@aragon-agent/cli 0.5.6 → 0.5.8

package/CHANGELOG.md

@@ -7,8 +7,85 @@ were written.
 
 ## Unreleased
 
+### Changed
+
+- **A long session stays as fast as a short one.** The TUI used to get slower as
+  a session grew and, past a threshold, stopped making progress at all. That was
+  structural rather than incidental: Ink has no output caching, so every frame
+  re-walked the entire mounted tree, re-measured every text node and
+  re-serialised the frame. The per-frame cost was therefore proportional to every
+  character the session had ever produced — and `transcriptWindow` bounded the
+  entry *count*, which bounds nothing when one entry can be fifty thousand lines.
+
+  Entries outside the visible band are no longer mounted. The viewport renders
+  what you can see plus a couple either side and replaces the rest with two
+  spacers of the right height, so the frame costs what the screen costs.
+  Scrolling, the `↑N` readout and the wheel routing are untouched. Because the
+  horizon is no longer a rendering budget, `transcriptWindow` rises from 300 to
+  1000 and its ceiling from 2000 to 20000; an existing setting is still valid
+  and still clamps.
+
+  Syntax highlighting and markdown parsing are memoised on their input, so a
+  200-line code block is tokenised once rather than thirty times a second for as
+  long as it stays on screen. Only the *parsed* form is cached and never a themed
+  one, so `/theme` still takes effect on the next frame.
+
+  Under genuine load the streaming interval widens — 33 ms up to a 320 ms
+  ceiling — so keystrokes and `Ctrl+C` do not queue behind renders. This is
+  visible rather than silent: a muted **`eco`** chip appears in the status bar
+  while it is in effect, because a user who cannot see why the stream got
+  chunkier will conclude the model got slower. `--no-render-governor`,
+  `renderGovernor: false` or `ARAGON_RENDER_GOVERNOR=0` turns it off;
+  `--max-render-interval 33` flattens the ladder without disabling the mechanism.
+
+- **A live thinking block no longer grows without limit.** While an answer is
+  streaming, visible thinking is clamped to its newest 24 rows behind a
+  `... N earlier lines` marker, and the whole block renders again the moment the
+  answer settles. Thinking is scratch reasoning you read from its newest end, and
+  an unbounded one was the easiest way for a single live entry to fill the
+  viewport on its own.
+
+### Fixed
+
+- **Inline mode could hard-freeze the terminal, and now cannot.** Once a live
+  entry grew taller than the terminal, Ink took a branch that writes
+  `clearTerminal` plus the *entire accumulated session history* on every
+  subsequent frame — bypassing both of its own dedupe gates, and growing without
+  bound for the rest of the session. Any inline user (`--no-fullscreen`,
+  `TERM=dumb`, CI, a terminal under 12 rows or 40 columns) whose model wrote a
+  long answer could reach it. The live region is now clamped below that
+  threshold, with a `... N earlier lines` marker naming what is deferred. Nothing
+  is lost: the entry prints in full into the terminal's own scrollback the moment
+  it settles.
+
+- **The view state no longer grows without a ceiling.** A single assistant answer
+  is capped at 256 KiB in the view (thinking at 64 KiB, streamed tool arguments
+  at 16 KiB) by eliding the MIDDLE, so both the opening and the live cursor
+  survive; a marker states how many characters went. `transcriptRetain`
+  (default 1000) caps the entries kept in memory, and what it removed is counted
+  and reported both by `/perf` and at the top of the exit replay. A model that
+  emits five megabytes no longer makes every later frame a five-megabyte scan.
+
 ### Added
 
