@aragon-agent/cli 0.5.6 → 0.5.9

package/dist/agent/reducer.js

@@ -10,17 +10,32 @@
  *   - `agent_end` after a turn that produced no `turn_end` and no error notice
  *     synthesizes a generic error notice (a swallowed throw is never a no-op).
  */
+import process from 'node:process';
 import { computeCost } from './usage.js';
+import { ENTRY_LIMITS, appendBounded, entryRetain, trimEntries } from './entry-limits.js';
 /** Default auto-dismiss window for a toast. */
 export const DEFAULT_TOAST_TTL_MS = 2500;
-export function initialViewState() {
+/**
+ * The initial view state, optionally seeded from config.
+ *
+ * THE DEFAULT IS `false`, NOT `true`, AND THAT IS THE WHOLE SAFETY ARGUMENT
+ * (D-2). There is exactly one production call site — `App`'s `useReducer`, which
+ * passes `cfg.showThinking`. Every other caller is a test. A future call site
+ * that forgets the seed fails CLOSED, toward the product default, rather than
+ * silently restoring the reasoning firehose for one code path with nothing
+ * reporting it.
+ *
+ * The seed is a PARAMETER rather than a post-mount dispatch so that `/resume`
+ * cannot flash a restored thinking block on frame 1.
+ */
+export function initialViewState(seed = {}) {
     return {
         entries: [],
         status: 'idle',
         usageTotal: { inputTokens: 0, outputTokens: 0, costUsd: 0 },
         contextTokens: 0,
         overlay: null,
-        thinkingVisible: true,
+        thinkingVisible: seed.thinkingVisible ?? false,
         toasts: [],
         expandedToolIds: {},
         // Seeded to the default posture; the App overrides it once on mount from
@@ -29,13 +44,18 @@ export function initialViewState() {
         pendingAgentMode: null,
         team: null,
         todos: null,
+        retry: null,
+        fast: null,
         seq: 0,
         teamEntryId: undefined,
         todoEntryId: undefined,
+        retryEntryId: undefined,
+        fastEntryId: undefined,
         streamingId: undefined,
         turnProduced: false,
         errorNoticed: false,
         aborted: false,
+        droppedEntries: 0,
     };
 }
 // ---------------------------------------------------------------------------
@@ -77,12 +97,18 @@ export function buildToolPreview(result) {
     }
     return preview;
 }
+/** The first line of a stored preview, without its trailing newline. */
+function firstLine(text) {
+    const at = text.indexOf('\n');
+    return at === -1 ? text : text.slice(0, at);
+}
 /**
  * Map one core `AgentEvent` to view actions. `cost` (the active model's cost
  * table) lets `turn_end` accumulate USD cost; omit it in tests that only assert
- * token totals.
+ * token totals. `patches` is the CLI-local diff side channel (§3.3.7); omitting
+ * it — every existing test, and headless mode — produces byte-identical actions.
  */
-export function reduceEvent(event, cost) {
+export function reduceEvent(event, cost, patches) {
     switch (event.type) {
         case 'agent_start':
             return [{ type: 'runStart' }];
@@ -100,16 +126,27 @@ export function reduceEvent(event, cost) {
             return [{ type: 'runEnd' }];
         case 'tool_execution_start':
             return [{ type: 'toolExecStart', toolCallId: event.toolCallId }];
-        case 'tool_execution_end':
+        case 'tool_execution_end': {
+            const patch = patches?.take(event.toolCallId);
+            const preview = buildToolPreview(event.result);
             return [
                 {
                     type: 'toolExecEnd',
                     toolCallId: event.toolCallId,
                     isError: event.isError,
                     duration: event.duration,
-                    preview: buildToolPreview(event.result),
+                    // AN ENTRY CARRIES A PATCH OR A FULL PREVIEW, NEVER BOTH (D-19). This
+                    // is not a budget compromise, it is deleting a duplicate: `ToolCard`
+                    // renders `DiffView` INSTEAD of `ToolPreview` when a patch exists, so
+                    // the stored preview is never drawn on that card — and for `edit_file`
+                    // it is literally the same diff, as text. Keeping the first line
+                    // preserves the one thing outside `DiffView` that still reads it,
+                    // `entryRevision`'s `preview?.length` term.
