@pellux/goodvibes-tui 1.16.0 → 1.17.0

package/src/input/commands/workstream-runtime.ts

@@ -2,7 +2,7 @@
 // workstream-runtime.ts — /workstream
 //
 // UX over the OrchestrationEngine (@pellux/goodvibes-sdk/platform/orchestration,
-// wo701/W4.1) via its command-facing facade wired onto RuntimeServices as
+//) via its command-facing facade wired onto RuntimeServices as
 // `workstreamCommands` (src/runtime/workstream-services.ts) and threaded
 // through CommandContext.session.workstreamEngine exactly like wrfcController
 // already is (bootstrap-command-context.ts).
@@ -21,7 +21,7 @@
 // pre-creation "draft" concept, so approval happens on a TUI-held draft
 // (workstream-services.ts's WorkstreamDraft) before anything is created in
 // the engine at all — see that module's header doc for the full reality-wins
-// divergence from the wo703 design brief.
+// divergence from the design brief.
 // ---------------------------------------------------------------------------
 
 import { AdaptivePlanner } from '@pellux/goodvibes-sdk/platform/core';

package/src/input/commands.ts

@@ -36,7 +36,6 @@ import { registerRemoteRuntimeCommands } from './commands/remote-runtime.ts';
 import { registerTeleportRuntimeCommands } from './commands/teleport-runtime.ts';
 import { registerSubscriptionRuntimeCommands } from './commands/subscription-runtime.ts';
 import { registerHooksRuntimeCommands } from './commands/hooks-runtime.ts';
-import { registerFlagsRuntimeCommands } from './commands/flags-runtime.ts';
 import { registerEditorRuntimeCommands } from './commands/editor-runtime.ts';
 import { registerControlRoomRuntimeCommands } from './commands/control-room-runtime.ts';
 import { registerMcpRuntimeCommands } from './commands/mcp-runtime.ts';
@@ -121,7 +120,6 @@ export const BUILTIN_COMMAND_GROUPS: readonly BuiltinCommandGroup[] = [
   { category: 'Remote', register: registerTeleportRuntimeCommands },
   { category: 'Subscriptions', register: registerSubscriptionRuntimeCommands },
   { category: 'Hooks', register: registerHooksRuntimeCommands },
-  { category: 'Feature Flags', register: registerFlagsRuntimeCommands },
   { category: 'Editor', register: registerEditorRuntimeCommands },
   { category: 'Control Room', register: registerControlRoomRuntimeCommands },
   { category: 'MCP', register: registerMcpRuntimeCommands },

package/src/input/config-modal-types.ts

@@ -1,9 +1,9 @@
 import type { ModalSectionStyle } from '../renderer/modal-factory.ts';
 
 /**
- * Config-modal host — the shared seam every W6.1 MIGRATE-TO-MODAL surface
+ * Config-modal host — the shared seam every MIGRATE-TO-MODAL surface
  * (provider-health, services, subscription, remote, local-auth, settings-sync,
- * sandbox, and the WO-B ecosystem/governance set) is expressed through.
+ * sandbox, and the ecosystem/governance set) is expressed through.
  *
  * A surface is PURE DATA + ACTIONS: it hands the host a `buildView()` that maps
  * live read-models to a tabbed, list-structured view, plus a declarative action
@@ -114,7 +114,7 @@ export interface ConfigModalAction {
    * Trigger key: a single printable char ('r', 'd') or a named key ('enter').
    * Must not collide with the host-reserved nav keys (up/down/left/right/tab/
    * j/k/escape/'/') — those are consumed by the host before actions are
-   * consulted. '/' arms the host's type-to-filter (DEBT-5 item 1); while
+   * consulted. '/' arms the host's type-to-filter (item 1); while
    * filtering, EVERY printable key (not just j/k) is captured by the query
    * instead of firing an action — see handleConfigModalToken.
    */

package/src/input/config-modal.ts

@@ -66,7 +66,7 @@ const DEFAULT_VISIBLE_ROWS = 10;
 const DEFAULT_LABEL_WRAP_WIDTH = 70;
 
 /**
- * Stable id for the synthesized "no matches" row DEBT-5 item 1 injects when a
+ * Stable id for the synthesized "no matches" row item 1 injects when a
  * filter query excludes every selectable row in a tab. Non-selectable (info
  * rows are never filtered — see ConfigModal's filter doc) so this id can
  * never collide with a real surface row id.
@@ -97,7 +97,7 @@ export class ConfigModal {
   private pendingConfirmKey: string | null = null;
 
