opencode-context-indicator 1.8.1 → 1.8.3

package/lib/state.js

@@ -38,7 +38,7 @@ import {
   sumCategories,
 } from "./estimate.js";
 import {
-  breakdownCache,
+  breakdownForModel,
   MAX_TRACKED_SESSIONS,
   sessionAgentCache,
   sessionParentCache,
@@ -424,10 +424,107 @@ function renameWithRetry(from, to, attempts = 3, delayMs = 50) {
 // affect the log / toast / event paths.
 // Tombstone window: state.json entries untouched for longer than this are
 // pruned during the next write (deleted / abandoned sessions used to linger
-// until the LRU cap evicted them). Conservative: consumers are family-scoped,
-// so this is file hygiene, not correctness. Entries with an unparsable
-// updatedAt are kept.
-const PRUNE_AFTER_MS = 30 * 24 * 60 * 60 * 1000;
+// until the LRU cap evicted them). Hygiene, not correctness: consumers are
+// family-scoped, and a resurrected session re-measures on its first request.
+// 7 days: a tombstone only matters while a sibling/parent poll can still see it.
+const PRUNE_AFTER_MS = 7 * 24 * 60 * 60 * 1000;
+
+// Session IDs whose persisted entry was removed by `session.deleted` (or is
+// queued for removal because the state lock was busy). The host never reuses an
+// ID, so once a session is gone every later write for it must be DROPPED - a
+// write would recreate the entry, and after `clearChildSubagentTracking()` there
+// is no parent cache left either, so the child came back as a phantom ROOT row
+// that lived up to the 7-day tombstone (worse than the old phantom child).
+// Bounded FIFO like the other per-instance maps.
+const PRUNED_MAX = 512;
+const prunedSessions = new Set();
+// DELETE REQUESTS waiting for a state-file write: the lock was busy when the
+// event arrived. Stored as the deleted ROOT id, not as a flat list of entries -
+// the subtree is unknown without the file, and the request is replayed under the
+// next write's lock (where the snapshot is available) so a busy lock cannot leave
+// descendants alive. Bounded FIFO as well.
+const pendingPruneRoots = new Set();
+// Diagnostics: one log line per session that a late write was blocked for. A
+// silent drop is impossible to debug in the field, but a line per idle/step
+// would flood the log.
+const barrierLogged = new Set();
+
+function rememberPruned(id) {
+  if (typeof id !== "string" || !id) return;
+  prunedSessions.add(id);
+  if (prunedSessions.size > PRUNED_MAX) {
+    const oldest = prunedSessions.values().next().value;
+    if (oldest !== undefined) prunedSessions.delete(oldest);
+  }
+}
+
+function queuePrune(rootID) {
+  if (typeof rootID !== "string" || !rootID) return;
+  pendingPruneRoots.add(rootID);
+  if (pendingPruneRoots.size > PRUNED_MAX) {
+    const oldest = pendingPruneRoots.values().next().value;
+    if (oldest !== undefined) pendingPruneRoots.delete(oldest);
+  }
+}
+
+function logBarrierOnce(id) {
+  if (barrierLogged.has(id)) return;
+  barrierLogged.add(id);
+  if (barrierLogged.size > PRUNED_MAX) {
+    const oldest = barrierLogged.values().next().value;
+    if (oldest !== undefined) barrierLogged.delete(oldest);
+  }
+  logErr(`writeStateFile dropped for deleted session=${oneLine(id)}`);
+}
+
+// `rootID` plus every persisted entry below it in the parentID chain. The index
+// is built once (O(n)) instead of rescanning the whole snapshot per visited node:
+// the file is user-writable and unbounded on read, and this runs on the event
+// loop. `doomed` doubles as the cycle guard.
+function subtreeIDs(all, rootID) {
+  const childrenByParent = new Map();
+  for (const [id, entry] of Object.entries(all)) {
+    const parent = entry?.parentID;
+    if (typeof parent !== "string") continue;
+    const kids = childrenByParent.get(parent);
+    if (kids) kids.push(id);
+    else childrenByParent.set(parent, [id]);
+  }
+  const doomed = new Set([rootID]);
+  const stack = [rootID];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    for (const child of childrenByParent.get(current) || []) {
+      if (doomed.has(child)) continue;
+      doomed.add(child);
+      stack.push(child);
+    }
+  }
+  return doomed;
+}
+
+// Atomic commit of a state snapshot: random temp suffix + exclusive create
+// (CWE-377), rename over a regular file only, temp cleanup on failure. Shared by
+// the writer and the deleter so the two can never drift apart.
+function commitState(all) {
+  const tmp = `${STATE_FILE}.${randomBytes(6).toString("hex")}.tmp`;
+  writeFileSync(tmp, JSON.stringify(all), { encoding: "utf8", flag: "wx" });
+  let renamed = false;
+  try {
+    ensureRegularFile(STATE_FILE); // never rename over a planted symlink
+    renamed = renameWithRetry(tmp, STATE_FILE);
+  } finally {
+    // A rename that exhausted its retries leaves the temp file behind; drop it
+    // so repeated failures cannot litter %TEMP% (best-effort: on a SUCCESSFUL
+    // rename the temp is already gone, existsSync filters that).
+    try {
+      if (existsSync(tmp)) unlinkSync(tmp);
+    } catch {
+      /* best-effort cleanup */
+    }
+  }
+  return renamed;
+}
 
