mixdog 0.9.147 → 0.9.149

package/src/standalone/session-transport.mjs

@@ -15,6 +15,7 @@
 import http from 'node:http';
 import { randomUUID } from 'node:crypto';
 import { sendJson, sendError } from '../runtime/memory/lib/http-wire.mjs';
+import { isPidAlive, parsePid } from '../runtime/shared/pid-liveness.mjs';
 import {
   compareRuntimeVersions,
   SESSION_CAPABILITY_FINGERPRINT,
@@ -99,17 +100,6 @@ function callSignature(name, args) {
   } catch { return null; }
 }
 
-function parsePid(value) {
-  const n = Number(value);
-  return Number.isInteger(n) && n > 0 ? n : null;
-}
-
-function isPidAlive(pid) {
-  const n = parsePid(pid);
-  if (!n) return false;
-  try { process.kill(n, 0); return true; }
-  catch (error) { return error?.code === 'EPERM'; }
-}
 
 // A stalled reader collapses the backlog to one frame per key. That is right
 // for SNAPSHOTS (the newest state is the whole truth) and wrong for a BYTE
@@ -313,17 +303,39 @@ export function createSessionTransport({
     return Math.min(limit, bytes);
   }
 
+  let callCachePressureLoggedAt = 0;
+
   function pruneCallCache() {
-    while (callCache.size > CALL_CACHE_MAX || callCacheBytes > CALL_CACHE_MAX_BYTES) {
-      let removed = false;
-      for (const [key, record] of callCache) {
-        // Never lose the dedup identity of an in-flight mutation.
-        if (!record.settled) continue;
-        deleteCallCacheEntry(key, record);
-        removed = true;
-        break;
-      }
-      if (!removed) return;
+    if (callCache.size <= CALL_CACHE_MAX && callCacheBytes <= CALL_CACHE_MAX_BYTES) return;
+    const now = nowMs();
+    // 1) Only an entry whose promised TTL has already elapsed may be forgotten
+    //    completely (its own timer may not have fired yet).
+    for (const [key, record] of callCache) {
+      if (callCache.size <= CALL_CACHE_MAX && callCacheBytes <= CALL_CACHE_MAX_BYTES) return;
+      if (!record.settled || !record.settledAt) continue;
+      if (now - record.settledAt < CALL_CACHE_TTL_MS) continue;
+      deleteCallCacheEntry(key, record);
+    }
+    // 2) Byte pressure drops the retained RESULT of settled entries, oldest
+    //    first, and KEEPS their dedup identity: evicting the identity inside
+    //    the promised TTL is exactly what let a retried submit/abort/configure
+    //    execute twice. A replay of a dropped result fails closed instead.
+    for (const record of callCache.values()) {
+      if (callCacheBytes <= CALL_CACHE_MAX_BYTES) break;
+      if (!record.settled || record.resultDropped) continue;
+      callCacheBytes = Math.max(0, callCacheBytes - (record.bytes || 0));
+      record.bytes = 0;
+      record.resultDropped = true;
+      record.promise = null;
+    }
+    // 3) Entry-count pressure never evicts a live dedup identity. What remains
+    //    carries no payload and expires with its own TTL timer.
+    if (callCache.size > CALL_CACHE_MAX && now - callCachePressureLoggedAt > 60_000) {
+      callCachePressureLoggedAt = now;
+      log(
+        `session call dedup cache above its entry budget (${callCache.size}/${CALL_CACHE_MAX});`
+        + ' every remaining entry is still inside its retry TTL',
+      );
     }
   }
 
