@worca/app 1.3.0 → 1.4.0-rc.1

package/ui/public/memory-view.mjs

@@ -27,7 +27,7 @@ export function memoryRoute(scopeKey, name = '') {
   return name ? `${base}/${encodeURIComponent(name)}` : base;
 }
 
-const BADGES = { fresh: ['No memory yet', ''], ok: ['Healthy', 'green'], due: ['Defragment due', 'amber'], overdue: ['Defragment overdue', 'red'] };
+const BADGES = { fresh: ['No memory yet', ''], ok: ['Healthy', 'green'], due: ['Defragment due', 'amber'], overdue: ['Defragment overdue', 'red'], failing: ['Writes failing', 'red'] };
 export function healthBadge(level) {
   const [text, cls] = BADGES[level] || BADGES.fresh;
   return { text, cls };
@@ -45,6 +45,17 @@ export function formatWhen(iso) {
 
 const NO_HOST_HINT = 'Register a project on the Projects page to host the global defragment run.';
 
+/** Settings › Memory's defragment model as the host hint names it — ` with Opus 5.5 · high` — from
+ *  the report's `defragModel` ({ model, effort, label, stale } | null). '' when unset, so the unset
+ *  sentence stays byte-identical. A model that left the catalog says so without naming a fallback:
+ *  the run then uses the node layers — the host project's own pick or the template's model — and the
+ *  global report cannot know which (memory-defrag-model.mjs). */
+export function defragModelPhrase(dm) {
+  if (!dm || typeof dm.model !== 'string' || !dm.model) return '';
+  if (dm.stale) return ` without the Settings › Memory model (${dm.model} is no longer in the catalog)`;
+  return ` with ${dm.label || dm.model}${dm.effort ? ` · ${dm.effort}` : ''}`;
+}
+
 /** The defragment glyph: three rows of blocks, the lower ones fragmented. Pure SVG elements (no
  *  text node), so the button's textContent stays its label alone. */
 function defragIcon(doc) {
@@ -66,18 +77,24 @@ function defragIcon(doc) {
  * hosts its own, so `host` is ignored there); with no registered project the button is disabled
  * and the hint says so, in visible text as well as the title. While a run is live the button stays
  * ENABLED, reads "Defragmenting… open the run" and carries `data-run-id`: the controller routes to
- * `#running/<id>`.
+ * `#running/<id>`. The global host hint also names Settings › Memory's defragment model when one is
+ * set (`report.defragModel`, see defragModelPhrase).
  */
 export function renderHealthCard(report, { doc = globalThis.document, host = null } = {}) {
   const health = report?.health || {};
   const isGlobal = String(report?.scope || 'global') === 'global';
   const card = h(doc, 'div', 'card mem-health');
+  // Interface mode (docs/ui-levels.md): byte counters and Defragment are expert upkeep — until the
+  // store needs it. An overdue or failing store is a problem the owner must see at any mode.
+  card.dataset.minLevel = 'expert';
+  if (health.level === 'overdue' || health.level === 'failing') card.dataset.levelKeep = '1';
   const head = h(doc, 'div', 'mem-health-head');
   const { text, cls } = healthBadge(health.level);
   head.appendChild(h(doc, 'span', `badge${cls ? ` ${cls}` : ''}`, text));
   head.appendChild(h(doc, 'span', 'mem-counters',
     `${plural(health.files || 0, 'file')} · ${health.bytes || 0} bytes · ${health.alwaysOnBytes || 0} bytes always loaded · ${plural(health.writesSinceDefrag || 0, 'write')} since the last defragment` +
-    (health.lastDefragAt ? ` · last defragmented ${formatWhen(health.lastDefragAt)}` : '')));
+    (health.lastDefragAt ? ` · last defragmented ${formatWhen(health.lastDefragAt)}` : '') +
+    (health.failedWrites ? ` · ${plural(health.failedWrites, 'failed write')}` : '')));
   // The ONE control sits at the head's right edge (margin-left:auto), styled like every other
   // secondary pill (btn-ghost) with the defragment glyph before its label.
   const runId = report?.defragRunId ? String(report.defragRunId) : '';
@@ -96,7 +113,7 @@ export function renderHealthCard(report, { doc = globalThis.document, host = nul
   }
   if (isGlobal && !runId) {
     card.appendChild(h(doc, 'small', 'hint mem-host-hint',
-      host ? `Runs on ${host.name || host.key} — pick another project on the New pipeline page.` : NO_HOST_HINT));
+      host ? `Runs on ${host.name || host.key}${defragModelPhrase(report?.defragModel)} — pick another project on the New pipeline page.` : NO_HOST_HINT));
   }
   card.appendChild(h(doc, 'small', 'hint', 'A defragment run merges duplicate topics, splits overgrown files, drops stale rules and tightens hooks. It is an ordinary pipeline run; the previous files stay in History.'));
   return card;
@@ -175,6 +192,7 @@ export function collectEditor(rootEl) {
 /** The snapshot ring, newest first, one Restore per row (disabled while a defragment run is live). */
 export function renderMemoryHistory(snapshots, { doc = globalThis.document, locked = false } = {}) {
   const wrap = h(doc, 'div', 'mem-history');
+  wrap.dataset.minLevel = 'expert';             // snapshot restore: expert (docs/ui-levels.md)
   wrap.appendChild(h(doc, 'div', 'mem-list-title', 'History'));
   const list = Array.isArray(snapshots) ? [...snapshots].reverse() : [];
   if (!list.length) { wrap.appendChild(h(doc, 'div', 'hist-empty', 'No snapshots yet — every write takes one.')); return wrap; }

