@pellux/goodvibes-tui 1.7.0 → 1.9.1

package/src/input/panel-paste-flood-guard.ts

@@ -0,0 +1,86 @@
+// ---------------------------------------------------------------------------
+// panel-paste-flood-guard.ts — DEBT-5 item 5.
+//
+// A terminal WITHOUT bracketed paste delivers a pasted block as a burst of
+// discrete 1-char 'text' tokens (isPasteToken stays false for every one of
+// them, since that flag only fires for a single token whose value.length > 1
+// — see handler-feed-routes.ts's own Invariant B doc). Before this guard,
+// each such character became a real panel hotkey on a focused non-capturing
+// panel (K arms kill, etc.) once it reached handlePanelFocusToken's per-char
+// dispatch loop.
+//
+// This is a RATE guard: more than PANEL_PASTE_FLOOD_THRESHOLD qualifying
+// tokens within the trailing PANEL_PASTE_FLOOD_WINDOW_MS, evaluated with a
+// real sliding window (old timestamps age out of `timestamps` every call).
+// It is deliberately NOT the retired per-feed char-SUM burst heuristic this
+// same input layer already tore out once (see panel-focus-burst.test.ts's
+// header doc): that old guard summed one feed()'s character count with no
+// timing signal at all, so two ordinary nav keystrokes landing in a single
+// feed() — a real, common case, not an edge case — were misread as a burst
+// and focus was silently flipped to the composer. This guard:
+//   - never touches focus (panelFocused is untouched by trackPanelPasteFloodGuard
+//     and by its caller);
+//   - is keyed on WALL-CLOCK TIMING, not a per-feed token count, so it
+//     doesn't care how many tokens land in one feed() call, only how fast
+//     they arrive relative to each other;
+//   - is sticky once tripped (only a quiet gap — no qualifying token for a
+//     full window — clears it) so it doesn't flap dispatch on/off as the
+//     count oscillates near the threshold mid-flood.
+//
+// ~8 keys/120ms is far beyond sustained human typing (a fast typist peaks
+// well under that inter-key rate over any real span) but is exactly the
+// shape an unbracketed paste replay takes. It also keeps the pre-existing
+// Invariant B regression tests (2 keys in one feed(), no timing control at
+// all) far under threshold while catching a real flood within its first ~9
+// characters.
+// ---------------------------------------------------------------------------
+
+export const PANEL_PASTE_FLOOD_WINDOW_MS = 120;
+export const PANEL_PASTE_FLOOD_THRESHOLD = 8;
+
+/**
+ * Guard state — a single persistent instance lives on the caller's
+ * long-lived context (handler-feed.ts's InputFeedContext, mirroring how that
+ * object already owns `nextPasteId`/`mouseDownRow`/etc.) and is MUTATED IN
+ * PLACE by trackPanelPasteFloodGuard below, never replaced — so callers never
+ * need to thread a return value back into their own state (unlike
+ * `panelFocused`, which handlePanelFocusToken returns because it is NOT a
+ * mutable outparam).
+ */
+export interface PanelBurstGuardState {
+  timestamps: readonly number[];
+  suspended: boolean;
+  hintShown: boolean;
+}
+
+export interface PanelBurstGuardResult {
+  /** False while suspended — the caller must drop this token, not dispatch it. */
+  readonly dispatch: boolean;
+  /** True exactly once per burst: the call that just tripped suspension. */
+  readonly showHintNow: boolean;
+}
+
+/** Advance `guard` (mutated in place) by one qualifying token at time `now` (ms). */
+export function trackPanelPasteFloodGuard(guard: PanelBurstGuardState, now: number): PanelBurstGuardResult {
+  const lastAt = guard.timestamps.length > 0 ? guard.timestamps[guard.timestamps.length - 1]! : -Infinity;
+  const isQuietGap = now - lastAt > PANEL_PASTE_FLOOD_WINDOW_MS;
+  if (isQuietGap && guard.suspended) {
+    // A silence at least as long as the window means whatever burst was
+    // happening has ended — un-suspend so a LATER burst gets its own fresh
+    // count and its own one-shot hint.
+    guard.suspended = false;
+    guard.hintShown = false;
+  }
+  guard.timestamps = isQuietGap
+    ? [now]
+    : [...guard.timestamps.filter((t) => t > now - PANEL_PASTE_FLOOD_WINDOW_MS), now];
+  if (guard.timestamps.length > PANEL_PASTE_FLOOD_THRESHOLD) {
+    guard.suspended = true;
+  }
+  let showHintNow = false;
+  if (guard.suspended && !guard.hintShown) {
+    guard.hintShown = true;
+    showHintNow = true;
+  }
+  return { dispatch: !guard.suspended, showHintNow };
+}

package/src/input/selection-modal.ts

@@ -36,6 +36,14 @@ export class SelectionModal {
   public selectedIndex = 0;
   public allowSearch = true;
   public customActions: Map<string, SelectionAction> = new Map();
+  /**
+   * UX-C vocab unification: overrides the default per-primaryAction Enter
+   * verb ("Select"/"Toggle"/"Edit"/"Delete") shown in the footer hint. Used by
+   * callers whose items are really commands (e.g. /help) so the hint reads
+   * "[Enter] Run", matching the slash-command palette's own verb, instead of
+   * the generic "Select".
+   */
+  public primaryVerbLabel: string | undefined = undefined;
 
