…n holdouts

PR #162 (dashboard snapshot wire) shipped 2-of-4 hero fields to
snapshot + correctly kept the other 2 (cost + health) on fan-out
per the anti-coercion discipline — snapshot lacked the necessary
fields. PR #169 (snapshot v3 cost_ladder.spent_to_date_usd +
credit_pool_usd) + PR #170 (snapshot v4 daemon_health) closed
both data gaps. This bucket flips cost + health TO snapshot on
the warm-cache path — 4-of-4 originally-spec'd dashboard hero
fields are now snapshot-driven when the cost-holder + daemon-
coordinator are populated.

Two new projection helpers
==========================

  * `projectCostFromSnapshot(snap) → CostStateResponse | null`
    Reads snap.cost_ladder. Returns null when spent_to_date_usd /
    current_tier / model_default are "unknown" — caller fans out
    for cost specifically (per-field anti-coercion preserved).
    On success: projects current.spent_to_date_usd / credit_pool_usd
    / active_rung (CostRung-enum-validated) / effective_model_tier
    (haiku/sonnet/opus inferred from model_default string).
    Non-rendered CostStateResponse fields (rate_limit_pulse,
    deferred_tickets, reconciliation_history) filled with empty
    sentinels so the type contract holds — CostCardBody doesn't
    read them; CostStatePage still fans out for the full panel.

  * `projectHealthFromSnapshot(snap) → HealthRollupResponse | null`
    Reads snap.daemon_health (NOT service_health — that's
    SaaS-deps, which was the semantic mismatch #162 correctly
    flagged). Returns null when overall_status is "unknown".
    On success: maps snapshot enum (healthy/degraded/unhealthy)
    → HealthStatus enum (healthy/degraded/outage). control_plane +
    worker mirror overall (snapshot doesn't carry the
    distinction yet — operator click-through to /health-rollup
    gives the full fan-out breakdown).

Both helpers return null instead of fabricating defaults so the
caller can decide PER-FIELD whether to fall back to fan-out. This
preserves the original PR #162 anti-coercion intent at field
granularity (vs the all-or-nothing per-card it had to use before
the substrate caught up).

DashboardPage.tsx wiring
========================

`loadInitial` (the snapshot-first path):

  1. Call api.getSnapshot()
  2. If snapshot has projectable cost_ladder + daemon_health:
     - operational + alerts + cost + health all set from snapshot
     - Fan out only the remaining 15 non-hero panels (sea,
       control, boot, dr, capabilities, charter, recentEvents,
       runbooks, heartbeat, mcpClients, webhookEvents,
       agentActivity, slackDM, email, reasoning)
  3. If snapshot projection returns null for cost OR health,
     PUSH that specific endpoint onto the remaining-fetches
     list — fan out for that field only.

snapshotProjectedFields set is populated with each field that
actually projected — drives the FreshnessBadge's
"N of 4 hero fields from snapshot" counter (= 4 in the
happy path).

forceFullLiveRefresh (operator-triggered force) keeps the
existing PR #162 behavior: bypasses snapshot, fans out
everything including cost + health. Per-card retry buttons
in CostCardBody / HealthHero error states ALSO fan out
(those use api.getCostState() / api.getHealthRollup() directly
as before).

FreshnessBadge update
=====================

Two new props:

  * `snapshotProjectedHeroCount` — count of the originally-spec'd
    hero fields actually projected from snapshot (0-4)
  * `totalHeroFields` — typically 4 (operational + alerts + cost
    + health)

Cost-hint copy now distinguishes:
  * "$0 cost view · all 4 hero fields from snapshot" — fully
    delivering warm cache
  * "$0 cost view · 2 of 4 hero fields from snapshot" — partial
    (some holders still booting → fell back to fan-out per-field)

Operator can tell at a glance whether the warm-cache path is
fully delivering or only partial.

api.ts SnapshotResponse type updates
====================================

The TS interface was stale relative to PR #169 + #170. Added:

  * cost_ladder.spent_to_date_usd: number | "unknown"
  * cost_ladder.credit_pool_usd: number
  * daemon_health (entire section): overall_status / boot_at /
    uptime_seconds / listeners / recent_error_count_5min

This is REQUIRED before the projection helpers can compile;
without it, the .spent_to_date_usd / .daemon_health reads in
projectCost / projectHealth would be type errors.

PR #162 anti-projection tests FLIPPED
=====================================

Per spec discipline ("don't just delete — replace with the
inverse invariant"):

  * `test_dashboard_does_not_project_cost_from_snapshot` →
    `test_dashboard_projects_cost_from_snapshot`
    Asserts: helper exists, reads spent_to_date_usd +
    credit_pool_usd, returns null when "unknown", caller fans
    out specifically when projectedCost === null.

  * `test_dashboard_does_not_project_health_from_snapshot` →
    `test_dashboard_projects_health_from_snapshot`
    Asserts: helper exists, reads daemon_health (NOT
    service_health — semantic-mismatch guard preserved), returns
    null when overall_status is "unknown", caller fans out
    when projectedHealth === null.

Plus 2 NEW tests:
  * `test_freshness_badge_surfaces_hero_field_count` — badge
    renders the N-of-M signal so 4-of-4 vs partial is visible
  * `test_dashboard_passes_hero_count_to_freshness_badge` —
    DASHBOARD_HERO_FIELD_COUNT === 4 literal + the hero-field
    keys are exactly ["operational","alerts","cost","health"]
    (regression guard against silently expanding to e.g. "boot"
    which isn't snapshot-driven and would make "of 4" wrong)

19/19 tests pass (17 from PR #162 baseline + 2 new).

Verification
============

  * 19/19 tests pass
  * tsc -b clean
  * vite build clean
  * Badge variants rendered at web/docs/dashboard-snapshot-fully-wired/
    (badge.png shows all 5 variants — 2 new ones + 3 preserved)
  * Fan-out elimination verified at DashboardPage.tsx:1270-1345 —
    on warm cache + populated holders, getOperationalState +
    getCurrentAlerts + getCostState + getHealthRollup are all NOT
    called from loadInitial

Refs:
  * rafe-walker/kora-docs
    17_cc_bucket_prompts/KR-FE-DASHBOARD-SNAPSHOT-FULLY-WIRED_close_anti_coercion_holdouts.md
  * PR #162 — original snapshot-wire (2-of-4 fields shipped, anti-pins added)
  * PR #169 — snapshot v3 cost_ladder USD fields (closed cost data gap)
  * PR #170 — snapshot v4 daemon_health section (closed health data gap)

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>