@pellux/goodvibes-tui 1.7.0 → 1.9.1

package/src/runtime/workstream-services.ts

@@ -31,11 +31,22 @@
 import {
   createOrchestrationEngine,
   fromChainSpec,
+  fromPlanProposal,
   type CreateWorkstreamInput,
   type OrchestrationEngine,
+  type WorkstreamIsolation,
 } from '@pellux/goodvibes-sdk/platform/orchestration';
 export type { OrchestrationEngine } from '@pellux/goodvibes-sdk/platform/orchestration';
-import { AdaptivePlanner, type DecompositionGate, type PlannerInputs } from '@pellux/goodvibes-sdk/platform/core';
+import {
+  AdaptivePlanner,
+  decomposeGoal,
+  type DecompositionGate,
+  type DecompositionServiceConfig,
+  type DecomposeGoalResult,
+  type PlannerInputs,
+  type PlanProposal,
+} from '@pellux/goodvibes-sdk/platform/core';
+import { createAgentManagerDecompositionRunner } from '@pellux/goodvibes-sdk/platform/agents';
 import type { ConfigManager } from '@pellux/goodvibes-sdk/platform/config';
 import type { AgentManager } from '@pellux/goodvibes-sdk/platform/tools';
 import type { RuntimeEventBus } from '@/runtime/index.ts';
@@ -49,12 +60,31 @@ export interface WorkstreamServicesDeps {
   readonly projectRoot: string;
 }
 
+/**
+ * Honest provenance for how a draft's decomposition was produced. Derived from
+ * the SDK decomposition service's outcome so the draft render can state plainly
+ * whether a planning agent decomposed the goal, or the heuristic path did (and
+ * if so, why).
+ */
+export interface WorkstreamDraftProvenance {
+  readonly kind: 'agent' | 'heuristic-configured' | 'gate-declined' | 'fallback';
+  readonly itemCount: number;
+  readonly agentCostUsd?: number | undefined;
+  readonly agentTokens?: number | undefined;
+  readonly elapsedMs?: number | undefined;
+  readonly fallbackReason?: string | undefined;
+}
+
 /** A not-yet-launched /workstream proposal. See this file's header doc for why it lives here rather than on the engine. */
 export interface WorkstreamDraft {
   readonly id: string;
   task: string;
   spec: CreateWorkstreamInput;
   readonly gate: DecompositionGate;
+  /** The engine-agnostic decomposition proposal (model- or heuristic-produced). */
+  proposal: PlanProposal;
+  /** How that proposal came to be, for honest rendering. */
+  provenance: WorkstreamDraftProvenance;
   approved: boolean;
   readonly createdAt: number;
 }
@@ -62,11 +92,12 @@ export interface WorkstreamDraft {
 /** `ctx.session.workstreamEngine`'s real shape: the live engine plus the draft-proposal bookkeeping the engine itself has no concept of. */
 export interface WorkstreamCommandService {
   readonly engine: OrchestrationEngine;
-  proposeDraft(task: string): WorkstreamDraft;
+  /** Spawn a bounded read-only planning agent to decompose the goal (with automatic heuristic fallback), then hold the draft. Async because the planning agent is real. `isolation` omitted ⇒ the engine's own default ('shared'); see CreateWorkstreamInput.isolation (SDK). */
+  proposeDraft(task: string, isolation?: WorkstreamIsolation): Promise<WorkstreamDraft>;
   getDraft(id: string): WorkstreamDraft | undefined;
   listDrafts(): WorkstreamDraft[];
-  /** Re-derive a held draft's spec from a new task string. Clears any prior approval — an edit must be re-approved. */
-  editDraft(id: string, task: string): WorkstreamDraft | undefined;
+  /** Re-derive a held draft's spec + decomposition from a new task string. Clears any prior approval — an edit must be re-approved. `isolation` omitted ⇒ keeps the draft's current choice (an edit that only changes the task text must not silently reset isolation back to shared). */
+  editDraft(id: string, task: string, isolation?: WorkstreamIsolation): Promise<WorkstreamDraft | undefined>;
   approveDraft(id: string): WorkstreamDraft | undefined;
   removeDraft(id: string): boolean;
   /** Materialize an approved draft into a real, running Workstream (engine.createWorkstream + start), then drop the draft. Null when the draft is missing or not approved. */
@@ -95,41 +126,130 @@ function buildPlannerInputs(task: string): PlannerInputs {
   };
 }
 
