@iowarp/clio-coder 0.3.8 → 0.4.0

package/src/interactive/interactive-application.ts

@@ -3,6 +3,7 @@ import type { ClioSettings } from "../core/config.js";
 import type { SafeEventBus } from "../core/event-bus.js";
 import { expandInlineFileReferencesAsync } from "../core/file-references.js";
 import type { PendingSkillRequest } from "../core/skill-activation.js";
+import { clioStateDir } from "../core/xdg.js";
 import type { AgentsContract } from "../domains/agents/contract.js";
 import type { ClioKeybinding } from "../domains/config/keybindings.js";
 import type { ContextState } from "../domains/context/index.js";
@@ -11,6 +12,8 @@ import type { ExtensionsContract } from "../domains/extensions/index.js";
 import type { InteropContract } from "../domains/interop/index.js";
 import type { TaskMemoryOperatorStatus } from "../domains/memory/index.js";
 import { openDetachedBatchViews } from "../domains/middleware/index.js";
+import type { MuxContract } from "../domains/mux/index.js";
+import type { PanesOperations, PanesWatchController } from "../domains/mux/operations.js";
 import type { ObservabilityContract } from "../domains/observability/index.js";
 import type { ProvidersContract, ThinkingLevel } from "../domains/providers/index.js";
 import type { ResourcesContract } from "../domains/resources/index.js";
@@ -39,8 +42,11 @@ import { createProcessInteractiveShell, getActiveRenderTrace } from "./interacti
 import { createInteractiveSlashRuntime, resolveAvailableThinkingLevels } from "./interactive-slash-runtime.js";
 import { createInteractiveSubscriptions } from "./interactive-subscriptions.js";
 import { createInteractiveTickers } from "./interactive-tickers.js";
+import type { createMuxBridge } from "./mux-bridge.js";
 import { createOverlayLifecycle, type OverlayLifecycleController, type OverlayState } from "./overlay-lifecycle.js";
 import { interopOverlaySurface } from "./overlays/interop.js";
+import { paneWatchDecision } from "./pane-policy.js";
+import { writeInputWedgeDump } from "./render-trace.js";
 import { settleChatBeforeSessionSwitch } from "./session-switch-settlement.js";
 import { createSessionTranscript } from "./session-transcript.js";
 import type {
@@ -51,7 +57,9 @@ import type {
 } from "./slash-commands.js";
 import { processAutoPacingAllowed, resolveSmoothStreamingMode } from "./stream-pacing-policy.js";
 import type { TerminalLease } from "./terminal-lease.js";
+import type { createWatchPaneController } from "./watch-pane.js";
 import { createWorkspaceFacts } from "./workspace-facts.js";
+import type { createYaziBridge, YaziBridge } from "./yazi-bridge.js";
 