package/ui/public/models-view.mjs

@@ -7,6 +7,8 @@
 // mv-promote, mv-save, mv-cancel, mv-env-add, mv-env-rm) so app.js wires ONE
 // delegated listener on the list container.
 
+import { bridgedBadge, needsSignInPill, degradationLine, renderConnectionSection, collectConnection, applyConnectionMode } from './bridge-view.mjs';
+
 function h(doc, tag, cls, text) {
   const n = doc.createElement(tag);
   if (cls) n.className = cls;
@@ -77,15 +79,54 @@ export function suggestDuplicateId(id, takenIds = []) {
  * `globals` come MASKED from GET /api/models. `predefinedShadowedIds` marks
  * built-ins currently overridden by a global entry.
  */
-export function renderModelsList({ globals = [], legacy = [], plugins = [], predefined = [], efforts = [], hideBuiltin = false, projectName = '' } = {}, { doc = globalThis.document } = {}) {
+/**
+ * The catalog. `query` / `filter` narrow it and `collapsed` folds a group away: with the built-ins,
+ * a plugin's models and a team policy's all listed at once the page ran to several screens, and the
+ * entry you came for was never the one on top.
+ * @param {{query?:string, filter?:string, collapsed?:object, highlight?:string[]}} [o]
+ */
+export function renderModelsList({ globals = [], legacy = [], plugins = [], policy = [], predefined = [], efforts = [], hideBuiltin = false, projectName = '', query = '', filter = 'all', collapsed = {}, highlight = [] } = {}, { doc = globalThis.document } = {}) {
   const root = h(doc, 'div', 'mv-list');
   const predefLc = new Set(predefined.map((m) => m.id.toLowerCase()));
   const pluginLc = new Set(plugins.map((m) => m.id.toLowerCase()));
+  const q = String(query || '').trim().toLowerCase();
+  const hi = new Set((highlight || []).map((x) => String(x).toLowerCase()));
+  const searching = !!q || filter !== 'all';
+
+  /** Does this entry survive the search box and the chip? */
+  const keep = (m, source) => {
+    if (filter === 'imported' && !hi.has(String(m.id).toLowerCase())) return false;
+    if (filter === 'needs-setup' && !m.needsSignIn) return false;
+    if (!['all', 'imported', 'needs-setup'].includes(filter) && filter !== source) return false;
+    if (!q) return true;
+    return [m.id, m.label, m.plugin, m.home, m.upstream && m.upstream.model].filter(Boolean).some((v) => String(v).toLowerCase().includes(q));
+  };
 
-  const section = (title, hint) => {
+  // Each group can fold: the header is the control, and its count is the answer to "is my model
+  // in there?" without opening it.
+  const sections = [];
+  const section = (title, hint, key = '') => {
     const s = h(doc, 'div', 'mv-section');
-    s.appendChild(h(doc, 'h3', 'mv-section-title', title));
-    if (hint) s.appendChild(h(doc, 'small', 'hint', hint));
+    s.dataset.section = key;
+    const head = h(doc, 'div', 'mv-section-head');
+    const btn = h(doc, 'button', 'mv-sec-toggle');
+    btn.type = 'button';
+    btn.dataset.section = key;
+    btn.appendChild(h(doc, 'span', 'mv-sec-caret', '▾'));
+    btn.appendChild(h(doc, 'h3', 'mv-section-title', title));
+    btn.appendChild(h(doc, 'span', 'mv-sec-count', ''));
+    head.appendChild(btn);
+    s.appendChild(head);
+    if (hint) s.appendChild(h(doc, 'small', 'hint mv-sec-hint', hint));
+    const body = h(doc, 'div', 'mv-sec-body');
+    s.appendChild(body);
+    // Searching opens every group that still has a hit — a match hidden inside a fold is a bug.
+    const folded = !searching && !!collapsed[key];
+    s.classList.toggle('is-folded', folded);
+    btn.setAttribute('aria-expanded', folded ? 'false' : 'true');
+    sections.push({ el: s, body, btn, key });
+    // The rows go into the body; every caller appends to the section, so proxy it.
+    s.appendChild = (node) => body.appendChild(node);
     return s;
   };
 