+- **`/perf`.** Reports what the renderer is actually doing: the frame interval
+  and the last commit cost, how many entries exist / are retained / were dropped
+  / are mounted, height-cache and render-cache occupancy, and the viewport
+  geometry. `/perf reset` clears the caches and returns the governor to its
+  fastest rung. Silent degradation is the one thing a claim of robustness cannot
+  afford, and this is the place that names it.
+
+- **Three configuration keys**, each with a flag and an environment override:
+  `transcriptRetain` (`--transcript-retain`, `ARAGON_TRANSCRIPT_RETAIN`),
+  `renderGovernor` (`--render-governor` / `--no-render-governor`,
+  `ARAGON_RENDER_GOVERNOR`) and `maxRenderIntervalMs`
+  (`--max-render-interval`, `ARAGON_MAX_RENDER_INTERVAL_MS`). No migration and no
+  config version bump: a file written before they existed loads unchanged.
+  `transcriptRetain` is raised to `transcriptWindow` when the two conflict —
+  retaining less than you can scroll to would make part of the horizon
+  unreachable — and a startup notice names both numbers, because overriding a
+  value you typed and saying nothing is the one thing none of this may do.
+
 - **Following the plan through, on a budget you can do arithmetic on.** A run
   that ended with steps outstanding used to print one sentence and stop. It now
   asks three questions the CLI already knew the answers to — did you abort it,

package/README.md

@@ -80,6 +80,9 @@ aragon --help  | -h             Print help
 | `--no-skills` | Disable the skill system entirely (no catalog, no skill tools) |
 | `--skill <name>` | Force-load a skill's full body for this run (repeatable) |
 | `--skills-yes` | Approve skill installs for this run (CI / headless) |
+| `--transcript-retain <n>` | Entries kept in memory, clamped to `[200, 20000]`. Older ones are dropped and counted |
+| `--render-governor` / `--no-render-governor` | Adapt the frame interval under load, or pin it at 33 ms |
+| `--max-render-interval <ms>` | Governor ceiling, clamped to `[33, 1000]`. `33` flattens the ladder |
 | `--no-color` | Disable ANSI color |
 | `--quiet` | (print mode) suppress tool/usage lines on stderr |
 
@@ -107,6 +110,7 @@ Exit codes: `0` success · `1` agent/runtime error · `2` config/usage error ·
 | `/theme <auto\|warm\|cool\|light>` | Switch the color theme live (persisted) |
 | `/expand [n]` | Expand / collapse the n-th-from-last (default last) tool card |
 | `/copy` | Copy the last answer to the clipboard |
+| `/perf` | What the renderer is doing: frame interval, mounted entries, dropped entries, cache occupancy. `/perf reset` clears the caches and the governor |
 | `/logs` | Show where this session is being logged, and at what level |
 | `/reload` | Re-read `config.json` after editing it in another window (refused mid-run) |
 | `/skills [sub]` | List and manage skills (see below) |
@@ -220,6 +224,55 @@ this mode, and mouse tracking is deliberately left off because enabling it costs
 text selection and copy in most terminals. If a crash ever strands your terminal
 on the alternate screen, `reset` restores it.
 
