@pellux/goodvibes-tui 1.7.0 → 1.9.0

package/src/renderer/ui-primitives.ts

@@ -1,134 +1,35 @@
-export const GLYPHS = {
-  frame: {
-    topLeft: '┌',
-    topRight: '┐',
-    bottomLeft: '└',
-    bottomRight: '┘',
-    horizontal: '─',
-    vertical: '│',
-    teeLeft: '├',
-    teeRight: '┤',
-    teeTop: '┬',
-    teeBottom: '┴',
-    cross: '┼',
-  },
-  surface: {
-    top: '▄',
-    bottom: '▀',
-    cursor: '█',
-    altCursor: '▌',
-  },
-  navigation: {
-    selected: '▸',
-    collapsed: '▸',
-    expanded: '▾',
-    up: '↑',
-    down: '↓',
-    moreAbove: '▲',
-    moreBelow: '▼',
-    next: '→',
-    back: '←',
-    pipeSeparator: '│',
-  },
-  status: {
-    success: '✓',
-    failure: '✕',
-    pending: '•',
-    active: '●',
-    idle: '◌',
-    info: '○',
-    warn: '⚠',
-    blocked: '⊘',
-    skipped: '◇',
-    review: '◈',
-    retry: '↻',
-    handoff: '⇢',
-    reference: '↗',
-    partial: '◐',
-    dualPane: '◆',
-    star: '★',
-  },
-  meter: {
-    filled: '█',
-    medium: '▓',
-    light: '▒',
-    empty: '░',
-    spark: ['▁', '▂', '▃', '▄', '▅', '▆', '▇', '█'],
-  },
-} as const;
+// ---------------------------------------------------------------------------
+// ui-primitives.ts — glyph registry + tone-token table.
+//
+// W6-P1: these four tables (GLYPHS, UI_TONES, DIFF_TONES, SPINNER_FRAMES) are
+// no longer minted locally. They are the SDK presentation contract
+// (@pellux/goodvibes-sdk/platform/presentation, landed by W4-S1 and already
+// adopted by the agent in W4-R4), consumed here so the TUI and the agent
+// share ONE source (Mike's move-to-SDK ruling — machinery needed by 2+
+// surfaces => SDK). The TUI was the reference these values were lifted from
+// verbatim, so this swap is byte-identical. See
+// docs/decisions/2026-07-05-presentation-contract-sdk-extraction.md in the SDK.
+//
+// Re-exported under the historical names (GLYPHS, UI_TONES) so every existing
+// importer keeps working with no call-site churn. UI_TONES is the dark-mode
+// tone table (== resolveTones('dark')); light is resolved via theme.ts's
+// activeUiTones() / resolveUiTones(), which composes the mode dimension over
+// this dark constant unchanged.
+// ---------------------------------------------------------------------------
+
+import {
+  GLYPHS,
+  TONE_TOKENS,
+  DIFF_TONES,
+  SPINNER_FRAMES,
+} from '@pellux/goodvibes-sdk/platform/presentation';
+
+export { GLYPHS, DIFF_TONES, SPINNER_FRAMES };
 
