@neuralis/brain-core 0.2.1 → 0.3.1

package/app/filesystem/ui/PendingChangesPanel.tsx

@@ -153,7 +153,7 @@ export const PendingDiffCard = memo(function PendingDiffCard({
       setLoadError(error instanceof Error ? error.message : 'Failed to load review'); setLoading(false);
     });
     return () => { seq.current++; };
-  }, [agentId, projectId, rec.id, cacheKey, expanded, shown, queue.run]);
+  }, [client, agentId, projectId, rec.id, cacheKey, expanded, shown, queue.run]);
 
   const hunks = useMemo(() => preview ? hunksOf(preview) : null, [preview]);
   const computed = useMemo(() => hunks ? countHunks(hunks) : null, [hunks]);
@@ -184,6 +184,7 @@ export const PendingDiffCard = memo(function PendingDiffCard({
         {indexState && indexState !== 'stored' ? <span className="text-[10px] text-amber-200/80 shrink-0">
           {indexState === 'missing' ? 'Index missing' : indexState === 'stale' ? 'Index stale' : 'Recovery only'}
         </span> : null}
+        {rec.conflict === 'PENDING_GENERATION_CHANGED' ? <span className="text-[10px] text-amber-200/80 shrink-0" title="Pending generation changed; this record cannot be repaired automatically.">Pending generation changed</span> : null}
         {orphaned ? ORPHAN_BADGE : rec.status === 'approved' || rec.status === 'reverted' ? (
           <span className={`w-1.5 h-1.5 rounded-full shrink-0 ${statusTone(rec.status)}`} title={rec.status} />
         ) : null}
@@ -261,17 +262,20 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   const [nonces, setNonces] = useState<Readonly<Record<string, number>>>({});
   const latest = useRef({ nonces, revisions }); latest.current = { nonces, revisions };
   const refetch = useCallback(async (rec: PendingChangeRecord): Promise<PendingPreview> => {
+    const epoch = contextEpoch.current;
     refetches.current.set(rec.id, null);
     try {
       const listed = (await relisted.current.promise)?.find(r => r.id === rec.id) ?? rec;
+      if (epoch !== contextEpoch.current) throw new Error('Review context changed');
       const fresh = await previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }, client);
+      if (epoch !== contextEpoch.current) throw new Error('Review context changed');
       const revision = (latest.current.nonces[rec.id] ?? 0) + 1 + (latest.current.revisions[listed.sourceSlug] ?? 0);
       refetches.current.set(rec.id, { key: previewKey(listed, revision), preview: fresh });
       previews.current.set(rec.id, fresh);
       return fresh;
-    } catch (failure) { refetches.current.delete(rec.id); throw failure; }
-    finally { setNonces(prev => ({ ...prev, [rec.id]: (prev[rec.id] ?? 0) + 1 })); }
-  }, [agentId, projectId]);
+    } catch (failure) { if (epoch === contextEpoch.current) refetches.current.delete(rec.id); throw failure; }
+    finally { if (epoch === contextEpoch.current) setNonces(prev => ({ ...prev, [rec.id]: (prev[rec.id] ?? 0) + 1 })); }
+  }, [client, agentId, projectId]);
   const [focusIndex, setFocusIndex] = useState(0);
   const [review, setReview] = useState<ReviewRequest | null>(null);
   const [results, setResults] = useState<ReviewResult[]>([]);
@@ -282,27 +286,50 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   const [collapsedGit, setCollapsedGit] = useState<ReadonlySet<string>>(new Set());
   const repairTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
   const listSeq = useRef(0);
+  const orphanSeq = useRef(0);
+  const contextEpoch = useRef(0);
+  const changesRef = useRef(changes); changesRef.current = changes;
+  const classified = useRef(new Map<string, string>());
+  const [nextCursor, setNextCursor] = useState<string | undefined>();
+  const [partial, setPartial] = useState(false);
+  const [repairProgress, setRepairProgress] = useState('');
+  const repairStop = useRef(false);
+  const repairCursor = useRef<string | undefined>(undefined);
+  const [repairPaused, setRepairPaused] = useState(false);
+  const generation = (rec: PendingChangeRecord): string => JSON.stringify([rec.id, rec.updatedAt, rec.snapshotHash, rec.status]);
 
   const inventory = useGitChangesInventory({ agentId, projectId, sources, revisions, resetKey: `${agentId}\u0000${projectId}\u0000${convFilter}` });
 
   /** The pending list. The orphan probe (one connector stat per record) runs only on mount, Refresh and Repair. */
-  const fetchPending = useCallback(async (withOrphans: boolean): Promise<PendingChangeRecord[] | undefined> => {
+  const fetchPending = useCallback(async (withOrphans: boolean, append = false): Promise<PendingChangeRecord[] | undefined> => {
     if (!agentId) return undefined;
     const mine = ++listSeq.current;
+    const scan = withOrphans ? ++orphanSeq.current : orphanSeq.current;
+    const epoch = contextEpoch.current;
     setLoading(true); setError(null);
     try {
       const list = await listPendingChanges({ agentId, ...(projectId ? { projectId } : {}),
-        ...(convFilter ? { conversationId: convFilter } : {}), ...(withOrphans ? { include_orphans: true } : {}) }, client);
+        ...(convFilter ? { conversationId: convFilter } : {}), ...(withOrphans ? { include_orphans: true } : {}),
+        ...(append && nextCursor ? { cursor: nextCursor } : {}) }, client);
+      if (epoch !== contextEpoch.current) return undefined;
+      if (withOrphans && scan === orphanSeq.current) {
+        for (const rec of list.changes) classified.current.set(rec.id, `${generation(rec)}:${list.orphanIds?.includes(rec.id) === true}`);
+        setOrphanIds(new Set(changesRef.current.filter(rec => classified.current.get(rec.id) === `${generation(rec)}:true`).map(rec => rec.id)));
+      }
       if (mine !== listSeq.current) return undefined;
-      const ids = new Set(list.changes.map(rec => rec.id));
-      setChanges(list.changes);
-      setOrphanIds(previous => withOrphans ? new Set(list.orphanIds) : new Set([...previous].filter(id => ids.has(id))));
-      return list.changes;
+      if (list.restartRequired) { setNextCursor(undefined); setError('Changes moved. Refresh to restart the list.'); return undefined; }
+      const prior = new Map(changesRef.current.map(rec => [rec.id, rec]));
+      const fresh = new Map(list.changes.map(rec => [rec.id, rec]));
+      const merged = append ? [...changesRef.current.map(rec => fresh.get(rec.id) ?? rec), ...list.changes.filter(rec => !prior.has(rec.id))] : list.changes;
+      changesRef.current = merged; setChanges(merged);
+      setOrphanIds(new Set(merged.filter(rec => classified.current.get(rec.id) === `${generation(rec)}:true`).map(rec => rec.id)));
+      setNextCursor(list.nextCursor); setPartial(list.partial);
+      return merged;
     } catch (failure) {
-      if (mine === listSeq.current) setError(failure instanceof Error ? failure.message : 'Failed to load changes');
+      if (epoch === contextEpoch.current && mine === listSeq.current) setError(failure instanceof Error ? failure.message : 'Failed to load changes');
       return undefined;
-    } finally { if (mine === listSeq.current) setLoading(false); }
-  }, [agentId, projectId, convFilter]);
+    } finally { if (epoch === contextEpoch.current && mine === listSeq.current) setLoading(false); }
+  }, [client, agentId, projectId, convFilter, nextCursor]);
 
