@pellux/goodvibes-tui 1.20.1 → 1.21.1

package/src/runtime/recovery-prompt.ts

@@ -46,11 +46,14 @@
  *     about again. Deleting the file used to be the entire memory of the
  *     answer, which is how the same question survived being answered three
  *     times.
+ *   - The offer is also where that ledger gets swept. Every run prunes it to
+ *     its age and count bounds and logs what it dropped, so the record of past
+ *     decisions cannot quietly grow forever and nothing is deleted in silence.
  */
 import { statSync } from 'node:fs';
 import { checkRecoveryFile, checkRecoveryForSession, consumeRecovery, removeRecoveryPoint } from '@/runtime/index.ts';
 import type { RecoveryFileInfo, SessionSurface } from '@/runtime/index.ts';
-import { isRecoveryRemovalRecorded, recordRecoveryRemoval } from './recovery-decisions.ts';
+import { isRecoveryRemovalRecorded, pruneRecoveryDecisions, recordRecoveryRemoval } from './recovery-decisions.ts';
 import { checkSessionLiveness } from './session-liveness-marker.ts';
 import type { SelectionItem, SelectionResult } from '../input/selection-modal.ts';
 
@@ -272,6 +275,13 @@ function findOfferableSnapshot(deps: RecoveryPromptDeps): RecoveryFileInfo | nul
  */
 export async function offerRecoverySnapshot(deps: RecoveryPromptDeps): Promise<RecoveryPromptOutcome> {
   try {
+    // Housekeeping first: recovery time is when the removal ledger gets its
+    // bounds actually applied to disk and says what it discarded. Without this
+    // the expired records were filtered on read but never removed, so on a
+    // machine where the user never answers "Remove" again the file only ever
+    // grew. Idempotent, so the second call in a run (targeted --continue offer
+    // plus the general startup offer) drops nothing and writes nothing.
+    pruneRecoveryDecisions(deps.surface, deps.now?.() ?? Date.now());
     const info = findOfferableSnapshot(deps);
     if (!info) return 'none';
     // Already answered about this snapshot earlier in this same run (the

package/src/runtime/services.ts

@@ -96,6 +96,8 @@ export interface RuntimeServicesOptions {
   /** Host power seam opt-in. Fork mirrors the SDK: non-spawning unavailable-seam
    * default (idle-power-services.ts); daemon + embedded runtime pass createHostPowerSeam(). */
   readonly powerSeam?: Parameters<typeof wireIdlePowerAndLiveTurn>[0]['powerSeam'];
+  /** Live session id, read per crash-residue sweep so the running session is exempt — see durability-services.ts. */
+  readonly currentSessionId?: (() => string | null) | undefined;
 }
 