 /**
  * UI_TONES — the single chrome/color-token source for src/renderer and
  * src/panels. Concrete (dark-mode) values; resolveUiTones(mode) in theme.ts
- * is the single mode-resolved read path — this object is the 'dark' entry.
- */
-export const UI_TONES = {
-  fg: {
-    primary: '#e2e8f0',
-    secondary: '#cbd5e1',
-    muted: '#94a3b8',
-    dim: '#475569',
-    inverse: '#0f172a',
-    /** Empty-state / placeholder foreground (formerly DEFAULT_PANEL_PALETTE.empty literal). */
-    empty: '#334155',
-  },
-  bg: {
-    base: '#11131a',
-    surface: '#161a22',
-    title: '#0f172a',
-    section: '#18202b',
-    summary: '#1b2430',
-    selected: '#223049',
-    input: '#1e293b',
-    warning: '#2b2116',
-    error: '#2a161b',
-    success: '#14241b',
-    /** Fullscreen/shell footer background. */
-    footer: '#111827',
-  },
-  state: {
-    info: '#38bdf8',
-    good: '#22c55e',
-    warn: '#f59e0b',
-    bad: '#ef4444',
-    blocked: '#f97316',
-    active: '#60a5fa',
-    /** Single canonical reasoning/thinking purple (replaces #9945FF and ad-hoc purples). */
-    reasoning: '#a855f7',
-  },
-  accent: {
-    browser: '#7dd3fc',
-    control: '#22d3ee',
-    inspector: '#c4b5fd',
-    workflow: '#fbbf24',
-    conversation: '#93c5fd',
-    /** Neon brand accent — header/splash/thinking gradient only. */
-    brand: '#00ffff',
-    gradientStart: '#00ffff',
-    gradientEnd: '#d000ff',
-  },
-  /** Canonical border stroke color for fullscreen/panel chrome. */
-  border: '#64748b',
-} as const;
-
-/**
- * Diff surface accent color shared across the three diff-rendering surfaces —
- * the conversation diff view (diff-view.ts), the file diff panel
- * (diff-panel.ts), and the git panel's inline diff (git-panel.ts). Hunk-header
- * blue has no matching UI_TONES.state/accent role, so WO-204 gives it one
- * named token here (value converged on diff-panel.ts's pre-existing hunk
- * color, the only one of the three surfaces that predates this token; add/del
- * on all three surfaces already converge on UI_TONES.state.good/bad).
+ * is the single mode-resolved read path — this object is the 'dark' entry
+ * (== resolveTones('dark') from the SDK presentation contract).
  */
-export const DIFF_TONES = {
-  // add/del carry diff-panel.ts's shipped colors: the diff panel is the only
-  // diff surface users have ever seen (diff-view.ts was unwired from v0.9.6
-  // until WO-204), so its look is the reference — the conversation surface
-  // adopts it, never the other way around.
-  add: '#00ff88',
-  del: '#ff4444',
-  hunk: '#88aaff',
-} as const;
-
-/** Single spinner-frame source — layout.ts and progress.ts both re-export this. */
-export const SPINNER_FRAMES = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'] as const;
+export const UI_TONES = TONE_TOKENS;

package/src/runtime/bootstrap-command-context.ts

@@ -123,6 +123,8 @@ export type CreateBootstrapCommandContextOptions = {
   hydrateSessionUsage?: () => void;
   workstreamEngine?: import('./workstream-services.ts').WorkstreamCommandService;
   codeIndexStore?: import('@pellux/goodvibes-sdk/platform/state').CodeIndexStore;
+  codeIndexReindexScheduler?: import('@pellux/goodvibes-sdk/platform/state').CodeIndexReindexScheduler;
+  isPassiveCodeInjectionFlagEnabled?: () => boolean;
   getMainSessionTurnInjections?: () => readonly import('../renderer/turn-injection.ts').TurnInjectionEntry[];
 };
 
@@ -184,6 +186,8 @@ export function createBootstrapCommandContext(
     hydrateSessionUsage,
     workstreamEngine,
     codeIndexStore,
+    codeIndexReindexScheduler,
+    isPassiveCodeInjectionFlagEnabled,
     getMainSessionTurnInjections,
     planManager,
     adaptivePlanner,
@@ -244,6 +248,8 @@ export function createBootstrapCommandContext(
     hydrateSessionUsage,
     workstreamEngine,
     codeIndexStore,
+    codeIndexReindexScheduler,
+    isPassiveCodeInjectionFlagEnabled,
     getMainSessionTurnInjections,
   });
   const provider = createBootstrapCommandProviderSection({

package/src/runtime/bootstrap-command-parts.ts

@@ -5,7 +5,7 @@ import type { ConversationManager } from '../core/conversation';
 import type { KnowledgeApi } from '@pellux/goodvibes-sdk/platform/knowledge';
 import type { HookApi } from '@pellux/goodvibes-sdk/platform/hooks';
 import type { McpApi } from '@pellux/goodvibes-sdk/platform/mcp';
-import type { PanelManager } from '../panels/panel-manager.ts';
+import type { PanelManager, PanelDeepLinkTarget } from '../panels/panel-manager.ts';
 import type { ProviderApi } from '@pellux/goodvibes-sdk/platform/providers';
 import type { OpsApi } from '@/runtime/index.ts';
 import type { MutableRuntimeState } from '@/runtime/index.ts';
@@ -118,6 +118,8 @@ export interface BootstrapCommandSectionOptions {
   readonly hydrateSessionUsage?: () => void;
   readonly workstreamEngine?: import('./workstream-services.ts').WorkstreamCommandService;
   readonly codeIndexStore?: CodeIndexStore;
+  readonly codeIndexReindexScheduler?: import('@pellux/goodvibes-sdk/platform/state').CodeIndexReindexScheduler;
+  readonly isPassiveCodeInjectionFlagEnabled?: () => boolean;
   readonly getMainSessionTurnInjections?: () => readonly import('../renderer/turn-injection.ts').TurnInjectionEntry[];
   readonly agentManager?: ShellAgentManagerService;
   readonly modeManager?: ShellModeManagerService;
@@ -190,7 +192,7 @@ export function createBootstrapCommandActions(
     localUserAuthManager,
   } = options;
 