   /**
-   * DEBT-5 item 1 — the host's own type-to-filter, armed with '/' (matching
+   * item 1 — the host's own type-to-filter, armed with '/' (matching
    * the pre-existing "'/' to filter" convention: scrollable-list-panel.ts's
    * opt-in filter, and SettingsModal's own '/'-armed search). `filterActive`
    * gates whether printable keys go to the query instead of nav/actions;
@@ -111,11 +111,11 @@ export class ConfigModal {
    *   - '/'-ARMED here (config-modal host surfaces): these surfaces bind PLAIN
    *     single keys to ACTION HOTKEYS (e.g. 'r' refresh, 'd' delete). A key
    *     can't be both an action and a filter character, so filtering must be
-   *     explicitly armed with '/' first. This is DEBT-5's design.
+   *     explicitly armed with '/' first. This is a deliberate design choice.
    *   - INSTANT filtering (pure pickers — help overlay, command palette,
    *     selection-modal): these have no single-key actions, so every printable
    *     key is unambiguously a filter character and narrows the list on the
-   *     first keystroke. This is UX-C's design (selection-modal-overlay.ts).
+   *     first keystroke. This is a deliberate design choice (selection-modal-overlay.ts).
    *   - Both keep single-Esc-close semantics. The only extra step is here: a
    *     two-stage Esc (first Esc clears a NON-EMPTY query, second Esc closes)
    *     — see the Esc branch in handleConfigModalToken. With an empty query,
@@ -221,7 +221,7 @@ export class ConfigModal {
     this._clampScroll();
   }
 
-  // ── Filter (DEBT-5 item 1 — each mutation is an interaction boundary) ──────
+  // ── Filter (item 1 — each mutation is an interaction boundary) ──────
 
   isFilterActive(): boolean {
     return this.filterActive;
@@ -306,7 +306,7 @@ export class ConfigModal {
   private _switchTab(dir: 1 | -1): void {
     this._clearConfirm();
     // A filter query is scoped to the tab it was typed against — switching
-    // tabs resets it (DEBT-5 item 1), same as statusMessage below.
+    // tabs resets it (item 1), same as statusMessage below.
     this.filterActive = false;
     this.filterQuery = '';
     this.syncStructure();
@@ -395,8 +395,7 @@ export class ConfigModal {
    *
    * `labelWrapWidth` is the wrap column ModalFactory's list section will use
    * for row labels (renderConfigModal computes and passes the real one for
-   * the current terminal size). It exists so the wrap-clamp below (DEBT-5
-   * item 2) can pre-empt a live label growing past ModalFactory's wrap width
+   * the current terminal size). It exists so the wrap-clamp below (* item 2) can pre-empt a live label growing past ModalFactory's wrap width
    * mid-tick — a structural change (an extra visible line) without an
    * interaction — by measuring wrapped line counts here, before the label
    * ever reaches the renderer.
@@ -445,7 +444,7 @@ export class ConfigModal {
     const visible = this.visibleRows;
     const windowed = allRows.slice(this.scrollOffset, this.scrollOffset + visible);
 
-    // DEBT-5 item 1: while filtering, the surface's own action/tab hints are
+    // item 1: while filtering, the surface's own action/tab hints are
     // unreliable (their printable-letter keys are captured by the filter
     // instead of firing — see handleConfigModalToken), so the footer swaps
     // to just the filter status (query + a truthful match count) and the
@@ -483,7 +482,7 @@ export class ConfigModal {
   // ── internals ────────────────────────────────────────────────────────────────
 
   /**
-   * DEBT-5 item 2 (wrap-clamp overlay): keep a live label within the FROZEN
+   * item 2 (wrap-clamp overlay): keep a live label within the FROZEN
    * row's line footprint until the next interaction boundary re-freezes it.
    * `frozenLabel` is what the row wrapped to when the structure was captured
    * (open/nav/filter keystroke); `liveLabel` is this tick's value. If the
@@ -526,7 +525,7 @@ export class ConfigModal {
    * empty-state copy, warning banners) always pass through unfiltered —
    * they're context, not data. When the query excludes every selectable row
    * but the tab genuinely had some, append the honest "no rows match" line
-   * (DEBT-5 item 1's empty-result case) instead of silently showing nothing
+   * (item 1's empty-result case) instead of silently showing nothing
    * or misleadingly falling back to the surface's own emptyText (which
    * describes "no data at all", not "no data matches your filter").
    */