+                    preview: patch ? firstLine(preview) : preview,
+                    ...(patch ? { patch } : {}),
                 },
             ];
+        }
         case 'message_update':
             return reduceStreamEvent(event.streamEvent);
         case 'code_execution_start':
@@ -165,6 +202,23 @@ function reduceStreamEvent(se) {
         case 'done':
             // Authoritative usage is redundant with `turn_end`; nothing to add.
             return [];
+        // --- API retry (llm-api-retry-backoff §6.4) ---------------------------
+        case 'retry_scheduled':
+            return [
+                {
+                    type: 'retryScheduled',
+                    attempt: se.attempt,
+                    maxRetries: se.maxRetries,
+                    delayMs: se.delayMs,
+                    resumeAt: se.resumeAt,
+                    errorType: se.errorType,
+                    message: se.message,
+                },
+            ];
+        case 'retry_attempt':
+            return [{ type: 'retryAttempt', attempt: se.attempt, maxRetries: se.maxRetries }];
+        case 'stream_restart':
+            return [{ type: 'streamRestart', discardedToolCallIds: se.discardedToolCallIds }];
         default:
             return [];
     }
@@ -201,6 +255,131 @@ function nextId(state) {
 function mapEntry(entries, id, fn) {
     return entries.map((e) => (e.id === id ? fn(e) : e));
 }
+/**
+ * Seal `thinkingMs`, once, as a spreadable patch (§3.1.2).
+ *
+ * Returns an EMPTY object when there is nothing to seal — no reasoning happened,
+ * or the clock has already stopped — so the three call sites can spread it
+ * unconditionally and none of them can re-seal a settled duration.
+ */
+function sealThinkingMs(entry) {
+    if (entry.thinkingStartedAt === undefined || entry.thinkingMs !== undefined)
+        return {};
+    return { thinkingMs: Math.max(0, Date.now() - entry.thinkingStartedAt) };
+}
+/**
+ * Append one entry and ring-trim the result (tui-render-performance L1).
+ *
+ * TRIMMING HAPPENS ONLY AT APPEND POINTS, and that is the whole reason this is a
+ * helper rather than a line in `viewReducer`. A mid-turn trim triggered by an
+ * UPDATE action could drop the entry `streamingId` / `teamEntryId` /
+ * `todoEntryId` points at while it is still being written to; appending is the
+ * only moment at which the tail is by definition the newest thing.
+ *
+ * I-L1-1 — the trim must never drop a live target. With `retain >= 200` and a
+ * trim that only ever removes from the head this is structurally true, but a
+ * future clamp change would break it SILENTLY (the `mapEntry` calls would simply
+ * stop matching), so development builds assert it.
+ */
+function appendEntry(state, entries, entry) {
+    const trimmed = trimEntries([...entries, entry], entryRetain());
+    if (trimmed.dropped > 0 && process.env.NODE_ENV !== 'production') {
+        // `retryEntryId` IS PART OF THIS LIST. A fourth live card that is not in it is
+        // a fourth card I-L1-1 does not cover — the trim would silently turn its
+        // `mapEntry` into a no-op instead of failing loudly.
+        const live = [
+            state.streamingId,
+            state.teamEntryId,
+            state.todoEntryId,
+            state.retryEntryId,
+            // `fastEntryId` IS PART OF THIS LIST for the reason the note above gives:
+            // a fifth live card left out of it is a card I-L1-1 does not cover.
+            state.fastEntryId,
+        ].filter((id) => typeof id === 'string');
+        for (const id of live) {
+            if (!trimmed.entries.some((e) => e.id === id)) {
+                throw new Error(`trimEntries dropped a live entry (${id}) - see I-L1-1`);
+            }
+        }
+    }
+    return {
+        entries: trimmed.entries,
+        droppedEntries: state.droppedEntries + trimmed.dropped,
+    };
+}
+/**
+ * Settle the turn's retry card, if it has one (llm-api-retry-backoff §6.4).
+ *
+ * SETTLING IS DERIVED HERE, NOT SENT BY CORE. Core knows it scheduled a retry; it
+ * does not know whether the turn eventually succeeded, was interrupted, or ran out
+ * of budget — that is the consumer's own timeline.
+ *
+ * FOUR PATHS REACH THIS, and the fourth is what makes the set exhaustive rather
+ * than enumerated: `turnEnd` (recovered), an error `notice` (exhausted),
+ * `abortMark` (interrupted) and `runEnd` (interrupted). The rule is "every path
+ * that reaches `status: 'idle'` settles the card", because a card left at
+ * `phase: 'waiting'` pins `Transcript`'s MONOTONIC settled boundary and re-renders
+ * the tail every frame for the rest of the session (R-10).
