@pellux/goodvibes-tui 1.16.1 → 1.18.0

package/src/input/config-modal-types.ts

@@ -1,9 +1,9 @@
 import type { ModalSectionStyle } from '../renderer/modal-factory.ts';
 
 /**
- * Config-modal host — the shared seam every W6.1 MIGRATE-TO-MODAL surface
+ * Config-modal host — the shared seam every MIGRATE-TO-MODAL surface
  * (provider-health, services, subscription, remote, local-auth, settings-sync,
- * sandbox, and the WO-B ecosystem/governance set) is expressed through.
+ * sandbox, and the ecosystem/governance set) is expressed through.
  *
  * A surface is PURE DATA + ACTIONS: it hands the host a `buildView()` that maps
  * live read-models to a tabbed, list-structured view, plus a declarative action
@@ -106,6 +106,17 @@ export interface ConfigModalActionContext {
   readonly setStatus: (message: string) => void;
   /** Close the modal (focus returns to whatever opened it). */
   readonly close: () => void;
+  /**
+   * Switch the active tab and select a row within it, by id — the in-surface
+   * "jump" affordance (e.g. the Memory modal's Proposals tab jumping to an
+   * affected record in the Review Queue tab, rather than opening a second
+   * modal). Host-owned, populated by ConfigModal itself (like `close`/
+   * `setStatus`) — a surface's `onAction` calls it, never constructs it. A
+   * no-op if either id is not present in the surface's current structure; the
+   * surface should check reachability itself and print an honest status line
+   * when it isn't, rather than relying on a silent no-op.
+   */
+  readonly jumpToRow?: (tabId: string, rowId: string) => void;
 }
 
 /** A declarative action bound to a key. */
@@ -114,7 +125,7 @@ export interface ConfigModalAction {
    * Trigger key: a single printable char ('r', 'd') or a named key ('enter').
    * Must not collide with the host-reserved nav keys (up/down/left/right/tab/
    * j/k/escape/'/') — those are consumed by the host before actions are
-   * consulted. '/' arms the host's type-to-filter (DEBT-5 item 1); while
+   * consulted. '/' arms the host's type-to-filter (item 1); while
    * filtering, EVERY printable key (not just j/k) is captured by the query
    * instead of firing an action — see handleConfigModalToken.
    */

package/src/input/config-modal.ts

@@ -66,7 +66,7 @@ const DEFAULT_VISIBLE_ROWS = 10;
 const DEFAULT_LABEL_WRAP_WIDTH = 70;
 
 /**
- * Stable id for the synthesized "no matches" row DEBT-5 item 1 injects when a
+ * Stable id for the synthesized "no matches" row item 1 injects when a
  * filter query excludes every selectable row in a tab. Non-selectable (info
  * rows are never filtered — see ConfigModal's filter doc) so this id can
  * never collide with a real surface row id.
@@ -97,7 +97,7 @@ export class ConfigModal {
   private pendingConfirmKey: string | null = null;
 
   /**
-   * DEBT-5 item 1 — the host's own type-to-filter, armed with '/' (matching
+   * item 1 — the host's own type-to-filter, armed with '/' (matching
    * the pre-existing "'/' to filter" convention: scrollable-list-panel.ts's
    * opt-in filter, and SettingsModal's own '/'-armed search). `filterActive`
    * gates whether printable keys go to the query instead of nav/actions;
@@ -111,11 +111,11 @@ export class ConfigModal {
    *   - '/'-ARMED here (config-modal host surfaces): these surfaces bind PLAIN
    *     single keys to ACTION HOTKEYS (e.g. 'r' refresh, 'd' delete). A key
    *     can't be both an action and a filter character, so filtering must be
-   *     explicitly armed with '/' first. This is DEBT-5's design.
+   *     explicitly armed with '/' first. This is a deliberate design choice.
    *   - INSTANT filtering (pure pickers — help overlay, command palette,
    *     selection-modal): these have no single-key actions, so every printable
    *     key is unambiguously a filter character and narrows the list on the
-   *     first keystroke. This is UX-C's design (selection-modal-overlay.ts).
+   *     first keystroke. This is a deliberate design choice (selection-modal-overlay.ts).
    *   - Both keep single-Esc-close semantics. The only extra step is here: a
    *     two-stage Esc (first Esc clears a NON-EMPTY query, second Esc closes)
    *     — see the Esc branch in handleConfigModalToken. With an empty query,
@@ -221,7 +221,7 @@ export class ConfigModal {
     this._clampScroll();
   }
 