 function writeStateFile(
   sessionID,
@@ -447,6 +544,16 @@ function writeStateFile(
       logErr(`writeStateFile skipped unsafe session key ${oneLine(sessionID)}`);
       return false;
     }
+    // The session was deleted: never recreate its entry. Without this barrier a
+    // late idle/step write (or a live child whose parent was just deleted)
+    // re-adds the row, and with the parent cache already cleared it lands with
+    // `parentID: null` - a phantom ROOT session in the table, the picker and the
+    // Desktop tab until the tombstone. Logged once per ID: the check runs on
+    // every write for that session and a silent drop would be undebuggable.
+    if (prunedSessions.has(sessionID)) {
+      logBarrierOnce(sessionID);
+      return false;
+    }
     const lock = acquireLock(STATE_LOCK_FILE);
     // {ok:false} => busy: skip (value stays in memory, lands next cycle), as
     // before. null => unexpected error: fail-open, write WITHOUT the lock and do
@@ -458,7 +565,6 @@ function writeStateFile(
       return false;
     }
     try {
-      const bd = breakdownCache.get(sessionID) || null;
       const usableInfo = getUsableContext(providerID, modelID, undefined, opts?.directory);
       // Persist the EFFECTIVE window (min(input, context) when both are known,
       // else input || context: the same window the ceiling was derived from),
@@ -503,7 +609,7 @@ function writeStateFile(
       }
       // Tombstone prune: entries untouched for PRUNE_AFTER_MS drop out of the
       // shared file (deleted / abandoned sessions used to linger until the LRU
-      // cap). Edge case: resuming a 30+-day-stale session prunes its own old
+      // cap). Edge case: resuming a 7+-day-stale session prunes its own old
       // entry once, losing the inherited usable/agent/parentID for the first
       // write — it self-heals on the next event. Unparsable updatedAt -> keep.
       {
@@ -516,27 +622,6 @@ function writeStateFile(
       const prevEntry = Object.prototype.hasOwnProperty.call(all, sessionID)
         ? all[sessionID]
         : null;
-      const pc = prevEntry?.categories || null;
-
-      // Which breakdown is allowed to OWN the persisted categories?
-      //
-      // This file is shared by every plugin instance, and the instance that
-      // answers the Desktop RPC (the window's) never serves a model request, so
-      // its `breakdownCache` entry is always the client-context fallback rebuilt
-      // from the persisted message list. That fallback cannot see the assembled
-      // system prompt or the tool schemas, folds their whole mass into `other`,
-      // and after a compaction it can even read an empty conversation. Letting
-      // it overwrite the hook's measurement — the two writes landed 11 ms apart
-      // in the field — produced "system 0 / tool schemas 0 / other inflated" and
-      // could blank user/assistant. So: a hook-family source (see
-      // isHookSource) always wins; the fallback only fills an entry that no hook
-      // has ever measured.
-      //
-      // Legacy entries (written before `source` was persisted) carry no tag, but
-      // only a hook can produce a non-null system / tool-schema estimate.
-      const prevHookMeasured = isHookMeasuredEntry(prevEntry);
-      const bdFromHook = bd != null && isHookSource(bd.source);
-      const useBd = bd != null && (bdFromHook || !prevHookMeasured);
 