+ *
+ * Returning `retry: null` / `retryEntryId: undefined` unconditionally is
+ * deliberate: both are already that when there is no card, so every caller can
+ * spread the result without a branch of its own.
+ */
+function settleRetryCard(state, entries, phase) {
+    if (!state.retryEntryId)
+        return { entries, retry: null, retryEntryId: undefined };
+    const now = Date.now();
+    return {
+        entries: mapEntry(entries, state.retryEntryId, (e) => e.kind === 'retry'
+            ? {
+                ...e,
+                phase,
+                totalRetries: e.attempt,
+                elapsedMs: Math.max(0, now - e.startedAt),
+                resumeAt: undefined,
+            }
+            : e),
+        retry: null,
+        retryEntryId: undefined,
+    };
+}
+/**
+ * EVERY PATH THAT REACHES `status: 'idle'` RELEASES THE LIVE TAIL (D-35 / AC-40).
+ *
+ * `runEnd` finalizes only the streaming ASSISTANT entry and `abortMark` maps only
+ * assistant entries, so neither touches a tool entry stranded at
+ * `status: 'running'` -- the engine's own idle watchdog, a provider error mid-call
+ * and `Esc` all produce one. Today that costs a single spinner row. With a tail
+ * attached it costs a permanent multi-row card whose stall counter is frozen at
+ * its last value, because the 200 ms ticker that feeds `nowSec` is torn down the
+ * instant `state.status` leaves `running` -- and, worse, `computeSettledCount`
+ * breaks on a non-settled tool entry, so that card pins `Transcript`'s MONOTONIC
+ * settled boundary and re-renders the tail every frame for the rest of the
+ * session. The rule and the stakes are `settleRetryCard`'s, verbatim.
+ *
+ * THE STATUS IS DELIBERATELY NOT CHANGED. That is a different decision with
+ * different consequences for `bashBadge` and for the run's own bookkeeping, and
+ * it is not this round's to make. Only the tail is released.
+ *
+ * `liveSeq` is BUMPED rather than cleared, and that is not bookkeeping: clearing
+ * `live` is a non-append mutation, and with the status untouched nothing else in
+ * the tool revision moves -- so without the bump the height cache would keep
+ * serving the multi-row measurement for a card that now draws one row (I-L3-1).
+ * Entries with no tail are returned by identity, which is what keeps
+ * `EntryView`'s memo boundary intact for the rest of the transcript.
+ */
+function releaseLiveTails(entries) {
+    let touched = false;
+    const next = entries.map((e) => {
+        if (e.kind !== 'tool' || !e.live)
+            return e;
+        if (e.status !== 'running' && e.status !== 'pending')
+            return e;
+        touched = true;
+        return { ...e, live: undefined, lastOutputAt: undefined, liveSeq: (e.liveSeq ?? 0) + 1 };
+    });
+    return touched ? next : entries;
+}
 function findToolEntryId(state, toolCallId) {
     for (let i = state.entries.length - 1; i >= 0; i -= 1) {
         const e = state.entries[i];
@@ -217,12 +396,16 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 seq,
-                entries: [...state.entries, entry],
+                ...appendEntry(state, state.entries, entry),
                 streamingId: undefined,
                 // A new turn gets its own card, in that turn's position in the
                 // transcript. The PREVIOUS card stays exactly where it is — it is
                 // history, and history is not retracted.
                 todoEntryId: undefined,
+                // Same rule for the retry card. `runStart` clears NONE of the three (it
+                // never has), and `runEnd`'s settle rule below is what makes that safe
+                // rather than merely lucky.
+                retryEntryId: undefined,
                 turnProduced: false,
                 errorNoticed: false,
                 aborted: false,
@@ -246,14 +429,23 @@ export function viewReducer(state, action) {
                 thinkingOpen: false,
                 streaming: true,
             };
-            return { ...state, seq, entries: [...state.entries, entry], streamingId: id };
+            return { ...state, seq, ...appendEntry(state, state.entries, entry), streamingId: id };
         }
         case 'thinkingStart': {
             if (!state.streamingId)
                 return state;
             return {
                 ...state,
-                entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, thinking: e.thinking ?? '', thinkingOpen: true } : e),
+                entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant'
+                    ? {
+                        ...e,
+                        thinking: e.thinking ?? '',
+                        thinkingOpen: true,
+                        // `Date.now()` in the reducer is not a new impurity class: the
+                        // retry card's `startedAt` already reads the clock here.
