atom-agent 1.3.0 → 1.5.0

package/dist/App.js

@@ -9,16 +9,20 @@ import { Box, Text, useApp, useInput, usePaste } from "ink";
 import { DEFAULT_MODEL, EFFORT_OPTIONS, FALLBACK_MODELS, LoopCancelledError, buildSystemPrompt, fetchModelsForProviderWithStatus, fetchModelsWithStatus, historyChars, isEffortSupported, messageChars, normalizeEffort, runAgenticLoopForProvider, } from "./zen.js";
 import { createContextManager, trackHistory, } from "./context-manager.js";
 import { assemblePrefix, providerCacheSupport, } from "./prompt-cache.js";
-import { TOOL_DEFINITIONS, TOOL_ONE_LINERS, APPROVAL_PREVIEW_MAX_BYTES, clearTodos, describeToolCall, executeTool, getTodos, needsApproval, previewDiffForApproval, providerSecrets } from "./tools.js";
+import { TOOL_DEFINITIONS, TOOL_ONE_LINERS, APPROVAL_PREVIEW_MAX_BYTES, clearTodos, describeToolCall, executeTool, getTodos, needsApproval, previewDiffForApproval, providerSecrets, todowriteTool } from "./tools.js";
 import { classifyTurnOutcome, createTelemetryRecorder, loadTelemetrySessions, resolveTelemetryEnabled, summarizeTelemetry, telemetryDir, } from "./telemetry.js";
 import { writeTelemetryDashboard } from "./telemetry-dashboard.js";
 import { formatRules, parseRuleInput, } from "./permissions.js";
-import { decidePolicy, skillGrantsFor } from "./policy.js";
+import { decideApproval, skillGrantsFor } from "./policy.js";
 import { capSkillBodyForAuto, createSkillRegistry, loadSkillBody, matchSkills, resolveSkills, } from "./skills.js";
 import { contextWindowFor } from "./context-windows.js";
 import { emptyGoalStats, formatGoalForCompact, goalClearNotice, goalFollowUp, goalPauseNotice, goalResumeNotice, goalSetNotice, goalStatusText, goalTokensForUsage, parseGoalCommand, restoreGoalFromPersist, serializeGoalForPersist, } from "./goal.js";
 import { requestGoalVerdict } from "./agent/goal-evaluator.js";
+import { readSessionTodos, withSessionTodos, } from "./todos.js";
+import { collectTurnFileDiffs, emptyFileDiffs, FILE_DIFFS_METADATA_KEY, mergeFileDiffs, readFileDiffs, serializeFileDiffs, } from "./file-diffs.js";
+import { revertSessionToCheckpoint, } from "./session-revert.js";
 import { COMPACT_PCT_DEFAULT, buildCompactedHistory, collectStoredTouchedFiles, collectTouchedFiles, compactBoundaryLine, compactPct, countUserTurns, estimateTokensForChars, fitSummaryWithFilesAndGoal, isThrashDisabled, requestCompactSummary, splitHistoryForCompaction, } from "./compact.js";
+import { shouldAutoCompactReal } from "./overflow.js";
 import { DEFAULT_PROVIDER, PROVIDERS, chatEndpointFor, getProvider, isLocalProviderId, isProviderId, localBaseURLFor, maskKey, openaiCompatibleChatEndpoint, providerNeedsKey, validateBaseURL, } from "./providers.js";
 import { createLocalDiscovery, summarizeLocalSnapshot, } from "./local-discovery.js";
 import { getStoredBaseURL, loadAuth, resolveApiKey, saveAuth, setStoredKey, } from "./auth.js";
@@ -26,7 +30,7 @@ import { validateProviderKey } from "./adapters.js";
 import { clearKiloModelsCache, isFreeKiloModel, preferFreeKiloModel, } from "./kilo.js";
 import { getGitInfo, withEnvBlock } from "./env-block.js";
 import { loadPrefs, loadSession, saveSession, sessionExists, } from "./session.js";
-import { createSession, ensureActiveSession, getActiveSession, getActiveSessionId, getSession, listSessions, renameSession, setActiveSession, updateSession, } from "./sessions.js";
+import { createSession, ensureActiveSession, forkSession, getActiveSession, getActiveSessionId, getSession, listSessions, renameSession, setActiveSession, updateSession, } from "./sessions.js";
 import { discoverExtensionEntries, loadExtensions, resolveExtensionName, } from "./extensions.js";
 import { formatExtensionStatusText } from "./extension-ui.js";
 import { getExtensionCommand, listExtensionCommands, parseExtensionCommandInput, runExtensionCommand, } from "./extension-commands.js";
@@ -47,21 +51,20 @@ import { PickerMoreAbove, PickerMoreBelow, PickerRow, PickerShell, pickerWindow
 import { shortenCwd } from "./ui/status-bar.js";
 import { StatusBarHost } from "./ui/status-host.js";
 import { createStreamStore } from "./ui/stream-store.js";
+import { createPaintScheduler } from "./ui/paint-scheduler.js";
 import { theme } from "./ui/theme.js";
 import { TodoPanel } from "./ui/todo-panel.js";
 import { TranscriptView, applyScrollAction } from "./ui/transcript.js";
 // Single registry for the "/" autocomplete menu and the exact-command path.
 export const SLASH_COMMANDS = [
-    { name: "/model", description: "Open the model picker." },
-    { name: "/models", description: "Refresh local model discovery (Ollama, LM Studio, llama.cpp)." },
+    { name: "/model", description: "Open the model picker (/model <text> filters, /model refresh re-probes servers)." },
     { name: "/provider", description: "Pick AI provider, paste API key once, chat." },
     {
         name: "/effort",
         description: "Open the reasoning-effort picker (Auto/Low/Medium/High/Max; Auto lets the model decide).",
     },
     { name: "/tools", description: "List the tools with one-line descriptions." },
-    { name: "/skills", description: "List installed skills (project + global)." },
-    { name: "/skill", description: "Invoke a skill by name (/skill:name; /skills lists)." },
+    { name: "/skill", description: "List skills in a picker, or invoke (/skill:name, /skill <name>)." },
     { name: "/mode", description: "Print the current permission mode (Tab cycles normal → yolo → plan)." },
     { name: "/trust", description: "Toggle session trust: auto-approve write/edit/bash without full yolo (/trust again revokes)." },
     { name: "/allow", description: "Pre-approve a tool pattern this session (e.g. /allow bash:npm test*)." },
@@ -75,10 +78,12 @@ export const SLASH_COMMANDS = [
     { name: "/queue", description: "List queued follow-ups (/queue clear wipes them)." },
     { name: "/steer", description: "Steer the running turn, or send when idle (/steer <text>)." },
     { name: "/autoscroll", description: "Toggle following new output (on by default; bare toggles, on|off sets it; off freezes the view mid-turn)." },
-    { name: "/goal", description: "Set, show, pause, resume, or clear the session goal (/goal <objective>; bare shows it; /goal pause|resume; /goal clear ends it)." },
+    { name: "/goal", description: "Set (and start working, like a normal message), show, pause, resume, or clear the session goal (/goal <objective>; bare shows it; /goal pause|resume; /goal clear ends it)." },
     { name: "/thinking", description: "Show or hide model thinking in the TUI (rendering only; the turn is untouched)." },
     { name: "/resume", description: "Restore the last saved session (turns, history, settings, usage)." },
     { name: "/session", description: "Switch the active session (interactive picker, most recent first)." },
+    { name: "/fork", description: "Fork this session into a new one and switch to it (/fork [n] drops the last n messages first)." },
+    { name: "/revert", description: "Undo to a checkpoint — restores conversation + files (/revert [n] goes n checkpoints back)." },
     { name: "/telemetry", description: "Show the local observability summary (sessions, tokens, tools)." },
     { name: "/dashboard", description: "Write the local observability dashboard page and show its path." },
     { name: "/rewind", description: "Restore files to a session checkpoint (files only; shell side effects are never snapshotted)." },
@@ -114,14 +119,17 @@ export const SUBMIT_PIPELINE_STAGES = [
 // Shared usage strings: the exact texts the commands print, hoisted to
 // module scope so the slash-menu argument hints reuse them (no second
 // implementation).
-export const SKILL_USAGE = "usage: /skill:<name> — invoke a skill directly (list with /skills, e.g. /skill:code-review)";
+export const SKILL_USAGE = "usage: /skill (list) · /skill:name or /skill <name> (invoke, e.g. /skill:code-review)";
+export const MODEL_USAGE = "usage: /model [filter text] — open the picker; /model refresh re-probes local servers (Ollama, LM Studio, llama.cpp)";
 export const RULE_USAGE = "usage: /allow <tool[:glob]> · /deny <tool[:glob]> · /rules · /rules clear (e.g. /allow bash:npm test*, /deny bash:rm *)";
 export const QUEUE_USAGE = "usage: /queue (list) · /queue clear (wipe) · /steer <text> (steer the running turn, or send when idle)";
 export const STEER_USAGE = "usage: /steer <text> — while busy, injects into the running turn at the next step boundary (the current action finishes first); when idle, sends as a normal turn";
 export const AUTOSCROLL_USAGE = "usage: /autoscroll [on|off] — on (default) follows new output as it arrives; off freezes the view while a turn runs (a `↓ N new` indicator offers the jump back). Bare /autoscroll toggles between the two.";
 export const THINKING_USAGE = "usage: /thinking — toggles model-thinking visibility in the TUI (rendering only: the live block and future rounds show or hide; already-printed blocks stay as printed; the turn, history, and telemetry are untouched).";
 export const RENAME_USAGE = 'usage: /rename <name> — rename the current session (e.g. /rename Build authentication; quotes optional: /rename "name with spaces"). Bare /rename prints this usage.';
-export const GOAL_USAGE = "usage: /goal <objective> (set; replacing resets counters) · /goal (show with cumulative stats) · /goal pause · /goal resume (re-arms; idle starts a turn, busy resumes at turn end) · /goal clear (ends it)";
+export const FORK_USAGE = "usage: /fork [n] — fork this session into a new one and switch to it (optional n drops the last n messages first, snapped to a turn boundary). Bare /fork clones the full conversation.";
+export const REVERT_USAGE = "usage: /revert [n] — undo to a checkpoint (n checkpoints back, default 0 = latest). Restores conversation + files; other sessions and forks untouched. Bare /revert undoes the last bad turn.";
+export const GOAL_USAGE = "usage: /goal <objective> (set and start working, just like a normal message; replacing resets counters; mid-turn set replaces quietly) · /goal (show with cumulative stats) · /goal pause · /goal resume (re-arms; idle starts a turn, busy resumes at turn end) · /goal clear (ends it)";
 // Pure arg parser for /rename (unit-tested): strips the command, trims,
 // then strips one layer of matching outer quotes (single or double) so
 // quoted names work even though the command line has no real parser.
@@ -142,8 +150,8 @@ export function parseRenameArg(raw) {
 export function filterSlashCommands(prefix) {
     const q = prefix.startsWith("/") ? prefix.slice(1) : prefix;
     // Exact match wins outright: a fully-typed command collapses the menu
-    // to itself, so prefix-siblings (/skill vs /skills, /model vs /models)
-    // never read as duplicates and Enter stays deterministic. Partial
+    // to itself, so prefix-siblings (/mode vs /model, /skill vs /skill:name
+    // rows) never read as duplicates and Enter stays deterministic. Partial
     // input keeps the prefix-then-fuzzy tiers below untouched.
     const full = `/${q}`;
     const exact = SLASH_COMMANDS.find((c) => c.name === full);
@@ -273,7 +281,7 @@ export function fuzzyScore(query, target) {
 // Max skill rows in the menu: the command list always renders whole, skills
 // narrow as you type — the menu can never take over the screen.
 export const SLASH_MENU_SKILL_CAP = 8;
-// Pure filter for the /skills picker (unit-tested): case-insensitive
+// Pure filter for the /skill picker (unit-tested): case-insensitive
 // substring over the skill name (a search popup narrows harder than the
 // prefix-only slash menu). Empty query returns everything as-is.
 export function filterSkillPicker(entries, query) {
@@ -380,10 +388,16 @@ export function commandUsage(name) {
             return STEER_USAGE;
         case "/skill":
             return SKILL_USAGE;
+        case "/model":
+            return MODEL_USAGE;
         case "/compact":
             return "Usage: /compact [focus text] — summarize older turns (works while busy; drains at turn end).";
         case "/rename":
             return RENAME_USAGE;
+        case "/fork":
+            return FORK_USAGE;
+        case "/revert":
+            return REVERT_USAGE;
         case "/goal":
             return GOAL_USAGE;
         default:
@@ -796,7 +810,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         modelFilterRef.current = next;
         setModelFilter(next);
     }
-    // /skills picker (opencode-style searchable popup): type-to-filter over the
+    // /skill picker (opencode-style searchable popup): type-to-filter over the
     // resolved registry, ↑/↓ + Enter to load, Esc cancels, windowed like the
     // model picker so any library size stays navigable. Snapshot state (the
     // registry always renders — names only, never descriptions).
@@ -817,7 +831,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // /session picker (interactive switcher): snapshot state loaded ONCE per
     // open (listSessions reads each record a single time), filtered in memory
     // per keystroke. ↑/↓ + Enter switches, Esc cancels with the live session
-    // untouched. Same keyboard/window pattern as the /skills picker.
+    // untouched. Same keyboard/window pattern as the /skill picker.
     const [selectingSession, setSelectingSession] = useState(false);
     const [sessionItems, setSessionItems] = useState([]);
     const [sessionIndex, setSessionIndex] = useState(0);
@@ -980,10 +994,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setScrollEnd(next);
     }
     // Thinking visibility (the /thinking toggle, rendering-only, default
-    // hidden): committed thinking turns + the live thinking block show only
-    // while on. Never touches the turn, history, or telemetry — purely paint.
-    const [showThinking, setShowThinking] = useState(false);
-    const showThinkingRef = useRef(false);
+    // shown): committed thinking turns + the live thinking block show while
+    // on. Never touches the turn, history, or telemetry — purely paint.