-  // ── Filter (DEBT-5 item 1 — each mutation is an interaction boundary) ──────
+  // ── Filter (item 1 — each mutation is an interaction boundary) ──────
 
   isFilterActive(): boolean {
     return this.filterActive;
@@ -306,7 +306,7 @@ export class ConfigModal {
   private _switchTab(dir: 1 | -1): void {
     this._clearConfirm();
     // A filter query is scoped to the tab it was typed against — switching
-    // tabs resets it (DEBT-5 item 1), same as statusMessage below.
+    // tabs resets it (item 1), same as statusMessage below.
     this.filterActive = false;
     this.filterQuery = '';
     this.syncStructure();
@@ -339,7 +339,7 @@ export class ConfigModal {
    * action (consumed). Handles the two-press confirm for destructive actions.
    * This is an interaction boundary (syncs structure first).
    */
-  fireAction(key: string, ctx: Omit<ConfigModalActionContext, 'row' | 'tabId' | 'setStatus' | 'close' | 'requestRender'>): boolean {
+  fireAction(key: string, ctx: Omit<ConfigModalActionContext, 'row' | 'tabId' | 'setStatus' | 'close' | 'requestRender' | 'jumpToRow'>): boolean {
     this.syncStructure();
     const action = this.resolveAction(key);
     if (!action) return false;
@@ -359,11 +359,36 @@ export class ConfigModal {
       requestRender: this.requestRender,
       setStatus: (m: string) => { this.statusMessage = m; },
       close: () => this.close(),
+      jumpToRow: (tabId: string, rowId: string) => this.jumpToRow(tabId, rowId),
     };
     this.surface?.onAction?.(action.id, fullCtx);
     return true;
   }
 
+  /**
+   * In-surface "jump": switch the active tab (by id) and select a specific
+   * row (by id) within it — the mechanism a surface's own action handler
+   * uses to move the user from one tab to a specific row in another (e.g.
+   * the Memory modal's Proposals tab jumping to an affected record in the
+   * Review Queue tab). An interaction boundary (re-syncs structure first,
+   * same as `_switchTab`). A no-op if either id is absent from the
+   * freshly-synced structure.
+   */
+  jumpToRow(tabId: string, rowId: string): void {
+    this._clearConfirm();
+    this.filterActive = false;
+    this.filterQuery = '';
+    this.syncStructure();
+    const tab = this.frozenView?.tabs.find((t) => t.id === tabId);
+    if (!tab) return;
+    if (!tab.rows.some((r) => r.id === rowId && r.selectable !== false)) return;
+    this.activeTabId = tabId;
+    this.selectedRowId = rowId;
+    this.scrollOffset = 0;
+    this.statusMessage = '';
+    this._clampScroll();
+  }
+
   /** Clear a pending confirm when the user navigates or presses an unrelated key. */
   clearConfirmOnMiss(): void {
     this._clearConfirm();
@@ -395,8 +420,7 @@ export class ConfigModal {
    *
    * `labelWrapWidth` is the wrap column ModalFactory's list section will use
    * for row labels (renderConfigModal computes and passes the real one for
-   * the current terminal size). It exists so the wrap-clamp below (DEBT-5
-   * item 2) can pre-empt a live label growing past ModalFactory's wrap width
+   * the current terminal size). It exists so the wrap-clamp below (* item 2) can pre-empt a live label growing past ModalFactory's wrap width
    * mid-tick — a structural change (an extra visible line) without an
    * interaction — by measuring wrapped line counts here, before the label
    * ever reaches the renderer.
@@ -443,9 +467,9 @@ export class ConfigModal {
     });
 
     const visible = this.visibleRows;
-    const windowed = allRows.slice(this.scrollOffset, this.scrollOffset + visible);
+    const windowed = this._windowRowsByLineBudget(allRows, this.scrollOffset, visible, labelWrapWidth);
 
-    // DEBT-5 item 1: while filtering, the surface's own action/tab hints are
+    // item 1: while filtering, the surface's own action/tab hints are
     // unreliable (their printable-letter keys are captured by the filter
     // instead of firing — see handleConfigModalToken), so the footer swaps
     // to just the filter status (query + a truthful match count) and the
@@ -483,7 +507,7 @@ export class ConfigModal {
   // ── internals ────────────────────────────────────────────────────────────────
 
