dsh-code 1.0.7 → 1.3.0

package/src/index.ts

@@ -18,25 +18,26 @@ import { createElement } from 'react'
 import type { Context } from '@deepseek-ai/cordis'
 import z from '@deepseek-ai/schemastery'
 import { installModelSelection } from '@deepseek-ai/dsh-agent'
-import type { Agent, AgentHandle, ModelSelection, ModelSelectionRef } from '@deepseek-ai/dsh-agent'
+import type { Agent, AgentHandle, AgentStatus, Inbox, ModelSelection, ModelSelectionRef } from '@deepseek-ai/dsh-agent'
 import type {} from '@deepseek-ai/dsh-agent-default-model'
 import type {} from '@deepseek-ai/dsh-attachment'
 import { createUserMessage, MessageId, type ContentBlock } from '@deepseek-ai/dsh-llm'
 import type { JobSnapshot } from '@deepseek-ai/dsh-jobs'
 import { SessionId, SessionLogOffset, type Session, type SessionEvent, type SessionHeader, type UserMessage } from '@deepseek-ai/dsh-session'
-import type { SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
+import { deriveTurnTokenUsage } from '@deepseek-ai/dsh-token-meter/client'
+import { SessionAlreadyOwnedError, type SessionPersistence } from '@deepseek-ai/dsh-session-persistence'
 // Type-only: carries the ctx.sessionTitle service merge for /title.
 import type {} from '@deepseek-ai/dsh-session-title'
 // Empty type imports carry the loader Context merge for the settlement await
 // and the cmdline Context merge for the appExit host value.
 import type {} from '@deepseek-ai/cordis-plugin-loader'
 import type {} from '@deepseek-ai/dsh-cmdline'
-import { App, type NoticeTone } from './app.ts'
+import { App, type NoticeTone, type QueueMutation } from './app.ts'
 import { mountApprovalAnswerer, type ApprovalStore } from './approval.ts'
 import { isSlashLine, submissionPayload, watchCommands, type CommandsView } from './commands.ts'
 import { internals, type TuiMount } from './internals.ts'
 import { syncModelCapabilities } from './model-capabilities.ts'
-import { buildModelSelection, applyModelSelectionToConfig, loadModelDirectory, modelSelectionLabel, resolveEffectiveSelection, type ModelRow } from './models.ts'
+import { buildModelSelection, applyModelSelectionToConfig, loadModelDirectory, modelSelectionLabel, pendingModelSelection, resolveEffectiveSelection, type ModelRow } from './models.ts'
 import {
   discoverProviderModels,
   loadProviderSettings,
@@ -70,7 +71,15 @@ import {
   subscribeProviderAuthorizations,
 } from './authorization.ts'
 import { selectForkSeed } from './fork.ts'
-import { buildReviewPrompt, loadGitDiff } from './git-workflow.ts'
+import {
+  buildReviewPrompt,
+  listReviewBranches,
+  listReviewCommits,
+  loadCommitDiff,
+  loadGitDiff,
+  mergeBaseWith,
+  type ReviewSelection,
+} from './git-workflow.ts'
 import type { TuiStartup } from './startup.ts'
 import { SessionSwitchQueue } from './session-switch.ts'
 import { agentPresetsFrom, normalizePresetId, resolvePreset, selectPreset } from './presets.ts'
@@ -85,22 +94,32 @@ import { listPluginRows } from './plugin-inventory.ts'
 import { applyLauncherUpdate, probeLauncherUpdate } from './update.ts'
 import { parseAnimationsPref } from './render/animations.ts'
 import { parseThemeName, setTheme, type ThemeName } from './theme.ts'
+import { parseLanguageName, setLanguage, t, type LanguageName } from './i18n.ts'
 import {
+  acquireSessionDeletionLeases,
   isSubagentSession,
   matchSessionId,
   mergeSessionTitles,
   newestRootForCwd,
+  sessionRowMatchesQuery,
   isSessionArtifactName,
   jsonlSessionRoot,
   planSessionDeletion,
   projectSessionRows,
+  releaseSessionDeletionLeases,
   sessionArtifactDirectory,
   sessionDirectoryFor,
   type SessionDirectoryOptions,
   type SessionQueryService,
   type SessionRow,
 } from './session-directory.ts'
+import type { JobRow, SearchRow } from './kernel-panels.ts'
 import { createUserSettingsPersistence, writeFileAtomically } from './settings-file.ts'
+import { turnUsages, type UsageView } from './render/usage.ts'
+// Type-only import: merges the projection registry into the Context type so
+// `ctx.get('sessionProjections')` is typed (the service itself is mounted by
+// dsh-base at runtime).
+import type {} from '@deepseek-ai/dsh-session-projection'
 
 /** Stable Cordis plugin name. */
 export const name = 'tui-runner'
@@ -128,7 +147,7 @@ export const Config: z<Config> = z.object({
 /** Process-facing effects of the runner: the Ink mount plus the launcher's exit request. */
 interface TuiIo {
   mount: typeof internals.mount
-  exit(code: number): void
+  exit: (code: number) => void
 }
 
 /** Report an unexpected direct-driver failure and request a failing exit. */
@@ -147,7 +166,7 @@ function fail(io: TuiIo, error: unknown): void {
  * @param caller - the active agent (undefined sees only unowned jobs).
  * @returns job rows in registration order; never throws.
  */
-function listJobs(ctx: Context, caller: Agent | undefined): readonly import('./kernel-panels.ts').JobRow[] {
+function listJobs(ctx: Context, caller: Agent | undefined): readonly JobRow[] {
   const jobs = ctx.get('jobs')
   if (jobs === undefined) return []
   try {
@@ -165,6 +184,23 @@ function listJobs(ctx: Context, caller: Agent | undefined): readonly import('./k
   }
 }
 
+/**
+ * Read one user-level settings file as a plain object. The callers all treat a
+ * missing file as "unset" and a corrupt one as "warn and fall back", so this
+ * helper owns the one distinction they share: readable JSON that is not an
+ * object is corruption, not an absent preference, and must not surface as a
+ * cryptic property access on `null`.
+ * @param path - absolute path of the settings file.
+ * @returns the parsed object; the caller narrows each field itself.
+ */
+function readSettingsObject(path: string): Record<string, unknown> {
+  const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'))
+  if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+    throw new Error(`${basename(path)} must contain a JSON object`)
+  }
+  return parsed as Record<string, unknown>
+}
+
 /**
  * Resolve the working directory's git branch for the status line.
  * @param cwd - the session's working directory.
@@ -189,6 +225,8 @@ interface Target {
   cwd?: string
   seed?: readonly SessionEvent[]
   parentSession?: SessionId
+  /** Marks the session as a subagent conversation in the durable header. */
+  origin?: 'subagent'
   seedLength?: number
 }
 
@@ -253,10 +291,100 @@ export async function runQuitSequence(
 /** One composer submission waiting behind the startup delivery. */
 export interface QueuedSubmission {
   readonly text: string
+  /** `steer` inserts into the running turn; `followup` waits for the next one. */
   readonly mode: 'followup' | 'steer'
   readonly images: readonly ContentBlock[]
 }
 