package/src/input/feature-unit-layout.ts

@@ -1,83 +1,84 @@
 /**
- * feature-unit-layout — turns the flat "44 flags in one bucket + their config
- * keys scattered across namespace categories" layout into feature UNITS: each
- * feature flag renders as a toggle header immediately followed by the config
- * keys that tune it, hosted in the topical category its config lives under
- * (sandbox with Runtime & Data, surfaces with Surfaces & Cloud, and so on).
+ * feature-unit-layout — every platform capability renders as a feature UNIT in
+ * its settings DOMAIN: the feature's real enablement row (its domain settings
+ * key, with the feature's name and full description attached) immediately
+ * followed by the settings keys that tune it.
  *
- * Grouping metadata is sourced entirely from the SDK's FEATURE_FLAG_CONFIG map
- * (the single source of truth, completeness test-guarded SDK-side) so the three
- * surfaces that present features — the settings modal, the onboarding wizard,
- * and /flags — agree on which config keys belong to which flag.
+ * Grouping metadata is sourced entirely from the SDK's FEATURE_SETTINGS
+ * surface (the single source of truth, completeness test-guarded SDK-side):
+ * `domain` is the top-level settings namespace the feature lives in, the
+ * enablement binding carries the real option shape (boolean switch, enum mode
+ * choices, or a constant capability), and `settings` lists every key that
+ * configures the feature.
  *
- * A flag whose FEATURE_FLAG_CONFIG entry has no config keys is hosted in the
- * Advanced Features bucket as a simple toggle (genuinely internal / startup-gated
- * plumbing flags with nothing to tune).
+ * A feature-unit header is the REAL config row for the feature's enablement
+ * key — boolean headers toggle, enum headers cycle their mode choices through
+ * the ordinary settings interactions. Two features can share one enablement
+ * key (e.g. behavior.compactionStrategy drives both compaction features);
+ * each still gets its own header row so every capability keeps its own name,
+ * description, and state, all reading the same underlying key.
  */
 
-import { FEATURE_FLAG_CONFIG, FEATURE_FLAGS } from '@pellux/goodvibes-sdk/platform/runtime/state';
-import type { ConfigKey, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
-import type { FeatureFlag } from '@/runtime/index.ts';
+import { FEATURE_SETTINGS } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import type { FeatureSetting } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import type { ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import { getConfigSchemaSetting } from '../runtime/feature-settings.ts';
 import type { FlagEntry, SettingEntry, SettingsCategory } from './settings-modal-types.ts';
 
-/**
- * The category that hosts flags with no tunable config keys. Repurposed from the
- * old flat "Feature Flags" tab — it now holds only the internal/plumbing flags
- * that have nothing to configure, as simple toggles.
- */
-export const ADVANCED_FEATURES_CATEGORY: SettingsCategory = 'flags';
+/** Every enablement key — these rows render as feature headers, never as plain sub-rows. */
+const ENABLEMENT_KEYS: ReadonlySet<string> = new Set(
+  FEATURE_SETTINGS.map((feature) => feature.enablement.key),
+);
 
 /**
- * Host category for a flag's feature unit: the single top-level namespace its
- * config keys live under (verified single-namespace SDK-side), or the Advanced
- * Features bucket when the flag has no config keys.
+ * Host category for a feature unit: its settings domain (the top-level
+ * namespace of its enablement key), which is always a real settings category.
  */
-export function getFeatureUnitHostCategory(flagId: string): SettingsCategory {
-  const assoc = FEATURE_FLAG_CONFIG[flagId];
-  const namespace = assoc?.configCategories[0];
-  return (namespace ?? ADVANCED_FEATURES_CATEGORY) as SettingsCategory;
+export function getFeatureUnitHostCategory(featureId: string): SettingsCategory | null {
+  const feature = FEATURE_SETTINGS.find((candidate) => candidate.id === featureId);
+  return feature ? (feature.domain as SettingsCategory) : null;
 }
 