   /**
-   * DEBT-5 item 2 (wrap-clamp overlay): keep a live label within the FROZEN
+   * item 2 (wrap-clamp overlay): keep a live label within the FROZEN
    * row's line footprint until the next interaction boundary re-freezes it.
    * `frozenLabel` is what the row wrapped to when the structure was captured
    * (open/nav/filter keystroke); `liveLabel` is this tick's value. If the
@@ -506,6 +530,44 @@ export class ConfigModal {
     return clamped.join('\n');
   }
 
+  /**
+   * Modal sizing rule (owner, zero tolerance: a modal/list must never clip
+   * its full descriptive text — size to content or scroll, never clip).
+   * `scrollOffset`/`visible` are ROW-count based, which is exactly right when
+   * every row wraps to one line — but ModalFactory renders each row's WRAPPED
+   * lines and then bounds the whole section to a fixed content-row budget
+   * computed from `visible` (see renderConfigModal's targetContentRows). A
+   * row whose label wraps to MULTIPLE lines can therefore push the total past
+   * that budget, and the LAST row handed to the renderer gets cut off
+   * mid-line instead of being deferred to the next scroll page — the
+   * clipping hazard this closes.
+   *
+   * Windows `rows` starting at `scrollOffset`, greedily including whole rows
+   * while their CUMULATIVE wrapped-line count (at `wrapWidth`) stays within
+   * the `visible` line budget. Always includes at least the first candidate
+   * row so the view is never empty — a single row that alone exceeds the
+   * budget is shown in full rather than replaced with nothing; only a
+   * SUBSEQUENT row that would overflow is deferred to scrolling instead of
+   * being rendered partially.
+   */
+  private _windowRowsByLineBudget(
+    rows: readonly ConfigModalRenderRow[],
+    scrollOffset: number,
+    visible: number,
+    wrapWidth: number,
+  ): ConfigModalRenderRow[] {
+    const candidates = rows.slice(scrollOffset);
+    const out: ConfigModalRenderRow[] = [];
+    let usedLines = 0;
+    for (const row of candidates) {
+      const lineCount = Math.max(1, wrapText(row.label, wrapWidth).length);
+      if (out.length > 0 && usedLines + lineCount > visible) break;
+      out.push(row);
+      usedLines += lineCount;
+    }
+    return out;
+  }
+
   /** Footer text for the active filter: the query + a truthful match count. */
   private _filterStatusHint(matched: number, total: number): string {
     const q = this.filterQuery;
@@ -526,7 +588,7 @@ export class ConfigModal {
    * empty-state copy, warning banners) always pass through unfiltered —
    * they're context, not data. When the query excludes every selectable row
    * but the tab genuinely had some, append the honest "no rows match" line
-   * (DEBT-5 item 1's empty-result case) instead of silently showing nothing
+   * (item 1's empty-result case) instead of silently showing nothing
    * or misleadingly falling back to the surface's own emptyText (which
    * describes "no data at all", not "no data matches your filter").
    */

package/src/input/feature-unit-layout.ts

@@ -1,83 +1,84 @@
 /**
- * feature-unit-layout — turns the flat "44 flags in one bucket + their config
- * keys scattered across namespace categories" layout into feature UNITS: each
- * feature flag renders as a toggle header immediately followed by the config
- * keys that tune it, hosted in the topical category its config lives under
- * (sandbox with Runtime & Data, surfaces with Surfaces & Cloud, and so on).
+ * feature-unit-layout — every platform capability renders as a feature UNIT in
+ * its settings DOMAIN: the feature's real enablement row (its domain settings
+ * key, with the feature's name and full description attached) immediately
+ * followed by the settings keys that tune it.
  *
- * Grouping metadata is sourced entirely from the SDK's FEATURE_FLAG_CONFIG map
- * (the single source of truth, completeness test-guarded SDK-side) so the three
- * surfaces that present features — the settings modal, the onboarding wizard,
- * and /flags — agree on which config keys belong to which flag.
+ * Grouping metadata is sourced entirely from the SDK's FEATURE_SETTINGS
+ * surface (the single source of truth, completeness test-guarded SDK-side):
+ * `domain` is the top-level settings namespace the feature lives in, the
+ * enablement binding carries the real option shape (boolean switch, enum mode
+ * choices, or a constant capability), and `settings` lists every key that
+ * configures the feature.
  *
- * A flag whose FEATURE_FLAG_CONFIG entry has no config keys is hosted in the
- * Advanced Features bucket as a simple toggle (genuinely internal / startup-gated
- * plumbing flags with nothing to tune).
+ * A feature-unit header is the REAL config row for the feature's enablement
+ * key — boolean headers toggle, enum headers cycle their mode choices through
+ * the ordinary settings interactions. Two features can share one enablement
+ * key (e.g. behavior.compactionStrategy drives both compaction features);
+ * each still gets its own header row so every capability keeps its own name,
+ * description, and state, all reading the same underlying key.
  */
 