+/** What one requested queue mutation did; the runner maps it to one notice. */
+export type QueueMutationOutcome =
+  | 'removed'
+  | 'edited'
+  | 'steered'
+  | 'unavailable'
+  | 'empty'
+  | 'steerUnavailable'
+
+/**
+ * Replace one queued message's text while keeping its attachments. A queue
+ * edit rewrites what the user typed, not what they attached: image and file
+ * blocks ride through in delivery order (text first, then attachments, the
+ * shape {@link deliverLine} submits). Dropping them here would silently strip
+ * an attachment the user already confirmed, so this is the edit's single
+ * definition and the panel's read-only marker only mirrors it.
+ */
+export function queueEditContent(content: readonly ContentBlock[], text: string): ContentBlock[] {
+  const attachments = content.filter(block => block.type !== 'text')
+  return [{ type: 'text', text }, ...attachments]
+}
+
+/**
+ * Apply one terminal queue mutation to the live inbox. The decision and the
+ * inbox change are pure over the supplied handles so every branch is testable
+ * without an agent; steering itself is injected because it wakes the driver
+ * rather than mutating the inbox. The durable inbox splices remain the UI's
+ * single source of truth — this helper never reports a state the inbox did not
+ * actually reach.
+ * @param inbox - the live agent inbox (pending lists plus its mutators).
+ * @param status - the agent's lifecycle status; steering needs `running`.
+ * @param messageId - identity of the queued message to mutate.
+ * @param action - the requested mutation.
+ * @param steer - submits the removed message as next-step steering.
+ * @returns the outcome the caller reports.
+ */
+export function applyQueueMutation(
+  inbox: Pick<Inbox, 'nextTurn' | 'append' | 'remove' | 'replace'>,
+  status: AgentStatus,
+  messageId: string,
+  action: QueueMutation,
+  steer: (message: UserMessage) => void,
+): QueueMutationOutcome {
+  const id = MessageId(messageId)
+  const message = inbox.nextTurn.find(candidate => candidate.id === id)
+  if (message === undefined) return 'unavailable'
+  switch (action.kind) {
+    case 'remove':
+      return inbox.remove(id) ? 'removed' : 'unavailable'
+    case 'edit':
+      if (action.text.trim() === '') return 'empty'
+      inbox.replace(id, createUserMessage({
+        content: queueEditContent(message.content, action.text),
+        source: message.source,
+      }))
+      return 'edited'
+    case 'steer':
+      if (status !== 'running') return 'steerUnavailable'
+      // Steer promotes the message out of next-turn, so a failing submit must
+      // put it back: the row the user was looking at never just disappears.
+      if (!inbox.remove(id)) return 'unavailable'
+      try {
+        steer(message)
+      } catch (error: unknown) {
+        inbox.append('next-turn', message)
+        throw error
+      }
+      return 'steered'
+  }
+}
+
+/**
+ * Cancel the active turn while keeping the next-turn queue, then wake the
+ * driver again so the preserved messages actually run. `cancel` clears
+ * pending work by default and never wakes the driver on its own, so the queue
+ * is captured first and re-submitted afterwards: a waking submission latches
+ * the wake while the aborted activity converges to idle, which is what turns
+ * "preserved" into "sent next" instead of "parked forever". Next-step
+ * steering is deliberately dropped — it belonged to the cancelled turn.
+ * @param agent - the live agent handle.
+ * @returns how many queued messages were preserved across the abort.
+ */
+export function cancelPreservingQueue(agent: Pick<Agent, 'inbox' | 'cancel' | 'followup'>): number {
+  const queued = [...agent.inbox.nextTurn]
+  agent.cancel({ kind: 'user' })
+  for (const message of queued) agent.followup(message)
+  return queued.length
+}
+
 /**
  * Whether a tagged submission still belongs to the active session. Attachment
  * prepares resolve on the microtask timeline, while a queued session switch
@@ -269,6 +397,44 @@ export function submissionBelongsToSession(origin: string | undefined, activeSes
   return origin === undefined || origin === '' || origin === activeSessionId
 }
 
+/**
+ * Root-log catalog facts a resumed session must replay into the subagent
+ * feed: constructor seeds never fire on the live bus, so without this the
+ * children of a resumed session vanish behind a restart. The empty-child
+ * placeholder row (childId '') is a placeholder, not a child, and stays out.
+ */
+export function subagentCatalogSeed(events: readonly SessionEvent[]): readonly SessionEvent<'subagent/catalog'>[] {
+  return events.filter((event): event is SessionEvent<'subagent/catalog'> =>
+    event.type === 'subagent/catalog' && event.data.childId !== '')
+}
+
+/**
+ * Map one cross-session full-text hit onto the /search panel's row (pure).
+ * Labels fall back to the short id form — the engine's hit carries the
+ * strongest matching event, not the title observation.
+ */
+export function searchHitToRow(hit: {
+  header: SessionHeader
+  bestMatch: { snippet: string; time: number }
+}): SearchRow {
+  const subagent = hit.header.origin === 'subagent'
+  const cwd = hit.header.cwd ?? ''
+  // Session cwds may arrive in either separator style regardless of the
+  // observing host (a workspace synced from Windows), so split on both.
+  const workspace = cwd.split(/[\\/]/u).filter(part => part !== '').at(-1) ?? ''
+  const preset = hit.header.agentPreset ?? ''
+  const flat = hit.bestMatch.snippet.replace(/\s+/gu, ' ').trim()
+  return {
+    id: hit.header.id,
+    label: hit.header.id.slice(-12),
+    detail: [workspace, preset].filter(part => part !== '').join(' · '),
+    snippet: flat.length > 158 ? `${flat.slice(0, 157)}…` : flat,
+    updatedAt: hit.bestMatch.time,
+    subagent,
+    resumable: !subagent,
+  }
+}
+
 /** One Shift+Tab station decision for the mode cycle. */
 export type ModeCycleDecision =
   | { readonly kind: 'permission'; readonly preset: string }
@@ -285,17 +451,26 @@ export type ModeCycleDecision =
  * parked on read-only), and leaving it lands on the next preset after the
  * most restrictive one. Without the /plan command the cycle is exactly the
  * preset table.
+ *
+ * `planIntent` covers the committed fold's commit lag: upstream queues a
+ * plan switch during an open turn (and the command pipeline is async even
+ * idle), so the durable plan/mode event lands AFTER the press that chose
+ * it. While an intent from an earlier press is in flight it — not the
+ * stale committed fold — decides the station, so repeated presses advance
+ * the cycle instead of re-issuing the same plan transition (the stuck
+ * plan-on/plan-off toggle). Undefined falls back to the committed fold.
  */
 export function planCycleDecision(input: {
   readonly names: readonly string[]
   readonly current: string
   readonly inPlan: boolean
   readonly planAvailable: boolean
+  readonly planIntent?: boolean
 }): ModeCycleDecision | undefined {
   const names = input.names
   if (names.length === 0) return undefined
-  const first = names[0]!
-  if (input.inPlan) return { kind: 'plan-off', preset: names[1] ?? first }
+  const first = names[0]
+  if ((input.planIntent ?? input.inPlan) === true) return { kind: 'plan-off', preset: names[1] ?? first }
   const at = names.indexOf(input.current)
   if (at === 0 && input.planAvailable) return { kind: 'plan-on' }
   return { kind: 'permission', preset: names[(at + 1) % names.length] ?? first }
@@ -398,7 +573,7 @@ function approvalCommandPreview(events: readonly { kind: string }[], callId: str
 /** The runner's connection between the React app and the process side. */
 interface AppBridge {
   /** Post one local notice line (feedback the transcript does not carry). */
-  notify(text: string, tone?: NoticeTone): void
+  notify: (text: string, tone?: NoticeTone) => void
 }
 