-  const showPanel = (panelId: string, pane?: 'top' | 'bottom') => {
+  const showPanel = (panelId: string, pane?: 'top' | 'bottom', target?: PanelDeepLinkTarget) => {
     // W6.1 (the purge): a MIGRATE-TO-MODAL id resolves to a modal, not a panel.
     // panelManager.open() fires the injected openModal callback and returns a
     // no-op sentinel — so skip panelManager.show() (which would reveal an empty
@@ -198,7 +200,7 @@ export function createBootstrapCommandActions(
     // showPanel-based front-door (openHooksPanel/openSecurityPanel/… and the
     // migrated command runtimes) opening the modal cleanly.
     const redirected = panelManager.getModalRedirect(panelId) !== undefined;
-    panelManager.open(panelId, pane);
+    panelManager.open(panelId, pane, target);
     if (!redirected) panelManager.show();
     requestRender();
   };
@@ -321,7 +323,7 @@ export function createBootstrapCommandActions(
 export function createBootstrapCommandSessionSection(
   options: Pick<
     BootstrapCommandSectionOptions,
-    'conversation' | 'runtime' | 'sessionManager' | 'sessionMemoryStore' | 'sessionLineageTracker' | 'wrfcController' | 'changeTracker' | 'hydrateSessionUsage' | 'workstreamEngine' | 'codeIndexStore' | 'getMainSessionTurnInjections'
+    'conversation' | 'runtime' | 'sessionManager' | 'sessionMemoryStore' | 'sessionLineageTracker' | 'wrfcController' | 'changeTracker' | 'hydrateSessionUsage' | 'workstreamEngine' | 'codeIndexStore' | 'codeIndexReindexScheduler' | 'isPassiveCodeInjectionFlagEnabled' | 'getMainSessionTurnInjections'
   >,
 ): BootstrapCommandSessionSection {
   return {
@@ -335,6 +337,8 @@ export function createBootstrapCommandSessionSection(
     hydrateSessionUsage: options.hydrateSessionUsage,
     workstreamEngine: options.workstreamEngine,
     codeIndexStore: options.codeIndexStore,
+    codeIndexReindexScheduler: options.codeIndexReindexScheduler,
+    isPassiveCodeInjectionFlagEnabled: options.isPassiveCodeInjectionFlagEnabled,
     getMainSessionTurnInjections: options.getMainSessionTurnInjections,
   };
 }

package/src/runtime/bootstrap-core.ts

@@ -33,6 +33,8 @@ import { join } from 'node:path';
 import { installWrfcAgentToolGuard } from '../tools/wrfc-agent-guard.ts';
 import { createWrfcPersistence, type WrfcPersistence } from './wrfc-persistence.ts';
 import type { SystemMessagePriority } from '../core/system-message-router.ts';
+import { SessionSpineClient, SessionUnionCache, TUI_SPINE_PARTICIPANT } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
+import { SessionInboundInputPoller, createBootstrapInboundInputPoller } from './session-inbound-inputs.ts';
 
 // ---------------------------------------------------------------------------
 // Pre-router buffer
@@ -114,6 +116,12 @@ export interface BootstrapCoreState {
   readonly requestRender: () => void;
   readonly setRenderRequest: (fn: () => void) => void;
   readonly runtimeSessionIdRef: { value: string };
+  /** Cross-surface identity mirror; permanently dormant for embedded/local-only (docs/decisions/2026-07-06-session-spine-mode-branch-is-permanent.md), activated by bootstrap.ts only for an adopted 'external' daemon. */
+  readonly sessionSpine: SessionSpineClient;
+  /** D3: inbound steer/follow-up delivery; dormant until bootstrap.ts activates it. */
+  readonly sessionInboundInputs: SessionInboundInputPoller;
+  /** Cache-backed read facade; bootstrap.ts drives its mode (embedded/external/local-only) from the same HostServiceMode as the spine above. */
+  readonly sessionUnionCache: SessionUnionCache;
   /**
    * WRFC chain persistence — call `rehydrate()` once after the SystemMessageRouter
    * is wired so interrupted chains from a previous process are surfaced to the operator.
@@ -127,17 +135,8 @@ export type CompanionMessagePayload = Extract<SessionEvent, { type: 'COMPANION_M
 // Operator narration of inbound channel events
 // ---------------------------------------------------------------------------
 