@@ -100,6 +141,26 @@ export function renderModelsList({ globals = [], legacy = [], plugins = [], pred
     return b;
   };
 
+  // ── Toolbar: search + the chip that says which layer you are looking at ──
+  const bar = h(doc, 'div', 'mv-toolbar');
+  const search = h(doc, 'input', 'input mv-search');
+  search.type = 'search';
+  search.placeholder = 'Search models by id, label or upstream…';
+  search.value = query || '';
+  search.setAttribute('aria-label', 'Search models');
+  bar.appendChild(search);
+  const chips = h(doc, 'div', 'mv-filters');
+  const CHIPS = [['all', 'All'], ['global', 'Yours'], ['builtin', 'Built-in'], ['plugin', 'Plugin'], ['policy', 'Team'], ['needs-setup', 'Needs setup']];
+  if (highlight.length) CHIPS.push(['imported', 'Just imported']);
+  for (const [id, label] of CHIPS) {
+    const c = h(doc, 'button', `mv-filter${filter === id ? ' on' : ''}`, label);
+    c.type = 'button'; c.dataset.filter = id;
+    c.setAttribute('aria-pressed', filter === id ? 'true' : 'false');
+    chips.appendChild(c);
+  }
+  bar.appendChild(chips);
+  root.appendChild(bar);
+
   // ── Hide built-in models (#422) — one checkbox, top of the pane ──
   const hideRow = h(doc, 'div', 'mv-hide-builtin-row');
   const hideLabel = h(doc, 'label', 'check-row');
@@ -114,11 +175,11 @@ export function renderModelsList({ globals = [], legacy = [], plugins = [], pred
   root.appendChild(hideRow);
 
