pilotswarm 0.5.38 → 0.5.40

package/ui/core/src/controller.js

@@ -51,6 +51,22 @@ import {
 import { findArtifactEntry } from "./state.js";
 import { getTheme, listThemes } from "./themes/index.js";
 
+/**
+ * The copy selector for a package LIST row: which same-named copy it is.
+ * Scope shadowing means one name can be a shared package AND a user copy at
+ * once; the row's scope (+ owner, for admins looking at someone else's user
+ * copy) is what disambiguates every read and action on it.
+ */
+export function packageRowSelector(row) {
+    if (!row) return null;
+    return {
+        ...(row.scope === "shared" || row.scope === "user" ? { scope: row.scope } : {}),
+        ...(row.scope === "user" && row.owner?.provider && row.owner?.subject
+            ? { owner: { provider: row.owner.provider, subject: row.owner.subject } }
+            : {}),
+    };
+}
+
 const ORCHESTRATION_STATS_REFRESH_MS = 20_000;
 const SESSION_STATS_REFRESH_MS = 20_000;
 const FLEET_STATS_REFRESH_MS = 30_000;
@@ -3062,27 +3078,39 @@ export class PilotSwarmUiController {
         }
     }
 
-    /** Select a package: loads its detail and workspace tree. */
-    async selectAdminPackage(name) {
-        this.dispatch({ type: "admin/packages/select", name });
+    /**
+     * Select a package: loads its detail and workspace tree.
+     *
+     * `selector` = { scope, owner? } from the clicked ROW. One name can be
+     * two packages at once (scope shadowing: a shared copy plus a user
+     * copy), and without the selector every read here resolved "own copy
+     * first" — both rows showed the same history, and actions could land on
+     * the copy the user was not looking at.
+     */
+    async selectAdminPackage(name, selector = null) {
+        this.dispatch({ type: "admin/packages/select", name, selector });
         if (!name) return;
+        // Selection token minted by the reducer just now; every response from
+        // this selection carries it so a slow response for another COPY of
+        // the same name (scope shadowing) can never land on this one.
+        const seq = this.getState().admin?.packages?.selectionSeq ?? 0;
         await Promise.all([
             (async () => {
                 try {
-                    const detail = await this.transport.getAgentPackage(name);
+                    const detail = await this.transport.getAgentPackage(name, selector);
                     if (!detail) throw new Error(`package "${name}" not found`);
-                    this.dispatch({ type: "admin/packages/detail/loaded", name, detail });
+                    this.dispatch({ type: "admin/packages/detail/loaded", name, seq, detail });
                 } catch (error) {
-                    this.dispatch({ type: "admin/packages/detail/loadFailed", name, error: error?.message || String(error) });
+                    this.dispatch({ type: "admin/packages/detail/loadFailed", name, seq, error: error?.message || String(error) });
                 }
             })(),
             (async () => {
                 try {
-                    const tree = await this.transport.getAgentPackageTree(name);
+                    const tree = await this.transport.getAgentPackageTree(name, null, selector);
                     // A slower tree for a PREVIOUS selection must not clobber
                     // the current package's workspace (stale-response race).
-                    if (this.getState().admin?.packages?.selectedName !== name) return;
-                    this.dispatch({ type: "admin/packages/tree/loaded", name, tree });
+                    if ((this.getState().admin?.packages?.selectionSeq ?? 0) !== seq) return;
+                    this.dispatch({ type: "admin/packages/tree/loaded", name, seq, tree });
                     // The package's own CHANGELOG, when it ships one. Loaded
                     // alongside the tree rather than on demand because it is
                     // the first thing a reviewer wants: what changed, why, and
@@ -3091,11 +3119,12 @@ export class PilotSwarmUiController {
                     if (hasChangelog && typeof this.transport.getAgentPackageFile === "function") {
                         void (async () => {
                             try {
-                                const file = await this.transport.getAgentPackageFile(name, null, "CHANGELOG.md");
-                                if (this.getState().admin?.packages?.selectedName !== name) return;
+                                const file = await this.transport.getAgentPackageFile(name, null, "CHANGELOG.md", selector);