+    const [showThinking, setShowThinking] = useState(true);
+    const showThinkingRef = useRef(true);
     function setShowThinkingBoth(next) {
         showThinkingRef.current = next;
         setShowThinking(next);
@@ -1019,6 +1033,15 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             // accounting never breaks the turn
         }
     }
+    // Goal-resume staged while busy (ticket 07): `/goal resume` mid-turn
+    // re-arms the flag for turn-end pickup (see runGoalCommand) — the running
+    // loop usually consumes the re-arm live at its next continuation check,
+    // but a resume that raced the loop's final check (or a failed turn, which
+    // never continues) leaves the goal active with no continuation. The
+    // turn-boundary drain consumes this flag exactly once (see
+    // drainTurnBoundary stage 5). Never set when idle (idle resume submits
+    // directly); cleared on every turn end even when it kicks nothing.
+    const goalResumePendingRef = useRef(false);
     // Usage accumulator (session totals + goal slice, real reports only): the
     // turn's onUsage below and the goal-judge runner share it so judge spend
     // bills exactly like model spend. Every reporting POST accumulates
@@ -1038,6 +1061,16 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             // the per-POST value, NOT the accumulated total.
             if (updateLoad)
                 lastPromptTokensRef.current = u.prompt_tokens;
+            // A real main-loop report just arrived: the load is exact again, so
+            // the estimate latch clears (reset paths set it; summary/judge POSTs
+            // never touch it — same rule as the latch above).
+            if (updateLoad)
+                setLoadEstimatedBoth(false);
+            // Overflow-trigger source: the full last report (total, else parts).
+            // Stashed only for main-loop POSTs — summary/judge spend must not
+            // move the trigger (same rule as the load latch above).
+            if (updateLoad)
+                lastUsageRef.current = u;
         }
         if (u.completion_tokens !== undefined) {
             next.completion_tokens = (next.completion_tokens ?? 0) + u.completion_tokens;
@@ -1088,7 +1121,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     const [skillRegistry] = useState(() => createSkillRegistry({ projectDir: skillDirs?.projectDir, homeDir: skillDirs?.homeDir }));
     // Skill entries for the slash menu (namespaced `/skill:name` commands):
     // a snapshot of user-invocable skills (name + description), refreshed on
-    // mount, /skills, /clear, and /new — never per keystroke (disk I/O stays
+    // mount, /skill, /clear, and /new — never per keystroke (disk I/O stays
     // out of the typing path). Empty until the first refresh lands.
     const [skillMenu, setSkillMenu] = useState([]);
     async function refreshSkillMenu() {
@@ -1135,6 +1168,17 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             return null;
         }
     }
+    // Approval provenance slot (display-only, ticket 04): the verdict's via
+    // token for the in-flight approval-gated call, held for the matching
+    // onToolActivity commit. Same single-slot discipline as pendingDiffRef —
+    // the scheduler never parallel-batches conflicting writes, and every
+    // execution commits exactly one activity entry in call order. Lifetime ⊆
+    // one turn: set in approve(), consumed-or-cleared by the matching
+    // activity (same name-match predicate as the diff slot), and cleared on
+    // deny/cancel/turn boundaries so a stale token can never attribute to a
+    // later call. Read-only tools never consult approval, so they never set
+    // this (their audit lines stay exactly as before).
+    const pendingViaRef = useRef(null);
     // Tool approval prompt (normal mode, write/edit/bash): the loop waits on
     // the resolver until the user presses y/a/n. Ctrl+C aborts the whole turn
     // (LoopCancelledError) instead of denying one call.
@@ -1176,12 +1220,27 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // Consumed by onToolActivity into Turn.ms and by the live running line;
     // parallel batches share it (last start wins — approximate, display-only).
     const toolStartRef = useRef(null);
+    // Structured tool identity (ticket 02 sink consumer): FIFO of started
+    // tools in commit order ({toolCallId, name, startedAt}). The loop's
+    // onToolStarted fires before each commit and onToolFinished right after
+    // the matching onToolActivity, so the queue head at activity time IS the
+    // committing call's stable identity — no label parsing. Lifetime ⊆ one
+    // turn like toolStartRef/pendingDiffRef: cleared at turn start and in the
+    // turn-end finally so a cancelled/vetoed start can never leak sideways.
+    const toolIdentityQueueRef = useRef([]);
     // Latest streamed answer text (display bookkeeping only): if the turn
     // FAILS after streaming (rate limits, dead network), the catch path
     // commits this as a marked partial turn so the output never vanishes.
     // History still rolls back (the model never sees it); the transcript
     // keeps what the user already read. Cleared at every turn start.
     const lastPartialRef = useRef("");
+    // Streamed answer text already placed in the transcript this turn.
+    // Multi-POST turns stream inter-tool chatter the loop keeps only in
+    // history — without this the commit (final `reply` only) drops what the
+    // user already read, and an empty final reply commits a blank turn that
+    // reads as vanished output. Drained at tool commits and turn end; reset
+    // at every turn start alongside lastPartialRef.
+    const committedStreamRef = useRef("");
     const [error, setError] = useState(null);
     // Local observability recorder (src/telemetry.ts): one telemetry session
     // per App mount. Best-effort and never throwing; off via ATOM_TELEMETRY=0
@@ -1205,6 +1264,15 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // completes. NK stays cumulative; P must NOT use the cumulative total.
     const [contextLoad, setContextLoad] = useState(null);
     const contextLoadRef = useRef(null);
+    // Estimate latch (ticket 07 closes the ticket-06 follow-up): true when the
+    // load behind P% is the chars/token heuristic rather than provider-reported
+    // input tokens (post-compaction / /clear / resume / switch resets, or a
+    // provider that never reports prompt_tokens). False once a main-loop POST
+    // reports prompt_tokens; null when there is no load to qualify. Passed to
+    // the status bar's `loadEstimated` prop — the bar's own heuristic covers
+    // only the never-reported case, this latch covers the reset paths.
+    const [loadEstimated, setLoadEstimated] = useState(null);
+    const loadEstimatedRef = useRef(null);
     // Git identity for the status bar (branch only, no status porcelain):
     // refreshed at turn boundaries (a turn's bash may switch branches), read
     // from render. Null outside git repos — the bar then shows cwd alone.
@@ -1221,10 +1289,21 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // parse time to include exclusive cache counters) — the load metric source.
     // Summary-request usage never touches this — only main-loop POSTs do.
     const lastPromptTokensRef = useRef(undefined);
+    // Last main-loop POST's full reported usage (the real-total source for the
+    // overflow trigger below). Summary/judge POSTs never touch this — only
+    // main-loop POSTs do (same rule as lastPromptTokensRef). Reset everywhere
+    // the load latch resets: the old report no longer measures this context.
+    const lastUsageRef = useRef(undefined);
     // Thrash guard: consecutive auto-compactions without the load dropping
     // below threshold. At 3, auto disables for the session (manual still
     // works and resets the counter on success).
     const autoStreakRef = useRef(0);
+    // Per-turn file-diff watermark (ticket 06): index into historyRef.current
+    // up to which committed tool_calls have been collected into the session's
+    // metadata.filediffs record. Replacements (compact/switch/resume/new/
+    // clear) swap the array, so the read site guards a stale watermark into
+    // a rescan — merge dedupes, so records are never lost, only re-scanned.
+    const fileDiffsWatermarkRef = useRef(0);
     const [autoDisabled, setAutoDisabled] = useState(false);
     const autoDisabledRef = useRef(false);
     // /compact typed while busy: focus text ("" = no focus) runs at turn end,
@@ -1262,6 +1341,40 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // `phase`/`phaseDetail`/`toolHint` stay in App state: they change at most a
     // few times per turn (low frequency, and StatusBar legitimately needs them).
     const [streamStore] = useState(() => createStreamStore());
+    // Centralized streaming paint scheduler (render-stability): ONE trailing
+    // timer for the answer draft + thinking lanes. onToken/onThinking push
+    // every partial (activity/stall tracking stays per-token); paints coalesce
+    // to one per DRAFT_THROTTLE_MS window, delivered in a single store update
+    // so both lanes land in the same React render. Flushed on done/turn-end
+    // and on tool transitions, errors, and cancellation (no stale trailing
+    // paint may outlive the state it depicts).
+    const paintSchedulerRef = useRef(null);
+    function paintScheduler() {
+        let ps = paintSchedulerRef.current;
+        if (!ps) {
+            ps = createPaintScheduler({
+                intervalMs: DRAFT_THROTTLE_MS,
+                now,
+                setTimeoutFn,
+                clearTimeoutFn,
+                onFlush: (lanes) => {
+                    // Paint path only: the commit carries the byte-exact full text.
+                    // One store update notifies LiveTailHost alone — never App.
+                    streamStore.set(lanes);
+                },
+            });
+            paintSchedulerRef.current = ps;
+        }
+        return ps;
+    }
+    function flushDraft() {
+        try {
+            paintScheduler().flush();
+        }
+        catch {
+            // ignore (draft stays as-is; the commit carries the full text)
+        }
+    }
     // Thinking channel (onThinking): reasoning text streamed apart from the
     // answer, rendered in its own dim block below. The live value is transient
     // like the draft — cleared on every turn boundary below — but each completed
@@ -1278,7 +1391,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         try {
             // Drop any trailing paint: the commit carries the full text, and a
             // late flush must never resurrect stale reasoning after the clear.
-            thinkingThrottleRef.current?.cancel();
+            paintScheduler().cancel("thinking");
         }
         catch {
             // ignore (the store clear below still wins)
@@ -1291,13 +1404,24 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     function clearThinking() {
         thinkingRef.current = null;
         try {
-            thinkingThrottleRef.current?.cancel();
+            paintScheduler().cancel("thinking");
         }
         catch {
             // ignore (the store clear below still wins)
         }
         streamStore.setThinking(null);
     }
+    // Take streamed answer text not yet in the transcript (null when none or
+    // already committed). Marks the take so later drains never duplicate it.
+    function takeUncommittedStream() {
+        const text = lastPartialRef.current;
+        if (typeof text !== "string" || text.trim().length === 0)
+            return null;
+        if (text === committedStreamRef.current)
+            return null;
+        committedStreamRef.current = text;
+        return { role: "assistant", content: text };
+    }
     const [phase, setPhase] = useState("idle");
     const [phaseDetail, setPhaseDetail] = useState("");
     const [toolHint, setToolHint] = useState(null);
@@ -1318,55 +1442,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             setPhaseDetail(detail);
         }
     }
-    // Task B smoothness (a): throttled streaming draft. onToken pushes every
-    // partial (activity/stall tracking stays per-token); paints coalesce to one
-    // per DRAFT_THROTTLE_MS trailing window, flushed on done/turn-end.
-    const draftThrottleRef = useRef(null);
-    function draftThrottler() {
-        let th = draftThrottleRef.current;
-        if (!th) {
-            th = createDraftThrottler({
-                now,
-                setTimeoutFn,
-                clearTimeoutFn,
-                onFlush: (text) => {
-                    // Paint path only: the commit carries the byte-exact full text.
-                    // Writing the store notifies LiveTailHost alone — never App.
-                    streamStore.setDraft(text);
-                },
-            });
-            draftThrottleRef.current = th;
-        }
-        return th;
-    }
-    function flushDraft() {
-        try {
-            draftThrottler().flush();
-        }
-        catch {
-            // ignore (draft stays as-is; the commit carries the full text)
-        }
-    }
-    // Thinking paint coalescing: reasoning chunks arrive at token rate but
-    // paint through the same trailing window into the store (producer/consumer
-    // symmetry with the draft). thinkingRef stays synchronous per chunk so
-    // commitThinking can never lose reasoning to a pending trailing paint.
-    const thinkingThrottleRef = useRef(null);
-    function thinkingThrottler() {
-        let th = thinkingThrottleRef.current;
-        if (!th) {
-            th = createDraftThrottler({
-                now,
-                setTimeoutFn,
-                clearTimeoutFn,
-                onFlush: (text) => {
-                    streamStore.setThinking(text);
-                },
-            });
-            thinkingThrottleRef.current = th;
-        }
-        return th;
-    }
+    // Production paint path uses paintScheduler() above (single trailing
+    // timer for both lanes). createDraftThrottler further below is retained
+    // for its unit tests and as the documented single-lane primitive.
     // Phase 5: models-list session cache (successful live lists only, keyed
     // by modelsCacheKey). Failures fall back uncached, exactly as before.
     const modelsCacheRef = useRef(new Map());
@@ -1398,7 +1476,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setLocalSnapBoth(snap);
     }
     // Non-blocking refresh kick: shared in-flight promise dedupes overlapping
-    // calls (mount + picker-open + /models), so servers are never probed twice.
+    // calls (mount + picker-open + /model refresh), so servers are never probed twice.
     function kickLocalDiscovery() {
         if (initialModels)
             return;
@@ -1423,7 +1501,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         if (r.ok)
             return null;
         const name = getProvider(id)?.name ?? id;
-        return `${name} is unreachable at ${r.baseURL} — start the server, then run /models refresh.`;
+        return `${name} is unreachable at ${r.baseURL} — start the server, then run /model refresh.`;
     }
     // Loopback baseURL for chat/submit paths (env override wins, else the
     // probed snapshot base, else the compiled default).
@@ -1533,7 +1611,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         };
     }, [endpoint, apiKey, initialModels]);
     // Slash-menu skill snapshot once on mount (local disk reads only —
-    // zero fetches; refreshed on /skills, /clear, /new below).
+    // zero fetches; refreshed on /skill, /clear, /new below).
     useEffect(() => {
         void refreshSkillMenu();
         // eslint-disable-next-line react-hooks/exhaustive-deps
@@ -1669,8 +1747,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 turnTimerRef.current = null;
             }
             try {
-                draftThrottleRef.current?.cancel();
-                thinkingThrottleRef.current?.cancel();
+                paintSchedulerRef.current?.cancel();
             }
             catch {
                 // ignore
@@ -1863,7 +1940,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setSelectingRewindScope(false);
         pendingRewindRef.current = null;
     }
-    // /skills picker (opencode-style searchable popup): opens on the fresh
+    // /skill picker (opencode-style searchable popup): opens on the fresh
     // registry (names only), filters as you type, loads on Enter. Local disk
     // reads only — zero fetches. Idle-only (history injection mid-turn would
     // break the loop's assistant/tool pairing).
