@pellux/goodvibes-tui 0.26.0 → 0.28.0

package/CHANGELOG.md

@@ -4,6 +4,46 @@ All notable changes to GoodVibes TUI.
 
 ---
 
+## [0.28.0] — 2026-06-30
+
+Panel navigation & UI/UX overhaul, plus the accumulated post-0.27.0 UX fixes.
+
+### Added
+- **Unified panel navigation**: a single consolidated tab bar with a focus-accent border; jump directly to any panel with `Alt+1`–`Alt+9`, click tabs, and toggle the active pane with `Ctrl+G`.
+- **In-panel filtering**: press `/` to filter the list in panels that support it.
+- **Mouse-wheel scrolling** on every panel (via `BasePanel.handleScroll`).
+
+### Changed
+- **Width-aware formatting** across panels: shared toolkit primitives (`fitDisplay`, table/tree/badge/meter helpers) replace hand-rolled `.slice()`/`.padEnd()`, so rows stay aligned across emoji, CJK, and other wide characters.
+- **Scroll-back**: you can scroll up during and after a turn; the view only auto-follows the tail when parked at the bottom.
+- **Auto-compaction is now owned entirely by the SDK** (`@pellux/goodvibes-sdk` 0.35.0 `handlePostTurnContextMaintenance`). The redundant TUI-side trigger was removed to prevent double-compaction; manual `/compact` now builds a richer handoff context (running agents, WRFC chains, active plan, session lineage).
+
+### Fixed
+- Timer/async panels repaint while the main thread is idle instead of looking frozen (repaints gated on panel-active state).
+- Input/keybinding papercuts: reverse-search accept, Home/End, and the command palette.
+- Crash/signal safety net: the terminal is always restored on uncaught exceptions and termination signals.
+- Consolidated number/duration/context-usage formatting and routed the context window through one corrected `getContextWindowForModel` source across every surface.
+
+### Internal
+- Split `polish.ts` into leaf `polish-core.ts` + `polish-tables.ts` and extracted `wrfc-panel-format.ts` to satisfy the 800-line architecture gate; no public API changes (all symbols re-exported).
+
+## [0.27.0] — 2026-06-30
+
+Full deep-review audit of the TUI (33 findings fixed, each reviewed to a score of 10) and adoption of `@pellux/goodvibes-sdk` 0.35.0.
+
+### Fixed
+- **Context window**: the footer meter, footer-height, context-inspector overlay, `/health`, `/guidance`, and the context visualizer now use the resolved `getContextWindowForModel` so every surface agrees; the pre-catalog fallback uses the SDK's family-aware `inferFallbackContextWindow` instead of a hardcoded 128k/32k.
+- **Compaction**: removed the TUI's redundant/racy post-turn auto-compact — the SDK Orchestrator's post-turn maintenance is now the sole, correctly-resolved path (the dead `context-auto-compact` module was deleted).
+- **Sub-agent panels**: the Agent Inspector, Agent Logs, Token Budget, and Context Visualizer panels now repaint live (`requestRender` + live window / `lastInputTokens` wired at their construction sites); Agent Logs repaints on `streamingContent` growth, not just JSONL file-size changes — fixing the frozen-panel and stale-inspector symptoms.
+- **Scroll / lifecycle**: scroll-up respects `scrollLocked` (no overwrite during a turn) and agrees with the renderer (no dead/snap-back when idle); the terminal is restored on `uncaughtException`/SIGTERM/SIGHUP/fatal startup; `exitApp` awaits shutdown before exit.
+- **WRFC**: panel resume covers `reviewing`/`fixing`/`awaiting_gates`; `rehydrate` re-imports interrupted chains; the panel subscribes to the new `WORKFLOW_SCORE_REGRESSION` event.
+- **Core**: journal replay preserves the session title/titleSource; transcript event-navigation indexing fixed; the streaming buffer survives a mid-stream terminal resize; journal seq-collision fixed; high-priority system messages now reach conversation delivery.
+- **Sub-agent firehose**: resolved at the source by adopting SDK 0.35.0 (agent progress no longer dumps raw streamed output into the one-line status slot).
+- **DRY**: standardized 53 error stringifications on the SDK `summarizeError`; consolidated three duration formatters onto `formatElapsed`; migrated 12 panel palettes to `extendPalette(DEFAULT_PANEL_PALETTE, …)` so themes propagate.
+
+### Changed
+- Adopt `@pellux/goodvibes-sdk` **0.35.0** — its own 55-finding audit remediation: tool-loop circuit-breaker fix, window-scaled compaction safety buffer, `configured_cap` context-window resolution, MCP orphan-restart fix, transport-middleware retry + SSE auth fixes, and the new `inferFallbackContextWindow` export.
+
 ## [0.26.0] — 2026-06-21
 