   /** Open the modal with items and title */
   open(
@@ -45,6 +53,7 @@ export class SelectionModal {
       preSelectId?: string;
       allowSearch?: boolean;
       customActions?: Map<string, SelectionAction>;
+      primaryVerbLabel?: string;
     }
   ): void {
     this.title = title;
@@ -53,6 +62,7 @@ export class SelectionModal {
     this.allowSearch = opts?.allowSearch ?? true;
     this.searchFocused = false;
     this.customActions = opts?.customActions ?? new Map();
+    this.primaryVerbLabel = opts?.primaryVerbLabel;
     this.active = true;
     this.filterItems();
 
@@ -74,6 +84,7 @@ export class SelectionModal {
     this.filteredItems = [];
     this.selectedIndex = 0;
     this.customActions = new Map();
+    this.primaryVerbLabel = undefined;
   }
 
   moveUp(): void {

package/src/input/session-picker-modal.ts

@@ -1,12 +1,28 @@
 /**
  * SessionPickerModal — state management for the /sessions picker modal.
  *
- * Lists sessions from SessionManager.list(), tracks selected index,
- * and handles load/delete actions.
+ * Lists LOCAL saved transcript files from SessionManager.list() (load/delete
+ * operate on these — a saved JSONL session is a different thing from a live
+ * control-plane session, see below), tracks selected index, and handles
+ * load/delete actions.
+ *
+ * W3-T2 (union-sessions surface): additionally surfaces the cross-surface
+ * session union from `sessionBroker` (a SessionReadFacade — normally
+ * `uiServices.sessions.sessionBroker`, the SessionUnionCache) so a user can
+ * SEE what sessions are live/closed across every surface sharing this
+ * daemon (TUI, webui, companion, automation), not just this process's own
+ * saved files. This is deliberately READ-ONLY: a SharedSessionRecord has no
+ * on-disk transcript this process can load()/delete() the way a local
+ * SessionInfo does, so cross-surface rows are visible + badged, not
+ * selectable for load/delete. `sessionBroker` is optional so every existing
+ * caller/test that only cares about local saved-session management keeps
+ * working unchanged.
  */
 
 import { unlinkSync } from 'node:fs';
 import type { SessionInfo, SessionManager } from '@pellux/goodvibes-sdk/platform/sessions';
+import type { SharedSessionRecord } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { CrossSurfaceView, SessionReadFacade } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import type { ConversationManager } from '../core/conversation';
 import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 
@@ -14,9 +30,22 @@ import { summarizeError } from '@pellux/goodvibes-sdk/platform/utils';
 // SessionPickerModal
 // ---------------------------------------------------------------------------
 
+/** Honest default posture when no `sessionBroker` was wired: no cross-surface claim. */
+const DORMANT_CROSS_SURFACE_VIEW: CrossSurfaceView = {
+  mode: 'local',
+  online: false,
+  stale: false,
+  lastSyncAt: null,
+  offlineNote: null,
+};
+
 export class SessionPickerModal {
   public active = false;
   public sessions: SessionInfo[] = [];
+  /** Cross-surface session union (view-only) — see class doc. Empty until open(). */
+  public crossSurfaceSessions: readonly SharedSessionRecord[] = [];
+  /** Honest posture for crossSurfaceSessions: mode/online/stale/offlineNote. */
+  public crossSurfaceView: CrossSurfaceView = DORMANT_CROSS_SURFACE_VIEW;
   public selectedIndex = 0;
   public scrollOffset = 0;
   public visibleRows = 8;
@@ -25,13 +54,24 @@ export class SessionPickerModal {
   /** Last status message to show in the modal (e.g. error or success). */
   public statusMessage = '';
 
-  public constructor(private readonly sessionManager: SessionManager) {}
+  public constructor(
+    private readonly sessionManager: SessionManager,
+    private readonly sessionBroker?: SessionReadFacade,
+  ) {}
 