-/**
- * Narrate an inbound channel event to the operator via the SystemMessageRouter.
- *
- * When an external surface (GitHub, Slack, ntfy, etc.) triggers an agent turn,
- * this function produces a human-readable system message so the operator can
- * observe which event caused the turn. Returns null for internal/companion
- * sources that do not need operator narration.
- *
- * @param event - The normalized inbound event descriptor.
- * @returns A narration string, or null if no narration is appropriate.
- */
+/** Narrate an inbound channel event (GitHub, Slack, ntfy, etc.) that triggered an
+ * agent turn, via the SystemMessageRouter — null for internal/companion sources. */
 export function narrateInboundEvent(event: {
   source: string;
   metadata: Readonly<Record<string, unknown>> | undefined;
@@ -293,6 +292,12 @@ export async function initializeBootstrapCore(
     surfaceRegistry,
     watcherRegistry,
   } = services;
+  // Permanently dormant for embedded/local-only (nothing to mirror to); bootstrap.ts activates it only for an adopted 'external' daemon.
+  const sessionSpine = new SessionSpineClient({ participant: TUI_SPINE_PARTICIPANT, recordKind: 'tui' });
+  // Cache-backed read facade over the local broker (passthrough until bootstrap.ts marks it
+  // embedded, or activates the adopted-daemon wire union for 'external').
+  // selfSessionIds keeps local authoritative for our own wire-mirrored session even when local/wire ids diverge (D-TUI-1).
+  const sessionUnionCache = new SessionUnionCache({ local: sharedSessionBroker, selfSessionIds: () => sessionSpine.mirroredSessionIds });
 
   routeBindings.attachRuntime({ runtimeBus, runtimeStore: store });
   surfaceRegistry.attachRuntime(store);
@@ -324,6 +329,7 @@ export async function initializeBootstrapCore(
   const uiServices = createUiRuntimeServices(services, {
     forensicsRegistry,
     getControlPlaneRecentEvents,
+    sessionUnionCache,
   });
 
   const conversation = new ConversationManager(() => {
@@ -427,6 +433,10 @@ export async function initializeBootstrapCore(
     } catch (err) {
       logger.error('Render threw; next requestRender will reschedule', { error: String(err) });
     }
+    // Debounced spine heartbeat on turn/render activity (no-op while dormant, i.e.
+    // embedded/local-only): a cheap synchronous no-op unless its own internal window has
+    // elapsed (at most one wire call per heartbeatMinIntervalMs) — safe on the hot path.
+    sessionSpine.heartbeat(runtimeSessionIdRef.value);
   };
   const requestRender = (): void => {
     if (renderScheduled) return;
@@ -634,6 +644,11 @@ export async function initializeBootstrapCore(
     },
   ));
 
+  // D3: inbound steer delivery — see createBootstrapInboundInputPoller's doc comment.
+  const sessionInboundInputs = createBootstrapInboundInputPoller({
+    runtimeSessionIdRef, routeOrBuffer, orchestratorHandleUserInputRef, conversation, requestRender,
+  });
+
   providerRegistry.startWatching(runtimeBus);
 
   // W2.3: attach the SAME WebhookNotifier instance that `/notify add|remove|clear`
@@ -724,6 +739,10 @@ export async function initializeBootstrapCore(
       lastSeenAt: Date.now(),
     },
   }).catch((err) => { logger.debug('session broker create session failed at bootstrap', { err }); });
+  // Fire-and-forget spine mirror — a permanent parallel-write posture alongside (never
+  // instead of) the still-authoritative local SharedSessionBroker above. Dormant/queued
+  // until bootstrap.ts's deferred task activates it for an adopted 'external' daemon.
+  sessionSpine.register({ sessionId: runtime.sessionId, project: services.workingDirectory, title: 'Terminal UI session' });
 
   domainDispatch.syncSessionState({
     id: userSessionId,
@@ -774,5 +793,8 @@ export async function initializeBootstrapCore(
     },
     runtimeSessionIdRef,
     wrfcPersistence,
+    sessionSpine,
+    sessionInboundInputs,
+    sessionUnionCache,
   };
 }