 export {
 	IDLE_LEADER_STATE,
@@ -128,6 +136,36 @@ export interface InteractiveDeps {
 	extensions?: ExtensionsContract;
 	interop?: InteropContract;
 	share?: ShareContract;
+	/**
+	 * Pane layer. A `none` contract still reaches the interactive surface so the
+	 * files preset can use its terminal chooser; every mux operation remains
+	 * best-effort and never reaches a dispatch or a turn.
+	 */
+	mux?: MuxContract;
+	/**
+	 * Pane-layer operations behind `/panes` and the `panes` tool. Built by the
+	 * composition root so the tool registry and this surface drive one instance.
+	 */
+	panes?: PanesOperations;
+	/**
+	 * Factory seam for the dispatch-to-pane bridge, so a contract test can drive
+	 * it without a TUI. Production leaves it unset and gets `createMuxBridge`.
+	 */
+	createMuxBridge?: typeof createMuxBridge;
+	/** Bind the file-pane return path after the composer and TUI exist. */
+	attachYaziBridge?: (bridge: YaziBridge) => () => void;
+	/**
+	 * Watch-pane factory from the `--with-panes` composition root; absent on a
+	 * plain boot. The controller it builds backs Enter in the workers view.
+	 */
+	createWatchPane?: typeof createWatchPaneController;
+	/** Bind the watch controller into the shared PanesOperations for `/panes show`. */
+	attachWatchPane?: (controller: PanesWatchController) => () => void;
+	/**
+	 * File-pane factory. Supplied by the `--with-panes` composition root (or a
+	 * contract test); absent on a plain boot, which therefore loads no yazi code.
+	 */
+	createYaziBridge?: typeof createYaziBridge;
 	/**
 	 * Shared tool registry. When wired, the permission overlay opens automatically
 	 * whenever a tool call is parked waiting for operator confirmation, and the
@@ -171,12 +209,19 @@ export interface InteractiveDeps {
 	registerAskUserHandler?: (handler: AskUserHandler) => () => void;
 	/** Live CLIO-CODER.md and memory state for the footer Context quadrant. */
 	getContextState?: (cwd?: string) => ContextState;
-	/** Persist a thinking level set by `/thinking <level>` or `/model <pattern>:<level>`. */
-	onSetThinkingLevel?: (level: ThinkingLevel) => void;
+	/**
+	 * Persist a thinking level set by `/thinking <level>` or `/model <pattern>:<level>`.
+	 * Scope "session" leaves settings.yaml alone; omitted means the historical
+	 * write-through, which is what the Shift+Tab cycle and `/thinking` still want.
+	 */
+	onSetThinkingLevel?: (level: ThinkingLevel, scope?: "session" | "global") => void;
 	/** Persist the next thinking level when Shift+Tab is pressed. */
 	onCycleThinking?: () => void;
-	/** Persist the orchestrator target selected in /model. */
-	onSelectModel?: (ref: { target: string; model: string }) => void;
+	/**
+	 * Apply the orchestrator target selected in /model at the scope the operator
+	 * chose. "session" routes this session only and never touches settings.yaml.
+	 */
+	onSelectModel?: (ref: { target: string; model: string }, scope: "session" | "global") => void;
 	/** Write handler the /settings overlay uses to persist cycled values. */
 	writeSettings?: (next: ClioSettings) => void;
 	/**
@@ -429,6 +474,21 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		});
 	const { terminal, tui } = shell;
 	const renderTrace = getActiveRenderTrace();
+	// SIGTERM is the kill an operator reaches for when a pane stops answering, so
+	// it is where the always-on input-wedge ring has to land (#224). It writes
+	// synchronously from its own listener rather than from a termination hook: a
+	// session wedged badly enough to be killed may never reach the coordinator's
+	// asynchronous drain, and this dump has to survive that.
+	const dumpInputWedgeOnTerminate = renderTrace
+		? (): void => {
+				try {
+					writeInputWedgeDump(clioStateDir(), renderTrace.snapshotInputWedge());
+				} catch {
+					// Best effort. The process is ending either way.
+				}
+			}
+		: null;
+	if (dumpInputWedgeOnTerminate) process.on("SIGTERM", dumpInputWedgeOnTerminate);
 	const visibleEventIngress = new WeakMap<
 		object,
 		{ sequence: number; traceSequence: number; generation: number; ingressAt: number }
@@ -498,6 +558,11 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		getLeaderArmed: () => leaderArmed,
 		getShutdownArmed: () => shutdownArmed,
 		isAwaitingApproval: () => overlayLifecycle?.getState() === "permission-confirm",
+		getPermissionInspection: () => {
+			if (overlayLifecycle === undefined || overlayLifecycle === null) return "none";
+			if (!overlayLifecycle.canInspectMutation()) return "none";
+			return overlayLifecycle.isInspectingMutation() ? "open" : "closed";
+		},
 		resolveVisibleEventSequence: (event) => visibleEventIngress.get(event)?.traceSequence ?? null,
 		resolveStreamIngress: (event) => visibleEventIngress.get(event) ?? null,
 		commitFrame: (reason) => shell.commitCurrentFrame(reason === "teardown" ? 300 : 30_000),
@@ -545,6 +610,31 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		chatRenderer,
 		io,
 	} = presentation;
+	// The factory arrives only from an active `--with-panes` boot (or a test); a
+	// plain session has no deps.panes and no factory, and loads no yazi code.
+	const yaziBridge =
+		deps.panes && deps.createYaziBridge
+			? deps.createYaziBridge({
+					...(deps.mux ? { mux: deps.mux } : {}),
+					getDraft: () => editor.getText(),
+					setDraft: (text) => editor.setText(text),
+					requestRender: () => tui.requestRender(),
+					notice: (level, text) => notify(level, text, `yazi:${level}`),
+					getCwd: () => process.cwd(),
+					getSettings: () =>
+						deps.getSettings?.().panes.yazi ?? {
+							mode: "companion",
+							profile: "managed",
+							followCwd: true,
+						},
+					stopUi: () => tui.stop(),
+					startUi: () => {
+						tui.start();
+						tui.requestRender(true);
+					},
+				})
+			: null;
+	const detachYaziBridge = yaziBridge ? deps.attachYaziBridge?.(yaziBridge) : undefined;
 	refreshPresentationFooter = () => footer.refresh();