+                        thinkingStartedAt: e.thinkingStartedAt ?? Date.now(),
+                    }
+                    : e),
             };
         }
         case 'thinkingDelta': {
@@ -262,7 +454,7 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant'
-                    ? { ...e, thinking: (e.thinking ?? '') + action.delta }
+                    ? { ...e, thinking: appendBounded(e.thinking ?? '', action.delta, ENTRY_LIMITS.thinking) }
                     : e),
             };
         }
@@ -271,7 +463,16 @@ export function viewReducer(state, action) {
                 return state;
             return {
                 ...state,
-                entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, text: e.text + action.delta } : e),
+                entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant'
+                    ? {
+                        ...e,
+                        text: appendBounded(e.text, action.delta, ENTRY_LIMITS.text),
+                        // FIRST TEXT DELTA ONLY. Thinking is over the moment the answer
+                        // starts; re-sealing on every delta would make the number climb
+                        // with the answer's length.
+                        ...sealThinkingMs(e),
+                    }
+                    : e),
             };
         }
         case 'toolCallStart': {
@@ -285,7 +486,7 @@ export function viewReducer(state, action) {
                 argsRaw: '',
                 status: 'pending',
             };
-            return { ...state, seq, entries: [...state.entries, entry] };
+            return { ...state, seq, ...appendEntry(state, state.entries, entry) };
         }
         case 'toolCallDelta': {
             const id = findToolEntryId(state, action.toolCallId);
@@ -293,7 +494,9 @@ export function viewReducer(state, action) {
                 return state;
             return {
                 ...state,
-                entries: mapEntry(state.entries, id, (e) => e.kind === 'tool' ? { ...e, argsRaw: e.argsRaw + action.argsDelta } : e),
+                entries: mapEntry(state.entries, id, (e) => e.kind === 'tool'
+                    ? { ...e, argsRaw: appendBounded(e.argsRaw, action.argsDelta, ENTRY_LIMITS.argsRaw) }
+                    : e),
             };
         }
         case 'toolCallEnd': {
@@ -316,6 +519,28 @@ export function viewReducer(state, action) {
                 entries: mapEntry(state.entries, id, (e) => e.kind === 'tool' ? { ...e, status: 'running' } : e),
             };
         }
+        /**
+         * THE STATUS GUARD IS WHAT KEEPS A LATE CHUNK FROM RESURRECTING A SETTLED
+         * CARD. The child's last write and its `close` event race, so a chunk can
+         * legitimately arrive after `tool_execution_end`; without the guard it would
+         * reattach a tail to a card whose authoritative preview is already drawn.
+         */
+        case 'toolOutputDelta': {
+            const id = findToolEntryId(state, action.toolCallId);
+            if (!id)
+                return state;
+            return {
+                ...state,
+                entries: mapEntry(state.entries, id, (e) => e.kind === 'tool' && (e.status === 'running' || e.status === 'pending')
+                    ? {
+                        ...e,
+                        live: action.rows,
+                        liveSeq: (e.liveSeq ?? 0) + 1,
+                        lastOutputAt: action.at,
+                    }
+                    : e),
+            };
+        }
         case 'toolExecEnd': {
             const id = findToolEntryId(state, action.toolCallId);
             if (!id)
@@ -329,6 +554,13 @@ export function viewReducer(state, action) {
                         isError: action.isError,
                         durationMs: action.duration,
                         preview: action.preview,
+                        ...(action.patch ? { patch: action.patch } : {}),
+                        // THE TAIL IS NEVER MERGED INTO `preview` (D-23): the
+                        // authoritative result already contains everything it held, in
+                        // full, and concatenating them would double the output and break
+                        // `bashBadge`'s last-line parse (`ToolPreview.tsx:35-54`).
+                        live: undefined,
+                        lastOutputAt: undefined,
                     }
                     : e),
             };
@@ -336,12 +568,20 @@ export function viewReducer(state, action) {
         case 'turnEnd': {
             const entries = state.streamingId
                 ? mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant'
-                    ? { ...e, streaming: false, thinkingOpen: false, usage: action.usage }
+                    ? {
+                        ...e,
+                        streaming: false,
+                        thinkingOpen: false,
+                        usage: action.usage,
+                        // The turn that thought and then called a tool without emitting
+                        // any text never saw a `textDelta`, so this is where its clock
+                        // is sealed.