 export interface RuntimeServices {
@@ -207,6 +209,9 @@ export interface RuntimeServices {
   readonly codeIndexReindexScheduler: CodeIndexReindexScheduler; // tool-site reindex
   /** Daily snapshots of every SQLite store this runtime writes, with bounded retention; unref'd timers (mirrors the SDK composition — hosts that tear down a runtime stop() it themselves). */
   readonly storeSnapshotScheduler: StoreSnapshotScheduler;
+  readonly appendOnlyRetentionScheduler: ReturnType<typeof createDurabilityServices>['appendOnlyRetentionScheduler']; // periodic append-only sweep; unref'd timers, stop() on teardown
+  /** Stops the recurring crash-residue sweep; idempotent, unref'd timer (hosts that tear a runtime down call it). */
+  readonly stopDurabilityHousekeeping: () => void;
   readonly memoryConsolidationScheduler: MemoryConsolidationScheduler;
   readonly powerManager: PowerManager;
   /** The daemon's memory governor (default ON). Backs ops.memory.get and defends the daemon's footprint by tier. */
@@ -566,10 +571,10 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
   // with MemoryStore above. Auto-build is config-gated (default off) — see
   // code-index-services.ts's header doc.
   const { codeIndexStore, codeIndexReindexScheduler } = createCodeIndexServices({ workingDirectory, configManager, memoryEmbeddingRegistry, isReindexPaused: () => pauseController.isPaused('code-index-reindex'), admitExpensiveWork });
-  // Store snapshots + durable remembered-approval rules + the live credential
-  // chain, mirroring the SDK composition — see durability-services.ts.
-  const { storeSnapshotScheduler, userPermissionRuleStore } = createDurabilityServices({
+  // Store snapshots, the periodic append-only sweep, durable remembered-approval rules + the live credential chain — see durability-services.ts.
+  const { storeSnapshotScheduler, appendOnlyRetentionScheduler, userPermissionRuleStore, stopDurabilityHousekeeping } = createDurabilityServices({
     configManager, secretsManager, providerRegistry, memoryDbPath, codeIndexDbPath: codeIndexDbPath(workingDirectory), surface, shellPaths, // + retention-sweep roots & live config watch (mirrors the SDK)
+    ...(options.currentSessionId ? { currentSessionId: options.currentSessionId } : {}), // exempts the running session from crash-residue reaping
   });
   const codeInjectionOrchestratorDeps = { codeIndex: codeIndexStore, isCodeInjectionSettingEnabled: () => isCodeInjectionSettingEnabled(configManager), codeIndexReindexScheduler }; // Code-injection seam (agent here; main via orchestrator-core-services.ts)
   const { processRegistry } = createFleetServices({ // Shared archive-aware fleet registry (+ daemon observed rows) — see fleet-services.ts
@@ -778,7 +783,7 @@ export function createRuntimeServices(options: RuntimeServicesOptions): RuntimeS
     workstreamCommands,
     codeIndexStore,
     codeIndexReindexScheduler,
-    storeSnapshotScheduler,
+    storeSnapshotScheduler, appendOnlyRetentionScheduler, stopDurabilityHousekeeping,
     memoryConsolidationScheduler,
     powerManager,
     memoryGovernor,

package/src/runtime/session-liveness-marker.ts

@@ -24,7 +24,7 @@
  * recovery snapshots they describe — mirrors the transcript-journal.ts
  * convention (homeDirectory-scoped, under the surface's own directory).
  */
-import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs';
+import { existsSync, mkdirSync, readFileSync, readdirSync, unlinkSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import type { SessionSurface } from '@/runtime/index.ts';
 
@@ -42,9 +42,14 @@ export interface LivenessMarker {
  */
 export const LIVENESS_STALE_AFTER_MS = 150_000;
 
+/** Absolute path to the directory holding every session's liveness marker. */
+export function livenessMarkerDirFor(surface: SessionSurface): string {
+  return join(surface.homeDirectory, '.goodvibes', surface.surfaceRoot, 'liveness');
+}
+
 /** Absolute path to a session's liveness marker file. */
 export function livenessMarkerPathFor(surface: SessionSurface, sessionId: string): string {
-  return join(surface.homeDirectory, '.goodvibes', surface.surfaceRoot, 'liveness', `${sessionId}.json`);
+  return join(livenessMarkerDirFor(surface), `${sessionId}.json`);
 }
 
 /** Refresh (creating if needed) the liveness marker for this session/pid. Best-effort — never throws. */
@@ -69,18 +74,27 @@ export function removeLivenessMarker(surface: SessionSurface, sessionId: string)
   }
 }
 
-function readLivenessMarker(surface: SessionSurface, sessionId: string): LivenessMarker | null {
+/** Parse one marker file by absolute path. Returns null for missing, empty, torn, or wrong-shaped content. */
+function parseMarkerFile(path: string): LivenessMarker | null {
   try {
-    const path = livenessMarkerPathFor(surface, sessionId);
     if (!existsSync(path)) return null;
-    const parsed = JSON.parse(readFileSync(path, 'utf-8')) as Partial<LivenessMarker>;
+    const text = readFileSync(path, 'utf-8');
+    // A crash between create and write leaves a zero-byte file. Content, not
+    // existence, decides whether this marker says anything at all.
+    if (text.trim().length === 0) return null;
+    const parsed = JSON.parse(text) as Partial<LivenessMarker>;
     if (typeof parsed.sessionId !== 'string' || typeof parsed.pid !== 'number' || typeof parsed.updatedAt !== 'number') return null;
+    if (!Number.isFinite(parsed.pid) || !Number.isFinite(parsed.updatedAt)) return null;
     return { sessionId: parsed.sessionId, pid: parsed.pid, updatedAt: parsed.updatedAt };
   } catch {
     return null;
   }
 }
 