@@ -738,7 +750,14 @@ export function createSessionTransport({
         const cached = cacheKey ? callCache.get(cacheKey) : null;
         let dispatch;
         if (cached) {
-          if (!signature || cached.signature !== signature) {
+          if (cached.resultDropped) {
+            // The identity survived memory pressure but its result did not.
+            // Fail closed: re-running a settled mutation is never correct.
+            dispatch = Promise.reject(Object.assign(
+              new Error(`callId '${callId}' already ran; its result is no longer retained`),
+              { code: 'ECALLRESULTDROPPED' },
+            ));
+          } else if (!signature || cached.signature !== signature) {
             // callId is an idempotency key, not a caller-selected overwrite
             // slot. Fail closed while the original keeps its cache identity;
             // dispatching here could execute two side-effecting mutations.
@@ -762,7 +781,13 @@ export function createSessionTransport({
           );
           if (cacheKey) {
             const record = {
-              promise: dispatch, at: nowMs(), signature, settled: false, bytes: 0,
+              promise: dispatch,
+              at: nowMs(),
+              signature,
+              settled: false,
+              settledAt: 0,
+              resultDropped: false,
+              bytes: 0,
             };
             callCache.set(cacheKey, record);
             pruneCallCache();
@@ -773,6 +798,7 @@ export function createSessionTransport({
               callCacheBytes += record.bytes;
             }, () => {}).then(() => {
               record.settled = true;
+              record.settledAt = nowMs();
               pruneCallCache();
               const t = setTimeout(() => {
                 deleteCallCacheEntry(cacheKey, record);
@@ -786,8 +812,13 @@ export function createSessionTransport({
           sendJson(res, { result });
         } catch (err) {
           // Session call errors travel as a 200 {error} envelope so the client can
-          // tell a failed CALL from a dead TRANSPORT (which must re-attach).
-          sendJson(res, { error: err?.message || String(err) }, 200);
+          // tell a failed CALL from a dead TRANSPORT (which must re-attach). The
+          // machine-readable `code` (ECALLIDCONFLICT / ECALLRESULTDROPPED) travels
+          // with it: a client must be able to branch on it, not parse prose.
+          sendJson(res, {
+            error: err?.message || String(err),
+            ...(err?.code ? { code: String(err.code) } : {}),
+          }, 200);
         }
         return;
       }