   /**
-   * Open the modal, loading sessions from SessionManager.
+   * Open the modal, loading local saved sessions from SessionManager and (when
+   * a sessionBroker was wired) the cross-surface session union, honestly.
    */
   open(): void {
     this.sessions = this.sessionManager.list();
+    if (this.sessionBroker) {
+      this.crossSurfaceSessions = this.sessionBroker.listSessions();
+      this.crossSurfaceView = this.sessionBroker.crossSurfaceView;
+    } else {
+      this.crossSurfaceSessions = [];
+      this.crossSurfaceView = DORMANT_CROSS_SURFACE_VIEW;
+    }
     this.selectedIndex = 0;
     this.scrollOffset = 0;
     this.statusMessage = '';

package/src/input/settings-modal-data.ts

@@ -15,6 +15,13 @@ import { buildSubscriptionEntries } from './settings-modal-subscriptions.ts';
 import type { SubscriptionManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { ServiceInspectionQuery } from '../runtime/ui-service-queries.ts';
 import { CODE_INDEX_ENABLED_CONFIG_KEY } from '../runtime/code-index-services.ts';
+import {
+  THEME_MODE_CONFIG_KEY,
+  THEME_MODE_VALUES,
+  THEME_MODE_DEFAULT,
+  THEME_MODE_DESCRIPTION,
+  coerceThemeModeSetting,
+} from '../renderer/theme-mode-config.ts';
 import {
   SETTINGS_CATEGORIES,
   type FlagEntry,
@@ -94,6 +101,14 @@ export function buildSettingGroups(
     }
   }
 
+  // DEBT-2: inject the synthetic display.themeMode enum (auto|dark|light). TUI-local
+  // key stored under the existing `display` section (see theme-mode-config.ts for why
+  // not `appearance`), same rationale as the other synthetic settings below.
+  const displayEntries = groups.get('display');
+  if (displayEntries && !displayEntries.some((e) => e.setting.key === (THEME_MODE_CONFIG_KEY as ConfigKey))) {
+    displayEntries.push(buildThemeModeSyntheticEntry(configManager));
+  }
+
   const uiEntries = groups.get('ui');
   if (uiEntries) {
     const uiPriority: Record<string, number> = {
@@ -199,6 +214,34 @@ export function buildTtsSpeedSyntheticEntry(configManager: Pick<ConfigManager, '
   };
 }
 
+// ---------------------------------------------------------------------------
+// display.themeMode synthetic setting (DEBT-2 light theme)
+// ---------------------------------------------------------------------------
+
+/**
+ * The synthetic ConfigSetting descriptor for display.themeMode. TUI-local (not
+ * in the SDK ConfigKey union); the key is cast to ConfigKey as the other
+ * synthetic settings do. Stored under the existing `display` section so
+ * ConfigManager.setDynamic/get round-trip it with no SDK change.
+ */
+export const THEME_MODE_SYNTHETIC_SETTING: ConfigSetting = {
+  key: THEME_MODE_CONFIG_KEY as ConfigKey,
+  type: 'enum',
+  default: THEME_MODE_DEFAULT,
+  enumValues: [...THEME_MODE_VALUES],
+  description: THEME_MODE_DESCRIPTION,
+};
+
+/** Build the synthetic SettingEntry for display.themeMode. */
+export function buildThemeModeSyntheticEntry(configManager: Pick<ConfigManager, 'get'>): SettingEntry {
+  const currentValue = coerceThemeModeSetting(configManager.get(THEME_MODE_CONFIG_KEY as ConfigKey));
+  return {
+    setting: THEME_MODE_SYNTHETIC_SETTING,
+    currentValue,
+    isDefault: currentValue === THEME_MODE_DEFAULT,
+  };
+}
+
 // ---------------------------------------------------------------------------
 // behavior.notifyAfterSeconds synthetic setting
 // ---------------------------------------------------------------------------
@@ -401,6 +444,8 @@ export function refreshEntryValues(
       // construction time so isDefault stays accurate.
       if (entry.setting.key === ('tts.speed' as ConfigKey)) {
         entry.currentValue = normalizeTtsSpeedValue(raw);
+      } else if (entry.setting.key === (THEME_MODE_CONFIG_KEY as ConfigKey)) {
+        entry.currentValue = coerceThemeModeSetting(raw);
       } else {
         entry.currentValue = raw;
       }
@@ -422,8 +467,12 @@ export function updateEntryForKey(
     const entry = entries.find((candidate) => candidate.setting.key === key);
     if (entry) {
       const raw = configManager.get(key);
-      // Synthetic tts.speed entry: normalize using the same fallback logic.
-      entry.currentValue = key === ('tts.speed' as ConfigKey) ? normalizeTtsSpeedValue(raw) : raw;
+      // Synthetic entries: normalize using the same fallback logic as construction.
+      entry.currentValue = key === ('tts.speed' as ConfigKey)
+        ? normalizeTtsSpeedValue(raw)
+        : key === (THEME_MODE_CONFIG_KEY as ConfigKey)
+          ? coerceThemeModeSetting(raw)
+          : raw;
       entry.isDefault = deepEqual(entry.currentValue, entry.setting.default);
     }
   }

package/src/input/settings-modal-types.ts

@@ -11,11 +11,13 @@ export type SettingsCategory =
   | 'storage'
   | 'permissions'
   | 'orchestration'
+  | 'planner'
   | 'wrfc'
   | 'tools'
   | 'helper'
   | 'tts'
   | 'service'
+  | 'daemon'
   | 'controlPlane'
   | 'httpListener'
   | 'web'
@@ -42,9 +44,9 @@ export const SETTINGS_CATEGORY_GROUPS: ReadonlyArray<{
 }> = [
   { label: 'Interface', categories: ['display', 'ui', 'behavior', 'permissions'] },
   { label: 'AI Routing', categories: ['provider', 'subscriptions', 'helper', 'tools', 'tts'] },
-  { label: 'Service & Network', categories: ['service', 'network', 'controlPlane', 'httpListener', 'web'] },
+  { label: 'Service & Network', categories: ['service', 'daemon', 'network', 'controlPlane', 'httpListener', 'web'] },
   { label: 'Surfaces & Cloud', categories: ['surfaces', 'mcp', 'cloudflare'] },
-  { label: 'Automation', categories: ['batch', 'automation', 'watchers', 'orchestration', 'wrfc'] },
+  { label: 'Automation', categories: ['batch', 'automation', 'watchers', 'orchestration', 'planner', 'wrfc'] },
   { label: 'Runtime & Data', categories: ['storage', 'sandbox', 'runtime', 'cache', 'telemetry'] },
   { label: 'Advanced', categories: ['flags', 'release', 'danger'] },
 ];

package/src/main.ts

@@ -34,15 +34,9 @@ import { bootstrapRuntime } from './runtime/bootstrap.ts';
 import type { BootstrapContext } from './runtime/bootstrap.ts';
 import { buildSharedOrchestratorCoreServices } from './runtime/orchestrator-core-services.ts';
 import type { HITLMode } from '@pellux/goodvibes-sdk/platform/state';
-import {
-  checkRecoveryFile,
-  deleteRecoveryFile,
-  loadRecoveryConversation,
-  readLastSessionPointer,
-  writeRecoveryFile,
-} from '@/runtime/index.ts';
+import { readLastSessionPointer, writeRecoveryFile } from '@/runtime/index.ts';
 import { handleBlockingShellInput, type PendingPermissionState } from './shell/blocking-input.ts';
-import { createPersistRecoverySnapshot, createReopenRecoveryPanels, handleErrorAffordanceKey } from './shell/recovery-input-helpers.ts';
+import { createPersistRecoverySnapshot, createRecoveryFileOps, createReopenRecoveryPanels, handleErrorAffordanceKey, resolveStartupRecoveryInfo } from './shell/recovery-input-helpers.ts';
 import { wireShellUiOpeners } from './shell/ui-openers.ts';
 import { deriveComposerState } from './core/composer-state.ts';
 import { buildPersistedSessionContext, formatReturnContextForDisplay, getReturnContextMode, maybeAssistReturnContextSummary } from '@/runtime/index.ts';
@@ -58,6 +52,7 @@ import { installProcessLifecycle } from './runtime/process-lifecycle.ts';
 import { createRenderScheduler } from './runtime/render-scheduler.ts';
 import { buildCommandArgsHint } from './input/command-args-hint.ts';
 import { summarizeRunningAgents } from './renderer/process-summary.ts';
+import { footerFleetCost } from './panels/fleet-read-model.ts';
 import { formatUserFacingErrorLine } from './core/format-user-error.ts';
 import { wireStreamEventMetrics, type StreamMetrics, type WireStreamEventMetricsResult } from './core/stream-event-wiring.ts';
 import { wireTurnEventHandlers } from './core/turn-event-wiring.ts';
@@ -67,12 +62,8 @@ import { createCancelGeneration } from './core/turn-cancellation.ts';
 import { wrapRequestPermissionWithAlert } from './core/approval-alert.ts';
 import { setPanelFrameRequester } from './panels/base-panel.ts';
 
-const ALT_SCREEN_ENTER = '\x1b[?1049h'; const ALT_SCREEN_EXIT  = '\x1b[?1049l';
-const MOUSE_ENABLE     = '\x1b[?1000h\x1b[?1002h\x1b[?1006h'; const MOUSE_DISABLE    = '\x1b[?1006l\x1b[?1002l\x1b[?1000l';
-const CURSOR_HIDE      = '\x1b[?25l'; const CURSOR_SHOW = '\x1b[?25h'; const CLEAR_SCREEN = '\x1b[2J\x1b[3J\x1b[H';
-const KEYBOARD_EXT_ENABLE  = '\x1b[>4;2m' + '\x1b[?1u'; const KEYBOARD_EXT_DISABLE = '\x1b[>4;0m' + '\x1b[?1l';
-const PASTE_ENABLE = '\x1b[?2004h'; const PASTE_DISABLE = '\x1b[?2004l';
-const FOCUS_ENABLE     = '\x1b[?1004h'; const FOCUS_DISABLE    = '\x1b[?1004l';
+import { ALT_SCREEN_ENTER, ALT_SCREEN_EXIT, MOUSE_ENABLE, MOUSE_DISABLE, CURSOR_HIDE, CURSOR_SHOW, CLEAR_SCREEN, KEYBOARD_EXT_ENABLE, KEYBOARD_EXT_DISABLE, PASTE_ENABLE, PASTE_DISABLE, FOCUS_ENABLE, FOCUS_DISABLE } from './renderer/terminal-escapes.ts';
+import { installBackgroundThemeProbe } from './renderer/terminal-bg-probe.ts';
 
