`
-        // is derived now, so re-latching with it would pass `false` for a partially
-        // walled session and clear every per-vendor latch as a side effect of setting
-        // a string.
-        (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setBlockedReason(value);
-    }
-    /**
-     * Latch the backend block off a turn outcome. The single decision point for
-     * both latch sites (the `tool-loop-end` bus subscription and `send()`'s
-     * return-value check), so the rule cannot diverge between them.
-     *
-     * Idempotent and one-way **per vendor**: it never unblocks, and it never
-     * re-writes an existing wall. That guard is load-bearing, not just an
-     * optimisation — the bus fires from the driver's `finally`, i.e. BEFORE
-     * `sendMessage()` resolves, so a host subscribed to `tool-loop-end` (what the
-     * migration guide's Option C recommends) sets its own detailed reason and the
-     * return-value latch would otherwise land a moment later and blank it.
-     *
-     * The guard being per-vendor rather than global is the whole difference. A
-     * single global "already blocked, do nothing" would swallow a second vendor's
-     * wall — so a session walled on Anthropic could never record that Gemini went
-     * too, and under a mixed registry an Anthropic-only wall would lock a composer
-     * that Gemini could still serve.
-     *
-     * **Which field is authoritative**, in order:
-     *
-     * 1. `budget.vendorLabel` — stamped by the transport that was actually refused,
-     *    so it can never be stale. But it is a static per-transport string, so a
-     *    white-labelled or multiplexing gateway fronting several upstreams leaves
-     *    it unclaimed by any vendor.
-     * 2. `budget.vendor` — which the driver resolved from the label where it could,
-     *    and otherwise from the proxy's own `vendor` field on the 402. It is
-     *    therefore NOT simply `vendorLabel` normalised, and the two can disagree;
-     *    that fallback is the only attribution on offer for the gateway case above.
-     * 3. `vendorHint` — the bus detail's top-level vendor, i.e. the driver's
-     *    last-resolved provider. Last resort because it CAN be stale: an
-     *    orchestrated turn classifies against the registry default, a provider the
-     *    chat driver may never have resolved, so its last-resolved provider there is
-     *    the previous turn's vendor or nothing at all.
-     *
-     * A wall that names no recognised vendor falls back to the vendor-agnostic
-     * block — fail-safe, and identical to the pre-per-vendor behaviour.
-     *
-     * **`otherVendorAvailable: false` is server-known truth and outranks every
-     * inference made here.** The proxy meters the pots, so only it can say whether
-     * anything else has headroom; this element can only observe which vendors the
-     * registry can REACH, which says nothing about their remaining spend. So when
-     * the proxy says no, every other *budgeted* vendor is walled in the same pass.
-     * That is what makes `blocked` derive true — locking the composer on the first
-     * response instead of after a second doomed turn — and what empties the "free"
-     * set the banner would otherwise have advised switching to.
-     *
-     * The sweep runs over `BUDGETED_VENDORS`, deliberately **not** over
-     * {@link FoundationAiAssistant.reachableVendors}. Reachability is loaded
-     * asynchronously (`activateSession` kicks off `loadProviderStatuses()` and does
-     * not await it), so a wall landing before the statuses resolve would have swept
-     * an empty set — silently discarding the one fact on the 402 the client cannot
-     * re-derive, with nothing to re-run it when the statuses arrived. Worse, it let
-     * the verdict effectively un-latch: the single wall derived `blocked` only
-     * while the reachable set was empty, so the moment the statuses landed the
-     * composer came back to life against a budget the proxy had already said was
-     * gone. Sweeping the metered vendor list instead makes the verdict independent
-     * of load order and of registry membership, which is exactly what it is: a
-     * statement about the proxy's pots, not about this user's registry.
-     *
-     * Walling a vendor the registry cannot reach costs nothing: `blocked` only asks
-     * whether every REACHABLE vendor is walled, and the banner reads
-     * {@link FoundationAiAssistant.relevantBlockedVendors}, which filters the walls
-     * back down to the reachable set before naming any of them.
-     *
-     * One boundary remains on the sweep: it walls only vendors the proxy meters,
-     * enforced structurally by iterating `BUDGETED_VENDORS` itself rather than
-     * filtering a wider set through a predicate. Chrome runs on-device with no pot
-     * to exhaust, so "no other vendor has budget" is not a statement about it, and
-     * "Switch to Chrome to keep going." stays honest advice.
-     *
-     * The sweep runs last but sits OUTSIDE the per-vendor idempotence guard, and
-     * both halves of that matter. Last, so the vendor that actually refused this
-     * turn heads the wall order the multi-vendor banner reads. Outside the guard,
-     * because the verdict can arrive on a LATER 402 for a vendor that is already
-     * walled — turn 1 walls Anthropic while Gemini still has headroom, turn 2 walls
-     * it again and reports that Gemini has since gone too — and an early return
-     * would drop exactly the news the second turn was there to deliver.
-     *
-     * @param reason - the turn's failure reason; anything but `'budget-exhausted'` is ignored.
-     * @param ref - session store to write through; defaults to the live one. `send()`
-     *   passes the ref it captured before its awaits, since a lifecycle event during the
-     *   turn may already have cleared `_sessionRef`.
-     * @param budget - what the 402 reported: figures when the proxy sent any, the
-     *   refusing vendor, and its `otherVendorAvailable` verdict.
-     * @param vendorHint - the `tool-loop-end` detail's top-level vendor, used only
-     *   when the budget payload names none.
-     *
-     * @internal
-     */
-    latchBlockedFrom(reason, ref = this._sessionRef, budget, vendorHint) {
-        var _a, _b;
-        if (reason !== 'budget-exhausted')
-            return;
-        const vendor = (_b = (_a = vendorTypeOfLabel(budget === null || budget === void 0 ? void 0 : budget.vendorLabel)) !== null && _a !== void 0 ? _a : budget === null || budget === void 0 ? void 0 : budget.vendor) !== null && _b !== void 0 ? _b : vendorHint;
-        // Meter feed (GENC-1464): snap this vendor's meter to the figures the 402
-        // itself reported, the moment the wall lands. Hosts refresh the meter on
-        // `tool-loop-end`, and a walled turn may never reach one — the user then
-        // stares at the pre-turn figures next to a banner saying the budget is gone
-        // until something else ends a loop (observed live: the meter only caught up
-        // when the user cancelled the stuck interaction). Deliberately NOT under the
-        // per-vendor idempotence guard below, for the same reason as the sweep: a
-        // later 402 for an already-walled vendor carries fresher spend. Both figures
-        // are required (`VendorBudgetFigures` is total, and half a meter is a lie),
-        // and the write goes through the captured `ref` like every other write here,
-        // so a teardown race cannot land it in a new session's store.
-        let metered = false;
-        if (vendor && vendor !== 'none' && (budget === null || budget === void 0 ? void 0 : budget.budgetUsd) != null && (budget === null || budget === void 0 ? void 0 : budget.spentUsd) != null) {
-            ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setVendorBudget({
-                vendor,
-                figures: { budgetUsd: budget.budgetUsd, spentUsd: budget.spentUsd },
-            });
-            this.budgetMeterLastFedAt = Date.now();
-            metered = true;
-        }
-        if (!vendor || vendor === 'none') {
-            if (!this.blocked) {
-                ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setBlocked({ blocked: true, reason: formatBlockedReason(budget) });
-            }
-        }
-        else if (!this.isVendorBlocked(vendor) || this.isVendorSwept(vendor)) {
-            // The idempotence guard protects a host-supplied reason from being
-            // overwritten by this latch's boilerplate — but a SWEPT wall cannot carry
-            // one (the sweep writes no reason, and any host call clears the swept
-            // mark), so upgrading it on a first-hand refusal clobbers nothing and
-            // gains the vendor its own figures plus a place in the early-window
-            // banner (see `relevantBlockedVendors`).
-            if (this.reachableVendors.length === 0) {
-                // Not fatal — `blocked` still derives to true, so the UI is correct — but
-                // the host gets no per-vendor benefit and would otherwise have no signal.
-                logger.warn(`FoundationAiAssistant: ${vendor} hit its AI budget, but no registered provider counts ` +
-                    'as reachable, so per-vendor blocking degrades to blocking everything. Two causes: no ' +
-                    'provider reports a status (implement AIProvider.getStatus()), or every provider that ' +
-                    'does is chat-less and so cannot serve a turn (implement chat() on at least one).');
-            }
-            ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setVendorBlocked({
-                vendor,
-                blocked: true,
-                // No reason when the meter snap above already stored these figures: the
-                // banner composes the same sentence from them, so carrying a copy here
-                // would duplicate the dollars in two places that can drift apart. It would
-                // also make this latch INDISTINGUISHABLE from host copy, which the banner
-                // must preserve verbatim — and preserving boilerplate is what forced it to
-                // repeat a sentence per walled vendor instead of folding them into one.
-                // The partial-figures case still needs copy carried here: it has no meter
-                // entry to compose from, and "an unknown amount of $50.00" is worth saying.
-                reason: metered ? undefined : formatBlockedReason(budget, vendor),
-            });
-        }
-        // Last, so the vendor that actually refused this turn heads the wall order the
-        // multi-vendor banner reads — and unconditionally, NOT under the per-vendor
-        // idempotence guard above, because the verdict can arrive on a later 402 for a
-        // vendor that is already walled.
-        if ((budget === null || budget === void 0 ? void 0 : budget.otherVendorAvailable) !== false)
-            return;
-        // Over the metered vendor list, NOT the reachable set: the statuses load
-        // asynchronously, so a reachability-scoped sweep dropped the verdict entirely
-        // when the wall beat them home. `relevantBlockedVendors` decides what the
-        // banner may NAME — reachability-filtered when the statuses are in, and
-        // refusals-only while they are not, which is what `swept: true` records.
-        for (const other of BUDGETED_VENDORS) {
-            if (other === vendor || this.isVendorBlocked(other))
-                continue;
-            // No reason: the slice's "an omitted reason keeps the existing explanation"
-            // rule applies, and there are no figures for this vendor — only the proxy's
-            // word that it has nothing left. `swept: true` records exactly that
-            // provenance, so the unknown-reachability banner can decline to name it.
-            ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setVendorBlocked({ vendor: other, blocked: true, swept: true });
-        }
+        this.budget.blockedReason = value;
     }
     /**
      * Block or unblock the assistant, optionally with custom banner copy.
@@ -1502,119 +1015,26 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * @beta
      */
     setBlocked(blocked, reason) {
-        var _a;
-        (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setBlocked({ blocked, reason });
+        this.budget.setBlocked(blocked, reason);
     }
     /**
-     * Copy shown in the blocked banner, in ascending specificity:
-     *
-     * 1. the host's `blockedReason` — a whole-banner override, unchanged;
-     * 2. copy composed from the walled vendors (their per-vendor reasons when set,
-     *    otherwise their names) plus the action that is actually available;
-     * 3. the default budget-exhaustion message.
-     *
-     * The action clause is computed here rather than stored, because whether
-     * "switch vendor" or "contact your administrator" is honest depends on whether
-     * another reachable vendor still has headroom — which changes when the registry
-     * changes, long after the wall was latched. Telling a user to switch to a
-     * vendor that is also exhausted is worse than saying nothing.
-     *
-     * The `free` set is a client-side inference — "reachable and not known to be
-     * walled" — and it is only ever allowed to be one. Where the proxy has told us
-     * otherwise (`otherVendorAvailable: false`) the latch has already walled those
-     * vendors, so they are not in `free` here and no "switch to X" clause can be
-     * composed from them. Both lists are filtered by reachability, so the copy
-     * names only vendors this user's registry can actually route to.
-     *
-     * **Per-vendor copy is composed however many vendors are walled**, which is
-     * what {@link FoundationAiAssistant.setVendorBlocked} and
-     * `docs/migration-GENC-1464.md` both promise. It previously reached only the
-     * single-vendor branch, so a host that had carefully set copy for each of its
-     * vendors watched all of it vanish the moment a second one walled — replaced by
-     * generic copy, at the exact moment the situation got worse.
-     *
-     * The compact list is the DEFAULT shape for several walls, now carrying each
-     * vendor's figures: "AI usage limits are reached for Gemini ($62.34 of $50.00)
-     * and Anthropic ($31.10 of $30.00)." A driver latch stores no copy of its own
-     * (it stores the figures, which this composes from), so that shape is what the
-     * real budget flow produces. As soon as any walled vendor carries HOST copy,
-     * which cannot be folded into a list item, the branch lists one statement per
-     * vendor instead — falling back to composed copy for the ones that have none, so
-     * the sentence set stays complete rather than silently naming a subset.
+     * Copy shown in the blocked banner — the host's override, else copy composed
+     * from the walled vendors, else the default. See
+     * `BudgetController.effectiveBlockedReason`, which explains why the
+     * action clause is composed on read rather than stored at latch time.
      *
      * @internal
      */
     get effectiveBlockedReason() {
-        var _a, _b;
-        if (this.blockedReason)
-            return this.blockedReason;
-        const walled = this.relevantBlockedVendors;
-        if (walled.length === 0)
-            return DEFAULT_BUDGET_EXHAUSTED_MESSAGE;
-        const free = this.reachableVendors.filter((v) => !walled.includes(v));
-        const action = free.length
-            ? `Switch to ${formatVendorList(free)} to keep going.`
-            : walled.length > 1
-                ? RAISE_LIMITS_ACTION
-                : RAISE_LIMIT_ACTION;
-        const reasons = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.blockedVendorReasons;
-        const budgets = (_b = this._sessionRef) === null || _b === void 0 ? void 0 : _b.store.aiAssistant.vendorBudgets;
-        // The wall's own figures, read from the entry the METER renders, so the two
-        // cannot state different dollars for the same vendor. A vendor with no entry
-        // (a swept wall — the proxy's word, no figures of its own) contributes a bare
-        // name rather than a gap where numbers should be.
-        const statementFor = (v) => {
-            var _a, _b;
-            return (_b = (_a = reasons === null || reasons === void 0 ? void 0 : reasons[v]) !== null && _a !== void 0 ? _a : formatBlockedReason(budgets === null || budgets === void 0 ? void 0 : budgets[v], v)) !== null && _b !== void 0 ? _b : `${vendorDisplayName(v)}'s AI usage limit is reached.`;
-        };
-        const nameWithFigures = (v) => {
-            const figures = budgets === null || budgets === void 0 ? void 0 : budgets[v];
-            return figures
-                ? `${vendorDisplayName(v)} (${formatUsd(figures.spentUsd)} of ${formatUsd(figures.budgetUsd)})`
-                : vendorDisplayName(v);
-        };
-        if (walled.length === 1)
-            return `${statementFor(walled[0])} ${action}`;
-        // Several walled vendors: fold them into ONE sentence carrying each vendor's
-        // figures, rather than repeating "X's AI usage limit is reached (…)." per
-        // vendor — the same clause twice reads like a stutter, and the second copy of
-        // the boilerplate adds nothing the first did not already say.