 	const agentProgress = createAgentProgress(terminal);
 	// Desktop notifications are a protocol write on the terminal owner, issued
@@ -618,7 +708,7 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		chat: deps.chat,
 		chatPanel: {
 			appendReplayBlock: (...args) => chatRenderer.mutate(() => chatPanel.appendReplayBlock(...args), "slash-output"),
-			appendUser: (text) => chatRenderer.mutate(() => chatPanel.appendUser(text), "user-submit"),
+			appendUser: (text, status) => chatRenderer.mutate(() => chatPanel.appendUser(text, status), "user-submit"),
 			clearFoldOverrides: () => chatRenderer.mutate(() => chatPanel.clearFoldOverrides(), "output-detail"),
 		},
 		beforeSemanticSubmit: () => chatRenderer.flush(),
@@ -659,7 +749,9 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		openMemory: () => openMemoryOverlayState(),
 		...(deps.seedTaskMemory ? { seedTaskMemory: deps.seedTaskMemory } : {}),
 		openView: (filter) => openViewOverlayState(filter),
+		...(deps.panes ? { panes: deps.panes } : {}),
 		openModel: () => openModelOverlayState(),
+		openModelScope: (ref) => openModelScopeState(ref),
 		openSettings: (section, rowId) => openSettingsOverlayState(section, rowId),
 		openResume: () => openResumeOverlayState(),
 		startNewSession: () => startNewSession(),
@@ -767,6 +859,7 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		openMemoryOverlayState,
 		openViewOverlayState,
 		openModelOverlayState,
+		openModelScopeState,
 		openSettingsOverlayState,
 		openResumeOverlayState,
 		openTreeOverlayState,
@@ -844,6 +937,64 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		};
 		notify(outcome.ok ? "success" : "info", outcome.message, "dispatch:background");
 	};
+	// Built only when a pane host answered detection, so a session with no
+	// panes subscribes to nothing and the bus handlers do not exist at all.
+	// The factories arrive from the `--with-panes` composition root (or a
+	// test); a plain session loads none of the bridge code.
+	const mux = deps.mux;
+	const muxBridge =
+		mux && mux.mode !== "none" && deps.createMuxBridge
+			? deps.createMuxBridge({
+					bus: deps.bus,
+					mux,
+					notificationsPolicy: () => deps.getSettings?.().panes.notifications ?? "failures",
+					log: (level, message) => {
+						if (level === "warning") notify("warning", message, "mux:bridge");
+					},
+					notice: (level, text) => appendNotice(level, text, busNoticeSink),
+				})
+			: null;
+	// The workers-view watch pane: opened on Enter over a live run, retargeted
+	// by arrow keys through its selection file. `/panes show` and the panes
+	// tool drive the same controller through the shared operations object.
+	const watchPane =
+		mux && mux.mode !== "none" && deps.createWatchPane
+			? deps.createWatchPane({ mux, getCwd: () => process.cwd() })
+			: null;
+	const detachWatchPane = watchPane ? deps.attachWatchPane?.(watchPane) : undefined;
+	const selectedWatchableRun = (): { runId: string; agentId: string } | null => {
+		if (!watchPane) return null;
+		const row = dispatchBoard.selectedRow();
+		if (!row) return null;
+		const decision = paneWatchDecision({ source: "workers-view", runStatus: row.status });
+		return decision.open ? { runId: row.runId, agentId: row.agentId } : null;
+	};
+	/**
+	 * Enter in the workers view. True means the watch pane took the key; false
+	 * (panes off, nothing watchable under the policy) falls back to the inline
+	 * worker-progress detail, so a terminal run's Enter still expands its card.
+	 */
+	const watchSelectedDispatch = (): boolean => {
+		const selected = selectedWatchableRun();
+		if (!watchPane || !selected) return false;
+		void watchPane.watch(selected.runId).then((result) => {
+			if (result.status === "watching") {
+				if (result.opened) {
+					notify("success", `watching ${selected.agentId} (${selected.runId}) in a pane`, "panes:watch");
+				}
+			} else {
+				notify("warning", result.reason, "panes:watch");
+			}
+			tui.requestRender();
+		});
+		return true;
+	};
+	/** Arrow keys: the watch pane follows the cursor, but only once it exists. */
+	const followBoardSelection = (): void => {
+		if (!watchPane?.isOpen()) return;
+		const selected = selectedWatchableRun();
+		if (selected) watchPane.follow(selected.runId);
+	};
 	const interactiveSubscriptions = createInteractiveSubscriptions({
 		bus: deps.bus,
 		refreshFooter: () => footer.refresh(),
@@ -894,7 +1045,18 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		onShutdownArmedChange: (armed) => {
 			shutdownArmed = armed;
 		},
-		dispatchBoard,
+		dispatchBoard: {
+			selectPrevious: () => {
+				dispatchBoard.selectPrevious();
+				followBoardSelection();
+			},
+			selectNext: () => {
+				dispatchBoard.selectNext();
+				followBoardSelection();
+			},
+			toggleDetail: () => dispatchBoard.toggleDetail(),
+		},
+		watchSelectedDispatch,
 		steerSelectedDispatch,
 		cancelSelectedDispatch,
 		cancelActiveEditorBash: () => editorSubmit.cancelActiveEditorBash(),
@@ -933,7 +1095,14 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 			disposeOverlay: overlayLifecycle.dispose,
 			stopAgentProgress: agentProgress.stop,
 			disposeChat: () => deps.chat.dispose(),
-			disposeSubscriptions: interactiveSubscriptions.dispose,
+			disposeSubscriptions: () => {
+				detachYaziBridge?.();
+				yaziBridge?.dispose();
+				detachWatchPane?.();
+				watchPane?.dispose();
+				muxBridge?.dispose();
+				interactiveSubscriptions.dispose();
+			},
 		},
 		beforeStopUi: (() => {
 			let settlement: Promise<void> | null = null;
@@ -949,6 +1118,7 @@ export async function createInteractiveApplication(deps: InteractiveDeps): Promi
 		cancelParkedCalls: (reason) => deps.toolRegistry?.cancelParkedCalls(reason),
 		onShutdown: async () => {
 			try {
+				if (dumpInputWedgeOnTerminate) process.off("SIGTERM", dumpInputWedgeOnTerminate);
 				await deps.onShutdown();
 			} finally {
 				if (lease) await lease.close();