+function readLivenessMarker(surface: SessionSurface, sessionId: string): LivenessMarker | null {
+  return parseMarkerFile(livenessMarkerPathFor(surface, sessionId));
+}
+
 /** Best-effort check that a pid still refers to a running process. Injectable for tests. */
 export function isPidAlive(pid: number, kill: (pid: number, signal: 0) => void = process.kill.bind(process)): boolean {
   try {
@@ -118,3 +132,126 @@ export function checkSessionLiveness(
   if (!aliveCheck(marker.pid)) return { live: false, pid: null };
   return { live: true, pid: marker.pid };
 }
+
+// ─── Reaping ────────────────────────────────────────────────────────────────
+//
+// `removeLivenessMarker` only runs on a CLEAN exit (process-lifecycle.ts). A
+// SIGKILL, a panic, or a pulled power cord leaves the marker behind forever,
+// and `checkSessionLiveness` treating it as not-live does not remove the file
+// — so the liveness directory grows one file per session id ever opened. The
+// sweep below is the reclaim half of that lifecycle.
+
+/**
+ * Hard ceiling on marker files kept after a sweep, oldest dropped first.
+ *
+ * The liveness rule below already reclaims ordinary crash residue, but it can
+ * be defeated: `isPidAlive` deliberately reports EPERM (a pid this user cannot
+ * signal) as alive, so on a busy host a reused pid can keep a dead session's
+ * marker "live" indefinitely. This cap is the second, unconditional bound so
+ * the directory can never grow without limit whatever the pid probe says.
+ */
+export const LIVENESS_MARKER_MAX_FILES = 200;
+
+export interface LivenessReapResult {
+  /** Marker files examined this sweep. */
+  readonly scanned: number;
+  /** Marker files deleted this sweep. */
+  readonly reaped: number;
+}
+
+export interface LivenessReapOptions {
+  readonly now?: () => number;
+  readonly isPidAliveFn?: typeof isPidAlive;
+  /**
+   * Session ids that must never be reaped regardless of what the marker says
+   * — normally just the current session's id. Belt-and-braces: the current
+   * session refreshes its own marker every 60s, so the liveness rule already
+   * keeps it.
+   */
+  readonly keepSessionIds?: readonly string[];
+  /** Override the count cap (tests). */
+  readonly maxFiles?: number;
+}
+
+/**
+ * Delete liveness markers that no longer describe a running session.
+ *
+ * A marker is reaped when it is either:
+ *   - unreadable, empty, or not shaped like a marker (crash residue that can
+ *     never resolve to a live session again — validated by parsing the
+ *     content, not by the file merely existing); or
+ *   - definitively not live: older than `LIVENESS_STALE_AFTER_MS` AND its pid
+ *     no longer resolves to a running process.
+ *
+ * Both halves of that second rule are required on purpose. Deleting is
+ * destructive while a liveness answer is only advisory, so a marker that is
+ * stale-but-pid-alive (a wedged owner still holding the session) or
+ * fresh-but-pid-dead (a process that died seconds ago, or a pid probe that
+ * failed transiently) is left for a later sweep. A genuinely crashed session
+ * satisfies both conditions within `LIVENESS_STALE_AFTER_MS` and is reclaimed
+ * on the next sweep after that.
+ *
+ * Idempotent and safe to run concurrently from several processes: a marker
+ * another sweeper unlinked between the directory listing and this unlink
+ * (ENOENT) counts as reaped, never as an error.
+ */
+export function reapStaleLivenessMarkers(surface: SessionSurface, opts: LivenessReapOptions = {}): LivenessReapResult {
+  const dir = livenessMarkerDirFor(surface);
+  let names: string[];
+  try {
+    names = readdirSync(dir).filter((name) => name.endsWith('.json'));
+  } catch {
+    // No liveness directory yet, or it is unreadable — nothing to reclaim.
+    return { scanned: 0, reaped: 0 };
+  }
+
+  const now = opts.now?.() ?? Date.now();
+  const aliveCheck = opts.isPidAliveFn ?? isPidAlive;
+  const keep = new Set(opts.keepSessionIds ?? []);
+  const maxFiles = opts.maxFiles ?? LIVENESS_MARKER_MAX_FILES;
+
+  let reaped = 0;
+  /** Survivors, so the count cap below can drop the oldest of them. */
+  const survivors: { readonly path: string; readonly updatedAt: number }[] = [];
+
+  for (const name of names) {
+    const sessionId = name.slice(0, -'.json'.length);
+    if (keep.has(sessionId)) continue;
+    const path = join(dir, name);
+    const marker = parseMarkerFile(path);
+    if (marker === null) {
+      if (unlinkIfPresent(path)) reaped++;
+      continue;
+    }
+    const stale = now - marker.updatedAt > LIVENESS_STALE_AFTER_MS;
+    if (stale && !aliveCheck(marker.pid)) {
+      if (unlinkIfPresent(path)) reaped++;
+      continue;
+    }
+    survivors.push({ path, updatedAt: marker.updatedAt });
+  }
+
+  if (survivors.length > maxFiles) {
+    survivors.sort((a, b) => a.updatedAt - b.updatedAt); // oldest first
+    for (const victim of survivors.slice(0, survivors.length - maxFiles)) {
+      if (unlinkIfPresent(victim.path)) reaped++;
+    }
+  }
+
+  return { scanned: names.length, reaped };
+}
+
+/**
+ * Best-effort unlink shared by the sweep. Returns true when the file is gone
+ * because of (or by the time of) this call. A concurrent sweeper winning the
+ * race (ENOENT) is success, not failure; any other error leaves the file for
+ * the next sweep.
+ */
+function unlinkIfPresent(path: string): boolean {
+  try {
+    unlinkSync(path);
+    return true;
+  } catch (err) {
+    return (err as NodeJS.ErrnoException | undefined)?.code === 'ENOENT';
+  }
+}