 async function main() {
   const stdout = process.stdout;
@@ -213,6 +204,8 @@ async function main() {
   let recoveryInterval: ReturnType<typeof setInterval> | null = null;
   let stopSpokenOutputForExit: (() => void) | null = null;
   let recoveryPending = false;
+  // Which file the current recovery prompt should load/delete from (see recovery-input-helpers.ts).
+  let recoverySource: 'live' | 'preserved' = 'live';
 
   const lifecycle = installProcessLifecycle({
     stdin,
@@ -392,7 +385,7 @@ async function main() {
       },
       sessions: {
         sessionManager: ctx.services.sessionManager,
-        sessionBroker: ctx.services.sessionBroker,
+        sessionBroker: uiServices.sessions.sessionBroker,
         sessionOrchestration: ctx.services.sessionOrchestration,
         sessionMemoryStore: ctx.services.sessionMemoryStore,
       },
@@ -477,7 +470,7 @@ async function main() {
           .slice(0, promptInfo.visibleCursorLine)
           .reduce((sum: number, line: string) => sum + line.length + 1, 0) + promptInfo.visibleCursorCol
         : undefined,
-      usage: { up: orchestrator.usage.input, down: orchestrator.usage.output },
+      usage: { up: orchestrator.usage.input, down: orchestrator.usage.output, fleetCostUsd: footerFleetCost(() => ctx.services.processRegistry.query().nodes, runningAgentCount > 0) },
       showExitNotice: input.showExitNotice,
       lastCopyTime: input.lastCopyTime,
       model: runtime.model,
@@ -504,8 +497,8 @@ async function main() {
       lastInputTokens: orchestrator.lastInputTokens,
       commandArgsHint,
       hitlMode: modeManager.getHITLMode(),
-      runningAgentCount,
-      runningProcessCount,
+      // S3d: cross-surface spine posture segment (adopted-daemon mode only).
+      sessionSpineStatus: (() => { const s = uiServices.platform.externalServices?.inspect(); return s?.sessionSpineActive && s.sessionSpineStatus && s.sessionSpineStatus !== 'unknown' ? s.sessionSpineStatus : undefined; })(), runningAgentCount, runningProcessCount,
       // Composer must not read as focused while the panel/process indicator owns keyboard focus.
       promptFocused: !input.panelFocused && !input.indicatorFocused,
       indicatorFocused: input.indicatorFocused,
@@ -552,7 +545,7 @@ async function main() {
     // Calculate how many rows are consumed by overlays (thinking, permissions, queue, file picker)
     let overlayRows = 0;
     if (orchestrator.isThinking) overlayRows += 2; // spinner + blank
-    if (pendingPermission) overlayRows += PermissionPromptUI.getPromptHeight(pendingPermission, pendingPermission.hunkState);
+    if (pendingPermission) overlayRows += PermissionPromptUI.getPromptHeight(pendingPermission, pendingPermission.hunkState, pendingPermission.detailsExpanded);
     overlayRows += orchestrator.messageQueue.length * 3; // queued messages
     // File picker and model picker overlay rows computed from actual rendered line count below
     // Selection modal overlay rows are computed from actual rendered line count below
@@ -591,6 +584,7 @@ async function main() {
         turnElapsedMs,
         streamMetrics.ttftMs,
         stallInfo,
+        pendingPermission !== null,
       );
       viewport.push(...thinking);
       // Live tool timer: render the currently executing tool row with ticking elapsed.
@@ -601,7 +595,7 @@ async function main() {
     }
 
     if (pendingPermission) {
-      viewport.push(...PermissionPromptUI.createPromptLines(conversationWidth, pendingPermission, pendingPermission.hunkState));
+      viewport.push(...PermissionPromptUI.createPromptLines(conversationWidth, pendingPermission, pendingPermission.hunkState, pendingPermission.detailsExpanded));
     }
 