-        //
-        // Host copy is not foldable: `setVendorBlocked` promises it survives verbatim,
-        // and it cannot be rewritten into a list item. So the moment any walled vendor
-        // carries some, the branch below lists one statement per vendor instead —
-        // falling back to composed copy for the ones that have none, so the sentence
-        // set stays complete rather than silently naming a subset.
-        if (!walled.some((v) => reasons === null || reasons === void 0 ? void 0 : reasons[v])) {
-            return `AI usage limits are reached for ${joinList(walled.map(nameWithFigures))}. ${action}`;
-        }
-        return `${walled.map(statementFor).join(' ')} ${action}`;
+        return this.budget.effectiveBlockedReason;
     }
     /**
      * Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall,
-     * or `undefined` to let the driver compose it per wall.
-     *
-     * A set `blockedReason` still wins — a white-labelled host must not read its
-     * own explanation in the banner and shipped copy directly below it, and the
-     * vendor-agnostic latch's `formatBlockedReason(budget)` form stays advice-free
-     * exactly as before.
-     *
-     * `undefined` (the usual case) is NOT the old `DEFAULT_BUDGET_EXHAUSTED_MESSAGE`
-     * fallback: it hands composition to the driver, which builds the bubble from
-     * EACH wall's own 402 — naming the exhausted vendor and advising a switch only
-     * when that refusal's `otherVendorAvailable` positively vouched for headroom
-     * elsewhere. That is immune to the staleness this getter used to guard against
-     * by freezing the copy: construction-time advice could outlive its truth
-     * (`getOrCreateDriver` re-runs on an agents swap and would have baked the
-     * sentence into every later bubble), but per-wall advice is derived from the
-     * refusal it annotates and dies with the turn. Forcing the default here was
-     * also what made the driver's composed bubble unreachable in every real
-     * mount — the banner advised switching while the bubble under it never did
-     * (the GENC-1464 tester finding, root cause).
+     * or `undefined` to let the driver compose it per wall — see
+     * `BudgetController.transcriptMessage`.
      */
     get transcriptBudgetExhaustedMessage() {
-        var _a;
-        return (_a = this.blockedReason) !== null && _a !== void 0 ? _a : undefined;
+        return this.budget.transcriptMessage;
     }
     /**
      * Name of the agent the user has pinned via the agent picker. `null` means
@@ -1631,12 +1051,10 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         return (_b = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.pinnedAgentName) !== null && _b !== void 0 ? _b : null;
     }
     set pinnedAgentName(value) {
-        var _a, _b, _c;
+        var _a, _b, _c, _d;
         const previous = (_b = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.pinnedAgentName) !== null && _b !== void 0 ? _b : null;
         (_c = this._sessionRef) === null || _c === void 0 ? void 0 : _c.actions.aiAssistant.setPinnedAgentName(value);
-        if (this.driver instanceof OrchestratingDriver) {
-            this.driver.setPinnedAgent(value);
-        }
+        (_d = this.orchestrator) === null || _d === void 0 ? void 0 : _d.setPinnedAgent(value);
         // Suggestions are scoped to the active routing — resetting forces a fresh
         // fetch when the user pins/unpins so the prompts match the new agent.
         if (previous !== value) {
@@ -1659,11 +1077,9 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         return (_b = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.flowOwnerAgentName) !== null && _b !== void 0 ? _b : null;
     }
     set flowOwnerAgentName(value) {
-        var _a;
+        var _a, _b;
         (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setFlowOwnerAgentName(value);
-        if (this.driver instanceof OrchestratingDriver) {
-            this.driver.setFlowOwner(value);
-        }
+        (_b = this.orchestrator) === null || _b === void 0 ? void 0 : _b.setFlowOwner(value);
     }
     get liveSubAgentTrace() {
         var _a, _b;
@@ -1744,83 +1160,47 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         return this.sessionUsage.costUsd;
     }
     /**
-     * Distinct models the registry currently resolves to — the live session's model chips.
-     *
-     * `providerStatuses` carries one entry per registry SLOT, so a vendor configured across several
-     * tiers that happen to resolve to the same model reports it once per tier, and the chips
-     * rendered it once per tier too. Which tier a model came from is not what these chips are for.
+     * The cost ledger's derived surface (GENC-1475). Every member below delegates to
+     * `CostLedgerController` — the names are this element's public API and the
+     * settings modal's bindings, so they stay put while the accounting moves.
      *
-     * Deduped on the label actually displayed, not on `status.model`: a slot whose provider reports
-     * no model falls back to the slot's own name, and those are distinct per slot, so keying on the
-     * label keeps them from collapsing into one another.
+     * None carries `@volatile`: the decorators live on the controller's getters, and they
+     * reach the binding observer from there — see `docs/code-health.md` §11.4.
      */
     get uniqueProviderModels() {
-        var _a, _b, _c, _d;
-        const seen = new Map();
-        for (const entry of this.providerStatuses) {
-            const model = (_b = (_a = entry.status) === null || _a === void 0 ? void 0 : _a.model) !== null && _b !== void 0 ? _b : entry.name;
-            if (!model)
-                continue;
-            const existing = seen.get(model);
-            if (!existing) {
-                seen.set(model, { model, provider: (_c = entry.status) === null || _c === void 0 ? void 0 : _c.provider });
-                continue;
-            }
-            // Keep whichever tier knew the vendor, so the chip still gets its colour when one slot
-            // reports a provider and another does not.
-            if (existing.provider === undefined && ((_d = entry.status) === null || _d === void 0 ? void 0 : _d.provider) !== undefined) {
-                existing.provider = entry.status.provider;
-            }
-        }
-        return [...seen.values()];
+        return this.costLedger.uniqueProviderModels;
     }
-    /**
-     * Build history for display: most recently worked on first.
-     *
-     * The stored order is insertion order (see `upsertRecord`), which leaves a project returned to
-     * sitting wherever it was first seen — so ordering is applied here, on read, where it also
-     * covers rows a host provider supplied.
-     */
+    /** Build history for display: most recently worked on first. */
     get sortedCostSessionHistory() {
-        return sortRecordsByRecency(this.costSessionHistory);
+        return this.costLedger.sortedHistory;
     }
-    /**
-     * Lifetime usage across every project in the history scope — cost and all four token
-     * buckets. What the Usage tab's lifetime section renders.
-     *
-     * Rows ONLY — deliberately not rows + live session. Each row holds a project's lifetime
-     * usage and the active project's row is kept current on every transcript change, so
-     * adding the live total would count this project's spend twice. That double-count is what
-     * made the figure grow on every refresh: a page-hide banked a row while the restored
-     * session still carried the same spend.
-     */
+    /** Lifetime usage across every project in the history scope — rows only, never plus live. */
     get cumulativeUsage() {
-        void this.costSessionHistory;
-        void this.chatConfig;
-        // With history off there are no rows to sum, so the live session IS all we know.
-        if (!this.resolvedCostHistory.enabled)
-            return this.sessionUsage;
-        return this.costSessionHistory.reduce((total, record) => addUsage(total, record.usage), emptyUsage());
+        return this.costLedger.cumulativeUsage;
     }
     /** Lifetime USD across every project in the history scope. */
     get cumulativeCostUsd() {
-        return this.cumulativeUsage.costUsd;
+        return this.costLedger.cumulativeCostUsd;
     }
-    /**
-     * Whether the live session figures amount to this project's whole history, which is true
-     * exactly when the transcript is restored on load. Drives the Usage tab's live labels
-     * ("Project cost" vs "Session cost") so they state the scope rather than imply one.
-     *
-     * Note this is NOT what makes the *rows* lifetime — those bank their pre-transcript spend
-     * (see `CostSessionRecord.banked`) and are lifetime either way.
-     */
+    /** Whether the live session figures amount to this project's whole history. */
     get liveUsageIsProjectLifetime() {
-        return this.persistenceActive;
+        return this.costLedger.liveUsageIsProjectLifetime;
     }
     /** Resolved cost tab and build-history settings from `chatConfig.costHistory`. */
     get resolvedCostHistory() {
-        void this.chatConfig;
-        return resolveCostHistoryConfig(this.chatConfig);
+        return this.costLedger.config;
+    }
+    /**
+     * Persisted finalized cost sessions shown on the Usage tab build history list.
+     *
+     * A get/set pair rather than a read-only projection: the banking tests seed rows to
+     * model a page load that found some, and a host provider's rows arrive the same way.
+     */
+    get costSessionHistory() {
+        return this.costLedger.history;
+    }
+    set costSessionHistory(value) {
+        this.costLedger.history = value;
     }
     /**
      * Total tokens across every chat turn in this session — all four buckets added up.
@@ -1831,157 +1211,26 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
     }
     /** Label shown on the Usage tab for the in-flight session (app title or first user phrase). */
     get liveCostSessionTitle() {
-        var _a, _b;
-        void this.messages;
-        void this.chatConfig;
-        const appTitle = ((_a = this.resolvedCostHistory.title) === null || _a === void 0 ? void 0 : _a.trim()) || ((_b = this._activeCostSessionTitle) === null || _b === void 0 ? void 0 : _b.trim());
-        if (appTitle)
-            return appTitle;
-        return deriveCostSessionTitleFromMessages(this.messages);
+        return this.costLedger.liveTitle;
     }
     /**
-     * Write this session's usage into persisted build history (`localStorage`) as a single
-     * row keyed by the session key, replacing any existing row for that key.
-     *
-     * **Idempotent** — safe to call per turn, on tab close, and on a title change alike.
-     * The name is historical: it does NOT end the session or reset the running totals.
-     * Resetting them is what used to double-count spend, since the row was banked while the
-     * persisted transcript still carried the same usage, so a reload restored it and the
-     * Usage tab counted both.
+     * Write this session's usage into persisted build history as a single row keyed by the
+     * session key, replacing any existing row for that key.
      *
-     * No-op unless `chatConfig.costHistory.enabled` is `true`, when the live session has no
-     * usage yet, or when the session has no key to upsert against. Gating on the *live*
-     * figures (not the banked total) means a reload that restores nothing rewrites nothing.
+     * **Idempotent** — safe to call per turn, on tab close, and on a title change alike. The
+     * name is historical: it does NOT end the session or reset the running totals. See
+     * `CostLedgerController.finalize` for the full contract and the no-op cases.
      */
     finalizeCostSession(options) {
-        if (!this.resolvedCostHistory.enabled)
-            return;
-        // Wait for the rows before writing: a provider read is async, and banking from a
-        // not-yet-loaded ledger would read as "nothing came before" and rewrite this project's
-        // row down to the current transcript. Skipping is free — this is called on every
-        // transcript change, so the next one writes.
-        if (!this._costHistoryLoaded)
-            return;
-        const live = this.sessionUsage;
-        const tokensConsumed = totalTokens(live);
-        if (live.costUsd <= 0 && tokensConsumed <= 0)
-            return;
-        // The session key identifies the work — a project id, for hosts that key sessions
-        // per project. Without one there is nothing stable to upsert against, so skip
-        // rather than write a row that can never be matched again.
-        const projectKey = this.getStateKey();
-        if (!projectKey)
-            return;
-        const title = resolveCostSessionTitle({
-            explicit: options === null || options === void 0 ? void 0 : options.title,
-            appTitle: this.resolvedCostHistory.title,
-            messages: this.messages,
-            headerTitle: this.headerTitle,
-        });
-        // Lifetime = what came before this transcript + what this transcript proves. Both
-        // terms are derived from state, never incremented, so the two element instances that
-        // share a session write the same row rather than each adding their own contribution.
-        const banked = this.bankedUsageFor(projectKey);
-        const record = {
-            // Stable per project so repeat upserts replace the row instead of stacking, and
-            // so the delete action keeps targeting the same row across reloads.
-            id: projectKey,
-            projectKey,
-            title,
-            updatedAt: new Date().toISOString(),
-            usage: addUsage(banked, live),
-            banked,
-            models: collectSessionModels(this.messages, this.providerStatuses),
-        };
-        this.persistCostHistory(upsertRecord(this.costSessionHistory, record));
-        // NOTE: the live counters are deliberately NOT reset here. Resetting was what
-        // double-counted spend — the row was banked while the persisted transcript still
-        // carried the same usage, so a reload restored it and the Usage tab added both.
-        // The row is a projection of the session totals, not a transfer out of them.
-    }
-    /**
-     * Spend for `projectKey` that predates the current transcript, resolved once per SESSION and
-     * shared by every element instance wired to it (see `banked-usage-baselines`), so it cannot
-     * drift as the row it came from is rewritten by our own upserts.
-     *
-     * The two cases turn on whether the transcript is authoritative for this project:
-     *
-     * - **Transcript restored** (`persistenceActive`): it already accounts for everything after
-     *   the previous row's own banked figure, so carry that figure forward unchanged. Re-banking
-     *   `usage` here would add the restored history to itself on every reload.
-     * - **Transcript starts empty**: nothing on screen accounts for the previous total, so the
-     *   whole of it becomes banked. Without this the next turn would rewrite the row downwards
-     *   to just that turn, losing the project's earlier spend.
-     *
-     * The baseline is deliberately NOT element state. This element is remounted repeatedly inside
-     * a single session (the host re-rendering its layout, popping out, docking) and a fresh
-     * instance re-deriving would take the second branch against rows that already hold the live
-     * transcript — banking the session as its own baseline. Keying on the session instead means a
-     * remount inherits the baseline that transcript was paired with.
-     */
-    bankedUsageFor(projectKey) {
-        const resolved = getBankedBaseline(projectKey);
-        if (resolved)
-            return resolved;
-        const existing = this.costSessionHistory.find((r) => r.projectKey === projectKey);
-        // `persistenceActive` is what decides whether the transcript speaks for the project's
-        // history: it is on only when a provider is wired AND the user is remembering the chat.
-        const banked = resolveBankedUsage(existing, this.persistenceActive);
-        setBankedBaseline(projectKey, banked);
-        return banked;
+        this.costLedger.finalize(options);
     }
     /**
-     * Re-baseline this session against an emptied transcript: what came before, plus what the
-     * transcript being discarded proved. `discarded` must be read BEFORE the live figures are
-     * reset, since that is the only record of the latter.
-     *
-     * Not the same as dropping the baseline. Dropping it re-derives through `persistenceActive`,
-     * and with persistence ON that carries the row's *old* banked figure forward — discarding
-     * every turn between the last baseline and the clear. The transcript is gone either way, so
-     * the branch that reads it as authoritative no longer applies.
-     *
-     * Derived from the memoised baseline and the live figure rather than from the project's row,
-     * because a row is only as current as the last `finalizeCostSession` — which skips its write
-     * while the ledger is unloaded, and while the session has no usage yet.