-import { FEATURE_FLAG_CONFIG, FEATURE_FLAGS } from '@pellux/goodvibes-sdk/platform/runtime/state';
-import type { ConfigKey, ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
-import type { FeatureFlag } from '@/runtime/index.ts';
+import { FEATURE_SETTINGS } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import type { FeatureSetting } from '@pellux/goodvibes-sdk/platform/runtime/state';
+import type { ConfigSetting } from '@pellux/goodvibes-sdk/platform/config';
+import { getConfigSchemaSetting } from '../runtime/feature-settings.ts';
 import type { FlagEntry, SettingEntry, SettingsCategory } from './settings-modal-types.ts';
 
-/**
- * The category that hosts flags with no tunable config keys. Repurposed from the
- * old flat "Feature Flags" tab — it now holds only the internal/plumbing flags
- * that have nothing to configure, as simple toggles.
- */
-export const ADVANCED_FEATURES_CATEGORY: SettingsCategory = 'flags';
+/** Every enablement key — these rows render as feature headers, never as plain sub-rows. */
+const ENABLEMENT_KEYS: ReadonlySet<string> = new Set(
+  FEATURE_SETTINGS.map((feature) => feature.enablement.key),
+);
 
 /**
- * Host category for a flag's feature unit: the single top-level namespace its
- * config keys live under (verified single-namespace SDK-side), or the Advanced
- * Features bucket when the flag has no config keys.
+ * Host category for a feature unit: its settings domain (the top-level
+ * namespace of its enablement key), which is always a real settings category.
  */
-export function getFeatureUnitHostCategory(flagId: string): SettingsCategory {
-  const assoc = FEATURE_FLAG_CONFIG[flagId];
-  const namespace = assoc?.configCategories[0];
-  return (namespace ?? ADVANCED_FEATURES_CATEGORY) as SettingsCategory;
+export function getFeatureUnitHostCategory(featureId: string): SettingsCategory | null {
+  const feature = FEATURE_SETTINGS.find((candidate) => candidate.id === featureId);
+  return feature ? (feature.domain as SettingsCategory) : null;
 }
 
 /**
- * Map every config key claimed by any flag to the flag that OWNS it — the first
- * flag (in FEATURE_FLAGS declaration order) whose FEATURE_FLAG_CONFIG entry lists
- * it. A key claimed by two flags (e.g. behavior.compactionStrategy, shared by
- * session-compaction and compaction-distiller-strategy) is listed once, under its
- * owner, so no config key double-lists across feature units.
+ * Map every non-enablement settings key claimed by any feature to the feature
+ * that OWNS it — the first feature (in FEATURE_SETTINGS declaration order)
+ * whose settings list contains it. A key claimed by two features is listed
+ * once, under its owner, so no settings key double-lists across feature units.
  */
 export function buildConfigKeyOwnership(): Map<string, string> {
   const owner = new Map<string, string>();
-  for (const flag of FEATURE_FLAGS) {
-    const assoc = FEATURE_FLAG_CONFIG[flag.id];
-    if (!assoc) continue;
-    for (const key of assoc.configKeys) {
-      if (!owner.has(key)) owner.set(key, flag.id);
+  for (const feature of FEATURE_SETTINGS) {
+    for (const key of feature.settings) {
+      if (ENABLEMENT_KEYS.has(key)) continue;
+      if (!owner.has(key)) owner.set(key, feature.id);
     }
   }
   return owner;
 }
 