 /**
@@ -444,6 +619,13 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     mode: string
     selection: { picked?: ModelSelection }
     resumed: boolean
+    /**
+     * Root-log `subagent/catalog` facts (resume path): constructor seeds
+     * never fire on the live bus, so activation replays them into the
+     * subagent feed after its reset — a resumed session's children stay
+     * visible instead of vanishing behind a restart.
+     */
+    catalogSeed: readonly SessionEvent<'subagent/catalog'>[]
   }
 
   /** Prepare a complete next session before disturbing the currently visible one. */
@@ -497,6 +679,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           cwd: nextCwd,
           agentPreset: mode,
           ...(next.parentSession === undefined ? {} : { parentSession: next.parentSession }),
+          ...(next.origin === undefined ? {} : { origin: next.origin }),
           // 0.1.5 fork lineage: the seed marker lives on the metadata and the
           // inherited prefix length on the top-level option (the v0 header's
           // numeric `seedLength` field is gone from the create contract).
@@ -512,15 +695,24 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     if (!next.resume && permissionPresets !== undefined) {
       applyPendingPermission(permissionPresets, session, pendingPermission)
     }
+    const seedEvents = session.snapshotEvents()
+    // Resume precedence, middle layer: the log's unconsumed `model/selection`
+    // (a pick the web host recorded that no request ever assembled) outranks
+    // the older request header; an in-process pick still outranks both.
+    if (next.resume && selectionState.picked === undefined) {
+      const pending = pendingModelSelection(seedEvents)
+      if (pending !== undefined) selectionState.picked = pending
+    }
     return {
       handle,
       agent: handle.agent,
       session,
-      store: createTranscriptStore(session.snapshotEvents()),
+      store: createTranscriptStore(seedEvents),
       mentions: createMentions(ctx, handle.agent, session.header.cwd ?? nextCwd),
       mode: mode ?? 'standard',
       selection: selectionState,
       resumed: next.resume,
+      catalogSeed: subagentCatalogSeed(seedEvents),
     }
   }
 
@@ -549,6 +741,14 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
    * session composes, so the first assembled step already plans.
    */
   let pendingPlan = false
+  /**
+   * In-flight mid-session plan choice from the Shift+Tab cycle. Upstream
+   * queues a plan switch during an open turn (and the command pipeline is
+   * async even idle), so the committed plan/mode fold lags the press that
+   * chose it; the cycle reads this intent until the durable event lands,
+   * then the session/event funnel clears it.
+   */
+  let planIntent: boolean | undefined
   /**
    * Whether the pre-session effective preset composes plan mode, answered by
    * the presets service composition inventory (minimal does not). Cached and
@@ -616,6 +816,9 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     session = prepared.session
     store = prepared.store
     mentions = prepared.mentions
+    // Replayed catalog facts rebuild the resumed session's child rows before
+    // the first render (the live handler only folds events from now on).
+    for (const event of prepared.catalogSeed) subagents.apply(event.data.childId, event)
   }
 
   // Seed the transcript from the full session log: constructor seeds never
@@ -626,6 +829,10 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     if (session === undefined) return
     if (subject.id === session.id) {
       store.apply(event)
+      // The committed plan fold caught up (or diverged via a typed /plan or
+      // an approved plan review): the durable event is the live truth again,
+      // so the cycle's in-flight intent retires.
+      if (event.type === 'plan/mode') planIntent = undefined
       // The parent-owned subagent catalog rides the ROOT log (0.1.5); each
       // fact describes one child, so it feeds that child's live row.
       if (event.type === 'subagent/catalog' && event.data.childId !== '') subagents.apply(event.data.childId, event)
@@ -741,7 +948,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let statuslineWarning: string | undefined
   let statuslineItems: readonly string[] = []
   try {
-    statuslineItems = parseStatuslineItems(JSON.parse(readFileSync(statuslinePath, 'utf8')).items)
+    statuslineItems = parseStatuslineItems(readSettingsObject(statuslinePath).items)
   } catch (error) {
     statuslineItems = parseStatuslineItems(undefined)
     if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
@@ -757,7 +964,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     statuslineItems = [...items]
     void settingsPersistence.save(statuslinePath, JSON.stringify({ items }, null, 2) + '\n')
       .catch((writeError: unknown) => {
-        bridge.notify('statusline save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.statuslineSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
@@ -780,7 +987,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let themeWarning: string | undefined
   if (startup.theme === undefined) {
     try {
-      setTheme(parseThemeName(JSON.parse(readFileSync(themePath, 'utf8')).theme))
+      setTheme(parseThemeName(readSettingsObject(themePath).theme))
     } catch (error) {
       if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
         themeWarning = error instanceof Error ? error.message : String(error)
@@ -793,7 +1000,27 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     setTheme(name)
     void settingsPersistence.save(themePath, JSON.stringify({ theme: name }, null, 2) + '\n')
       .catch((writeError: unknown) => {
-        bridge.notify('theme save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.themeSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
+      })
+  }
+
+  // /language persistence: one user-level JSON file beside theme.json. A
+  // missing file means English; a corrupt file degrades to English with a
+  // surfaced warning.
+  const languagePath = join(homedir(), '.dsh', 'dsh-code', 'language.json')
+  let languageWarning: string | undefined
+  try {
+    setLanguage(parseLanguageName(readSettingsObject(languagePath).language))
+  } catch (error) {
+    if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
+      languageWarning = error instanceof Error ? error.message : String(error)
+    }
+  }
+  const saveLanguage = (name: LanguageName): void => {
+    setLanguage(name)
+    void settingsPersistence.save(languagePath, JSON.stringify({ language: name }, null, 2) + '\n')
+      .catch((writeError: unknown) => {
+        bridge.notify(t('notice.languageSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
@@ -806,8 +1033,9 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let animationsEnabled = true
   let animationsWarning: string | undefined
   try {
-    // `?? {}` keeps a literal `null` file from surfacing a cryptic TypeError.
-    animationsEnabled = parseAnimationsPref((JSON.parse(readFileSync(animationsPath, 'utf8')) ?? {}).animations)
+    // A literal `null` file reads as corruption and surfaces the warning the
+    // block above promises, instead of a property access on `null`.
+    animationsEnabled = parseAnimationsPref(readSettingsObject(animationsPath).animations)
   } catch (error) {
     if ((error as NodeJS.ErrnoException).code !== 'ENOENT') {
       animationsWarning = error instanceof Error ? error.message : String(error)
@@ -816,7 +1044,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   const saveAnimations = (enabled: boolean): void => {
     void settingsPersistence.save(animationsPath, JSON.stringify({ animations: enabled }, null, 2) + '\n')
       .catch((writeError: unknown) => {
-        bridge.notify('animations save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.animationsSaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
@@ -860,19 +1088,32 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       .then(() => mkdir(dirname(historyPath), { recursive: true }))
       .then(() => appendFileAsync(historyPath, historyLine(text), 'utf8'))
       .catch((writeError: unknown) => {
-        bridge.notify('history save failed: ' + (writeError instanceof Error ? writeError.message : String(writeError)), 'error')
+        bridge.notify(t('notice.historySaveFailed', { message: writeError instanceof Error ? writeError.message : String(writeError) }), 'error')
       })
   }
 