   const refreshAll = useCallback(async () => {
     await Promise.all([fetchPending(true), inventory.refresh(true)]);
@@ -310,10 +337,14 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   }, [fetchPending, inventory.refresh, refreshPendingCount, agentId, projectId]);
 
   useEffect(() => {
-    previews.current.clear(); setReview(null); setChanges([]); setOrphanIds(new Set()); setResults([]);
+    contextEpoch.current++; repairStop.current = true; repairCursor.current = undefined; setRepairPaused(false);
+    relisted.current.resolve(undefined); relisted.current = Promise.withResolvers(); refetches.current.clear();
+    setRepairing(false); setBusyId(null); setApprovingAll(false); setConfirmAll(false); setConfirmRepair(false);
+    classified.current.clear(); previews.current.clear(); setReview(null); changesRef.current = [];
+    setChanges([]); setOrphanIds(new Set()); setResults([]); setNextCursor(undefined); setPartial(false); setHeld(null);
     void fetchPending(true);
-    return () => { listSeq.current++; previews.current.clear(); };
-  }, [fetchPending]);
+    return () => { contextEpoch.current++; listSeq.current++; orphanSeq.current++; repairStop.current = true; previews.current.clear(); };
+  }, [client, agentId, projectId, convFilter]);
   // A source revision re-reads the plain list, never the orphan probe; a context change is the effect above's.
   const fetchPendingRef = useRef(fetchPending); fetchPendingRef.current = fetchPending;
   const firstRevision = useRef(true);
@@ -380,6 +411,7 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   }, [removeFilePath, storeApi]);
 
   const afterMutation = useCallback(async (done: ReviewResult[]) => {
+    const epoch = contextEpoch.current;
     for (const result of done) {
       const rec = changes.find(c => c.id === result.id);
       if (rec && result.outcome === 'ok' && result.action !== 'revert') dropResolvedDeleteRow(rec);
@@ -390,6 +422,7 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
     if (refused.length) setNonces(prev => { const next = { ...prev }; for (const r of refused) next[r.id] = (next[r.id] ?? 0) + 1; return next; });
     setResults(done);
     const after = await fetchPending(false);
+    if (epoch !== contextEpoch.current) return;
     // The STORE's value, not the last render's: the batch's own bumps may not have rendered yet.
     listedRevisions.current = storeApi.getState().sourceChangeRevision; setHeld(null);
     relisted.current.resolve(after); relisted.current = Promise.withResolvers();
@@ -400,38 +433,55 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
     if (!canWrite) return;
     const preview = previews.current.get(rec.id);
     if (!preview || preview.requiresAcknowledgement.length) { setReview({ kind: 'single', rec, action, ...(preview ? { preview } : {}) }); return; }
+    const epoch = contextEpoch.current;
     setBusyId(rec.id);
-    try { await afterMutation([await applyReview({ agentId, projectId, client }, rec, preview, action, false)]); }
-    finally { setBusyId(null); }
-  }, [canWrite, agentId, projectId, afterMutation]);
+    try { const result = await applyReview({ agentId, projectId, client }, rec, preview, action, false); if (epoch === contextEpoch.current) await afterMutation([result]); }
+    finally { if (epoch === contextEpoch.current) setBusyId(null); }
+  }, [client, canWrite, agentId, projectId, afterMutation]);
 
   // Discard a single ORPHANED row — removes the review record + baseline blob + vector point.
   const discard = useCallback(async (rec: PendingChangeRecord) => {
+    const epoch = contextEpoch.current;
     setBusyId(rec.id);
     try {
       const res = await discardPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }, client);
+      if (epoch !== contextEpoch.current) return;
       if (!res.ok) setError(res.error || 'Discard failed'); else dropResolvedDeleteRow(rec);
       await fetchPending(false);
       void refreshPendingCount({ agentId, projectId });
-    } catch (e) { setError(e instanceof Error ? e.message : 'Discard failed'); } finally { setBusyId(null); }
-  }, [agentId, projectId, fetchPending, dropResolvedDeleteRow, refreshPendingCount]);
+    } catch (e) { if (epoch === contextEpoch.current) setError(e instanceof Error ? e.message : 'Discard failed'); } finally { if (epoch === contextEpoch.current) setBusyId(null); }
+  }, [client, agentId, projectId, fetchPending, dropResolvedDeleteRow, refreshPendingCount]);
 