 /**
- * Build the synthetic SettingEntry that is a feature unit's toggle header. Its
- * key is `featureFlags.<id>` (the same override path persistFlagState writes), so
- * it round-trips through the config layer; type boolean so the existing
- * activate/adjust toggle paths drive it. currentValue mirrors the live runtime
- * state; isDefault is true when the flag sits at its declared default state (so
- * the "modified" marker shows only for an actual override). The attached
- * `flag` marks the row as a feature-unit header for rendering and interaction.
+ * Build a feature unit's header row: the REAL config row for the feature's
+ * enablement key (so booleans toggle and enums cycle their mode choices
+ * through the ordinary settings paths), cloned with the feature attached.
+ * When the category has no row for the key (it should always have one — every
+ * binding key is CONFIG_SCHEMA-registered), the schema descriptor is used
+ * directly so the header still renders honestly.
  */
-export function buildFlagHeaderEntry(entry: FlagEntry): SettingEntry {
-  const { flag, state } = entry;
-  const setting: ConfigSetting = {
-    key: `featureFlags.${flag.id}` as ConfigKey,
-    type: 'boolean',
-    default: flag.defaultState === 'enabled',
-    description: flag.description,
-  };
+export function buildFeatureHeaderEntry(entry: FlagEntry, base: SettingEntry | null): SettingEntry {
+  const feature = entry.feature;
+  const setting: ConfigSetting = base?.setting
+    ?? getConfigSchemaSetting(feature.enablement.key)
+    ?? {
+      key: feature.enablement.key,
+      type: 'boolean',
+      default: feature.defaultEnabled,
+      description: feature.description,
+    };
   return {
+    ...(base ?? {}),
     setting,
-    currentValue: state === 'enabled',
-    isDefault: state === flag.defaultState,
+    currentValue: base ? base.currentValue : setting.default,
+    isDefault: base ? base.isDefault : true,
     flag: entry,
   };
 }
@@ -88,13 +89,14 @@ function cloneOwnedEntry(entry: SettingEntry, ownerFlagId: string): SettingEntry
 }
 
 /**
- * Rewrite `groups` in place so each host category leads with its feature units
- * (flag toggle header + its owned config sub-options, in FEATURE_FLAGS order),
- * followed by the category's remaining un-owned config rows. The Advanced
- * Features category is filled with the no-config flags as bare toggles.
+ * Rewrite `groups` in place so each settings domain leads with its feature
+ * units (feature header + its owned settings sub-rows, in FEATURE_SETTINGS
+ * declaration order), followed by the category's remaining un-owned rows.
+ * The plain rows for enablement keys are consumed into the headers; cross
+ * listed copies in the combined network view keep their plain form.
  *
- * No-op when there are no flag entries (the flagless test path), leaving the
- * plain namespace-bucketed layout intact.
+ * No-op when there are no feature entries (the featureless test path),
+ * leaving the plain namespace-bucketed layout intact.
  */
 export function applyFeatureUnitLayout(
   groups: Map<SettingsCategory, SettingEntry[]>,
@@ -102,39 +104,48 @@ export function applyFeatureUnitLayout(
 ): void {
   if (flagEntries.length === 0) return;
   const owner = buildConfigKeyOwnership();
-  const flagState = new Map<string, FlagEntry>(flagEntries.map((entry) => [entry.flag.id, entry]));
+  const entryById = new Map<string, FlagEntry>(flagEntries.map((entry) => [entry.feature.id, entry]));
 
-  // Group the flags this runtime actually registered by their host category,
-  // preserving FEATURE_FLAGS declaration order within each category.
-  const flagsByCategory = new Map<SettingsCategory, FeatureFlag[]>();
-  for (const flag of FEATURE_FLAGS) {
-    if (!flagState.has(flag.id)) continue; // not registered in this runtime
-    const category = getFeatureUnitHostCategory(flag.id);
-    if (!flagsByCategory.has(category)) flagsByCategory.set(category, []);
-    flagsByCategory.get(category)!.push(flag);
+  // Group the features this runtime actually registered by their domain,
+  // preserving FEATURE_SETTINGS declaration order within each category.
+  const featuresByCategory = new Map<SettingsCategory, FeatureSetting[]>();
+  for (const feature of FEATURE_SETTINGS) {
+    if (!entryById.has(feature.id)) continue; // not registered in this runtime
+    const category = feature.domain as SettingsCategory;
+    if (!featuresByCategory.has(category)) featuresByCategory.set(category, []);
+    featuresByCategory.get(category)!.push(feature);
   }
 