-  /** Cancel one queued inbox message (Delete on the empty composer); the durable splice retires its pending row. */
-  const cancelQueued = (messageId: string): void => {
-    if (agent === undefined) return
+  /** Mutate one next-turn inbox item; durable inbox splices remain the UI truth. */
+  const updateQueued = (messageId: string, action: QueueMutation): void => {
+    const current = agent
+    if (current === undefined) return
     try {
-      if (agent.inbox.remove(MessageId(messageId))) {
-        bridge.notify('queued message cancelled')
+      const outcome = applyQueueMutation(
+        current.inbox,
+        current.status,
+        messageId,
+        action,
+        message => current.steer(message),
+      )
+      switch (outcome) {
+        case 'removed': bridge.notify(t('notice.queueCancelled')); return
+        case 'edited': bridge.notify(t('notice.queueEdited')); return
+        case 'steered': bridge.notify(t('notice.queueSteered')); return
+        case 'empty': bridge.notify(t('notice.queueEditEmpty'), 'warning'); return
+        case 'steerUnavailable': bridge.notify(t('notice.queueSteerUnavailable'), 'warning'); return
+        case 'unavailable': bridge.notify(t('notice.queueUnavailable'), 'warning'); return
       }
     } catch (error: unknown) {
-      bridge.notify('queue cancel failed: ' + (error instanceof Error ? error.message : String(error)), 'error')
+      bridge.notify(t('notice.queueActionFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     }
   }
 
@@ -937,7 +1178,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     }
     const registry = ctx.get('commands')
     if (registry === undefined) {
-      bridge.notify('no command registry is mounted in this composition', 'error')
+      bridge.notify(t('notice.commandRegistryMissing'), 'error')
       return
     }
     const controller = new AbortController()
@@ -965,13 +1206,17 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
             source: { kind: 'user' },
           }))
         } catch (error: unknown) {
-          bridge.notify(`command fallback failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+          bridge.notify(t('notice.commandFallbackFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
         }
       }
     }, (error: unknown) => {
       finish()
       if (epoch !== atEpoch || agent !== currentAgent) return
-      bridge.notify(`command failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      // A failed plan switch never appends the plan/mode event the cycle's
+      // intent retirement waits for, so the in-flight choice dies here too —
+      // otherwise every later Shift+Tab reads a phantom plan state.
+      if (line === '/plan' || line === '/plan off') planIntent = undefined
+      bridge.notify(t('notice.commandFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     })
   }
 
@@ -979,13 +1224,12 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   let deliveryChain: { epoch: number; tail: Promise<void> } = { epoch: 0, tail: Promise.resolve() }
 
   /** Deliver one trimmed line to the live session, expanding mentions first. */
-  const deliverLine = (line: string, mode: 'followup' | 'steer', images: readonly ContentBlock[] = []): void => {
+  const deliverLine = (line: string, images: readonly ContentBlock[] = [], mode: 'followup' | 'steer' = 'followup'): void => {
     const currentAgent = agent!
-    const currentMentions = mentions!
+    const currentMentions = mentions
     // The command registry is a closed namespace: slash lines run out of
-    // band and never reach the model through this path (steering keeps the
-    // registry out of the inbox, so slash lines steer as literal text).
-    if (images.length === 0 && isSlashLine(line) && mode === 'followup') {
+    // band and never reach the model through this path.
+    if (images.length === 0 && isSlashLine(line)) {
       runSlash(line)
       return
     }
@@ -993,7 +1237,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     try {
       parsed = currentMentions.parse(line)
     } catch (error: unknown) {
-      bridge.notify(`invalid session reference: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.invalidReference', { message: error instanceof Error ? error.message : String(error) }), 'error')
       return
     }
     // Ordered delivery: the inbox order IS the user's message order. A line
@@ -1023,15 +1267,12 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           content,
           source: { kind: 'user' },
         })
-        if (mode === 'steer') {
-          // The queued message is visible as a pending transcript row (the
-          // web queue-mirror contract); no notice noise on the happy path.
-          currentAgent.steer(message)
-        } else {
-          currentAgent.followup(message)
-        }
+        // Steering is consumed at the next step boundary of the turn already
+        // running; a followup becomes its own turn instead.
+        if (mode === 'steer') currentAgent.steer(message)
+        else currentAgent.followup(message)
       } catch (error: unknown) {
-        bridge.notify(`${mode === 'steer' ? 'steering' : 'message'} failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+        bridge.notify(t('notice.messageFailed', { kind: mode === 'steer' ? 'steering' : 'message', message: error instanceof Error ? error.message : String(error) }), 'error')
       }
     }
     if (parsed.references.length === 0) {
@@ -1040,14 +1281,18 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     }
     const controller = new AbortController()
     pendingControllers.add(controller)
-    enqueueDelivery(() => currentMentions.prepare(parsed, controller.signal).then((prepared) => {
-      pendingControllers.delete(controller)
-      deliver(prepared.text, prepared.additionalContext)
-    }, (error: unknown) => {
-      pendingControllers.delete(controller)
-      if (controller.signal.aborted || epoch !== atEpoch) return
-      bridge.notify(`session reference failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
-    }))
+    // `enqueueDelivery` returns nothing; the delivery chain only orders the
+    // work, so the promise is consumed here with an explicit void.
+    enqueueDelivery(() => {
+      void currentMentions.prepare(parsed, controller.signal).then((prepared) => {
+        pendingControllers.delete(controller)
+        deliver(prepared.text, prepared.additionalContext)
+      }, (error: unknown) => {
+        pendingControllers.delete(controller)
+        if (controller.signal.aborted || epoch !== atEpoch) return
+        bridge.notify(t('notice.referenceFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
+      })
+    })
   }
 
   // Deferred first-session creation for a bare launch: the session is composed
@@ -1073,7 +1318,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         // (which would orphan the live one without a dispose).
         if (session !== undefined) {
           const queued = pendingInputs.splice(0)
-          for (const item of queued) deliverLine(item.text, item.mode, item.images)
+          for (const item of queued) deliverLine(item.text, item.images, item.mode)
           return
         }
         const next = await prepare({
@@ -1093,6 +1338,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           store = next.store
           mentions = next.mentions
           subagents.reset()
+          for (const event of next.catalogSeed) subagents.apply(event.data.childId, event)
           pendingMode = undefined
           pendingPermission = undefined
           commands.setAgent(agent)
@@ -1121,7 +1367,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           }
           await next.handle.dispose().catch(() => {})
           if (!quitting) renderCurrent()
-          bridge.notify(`session activation failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+          bridge.notify(t('notice.activationFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
           return
         }
         abortPendingControllers()
@@ -1132,52 +1378,62 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           // A pre-session plan choice materializes as the registry command
           // delivered AHEAD of the queued lines, so the first assembled step
           // of the user's opening message already runs in plan mode.
-          deliverLine('/plan', 'followup')
+          deliverLine('/plan')
         }
-        for (const item of queued) deliverLine(item.text, item.mode, item.images)
+        for (const item of queued) deliverLine(item.text, item.images, item.mode)
       } finally {
         creating = false
       }
     }).catch((error: unknown) => {
       pendingInputs.length = 0
-      bridge.notify(`session creation failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.creationFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     })
   }
 