@@ -2056,6 +2133,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         contextLoadRef.current = next;
         setContextLoad(next);
     }
+    function setLoadEstimatedBoth(next) {
+        loadEstimatedRef.current = next;
+        setLoadEstimated(next);
+    }
     function setAutoDisabledBoth(next) {
         autoDisabledRef.current = next;
         setAutoDisabled(next);
@@ -2078,6 +2159,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     // the chars/4 estimate applies until the next report arrives.
     function resetContextLoadToEstimate() {
         lastPromptTokensRef.current = undefined;
+        lastUsageRef.current = undefined;
+        // The estimate applies until the next report arrives: the latch marks
+        // P% estimated so the bar reads `(~P%)`, never an exact fact.
+        setLoadEstimatedBoth(true);
         if (!usageRef.current) {
             setContextLoadBoth(null);
         }
@@ -2363,10 +2448,35 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             const id = ensureStoreSession();
             if (!id)
                 return;
+            // The live checklist rides every store persist (same call as every
+            // completed turn — no new save cadence). Other metadata keys pass
+            // through untouched; only metadata.todos is set (never filediffs).
+            let diskMetadata;
+            try {
+                diskMetadata = getSession(id, authHome)?.metadata;
+            }
+            catch {
+                diskMetadata = undefined;
+            }
+            // Per-turn file diffs (ticket 06): collect the tool_calls committed
+            // since the last persist and merge them into the session-scoped
+            // metadata.filediffs record. This site runs on completed turns only
+            // (failed/cancelled turns roll back and never persist), so failed
+            // work is never recorded. Delta-only scan; a stale watermark after
+            // an array replacement degrades to a rescan, and merge dedupes.
+            const liveHistory = historyRef.current;
+            const diffsStart = fileDiffsWatermarkRef.current <= liveHistory.length
+                ? fileDiffsWatermarkRef.current
+                : 0;
+            const diskRecord = typeof diskMetadata === "object" && diskMetadata !== null && !Array.isArray(diskMetadata)
+                ? diskMetadata
+                : undefined;
+            const mergedDiffs = mergeFileDiffs(readFileDiffs(diskRecord?.[FILE_DIFFS_METADATA_KEY]), collectTurnFileDiffs(liveHistory.slice(diffsStart)));
+            fileDiffsWatermarkRef.current = liveHistory.length;
             updateSession(id, {
                 history: historyRef.current,
                 turns: turnsRef.current.map((t) => {
-                    const { diff: _dropped, ...rest } = t;
+                    const { diff: _dropped, approvalVia: _viaDropped, ...rest } = t;
                     return rest;
                 }),
                 usageTotals: usageRef.current,
@@ -2375,6 +2485,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 // snapshots this session's goal into its own record first, so a
                 // switch back restores it and sessions never leak goals.
                 goal: serializeGoalForPersist(goalRef.current),
+                metadata: {
+                    ...withSessionTodos(diskMetadata, getTodos()),
+                    [FILE_DIFFS_METADATA_KEY]: serializeFileDiffs(mergedDiffs),
+                },
                 provider: providerRef.current,
                 model: modelRef.current,
                 effort: effortRef.current,
@@ -2525,7 +2639,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 goal: goalRef.current,
                 history: historyRef.current,
                 turns: turnsRef.current.map((t) => {
-                    const { diff: _dropped, ...rest } = t;
+                    const { diff: _dropped, approvalVia: _viaDropped, ...rest } = t;
                     return rest;
                 }),
             }, authHome);
@@ -2611,7 +2725,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 pushInfo("(nothing to compact)");
             return false;
         }
-        const split = splitHistoryForCompaction(historyRef.current);
+        const split = splitHistoryForCompaction(historyRef.current, undefined, modelRef.current);
         if (split.olderTurnCount <= 0 || split.head.length === 0) {
             if (!isAuto)
                 pushInfo("(nothing to compact)");
@@ -2736,7 +2850,23 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             // the same goal without re-exploring; over-budget lists shrink instead
             // of failing compaction (model text + goal block are never cut).
             const goalBlock = formatGoalForCompact(goalRef.current, getTodos().map((t) => ({ content: t.content, status: t.status })));
-            const fitted = fitSummaryWithFilesAndGoal(summary, collectTouchedFiles(split.head), goalBlock);
+            // Ticket 06: the session-scoped accumulated record (files from earlier
+            // turns and prior compactions) merges with this head's touches, so
+            // Relevant Files names exactly what the session touched — not just
+            // the head being summarized now. Disk is the source of truth; a
+            // failed read falls back to the head alone (compaction never fails
+            // for a files feed).
+            let recordedDiffs = emptyFileDiffs();
+            try {
+                const compactId = ensureStoreSession();
+                if (compactId) {
+                    recordedDiffs = readFileDiffs(getSession(compactId, authHome)?.metadata?.[FILE_DIFFS_METADATA_KEY]);
+                }
+            }
+            catch {
+                // ignore — head touches alone still summarize
+            }
+            const fitted = fitSummaryWithFilesAndGoal(summary, mergeFileDiffs(recordedDiffs, collectTouchedFiles(split.head)), goalBlock);
             const next = buildCompactedHistory(systemMsg, fitted.text, split.tail, split.olderTurnCount);
             // Replacement: re-wrap so the ledger restarts from the compacted array
             // (the old ledger is discarded with the old array).
@@ -2750,14 +2880,13 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 pushInfo(`(/compact — discarded ${compactDrops} file checkpoint(s); undos do not cross a compaction)`);
             }
             // P% must drop immediately: the old lastPromptTokens reflects the
-            // pre-compact context (and its cache counters), so clear it and use
-            // the new-history estimate.
-            lastPromptTokensRef.current = undefined;
-            const newLoad = estimateTokensForChars(historyChars(historyRef.current));
-            setContextLoadBoth(newLoad);
+            // pre-compact context (and its cache counters), so the estimate latch
+            // resets onto the new history (marks P% `(~P%)` until next report).
+            resetContextLoadToEstimate();
             if (isAuto) {
                 const pct = compactPct();
                 const window = contextWindowFor(modelRef.current);
+                const newLoad = contextLoadRef.current ?? 0;
                 if (window !== undefined && newLoad / window < pct) {
                     autoStreakRef.current = 0;
                 }
@@ -2778,22 +2907,23 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             return false;
         }
     }
-    // After a completed main turn: refresh load, reset the streak when below
-    // threshold, else auto-compact (known-window models only, unless
-    // thrash-disabled). Called while still busy, before the next turn.
+    // After a completed main turn: refresh load, reset the streak when the
+    // real-usage overflow trigger is quiet, else auto-compact (known-window
+    // models with a reported real total at/above the usable limit only,
+    // unless thrash-disabled). Called while still busy, before the next turn.
     async function maybeAutoCompact() {
         const load = refreshContextLoad();
         if (load === null) {
             autoStreakRef.current = 0;
             return;
         }
-        // Unknown window → no auto trigger (never invent a window); below
-        // threshold → streak resets. The manager owns the pct math, so a false
-        // there means either case — re-check the window for the reset.
-        if (!contextManager().needsCompaction(load)) {
+        // Unknown window or no real usage reported → no auto trigger (never
+        // invent a window, never estimate); below the usable limit → streak
+        // resets. shouldAutoCompactReal is false for all three, so re-check
+        // the window for the reset.
+        if (!shouldAutoCompactReal(modelRef.current, lastUsageRef.current)) {
             // Distinguish unknown-window (streak untouched — irrelevant) from
-            // below-threshold (streak resets). shouldAutoCompact is false for
-            // both, so re-check the window for the reset.
+            // below-limit (streak resets).
             if (contextWindowFor(modelRef.current) !== undefined) {
                 autoStreakRef.current = 0;
             }
@@ -2846,13 +2976,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         refreshSystemEnv();
         // Restored load is the estimate (no prompt_tokens survived the save);
         // thrash state restarts fresh on resume.
-        lastPromptTokensRef.current = undefined;
-        if (!usageRef.current) {
-            setContextLoadBoth(null);
-        }
-        else {
-            setContextLoadBoth(estimateTokensForChars(historyChars(historyRef.current)));
-        }
+        resetContextLoadToEstimate();
         autoStreakRef.current = 0;
         setAutoDisabledBoth(false);
         pendingCompactRef.current = null;
@@ -2995,13 +3119,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         if (target.history.length > 0) {
             refreshSystemEnv();
         }
-        lastPromptTokensRef.current = undefined;
-        if (!usageRef.current) {
-            setContextLoadBoth(null);
-        }
-        else {
-            setContextLoadBoth(estimateTokensForChars(historyChars(historyRef.current)));
-        }
+        // Switched sessions measure a different context: the estimate applies
+        // until the next report (same latch as resume above).
+        resetContextLoadToEstimate();
         autoStreakRef.current = 0;
         setAutoDisabledBoth(false);
         pendingCompactRef.current = null;
@@ -3015,22 +3135,19 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 content: `(/session — discarded ${switchDrops} live file checkpoint(s); undos do not cross a session switch)`,
             });
         }
-        // TODO isolation (mirrors /new): the checklist is process-global memory
-        // that is never persisted — carrying it across sessions would show the
-        // new session the old session's plan, and the agent would act on it.
-        // Reset it, loudly when non-empty.
-        if (getTodos().length > 0) {
-            clearTodos();
-            setTodoSnap([]);
-            pendingNotices.push({
-                role: "tool",
-                content: "(/session — checklist reset; TODOs are per-conversation and do not cross sessions)",
-            });
-        }
-        else {
-            clearTodos();
-            setTodoSnap([]);
-        }
+        // Todo restore (mirrors the goal restore above): the target's checklist
+        // replaces the live one wholesale (never merged) — one session's plan
+        // can never leak into another. The outgoing list was snapshotted into
+        // its own record by persistStoreSession above, so switching back
+        // restores it. Absent/corrupt data lands on an empty list. Restored
+        // through todowriteTool so the live invariants still hold; the record
+        // always replays cleanly because it was valid when saved.
+        clearTodos();
+        const restoredTodos = readSessionTodos(target.metadata);
+        if (restoredTodos.length > 0) {
+            await todowriteTool({ todos: restoredTodos });
+        }
+        setTodoSnap(getTodos());
         // The target's history/turns REPLACE the live arrays wholesale — used
         // whole, never trimmed.
         for (const section of collectStoredTouchedFiles(historyRef.current)) {
@@ -3288,6 +3405,132 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setSessionTitleBoth(renamed.title);
         pushInfo(`(renamed session to "${renamed.title}")`);
     }
+    // /fork [n]: clone the active session into a brand-new session and switch
+    // to it ("try another approach from here"). Bare forks at the tip; /fork
+    // <n> keeps all but the last n messages (forkSession snaps the cut to a
+    // turn boundary, so assistant/tool pairing never splits). Idle-only: the
+    // wholesale live-array swap would race a running turn.
+    async function runForkCommand(raw) {
+        const arg = raw.trim() === "/fork" ? "" : raw.trim().slice("/fork".length).trim();
+        let drop = 0;
+        if (arg !== "") {
+            if (!/^\d+$/.test(arg)) {
+                pushInfo(FORK_USAGE);
+                return;
+            }
+            drop = Number(arg);
+        }
+        let id = null;
+        try {
+            id = ensureStoreSession();
+        }
+        catch {
+            id = null;
+        }
+        if (!id) {
+            pushInfo("(fork failed — session store unavailable; staying put)");
+            return;
+        }
+        // Snapshot live state first so unpersisted turns ride into the fork;
+        // forkSession only reads the disk record.
+        persistStoreSession();
+        const keep = drop === 0 ? undefined : Math.max(0, historyRef.current.length - drop);
+        let forked = null;
+        try {
+            forked = forkSession(id, keep, authHome);
+        }
+        catch {
+            forked = null;
+        }
+        if (!forked) {
+            pushInfo("(fork failed — source session unreadable; staying put)");
+            return;
+        }
+        await switchToSession(forked.id);
+        pushInfo(`(forked into "${forked.title}")`);
+    }
+    // /revert [n]: undo to a checkpoint via revertSessionToCheckpoint —
+    // restores the session's conversation AND files, then swaps the live
+    // arrays wholesale (switch precedent). Bare reverts to the latest
+    // checkpoint; /revert <n> goes n checkpoints back. Idle-only: the swap
+    // would race a running turn. Checkpoints are live-lineage (in-memory,
+    // dropped by compact/switch like /rewind's) — nothing older is offered.
+    async function runRevertCommand(raw) {
+        const arg = raw.trim() === "/revert" ? "" : raw.trim().slice("/revert".length).trim();
+        let back = 0;
+        if (arg !== "") {
+            if (!/^\d+$/.test(arg)) {
+                pushInfo(REVERT_USAGE);
+                return;
+            }
+            back = Number(arg);
+        }
+        const cps = listCheckpoints();
+        if (cps.length === 0) {
+            pushInfo("(no snapshots recorded — every write/edit auto-snapshots; nothing to revert)");
+            return;
+        }
+        if (back >= cps.length) {
+            pushInfo(`(only ${cps.length} checkpoint(s) — nothing was changed)`);
+            return;
+        }
+        const cp = cps[cps.length - 1 - back];
+        let id = null;
+        try {
+            id = ensureStoreSession();
+        }
+        catch {
+            id = null;
+        }
+        if (!id) {
+            pushInfo("(revert failed — session store unavailable; nothing was changed)");
+            return;
+        }
+        // Snapshot live state first: the revert reads the disk record, so
+        // unpersisted turns must land there before the cut.
+        persistStoreSession();
+        let result;
+        try {
+            result = await revertSessionToCheckpoint(id, cp.id, authHome);
+        }
+        catch {
+            result = { ok: false, error: "revert failed unexpectedly — session left exactly as it was" };
+        }
+        if (!result.ok) {
+            pushInfo(`(${result.error})`);
+            return;
+        }
+        // Wholesale live swap: the persisted record is truth (goal/todos live
+        // on unchanged — the revert only rewrote history+turns).
+        historyRef.current = trackHistory(result.session.history.length > 0
+            ? [...result.session.history]
+            : [{ role: "system", content: withEnvBlock(systemPrompt) }]);
+        setTurnsBoth(result.session.turns);
+        // Restored bytes invalidate stale-read fingerprints (runRewind
+        // precedent): forget them so later edits re-capture instead of
+        // false-refusing.