   // Repair: bulk-discard every orphaned change the caller can write. Which records
   // went is read from the refetch — the route re-authorizes each one.
   const repair = useCallback(async () => {
     if (repairTimer.current) { clearTimeout(repairTimer.current); repairTimer.current = null; }
-    setRepairing(true); setConfirmRepair(false); setError(null);
+    const epoch = contextEpoch.current;
+    repairStop.current = false; holdRevisions(); setRepairing(true); setConfirmRepair(false); setError(null);
+    let cursor = repairCursor.current; setRepairPaused(false);
+    let scanned = 0; let discarded = 0; let refused = 0; let failed = 0;
     try {
-      await discardOrphanedPending({ agentId, ...(projectId ? { projectId } : {}), ...(convFilter ? { conversationId: convFilter } : {}) }, client);
-      const candidates = changes.filter((rec) => orphanIds.has(rec.id));
-      const after = await fetchPending(true);
-      if (after) {
-        const survivors = new Set(after.map((rec) => rec.id));
-        for (const rec of candidates) if (!survivors.has(rec.id)) dropResolvedDeleteRow(rec);
-      }
+      do {
+        const page = await discardOrphanedPending({ agentId, ...(projectId ? { projectId } : {}),
+          ...(convFilter ? { conversationId: convFilter } : {}), ...(cursor ? { cursor } : {}) }, client);
+        if (epoch !== contextEpoch.current) return;
+        scanned += page.scannedVisible; discarded += page.discarded; refused += page.refused; failed += page.failed;
+        setRepairProgress(`${scanned} scanned · ${discarded} discarded · ${refused} refused · ${failed} failed`);
+        cursor = page.nextCursor; repairCursor.current = cursor;
+        if (page.restartRequired) { repairCursor.current = undefined; setRepairPaused(true); setError('Changes moved. Refresh before continuing repair.'); break; }
+        if (page.failed > 0) { setRepairPaused(true); setError('Repair paused after a failed change. Refresh before continuing.'); break; }
+        if (page.partial) { setRepairPaused(true); setError('Repair paused; part of the inventory or orphan checks are unavailable.'); break; }
+      } while (cursor && !repairStop.current);
+      if (cursor) setRepairPaused(true);
+      if (epoch !== contextEpoch.current) return;
+      await fetchPending(true);
+      if (epoch !== contextEpoch.current) return;
+      listedRevisions.current = storeApi.getState().sourceChangeRevision; setHeld(null);
       void refreshPendingCount({ agentId, projectId });
-    } catch (e) { setError(e instanceof Error ? e.message : 'Repair failed'); } finally { setRepairing(false); }
-  }, [agentId, projectId, convFilter, fetchPending, changes, orphanIds, dropResolvedDeleteRow, refreshPendingCount]);
+    } catch (e) { if (epoch === contextEpoch.current) { setRepairPaused(true); setError(e instanceof Error ? e.message : 'Repair failed'); } }
+    finally { if (epoch === contextEpoch.current) { setRepairing(false); setHeld(null); } }
+  }, [client, agentId, projectId, convFilter, fetchPending, refreshPendingCount, holdRevisions, storeApi]);
+
   const onRepairClick = useCallback(() => {
     if (confirmRepair) { void repair(); return; }
     setConfirmRepair(true);
@@ -443,27 +493,32 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
   // confirm). A record whose fresh preview turns out to need one is reported AND handed
   // to the grouped review dialog, where it is approved or dismissed with its acknowledgement.
   const approveAll = useCallback(async () => {
+    const epoch = contextEpoch.current;
     setApprovingAll(true); setConfirmAll(false); setError(null); holdRevisions();
     const done: ReviewResult[] = [];
     try {
       for (const rec of approvable) {
+        if (epoch !== contextEpoch.current) break;
         let preview = previews.current.get(rec.id);
         if (!preview) {
           try { preview = await previewPendingChange({ agentId, ...(projectId ? { projectId } : {}), id: rec.id }, client); }
           catch (e) { done.push({ id: rec.id, uri: rec.uri, action: 'approve', outcome: 'error', detail: e instanceof Error ? e.message : 'Preview failed' }); continue; }
+          if (epoch !== contextEpoch.current) break;
           previews.current.set(rec.id, preview);
         }
         if (preview.requiresAcknowledgement.length) { done.push({ id: rec.id, uri: rec.uri, action: 'approve', outcome: 'needs-ack' }); continue; }
         done.push(await applyReview({ agentId, projectId, client }, rec, preview, 'approve', false));
       }
     } finally {
+      if (epoch !== contextEpoch.current) return;
       setApprovingAll(false);
       const handed = approvable.filter(rec => done.some(r => r.id === rec.id && r.outcome === 'needs-ack'));
       if (handed.length) setAckPreviews(n => n + 1);
       await afterMutation(done);
+      if (epoch !== contextEpoch.current) return;
       if (handed.length && canWrite) { reviewed.current.clear(); setReview({ kind: 'group', records: handed.slice(0, REVIEW_BATCH), total: handed.length }); }
     }
-  }, [approvable, agentId, projectId, afterMutation, canWrite]);
+  }, [approvable, agentId, projectId, client, afterMutation, canWrite]);
 
   const move = useCallback((delta: number) => setFocusIndex((i) => (visible.length === 0 ? 0
     : Math.max(0, Math.min(visible.length - 1, i + delta)))), [visible.length]);
@@ -514,6 +569,7 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
     </div>;
   };
 
+  const renderedEpoch = contextEpoch.current;
   const failed = results.filter(r => r.outcome !== 'ok');
   const busy = loading || inventory.loading;
   return (
@@ -522,7 +578,7 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
         key={review.kind === 'group' ? `group\u0000${review.records[0]?.id ?? ''}` : `single\u0000${review.rec.id}`}
         onClose={() => setReview(null)} next={review.kind === 'group' ? unreviewed.filter(rec => !review.records.some(r => r.id === rec.id)).length : 0}
         onNext={openReviewBatch} refetch={refetch} onBatchStart={holdRevisions}
-        onDone={done => { for (const result of done) reviewed.current.add(result.id); void afterMutation(done); }} /> : null}
+        onDone={done => { if (renderedEpoch !== contextEpoch.current) return; for (const result of done) reviewed.current.add(result.id); void afterMutation(done); }} /> : null}
       {/* Header: title + nav cursor + approve-all + view toggle + refresh */}
       <div className="flex flex-wrap items-center gap-1.5 px-3 py-2 border-b border-white/5 shrink-0">
         <span className="text-xs font-semibold text-white/80">Changes</span>
@@ -573,10 +629,15 @@ export function PendingChangesPanel({ agentId, projectId }: Props) {
           </button>
           {/* Additive — the per-row buttons stay the primary path. */}
           <SkillLauncher variant="icon" size="sm" skill="manage-files" packageId="@neuralis/brain-core"
-            scripts={["scripts/pending.sh", "scripts/approve.sh"]} label="Review or approve pending changes with the agent" icon="FileText" />
+            label="Review or approve pending changes with the agent" icon="FileText" />
         </div>
       </div>
 
+      {repairing ? <button type="button" onClick={() => { repairStop.current = true; }} className="px-3 py-1 text-xs text-amber-200">Stop after this batch</button> : null}
+      {repairProgress ? <div role="status" className="px-3 py-1 text-xs text-white/60">{repairProgress}</div> : null}
+      {canWrite && repairPaused && !repairing ? <button type="button" onClick={() => void repair()} className="px-3 py-1 text-xs text-amber-200">{repairCursor.current ? 'Continue available repair' : 'Retry repair'}</button> : null}
+      {partial ? <div role="status" className="px-3 py-1 text-xs text-amber-200">Showing available changes; some inventory or orphan checks are unavailable.</div> : null}
+      {nextCursor ? <button type="button" disabled={loading || repairing} onClick={() => void fetchPending(true, true)} className="px-3 py-1 text-xs text-violet-200 disabled:opacity-40">Load more</button> : null}
       {/* Filter bar */}
       <div className="flex flex-wrap items-center gap-2 px-3 py-1.5 border-b border-white/5 shrink-0 text-[11px]">
         {convFilter ? <span className="inline-flex items-center gap-1 px-1.5 py-0.5 rounded bg-violet-500/15 text-violet-200/90" title={convFilter}>

