Wave-5 chunk B: three model slots, search-engine row, first-run setup flow

Chunk B (owner-designed, model-slots wave) on the merged engine surface
(main 1d66a17):

AGENT SECTION — SLOTS ONLY (owner ruling)
- The six per-role model rows are GONE; three slot rows instead:
  Strong (Prober + Teacher), Cheap (five workhorse roles), Vision
  (visual maker + PDF reader), roster + resolved-default in every hint.
- Slot dropdowns share the app's menu language over the FEDERATED
  catalog (/api/models = keyed providers only, fresh per call — saving
  a key in Keys immediately widens the picker); the vision slot
  filters to image-capable models (Model.input); the menu's highlight
  now matches provider+id (ids can collide across providers).
- Slots write the new models section (PUT /api/settings/models) through
  the dialog's write seam; per-role overrides stay schema-only.
- ModelMenuList rows read 'provider · id' — federation makes the
  provider bookkeeping-relevant. Usage stamps render provider-qualified
  (prettyModel(qualified): 'Glm 5.3 Flash · openrouter') in the stats
  bar's turn lines.

SEARCH ENGINE (search wave: no default, owner)
- A row in Tools: Tavily/Brave via the shared-menu look, Automatic =
  the pin removed (auto-activation). The live reason line comes from
  /api/search; no engine key at all grays the whole row + disables the
  trigger (a keyless choice would only block auto-activation).

FIRST-RUN SETUP FLOW (owner design A: composer CTA + send interception)
- Chats cannot start until all three slots are picked — no defaults
  for 33 providers (slotsConfigured: all three slot models required).
- The graph view's new-session dock (home) shows a 'Set up your models'
  CTA while unconfigured; submitting a topic opens the SetupDialog WITH
  THE DRAFT PRESERVED; Save stores the models section and the queued
  message sends. Same interception on /chat/new sends.
- STAGED BY DEPENDENCY (owner: keys first, models after): no keyed
  provider → stage 1 deep-links the settings dialog on Keys (open now
  takes a section); a saved key reopens at stage 2 on the next submit.
- Stage 2: Strong → Cheap → Vision pickers (federated, vision-filtered,
  all three required). Closable without configuring — browsing stays
  possible; the gate is the send, not the dialog. Layered Esc: an open
  slot menu eats Esc before the dialog.
- Two closure bugs caught live: onDone→start/send captured the stale
  pre-save 'configured' (the flow now forces the replayed send); menu-Esc
  used to close the whole dialog.

Settings-dialog provider: open(section?) lands on a section (stage 1
deep-link). Tests: composeSlotModel/composeSearchEngine pure, slot SSR
replacing role rows, slotsConfigured/setupStage first-run gates,
provider-qualified prettyModel. Gates: typecheck, lint, 792/792, build.

components/usage-format.ts

@@ -15,14 +15,30 @@ export function formatTokens(n: number): string {
 	return String(n);
 }
 
+/** Split a provider-qualified stamp "provider:id" (the usage contracts'
+ *  qualification, model-slots wave 2026-09-20) into its two coordinates.
+ *  No colon = no provider qualification (a bare catalog id). */
+export function splitQualified(id: string): { provider: string | null; id: string } {
+	const colon = id.indexOf(":");
+	if (colon === -1) return { provider: null, id };
+	return { provider: id.slice(0, colon), id: id.slice(colon + 1) };
+}
+
 /**
  * "z-ai/glm-5.3-flash" → "Glm 5.3 Flash" — vendor prefix dropped, dashes to
  * spaces, capitalized; a trailing all-digit segment (OpenRouter's date
  * suffix, "qwen3.8-max-0902") is dropped. Quiet-chip friendly.
+ *
+ * With `qualified` (usage stamps are "provider:id", model-slots wave):
+ * the provider rides as a quiet suffix — "Glm 5.3 Flash · openrouter" —
+ * because with federation the same model via two providers is genuinely
+ * different bookkeeping. Bare catalog ids are unchanged.
  */
-export function prettyModel(id: string): string {
-	const short = id.includes("/") ? id.slice(id.lastIndexOf("/") + 1) : id;
+export function prettyModel(id: string, qualified = false): string {
+	const { provider, id: bare } = splitQualified(id);
+	const short = bare.includes("/") ? bare.slice(bare.lastIndexOf("/") + 1) : bare;
 	const parts = short.split("-");
 	const trimmed = /^\d+$/.test(parts[parts.length - 1] ?? "") ? parts.slice(0, -1) : parts;
-	return trimmed.map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(" ");
+	const pretty = trimmed.map((p) => p.charAt(0).toUpperCase() + p.slice(1)).join(" ");
+	return qualified && provider ? `${pretty} · ${provider}` : pretty;
 }