-  for (const [category, flags] of flagsByCategory) {
+  for (const [category, features] of featuresByCategory) {
     const existing = groups.get(category) ?? [];
-    // Split existing config rows into those owned by a feature unit hosted here
-    // and the remaining orphan rows. An owned row's owner is guaranteed to be a
-    // flag hosted in THIS category (owned keys share the flag's namespace).
-    const ownedByFlag = new Map<string, SettingEntry[]>();
+    const rowByKey = new Map<string, SettingEntry>();
+    for (const entry of existing) {
+      if (!rowByKey.has(entry.setting.key)) rowByKey.set(entry.setting.key, entry);
+    }
+
+    // Split existing config rows: enablement rows are consumed into headers,
+    // rows owned by a feature hosted here become indented sub-rows, and the
+    // rest stay as orphan rows after the feature units.
+    const hostedEnablementKeys = new Set(features.map((feature) => feature.enablement.key));
+    const ownedByFeature = new Map<string, SettingEntry[]>();
     const orphans: SettingEntry[] = [];
     for (const entry of existing) {
-      const ownerId = owner.get(entry.setting.key);
-      if (ownerId !== undefined && flagState.has(ownerId)) {
-        if (!ownedByFlag.has(ownerId)) ownedByFlag.set(ownerId, []);
-        ownedByFlag.get(ownerId)!.push(cloneOwnedEntry(entry, ownerId));
+      const key = entry.setting.key;
+      if (hostedEnablementKeys.has(key)) continue; // consumed into header(s)
+      const ownerId = owner.get(key);
+      if (ownerId !== undefined && entryById.has(ownerId)) {
+        if (!ownedByFeature.has(ownerId)) ownedByFeature.set(ownerId, []);
+        ownedByFeature.get(ownerId)!.push(cloneOwnedEntry(entry, ownerId));
       } else {
         orphans.push(entry);
       }
     }
 
     const rebuilt: SettingEntry[] = [];
-    for (const flag of flags) {
-      rebuilt.push(buildFlagHeaderEntry(flagState.get(flag.id)!));
-      for (const sub of ownedByFlag.get(flag.id) ?? []) rebuilt.push(sub);
+    for (const feature of features) {
+      const base = rowByKey.get(feature.enablement.key) ?? null;
+      rebuilt.push(buildFeatureHeaderEntry(entryById.get(feature.id)!, base));
+      for (const sub of ownedByFeature.get(feature.id) ?? []) rebuilt.push(sub);
     }
     rebuilt.push(...orphans);
     groups.set(category, rebuilt);

package/src/input/feed-context-factory.ts

@@ -90,7 +90,7 @@ export interface FeedContextMutableInit {
  *   - `commandRegistry`, `commandContext`, `autocomplete`, `inputHistory`,
  *     `conversationManager` — wired after construction; synced at feed() entry only
  *     (not per-action) since no in-feed action changes them
- *   - `focusTracker` (W2.3) — shared instance from uiServices.platform, mutated
+ *   - `focusTracker` — shared instance from uiServices.platform, mutated
  *     directly by feedInputTokens() on 'focus' tokens; never reallocated
  *
  * **Rationale:** per-feed mutation on a single object avoids per-keystroke GC pressure
@@ -126,7 +126,7 @@ export interface FeedContextStableRefs {
   keybindingsManager: KeybindingsManager;
   killRing: KillRing;
   focusTracker: FocusTracker;
-  /** DEBT-5 item 5 — paste-flood guard state, mutated in place (never reallocated). */
+  /** item 5 — paste-flood guard state, mutated in place (never reallocated). */
   panelBurstGuard: PanelBurstGuardState;
   getHistory: () => InfiniteBuffer;
   getViewportHeight: () => number;

package/src/input/handler-command-route.ts

@@ -145,13 +145,13 @@ function withPanelFocusSync(context: CommandContext, state: CommandModeRouteStat
     showPanel: context.showPanel
       ? (panelId, pane, target, opts) => {
           context.showPanel?.(panelId, pane, target, opts);
-          // UX-C: showPanel no longer transfers focus by default — the command
+          // showPanel no longer transfers focus by default — the command
           // path leaves the composer focused (ui-openers.ts's showPanel only
           // calls focusPanels() when opts.focus is set). Only flip the local
           // panelFocused mirror when the caller explicitly asked for focus;
           // otherwise leave it exactly as it was (the composer, since you can
           // only type a command from there in the first place). `target` is the
-          // DEBT-5 deep-link jump target, forwarded verbatim.
+          // deep-link jump target, forwarded verbatim.
           if (opts?.focus) state.panelFocused = true;
         }
       : undefined,