   // ── Your models (global) ──
-  const yours = section('Your models', 'Defined once, available in every project. An entry with a built-in id overrides that built-in.');
+  const yours = section('Your models', 'Defined once, available in every project. An entry with a built-in id overrides that built-in.', 'global');
   if (!globals.length) {
     yours.appendChild(h(doc, 'div', 'hist-empty', 'No global models yet — Add model to define one.'));
   }
-  for (const m of globals) {
+  for (const m of globals.filter((x) => keep(x, 'global'))) {
     const card = h(doc, 'section', 'card mv-card');
     card.dataset.id = m.id;
     const body = h(doc, 'div', 'mv-body');
@@ -128,14 +189,22 @@ export function renderModelsList({ globals = [], legacy = [], plugins = [], pred
     else if (pluginLc.has(m.id.toLowerCase())) head.appendChild(h(doc, 'span', 'badge violet mv-shadow', 'overrides plugin'));
     const rb = routedBadge(m);
     if (rb) head.appendChild(rb);
+    // Model bridge (model-bridge-design.md §8.5): the provider badge, and the
+    // blocking "needs sign-in" pill when that provider is not usable yet.
+    const bb = bridgedBadge(m, { doc });
+    if (bb) head.appendChild(bb);
+    const ns = needsSignInPill(m, { doc });
+    if (ns) head.appendChild(ns);
     // The §4.6 "unreliable" badge is meaningless once an override GOVERNS this
     // model's spend — and the backend only lifts the stored flag on the model's
     // next result event, so suppress it here the moment pricing is pinned.
     if (m.costUnreliable && !m.cost) head.appendChild(h(doc, 'span', 'badge waiting mv-cost', 'cost not verified'));
     if (m.cost) head.appendChild(h(doc, 'span', 'badge violet mv-cost-pinned', m.cost.free ? 'free' : 'priced'));
     body.appendChild(head);
-    const bits = [m.id, effortsSummary(m.efforts, efforts), envSummary(m.env), costSummary(m.cost)].filter(Boolean);
+    const bits = [m.id, effortsSummary(m.efforts, efforts), m.upstream ? `→ ${m.upstream.model}` : '', envSummary(m.env), costSummary(m.cost)].filter(Boolean);
     body.appendChild(h(doc, 'small', 'mv-summary hint', bits.join(' — ')));
+    const deg = degradationLine(m);
+    if (deg) body.appendChild(h(doc, 'small', 'mv-degradation hint', deg));
     body.appendChild(h(doc, 'small', 'mv-test-result hint')); // app.js paints the Test outcome here
     card.appendChild(body);
     const del = h(doc, 'button', 'btn-ghost mv-delete', 'Delete');
@@ -185,8 +254,8 @@ export function renderModelsList({ globals = [], legacy = [], plugins = [], pred
   const globalLc = new Set(globals.map((m) => m.id.toLowerCase()));
   if (plugins.length) {
     const plug = section('From plugins',
-      'Installed by plugins — read-only and updated with the plugin. "Edit a copy" clones one into Your models, which then overrides it.');
-    for (const m of plugins) {
+      'Installed by plugins — read-only and updated with the plugin. "Edit a copy" clones one into Your models, which then overrides it.', 'plugin');
+    for (const m of plugins.filter((x) => keep(x, 'plugin'))) {
       const card = h(doc, 'section', 'card mv-card mv-plugin');
       card.dataset.id = m.id;
       card.dataset.plugin = m.plugin;
@@ -197,13 +266,19 @@ export function renderModelsList({ globals = [], legacy = [], plugins = [], pred
       if (globalLc.has(m.id.toLowerCase())) head.appendChild(h(doc, 'span', 'badge violet mv-shadowed', 'overridden by your copy'));
       const prb = routedBadge(m);
       if (prb) head.appendChild(prb);
+      const pbb = bridgedBadge(m, { doc });
+      if (pbb) head.appendChild(pbb);
+      const pns = needsSignInPill(m, { doc });
+      if (pns) head.appendChild(pns);
       // Same rule as a global card: a manifest-pinned price governs the spend,
       // so the §4.6 "unreliable" flag says nothing about it.
       if (m.costUnreliable && !m.cost) head.appendChild(h(doc, 'span', 'badge waiting mv-cost', 'cost not verified'));
       if (m.cost) head.appendChild(h(doc, 'span', 'badge violet mv-cost-pinned', m.cost.free ? 'free' : 'priced'));
       body.appendChild(head);
-      const bits = [m.id, effortsSummary(m.efforts, efforts), envSummary(m.env), costSummary(m.cost)].filter(Boolean);
+      const bits = [m.id, effortsSummary(m.efforts, efforts), m.upstream ? `→ ${m.upstream.model}` : '', envSummary(m.env), costSummary(m.cost)].filter(Boolean);
       body.appendChild(h(doc, 'small', 'mv-summary hint', bits.join(' — ')));
+      const pdeg = degradationLine(m);
+      if (pdeg) body.appendChild(h(doc, 'small', 'mv-degradation hint', pdeg));
       for (const s of m.secrets || []) {
         body.appendChild(h(doc, 'small', `mv-secret hint${s.set ? '' : ' err'}`,
           s.set ? `secret ${s.key}: set` : `secret ${s.key}: NOT SET — configure it in the plugin's settings`));
@@ -226,12 +301,41 @@ export function renderModelsList({ globals = [], legacy = [], plugins = [], pred
     root.appendChild(plug);
   }
 
+  // ── From team policy (read-only; team-policy design §8) ──
+  if (policy.length) {
+    const pol = section('From team policy',
+      'Shipped by a team policy — read-only and updated when the policy changes. Add a model with the same id to Your models to override one on this machine.', 'policy');
+    for (const m of policy.filter((x) => keep(x, 'policy'))) {
+      const card = h(doc, 'section', 'card mv-card mv-policy');
+      card.dataset.id = m.id;
+      const body = h(doc, 'div', 'mv-body');
+      const head = h(doc, 'div', 'mv-head');
+      head.appendChild(h(doc, 'b', 'mv-name', m.label || m.id));
+      const badge = h(doc, 'span', 'badge blue mv-origin', 'policy');
+      badge.title = `Team policy on ${m.home}`;
+      head.appendChild(badge);
+      if (globalLc.has(m.id.toLowerCase())) head.appendChild(h(doc, 'span', 'badge violet mv-shadowed', 'overridden by your copy'));
+      const rb = routedBadge(m);
+      if (rb) head.appendChild(rb);
+      body.appendChild(head);
+      const bits = [m.id, effortsSummary(m.efforts, efforts), envSummary(m.env), m.home ? `policy ${m.home}` : ''].filter(Boolean);
+      body.appendChild(h(doc, 'small', 'mv-summary hint', bits.join(' — ')));
+      body.appendChild(h(doc, 'small', 'mv-test-result hint'));
+      card.appendChild(body);
+      const tst = h(doc, 'button', 'btn-ghost mv-test', 'Test');
+      tst.type = 'button'; tst.dataset.id = m.id;
+      card.appendChild(tst);
+      pol.appendChild(card);
+    }
+    root.appendChild(pol);
+  }
+
   // ── Built-ins (read-only) ──
   const builtins = section('Built-in models', hideBuiltin
     ? `Hidden from every picker (${predefined.length} built-in${predefined.length === 1 ? '' : 's'}) — untick the box above to show them.`
-    : 'Shipped with worca. Add a model with the same id to override its label, efforts, or routing.');
+    : 'Shipped with worca. Add a model with the same id to override its label, efforts, or routing.', 'builtin');
   builtins.classList.add(hideBuiltin ? 'mv-builtins-hidden' : 'mv-builtins-shown');
-  for (const m of hideBuiltin ? [] : predefined) {
+  for (const m of (hideBuiltin ? [] : predefined).filter((x) => keep(x, 'builtin'))) {
     const row = h(doc, 'div', 'mv-builtin');
     row.dataset.id = m.id;
     row.appendChild(h(doc, 'b', 'mv-name', m.label));
@@ -242,6 +346,18 @@ export function renderModelsList({ globals = [], legacy = [], plugins = [], pred
     builtins.appendChild(row);
   }
   root.appendChild(builtins);
+
+  // Counts on every header, and a group with nothing left drops out while a search is on.
+  let shown = 0;
+  for (const sec of sections) {
+    const n = sec.body.querySelectorAll('.mv-card, .mv-builtin').length;
+    shown += n;
+    sec.btn.querySelector('.mv-sec-count').textContent = String(n);
+    if (searching && !n) sec.el.classList.add('hidden');
+  }
+  if (searching && !shown) {
+    root.appendChild(h(doc, 'div', 'hist-empty mv-no-hits', q ? `No model matches “${query}”.` : 'No model in this group.'));
+  }
   return root;
 }
 