package/src/tui/App.jsx

@@ -73,6 +73,8 @@ import {
   memoryCoreResultErrorText,
 } from './app/input-parsers.mjs';
 import { copyToClipboard } from './app/clipboard.mjs';
+import { shouldSupersedePanelEpoch, supersedePanelEpoch } from './app/panel-epoch.mjs';
+import { createPanelSurface } from './app/panel-surface.mjs';
 import { wrappedTextRows, promptContentRows, wrappedDetailRows, textEntryReservedRows, queuedBandRows } from './app/text-layout.mjs';
 import stringWidth from 'string-width';
 import { useMouseInput } from './app/use-mouse-input.mjs';
@@ -348,7 +350,17 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
   const setPicker = useCallback((next) => {
     // Synchronous ref update so out-of-band setPicker(null/other) is visible to
     // in-flight async guards immediately, before React commits the next render.
-    livePickerRef.current = typeof next === 'function' ? next(livePickerRef.current) : next;
+    const previousPicker = livePickerRef.current;
+    livePickerRef.current = typeof next === 'function' ? next(previousPicker) : next;
+    // A real handover — closing the panel (open → null) OR replacing it with a
+    // different panel — gives the surface to what the user is looking at now:
+    // supersede every deferred paint issued before this point so a daemon write
+    // settling afterwards cannot resurrect the dismissed panel or clobber the
+    // panel that replaced it. Rebuilding the SAME panel keeps ownership (its
+    // own refresh must land), and a redundant null → null (or a first open) is
+    // not a handover and must not invalidate the in-flight write of a
+    // text-entry prompt that is currently on screen.
+    if (shouldSupersedePanelEpoch(previousPicker, livePickerRef.current)) supersedePanelEpoch();
     setPickerState((prev) => {
       const resolved = typeof next === 'function' ? next(prev) : next;
       if (resolved && typeof resolved === 'object' && pickerOpenedFromEnterRef.current) {
@@ -377,35 +389,40 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
   livePickerRef.current = picker;
   const [contextPanel, setContextPanel] = useState(null);
   const [usagePanel, setUsagePanel] = useState(null);
-  const usageRequestRef = useRef(0);
+  // OWNING LAYER (app/panel-surface.mjs): the three sinks above are handed over
+  // exactly once and never leave that module. Every panel factory below gets
+  // `surface` instead, so painting or delegating without a claim that proves
+  // ownership is not expressible outside this file. Stable across renders — the
+  // usage generation lives inside it.
+  const surfaceRef = useRef(null);
+  if (!surfaceRef.current) {
+    surfaceRef.current = createPanelSurface({ setPicker, setContextPanel, setUsagePanel });
+  }
+  const surface = surfaceRef.current;
   // Cache of the last computed heavy settings-picker status objects (MCP,
   // hooks, plugins, skills, channel provider). ←/→ cycle/toggle handlers in
   // openSettingsPicker() pass { light: true } to reuse this cache instead of
   // re-querying these heavy getters on every keystroke; only a full open
   // (initial /config or Esc-return) recomputes them.
   const settingsHeavyCacheRef = useRef(null);
-  const closeUsagePanel = useCallback(() => {
-    usageRequestRef.current += 1;
-    setUsagePanel(null);
-  }, []);
+  // Settings build generation: every open/refresh takes a ticket and Esc bumps
+  // it, so a slow (daemon) snapshot from a superseded build cannot re-open the
+  // panel after it was closed.
+  const settingsRequestRef = useRef(0);
+  const closeUsagePanel = useCallback(() => surface.closeUsage(), [surface]);
   const [providerPrompt, setProviderPrompt] = useState(null);
   const oauthSubmitRef = useRef(false);
-  const [channelPrompt, setChannelPrompt] = useState(null);
-  const [hookPrompt, setHookPrompt] = useState(null);
   const [settingsPrompt, setSettingsPrompt] = useState(null);
-  // Instantiate the project-picker cluster now that setPicker + every prompt
+  // Instantiate the project-picker cluster now that the surface + every prompt
   // setter and the usage-panel closer exist. projectPickerRef (declared above,
   // before the picker useState) is populated here so first-mount build and all
   // later callers resolve the same set of builders.
   const projectPicker = createProjectPicker({
     state,
     store,
-    setPicker,
+    surface,
     setProviderPrompt,
-    setChannelPrompt,
-    setHookPrompt,
     setSettingsPrompt,
-    setContextPanel,
     closeUsagePanel,
     projectNameFromPath,
     pickFolder,
@@ -609,12 +626,9 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
   } = createAppPickers({
     state,
     store,
-    setPicker,
+    surface,
     setProviderPrompt,
-    setChannelPrompt,
-    setHookPrompt,
     setSettingsPrompt,
-    setContextPanel,
     setOnboardingActive,
     closeUsagePanel,
     oauthSubmitRef,
@@ -625,6 +639,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     modelPickerRequestRef,
     onboardingPrefetchSeqRef,
     settingsHeavyCacheRef,
+    settingsRequestRef,
     livePickerRef,
     disabledSkills,
     setDisabledSkills,
@@ -823,7 +838,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
   const { hasUserMessages, openMessageSelector } = useMessageSelector({
     store,
     state,
-    setPicker,
+    surface,
     setPromptDraftOverride,
     syncPromptLayoutRows,
     showPromptHint,
@@ -849,7 +864,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     setPastedImages,
     setPastedTexts,
     setPromptDraftOverride,
-    setContextPanel,
+    surface,
     syncPromptLayoutRows,
     showPromptHint,
     clearPromptHint,
@@ -883,7 +898,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     picker,
     usagePanel,
     contextPanel,
-    setContextPanel,
+    surface,
     closeUsagePanel,
     isRawModeSupported,
     resizeState,
@@ -906,14 +921,9 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
   const { openUsagePanel, openContextPicker } = createUsageContextPanels({
     store,
     state,
-    usageRequestRef,
-    setPicker,
+    surface,
     setProviderPrompt,
-    setChannelPrompt,
-    setHookPrompt,
     setSettingsPrompt,
-    setContextPanel,
-    setUsagePanel,
     closeUsagePanel,
   });
 
@@ -960,17 +970,12 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     store,
     state,
     providerPrompt,
-    channelPrompt,
-    hookPrompt,
     settingsPrompt,
     setProviderPrompt,
-    setChannelPrompt,
-    setHookPrompt,
     setSettingsPrompt,
     oauthSubmitRef,
     clearModelCaches,
     openProviderSetupPicker,
-    openHooksPicker,
     openSettingsPicker,
     openProjectPicker,
     openAutoClearPicker,
@@ -988,7 +993,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     pastedTextsRef,
   });
 