package/src/interactive/interactive-input-runtime.ts

@@ -60,6 +60,10 @@ export interface InteractiveInputRuntimeDeps {
 		closeOverlay(): void;
 		confirmPermission(): void;
 		stopTurnFromPermission(): void;
+		canInspectMutation(): boolean;
+		isInspectingMutation(): boolean;
+		toggleMutationInspection(): void;
+		scrollMutationInspection(delta: number): void;
 		cancelAskUser(): void;
 		toggleFooterDashboardState(): void;
 		toggleDispatchBoardOverlay(): void;
@@ -78,6 +82,8 @@ export interface InteractiveInputRuntimeDeps {
 		selectNext(): void;
 		toggleDetail(): void;
 	};
+	/** Enter in the workers view; false falls through to the detail toggle. */
+	watchSelectedDispatch: () => boolean;
 	steerSelectedDispatch: () => void;
 	cancelSelectedDispatch: () => void;
 	cancelActiveEditorBash: () => boolean;
@@ -213,6 +219,10 @@ export function createInteractiveInputRuntime(deps: InteractiveInputRuntimeDeps)
 					confirmPermission: () => deps.overlay.confirmPermission(),
 					stopTurnFromPermission: () => deps.overlay.stopTurnFromPermission(),
 					composerHasDraft: () => deps.editor.getText().length > 0,
+					canInspectMutation: () => deps.overlay.canInspectMutation(),
+					isInspectingMutation: () => deps.overlay.isInspectingMutation(),
+					toggleMutationInspection: () => deps.overlay.toggleMutationInspection(),
+					scrollMutationInspection: (delta) => deps.overlay.scrollMutationInspection(delta),
 					editDraft: (data) => {
 						deps.editor.handleInput?.(data);
 						deps.requestRender();
@@ -230,6 +240,11 @@ export function createInteractiveInputRuntime(deps: InteractiveInputRuntimeDeps)
 						deps.dispatchBoard.toggleDetail();
 						deps.requestRender();
 					},
+					watchSelectedDispatch: () => {
+						const handled = deps.watchSelectedDispatch();
+						if (handled) deps.requestRender();
+						return handled;
+					},
 					steerSelectedDispatch: deps.steerSelectedDispatch,
 					cancelSelectedDispatch: deps.cancelSelectedDispatch,
 					cancelAskUser: () => deps.overlay.cancelAskUser(),