+                                if ((this.getState().admin?.packages?.selectionSeq ?? 0) !== seq) return;
                                 this.dispatch({
                                     type: "admin/packages/changelog/loaded",
                                     name,
+                                    seq,
                                     content: typeof file === "string" ? file : (file?.content ?? file?.text ?? ""),
                                 });
                             } catch {
@@ -3104,13 +3133,13 @@ export class PilotSwarmUiController {
                             }
                         })();
                     } else {
-                        this.dispatch({ type: "admin/packages/changelog/loaded", name, content: null });
+                        this.dispatch({ type: "admin/packages/changelog/loaded", name, seq, content: null });
                     }
                     // Default preview: plugin.json (always present in a valid package).
                     const first = tree?.files?.find((f) => f.path === "plugin.json") ?? tree?.files?.[0];
                     if (first) void this.selectAdminPackageFile(first.path);
                 } catch (error) {
-                    this.dispatch({ type: "admin/packages/tree/loadFailed", name, error: error?.message || String(error) });
+                    this.dispatch({ type: "admin/packages/tree/loadFailed", name, seq, error: error?.message || String(error) });
                 }
             })(),
         ]);
@@ -3121,14 +3150,22 @@ export class PilotSwarmUiController {
         const pkgs = this.getState().admin?.packages;
         if (!pkgs?.list?.length) return;
         // Same shared→user projection the settings tree renders, so j/k walks
-        // the list in VISUAL order regardless of transport ordering.
-        const names = [
+        // the list in VISUAL order regardless of transport ordering. Rows are
+        // COPIES, not names: a shadowed name appears once per scope.
+        const rows = [
             ...pkgs.list.filter((p) => p.scope === "shared"),
             ...pkgs.list.filter((p) => p.scope !== "shared"),
-        ].map((p) => p.name);
-        const index = names.indexOf(pkgs.selectedName);
-        const next = names[Math.min(names.length - 1, Math.max(0, (index < 0 ? (delta > 0 ? -1 : 0) : index) + delta))];
-        if (next && next !== pkgs.selectedName) await this.selectAdminPackage(next);
+        ];
+        const keyOf = (row) => `${row.name}\u0001${row.scope ?? ""}\u0001${row.owner?.subject ?? ""}`;
+        const selectedKey = pkgs.selectedName
+            ? `${pkgs.selectedName}\u0001${pkgs.selectedSelector?.scope ?? ""}\u0001${pkgs.selectedSelector?.owner?.subject ?? ""}`
+            : null;
+        let index = rows.findIndex((row) => keyOf(row) === selectedKey);
+        if (index < 0) index = rows.findIndex((row) => row.name === pkgs.selectedName);
+        const next = rows[Math.min(rows.length - 1, Math.max(0, (index < 0 ? (delta > 0 ? -1 : 0) : index) + delta))];
+        if (next && (next.name !== pkgs.selectedName || keyOf(next) !== selectedKey)) {
+            await this.selectAdminPackage(next.name, packageRowSelector(next));
+        }
     }
 
     toggleAdminPackageDir(dir) {
@@ -3139,12 +3176,17 @@ export class PilotSwarmUiController {
         const pkgs = this.getState().admin?.packages;
         const name = pkgs?.selectedName;
         if (!name || !filePath) return;
+        // Tag the preview with the current selection token so a slow file for
+        // one copy can't render under another copy of the same name (their
+        // file paths are identical — both ship plugin.json).
+        const seq = pkgs?.selectionSeq ?? 0;
+        const selector = pkgs?.selectedSelector ?? null;
         this.dispatch({ type: "admin/packages/file/loading", path: filePath });
         try {
-            const file = await this.transport.getAgentPackageFile(name, null, filePath);
-            this.dispatch({ type: "admin/packages/file/loaded", file });
+            const file = await this.transport.getAgentPackageFile(name, null, filePath, selector);
+            this.dispatch({ type: "admin/packages/file/loaded", seq, file });
         } catch (error) {
-            this.dispatch({ type: "admin/packages/file/loadFailed", path: filePath, error: error?.message || String(error) });
+            this.dispatch({ type: "admin/packages/file/loadFailed", seq, path: filePath, error: error?.message || String(error) });
         }
     }
 