package/src/runtime/workstream-draft-store.ts

@@ -21,19 +21,99 @@
 // unreadable or malformed file, or a write failure degrades to "that draft
 // isn't there" rather than crashing session startup — mirroring the engine
 // persistence layer's own quarantine-don't-propagate discipline.
+//
+// RECLAIM: `remove(id)` retires a draft the moment it is launched or cancelled,
+// but a draft the user simply walks away from was never reclaimed by anything,
+// so the directory grew forever. `loadAll()` — the recovery point, called once
+// at command-facade construction — now also bounds the directory by BOTH an age
+// TTL and a count cap, and reports what it reclaimed through `lastReclaim` /
+// the `onReclaim` hook. Deletions are `rmSync(..., { force: true })`, so a file
+// another process removed first is not an error: two concurrent `loadAll()`
+// calls converge on the same surviving set.
 // ---------------------------------------------------------------------------
 
-import { mkdirSync, readdirSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readdirSync, readFileSync, rmSync, statSync } from 'node:fs';
 import { join } from 'node:path';
+import { atomicWriteFileSync } from '@/config/atomic-write.ts';
 import type { WorkstreamDraft } from './workstream-draft-types.ts';
 
+/**
+ * Age TTL for an abandoned draft. A proposal that has sat un-launched and
+ * un-cancelled this long is not a plan the user is still reviewing; it is
+ * litter. Measured from the draft's own `createdAt`.
+ */
+export const WORKSTREAM_DRAFT_TTL_MS = 14 * 24 * 60 * 60 * 1000; // 14 days
+
+/**
+ * Count cap on retained drafts: the newest this many survive, older ones are
+ * reclaimed oldest-first. Bounds the directory even if every draft is recent.
+ */
+export const WORKSTREAM_DRAFT_CAP = 50;
+
+/**
+ * Minimum gap between reaps triggered by `save()`. `loadAll()` is the recovery
+ * point but runs once per session, so a session that stays open for days would
+ * otherwise never reap again. Every `save()` (draft created, reshaped, or
+ * approved) re-checks the bounds, throttled to this interval so the directory
+ * is not re-scanned on every keystroke-driven save.
+ */
+export const WORKSTREAM_DRAFT_SWEEP_INTERVAL_MS = 5 * 60 * 1000; // 5 minutes
+
+/** What one `loadAll()` reclaimed. Counts only — never draft text. */
+export interface WorkstreamDraftReclaim {
+  /** Unix ms of the sweep. */
+  readonly at: number;
+  /** Valid drafts removed because they aged past the TTL. */
+  readonly expired: number;
+  /** Valid drafts removed because they fell outside the count cap. */
+  readonly overCap: number;
+  /** Torn/malformed snapshots removed once they were older than the TTL. */
+  readonly unreadable: number;
+}
+
+export interface WorkstreamDraftStoreOptions {
+  /**
+   * Called after a `loadAll()` that reclaimed at least one file, so the count
+   * can be surfaced to the operator. Receives counts only. Never throws out of
+   * `loadAll()` — a failing hook is swallowed like every other side effect here.
+   */
+  readonly onReclaim?: (summary: WorkstreamDraftReclaim) => void;