+                        ...sealThinkingMs(e),
+                    }
                     : e)
                 : state.entries;
             return {
                 ...state,
-                entries,
                 streamingId: undefined,
                 turnProduced: true,
                 contextTokens: action.usage.inputTokens + action.usage.outputTokens,
@@ -350,50 +590,91 @@ export function viewReducer(state, action) {
                     outputTokens: state.usageTotal.outputTokens + action.usage.outputTokens,
                     costUsd: state.usageTotal.costUsd + action.costDelta,
                 },
+                // The turn produced an answer, so whatever it had to retry, it recovered.
+                ...settleRetryCard(state, entries, 'recovered'),
             };
         }
         case 'runEnd': {
             // Finalize any still-streaming entry.
             let entries = state.streamingId
-                ? mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, streaming: false } : e)
+                ? mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, streaming: false, ...sealThinkingMs(e) } : e)
                 : state.entries;
             let seq = state.seq;
+            let droppedEntries = state.droppedEntries;
             // Silent-failure guard (R2): a swallowed throw shows nothing otherwise.
             // A user abort is an expected empty run, not a failure — skip the guard.
             if (!state.turnProduced && !state.errorNoticed && !state.aborted) {
                 const next = nextId({ ...state, seq });
                 seq = next.seq;
-                entries = [
-                    ...entries,
-                    { id: next.id, kind: 'notice', level: 'error', text: GENERIC_RUN_FAILURE },
-                ];
+                const appended = appendEntry(state, entries, {
+                    id: next.id,
+                    kind: 'notice',
+                    level: 'error',
+                    text: GENERIC_RUN_FAILURE,
+                });
+                entries = appended.entries;
+                droppedEntries = appended.droppedEntries;
             }
             // The card may now reach `<Static>` (C-5 / I-6): the turn that owns it is
             // over, so nothing will rewrite it.
             if (state.todoEntryId) {
                 entries = mapEntry(entries, state.todoEntryId, (e) => e.kind === 'todo' ? { ...e, live: false } : e);
             }
-            return { ...state, entries, seq, status: 'idle', streamingId: undefined };
+            return {
+                ...state,
+                seq,
+                droppedEntries,
+                status: 'idle',
+                streamingId: undefined,
+                // THE TERMINAL BACKSTOP, and it is not redundant with `abortMark`
+                // (llm-api-retry-backoff P1-8 / AC-25b). `abortMark` is dispatched only
+                // from the Esc handler, but the ENGINE also aborts itself: the idle
+                // watchdog calls `Agent.abort()` directly, the run unwinds, and the UI
+                // sees `agent_end` -> `runEnd` with no `abortMark`, no `turn_end` and no
+                // error notice. A card left at `phase: 'waiting'` then pins
+                // `Transcript`'s monotonic boundary and re-renders the tail every frame
+                // for the rest of the session. By the time this runs the three other
+                // settle paths have already cleared `retryEntryId`, so this only fires on
+                // a genuinely unsettled card.
+                //
+                // `releaseLiveTails` rides the same argument one entry kind over (D-35):
+                // a tool card stranded at `running` by this very path would otherwise
+                // keep a tail and a frozen stall clock for the rest of the session.
+                ...settleRetryCard(state, releaseLiveTails(entries), 'interrupted'),
+            };
         }
         case 'notice': {
             const { id, seq } = nextId(state);
             const entry = { id, kind: 'notice', level: action.level, text: action.text };
+            const appended = appendEntry(state, state.entries, entry);
+            // A terminal error notice is what an EXHAUSTED ladder looks like from here:
+            // the retry wrapper forwards the provider's own error once it stops
+            // retrying, and that error always precedes any `turn_end` because a failed
+            // turn has none. A non-error notice leaves the card alone.
+            const settled = action.level === 'error'
+                ? settleRetryCard(state, appended.entries, 'exhausted')
+                : { entries: appended.entries };
             return {
                 ...state,
                 seq,
-                entries: [...state.entries, entry],
+                droppedEntries: appended.droppedEntries,
                 errorNoticed: action.level === 'error' ? true : state.errorNoticed,
+                ...settled,
             };
         }
         case 'abortMark': {
             // Mark the run aborted even when no assistant entry is streaming (e.g. an
             // abort during a tool call) so the runEnd failure guard stays suppressed.
-            if (!state.streamingId)
-                return { ...state, aborted: true };
+            const marked = state.streamingId
+                ? mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, streaming: false, aborted: true } : e)
+                : state.entries;
             return {
                 ...state,
                 aborted: true,
-                entries: mapEntry(state.entries, state.streamingId, (e) => e.kind === 'assistant' ? { ...e, streaming: false, aborted: true } : e),
+                // An abort during a tool call is the COMMON way a tail is stranded --
+                // `Esc` while `npm test` runs -- so this is the clause manual row 9
+                // exercises (D-35 / AC-40).