+/**
+ * Read the planner decomposition config (mode + bounds) from the config
+ * manager, defensively defaulting anything missing or invalid. Real config
+ * always supplies the DEFAULT_CONFIG values; these fallbacks matter only for a
+ * partially-stubbed config manager, and guarantee finite positive bounds so a
+ * planning-agent poll can never loop forever on a NaN deadline.
+ */
+function readDecompositionConfig(configManager: Pick<ConfigManager, 'get'>): DecompositionServiceConfig {
+  const num = (value: unknown, fallback: number): number =>
+    typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : fallback;
+  return {
+    mode: configManager.get('planner.decomposition') === 'heuristic' ? 'heuristic' : 'agent',
+    bounds: {
+      maxTurns: num(configManager.get('planner.maxTurns'), 6),
+      tokenCeiling: num(configManager.get('planner.tokenCeiling'), 120_000),
+      wallTimeoutMs: num(configManager.get('planner.wallTimeoutMs'), 60_000),
+    },
+  };
+}
+
+/** Honest cost estimator: prices the planning agent's tokens only when the
+ *  session's default model is one we actually have pricing for; otherwise the
+ *  render falls back to a raw token count. Never throws. */
+function makeCostEstimator(configManager: Pick<ConfigManager, 'get'>): (usage: { inputTokens: number; outputTokens: number; cacheReadTokens?: number | undefined; cacheWriteTokens?: number | undefined }) => number | undefined {
+  return (usage) => {
+    try {
+      const model = configManager.get('provider.model') as unknown as string | undefined;
+      if (!model || !isModelPriced(model)) return undefined;
+      return calcSessionCost(usage.inputTokens, usage.outputTokens, usage.cacheReadTokens ?? 0, usage.cacheWriteTokens ?? 0, model);
+    } catch {
+      return undefined;
+    }
+  };
+}
+
+function toProvenance(result: DecomposeGoalResult): WorkstreamDraftProvenance {
+  const p = result.proposal;
+  const kind: WorkstreamDraftProvenance['kind'] =
+    result.outcome.kind === 'agent' ? 'agent'
+      : result.outcome.kind === 'heuristic-configured' ? 'heuristic-configured'
+        : result.outcome.kind === 'gate-declined' ? 'gate-declined'
+          : 'fallback';
+  return {
+    kind,
+    itemCount: p.workItems.length,
+    ...(p.agentCostUsd !== undefined ? { agentCostUsd: p.agentCostUsd } : {}),
+    ...(p.agentUsage ? { agentTokens: p.agentUsage.totalTokens } : {}),
+    ...(p.elapsedMs !== undefined ? { elapsedMs: p.elapsedMs } : {}),
+    ...(p.fallbackReason ? { fallbackReason: p.fallbackReason } : {}),
+  };
+}
+
 function createWorkstreamCommandService(
   engine: OrchestrationEngine,
   adaptivePlanner: AdaptivePlanner,
   configManager: Pick<ConfigManager, 'get' | 'getCategory'>,
+  agentManager: Pick<AgentManager, 'spawn' | 'getStatus' | 'cancel'>,
+  projectRoot: string,
 ): WorkstreamCommandService {
   const drafts = new Map<string, WorkstreamDraft>();
 