@@ -3157,32 +3199,53 @@ export class PilotSwarmUiController {
     async runAdminPackageAction(kind, arg = null) {
         const pkgs = this.getState().admin?.packages;
         const name = pkgs?.selectedName;
+        const selector = pkgs?.selectedSelector ?? null;
         if (!name) return;
         this.dispatch({ type: "admin/packages/action/pending", action: kind });
         try {
             switch (kind) {
                 case "promote":
-                    await this.transport.setAgentPackageScope(name, "shared");
+                    await this.transport.setAgentPackageScope(name, "shared", selector);
                     break;
                 case "demote":
-                    await this.transport.setAgentPackageScope(name, "user");
+                    await this.transport.setAgentPackageScope(name, "user", selector);
+                    break;
+                // Publish the selected copy's version (arg, default active)
+                // into the same-named package in the OTHER scope. THE update
+                // path when the shared name already exists — promote can only
+                // move a row to an unused name.
+                case "republish":
+                    await this.transport.republishAgentPackageVersion(
+                        name, arg, selector?.scope === "shared" ? "user" : "shared",
+                    );
                     break;
                 case "pin":
-                    await this.transport.pinAgentPackageVersion(name, arg);
+                    await this.transport.pinAgentPackageVersion(name, arg, selector);
                     break;
                 case "enable":
                 case "disable":
-                    await this.transport.setAgentPackageEnabled(name, kind === "enable");
+                    await this.transport.setAgentPackageEnabled(name, kind === "enable", selector);
                     break;
                 case "delete":
-                    await this.transport.deleteAgentPackage(name);
+                    await this.transport.deleteAgentPackage(name, selector);
                     break;
                 default:
                     throw new Error(`unknown package action: ${kind}`);
             }
             this.dispatch({ type: "admin/packages/action/done" });
             await this.refreshAdminAgentPackages();
-            if (kind !== "delete") await this.selectAdminPackage(name);
+            // Re-select the copy that still exists. promote/demote MOVE the row
+            // to the other scope, so the pre-action selector now points at a
+            // copy that is gone — re-selecting it would error the pane with
+            // "package not found". Every other action leaves the copy in place.
+            if (kind !== "delete") {
+                const nextSelector = kind === "promote"
+                    ? { scope: "shared", ...(selector?.owner ? { owner: selector.owner } : {}) }
+                    : kind === "demote"
+                        ? { scope: "user", ...(selector?.owner ? { owner: selector.owner } : {}) }
+                        : selector;
+                await this.selectAdminPackage(name, nextSelector);
+            }
         } catch (error) {
             this.dispatch({ type: "admin/packages/action/failed", error: error?.message || String(error) });
         }
@@ -4436,8 +4499,41 @@ export class PilotSwarmUiController {
         return true;
     }
 