package/app/filesystem/ui/README.md

@@ -25,9 +25,9 @@ Re-exported from `app/filesystem/ui/index.ts`:
   - **`DiffModeToggle`** is the ONE Auto/Unified/Split control bound to the store `diffViewMode`, shared by BOTH the review diff AND the git diff (Auto picks unified/split by container width via `useContainerWidth`).
   - The editor also carries the VS Code-style **git left-gutter** (`codeEditor/editorGitGutter.ts` + the pure `codeEditor/gitLineStatus.ts` parser) for git-tracked files — a thin emerald(added)/blue(modified) bar + red delete caret, derived **fail-soft** from `getGitDiff({staged:false})` (Working↔Index).
   - `DiffView` (the old hand-rolled Myers review diff) was **DELETED** — superseded by `ReviewDiffView`. NB `app/cards/DiffView.tsx` is a DIFFERENT file (the chat-card single-column diff) and stays.
-- `Toolbar` — top toolbar with the active agent’s standalone configured icon (no visible name or identity badge), sidebar toggle, refresh, upload, and panel switches. The Changes switch carries the caller's visible pending COUNT as a static badge (`pendingCount`, the server `count_only` answer — `1000+` at the listing cap); the client `pendingReviewPaths` set only tones tree rows.
+- `Toolbar` — top toolbar with the active agent’s standalone configured icon (no visible name or identity badge), sidebar toggle, refresh, upload, and panel switches. The Changes switch carries the caller's visible pending COUNT as a static badge (`pendingCount`, the server `count_only` answer — `1000+` display cap; partial totals carry `+`, stale/unavailable totals `?`); the client `pendingReviewPaths` set only tones tree rows.
 - `SourcesPanel`, `PackagesPanel`, `VectorHealthPanel`, `PanelScaffold` — right-hand panels. Sources offers advisory metrics exclusions only when enabling an attested own data source with no sync block; Save persists the editable draft. Media summaries include local structural PNG failures, and chunk-only cleanup refreshes Files separately from removed-file counts.
-- `PendingChangesPanel` — Changes groups current Git status and pending review by source/repository, including non-Git sources. Normalized URI joining renders a file once while retaining separately labeled staged/unstaged comparisons for each overlapping repository and one pending review. All cards start expanded in ONE `useVirtualizer` list (`pendingChangesModel.ts` owns the filters, the flat row list, `rowEstimate`/`isMeasuredRow` and the Approve split; the compact row pins `h-8`, every card is measured; `overflow-anchor:none` plus an above-the-fold size adjustment keep the view still); the content lanes cache every loaded preview/diff, and source revisions plus context sequences fence obsolete replies. A **Type** filter (all · pending · Git) narrows the layers; the repository picker uses the Git panel's `resolveRepoLabel`. **Approve N** counts records with no acknowledgement on their own fields (`ackHintFor`, the server preview's own predicate) or in an already-loaded preview (`splitApprovable`'s `knownPreview`, no fetch of its own); the rest open `PendingReviewDialog` grouped by reason, each record sent with its own fingerprint, and every sweep reports a per-record result row (a refused revert included) — a record the sweep found needing an acknowledgement is reported AND handed to that grouped dialog (approve or dismiss with the acknowledgement). A batch (the sweep, a dialog group) HOLDS the source revisions its own writes bump (`holdRevisions`, released in `afterMutation`): N writes cost N verb requests, ONE re-list and at most one re-preview per card still listed — never a re-list plus every visible card's re-preview per write. A `changed` answer (`PENDING_STATE_CHANGED` / `PENDING_GENERATION_CHANGED`) is not final: the dialog fetches ONE fresh preview for that record (per-record sequence, liveness cleared on unmount only) and waits for a new click — never a replay. In the panel that ONE fetch is the panel's `refetch`: it waits for the re-list, the record's card holds meanwhile and adopts the answer under its final key (`takeRefetch`), so the card sends nothing of its own; a direct (dialog-less) refusal bumps only that card's preview nonce. A confirmed absence with a saved baseline is named in the preview body (`acceptsAbsence`). The orphan probe runs on mount, Refresh and Repair only — a source revision re-reads the plain list. Source inventory is separate from content, completed siblings are cached, truncation is shown, and Git errors do not hide other sources. Review reads a bounded pending preview/fingerprint with typed current/baseline/index states; ack-required state opens an explicit confirmation. Actual WRITE access gates card, compact, bulk and repair controls; historical cards remain read-only. Orphan ids arrive with the same pending listing, so Repair remains orphan-only and re-authorized server-side.
+- `PendingChangesPanel` — Changes groups current Git status and pending review by source/repository, including non-Git sources. Normalized URI joining renders a file once while retaining separately labeled staged/unstaged comparisons for each overlapping repository and one pending review. All cards start expanded in ONE `useVirtualizer` list (`pendingChangesModel.ts` owns the filters, the flat row list, `rowEstimate`/`isMeasuredRow` and the Approve split; the compact row pins `h-8`, every card is measured; `overflow-anchor:none` plus an above-the-fold size adjustment keep the view still); the content lanes cache every loaded preview/diff, and source revisions plus context sequences fence obsolete replies. A **Type** filter (all · pending · Git) narrows the layers; the repository picker uses the Git panel's `resolveRepoLabel`. **Approve N** counts records with no acknowledgement on their own fields (`ackHintFor`, the server preview's own predicate) or in an already-loaded preview (`splitApprovable`'s `knownPreview`, no fetch of its own); the rest open `PendingReviewDialog` grouped by reason, each record sent with its own fingerprint, and every sweep reports a per-record result row (a refused revert included) — a record the sweep found needing an acknowledgement is reported AND handed to that grouped dialog (approve or dismiss with the acknowledgement). A batch (the sweep, a dialog group) HOLDS the source revisions its own writes bump (`holdRevisions`, released in `afterMutation`): N writes cost N verb requests, ONE re-list and at most one re-preview per card still listed — never a re-list plus every visible card's re-preview per write. A `changed` answer (`PENDING_STATE_CHANGED` / `PENDING_GENERATION_CHANGED`) is not final: the dialog fetches ONE fresh preview for that record (per-record sequence, liveness cleared on unmount only) and waits for a new click — never a replay. In the panel that ONE fetch is the panel's `refetch`: it waits for the re-list, the record's card holds meanwhile and adopts the answer under its final key (`takeRefetch`), so the card sends nothing of its own; a direct (dialog-less) refusal bumps only that card's preview nonce. A confirmed absence with a saved baseline is named in the preview body (`acceptsAbsence`). The orphan probe runs on mount, Refresh and Repair only — a source revision re-reads the plain list. Source inventory is separate from content, completed siblings are cached, truncation is shown, and Git errors do not hide other sources. Review reads a bounded pending preview/fingerprint with typed current/baseline/index states; ack-required state opens an explicit confirmation. Actual WRITE access gates card, compact, bulk and repair controls; historical cards remain read-only. Orphan ids arrive with the same pending listing, so Repair remains orphan-only and re-authorized server-side. Changes exposes Load more and incomplete inventory state. Repair processes batches sequentially with progress and Stop after the current batch; partial pages pause at their cursor for explicit Continue available/Retry. List and orphan epochs are independent; classification survives a plain relist only for matching record generations. FileEditor opens the shared review dialog for the exact visible URI. Returned generation conflicts appear in the existing Changes row status before preview succeeds. Git hunk rows retain geometry during same-context permission refresh while actions remain disabled until permission and diff settle.
 