@@ -278,7 +394,7 @@ function envRow(doc, key = '', value = '') {
  * Returns detached DOM; app.js wires mv-save / mv-cancel / mv-env-add /
  * mv-env-rm and calls collectModelEditor on save.
  */
-export function renderModelEditor(model, efforts, { doc = globalThis.document } = {}) {
+export function renderModelEditor(model, efforts, { doc = globalThis.document, providers = null, copilotModels = [] } = {}) {
   const editing = !!model;
   const root = h(doc, 'section', 'card mv-editor');
   root.dataset.mode = editing ? 'edit' : 'create';
@@ -313,6 +429,11 @@ export function renderModelEditor(model, efforts, { doc = globalThis.document }
   labelInput.value = editing ? (model.label === model.id ? '' : model.label) : '';
   grid.appendChild(field('Label', labelInput));
 
+  // ── Connection (model-bridge-design.md §8.3): direct / env / provider ──
+  // Rendered first among the routing controls: it decides whether the env
+  // rows below carry the routing or Worca's own bridge does.
+  grid.appendChild(field('Connection', renderConnectionSection(model, { doc, providers, copilotModels })));
+
   const effWrap = h(doc, 'div', 'mv-efforts');
   const selected = new Set(editing && Array.isArray(model.efforts) ? model.efforts : efforts);
   for (const e of efforts) {
@@ -323,7 +444,9 @@ export function renderModelEditor(model, efforts, { doc = globalThis.document }
     lab.appendChild(h(doc, 'span', null, e));
     effWrap.appendChild(lab);
   }
-  grid.appendChild(field('Supported efforts', effWrap, 'All checked = every effort (the default).'));
+  const effField = field('Supported efforts', effWrap, 'All checked = every effort (the default).');
+  effField.querySelector('.hint').classList.add('mv-efforts-hint');   // applyConnectionMode rewrites it
+  grid.appendChild(effField);
 
   const envWrap = h(doc, 'div', 'mv-env');
   const rows = editing && model.env ? Object.entries(model.env) : [];
@@ -331,7 +454,7 @@ export function renderModelEditor(model, efforts, { doc = globalThis.document }
   const add = h(doc, 'button', 'btn-ghost mv-env-add', '+ env var');
   add.type = 'button';
   grid.appendChild(field('Routing env (merged into the claude spawn for this model)', envWrap,
-    'e.g. ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN. ANTHROPIC_MODEL sets the wire id sent to --model (the id above stays worca’s handle). Stored values show masked; leave masked to keep. WORCA_* and process keys are reserved.'));
+    'e.g. ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN. ANTHROPIC_MODEL sets the wire id sent to --model (the id above stays worca’s handle). Stored values show masked; leave masked to keep. WORCA_* and process keys are reserved. Through a provider, the bridge owns ANTHROPIC_BASE_URL / ANTHROPIC_AUTH_TOKEN / ANTHROPIC_API_KEY / ANTHROPIC_MODEL — setting them here is refused.'));
   const envBtns = h(doc, 'div', 'mv-env-btns');
   envBtns.appendChild(add);
   if (rows.length) {
@@ -386,6 +509,7 @@ export function renderModelEditor(model, efforts, { doc = globalThis.document }
 
   root.appendChild(grid);
   setModelCost(root, editing ? model.cost : null); // grid is attached now — the block is reachable from root
+  applyConnectionModeIn(root);                       // efforts hint + collapse follow the Connection (now reachable)
   const msg = h(doc, 'p', 'form-msg mv-editor-msg');
   msg.setAttribute('aria-live', 'polite');
   root.appendChild(msg);
@@ -486,6 +610,10 @@ export function collectModelEditor(rootEl) {
     cost = { perMtok };   // empty -> the server rejects it by name, surfaced in the form
   }
 