 ### Changes

package/README.md

@@ -2,7 +2,7 @@
 
 [![CI](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml/badge.svg)](https://github.com/mgd34msu/goodvibes-tui/actions/workflows/ci.yml)
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
-[![Version](https://img.shields.io/badge/version-0.26.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
+[![Version](https://img.shields.io/badge/version-0.28.0-blue.svg)](https://github.com/mgd34msu/goodvibes-tui)
 
 A terminal-native AI coding, operations, automation, knowledge, and integration console with a typed runtime, omnichannel surfaces, structured memory/knowledge, and a raw ANSI renderer.
 
@@ -125,7 +125,7 @@ The interface is rendered directly to the alternate screen buffer with raw ANSI
 
 The runtime is organized around typed store domains, typed runtime events, a shared control plane for permissions and orchestration, and product surfaces for reviewing and repairing state. Agents run in-process with isolated histories, scoped tools, and optional worktrees. Operational state such as provider routing, local auth, daemon/gateway posture, channels, search, artifacts, structured knowledge, multimodal analysis, remote sessions, settings control-plane state, and task execution is routed into dedicated panels and APIs.
 
-The TUI now consumes the extracted `@pellux/goodvibes-sdk` platform layer for shared contracts, daemon route surfaces, transports, remote runtime contracts, and other reusable runtime code. The repo keeps the terminal UI, host wiring, and product-specific composition while future surfaces consume the same SDK-backed runtime foundation.
+The TUI now consumes the extracted `@pellux/goodvibes-sdk` (`0.34.0`) platform layer for shared contracts, daemon route surfaces, transports, remote runtime contracts, and other reusable runtime code. The repo keeps the terminal UI, host wiring, and product-specific composition while future surfaces consume the same SDK-backed runtime foundation.
 
 ---
 
@@ -145,6 +145,7 @@ The TUI now consumes the extracted `@pellux/goodvibes-sdk` platform layer for sh
 - Width-aware overlays, stable bottom docking above the prompt, half-height message surfaces, and structured footer layers
 - Shared panel workspace layout budgeting with renderer-owned visible-row budgets
 - Copy/selection logic that strips decorative gutters and visual scaffolding from clipboard output
+- Line-count indicator rendered right-aligned inside the prompt border on multi-line input (footer height stays stable regardless of prompt line count)
 
 ### Conversation And Transcript Workflow
 - Markdown rendering, syntax highlighting, inline diffs, collapsible blocks, bookmarks, block copy, and block save
@@ -540,6 +541,7 @@ Related storage paths:
 | `behavior.autoCompactThreshold` | `80` | Context % before auto-compact triggers |
 | `behavior.saveHistory` | `true` | Persist conversation history |
 | `behavior.returnContextMode` | `off` | Session return-context mode: `off`, `local`, `assisted` |
+| `behavior.notifyAfterSeconds` | `60` | Send desktop and webhook notifications for long-running turns after this many seconds (`0` disables); metadata-only — no conversation text is included |
 | `behavior.guidanceMode` | `minimal` | Operational guidance mode: `off`, `minimal`, `guided` |
 | `storage.secretPolicy` | `preferred_secure` | Secret storage policy: prefer secure backing store, fall back when allowed |
 | `permissions.mode` | `prompt` | Permission mode: `prompt`, `allow-all`, `custom` |
@@ -803,7 +805,7 @@ Key commands:
 - `/update`
 - `/trust`
 - `/bridge`
-- `/profile-sync`
+- `/profile-sync` (alias: `/profilesync`)
 
 The setup surface is also broader than a single readiness screen:
 
@@ -874,7 +876,7 @@ Key commands:
 
 - `/services inspect|test|resolve|auth|auth-review|doctor|export|import`
 - `/profiles`
-- `/profile-sync`
+- `/profile-sync` (alias: `/profilesync`)
 - `/setup transfer export|inspect|import`
 