+## Render performance
+
+A long session used to get slower and slower, and past a point it stopped
+responding at all. The cause was structural rather than incidental: Ink has no
+output caching, so every frame re-walked the whole mounted tree, re-measured
+every text node and re-serialised the frame. The cost was therefore proportional
+to **every character the session had ever produced**, not to the characters
+actually on screen — and `transcriptWindow` bounded the entry *count*, which is
+not the same thing when one entry can be fifty thousand lines.
+
+Four things changed, and you should not have to think about any of them:
+
+- **Off-screen entries are not mounted.** The viewport renders the band you can
+  see plus a couple of entries either side, and replaces the rest with two
+  spacers of the right height. Scrolling and the `↑N` readout are unchanged.
+- **The expensive pure work is cached.** Syntax highlighting and markdown
+  parsing now run once per distinct block instead of once per frame. Themes are
+  still applied at render time, so `/theme` takes effect immediately.
+- **The transcript is bounded.** A single answer cannot exceed 256 KiB in the
+  view, and `transcriptRetain` caps how many entries are kept. Both bounds
+  report what they removed rather than dropping it silently.
+- **The frame interval adapts.** If a frame is genuinely expensive, updates
+  coalesce into a wider window — 33 ms up to a 320 ms ceiling — so the terminal
+  stays responsive to typing and to `Ctrl+C`. A muted **`eco`** chip appears in
+  the status bar whenever this is in effect: the stream getting chunkier is
+  something you should be able to see a reason for.
+
+`/perf` reports exactly what the renderer is doing:
+
+```
+render     rung 2  -  interval 80ms  -  last commit 61ms  -  eco
+transcript 4213 entries  -  1000 retained  -  3213 dropped  -  38 mounted
+heights    412 cached  -  6 estimated  -  cols 132
+caches     md 178 (1.9MB)  -  hl 96 (1.4MB)  -  lines 340
+mode       fullscreen  -  viewport 44 rows  -  offset 0
+```
+
+`/perf reset` clears the render caches and returns the governor to its fastest
+rung. `--no-render-governor` (or `renderGovernor: false`, or
+`ARAGON_RENDER_GOVERNOR=0`) turns the adaptation off entirely; the output is
+identical, just heavier under load.
+
+**Inline mode** (`--no-fullscreen`, `TERM=dumb`, CI, a very small terminal) gets
+one extra guarantee. Ink repaints the *entire session history* on every frame
+once a live entry grows taller than the terminal, which is a genuine freeze
+rather than a slowdown. The live region is now clamped to stay below that
+threshold, with a `... N earlier lines` marker naming what is deferred; the
+entry prints **in full** into your scrollback the moment it finishes.
+
 ## Plan mode
 
 `aragon` has two postures, and `Shift+Tab` switches between them. `/plan` does
@@ -789,7 +842,9 @@ env / `.env` → CLI flags**.
   `ARAGON_TODO_FOLLOW` (`notify` / `auto` / `off`),
   `ARAGON_SKILLS` (`0` disables), `ARAGON_SKILLS_PATH`,
   `ARAGON_SKILLS_DISABLED` (comma-separated names), `ARAGON_LOG_LEVEL`,
-  `ARAGON_LOG_FILE` (`0` disables), `ARAGON_LOG_DIR`.
+  `ARAGON_LOG_FILE` (`0` disables), `ARAGON_LOG_DIR`,
+  `ARAGON_TRANSCRIPT_RETAIN`, `ARAGON_RENDER_GOVERNOR` (`0` disables),
+  `ARAGON_MAX_RENDER_INTERVAL_MS`.
   `ARAGON_HOME` is the exception that **cannot** come from `.env`: it is read
   before any `.env` is loaded. See [Files & logs](#files--logs).
 - **User config file** (`aragon config path`): JSON, written `0600` on POSIX.
@@ -805,7 +860,10 @@ env / `.env` → CLI flags**.
 | `maxTokens` | `64000` | Output token cap, clamped to `[256, 200000]`. `null` means **auto** — use each model's own ceiling, never above 64000. Absent means the default. See [Output token limits](#output-token-limits). |
 | `fullscreen` | `true` | Use the full-screen TUI (still subject to the automatic downgrades). Setting it to `false` opts out permanently; leaving it `true` is *not* a force — only `--fullscreen` / `ARAGON_FULLSCREEN=1` override the heuristics. |
 | `exitTranscript` | `true` | Replay a plain-text session summary after exiting (full-screen only). |
-| `transcriptWindow` | `300` | How many trailing entries the full-screen viewport renders, clamped to `[50, 2000]`. The full history stays in memory and in `/save`. |
+| `transcriptWindow` | `1000` | How far back you can scroll, clamped to `[50, 20000]`. Entries beyond it collapse into one line. It is no longer a rendering budget: the viewport is virtualised, so off-screen entries are not laid out at all. |
+| `transcriptRetain` | `1000` | Entries kept in memory, clamped to `[200, 20000]` and raised to `transcriptWindow` if the two conflict — with a startup notice saying so, because retaining less than you can scroll to would otherwise make part of the horizon quietly unreachable. Older entries are dropped, counted, and reported by `/perf` and by the exit replay. |
+| `renderGovernor` | `true` | Widen the streaming frame interval when a frame is genuinely expensive. See [Render performance](#render-performance). |
+| `maxRenderIntervalMs` | `320` | Ceiling of the governor ladder, clamped to `[33, 1000]`. `33` flattens it to the pre-0.6 cadence without disabling the mechanism. |
 | `planModeDefault` | `false` | Start every session in plan mode. `--no-plan` still overrides it for a single run. |
 | `planModeMaxAskRounds` | `4` | `ask_user` rounds allowed per user message, clamped to `[1, 10]`. The counter resets on your next message; steering does **not** reset it. |
 | `planModeHumanTimeoutMs` | `1800000` | Ceiling on a single question / plan wait, clamped to `[60000, 7200000]`. Thirty minutes is far outside "went to get coffee", but a ceiling has to exist so an unattended terminal cannot wedge a CI job forever. |