+  // Connection (model-bridge-design.md §8.3): the object to store, or null to
+  // clear — like 'cli' for pricing, the form shows the truth.
+  const { upstream } = collectConnection(rootEl);
+
   const body = {
     ...(editing ? {} : { id }),
     label,
@@ -493,10 +621,20 @@ export function collectModelEditor(rootEl) {
     efforts: efforts.length === allCount ? [] : efforts,
     env,
     cost,
+    // Create mode has nothing to clear, so a null upstream is simply omitted
+    // and the POST body stays byte-identical for a non-bridged entry.
+    ...(upstream === undefined || (!editing && upstream === null) ? {} : { upstream }),
   };
   return { id: editing ? id : null, body };
 }
 
+/** applyConnectionMode over an editor root (re-exported here so app.js's one
+ *  delegated `change` handler for the editor needs a single import). */
+export function applyConnectionModeIn(rootEl) {
+  const conn = rootEl && rootEl.querySelector && rootEl.querySelector('.mv-conn');
+  if (conn) applyConnectionMode(conn);
+}
+
 // ── Share-as-plugin export wizard (design §9.5) ─────────────────────────────
 
 // Credential-looking env keys default to "Require at install". Word-ish
@@ -620,7 +758,14 @@ export function deleteRefsSummary(id, refs) {
     ...((refs && refs.nodes) || []).map((n) => n.projectKey),
     ...((refs && refs.steps) || []).map((s) => s.projectKey),
   ]).size;
-  if (!nodes && !steps) return `Delete model "${id}"? No pipeline configuration references it.`;
+  // Settings › Memory's defragment model is the one GLOBAL ref (globalModelRefs `memoryDefrag`).
+  const defrag = !!(refs && refs.memoryDefrag);
+  if (!nodes && !steps) {
+    return defrag
+      ? `Delete model "${id}"? Memory defragment runs use it (Settings › Memory) — that setting is cleared and they fall back to the default.`
+      : `Delete model "${id}"? No pipeline configuration references it.`;
+  }
   return `Delete model "${id}"? This also clears ${nodes} node selection${nodes === 1 ? '' : 's'} and ` +
-    `${steps} role selection${steps === 1 ? '' : 's'} across ${projects} project${projects === 1 ? '' : 's'}.`;
+    `${steps} role selection${steps === 1 ? '' : 's'} across ${projects} project${projects === 1 ? '' : 's'}` +
+    (defrag ? ', and the Memory defragment model (Settings › Memory).' : '.');
 }