package/src/input/handler-content-actions.ts

@@ -440,7 +440,7 @@ export function handleCtrlC(
   // double-press window from advancing. A throw from the async TTS-stop path
   // (e.g. killing the audio subprocess) would otherwise swallow this press and
   // strand the user unable to quit while TTS is speaking. Decouple the two: the
-  // press below is recorded no matter how speech-stop fares. (UX-B item 6b.)
+  // press below is recorded no matter how speech-stop fares. (item 6b.)
   let stoppedSpeech = false;
   try {
     stoppedSpeech = cancelGeneration?.() === true;

package/src/input/handler-feed-routes.ts

@@ -45,7 +45,7 @@ export type PanelFocusRouteState = {
    * no text capture (Invariant A: focus must not silently flip to the composer).
    */
   onPasteDropped?: (panelName: string) => void;
-  /** Wall-clock time (ms) for this token; `burstGuard` is DEBT-5 item 5's flood-guard state, mutated in place across tokens (see panel-paste-flood-guard.ts). */
+  /** Wall-clock time (ms) for this token; `burstGuard` is item 5's flood-guard state, mutated in place across tokens (see panel-paste-flood-guard.ts). */
   now: number;
   burstGuard: PanelBurstGuardState;
   /**
@@ -92,7 +92,7 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
     // (e.g. dismiss a confirm dialog or clear search). Only unfocus if the
     // panel returns false (unconsumed) or there is no active panel.
     if (token.logicalName === 'escape') {
-      // I6.1/replay R5: while streaming, a focused panel must not swallow the
+      // While streaming, a focused panel must not swallow the
       // only way to cancel — Escape's first job is always cancel-turn; the
       // panel's own two-stage consume-or-unfocus contract only runs once no
       // turn is active, so a *second* Escape falls through to it normally
@@ -148,12 +148,12 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
 
   if (token.type === 'text' && token.value) {
     const activePanel = state.panelManager.getActive();
-    // UX-C: '/' is an explicit transfer verb back to the composer (a capturing panel, isCapturingTextBurst, keeps '/' for itself).
+    // '/' is an explicit transfer verb back to the composer (a capturing panel, isCapturingTextBurst, keeps '/' for itself).
     if (token.value === '/' && !activePanel?.isCapturingTextBurst?.()) {
       panelFocused = false;
       return { handled: false, panelFocused };
     }
-    // Invariant A/B (W6.2): a paste (isPasteToken, one multi-char token) into
+    // Invariant A/B: a paste (isPasteToken, one multi-char token) into
     // a capturing panel forwards verbatim below; elsewhere it is DROPPED with
     // a one-shot hint (never exploded into hotkeys, never a silent focus
     // flip — focus moves only on an explicit verb). Discrete keystrokes fall
@@ -164,7 +164,7 @@ export function handlePanelFocusToken(state: PanelFocusRouteState, token: InputT
       return { handled: true, panelFocused };
     }
 
-    // DEBT-5 item 5 — paste flood guard (rate-based; see panel-paste-flood-guard.ts).
+    // item 5 — paste flood guard (rate-based; see panel-paste-flood-guard.ts).
     if (!state.isPasteToken && !activePanel?.isCapturingTextBurst?.()) {
       const guard = trackPanelPasteFloodGuard(state.burstGuard, state.now);
       if (!guard.dispatch) {
@@ -211,7 +211,7 @@ export function handleIndicatorFocusToken(state: IndicatorFocusRouteState, token
     }
     if (token.logicalName === 'enter') {
       indicatorFocused = false;
-      // W2.2: opens the Fleet panel (see openFleetPanel's own doc, line ~352).
+      // opens the Fleet panel (see openFleetPanel's own doc, line ~352).
       state.openFleetPanel();
       state.requestRender();
       return { handled: true, indicatorFocused };
@@ -626,7 +626,7 @@ export function handlePromptKeyToken(state: KeyRouteState, token: InputToken): {
     return { handled: true, prompt, cursorPos, inputScrollTop, commandMode, indicatorFocused };
   }
 