-  const activeSlashQuery = providerPrompt || channelPrompt || hookPrompt || settingsPrompt || toolApproval || contextPanel || usagePanel ? null : slashQuery(promptDraft);
+  const activeSlashQuery = providerPrompt || settingsPrompt || toolApproval || contextPanel || usagePanel ? null : slashQuery(promptDraft);
   // "Slash mode" is live whenever a /token is being edited and no other
   // surface owns the floating area. The palette stays OPEN for the whole
   // slash session — including 0-match frames — so its 14-row layout never
@@ -1009,8 +1014,6 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     contextPanel: !!contextPanel,
     usagePanel: !!usagePanel,
     providerPrompt: !!providerPrompt,
-    channelPrompt: !!channelPrompt,
-    hookPrompt: !!hookPrompt,
     settingsPrompt: !!settingsPrompt,
   };
 
@@ -1023,8 +1026,6 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
   const {
     onPromptDraftChange,
     cancelProviderPrompt,
-    cancelChannelPrompt,
-    cancelHookPrompt,
     cancelSettingsPrompt,
     acceptSlashPalette,
     completeSlashPalette,
@@ -1044,12 +1045,8 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     slashDismissedFor,
     setSlashDismissedFor,
     providerPrompt,
-    channelPrompt,
-    hookPrompt,
     settingsPrompt,
     setProviderPrompt,
-    setChannelPrompt,
-    setHookPrompt,
     setSettingsPrompt,
     oauthSubmitRef,
     openProjectPicker,
@@ -1070,8 +1067,6 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
   // Transcript viewport + bottom-cluster row budget: app/shell-layout.mjs.
   const layout = computeShellLayout({
     providerPrompt,
-    channelPrompt,
-    hookPrompt,
     settingsPrompt,
     panelTransitionEpoch,
     panelInkMaskEpoch,
@@ -1194,7 +1189,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     setMeasuredRowsVersion,
   });
   const cycleWorkflowFromPrompt = useCallback(() => {
-    if (slashPaletteOpen || toolApproval || picker || settingsPrompt || providerPrompt || channelPrompt || hookPrompt || contextPanel || usagePanel) return true;
+    if (slashPaletteOpen || toolApproval || picker || settingsPrompt || providerPrompt || contextPanel || usagePanel) return true;
     const repeatGuardMs = 300;
     const cycleGuard = workflowTabCycleRef.current;
     const now = Date.now();
@@ -1236,7 +1231,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
         cycleGuard.lastAt = Date.now();
       });
     return true;
-  }, [slashPaletteOpen, toolApproval, picker, settingsPrompt, providerPrompt, channelPrompt, hookPrompt, contextPanel, usagePanel, state.commandBusy, state.workflow, store]);
+  }, [slashPaletteOpen, toolApproval, picker, settingsPrompt, providerPrompt, contextPanel, usagePanel, state.commandBusy, state.workflow, store]);
   // The hardware/IME caret is parked by PromptInput from its OWN measured box
   // position (ink useCursor + useBoxMetrics) — correct now that the transcript
   // is a live column, so the live-frame line count ink relies on is accurate.
@@ -1247,12 +1242,9 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     activeSlashQuery,
     activeTools,
     agentRevision,
-    cancelChannelPrompt,
-    cancelHookPrompt,
     cancelProviderPrompt,
     cancelSettingsPrompt,
     cancelSlashPalette,
-    channelPrompt,
     clearPromptHint,
     completeSlashPalette,
     contextPanel,
@@ -1265,7 +1257,6 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     handlePromptInterrupt,
     handlePromptPaste,
     hasUserMessages,
-    hookPrompt,
     initialStatusLine,
     onPromptDraftChange,
     onSubmit,
@@ -1288,7 +1279,6 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     resizeEpoch,
     resizeState,
     restoreQueuedToPrompt,
-    setPicker,
     setSlashIndex,
     setTextEntryLayoutRows,
     settingsPrompt,
@@ -1298,6 +1288,7 @@ export function App({ store, initialStatusLine = '', forceOnboarding = false, on
     state,
     statuslineStats,
     store,
+    surface,
     toolApproval,
     toolOutputExpanded,
     transcriptMeasureRef,