+        for (const f of cp.files) {
+            try {
+                forgetReadFingerprint(f.abs);
+            }
+            catch {
+                // ignore — fingerprint refresh never breaks a revert
+            }
+        }
+        // Same remount + load refresh as /clear and /resume: the cut tail
+        // leaves the test frame, and the old load no longer measures this
+        // context.
+        setScrollEndBoth(null);
+        setClearGen((g) => g + 1);
+        refreshContextLoad();
+        lastPromptTokensRef.current = undefined;
+        lastUsageRef.current = undefined;
+        // The cut tail leaves the test frame: the refreshed load above was built
+        // on the pre-cut report, so the estimate latch marks it until next turn.
+        setLoadEstimatedBoth(true);
+        pushInfo(result.message);
+        persistSession();
+    }
     // /autoscroll [on|off]: follow switch for the scrollback viewport. View-
     // only state — safe while busy (never touches the turn, like /queue).
     // Bare toggles off ⇄ on; on jumps to the latest; off freezes a following
@@ -3365,6 +3608,12 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             setGoalBoth({ ...g, active: true });
             persistSession();
             if (busyRef.current) {
+                // Re-arm for turn-end pickup: the running loop reads the live flag
+                // (usually consuming this immediately), and the turn-boundary drain
+                // kicks one continuation turn when the ended turn left it stranded
+                // (see drainTurnBoundary stage 5). Staged only on a real re-arm —
+                // absent/already-active goals return above with no flag.
+                goalResumePendingRef.current = true;
                 pushInfo("(goal resumes when the current turn ends — no new turn started while busy)");
                 return;
             }
@@ -3374,16 +3623,46 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         pushInfo(goalSetNotice(cmd.objective, goalRef.current));
         setGoalBoth({ objective: cmd.objective, active: true, stats: emptyGoalStats() });
         persistSession();
+        if (busyRef.current) {
+            // Mid-turn set replaces the live goal quietly (pre-existing
+            // behavior): the running loop reads the live goal at its
+            // continuation checks. No turn is ever injected while busy.
+            pushInfo("(goal set — the running turn picks it up; nothing new started while busy)");
+            return;
+        }
+        // A goal is just like a normal message: setting it starts a turn with
+        // the objective as the user message, so the live-goal loop engages
+        // (resume already kicks this way; set was the quiet outlier).
+        void submit(cmd.objective);
+    }
+    // runModelsCommand (the `/model refresh` backend): reports the last
+    // snapshot (kicking a first probe when discovery never ran) on a bare
+    // call; `refresh` re-probes all three runtimes first. Results merge into
+    // the models cache, so the /model picker serves them with no extra
+    // fetches — one dim summary line, never transcript spam.
+    // Unified /model picker open: unfiltered with the highlight on the
+    // current model, or pre-filtered when the command carried text
+    // (/model <text>). Active provider's section first, so same-provider
+    // rises stay index-stable when other keyed providers add sections below.
+    // Late lifecycle: if discovery never ran (slow/no startup probe),
+    // kick it now so local sections fill in behind the open picker.
+    function openModelPicker(initialFilter) {
+        if (localSnapRef.current.version === 0)
+            kickLocalDiscovery();
+        setModelFilterBoth(initialFilter);
+        const entries = buildModelEntries();
+        const at = entries.findIndex((e) => e.providerId === providerRef.current && e.model === modelRef.current);
+        setSelIndexBoth(Math.max(0, at));
+        setSelecting(true);
+        setSelectingEffort(false);
+        setSelectingProvider(false);
+        setKeyPromptBoth(null);
+        setBaseURLPromptBoth(null);
     }
-    // /models: local-discovery status + refresh. Bare `/models` reports the
-    // last snapshot (kicking a first probe when discovery never ran);
-    // `/models refresh` re-probes all three runtimes, then reports. Results
-    // merge into the models cache, so the /model picker serves them with no
-    // extra fetches — one dim summary line, never transcript spam.
     async function runModelsCommand(arg) {
         const a = arg.trim().toLowerCase();
         if (a !== "" && a !== "refresh") {
-            pushInfo("usage: /models [refresh] — probe local model servers (Ollama, LM Studio, llama.cpp).");
+            pushInfo("usage: /model [filter|refresh] — pick a model, or probe local model servers (Ollama, LM Studio, llama.cpp).");
             return;
         }
         // Manual Kilo refresh: clear the gateway catalog cache and re-fetch.
@@ -3445,6 +3724,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 setClearGen((g) => g + 1);
                 setError(null);
                 streamStore.setDraft(null);
+                lastPartialRef.current = "";
+                committedStreamRef.current = "";
                 clearThinking();
                 setToolHint(null);
                 setPhaseBoth("idle", "");
@@ -3473,7 +3754,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 }
                 // autoDisabled stays for the session (thrash guard is session-wide).
                 lastPromptTokensRef.current = undefined;
+                lastUsageRef.current = undefined;
                 setContextLoadBoth(null);
+                // No load left to qualify: the latch clears with it.
+                setLoadEstimatedBoth(null);
                 autoStreakRef.current = 0;
                 pendingCompactRef.current = null;
                 telemetry.recordEvent("clear", "conversation cleared (token totals kept)");
@@ -3536,6 +3820,8 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 setClearGen((g) => g + 1);
                 setError(null);
                 streamStore.setDraft(null);
+                lastPartialRef.current = "";
+                committedStreamRef.current = "";
                 clearThinking();
                 setToolHint(null);
                 setPhaseBoth("idle", "");
@@ -3545,7 +3831,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 // conversation + counters reset.
                 setUsageBoth(null);
                 lastPromptTokensRef.current = undefined;
+                lastUsageRef.current = undefined;
                 setContextLoadBoth(null);
+                // Fresh conversation with no usage and no load: nothing to qualify.
+                setLoadEstimatedBoth(null);
                 // Fresh conversation: the session checklist restarts too.
                 clearTodos();
                 setTodoSnap([]);
@@ -3573,22 +3862,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 void runCompactCommand("");
                 return;
             case "/model": {
-                // Unified picker opens unfiltered with the highlight on the current
-                // model (active provider's section first, so same-provider rises
-                // stay index-stable when other keyed providers add sections below).
-                // Late lifecycle: if discovery never ran (slow/no startup probe),
-                // kick it now so local sections fill in behind the open picker.
-                if (localSnapRef.current.version === 0)
-                    kickLocalDiscovery();
-                setModelFilterBoth("");
-                const entries = buildModelEntries();
-                const at = entries.findIndex((e) => e.providerId === providerRef.current && e.model === modelRef.current);
-                setSelIndexBoth(Math.max(0, at));
-                setSelecting(true);
-                setSelectingEffort(false);
-                setSelectingProvider(false);
-                setKeyPromptBoth(null);
-                setBaseURLPromptBoth(null);
+                openModelPicker("");
                 return;
             }
             case "/provider":
@@ -3605,13 +3879,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             case "/tools":
                 pushInfo(toolsListText());
                 return;
-            case "/skills":
-                // Searchable picker (names only, type to filter, Enter loads).
-                // Local reads only — zero fetches, like the model picker.
-                openSkillPicker();
-                return;
             case "/skill":
-                pushInfo(SKILL_USAGE);
+                // Unified skill command: bare opens the picker (what /skills did).
+                openSkillPicker();
                 return;
             case "/context":
                 pushInfo(buildContextText());
@@ -3678,6 +3948,18 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             case "/session":
                 openSessionPicker("");
                 return;
+            case "/fork":
+                // Bare exact match (slash-menu Enter on the highlighted name):
+                // full-conversation fork — the typed-args form is preserved by the
+                // menu branch and the submit prefix route below.
+                void runForkCommand("/fork");
+                return;
+            case "/revert":
+                // Bare exact match: revert to the latest checkpoint — the typed
+                // form is preserved by the menu branch and the submit prefix
+                // route below.
+                void runRevertCommand("/revert");
+                return;
             case "/rename":
                 // Bare exact match (slash-menu Enter on the highlighted name):
                 // usage — the typed-args form is preserved by the menu branch and
@@ -3727,14 +4009,21 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 }
         }
     }
-    // approve hook for runAgenticLoop: scoped rules first (deny refuses as a
+    // approve hook for runAgenticLoop: one verdict per call (deny refuses as a
     // standard "no" — pre-execution, model-visible denial result, audit line
     // via the untouched onToolActivity path — and wins over everything below,
-    // including plan mode); plan mode second (mutations flow to the execute
-    // gate, which refuses with a replan note — never a prompt here, so
-    // allow/yolo/trust/always/skill grants cannot punch through); then allow,
-    // yolo, session trust (/trust or [t]), and always-allowed tools run without
-    // prompting; otherwise an Ink y/a/t/n prompt resolves the promise.
+    // including plan mode); plan mode never prompts — its mutations flow to
+    // the execute gate, which refuses with a replan note (allow/yolo/trust/
+    // always/skill grants cannot punch through); then allow, yolo, session
+    // trust (/trust or [t]), and always-allowed tools run without prompting;
+    // otherwise an Ink y/a/t/n prompt resolves the promise.
+    // The verdict (decision + provenance + preview) is computed ONCE here via
+    // decideApproval: the modal renders verdict.preview and the stashed
+    // description (never recomputing either — no filesystem reads in render),
+    // and execution consumes the recorded via without re-deciding. The only
+    // other mode consultation is the execute gate below (guardedExecute),
+    // which enforces plan-mode at execution time — it consults no rules and
+    // prompts nothing, so approval still decides exactly once.
     // The promise also rejects with LoopCancelledError when the turn is
     // cancelled (Ctrl+C aborts the controller), so a cancel unblocks the loop
     // as a whole-turn cancel — never as a one-call denial.
@@ -3760,38 +4049,49 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 : null;
             pendingDiffRef.current = { name, path: toolPath, beforeFull, afterArg, diff: stagedDiff };
         }
-        // Policy layer owns the decision order (deny → plan → allow → yolo →
-        // trust → always → skill grants → prompt); this function owns cancel
-        // handling and the interactive prompt plumbing around it.
-        const outcome = decidePolicy(name, args, {
+        // One verdict for this call (deny → plan → allow → yolo → trust →
+        // always → skill grants → prompt, owned by the policy layer). The
+        // modal description is computed here too (same single pass — the label
+        // may resolve symlinks, so render must not recompute it).
+        const verdict = decideApproval(name, args, {
             mode: modeRef.current,
             trustAll: trustAllRef.current,
             rules: rulesRef.current,
             alwaysAllowed: alwaysAllowedRef.current,
             skillGrants: skillGrantsRef.current,
             approvalGated: needsApproval(name),
-        });
-        if (outcome.kind === "deny") {
+        }, stagedDiff);
+        // Provenance for the transcript: approval-gated calls record their via
+        // for the matching activity commit (deny clears immediately below —
+        // its ↳ line already names the denial — and prompt-denials clear in
+        // resolveApproval, so only executed calls ever render it).
+        if (needsApproval(name))
+            pendingViaRef.current = { name, via: verdict.via };
+        if (verdict.decision === "deny") {
             pendingDiffRef.current = null;
+            pendingViaRef.current = null;
             return "no";
         }
-        if (outcome.kind === "allow")
+        if (verdict.decision === "allow")
             return "once";
+        const description = describeToolCall(name, args);
         const signal = turnCancelRef.current?.signal ?? null;
         if (signal?.aborted) {
             pendingDiffRef.current = null;
+            pendingViaRef.current = null;
             throw new LoopCancelledError();
         }
         return new Promise((resolve, reject) => {
             approvalResolveRef.current = { resolve, reject };
             setApproveIndexBoth(0);
-            setPendingApproval({ name, args, diff: stagedDiff });
+            setPendingApproval({ name, args, diff: verdict.preview, description });
             if (signal) {
                 const onAbort = () => {
                     const h = approvalResolveRef.current;
                     approvalResolveRef.current = null;
                     setPendingApproval(null);
                     pendingDiffRef.current = null;
+                    pendingViaRef.current = null;
                     h?.reject(new LoopCancelledError());
                 };
                 if (signal.aborted)
@@ -3805,8 +4105,10 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         if (decision === "always" && pendingApproval) {
             alwaysAllowedRef.current.add(pendingApproval.name);
         }
-        if (decision === "no")
+        if (decision === "no") {
             pendingDiffRef.current = null;
+            pendingViaRef.current = null;
+        }
         const h = approvalResolveRef.current;
         approvalResolveRef.current = null;
         setPendingApproval(null);
@@ -3879,6 +4181,175 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         setAskCustomBoth("");
         h?.reject(new Error("question cancelled by user"));
     }
+    // Turn-boundary drain (ticket 07): the ONE explicitly ordered routine for
+    // everything pending at a turn boundary. Called once per turn from
+    // submit()'s turn-end finally (the single turn boundary — the compact
+    // drains are extracted from submit's success path (try) and failure path
+    // (catch) here); submit-time handlers only STAGE pending state (glue that
+    // stays at those call sites, documented where it stages: /compact-while-
+    // busy sets pendingCompactRef, busy follow-ups enqueue, busy /steer sets
+    // steerRef, busy /goal resume re-arms plus stages goalResumePendingRef).
+    //
+    // Effective order (verified against the pre-ticket code + tests — every
+    // stage keeps today's semantics; do not reorder):
+    //   1. compact — manual /compact first (pending flag; a /compact arriving
+    //      mid-compaction re-arms the flag → nested second drain on clean
+    //      turns), else auto-compact on clean turns only. Failed/cancelled
+    //      turns drain a pending manual only (single, guarded); auto never
+    //      fires there (load is meaningless for a rolled-back turn — just
+    //      refresh it). Runs while still busy, so a /compact now re-arms the
+    //      pending flag instead of running a concurrent compaction.
+    //   2. turn teardown (pinned here, not a drain stage: the goal work-time
+    //      accrual must follow compaction — both old paths ran compact-then-
+    //      accrue — and the busy reset plus modal/slot cleanup must precede
+    //      any chained submit so the next turn starts clean).
+    //   3. steer — a steer stranded by a failed/cancelled turn rejoins the
+    //      queue FRONT (all outcomes; never dropped, never run inline).