   /** Deliver one readable line to the agent, expanding session mentions first. */
-  const sendNow = (text: string, mode: 'followup' | 'steer', images: readonly ContentBlock[] = []): void => {
+  const sendNow = (text: string, images: readonly ContentBlock[] = [], mode: 'followup' | 'steer' = 'followup'): void => {
     // Blank check on the trimmed form; the payload itself keeps the draft's
     // exact whitespace unless the line is a syntactic slash command.
     const line = submissionPayload(text)
     if (line.trim() === '' && images.length === 0) return
+    // A switch between the idle wait and the handoff keeps the OLD session
+    // installed: a line delivered now would start a turn the handoff discards.
+    // Refusing loudly beats losing it silently — the caller can retry after the
+    // switch, and `switchQueue.cancel()` is the way out.
+    if (switchQueue.activating) {
+      bridge.notify(t('notice.switchInProgress'), 'warning')
+      return
+    }
     if (images.length === 0 && line.startsWith('/mode ')) {
       void switchModeAction(line.slice(6).trim()).then(
-        selected => bridge.notify(`mode → ${selected}`),
-        error => bridge.notify(`mode switch failed: ${error instanceof Error ? error.message : String(error)}`, 'error'),
+        selected => bridge.notify(t('notice.modeChanged', { value: selected })),
+        error => bridge.notify(t('notice.modeChangeFailed', { message: error instanceof Error ? error.message : String(error) }), 'error'),
       )
       return
     }
     if (images.length === 0 && line.startsWith('/permission ')) {
       try {
         const selected = setPermissionAction(line.slice(12).trim())
-        bridge.notify(`permission → ${selected}`)
+        bridge.notify(t('notice.permissionChanged', { value: selected }))
       } catch (error: unknown) {
-        bridge.notify(`permission change failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+        bridge.notify(t('notice.permissionChangeFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
       }
       return
     }
     if (session === undefined) {
+      // The delivery mode rides the buffered line: a steer picked before the
+      // first session exists must still steer once that session composes.
       pendingInputs.push({ text: line, mode, images })
       ensureSession()
       return
     }
-    deliverLine(line, mode, images)
+    deliverLine(line, images, mode)
   }
 
   // Startup serialization: input submitted while the startup prompt/images
   // are still preparing queues behind the initial request.
-  const inputGate = new StartupInputGate(({ text, mode, images }) => sendNow(text, mode, images))
-  const send = (text: string, mode: 'followup' | 'steer', images: readonly ContentBlock[] = []): void => {
+  const inputGate = new StartupInputGate(({ text, mode, images }) => sendNow(text, images, mode))
+  const send = (text: string, images: readonly ContentBlock[] = [], mode: 'followup' | 'steer' = 'followup'): void => {
     inputGate.submit({ text, mode, images })
   }
 
@@ -1187,28 +1443,33 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     // session (queued switch): the composing session is gone, so the stale
     // delivery is dropped instead of landing in the new session's inbox.
     if (!submissionBelongsToSession(origin, session?.id)) return
-    send(text, 'followup', images)
+    send(text, images)
   }
 
   /**
-   * Submit steering: a running driver consumes the text at its next step
-   * boundary (the inbox delivers between steps); an idle driver just starts
-   * a turn, so this doubles as the busy-state submit path.
+   * Deliver one line as steering: a running driver consumes it at its next
+   * step boundary, an idle one starts a turn with it. The composer's Tab
+   * toggle picks this over {@link dispatch} for the next submission.
    */
   const steer = (text: string, images: readonly ContentBlock[] = [], origin?: string): void => {
     if (!submissionBelongsToSession(origin, session?.id)) return
-    send(text, 'steer', images)
+    send(text, images, 'steer')
   }
 
-  /** Interrupt the running turn (Esc); true when a turn was actually cancelled. */
+  /**
+   * Interrupt the running turn (Esc); true when a turn was actually
+   * cancelled. {@link cancelPreservingQueue} keeps the next-turn queue alive
+   * AND re-wakes the driver, so the preserved messages run instead of
+   * parking; next-step steering dies with the turn.
+   */
   const interrupt = (): boolean => {
     if (agent === undefined || agent.status !== 'running') return false
     try {
-      agent.cancel({ kind: 'user' })
-      bridge.notify('turn cancelled — Ctrl+C or /quit to exit')
+      const preserved = cancelPreservingQueue(agent)
+      bridge.notify(t(preserved > 0 ? 'notice.turnCancelledKeepQueue' : 'notice.turnCancelled'))
       return true
     } catch (error: unknown) {
-      bridge.notify(`cancel failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.cancelFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
       return false
     }
   }
@@ -1233,11 +1494,15 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
    * so minimal sessions and the pre-session state cycle permissions only).
    * Plan transitions submit the upstream registry command — it stays the
    * single owner of plan state; the TUI renders the durable plan/mode event
-   * it appends. Returns the notice label, or '' when nothing changed.
+   * it appends. Because that event lags the press (upstream queues the
+   * switch during an open turn), each mid-session plan decision records the
+   * choice in `planIntent` and the next press reads it back, so the cycle
+   * advances stations instead of re-issuing one transition. Returns the
+   * notice label, or '' when nothing changed.
    */
   const cycleMode = (): string => {
     if (permissionPresets === undefined || permissionPresets.names.length === 0) {
-      bridge.notify('permission presets are not mounted in this composition', 'warning')
+      bridge.notify(t('notice.permissionPresetsUnmounted'), 'warning')
       return ''
     }
     try {
@@ -1250,6 +1515,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         names: permissionPresets.names,
         current: effectivePermission(permissionPresets, session, pendingPermission),
         inPlan: preSession ? pendingPlan : store.getView().plan === true,
+        ...(preSession ? {} : { planIntent }),
         planAvailable: preSession ? preSessionPlanAvailable : commands.descriptors.some(descriptor => descriptor.name === 'plan'),
       })
       if (decision === undefined) return ''
@@ -1270,7 +1536,8 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           renderCurrent()
           return 'plan → on (applies to the first session)'
         }
-        send('/plan', 'followup')
+        planIntent = true
+        send('/plan')
         return 'plan → on'
       }
       // Leaving plan lands on the station after the most restrictive
@@ -1281,11 +1548,12 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         renderCurrent()
         return `plan → off · permission → ${decision.preset}`
       }
-      send('/plan off', 'followup')
+      planIntent = false
+      send('/plan off')
       selectPermission(permissionPresets, session, decision.preset)
       return `plan → off · permission → ${decision.preset}`
     } catch (error: unknown) {
-      bridge.notify(`mode change failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.modeChangeFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
       return ''
     }
   }
@@ -1311,7 +1579,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     // it. Save failures degrade to a notice — the in-session switch already
     // took effect and must not roll back (the web contract).
     void defaultModel.saveSelection(selection).catch((error: unknown) => {
-      bridge.notify(`model switch applies to this session but was not saved as the default: ${error instanceof Error ? error.message : String(error)}`, 'warning')
+      bridge.notify(t('notice.modelNotDefault', { message: error instanceof Error ? error.message : String(error) }), 'warning')
     })
     // Advisory immediate validation (web selectModel parity): run the same
     // local resolveCallConfig check the request pipeline would, so a stale
@@ -1330,7 +1598,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         model: selection.model,
         ...selection.reasoningEffort === undefined ? {} : { reasoningEffort: selection.reasoningEffort },
       })).catch((error: unknown) => {
-        bridge.notify(`model selection rejected: ${error instanceof Error ? error.message : String(error)} — reopen /model to pick again`, 'error')
+        bridge.notify(t('notice.modelSelectionRejected', { message: error instanceof Error ? error.message : String(error) }), 'error')
       })
     }
     return `${row.provider}/${row.model}`
@@ -1359,7 +1627,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
    */
   const exportTranscript = async (argument: string): Promise<void> => {
     if (session === undefined) {
-      bridge.notify('no session yet — submit a message to start', 'warning')
+      bridge.notify(t('notice.noSessionYet'), 'warning')
       return
     }
     const wanted = argument.trim()
@@ -1376,9 +1644,9 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     const markdown = buildExportMarkdown(store.getView(), session.id)
     try {
       await writeFileAsync(target, `${markdown}\n`, 'utf8')
-      bridge.notify(`exported to ${target}`)
+      bridge.notify(t('notice.exported', { path: target }))
     } catch (error: unknown) {
-      bridge.notify(`export failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.exportFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     }
   }
 