+     * Re-baseline this session against an emptied transcript — see
+     * `CostLedgerController.rebaselineOnClearedTranscript`. `discarded` must be read
+     * BEFORE the live figures are reset, since that is the only record of the latter.
      */
     rebaselineOnClearedTranscript(key, discarded) {
-        // Already resolved for this session? Then the new baseline is fully determined without
-        // consulting the ledger at all — `bankedUsageFor` would short-circuit on this same value — so
-        // answer before the guard below, which would otherwise discard a figure that is both correct
-        // and independent of the rows. Losing it costs real spend: with a row at `usage: 120,
-        // banked: 90` and 30 on screen, a clear during a reload would drop the memoised 90, and the
-        // next turn would re-derive `row.banked` and rewrite the row BACKWARDS from 120 to 95.
-        const resolved = getBankedBaseline(key);
-        if (resolved) {
-            setBankedBaseline(key, addUsage(resolved, discarded));
-            return;
-        }
-        // Nothing memoised, so a baseline can only come from the rows — and a stamped one is STICKY
-        // (`bankedUsageFor` short-circuits on any stored entry, and a zero usage is a *resolved* value
-        // there, not "unresolved"). So unless the rows are genuinely known, do not guess:
-        //
-        //  - `enabled` false: `reloadCostSessionHistory` sets `_costHistoryLoaded` TRUE over a
-        //    deliberately empty list, meaning "nothing will be loaded" rather than "rows are known".
-        //    The flag alone therefore is not enough. Reachable because `enabled` is
-        //    `cost?.enabled === true` — false for an unbound `chatConfig`, and for any host resolving
-        //    it from an async setting, exactly as `chatConfigChanged` already expects.
-        //  - Provider read in flight: the list is emptied and the flag cleared synchronously, on
-        //    connect and again on every `chatConfig` rebind.
-        //  - Unreadable: the rows we hold are a fallback, not the ledger.
-        //
-        // In all three, pinning would bury this project's real total the moment it arrived — a later
-        // load does NOT invalidate baselines (deliberately, see `reloadCostSessionHistory`), so the
-        // next write would replace the row off the pinned figure and lose everything before it.
-        //
-        // Dropping instead leaves the next write to re-derive from rows that actually arrived. It
-        // under-banks `discarded` in that window — a bounded loss, and what every clear did before
-        // this method existed. Nothing is written while disabled, so there is no banked value to
-        // preserve in that case either.
-        if (!this.resolvedCostHistory.enabled || !this._costHistoryLoaded || this._ledgerUnreadable) {
-            deleteBankedBaseline(key);
-            return;
-        }
-        setBankedBaseline(key, addUsage(this.bankedUsageFor(key), discarded));
+        this.costLedger.rebaselineOnClearedTranscript(key, discarded);
     }
     showConfirmationDialog(confirmationMessage, modalParent, onConfirm, onCancel) {
         showNotificationDialog({
@@ -1995,174 +1244,11 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
     }
     /** Remove one entry from persisted build history. */
     removeCostSessionFromHistory(id) {
-        // Deleting a row discards its banked spend by intent, so drop the baseline too —
-        // otherwise the next turn would rewrite the row we just removed, restoring the total the
-        // user asked to be rid of.
-        //
-        // Resolve the row first: `id` is a row id while baselines are keyed by projectKey. They
-        // match only for rows this element wrote (`finalizeCostSession` sets `id: projectKey`); a
-        // row from a host provider can carry any id, and deleting by the wrong namespace would
-        // silently leave the baseline in place.
-        const removed = this.costSessionHistory.find((record) => record.id === id);
-        if (removed)
-            deleteBankedBaseline(removed.projectKey);
-        this.persistCostHistory(this.costSessionHistory.filter((record) => record.id !== id));
+        this.costLedger.remove(id);
     }
     /** Clear all persisted build history for this assistant scope. */
     clearCostSessionHistory() {
-        // Every row is gone, so nothing is banked any more — without this the next turn would
-        // resurrect the pre-clear total. Dropped per row rather than for the active session alone,
-        // so a project whose row was cleared while another session was displaying it does not keep
-        // a baseline pointing at spend that no longer exists anywhere.
-        for (const record of this.costSessionHistory)
-            deleteBankedBaseline(record.projectKey);
-        // Provider-backed: write an empty ledger through. The `localStorage` path instead
-        // removes its key outright rather than leaving an empty array behind.
-        if (this.costHistoryProvider()) {
-            this.persistCostHistory([]);
-            return;
-        }
-        clearCostSessionHistory(this.getCostHistoryScope());
-        this.costSessionHistory = [];
-    }
-    getCostHistoryScope() {
-        const scope = this.resolvedCostHistory.scope;
-        if (scope)
-            return scope;
-        if (this.id)
-            return this.id;
-        return 'default';
-    }
-    reloadCostSessionHistory() {
-        // NOTE: deliberately does NOT invalidate the banked figure. This runs again whenever
-        // `chatConfig` rebinds — hosts commonly build it in a template expression, so a new
-        // object arrives mid-session — and by then the rows include our own upserts, whose
-        // `usage` already contains the live transcript. Re-deriving from those would add the
-        // current session to itself. `bankedUsageFor` keys its memo on the project instead,
-        // which handles a genuine session switch without trusting reload timing.
-        this._costHistoryLoaded = false;
-        this._ledgerUnreadable = false;
-        if (!this.resolvedCostHistory.enabled) {
-            this.costSessionHistory = [];
-            this._costHistoryLoaded = true;
-            return;
-        }
-        const scope = this.getCostHistoryScope();
-        const provider = this.costHistoryProvider();
-        if (!provider) {
-            this.costSessionHistory = loadCostSessionHistory(scope);
-            this._costHistoryLoaded = true;
-            return;
-        }
-        // Provider reads are async, so the Usage tab renders an empty list for a tick before
-        // this lands. Seeded empty rather than left stale so a scope change can't briefly show
-        // the previous scope's rows.
-        this.costSessionHistory = [];
-        void provider.loadCostHistory(scope)
-            .then((records) => {
-            // Guard against a scope change while the load was in flight — a late result must
-            // not overwrite the rows of whatever scope is current now.
-            if (this.getCostHistoryScope() === scope) {
-                // Filtered exactly as the localStorage path is. A host's rows are as capable of
-                // being malformed as a hand-edited storage entry, and an unchecked one poisons
-                // every total with NaN or throws in the sort during render.
-                this.costSessionHistory = (records !== null && records !== void 0 ? records : []).filter(isCostSessionRecord);
-                this._costHistoryLoaded = true;
-            }
-        })
-            .catch((e) => {
-            logger.warn('Cost history unreadable — recording locally only this page-load', e);
-            // Writes stay blocked, and `persistCostHistory` will not save even if something else
-            // calls it. `saveCostHistory` REPLACES the stored list, so writing an upsert against
-            // the empty list we fell back to would delete every other project's row and reset
-            // this project's banked total — destroying data we simply failed to read. The row
-            // rebuilds from the transcript on the next successful load.
-            this._ledgerUnreadable = true;
-        });
-    }
-    /**
-     * The persistence provider, but only when it implements BOTH cost-history methods.
-     *
-     * Both or neither: a provider that can save but not load would silently accumulate a
-     * ledger nobody ever reads back, so a partial implementation is treated as absent and
-     * falls back to `localStorage`.
-     */
-    costHistoryProvider() {
-        const provider = this.persistence.provider;
-        return (provider === null || provider === void 0 ? void 0 : provider.loadCostHistory) && provider.saveCostHistory ? provider : undefined;
-    }
-    /**
-     * Adopt `records` as the live list, and schedule a write to whichever backend owns cost
-     * history — the provider when the host implements it, else `localStorage`.
-     *
-     * The list is adopted synchronously because that is what the Usage tab renders; only the
-     * *write* is deferred. This runs on every usage change (about once per LLM call, plus once
-     * per sub-agent turn) and each write serialises the whole ledger, so coalescing cuts a
-     * per-turn `localStorage.setItem` or network round-trip down to one per quiet period. Safe
-     * because the write is a full replace of idempotent state: the newest call wins and no
-     * intermediate state is meaningful. Flushed on `pagehide` and disconnect so nothing is lost.
-     */
-    persistCostHistory(records) {
-        this.costSessionHistory = records;
-        // A ledger we could not read must never be written back — see reloadCostSessionHistory.
-        // Guarded here rather than only at the finalize gate so it also covers the row-removal and
-        // clear paths, which write directly.
-        if (this._ledgerUnreadable)
-            return;
-        this._ledgerDirty = true;
-        if (this._ledgerFlushTimer !== undefined)
-            clearTimeout(this._ledgerFlushTimer);
-        this._ledgerFlushTimer = setTimeout(() => this.flushCostHistory(), LEDGER_FLUSH_DEBOUNCE_MS);
-    }
-    /**
-     * Write the pending ledger now. Safe to call when nothing is pending.
-     *
-     * Provider writes are fire-and-forget and best-effort: the ledger is accounting, not
-     * conversation content, so a failed write is logged and never surfaced into the chat. On
-     * `pagehide` the `localStorage` path completes synchronously; a provider write is subject to
-     * the same unload race as every other network save the assistant makes.
-     */
-    flushCostHistory() {
-        if (this._ledgerFlushTimer !== undefined) {
-            clearTimeout(this._ledgerFlushTimer);
-            this._ledgerFlushTimer = undefined;
-        }
-        if (!this._ledgerDirty || this._ledgerUnreadable)
-            return;
-        this._ledgerDirty = false;
-        const records = this.costSessionHistory;
-        const scope = this.getCostHistoryScope();
-        const provider = this.costHistoryProvider();
-        if (!provider) {
-            saveCostSessionHistory(scope, records);
-            return;
-        }
-        void provider.saveCostHistory(scope, records).catch((e) => {
-            logger.warn('Cost history save failed', e);
-        });
-    }
-    /**
-     * Finalize the previous session when the host-provided title changes — a rename should land on
-     * the row under its old name rather than silently relabelling accrued spend.
-     *
-     * Only when the session key still matches the one that title accrued under. Hosts change
-     * `costHistory.title` on project SWITCH too, and if the key has already flipped, this would
-     * upsert the outgoing project's live usage onto the incoming project's row as
-     * `banked + old live`, inflating it. Under the old append model a mis-keyed write left a stray
-     * row; with the upsert it overwrites a real one.
-     */
-    syncActiveCostSessionTitle() {
-        var _a, _b;
-        const previous = this._activeCostSessionTitle;
-        const next = (_b = (_a = this.resolvedCostHistory.title) === null || _a === void 0 ? void 0 : _a.trim()) !== null && _b !== void 0 ? _b : '';
-        const key = this.getStateKey();
-        if (previous && previous !== next && this._activeCostSessionKey === key) {
-            this.finalizeCostSession({ title: previous });
-        }
-        if (previous !== next) {
-            this._activeCostSessionTitle = next;
-            this._activeCostSessionKey = key;
-        }
+        this.costLedger.clear();
     }
     /** Active model id resolved from the AIProvider, if exposed. */
     get activeModel() {
@@ -2199,6 +1285,41 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         var _a;
         (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setInputValue(value);
     }
+    /** Attachments pending on the next message. */
+    get attachments() {
+        return this.attachmentCtrl.attachments;
+    }
+    set attachments(value) {
+        this.attachmentCtrl.attachments = value;
+    }
+    /** Rejection messages for files the last pick refused. */
+    get attachmentErrors() {
+        return this.attachmentCtrl.errors;
+    }
+    set attachmentErrors(value) {
+        this.attachmentCtrl.errors = value;
+    }
+    /** Bump to re-render app settings toggles when the host provider notifies a change. */
+    get appSettingsRevision() {
+        return this.settings.appSettingsRevision;
+    }
+    set appSettingsRevision(value) {
+        this.settings.appSettingsRevision = value;
+    }
+    /** Whether the settings modal is open. */
+    get settingsOpen() {
+        return this.settings.open;
+    }
+    set settingsOpen(value) {
+        this.settings.open = value;
+    }
+    /** Active tab inside the settings modal. */
+    get settingsModalTab() {
+        return this.settings.tab;
+    }
+    set settingsModalTab(value) {
+        this.settings.tab = value;
+    }
     /**
      * Showing and hiding the modal hangs off the PROPERTY, so `persistenceBroken` is the single
      * entry point — for this element's own persister callback and for a host reporting a failure in
@@ -2263,6 +1384,69 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         (_a = this.persistenceEscapeGuardTarget) === null || _a === void 0 ? void 0 : _a.removeEventListener('cancel', this.onPersistenceModalCancel);
         this.persistenceEscapeGuardTarget = undefined;
     }
+    /**
+     * Light-DOM nodes assigned to settings modal slots. The template's `slotted()`
+     * bindings write these by property NAME, so each needs a real setter here even
+     * though the controller owns the arrays.
+     */
+    get settingsModelSlotted() {
+        return this.settings.modelSlotted;
+    }
+    set settingsModelSlotted(value) {
+        this.settings.modelSlotted = value;
+    }
+    get settingsAppSlotted() {
+        return this.settings.appSlotted;
+    }
+    set settingsAppSlotted(value) {
+        this.settings.appSlotted = value;
+    }
+    get settingsCostCurrentSlotted() {
+        return this.settings.costCurrentSlotted;
+    }
+    set settingsCostCurrentSlotted(value) {
+        this.settings.costCurrentSlotted = value;
+    }
+    get settingsCostHistorySlotted() {
+        return this.settings.costHistorySlotted;
+    }
+    set settingsCostHistorySlotted(value) {
+        this.settings.costHistorySlotted = value;
+    }
+    /**
+     * This element's driver as an orchestrator, or `undefined` when the session is
+     * running a bare `ChatDriver`.
+     *
+     * The five call sites that used to test the type themselves now read this
+     * (§11.2 constraint 3 of `docs/code-health.md`): the agent pin, the flow-owner
+     * lock, the wire-up in `wireDriver`, and the two `driverKind` diagnostics. The
+     * type test itself lives in `asOrchestrator`, shared with the session
+     * persister.
+     */
+    get orchestrator() {
+        return asOrchestrator(this.driver);
+    }
+    /**
+     * A get/set pair over one of this element's own properties, for a controller
+     * that drives state it does not own. Written as a helper rather than two inline
+     * closures per call: a pair of same-typed closures is easy to transpose by
+     * accident, and a single object cannot be.