 /**
- * Map every config key claimed by any flag to the flag that OWNS it — the first
- * flag (in FEATURE_FLAGS declaration order) whose FEATURE_FLAG_CONFIG entry lists
- * it. A key claimed by two flags (e.g. behavior.compactionStrategy, shared by
- * session-compaction and compaction-distiller-strategy) is listed once, under its
- * owner, so no config key double-lists across feature units.
+ * Map every non-enablement settings key claimed by any feature to the feature
+ * that OWNS it — the first feature (in FEATURE_SETTINGS declaration order)
+ * whose settings list contains it. A key claimed by two features is listed
+ * once, under its owner, so no settings key double-lists across feature units.
  */
 export function buildConfigKeyOwnership(): Map<string, string> {
   const owner = new Map<string, string>();
-  for (const flag of FEATURE_FLAGS) {
-    const assoc = FEATURE_FLAG_CONFIG[flag.id];
-    if (!assoc) continue;
-    for (const key of assoc.configKeys) {
-      if (!owner.has(key)) owner.set(key, flag.id);
+  for (const feature of FEATURE_SETTINGS) {
+    for (const key of feature.settings) {
+      if (ENABLEMENT_KEYS.has(key)) continue;
+      if (!owner.has(key)) owner.set(key, feature.id);
     }
   }
   return owner;
 }
 
 /**
- * Build the synthetic SettingEntry that is a feature unit's toggle header. Its
- * key is `featureFlags.<id>` (the same override path persistFlagState writes), so
- * it round-trips through the config layer; type boolean so the existing
- * activate/adjust toggle paths drive it. currentValue mirrors the live runtime
- * state; isDefault is true when the flag sits at its declared default state (so
- * the "modified" marker shows only for an actual override). The attached
- * `flag` marks the row as a feature-unit header for rendering and interaction.
+ * Build a feature unit's header row: the REAL config row for the feature's
+ * enablement key (so booleans toggle and enums cycle their mode choices
+ * through the ordinary settings paths), cloned with the feature attached.
+ * When the category has no row for the key (it should always have one — every
+ * binding key is CONFIG_SCHEMA-registered), the schema descriptor is used
+ * directly so the header still renders honestly.
  */
-export function buildFlagHeaderEntry(entry: FlagEntry): SettingEntry {
-  const { flag, state } = entry;
-  const setting: ConfigSetting = {
-    key: `featureFlags.${flag.id}` as ConfigKey,
-    type: 'boolean',
-    default: flag.defaultState === 'enabled',
-    description: flag.description,
-  };
+export function buildFeatureHeaderEntry(entry: FlagEntry, base: SettingEntry | null): SettingEntry {
+  const feature = entry.feature;
+  const setting: ConfigSetting = base?.setting
+    ?? getConfigSchemaSetting(feature.enablement.key)
+    ?? {
+      key: feature.enablement.key,
+      type: 'boolean',
+      default: feature.defaultEnabled,
+      description: feature.description,
+    };
   return {
+    ...(base ?? {}),
     setting,
-    currentValue: state === 'enabled',
-    isDefault: state === flag.defaultState,
+    currentValue: base ? base.currentValue : setting.default,
+    isDefault: base ? base.isDefault : true,
     flag: entry,
   };
 }
@@ -88,13 +89,14 @@ function cloneOwnedEntry(entry: SettingEntry, ownerFlagId: string): SettingEntry
 }
 
 /**
- * Rewrite `groups` in place so each host category leads with its feature units
- * (flag toggle header + its owned config sub-options, in FEATURE_FLAGS order),
- * followed by the category's remaining un-owned config rows. The Advanced
- * Features category is filled with the no-config flags as bare toggles.
+ * Rewrite `groups` in place so each settings domain leads with its feature
+ * units (feature header + its owned settings sub-rows, in FEATURE_SETTINGS
+ * declaration order), followed by the category's remaining un-owned rows.
+ * The plain rows for enablement keys are consumed into the headers; cross
+ * listed copies in the combined network view keep their plain form.
  *
- * No-op when there are no flag entries (the flagless test path), leaving the
- * plain namespace-bucketed layout intact.
+ * No-op when there are no feature entries (the featureless test path),
+ * leaving the plain namespace-bucketed layout intact.
  */
 export function applyFeatureUnitLayout(
   groups: Map<SettingsCategory, SettingEntry[]>,
@@ -102,39 +104,48 @@ export function applyFeatureUnitLayout(
 ): void {
   if (flagEntries.length === 0) return;
   const owner = buildConfigKeyOwnership();
-  const flagState = new Map<string, FlagEntry>(flagEntries.map((entry) => [entry.flag.id, entry]));
+  const entryById = new Map<string, FlagEntry>(flagEntries.map((entry) => [entry.feature.id, entry]));
 