@@ -1427,13 +1695,15 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         }
       }))
     }
-    const projected = projectSessionRows(records, options, updated)
-    // Titles are the expensive fold. Fetch only the first bounded picker page;
-    // navigation/filter changes trigger a fresh, cancellable observation.
-    const page = projected.slice(0, 32)
+    const projected = projectSessionRows(records, { ...options, query: '' }, updated)
+    // Titles are the expensive fold. Fetch the first picker page when idle;
+    // a non-empty query loads more so the displayed title can match.
+    const titleBudget = options.query.trim() === '' ? 32 : Math.min(projected.length, 128)
+    const page = projected.slice(0, titleBudget)
     if (page.length === 0) return projected
     const observations = await sessionQuery.readTitleSnapshots(page.map(row => row.id), signal)
-    return mergeSessionTitles(projected, observations)
+    const titled = mergeSessionTitles(projected, observations)
+    return titled.filter(row => sessionRowMatchesQuery(row, options.query))
   }
 
   /**
@@ -1451,9 +1721,12 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
    *    Backends without a derivable artifact (non-JSONL) refuse the WHOLE
    *    deletion here — no file has been touched yet, so a backend or layout
    *    surprise can never strand a half-deleted subtree.
-   * 3. Artifacts are removed children-first: only an I/O error mid-delete
-   *    can stop it short (reported with removed/total counts), leaving the
-   *    shallowest lineage intact.
+   * 3. Acquire every node's public persistence write handle before touching
+   *    files. The JSONL backend holds its cross-process kernel lease for each
+   *    handle, so another terminal's live session refuses the whole deletion.
+   * 4. Artifacts are removed children-first while every lease remains held:
+   *    only an I/O error mid-delete can stop it short (reported with
+   *    removed/total counts), leaving the shallowest lineage intact.
    *
    * @param id - the root session id to delete.
    * @returns the outcome line for the panel/notice.
@@ -1468,7 +1741,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     // layout-check every node up front, so a refusal never leaves a
     // partially removed subtree behind.
     const root = jsonlSessionRoot(persistence)
-    if (root === undefined) {
+    if (root === undefined || persistence === undefined) {
       return 'session backend exposes no deletable artifact (deletion is unsupported on this backend)'
     }
     const byId = new Map<string, (typeof records)[number]>(records.map(record => [record.header.id, record]))
@@ -1482,14 +1755,25 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       }
       dirs.set(node.id, dir)
     }
+    let leases
+    try {
+      leases = await acquireSessionDeletionLeases(persistence, plan.nodes.map(node => node.id))
+    } catch (error: unknown) {
+      if (error instanceof SessionAlreadyOwnedError) {
+        return `cannot delete ${error.sessionId.slice(-12)} — it is open in this or another process`
+      }
+      return `cannot safely lock sessions for deletion: ${error instanceof Error ? error.message : String(error)}`
+    }
+
     let removed = 0
+    let outcome: string | undefined
     for (const node of plan.nodes) {
       const dir = dirs.get(node.id)!
       try {
         // Remove every canonical generation artifact this build knows; other
-        // sibling files are never ours to delete, and the directory itself is
-        // only removed once empty. An unreadable directory counts as a
-        // failure (not a silent success) so the outcome line stays honest.
+        // sibling files are never ours to delete. The POSIX session.lock file
+        // deliberately remains because unlinking a held flock inode would
+        // forfeit the backend's exclusion guarantee.
         const entries = await readdir(dir, { withFileTypes: true })
         for (const entry of entries) {
           if (entry.isFile() && isSessionArtifactName(entry.name)) {
@@ -1499,10 +1783,17 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         await rm(dir, { force: true, recursive: false }).catch(() => {})
         removed += 1
       } catch (error: unknown) {
-        return `delete failed for ${node.id.slice(-12)} after ${removed} of ${plan.nodes.length}: ${error instanceof Error ? error.message : String(error)}`
+        outcome = `delete failed for ${node.id.slice(-12)} after ${removed} of ${plan.nodes.length}: ${error instanceof Error ? error.message : String(error)}`
+        break
       }
     }
-    return `deleted ${removed} session${removed === 1 ? '' : 's'}`
+    outcome ??= `deleted ${removed} session${removed === 1 ? '' : 's'}`
+    try {
+      await releaseSessionDeletionLeases(leases)
+    } catch (error: unknown) {
+      return `${outcome}; failed to release deletion locks: ${error instanceof Error ? error.message : String(error)}`
+    }
+    return outcome
   }
 
   const loadSessionTranscript = async (id: string, signal?: AbortSignal): Promise<string> => {
@@ -1511,6 +1802,26 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     return buildExportMarkdown(createTranscriptStore(snapshot.events).getView(), snapshot.session.id)
   }
 
+  /**
+   * Read one session's usage blocks for the /usage panel: the mounted
+   * projection's session totals plus the meter's own per-turn fold over the
+   * durable log (which the panel merges by model). A deployment without the
+   * projection registry renders the totals as explicitly unavailable rather
+   * than as zeros. The read is synchronous — the registry materializes a cell
+   * on first touch — so it is handed to the panel behind a resolved promise,
+   * which keeps the fold out of the keystroke that opens the panel.
+   * @param current - the session to read, or undefined before the first one.
+   * @returns the resolved panel data.
+   */
+  const loadUsage = (current: Session | undefined): Promise<UsageView> => {
+    if (current === undefined) return Promise.resolve({ turns: [] })
+    const values = ctx.get('sessionProjections')?.snapshot(current, ['tokenUsage']).values
+    return Promise.resolve({
+      totals: values?.tokenUsage,
+      turns: turnUsages(current.snapshotEvents(), deriveTurnTokenUsage),
+    })
+  }
+
   const switchModeAction = async (id: string): Promise<string> => {
     if (id === '') throw new Error('usage: /mode <preset>')
     const currentAgent = agent
@@ -1579,17 +1890,24 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       commands.setAgent(agent)
       skills.setAgent(agent)
       try {
+        // Reseed the feed BEFORE the first frame of the new session so no
+        // stale row from the previous one flashes; a rolled-back handoff
+        // re-seeds the previous session's catalog the same way.
+        subagents.reset()
+        for (const event of next.catalogSeed) subagents.apply(event.data.childId, event)
         process.stdout.write('\x1b[r\x1b[0m\x1b[H\x1b[2J\x1b[3J\x1b[H')
         renderCurrent()
         // Only a successful handoff may clear the transient per-session
         // surfaces: a rolled-back switch keeps the previous session's
         // subagent feed plus the user's pre-session /mode and permission
         // picks (the bare-launch promise: explicit choices survive until
-        // composition takes them).
-        subagents.reset()
+        // composition takes them). The in-flight cycle intent belonged to
+        // the previous session's presses; the new session's committed fold
+        // decides from here.
         pendingMode = undefined
         pendingPermission = undefined
         pendingPlan = false
+        planIntent = undefined
       } catch (error: unknown) {
         active = previous
         agent = previous?.agent
@@ -1598,6 +1916,14 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         mentions = previous === undefined ? createMentions(ctx, undefined, cwd) : previous.mentions
         if (agent !== undefined) commands.setAgent(agent)
         if (agent !== undefined) skills.setAgent(agent)
+        subagents.reset()
+        if (previous !== undefined) {
+          for (const event of previous.catalogSeed) subagents.apply(event.data.childId, event)
+        }
+        // The failed handoff disposed the incoming session; the restored
+        // store's committed plan fold is the truth, so any cycle intent
+        // collected against the switch churn retires too.
+        planIntent = undefined
         await next.handle.dispose()
         if (!quitting) renderCurrent()
         throw error
@@ -1614,7 +1940,10 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         // effect AFTER it, so an immediate notice reaches the UNMOUNTED
         // instance and React drops it silently. Defer past the commit.
         setTimeout(() => {
-          bridge.notify(`${next.resumed ? 'resumed' : 'created'} ${next.session.id.slice(-12)} · mode ${next.mode}`)
+          bridge.notify(t(next.resumed ? 'notice.sessionResumed' : 'notice.sessionCreated', {
+            id: next.session.id.slice(-12),
+            mode: next.mode,
+          }))
         }, 0)
         return
       }
@@ -1622,23 +1951,25 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       try {
         await sessions.flush(previous.session)
       } catch (error: unknown) {
-        cleanupWarning = `previous session flush failed: ${error instanceof Error ? error.message : String(error)}`
+        cleanupWarning = t('notice.flushFailed', { message: error instanceof Error ? error.message : String(error) })
       }
       try {
         await previous.handle.dispose()
       } catch (error: unknown) {
-        cleanupWarning = `${cleanupWarning === undefined ? '' : `${cleanupWarning}; `}previous agent release failed: ${error instanceof Error ? error.message : String(error)}`
+        const release = t('notice.agentReleaseFailed', { message: error instanceof Error ? error.message : String(error) })
+        cleanupWarning = cleanupWarning === undefined ? release : `${cleanupWarning}; ${release}`
       }
+      const shortId = next.session.id.slice(-12)
       bridge.notify(cleanupWarning === undefined
-        ? `${next.resumed ? 'resumed' : 'created'} ${next.session.id.slice(-12)} · mode ${next.mode}`
-        : `switched to ${next.session.id.slice(-12)}, but ${cleanupWarning}`,
+        ? t(next.resumed ? 'notice.sessionResumed' : 'notice.sessionCreated', { id: shortId, mode: next.mode })
+        : t('notice.sessionSwitchedDirty', { id: shortId, detail: cleanupWarning }),
       cleanupWarning === undefined ? 'info' : 'warning')
     })
   }
 
   const switchQueue = new SessionSwitchQueue<PendingSwitch>(
     async request => { if (!quitting) await activate(request.target) },
-    error => bridge.notify(`session switch failed: ${error instanceof Error ? error.message : String(error)}`, 'error'),
+    error => bridge.notify(t('notice.sessionSwitchFailed', { message: error instanceof Error ? error.message : String(error) }), 'error'),
   )
 
   const requestSwitch = (request: PendingSwitch): void => {
@@ -1647,17 +1978,17 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       // the target directly — there is no running turn to wait on and nothing
       // to flush.
       void activate(request.target).catch((error: unknown) => {
-        bridge.notify(`session switch failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+        bridge.notify(t('notice.sessionSwitchFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
       })
       return
     }
     if (request.target.sessionId === session.id) {
-      bridge.notify('that session is already active', 'warning')
+      bridge.notify(t('notice.alreadyActive'), 'warning')
       return
     }
     const outcome = switchQueue.request(agent!, request)
     if (outcome === 'queued') {
-      bridge.notify(`will switch to ${request.label} when the current turn finishes · /resume cancel to abort`)
+      bridge.notify(t('notice.switchQueued', { label: request.label }))
     }
   }
 
@@ -1669,7 +2000,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     const matches = exact.length > 0 ? exact : records.filter(record => record.header.id.startsWith(wanted))
     if (matches.length === 0) throw new Error(`no session matches "${wanted}"`)
     if (matches.length > 1) throw new Error(`session prefix "${wanted}" is ambiguous (${matches.length} matches)`)
-    const matched = matches[0]!
+    const matched = matches[0]
     // Same lineage gate as the CLI --resume path and the picker.
     if (isSubagentSession(matched.header)) {
       throw new Error('subagent conversations are read-only; resume a root session')
@@ -1683,7 +2014,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   const requestResume = (wanted: string): void => {
     void resolveResumeId(wanted).then(id => {
       requestSwitch({ target: { sessionId: id, resume: true }, label: id.slice(-12) })
-    }, (error: unknown) => bridge.notify(`resume failed: ${error instanceof Error ? error.message : String(error)}`, 'error'))
+    }, (error: unknown) => bridge.notify(t('notice.resumeFailed', { message: error instanceof Error ? error.message : String(error) }), 'error'))
   }
 
   const createSession = (mode?: string): void => {
@@ -1697,7 +2028,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     requestSwitch({ target: { sessionId: id, resume: false, mode, cwd: nextCwd }, label: id.slice(-12) })
   }
 
-  const reviewChanges = (argument: string): void => {
+  const reviewChanges = (selection: ReviewSelection): void => {
     // Works from a bare launch too: with no session yet the read-only
     // choice goes to pendingPermission (materialized when the first
     // session composes) and the review prompt queues behind that
@@ -1717,27 +2048,37 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
     const finish = (): void => {
       pendingControllers.delete(controller)
     }
-    void loadGitDiff(reviewCwd, argument, controller.signal).then(({ title, files }) => {
+    // Branch reviews diff from the precomputed merge base (what would
+    // actually land), commit reviews the commit's own patch, everything
+    // else reviews the uncommitted working tree.
+    const load = selection.kind === 'commit'
+      ? loadCommitDiff(reviewCwd, selection.sha, controller.signal)
+      : selection.kind === 'base-branch'
+        ? mergeBaseWith(reviewCwd, selection.branch, controller.signal)
+          .then(base => loadGitDiff(reviewCwd, base ?? selection.branch, controller.signal))
+        : loadGitDiff(reviewCwd, '', controller.signal)
+    const note = selection.kind === 'custom' ? selection.instructions : undefined
+    void load.then(({ title, files }) => {
       finish()
       if (controller.signal.aborted || epoch !== atEpoch || agent !== currentAgent) return
       try {
         setPermissionAction('read-only')
       } catch (error: unknown) {
-        bridge.notify(`review unavailable: ${error instanceof Error ? error.message : String(error)}`, 'error')
+        bridge.notify(t('notice.reviewUnavailable', { message: error instanceof Error ? error.message : String(error) }), 'error')
         return
       }
-      send(buildReviewPrompt(files.flatMap(file => file.lines).join('\n'), title), 'followup')
-      bridge.notify('review started under read-only permissions')
+      send(buildReviewPrompt(files.flatMap(file => file.lines).join('\n'), title, note))
+      bridge.notify(t('notice.reviewStarted'))
     }, (error: unknown) => {
       finish()
       if (controller.signal.aborted || epoch !== atEpoch) return
-      bridge.notify(`review failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.reviewFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     })
   }
 