+     */
+    accessor(key) {
+        return {
+            get: () => this[key],
+            set: (value) => {
+                this[key] = value;
+            },
+        };
+    }
+    /** Explicit composer height once dragged; `null` keeps the default auto-grow. */
+    get composerHeightPx() {
+        return this.composerResize.heightPx;
+    }
+    set composerHeightPx(value) {
+        this.composerResize.heightPx = value;
+    }
     syncShowHalo() {
         if (!this.busy) {
             this.showHalo = 'no';
@@ -2410,7 +1594,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             this.driver.loadHistory([...history]);
         this.logMeta('driver.created', {
             reason: 'agents-changed',
-            driverKind: this.driver instanceof OrchestratingDriver ? 'orchestrating' : 'chat',
+            driverKind: this.orchestrator ? 'orchestrating' : 'chat',
         });
     }
     /** Returns a stable fingerprint for an agents array based on agent names and tool handler keys. */
@@ -2515,6 +1699,11 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         const { driver } = this;
         if (!driver)
             return;
+        // Captured, not re-read: the cleanup closures below must remove their listeners
+        // from the object they were added to, even if `this.driver` has been reassigned
+        // by the time `unwireDriver` runs. Same reason `driver` itself is destructured,
+        // and reading both from `this` here means they cannot disagree.
+        const orchestrator = this.orchestrator;
         // Idempotent — unwire previous listeners on this component before re-wiring.
         this.unwireDriver();
         const onHistoryUpdated = (e) => {
@@ -2635,13 +1824,13 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             () => driver.removeEventListener('interaction-stop', onInteractionStop),
             () => driver.removeEventListener('provider-changed', onProviderChanged),
         ];
-        if (driver instanceof OrchestratingDriver) {
+        if (orchestrator) {
             // Restore the user pin and flow-owner lock from the session store onto
             // the freshly built driver, so pop-in/pop-out and agents-array
             // reassignment preserve both.
-            driver.setPinnedAgent(this.pinnedAgentName);
-            driver.setFlowOwner(this.flowOwnerAgentName);
-            driver.setContextGuard(this.contextGuardPolicy);
+            orchestrator.setPinnedAgent(this.pinnedAgentName);
+            orchestrator.setFlowOwner(this.flowOwnerAgentName);
+            orchestrator.setContextGuard(this.contextGateCtrl.guardPolicy);
             const onOrchStart = () => {
                 this.showHalo = 'orchestrating';
             };
@@ -2694,12 +1883,12 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
                     (_h = this._sessionRef) === null || _h === void 0 ? void 0 : _h.actions.aiAssistant.setFlowActivationPrompt(null);
                 }
             };
-            driver.addEventListener('orchestrating-start', onOrchStart);
-            driver.addEventListener('orchestrating-stop', onOrchStop);
-            driver.addEventListener('agent-changed', onAgentChanged);
-            driver.addEventListener('pinned-changed', onPinnedChanged);
-            driver.addEventListener('flow-owner-changed', onFlowOwnerChanged);
-            cleanups.push(() => driver.removeEventListener('orchestrating-start', onOrchStart), () => driver.removeEventListener('orchestrating-stop', onOrchStop), () => driver.removeEventListener('agent-changed', onAgentChanged), () => driver.removeEventListener('pinned-changed', onPinnedChanged), () => driver.removeEventListener('flow-owner-changed', onFlowOwnerChanged));
+            orchestrator.addEventListener('orchestrating-start', onOrchStart);
+            orchestrator.addEventListener('orchestrating-stop', onOrchStop);
+            orchestrator.addEventListener('agent-changed', onAgentChanged);
+            orchestrator.addEventListener('pinned-changed', onPinnedChanged);
+            orchestrator.addEventListener('flow-owner-changed', onFlowOwnerChanged);
+            cleanups.push(() => orchestrator.removeEventListener('orchestrating-start', onOrchStart), () => orchestrator.removeEventListener('orchestrating-stop', onOrchStop), () => orchestrator.removeEventListener('agent-changed', onAgentChanged), () => orchestrator.removeEventListener('pinned-changed', onPinnedChanged), () => orchestrator.removeEventListener('flow-owner-changed', onFlowOwnerChanged));
         }
         this.driverCleanup = () => {
             for (const fn of cleanups)
@@ -2820,13 +2009,13 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         // where state is loading and the input may be hidden or disabled).
         if (!this.busy)
             this.maybeAutoFocusChatInput();
-        this.reloadCostSessionHistory();
-        this.syncActiveCostSessionTitle();
+        this.costLedger.reload();
+        this.costLedger.syncActiveTitle();
         this.logMeta('assistant.connected', {
             store: isNewStore ? 'created' : 'restored',
             restoredMessages: this.messages.length,
             driver: driverExisted ? 'reused' : 'created',
-            driverKind: this.driver instanceof OrchestratingDriver ? 'orchestrating' : 'chat',
+            driverKind: this.orchestrator ? 'orchestrating' : 'chat',
             driverBusy: (_f = (_e = this.driver) === null || _e === void 0 ? void 0 : _e.isBusy()) !== null && _f !== void 0 ? _f : false,
         });
     }
@@ -2868,7 +2057,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
                 void this.loadProviderStatuses();
             });
         }
-        this.wireAppSettingsProvider();
+        this.settings.wireAppSettingsProvider();
         // Latch the backend block off the activity bus (GENC-1464). This is the primary
         // seam: it fires for a turn this element did not start, for a sub-agent's
         // wall (the child inherits the parent's bus and publishes its own
@@ -2880,7 +2069,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         // Pass the figures through: this seam wins the latch for an in-loop wall (the
         // common case), so dropping them here would render the generic banner copy in
         // exactly the path `ChatDriverResult.budget` was widened to serve.
-        this.latchBlockedFrom(d === null || d === void 0 ? void 0 : d.failureReason, undefined, d === null || d === void 0 ? void 0 : d.budget, d === null || d === void 0 ? void 0 : d.vendor));
+        this.budget.latchFrom(d === null || d === void 0 ? void 0 : d.failureReason, undefined, d === null || d === void 0 ? void 0 : d.budget, d === null || d === void 0 ? void 0 : d.vendor));
         if (this.messagesEl) {
             this._scrollListener = () => {
                 this._userScrolledAway =
@@ -2976,13 +2165,14 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
     disconnectedCallback() {
         var _a, _b, _c, _d, _e, _f, _g;
         window.removeEventListener('pagehide', this._handlePageHide);
-        // Both menus close below via the toggles' `finalize()`, but that writes to
-        // the store and never reaches the setters — drop the document listeners
-        // directly so they cannot outlive the element.
-        this.teardownComposerMenuDismissal();
+        // Drops the menus' document listeners and finalises any in-flight close
+        // animation. Ordering matters and is satisfied here: `finalize()` writes the
+        // closed state through the store, so it has to run while `_sessionRef` is still
+        // set (cleared at the end of this method) or the panel re-mounts open.
+        this.composerMenus.dispose();
         // Write out anything the debounce is still holding — the timer would otherwise fire against
         // a torn-down element, or not at all.
-        this.flushCostHistory();
+        this.costLedger.flush();
         super.disconnectedCallback();
         this._sessionActive = false;
         this.stopLoadingTimer();
@@ -3000,7 +2190,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         this._unsubBudgetLatch = undefined;
         (_c = this.unsubProviderRegistry) === null || _c === void 0 ? void 0 : _c.call(this);
         this.unsubProviderRegistry = undefined;
-        this.unwireAppSettingsProvider();
+        this.settings.unwireAppSettingsProvider();
         (_d = this._executionCompletionUnsub) === null || _d === void 0 ? void 0 : _d.call(this);
         this._executionCompletionUnsub = undefined;
         // Note: the restore-core autosave AND diagnostics-append timers live on the
@@ -3014,15 +2204,10 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         this.removeEventListener('request-scroll-to-bottom', this._handleRequestScrollToBottom);
         document.removeEventListener('pointerdown', this._handleGlobalInteraction, true);
         document.removeEventListener('focusin', this._handleGlobalInteraction, true);
-        // Finalise any in-flight panel-close animations before clearing
-        // _sessionRef, otherwise the closed state never makes it to the store and
-        // the panel re-mounts open.
-        this._agentPickerToggle.finalize();
         if (this.settingsOpen) {
             (_e = this.settingsModal) === null || _e === void 0 ? void 0 : _e.close();
             this.settingsOpen = false;
         }
-        this._sessionMenuToggle.finalize();
         // Capture before clearing — `wasBusy` reads the driver, which is dropped below.
         this.logMeta('assistant.disconnected', { wasBusy: (_g = (_f = this.driver) === null || _f === void 0 ? void 0 : _f.isBusy()) !== null && _g !== void 0 ? _g : false });
         // Clear local references only — driver and store stay in their registries.
@@ -3066,27 +2251,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      */
     syncContextGuard() {
         var _a, _b;
-        (_b = (_a = this.driver) === null || _a === void 0 ? void 0 : _a.setContextGuard) === null || _b === void 0 ? void 0 : _b.call(_a, this.contextGuardPolicy);
-    }
-    /**
-     * Guard policy pushed to the driver, or `undefined` when the host has switched
-     * the gate off — so `enabled: false` really does mean no local blocking of any
-     * kind, UI or mid-loop.
-     *
-     * A MARGIN, not a threshold: the driver resolves the window of the provider
-     * each call actually goes to. The fallback window rides along because the
-     * driver cannot learn it any other way — without it, a host that knows its
-     * window while its provider does not report one had `fallbackContextLimit`
-     * protecting the composer and nothing else.
-     */
-    get contextGuardPolicy() {
-        var _a;
-        if (!this.contextBudget.enabled)
-            return undefined;
-        return {
-            marginTokens: CONTEXT_ABORT_MARGIN_TOKENS,
-            fallbackLimit: (_a = this.chatConfig.context) === null || _a === void 0 ? void 0 : _a.fallbackContextLimit,
-        };
+        (_b = (_a = this.driver) === null || _a === void 0 ? void 0 : _a.setContextGuard) === null || _b === void 0 ? void 0 : _b.call(_a, this.contextGateCtrl.guardPolicy);
     }
     loadProviderStatuses() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -3104,8 +2269,8 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         // the store is fresh and the user hasn't already toggled something.
         this.applyPreferenceBaseline();
         this.syncShowingSplash();
-        this.syncActiveCostSessionTitle();
-        this.reloadCostSessionHistory();
+        this.costLedger.syncActiveTitle();
+        this.costLedger.reload();
         // `chatConfig.context` decides whether the mid-loop guard runs at all, so a
         // late or changed binding has to reach the driver — otherwise switching the
         // gate off leaves the guard armed from whatever the config said at connect.
@@ -3380,130 +2545,19 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
                 : 'standalone';
         recordMetaEvent(key, type, Object.assign({ placement }, detail));
     }
-    closeOpenComposerMenus() {
-        if (this.agentPickerOpen)
-            this.toggleAgentPicker();
-        if (this.sessionMenuOpen)
-            this.toggleSessionMenu();
-    }
     /**
-     * Places an open composer menu directly above the control that opened it.
-     *
-     * CSS alone cannot: the menu is a child of `.composer` — which is what lets its
-     * width be capped against the composer rather than against a button — while its
-     * anchor is a button several levels down the bar, and no selector can read a
-     * sibling's offset. So the left edge is measured on open and written as a
-     * custom property.
+     * Document-level dismissal for whichever composer menu is open. Bound only
+     * while one IS open — a permanently-attached listener on a component that can
+     * be mounted twice (bubble + popout panel) is a cost every click on the page
+     * pays for a menu that is usually closed.
      *
-     * Clamped to the composer, so a menu opened from a control near the right edge
-     * of a narrow panel slides back inside instead of overhanging. The animation
-     * origin is written separately and keeps pointing at the button's centre even
-     * after such a shift — the menu still grows out of the thing that opened it,
-     * which is the whole point of anchoring it there.
+     * Uses `composedPath()` rather than `event.target`: the click lands on a node
+     * inside this element's shadow root, which retargets to the host, so a plain
+     * `contains()` check cannot tell "clicked the menu" from "clicked the
+     * transcript". The path crosses the boundary and carries both.
      */
-    positionComposerMenu(panelSelector, triggerSelector) {
-        const root = this.shadowRoot;
-        const composer = root === null || root === void 0 ? void 0 : root.querySelector('.composer');
-        const panel = root === null || root === void 0 ? void 0 : root.querySelector(panelSelector);
-        const trigger = root === null || root === void 0 ? void 0 : root.querySelector(triggerSelector);
-        if (!composer || !panel || !trigger)
-            return;
-        const box = composer.getBoundingClientRect();
-        const anchor = trigger.getBoundingClientRect();
-        // An absolutely-positioned child is placed against its containing block's
-        // PADDING box, while getBoundingClientRect reports the border box — so every
-        // offset below is taken from the padding edge. Skipping this is a 1px drift
-        // that reads as the menu being very slightly out of line with its button.
-        const style = getComputedStyle(composer);
-        const originLeft = box.left + (parseFloat(style.borderLeftWidth) || 0);
-        const originBottom = box.bottom - (parseFloat(style.borderBottomWidth) || 0);
-        // A menu wider than the composer clamps to 0 rather than a negative offset:
-        // Math.min picks the negative headroom, Math.max floors it at the left edge.
-        const left = Math.max(0, Math.min(anchor.left - originLeft, composer.clientWidth - panel.offsetWidth));
-        panel.style.setProperty('--composer-menu-left', `${left}px`);
-        panel.style.setProperty('--composer-menu-origin', `${anchor.left + anchor.width / 2 - originLeft - left}px`);
-        // Sit on the button rather than on top of the whole composer. The gap stays
-        // in CSS so it can be expressed in design units; this is the raw distance
-        // from the padding edge up to the button's top.
-        panel.style.setProperty('--composer-menu-bottom', `${originBottom - anchor.top}px`);
-        // Starting on the button rather than on the composer means less room above,
-        // and the assistant can be short enough that a full-height menu would be
-        // clipped by the wrapper's overflow. Cap it at what is actually available;
-        // the menu scrolls inside whatever it gets.
-        const wrapper = root === null || root === void 0 ? void 0 : root.querySelector('.chat-wrapper');
-        if (wrapper) {
-            const available = anchor.top -
-                wrapper.getBoundingClientRect().top -
-                FoundationAiAssistant_1.MENU_HEADROOM_RESERVE;
-            panel.style.setProperty('--composer-menu-max-height', `${Math.max(COMPOSER_MENU_MIN_HEIGHT, available)}px`);
-        }
-    }
-    /** Re-place whichever menu is open. Cheap enough to run from a resize. */
-    repositionOpenComposerMenu() {
-        if (this.agentPickerOpen) {
-            this.positionComposerMenu('.agent-picker-panel', '.agent-toggle-button');
-        }
-        if (this.sessionMenuOpen) {
-            this.positionComposerMenu('.session-menu-panel', '.session-menu-button');
-        }
-    }
-    syncComposerMenuDismissal() {
-        const shouldListen = this.agentPickerOpen || this.sessionMenuOpen;
-        if (shouldListen === !!this._dismissPointerHandler)
-            return;
-        if (!shouldListen) {
-            this.teardownComposerMenuDismissal();
-            return;
-        }
-        this._dismissPointerHandler = (e) => {
-            var _a;
-            // The composer owns both the menus and the buttons that open them, so a
-            // path that reaches it is an inside click — including the toggle itself,
-            // whose own handler closes the menu. Closing here too would immediately
-            // reopen-then-close and the menu would never appear.