   /**
-   * fromChainSpec is the SDK's own bridge from "a task string" to a real,
-   * launchable engineer -> review CreateWorkstreamInput — the same two-phase
-   * shape WrfcController.createChain would otherwise start (see
-   * controller-compat.ts). AdaptivePlanner.proposeWorkstream's own
-   * PlanProposal is deliberately NOT used for the rendered shape: it always
-   * degrades to a fictional single-phase fallback in this wave (nothing yet
-   * supplies it a `raw` LLM decomposition — no planning-agent-spawn pipeline
-   * exists in the shipped SDK surface this item compiles against), which
-   * would silently disagree with what launchDraft actually creates. Showing
-   * the real fromChainSpec shape keeps the proposal and the launch
-   * byte-for-byte the same plan. proposeWorkstream is still called (below)
-   * for its `gate` — the real strategy/reason-code rationale — which stays
-   * meaningful even without a raw decomposition.
+   * Run the SDK decomposition service: it spawns a bounded, read-only planning
+   * agent (which surfaces in the fleet like any agent — kill/steer reach it,
+   * and a kill lands as a 'cancelled' fallback) and validates its structured
+   * output, or falls back to the heuristic single-item path on any failure.
+   * The returned proposal is engine-agnostic; the launchable `spec` is still
+   * derived by `buildSpec` (see below).
+   */
+  async function decompose(task: string): Promise<DecomposeGoalResult> {
+    const runner = createAgentManagerDecompositionRunner({ agentManager });
+    return decomposeGoal(
+      { goal: task, workingDir: projectRoot, constraints: {} },
+      adaptivePlanner,
+      buildPlannerInputs(task),
+      readDecompositionConfig(configManager),
+      runner,
+      { estimateCostUsd: makeCostEstimator(configManager) },
+    );
+  }
+
+  /**
+   * Derive the launchable CreateWorkstreamInput from the decomposition
+   * proposal (BIG-3 — the final stage of the WRFC→orchestration migration).
+   *
+   * THE BOUNDARY, stated honestly (and in the /workstream help + draft render):
+   *  - A genuinely MULTI-ITEM proposal (the planning agent decomposed the goal
+   *    into >1 work item) is assembled by the SDK's fromPlanProposal into the
+   *    REAL multi-item workstream: one engineer→review-phased item per proposal
+   *    item, inter-item dependencies preserved as scheduling constraints, and
+   *    workstream-level provenance carried. This is the plan the engine runs —
+   *    no flattening.
+   *  - A SINGLE-ITEM proposal (the heuristic single-item path, a gate-decline,
+   *    or an agent that honestly returned one item) keeps the fromChainSpec
+   *    COMPAT path: byte-for-byte the same engineer→review chain
+   *    WrfcController.createChain would start. A single item carries no
+   *    dependencies and no multi-item structure, so the proposal mapping would
+   *    add nothing — the compat path is the honest, unchanged choice.
+   *
+   * Earlier waves always took the compat path because no planning-agent-spawn
+   * pipeline existed to produce a real multi-item decomposition; BIG-2 landed
+   * that pipeline, so `result.proposal` can now be a real multi-item plan and
+   * this maps it faithfully. The rendered draft shows THIS spec, so the
+   * proposal preview and the launch are always the same plan.
    */
-  function buildSpec(task: string): CreateWorkstreamInput {
+  function buildSpec(task: string, proposal: PlanProposal): CreateWorkstreamInput {
+    if (proposal.workItems.length > 1) {
+      return fromPlanProposal(proposal, configManager);
+    }
     return fromChainSpec({ id: `item-${crypto.randomUUID().slice(0, 8)}`, task }, configManager);
   }
 
   return {
     engine,
-    proposeDraft(task: string): WorkstreamDraft {
-      const { gate } = adaptivePlanner.proposeWorkstream(buildPlannerInputs(task));
+    async proposeDraft(task: string, isolation?: WorkstreamIsolation): Promise<WorkstreamDraft> {
+      const result = await decompose(task);
+      const spec = buildSpec(task, result.proposal);
       const draft: WorkstreamDraft = {
         id: `wsd_${crypto.randomUUID().slice(0, 8)}`,
         task,
-        spec: buildSpec(task),
-        gate,
+        spec: isolation ? { ...spec, isolation } : spec,
+        gate: result.gate,
+        proposal: result.proposal,
+        provenance: toProvenance(result),
         approved: false,
         createdAt: Date.now(),
       };
@@ -138,11 +258,15 @@ function createWorkstreamCommandService(
     },
     getDraft: (id) => drafts.get(id),
     listDrafts: () => Array.from(drafts.values()).sort((a, b) => a.createdAt - b.createdAt),
-    editDraft(id, task) {
+    async editDraft(id, task, isolation) {
       const draft = drafts.get(id);
       if (!draft) return undefined;
+      const result = await decompose(task);
+      const nextIsolation = isolation ?? draft.spec.isolation;
       draft.task = task;
-      draft.spec = buildSpec(task);
+      draft.spec = { ...buildSpec(task, result.proposal), isolation: nextIsolation };
+      draft.proposal = result.proposal;
+      draft.provenance = toProvenance(result);
       draft.approved = false;
       return draft;
     },
@@ -169,9 +293,11 @@ function createWorkstreamCommandService(
  * facade. `persist` and `createWorktree` are left at the engine's own
  * defaults: journal-backed snapshots under .goodvibes/orchestration/ (so
  * resumeAllFromDisk below has something to resume) and a plain
- * AgentWorktree(projectRoot) — the same "shared working directory, no real
- * per-item isolation" behavior WrfcController itself uses today (see
- * phase-runner.ts's own REALITY-WINS divergence doc in the SDK).
+ * AgentWorktree(projectRoot) for the (default) `shared`-isolation path.
+ * A draft's `isolation: 'worktree'` (see /workstream create --isolation
+ * worktree, input/commands/workstream-runtime.ts) opts a single workstream
+ * into the SDK's per-item git-worktree isolation (WorktreeIsolationManager,
+ * engine-side) instead — the engine, not this facade, owns that lifecycle.
  */
 export function createWorkstreamServices(deps: WorkstreamServicesDeps): WorkstreamServices {
   const orchestrationEngine = createOrchestrationEngine({
@@ -190,6 +316,12 @@ export function createWorkstreamServices(deps: WorkstreamServicesDeps): Workstre
   // restart. Never throws — persistence.ts guards every read/parse and
   // quarantines an unrecognized snapshot rather than propagating.
   orchestrationEngine.resumeAllFromDisk();
-  const workstreamCommands = createWorkstreamCommandService(orchestrationEngine, deps.adaptivePlanner, deps.configManager);
+  const workstreamCommands = createWorkstreamCommandService(
+    orchestrationEngine,
+    deps.adaptivePlanner,
+    deps.configManager,
+    deps.agentManager,
+    deps.projectRoot,
+  );
   return { orchestrationEngine, workstreamCommands };
 }