     orchestrator.messageQueue.forEach(msg => {
@@ -648,8 +642,8 @@ async function main() {
     });
   };
   const renderScheduler = createRenderScheduler(renderNow); // WO-208 same-tick coalescer
-  const render = (): void => renderScheduler.schedule();
-  const terminalOutputGuard = installTuiTerminalOutputGuard({ stdout, stderr: process.stderr, notify: (message) => { systemMessageRouter.low(message); render(); } });
+  const render = (): void => renderScheduler.schedule(); // captured direct writes → activity log + quiet /debug counter, not repeated transcript lines (UX-B 1a)
+  const terminalOutputGuard = installTuiTerminalOutputGuard({ stdout, stderr: process.stderr, onCapture: (total) => { commandContext.session.runtime.terminalWritesIntercepted = total; render(); } });
 
   setRenderRequest(renderNow); // bootstrap's 16ms coalescer calls the composite directly
   setPanelFrameRequester(render); // live panels repaint when idle (Wave-6 replay: fleet sat stale until keypress)
@@ -711,6 +705,7 @@ async function main() {
     events: uiServices.events, orchestrator, providerRegistry,
     systemMessageRouter, render, metrics: streamMetrics,
     providerOptimizer: ctx.services.providerOptimizer, costLookup: providerRegistry, retryTurn,
+    isApprovalPending: () => pendingPermission !== null,
   });
   unsubs.push(...streamResult.unsubs);
   // Activate one-key retry affordance when a user-visible error surfaces.
@@ -734,15 +729,18 @@ async function main() {
   stdin.resume();
   stdin.setEncoding('utf8');
   allowTerminalWrite(() => stdout.write((cli.flags.noAltScreen ? '' : ALT_SCREEN_ENTER) + CLEAR_SCREEN + CURSOR_HIDE + MOUSE_ENABLE + KEYBOARD_EXT_ENABLE + PASTE_ENABLE + FOCUS_ENABLE));
+  // DEBT-2: forced dark/light applies before first paint; auto (TTY only) fires the
+  // OSC 11 probe and repaints once if light wins. filterInput strips the reply from stdin.
+  const themeProbe = installBackgroundThemeProbe({ configManager, isTTY: Boolean(stdout.isTTY), env: process.env, writeQuery: (b) => allowTerminalWrite(() => stdout.write(b)), requestRepaint: () => { compositor.resetDiff(); render(); } });
 
   applyInitialTuiCliState({ cli, input, commandRegistry, commandContext, shellPaths: ctx.services.shellPaths, render });
 
-  stdin.on('data', (data: string) => {
+  stdin.on('data', (raw: string) => {
+    const data = themeProbe.filterInput(raw); if (data.length === 0) return;
     const blocking = handleBlockingShellInput({
       data, pendingPermission, recoveryPending, conversation, systemMessageRouter, render,
       abortTurn: () => orchestrator.abort(),
-      loadRecoveryConversation: () => loadRecoveryConversation({ homeDirectory }),
-      deleteRecoveryFile: () => deleteRecoveryFile({ homeDirectory }),
+      ...createRecoveryFileOps(() => recoverySource, { homeDirectory }),
       homeDirectory, sessionId: runtime.sessionId,
       persistSnapshot: createPersistRecoverySnapshot({ sessionManager: ctx.services.sessionManager, runtime, conversation }),
       reopenPanels: createReopenRecoveryPanels({ panelManager, render }),
@@ -769,9 +767,10 @@ async function main() {
   conversation.rebuildHistory();
   render();
 
-  // --- Crash recovery check ---
-  const recoveryInfo = checkRecoveryFile({ workingDirectory: workingDir, homeDirectory });
+  // --- Crash recovery check (also checks the preserve-on-dismiss sibling; see recovery-input-helpers.ts) ---
+  const recoveryInfo = resolveStartupRecoveryInfo({ workingDirectory: workingDir, homeDirectory });
   if (recoveryInfo) {
+    recoverySource = recoveryInfo.source;
     systemMessageRouter.high(`[Recovery] Found unsaved session from ${new Date(recoveryInfo.timestamp).toLocaleString()}. Title: "${recoveryInfo.title}". Press Ctrl+R to restore, Esc to discard, or start typing to ignore it.`);
     for (const line of formatReturnContextForDisplay(recoveryInfo.returnContext)) {
       systemMessageRouter.low(`[Recovery] ${line}`);
@@ -782,6 +781,8 @@ async function main() {
 
   // --- Auto-save to recovery file every 60s ---
   recoveryInterval = setInterval(() => {
+    // Skip while an earlier recovery prompt is unresolved (avoids racing preserve-on-dismiss).
+    if (recoveryPending) return;
     const snapshot = conversation.toJSON() as { messages: Array<import('./core/conversation.ts').ConversationMessageSnapshot> };
     const persisted = buildPersistedSessionContext(snapshot.messages, conversation.getTitleSource(), buildSessionContinuityHints());
     writeRecoveryFile(