package/src/tui/app/app-view.jsx

@@ -18,9 +18,10 @@ import { SlashCommandPalette } from '../components/SlashCommandPalette.jsx';
 import { ContextPanel } from '../components/ContextPanel.jsx';
 import { UsagePanel } from '../components/UsagePanel.jsx';
 import { TextEntryPanel } from '../components/TextEntryPanel.jsx';
+import { textEntryClearsByEmpty } from './text-entry-policy.mjs';
 import { Item } from '../components/TranscriptItem.jsx';
 export function renderAppView(ctx) {
-  const { PANEL_MAX_VISIBLE, acceptSlashPalette, activeSlashQuery, activeTools, agentRevision, cancelChannelPrompt, cancelHookPrompt, cancelProviderPrompt, cancelSettingsPrompt, cancelSlashPalette, channelPrompt, clearPromptHint, completeSlashPalette, contextPanel, cycleWorkflowFromPrompt, exiting, expandedOptionPanel, floatingPanelRows, frameColumns, gridSelectionActiveRef, guardHintWidth, handlePromptEscape, handlePromptHistoryNavigate, handlePromptInterrupt, handlePromptPaste, hasUserMessages, hookPrompt, initialStatusLine, inputBoxHidden, inputHint, inputHintTone, liveSpinner, onPromptDraftChange, onSubmit, overlayHintAttachItemIndex, overlayHintBandRows, overlayHintFallbackRow, overlayHintOnLastItem, panelCloseMaskRows, panelInkMaskEpoch, panelTransitionClearRows, panelTransitionEpoch, picker, pickerOpenedFromEnterRef, pickerOpenedFromEnterTimerRef, pickerVisibleRows, promptBoxRectRef, promptBoxRows, promptDraft, promptDraftOverride, promptMetaVisible, promptMouseSelectionRef, promptSelectionRef, promptSpinnerColumns, promptValueRef, providerPrompt, queuedCompact, queuedVisible, renderedTranscriptItems, resizeEpoch, resizeState, restoreQueuedToPrompt, setPicker, setSlashIndex, setTextEntryLayoutRows, settingsPrompt, showWelcomeBanner, slashCommands, slashIndex, slashPaletteOpen, state, statuslineStats, store, toolApproval, toolOutputExpanded, transcriptContentHeight, transcriptGuardRows, transcriptMeasureRef, transcriptTailPinned, transcriptWindow, transientStatusWidth, tuiReady, usagePanel, viewportHeight, welcomePromptHintRows, welcomePromptHintText } = ctx; /* DESTRUCTURE */
+  const { PANEL_MAX_VISIBLE, acceptSlashPalette, activeSlashQuery, activeTools, agentRevision, cancelProviderPrompt, cancelSettingsPrompt, cancelSlashPalette, clearPromptHint, completeSlashPalette, contextPanel, cycleWorkflowFromPrompt, exiting, expandedOptionPanel, floatingPanelRows, frameColumns, gridSelectionActiveRef, guardHintWidth, handlePromptEscape, handlePromptHistoryNavigate, handlePromptInterrupt, handlePromptPaste, hasUserMessages, initialStatusLine, inputBoxHidden, inputHint, inputHintTone, liveSpinner, onPromptDraftChange, onSubmit, overlayHintAttachItemIndex, overlayHintBandRows, overlayHintFallbackRow, overlayHintOnLastItem, panelCloseMaskRows, panelInkMaskEpoch, panelTransitionClearRows, panelTransitionEpoch, picker, pickerOpenedFromEnterRef, pickerOpenedFromEnterTimerRef, pickerVisibleRows, promptBoxRectRef, promptBoxRows, promptDraft, promptDraftOverride, promptMetaVisible, promptMouseSelectionRef, promptSelectionRef, promptSpinnerColumns, promptValueRef, providerPrompt, queuedCompact, queuedVisible, renderedTranscriptItems, resizeEpoch, resizeState, restoreQueuedToPrompt, setSlashIndex, setTextEntryLayoutRows, settingsPrompt, showWelcomeBanner, slashCommands, slashIndex, slashPaletteOpen, state, statuslineStats, store, surface, toolApproval, toolOutputExpanded, transcriptContentHeight, transcriptGuardRows, transcriptMeasureRef, transcriptTailPinned, transcriptWindow, transientStatusWidth, tuiReady, usagePanel, viewportHeight, welcomePromptHintRows, welcomePromptHintText } = ctx; /* DESTRUCTURE */