 Service entries can use existing `tokenKey` fields, a SecretRef in the key field, or explicit `tokenRef` / `passwordRef` / `webhookUrlRef` / `signingSecretRef` / `publicKeyRef` / `appTokenRef` fields:
@@ -1270,6 +1272,8 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/accounts [action]` | — | Review provider-account routes, auth posture, and repair actions |
 | `/auth [action]` | — | Review auth posture and manage local service auth users/sessions |
 | `/memory [action]` | — | Session memory management: `list`, `add <text>`, `remove <id>` |
+| `/keep <text>` | — | Pin text to session memory; survives context compaction |
+| `/memory-sync [action]` | `/memsync` | Durable memory export/import and bundle exchange: `export <path> [scope]`, `import <path>` |
 | `/recall [action]` | `/rc` | Durable knowledge and memory substrate: capture, review, explain, export, import, and handoff |
 | `/knowledge [action]` | `/know`, `/kb` | Structured knowledge graph: ingest URLs/bookmarks, inspect issues, build packets, and run consolidation jobs |
 | `/context` | `/ctx` | Inspect context window usage (token breakdown per message) |
@@ -1281,7 +1285,7 @@ Those pieces cover conversation-noise routing, panel-health/performance budgets,
 | `/git [action]` | `/g` | Git commands: status, log, diff. Opens git panel if no action given |
 | `/scan` | — | Scan for local LLM servers |
 | `/plan [goal]` | — | Inspect or seed TUI-owned project planning state; `panel`, `approve`, `list`, and `show <id>` are supported |
-| `/work-plan [action]` | `/wp`, `/todo` | Open or update the persistent workspace work-plan checklist |
+| `/work-plan [action]` | `/wp`, `/todo`, `/workplan` | Open or update the persistent workspace work-plan checklist |
 | `/panel [action]` | `/panels` | Panel management: open, close, list, toggle, move, focus, split, width, height |
 | `/plugin [action]` | — | Manage plugins (enable/disable/reload/list) |
 | `/marketplace [action]` | — | Browse curated plugin, skill, hook-pack, and policy-pack surfaces |
@@ -1363,6 +1367,7 @@ All shortcuts are customizable via `~/.goodvibes/tui/keybindings.json`. Use `/ke
 | `Mouse wheel` | Scroll |
 | `Click drag` | Select text |
 | `Middle click` | Paste |
+| `n` / `N` | Next / previous match in locked search mode; wraps with a `(wrap)` marker |
 | `Escape` | Exit current mode (search, command, modal) |
 
 ### Blocks & Content
@@ -1646,7 +1651,7 @@ src/
 - **Agent Client Protocol** — subagents communicate via @agentclientprotocol/sdk over stdio ndJsonStream
 - **Backend-first external surface** — the daemon/control plane exposes typed HTTP/gateway methods for knowledge, artifacts, media, search, channels, and remote peers so future clients do not have to reimplement runtime logic
 - **Plugin system** — manifest.json + sandboxed API surface for commands, providers, tools, gateway methods, channels, embeddings, voice, media, and search
-- **Crash recovery** — periodic JSONL snapshots with recovery prompt on next startup
+- **Crash recovery** — periodic JSONL snapshots with recovery prompt on next startup; an fsync-per-record append-only transcript journal between snapshots is replayed at every resume seam (command resume, Ctrl+R crash recovery, panel resume) for SIGKILL-proof durability
 