       // Resolve the model identity for THIS write. An unmeasured write from a
       // mirror/idle instance may not know the model (its caches were cleared);
@@ -554,10 +639,52 @@ function writeStateFile(
       // Same model AND provider? Only then is a previously persisted denominator
       // meaningful — a session that switched model (or provider, even with the
       // same modelID) must not inherit the old window.
+      //
+      // An EMPTY provider on either side is "not known yet", not a change: an
+      // idle/mirror write carries no provider (its caches were cleared), and a
+      // valid split written by another instance under `providerID: ""` must
+      // survive the next write that knows the provider. Treating that as a
+      // switch would zero the categories and drop the denominator.
+      const providerCompatible =
+        prevEntry == null ||
+        !prevEntry.providerID ||
+        !effectiveProvider ||
+        prevEntry.providerID === effectiveProvider;
       const sameModelAsPrev =
         prevEntry != null &&
         prevEntry.model === effectiveModel &&
-        (prevEntry.providerID || "") === effectiveProvider;
+        providerCompatible;
+
+      // A breakdown measured for a DIFFERENT model describes the payload the
+      // previous model received: same tokens, but the window and the tool/system
+      // share move. Persisting it under the new model shows the old split until
+      // the next request re-measures (the reported "categories lag after a model
+      // switch"). breakdownForModel drops exactly that case.
+      const bd = breakdownForModel(sessionID, effectiveModel);
+      // Persisted categories are model-scoped too: after a switch the old split
+      // must not seed the new entry (a hook measurement of the OLD model also
+      // must not block the fallback from filling the new one).
+      const pc = sameModelAsPrev ? prevEntry?.categories || null : null;
+
+      // Which breakdown is allowed to OWN the persisted categories?
+      //
+      // This file is shared by every plugin instance, and the instance that
+      // answers the Desktop RPC (the window's) never serves a model request, so
+      // its `breakdownCache` entry is always the client-context fallback rebuilt
+      // from the persisted message list. That fallback cannot see the assembled
+      // system prompt or the tool schemas, folds their whole mass into `other`,
+      // and after a compaction it can even read an empty conversation. Letting
+      // it overwrite the hook's measurement — the two writes landed 11 ms apart
+      // in the field — produced "system 0 / tool schemas 0 / other inflated" and
+      // could blank user/assistant. So: a hook-family source (see
+      // isHookSource) always wins; the fallback only fills an entry that no hook
+      // has ever measured.
+      //
+      // Legacy entries (written before `source` was persisted) carry no tag, but
+      // only a hook can produce a non-null system / tool-schema estimate.
+      const prevHookMeasured = sameModelAsPrev && isHookMeasuredEntry(prevEntry);
+      const bdFromHook = bd != null && isHookSource(bd.source);
+      const useBd = bd != null && (bdFromHook || !prevHookMeasured);
 
       // A write with no token figure at all is NOT a measurement: it happens on
       // a mirror instance (the hook/step served another instance, so this
@@ -608,25 +735,34 @@ function writeStateFile(
       // Untrusted names -> sanitised + bounded. A present breakdown OWNS the
       // split (an empty one means "no tool results now" — do NOT revive a stale
       // peer value); only fall back to the persisted map when this instance has
-      // no live breakdown at all.
+      // no live breakdown at all AND the model is unchanged (the split describes
+      // the previous model's request payload).
       const toolOutByTool = useBd
         ? safeToolOutByTool(bd.toolOutByTool)
-        : safeToolOutByTool(prevEntry?.toolOutByTool);
+        : sameModelAsPrev
+          ? safeToolOutByTool(prevEntry?.toolOutByTool)
+          : null;
 