+    applyCanvasDataEvent(sessionId, event) {
+        this.dispatch({
+            type: "canvas/data",
+            sessionId,
+            slot: Number(event?.data?.slot) || 1,
+            dataRev: Number(event?.data?.dataRev),
+            payload: event?.data?.payload,
+            // Plane-fed ticks (the canvas data plane's live mirror) carry
+            // their own seq lineage and the patch that produced them — the
+            // reducer orders plane ticks by planeSeq and hands the patch to
+            // pages that opt into targeted updates.
+            ...(Number.isFinite(Number(event?.data?.planeSeq)) ? { planeSeq: Number(event.data.planeSeq) } : {}),
+            ...(event?.data?.patch && typeof event.data.patch === "object" ? { patch: event.data.patch } : {}),
+            note: typeof event?.data?.note === "string" ? event.data.note : "",
+        });
+    }
+
     mergeSessionEvent(sessionId, event) {
         if (!sessionId || !event) return false;
+        // Plane-synthesized canvas events are TRANSIENT: they update canvas
+        // state and nothing else. They carry no seq — letting them into
+        // history would corrupt the replay cursor — and they must never
+        // appear in the transcript.
+        if (event.transient === true) {
+            if (event.eventType === "session.canvas_data") {
+                this.applyCanvasDataEvent(sessionId, event);
+            }
+            if (event.eventType === "session.canvas_plane_released") {
+                // The plane died for this session (server error/rollback).
+                // Clear the reducer's takeover so legacy durable ticks — the
+                // fallback path — apply again instead of being dropped.
+                this.dispatch({ type: "canvas/planeReleased", sessionId });
+            }
+            return false;
+        }
         const state = this.getState();
         const existing = state.history.bySessionId.get(sessionId) || { chat: [], activity: [], lastSeq: 0 };
         if (event.seq <= (existing.lastSeq || 0)) return false;
@@ -4498,14 +4594,7 @@ export class PilotSwarmUiController {
             this.applyCanvasPresented(sessionId, event);
         }
         if (event.eventType === "session.canvas_data") {
-            this.dispatch({
-                type: "canvas/data",
-                sessionId,
-                slot: Number(event?.data?.slot) || 1,
-                dataRev: Number(event?.data?.dataRev),
-                payload: event?.data?.payload,
-                note: typeof event?.data?.note === "string" ? event.data.note : "",
-            });
+            this.applyCanvasDataEvent(sessionId, event);
         }
         this.reconcileOutboxAgainstEvent(sessionId, event);
         const derivedModel = extractSessionModelFromEvent(event);
@@ -7225,7 +7314,14 @@ export class PilotSwarmUiController {
     }
 
     setFocus(focusRegion) {
-        this.dispatch({ type: "ui/focus", focusRegion: normalizeFocusRegion(focusRegion, this.getCurrentLayout()) });
+        // Carry the raw request alongside the normalized region: on a phone a
+        // workspace region (sessions/chat) normalizes to inspector, and the
+        // mobile follow-focus effect must not read that as "open diagnostics".
+        this.dispatch({
+            type: "ui/focus",
+            focusRegion: normalizeFocusRegion(focusRegion, this.getCurrentLayout()),
+            requestedFocusRegion: focusRegion,
+        });
     }
 
     focusNext() {

package/ui/core/src/history.js

@@ -1123,7 +1123,11 @@ export function appendEventToHistory(history, event) {
         chat: clampHistoryItems(history?.chat || [], loadedEventLimit),
         activity: clampHistoryItems(history?.activity || [], loadedEventLimit),
         events: nextEvents,
-        lastSeq: event.seq,
+        // The replay cursor. A seq-less event (plane-synthesized canvas
+        // ticks are transient and carry none) must never poison it —
+        // lastSeq=undefined reads as afterSeq 0 on the next sync and the
+        // whole transcript re-merges, duplicated.
+        lastSeq: Number.isFinite(Number(event.seq)) ? event.seq : (history?.lastSeq || 0),
         loadedEventLimit,
         loadedEventCount: Math.max(Number(history?.loadedEventCount || 0), nextEvents.length),
         hasOlderEvents: Boolean(history?.hasOlderEvents),

package/ui/core/src/index.js

@@ -8,6 +8,7 @@ export * from "./repo-import.js";
 export * from "./session-tree.js";
 export * from "./state.js";
 export * from "./reducer.js";
+export * from "./portal-links.js";
 export * from "./store.js";
 export * from "./selectors.js";
 export * from "./controller.js";

package/ui/core/src/layout.js

@@ -57,6 +57,16 @@ export function getMaxSessionPaneHeight(totalHeight, bodyHeight) {
     return Math.max(MIN_SESSION_PANE_HEIGHT, Math.min(maxByChatMinimum, maxByWindow));
 }
 