+    //   4. queue — the next queued follow-up auto-sends on non-cancelled turns
+    //      only (cancelled turns keep the queue visible but never auto-send;
+    //      failed turns auto-send like clean ones — the gate is the
+    //      cancellation latch, same `!turnCancelledRef` as before). The
+    //      chained submit re-enters submit() → a clean turn → this drain
+    //      again at its end.
+    //   5. goal-resume — a staged busy-resume whose goal is still active with
+    //      no turn just chained starts exactly one continuation turn (covers
+    //      failed turns, which never continue inside the loop, and resumes
+    //      that raced the loop's final continuation check). A chained queue
+    //      turn consumes the stage instead (its loop reads the live flag — no
+    //      second turn starts); cancelled turns never kick (the loop paused
+    //      the goal, and the queue stays put for the user).
+    // Re-entrancy: chained submits re-enter this routine per turn; every flag
+    // is consumed (nulled) before the await that acts on it, so a nested
+    // drain can never double-run a stage.
+    async function drainTurnBoundary(outcome, goalWorkStartMs, goalWorkObjective) {
+        // STAGE 1 — compact (verbatim from the old try/catch drains).
+        if (outcome === "clean") {
+            // Drain boundary (still busy, never mid-turn): pending manual /compact
+            // first (it resets the thrash counter), else auto-compact when the
+            // load is over threshold. Compaction persists via the normal save path.
+            if (pendingCompactRef.current !== null) {
+                const focus = pendingCompactRef.current;
+                pendingCompactRef.current = null;
+                await doCompact(focus, false);
+                // A /compact that arrived during the compaction above drains now.
+                if (pendingCompactRef.current !== null) {
+                    const focus2 = pendingCompactRef.current;
+                    pendingCompactRef.current = null;
+                    await doCompact(focus2, false);
+                }
+            }
+            else {
+                await maybeAutoCompact();
+                if (pendingCompactRef.current !== null) {
+                    const focus = pendingCompactRef.current;
+                    pendingCompactRef.current = null;
+                    await doCompact(focus, false);
+                }
+            }
+        }
+        else {
+            // Turn-end drain even after failure/rollback: pending manual still
+            // runs (it applies to the surviving history); auto never fires here
+            // (load is meaningless for a rolled-back turn — just refresh it).
+            if (pendingCompactRef.current !== null) {
+                const focus = pendingCompactRef.current;
+                pendingCompactRef.current = null;
+                try {
+                    await doCompact(focus, false);
+                }
+                catch {
+                    // doCompact never throws (it reports inline), but stay safe.
+                }
+            }
+            else {
+                refreshContextLoad();
+            }
+        }
+        // STAGE 2 — turn teardown (verbatim from the old finally, position
+        // pinned: accrual after compaction, busy reset before any chained turn).
+        // Goal work time (ticket 02): this submit's wall clock accrues once,
+        // for every outcome (success, failure, and cancel all did work), when
+        // the same goal is still live. A mid-turn replacement keeps its own
+        // stats — we accrue only while the objective still matches.
+        try {
+            if (goalWorkStartMs !== null &&
+                goalRef.current !== null &&
+                goalRef.current.objective === goalWorkObjective) {
+                const workedMs = Math.max(0, Date.now() - goalWorkStartMs);
+                patchGoalStats((s) => ({ ...s, workMs: s.workMs + workedMs }));
+            }
+        }
+        catch {
+            // accounting never breaks turn teardown
+        }
+        turnCancelRef.current = null;
+        approvalResolveRef.current = null;
+        setPendingApproval(null);
+        // Safety net: the slot is normally consumed by onToolActivity or
+        // cleared on deny/cancel — never let it cross a turn boundary.
+        // Same for the structured-identity queue (cancelled/vetoed starts)
+        // and the provenance slot (same lifetime as the diff slot).
+        pendingDiffRef.current = null;
+        pendingViaRef.current = null;
+        toolIdentityQueueRef.current = [];
+        askResolveRef.current = null;
+        setPendingQuestion(null);
+        setAskCustomBoth("");
+        // Turn-scoped skill grants expire here: armed-while-idle and auto
+        // skills cover exactly the turn that just ended (success, failure,
+        // or cancel) — the next user message starts clean (ticket 06).
+        skillGrantsRef.current = new Set();
+        busyRef.current = false;
+        setBusy(false);
+        refreshGitInfo();
+        try {
+            paintSchedulerRef.current?.cancel();
+        }
+        catch {
+            // ignore
+        }
+        streamStore.setDraft(null);
+        clearThinking();
+        setToolHint(null);
+        clearTurnTimer();
+        setStalledBoth(false);
+        setElapsedSecs(0);
+        setPhaseBoth("idle", "");
+        // STAGE 3 — steer (verbatim from the old finally): a steer stranded
+        // by a failed/cancelled turn rejoins the queue front — the thought is
+        // preserved, the user decides when it runs.
+        const stranded = steerRef.current;
+        if (stranded) {
+            steerRef.current = null;
+            setSteerPending(null);
+            setQueueBoth([stranded, ...queueRef.current]);
+        }
+        // STAGE 4 — queue (verbatim from the old finally): a clean turn
+        // auto-sends the next queued follow-up (chaining while the queue is
+        // non-empty); a cancelled turn keeps its queue visible but never
+        // auto-sends. Runs after the busy reset above so the chained submit
+        // enters a clean turn.
+        if (!turnCancelledRef.current && queueRef.current.length > 0) {
+            const next = queueRef.current[0];
+            setQueueBoth(queueRef.current.slice(1));
+            void submit(next);
+        }
+        // STAGE 5 — goal-resume: consume the staged busy-resume (always —
+        // even when it kicks nothing, so the flag never leaks across turns),
+        // then kick exactly one continuation turn when the ended turn left the
+        // goal active without chaining (failed turns and raced resumes — the
+        // running loop consumes live re-arms itself, and a chained queue turn
+        // above already carries the live goal). Cancelled turns never kick.
+        const resumeStaged = goalResumePendingRef.current;
+        goalResumePendingRef.current = false;
+        if (resumeStaged &&
+            outcome !== "cancelled" &&
+            !busyRef.current &&
+            goalRef.current !== null &&
+            goalRef.current.active === true) {
+            void submit(goalFollowUp(goalRef.current.objective));
+        }
+    }
     // Submit-time pipeline (ticket 02 — stage order is SUBMIT_PIPELINE_STAGES
     // above; each `SUBMIT STAGE n/3` marker below names its stage plus its
     // rollback-scope rule). Local "/" routing precedes the pipeline: exact
@@ -3989,11 +4460,24 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             runRulesCommand(text);
             return;
         }
-        // /models takes an optional subcommand (/models refresh), like the
-        // /allow family — SLASH_NAMES only holds exact commands.
+        // /model takes an optional filter or subcommand: bare opens the picker,
+        // `/model refresh` re-probes local servers (and the Kilo catalog when
+        // Kilo is active), `/model <text>` opens the picker pre-filtered.
+        // SLASH_NAMES only holds the exact command.
+        if (text === "/model" || text.startsWith("/model ")) {
+            const arg = text === "/model" ? "" : text.slice("/model ".length).trim();
+            if (arg.toLowerCase() === "refresh") {
+                void runModelsCommand("refresh");
+                return;
+            }
+            openModelPicker(arg);
+            return;
+        }
+        // Retired: /models merged into /model (see above). Explicit branch so
+        // the input explains instead of hitting skill lookup — the name stays
+        // reserved against extension shadowing.
         if (text === "/models" || text.startsWith("/models ")) {
-            const arg = text === "/models" ? "" : text.slice("/models ".length);
-            void runModelsCommand(arg);
+            pushInfo("(merged — use /model to pick, /model refresh to re-probe local servers)");
             return;
         }
         // /session takes an optional initial filter ("/session auth" opens the
@@ -4003,6 +4487,21 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             openSessionPicker(initial);
             return;
         }
+        // /fork takes an optional drop count ("/fork 5" drops the last 5
+        // messages first) — SLASH_NAMES only holds the exact command. Idle-only
+        // like /session: the live-array swap would race a running turn, and the
+        // busy guard above already drops other "/" input while busy.
+        if (text === "/fork" || text.startsWith("/fork ")) {
+            await runForkCommand(text);
+            return;
+        }
+        // /revert takes an optional checkpoint index ("/revert 1" goes one
+        // checkpoint back) — SLASH_NAMES only holds the exact command.
+        // Idle-only like /fork: the live-array swap would race a running turn.
+        if (text === "/revert" || text.startsWith("/revert ")) {
+            await runRevertCommand(text);
+            return;
+        }
         // Exact full-command + Enter runs it. A single-token "/name" not in
         // SLASH_NAMES resolves through the skill registry (ticket 03, legacy
         // form — the namespaced `/skill:name` below is canonical); anything
@@ -4016,13 +4515,28 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             runSlashCommand(text);
             return;
         }
-        // Namespaced skill invocation: `/skill:name` (bare `/skill` shows usage
-        // via the registry path above). Resolves through the same registry as
-        // the legacy `/name` form and the slash menu.
+        // Namespaced skill invocation: `/skill:name` (bare `/skill` opens the
+        // picker via the registry path above; `/skill <name>` below invokes).
+        // Resolves through the same registry as the legacy `/name` form and
+        // the slash menu.
         if (text === "/skill" || text === "/skill:") {
             pushInfo(SKILL_USAGE);
             return;
         }
+        // Space form for the unified command: `/skill deploy` invokes exactly
+        // like `/skill:deploy`.
+        const spacedSkill = /^\/skill\s+([A-Za-z0-9_-]+)\s*$/.exec(text)?.[1];
+        if (spacedSkill !== undefined) {
+            void invokeSkillByName(spacedSkill);
+            return;
+        }
+        // Retired: /skills merged into /skill (bare opens the picker).
+        // Explicit branch so the input explains instead of hitting skill
+        // lookup — the name stays reserved against extension shadowing.
+        if (text === "/skills" || text.startsWith("/skills ")) {
+            pushInfo("(merged — /skill lists and picks, /skill:name invokes)");
+            return;
+        }
         const namespaced = /^\/skill:([A-Za-z0-9_-]+)$/.exec(text)?.[1];
         if (namespaced !== undefined) {
             void invokeSkillByName(namespaced);
@@ -4069,8 +4583,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         // (loaded while idle) must survive into the turn it was armed for.
         // Expiry happens in the turn-end finally below, plus /clear + /new.
         try {
-            draftThrottler().reset();
-            thinkingThrottler().reset();
+            paintScheduler().reset();
         }
         catch {
             // ignore (first token still paints; at worst one window late)
@@ -4082,11 +4595,17 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         startTurnTimer();
         // Display-only tool clock: no tool is running at turn start, so any
         // stale timestamp from a previous turn must not leak into this one.
+        // Same for the structured-identity queue (a cancelled turn's unconsumed
+        // starts must never attribute to this turn).
         toolStartRef.current = null;
+        toolIdentityQueueRef.current = [];
         // Same for the transcript-diff slot: a previous turn's unconsumed
         // preview (cancelled mid-execution) must never attach to this turn.
+        // Same for the provenance slot (same lifetime, same reason).
         pendingDiffRef.current = null;
+        pendingViaRef.current = null;
         lastPartialRef.current = "";
+        committedStreamRef.current = "";
         refreshGitInfo();
         // SUBMIT STAGE 2/3 — context-assembly (rollback scope: pre-rollbackTo,
         // survives failure). Refresh the pinned env block ONCE per turn (not per
@@ -4104,6 +4623,12 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
         // catch). Cancellation (LoopCancelledError) shares the same splice
         // contract.
         const rollbackTo = historyRef.current.length;
+        // Turn-boundary outcome glue (ticket 07): the try end marks clean, the
+        // catch marks failed/cancelled — the turn-end finally passes it to the
+        // single drain routine (see drainTurnBoundary). Dead default is the most
+        // conservative ("cancelled" never auto-sends); every path below
+        // overwrites it before the finally reads it.
+        let turnOutcome = "cancelled";
         // Goal work time (ticket 02): wall clock for this submit accrues to the
         // live goal in the turn finally (all outcomes — success, failure, and
         // cancel all did work). Pinned to the starting objective so a mid-turn
@@ -4218,6 +4743,37 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 // Local observability sink: the loop reports completed model/tool
                 // calls (iterations, durations, usage) into the open turn trace.
                 telemetry: telemetrySink,
+                // Structured tool identity (ticket 02 sink consumer): every tool
+                // start/finish arrives here with its stable toolCallId + name, in
+                // commit order. onToolActivity below consumes the queue head (the
+                // start fired before the commit); onToolFinished reconciles by id
+                // for paths whose activity never fired. Guarded: observer errors
+                // degrade to the label-matching fallback, never break the turn.
+                turnEvents: {
+                    onToolStarted: (info) => {
+                        try {
+                            toolIdentityQueueRef.current.push({
+                                toolCallId: info.toolCallId,
+                                name: info.name,
+                                startedAt: clockNow(),
+                            });
+                        }
+                        catch {
+                            // ignore (that call falls back to the phase-timing channel)
+                        }
+                    },
+                    onToolFinished: (info) => {
+                        try {
+                            const q = toolIdentityQueueRef.current;
+                            const at = q.findIndex((e) => e.toolCallId === info.toolCallId);
+                            if (at >= 0)
+                                q.splice(at, 1);
+                        }
+                        catch {
+                            // ignore (queue hygiene only; the activity already consumed)
+                        }
+                    },
+                },
                 // Loop-harness rollup: per-turn LoopStats (cache hits, guard hits,
                 // bottleneck, context growth) attach to the same open turn trace.
                 // Fires once per turn — including failed/cancelled turns, whose
@@ -4231,7 +4787,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 endpointOverride: activeEndpoint,
                 onToken: (partial) => {
                     try {
-                        draftThrottler().push(partial);
+                        paintScheduler().push("draft", partial);
                     }
                     catch {
                         // Never lose tokens: paint now rather than drop the partial.
@@ -4243,7 +4799,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 onThinking: (partial) => {
                     thinkingRef.current = partial;
                     try {
-                        thinkingThrottler().push(partial);
+                        paintScheduler().push("thinking", partial);
                     }
                     catch {
                         // Never lose reasoning: paint now rather than drop the partial.