package/src/runtime/wrfc-persistence.ts

@@ -1,6 +1,8 @@
 /**
  * WRFC chain persistence — snapshot active chains to disk on every lifecycle
- * event so that a crash/restart can surface interrupted chains to the operator.
+ * event so that a crash/restart can surface interrupted chains to the operator,
+ * and so that terminal chains (passed/failed/cancelled) remain visible as
+ * bounded history rather than vanishing the moment they finish.
  *
  * Architecture
  * ─────────────
@@ -16,11 +18,27 @@
  *    row and can be resumed by the operator. The `interruptedChains` accessor
  *    additionally exposes the recovered set for inspection.
  *
- * 3. Snapshot lifecycle:
- *    - Terminal chains ('passed' | 'failed') are pruned from the snapshot
- *      after rehydration surfaces them.
- *    - A corrupt or version-mismatched snapshot is quarantined by renaming it
- *      to `<path>.unrecognized` — never a hard crash.
+ *    A chain that looked interrupted (non-terminal) in the old snapshot can be
+ *    reaped to terminal IN PLACE by `WrfcController.importChain` (Wave 6, wo-F:
+ *    no member agent survived the restart — see wrfc-controller.ts). This
+ *    module always re-checks `chain.state` AFTER the import call, never the
+ *    pre-import classification, so a reaped chain is treated as history, not
+ *    re-surfaced as interrupted and never re-imported again on a later restart.
+ *
+ * 3. Terminal-history retention (bounded, most-recently-completed first):
+ *    Previously, every terminal chain was pruned from the snapshot the moment
+ *    it was written or rehydrated — a killed/finished chain vanished from
+ *    wrfc-chains.json entirely, including across a restart, so nothing could
+ *    ever honestly report "last chain: <state>". Terminal chains are now
+ *    RETAINED, capped at MAX_TERMINAL_HISTORY (20) most-recently-completed,
+ *    both:
+ *      - across a live session, via an internal history cache that survives
+ *        even after WrfcController's own in-memory cleanup (60s after a
+ *        chain terminates) drops the chain from listChains(); and
+ *      - across a restart, via rehydrate() seeding that cache from whatever
+ *        was already terminal in the prior snapshot instead of discarding it.
+ *    A corrupt or version-mismatched snapshot is quarantined by renaming it
+ *    to `<path>.unrecognized` — never a hard crash.
  *
  * Snapshot path: `.goodvibes/tui/wrfc-chains.json`
  * Snapshot schema: `{ version: 1, writtenAt: number, chains: WrfcChain[] }`
@@ -37,6 +55,9 @@ import type { SystemMessageRouter } from '../core/system-message-router.ts';
 const SNAPSHOT_VERSION = 1;
 const DEBOUNCE_MS = 250;
 
+/** Bounded terminal-history retention: keep the most recent K chains, prune beyond. */
+const MAX_TERMINAL_HISTORY = 20;
+
 /** Terminal states — chains in these states will not be surfaced as interrupted. */
 const TERMINAL_STATES = new Set<WrfcState>(['passed', 'failed']);
 