   const forkSession = (argument: string): void => {
     if (session === undefined || active === undefined) {
-      bridge.notify('no session yet - submit a message to start', 'warning')
+      bridge.notify(t('notice.noSessionYet'), 'warning')
       return
     }
     try {
@@ -1761,18 +2102,42 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
         label: id.slice(-12),
       })
     } catch (error: unknown) {
-      bridge.notify(`fork failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.forkFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     }
   }
 
   const switchSession = (row: SessionRow): void => {
     if (!row.resumable) {
-      bridge.notify('subagent conversations are read-only', 'warning')
+      bridge.notify(t('notice.subagentsReadOnly'), 'warning')
       return
     }
     requestSwitch({ target: { sessionId: row.id, resume: true }, label: row.title ?? row.id.slice(-12) })
   }
 
+  // /search reads the SAME in-process engine the model's session_search
+  // tools use (the bundle's skip-tolerant subclass). The row may be disabled
+  // by a deployment; /search then degrades to a notice instead of a panel.
+  const searchSessions = sessionQuery === undefined
+    ? undefined
+    : async (query: string, signal?: AbortSignal): Promise<readonly SearchRow[]> => {
+      const page = await sessionQuery.searchSessions({ query, limit: 30 }, signal === undefined ? undefined : { signal })
+      const rows = page.items.map(hit => searchHitToRow(hit))
+      // Best-effort title enrichment (the same snapshots /resume merges):
+      // a failure keeps the short-id labels instead of failing the search.
+      try {
+        const observations = await sessionQuery.readTitleSnapshots(rows.map(row => row.id), signal)
+        const titles = new Map<string, string>()
+        for (const observation of observations) {
+          if (observation.status !== 'fulfilled') continue
+          const title = observation.value?.title?.title
+          if (title !== undefined && title.trim() !== '') titles.set(observation.sessionId, title)
+        }
+        return rows.map(row => titles.has(row.id) ? { ...row, label: titles.get(row.id)! } : row)
+      } catch {
+        return rows
+      }
+    }
+
   const cancelSessionSwitch = (): boolean => {
     return switchQueue.cancel()
   }
@@ -1854,6 +2219,8 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       renameTitle,
       copyLastResponse,
       loadGitDiff: (argument: string) => loadGitDiff(session?.header.cwd ?? cwd, argument),
+      listReviewBranches: (signal?: AbortSignal) => listReviewBranches(session?.header.cwd ?? cwd, signal),
+      listReviewCommits: (signal?: AbortSignal) => listReviewCommits(session?.header.cwd ?? cwd, signal),
       reviewChanges,
       loadPresets: () => presets.list(),
       switchMode: switchModeAction,
@@ -1864,6 +2231,7 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
       forkSession,
       loadSessions,
       loadSessionTranscript,
+      loadUsage: () => loadUsage(session),
       loadSubagents: () => {
         const current = session
         if (current === undefined || sessionQuery === undefined) return Promise.resolve([])
@@ -1871,22 +2239,24 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
           .then(rows => rows.filter(row => row.parent === current.id && row.subagent))
       },
       switchSession,
+      searchSessions,
       cancelSessionSwitch,
       loadPlugins: () => listPluginRows(ctx),
       // The launcher owns every update decision; the TUI only drives its
       // read-only probe and streamed apply as child processes.
       probeUpdate: () => probeLauncherUpdate(),
-      applyUpdate: onLine => applyLauncherUpdate(onLine),
+      applyUpdate: (onLine, plan) => applyLauncherUpdate(onLine, undefined, plan),
       loadJobs: () => listJobs(ctx, active?.agent),
       statusline: statuslineItems,
       saveStatusline,
       applyEditorKeys,
       saveTheme,
+      saveLanguage,
       animations: animationsEnabled,
       saveAnimations,
       history: inputHistory,
       recordHistory,
-      cancelQueued,
+      updateQueued,
       onBridgeReady: (instance: AppBridge) => { bridge.notify = instance.notify },
     })
   }
@@ -1903,41 +2273,46 @@ async function run(ctx: Context, startup: TuiStartup, io: TuiIo): Promise<void>
   // the agent always receives the startup prompt first.
   if (startup.prompt !== undefined || (startup.images?.length ?? 0) > 0) {
     if ((startup.images?.length ?? 0) > 0) {
-      bridge.notify(`processing ${startup.images!.length} startup image${startup.images!.length === 1 ? '' : 's'}…`)
+      bridge.notify(t('notice.startupImages', { count: startup.images!.length, plural: startup.images!.length === 1 ? '' : 's' }))
     }
     void inputGate.run(async deliver => {
       const images = await saveImagePaths(startup.images ?? [], ctx.get('attachments'))
-      if (images.length > 0) bridge.notify(`${images.length} startup image${images.length === 1 ? '' : 's'} attached`)
+      if (images.length > 0) bridge.notify(t('notice.startupImagesAttached', { count: images.length, plural: images.length === 1 ? '' : 's' }))
       deliver({ text: startup.prompt ?? '', mode: 'followup', images })
     }).catch((error: unknown) => {
-      bridge.notify(`initial prompt failed: ${error instanceof Error ? error.message : String(error)}`, 'error')
+      bridge.notify(t('notice.initialPromptFailed', { message: error instanceof Error ? error.message : String(error) }), 'error')
     })
   }
 
   async function copyLastResponse(): Promise<string> {
     const text = latestAssistantText(store.getView())
-    if (text === undefined) return 'nothing to copy yet'
+    if (text === undefined) return t('notice.copyEmpty')
     await copyText(text)
-    return 'copied latest response'
+    return t('notice.copied')
   }
 
   // A corrupt statusline config must not vanish silently: surface it once
   // the notice channel is live, after the first frame settles.
   if (statuslineWarning !== undefined) {
     setTimeout(() => {
-      bridge.notify('statusline config unreadable, using defaults: ' + statuslineWarning, 'warning')
+      bridge.notify(t('notice.statuslineConfigUnreadable', { message: statuslineWarning }), 'warning')
     }, 50)
   }
   // Same one-shot surface for a corrupt theme file (dark fallback stays live).
+  if (languageWarning !== undefined) {
+    setTimeout(() => {
+      bridge.notify(t('notice.languageConfigUnreadable', { message: languageWarning }), 'warning')
+    }, 0)
+  }
   if (themeWarning !== undefined) {
     setTimeout(() => {
-      bridge.notify('theme config unreadable, using dark: ' + themeWarning, 'warning')
+      bridge.notify(t('notice.themeConfigUnreadable', { message: themeWarning }), 'warning')
     }, 50)
   }
   // And for a corrupt animations file (on-by-default fallback stays live).
   if (animationsWarning !== undefined) {
     setTimeout(() => {
-      bridge.notify('animations config unreadable, animations stay on: ' + animationsWarning, 'warning')
+      bridge.notify(t('notice.animationsConfigUnreadable', { message: animationsWarning }), 'warning')
     }, 50)
   }