 - `InlineUploader` — the Upload tab (folder pick, new folder, drop zone). The two modals it once sat beside (`EditFileModal`, `UploadFileModal`) were deleted 2026-09-04: nothing had mounted either since the repository's baseline, so the settling-sandpiper M9 reconcile tails had been fixed on dead code while the live in-place Edit still called the upsert-only `refresh`. Those tails are store actions now (`saveFileInPlace` / `markFileDeleted`, `../store/README.md`) that `FileEditor` calls.
 - `GitControlPanel`, `StackedSections` (+ pure `stackedSectionsLayout.ts`), `GitCommitGraph` (+ pure `gitGraphLayout.ts`/`gitGraphPaging.ts`/`gitGraphItems.ts` — the item model: expandable rows, the outgoing divider, ref-chip/dot classing, the branch-bar ahead/behind chips), `GitDiffView` + `GitFileDiff` + `GitCommitChangesView` (re-exported; + pure `gitDiffExpand.ts`/`gitDiffPatch.ts`/`gitFileDiffMode.ts`), `GitStatusBadge`, `DiffCountBadge` — the Git Control surface: the sidebar pane-stack panel, the in-panel virtualized commit graph with commit drill-in + outgoing markers, the side-by-side diff view (single + multi-file stacked tab), the per-file tree badge. The owning narrative (sections, paging/live-refresh, drill-in, outgoing, caps, write gating) is the package-root README "Git Control panel" section — this bullet only anchors the files.
@@ -39,7 +39,7 @@ Re-exported from `app/filesystem/ui/index.ts`:
 - `PolicyEditor` — compact admin-style permissions editor for the source-config panel. Renders the persisted JSON tree (`default`, `byRole`, `byUser`, `byAgent`, `paths[]`) with tri-state R/W/X pill badges (allow / deny / inherit cycle), per-role/user/agent override rows (with `+ Add` input + trash), and path rules with clickable role chips + per-rule agent chips (`$self/agentId`, inline-add). `OVR` toggles the rule's `override` flag. Adding a rule **prepends** it (visible at the top of long policy sets; first-match-wins means the fresh rule also takes precedence). Two modes: `edit` (Save button visible when dirty) and `view` (read-only chat-config render). It is wired into `SourcesPanel`, laid out admin-style, and carries the By Role / By User / By Agent sections. Save threads through `handlePolicySave` → `updateSourceConfig` without disturbing the user's pending sync/credential edits.
 - `SourcesPanel` "Discoverable" section — lives INSIDE the Vector Health expandable, alongside a `mount.mts` explainer card. Suggestions arrive from `GET /sources/discoverable` and use the shared `dimmedSourceTone('unattached')` util. The icon name (`AppWindow`, `GitBranch`, `FolderTree`, …) resolves through the shared `resolveLucideIcon` helper (same `ICON_MAP` as the workspace dock-left). Click pre-fills the add-source form with `{ key, path, kind, hostRoot? }` from the suggestion, plus the suggestion's optional `suggestedAccess` (read/write/exec) which overrides the connector-kind default, and — for `seed:'discoverable'` package declarations (e.g. the admin app zone, suggestion id `discover:decl:app`) — the **declared `description`** prefills the add form's description field. The **Full Host** suggestion (native/non-Docker only — `/` is the readable host root; in Docker the host must first be bound via `pnpm neuralis:mount add /`) ships `suggestedAccess: { read:true, write:false, exec:false }` so the whole-host root attaches **read-only by default** — the owner widens it (or narrows the uri-policy) in the form before saving. A host source is readable from the container shell, but host-native binaries still won't execute under the container runtime (a host PTY broker is a separate, future capability).
 - `SourcesPanel` row actions say what they do: **Rescan changes** (the `reindex` route without `force` — changed files are embedded again, unchanged ones keep their vectors), **Re-embed…** (`ReembedDialog` — every file of the source with the active model, estimate first), **Embed pending…** (`ReembedDialog kind="pending"`; it and **Re-embed…** are disabled while the row's live `embedding_enabled` says off), **Forget sync state** (the `reset` route — the next sync compares every file again; deletes no file and no vector). A started re-embed is followed by the same job poll + count refresh as a rescan (`followReindex`); an embedding pass that ends `paused` (terminal, not failed) shows "Embedding paused: <reason>" with **Resume** (the same owed-only apply). The Modify-source body states `binarySkipLine` ("N binary files not indexed" — the last count a pass measured) and `embeddingLine` beside `mediaSkipLine`: off — the live `embedding_enabled`, never the last pass — reads neutral ("Semantic embedding off — text and field search only"); the last pass's other reasons read amber ("Semantic embedding pending: <reasons>").
-- `SourcesPanel` row is **name-first** (the redesign for the always-narrow widget). The source name is the dominant element (`flex-1`, larger/bold); the kind icon uses the SAME resolved icon set as the file tree (`resolveIconWithFallback` over the connector-manifest `kind_icon`/`meta.icon`) and is **coloured by `getSourceVisualTone`** — so the icon tone IS the sync/live signal, matching the tree (the old `Healthy/Idle/Error` status text + `statusTone` are gone). The per-row **trust badge** (`first-party`/…) and the **scope badge** (`project`/`user`/`agent` — already a tab filter above) are removed; only `observed`, `orphan`, `unsaved`, and the enabled toggle remain inline. Rows are **grouped by `origin_package`** — the **declaring package id** the server resolves per source (the CONTRACT-BACKED `PackageSourceDeclaration` owner, returned on each `SourceRuntimeSummary` / `s.origin_package`), one group **per package**: each real `@neuralis/*` (or any other) package sorts **alphabetically** and user-added mounts collapse into a single **`Mounted (user-added)`** group that sorts **LAST** (`sourceOriginGroup` / `MOUNTED_GROUP`). The small left-indented group header **replaces** the per-row trust/`first-party` badge. The old client-side heuristic that inferred the owner from the connector kind's npm scope (`sourceOriginLabel`) is **gone** — attribution is now resolved server-side from the declarations (`matchDeclaredSource`, slug + resolved-root for rooted kinds; kind-only for rootless sandbox kinds), so a user mount named `app` that is NOT rooted at the platform app zone is NOT attributed to admin — the grouping is **unspoofable**.
+- `SourcesPanel` row is **name-first** (the redesign for the always-narrow widget). The source name stays left-aligned and is the dominant element (`flex-1`, larger/bold); the kind icon uses the SAME resolved icon set as the file tree (`resolveIconWithFallback` over the connector-manifest `kind_icon`/`meta.icon`) and is **coloured by `getSourceVisualTone`** — so the icon tone IS the sync/live signal, matching the tree (the old `Healthy/Idle/Error` status text + `statusTone` are gone). The per-row **trust badge** (`first-party`/…) and the **scope badge** (`project`/`user`/`agent` — already a tab filter above) are removed; only `observed`, `orphan`, `unsaved`, and the enabled toggle remain inline. Rows are **grouped by `origin_package`** — the **declaring package id** the server resolves per source (the CONTRACT-BACKED `PackageSourceDeclaration` owner, returned on each `SourceRuntimeSummary` / `s.origin_package`), one group **per package**: each real `@neuralis/*` (or any other) package sorts **alphabetically** and user-added mounts collapse into a single **`Mounted (user-added)`** group that sorts **LAST** (`sourceOriginGroup` / `MOUNTED_GROUP`). The small left-indented group header **replaces** the per-row trust/`first-party` badge. The old client-side heuristic that inferred the owner from the connector kind's npm scope (`sourceOriginLabel`) is **gone** — attribution is now resolved server-side from the declarations (`matchDeclaredSource`, slug + resolved-root for rooted kinds; kind-only for rootless sandbox kinds), so a user mount named `app` that is NOT rooted at the platform app zone is NOT attributed to admin — the grouping is **unspoofable**.
 - `SourcesPanel` source body: when a row is expanded it renders at **full height** (no `max-h` clamp) so every Path Rule / uri-policy is visible and the outer panel scrolls — the closed state keeps the collapse animation. The Sync sub-section shows a per-trigger explainer (Manual = only the Sync button; Auto = file-watch + reconcile; Scheduled = interval) and clarifies the "Always active" pin. Disabling sync (unchecking "Enable sync" + Save) sends `clearSync: true` — an omitted `sync` means "no change" server-side, so without the flag the disable would silently revert.
 - `SourcesPanel` per-source counts are **lazy** — the exact `connector` / `indexed` / `unindexed` stats row is fetched ONLY when its row is opened (`toggleSource` → `fetchSourceCounts` → a list scoped to `<source>://` with `include_counts`, so `computeSourcesRegistry` walks that ONE source), cached in `countsBySource`, and shown behind a "Loading counts…" placeholder. Panel-open itself does a **count-FREE** `refresh()` (no `withCounts`) — that still populates `sourceSummaries` (`s.sources`) for source discovery (observed-only sources, project scope) + per-row connector liveness dim, but fires **zero** project-wide count walks. There is deliberately no eager `refresh({withCounts:true})` on open — that, together with the Vector Health walk below, is what used to make opening one panel slow everything. Counted refreshes are narrowed to the operations that actually MOVE a number: sync, reindex, and a config save that changed the sync FILTER set (`syncFilterChanged` — exclude/include/`maxScanFiles`/a cleared sync block, which `connector.count()` applies, so the on-disk total shifts at once). A permissions save, a delete and an add refresh count-FREE: the indexed count is a project-scoped `countByFilter` with no per-caller policy input, the on-disk count is physical truth, a deleted row is gone and a brand-new row's numbers are one expand away. Every counted path also evicts that source's cached counts (`clearCachedCounts`) so the fresh summary is what renders — the lazy cache used to shadow it indefinitely after an exclude edit. `pollSyncJob` (1.5 s × `MAX_POLLS` 2400 = a sixty-minute ceiling) checks a `mountedRef` each turn and returns the moment the panel unmounts; the ref is cleared on UNMOUNT ONLY, never in a dependency-change cleanup, so a live poll is never dropped while the panel is still there. And EVERY hook in `SourcesPanel` sits above its `if (!open) return null` guard: two `useCallback`s used to live below it, so the component rendered a different number of hooks open than closed — React refuses that on one instance, and only the parent's mount gate carrying the same `workspacePanels.sources` flag kept it from ever firing.
 - `useFilesystemSSE` `sync:completed`: the handler is matched **before** the `if (!uri) return` guard — the event carries `source` (the slug), NOT a file `uri`. It runs the authoritative `reconcileSourceFolders` over that source's VISIBLE folders (a sync can have removed files), skips the pass entirely when every change count on the payload is zero (a missing count is unknown and still re-lists), and falls back to `refreshTree` only when no source is present. That pass rides the ONE per-source reconcile schedule shared with external-change events (a trailing quiet window with a max-wait), so a burst of changes becomes one pass. Owner: `app/filesystem/hooks/README.md`.
@@ -53,13 +53,13 @@ Re-exported from `app/filesystem/ui/index.ts`:
 