@@ -4265,8 +4821,14 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                     else if (p === "tool" && detail) {
                         setToolHint(detail);
                         toolStartRef.current = clockNow();
+                        // Paint any coalesced stream text NOW so the tool transition
+                        // never shows a stale draft for up to a window behind.
+                        flushDraft();
                     }
                     else if (p === "retry") {
+                        // Same ordering as tool start: pending paint lands before the
+                        // retry line commits, so the transcript never reorders.
+                        flushDraft();
                         const msg = detail ? `↻ retrying… ${detail}` : "↻ retrying…";
                         appendTurns({ role: "tool", content: msg });
                         // Local observability: transport retries attach to the model call
@@ -4281,6 +4843,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 onToolDelta: (name) => {
                     setToolHint(name);
                     toolStartRef.current = clockNow();
+                    // Tool calls can start mid-stream: paint the pending draft now so
+                    // the running line and the latest text arrive in the same frame.
+                    flushDraft();
                 },
                 onUsage: (u) => {
                     // Local observability: per-turn usage accumulates inside the
@@ -4312,13 +4877,34 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                     appendTurns({ role: "user", content: s });
                 },
                 onToolActivity: (label, result, isError) => {
-                    // Display-only duration: wall time since the tool started (see
-                    // toolStartRef). Attached as Turn.ms for the `· Ns` suffix; the
-                    // label text itself stays byte-identical to the loop's audit line.
-                    const started = toolStartRef.current;
+                    // Structured identity first (ticket 02 sink): the queue head is
+                    // this commit's stable identity (toolCallId + name, commit order)
+                    // — never parsed out of the label. Null head = identity-less call
+                    // (old paths, tests driving the callback directly) → the legacy
+                    // label-matching fallback for that call only, so no line is ever
+                    // dropped. The label text itself stays byte-identical either way.
+                    const identity = toolIdentityQueueRef.current.length > 0
+                        ? toolIdentityQueueRef.current.shift()
+                        : null;
+                    // Display-only duration: wall time since the tool started. On the
+                    // sink path the start comes from the structured identity (never
+                    // the phase-timing side channel); the fallback keeps toolStartRef.
+                    // Attached as Turn.ms for the `· Ns` suffix.
+                    const phaseStarted = toolStartRef.current;
                     toolStartRef.current = null;
-                    const ms = started !== null ? Math.max(0, clockNow() - started) : 0;
-                    const items = [{ role: "tool", content: label, ms }];
+                    const ms = identity !== null
+                        ? Math.max(0, clockNow() - identity.startedAt)
+                        : phaseStarted !== null
+                            ? Math.max(0, clockNow() - phaseStarted)
+                            : 0;
+                    const items = [];
+                    // Inter-tool chatter streamed before this result would otherwise
+                    // vanish (the turn commit carries the final reply only). Pin it
+                    // above the tool line in commit order.
+                    const pendingStream = takeUncommittedStream();
+                    if (pendingStream !== null)
+                        items.push(pendingStream);
+                    items.push({ role: "tool", content: label, ms });
                     // Inspector retention (display-only): keep the full result for
                     // later browsing. Capped count; stored text char-capped inside
                     // the record with an explicit truncation flag.
@@ -4330,12 +4916,22 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                     // are short checklists, so successful ones join the transcript
                     // (history fidelity — what did the list look like when?) and
                     // refresh the live <TodoPanel> snapshot below the transcript.
-                    const isTodo = label === "⚙ todo_get" ||
-                        label.startsWith("⚙ todowrite ") ||
-                        label.startsWith("⚙ todo_update ");
+                    // The membership test reads the structured tool name on the sink
+                    // path; the label-prefix match survives only for identity-less
+                    // fallback calls.
+                    const isTodo = identity !== null
+                        ? identity.name === "todo_get" ||
+                            identity.name === "todowrite" ||
+                            identity.name === "todo_update"
+                        : label === "⚙ todo_get" ||
+                            label.startsWith("⚙ todowrite ") ||
+                            label.startsWith("⚙ todo_update ");
                     if (isTodo)
                         setTodoSnap(getTodos());
                     if (isError) {
+                        // Errors commit immediately: paint any coalesced stream text
+                        // first so the failure line never overtakes the text it follows.
+                        flushDraft();
                         const firstLine = result.split("\n", 1)[0] ?? result;
                         items.push({ role: "tool", content: `  ↳ ${firstLine}`, error: true });
                     }
@@ -4347,12 +4943,34 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                     // every matching activity (success or failure) so a stale
                     // capture can never leak onto a later call; render only on
                     // success with a real payload (failures keep the ↳ line only).
+                    // The match reads the structured tool name on the sink path
+                    // (never parsed out of the label); the label-prefix match
+                    // survives only for identity-less fallback calls.
                     // Full-file BEFORE→AFTER is preferred (aligned panes with
                     // context); when either side is unavailable (unreadable file,
                     // oversize), fall back to the arg-block preview pair.
                     const slot = pendingDiffRef.current;
-                    if (slot !== null &&
-                        (label === `⚙ ${slot.name}` || label.startsWith(`⚙ ${slot.name} `))) {
+                    const slotMatch = slot !== null &&
+                        (identity !== null
+                            ? identity.name === slot.name
+                            : label === `⚙ ${slot.name}` || label.startsWith(`⚙ ${slot.name} `));
+                    // Approval provenance rides the same pairing: the verdict's via
+                    // token recorded in approve() attributes to this exact execution.
+                    // Consume-or-clear on match (same predicate as the diff slot), so
+                    // a stale token can never leak onto a later call; denied calls
+                    // cleared their slot in approve()/resolveApproval and render no
+                    // suffix. Attached to the label turn for success and error alike
+                    // (a plan-passthrough refusal names its provenance too).
+                    const viaSlot = pendingViaRef.current;
+                    const viaMatch = viaSlot !== null &&
+                        (identity !== null
+                            ? identity.name === viaSlot.name
+                            : label === `⚙ ${viaSlot.name}` || label.startsWith(`⚙ ${viaSlot.name} `));
+                    if (viaMatch) {
+                        pendingViaRef.current = null;
+                        items[0].approvalVia = viaSlot.via;
+                    }
+                    if (slotMatch) {
                         pendingDiffRef.current = null;
                         if (!isError) {
                             let afterFull = null;
@@ -4363,7 +4981,18 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                                 afterFull = readFileForDiff(path.resolve(process.cwd(), slot.path));
                             }
                             const beforeFull = slot.beforeFull;
-                            if (beforeFull !== null && afterFull !== null) {
+                            // Retention bound (OOM defense): full file texts stay on the
+                            // committed turn for the whole session. Past 1MB a side the
+                            // diff engine would only render its "file over 1MB — diff
+                            // skipped" notice anyway, so attach nothing and keep the
+                            // label-only turn instead of retaining megabytes to paint one
+                            // line. The modal preview (transient) is unaffected.
+                            const oversize = (beforeFull !== null && beforeFull.length > APPROVAL_PREVIEW_MAX_BYTES) ||
+                                (afterFull !== null && afterFull.length > APPROVAL_PREVIEW_MAX_BYTES) ||
+                                (slot.diff !== null &&
+                                    ((slot.diff.oldText !== null && slot.diff.oldText.length > APPROVAL_PREVIEW_MAX_BYTES) ||
+                                        slot.diff.newText.length > APPROVAL_PREVIEW_MAX_BYTES));
+                            if (!oversize && beforeFull !== null && afterFull !== null) {
                                 items[0].diff = {
                                     oldText: beforeFull,
                                     newText: afterFull,
@@ -4371,7 +5000,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                                     path: slot.path,
                                 };
                             }
-                            else if (slot.diff !== null) {
+                            else if (!oversize && slot.diff !== null) {
                                 items[0].diff = slot.diff;
                             }
                         }
@@ -4387,7 +5016,21 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             // the answer it produced).
             flushDraft();
             commitThinking();
-            appendTurns({ role: "assistant", content: reply });
+            // The loop returns the FINAL post's text only: inter-tool chatter was
+            // pinned above at each tool commit, so commit just the remainder — an
+            // empty final reply falls back to uncommitted stream text, and a turn
+            // with nothing streamed commits nothing (never a blank vanishing turn).
+            if (reply.trim().length > 0) {
+                if (reply !== committedStreamRef.current) {
+                    committedStreamRef.current = reply;
+                    appendTurns({ role: "assistant", content: reply });
+                }
+            }
+            else {
+                const pendingReply = takeUncommittedStream();
+                if (pendingReply !== null)
+                    appendTurns(pendingReply);
+            }
             // The turn committed to history (final text, denial-as-result, or
             // stop-notice) — persist the kill-safe save. Rolled-back turns (catch
             // below) never reach here, so a failure can't clobber the last good save.
@@ -4396,28 +5039,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             // labels (completed / blocked / unverified / budget-exceeded) and flush.
             telemetry.endTurn(telemetryTurnId, classifyTurnOutcome(reply), reply);
             persistTelemetry();
-            // Drain boundary (still busy, never mid-turn): pending manual /compact
-            // first (it resets the thrash counter), else auto-compact when the
-            // load is over threshold. Compaction persists via the normal save path.
-            if (pendingCompactRef.current !== null) {
-                const focus = pendingCompactRef.current;
-                pendingCompactRef.current = null;
-                await doCompact(focus, false);
-                // A /compact that arrived during the compaction above drains now.
-                if (pendingCompactRef.current !== null) {
-                    const focus2 = pendingCompactRef.current;
-                    pendingCompactRef.current = null;
-                    await doCompact(focus2, false);
-                }
-            }
-            else {
-                await maybeAutoCompact();
-                if (pendingCompactRef.current !== null) {
-                    const focus = pendingCompactRef.current;
-                    pendingCompactRef.current = null;
-                    await doCompact(focus, false);
-                }
-            }
+            // Success path reached turn end — the compact drain plus everything
+            // after it runs in the single turn-boundary drain (see the finally).
+            turnOutcome = "clean";
         }
         catch (err) {
             const cancelled = err instanceof LoopCancelledError ||
@@ -4425,6 +5049,9 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 controller.signal.aborted;
             historyRef.current.splice(rollbackTo); // don't keep the failed/cancelled turn
             turnCancelledRef.current = cancelled;
+            // The failure path reached turn end — compact drain plus the rest runs
+            // in the single turn-boundary drain (see the finally).
+            turnOutcome = cancelled ? "cancelled" : "failed";
             // The turn never happened: drop live thinking with it (a failed turn
             // commits nothing — same scope as the history rollback above).
             clearThinking();
@@ -4448,95 +5075,26 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                 // limit or dead network after 30s of streaming wipes everything the
                 // user already read. History stays rolled back (model never sees
                 // it); only the display transcript keeps the partial.
-                const partial = lastPartialRef.current.trim();
+                const pendingPartial = takeUncommittedStream();
                 lastPartialRef.current = "";
-                if (partial) {
+                if (pendingPartial !== null) {
                     appendTurns({
                         role: "assistant",
-                        content: `${partial}\n\n(request failed before completing — partial output preserved)`,
+                        content: `${pendingPartial.content}\n\n(request failed before completing — partial output preserved)`,
                     });
                 }
                 setError(err instanceof Error ? err.message : String(err));
             }
-            // Turn-end drain even after failure/rollback: pending manual still
-            // runs (it applies to the surviving history); auto never fires here
-            // (load is meaningless for a rolled-back turn — just refresh it).
-            if (pendingCompactRef.current !== null) {
-                const focus = pendingCompactRef.current;
-                pendingCompactRef.current = null;
-                try {
-                    await doCompact(focus, false);
-                }
-                catch {
-                    // doCompact never throws (it reports inline), but stay safe.
-                }
-            }
-            else {
-                refreshContextLoad();
-            }
+            // (Compact drain for this path lives in the single turn-boundary
+            // drain below — no inline drain logic remains here.)
         }
         finally {
-            // Goal work time (ticket 02): this submit's wall clock accrues once,
-            // for every outcome (success, failure, and cancel all did work), when
-            // the same goal is still live. A mid-turn replacement keeps its own
-            // stats — we accrue only while the objective still matches.
-            try {
-                if (goalWorkStartMs !== null &&
-                    goalRef.current !== null &&
-                    goalRef.current.objective === goalWorkObjective) {
-                    const workedMs = Math.max(0, Date.now() - goalWorkStartMs);
-                    patchGoalStats((s) => ({ ...s, workMs: s.workMs + workedMs }));
-                }
-            }
-            catch {
-                // accounting never breaks turn teardown
-            }
-            turnCancelRef.current = null;
-            approvalResolveRef.current = null;
-            setPendingApproval(null);
-            // Safety net: the slot is normally consumed by onToolActivity or
-            // cleared on deny/cancel — never let it cross a turn boundary.
-            pendingDiffRef.current = null;
-            askResolveRef.current = null;
-            setPendingQuestion(null);
-            setAskCustomBoth("");
-            // Turn-scoped skill grants expire here: armed-while-idle and auto
-            // skills cover exactly the turn that just ended (success, failure,
-            // or cancel) — the next user message starts clean (ticket 06).
-            skillGrantsRef.current = new Set();
-            busyRef.current = false;
-            setBusy(false);
-            refreshGitInfo();
-            try {
-                draftThrottleRef.current?.cancel();
-            }
-            catch {
-                // ignore
-            }
-            streamStore.setDraft(null);
-            clearThinking();
-            setToolHint(null);
-            clearTurnTimer();
-            setStalledBoth(false);
-            setElapsedSecs(0);
-            setPhaseBoth("idle", "");
-            // Queue drain (Claude-Code-style): a clean turn auto-sends the next
-            // queued follow-up (chaining while the queue is non-empty); a cancelled
-            // turn keeps its queue visible but never auto-sends. A steer stranded
-            // by a failed/cancelled turn rejoins the queue front — the thought is
-            // preserved, the user decides when it runs. Runs after busy resets
-            // above so the chained submit enters a clean turn.