+  /** Clock seam (tests). Defaults to Date.now. */
+  readonly now?: () => number;
+  /** Override the age TTL (tests / embedders). Defaults to WORKSTREAM_DRAFT_TTL_MS. */
+  readonly ttlMs?: number;
+  /** Override the count cap (tests / embedders). Defaults to WORKSTREAM_DRAFT_CAP. */
+  readonly cap?: number;
+  /**
+   * Throttle for the reap that `save()` triggers. 0 or less means every save
+   * reaps (tests); defaults to WORKSTREAM_DRAFT_SWEEP_INTERVAL_MS.
+   */
+  readonly sweepIntervalMs?: number;
+}
+
 export interface WorkstreamDraftStore {
-  /** Every valid draft on disk, oldest first. A directory that doesn't exist yet ⇒ []. Malformed files are skipped, never fatal. */
+  /**
+   * Every valid draft on disk, oldest first, after reaping abandoned ones. A
+   * directory that doesn't exist yet ⇒ []. Malformed files are skipped, never
+   * fatal, and are only deleted once older than the TTL.
+   */
   loadAll(): WorkstreamDraft[];
-  /** Write (or overwrite) one draft's snapshot. Silently no-ops on any I/O failure — a lost journal write must never break the in-memory flow. */
+  /** Write (or overwrite) one draft's snapshot atomically. Silently no-ops on any I/O failure — a lost journal write must never break the in-memory flow. */
   save(draft: WorkstreamDraft): void;
   /** Delete one draft's snapshot (on launch or cancel). Missing file ⇒ no-op. */
   remove(id: string): void;
+  /** Summary of the most recent `loadAll()` that reclaimed something; null otherwise. */
+  readonly lastReclaim: WorkstreamDraftReclaim | null;
+}
+
+/** Human-readable, content-free disclosure line for a reclaim summary. */
+export function formatWorkstreamDraftReclaim(summary: WorkstreamDraftReclaim): string {
+  const parts: string[] = [];
+  if (summary.expired > 0) parts.push(`${summary.expired} abandoned`);
+  if (summary.overCap > 0) parts.push(`${summary.overCap} over the retention cap`);
+  if (summary.unreadable > 0) parts.push(`${summary.unreadable} unreadable`);
+  if (parts.length === 0) return 'Workstream drafts: nothing reclaimed.';
+  return `Workstream drafts: reclaimed ${parts.join(', ')} draft file(s).`;
 }
 
 /** Draft ids are `wsd_<hex>`; this refuses anything else so a crafted id can never escape the drafts directory. */
@@ -54,48 +134,141 @@ function isDraftShape(value: unknown): value is WorkstreamDraft {
   );
 }
 
-export function createWorkstreamDraftStore(projectRoot: string): WorkstreamDraftStore {
+export function createWorkstreamDraftStore(
+  projectRoot: string,
+  options: WorkstreamDraftStoreOptions = {},
+): WorkstreamDraftStore {
   const dir = join(projectRoot, '.goodvibes', 'orchestration', 'drafts');
   const fileFor = (id: string): string => join(dir, `${id}.json`);
+  const clock = options.now ?? Date.now;
+  const ttlMs = options.ttlMs ?? WORKSTREAM_DRAFT_TTL_MS;
+  const cap = options.cap ?? WORKSTREAM_DRAFT_CAP;
+  const sweepIntervalMs = options.sweepIntervalMs ?? WORKSTREAM_DRAFT_SWEEP_INTERVAL_MS;
+  let lastReclaim: WorkstreamDraftReclaim | null = null;
+  /** Unix ms of this instance's last reap; 0 means "never", so the first save sweeps. */
+  let lastSweepAt = 0;
 