 ---
 
@@ -1664,7 +1669,7 @@ bun run dev
 bun test
 ```
 
-8,500+ tests across contract, security, release gate, runtime, renderer, panel, integration, and UX anti-regression suites. Performance budget gate runs as part of CI — the build fails if any of the 5 perf budgets (store update latency, event dispatch latency, tool execution overhead, compaction duration, startup time) are exceeded.
+8,978 tests across contract, security, release gate, runtime, renderer, panel, integration, and UX anti-regression suites. Performance budget gate runs as part of CI — the build fails if any of the 5 perf budgets (store update latency, event dispatch latency, tool execution overhead, compaction duration, startup time) are exceeded.
 
 ### Build standalone binary
 

package/docs/foundation-artifacts/operator-contract.json

@@ -3,7 +3,7 @@
   "product": {
     "id": "goodvibes",
     "surface": "operator",
-    "version": "0.34.0"
+    "version": "0.35.0"
   },
   "auth": {
     "modes": [
@@ -19468,6 +19468,7 @@
           ],
           "additionalProperties": false
         },
+        "dangerous": true,
         "invokable": true
       },
       {
@@ -20641,6 +20642,7 @@
           ],
           "additionalProperties": false
         },
+        "dangerous": true,
         "invokable": true
       },
       {
@@ -25987,6 +25989,7 @@
           ],
           "additionalProperties": false
         },
+        "dangerous": true,
         "invokable": true
       },
       {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pellux/goodvibes-tui",
-  "version": "0.26.0",
+  "version": "0.28.0",
   "description": "Terminal-native GoodVibes product for coding, operations, automation, knowledge, channels, and daemon-backed control-plane workflows.",
   "type": "module",
   "main": "src/main.ts",
@@ -99,7 +99,7 @@
     "@anthropic-ai/vertex-sdk": "^0.16.0",
     "@ast-grep/napi": "^0.42.0",
     "@aws/bedrock-token-generator": "^1.1.0",
-    "@pellux/goodvibes-sdk": "0.34.0",
+    "@pellux/goodvibes-sdk": "0.35.0",
     "bash-language-server": "^5.6.0",
     "fuse.js": "^7.1.0",
     "graphql": "^16.13.2",

package/src/cli/bundle-command.ts

@@ -15,6 +15,7 @@ import { getPackageVersion } from './help.ts';
 import { classifyProviderSetup } from './provider-classification.ts';
 import { buildCliServicePosture } from './service-posture.ts';
 import { REDACTED_VALUE, collectSensitiveConfigValues, isRedactedValue, redactConfig, redactSerializedSecrets } from './redaction.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 interface BundleInspectSummary {
   readonly type: string;
@@ -43,7 +44,7 @@ function readJsonFile(path: string): { readonly ok: true; readonly value: Record
   try {
     return { ok: true, value: JSON.parse(readFileSync(path, 'utf-8')) as Record<string, unknown> };
   } catch (error) {
-    return { ok: false, error: error instanceof Error ? error.message : String(error) };
+    return { ok: false, error: summarizeError(error) };
   }
 }
 

package/src/cli/service-posture.ts

@@ -10,6 +10,7 @@ import { resolveRuntimeEndpointBinding } from './endpoints.ts';
 import type { RuntimeEndpointBinding, RuntimeEndpointId } from './endpoints.ts';
 import { classifyBindPosture, isNetworkFacing } from './network-posture.ts';
 import { redactText } from './redaction.ts';
+import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
 export interface CliServiceRuntime {
   readonly configManager: ConfigManager;
@@ -326,7 +327,7 @@ function readLogPosture(path: string | undefined, tailBytes: number): CliService
       exists: true,
       size: 0,
       modifiedAt: null,
-      readError: error instanceof Error ? error.message : String(error),
+      readError: summarizeError(error),
     };
   }
 }

package/src/core/context-usage.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared context-window usage computation.
+ *
+ * Centralises the tokens/contextWindow ratio so all panels, auto-compact,
+ * and session-maintenance read from one formula rather than six diverging
+ * hand-rolled copies.
+ *
+ * IMPORTANT: compaction-preview.ts intentionally displays usage > 100%
+ * ("exceeds window") — callers that need the unclamped value must use
+ * rawRatio, not clampedRatio / pct.
+ */
+
+export interface ContextUsage {
+  /**
+   * Raw (unclamped) ratio: max(0, tokens) / contextWindow.
+   * May exceed 1.0 when token count surpasses the context window.
+   * 0 when contextWindow <= 0.
+   */
+  rawRatio: number;
+  /**
+   * Ratio clamped to [0, 1]. Use for progress-bar fill and color bands.
+   */
+  clampedRatio: number;
+  /**
