diff --git a/src/lib/stores/settings.svelte.ts b/src/lib/stores/settings.svelte.ts
index bd3b0e9..0cb1840 100644
--- a/src/lib/stores/settings.svelte.ts
+++ b/src/lib/stores/settings.svelte.ts
@@ -28,6 +28,7 @@ const DEFAULT_SETTINGS: AppSettings = {
   low_overhead: false,
   default_record: false, // recording OFF by default (ADR-0009)
   consent_acknowledged: false,
+  hosted_ai_acknowledged: false, // hosted-AI "leaves your device" notice (ADR-0011)
   sync_enabled: false, // sync OFF by default (ADR-0010)
   mcp_enabled: false, // MCP server OFF by default (ADR-0011)
   retention_max_age_days: null, // no cap by default (FR-STORE-2)
@@ -183,8 +184,16 @@ class SettingsStore {
     }
   }
 
-  /** Persist the LLM provider/endpoint/model and refresh status (T5.2). */
-  async setLlmProvider(config: { provider: string; endpoint?: string; model?: string }) {
+  /** Persist the LLM provider/endpoint/model (+ hosted apiKey, ADR-0011) and
+   * refresh status (T5.2/T10.2). The key is only ever sent to the backend
+   * command (which stores it in the OS credential store) — never held here
+   * beyond this call, and never merged into `this.settings`. */
+  async setLlmProvider(config: {
+    provider: string;
+    endpoint?: string;
+    model?: string;
+    apiKey?: string;
+  }) {
     this.llmSaving = true;
     // Optimistic local update so the form reflects the change immediately.
     this.settings = {
@@ -202,6 +211,13 @@ class SettingsStore {
     }
   }
 
+  /** Persist the one-time hosted-AI "leaves your device" acknowledgment
+   * (ADR-0011, T10.3) — same generic patch() every other boolean setting
+   * here uses (see setDefaultRecord below). */
+  acknowledgeHostedAi() {
+    return this.patch({ hosted_ai_acknowledged: true });
+  }
+
   async setPreferredBackend(backend: AppSettings["preferred_backend"]) {
     await this.patch({ preferred_backend: backend });
     await this.loadHardware();