-            const composer = (_a = this.shadowRoot) === null || _a === void 0 ? void 0 : _a.querySelector('.composer');
-            if (composer && e.composedPath().includes(composer))
-                return;
-            this.closeOpenComposerMenus();
-        };
-        this._dismissKeyHandler = (e) => {
-            var _a;
-            if (e.key !== 'Escape')
-                return;
-            this.closeOpenComposerMenus();
-            // Return focus to the input rather than leaving it on a button that has
-            // just disappeared from under the user.
-            (_a = this.chatInputEl) === null || _a === void 0 ? void 0 : _a.focus();
-        };
-        this._dismissResizeHandler = () => this.repositionOpenComposerMenu();
-        document.addEventListener('pointerdown', this._dismissPointerHandler, true);
-        document.addEventListener('keydown', this._dismissKeyHandler, true);
-        window.addEventListener('resize', this._dismissResizeHandler);
-    }
-    teardownComposerMenuDismissal() {
-        if (this._dismissPointerHandler) {
-            document.removeEventListener('pointerdown', this._dismissPointerHandler, true);
-            this._dismissPointerHandler = undefined;
-        }
-        if (this._dismissKeyHandler) {
-            document.removeEventListener('keydown', this._dismissKeyHandler, true);
-            this._dismissKeyHandler = undefined;
-        }
-        if (this._dismissResizeHandler) {
-            window.removeEventListener('resize', this._dismissResizeHandler);
-            this._dismissResizeHandler = undefined;
-        }
-    }
     toggleAgentPicker() {
-        // Mutually exclusive with the session menu — both anchor to the composer bar.
-        if (!this.agentPickerOpen && this.sessionMenuOpen)
-            this.toggleSessionMenu();
-        this.logMeta('panel.toggled', { panel: 'agent-picker', open: !this.agentPickerOpen });
-        this._agentPickerToggle.toggle();
-        // After the render that mounts the panel — it has no box to measure before that.
-        if (this.agentPickerOpen) {
-            void DOM.nextUpdate().then(() => this.positionComposerMenu('.agent-picker-panel', '.agent-toggle-button'));
-        }
+        this.composerMenus.toggleAgentPicker();
     }
     /**
      * Whether the lifecycle-menu button shows. It occupies the stop-button slot,
@@ -3571,35 +2625,21 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         return !!this.persistence.enabled && !!this.persistence.provider;
     }
     /**
-     * Context-headroom thresholds for the active model (GENC-1567) — the warning
-     * and block lines, plus the tail budget compaction aims at.
+     * The context gate's derived surface (GENC-1567). Every member below delegates to
+     * `ContextGateController` — the names are this element's public API and the
+     * template's bindings, so they stay put while the derivation moves.
      *
      * The per-agent `contextReserve` IS folded in, via the driver (GENC-1582). It
      * used to be described here as a separate, later check made when an agent took
      * ownership of a flow — but there is no such check, and by flow entry the send
-     * has already been allowed. Resolving it here, before the send, is what makes it
-     * a gate rather than a label.
+     * has already been allowed. Resolving it before the send is what makes it a gate
+     * rather than a label.
      *
-     * Overhead is read off `messages` (the Redux mirror) rather than the driver's
-     * own history, which the compaction plan uses. That is safe rather than sloppy:
-     * `estimateSystemOverhead` only looks at messages BEFORE the first usage-bearing
-     * one, and the two lists agree completely that early — the drift between mirror
-     * and driver history is only ever at the tail.
+     * None carries `@volatile`: the decorators live on the controller's getters, and
+     * they reach the binding observer from there — see `docs/code-health.md` §11.4.
      */
     get contextBudget() {
-        // Resolved ONCE. `contextReserve` re-reads live routing state on every access,
-        // so two reads can land on different winners and pair one agent's
-        // `warnAheadTokens` with another's `tokens` — the exact pairing
-        // `ContextReserveResolution` warns against, and the reason this is a local
-        // rather than two property reads (reviewer catch on #2504). It also stops the
-        // orchestrator walking every specialist plus the fallback twice per evaluation.
-        const reserve = this.contextReserve;
-        return resolveContextBudget({
-            chatConfig: this.chatConfig,
-            contextLimit: this.contextLimit,
-            agentReserveTokens: reserve === null || reserve === void 0 ? void 0 : reserve.tokens,
-            agentWarnAheadTokens: reserve === null || reserve === void 0 ? void 0 : reserve.warnAheadTokens,
-        });
+        return this.contextGateCtrl.budget;
     }
     /**
      * Headroom the next turn needs, resolved against how routing is currently
@@ -3619,6 +2659,10 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * `contextReserve` is a plain number by design — see `ContextReserveInput` for
      * why a resolver form was dropped rather than accepted and ignored.
      *
+     * Stays on the element rather than moving into `ContextGateController` because it
+     * reaches the driver, which no extracted controller may do (`docs/code-health.md`
+     * §11.2 constraint 2). The controller receives the resolved value as a callback.
+     *
      * @internal
      */
     get contextReserve() {
@@ -3645,250 +2689,46 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             basis: 'locked',
         };
     }
-    /**
-     * What compacting right now would reclaim, or `null` when it would not be
-     * worth it (GENC-1567). Sized against {@link FoundationAiAssistant.contextBudget},
-     * so the plan aims at this model's window rather than a fixed default.
-     *
-     * Reads `messages` to stay reactive as the conversation grows: the driver's
-     * history is not a tracked observable, so every consumer of this keys its
-     * re-evaluation off the Redux mirror.
-     */
     get compactionPlan() {
-        var _a, _b, _c, _d, _e;
-        if (this.messages.length === 0)
-            return null;
-        const budget = this.contextBudget;
-        return ((_e = (_b = (_a = this.driver) === null || _a === void 0 ? void 0 : _a.getCompactionPlan) === null || _b === void 0 ? void 0 : _b.call(_a, {
-            preambleTokens: (_d = (_c = this.driver) === null || _c === void 0 ? void 0 : _c.getPreambleTokens) === null || _d === void 0 ? void 0 : _d.call(_c),
-            tailTokenBudget: budget.tailTokenBudget,
-            minReclaimTokens: budget.minReclaimTokens,
-        })) !== null && _e !== void 0 ? _e : null);
+        return this.contextGateCtrl.plan;
     }
-    /**
-     * Tooltip and hint for the Compact row — why it is or is not available.
-     *
-     * Replaces a fixed "Not enough conversation yet to be worth compacting", which
-     * since GENC-1567 could be flatly wrong: a long conversation whose tail is one
-     * indivisible tool result has plenty of conversation and still cannot be
-     * compacted. Reading the plan means the hint states the actual reason.
-     *
-     * @internal
-     */
-    get compactHint() {
-        const plan = this.compactionPlan;
-        if (plan)
-            return `Summarize older messages to free up context`;
-        return this.messages.length === 0
-            ? 'Nothing to compact yet'
-            : 'There is nothing left to summarize here — the recent messages are too large to shrink further';
-    }
-    /**
-     * How close this conversation is to the model's context window (GENC-1567).
-     *
-     * **Derived, never latched** — the opposite of {@link FoundationAiAssistant.blocked}.
-     * A budget wall stays set because nothing the user does fixes it; this clears
-     * itself the moment the conversation shrinks, which is precisely what the user
-     * is being asked to do. The two must not be conflated: `blocked` is also
-     * deliberately preserved across `resetSession`, and a context gate obviously
-     * must not survive starting a new chat.
-     *
-     * **A flow in progress is never blocked, only warned.** Machine state lives
-     * outside the transcript, so a stateful flow is not desynced by compaction —
-     * but the summary can still drop detail the flow's own prompt leans on, and
-     * blocking mid-journey would strand the user between a flow they cannot finish
-     * and a compaction that is a poor idea right there. Letting the flow complete
-     * and gating on the way out is the lesser harm; the headroom reserve exists so
-     * this is rare rather than routine.
-     */
     /**
      * WHY the composer is blocked, when it is (GENC-1582). `undefined` unless
-     * {@link FoundationAiAssistant.contextGate} is `'blocked'`.
-     *
-     * A cause rather than a fourth gate level: the severity is identical — sends are
-     * refused either way — and every consumer switches on the three levels. What
-     * differs is what the user can do about it, which is worth splitting because the
-     * two answers have no remedy in common.
-     *
-     * - `'transcript'` — the conversation has grown into the reserve. Compacting or
-     *   clearing helps, and the copy says so.
-     * - `'model'` — the active agent's reserve meets or exceeds the whole window, so
-     *   `blockAt` is 0 and EVERY message is refused, including the first of an empty
-     *   chat. Neither compacting nor clearing can help: the constraint is the model,
-     *   not the transcript. Before this existed the user was told to clear the chat,
-     *   did, and hit the identical block with no way to understand why.
-     *
-     * Keyed off `blockAt === 0`, deliberately NOT off whether a compaction plan
-     * exists. A null plan has two unrelated causes — nothing left worth summarizing,
-     * versus a window that cannot host the agent at all — and conflating them is what
-     * produced the misleading copy.
-     *
-     * Note the block itself is correct in both cases and must stay: an agent that
-     * measurably cannot complete a turn in this window would otherwise start one and
-     * die mid-loop on a provider context error, with partial writes and no clean
-     * exit. Refusing up front is the better failure.
+     * {@link FoundationAiAssistant.contextGate} is `'blocked'`. See
+     * `ContextGateController.blockCause` for the `'transcript'` / `'model'` split
+     * and why it is a cause rather than a fourth gate level.
      *
      * @internal
      */
     get contextBlockCause() {
-        if (this.contextGate !== 'blocked')
-            return undefined;
-        return this.contextBudget.blockAt === 0 ? 'model' : 'transcript';
+        return this.contextGateCtrl.blockCause;
     }
     get contextGate() {
-        var _a;
-        const budget = this.contextBudget;
-        if (!budget.enabled)
-            return 'ok';
-        // The figure from the last moment nothing was running, not the live one — see
-        // `_gateContextTokens` for why the gauge and the gate differ here.
-        const tokens = (_a = this._gateContextTokens) !== null && _a !== void 0 ? _a : this.contextTokens;
-        if (tokens == null || budget.blockAt == null || budget.warnAt == null)
-            return 'ok';
-        if (tokens >= budget.blockAt)
-            return this.flowOwnerAgentName !== null ? 'warn' : 'blocked';
-        return tokens >= budget.warnAt ? 'warn' : 'ok';
+        return this.contextGateCtrl.gate;
     }
-    /**
-     * What the composer notice says about the context gate.
-     *
-     * The copy is a function of whether compaction can actually clear the gate,
-     * which is why it reads {@link FoundationAiAssistant.compactionPlan} rather
-     * than assuming. Telling someone to compact when the projection says it would
-     * not free enough — a tail that is one indivisible tool result, say — sends
-     * them into a summarizer call that leaves them exactly where they were.
-     *
-     * @internal
-     */
     get contextGateReason() {
-        var _a, _b;
-        const level = this.contextGate;
-        const canHelp = this.compactionPlan != null;
-        if (level === 'blocked' && this.contextBlockCause === 'model') {
-            // The window cannot host this agent, so neither remedy the other branches
-            // offer can help. Name the agent and both figures instead: the numbers are
-            // what make "switch model" an instruction rather than a shrug, and they are
-            // already to hand.
-            const reserve = this.contextReserve;
-            const need = reserve ? `${reserve.tokens.toLocaleString()} tokens` : 'more headroom';
-            const have = (_a = this.contextLimit) === null || _a === void 0 ? void 0 : _a.toLocaleString();
-            const who = (_b = reserve === null || reserve === void 0 ? void 0 : reserve.agentName) !== null && _b !== void 0 ? _b : 'This task';
-            return (`${who} needs about ${need} of context headroom to complete a turn, and this model has ` +
-                `${have !== null && have !== void 0 ? have : 'less than that'}. Switch to a model with a larger context window, or pick a ` +
-                `different agent — compacting or clearing this conversation will not help.`);
-        }
-        if (level === 'blocked') {
-            // Name the agent whose headroom is binding when routing is automatic
-            // (GENC-1582). The reserve is then the hungriest agent the turn could land
-            // on, so the composer can close while there is plenty of room for the short
-            // question the user was about to type — and a message that only said "not
-            // enough room for more work" would read as a bug rather than a reason.
-            const reserve = this.contextReserve;
-            const cause = (reserve === null || reserve === void 0 ? void 0 : reserve.basis) === 'reachable-max'
-                ? `There is not enough room in the model context to start another task — ${reserve.agentName} needs the most of any I could pick up next.`
-                : 'There is not enough room in the model context for more work.';
-            const remedy = canHelp
-                ? 'Click the error pill and compact the context to continue working.'
-                : 'Compacting the context will not free enough room, click the error pill to clear and start a new conversation.';
-            return `${cause} ${remedy}`;
-        }
-        if (this.flowOwnerAgentName !== null) {
-            return 'This conversation is nearly full. The task in progress will finish, but compact before starting another.';
-        }
-        return canHelp
-            ? 'This conversation is getting long. Compact it to free up room.'
-            : 'This conversation is getting long and is close to the limit.';
+        return this.contextGateCtrl.gateReason;
     }
-    /**
-     * Short label the session-menu pill wears while the gate is active — the
-     * primary visible signal, in place of a banner.
-     *
-     * Borrowed from the agent pin, which is the established way this composer says
-     * "a mode is in force": a pill that grows a label rather than a strip of prose
-     * above the input. It states the CONDITION only; the remedy lives in the
-     * placeholder once the composer is actually blocked, which is the moment the
-     * user needs to be told what to do rather than merely warned.
-     *
-     * @internal
-     */
     get contextGateLabel() {
-        switch (this.contextGate) {
-            case 'blocked':
-                return 'At context limit';
-            case 'warn':
-                return 'Approaching context limit';
-            default:
-                return '';
-        }
+        return this.contextGateCtrl.gateLabel;
+    }
+    get compactHint() {
+        return this.contextGateCtrl.compactHint;
+    }
+    get compactable() {
+        return this.contextGateCtrl.compactable;
     }
-    /**
-     * Whether the composer notice has anything to show — a budget wall or the
-     * context gate. One region for both, so the live region stays single and
-     * registered (see the banner template's accessibility note).
-     *
-     * @internal
-     */
     get composerNoticeVisible() {
-        return this.bannerVisible || this.contextGate !== 'ok';
+        return this.contextGateCtrl.noticeVisible;
     }
-    /**
-     * Text for that region. A budget wall outranks the context gate: it is the
-     * condition the user cannot clear, so it must not be hidden behind advice
-     * about compacting that would not restore sending anyway.