+                ...settleRetryCard(state, releaseLiveTails(marked), 'interrupted'),
             };
         }
         // `teamEntryId` is dropped with the entries it pointed at. Keeping it would
@@ -403,6 +684,11 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 entries: [],
+                // The count describes what the RETAIN RING removed from the visible
+                // transcript. `/clear` empties it by intent, so carrying the number
+                // over would make the exported transcript claim a loss that did not
+                // happen.
+                droppedEntries: 0,
                 streamingId: undefined,
                 expandedToolIds: {},
                 teamEntryId: undefined,
@@ -411,11 +697,18 @@ export function viewReducer(state, action) {
                 // the conversation, so the model still believes in the plan, and a panel
                 // that disagrees with the model is worse than no panel.
                 todoEntryId: undefined,
+                // Same reasoning for the retry card: the entry is gone, so the id must go
+                // with it or `retryScheduled` would `mapEntry` an id that no longer
+                // exists. `retry` goes too — unlike `todos` it is not a belief the model
+                // holds, it is a projection of an entry that has just been erased.
+                retryEntryId: undefined,
+                retry: null,
             };
         case 'resetConversation':
             return {
                 ...state,
                 entries: [],
+                droppedEntries: 0,
                 streamingId: undefined,
                 expandedToolIds: {},
                 contextTokens: 0,
@@ -426,6 +719,8 @@ export function viewReducer(state, action) {
                 // the STORE; this clears the mirror.
                 todos: null,
                 todoEntryId: undefined,
+                retryEntryId: undefined,
+                retry: null,
             };
         case 'setOverlay':
             return { ...state, overlay: action.overlay };
@@ -462,6 +757,10 @@ export function viewReducer(state, action) {
             const runs = action.specs.map((spec) => ({
                 label: spec.label,
                 description: spec.description,
+                // Already downgraded by the normalizer when the tier was unavailable, so
+                // the card and the report agree from the first frame (fast-model-tier
+                // §3.4).
+                tier: spec.tier,
                 phase: 'queued',
                 turns: 0,
                 toolCalls: 0,
@@ -481,7 +780,7 @@ export function viewReducer(state, action) {
             return {
                 ...state,
                 seq,
-                entries: [...state.entries, entry],
+                ...appendEntry(state, state.entries, entry),
                 teamEntryId: id,
                 team: {
                     dispatchId: action.dispatchId,
@@ -535,6 +834,12 @@ export function viewReducer(state, action) {
         }
         // --- Todo planning (todo-plan-execution §5.2) -------------------------
         case 'todoUpdate': {
+            // TYPED AS THE TODO MEMBER, NOT AS `Entry`. The rewrite below spreads this
+            // and overrides `live: boolean`; while the return type was the whole union
+            // that spread also produced a TOOL entry carrying `live: boolean`, which
+            // stopped type-checking the moment the tool member gained its own `live`
+            // (agent-activity-presentation-live). Narrowing here is what keeps the
+            // override honest rather than accidentally legal.
             const entry = (id) => ({
                 id,
                 kind: 'todo',
@@ -558,7 +863,7 @@ export function viewReducer(state, action) {
                 ...state,
                 seq,
                 todos: action.snapshot,
-                entries: [...state.entries, entry(id)],
+                ...appendEntry(state, state.entries, entry(id)),
                 todoEntryId: id,
             };
         }
@@ -566,21 +871,241 @@ export function viewReducer(state, action) {
         // live projection goes away, which is what unmounts the rail.
         case 'todoCleared':
             return { ...state, todos: null, todoEntryId: undefined };
+        // --- Fast model tier (fast-model-tier §5.4) ---------------------------
+        case 'fastStart': {
+            const { id, seq } = nextId(state);
+            const entry = {
+                id,
+                kind: 'fast',
+                reviewIndex: action.index,
+                model: action.model,
+                status: 'running',
+                turn: action.turn,
+                live: true,
+            };
+            return {
+                ...state,
+                seq,
+                ...appendEntry(state, state.entries, entry),
+                fastEntryId: id,
+            };
+        }
+        case 'fastEnd': {
+            const { review } = action;
+            const settle = (e) => e.kind === 'fast'
+                ? {
+                    ...e,
+                    status: review.kind,
+                    ...(review.text !== undefined ? { text: review.text } : {}),
+                    ...(review.detail !== undefined ? { detail: review.detail } : {}),
+                    durationMs: review.durationMs,
+                    // SETTLED. `Transcript`'s boundary is monotonic, so a card that
+                    // never settles is re-rendered on every frame for the rest of the
+                    // session (C-5).