-  // Group the flags this runtime actually registered by their host category,
-  // preserving FEATURE_FLAGS declaration order within each category.
-  const flagsByCategory = new Map<SettingsCategory, FeatureFlag[]>();
-  for (const flag of FEATURE_FLAGS) {
-    if (!flagState.has(flag.id)) continue; // not registered in this runtime
-    const category = getFeatureUnitHostCategory(flag.id);
-    if (!flagsByCategory.has(category)) flagsByCategory.set(category, []);
-    flagsByCategory.get(category)!.push(flag);
+  // Group the features this runtime actually registered by their domain,
+  // preserving FEATURE_SETTINGS declaration order within each category.
+  const featuresByCategory = new Map<SettingsCategory, FeatureSetting[]>();
+  for (const feature of FEATURE_SETTINGS) {
+    if (!entryById.has(feature.id)) continue; // not registered in this runtime
+    const category = feature.domain as SettingsCategory;
+    if (!featuresByCategory.has(category)) featuresByCategory.set(category, []);
+    featuresByCategory.get(category)!.push(feature);
   }
 
-  for (const [category, flags] of flagsByCategory) {
+  for (const [category, features] of featuresByCategory) {
     const existing = groups.get(category) ?? [];
-    // Split existing config rows into those owned by a feature unit hosted here
-    // and the remaining orphan rows. An owned row's owner is guaranteed to be a
-    // flag hosted in THIS category (owned keys share the flag's namespace).
-    const ownedByFlag = new Map<string, SettingEntry[]>();
+    const rowByKey = new Map<string, SettingEntry>();
+    for (const entry of existing) {
+      if (!rowByKey.has(entry.setting.key)) rowByKey.set(entry.setting.key, entry);
+    }
+
+    // Split existing config rows: enablement rows are consumed into headers,
+    // rows owned by a feature hosted here become indented sub-rows, and the
+    // rest stay as orphan rows after the feature units.
+    const hostedEnablementKeys = new Set(features.map((feature) => feature.enablement.key));
+    const ownedByFeature = new Map<string, SettingEntry[]>();
     const orphans: SettingEntry[] = [];
     for (const entry of existing) {
-      const ownerId = owner.get(entry.setting.key);
-      if (ownerId !== undefined && flagState.has(ownerId)) {
-        if (!ownedByFlag.has(ownerId)) ownedByFlag.set(ownerId, []);
-        ownedByFlag.get(ownerId)!.push(cloneOwnedEntry(entry, ownerId));
+      const key = entry.setting.key;
+      if (hostedEnablementKeys.has(key)) continue; // consumed into header(s)
+      const ownerId = owner.get(key);
+      if (ownerId !== undefined && entryById.has(ownerId)) {
+        if (!ownedByFeature.has(ownerId)) ownedByFeature.set(ownerId, []);
+        ownedByFeature.get(ownerId)!.push(cloneOwnedEntry(entry, ownerId));
       } else {
         orphans.push(entry);
       }
     }
 
     const rebuilt: SettingEntry[] = [];
-    for (const flag of flags) {
-      rebuilt.push(buildFlagHeaderEntry(flagState.get(flag.id)!));
-      for (const sub of ownedByFlag.get(flag.id) ?? []) rebuilt.push(sub);
+    for (const feature of features) {
+      const base = rowByKey.get(feature.enablement.key) ?? null;
+      rebuilt.push(buildFeatureHeaderEntry(entryById.get(feature.id)!, base));
+      for (const sub of ownedByFeature.get(feature.id) ?? []) rebuilt.push(sub);
     }
     rebuilt.push(...orphans);
     groups.set(category, rebuilt);

package/src/input/feed-context-factory.ts

@@ -90,7 +90,7 @@ export interface FeedContextMutableInit {
  *   - `commandRegistry`, `commandContext`, `autocomplete`, `inputHistory`,
  *     `conversationManager` — wired after construction; synced at feed() entry only
  *     (not per-action) since no in-feed action changes them
- *   - `focusTracker` (W2.3) — shared instance from uiServices.platform, mutated
+ *   - `focusTracker` — shared instance from uiServices.platform, mutated
  *     directly by feedInputTokens() on 'focus' tokens; never reallocated
  *
  * **Rationale:** per-feed mutation on a single object avoids per-keystroke GC pressure
@@ -126,7 +126,7 @@ export interface FeedContextStableRefs {
   keybindingsManager: KeybindingsManager;
   killRing: KillRing;
   focusTracker: FocusTracker;
-  /** DEBT-5 item 5 — paste-flood guard state, mutated in place (never reallocated). */
+  /** item 5 — paste-flood guard state, mutated in place (never reallocated). */
   panelBurstGuard: PanelBurstGuardState;
   getHistory: () => InfiniteBuffer;
   getViewportHeight: () => number;