package/ui/public/node-tunables.mjs

@@ -142,9 +142,13 @@ export function pruneNodeSelection(row, next = {}) {
   // the setters ("select a model before choosing an effort").
   const inheritPair = (eff.model || '') === (row.def.model || '')
     && (eff.effort || '') === (row.def.effort || '');
+  // A PINNED row (Settings › Memory owns the pair) never edits model/effort, and the setters
+  // REPLACE both on every save: re-send the project's own stored pick untouched, so saving
+  // another tunable cannot erase it — it applies again the moment the setting is cleared.
+  const kept = row.pinned && row.storedPair ? row.storedPair : null;
   return {
-    model: inheritPair ? '' : (eff.model || ''),
-    effort: inheritPair || !eff.model ? '' : eff.effort,
+    model: kept ? kept.model : (inheritPair ? '' : (eff.model || '')),
+    effort: kept ? kept.effort : (inheritPair || !eff.model ? '' : eff.effort),
     fanOut: !!eff.fanOut === !!row.def.fanOut ? null : !!eff.fanOut,
     askQuestions: row.askQuestions === null || row.questionsLocked
       ? undefined // no capability / locked: never persist a value for it
@@ -168,6 +172,25 @@ export function buildGraphNodeRows(tpl, registry, runConfig, opts = {}) {
   // app.js hands its own panelPortsFn (falls back to the Composer's index for
   // agents the palette omits); the card and the tests use the registry alone.
   const portsFn = typeof opts.portsFn === 'function' ? opts.portsFn : portsFnFor(reg);
+  // Settings › Memory (the built-in Memory defragment workflow only): GET /api/workflows/:id
+  // stamps `pinnedAgentModel` when a valid pair is stored, and every run of the workflow then
+  // uses it for every agent node whatever the project picked (resolveGraph `agentPair`). So the
+  // rows SHOW the pair as the default and carry `pinned`; both renderers lock model and effort —
+  // an editable model the run ignores would be a control that lies.
+  const pin = tpl && tpl.pinnedAgentModel && typeof tpl.pinnedAgentModel.model === 'string' && tpl.pinnedAgentModel.model
+    ? tpl.pinnedAgentModel : null;
+  const withoutPair = ({ model: _m, effort: _e, ...rest }) => rest;
+  // A pinned row re-sends the project's hidden pick on every save (pruneNodeSelection), and the
+  // setter refuses a model that left the catalog or an effort it no longer offers — so heal the
+  // pick against the catalog the caller holds (`opts.models`), dropping exactly what an unpinned
+  // row's selects would drop. No catalog (not loaded yet) → the pick as stored.
+  const catalog = Array.isArray(opts.models) && opts.models.length ? opts.models : null;
+  const healPair = (model, effort) => {
+    if (!model || !catalog) return { model: model || '', effort: (model && effort) || '' };
+    const hit = catalog.find((m) => m && m.id === model);
+    if (!hit) return { model: '', effort: '' };
+    return { model, effort: effort && Array.isArray(hit.efforts) && hit.efforts.includes(effort) ? effort : '' };
+  };
   const order = classifyLoops(tpl, portsFn).launchOrder;
   const byId = new Map(tpl.nodes.map((n) => [n.id, n]));
   const rank = new Map(order.map((id, i) => [id, i]));
@@ -176,8 +199,12 @@ export function buildGraphNodeRows(tpl, registry, runConfig, opts = {}) {
   for (const node of agentNodes) {
     const meta = reg[node.key] || null;
     const role = legacySteps ? node.key : null;
-    const saved = { ...(role ? legacySteps[role] : null), ...nodes[node.id] };
-    const wfDef = (node.config && typeof node.config === 'object') ? node.config : {};
+    const stored = { ...(role ? legacySteps[role] : null), ...nodes[node.id] };
+    const authored = (node.config && typeof node.config === 'object') ? node.config : {};
+    const saved = pin ? withoutPair(stored) : stored;
+    const wfDef = pin
+      ? { ...withoutPair(authored), model: pin.model, ...(typeof pin.effort === 'string' && pin.effort ? { effort: pin.effort } : {}) }
+      : authored;
     const metaFan = meta && typeof meta.fanOut === 'boolean' ? meta.fanOut : false;
     const metaAsks = !!(meta && meta.asksQuestions);
     const metaLocked = !!(meta && meta.questionsLocked);
@@ -195,6 +222,8 @@ export function buildGraphNodeRows(tpl, registry, runConfig, opts = {}) {
       def: t.def, override: t.override,
       modified: modifiedFieldsOf(t, t.def,
         { asksQuestions: metaAsks, questionsLocked: metaLocked }).length > 0,
+      // `storedPair`: the project's own pick the pin hides — pruneNodeSelection re-sends it.
+      ...(pin ? { pinned: 'settings', storedPair: healPair(stored.model, stored.effort) } : {}),
     });
   }
   return rows;