+   * Integer percentage clamped to [0, 100].
+   * Equivalent to Math.min(100, Math.round(rawRatio * 100)).
+   * Use for numeric displays and threshold comparisons.
+   */
+  pct: number;
+  /**
+   * Remaining tokens: max(0, contextWindow - tokens).
+   * 0 when contextWindow <= 0.
+   */
+  remaining: number;
+}
+
+/**
+ * Compute context-window usage metrics from raw token counts.
+ *
+ * @param tokens        Current input-token count (negative values are treated as 0).
+ * @param contextWindow Model context window size (0 or negative → all fields return 0).
+ */
+export function computeContextUsage(tokens: number, contextWindow: number): ContextUsage {
+  if (contextWindow <= 0) {
+    return { rawRatio: 0, clampedRatio: 0, pct: 0, remaining: 0 };
+  }
+  const safeTokens   = Math.max(0, tokens);
+  const rawRatio     = safeTokens / contextWindow;
+  const clampedRatio = Math.min(1, rawRatio);
+  const pct          = Math.min(100, Math.round(rawRatio * 100));
+  const remaining    = Math.max(0, contextWindow - tokens);
+  return { rawRatio, clampedRatio, pct, remaining };
+}

package/src/core/conversation-rendering.ts

@@ -320,10 +320,10 @@ export function appendConversationMessages(
 
   for (let msgIdx = 0; msgIdx < messages.length; msgIdx++) {
     const message = messages[msgIdx];
-    messageLineRegistry[msgIdx] = context.history.getLineCount();
     // absoluteIdx aligns the slice-relative loop counter with the absolute
-    // message index used as the key in messageKindRegistry.
+    // message index used as the key in messageKindRegistry and messageLineRegistry.
     const absoluteIdx = msgIndexOffset + msgIdx;
+    messageLineRegistry[absoluteIdx] = context.history.getLineCount();
     if (message.role === 'user') {
       renderConversationUserMessage(context, message, width);
     } else if (message.role === 'assistant') {

package/src/core/conversation.ts

@@ -64,7 +64,15 @@ export class ConversationManager extends SdkConversationManager {
   private collapseState: Map<string, boolean> = new Map();
   /** Block registry: track rendered blocks for copy/apply. */
   protected blockRegistry: BlockMeta[] = [];
-  /** Message index -> first rendered line index in the history buffer. */
+  /**
+   * Absolute message index -> first rendered line index in the history buffer.
+   * Keyed by the message's ABSOLUTE position in the full (unsliced) snapshot —
+   * appendConversationMessages writes `messageLineRegistry[absoluteIdx]`, not the
+   * slice-relative loop counter — so transcript-event navigation
+   * (next/prevTranscriptEventLine), whose event.messageIndex is absolute, resolves
+   * correctly even after clearDisplay() renders only a tail slice. Holes (indices
+   * not currently rendered) read back as undefined and are filtered out by consumers.
+   */
   private messageLineRegistry: number[] = [];
   /**
    * Registry of rendered line indices for system messages whose kind is
@@ -91,11 +99,18 @@ export class ConversationManager extends SdkConversationManager {
    * Reset to 0 on startStreamingBlock and finalizeStreamingBlock.
    */
   private _lastStreamRenderMs = 0;
+  /**
+   * Terminal width captured when the current streaming block was anchored.
+   * If the width changes mid-stream, updateStreamingBlock forces a rebuild so
+   * streamingStartLine is re-anchored to the new buffer (see rebuildHistory).
+   * -1 when no stream is active.
+   */
+  private _streamWidth = -1;
   /**
    * Message index at the time of the last clearDisplay() call.
    * rebuildHistory() renders only messages at or after this index, so the
    * display stays blank for messages added before the clear while LLM history
-   * is fully preserved. Reset to 0 on resetAll() or rebuildHistory() width change.
+   * is fully preserved. Persists until resetAll(). rebuildHistory() never resets this value.
    */
   private _displayFromMessageIndex = 0;
 
@@ -229,6 +244,7 @@ export class ConversationManager extends SdkConversationManager {
     // Reset the render throttle so the first delta always renders immediately.
     this.flushHistory();
     this.streamingStartLine = this.history.getLineCount();
+    this._streamWidth = this._getWidth();
     this._lastStreamRenderMs = 0;
   }
 
@@ -243,6 +259,13 @@ export class ConversationManager extends SdkConversationManager {
     // Throttle renderMarkdown to the 16ms render-coalescer cadence to avoid
     // O(n) parse overhead on every delta token during streaming.
     if (this.streamingStartLine >= 0) {
+      // If the terminal was resized mid-stream, force the pending width-change