package/src/interactive/interactive-presentation.ts

@@ -99,6 +99,8 @@ export interface InteractivePresentationDeps {
 	getShutdownArmed?: () => boolean;
 	/** Whether a permission prompt owns the keyboard, for the composer's CONFIRM rail. */
 	isAwaitingApproval?: () => boolean;
+	/** Whether that prompt has a mutation to inspect, and whether it is open (issue #254). */
+	getPermissionInspection?: () => import("./permission-hint.js").PermissionInspectionHint;
 	getCwd?: () => string;
 	resolveVisibleEventSequence?: (event: ChatLoopEvent) => number | null;
 	resolveStreamIngress?: (
@@ -418,6 +420,8 @@ export function createInteractivePresentation(deps: InteractivePresentationDeps)
 		},
 		isStreaming: () => deps.chat.isStreaming(),
 		...(deps.isAwaitingApproval ? { isAwaitingApproval: deps.isAwaitingApproval } : {}),
+		...(deps.getPermissionInspection ? { getPermissionInspection: deps.getPermissionInspection } : {}),
+		getTurnPreparation: () => deps.chat.turnPreparation().phase,
 		willEnterSteer: (text) => willEnterSteerActiveWork(deps, text),
 		getSubmitKeyLabel: () => formatKeyLabel(keybindings.getKeys("tui.input.submit")[0], "Enter"),
 		getNewlineKeyLabel: () => formatKeyLabel(keybindings.getKeys("tui.input.newLine")[0], "Shift+Enter"),

package/src/interactive/interactive-shell.ts

@@ -158,9 +158,11 @@ export function createInteractiveShell<TTerminal extends Terminal, TTui extends
 }
 
 /**
- * Trace for the current process, created once when CLIO_CODER_RENDER_TRACE names a
- * file. The panel wires its render metrics into the same instance, so the
- * frame rows carry both the build cost and the write cost.
+ * Trace for the current process, created once per interactive shell. It writes
+ * a JSONL file when CLIO_CODER_RENDER_TRACE names one and otherwise keeps only
+ * its bounded input-wedge ring in memory. The panel wires its render metrics
+ * into the same instance, so the frame rows carry both the build cost and the
+ * write cost.
  */
 let activeRenderTrace: RenderTrace | null = null;
 
@@ -203,20 +205,21 @@ export function createProcessInteractiveShell(
 	let restoreRoot: (() => void) | null = null;
 	let backpressure: StdoutBackpressureGate | null = null;
 	let observedBackpressure = false;
-	if (tracePath) {
-		let candidate: RenderTrace | null = null;
-		try {
-			candidate = createRenderTrace(tracePath);
-			restoreStdout = traceProcessStdout(candidate);
-			activeRenderTrace = candidate;
-		} catch {
-			// A diagnostics path must never prevent the interactive application from starting.
-			restoreStdout?.();
-			restoreStdout = null;
-			void candidate?.close().catch(() => {});
-			activeRenderTrace = null;
-		}
-	} else activeRenderTrace = null;
+	let candidate: RenderTrace | null = null;
+	try {
+		// A null path is the ring-only mode: no file, but the input-wedge ring still
+		// fills, because the operator who hits a wedge did not arm a trace before it
+		// happened (#224).
+		candidate = createRenderTrace(tracePath);
+		restoreStdout = traceProcessStdout(candidate);
+		activeRenderTrace = candidate;
+	} catch {
+		// A diagnostics path must never prevent the interactive application from starting.
+		restoreStdout?.();
+		restoreStdout = null;
+		void candidate?.close().catch(() => {});
+		activeRenderTrace = null;
+	}
 	const trace = activeRenderTrace;
 	if (trace && options.onFirstFrameCommit) trace.onFirstFrameCommit(options.onFirstFrameCommit);
 	let firstFrameDelivered = false;

package/src/interactive/interactive-slash-runtime.ts

@@ -9,6 +9,7 @@ import type { AgentsContract } from "../domains/agents/contract.js";
 import type { DispatchContract } from "../domains/dispatch/contract.js";
 import { agentRoleFactsResolver } from "../domains/dispatch/execution-role.js";
 import type { ExtensionsContract } from "../domains/extensions/index.js";
+import type { PanesOperations } from "../domains/mux/operations.js";
 import {
 	type ProvidersContract,
 	type ResolvedThinkingCapability,
@@ -36,6 +37,7 @@ import { runOperatorRecall } from "./context-recall-command.js";
 import { renderSessionHtml } from "./export-html/index.js";
 import { dateLocal } from "./format-time.js";
 import type { OracleDigestSources } from "./oracle.js";
+import type { PendingModelScope } from "./overlays/model-scope.js";
 import type { SettingsCenterRowId, SettingsSectionId } from "./overlays/settings.js";
 import {
 	type ContextClearCommandOptions,
@@ -48,7 +50,7 @@ import {
 	type SlashCommandDispatchResult,
 	type TaskMemorySeedCommandResult,
 } from "./slash-commands.js";
-import { verifyReceiptFile } from "./view/artifacts.js";
+import { verifyReceiptFileReport } from "./view/artifacts.js";
 import type { WorkerEntryState } from "./worker-stream.js";
 
 const EXPORT_RENDER_WIDTH = 100;
@@ -62,6 +64,7 @@ export interface InteractiveSlashSubmitExpansion {
 
 type SlashChat = Pick<ChatLoop, "getSessionId" | "isStreaming" | "submit">;
 type SlashChatPanel = Pick<ChatPanel, "appendReplayBlock" | "appendUser" | "clearFoldOverrides">;
+type UserTurnStatus = import("./chat-panel.js").UserTurnStatus;
 type SlashResources = Pick<ResourcesContract, "prompts" | "expandPromptTemplate" | "reload">;
 type SlashExtensions = Pick<ExtensionsContract, "list">;
 type SlashAgents = Pick<AgentsContract, "getSpec" | "listSpecs">;
@@ -88,8 +91,8 @@ export interface InteractiveSlashRuntimeDeps {
 	 * making a value permanent stays the Settings overlay's explicit choice.
 	 */
 	commitSetting?: (id: string, next: ClioSettings, scope: "session" | "global") => void;
-	onSelectModel?: (ref: { target: string; model: string }) => void;
-	onSetThinkingLevel?: (level: ThinkingLevel) => void;
+	onSelectModel?: (ref: { target: string; model: string }, scope: "session" | "global") => void;
+	onSetThinkingLevel?: (level: ThinkingLevel, scope?: "session" | "global") => void;
 	onCompact?: (instructions: string | undefined) => Promise<void>;
 	onInit?: (options: InitCommandOptions, io?: RunIo) => Promise<void>;
 	onContextClear?: (options: ContextClearCommandOptions) => Promise<void>;
@@ -134,7 +137,14 @@ export interface InteractiveSlashRuntimeDeps {
 	openMemory: () => void;
 	seedTaskMemory?: () => TaskMemorySeedCommandResult;
 	openView: (filter?: string) => void;
+	/** Pane-layer operations behind `/panes`. Absent when the mux resolved to `none`. */
+	panes?: PanesOperations;
 	openModel: () => void;
+	/**
+	 * Ask where a resolved `/model <pattern>` swap lands before anything applies.
+	 * Absent on a host with no overlay layer, where the swap stays session-scoped.
+	 */
+	openModelScope?: (ref: PendingModelScope) => void;
 	openSettings: (section?: SettingsSectionId, rowId?: SettingsCenterRowId) => void;
 	openResume: () => void;
 	startNewSession: () => void;
@@ -199,6 +209,7 @@ export function resolveAvailableThinkingLevels(
 export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps): InteractiveSlashRuntime {
 	let activeContextInit = false;
 	let latestAdmission: Promise<void> = Promise.resolve();
+	let latestLocalOperation: Promise<void> = Promise.resolve();
 	let activeAdmissionSignal: AbortSignal | undefined;
 	const cwd = (): string => deps.getCwd?.() ?? process.cwd();
 	const resources = deps.resources;
@@ -245,9 +256,13 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 			const willQueue = deps.chat.isStreaming();
 			deps.recordSubmittedTurn();
 			deps.refreshFooter();
-			if (!willQueue) deps.chatPanel.appendUser(sub.text);
+			// The row is painted now, so the operator sees their prompt land, but
+			// it is marked pending until the durable append at admission: nothing
+			// is in the ledger yet, and a refused preflight must not leave a row
+			// that reads like a committed turn (issue #251).
+			let rowStatus: UserTurnStatus = "pending";
+			if (!willQueue) deps.chatPanel.appendUser(sub.text, () => rowStatus);
 			deps.requestRender();
-			deps.beforeSemanticSubmit?.();
 			let acknowledgeAdmission = (): void => {};
 			const admitted = new Promise<void>((resolve) => {
 				acknowledgeAdmission = resolve;
@@ -257,7 +272,19 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 				...(sub.workingContextPaths.length > 0 ? { workingContextPaths: sub.workingContextPaths } : {}),
 				...(sub.pendingSkillRequests.length > 0 ? { pendingSkillRequests: sub.pendingSkillRequests } : {}),
 				...(awaitAdmission && willQueue ? { steering: "end-of-turn" as const } : {}),
-				...(awaitAdmission ? { onAdmitted: acknowledgeAdmission } : {}),
+				...(!willQueue
+					? {
+							onPreparationVisible: async () => {
+								deps.beforeSemanticSubmit?.();
+								await deps.settleVisibleFrame?.("submit-preparing");
+							},
+						}
+					: {}),
+				onAdmitted: () => {
+					rowStatus = "committed";
+					deps.requestRender();
+					if (awaitAdmission) acknowledgeAdmission();
+				},
 			});
 			const settlement = turn
 				.then(() => deps.settleVisibleFrame?.("submit-return"))
@@ -265,7 +292,13 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 					const msg = err instanceof Error ? err.message : String(err);
 					deps.io.stderr(`[interactive] chat failed: ${msg}\n`);
 				})
-				.finally(deps.requestRender);
+				.finally(() => {
+					// Settlement without admission is a refusal: the probe failed, the
+					// overflow preflight blocked the request, or the submit became a
+					// steer. Say so on the row rather than leaving a phantom turn.
+					if (rowStatus === "pending") rowStatus = willQueue ? "committed" : "refused";
+					deps.requestRender();
+				});
 			return awaitAdmission ? Promise.race([admitted, settlement]) : settlement;
 		} catch (err) {
 			const msg = err instanceof Error ? err.message : String(err);
@@ -413,6 +446,7 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 			return result;
 		},
 		openView: deps.openView,
+		...(deps.panes ? { panes: deps.panes } : {}),
 		setThinkingLevel: (level) => {
 			const settings = deps.getSettings?.();
 			if (!settings || !deps.onSetThinkingLevel) return { status: "unavailable" };
@@ -462,9 +496,20 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 		openModel: deps.openModel,
 		providers: deps.providers,
 		applyModelRef: (ref) => {
-			deps.onSelectModel?.({ target: ref.target, model: ref.model });
-			if (ref.thinkingLevel) deps.onSetThinkingLevel?.(ref.thinkingLevel);
+			// A mid-conversation swap used to rewrite the orchestrator role in
+			// settings.yaml with no prompt, so the next launch could come up on a
+			// dead endpoint (smoke pass 2, G3). The scope dialog owns the commit
+			// now, and it applies nothing until the operator answers.
+			if (deps.openModelScope) {
+				deps.openModelScope(ref);
+				return "pending";
+			}
+			// No overlay layer to ask with: session scope is the answer that cannot
+			// outlive the session that chose it.
+			deps.onSelectModel?.({ target: ref.target, model: ref.model }, "session");
+			if (ref.thinkingLevel) deps.onSetThinkingLevel?.(ref.thinkingLevel, "session");
 			deps.requestRender();
+			return "applied";
 		},
 		openSettings: deps.openSettings,
 		openResume: deps.openResume,
@@ -611,7 +656,7 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 				})
 				.finally(deps.requestRender);
 		},
-		verifyReceipt: (runId) => verifyReceiptFile(deps.stateDir, runId),
+		verifyReceipt: (runId) => verifyReceiptFileReport(deps.stateDir, runId),
 		...(deps.listWorkerRuns ? { listWorkerRuns: deps.listWorkerRuns } : {}),
 		// The user-turn path, minus expansion. A worker's answer is literal text:
 		// running it through the prompt, skill, and @file expanders would let a
@@ -621,6 +666,9 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 			latestAdmission = admitChat(text, activeAdmissionSignal);
 			void latestAdmission;
 		},
+		runLocalOperation: (operation) => {
+			latestLocalOperation = latestLocalOperation.catch(() => undefined).then(operation);
+		},
 		render: deps.requestRender,
 	};
 