package/src/runtime/bootstrap-hook-bridge.ts

@@ -9,6 +9,7 @@ import { HelperModel } from '@pellux/goodvibes-sdk/platform/config';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import { formatReturnContextForDisplay, getReturnContextMode, maybeAssistReturnContextSummary } from '@/runtime/index.ts';
 import type { SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { SessionSpineClient } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import type { SessionManager } from '@pellux/goodvibes-sdk/platform/sessions';
 import type { PanelManager } from '../panels/panel-manager.ts';
 import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
@@ -22,6 +23,10 @@ export interface ResumeSessionOptions {
   readonly requestRender: () => void;
   readonly onSessionIdChanged?: (sessionId: string) => void;
   readonly sharedSessionBroker: Pick<SharedSessionBroker, 'reopenSession'>;
+  /** S3c: fire-and-forget daemon-spine mirror. Reopen (not register) is the
+   * ONLY resume-time verb — see the SDK session-spine client.ts header doc. */
+  readonly sessionSpine: Pick<SessionSpineClient, 'reopen'>;
+  readonly project: string;
   readonly writeLastSessionPointer: (sessionId: string) => void;
   readonly hookDispatcher: HookDispatcher;
   readonly sessionManager: SessionManager;
@@ -75,6 +80,8 @@ export function createResumeSessionHandler(options: ResumeSessionOptions): (sess
       if (meta?.provider) options.runtime.provider = meta.provider;
       options.writeLastSessionPointer(sessionId);
       void options.sharedSessionBroker.reopenSession(sessionId).catch((err) => { logger.debug('session broker reopen session failed', { err }); });
+      // S3c: fire-and-forget spine mirror (reopen:true — the user resume verb).
+      options.sessionSpine.reopen({ sessionId, project: options.project, title: options.conversation.title || meta.title });
       options.conversation.log(`Resumed session: ${sessionId}`, { fg: '135' });
       const reopenedPanels: string[] = [];
       if (meta.returnContext?.openPanels?.length) {

package/src/runtime/bootstrap-shell.ts

@@ -32,6 +32,7 @@ import type { PolicyRuntimeState } from '@/runtime/index.ts';
 import type { TaskManager } from '@/runtime/index.ts';
 import type { UiRuntimeServices } from './ui-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
+import type { SessionSpineClient } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 
 export interface BootstrapShellState {
   readonly commandRegistry: CommandRegistry;
@@ -47,6 +48,8 @@ export interface BootstrapShellOptions {
   readonly runtimeBus: RuntimeEventBus;
   readonly runtimeStore: RuntimeStore;
   readonly services: RuntimeServices;
+  /** S3c: dormant until bootstrap.ts activates it for an adopted 'external' daemon. */
+  readonly sessionSpine: SessionSpineClient;
   readonly conversation: ConversationManager;
   readonly runtime: MutableRuntimeState;
   readonly orchestrator: Orchestrator;
@@ -70,6 +73,7 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     runtimeBus,
     runtimeStore,
     services,
+    sessionSpine,
     conversation,
     runtime,
     orchestrator,
@@ -103,6 +107,8 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     requestRender,
     onSessionIdChanged,
     sharedSessionBroker: services.sessionBroker,
+    sessionSpine,
+    project: services.workingDirectory,
     writeLastSessionPointer,
     hookDispatcher: services.hookDispatcher,
     sessionManager: services.sessionManager,
@@ -175,7 +181,8 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     forensicsRegistry,
     policyRuntimeState,
     approvalBroker: services.approvalBroker,
-    sessionBroker: services.sessionBroker,
+    // S3d: panels read the cross-surface union facade, not the raw local broker.
+    sessionBroker: uiServices.sessions.sessionBroker,
     automationManager: services.automationManager,
     getControlPlaneRecentEvents,
     tokenAuditor: services.tokenAuditor,
@@ -207,6 +214,15 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
       if (kind === 'operational') return ui.operationalMessages;
       return ui.systemMessages;
     },
+    {
+      // Suppress stale WRFC replay re-notifications for chains that can no
+      // longer act — gone (killed/removed → getChain null) or terminal
+      // (passed/failed). (UX-B item 1c.)
+      isChainTerminal: (chainId) => {
+        const chain = services.wrfcController.getChain(chainId);
+        return chain === null || chain.state === 'passed' || chain.state === 'failed';
+      },
+    },
   );
   orchestrator.setSystemMessageRouter(systemMessageRouter);
 