   const promptInputControl = (
     <PromptInput
       onSubmit={onSubmit}
@@ -277,7 +278,9 @@ export function renderAppView(ctx) {
                 onCancel={() => {
                   if (picker.onCancel) picker.onCancel();
                   else {
-                    setPicker(null);
+                    // Esc with no owner-supplied handler: this keypress owns
+                    // the surface it clears (app/panel-surface.mjs).
+                    surface.claim().close();
                     clearPromptHint();
                   }
                 }}
@@ -326,6 +329,9 @@ export function renderAppView(ctx) {
               />
             ) : providerPrompt ? (
               <TextEntryPanel
+                // Remount on a restore so a repeated failed save re-seeds the
+                // editor even when the restored text is byte-identical.
+                key={`provider-prompt:${providerPrompt.restoreEpoch || 0}`}
                 title={providerPrompt.kind === 'api-key'
                   ? `${providerPrompt.mode === 'replace' ? 'Replace' : 'Set'} API key · ${providerPrompt.label}`
                   : providerPrompt.kind === 'oauth-code'
@@ -347,6 +353,9 @@ export function renderAppView(ctx) {
                 detail={providerPrompt.detail || ''}
                 mask={providerPrompt.kind === 'api-key' || providerPrompt.kind === 'openai-usage-session'}
                 columns={frameColumns}
+                // Restored after a REJECTED daemon save so the entered secret
+                // is not lost with the failed round-trip (normally empty).
+                initialValue={providerPrompt.initialValue || ''}
                 actionLabel={providerPrompt.kind === 'oauth-code' ? 'continue' : 'save'}
                 promptLabel={providerPrompt.kind === 'api-key'
                   ? 'API key > '
@@ -358,31 +367,15 @@ export function renderAppView(ctx) {
                 onSubmit={onSubmit}
                 onCancel={cancelProviderPrompt}
               />
-            ) : channelPrompt ? (
-              <TextEntryPanel
-                title={channelPrompt.label}
-                hint={channelPrompt.hint || 'Save channel setting.'}
-                mask={channelPrompt.kind === 'webhook-token'}
-                columns={frameColumns}
-                promptLabel="Value > "
-                onSubmit={onSubmit}
-                onCancel={cancelChannelPrompt}
-              />
-            ) : hookPrompt ? (
-              <TextEntryPanel
-                title={hookPrompt.label}
-                hint={hookPrompt.hint || 'Save hook setting.'}
-                columns={frameColumns}
-                promptLabel="Value > "
-                onSubmit={onSubmit}
-                onCancel={cancelHookPrompt}
-              />
             ) : settingsPrompt ? (
               <TextEntryPanel
+                key={`settings-prompt:${settingsPrompt.kind}:${settingsPrompt.restoreEpoch || 0}`}
                 title={settingsPrompt.label}
                 hint={settingsPrompt.hint || 'Save setting.'}
                 columns={frameColumns}
                 initialValue={settingsPrompt.initialValue || ''}
+                // Reset/clear prompts document an empty submit as the action.
+                allowEmpty={textEntryClearsByEmpty(settingsPrompt.kind)}
                 multiline={settingsPrompt.kind === 'core-add' || settingsPrompt.kind === 'core-edit'}
                 maxContentRows={PANEL_MAX_VISIBLE}
                 onContentRowsChange={setTextEntryLayoutRows}