-            const stranded = steerRef.current;
-            if (stranded) {
-                steerRef.current = null;
-                setSteerPending(null);
-                setQueueBoth([stranded, ...queueRef.current]);
-            }
-            if (!turnCancelledRef.current && queueRef.current.length > 0) {
-                const next = queueRef.current[0];
-                setQueueBoth(queueRef.current.slice(1));
-                void submit(next);
-            }
+            // The single turn-boundary drain (ticket 07): compact → steer →
+            // queue → goal-resume, in that order (see drainTurnBoundary). The
+            // outcome glue above selects the clean vs failed/cancelled compact
+            // variant; everything else (teardown position, steer-to-front,
+            // cancel-keeps-queue) is owned by the routine.
+            await drainTurnBoundary(turnOutcome, goalWorkStartMs, goalWorkObjective);
         }
     }
     function cancelTurn() {
@@ -4964,7 +5522,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
             }
             return;
         }
-        // 3a2. Session picker (interactive switcher, same pattern as /skills:
+        // 3a2. Session picker (interactive switcher, same pattern as /skill:
         // type to filter, ↑/↓ + Enter switches, Esc cancels with the live
         // session completely unchanged). The list is the open-time snapshot —
         // filtering never touches disk. Enter on an empty filtered list only
@@ -5170,6 +5728,22 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
                         setInputBoth("");
                         runRenameCommand(raw);
                     }
+                    else if (pick.name === "/fork" &&
+                        (inputRef.current === "/fork" || inputRef.current.startsWith("/fork "))) {
+                        // Preserve the typed drop count (e.g. "/fork 5"); a bare
+                        // highlighted name forks at the tip.
+                        const raw = inputRef.current;
+                        setInputBoth("");
+                        void runForkCommand(raw);
+                    }
+                    else if (pick.name === "/revert" &&
+                        (inputRef.current === "/revert" || inputRef.current.startsWith("/revert "))) {
+                        // Preserve the typed checkpoint index (e.g. "/revert 1"); a
+                        // bare highlighted name reverts to the latest checkpoint.
+                        const raw = inputRef.current;
+                        setInputBoth("");
+                        void runRevertCommand(raw);
+                    }
                     else if (!pick.skill &&
                         getExtensionCommand(pick.name.slice(1)) &&
                         (inputRef.current === pick.name || inputRef.current.startsWith(`${pick.name} `))) {
@@ -5563,7 +6137,7 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     const modelTitle = `Atom — Select model (${modelEntries.length}` +
         (modelFilter ? ` of ${modelEntriesAll.length}, filter: "${modelFilter}"` : "") +
         `) — type to filter, up/down + Enter, Esc cancels:`;
-    // /skills picker derived for render (mirrors the useInput computation
+    // /skill picker derived for render (mirrors the useInput computation
     // above): names only, filtered, clamped highlight, visible window. The
     // title keeps the `Skills (` prefix the registry header always had.
     // Memoized for the same tick/append reason as the model picker above.
@@ -5603,10 +6177,11 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     const checkpointListMemo = useMemo(() => (selectingRewind ? listCheckpoints() : []), 
     // eslint-disable-next-line react-hooks/exhaustive-deps
     [selectingRewind]);
-    // Approval description: the tool-call one-liner for the modal. Memoized on
-    // the pending approval itself — the 1s busy tick keeps firing while the
-    // modal waits, and must not rebuild the string (nor re-render the modal).
-    const approvalDescription = useMemo(() => (pendingApproval ? describeToolCall(pendingApproval.name, pendingApproval.args) : ""), [pendingApproval]);
+    // Approval description: the tool-call one-liner for the modal, stashed on
+    // the pending approval by approve() itself — render never recomputes it
+    // (describeToolCall may resolve symlinks, so rebuilding it here would put
+    // filesystem reads back into the 1s busy-tick render path).
+    const approvalDescription = pendingApproval?.description ?? "";
     // (The cursor clamp lives inside the memoized InputBox now, next to its
     // only use — App body no longer reads cursor state for paint.)
     // Status-line reasoning segment wired to the effort session state: a
@@ -5627,44 +6202,50 @@ export function App({ apiKey, endpoint, initialModel, initialModels, initialProv
     const toolElapsedSecs = busy && toolHint && toolStartRef.current !== null
         ? elapsedSecsSince(toolStartRef.current, turnStartRef.current + elapsedSecs * 1000)
         : null;
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(TranscriptView, { turns: turns, clearGen: clearGen, end: scrollEnd, held: scrollEnd !== null, showThinking: showThinking }), _jsx(LiveTailHost, { store: streamStore, isEmpty: turns.length === 0, sessionHint: sessionHint, emptySessionTitle: turns.length === 0 ? sessionTitle : null, busy: busy, held: scrollEnd !== null, toolHint: toolHint, toolElapsedSecs: toolElapsedSecs, elapsedSecs: elapsedSecs, showThinking: showThinking }), error ? _jsxs(Text, { color: theme.color.error, children: ["error> ", error] }) : null, pendingApproval ? (_jsx(ApprovalBox, { toolName: pendingApproval.name, description: approvalDescription, selected: approveIndex, diff: pendingApproval.diff ?? null })) : null, pendingQuestion ? (_jsx(QuestionBox, { question: pendingQuestion.question, options: pendingQuestion.options, allowCustom: pendingQuestion.allowCustom, askCustom: askCustom, askSelIndex: askSelIndex })) : null, extPendingDialog && !pendingApproval && !pendingQuestion ? (_jsx(QuestionBox, { question: `[${extPendingDialog.owner}] ${extPendingDialog.question}`, options: extPendingDialog.options, allowCustom: extPendingDialog.allowCustom, askCustom: extDlgCustom, askSelIndex: extDlgSel }, `ext-dialog-${extPendingDialog.id}`)) : null, _jsx(TodoPanel, { items: todoSnap }), extWidgets.map((w) => (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.panel, paddingX: theme.spacing.pickerPadX, children: [_jsxs(Text, { bold: true, children: ["[", w.owner, "] ", w.title] }), _jsx(Text, { children: w.text })] }, `${w.owner}-${w.id}`))), steerPending ? _jsxs(Text, { dimColor: true, children: ["Steering: ", steerPending] }) : null, queue.length > 0 ? (_jsxs(Text, { dimColor: true, children: ["Queued (", queue.length, "): ", queue[0], queue.length > 1 ? ` +${queue.length - 1} more (/queue)` : ""] })) : null, paletteOpen ? (_jsx(PalettePanel, { entries: paletteEntriesMemo, index: paletteIndex, filter: paletteFilter })) : inspecting ? (_jsx(InspectorPanel, { records: toolLogRef.current, index: inspectIndex, expanded: inspectExpanded, scroll: inspectScroll })) : selecting ? (_jsxs(PickerShell, { title: modelTitle, children: [_jsx(PickerMoreAbove, { count: modelWin.start }), modelEntries.slice(modelWin.start, modelWin.end).map((e, k) => {
-                        const i = modelWin.start + k;
-                        const entryLocal = e.local === true;
-                        const prevLocal = i === 0 ? null : modelEntries[i - 1]?.local === true;
-                        const showGroup = i === 0 || prevLocal !== entryLocal;
-                        const showHeader = showGroup || modelEntries[i - 1]?.providerId !== e.providerId;
-                        const def = getProvider(e.providerId);
-                        return (_jsxs(React.Fragment, { children: [showGroup ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.descSeparator, " ", entryLocal ? "Local" : "Remote"] })) : null, showHeader ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.descSeparator, " ", def?.name ?? e.providerId, entryLocal && isLocalProviderId(e.providerId)
-                                            ? ` ${theme.symbol.separator} ${localBaseURLFor(e.providerId)}`
-                                            : null, e.providerId === provider ? " (current)" : ""] })) : null, _jsxs(PickerRow, { highlighted: i === modelHi, children: [e.model, e.free === true ? _jsx(Text, { dimColor: true, children: " (free)" }) : null, e.providerId === provider && e.model === model ? " (current)" : ""] })] }, `${e.providerId}-${e.model}-${i}`));
-                    }), _jsx(PickerMoreBelow, { count: modelEntries.length - modelWin.end }), modelEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: "No models match \u2014 backspace to widen the filter." })) : null] })) : selectingSkills ? (_jsxs(PickerShell, { title: skillTitle, children: [_jsx(PickerMoreAbove, { count: skillWin.start }), skillEntries.slice(skillWin.start, skillWin.end).map((e, k) => {
-                        const i = skillWin.start + k;
-                        return (_jsxs(PickerRow, { highlighted: i === skillHi, children: ["/skill:", e.name, !e.userInvocable ? _jsx(Text, { dimColor: true, children: " [auto-only]" }) : null] }, `${e.name}-${i}`));
-                    }), _jsx(PickerMoreBelow, { count: skillEntries.length - skillWin.end }), skillEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: skillEntriesAll.length === 0
-                            ? "No skills installed — add SKILL.md skills under .claude/skills/, .agents/skills/, or the ~/. counterparts."
-                            : "No skills match — backspace to widen the filter." })) : null] })) : selectingSession ? (_jsxs(PickerShell, { title: sessionPickerTitle, children: [_jsx(PickerMoreAbove, { count: sessionWin.start }), sessionEntries.slice(sessionWin.start, sessionWin.end).map((e, k) => {
-                        const i = sessionWin.start + k;
-                        const age = formatSessionAge(Date.now(), e.updatedAt);
-                        return (_jsxs(PickerRow, { highlighted: i === sessionHi, children: [e.title, e.active ? " (current)" : "", _jsxs(Text, { dimColor: true, children: [" ", "\u00B7 ", e.turnCount, " turn", e.turnCount === 1 ? "" : "s", " \u00B7 ", age] })] }, `${e.id}-${i}`));
-                    }), _jsx(PickerMoreBelow, { count: sessionEntries.length - sessionWin.end }), sessionEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: sessionEntriesAll.length === 0
-                            ? "No sessions yet — your current conversation is saved automatically."
-                            : "No sessions match — backspace to widen the filter." })) : null] })) : selectingProvider ? (_jsx(PickerShell, { title: "Atom \u2014 Select provider (up/down + Enter, Esc cancels):", children: PROVIDERS.map((p, i) => {
-                    const has = keyForProvider(p.id).length > 0;
-                    const keyMark = isLocalProviderId(p.id)
-                        ? `local ${theme.symbol.descSeparator} no key needed`
-                        : has
-                            ? `${theme.symbol.keyPresent} key`
-                            : p.id === "kilo"
-                                ? `${theme.symbol.descSeparator} key optional — free models need none`
-                                : `${theme.symbol.descSeparator} no key`;
-                    return (_jsxs(PickerRow, { highlighted: i === providerIndex, children: [p.name, " (", p.id, ") ", keyMark, p.id === provider ? " (current)" : ""] }, p.id));
-                }) })) : keyPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsxs(Text, { bold: true, children: ["Atom \u2014 API key for ", keyPrompt.providerId, " (paste + Enter, Esc cancels):"] }), keyPrompt.consoleURL ? (_jsxs(Text, { dimColor: true, children: ["Get a key: ", keyPrompt.consoleURL] })) : null, keyPrompt.existingMasked ? (_jsxs(Text, { dimColor: true, children: ["key on file (", keyPrompt.existingMasked, ") \u2014 type a new key to replace, Esc keeps + switches"] })) : (_jsx(Text, { dimColor: true, children: "No key on file \u2014 paste once, validated then stored in ~/.atom/auth.json" })), keyPrompt.providerId === "kilo" ? (_jsx(Text, { dimColor: true, children: "Optional: free models work without a key \u2014 empty Enter continues anonymously" })) : null, _jsxs(Text, { children: ["key: ", theme.symbol.keyMask.repeat(keyPrompt.draft.length), _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), keyPrompt.validating ? _jsxs(Text, { dimColor: true, children: ["validating", theme.symbol.ellipsis] }) : null, keyPrompt.error ? _jsx(Text, { color: theme.color.error, children: keyPrompt.error }) : null] })) : baseURLPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsx(Text, { bold: true, children: "Atom \u2014 baseURL for openai-compatible (http(s) URL + Enter, Esc cancels):" }), _jsxs(Text, { children: ["baseURL: ", baseURLPrompt.draft, _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), baseURLPrompt.error ? _jsx(Text, { color: theme.color.error, children: baseURLPrompt.error }) : null] })) : selectingEffort ? (_jsxs(PickerShell, { title: "Atom \u2014 Select reasoning effort (up/down + Enter, Esc cancels):", children: [EFFORT_OPTIONS.map((o, i) => (_jsxs(PickerRow, { highlighted: i === effortIndex, children: [o === "auto" ? "Auto" : o === "max" ? "Max" : o[0]?.toUpperCase() + o.slice(1), o === effort ? " (current)" : ""] }, `${o}-${i}`))), _jsx(Text, { dimColor: true, children: "Auto lets the model decide; Low\u2192Max raise reasoning depth on every model." })] })) : selectingRewind ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind to checkpoint (up/down + Enter, Esc cancels):", children: [checkpointListMemo.map((c, i) => (_jsxs(PickerRow, { highlighted: i === rewindIndex, children: ["#", c.seq, " ", theme.symbol.separator, " ", c.label, " ", theme.symbol.separator, " ", c.files.length, " file(s)"] }, c.id))), _jsx(Text, { dimColor: true, children: "Restores exact bytes (hash-verified). Shell side effects (bash) are never snapshotted and cannot be undone." })] })) : selectingRewindScope ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind scope (up/down + Enter, Esc cancels):", children: [REWIND_SCOPES.map((s, i) => (_jsx(PickerRow, { highlighted: i === rewindScopeIndex, children: s }, s))), _jsx(Text, { dimColor: true, children: "Shell side effects (bash) are explicitly out of scope and cannot be undone." })] })) : (
-            // The input is the one boxed, prominent surface (see the memoized
-            // InputBox above): a quiet gray frame sets it apart from the
-            // transcript above and the status line below. Pickers and modals
-            // replace it (never stack with it), each carrying their own semantic
-            // border color.