package/src/input/handler-command-route.ts

@@ -145,13 +145,13 @@ function withPanelFocusSync(context: CommandContext, state: CommandModeRouteStat
     showPanel: context.showPanel
       ? (panelId, pane, target, opts) => {
           context.showPanel?.(panelId, pane, target, opts);
-          // UX-C: showPanel no longer transfers focus by default — the command
+          // showPanel no longer transfers focus by default — the command
           // path leaves the composer focused (ui-openers.ts's showPanel only
           // calls focusPanels() when opts.focus is set). Only flip the local
           // panelFocused mirror when the caller explicitly asked for focus;
           // otherwise leave it exactly as it was (the composer, since you can
           // only type a command from there in the first place). `target` is the
-          // DEBT-5 deep-link jump target, forwarded verbatim.
+          // deep-link jump target, forwarded verbatim.
           if (opts?.focus) state.panelFocused = true;
         }
       : undefined,

package/src/input/handler-content-actions.ts

@@ -440,7 +440,7 @@ export function handleCtrlC(
   // double-press window from advancing. A throw from the async TTS-stop path
   // (e.g. killing the audio subprocess) would otherwise swallow this press and
   // strand the user unable to quit while TTS is speaking. Decouple the two: the
-  // press below is recorded no matter how speech-stop fares. (UX-B item 6b.)
+  // press below is recorded no matter how speech-stop fares. (item 6b.)
   let stoppedSpeech = false;
   try {
     stoppedSpeech = cancelGeneration?.() === true;

package/src/input/handler-feed-routes.ts

@@ -45,7 +45,7 @@ export type PanelFocusRouteState = {
    * no text capture (Invariant A: focus must not silently flip to the composer).
    */
   onPasteDropped?: (panelName: string) => void;
-  /** Wall-clock time (ms) for this token; `burstGuard` is DEBT-5 item 5's flood-guard state, mutated in place across tokens (see panel-paste-flood-guard.ts). */
+  /** Wall-clock time (ms) for this token; `burstGuard` is item 5's flood-guard state, mutated in place across tokens (see panel-paste-flood-guard.ts). */
   now: number;
   burstGuard: PanelBurstGuardState;
   /**
@@ -92,7 +92,7 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
     // (e.g. dismiss a confirm dialog or clear search). Only unfocus if the
     // panel returns false (unconsumed) or there is no active panel.
     if (token.logicalName === 'escape') {
-      // I6.1/replay R5: while streaming, a focused panel must not swallow the
+      // While streaming, a focused panel must not swallow the
       // only way to cancel — Escape's first job is always cancel-turn; the
       // panel's own two-stage consume-or-unfocus contract only runs once no
       // turn is active, so a *second* Escape falls through to it normally
@@ -148,12 +148,12 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
 
   if (token.type === 'text' && token.value) {
     const activePanel = state.panelManager.getActive();
-    // UX-C: '/' is an explicit transfer verb back to the composer (a capturing panel, isCapturingTextBurst, keeps '/' for itself).
+    // '/' is an explicit transfer verb back to the composer (a capturing panel, isCapturingTextBurst, keeps '/' for itself).
     if (token.value === '/' && !activePanel?.isCapturingTextBurst?.()) {
       panelFocused = false;
       return { handled: false, panelFocused };
     }
-    // Invariant A/B (W6.2): a paste (isPasteToken, one multi-char token) into
+    // Invariant A/B: a paste (isPasteToken, one multi-char token) into
     // a capturing panel forwards verbatim below; elsewhere it is DROPPED with
     // a one-shot hint (never exploded into hotkeys, never a silent focus
     // flip — focus moves only on an explicit verb). Discrete keystrokes fall
@@ -164,7 +164,7 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
       return { handled: true, panelFocused };
     }
 
-    // DEBT-5 item 5 — paste flood guard (rate-based; see panel-paste-flood-guard.ts).
+    // item 5 — paste flood guard (rate-based; see panel-paste-flood-guard.ts).
     if (!state.isPasteToken && !activePanel?.isCapturingTextBurst?.()) {
       const guard = trackPanelPasteFloodGuard(state.burstGuard, state.now);
       if (!guard.dispatch) {
@@ -211,7 +211,7 @@ export function handleIndicatorFocusToken(state: IndicatorFocusRouteState, token
     }
     if (token.logicalName === 'enter') {
       indicatorFocused = false;
-      // W2.2: opens the Fleet panel (see openFleetPanel's own doc, line ~352).
+      // opens the Fleet panel (see openFleetPanel's own doc, line ~352).
       state.openFleetPanel();
       state.requestRender();
       return { handled: true, indicatorFocused };
@@ -626,7 +626,7 @@ export function handlePromptKeyToken(state: KeyRouteState, token: InputToken): {
     return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
   }
 
