Merge branch 'v143/ai' into release/v1.43.0

# Conflicts:
#	docs/api/openapi.yaml
#	messages/de.json
#	messages/en.json
#	messages/es.json
#	messages/fr.json
#	messages/it.json
#	messages/ko.json
#	messages/pl.json
#	src/__tests__/contract-stub-inventory.test.ts

src/__tests__/ai-egress-capability-guard.test.ts

@@ -19,6 +19,7 @@ import { describe, expect, it } from "vitest";
 import { readFileSync } from "node:fs";
 import { join } from "node:path";
 
+import { AI_CAPABILITY_KEYS } from "@/lib/ai/capabilities/types";
 import { DOCUMENT_AI_RUN_KINDS } from "@/lib/documents/ai-runs/types";
 import type { runStatusCompletion } from "@/lib/insights/status-provider";
 
@@ -283,3 +284,29 @@ describe("the status chokepoint's capability argument", () => {
     expect(withCapability.capability).toBe("statusText");
   });
 });
+
+/**
+ * v1.43 (#1217) — capabilities whose model call has not landed yet. The
+ * capability is published (clients can render its state) before the route
+ * that reads a label photo exists; until then that route must not reach a
+ * provider at all. When it does, it becomes an egress site above, re-checking
+ * its capability at the wire like every document read, and leaves this list.
+ */
+const CAPABILITY_EGRESS_PENDING: Record<string, string> = {
+  supplementLabel: "app/api/medications/[id]/ingredients/extract/route.ts",
+};
+
+describe("capabilities whose model call is still to come", () => {
+  it.each(Object.entries(CAPABILITY_EGRESS_PENDING))(
+    "%s is a published capability whose route does not call a model yet",
+    (key, rel) => {
+      expect(AI_CAPABILITY_KEYS as readonly string[]).toContain(key);
+      const text = code(rel);
+      expect(
+        EGRESS_CALL.test(text),
+        `${rel} calls a provider now: list it in EGRESS_SITES with its re-check and drop it here`,
+      ).toBe(false);
+      expect(/\bnotImplemented\s*\(/.test(text)).toBe(true);
+    },
+  );
+});

src/__tests__/contract-stub-inventory.test.ts

@@ -38,7 +38,6 @@ const CONTRACT_STUBS: Readonly<Record<string, readonly string[]>> = {
   ],
   "anamnesis/life-circumstances/route.ts": ["anamnesis.life_circumstances.get"],
   "auth/claim/sso/route.ts": ["profile_claim.sso.start"],
-  "auth/me/ai-usage/route.ts": ["auth.me.ai_usage.put"],
   "dawarich/connect/route.ts": ["dawarich.connect"],
   "dawarich/disconnect/route.ts": ["dawarich.disconnect"],
   "dawarich/places/route.ts": ["dawarich.places.get"],
@@ -62,7 +61,7 @@ const CONTRACT_STUBS: Readonly<Record<string, readonly string[]>> = {
 };
 
 /** The size of the register when it was written; see the header. */
-const REGISTER_SIZE = 23;
+const REGISTER_SIZE = 21;
 
 function routeFiles(): string[] {
   return walkSourceFiles(API_ROOT, { floor: 400, extensions: [".ts"] })

src/__tests__/success-affordance-guard.test.ts

@@ -92,6 +92,8 @@ const PINNED_AFFORDANCES: Record<
     "text-success": 1,
   },
   "src/components/admin/assistant-section.tsx": { "toast.success": 1 },
+  // v1.43 — the AI usage bounds: a settings save, not a write with counts.
+  "src/components/admin/ai-usage-section.tsx": { "toast.success": 1 },
   "src/components/admin/backups-section.tsx": { "toast.success": 4 },
   "src/components/admin/central-codex-section.tsx": { "toast.success": 2 },
   "src/components/admin/danger-zone-section.tsx": { "text-success": 1 },