+export function getDiagnosticsSplitAdjustBounds(columnHeight, dividerHeight) {
+    const height = Math.max(0, Number(columnHeight) || 0);
+    const divider = clamp(Math.max(0, Number(dividerHeight) || 0), 0, height);
+    const minAdjust = -(height / 2);
+    return {
+        minAdjust,
+        maxAdjust: Math.max(minAdjust, (height / 2) - divider),
+    };
+}
+
 export function computeLegacyLayout(viewport, paneAdjust = 0, promptRows = 1, sessionPaneAdjust = 0, activityPaneAdjust = 0, fullscreenPane = null) {
     const safeViewport = normalizeViewport(viewport);
     const totalWidth = safeViewport.width;

package/ui/core/src/portal-links.js

@@ -0,0 +1,46 @@
+/**
+ * Multi-origin portal links.
+ *
+ * A deployment can be reachable through several entry points at once — a
+ * public edge and a private/VPN hostname, say — and a link built from the
+ * sender's window.location.origin only works for recipients on the SAME
+ * network path. When the portal is configured with named link origins,
+ * every link-producing surface offers one variant per origin, labeled.
+ *
+ * This replaces waldemort's deploy-time monkey patch
+ * (patch-pilotswarm-dual-session-links.mjs), which anchor-matched the
+ * minified bundle and broke on every release. The plug-in surface is one
+ * env var on the portal server: PORTAL_LINK_ORIGINS.
+ */
+
+/**
+ * Rebase one produced URL onto each configured origin.
+ * @param {string} url - a full URL produced against the current origin
+ * @param {Array<{label: string, origin: string}>} linkOrigins
+ * @returns {Array<{label: string|null, url: string}>} one entry per origin;
+ *   with no (or one) configured origin, a single unlabeled entry with the
+ *   original URL — zero behavior change for plain deployments.
+ */
+export function buildPortalLinks(url, linkOrigins) {
+    const origins = Array.isArray(linkOrigins) ? linkOrigins.filter((o) => o?.origin && o?.label) : [];
+    if (origins.length < 2) return [{ label: null, url: String(url || "") }];
+    let suffix;
+    try {
+        const parsed = new URL(String(url || ""));
+        suffix = `${parsed.pathname}${parsed.search}${parsed.hash}`;
+    } catch {
+        return [{ label: null, url: String(url || "") }];
+    }
+    return origins.map((o) => ({ label: String(o.label), url: `${o.origin}${suffix}` }));
+}
+
+/**
+ * Clipboard shape: a bare URL for the single-origin case; one labeled line
+ * per origin otherwise, so the sender pastes both and the recipient picks
+ * the one their network can reach.
+ */
+export function formatPortalLinksForCopy(links) {
+    const list = Array.isArray(links) ? links : [];
+    if (list.length <= 1) return String(list[0]?.url || "");
+    return list.map((l) => `${l.label}: ${l.url}`).join("\n");
+}

package/ui/core/src/reducer.js

@@ -19,6 +19,20 @@ import {
     createInitialState,
 } from "./state.js";
 
+/**
+ * Is this package detail/tree/changelog response for a selection the user has
+ * already left? Responses carry the selectionSeq captured when their fetch
+ * started; the NAME alone cannot tell two copies of a shadowed name apart
+ * (scope shadowing: one name, two packages), so a name-only guard let a slow
+ * response for one copy land on top of the other. Name-only actions (older
+ * hosts) keep the historical name compare.
+ */
+function packageResponseIsStale(packages, action) {
+    if (packages.selectedName !== action.name) return true;
+    if (typeof action.seq === "number") return (packages.selectionSeq ?? 0) !== action.seq;
+    return false;
+}
+
 function cloneHistoryMap(historyMap) {
     return new Map(historyMap);
 }
@@ -619,6 +633,7 @@ function applyVisibleSessionSelection(state, nextSessions) {
         sessions = {
             ...sessions,
             activeSessionId: intentTargetId,
+            listDeselected: false,
             navigationIntent: intent.status === "resolved"
                 ? intent
                 : { sessionId: intent.sessionId, status: "resolved" },
@@ -1026,6 +1041,15 @@ export function appReducer(state, action) {
                 ui: {
                     ...state.ui,
                     focusRegion: action.focusRegion,
+                    // The RAW region the caller asked for, before layout
+                    // normalization. A workspace region (sessions/chat) with no
+                    // slot in the current layout normalizes to the first
+                    // focusable pane — inspector, on a phone — so the normalized
+                    // value alone cannot tell "focus the inspector" from
+                    // "sessions got rewritten to inspector". The mobile
+                    // follow-focus pane switch reads this to avoid opening
+                    // diagnostics when the user only asked for the workspace.
+                    requestedFocusRegion: action.requestedFocusRegion ?? action.focusRegion,
                 },
             };
 