package/src/panels/builtin/shared.ts

@@ -4,7 +4,8 @@ import type { ToolRegistry } from '@pellux/goodvibes-sdk/platform/tools';
 import type { ProviderRegistry } from '@pellux/goodvibes-sdk/platform/providers';
 import type { Orchestrator } from '../../core/orchestrator';
 import type { MemoryRegistry } from '@pellux/goodvibes-sdk/platform/state';
-import type { ApprovalBroker, SharedSessionBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { ApprovalBroker } from '@pellux/goodvibes-sdk/platform/control-plane';
+import type { SessionReadFacade } from '@pellux/goodvibes-sdk/platform/runtime/session-spine';
 import type { AutomationManager } from '@pellux/goodvibes-sdk/platform/automation';
 import type { ControlPlaneRecentEvent } from '@pellux/goodvibes-sdk/platform/control-plane';
 import type { UiRuntimeServices } from '../../runtime/ui-services.ts';
@@ -84,8 +85,13 @@ export interface BuiltinPanelDeps {
   policyRuntimeState?: import('@/runtime/index.ts').PolicyRuntimeState;
   /** Approval broker for control-plane/operator panels. */
   approvalBroker?: ApprovalBroker;
-  /** Shared session broker for control-plane/operator panels. */
-  sessionBroker?: SharedSessionBroker;
+  /**
+   * S3d: cross-surface session READ facade for control-plane/operator panels.
+   * Sync listSessions()/getSession() shape preserved; in adopted-daemon mode it
+   * serves the daemon-hosted union (with an honest offline note when the wire is
+   * down) instead of only this process's local broker. See session-union-cache.ts.
+   */
+  sessionBroker?: SessionReadFacade;
   /** Automation manager for schedule/operator panels. */
   automationManager?: AutomationManager;
   /** Recent control-plane events provider for control-plane/operator panels. */

package/src/panels/fleet-deep-link.ts

@@ -0,0 +1,31 @@
+// ---------------------------------------------------------------------------
+// fleet-deep-link.ts — DEBT-5 item 4.
+//
+// PanelManager.open('fleet', pane, target) hands FleetPanel a
+// PanelDeepLinkTarget (a process id + optional ProcessKind) so a cross-panel
+// jump (the work-plan modal's 'i'/'w' agent/WRFC-chain jumps, the docs
+// modal's tools-tab Enter) can select + reveal a SPECIFIC node instead of
+// just opening Fleet generically. Extracted from fleet-panel.ts (already at
+// the 800-line architecture cap) so the panel stays a thin caller.
+//
+// `kind`, when given, must also match: ProcessNode ids are unique per the
+// SDK's own contract, so this is a cheap extra honesty check, not the
+// primary lookup key. Reveal is "free" once selectedIndex is set —
+// ScrollableListPanel's render-time scroll-window resolution keeps the
+// selected row visible, so FleetPanel.receiveDeepLink does not need its own
+// scroll math.
+//
+// A target that isn't found (pruned, killed, never existed, or a domain —
+// like the docs Tools tab's static tool definitions — that has no
+// corresponding fleet node at all) resolves to -1; the caller degrades
+// honestly (FleetPanel.setError('node no longer present.')) rather than
+// silently landing on an unrelated row.
+// ---------------------------------------------------------------------------
+
+import type { PanelDeepLinkTarget } from './types.ts';
+import type { FleetTreeRow } from './fleet-read-model.ts';
+
+/** The row index matching `target`'s id (+ kind, if given), or -1. Pure — no I/O, no mutation. */
+export function resolveFleetDeepLinkIndex(rows: readonly FleetTreeRow[], target: PanelDeepLinkTarget): number {
+  return rows.findIndex((row) => row.node.id === target.id && (!target.kind || row.node.kind === target.kind));
+}