-  // UX-C: F2 is now handled globally with toggle semantics (handler-shortcuts.ts)
+  // F2 is now handled globally with toggle semantics (handler-shortcuts.ts)
   // BEFORE it ever reaches this route; this branch is dead in the real
   // pipeline but stays for panel-entry-points-reachable.test.ts's direct test.
   if (token.logicalName === 'f2') {

package/src/input/handler-feed.ts

@@ -129,9 +129,9 @@ export interface InputFeedContext {
   inputHistory: InputHistory | null;
   conversationManager: ConversationManager | null;
   readonly killRing: KillRing;
-  /** Terminal focus tracker (W2.3) — updated here from 'focus' tokens, read by the unfocused-alert notifiers in core/. */
+  /** Terminal focus tracker — updated here from 'focus' tokens, read by the unfocused-alert notifiers in core/. */
   readonly focusTracker: FocusTracker;
-  /** DEBT-5 item 5 — the paste-flood guard's persistent state, mutated in place across tokens by handlePanelFocusToken (see panel-paste-flood-guard.ts). Never reallocated. */
+  /** item 5 — the paste-flood guard's persistent state, mutated in place across tokens by handlePanelFocusToken (see panel-paste-flood-guard.ts). Never reallocated. */
   readonly panelBurstGuard: PanelBurstGuardState;
   readonly getHistory: () => InfiniteBuffer;
   readonly getViewportHeight: () => number;
@@ -204,13 +204,13 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
   // several batched into one feed() by render-tick latency — arrive as
   // separate 1-char 'text' tokens. The old per-feed sum misread two quick nav
   // keystrokes (e.g. j then k in one drain) as a "burst" and yanked focus.
-  // DEBT-5 item 5's flood guard reuses that same per-token model but adds
+  // item 5's flood guard reuses that same per-token model but adds
   // real timing: one `now` per feed() call (not per token) is intentional —
   // a genuine flood delivers many tokens in one drain, and they should all
   // measure as arriving "at once", not spread across meaningless sub-ms noise.
   const now = Date.now();
   for (const token of tokens) {
-    // Focus-reporting tokens (CSI ?1004h, W2.3) never reach the composer or any
+    // Focus-reporting tokens (CSI ?1004h) never reach the composer or any
     // modal route — consumed here, first, unconditionally. No render needed.
     if (token.type === 'focus') {
       context.focusTracker.setFocused(token.action === 'in');

package/src/input/handler-interactions.ts

@@ -1,4 +1,5 @@
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
+import { enrichProviderAccountsSnapshot } from '../runtime/onboarding/provider-key-capture.ts';
 import type { OnboardingWizardMode } from './onboarding/onboarding-wizard.ts';
 import { collectOnboardingSnapshot } from '../runtime/onboarding/index.ts';
 import { cleanupMarkerRegistry, expandPrompt, findMarkerAtPos, handleBlockCopy, handleBlockRerun, handleBlockSave, handleBlockToggle, handleBookmark, handleClipboardPaste, handleCopy, handleCtrlC, handleDiffApply, registerPaste } from './handler-content-actions.ts';
@@ -37,12 +38,12 @@ export async function hydrateOnboardingWizardFromRuntimeForHandler(handler: Inpu
           list: () => handler.uiServices.platform.surfaceRegistry.syncConfiguredSurfaces(),
         },
         providerAccounts: {
-          loadSnapshot: () => buildProviderAccountSnapshot({
+          loadSnapshot: async () => enrichProviderAccountsSnapshot(await buildProviderAccountSnapshot({
             providerRegistry: handler.uiServices.providers.providerRegistry,
             serviceRegistry: handler.uiServices.platform.serviceRegistry,
             subscriptionManager: handler.uiServices.platform.subscriptionManager,
             secretsManager: handler.uiServices.platform.secretsManager,
-          }),
+          }), handler.uiServices.providers.providerRegistry),
         },
       });
       if (!handler.onboardingWizard.active || hydrationSerial !== handler.onboardingHydrationSerial) return;