+                    live: false,
+                }
+                : e;
+            // Rewrite the card this review opened when there is one; otherwise append
+            // a settled card. THE SECOND BRANCH IS NOT DEFENSIVE PADDING: a review
+            // that is dropped as `stranded` is emitted from `agent_end` and never had
+            // a `review_start`, and a run restored from `/resume` has no live id at
+            // all — "it did nothing" must never be the observable outcome (R-8).
+            if (state.fastEntryId) {
+                return {
+                    ...state,
+                    entries: mapEntry(state.entries, state.fastEntryId, settle),
+                    fastEntryId: undefined,
+                };
+            }
+            const { id, seq } = nextId(state);
+            const entry = {
+                id,
+                kind: 'fast',
+                reviewIndex: review.index,
+                model: review.model,
+                status: review.kind,
+                ...(review.text !== undefined ? { text: review.text } : {}),
+                ...(review.detail !== undefined ? { detail: review.detail } : {}),
+                turn: review.turn,
+                durationMs: review.durationMs,
+                live: false,
+            };
+            return { ...state, seq, ...appendEntry(state, state.entries, entry) };
+        }
+        case 'fastUsage':
+            // `usageTotal` AND NOTHING ELSE, exactly as `teamUsage` (§3.6 / AC-18). In
+            // particular NOT `contextTokens`: that gauge shows the LEAD's context
+            // occupancy against the lead model's window, and a review is a separate
+            // conversation with a different model entirely.
+            return {
+                ...state,
+                usageTotal: {
+                    inputTokens: state.usageTotal.inputTokens + action.usage.inputTokens,
+                    outputTokens: state.usageTotal.outputTokens + action.usage.outputTokens,
+                    costUsd: state.usageTotal.costUsd + action.costDelta,
+                },
+            };
+        case 'fastTier':
+            return { ...state, fast: action.snapshot };
+        // --- API retry (llm-api-retry-backoff §6.4) ---------------------------
+        case 'retryScheduled': {
+            const snapshot = {
+                attempt: action.attempt,
+                maxRetries: action.maxRetries,
+                resumeAt: action.resumeAt,
+                phase: 'waiting',
+                errorType: action.errorType,
+            };
+            // ONE CARD PER TURN, REWRITTEN IN PLACE. One `mapEntry` on the KNOWN id,
+            // never a scan — the same discipline `todoUpdate` follows.
+            if (state.retryEntryId) {
+                const known = state.retryEntryId;
+                return {
+                    ...state,
+                    retry: snapshot,
+                    entries: mapEntry(state.entries, known, (e) => e.kind === 'retry'
+                        ? {
+                            ...e,
+                            attempt: action.attempt,
+                            maxRetries: action.maxRetries,
+                            errorType: action.errorType,
+                            message: action.message,
+                            delayMs: action.delayMs,
+                            resumeAt: action.resumeAt,
+                            phase: 'waiting',
+                        }
+                        : e),
+                };
+            }
+            const { id, seq } = nextId(state);
+            const entry = {
+                id,
+                kind: 'retry',
+                attempt: action.attempt,
+                maxRetries: action.maxRetries,
+                errorType: action.errorType,
+                message: action.message,
+                delayMs: action.delayMs,
+                resumeAt: action.resumeAt,
+                phase: 'waiting',
+                // The clock the settled card's `elapsedMs` is measured from: the FIRST
+                // retry of the turn, not the last.
+                startedAt: Date.now(),
+            };
+            return {
+                ...state,
+                seq,
+                retry: snapshot,
+                ...appendEntry(state, state.entries, entry),
+                retryEntryId: id,
+            };
+        }
+        case 'retryAttempt': {
+            if (!state.retryEntryId)
+                return state;
+            const known = state.retryEntryId;
+            return {
+                ...state,
+                // `resumeAt` is CLEARED: the wait is over, so a countdown would tick
+                // downward past zero while the request is already in flight.
+                retry: state.retry ? { ...state.retry, phase: 'retrying', resumeAt: undefined } : null,
+                entries: mapEntry(state.entries, known, (e) => e.kind === 'retry' ? { ...e, phase: 'retrying', resumeAt: undefined } : e),
+            };
+        }
+        /**
+         * Rewind the view for a mid-stream restart.