package/src/panels/fleet-panel-format.ts

@@ -0,0 +1,62 @@
+// ---------------------------------------------------------------------------
+// fleet-panel-format.ts
+//
+// Pure column-layout + cell-formatting helpers for FleetPanel's tree rows.
+// Extracted from fleet-panel.ts (S3b hygiene) to hold that file under the
+// 800-line architecture cap; these are stateless functions the panel's
+// renderItem/renderDetail call, with no `this` dependency.
+// ---------------------------------------------------------------------------
+
+import type { ProcessCostState, ProcessUsage } from '@pellux/goodvibes-sdk/platform/runtime/fleet';
+import { formatAgentCost } from './agent-inspector-shared.ts';
+import { DEFAULT_PANEL_PALETTE, type ColumnSpec, type PanelPalette } from './polish.ts';
+import { fleetUsageTokens, hasFleetCost, type FleetStateTone } from './fleet-read-model.ts';
+
+// Column widths for the tree row layout. `label` absorbs whatever width is
+// left over after the fixed columns + gaps; on hostile (narrow) widths the
+// trailing columns simply clip (buildAlignedRow/buildSelectablePanelLine stop
+// writing once a cell would overflow the row) rather than throwing or
+// wrapping — the tree stays readable, just denser.
+const KIND_W = 8;
+const ELAPSED_W = 7;
+const TOKENS_W = 7;
+const COST_W = 8;
+const ACTIVITY_W = 20;
+const GAP = 1;
+const FIXED_W = 1 /* glyph */ + KIND_W + ELAPSED_W + TOKENS_W + COST_W + ACTIVITY_W + GAP * 6;
+
+export function planColumns(width: number): ColumnSpec[] {
+  const labelWidth = Math.max(10, width - FIXED_W);
+  return [
+    { width: 1 },
+    { width: KIND_W },
+    { width: labelWidth },
+    { width: ELAPSED_W, align: 'right' },
+    { width: TOKENS_W, align: 'right' },
+    { width: COST_W, align: 'right' },
+    { width: ACTIVITY_W },
+  ];
+}
+
+export function toneColor(tone: FleetStateTone, palette: PanelPalette): string {
+  switch (tone) {
+    case 'active': return palette.info ?? DEFAULT_PANEL_PALETTE.info;
+    case 'success': return palette.good ?? DEFAULT_PANEL_PALETTE.good;
+    case 'failure': return palette.bad ?? DEFAULT_PANEL_PALETTE.bad;
+    case 'warn': return palette.warn ?? DEFAULT_PANEL_PALETTE.warn;
+    case 'muted': return palette.dim;
+  }
+}
+
+export function formatFleetTokens(usage: ProcessUsage | undefined): string {
+  const total = fleetUsageTokens(usage);
+  if (total === null) return 'n/a';
+  return total >= 1000 ? `${(total / 1000).toFixed(1)}k` : String(total);
+}
+
+/** Honest cost display: never a fabricated $0.00 — 'unpriced' when costState says so. */
+export function formatFleetCost(costUsd: number | null | undefined, costState: ProcessCostState): string {
+  if (!hasFleetCost(costUsd, costState)) return 'unpriced';
+  const formatted = formatAgentCost(costUsd as number);
+  return costState === 'estimated' ? `~${formatted}` : formatted;
+}

package/src/panels/fleet-panel-worktree-detail.ts

@@ -0,0 +1,48 @@
+// ---------------------------------------------------------------------------
+// fleet-panel-worktree-detail.ts
+//
+// NET-NEW helper (not moved code — it was authored here because fleet-panel.ts
+// sits at the architecture check's 800-line cap, scripts/check-architecture.ts):
+// a single pure helper for the Fleet panel's per-work-item detail view, so a
+// new panel feature doesn't have to fight that cap inline.
+// ---------------------------------------------------------------------------
+
+import type { WorkItem } from '@pellux/goodvibes-sdk/platform/orchestration';
+
+/**
+ * Per-item worktree-isolation detail text for the Fleet panel's expanded
+ * node detail (fleet-panel.ts renderDetail), or null for a shared-isolation
+ * item (or any node that isn't a work item). Inferred from the item's OWN
+ * fields (worktreePath/worktreeBranch/mergeState) rather than a
+ * workstream-level flag — adaptWorkItem's ProcessNode.raw carries
+ * `{ item, workstreamId }`, not the full Workstream, and these fields are
+ * set ONLY when the owning workstream's isolation is 'worktree'
+ * (engine.ts/worktree-isolation.ts, SDK), so they are a reliable
+ * self-contained signal with no fleet-adapter change needed.
+ */
+export function formatWorkItemIsolationDetail(item: WorkItem): string | null {
+  const isolated = item.worktreePath !== undefined || item.worktreeBranch !== undefined || item.mergeState !== undefined;
+  if (!isolated) return null;
+  switch (item.mergeState) {
+    case 'merged':
+      // Papercut sweep item 3: worktree-isolation items whose integration had
+      // no changes to merge (mergeState 'merged', mergeHash undefined — a
+      // documented cosmetic case, not an error) used to read as a bare/awkward
+      // "merged (nothing to merge)". "merged (no changes)" says the same thing
+      // in the same shape as the other merge-state phrases below.
+      return item.mergeHash ? `worktree — merged ${item.mergeHash.slice(0, 12)}` : 'worktree — merged (no changes)';
+    case 'conflict':
+      return 'worktree — merge-conflict (kept for inspection)';
+    case 'pending':
+      return 'worktree — merge pending';
+    case 'n-a':
+    default:
+      return item.worktreeKept ? 'worktree — kept' : 'worktree — not yet integrated';
+  }
+}
+
+/** `node.raw` for a 'work-item' ProcessNode is `{ item, workstreamId }` (unknown to the panel's own types) — this narrows without fleet-panel.ts needing its own WorkItem import at the call site. Non-work-item nodes (raw is undefined/some other shape) fall through to null. */
+export function formatWorkItemIsolationDetailFromRaw(raw: unknown): string | null {
+  const item = (raw as { item?: WorkItem } | undefined)?.item;
+  return item ? formatWorkItemIsolationDetail(item) : null;
+}