 - `SourceDeleteConfirm` — inline rose-tinted popover under the row (no modal, matches the panel's "no overlay" pattern). Headline + one-line reminder that the host folder is not touched + `[ ] Purge vector index entries (~N point(s))` checkbox (default OFF — conservative) + Docker-bind-mount warning ribbon when `connection.config.hostRoot` is set, telling the user to run `neuralis mount remove <slug>` before restarting the container. On confirm, `SourcesPanel.handleDelete` calls `deleteSource({ purgeVectors })` and surfaces a transient `successMsg` ("Deleted "<source>" (vectors purged: N)").
 - **`SkillLauncher` coverage** (`@neuralis/package-system/client`, additive "+" launchers) — every filesystem function the LLM can drive has a visible composer-prefill trace. Clicking a launcher PREFILLS the chat composer with the skill (+ scripts) like a `/` slash pick; it never sends/streams. **No launcher states a feature list**: visibility is DERIVED from the host's per-caller skill catalog, so it cannot drift from each skill's own `SKILL.md` `requiredFeatures` and an unresolved catalog renders nothing (the gate named per row below is the SKILL's, documented here, not repeated in the JSX). `packageId` is the REGISTRY id (`@neuralis/brain-core`), matched as an exact pair with the skill id. The launchers resolve the `WorkspaceHostPort` from the `WorkspaceHostPortProvider` mounted once in `host/installFilesystemHostComponents.tsx` — without it they render `null` silently. Current placements:
-  - `Toolbar` — `sync` (`drive.sync`, icon-`brain`, script-less) next to the Sources panel toggle, and `manage-files` (`drive.write`; `scripts: mkdir, copy, modify, search`) as the general file-ops handoff. The tree's CONTEXT MENU deliberately carries none: it is a keyboard-navigable click-to-act list with one uniform item model, and a composer-prefill affordance would need a bespoke item kind there.
-  - `SourcesPanel` header — `manage-sources` (`drive.read`, attached-left to the `+ Source` button; `scripts: sync, reindex, set-enabled`).
-  - `SourcesPanel` per-source **Permissions** header — `manage-uri-policy` (`drive.policy` — no grant below the `admin` tier, grantable to any custom role; `scripts: show-uri, set-uri, manifests`) hands the URI-policy / path-permission edit for that source to the agent, alongside the `PolicyEditor`.
+  - `Toolbar` — `sync` (`drive.sync`, icon-`brain`, script-less) next to the Sources panel toggle, and `manage-files` (`drive.write`; `scripts: mkdir, copy, modify`) as the general file-ops handoff. The tree's CONTEXT MENU deliberately carries none: it is a keyboard-navigable click-to-act list with one uniform item model, and a composer-prefill affordance would need a bespoke item kind there.
+  - `SourcesPanel` header — `manage-sources` (`drive.read`, attached-left to the `+ Source` button).
+  - `SourcesPanel` per-source **Permissions** header — `manage-uri-policy` (`drive.policy` — no grant below the `admin` tier, grantable to any custom role) hands the URI-policy / path-permission edit for that source to the agent, alongside the `PolicyEditor`.
   - `FileTree` empty-state — `manage-files` (`drive.write`, label; `scripts: upload, modify`) to populate a source.
-  - `GitControlPanel` header — `git` (`drive.read`; `scripts: git.sh`) next to the refresh button. The `git` skill drives the SAME `/git/*` routes this panel does — its own SKILL.md says so — and the panel shipped with no way to reach it until 2026-07-28.
-  - `PendingChangesPanel` toolbar — `manage-files` (`drive.write`; `scripts: pending, approve`) for bulk review; the per-row approve/revert buttons stay the primary path.
-  - `VectorHealthPanel` actions row — `manage-sources` (`drive.read`; `scripts: sync-status, reindex`). The index is per-SOURCE, so the agent-side equivalent of scan/repair is a source reindex plus a sync-status readout.
+  - `GitControlPanel` header — `git` (`drive.read`) next to the refresh button. The `git` skill drives the SAME `/git/*` routes this panel does — its own SKILL.md says so — and the panel shipped with no way to reach it until 2026-07-28.
+  - `PendingChangesPanel` toolbar — `manage-files` (`drive.write`) for bulk review; the per-row approve/revert buttons stay the primary path.
+  - `VectorHealthPanel` actions row — `manage-sources` (`drive.read`). The index is per-SOURCE, so the agent-side equivalent of scan/repair is a source reindex plus a sync-status readout.
   - `PackagesPanel` header — `create-package` (label, script-less) hands the whole authoring flow (scaffold, manifest, tools, surfaces, connectors, build — including the WASM pipeline) to the agent; additive to the per-row `Build` button. This is the ONE launcher that narrows further, with `alsoRequires={["packages.author"]}`, even though the SKILL ships ungated (so it stays importable): it scaffolds into `packages://`, which needs write + install/build capability the default `member` role does not hold, so showing it to a caller whose first action would be denied is worse UX than hiding it. `alsoRequires` can only ever hide a launcher, never reveal one, so this cannot become a disclosure. Deliberate — do not "align" it with the skill frontmatter.
 