@@ -1087,6 +1111,10 @@ export function appReducer(state, action) {
             if (!sessionId) return state;
             const nextSessions = {
                 ...state.sessions,
+                // A deep link is explicit navigation. Keep the list highlight
+                // aligned with the linked chat even if empty-space click had
+                // previously deselected the session row.
+                listDeselected: false,
                 navigationIntent: { sessionId, status: "pending" },
                 filterExceptionId: null,
             };
@@ -1542,6 +1570,39 @@ export function appReducer(state, action) {
             if (previousActiveId && previousActiveId !== action.sessionId) {
                 savedChatScroll[previousActiveId] = Number(state.ui.scroll?.chat) || 0;
             }
+            // Per-session prompt drafts: a half-written message belongs to the
+            // session it was written in. Stash the outgoing draft (text +
+            // staged attachments) and restore the incoming one, exactly like
+            // the chat-scroll memory above. Exception: while editing a pending
+            // outbox message the composer text lives in that outbox item, not
+            // in a draft — leave the item alone, drop the edit latch, and give
+            // the incoming session its own draft back.
+            const switchingSession = previousActiveId !== action.sessionId;
+            const savedDrafts = { ...(state.ui.promptDraftBySession || {}) };
+            let nextPrompt = state.ui.prompt;
+            let nextPromptCursor = state.ui.promptCursor;
+            let nextPromptAttachments = state.ui.promptAttachments;
+            let nextPromptEdit = state.ui.promptEdit ?? null;
+            if (switchingSession) {
+                const editingPending = Boolean(state.ui.promptEdit);
+                if (!editingPending && previousActiveId) {
+                    const outgoing = {
+                        prompt: String(state.ui.prompt || ""),
+                        attachments: Array.isArray(state.ui.promptAttachments) ? state.ui.promptAttachments : [],
+                    };
+                    if (outgoing.prompt || outgoing.attachments.length > 0) {
+                        savedDrafts[previousActiveId] = outgoing;
+                    } else {
+                        delete savedDrafts[previousActiveId];
+                    }
+                }
+                const incoming = action.sessionId ? savedDrafts[action.sessionId] : null;
+                delete savedDrafts[action.sessionId];
+                nextPrompt = incoming?.prompt || "";
+                nextPromptCursor = nextPrompt.length;
+                nextPromptAttachments = Array.isArray(incoming?.attachments) ? incoming.attachments : [];
+                nextPromptEdit = null;
+            }
             // Manual navigation to a different session releases the deep-link
             // latch and its transient filter exception.
             const releasesNavigationLatch = Boolean(
@@ -1560,6 +1621,12 @@ export function appReducer(state, action) {
                 ui: {
                     ...state.ui,
                     chatScrollBySession: savedChatScroll,
+                    promptDraftBySession: savedDrafts,
+                    prompt: nextPrompt,
+                    promptCursor: nextPromptCursor,
+                    promptRows: getPromptInputRows(nextPrompt),
+                    promptAttachments: nextPromptAttachments,
+                    promptEdit: nextPromptEdit,
                     // Status notices are per-moment, usually per-session (send
                     // refusals, access hints) — a stale one must not follow the
                     // user to the next session.
@@ -1833,6 +1900,8 @@ export function appReducer(state, action) {
             for (const id of ids) delete nextOutbox[id];
             const nextChatScroll = { ...(state.ui.chatScrollBySession || {}) };
             for (const id of ids) delete nextChatScroll[id];
+            const nextDrafts = { ...(state.ui.promptDraftBySession || {}) };
+            for (const id of ids) delete nextDrafts[id];
             return {
                 ...state,
                 history: {
@@ -1846,6 +1915,7 @@ export function appReducer(state, action) {
                 ui: {
                     ...state.ui,
                     chatScrollBySession: nextChatScroll,
+                    promptDraftBySession: nextDrafts,
                 },
             };
         }
@@ -2319,6 +2389,7 @@ export function appReducer(state, action) {
                         workerState: Array.isArray(action.workerState) ? action.workerState : [],
                         fetchedAt: Date.now(),