@@ -45,6 +66,13 @@ function isNonTerminal(state: WrfcState): boolean {
   return !TERMINAL_STATES.has(state);
 }
 
+/** Sort by most-recently-completed first (falls back to createdAt for chains missing completedAt) and keep only the first `limit`. */
+function takeMostRecentTerminal(chains: readonly WrfcChain[], limit: number): WrfcChain[] {
+  return [...chains]
+    .sort((a, b) => (b.completedAt ?? b.createdAt ?? 0) - (a.completedAt ?? a.createdAt ?? 0))
+    .slice(0, limit);
+}
+
 // ─── Snapshot schema ─────────────────────────────────────────────────────────
 
 interface WrfcSnapshot {
@@ -90,9 +118,19 @@ export interface WrfcPersistence {
    */
   attach(runtimeBus: RuntimeEventBus): Array<() => void>;
 
+  /**
+   * All chains known after rehydrate(): the (re-checked, post-reap) interrupted
+   * set plus the bounded terminal-history cache seeded from the prior snapshot.
+   * Empty until rehydrate() is called. Consumers building a post-restart
+   * summary (e.g. the boot resume notice) read this instead of re-parsing the
+   * snapshot file themselves.
+   */
+  readonly knownChains: readonly WrfcChain[];
+
   /**
    * Read the snapshot from a previous process, surface any interrupted chains
-   * as system messages, and prune terminal chains from the snapshot on disk.
+   * as system messages, and retain terminal chains (bounded, most-recently-
+   * completed first) as on-disk history instead of pruning them.
    *
    * Must be called after the SystemMessageRouter is available.
    */
@@ -111,6 +149,14 @@ class WrfcPersistenceImpl implements WrfcPersistence {
 
   private _interruptedChains: WrfcChain[] = [];
   private _debounceTimer: ReturnType<typeof setTimeout> | null = null;
+  /**
+   * Bounded terminal-history cache (most-recently-completed first once
+   * trimmed). Survives past WrfcController's own in-memory cleanup of
+   * terminated chains (60s after termination — see wrfc-controller.ts
+   * scheduleChainCleanup) so a chain that ages out of listChains() is not
+   * silently dropped from the persisted snapshot.
+   */
+  private _terminalHistory: WrfcChain[] = [];
 
   constructor(options: WrfcPersistenceOptions) {
     this.snapshotPath = options.snapshotPath;
@@ -122,6 +168,10 @@ class WrfcPersistenceImpl implements WrfcPersistence {
     return this._interruptedChains;
   }
 
+  get knownChains(): readonly WrfcChain[] {
+    return [...this._interruptedChains, ...this._terminalHistory];
+  }
+
   attach(runtimeBus: RuntimeEventBus): Array<() => void> {
     const schedule = (): void => this._scheduleSnapshot();
 
@@ -144,17 +194,40 @@ class WrfcPersistenceImpl implements WrfcPersistence {
     const snapshot = this._readSnapshot();
     if (!snapshot) return;
 
-    const interrupted = snapshot.chains.filter((c) => isNonTerminal(c.state));
-    this._interruptedChains = interrupted;
+    // Seed the bounded terminal-history cache from whatever was already
+    // terminal in the prior process's snapshot, so it survives this restart
+    // instead of being wiped (the old behaviour pruned every terminal chain
+    // unconditionally on every rehydrate).
+    const alreadyTerminal = snapshot.chains.filter((c) => !isNonTerminal(c.state));
+    this._terminalHistory = takeMostRecentTerminal(alreadyTerminal, MAX_TERMINAL_HISTORY);
 