       // Redundant tool output (waste detector). Persisted WITHOUT targets
       // (keepTarget=false): state.json is a local temp file, but keeping it
       // path-free matches the redacted-export policy. A present breakdown owns
-      // the value; otherwise inherit the persisted one.
+      // the value; otherwise inherit the persisted one (model-gated, like the
+      // categories it summarises).
       const reclaim = useBd
         ? safeReclaim(bd.reclaim, false)
-        : safeReclaim(prevEntry?.reclaim, false);
+        : sameModelAsPrev
+          ? safeReclaim(prevEntry?.reclaim, false)
+          : null;
 
       // Heaviest single items still in the request (top-N). A present breakdown
-      // OWNS the list; otherwise inherit the persisted one. Persisted WITHOUT
-      // targets (path-free policy, same as reclaim).
+      // OWNS the list; otherwise inherit the persisted one (model-gated: the
+      // system prompt / tool-schema share moves between models). Persisted
+      // WITHOUT targets (path-free policy, same as reclaim).
       const top = useBd
         ? safeTop(bd.top, false)
-        : safeTop(prevEntry?.top, false);
+        : sameModelAsPrev
+          ? safeTop(prevEntry?.top, false)
+          : [];
 
       // Provider-reported prompt cache (EXACT; a subset of input — never added
       // to the category sum). Inherit when this write carries no fresh figure
@@ -788,24 +924,23 @@ function writeStateFile(
           .slice(MAX_TRACKED_SESSIONS)
           .forEach((k) => delete all[k]);
       }
-      // Random temp suffix + exclusive create (CWE-377), then atomic rename.
-      const tmp = `${STATE_FILE}.${randomBytes(6).toString("hex")}.tmp`;
-      writeFileSync(tmp, JSON.stringify(all), { encoding: "utf8", flag: "wx" });
-      let renamed = false;
-      try {
-        ensureRegularFile(STATE_FILE); // never rename over a planted symlink
-        renamed = renameWithRetry(tmp, STATE_FILE);
-      } finally {
-        // A rename that exhausted its retries leaves the temp file behind; drop
-        // it so repeated failures cannot litter %TEMP% (best-effort: on a
-        // SUCCESSFUL rename the temp is already gone, existsSync filters that).
-        try {
-          if (existsSync(tmp)) unlinkSync(tmp);
-        } catch {
-          /* best-effort cleanup */
+      // Replay queued deletes inside THIS write's lock: the snapshot is only
+      // readable under it, so a busy lock at delete time cannot leave descendants
+      // alive. The requests are kept until the commit SUCCEEDS - clearing the
+      // queue before a rename that never happened would drop the delete silently
+      // and leave the row to the 7-day tombstone.
+      const replaying = pendingPruneRoots.size > 0;
+      if (replaying) {
+        for (const root of pendingPruneRoots) {
+          for (const id of subtreeIDs(all, root)) {
+            delete all[id];
+            rememberPruned(id);
+          }
         }
       }
-      return renamed;
+      const committed = commitState(all);
+      if (committed && replaying) pendingPruneRoots.clear();
+      return committed;
     } finally {
       // Release ONLY a lock we actually own (lock === null => fail-open, skip).
       if (lock && lock.ok) releaseLock(STATE_LOCK_FILE, lock.token);
@@ -902,10 +1037,84 @@ function pushFinalSummary(claimKey, summaryLines) {
   }
 }
 