@@ -271,6 +287,8 @@ export function createBootstrapShell(options: BootstrapShellOptions): BootstrapS
     wrfcController: services.wrfcController,
     workstreamEngine: services.workstreamCommands,
     codeIndexStore: services.codeIndexStore,
+    codeIndexReindexScheduler: services.codeIndexReindexScheduler,
+    isPassiveCodeInjectionFlagEnabled: () => services.featureFlags.isEnabled('agent-passive-code-injection'),
     // Wave 5 (wo805): expose the MAIN session's per-turn passive-injection ring
     // so `/recall injections` (no agent id) renders it — see recall-review.ts.
     getMainSessionTurnInjections: () => orchestrator.getTurnInjections(),

package/src/runtime/bootstrap.ts

@@ -36,12 +36,16 @@ import {
 import { scheduleBackgroundMcpDiscovery, startBackgroundProviderRegistration } from '@/runtime/index.ts';
 import { restoreSavedModel } from '@/runtime/index.ts';
 import { startExternalServices, type ExternalServicesHandle, type HostServiceStatus } from '@/runtime/index.ts';
-import { getOrCreateCompanionToken, pruneStaleOperatorTokens } from '@pellux/goodvibes-sdk/platform/pairing';
-import { workspaceOperatorTokenCandidates } from './operator-token-cleanup.ts';
+import { createHttpTransport } from '@/runtime/index.ts';
+import { foldLegacySpineStore, deriveSpineFooterStatus } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
+import { createTuiSpineTransport, type SpineSessionsClient } from './session-spine-transport.ts';
+import { pruneStaleOperatorTokens } from '@pellux/goodvibes-sdk/platform/pairing';
+import { resolveDaemonCompanionToken, workspaceOperatorTokenCandidates } from './operator-token-cleanup.ts';
 import type { UiRuntimeServices } from './ui-services.ts';
 import { createDeferredStartupCoordinator } from '@/runtime/index.ts';
 import { initializeBootstrapCore } from './bootstrap-core.ts';
 import { createBootstrapShell } from './bootstrap-shell.ts';
+import { announceResumeState } from './resume-notice.ts';
 import { buildSharedOrchestratorCoreServices } from './orchestrator-core-services.ts';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 import { DaemonServer } from '@pellux/goodvibes-sdk/platform/daemon';
@@ -183,6 +187,9 @@ export async function bootstrapRuntime(
     setRenderRequest,
     runtimeSessionIdRef,
     wrfcPersistence,
+    sessionSpine,
+    sessionInboundInputs,
+    sessionUnionCache,
   } = await initializeBootstrapCore(stdout, options, (limit) => controlPlaneRecentEventsRef.value(limit));
   const providerRegistry = services.providerRegistry;
   const {
@@ -192,6 +199,11 @@ export async function bootstrapRuntime(
     pluginManager,
   } = services;
 
+  // D4b: a liveness flip is only PAINTED once something calls requestRender();
+  // without this, the footer's spine segment sat correct-but-undrawn until
+  // incidental activity redrew it (minutes, during an idle stretch).
+  sessionUnionCache.setOnTransition(() => requestRender());
+
   // ── Phase 6: Orchestrator + AcpManager ───────────────────────────────────
 
   // Mutable function refs so main.ts can patch these after constructing the scroll/viewport state.
@@ -262,6 +274,7 @@ export async function bootstrapRuntime(
     runtimeBus,
     runtimeStore: store,
     services,
+    sessionSpine,
     conversation,
     runtime,
     orchestrator,
@@ -287,6 +300,25 @@ export async function bootstrapRuntime(
   wrfcPersistence.rehydrate();
   const commandRegistry = shell.commandRegistry;
   const commandContext = shell.commandContext;
+  // Boot resume notice (UX-D item 1): after rehydrate() so chain history is
+  // ready, before the operator can type anything. Fire-and-forget — the
+  // checkpoint-count lookup is async (WorkspaceCheckpointManager.list() awaits
+  // its own init()), and this must not block the rest of bootstrap the way
+  // main.ts's `void workspaceCheckpointManager.init().catch(() => {})`
+  // deliberately doesn't either. Local file I/O only; resolves well before a
+  // human can react to the first rendered frame.
+  void announceResumeState({
+    workingDirectory: services.workingDirectory,
+    homeDirectory: services.homeDirectory,
+    surfaceRoot: 'tui',
+    sessionManager: services.sessionManager,
+    checkpointManager: services.workspaceCheckpointManager,
+    chainHistory: wrfcPersistence.knownChains,
+    memoryAvailable: Boolean(commandContext.clients?.knowledgeApi?.memory),
+    router: systemMessageRouter,
+  }).catch(() => {
+    // Best-effort — never let the resume notice block or crash boot.
+  });
   const gitStatusProvider = shell.gitStatusProvider;
   const inputHistory = shell.inputHistory;
   const lastGitInfoRef = shell.lastGitInfoRef;
@@ -343,7 +375,70 @@ export async function bootstrapRuntime(
 
   const hostServiceIsActive = (status: HostServiceStatus): boolean => status.mode === 'embedded' || status.mode === 'external';
 