                         selectedName: stillThere ? previous.selectedName : null,
+                        selectedSelector: stillThere ? (previous.selectedSelector ?? null) : null,
                         ...(stillThere ? {} : { detail: null, workspace: { ...previous.workspace, tree: null, selectedPath: null, file: null } }),
                     },
                 },
@@ -2336,6 +2407,18 @@ export function appReducer(state, action) {
                     packages: {
                         ...state.admin.packages,
                         selectedName: action.name || null,
+                        // WHICH copy of the name: {scope, owner} from the row
+                        // the user clicked. One name can be two packages
+                        // (scope shadowing) — without this every read and
+                        // action fell back to "own copy first" and could
+                        // target the row the user was NOT looking at.
+                        selectedSelector: action.selector || null,
+                        // Monotonic selection token. The stale-response guards
+                        // below compare it, because comparing the NAME alone
+                        // cannot tell two copies of a shadowed name apart — a
+                        // slow response for the user copy could land on top of
+                        // the shared copy the user just clicked.
+                        selectionSeq: (state.admin.packages.selectionSeq ?? 0) + 1,
                         detail: null,
                         detailLoading: Boolean(action.name),
                         detailError: null,
@@ -2354,17 +2437,17 @@ export function appReducer(state, action) {
             };
         }
         case "admin/packages/detail/loaded": {
-            if (state.admin.packages.selectedName !== action.name) return state;
+            if (packageResponseIsStale(state.admin.packages, action)) return state;
             return { ...state, admin: { ...state.admin, packages: { ...state.admin.packages, detail: action.detail, detailLoading: false, detailError: null } } };
         }
         case "admin/packages/detail/loadFailed": {
-            if (state.admin.packages.selectedName !== action.name) return state;
+            if (packageResponseIsStale(state.admin.packages, action)) return state;
             return { ...state, admin: { ...state.admin, packages: { ...state.admin.packages, detail: null, detailLoading: false, detailError: action.error || "Failed to load package" } } };
         }
         case "admin/packages/changelog/loaded": {
             // Stale-response guard, same as the tree: a slow changelog for a
             // previously-selected package must not surface under the current one.
-            if (state.admin.packages.selectedName !== action.name) return state;
+            if (packageResponseIsStale(state.admin.packages, action)) return state;
             return {
                 ...state,
                 admin: {
@@ -2377,7 +2460,7 @@ export function appReducer(state, action) {
             };
         }
         case "admin/packages/tree/loaded": {
-            if (state.admin.packages.selectedName !== action.name) return state;
+            if (packageResponseIsStale(state.admin.packages, action)) return state;
             const topDirs = Array.isArray(action.tree?.dirs)
                 ? action.tree.dirs.filter((dir) => !dir.includes("/"))
                 : [];
@@ -2400,7 +2483,7 @@ export function appReducer(state, action) {
             };
         }
         case "admin/packages/tree/loadFailed": {
-            if (state.admin.packages.selectedName !== action.name) return state;
+            if (packageResponseIsStale(state.admin.packages, action)) return state;
             return { ...state, admin: { ...state.admin, packages: { ...state.admin.packages, workspace: { ...state.admin.packages.workspace, treeLoading: false, treeError: action.error || "Failed to load package files" } } } };
         }
         case "admin/packages/toggleDir": {
@@ -2414,11 +2497,17 @@ export function appReducer(state, action) {
             return { ...state, admin: { ...state.admin, packages: { ...state.admin.packages, workspace: { ...state.admin.packages.workspace, selectedPath: action.path, file: null, fileLoading: true, fileError: null } } } };
         }
         case "admin/packages/file/loaded": {
+            // Path AND selection token: two copies of a shadowed name have the
+            // SAME file paths (both ship plugin.json), so a slow preview for
+            // the previously-selected copy would otherwise land under the
+            // current one. The seq check tells the two copies apart.