-  return {
-    loadAll(): WorkstreamDraft[] {
-      let entries: string[];
+  /** Delete one path, treating "already gone" as success (concurrent sweeps). */
+  const discard = (path: string): void => {
+    try {
+      rmSync(path, { force: true });
+    } catch {
+      // Unremovable (permissions, or a racing process holding it) — the next
+      // loadAll() will try again; never fatal.
+    }
+  };
+
+  /** Age of a file by mtime, used only for snapshots whose contents we cannot trust. */
+  const modifiedBefore = (path: string, cutoff: number): boolean => {
+    try {
+      return statSync(path).mtimeMs < cutoff;
+    } catch {
+      return false;
+    }
+  };
+
+  /**
+   * Read every snapshot, reject the ones whose CONTENT is not a draft, apply
+   * both bounds, and record/announce what was reclaimed. Returns the surviving
+   * drafts, oldest first. Never throws.
+   *
+   * Idempotent: a second run over the same directory finds nothing left to
+   * remove, which is also what makes two processes running it at once safe —
+   * they converge on the same surviving set and unlink races count as done.
+   */
+  const reap = (): WorkstreamDraft[] => {
+    let entries: string[];
+    try {
+      entries = readdirSync(dir);
+    } catch {
+      lastReclaim = null;
+      return []; // directory not created yet, or unreadable — nothing to resume
+    }
+    const now = clock();
+    lastSweepAt = now;
+    const cutoff = now - ttlMs;
+    const drafts: WorkstreamDraft[] = [];
+    let unreadable = 0;
+    for (const entry of entries) {
+      if (!entry.endsWith('.json')) continue;
+      const path = join(dir, entry);
+      let parsed: unknown;
       try {
-        entries = readdirSync(dir);
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
       } catch {
-        return []; // directory not created yet, or unreadable — nothing to resume
+        parsed = undefined;
       }
-      const drafts: WorkstreamDraft[] = [];
-      for (const entry of entries) {
-        if (!entry.endsWith('.json')) continue;
-        try {
-          const parsed: unknown = JSON.parse(readFileSync(join(dir, entry), 'utf8'));
-          if (isDraftShape(parsed) && isSafeId(parsed.id)) drafts.push(parsed);
-        } catch {
-          // A malformed or half-written snapshot is skipped, never fatal.
-        }
+      // Validation is by CONTENT: a torn or half-written snapshot never
+      // becomes a draft. It is only DELETED once it is older than the TTL, so
+      // a file another process is writing right now is left alone.
+      if (parsed !== undefined && isDraftShape(parsed) && isSafeId(parsed.id)) {
+        drafts.push(parsed);
+        continue;
       }
-      return drafts.sort((a, b) => a.createdAt - b.createdAt);
+      if (modifiedBefore(path, cutoff)) {
+        discard(path);
+        unreadable += 1;
+      }
+    }
+    drafts.sort((a, b) => a.createdAt - b.createdAt);
+
+    // Bound 1 — age TTL: an abandoned proposal is reclaimed.
+    const live: WorkstreamDraft[] = [];
+    let expired = 0;
+    for (const draft of drafts) {
+      if (now - draft.createdAt > ttlMs) {
+        discard(fileFor(draft.id));
+        expired += 1;
+        continue;
+      }
+      live.push(draft);
+    }
+    // Bound 2 — count cap: keep the newest `cap`, reclaim the oldest overflow.
+    const overCapCount = Math.max(0, live.length - cap);
+    for (const draft of live.slice(0, overCapCount)) discard(fileFor(draft.id));
+    const kept = live.slice(overCapCount);
+
+    if (expired + overCapCount + unreadable > 0) {
+      lastReclaim = { at: now, expired, overCap: overCapCount, unreadable };
+      try {
+        options.onReclaim?.(lastReclaim);
+      } catch {
+        // Disclosure must never take startup down.
+      }
+    } else {
+      lastReclaim = null;
+    }
+    return kept;
+  };
+
+  return {
+    get lastReclaim(): WorkstreamDraftReclaim | null {
+      return lastReclaim;
+    },
+    loadAll(): WorkstreamDraft[] {
+      return reap();
     },
     save(draft: WorkstreamDraft): void {
       if (!isSafeId(draft.id)) return;
       try {
         mkdirSync(dir, { recursive: true });
-        writeFileSync(fileFor(draft.id), JSON.stringify(draft), 'utf8');
+        // Atomic (temp + fsync + rename): a crash mid-save can no longer leave a
+        // truncated snapshot behind for loadAll() to reject.
+        atomicWriteFileSync(fileFor(draft.id), JSON.stringify(draft));
       } catch {
         // A failed journal write leaves the in-memory draft intact and usable;
         // only its restart-durability is lost, which is strictly better than
         // failing the edit the user just made.
       }
+      // Keep reaping DURING the session, not only at the loadAll() recovery
+      // point: loadAll runs once at construction, so a long-lived session would
+      // otherwise never bound the directory again. Throttled, and always after
+      // this draft is on disk so the newest file is never the one reclaimed.
+      if (clock() - lastSweepAt >= sweepIntervalMs) reap();
     },
     remove(id: string): void {
       if (!isSafeId(id)) return;
-      try {
-        rmSync(fileFor(id), { force: true });
-      } catch {
-        // Already gone, or unremovable — nothing more to do.
-      }
+      discard(fileFor(id));
     },
   };
 }

package/src/runtime/workstream-services.ts

@@ -56,7 +56,8 @@ import type { AgentManager } from '@pellux/goodvibes-sdk/platform/tools';
 import type { RuntimeEventBus } from '@/runtime/index.ts';
 import { calcSessionCost, isModelPriced } from '../export/cost-utils.ts';
 import { editItemBrief, moveItemInSpec, removeItemFromSpec } from './workstream-draft-edits.ts';
-import { createWorkstreamDraftStore } from './workstream-draft-store.ts';
+import { createWorkstreamDraftStore, formatWorkstreamDraftReclaim } from './workstream-draft-store.ts';
+import { logger } from '@pellux/goodvibes-sdk/platform/utils';
 
 export interface WorkstreamServicesDeps {
   readonly agentManager: Pick<AgentManager, 'spawn' | 'getStatus' | 'cancel' | 'registerCancellationSignal' | 'releaseCancellationSignal'>;
@@ -184,7 +185,21 @@ function createWorkstreamCommandService(
   // proposal at construction so a create/reshape/approve done before a restart
   // is still here to launch afterward — the plan-review gate survives restart,
   // exactly as the live-workstream snapshots do via resumeAllFromDisk().
-  const store = createWorkstreamDraftStore(projectRoot);
+  // Reclaiming an abandoned draft deletes a plan the user once wrote, so it is
+  // never done silently: the store reaps at load and on a throttled save, and
+  // every reap that actually removed something reports a content-free count
+  // here. Without this hook the store recorded the reclaim on itself and
+  // nothing ever read it, which is deletion the user has no way to notice.
+  const store = createWorkstreamDraftStore(projectRoot, {
+    onReclaim: (summary) => {
+      logger.info(formatWorkstreamDraftReclaim(summary), {
+        projectRoot,
+        expired: summary.expired,
+        overCap: summary.overCap,
+        unreadable: summary.unreadable,
+      });
+    },
+  });
   for (const persisted of store.loadAll()) drafts.set(persisted.id, persisted);
 
   /**

package/src/shell/ui-openers.ts

@@ -373,7 +373,7 @@ export function wireShellUiOpeners(options: WireShellUiOpenersOptions): void {
   // 'search' case) — the transcript search overlay isn't tracked on the
   // modal stack, so this doesn't call modalOpened either.
   commandContext.openTranscriptSearch = () => {
-    if (input.searchManager.active) input.searchManager.close();
+    if (input.searchManager.active) input.searchManager.close(input.conversationManager);
     else input.searchManager.open();
     render();
   };

package/src/version.ts

@@ -6,7 +6,7 @@ import { join } from 'node:path';
 // The prebuild script updates the fallback value before compilation.
 // Uses import.meta.dir (Bun) to locate package.json relative to this file,
 // which is correct regardless of the process working directory.
-let _version = '1.20.1';
+let _version = '1.21.1';
 try {
   const pkg = JSON.parse(readFileSync(join(import.meta.dir, '..', 'package.json'), 'utf-8'));
   // Only trust a version read from OUR OWN package.json. A Bun single-file