-            _jsx(InputBox, { input: input, cursor: cursor })), slashVisible && !inspecting && !paletteOpen ? (_jsxs(PickerShell, { title: slashHasSkills
-                    ? `Atom commands + skills (${theme.symbol.moreAbove}/${theme.symbol.moreBelow} + Enter/Tab to run, Esc dismisses):`
-                    : `Atom commands (${theme.symbol.moreAbove}/${theme.symbol.moreBelow} + Enter/Tab to run, Esc dismisses):`, borderColor: theme.border.menu, children: [_jsx(PickerMoreAbove, { count: slashWin.start }), filteredSlash.slice(slashWin.start, slashWin.end).map((c) => (_jsxs(PickerRow, { highlighted: c.name === slashHighlight, highlightColor: theme.color.menuSelection, children: [c.name, c.description ? ` ${theme.symbol.descSeparator} ${c.description}` : ""] }, c.name))), _jsx(PickerMoreBelow, { count: filteredSlash.length - slashWin.end }), slashUsage ? _jsx(Text, { dimColor: true, children: slashUsage }) : null, slashMenu.moreSkills > 0 ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.ellipsis, "and ", slashMenu.moreSkills, " more skill", slashMenu.moreSkills === 1 ? "" : "s", " \u2014 keep typing to narrow"] })) : null] })) : null, _jsx(StatusBarHost, { provider: provider, model: model, usageTotals: usageTotals, contextLoad: contextLoad, reasoningDisplay: reasoningDisplay, mode: mode, trustAll: trustAll, busy: busy, activity: toolHint ? activityText(toolHint) : null, phaseLabel: phaseLabel, elapsedSecs: elapsedSecs, stalled: stalled, approvalPending: pendingApproval !== null, cwd: shortenCwd(process.cwd(), os.homedir()), branch: gitInfo?.branch ?? null, extensionStatus: extStatusText, goal: goal ? { objective: goal.objective, active: goal.active === true } : null })] }));
+    // Memoized goal slice for the status bar (render-stability): the inline
+    // literal used to defeat StatusBarHost's memo on every App render
+    // (keystrokes, 1s ticks) whenever a goal was active — a new object
+    // identity per render meant the whole status subtree reconciled for
+    // nothing. Identity now tracks the goal, not the render.
+    const goalStatus = useMemo(() => (goal ? { objective: goal.objective, active: goal.active === true } : null), [goal]);
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(TranscriptView, { turns: turns, clearGen: clearGen, end: scrollEnd, held: scrollEnd !== null, showThinking: showThinking }), _jsx(LiveTailHost, { store: streamStore, isEmpty: turns.length === 0, sessionHint: sessionHint, emptySessionTitle: turns.length === 0 ? sessionTitle : null, busy: busy, held: scrollEnd !== null, toolHint: toolHint, toolElapsedSecs: toolElapsedSecs, elapsedSecs: elapsedSecs, showThinking: showThinking }), error ? _jsxs(Text, { color: theme.color.error, children: ["error> ", error] }) : null, pendingApproval ? (_jsx(ApprovalBox, { toolName: pendingApproval.name, description: approvalDescription, selected: approveIndex, diff: pendingApproval.diff ?? null })) : null, pendingQuestion ? (_jsx(QuestionBox, { question: pendingQuestion.question, options: pendingQuestion.options, allowCustom: pendingQuestion.allowCustom, askCustom: askCustom, askSelIndex: askSelIndex })) : null, extPendingDialog && !pendingApproval && !pendingQuestion ? (_jsx(QuestionBox, { question: `[${extPendingDialog.owner}] ${extPendingDialog.question}`, options: extPendingDialog.options, allowCustom: extPendingDialog.allowCustom, askCustom: extDlgCustom, askSelIndex: extDlgSel }, `ext-dialog-${extPendingDialog.id}`)) : null, _jsx(TodoPanel, { items: todoSnap }), extWidgets.map((w) => (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.panel, paddingX: theme.spacing.pickerPadX, children: [_jsxs(Text, { bold: true, children: ["[", w.owner, "] ", w.title] }), _jsx(Text, { children: w.text })] }, `${w.owner}-${w.id}`))), steerPending ? _jsxs(Text, { dimColor: true, children: ["Steering: ", steerPending] }) : null, queue.length > 0 ? (_jsxs(Text, { dimColor: true, children: ["Queued (", queue.length, "): ", queue[0], queue.length > 1 ? ` +${queue.length - 1} more (/queue)` : ""] })) : null, _jsxs(Box, { flexDirection: "column", flexShrink: 0, children: [paletteOpen ? (_jsx(PalettePanel, { entries: paletteEntriesMemo, index: paletteIndex, filter: paletteFilter })) : inspecting ? (_jsx(InspectorPanel, { records: toolLogRef.current, index: inspectIndex, expanded: inspectExpanded, scroll: inspectScroll })) : selecting ? (_jsxs(PickerShell, { title: modelTitle, children: [_jsx(PickerMoreAbove, { count: modelWin.start }), modelEntries.slice(modelWin.start, modelWin.end).map((e, k) => {
+                                const i = modelWin.start + k;
+                                const entryLocal = e.local === true;
+                                const prevLocal = i === 0 ? null : modelEntries[i - 1]?.local === true;
+                                const showGroup = i === 0 || prevLocal !== entryLocal;
+                                const showHeader = showGroup || modelEntries[i - 1]?.providerId !== e.providerId;
+                                const def = getProvider(e.providerId);
+                                return (_jsxs(React.Fragment, { children: [showGroup ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.descSeparator, " ", entryLocal ? "Local" : "Remote"] })) : null, showHeader ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.descSeparator, " ", def?.name ?? e.providerId, entryLocal && isLocalProviderId(e.providerId)
+                                                    ? ` ${theme.symbol.separator} ${localBaseURLFor(e.providerId)}`
+                                                    : null, e.providerId === provider ? " (current)" : ""] })) : null, _jsxs(PickerRow, { highlighted: i === modelHi, children: [e.model, e.free === true ? _jsx(Text, { dimColor: true, children: " (free)" }) : null, e.providerId === provider && e.model === model ? " (current)" : ""] })] }, `${e.providerId}-${e.model}-${i}`));
+                            }), _jsx(PickerMoreBelow, { count: modelEntries.length - modelWin.end }), modelEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: "No models match \u2014 backspace to widen the filter." })) : null] })) : selectingSkills ? (_jsxs(PickerShell, { title: skillTitle, children: [_jsx(PickerMoreAbove, { count: skillWin.start }), skillEntries.slice(skillWin.start, skillWin.end).map((e, k) => {
+                                const i = skillWin.start + k;
+                                return (_jsxs(PickerRow, { highlighted: i === skillHi, children: ["/skill:", e.name, !e.userInvocable ? _jsx(Text, { dimColor: true, children: " [auto-only]" }) : null] }, `${e.name}-${i}`));
+                            }), _jsx(PickerMoreBelow, { count: skillEntries.length - skillWin.end }), skillEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: skillEntriesAll.length === 0
+                                    ? "No skills installed — add SKILL.md skills under .claude/skills/, .agents/skills/, or the ~/. counterparts."
+                                    : "No skills match — backspace to widen the filter." })) : null] })) : selectingSession ? (_jsxs(PickerShell, { title: sessionPickerTitle, children: [_jsx(PickerMoreAbove, { count: sessionWin.start }), sessionEntries.slice(sessionWin.start, sessionWin.end).map((e, k) => {
+                                const i = sessionWin.start + k;
+                                const age = formatSessionAge(Date.now(), e.updatedAt);
+                                return (_jsxs(PickerRow, { highlighted: i === sessionHi, children: [e.title, e.active ? " (current)" : "", _jsxs(Text, { dimColor: true, children: [" ", "\u00B7 ", e.turnCount, " turn", e.turnCount === 1 ? "" : "s", " \u00B7 ", age] })] }, `${e.id}-${i}`));
+                            }), _jsx(PickerMoreBelow, { count: sessionEntries.length - sessionWin.end }), sessionEntries.length === 0 ? (_jsx(Text, { dimColor: true, children: sessionEntriesAll.length === 0
+                                    ? "No sessions yet — your current conversation is saved automatically."
+                                    : "No sessions match — backspace to widen the filter." })) : null] })) : selectingProvider ? (_jsx(PickerShell, { title: "Atom \u2014 Select provider (up/down + Enter, Esc cancels):", children: PROVIDERS.map((p, i) => {
+                            const has = keyForProvider(p.id).length > 0;
+                            const keyMark = isLocalProviderId(p.id)
+                                ? `local ${theme.symbol.descSeparator} no key needed`
+                                : has
+                                    ? `${theme.symbol.keyPresent} key`
+                                    : p.id === "kilo"
+                                        ? `${theme.symbol.descSeparator} key optional — free models need none`
+                                        : `${theme.symbol.descSeparator} no key`;
+                            return (_jsxs(PickerRow, { highlighted: i === providerIndex, children: [p.name, " (", p.id, ") ", keyMark, p.id === provider ? " (current)" : ""] }, p.id));
+                        }) })) : keyPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsxs(Text, { bold: true, children: ["Atom \u2014 API key for ", keyPrompt.providerId, " (paste + Enter, Esc cancels):"] }), keyPrompt.consoleURL ? (_jsxs(Text, { dimColor: true, children: ["Get a key: ", keyPrompt.consoleURL] })) : null, keyPrompt.existingMasked ? (_jsxs(Text, { dimColor: true, children: ["key on file (", keyPrompt.existingMasked, ") \u2014 type a new key to replace, Esc keeps + switches"] })) : (_jsx(Text, { dimColor: true, children: "No key on file \u2014 paste once, validated then stored in ~/.atom/auth.json" })), keyPrompt.providerId === "kilo" ? (_jsx(Text, { dimColor: true, children: "Optional: free models work without a key \u2014 empty Enter continues anonymously" })) : null, _jsxs(Text, { children: ["key: ", theme.symbol.keyMask.repeat(keyPrompt.draft.length), _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), keyPrompt.validating ? _jsxs(Text, { dimColor: true, children: ["validating", theme.symbol.ellipsis] }) : null, keyPrompt.error ? _jsx(Text, { color: theme.color.error, children: keyPrompt.error }) : null] })) : baseURLPrompt ? (_jsxs(Box, { flexDirection: "column", borderStyle: theme.border.style, borderColor: theme.border.picker, paddingX: theme.spacing.pickerPadX, children: [_jsx(Text, { bold: true, children: "Atom \u2014 baseURL for openai-compatible (http(s) URL + Enter, Esc cancels):" }), _jsxs(Text, { children: ["baseURL: ", baseURLPrompt.draft, _jsx(Text, { color: theme.color.mutedPaint, children: theme.symbol.cursorBlock })] }), baseURLPrompt.error ? _jsx(Text, { color: theme.color.error, children: baseURLPrompt.error }) : null] })) : selectingEffort ? (_jsxs(PickerShell, { title: "Atom \u2014 Select reasoning effort (up/down + Enter, Esc cancels):", children: [EFFORT_OPTIONS.map((o, i) => (_jsxs(PickerRow, { highlighted: i === effortIndex, children: [o === "auto" ? "Auto" : o === "max" ? "Max" : o[0]?.toUpperCase() + o.slice(1), o === effort ? " (current)" : ""] }, `${o}-${i}`))), _jsx(Text, { dimColor: true, children: "Auto lets the model decide; Low\u2192Max raise reasoning depth on every model." })] })) : selectingRewind ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind to checkpoint (up/down + Enter, Esc cancels):", children: [checkpointListMemo.map((c, i) => (_jsxs(PickerRow, { highlighted: i === rewindIndex, children: ["#", c.seq, " ", theme.symbol.separator, " ", c.label, " ", theme.symbol.separator, " ", c.files.length, " file(s)"] }, c.id))), _jsx(Text, { dimColor: true, children: "Restores exact bytes (hash-verified). Shell side effects (bash) are never snapshotted and cannot be undone." })] })) : selectingRewindScope ? (_jsxs(PickerShell, { title: "Atom \u2014 Rewind scope (up/down + Enter, Esc cancels):", children: [REWIND_SCOPES.map((s, i) => (_jsx(PickerRow, { highlighted: i === rewindScopeIndex, children: s }, s))), _jsx(Text, { dimColor: true, children: "Shell side effects (bash) are explicitly out of scope and cannot be undone." })] })) : (
+                    // The input is the one boxed, prominent surface (see the memoized
+                    // InputBox above): a quiet gray frame sets it apart from the
+                    // transcript above and the status line below. Pickers and modals
+                    // replace it (never stack with it), each carrying their own semantic
+                    // border color.
+                    _jsx(InputBox, { input: input, cursor: cursor, busy: busy })), slashVisible && !inspecting && !paletteOpen ? (_jsxs(PickerShell, { title: slashHasSkills
+                            ? `Atom commands + skills (${theme.symbol.moreAbove}/${theme.symbol.moreBelow} + Enter/Tab to run, Esc dismisses):`
+                            : `Atom commands (${theme.symbol.moreAbove}/${theme.symbol.moreBelow} + Enter/Tab to run, Esc dismisses):`, borderColor: theme.border.menu, children: [_jsx(PickerMoreAbove, { count: slashWin.start }), filteredSlash.slice(slashWin.start, slashWin.end).map((c) => (_jsxs(PickerRow, { highlighted: c.name === slashHighlight, highlightColor: theme.color.menuSelection, children: [c.name, c.description ? ` ${theme.symbol.descSeparator} ${c.description}` : ""] }, c.name))), _jsx(PickerMoreBelow, { count: filteredSlash.length - slashWin.end }), slashUsage ? _jsx(Text, { dimColor: true, children: slashUsage }) : null, slashMenu.moreSkills > 0 ? (_jsxs(Text, { dimColor: true, children: [theme.symbol.ellipsis, "and ", slashMenu.moreSkills, " more skill", slashMenu.moreSkills === 1 ? "" : "s", " \u2014 keep typing to narrow"] })) : null] })) : null, _jsx(StatusBarHost, { provider: provider, model: model, usageTotals: usageTotals, contextLoad: contextLoad, loadEstimated: loadEstimated, reasoningDisplay: reasoningDisplay, mode: mode, trustAll: trustAll, busy: busy, activity: toolHint ? activityText(toolHint) : null, phaseLabel: phaseLabel, elapsedSecs: elapsedSecs, stalled: stalled, approvalPending: pendingApproval !== null, cwd: shortenCwd(process.cwd(), os.homedir()), branch: gitInfo?.branch ?? null, extensionStatus: extStatusText, goal: goalStatus })] })] }));
 }