-     *
-     * For the context gate the region is present and announced but not drawn — see
-     * {@link FoundationAiAssistant.composerNoticeSrOnly}.
-     *
-     * @internal
-     */
     get composerNoticeText() {
-        if (this.bannerVisible)
-            return this.effectiveBlockedReason;
-        return this.contextGate === 'ok' ? '' : this.contextGateReason;
+        return this.contextGateCtrl.noticeText;
     }
-    /**
-     * Whether the notice region should be announced but not drawn.
-     *
-     * The context gate shows itself visually through the pill's label, the
-     * composer outline and the placeholder — a strip of prose on top of those
-     * would be a fourth statement of the same thing. But dropping the region
-     * outright would be an accessibility regression, and a documented one: a
-     * `role="status"` region announces MUTATIONS to a region already being
-     * observed, and it is the only announcement available here, because the
-     * composer flips to `disabled` at the same moment and a disabled control is out
-     * of the tab order — so neither the placeholder nor an `aria-label` on it is
-     * ever voiced.
-     *
-     * So the region stays mounted, keeps its text and keeps announcing; only the
-     * visual treatment is withheld. A budget wall still draws its banner, because
-     * that condition has no other visible expression.
-     *
-     * @internal
-     */
     get composerNoticeSrOnly() {
-        return !this.bannerVisible && this.contextGate !== 'ok';
-    }
-    /**
-     * Whether the menu's "Compact" action would do anything (GENC-1351 §5.7,
-     * GENC-1567). Delegates to the driver's plan so the gate uses the exact same
-     * history `compact()` acts on, judged against the same budget — one source of
-     * truth for both whether a cut is legal and whether it reclaims enough.
-     */
-    get compactable() {
-        return this.compactionPlan != null;
+        return this.contextGateCtrl.noticeSrOnly;
     }
     toggleSessionMenu() {
-        // Mutually exclusive with the agent picker; always reopen showing the menu
-        // (not a leftover Clear-confirm prompt).
-        if (!this.sessionMenuOpen && this.agentPickerOpen)
-            this.toggleAgentPicker();
-        this.confirmingClear = false;
-        this.confirmingCompact = false;
-        this.logMeta('panel.toggled', { panel: 'session-menu', open: !this.sessionMenuOpen });
-        this._sessionMenuToggle.toggle();
-        if (this.sessionMenuOpen) {
-            void DOM.nextUpdate().then(() => this.positionComposerMenu('.session-menu-panel', '.session-menu-button'));
-        }
+        this.composerMenus.toggleSessionMenu();
     }
     /**
      * Set persistence on/off for this session (the menu switch). Reassigns the
@@ -4009,7 +2849,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             if (!(driver === null || driver === void 0 ? void 0 : driver.compact) || driver.isBusy() || this.compacting)
                 return;
             this.confirmingCompact = false;
-            this.sessionMenuOpen = false;
+            this.composerMenus.closeImmediate();
             // Swap the transcript for a "Compacting…" indicator while the async summary
             // runs. Purely visual: the driver only replaces history on success, so a
             // failure just restores the untouched messages when the flag clears — and
@@ -4108,7 +2948,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             // append-only and handled separately below.
             yield ((_h = this.persister()) === null || _h === void 0 ? void 0 : _h.clearRestoreCore());
             this.confirmingClear = false;
-            this.sessionMenuOpen = false;
+            this.composerMenus.closeImmediate();
             this.logMeta('session.cleared', { agentName });
             // Diagnostics is append-only, so Clear never wipes the prior log — the
             // provider.clear above only drops the restore-core snapshot. Now restart the
@@ -4158,81 +2998,61 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             return false;
         return ((_c = this.agents) !== null && _c !== void 0 ? _c : []).some((a) => { var _a; return (_a = a.manualSelection) === null || _a === void 0 ? void 0 : _a.enabled; });
     }
-    /** Whether the settings modal AI Model section has slotted app content, context usage or budget figures. */
+    /**
+     * The settings modal's derived surface. Every member below delegates to
+     * `SettingsModalController` — the names are this element's public API and the
+     * 943-line template's bindings, so they stay put while the logic moves into the
+     * `settings-modal.ts` that folder never had (`docs/code-health.md` §3).
+     *
+     * None carries `@volatile`: the decorators live on the controller's getters, and
+     * they reach the binding observer from there — see `docs/code-health.md` §11.4.
+     */
     get settingsModelSectionVisible() {
-        return (this.settingsModelSlotted.length > 0 ||
-            this.settingsContextUsageVisible ||
-            this.settingsBudgetUsageVisible);
+        return this.settings.modelSectionVisible;
     }
     /** Built-in context window indicator (generic platform concern). */
     get settingsContextUsageVisible() {
-        const ui = this.chatConfig.ui;
-        return ((ui === null || ui === void 0 ? void 0 : ui.showContextUsage) !== false && this.contextTokens != null && this.contextLimit != null);
+        return this.settings.contextUsageVisible;
+    }
+    /**
+     * The context indicator's figures, pre-formatted, or `undefined` when there is
+     * nothing measurable to show — see {@link SettingsContextUsage}.
+     *
+     * @internal
+     */
+    get settingsContextUsage() {
+        return this.settings.contextUsage;
     }
     /**
      * Built-in per-vendor budget meter (GENC-1464) — the money sibling of
      * {@link FoundationAiAssistant.settingsContextUsageVisible}, with the same
-     * shape of gate: not configured off, and there is data to show. "Data" here
-     * is "at least one vendor has figures", so a host that feeds nothing (or only
-     * unlimited vendors) gets no meter and no empty container — exactly the
-     * context indicator's absent case.
-     *
-     * Answered from the RAW slice state rather than from
-     * {@link FoundationAiAssistant.settingsBudgetRows}, whose `.length` would
-     * format every row (a `formatUsd` pair and a `budgetPercentOf` each) only to
-     * ask whether any exist. This is read several times per render pass — the
-     * getter, the section gate, the template's `when` — so it stays as cheap as
-     * the context sibling's `!= null`.
+     * shape of gate: not configured off, and there is data to show. See
+     * `BudgetController.settingsUsageVisible` for why it reads the raw slice
+     * rather than counting the rows.
      *
      * @internal
      */
     get settingsBudgetUsageVisible() {
-        var _a, _b;
-        const budgets = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.vendorBudgets;
-        return (((_b = this.chatConfig.ui) === null || _b === void 0 ? void 0 : _b.showBudgetUsage) !== false &&
-            budgets != null &&
-            // Keyed off BUDGETED_VENDORS, exactly as the rows are, so a key outside
-            // that list could never surface a meter with no row to show.
-            BUDGETED_VENDORS.some((vendor) => budgets[vendor] != null));
+        return this.budget.settingsUsageVisible;
     }
     /**
      * The meter's rows — one per vendor that currently has figures, in
-     * `BUDGETED_VENDORS` order (the proxy's own metered list) so the rendering is
-     * stable however the host ordered its feed calls. Pre-formatted; see
-     * {@link SettingsBudgetRow} for why the text is unclamped while the bar is.
+     * `BUDGETED_VENDORS` order so the rendering is stable however the host ordered
+     * its feed calls. Pre-formatted; see {@link SettingsBudgetRow} for why the text
+     * is unclamped while the bar is.
      *
      * @internal
      */
     get settingsBudgetRows() {
-        var _a;
-        const budgets = (_a = this._sessionRef) === null || _a === void 0 ? void 0 : _a.store.aiAssistant.vendorBudgets;
-        if (!budgets)
-            return [];
-        const rows = [];
-        for (const vendor of BUDGETED_VENDORS) {
-            const figures = budgets[vendor];
-            if (!figures)
-                continue;
-            const percent = budgetPercentOf(figures);
-            rows.push({
-                vendor,
-                label: vendorDisplayName(vendor),
-                figures: `${formatUsd(figures.spentUsd)} / ${formatUsd(figures.budgetUsd)} (${percent}%)`,
-                // The same clamp the context indicator applies to its bar. No lower
-                // clamp needed: the boundary refuses negative figures.
-                barValue: Math.min(100, percent),
-            });
-        }
-        return rows;
+        return this.budget.settingsRows;
     }
     /** Whether the settings modal UI Builder section should render. */
     get settingsAppSectionVisible() {
-        return this.settingsAppSlotted.length > 0 || this.visibleAppSettingsToggles.length > 0;
+        return this.settings.appSectionVisible;
     }
     /** App toggles currently visible per each entry's `visible()` predicate. */
     get visibleAppSettingsToggles() {
-        void this.appSettingsRevision;
-        return this.appSettingsProvider.toggles.filter((toggle) => { var _a; return ((_a = toggle.visible) === null || _a === void 0 ? void 0 : _a.call(toggle)) !== false; });
+        return this.settings.visibleAppSettingsToggles;
     }
     /**
      * Host-supplied heading for the toggle group, or `undefined` for none — the assistant has no
@@ -4240,237 +3060,72 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
      * the last one takes its heading with it rather than leaving a label over nothing.
      */
     get appSettingsTogglesHeading() {
-        void this.appSettingsRevision;
-        if (this.visibleAppSettingsToggles.length === 0)
-            return undefined;
-        return this.appSettingsProvider.togglesHeading;
+        return this.settings.appSettingsTogglesHeading;
     }
     getAppSettingValue(id) {
-        void this.appSettingsRevision;
-        return this.appSettingsProvider.getValue(id);
+        return this.settings.getAppSettingValue(id);
     }
     setAppSettingValue(id, value) {
-        this.appSettingsProvider.setValue(id, value);
-    }
-    wireAppSettingsProvider() {
-        this.unwireAppSettingsProvider();
-        if (!this.appSettingsProvider.subscribe)
-            return;
-        this.unsubAppSettingsProvider = this.appSettingsProvider.subscribe(() => {
-            this.appSettingsRevision += 1;
-        });
-    }
-    unwireAppSettingsProvider() {
-        var _a;
-        (_a = this.unsubAppSettingsProvider) === null || _a === void 0 ? void 0 : _a.call(this);
-        this.unsubAppSettingsProvider = undefined;
+        this.settings.setAppSettingValue(id, value);
     }
     get settingsCostCurrentSectionVisible() {
-        return this.settingsCostCurrentSlotted.length > 0;
+        return this.settings.costCurrentSectionVisible;
     }
     /**
      * Whether the build-history section has anything in it — the built-in row list, or a host's own
-     * markup in the `settings-cost-history` slot.
-     *
-     * Slotted content is checked FIRST, ahead of `enabled`. That flag governs the *built-in* ledger:
-     * it gates the row writes, the reload, and the lifetime sum — and it defaults to `false`
-     * (`cost?.enabled === true`), while the Usage tab itself shows for `showCost`/`showTokens`, which
-     * default true. So a host can legitimately render its own build history into the slot and never
-     * opt into our `localStorage` ledger. Short-circuiting on `enabled` above the slot check hid that
-     * host's markup outright, since the slot is the only thing in the container.
+     * markup in the `settings-cost-history` slot. See
+     * `SettingsModalController.costHistorySectionVisible` for why slotted content is
+     * checked ahead of `enabled`.
      */
     get settingsCostHistorySectionVisible() {
-        if (this.settingsCostHistorySlotted.length > 0)
-            return true;
-        if (!this.resolvedCostHistory.enabled)
-            return false;
-        return this.costSessionHistory.length > 0;
+        return this.settings.costHistorySectionVisible;
     }
     /**
-     * Whether the "Build history" heading has anything under it.
-     *
-     * Broader than {@link FoundationAiAssistant.settingsCostHistorySectionVisible} because the
-     * heading also covers the lifetime total, which renders before the first row exists (rows are
-     * written as spend accrues, the lifetime section only needs history switched on). Gating the
-     * heading on the rows alone left that total sitting under nothing.
+     * Whether the "Build history" heading has anything under it — broader than
+     * {@link FoundationAiAssistant.settingsCostHistorySectionVisible}, because the
+     * heading also covers the lifetime total, which renders before the first row exists.
      */
     get settingsCostHistoryHeadingVisible() {
-        return this.settingsCostHistorySectionVisible || this.settingsCostLifetimeVisible;
+        return this.settings.costHistoryHeadingVisible;
     }
     /** Whether the built-in Usage tab summary block has anything to show. */
     get settingsCostSummaryVisible() {
-        var _a;
-        void this.chatConfig;
-        const cost = this.resolvedCostHistory;
-        if (cost.showCost)
-            return true;
-        if (cost.showTokens)
-            return true;
-        if (((_a = this.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.showActiveModel) !== false && this.providerStatuses.length > 0) {
-            return true;
-        }
-        return !!this.liveCostSessionTitle;
+        return this.settings.costSummaryVisible;
     }
     /**
-     * Whether the lifetime-usage section has anything to say.
-     *
-     * Requires build history: with it off there are no rows, so `cumulativeUsage` falls back to
-     * the live session and the section would restate the block directly below it under a
-     * "lifetime" heading it hasn't earned.
+     * Whether the lifetime-usage section has anything to say. Requires build history
+     * AND a resolvable state key — see `SettingsModalController.costLifetimeVisible`.
      */
     get settingsCostLifetimeVisible() {
-        void this.chatConfig;
-        void this._sessionRef;
-        const cost = this.resolvedCostHistory;
-        if (!cost.enabled || !(cost.showCost || cost.showTokens))
-            return false;
-        // Also requires a state key, because `finalizeCostSession` skips the write without one and the
-        // lifetime figures sum rows only — so the section would show a permanent $0.00 directly above
-        // a live block reporting real spend.
-        //
-        // Narrow in practice: `getStateKey` falls back to `id::headerTitle`, and `headerTitle` has a
-        // non-empty default, so a key is almost always derivable even with no `session-key`. This
-        // catches the remaining case — a host that supplies no session key, no element id, AND blanks
-        // the header title. Cheap, and the alternative is a figure that is simply wrong.