+      // rebuild now. rebuildHistory() re-anchors streamingStartLine to the new
+      // buffer (see its streaming branch), so the incremental truncate below
+      // targets the correct offset instead of a stale one.
+      if (this._getWidth() !== this._streamWidth) {
+        this.flushHistory();
+      }
       const now = Date.now();
       if (now - this._lastStreamRenderMs >= 16) {
         this._lastStreamRenderMs = now;
@@ -261,6 +284,7 @@ export class ConversationManager extends SdkConversationManager {
   public override finalizeStreamingBlock(): void {
     super.finalizeStreamingBlock();
     this.streamingStartLine = -1;
+    this._streamWidth = -1;
     this._lastStreamRenderMs = 0;
     this.markDirty();
   }
@@ -367,12 +391,21 @@ export class ConversationManager extends SdkConversationManager {
     this.dirty = false;
 
     const snapshot = this.getMessageSnapshot();
+    // During streaming, the in-progress placeholder (always the last message) is
+    // rendered here as EMPTY; the incremental streaming path (updateStreamingBlock)
+    // owns its content. This keeps streamingStartLine valid across width-change
+    // rebuilds — otherwise the placeholder would be re-rendered with its content at
+    // the new width while streamingStartLine still pointed into the old buffer.
+    const lastMsg = snapshot[snapshot.length - 1];
+    const isStreaming = this.streamingStartLine >= 0 && lastMsg?.role === 'assistant';
+    const renderSnapshot = isStreaming
+      ? [...snapshot.slice(0, -1), { ...lastMsg, content: '' } as Message]
+      : snapshot;
+
     // When _displayFromMessageIndex > 0, clearDisplay() was called. Only render
     // messages added after the clear — the pre-clear history stays off-screen.
-    // On a full rebuild (e.g. width change), reset the display-start to 0 so the
-    // user can scroll back to the full history if needed.
     const displayStart = this._displayFromMessageIndex;
-    const visibleSnapshot = displayStart > 0 ? snapshot.slice(displayStart) : snapshot;
+    const visibleSnapshot = displayStart > 0 ? renderSnapshot.slice(displayStart) : renderSnapshot;
 
     // Tool messages ARE rendered (as collapsed blocks); this filter is only
     // for determining whether to show the splash screen (tool-only messages
@@ -388,6 +421,18 @@ export class ConversationManager extends SdkConversationManager {
 
     this.appendMessages(visibleSnapshot, width, displayStart);
     this.appendedUpTo = snapshot.length;
+
+    if (isStreaming) {
+      // Re-anchor the streaming block to the freshly rebuilt buffer and re-render
+      // the in-progress content at the current width, mirroring startStreamingBlock.
+      this.streamingStartLine = this.history.getLineCount();
+      this._streamWidth = width;
+      this._lastStreamRenderMs = 0;
+      const streamingContent = lastMsg?.content;
+      if (typeof streamingContent === 'string' && streamingContent.length > 0) {
+        this.history.addLines(renderMarkdown(streamingContent, width, { isStreaming: true }));
+      }
+    }
   }
 
   /**
@@ -615,9 +660,9 @@ export class ConversationManager extends SdkConversationManager {
     // messageKindRegistry is NOT cleared here. The underlying messages array is
     // preserved by clearDisplay(); kind entries for pre-clear messages are harmless
     // because those messages are hidden by _displayFromMessageIndex and never rendered.
-    // Clearing the registry would cause kind loss for pre-clear messages that become
-    // visible again after a subsequent width-change rebuild (which resets displayStart
-    // to 0), incorrectly making operational messages navigable.
+    // Clearing the registry would cause kind loss for pre-clear messages; if
+    // resetAll() later restores displayStart to 0, those messages re-render
+    // and their kind entries must still be present to suppress navigation.
     // Advance _displayFromMessageIndex to exclude all current messages from display.
     // rebuildHistory() will only render messages added AFTER this point.
     this._displayFromMessageIndex = this.getMessageSnapshot().length;

package/src/core/session-recovery.ts

@@ -26,7 +26,8 @@
  *    journal silently and return.
  * 3. If records are found, apply the final record's messages — each journal
  *    record carries the full conversation snapshot at that moment, so the
- *    last record by seq is the authoritative post-crash state.
+ *    record with the newest timestamp is the authoritative post-crash state
+ *    (resilient to seq collisions across re-inits onto a stale journal file).