package/dist/agent/entry-limits.d.ts

@@ -0,0 +1,65 @@
+/**
+ * Bounded view state (tui-render-performance L1 / R5).
+ *
+ * `ViewState.entries` used to grow without any ceiling: `argsRaw`, assistant
+ * `text` and `thinking` all concatenated forever, and the entry array was never
+ * trimmed. That makes the per-frame cost of the renderer proportional to the
+ * total number of characters the session has ever produced, because Ink's
+ * `renderNodeToOutput` walks and measures every mounted text node whether or not
+ * `overflow: hidden` clips it.
+ *
+ * Two bounds live here, both pure and React-free:
+ *   - `appendBounded` caps one field by eliding its MIDDLE, and
+ *   - `trimEntries` ring-trims the entry array itself.
+ *
+ * ASCII ONLY. This module is produced outside `src/ui/**`, where no terminal
+ * capabilities are available, so the elision marker has to be safe on a legacy
+ * `cmd.exe` -- the same rule `PREVIEW_TRUNCATION_MARK` in `reducer.ts` records.
+ */
+import type { Entry } from './reducer.js';
+export interface EntryLimits {
+    /** Assistant answer text ceiling, in characters. */
+    text: number;
+    /** Assistant thinking ceiling. */
+    thinking: number;
+    /** Streamed tool-argument JSON ceiling. */
+    argsRaw: number;
+}
+/**
+ * The per-field ceilings.
+ *
+ * `text` is the generous one on purpose: a 256 KiB answer is already far past
+ * anything a terminal can usefully show, and the middle is what gets elided, so
+ * both the opening and the live cursor survive. `argsRaw` is the tight one --
+ * it is a streamed JSON fragment rendered as a 60-character card summary, so
+ * anything past a few KiB is invisible by construction.
+ */
+export declare const ENTRY_LIMITS: EntryLimits;
+/** Marker inserted at the elision point. ASCII -- produced outside `src/ui/**`. */
+export declare const ELISION_MARK_PREFIX = "\n[... ";
+export declare const ELISION_MARK_SUFFIX = " characters elided ...]\n";
+/**
+ * Append `delta` to `prev`, keeping the result at or below `cap` by eliding the
+ * MIDDLE. Head and tail are both preserved: the head is the answer's opening,
+ * the tail is where the cursor is. Idempotent -- re-eliding an already elided
+ * string collapses the two markers into one.
+ *
+ * The returned string is NEVER longer than `cap` (AC-7). The marker's own digit
+ * count is bounded before the tail budget is computed, so the arithmetic cannot
+ * overshoot by a digit the way a naive `cap - marker.length` would.
+ */
+export declare function appendBounded(prev: string, delta: string, cap: number): string;
+export interface TrimResult {
+    entries: Entry[];
+    dropped: number;
+}
+/**
+ * Ring-trim to `retain` entries; returns the SAME array reference when no-op.
+ *
+ * The identity return is load-bearing: the reducer spreads this result into a
+ * new `ViewState` on every append, and a fresh array on every action would
+ * defeat the `React.memo` boundaries L2 installs on the transcript.
+ */
+export declare function trimEntries(entries: Entry[], retain: number): TrimResult;
+export declare function setEntryRetain(value: number): void;
+export declare function entryRetain(): number;