@@ -630,8 +678,12 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 		dispatchCommand: (text) => dispatchSlashCommand(parseSlashCommand(text), context),
 		admitCommand: async (text, signal) => {
 			signal?.throwIfAborted();
+			// Pane opens and focus changes mutate a remote registry. A following
+			// slash read must observe their settled state, just as the tool path does.
+			await latestLocalOperation;
 			const command = parseSlashCommand(text);
 			const before = latestAdmission;
+			const localBefore = latestLocalOperation;
 			const previousSignal = activeAdmissionSignal;
 			activeAdmissionSignal = signal;
 			try {
@@ -640,6 +692,7 @@ export function createInteractiveSlashRuntime(deps: InteractiveSlashRuntimeDeps)
 				activeAdmissionSignal = previousSignal;
 			}
 			if (latestAdmission !== before) await latestAdmission;
+			if (latestLocalOperation !== localBefore) await latestLocalOperation;
 		},
 	};
 }

package/src/interactive/memory-overlay.ts

@@ -1,5 +1,6 @@
 import {
 	describeTaskMemoryActivity,
+	formatTaskMemorySpend,
 	type MemoryProposalResult,
 	type MemoryRecord,
 	type TaskMemoryActivityEvent,
@@ -38,6 +39,12 @@ export function formatMemoryStatusLine(status: TaskMemoryOperatorStatus, content
 		theme.fg("muted", `last ${status.lastDecision ?? "none"}`),
 	];
 	if (status.stepInFlight) units.push(theme.fg("reason", "step running"));
+	// Lifetime cost of the background plane, beside the state of the current
+	// session. The tier spent 137,205 tokens over 14 days on the operator's own
+	// machine before any surface said so (#229), and a hit rate is the one figure
+	// that says whether that spend is buying anything.
+	const spend = status.spend === null || status.spend === undefined ? "" : formatTaskMemorySpend(status.spend);
+	if (spend.length > 0) units.push(theme.fg("dim", spend));
 	return fitUnits(theme, "", units, width);
 }
 
@@ -172,6 +179,7 @@ function memorySignature(status: TaskMemoryOperatorStatus, records: ReadonlyArra
 		String(status.size),
 		status.lastDecision ?? "none",
 		status.stepInFlight ? "running" : "idle",
+		`${status.spend?.llmSteps ?? 0}:${status.spend?.injections ?? 0}:${status.spend?.totalTokens ?? 0}`,
 	];
 	for (const record of records) parts.push(`r:${record.id}:${record.approved}:${record.rejectedAt ?? ""}`);
 	for (const entry of bankEntries(status.bank)) {
@@ -350,6 +358,7 @@ export function openMemoryOverlay(
 	const handle = showClioOverlayFrame(tui, view, {
 		anchor: "center",
 		width: MEMORY_OVERLAY_WIDTH,
+		markerId: "memory",
 		title: () => "Memory",
 		footerHint: () => view.getHint(),
 	});