  * 4. Rebuild the conversation history and call the snapshot writer so the
  *    gap is durably closed before the user sees the restored conversation.
  * 5. Rotate the journal (it is no longer needed as a gap-filler).
@@ -64,8 +65,6 @@ export interface ReplayIntoConversationResult {
   readonly replayed: number;
   /** True if the journal tail was corrupt (quarantined). */
   readonly hadCorruptTail: boolean;
-  /** True if the journal had an unrecognised schema version (quarantined). */
-  readonly hadVersionMismatch: boolean;
 }
 
 // ─── Public API ─────────────────────────────────────────────────────────────
@@ -85,30 +84,39 @@ export function replayJournalIntoConversation(
   try {
     const { records, hadCorruptTail } = replayJournal(journalPath, snapshotTimestamp);
 
-    // Detect version mismatch: replayJournal quarantines and returns
-    // hadCorruptTail=true + 0 records when the header version is wrong.
-    // We distinguish it from a genuine corrupt tail by checking whether the
-    // journal file still exists (quarantine renames it away in both cases,
-    // so we cannot inspect the header at this point). We surface both cases
-    // through hadCorruptTail to the caller; hadVersionMismatch is derived
-    // from it to give the caller a distinct notice option.
-    const hadVersionMismatch = hadCorruptTail && records.length === 0;
-
     const journal = openTranscriptJournal(journalPath, sessionId);
 
     if (records.length === 0) {
       // Nothing to replay — rotate the (now-stale) journal silently.
       journal.rotate();
-      return { replayed: 0, hadCorruptTail, hadVersionMismatch };
+      return { replayed: 0, hadCorruptTail };
     }
 
-    // The last record (highest seq) holds the most recent full conversation
-    // state captured before the crash. Apply it.
-    const lastRecord = records[records.length - 1]!;
+    // Select the authoritative record by newest wall-clock timestamp (tie-broken
+    // by highest seq). Each record carries the full conversation snapshot at its
+    // moment, so the newest ts is by definition the most recent state. This is
+    // resilient to seq collisions that arise when a fresh process appends to a
+    // pre-existing, non-rotated journal: its records restart at seq 0 after the
+    // surviving old records, so "last by seq" could otherwise pick a stale one.
+    const lastRecord = records.reduce((newest, candidate) =>
+      candidate.ts > newest.ts ||
+      (candidate.ts === newest.ts && candidate.seq > newest.seq)
+        ? candidate
+        : newest,
+    );
     const replayedMessages = lastRecord.messages as ConversationMessageSnapshot[];
 
+    // Preserve the session identity (title/titleSource/branches/currentBranch)
+    // that the resume seam already hydrated onto the live conversation. Journal
+    // records carry only messages, so a bare fromJSON would blank the title and
+    // reset titleSource to the system default — and the next TURN_COMPLETED
+    // snapshot would then persist the empty title, making the loss permanent.
+    const preserved = conversation.toJSON();
     conversation.fromJSON({
+      ...preserved,
       messages: replayedMessages as never[],
+      title: conversation.title,
+      titleSource: conversation.getTitleSource(),
     });
     conversation.rebuildHistory();
 
@@ -123,10 +131,10 @@ export function replayJournalIntoConversation(
     // Rotate the journal — it is no longer needed as a gap-filler.
     journal.rotate();
 
-    return { replayed: records.length, hadCorruptTail, hadVersionMismatch: false };
+    return { replayed: records.length, hadCorruptTail };
   } catch {
     // Absolute last-resort guard — recovery must never crash a resume.
-    return { replayed: 0, hadCorruptTail: false, hadVersionMismatch: false };
+    return { replayed: 0, hadCorruptTail: false };
   }
 }
 

package/src/core/system-message-router.ts

@@ -1,15 +1,19 @@
 /**
  * SystemMessageRouter — routes system messages to the appropriate surfaces
- * based on priority.
+ * based on their kind and configured routing target.
  *
- * Two tiers:
- *   - 'high' — appears in both the main conversation AND the SystemMessagesPanel.
- *     Use for: fatal errors, model/provider confirmations, session save/load,
- *     compaction events (e.g. [Compaction] completed).
- *   - 'low'  — appears in the SystemMessagesPanel only (panel-only routing).
- *     Use for: scan results, provider discovery, plugin load/unload, feature
- *     flag changes, tool execution status, permission decisions,
- *     health/cascade events, debug/operational info.