+// Delete one session's entry AND its whole subtree from the shared state file.
+//
+// `session.deleted` is authoritative, so waiting for the tombstone (7 days) or
+// the LRU cap keeps a dead session visible in `/context-breakdown`, the Desktop
+// tab and the `/cx` picker - and a phantom row has no step event left to be
+// filtered out by. The walk follows the persisted parentID chain (the same
+// source discovery uses), so a deleted parent takes its descendants with it and
+// a deleted child takes its own sub-subagents.
+//
+// Every removed ID also enters `prunedSessions`: the host never reuses an ID, so
+// a later write for it is dropped instead of recreating the row (a live child
+// whose parent was deleted would otherwise come back as a phantom ROOT once
+// clearChildSubagentTracking() had dropped its parent cache).
+//
+// Same locking/atomic-write contract as writeStateFile, except busy: the delete
+// is QUEUED for the next write (which already holds the lock) rather than lost -
+// the tombstone would not remove it for 7 days.
+function pruneSessionState(sessionID) {
+  try {
+    if (!sessionID || !isSafeSessionKey(sessionID)) return false;
+    // In-memory descendants first: a child that has not written its first entry
+    // yet is invisible to the disk walk below, but it WILL write later - and by
+    // then `session.deleted` has already wiped its parent attribution, so it
+    // would land as a phantom root. Remember them regardless of the lock.
+    const kidsByParent = new Map();
+    for (const [childID, parentID] of sessionParentCache) {
+      if (typeof parentID !== "string") continue;
+      const kids = kidsByParent.get(parentID);
+      if (kids) kids.push(childID);
+      else kidsByParent.set(parentID, [childID]);
+    }
+    const inMemory = new Set([sessionID]);
+    const pending = [sessionID];
+    while (pending.length > 0) {
+      const current = pending.pop();
+      for (const child of kidsByParent.get(current) || []) {
+        if (inMemory.has(child)) continue;
+        inMemory.add(child);
+        pending.push(child);
+      }
+    }
+    for (const id of inMemory) rememberPruned(id);
+    const lock = acquireLock(STATE_LOCK_FILE);
+    if (lock && !lock.ok) {
+      logErr(`pruneSessionState queued (state lock busy) session=${oneLine(sessionID)}`);
+      queuePrune(sessionID); // replayed under the next write's lock, with the subtree
+      return false;
+    }
+    try {
+      const all = readStateSnapshot();
+      const doomed = subtreeIDs(all, sessionID);
+      let removed = 0;
+      for (const id of doomed) {
+        // Remembered even when nothing was persisted: the write barrier has to
+        // cover a session whose entry was already gone (another instance pruned
+        // it) and a child that has not written its first entry yet.
+        rememberPruned(id);
+        if (Object.prototype.hasOwnProperty.call(all, id)) {
+          delete all[id];
+          removed++;
+        }
+      }
+      if (removed === 0) return false; // nothing persisted (already gone)
+      return commitState(all);
+    } finally {
+      if (lock && lock.ok) releaseLock(STATE_LOCK_FILE, lock.token);
+    }
+  } catch (err) {
+    logErr("pruneSessionState failed", err);
+    return false;
+  }
+}
+
 export {
   logErr,
   writeLog,
   writeStateFile,
+  pruneSessionState,
   debugEvent,
   readStateSnapshot,
   pushFinalSummary,

package/lib/tui-data.d.ts

@@ -73,6 +73,19 @@ export declare function fmt(n: number): string
 export declare function num(v: unknown): number
 export declare function fit(s: string, w: number): string
 export declare function updatedAt(iso: string | undefined): string
+export declare function updatedCell(
+  iso: string | undefined,
+  stale: boolean | undefined,
+  width: number,
+): string
+export declare function panelLayout(panelWidth: number | undefined): {
+  roleW: number
+  modelW: number
+  ctxW: number
+  costW: number
+  updW: number
+  gutter: string
+}
 export declare function toolOutEntries(
   map: Record<string, number> | undefined,
   limit?: number,

package/lib/tui-data.js

@@ -122,16 +122,102 @@ export function fit(s, w) {
   return s.padEnd(w)
 }
 
+// Compose the `updated` cell. The stale marker is appended AFTER fitting: fit()
+// cuts the tail and replaces it with "~", so a marker folded into the fitted
+// string would disappear at the first narrow width - while the legend line below
+// the table would still advertise it. The time cell keeps at least 5 columns.
+export function updatedCell(iso, stale, width) {
+  const marker = stale === true ? " *" : ""
+  const timeW = Math.max(5, width - marker.length)
+  return fit(updatedAt(iso), timeW) + marker
+}
+
+// Deterministic clock for the updated column: HH:MM:SS in LOCAL time, built
+// from the Date getters instead of toLocaleTimeString(). toLocaleTimeString()
+// follows the host locale (AM/PM, dots, seconds dropped) and can exceed the
+// column width - the sidebar and the `/cx` row then lose their alignment on
+// non-en-US machines.
 export function updatedAt(iso) {
   if (!iso) return "?"
   try {
     const d = new Date(iso)
-    return Number.isNaN(d.getTime()) ? "?" : d.toLocaleTimeString()
+    if (Number.isNaN(d.getTime())) return "?"
+    const pad = (n) => String(n).padStart(2, "0")
+    return `${pad(d.getHours())}:${pad(d.getMinutes())}:${pad(d.getSeconds())}`
   } catch {
     return "?"
   }
 }
 