             if (state.admin.packages.workspace.selectedPath !== action.file?.path) return state;
+            if (typeof action.seq === "number" && (state.admin.packages.selectionSeq ?? 0) !== action.seq) return state;
             return { ...state, admin: { ...state.admin, packages: { ...state.admin.packages, workspace: { ...state.admin.packages.workspace, file: action.file, fileLoading: false, fileError: null } } } };
         }
         case "admin/packages/file/loadFailed": {
             if (state.admin.packages.workspace.selectedPath !== action.path) return state;
+            if (typeof action.seq === "number" && (state.admin.packages.selectionSeq ?? 0) !== action.seq) return state;
             return { ...state, admin: { ...state.admin, packages: { ...state.admin.packages, workspace: { ...state.admin.packages.workspace, fileLoading: false, fileError: action.error || "Failed to load file" } } } };
         }
         case "admin/packages/action/pending": {
@@ -2906,7 +2995,20 @@ export function appReducer(state, action) {
             const dataRev = Number(action.dataRev);
             if (!sessionId || !Number.isFinite(dataRev) || dataRev <= 0) return state;
             const existing = state.canvas.bySessionId[key] || {};
-            if ((existing.latestDataRev || 0) >= dataRev) return state;
+            const planeSeq = Number(action.planeSeq);
+            const isPlane = Number.isFinite(planeSeq) && planeSeq > 0;
+            // Plane takeover: once a slot has seen ONE plane-fed tick, that
+            // lineage owns the slot. Plane ticks order by planeSeq (their
+            // numbering restarts relative to legacy dataRev, so the numeric
+            // guard below would wrongly starve them); legacy dual-written
+            // events for a plane-owned slot are strictly staler copies of
+            // state the plane already delivered — drop them.
+            if (isPlane) {
+                if ((existing.planeSeq || 0) >= planeSeq) return state;
+            } else {
+                if (existing.planeSeq) return state;
+                if ((existing.latestDataRev || 0) >= dataRev) return state;
+            }
             return {
                 ...state,
                 canvas: {
@@ -2915,14 +3017,45 @@ export function appReducer(state, action) {
                         ...state.canvas.bySessionId,
                         [key]: {
                             ...existing,
-                            latestDataRev: dataRev,
+                            // The DISPLAYED tick number stays monotonic across
+                            // the takeover: viewed-marking and badges compare
+                            // against it, and a smaller number would replay
+                            // as "already seen".
+                            latestDataRev: Math.max(dataRev, existing.latestDataRev || 0),
+                            ...(isPlane ? { planeSeq } : {}),
                             dataPayload: action.payload && typeof action.payload === "object" ? action.payload : null,
+                            // The patch that produced this state, for pages
+                            // that opt into targeted updates. Whole-state
+                            // ticks clear it — there is no delta to hand out.
+                            dataPatch: isPlane && action.patch && typeof action.patch === "object" ? action.patch : null,
                         },
                     },
                 },
             };
         }
 
+        case "canvas/planeReleased": {
+            // The plane died for this session: release the takeover on every
+            // slot so legacy durable ticks resume applying. Displayed tick
+            // numbers (latestDataRev) survive, so stale legacy dupes still
+            // drop by ordinary ordering while fresh ones flow.
+            const sessionId = String(action.sessionId || "").trim();
+            if (!sessionId) return state;
+            let changed = false;
+            const nextBySession = { ...state.canvas.bySessionId };
+            for (let slot = 1; slot <= 5; slot++) {
+                const key = canvasKey(sessionId, slot);
+                const entry = nextBySession[key];
+                if (entry && entry.planeSeq) {
+                    const { planeSeq: _released, ...rest } = entry;
+                    nextBySession[key] = rest;
+                    changed = true;
+                }
+            }
+            if (!changed) return state;
+            return { ...state, canvas: { ...state.canvas, bySessionId: nextBySession } };
+        }
+
         case "canvas/snapshot": {
             const sessionId = String(action.sessionId || "").trim();
             if (!sessionId) return state;