package/src/tui/app/core-memory-picker.mjs

@@ -2,16 +2,16 @@
  * core-memory-picker.mjs — the Core Memory picker + add/edit/delete flow.
  *
  * Extracted from App.jsx behavior-preservingly as a dependency-injection
- * factory: these openers drive setPicker + setSettingsPrompt and read live
- * store state, so they can't be pure. Every function body is the original App
- * logic verbatim, with closure identifiers threaded through the factory
+ * factory: these openers drive the panel surface + setSettingsPrompt and read
+ * live store state, so they can't be pure. Every function body is the original
+ * App logic verbatim, with closure identifiers threaded through the factory
  * argument. The Esc-return target is per-entry: the Settings row passes
  * { returnTo }, the standalone /memory command passes { returnTo: null },
  * and Esc either reopens the caller or simply closes the picker.
  */
 export function createCoreMemoryPicker({
   store,
-  setPicker,
+  surface,
   setSettingsPrompt,
   parseMemoryCoreRows,
 }) {
@@ -22,13 +22,19 @@ export function createCoreMemoryPicker({
   let escReturnTo = null;
   const closeMemoryCorePicker = () => {
     if (escReturnTo) escReturnTo();
-    else setPicker(null);
+    // Esc on the panel: this keypress owns the surface it clears.
+    else surface.claim().close();
   };
   const openMemoryCorePicker = (options = {}) => {
     if (options && Object.prototype.hasOwnProperty.call(options, 'returnTo')) {
       escReturnTo = typeof options.returnTo === 'function' ? options.returnTo : null;
     }
-    setPicker({
+    // Surface claim (panel-surface.mjs): every paint re-validates and re-arms
+    // it, so the loading frame can take the surface while a list (or failure
+    // close) landing after Esc cannot touch it.
+    const own = surface.claim();
+    const paintPanel = (panel) => own.paint(panel);
+    paintPanel({
       title: 'Memory',
       // Loading state lives in the header description row, not as a fake
       // selectable menu item.
@@ -53,7 +59,7 @@ export function createCoreMemoryPicker({
             _rows: coreRows,
           },
         ];
-        setPicker({
+        paintPanel({
           title: 'Memory',
           description: 'User-curated core memories across projects.',
           items: rows.length ? rows : [{ value: 'empty', label: 'Memory', description: 'empty' }],
@@ -71,14 +77,17 @@ export function createCoreMemoryPicker({
         });
       })
       .catch((e) => {
-        setPicker(null);
+        own.close();
         store.pushNotice(`core memory failed: ${e?.message || e}`, 'error');
       });
   };
 
   const openCoreMemoryListPicker = (rows = null) => {
+    // Same ownership rule as openMemoryCorePicker.
+    const own = surface.claim();
+    const paintPanel = (panel) => own.paint(panel);
     const renderList = (coreRows) => {
-      setPicker({
+      paintPanel({
         title: 'Memory · List',
         description: coreRows.length
           ? 'Select a memory to edit or delete.'
@@ -101,7 +110,7 @@ export function createCoreMemoryPicker({
       return;
     }
 
-    setPicker({
+    paintPanel({
       title: 'Memory · List',
       description: 'Loading memories…',
       items: [],
@@ -109,15 +118,19 @@ export function createCoreMemoryPicker({
       onCancel: () => openMemoryCorePicker(),
     });
     void store.memoryControl?.({ action: 'core', op: 'list', project_id: '*' }, { silent: true })
-      .then((result) => renderList(parseMemoryCoreRows(result)))
+      .then((result) => {
+        renderList(parseMemoryCoreRows(result));
+      })
       .catch((e) => {
-        setPicker(null);
+        own.close();
         store.pushNotice(`core memory failed: ${e?.message || e}`, 'error');
       });
   };
 
   const openCoreEntryActionsPicker = (entryItem) => {
-    setPicker({
+    // Synchronous panel for an Enter on a list row: an ordinary claimed paint.
+    const own = surface.claim();
+    own.paint({
       title: `Memory · #${entryItem._id}`,
       description: entryItem._summary || entryItem._element || '',
       items: [
@@ -133,7 +146,7 @@ export function createCoreMemoryPicker({
   };
 
   const beginAddCoreMemory = () => {
-    setPicker(null);
+    surface.claim().close();
     setSettingsPrompt({
       kind: 'core-add',
       label: 'Add memory',
@@ -142,7 +155,7 @@ export function createCoreMemoryPicker({
   };
 
   const beginEditCoreMemory = (entryItem) => {
-    setPicker(null);
+    surface.claim().close();
     setSettingsPrompt({
       kind: 'core-edit',
       label: `Memory · Edit #${entryItem._id}`,
@@ -158,7 +171,7 @@ export function createCoreMemoryPicker({
   };
 
   const beginDeleteCoreMemory = (entryItem) => {
-    setPicker(null);
+    surface.claim().close();
     setSettingsPrompt({
       kind: 'core-delete-confirm',
       label: `Memory · Delete #${entryItem._id}?`,