package/src/input/handler-modal-routes.ts

@@ -95,7 +95,7 @@ export function handleSelectionModalToken(state: SelectionRouteState, token: Inp
           dispatchSelectionAction(action, selected);
         }
       } else if (state.selectionModal.allowSearch) {
-        // UX-C instant filter: an unclaimed keystroke arms search AND starts
+        // instant filter: an unclaimed keystroke arms search AND starts
         // the query immediately, instead of silently doing nothing until the
         // user discovers '/' first (the "help search needs '/' arming while
         // the palette filters instantly" evaluator finding — /help has no
@@ -108,7 +108,7 @@ export function handleSelectionModalToken(state: SelectionRouteState, token: Inp
     }
   } else if (token.type === 'key') {
     if (token.logicalName === 'escape') {
-      // UX-C: ONE Escape always closes the modal, regardless of search state.
+      // ONE Escape always closes the modal, regardless of search state.
       // Clearing an in-progress query is Backspace's job, not Esc's — the old
       // two-stage contract (1st Esc clears query, 2nd blurs search, 3rd
       // finally closes) was the "help modal took 3 Escapes after searching"
@@ -234,6 +234,8 @@ type SettingsRouteState = {
     searchQuery: string;
     commitEdit: () => void;
     toggleSelectedFlag: () => void;
+    /** Scroll the documentation pane (PgUp/PgDn); the renderer clamps and shows honest markers. */
+    scrollContext?: (delta: number) => void;
     activateSelected: () => void;
     handleSubscriptionLogoutKey?: (key: string) => 'confirmed' | 'cancelled' | 'absorbed' | 'inactive';
     adjustSelected: (direction: 'left' | 'right', step?: number) => void;
@@ -415,6 +417,12 @@ export function handleSettingsModalToken(state: SettingsRouteState, token: Input
       const reset = state.settingsModal.resetSelected?.();
       if (reset) syncRuntimeAfterSettingReset(state.commandContext, reset.key, reset.value);
     }
+    else if (token.logicalName === 'pageup' && !state.settingsModal.editingMode) {
+      state.settingsModal.scrollContext?.(-3);
+    }
+    else if (token.logicalName === 'pagedown' && !state.settingsModal.editingMode) {
+      state.settingsModal.scrollContext?.(3);
+    }
     else if (token.logicalName === 'tab' && !state.settingsModal.searchFocused) {
       if (state.settingsModal.toggleFocusPane) state.settingsModal.toggleFocusPane();
       else if (focusPane === 'categories') state.settingsModal.focusSettings?.();
@@ -556,9 +564,9 @@ type ConfigModalRouteState = {
 };
 
 /**
- * Route a key to the generic config-modal host (W6.1 MIGRATE-TO-MODAL
+ * Route a key to the generic config-modal host (MIGRATE-TO-MODAL
  * surfaces). The host owns the reserved navigation keys (Esc, up/down/j/k tab
- * left/right, and now '/' — DEBT-5 item 1's type-to-filter, armed the same
+ * left/right, and now '/' — item 1's type-to-filter, armed the same
  * way as scrollable-list-panel.ts's opt-in filter and SettingsModal's own
  * '/'-armed search); every other key is offered to the active surface's
  * declarative action table (fireAction handles the two-press confirm for

package/src/input/handler-modal-token-routes.ts

@@ -227,7 +227,7 @@ export function handleModalTokenRoutes(state: ModalTokenRouteState, token: Input
     return withState(state, true);
   }
 
-  // W6.1 retirement: the live-tail, agent-detail, and process-modal token
+  // retirement: the live-tail, agent-detail, and process-modal token
   // routes were removed with those modals (F2 now opens Fleet, which subsumes
   // the live process tree; the three modals were structurally unreachable after
   // the F2 repoint and were deleted).

package/src/input/handler-onboarding-daemon-adopt.ts

@@ -138,10 +138,10 @@ export async function handleMigrateLegacyDaemonServiceForHandler(handler: InputH
       legacy,
     );
     handler.commandContext?.print?.(
-      ['Migrate legacy daemon service:', ...result.lines.map((line: string) => `  ${line}`)].join('\n'),
+      ['Migrate install-script daemon service:', ...result.lines.map((line: string) => `  ${line}`)].join('\n'),
     );
   } catch (error) {
-    handler.commandContext?.print?.(`Migrate legacy daemon service failed: ${summarizeError(error)}`);
+    handler.commandContext?.print?.(`Migrate install-script daemon service failed: ${summarizeError(error)}`);
   } finally {
     handler.onboardingApplyPending = false;
     handler.requestRender();