+         *
+         * THE ONLY ACTION IN THIS REDUCER THAT SHRINKS `entries`, and it is safe for
+         * one specific reason (§6.4 / AC-22). `Transcript` clamps its settled boundary
+         * with a MONOTONIC high-water mark: if `highWater` ever exceeded
+         * `entries.length` the clamp would mark EVERYTHING settled — including the
+         * still-streaming assistant entry — and `<Static>` would duplicate it.
+         *
+         * It cannot, and the ORDERING is why: the entries removed here are
+         * `kind: 'tool'` cards created by `toolCallStart` AFTER `turnStart` created the
+         * streaming assistant entry, so they sit strictly above it in the array; and
+         * the boundary scan already breaks at that entry. Removing only entries above
+         * the boundary is the invariant. A future action that removed a SETTLED entry
+         * would break `<Static>` and nothing would report it.
+         */
+        case 'streamRestart': {
+            const discarded = new Set(action.discardedToolCallIds);
+            const entries = state.entries.filter((e) => !(e.kind === 'tool' && discarded.has(e.toolCallId)));
+            return {
+                ...state,
+                entries: state.streamingId
+                    ? mapEntry(entries, state.streamingId, (e) => e.kind === 'assistant'
+                        ? {
+                            ...e,
+                            text: '',
+                            thinking: undefined,
+                            thinkingOpen: false,
+                            // A restarted stream re-thinks from scratch. Carrying the old
+                            // clock forward would report a duration for reasoning that
+                            // was discarded.
+                            thinkingStartedAt: undefined,
+                            thinkingMs: undefined,
+                        }
+                        : e)
+                    : entries,
+            };
+        }
+        /**
+         * The 1 Hz countdown tick. NO VALUE CHANGES — the card is refreshed by
+         * IDENTITY so that React re-renders exactly one entry.
+         *
+         * A FLAT NONCE ON `ViewState` WOULD NOT WORK, and this is the trap worth
+         * naming: `EntryView` is `React.memo`'d with an explicit comparator whose
+         * first clause is `a.entry === b.entry`, so a state field the card does not
+         * receive as a prop changes nothing at all — the countdown would freeze at
+         * whatever second it was first drawn on, and the transcript would keep
+         * re-rendering around it for no benefit. Rewriting the entry is what breaks
+         * that boundary, and `EntryView` reads the clock for this kind only.
+         *
+         * `entryRevision` is deliberately NOT extended: the card is one row in every
+         * phase, so the cached height stays correct and no re-measure is wanted.
+         *
+         * Returning `state` unchanged when nothing is waiting is what keeps a stray
+         * tick from costing a render at all.
+         */
+        case 'retryTick': {
+            if (state.retry?.phase !== 'waiting' || !state.retryEntryId)
+                return state;
+            const known = state.retryEntryId;
+            return {
+                ...state,
+                entries: mapEntry(state.entries, known, (e) => (e.kind === 'retry' ? { ...e } : e)),
+            };
+        }
         case 'restoreEntries': {
             // Adopt a seq beyond any restored id to keep future ids unique.
             const maxSeq = action.entries.reduce((acc, e) => {
                 const n = Number.parseInt(e.id.replace(/^e/, ''), 10);
                 return Number.isFinite(n) ? Math.max(acc, n) : acc;
             }, state.seq);
+            // A session file can be longer than the retain ring; trimming it here is
+            // the one append-free place the bound still has to hold, and the count
+            // starts from this restore rather than inheriting the previous session's.
+            const restored = trimEntries([...action.entries], entryRetain());
             return {
                 ...state,
-                entries: [...action.entries],
+                entries: restored.entries,
+                droppedEntries: restored.dropped,
                 seq: maxSeq,
                 teamEntryId: undefined,
                 // As for `team`: the restored cards are history and no turn owns them.
                 // The LIST itself arrives separately, through `controller.restoreTodos`
                 // and the store's own event (§3.13).
                 todoEntryId: undefined,
+                // Same for the retry card. `normalizeLoadedEntries` has already forced any
+                // in-flight phase to `interrupted`, so nothing restored is live.
+                retryEntryId: undefined,
+                retry: null,
+                // Same again for the fast card: `normalizeLoadedEntries` has already
+                // forced `live: false`, so nothing restored is live. `state.fast` is
+                // NOT cleared — it is the session's own tier projection, which a
+                // `/resume` does not change.
+                fastEntryId: undefined,
             };
         }
         default: