Extraction-UX data layer: the chunk budget becomes a graph setting; the chat view gets a per-session coverage read

Owner-locked extraction-UX redesign (dispatch 2026-09-24), part 1 (data
layer; the UI chunk follows).

THRESHOLD -> SETTING
- config.ts's EXTRACTION.chunkTokens dies; the default moves into
  FACTORY_SETTINGS.graph.extractionChunkTokens (4096, the old constant's
  value). GraphSettings gains the optional field, Required at resolution
  via the standard ?? FACTORY pattern — pre-redesign records resolve the
  default cleanly.
- FLOOR 500 (the implementer's call, documented on the field): every run
  pays the graph-carrying prompt overhead out of the write channel's
  money — a smaller budget fires penny-batches that cost more per
  extracted token than the content is worth. The sanitizer CLAMPS up
  (bd68486 clamp-never-reject discipline: fractions floor, junk drops);
  the settings PUT REJECTS below-floor with the rationale in the message.
  No ceiling: a large budget just delays extraction — the user's stated
  cost/thoroughness tradeoff, not a misconfiguration to police.
- The trigger (turn-service.triggerExtraction) takes the budget as a
  parameter — chat-handler passes effective.graph.extractionChunkTokens,
  the fresh per-turn read, same as every other gate.
- The pipeline's BATCH side threads through the same number:
  ExtractionPipelineDeps gains an OPTIONAL getChunkTokens getter with the
  factory default (Teacher's 24 test fixtures stay untouched; the two
  call-site lines inside extraction.ts are the only cross-band edits,
  flagged). chat-handler + backfill/import-notes wire the live
  effectiveSettings — trigger and batches share one budget, always.

PER-SESSION COVERAGE READ
- sessionCoverage(chatId) (server/chats.ts): the chat view's ring-meter
  block — totalMessages/coveredCount/uncoveredCount/coveredTokens/
  uncoveredTokens (the same coverageOf derivation /api/graph/coverage
  serves, scoped to one chat), running (chat-kind extraction registered
  for this id), and lastFoldedAt (the chat's newest coverage row's fold
  — a cheap single pass; null before any fold). GET /api/chats/[id]
  carries it as coverage: {...}; unknown chat -> null (the route 404s
  first).
- /api/graph/coverage (the all-sessions list) compiles untouched — the
  per-session read is a scoping of it, not a supersession; the UI's
  sidebar/ring chunk decides which surface it consumes.

Tests: factory/sanitizer pins (clamp-up, fraction-floor, junk-drop),
resolution pins (absent -> 4096, stored 2000 wins), settings-body pins
(valid/absent/fraction/below-floor 400/junk 400), sessionCoverage pins
(derived split, newest-fold scoping, cross-session isolation, running via
the registry, null on unknown chat). 893/893.

src/core/settings.ts

@@ -255,6 +255,26 @@ export interface GraphSettings {
 	 *  names, and the prober graph tools read the ledgers directly — there
 	 *  is nothing left to configure. Data stays stored either way. */
 	enabled?: boolean;
+	/** The chunk budget (extraction-UX redesign, owner 2026-09-24): the
+	 *  transcript-token share of the extractor's context — a run fires
+	 *  when a chat's UNCOVERED tokens reach it, and the run batches the
+	 *  oldest uncovered messages into runs of ≤ this many tokens. It
+	 *  bounds both cost and chunk size (the extractor prompt also
+	 *  carries the whole graph + instructions, so a smaller budget means
+	 *  more, smaller runs — each paying that fixed overhead).
+	 *
+	 *  FACTORY DEFAULT 4096 (the pre-setting constant, config.ts's
+	 *  EXTRACTION.chunkTokens — vision-extraction-coverage.md, 2026-09-15).
+	 *
+	 *  FLOOR 500 (EXTRACTION_CHUNK_TOKENS_FLOOR, the implementer's call
+	 *  per the owner's dispatch): every run pays the graph-carrying
+	 *  prompt overhead out of the write channel's money — a budget below
+	 *  ~500 tokens would fire penny-batches that cost more per extracted
+	 *  token than the content is worth, so the sanitizer clamps and the
+	 *  PUT rejects below it. NO CEILING on purpose: a large budget just
+	 *  delays extraction — the user's stated cost/thoroughness tradeoff,
+	 *  not a misconfiguration to police. */
+	extractionChunkTokens?: number;
 }
 
 /** THE record. Every section optional (delta); unknown top-level keys are
@@ -307,9 +327,14 @@ export const FACTORY_SETTINGS: FactorySettings = {
 		sessionNameSerif: true,
 		mdRendering: { headingWeight: 900, boldColor: null, italicColor: null },
 	},
-	graph: { enabled: true },
+	graph: { enabled: true, extractionChunkTokens: 4096 },
 };
 
+/** The chunk budget's validated floor (GraphSettings.extractionChunkTokens
+ *  — see its doc for the penny-batch rationale; the settings PUT names this
+ *  in its rejection, the sanitizer clamps to it). */
+export const EXTRACTION_CHUNK_TOKENS_FLOOR = 500;
+
 // ─── Sanitizer ─────────────────────────────────────────────────────────────
 
 const PROSE_FONT_MIN = 12;
@@ -462,9 +487,20 @@ function sanitizeGraph(raw: Record<string, unknown>): GraphSettings {
 	// this reconstruction — the migration story: the next graph-section
 	// write (PUT is replace-whole) persists the collapsed shape, and no
 	// active code ever looks at the stale fields.
+	//
+	// extractionChunkTokens (extraction-UX redesign, 2026-09-24): the chunk
+	// budget — clamp-never-reject (the bd68486 discipline): a finite
+	// positive number floors to EXTRACTION_CHUNK_TOKENS_FLOOR (fractions
+	// floor to integers), anything else drops to the factory default at
+	// resolution. A disk record below the floor (older app, hand edit)
+	// clamps UP — the floor is a cost protection, not data to honor.
 	const out: GraphSettings = {};
 	const enabled = boolOrDrop(raw.enabled);
 	if (enabled !== undefined) out.enabled = enabled;
+	const rawTokens = raw.extractionChunkTokens;
+	if (typeof rawTokens === "number" && Number.isFinite(rawTokens) && rawTokens > 0) {
+		out.extractionChunkTokens = Math.max(EXTRACTION_CHUNK_TOKENS_FLOOR, Math.floor(rawTokens));
+	}
 	return out;
 }