+ * Delivery is resolved from the message KIND ('system' | 'wrfc' |
+ * 'operational'), which maps to a configurable routing target
+ * (ui.systemMessages / ui.wrfcMessages / ui.operationalMessages, each
+ * 'panel' | 'conversation' | 'both'). resolveSystemMessageDelivery() turns that
+ * target — plus whether a panel is attached — into a { toPanel, toConversation }
+ * decision. The priority ('high' | 'low') only sets the panel emphasis; it does
+ * not by itself decide conversation delivery.
+ *
+ * Critical override: errors, provider failovers, and compaction/context notices
+ * (see FORCE_CONVERSATION_PREFIXES) ALWAYS also reach the main conversation,
+ * regardless of target, so the user never has to open the SystemMessagesPanel
+ * to discover them.
  *
  * Usage:
  * ```ts
@@ -18,9 +22,9 @@
  * router.routeSystemMessage('[Session] Saved session abc123', 'high');
  * ```
  *
- * The router can also be used as a drop-in replacement for
- * conversation.addSystemMessage() calls — it classifies messages by priority
- * automatically when using routeAuto().
+ * routeAuto() can be used as a drop-in replacement for
+ * conversation.addSystemMessage(): it classifies the message kind and priority
+ * automatically before routing.
  *
  * @remarks
  * This router handles system messages (operational status, errors). It is
@@ -28,8 +32,6 @@
  * notifications with policy-based routing.
  */
 
-import { getConfigSnapshot } from '../config/index.ts';
-import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConversationManager } from './conversation';
 import type { SystemMessagesPanel, SystemMessagePriority } from '../panels/system-messages-panel.ts';
 import {
@@ -46,14 +48,23 @@ export type {
   SystemMessageTarget,
 } from '@/runtime/index.ts';
 
-function targetForKind(
-  configManager: Pick<ConfigManager, 'getRaw'>,
-  kind: SystemMessageKind,
-): SystemMessageTarget {
-  const ui = getConfigSnapshot(configManager).ui;
-  if (kind === 'wrfc') return ui.wrfcMessages;
-  if (kind === 'operational') return ui.operationalMessages;
-  return ui.systemMessages;
+/**
+ * Message categories that are operationally critical enough that the user must
+ * see them inline in the main conversation, regardless of the configured
+ * routing target (ui.systemMessages defaults to panel-only). Errors, provider
+ * failovers, and compaction/context notices fall here: a user should never have
+ * to open the SystemMessagesPanel to discover that a turn errored, a provider
+ * failed over, or the context was compacted.
+ *
+ * Detection is by the stable message prefix tag, mirroring how the SDK
+ * classifiers key off message content. This deliberately does NOT force every
+ * high-priority message inline (model/provider/session confirmations still
+ * honour the configured target), so the routing-target config stays meaningful.
+ */
+const FORCE_CONVERSATION_PREFIXES = ['[Error]', '[Failover]', '[Compaction]', '[Context]'] as const;
+
+function mustReachConversation(message: string): boolean {
+  return FORCE_CONVERSATION_PREFIXES.some((prefix) => message.startsWith(prefix));
 }
 
 // ---------------------------------------------------------------------------
@@ -74,10 +85,11 @@ export class SystemMessageRouter {
   // ── Public API ────────────────────────────────────────────────────────────
 
   /**
-   * Route a system message with explicit priority.
+   * Route a system message.
    *
-   * - 'high': delivered to both conversation AND panel.
-   * - 'low':  delivered to panel only (conversation is not touched).
+   * Delivery is resolved from the kind and its configured target; priority only
+   * sets panel emphasis. Critical notices (errors/failover/compaction, see
+   * FORCE_CONVERSATION_PREFIXES) are additionally forced into the conversation.
    *
    * @param message  - Message text.
    * @param priority - 'high' | 'low'.
@@ -94,7 +106,11 @@ export class SystemMessageRouter {
     if (delivery.toPanel) {
       this.panel?.push(message, priority);
     }
-    if (delivery.toConversation) {
+    // Critical notices (errors, failover, compaction) must surface inline even
+    // when the configured target is panel-only — otherwise a user without the
+    // SystemMessagesPanel open would never see them.
+    const toConversation = delivery.toConversation || mustReachConversation(message);
+    if (toConversation) {
       // addTypedSystemMessage threads the kind into the conversation so the
       // renderer can use kind-based navigability instead of substring matching.
       this.conversation.addTypedSystemMessage(message, kind);