-    const router = this.getSystemMessageRouter();
-    for (const chain of interrupted) {
+    const candidateInterrupted = snapshot.chains.filter((c) => isNonTerminal(c.state));
+    for (const chain of candidateInterrupted) {
       // Re-import so the chain reappears in the controller's in-memory map and
       // becomes selectable/resumable from the panel. On a fresh process start
       // the map is empty, so importChain (force=false) never clobbers a live
       // chain. The accessor is optional for read-only test doubles.
+      //
+      // NOTE: importChain may reap this chain to a terminal state IN PLACE
+      // (Wave 6, wo-F zombie-reap: no member agent survived the restart) —
+      // always read chain.state AFTER this call below, never the pre-import
+      // classification captured by candidateInterrupted.
       this.controller.importChain?.(chain);
+    }
+
+    // Re-partition after the reap check: a chain that looked interrupted
+    // before import may now be terminal. Only genuinely still-live chains are
+    // surfaced to the operator as interrupted; anything reaped just now joins
+    // history instead — it is done, not a resurrection candidate, and must
+    // never be handed to importChain again on a future restart (a chain only
+    // ever lands in candidateInterrupted while its persisted state is
+    // non-terminal; once it's history its state is terminal for good).
+    this._interruptedChains = candidateInterrupted.filter((c) => isNonTerminal(c.state));
+    const reapedJustNow = candidateInterrupted.filter((c) => !isNonTerminal(c.state));
+    for (const chain of reapedJustNow) this._upsertHistoryChain(chain);
 
+    const router = this.getSystemMessageRouter();
+    for (const chain of this._interruptedChains) {
       const msg =
         `[WRFC] Chain ${chain.id.slice(0, 12)} (${chain.task.slice(0, 60).trim()}) ` +
         `was interrupted by a restart — state was '${chain.state}' ` +
@@ -162,14 +235,19 @@ class WrfcPersistenceImpl implements WrfcPersistence {
       router?.wrfc(msg, 'high');
     }
 
-    // Prune terminal chains from the on-disk snapshot after surfacing.
-    if (snapshot.chains.length !== interrupted.length) {
-      const pruned: WrfcSnapshot = {
+    // Rewrite the snapshot only when something actually changed: a chain was
+    // reaped just now, or the history cap pruned an entry that was on disk.
+    // Terminal chains are RETAINED (bounded to MAX_TERMINAL_HISTORY, most
+    // recently completed first) instead of erased — post-restart surfaces
+    // (fleet, the resume notice, /wrfc history) need this to honestly report
+    // e.g. "last chain: cancelled".
+    if (reapedJustNow.length > 0 || alreadyTerminal.length !== this._terminalHistory.length) {
+      const rebuilt: WrfcSnapshot = {
         version: SNAPSHOT_VERSION,
         writtenAt: Date.now(),
-        chains: interrupted,
+        chains: [...this._interruptedChains, ...this._terminalHistory],
       };
-      this._writeSnapshot(pruned);
+      this._writeSnapshot(rebuilt);
     }
   }
 
@@ -194,14 +272,43 @@ class WrfcPersistenceImpl implements WrfcPersistence {
   }
 
   private _writeCurrentSnapshot(): void {
+    const live = this.controller.listChains();
+    this._recordTerminalHistory(live);
     const snapshot: WrfcSnapshot = {
       version: SNAPSHOT_VERSION,
       writtenAt: Date.now(),
-      chains: this.controller.listChains(),
+      chains: this._mergeWithHistory(live),
     };
     this._writeSnapshot(snapshot);
   }
 
+  /** Fold any terminal chains in a live listing into the bounded history cache, so they are not lost once WrfcController's own in-memory cleanup drops them from listChains(). */
+  private _recordTerminalHistory(chains: readonly WrfcChain[]): void {
+    for (const chain of chains) {
+      if (!isNonTerminal(chain.state)) this._upsertHistoryChain(chain);
+    }
+  }
+
+  /** Insert/replace `chain` in the terminal-history cache (by id), then trim to MAX_TERMINAL_HISTORY, most-recently-completed first. */
+  private _upsertHistoryChain(chain: WrfcChain): void {
+    const next = this._terminalHistory.filter((c) => c.id !== chain.id);
+    next.push(chain);
+    this._terminalHistory = takeMostRecentTerminal(next, MAX_TERMINAL_HISTORY);
+  }
+
+  /**
+   * Combine the live chains the controller is currently tracking with any
+   * historical terminal chains the live map has already forgotten (e.g. after
+   * WrfcController's own 60s in-memory cleanup) — so the persisted file never
+   * loses a terminal chain just because the live map stopped carrying it.
+   * Live entries win on id collision since they are always the freshest copy.
+   */
+  private _mergeWithHistory(live: readonly WrfcChain[]): WrfcChain[] {
+    const liveIds = new Set(live.map((c) => c.id));
+    const historyOnly = this._terminalHistory.filter((c) => !liveIds.has(c.id));
+    return [...live, ...historyOnly];
+  }
+
   private _writeSnapshot(snapshot: WrfcSnapshot): void {
     try {
       atomicWriteFileSync(this.snapshotPath, JSON.stringify(snapshot), { mkdirp: true });