-  const hostServiceIsBlocked = (status: HostServiceStatus): boolean => status.mode === 'blocked';
+  // 'blocked' (occupied by an unverified process) and 'incompatible' (occupied
+  // by a GoodVibes daemon we refused to adopt on a wire-version mismatch) both
+  // mean the configured port is held and unusable by this TUI instance.
+  const hostServiceIsBlocked = (status: HostServiceStatus): boolean => status.mode === 'blocked' || status.mode === 'incompatible';
+
+  // PERMANENT DESIGN (docs/decisions/2026-07-06-session-spine-mode-branch-is-permanent.md):
+  // 'embedded'/'external' are two distinct, both-supported daemon topologies, not
+  // migration stages — the ONE client-selection point for the session spine, driven by
+  // the SAME authoritative HostServiceMode adopt-or-start already computed above.
+  // 'embedded' (daemon.embedInProcess=true) means THIS process's own SharedSessionBroker
+  // already IS the daemon's broker — nothing to mirror TO, so the spine stays
+  // permanently dormant. Every other mode ('disabled'/'blocked'/'incompatible'/
+  // 'unavailable') also stays local-only and honest. Only 'external' (a separately-
+  // running daemon this TUI adopted) activates the wire mirror.
+  let spineActiveForBaseUrl: string | null = null;
+  const syncSessionSpineToHostStatus = (daemonStatus: HostServiceStatus, sharedDaemonToken: string): void => {
+    if (daemonStatus.mode !== 'external') {
+      if (spineActiveForBaseUrl !== null) {
+        sessionSpine.deactivate(`daemon mode changed to '${daemonStatus.mode}'`);
+        sessionInboundInputs.deactivate(`daemon mode changed to '${daemonStatus.mode}'`);
+        spineActiveForBaseUrl = null;
+      }
+      // Keep the read facade honest per topology (permanent, not staged): 'embedded'
+      // means this process's broker IS the daemon's broker (local reads are the whole
+      // truth); every other non-external mode is local-only/dormant.
+      if (daemonStatus.mode === 'embedded') sessionUnionCache.markEmbedded();
+      else sessionUnionCache.deactivate(`daemon mode '${daemonStatus.mode}'`);
+      logger.info(`[bootstrap] session spine: daemon mode '${daemonStatus.mode}' — local-only (no spine mirror)`);
+      return;
+    }
+    const baseUrl = daemonStatus.baseUrl;
+    if (spineActiveForBaseUrl === baseUrl) return; // already wired to this exact adopted daemon
+    const httpTransport = createHttpTransport({ baseUrl, authToken: sharedDaemonToken });
+    const sessionsClient: SpineSessionsClient = {
+      register: (input) => httpTransport.operator.sessions.register(input),
+      close: (sessionId) => httpTransport.operator.sessions.close(sessionId),
+    };
+    sessionSpine.activate(createTuiSpineTransport(sessionsClient));
+    // D3: adopt the same daemon's wire for the INBOUND steer path — collect
+    // steer/follow-up inputs another live surface queued for this session and
+    // inject them into the turn machinery (acking delivery on the wire).
+    sessionInboundInputs.activate({
+      listInputs: async (sessionId, opts) => ({
+        inputs: await httpTransport.operator.sessions.inputs(sessionId, opts.limit, { state: opts.state, since: opts.since }),
+      }),
+      deliverInput: (sessionId, inputId, opts) => httpTransport.operator.sessions.deliverInput(sessionId, inputId, opts),
+    });
+    // 'external' only: adopt the same daemon's wire as the read facade's cross-surface
+    // union source (interval-refreshed; served synchronously to panels).
+    sessionUnionCache.activate({ list: (limit) => httpTransport.operator.sessions.list(limit) });
+    spineActiveForBaseUrl = baseUrl;
+    logger.info(`[bootstrap] session spine: adopted external daemon at ${baseUrl} — mirroring session identity`);
+    // Legacy fold: one-time (marker-guarded) import of this project's own
+    // pre-spine control-plane sessions.json into the now-adopted daemon.
+    const legacyStorePath = services.shellPaths.resolveProjectPath('tui', 'control-plane', 'sessions.json');
+    const fold = foldLegacySpineStore(sessionSpine, {
+      storePath: legacyStorePath,
+      markerPath: `${legacyStorePath}.spine-migrated`,
+      project: services.workingDirectory,
+    });
+    if (fold.folded > 0) {
+      logger.info(`[bootstrap] session spine: folded ${fold.folded} legacy local session(s) into the adopted daemon`);
+    }
+  };
 
   const inspectExternalServices = () => {
     const daemonStatus = externalServices.daemonStatus;
@@ -355,6 +450,16 @@ export async function bootstrapRuntime(
       httpListenerPortInUse: hostServiceIsBlocked(httpListenerStatus),
       daemonStatus,
       httpListenerStatus,
+      // Honest session-spine posture, independent of daemonRunning —
+      // 'external'-adopted-but-currently-unreachable degrades to 'offline' here
+      // even though daemonRunning might still read true from a stale handle.
+      // D4: sessionSpine.status() alone is ACTIVITY-gated (only updates on a
+      // register/heartbeat/close), so after the daemon dies mid-idle it would
+      // keep reading 'online'. Derive the footer status from the union cache's
+      // 5s liveness probe too — one signal, no new timer — so offline surfaces
+      // within one refresh interval of the daemon dying.
+      sessionSpineActive: sessionSpine.active,
+      sessionSpineStatus: deriveSpineFooterStatus(sessionSpine.status(), sessionUnionCache.crossSurfaceView),
     };
   };
 
@@ -413,7 +518,7 @@ export async function bootstrapRuntime(
       await waitForConfigDrivenRestarts(externalServices);
       await externalServices.stop();
       const daemonHomeDir = join(services.homeDirectory, '.goodvibes', 'daemon');
-      const companionTokenRecord = getOrCreateCompanionToken('tui', { daemonHomeDir });
+      const companionTokenRecord = resolveDaemonCompanionToken(daemonHomeDir);
       externalServicesPromise = startExternalServices(
         configManager,
         runtimeBus,
@@ -423,6 +528,7 @@ export async function bootstrapRuntime(
       );
       externalServices = await externalServicesPromise;
       controlPlaneRecentEventsRef.value = (limit) => externalServices.listRecentControlPlaneEvents(limit);
+      syncSessionSpineToHostStatus(externalServices.daemonStatus, companionTokenRecord.token);
       requestRender();
       return inspectExternalServices();
     },
@@ -461,7 +567,7 @@ export async function bootstrapRuntime(
       // bearer, so tokens scanned from the /qrcode panel's QR actually
       // authenticate against the embedded daemon this surface starts.
       const daemonHomeDir = join(services.homeDirectory, '.goodvibes', 'daemon');
-      const companionTokenRecord = getOrCreateCompanionToken('tui', { daemonHomeDir });
+      const companionTokenRecord = resolveDaemonCompanionToken(daemonHomeDir);
       // F3 resolution (TUI 0.19.20): remove stale pre-0.21.28 workspace-scoped operator
       // token files so only the canonical <daemonHomeDir>/operator-tokens.json survives.
       // The prune is best-effort — it silently skips missing files, no-ops when tokens
@@ -486,6 +592,7 @@ export async function bootstrapRuntime(
       );
       externalServices = await externalServicesPromise;
       controlPlaneRecentEventsRef.value = (limit) => externalServices.listRecentControlPlaneEvents(limit);
+      syncSessionSpineToHostStatus(externalServices.daemonStatus, companionTokenRecord.token);
       requestRender();
     },
     onError: (error) => {
@@ -630,6 +737,12 @@ export async function bootstrapRuntime(
       runtimeUnsubs.forEach((fn) => fn());
       runtimeUnsubs.length = 0;
       forensicsCollector.dispose();
+      // Honest close on exit — fire-and-forget (never blocks shutdown);
+      // a no-op when the spine was never activated (embedded/local-only topology).
+      sessionSpine.close(runtime.sessionId);
+      sessionSpine.dispose();
+      sessionInboundInputs.dispose(); // D3: stop the inbound steer poll interval on exit
+      sessionUnionCache.dispose(); // stop the wire-refresh interval on exit
       await deferredStartup.drain(100);
       if (externalServicesPromise) {
         try {