package/ui/public/plugins-view.mjs

@@ -34,7 +34,7 @@ function iconBtn(doc, cls, icon, label) {
 function contribSummary(c) {
   const n = (v) => (Array.isArray(v) ? v.length : (Number.isFinite(v) ? v : 0));
   const parts = [
-    [n(c && c.agents), 'agent'], [n(c && c.taskSources), 'source'],
+    [n(c && c.agents), 'agent'], [n(c && c.scripts), 'script'], [n(c && c.taskSources), 'source'],
     [n(c && c.chatChannels), 'chat channel'], [n(c && c.models), 'model'],
     [n(c && c.skills), 'skill'], [n(c && c.workflows), 'workflow'],
   ].filter(([k]) => k > 0).map(([k, w]) => `${k} ${w}${k > 1 ? 's' : ''}`);
@@ -59,6 +59,8 @@ export function renderPluginList(plugins, { doc = globalThis.document, channelSt
     if (p.linked) head.appendChild(h(doc, 'span', 'badge waiting pl-linked', 'linked'));
     if (p.apiMismatch) head.appendChild(h(doc, 'span', 'badge amber pl-api-mismatch', 'needs update'));
     else if (p.broken) head.appendChild(h(doc, 'span', 'badge red pl-broken', 'broken'));
+    // A shipped python script on a host without python: a chip, never a block.
+    if (p.pythonMissing) head.appendChild(h(doc, 'span', 'badge amber pl-python-missing', 'python not found'));
     // Enabling a plugin acts on a live system the moment it flips, so it reads
     // as a switch. `.switch` MUST be the input's immediate next sibling — the
     // `.sw-input:checked + .switch` rule is what paints the on state.
@@ -100,6 +102,7 @@ export function renderPluginList(plugins, { doc = globalThis.document, channelSt
       const b = h(doc, 'button', `btn-ghost ${cls}`, label);
       b.type = 'button';
       b.dataset.name = p.name;
+      if (cls === 'pl-doctor') b.dataset.minLevel = 'expert';   // diagnostics (docs/ui-levels.md)
       actions.appendChild(b);
     }
     card.appendChild(actions);
@@ -126,6 +129,7 @@ export function channelBadge(doc, c) {
 // listener. Empty/nullish input -> childless container (app.js skips mounting).
 export function renderOrphanList(orphans, { doc = globalThis.document } = {}) {
   const root = h(doc, 'div', 'pl-orphans');
+  root.dataset.minLevel = 'expert';                       // purge of leftover data (docs/ui-levels.md)
   if (!orphans || !orphans.length) return root;
   root.appendChild(h(doc, 'h3', 'pl-orphans-title', 'Leftover data'));
   for (const o of orphans) {
@@ -159,6 +163,24 @@ export function renderInstallConsent(entry, inventory, { doc = globalThis.docume
   for (const a of inv.agents || []) {
     agents.appendChild(h(doc, 'div', 'pl-consent-row mono',
       `${a.key} — tools: ${(a.tools || []).join(', ') || 'none declared'}`));
+    // Ask forms (spec §10): how many question forms this agent can put on
+    // screen, and which file types they may display from the run folder. An
+    // older snapshot has neither key, so both are read defensively.
+    const forms = Array.isArray(a.forms) ? a.forms : [];
+    if (forms.length) {
+      const types = Array.isArray(a.fileTypes) ? a.fileTypes : [];
+      agents.appendChild(h(doc, 'div', 'pl-consent-row pl-consent-forms',
+        `${forms.length} form${forms.length === 1 ? '' : 's'}: ${forms.join(', ')}`
+        + (types.length ? ` · may display ${types.join(', ')} from the run folder` : '')));
+    }
+  }
+  if ((inv.scripts || []).length) {
+    const scripts = section(`Scripts (${inv.scripts.length})`);
+    for (const s of inv.scripts) {
+      scripts.appendChild(h(doc, 'div', 'pl-consent-row mono',
+        `${s.key} — ${s.runtime}${s.command ? ` · ${s.command}` : s.file ? ` · ${s.file}` : ''}`
+        + `${s.cases ? ` · ${s.cases} case${s.cases === 1 ? '' : 's'}` : ''}`));
+    }
   }
   const sources = section(`Task sources (${(inv.taskSources || []).length})`);
   for (const s of inv.taskSources || []) {

package/ui/public/results-view.mjs

@@ -124,14 +124,14 @@ export function workflowPickerLabel(wf, enabledPluginNames = []) {
  * Rows for the History Overview "Memory changes" block (agent-memory-design.md §6).
  * Pure: `memory` is results.json.memory / the detail's `memory` ({ changes }).
  * One row per change entry that carries at least one file; chips in the order
- * added, modified, deleted, rejected; a rejected chip's `title` is the reason.
+ * added, modified, deleted, rejected, failed; a rejected or failed chip's `title` is the reason.
  * Each chip also carries the ref it was built from — `scope` (mount-relative:
  * `global` | `project` | `projects/<key>`) and `name` — so History can link to
  * the file in its Memory view (B6).
  */
 export function memoryChangesRows(memory) {
   const changes = Array.isArray(memory?.changes) ? memory.changes : [];
-  const file = (r) => `${r.scope}/${r.name}.md`;
+  const file = (r) => `${r.scope ? `${r.scope}/` : ''}${r.name}.md`;
   const rows = [];
   for (const c of changes) {
     const chips = [
@@ -139,6 +139,8 @@ export function memoryChangesRows(memory) {
       ...(c.modified || []).map((r) => ({ kind: 'mod', text: `~ ${file(r)}`, scope: r.scope, name: r.name })),
       ...(c.deleted || []).map((r) => ({ kind: 'del', text: `− ${file(r)}`, scope: r.scope, name: r.name })),
       ...(c.rejected || []).map((r) => ({ kind: 'rej', text: `✕ ${file(r)}`, title: String(r.reason || ''), scope: r.scope, name: r.name })),
+      // A write that never reached the mount (a refused tool call): nothing in the store to open.
+      ...(c.failed || []).map((r) => ({ kind: 'fail', text: `⊘ ${file(r)}`, title: String(r.reason || ''), scope: r.scope, name: r.name })),
     ];
     if (chips.length) rows.push({ node: c.agentKey || c.nodeId || 'run', chips });
   }