+// Panel column layout (monospace), derived from the host-provided panel width so
+// cells never collide on narrow terminals. Pure math (no JSX, no host imports),
+// so the unit harness can assert the row never grows past the panel.
+//
+// Columns: role | model | ctx | cost | updated, four 2-column gutters.
+//
+// Width budget (row = role + model + ctx + cost + updated + 4 gutters):
+//   - the `updated` cell takes 10 columns (HH:MM:SS + " *") only when that
+//     leaves the model cell at its 8-column floor, otherwise 8 (the marker then
+//     elides the seconds) - growing it must never push the row past the panel;
+//   - the model cell absorbs whatever is left above its floor;
+//   - if both floors bind (narrow panels), the ROLE cell gives back the
+//     difference down to its own floor: without that clawback the row landed on
+//     an exact fit at w=60..62, and an exact fit is what clipped the last cell
+//     (the stale marker) in the first place;
+//   - PANEL_SAFE_COLUMNS is therefore preserved for every width >= 57; at 56
+//     the role floor stops the clawback and the row is an exact fit.
+// Below 56 columns the fixed columns (ctx 12 + cost 8 + updated 8 + four
+// gutters) plus the role/model floors no longer fit; the host clips the right
+// edge there.
+const PANEL_GUTTER = 2
+const PANEL_CTX_WIDTH = 12
+const PANEL_COST_WIDTH = 8
+// One spare column: the host adds its own padding/border around a panel and an
+// exact fit let the last cell land on the right edge (clipped on some widths).
+const PANEL_SAFE_COLUMNS = 1
+// Model cell floor: a model name shorter than this is unreadable.
+const PANEL_MIN_MODEL_W = 8
+// Role cell floor: `subagent-12` is the longest role label we print.
+const PANEL_MIN_ROLE_W = 12
+// `HH:MM:SS` is 8 columns; the stale marker needs 2 more.
+const PANEL_TIME_W = 8
+const PANEL_TIME_STALE_W = 10
+
+export function panelLayout(panelWidth) {
+  const w = num(panelWidth) > 0 ? num(panelWidth) : 60
+  const ctxW = PANEL_CTX_WIDTH
+  const costW = PANEL_COST_WIDTH
+  const gutters = 4 * PANEL_GUTTER
+  let roleW = Math.max(PANEL_MIN_ROLE_W, Math.min(20, Math.floor(w * 0.28)))
+  const usable = w - PANEL_SAFE_COLUMNS - roleW - ctxW - costW - gutters
+  // Prefer the full `HH:MM:SS` + " *" cell. When that does not leave the model
+  // cell its floor, fall back to the 8-column time cell: the marker then elides
+  // the SECONDS instead of the row overrunning the panel (which clipped the very
+  // marker the legend explains).
+  const updW =
+    usable - PANEL_TIME_STALE_W >= PANEL_MIN_MODEL_W
+      ? PANEL_TIME_STALE_W
+      : PANEL_TIME_W
+  const modelW = Math.max(PANEL_MIN_MODEL_W, usable - updW)
+  // Both floors binding (narrow panel) made the row an EXACT fit: the model
+  // floor ate PANEL_SAFE_COLUMNS and the last cell again landed on the panel
+  // edge. Take the difference back from the role cell instead - it is prose and
+  // elides gracefully, and the safe column survives.
+  const total = roleW + modelW + ctxW + costW + updW + gutters
+  const over = total - (w - PANEL_SAFE_COLUMNS)
+  if (over > 0) {
+    roleW = Math.max(PANEL_MIN_ROLE_W, roleW - over)
+  }
+  return {
+    roleW,
+    modelW,
+    ctxW,
+    costW,
+    updW,
+    gutter: " ".repeat(PANEL_GUTTER),
+  }
+}
+
 // ---------------------------------------------------------------------------
 // Composer pill (`prompt.footer.status` slot).
 // ---------------------------------------------------------------------------

package/lib/tui-panel.ts

@@ -10,7 +10,7 @@ import { mkdirSync, writeFileSync } from "node:fs"
 import { tmpdir } from "node:os"
 import { basename, join } from "node:path"
 import type { StateEntry } from "./tui-data.js"
-import { collectFamily, fit, fmt, num, toolOutEntries, updatedAt } from "./tui-data.js"
+import { collectFamily, fit, fmt, num, panelLayout, toolOutEntries, updatedCell } from "./tui-data.js"
 import { token } from "./tui-theme.js"
 import { c as comp, h } from "./tui-h.ts"
 import {
@@ -121,29 +121,9 @@ function listSignature(list: unknown[]): string {
   return `${n}:${id}:${created}:${size}`
 }
 
-// Panel column layout (monospace), derived from the host-provided panel width
-// so cells never collide on narrow terminals. Gaps between columns keep a
-// truncated cell visually separated from its neighbour.
-const GUTTER = 2
-const CTX_WIDTH = 12
-const COST_WIDTH = 8
-
-function panelLayout(panelWidth: number): {
-  roleW: number
-  modelW: number
-  ctxW: number
-  costW: number
-  updW: number
-  gutter: string
-} {
-  const w = num(panelWidth) > 0 ? num(panelWidth) : 60
-  const ctxW = CTX_WIDTH
-  const costW = COST_WIDTH
-  const updW = Math.max(5, Math.min(8, w - ctxW - 4 * GUTTER - 24))
-  const roleW = Math.max(12, Math.min(20, Math.floor(w * 0.28)))
-  const modelW = Math.max(8, w - roleW - ctxW - costW - updW - 4 * GUTTER)
-  return { roleW, modelW, ctxW, costW, updW, gutter: " ".repeat(GUTTER) }
-}
+// Panel column layout lives in lib/tui-data.js (pure math) so the unit harness
+// can regression-test that the row never grows past the panel width (T42 in
+// test/prepublish.mjs).
 
 // Dollar formatting for the cost column: compact, always `$`-prefixed, `-`
 // when the host data layer has no cost for the session.
@@ -617,8 +597,7 @@ export function BreakdownPanel(props: {
       L.gutter +
       fit(money(costOf(e.sessionID)), L.costW) +
       L.gutter +
-      updatedAt(e.updatedAt) +
-      (e.compactStale === true ? " (stale)" : "")
+      updatedCell(e.updatedAt, e.compactStale === true, L.updW)
     )
   }
 
@@ -633,7 +612,7 @@ export function BreakdownPanel(props: {
       all && typeof all === "object"
         ? Object.values(all).filter((v) => num(v) > 0).length
         : 0
-    const parts = entries.map(([name, val]) => `${safeText(name)} ${fmt(val)}`)
+    const parts = entries.map(([name, val]) => `${safeText(name)} ${fmt(val)} tokens`)
     if (total > entries.length) parts.push(`+${total - entries.length} more`)
     return parts.join(" \u00b7 ")
   }
@@ -701,6 +680,14 @@ export function BreakdownPanel(props: {
                 .rows.map((e, i) =>
                   mutedText(() => row(e, i === 0)),
                 ),
+              comp(Show, {
+                get when() {
+                  return data().rows.some((e) => e.compactStale === true)
+                },
+                get children() {
+                  return mutedText(() => " * stale - compacted")
+                },
+              }),
               comp(Show, {
                 get when() {
                   return (data().root?.usable ?? 0) > 0

package/lib/v1.js

@@ -671,6 +671,11 @@ function makeV1(client) {
       ) {
         // session.idle / session.compacted -> properties.sessionID;
         // session.deleted -> properties.info.id
+        //
+        // V1 is feature-frozen: unlike the V2 handler, a V1 delete event does NOT
+        // purge the state.json entry (it ages out via the 7-day tombstone), so a
+        // V1 host can still show a phantom row. Kept intentionally small; V2 is
+        // the supported path.
         const sid =
           event.properties?.sessionID ?? event.properties?.info?.id;
         if (!sid) return;