 ## How it plugs into the package-system kernel

package/app/filesystem/ui/SourcesPanel.tsx

@@ -1261,7 +1261,6 @@ export function SourcesPanel(props: Props) {
               attached="left"
               skill="manage-sources"
               packageId="@neuralis/brain-core"
-              scripts={["scripts/sync.sh", "scripts/reindex.sh", "scripts/set-enabled.sh"]}
               label="Manage sources with the agent"
             />
           </div>
@@ -1677,7 +1676,7 @@ export function SourcesPanel(props: Props) {
               <div className="w-full flex items-center gap-2 py-2 text-left group hover:bg-white/[0.02] rounded-md px-1 transition">
                 <button type="button" onClick={() => toggleSource(config.source)} aria-expanded={isOpen}
                   title={disconnected ? sourceLiveReasonLabel(config.live_reason) : undefined}
-                  className="min-w-0 flex-1 flex items-center gap-2">
+                  className="min-w-0 flex-1 flex items-center gap-2 text-left">
                 {/* Git indicator (G2.1) — a GitBranch overlay on a git-repo
                     source's icon, ORTHOGONAL to the sync tone (visualTone still
                     owns the icon colour). */}
@@ -1902,7 +1901,6 @@ export function SourcesPanel(props: Props) {
                         size="sm"
                         skill="manage-uri-policy"
                         packageId="@neuralis/brain-core"
-                        scripts={["scripts/show-uri.sh", "scripts/set-uri.sh", "scripts/manifests.sh"]}
                         label={`Edit URI policy for "${config.source}" with the agent`}
                         icon="shield"
                       />

package/app/filesystem/ui/Toolbar.tsx

@@ -20,6 +20,7 @@ export function Toolbar(props: { agentId: string; onOpenProjectFiles: () => void
   const activeWorkspaceTab = useFilesystemStore((s) => s.activeWorkspaceTab);
   // The server count of the caller's visible pending reviews (`refreshPendingCount`),
   // never the client set of loaded folders' rows.
+  const pendingCountState = useFilesystemStore((s) => s.pendingCountState);
   const pendingCount = useFilesystemStore((s) => s.pendingCount);
 
   return (
@@ -112,7 +113,7 @@ export function Toolbar(props: { agentId: string; onOpenProjectFiles: () => void
           size="sm"
           skill="manage-files"
           packageId="@neuralis/brain-core"
-          scripts={["scripts/mkdir.sh", "scripts/copy.sh", "scripts/modify.sh", "scripts/search.sh"]}
+          scripts={["scripts/mkdir.sh", "scripts/copy.sh", "scripts/modify.sh"]}
           label="Create, copy, edit or search files with the agent"
           icon="Folder"
         />
@@ -133,7 +134,7 @@ export function Toolbar(props: { agentId: string; onOpenProjectFiles: () => void
 
         <button
           className={`relative p-1.5 rounded-lg transition-colors ${workspacePanels.pending && activeWorkspaceTab === 'pending' ? 'bg-amber-500/15 text-amber-300' : 'text-white/50 hover:bg-white/5 hover:text-amber-200'}`}
-          title={pendingCount > 0 ? `Pending changes — ${pendingCount} to review` : 'Pending changes — review, approve & revert'}
+          title={pendingCountState === 'stale' ? `Pending changes — count unavailable${pendingCount > 0 ? ` (last count ${pendingCount})` : ''}` : pendingCountState === 'partial' ? `Pending changes — ${pendingCount}+ (incomplete) to review` : pendingCount > 0 ? `Pending changes — ${pendingCount} to review` : 'Pending changes — review, approve & revert'}
           onClick={() => {
             if (workspacePanels.pending && activeWorkspaceTab === 'pending') {
               setWorkspacePanelOpen('pending', false);
@@ -143,9 +144,9 @@ export function Toolbar(props: { agentId: string; onOpenProjectFiles: () => void
           }}
         >
           <FileDiff className="w-4 h-4" />
-          {pendingCount > 0 ? (
+          {pendingCount > 0 || pendingCountState !== 'exact' ? (
             <span data-testid="pending-count-badge" className="absolute -top-1 -right-1 min-w-[14px] rounded-full px-1 text-center text-[9px] leading-[14px] font-semibold bg-amber-500/15 text-amber-300">
-              {pendingCount >= 1000 ? '1000+' : pendingCount}
+              {pendingCount > 999 ? '1000+' : pendingCount}{pendingCountState === 'partial' && pendingCount <= 999 ? '+' : pendingCountState === 'stale' ? '?' : ''}
             </span>
           ) : null}
         </button>

package/app/filesystem/ui/VectorHealthPanel.tsx

@@ -99,9 +99,17 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
    *  Cleared automatically after 3s. Skipped when `dryRun === true` since
    *  preview-only doesn't need a guard. */
   const [confirmingAction, setConfirmingAction] = useState<ActionKind | null>(null);
+  const epoch = useRef(0);
+  const reportSeq = useRef(0);
+  const scanSeq = useRef(0);
+  const stop = useRef(false);
+  const pendingCursor = useRef<string | undefined>(undefined);
+  const [pendingPaused, setPendingPaused] = useState(false);
+  useEffect(() => { pendingCursor.current = undefined; setPendingPaused(false); }, [dryRun, retentionHours]);
   const confirmTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null);
 