-        return !!this.getStateKey();
+        return this.settings.costLifetimeVisible;
     }
     /** Whether the Usage tab should appear in the settings modal. */
     get settingsCostTabVisible() {
-        void this.chatConfig;
-        const cost = this.resolvedCostHistory;
-        return (cost.showCost ||
-            cost.showTokens ||
-            this.settingsCostCurrentSectionVisible ||
-            this.settingsCostHistorySectionVisible);
+        return this.settings.costTabVisible;
     }
     /** Whether session token usage should render on the Usage tab. */
     get settingsSessionTokensVisible() {
-        void this.chatConfig;
-        return this.resolvedCostHistory.showTokens;
+        return this.settings.sessionTokensVisible;
     }
     /** Whether the chat header (and settings cog) should render. */
     get settingsCogVisible() {
-        void this.chatConfig;
-        const ui = this.chatConfig.ui;
-        const cost = this.resolvedCostHistory;
-        return (!!this.popoutMode ||
-            !!this.headerTitle ||
-            (ui === null || ui === void 0 ? void 0 : ui.showToolCalls) != null ||
-            (ui === null || ui === void 0 ? void 0 : ui.showThinkingSteps) != null ||
-            (ui === null || ui === void 0 ? void 0 : ui.showNarration) != null ||
-            (ui === null || ui === void 0 ? void 0 : ui.showAgentSwitchIndicator) != null ||
-            (ui === null || ui === void 0 ? void 0 : ui.allowDebugDownload) === true ||
-            (ui === null || ui === void 0 ? void 0 : ui.animations) != null ||
-            cost.showCost ||
-            cost.showTokens ||
-            (ui === null || ui === void 0 ? void 0 : ui.showContextUsage) !== false ||
-            (ui === null || ui === void 0 ? void 0 : ui.showActiveModel) !== false ||
-            this.visibleAppSettingsToggles.length > 0);
+        return this.settings.cogVisible;
     }
     openSettingsModal() {
-        this.logMeta('panel.toggled', { panel: 'settings', open: true });
-        // The meter refreshes per turn, which a user staring at the modal cannot
-        // see — ask the host for fresh figures at the moment they start looking.
-        this.requestBudgetRefresh();
-        this.settingsModalTab = 'settings';
-        this.settingsOpen = true;
-        const show = () => {
-            if (!this.settingsOpen)
-                return;
-            if (this.settingsModal) {
-                if (this.settingsModal.open)
-                    return;
-                this.settingsModal.show();
-                requestAnimationFrame(() => this.resetSettingsModalTabsOnOpen());
-            }
-            else {
-                DOM.queueUpdate(show);
-            }
-        };
-        DOM.queueUpdate(show);
+        this.settings.openModal();
     }
     closeSettingsModal() {
-        var _a;
-        this.logMeta('panel.toggled', { panel: 'settings', open: false });
-        if ((_a = this.settingsModal) === null || _a === void 0 ? void 0 : _a.open) {
-            this.settingsModal.close();
-            return;
-        }
-        this.settingsModalTab = 'settings';
-        this.settingsOpen = false;
+        this.settings.closeModal();
     }
     onSettingsModalClosed() {
-        this.settingsModalTab = 'settings';
-        this.settingsOpen = false;
-        requestAnimationFrame(() => this.resetSettingsModalTabsOnClose());
+        this.settings.onClosed();
     }
     setSettingsModalTab(tab) {
-        if (tab === 'cost' && !this.settingsCostTabVisible)
-            return;
-        this.settingsModalTab = tab;
+        this.settings.setTab(tab);
     }
     /** Sync the active settings modal tab when the design-system tab bar changes. */
     onSettingsModalTabsChange(event) {
-        var _a;
-        const id = (_a = event.detail) === null || _a === void 0 ? void 0 : _a.id;
-        if (id === 'settings' || id === 'cost') {
-            this.setSettingsModalTab(id);
-        }
-    }
-    /** Ensure the settings tab is selected when the modal opens. */
-    resetSettingsModalTabsOnOpen() {
-        this.settingsModalTab = 'settings';
-        const tabs = this.settingsTabsEl;
-        if (!tabs)
-            return;
-        const settingsTab = tabs.querySelector('[id="settings"]');
-        const costTab = tabs.querySelector('[id="cost"]');
-        if (costTab instanceof HTMLElement && costTab.getAttribute('aria-selected') === 'true') {
-            settingsTab instanceof HTMLElement && settingsTab.click();
-            return;
-        }
-        if (settingsTab instanceof HTMLElement &&
-            settingsTab.getAttribute('aria-selected') !== 'true') {
-            settingsTab.click();
-            return;
-        }
-        this.snapSettingsModalTabIndicator();
-    }
-    /** Return to the settings tab when the modal closes on Cost. */
-    resetSettingsModalTabsOnClose() {
-        const tabs = this.settingsTabsEl;
-        if (!tabs)
-            return;
-        const settingsTab = tabs.querySelector('[id="settings"]');
-        const costTab = tabs.querySelector('[id="cost"]');
-        if (costTab instanceof HTMLElement && costTab.getAttribute('aria-selected') === 'true') {
-            settingsTab instanceof HTMLElement && settingsTab.click();
-        }
-        this.snapSettingsModalTabIndicator();
-    }
-    /**
-     * Snap the tab underline to the settings tab without animating from Cost.
-     * Used after hide/show when aria state is correct but the indicator drifted.
-     */
-    snapSettingsModalTabIndicator(retry = true) {
-        var _a;
-        const tabs = this.settingsTabsEl;
-        if (!tabs)
-            return;
-        const settingsIndex = 0;
-        const indicator = (_a = tabs.shadowRoot) === null || _a === void 0 ? void 0 : _a.querySelector('.activeIndicator');
-        if (!indicator) {
-            if (retry)
-                DOM.queueUpdate(() => this.snapSettingsModalTabIndicator(false));
-            return;
-        }
-        const internal = tabs;
-        indicator.style.gridColumn = `${settingsIndex + 1}`;
-        indicator.style.transform = 'translateX(0px)';
-        indicator.classList.remove('activeIndicatorTransition');
-        internal.ticking = false;
-        internal.prevActiveTabIndex = settingsIndex;
-        internal.activeTabIndex = settingsIndex;
+        this.settings.onTabsChange(event);
     }
     /** Hint text for the currently pinned agent, if any. Used in the toggle button tooltip. */
     get pinnedAgentHint() {
@@ -4608,112 +3263,30 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         ];
     }
     /**
-     * The single `meta-snapshot` entry for right now — the export-time `meta` block
-     * (agent summary, active prompt/state, context + cost) plus the `dedupSignature`
-     * the forward-capture delta keys on.
+     * The `meta-snapshot` entry for right now. The assembly is a pure transformation
+     * in `buildMetaSnapshot`; this gathers what it reports.
      *
-     * Separate from `buildDiagnosticEntries` because the download path needs a
-     * FRESH one on its own: the persisted stream only re-appends this block when the
-     * near-static config changes, so the newest stored snapshot's volatile half — the
-     * `context` figures especially — is typically frozen at the session's first flush.
+     * The live agent comes from the DRIVER, not `this.activeAgent` (the redux-stripped
+     * projection, no functions) and not a lookup in `this.agents` (which may mint
+     * fresh, never-activated configs) — only the driver holds the instance whose
+     * `onActivate` ran, so only its `getDebugSnapshot` closure holds state.
      */
     buildMetaSnapshot() {
-        var _a, _b, _c, _d, _e, _f, _g, _h;
-        const timestamp = new Date().toISOString().replace(/:/g, '-');
-        // Snapshot the live active agent from the DRIVER — the instance whose
-        // `onActivate` ran, so its `getDebugSnapshot` closure holds state.
-        // `this.activeAgent` is the redux-stripped projection (no functions), and
-        // `this.agents` may mint fresh, never-activated configs (e.g. the showcase).
-        const liveActiveAgent = (_b = (_a = this.driver) === null || _a === void 0 ? void 0 : _a.getActiveAgent) === null || _b === void 0 ? void 0 : _b.call(_a);
-        let activeDebugSnapshot;
-        try {
-            activeDebugSnapshot = (_c = liveActiveAgent === null || liveActiveAgent === void 0 ? void 0 : liveActiveAgent.getDebugSnapshot) === null || _c === void 0 ? void 0 : _c.call(liveActiveAgent);
-        }
-        catch (e) {
-            activeDebugSnapshot = `<getDebugSnapshot threw: ${e instanceof Error ? e.message : String(e)}>`;
-        }
-        const contextUsagePercent = this.contextTokens != null && this.contextLimit != null && this.contextLimit > 0
-            ? Math.round((this.contextTokens / this.contextLimit) * 100)
-            : undefined;
-        // The export-time `meta` block, carried on a `meta-snapshot` entry so it lives
-        // in the same forward stream (the latest one wins on reassembly, and the
-        // accumulated history exposes config/state evolution across the lifetime).
-        const metaSnapshot = {
-            kind: 'meta-snapshot',
-            timestamp: new Date().toISOString(),
-            meta: {
-                timestamp,
-                host: window.location.host,
-                // stripAgentHandlers drops every function-valued field (handlers, lifecycle
-                // hooks, onUnresolvedTool, function-form resolvers) AND object handler bags
-                // like an object-form `toolHandlers`, and recurses subAgents — no manual
-                // exclusion list to keep in sync. We only override toolDefinitions
-                // afterwards to expand the fold tree for the log.
-                agentSummary: (_d = this.agents) === null || _d === void 0 ? void 0 : _d.map((a) => {
-                    var _a;
-                    return (Object.assign(Object.assign({}, stripAgentHandlers(a)), { toolDefinitions: Array.isArray(a.toolDefinitions)
-                            ? typeof a.toolHandlers === 'function'
-                                ? // Static defs + dynamic handlers — can't walk fold tree
-                                    // because the handler map isn't materialized at log time.
-                                    a.toolDefinitions
-                                : expandToolTree(a.toolDefinitions, (_a = a.toolHandlers) !== null && _a !== void 0 ? _a : {})
-                            : typeof a.toolDefinitions === 'function'
-                                ? '<dynamic — resolved per turn>'
-                                : [] }));
-                }),
-                activeSystemPrompt: typeof ((_e = this.activeAgent) === null || _e === void 0 ? void 0 : _e.systemPrompt) === 'function'
-                    ? '<dynamic — resolved per turn>'
-                    : (_f = this.activeAgent) === null || _f === void 0 ? void 0 : _f.systemPrompt,
-                activePrimerHistory: (_g = this.activeAgent) === null || _g === void 0 ? void 0 : _g.primerHistory,
-                activeFoldStack: this.driver instanceof ChatDriver ? this.driver.getActiveFoldNames() : undefined,
-                // Context window + cost snapshot. `sessionCostUsd` is the chat-scoped
-                // total (per-message `cost` summed); the transport's lifetime cost is
-                // not included here because it pools other call sites (suggestions,
-                // criteria interpretation, etc.) and would be misleading next to the
-                // chat-only token counts.
-                context: {
-                    model: this.activeModel,
-                    contextTokens: this.contextTokens,
-                    contextLimit: this.contextLimit,
-                    contextUsagePercent,
-                    sessionCostUsd: this.sessionCostUsd,
-                    sessionTokensConsumed: this.sessionTokensConsumed,
-                    // The per-bucket split alongside the total. Without it a log shows a large
-                    // token count next to a small cost with no way to tell why — the answer is
-                    // almost always that most of the prompt was a cache hit.
-                    sessionUsage: this.sessionUsage,
-                },
-                // Snapshot captured fresh at log-export time — reflects state NOW, which
-                // may have transitioned since the last LLM call.
-                activeDebugSnapshot,
-                debug: (_h = this.debugStateFactory) === null || _h === void 0 ? void 0 : _h.call(this),
-            },
-        };
-        // Stable dedup signature for the forward-capture stream (GENC-1351 §5.8 / #12):
-        // the near-static config only. Excludes the volatile fields — the export
-        // `timestamp`, the per-turn `context` (tokens/cost), and the live
-        // `activeDebugSnapshot` — whose churn otherwise made the whole-`meta` dedup key
-        // differ on every throttled flush, so a bulky snapshot was re-appended each time
-        // instead of "only when the block actually changed". The volatile evolution is
-        // already in the timeline (turn snapshots + `context.updated` events), so the
-        // persister only needs a fresh meta-snapshot when the config/prompt changes.
-        // Consequence for the download path: the newest STORED snapshot's context/cost
-        // figures are stale, which is why `buildDownloadLog` appends a fresh one.
-        //
-        // DIGESTED rather than stored verbatim (GENC-1566). The projection is right; keeping a
-        // full copy of it was not. It is only ever compared for equality, and `agentSummary`
-        // alone was 159 KB in the session that prompted this — so each snapshot carried the
-        // block plus a stringified copy of most of it, and both went up the wire on every
-        // flush. See {@link configDigest} for the hash and why a collision is harmless here.
-        const m = metaSnapshot.meta;
-        metaSnapshot.dedupSignature = configDigest(JSON.stringify({
-            host: m.host,
-            agentSummary: m.agentSummary,
-            activeSystemPrompt: m.activeSystemPrompt,
-            activePrimerHistory: m.activePrimerHistory,
-            activeFoldStack: m.activeFoldStack,
-        }));
-        return metaSnapshot;
+        var _a, _b, _c;
+        return buildMetaSnapshot({
+            agents: this.agents,
+            activeAgent: this.activeAgent,
+            liveActiveAgent: (_b = (_a = this.driver) === null || _a === void 0 ? void 0 : _a.getActiveAgent) === null || _b === void 0 ? void 0 : _b.call(_a),
+            activeFoldStack: this.driver instanceof ChatDriver ? this.driver.getActiveFoldNames() : undefined,
+            activeModel: this.activeModel,
+            contextTokens: this.contextTokens,
+            contextLimit: this.contextLimit,
+            sessionCostUsd: this.sessionCostUsd,
+            sessionTokensConsumed: this.sessionTokensConsumed,
+            sessionUsage: this.sessionUsage,
+            debugState: (_c = this.debugStateFactory) === null || _c === void 0 ? void 0 : _c.call(this),
+            host: window.location.host,
+        });
     }
     downloadDebugLog() {
         return __awaiter(this, void 0, void 0, function* () {
@@ -4946,146 +3519,16 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
         });
     }
     triggerFileInput() {
-        var _a, _b;
-        (_b = (_a = this.shadowRoot) === null || _a === void 0 ? void 0 : _a.querySelector('.file-input')) === null || _b === void 0 ? void 0 : _b.click();
+        this.attachmentCtrl.triggerFileInput();
     }
     handleFileSelect(e) {
-        void this.loadSelectedFiles(e);
+        this.attachmentCtrl.handleFileSelect(e);
     }
     removeAttachment(attachment) {
-        this.attachments = this.attachments.filter((a) => a !== attachment);
+        this.attachmentCtrl.remove(attachment);
     }
     removeAttachmentError(message) {
-        const idx = this.attachmentErrors.indexOf(message);
-        if (idx !== -1) {
-            this.attachmentErrors = [
-                ...this.attachmentErrors.slice(0, idx),
-                ...this.attachmentErrors.slice(idx + 1),
-            ];
-        }
-    }
-    isAcceptedFile(file) {
-        var _a, _b, _c;
-        const accepted = (_a = this.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.acceptedFiles;
-        if (!accepted)
-            return false;
-        const acceptedList = accepted.split(',').map((s) => s.trim().toLowerCase());
-        const ext = `.${(_c = (_b = file.name.split('.').pop()) === null || _b === void 0 ? void 0 : _b.toLowerCase()) !== null && _c !== void 0 ? _c : ''}`;
-        return acceptedList.some((a) => a === ext ||
-            a === file.type ||
-            (a.endsWith('/*') && file.type.startsWith(a.replace('/*', '/'))));
-    }
-    // Blob's own promise APIs, not FileReader: UTF-8 only (a `charset` parameter on the blob's
-    // type is ignored, where FileReader would honour it), and they exist in the node test runtime
-    // too — FileReader does not, so neither reader was testable before.