-  // UX-C: F2 is now handled globally with toggle semantics (handler-shortcuts.ts)
+  // F2 is now handled globally with toggle semantics (handler-shortcuts.ts)
   // BEFORE it ever reaches this route; this branch is dead in the real
   // pipeline but stays for panel-entry-points-reachable.test.ts's direct test.
   if (token.logicalName === 'f2') {

package/src/input/handler-feed.ts

@@ -129,9 +129,9 @@ export interface InputFeedContext {
   inputHistory: InputHistory | null;
   conversationManager: ConversationManager | null;
   readonly killRing: KillRing;
-  /** Terminal focus tracker (W2.3) — updated here from 'focus' tokens, read by the unfocused-alert notifiers in core/. */
+  /** Terminal focus tracker — updated here from 'focus' tokens, read by the unfocused-alert notifiers in core/. */
   readonly focusTracker: FocusTracker;
-  /** DEBT-5 item 5 — the paste-flood guard's persistent state, mutated in place across tokens by handlePanelFocusToken (see panel-paste-flood-guard.ts). Never reallocated. */
+  /** item 5 — the paste-flood guard's persistent state, mutated in place across tokens by handlePanelFocusToken (see panel-paste-flood-guard.ts). Never reallocated. */
   readonly panelBurstGuard: PanelBurstGuardState;
   readonly getHistory: () => InfiniteBuffer;
   readonly getViewportHeight: () => number;
@@ -204,13 +204,13 @@ export function feedInputTokens(context: InputFeedContext, tokens: readonly Inpu
   // several batched into one feed() by render-tick latency — arrive as
   // separate 1-char 'text' tokens. The old per-feed sum misread two quick nav
   // keystrokes (e.g. j then k in one drain) as a "burst" and yanked focus.
-  // DEBT-5 item 5's flood guard reuses that same per-token model but adds
+  // item 5's flood guard reuses that same per-token model but adds
   // real timing: one `now` per feed() call (not per token) is intentional —
   // a genuine flood delivers many tokens in one drain, and they should all
   // measure as arriving "at once", not spread across meaningless sub-ms noise.
   const now = Date.now();
   for (const token of tokens) {
-    // Focus-reporting tokens (CSI ?1004h, W2.3) never reach the composer or any
+    // Focus-reporting tokens (CSI ?1004h) never reach the composer or any
     // modal route — consumed here, first, unconditionally. No render needed.
     if (token.type === 'focus') {
       context.focusTracker.setFocused(token.action === 'in');

package/src/input/handler-interactions.ts

@@ -1,4 +1,5 @@
 import { buildProviderAccountSnapshot } from '@/runtime/index.ts';
+import { enrichProviderAccountsSnapshot } from '../runtime/onboarding/provider-key-capture.ts';
 import type { OnboardingWizardMode } from './onboarding/onboarding-wizard.ts';
 import { collectOnboardingSnapshot } from '../runtime/onboarding/index.ts';
 import { cleanupMarkerRegistry, expandPrompt, findMarkerAtPos, handleBlockCopy, handleBlockRerun, handleBlockSave, handleBlockToggle, handleBookmark, handleClipboardPaste, handleCopy, handleCtrlC, handleDiffApply, registerPaste } from './handler-content-actions.ts';
@@ -37,12 +38,12 @@ export async function hydrateOnboardingWizardFromRuntimeForHandler(handler: Inpu
           list: () => handler.uiServices.platform.surfaceRegistry.syncConfiguredSurfaces(),
         },
         providerAccounts: {
-          loadSnapshot: () => buildProviderAccountSnapshot({
+          loadSnapshot: async () => enrichProviderAccountsSnapshot(await buildProviderAccountSnapshot({
             providerRegistry: handler.uiServices.providers.providerRegistry,
             serviceRegistry: handler.uiServices.platform.serviceRegistry,
             subscriptionManager: handler.uiServices.platform.subscriptionManager,
             secretsManager: handler.uiServices.platform.secretsManager,
-          }),
+          }), handler.uiServices.providers.providerRegistry),
         },
       });
       if (!handler.onboardingWizard.active || hydrationSerial !== handler.onboardingHydrationSerial) return;