package/dist/agent/entry-limits.js

@@ -0,0 +1,133 @@
+/**
+ * Bounded view state (tui-render-performance L1 / R5).
+ *
+ * `ViewState.entries` used to grow without any ceiling: `argsRaw`, assistant
+ * `text` and `thinking` all concatenated forever, and the entry array was never
+ * trimmed. That makes the per-frame cost of the renderer proportional to the
+ * total number of characters the session has ever produced, because Ink's
+ * `renderNodeToOutput` walks and measures every mounted text node whether or not
+ * `overflow: hidden` clips it.
+ *
+ * Two bounds live here, both pure and React-free:
+ *   - `appendBounded` caps one field by eliding its MIDDLE, and
+ *   - `trimEntries` ring-trims the entry array itself.
+ *
+ * ASCII ONLY. This module is produced outside `src/ui/**`, where no terminal
+ * capabilities are available, so the elision marker has to be safe on a legacy
+ * `cmd.exe` -- the same rule `PREVIEW_TRUNCATION_MARK` in `reducer.ts` records.
+ */
+import { DEFAULT_TRANSCRIPT_RETAIN } from '../config/schema.js';
+/**
+ * The per-field ceilings.
+ *
+ * `text` is the generous one on purpose: a 256 KiB answer is already far past
+ * anything a terminal can usefully show, and the middle is what gets elided, so
+ * both the opening and the live cursor survive. `argsRaw` is the tight one --
+ * it is a streamed JSON fragment rendered as a 60-character card summary, so
+ * anything past a few KiB is invisible by construction.
+ */
+export const ENTRY_LIMITS = {
+    text: 262_144,
+    thinking: 65_536,
+    argsRaw: 16_384,
+};
+/** Marker inserted at the elision point. ASCII -- produced outside `src/ui/**`. */
+export const ELISION_MARK_PREFIX = '\n[... ';
+export const ELISION_MARK_SUFFIX = ' characters elided ...]\n';
+/** Matches a marker this module wrote, so re-elision collapses rather than nests. */
+const ELISION_RE = /\n\[\.\.\. (\d+) characters elided \.\.\.\]\n/;
+/** Fixed cost of the marker, before the digits of the count. */
+const MARKER_FIXED = ELISION_MARK_PREFIX.length + ELISION_MARK_SUFFIX.length;
+/**
+ * Fraction of the cap reserved for the HEAD. The tail gets the rest because that
+ * is where the cursor is; the head exists so the answer still starts where the
+ * model started it.
+ */
+const HEAD_FRACTION = 4;
+/** Undo one elision, so a second one merges into it rather than nesting. */
+function splitElided(prev) {
+    const m = ELISION_RE.exec(prev);
+    if (!m)
+        return { head: '', elided: 0, tail: prev };
+    const index = m.index;
+    return {
+        head: prev.slice(0, index),
+        elided: Number.parseInt(m[1], 10) || 0,
+        tail: prev.slice(index + m[0].length),
+    };
+}
+/**
+ * Append `delta` to `prev`, keeping the result at or below `cap` by eliding the
+ * MIDDLE. Head and tail are both preserved: the head is the answer's opening,
+ * the tail is where the cursor is. Idempotent -- re-eliding an already elided
+ * string collapses the two markers into one.
+ *
+ * The returned string is NEVER longer than `cap` (AC-7). The marker's own digit
+ * count is bounded before the tail budget is computed, so the arithmetic cannot
+ * overshoot by a digit the way a naive `cap - marker.length` would.