-    readFileAsText(file) {
-        return file.text();
-    }
-    /** The base64 payload of a file, without any `data:` prefix — the raw form
-     *  `ChatImageAttachment.data` specifies (transports add their own framing). */
-    readFileAsBase64(file) {
-        return __awaiter(this, void 0, void 0, function* () {
-            const bytes = new Uint8Array(yield file.arrayBuffer());
-            let binary = '';
-            const CHUNK = 0x8000;
-            for (let i = 0; i < bytes.length; i += CHUNK) {
-                binary += String.fromCharCode(...bytes.subarray(i, i + CHUNK));
-            }
-            return btoa(binary);
-        });
-    }
-    processFiles(files_1) {
-        return __awaiter(this, arguments, void 0, function* (files, existingBytes = 0) {
-            // Budget the batch BEFORE reading any of it. `file.size` needs no I/O, so the verdict is
-            // deterministic and in the user's own pick order; deciding inside the parallel map below would
-            // hand the last slot to whichever read happened to finish first. `existingBytes` is what the
-            // caller has already committed to — the picker appends to a running list, so its files have to
-            // count against what is already attached rather than starting from zero each time.
-            let running = existingBytes;
-            const overBudget = new Map();
-            for (const file of files) {
-                if (running + file.size > MAX_ATTACHMENTS_TOTAL_BYTES) {
-                    overBudget.set(file, `"${file.name}" would take this message past the ` +
-                        `${MAX_ATTACHMENTS_TOTAL_BYTES / BYTES_PER_MB}MB attachment limit ` +
-                        `(${(running / BYTES_PER_MB).toFixed(1)}MB already attached).`);
-                    continue;
-                }
-                running += file.size;
-            }
-            const results = yield Promise.all(files.map((file) => __awaiter(this, void 0, void 0, function* () {
-                if (!this.isAcceptedFile(file)) {
-                    return { ok: false, message: `"${file.name}" is not an accepted file type.` };
-                }
-                const tooMuch = overBudget.get(file);
-                if (tooMuch)
-                    return { ok: false, message: tooMuch };
-                try {
-                    // An image file becomes a real image attachment — the transports render those as
-                    // image blocks the model SEES. Reading it as text (the only path that existed)
-                    // produced mojibake the model "read" as prose: an accepted .png was worse than a
-                    // rejected one. Text stays the default for everything else.
-                    //
-                    // Only the types the vendors actually accept take this branch. `image/*` covers far
-                    // more than that, and sending one an API rejects fails the whole turn the user is
-                    // waiting on — where the text branch merely degrades. It also keeps SVG working:
-                    // SVG *is* text, and reading it as such gives the model something it can genuinely
-                    // read, which a base64 image block of it would not.
-                    if (VENDOR_IMAGE_MIME_TYPES.has(file.type.toLowerCase())) {
-                        if (file.size > MAX_IMAGE_ATTACHMENT_BYTES) {
-                            return {
-                                ok: false,
-                                message: `"${file.name}" is ${Math.ceil(file.size / BYTES_PER_MB)}MB; images are limited to ` +
-                                    `${MAX_IMAGE_ATTACHMENT_BYTES / BYTES_PER_MB}MB.`,
-                            };
-                        }
-                        const data = yield this.readFileAsBase64(file);
-                        return {
-                            ok: true,
-                            attachment: { kind: 'image', name: file.name, mimeType: file.type, data },
-                        };
-                    }
-                    const content = yield this.readFileAsText(file);
-                    return {
-                        ok: true,
-                        attachment: { name: file.name, content, mimeType: file.type || 'text/plain' },
-                    };
-                }
-                catch (readError) {
-                    logger.error('Failed to read file:', readError);
-                    this.logMeta('file.read-failed', {
-                        file: file.name,
-                        message: readError instanceof Error ? readError.message : String(readError),
-                    });
-                    return { ok: false, message: `Failed to read "${file.name}".` };
-                }
-            })));
-            return {
-                attachments: results
-                    .filter((r) => r.ok)
-                    .map((r) => r.attachment),
-                errors: results
-                    .filter((r) => !r.ok)
-                    .map((r) => r.message),
-            };
-        });
-    }
-    loadSelectedFiles(e) {
-        return __awaiter(this, void 0, void 0, function* () {
-            var _a;
-            const input = e.target;
-            const files = Array.from((_a = input.files) !== null && _a !== void 0 ? _a : []);
-            input.value = '';
-            const { attachments, errors } = yield this.processFiles(files, this.attachments.reduce((n, a) => n + attachmentBytes(a), 0));
-            if (attachments.length) {
-                this.attachments = [...this.attachments, ...attachments];
-                this.logMeta('attachment.added', {
-                    count: attachments.length,
-                    names: attachments.map((a) => a.name),
-                });
-            }
-            if (errors.length)
-                this.attachmentErrors = [...this.attachmentErrors, ...errors];
-        });
+        this.attachmentCtrl.dismissError(message);
     }
     handleSendClick() {
         this.send();
@@ -5141,7 +3584,7 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             }
             let nextAttachments = [];
             if ((_a = input.files) === null || _a === void 0 ? void 0 : _a.length) {
-                const { attachments, errors } = yield this.processFiles(input.files);
+                const { attachments, errors } = yield this.attachmentCtrl.process(input.files);
                 // State may have flipped to 'loading' during the async file processing
                 // (e.g. a concurrent send via the composer). Re-check before committing
                 // any composer state. Beyond this point execution is synchronous up to
@@ -5260,10 +3703,8 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
             // which in turn triggers the _executionCompletionUnsub subscription on whichever
             // element is currently active (e.g. the collapse-mode element after docking).
             const capturedSessionRef = this._sessionRef;
-            const pendingAttachments = this.attachments.length ? [...this.attachments] : undefined;
+            const pendingAttachments = this.attachmentCtrl.take();
             this.inputValue = '';
-            this.attachments = [];
-            this.attachmentErrors = [];
             this.suggestionsState = { status: 'idle' };
             this._userScrolledAway = false;
             // Close the picker on send — the toggle button is disabled during loading,
@@ -5283,10 +3724,10 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
                 // locks without waiting on the host's next pre-flight. The bus subscription
                 // in `connectedCallback` covers most walls; this covers the one it cannot —
                 // a wall hit during multi-agent classification, where no tool loop ran and
-                // so no `tool-loop-end` was published. `latchBlockedFrom` is idempotent, so
+                // so no `tool-loop-end` was published. `latchFrom` is idempotent, so
                 // the two seams overlapping is harmless.
                 if ((result === null || result === void 0 ? void 0 : result.reason) === 'done') {
-                    this.latchBlockedFrom(result.failureReason, capturedSessionRef, result.budget);
+                    this.budget.latchFrom(result.failureReason, capturedSessionRef, result.budget);
                 }
             }
             finally {
@@ -5392,58 +3833,22 @@ let FoundationAiAssistant = FoundationAiAssistant_1 = class FoundationAiAssistan
     get sendButtonVisible() {
         return !this.stopButtonVisible;
     }
-    /** Whether the message input shows a drag handle to resize its height.
-     * On by default; hosts opt out via `chatConfig.ui.resizableInput: false`. */
+    /** Whether the message input shows a drag handle to resize its height. */
     get isComposerResizable() {
-        var _a;
-        return ((_a = this.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.resizableInput) !== false;
+        return this.composerResize.resizable;
     }
-    /** Inline style for the chat input: writes the chosen height into the
-     * `--composer-height` custom property (read by `.chat-input` + its control in
-     * `main.styles.ts`). Empty until the user drags (or when resizing is disabled),
-     * so the default applies. */
+    /** Inline style carrying the dragged height into `--composer-height`. */
     get composerHeightStyle() {
-        return this.isComposerResizable && this.composerHeightPx != null
-            ? `--composer-height: ${this.composerHeightPx}px`
-            : '';
+        return this.composerResize.heightStyle;
     }
-    /** Begin a composer resize drag. Captures the pointer so move/up keep firing
-     * on the handle even when the cursor leaves its 7px band. */
     onComposerResizeStart(e) {
-        var _a, _b, _c, _d, _e;
-        const measured = (_b = (_a = this.chatInputEl) === null || _a === void 0 ? void 0 : _a.getBoundingClientRect().height) !== null && _b !== void 0 ? _b : COMPOSER_MIN_HEIGHT_PX;
-        // First drag (no explicit height yet) measures the natural height — the
-        // floor for shrinking, so the box never goes below where it started.
-        if (this.composerHeightPx == null)
-            this._composerNaturalHeight = measured;
-        this._resizeStartY = e.clientY;
-        this._resizeStartHeight = (_c = this.composerHeightPx) !== null && _c !== void 0 ? _c : measured;
-        // Cap growth to the headroom currently above the composer: the message
-        // list can yield all but a visible strip of its height. The pool (composer
-        // + messages) is fixed for the duration of one drag, so measuring once here
-        // is correct throughout the gesture.
-        const messagesHeight = (_e = (_d = this.messagesEl) === null || _d === void 0 ? void 0 : _d.getBoundingClientRect().height) !== null && _e !== void 0 ? _e : COMPOSER_MAX_HEIGHT_PX;
-        this._resizeMaxHeight = Math.min(COMPOSER_MAX_HEIGHT_PX, this._resizeStartHeight + Math.max(0, messagesHeight - COMPOSER_MIN_MESSAGES_PX));
-        e.currentTarget.setPointerCapture(e.pointerId);
-    }
-    /** Resize while dragging. Dragging up (clientY decreases) grows the composer;
-     * the result is clamped between the natural height (lower) and the available
-     * headroom/max (upper). No-op unless a drag is active (the handle holds pointer
-     * capture), so plain hover-moves are ignored. */
+        this.composerResize.onStart(e);
+    }
     onComposerResizeMove(e) {
-        const handle = e.currentTarget;
-        if (!handle.hasPointerCapture(e.pointerId))
-            return;
-        const min = Math.max(COMPOSER_MIN_HEIGHT_PX, Math.round(this._composerNaturalHeight));
-        const max = Math.max(min, Math.round(this._resizeMaxHeight));
-        const next = this._resizeStartHeight + (this._resizeStartY - e.clientY);
-        this.composerHeightPx = Math.max(min, Math.min(max, Math.round(next)));
+        this.composerResize.onMove(e);
     }
-    /** End a resize drag and release the pointer capture. */
     onComposerResizeEnd(e) {
-        const handle = e.currentTarget;
-        if (handle.hasPointerCapture(e.pointerId))
-            handle.releasePointerCapture(e.pointerId);
+        this.composerResize.onEnd(e);
     }
 };
 FoundationAiAssistant.SCROLL_BOTTOM_THRESHOLD_PX = 50;
@@ -5452,16 +3857,6 @@ FoundationAiAssistant.CONTEXT_USAGE_WARN_PERCENT = 80;
 FoundationAiAssistant.DEFAULT_LOADING_DELAY_S = 0;
 FoundationAiAssistant.DEFAULT_SUGGESTION_COUNT = 3;
 FoundationAiAssistant.MS_PER_SECOND = 1000;
-/**
- * Vertical space an open menu must leave free above the button, covering BOTH
- * the gap the menu sits off the button by (8px, declared in design units in
- * main.styles.ts) and the breathing room wanted above it. The two are lumped
- * together because only the second half is a free choice: the first is fixed by
- * the stylesheet and simply has to be subtracted from the headroom, and a
- * constant named for only one of them invites someone to "fix" a gap that is
- * doing exactly what it should.
- */
-FoundationAiAssistant.MENU_HEADROOM_RESERVE = 20;
 __decorate([
     AIProviderRegistry
 ], FoundationAiAssistant.prototype, "providerRegistry", void 0);
@@ -5528,78 +3923,15 @@ __decorate([
 __decorate([
     volatile
 ], FoundationAiAssistant.prototype, "busy", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "blocked", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "reachableVendors", null);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "budgetMeterLastFedAt", void 0);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsBudgetUpdatedLabel", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "relevantBlockedVendors", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "bannerVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "suggestionsBlocked", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "activeVendor", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "effectiveBlockedReason", null);
 __decorate([
     volatile
 ], FoundationAiAssistant.prototype, "effectiveChatInputDuringExecution", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "uniqueProviderModels", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "sortedCostSessionHistory", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "cumulativeUsage", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "cumulativeCostUsd", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "liveUsageIsProjectLifetime", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "resolvedCostHistory", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "liveCostSessionTitle", null);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "attachments", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "attachmentErrors", void 0);
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "showLoadingIndicator", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "appSettingsRevision", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "settingsOpen", void 0);
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "downloadingDebugLog", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "settingsModalTab", void 0);
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "persistenceBroken", void 0);
@@ -5609,27 +3941,9 @@ __decorate([
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "persistenceBrokenDetail", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "settingsModelSlotted", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "settingsAppSlotted", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "settingsCostCurrentSlotted", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "settingsCostHistorySlotted", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "costSessionHistory", void 0);
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "showingSplash", void 0);
-__decorate([
-    observable
-], FoundationAiAssistant.prototype, "composerHeightPx", void 0);
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "isEngaged", void 0);
@@ -5639,9 +3953,6 @@ __decorate([
 __decorate([
     volatile
 ], FoundationAiAssistant.prototype, "visibleMessages", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "contextGuardPolicy", null);
 __decorate([
     observable
 ], FoundationAiAssistant.prototype, "confirmingClear", void 0);
@@ -5663,90 +3974,12 @@ __decorate([
 __decorate([
     volatile
 ], FoundationAiAssistant.prototype, "persistenceActive", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "contextBudget", null);
 __decorate([
     volatile
 ], FoundationAiAssistant.prototype, "contextReserve", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "compactionPlan", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "compactHint", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "contextBlockCause", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "contextGate", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "contextGateReason", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "contextGateLabel", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "composerNoticeVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "composerNoticeText", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "composerNoticeSrOnly", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "compactable", null);
 __decorate([
     volatile
 ], FoundationAiAssistant.prototype, "agentPickerEnabled", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsModelSectionVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsContextUsageVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsBudgetUsageVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsBudgetRows", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsAppSectionVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "visibleAppSettingsToggles", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "appSettingsTogglesHeading", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsCostCurrentSectionVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsCostHistorySectionVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsCostHistoryHeadingVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsCostSummaryVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsCostLifetimeVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsCostTabVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsSessionTokensVisible", null);
-__decorate([
-    volatile
-], FoundationAiAssistant.prototype, "settingsCogVisible", null);
 __decorate([
     volatile
 ], FoundationAiAssistant.prototype, "pinnedAgentHint", null);