package/src/shell/blocking-input.ts

@@ -10,6 +10,8 @@ export type PendingPermissionState = PermissionRequest & {
   resolve: (approved: boolean, remember?: boolean, modifiedArgs?: Record<string, unknown>) => void;
   /** Present only when isHunkSelectable(request) was true when the prompt was opened. */
   hunkState?: HunkSelectionState;
+  /** True once the user pressed `d` to expand a condensed low-risk card. (UX-B 2b.) */
+  detailsExpanded?: boolean;
 };
 
 export type BlockingInputHandlerOptions = {
@@ -22,6 +24,15 @@ export type BlockingInputHandlerOptions = {
   render: () => void;
   loadRecoveryConversation: () => SessionSnapshot | null;
   deleteRecoveryFile: () => void;
+  /**
+   * Copy the live recovery.jsonl aside to a preserved sibling so the dismiss
+   * message's promise ("still on disk") survives this session's later 60s
+   * autosaves, which would otherwise overwrite the shared recovery file with
+   * the CURRENT (post-dismiss) session's state (W3 Finding 3). Optional so
+   * every pre-existing test/caller that doesn't care about preservation is
+   * unaffected; when omitted, dismiss behaves exactly as before.
+   */
+  preserveRecoveryFile?: () => { readonly preserved: boolean; readonly replacedPrevious: boolean };
   /**
    * Absolute home directory used to locate the transcript journal for this
    * recovery session. Required for journal replay on Ctrl+R restore.
@@ -68,6 +79,7 @@ export function handleBlockingShellInput(
     render,
     loadRecoveryConversation,
     deleteRecoveryFile,
+    preserveRecoveryFile,
     homeDirectory,
     sessionId,
     persistSnapshot,
@@ -115,6 +127,16 @@ export function handleBlockingShellInput(
       return { handled: true, pendingPermission: null, recoveryPending };
     }
 
+    if (key === 'd') {
+      // Toggle the condensed↔full detail view without resolving the request.
+      render();
+      return {
+        handled: true,
+        pendingPermission: { ...req, detailsExpanded: !req.detailsExpanded },
+        recoveryPending,
+      };
+    }
+
     render();
     return { handled: true, pendingPermission, recoveryPending };
   }
@@ -156,10 +178,31 @@ export function handleBlockingShellInput(
       return { handled: true, pendingPermission: null, recoveryPending: false };
     }
 
-    // Stray key: leave the recovery prompt active so the user can still Ctrl+R or Esc.
-    systemMessageRouter.high('[Recovery] Ctrl+R to restore · Esc to discard');
+    // Any other key demonstrates the user's intent to ignore the banner and
+    // keep working — the prompt's own text invites exactly this ("start
+    // typing to ignore it"). Previously this branch re-posted the same
+    // '[Recovery] Ctrl+R to restore...' line on EVERY such key and never
+    // cleared recoveryPending, so a user who took that invitation got a
+    // fresh [Recovery] line injected into the transcript around every
+    // character they typed, forever. Dismiss ONCE instead: clear
+    // recoveryPending so it stops re-asserting, but do NOT delete the
+    // recovery file — dismiss is not discard, and the file remains
+    // restorable by the automatic recovery check on the next launch.
+    //
+    // W3 Finding 3: the promise below ("still on disk; you will be asked
+    // again") used to go false silently — main.ts's 60s autosave overwrites
+    // the single shared recovery.jsonl with the CURRENT session's state
+    // within a minute. preserveRecoveryFile (when wired) copies it aside
+    // NOW, while it still holds the dismissed session's data, so the
+    // promise stays true. If an earlier dismiss's preserved snapshot gets
+    // replaced by this one, say so honestly instead of silently discarding it.
+    const preserveResult = preserveRecoveryFile?.();
+    if (preserveResult?.replacedPrevious) {
+      systemMessageRouter.low('[Recovery] Replacing the previously preserved (unrestored) snapshot with this one.');
+    }
+    systemMessageRouter.high('[Recovery] Dismissed — the unsaved session is still on disk; you will be asked again next time GoodVibes starts here.');
     render();
-    return { handled: false, pendingPermission, recoveryPending: true };
+    return { handled: false, pendingPermission, recoveryPending: false };
   }
 
   return { handled: false, pendingPermission, recoveryPending };