+ */
+export function appendBounded(prev, delta, cap) {
+    if (!Number.isFinite(cap) || cap <= 0)
+        return '';
+    const split = splitElided(prev);
+    let head = split.head;
+    let tail = split.tail + delta;
+    let elided = split.elided;
+    // Fast path: nothing has ever been elided and it still fits. This is the path
+    // every ordinary answer takes, so it must allocate nothing beyond the concat.
+    if (elided === 0 && tail.length <= cap)
+        return tail;
+    const headBudget = Math.max(0, Math.min(Math.floor(cap / HEAD_FRACTION), cap - MARKER_FIXED - 1));
+    if (elided === 0) {
+        // First elision: the head has to be carved out of the accumulated text.
+        head = tail.slice(0, headBudget);
+        tail = tail.slice(headBudget);
+    }
+    else if (head.length > headBudget) {
+        // A later `cap` reduction can leave the stored head oversized; charge the
+        // difference to the elision count rather than silently keeping it.
+        elided += head.length - headBudget;
+        head = head.slice(0, headBudget);
+    }
+    if (head.length + MARKER_FIXED >= cap) {
+        // Degenerate cap (only reachable from a hand-written test): keep the tail.
+        return tail.slice(Math.max(0, tail.length - cap));
+    }
+    // `elided + tail.length` is an UPPER BOUND on the final count, so its digit
+    // count is an upper bound on the marker's width. Budgeting against the bound
+    // is what makes the `<= cap` guarantee hold without a second pass.
+    const digitBound = String(elided + tail.length).length;
+    const markerBound = MARKER_FIXED + digitBound;
+    const tailKeep = Math.max(0, Math.min(tail.length, cap - head.length - markerBound));
+    const total = elided + (tail.length - tailKeep);
+    return `${head}${ELISION_MARK_PREFIX}${total}${ELISION_MARK_SUFFIX}${tail.slice(tail.length - tailKeep)}`;
+}
+/**
+ * Ring-trim to `retain` entries; returns the SAME array reference when no-op.
+ *
+ * The identity return is load-bearing: the reducer spreads this result into a
+ * new `ViewState` on every append, and a fresh array on every action would
+ * defeat the `React.memo` boundaries L2 installs on the transcript.
+ */
+export function trimEntries(entries, retain) {
+    const keep = Math.max(1, Math.floor(retain));
+    if (entries.length <= keep)
+        return { entries, dropped: 0 };
+    return { entries: entries.slice(entries.length - keep), dropped: entries.length - keep };
+}
+// ---------------------------------------------------------------------------
+// The resolved retain ceiling
+// ---------------------------------------------------------------------------
+/**
+ * `viewReducer` is pure and takes no config, so the resolved `transcriptRetain`
+ * reaches it through a module-level singleton -- the shape `prompt-history.ts`
+ * already uses for `setHistoryEnabled`. `load.ts` is the ONLY writer.
+ */
+let resolvedRetain = DEFAULT_TRANSCRIPT_RETAIN;
+export function setEntryRetain(value) {
+    if (Number.isFinite(value) && value > 0)
+        resolvedRetain = Math.floor(value);
+}
+export function entryRetain() {
+    return resolvedRetain;
+}