   const fetchReport = useCallback(async () => {
+    const mine = epoch.current; const request = ++reportSeq.current;
     setLoading(true);
     setError(null);
     try {
@@ -128,26 +136,29 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
           return meta ? { ...row, ...meta } : row;
         });
       }
+      if (mine !== epoch.current || request !== reportSeq.current) return;
       setReport(enriched);
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Failed to fetch health report');
+      if (mine === epoch.current && request === reportSeq.current) setError(err instanceof Error ? err.message : 'Failed to fetch health report');
     } finally {
-      setLoading(false);
+      if (mine === epoch.current && request === reportSeq.current) setLoading(false);
     }
-  }, [agentId, projectId]);
+  }, [client, agentId, projectId]);
 
   const runScan = useCallback(async () => {
+    const mine = epoch.current; const request = ++scanSeq.current;
     setScanLoading(true);
     setError(null);
     try {
       const result = await scanVectorHealth({ agentId, ...(projectId ? { projectId } : {}) }, client);
+      if (mine !== epoch.current || request !== scanSeq.current) return;
       setScan({ orphanChunkCount: result.orphanChunkCount ?? 0, duplicateGroups: result.duplicateGroups ?? 0 });
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Scan failed');
+      if (mine === epoch.current && request === scanSeq.current) setError(err instanceof Error ? err.message : 'Scan failed');
     } finally {
-      setScanLoading(false);
+      if (mine === epoch.current && request === scanSeq.current) setScanLoading(false);
     }
-  }, [agentId, projectId]);
+  }, [client, agentId, projectId]);
 
   const runAction = useCallback(async (action: ActionKind) => {
     // Two-click confirm for destructive actions when not in dry-run mode.
@@ -162,6 +173,7 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
       confirmTimerRef.current = null;
     }
     setConfirmingAction(null);
+    const mine = epoch.current; stop.current = false;
     setActionLoading(true);
     setActionResult(null);
     setLastActionKind(action);
@@ -170,8 +182,22 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
     // we're actually deleting something (`dryRun=false`).
     setPrevReport(!dryRun ? report : null);
     try {
-      const result = await runHealthAction({ agentId, ...(projectId ? { projectId } : {}), action, dryRun, retentionHours }, client);
-      setActionResult(result);
+      let cursor = action === 'repair-pending' ? pendingCursor.current : undefined; setPendingPaused(false);
+      const totals: Record<string, number> = {};
+      do {
+        const result = await runHealthAction({ agentId, ...(projectId ? { projectId } : {}), action, dryRun, retentionHours, ...(cursor ? { cursor } : {}) }, client);
+        if (mine !== epoch.current) return;
+        for (const key of ['scannedVisible', 'orphaned', 'attempted', 'discarded', 'refused', 'failed', 'legacyUnknownDraft']) {
+          if (typeof result[key] === 'number') totals[key] = (totals[key] ?? 0) + result[key];
+        }
+        setActionResult({ ...result, ...totals });
+        cursor = action === 'repair-pending' && !result.restartRequired && typeof result.nextCursor === 'string' ? result.nextCursor : undefined;
+        if (action === 'repair-pending') pendingCursor.current = cursor;
+        if (result.partial === true) { setPendingPaused(true); setError('Repair paused; part of the inventory or orphan checks are unavailable.'); break; }
+        if (result.restartRequired) { pendingCursor.current = undefined; setPendingPaused(true); setError('Changes moved. Refresh before continuing repair.'); }
+        if (typeof result.failed === 'number' && result.failed > 0) { cursor = undefined; setPendingPaused(true); setError('Repair paused after a failed change. Refresh before continuing.'); }
+      } while (cursor && !stop.current);
+      if (cursor) setPendingPaused(true);
       if (!dryRun) {
         void fetchReport();
         // A destructive action changes orphan/dup counts — refresh the scan
@@ -179,15 +205,17 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
         if (scan) void runScan();
       }
     } catch (err) {
-      setError(err instanceof Error ? err.message : 'Action failed');
+      if (mine === epoch.current) { if (action === 'repair-pending') setPendingPaused(true); setError(err instanceof Error ? err.message : 'Action failed'); }
     } finally {
-      setActionLoading(false);
+      if (mine === epoch.current) setActionLoading(false);
     }
-  }, [agentId, projectId, dryRun, retentionHours, fetchReport, confirmingAction, report, scan, runScan]);
+  }, [client, agentId, projectId, dryRun, retentionHours, fetchReport, confirmingAction, report, scan, runScan]);
 
   // Auto-load on mount
   useEffect(() => {
+    epoch.current++; stop.current = true; pendingCursor.current = undefined; setPendingPaused(false); setActionLoading(false); setActionResult(null); setReport(null); setScan(null); setError(null);
     void fetchReport();
+    return () => { epoch.current++; stop.current = true; };
   }, [fetchReport]);
 
   // Clean up confirm timer on unmount.
@@ -211,6 +239,8 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
 
   return (
     <div className="space-y-3 px-2 pb-2">
+      {actionLoading && lastActionKind === 'repair-pending' ? <button type="button" onClick={() => { stop.current = true; }} className="text-xs text-amber-200">Stop after this batch</button> : null}
+      {canWrite && pendingPaused && !actionLoading ? <button type="button" onClick={() => void runAction('repair-pending')} className="text-xs text-amber-200">{pendingCursor.current ? 'Continue available repair' : 'Retry repair'}</button> : null}
       {/* Description */}
       <div className="text-[10px] text-white/40 italic leading-relaxed">
         Cleanup tool for the vector index. Removes leftover records:{' '}
@@ -370,7 +400,6 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
                 size="sm"
                 skill="manage-sources"
                 packageId="@neuralis/brain-core"
-                scripts={["scripts/sync-status.sh", "scripts/reindex.sh"]}
                 label="Inspect sync status or reindex a source with the agent"
                 icon="Database"
               />
@@ -378,13 +407,13 @@ export function VectorHealthPanel({ agentId, projectId }: Props) {
             <div className="flex items-center gap-3">
               <label className="inline-flex items-center gap-1 text-[10px] text-white/60 cursor-pointer"
                 title="Preview only — nothing will be deleted.">
-                <input type="checkbox" checked={dryRun} onChange={(e) => setDryRun(e.target.checked)} className="accent-emerald-400 h-3 w-3" />
+                <input type="checkbox" disabled={actionLoading} checked={dryRun} onChange={(e) => setDryRun(e.target.checked)} className="accent-emerald-400 h-3 w-3" />
                 Dry run
               </label>
               <label className="inline-flex items-center gap-1 text-[10px] text-white/60"
                 title="Records marked as deleted within this many hours are kept (GC ignores them).">
                 Retention:
-                <input type="number" min={1} value={retentionHours}
+                <input type="number" disabled={actionLoading} min={1} value={retentionHours}
                   onChange={(e) => setRetentionHours(Math.max(1, Number(e.target.value) || 24))}
                   className="w-12 h-5 rounded px-1 text-[10px] bg-white/[0.04] border border-white/[0.08] text-white/80 outline-none" />h
               </label>