package/dist/agent/reducer.d.ts

@@ -160,6 +160,14 @@ export interface ViewState {
     errorNoticed: boolean;
     /** The current run was aborted by the user (suppresses the failure guard). */
     aborted: boolean;
+    /**
+     * Entries removed by `transcriptRetain` (tui-render-performance L1).
+     *
+     * Rendered by `transcript-text` and reported by `/perf`; NEVER PERSISTED —
+     * `SavedSession` keeps `{ model, messages, entries, todos }` exactly as it is,
+     * so `/save` and `/resume` need no format change and old files load unchanged.
+     */
+    droppedEntries: number;
 }
 export declare function initialViewState(): ViewState;
 export type ViewAction = {

package/dist/agent/reducer.js

@@ -10,7 +10,9 @@
  *   - `agent_end` after a turn that produced no `turn_end` and no error notice
  *     synthesizes a generic error notice (a swallowed throw is never a no-op).
  */
+import process from 'node:process';
 import { computeCost } from './usage.js';
+import { ENTRY_LIMITS, appendBounded, entryRetain, trimEntries } from './entry-limits.js';
 /** Default auto-dismiss window for a toast. */
 export const DEFAULT_TOAST_TTL_MS = 2500;
 export function initialViewState() {
@@ -36,6 +38,7 @@ export function initialViewState() {
         turnProduced: false,
         errorNoticed: false,
         aborted: false,
+        droppedEntries: 0,
     };
 }
 // ---------------------------------------------------------------------------
@@ -201,6 +204,35 @@ function nextId(state) {
 function mapEntry(entries, id, fn) {
     return entries.map((e) => (e.id === id ? fn(e) : e));
 }
+/**
+ * Append one entry and ring-trim the result (tui-render-performance L1).
+ *
+ * TRIMMING HAPPENS ONLY AT APPEND POINTS, and that is the whole reason this is a
+ * helper rather than a line in `viewReducer`. A mid-turn trim triggered by an
+ * UPDATE action could drop the entry `streamingId` / `teamEntryId` /
+ * `todoEntryId` points at while it is still being written to; appending is the
+ * only moment at which the tail is by definition the newest thing.
+ *
+ * I-L1-1 — the trim must never drop a live target. With `retain >= 200` and a
+ * trim that only ever removes from the head this is structurally true, but a
+ * future clamp change would break it SILENTLY (the `mapEntry` calls would simply
+ * stop matching), so development builds assert it.
+ */
+function appendEntry(state, entries, entry) {
+    const trimmed = trimEntries([...entries, entry], entryRetain());
+    if (trimmed.dropped > 0 && process.env.NODE_ENV !== 'production') {
+        const live = [state.streamingId, state.teamEntryId, state.todoEntryId].filter((id) => typeof id === 'string');
+        for (const id of live) {
+            if (!trimmed.entries.some((e) => e.id === id)) {
+                throw new Error(`trimEntries dropped a live entry (${id}) - see I-L1-1`);
+            }
+        }
+    }
+    return {
+        entries: trimmed.entries,
+        droppedEntries: state.droppedEntries + trimmed.dropped,
+    };
+}
 function findToolEntryId(state, toolCallId) {
     for (let i = state.entries.length - 1; i >= 0; i -= 1) {
         const e = state.entries[i];
@@ -217,7 +249,7 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 seq,
-                entries: [...state.entries, entry],
+                ...appendEntry(state, state.entries, entry),
                 streamingId: undefined,
                 // A new turn gets its own card, in that turn's position in the
                 // transcript. The PREVIOUS card stays exactly where it is — it is
@@ -246,7 +278,7 @@ export function viewReducer(state, action) {
                 thinkingOpen: false,
                 streaming: true,
             };
-            return { ...state, seq, entries: [...state.entries, entry], streamingId: id };
+            return { ...state, seq, ...appendEntry(state, state.entries, entry), streamingId: id };
         }
         case 'thinkingStart': {
             if (!state.streamingId)
@@ -262,7 +294,7 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant'
-                    ? { ...e, thinking: (e.thinking ?? '') + action.delta }
+                    ? { ...e, thinking: appendBounded(e.thinking ?? '', action.delta, ENTRY_LIMITS.thinking) }
                     : e),
             };
         }
@@ -271,7 +303,9 @@ export function viewReducer(state, action) {
                 return state;
             return {
                 ...state,
-                entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, text: e.text + action.delta } : e),
+                entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant'
+                    ? { ...e, text: appendBounded(e.text, action.delta, ENTRY_LIMITS.text) }
+                    : e),
             };
         }
         case 'toolCallStart': {
@@ -285,7 +319,7 @@ export function viewReducer(state, action) {
                 argsRaw: '',
                 status: 'pending',
             };
-            return { ...state, seq, entries: [...state.entries, entry] };
+            return { ...state, seq, ...appendEntry(state, state.entries, entry) };
         }
         case 'toolCallDelta': {
             const id = findToolEntryId(state, action.toolCallId);
@@ -293,7 +327,9 @@ export function viewReducer(state, action) {
                 return state;
             return {
                 ...state,
-                entries: mapEntry(state.entries, id, (e) => e.kind === 'tool' ? { ...e, argsRaw: e.argsRaw + action.argsDelta } : e),
+                entries: mapEntry(state.entries, id, (e) => e.kind === 'tool'
+                    ? { ...e, argsRaw: appendBounded(e.argsRaw, action.argsDelta, ENTRY_LIMITS.argsRaw) }
+                    : e),
             };
         }
         case 'toolCallEnd': {
@@ -358,22 +394,27 @@ export function viewReducer(state, action) {
                 ? mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, streaming: false } : e)
                 : state.entries;
             let seq = state.seq;
+            let droppedEntries = state.droppedEntries;
             // Silent-failure guard (R2): a swallowed throw shows nothing otherwise.
             // A user abort is an expected empty run, not a failure — skip the guard.
             if (!state.turnProduced && !state.errorNoticed && !state.aborted) {
                 const next = nextId({ ...state, seq });
                 seq = next.seq;
-                entries = [
-                    ...entries,
-                    { id: next.id, kind: 'notice', level: 'error', text: GENERIC_RUN_FAILURE },
-                ];
+                const appended = appendEntry(state, entries, {
+                    id: next.id,
+                    kind: 'notice',
+                    level: 'error',
+                    text: GENERIC_RUN_FAILURE,
+                });
+                entries = appended.entries;
+                droppedEntries = appended.droppedEntries;
             }
             // The card may now reach `<Static>` (C-5 / I-6): the turn that owns it is
             // over, so nothing will rewrite it.
             if (state.todoEntryId) {
                 entries = mapEntry(entries, state.todoEntryId, (e) => e.kind === 'todo' ? { ...e, live: false } : e);
             }
-            return { ...state, entries, seq, status: 'idle', streamingId: undefined };
+            return { ...state, entries, seq, droppedEntries, status: 'idle', streamingId: undefined };
         }
         case 'notice': {
             const { id, seq } = nextId(state);
@@ -381,7 +422,7 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 seq,
-                entries: [...state.entries, entry],
+                ...appendEntry(state, state.entries, entry),
                 errorNoticed: action.level === 'error' ? true : state.errorNoticed,
             };
         }
@@ -403,6 +444,11 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 entries: [],
+                // The count describes what the RETAIN RING removed from the visible
+                // transcript. `/clear` empties it by intent, so carrying the number
+                // over would make the exported transcript claim a loss that did not
+                // happen.
+                droppedEntries: 0,
                 streamingId: undefined,
                 expandedToolIds: {},
                 teamEntryId: undefined,
@@ -416,6 +462,7 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 entries: [],
+                droppedEntries: 0,
                 streamingId: undefined,
                 expandedToolIds: {},
                 contextTokens: 0,
@@ -481,7 +528,7 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 seq,
-                entries: [...state.entries, entry],
+                ...appendEntry(state, state.entries, entry),
                 teamEntryId: id,
                 team: {
                     dispatchId: action.dispatchId,
@@ -558,7 +605,7 @@ export function viewReducer(state, action) {
                 ...state,
                 seq,
                 todos: action.snapshot,
-                entries: [...state.entries, entry(id)],
+                ...appendEntry(state, state.entries, entry(id)),
                 todoEntryId: id,
             };
         }
@@ -572,9 +619,14 @@ export function viewReducer(state, action) {
                 const n = Number.parseInt(e.id.replace(/^e/, ''), 10);
                 return Number.isFinite(n) ? Math.max(acc, n) : acc;
             }, state.seq);
+            // A session file can be longer than the retain ring; trimming it here is
+            // the one append-free place the bound still has to hold, and the count
+            // starts from this restore rather than inheriting the previous session's.
+            const restored = trimEntries([...action.entries], entryRetain());
             return {
                 ...state,
-                entries: [...action.entries],
+                entries: restored.entries,
+                droppedEntries: restored.dropped,
                 seq: maxSeq,
                 teamEntryId: undefined,
                 // As for `team`: the restored cards are history and no turn owns them.