@haywoodmarx/agent-pager 0.1.0

package/dist/src/tui/model.js

@@ -0,0 +1,758 @@
+import { archivedOperatorRepositoryIds, selectOperatorAgentHealth, } from "../operator/agent-projection.js";
+import { OPERATOR_PROTOCOL_VERSION, } from "../operator/protocol.js";
+import { classifyOperatorEvent, validateOperatorSnapshot } from "../operator/validation.js";
+import { isTuiExpirable } from "../operator/agent-projection.js";
+/* eslint-enable jsdoc/require-jsdoc -- The state field declarations end here. */
+/** Entries the diagnostics log keeps before discarding its oldest. */
+const TUI_DIAGNOSTIC_LIMIT = 200;
+/** Delay before the first reconnect attempt, in milliseconds. */
+const TUI_RECONNECT_BASE_DELAY_MS = 200;
+/** Ceiling the doubling reconnect delay never exceeds, in milliseconds. */
+const TUI_RECONNECT_MAX_DELAY_MS = 5_000;
+/** Time a server has to deliver the replacement snapshot it owes before recovery restarts, in milliseconds. */
+const TUI_REPLACEMENT_TIMEOUT_MS = 5_000;
+/**
+ * Total time one outstanding replacement transfer may spend extending its deadline before recovery
+ * restarts regardless of continuing progress, in milliseconds.
+ *
+ * Bounds wall-clock time since the wait began rather than a count of extensions, since chunk size and
+ * cadence are server-chosen and unbounded per-chunk resets alone would let a slow-but-steady transfer
+ * hold the wait open indefinitely.
+ */
+const TUI_REPLACEMENT_TOTAL_LIMIT_MS = 60_000;
+/** Attempt count the backoff stops counting past, so the doubling cannot overflow. */
+const TUI_RECONNECT_MAX_ATTEMPT = 16;
+/**
+ * Drop whole chunks from the front until the replay buffer fits its budget.
+ *
+ * Chunks are never split, because half a terminal escape sequence would leave the emulator misreading
+ * every byte that follows it.
+ * @param chunks - Replay buffer with the newest chunk appended.
+ * @param truncated - Whether an earlier chunk had already been dropped.
+ * @returns - Bounded buffer and whether anything has ever been dropped from it.
+ */
+function bounded(chunks, truncated) {
+    let total = chunks.reduce((sum, chunk) => sum + chunk.byteLength, 0);
+    let first = 0;
+    while (first < chunks.length - 1 && total > TUI_RUN_OUTPUT_BYTE_LIMIT) {
+        const dropped = chunks[first];
+        if (!dropped)
+            break;
+        total -= dropped.byteLength;
+        first += 1;
+    }
+    return first === 0 ? { chunks, truncated } : { chunks: chunks.slice(first), truncated: true };
+}
+/** Bytes a run's replay buffer keeps before it drops its oldest chunks. */
+export const TUI_RUN_OUTPUT_BYTE_LIMIT = 256 * 1024;
+/**
+ * Renderer-independent authoritative-state controller.
+ *
+ * Data flows broker → model → view. The model holds the authoritative facts and one map derived from
+ * them, `healthByAgentId`; every other derivation is computed at read time, in `presentation.ts` or
+ * beside the component that reads it, and never stored here. A view renders immutable state read
+ * through `useSyncExternalStore` and calls model intents, but a key or pointer handler reads
+ * `model.state` instead of the state its component last rendered: a reduction carries a whole view, so
+ * one built from a rendered snapshot overwrites what another handler decided since.
+ *
+ * Transport, local process, and scheduling reach the model as injected ports, so a component never
+ * opens a socket. The clipboard and the command-id and issue-time ports are the shell's, not the
+ * model's: they reach components as props, and components call them directly. Diagnostics go through
+ * this model's log, not `console.*` from a component; the runtime reports an abnormal exit's cause
+ * once the terminal is restored.
+ */
+export class TuiOperatorModel {
+    dependencies;
+    #state = initialState();
+    #listeners = new Set();
+    #streamCancel;
+    #recoveryCancel;
+    #replacementCancel;
+    #replacementArmedAt;
+    #snapshotCancel;
+    #commandCancels = new Set();
+    #runSession = null;
+    #runGeneration = 0;
+    #knownMessageIds = new Set();
+    #disposed = false;
+    #generation = 0;
+    /**
+     * Consecutive recovery attempts since authoritative data last landed, driving the backoff delay.
+     *
+     * The reset is tied to applied data rather than to a healthy connection because a server can
+     * accept a subscription and heartbeat without serving anything: resetting on the transition would
+     * pin a crash-looping broker at the base delay for as long as it kept flapping.
+     */
+    #recoveryAttempts = 0;
+    /**
+     * Construct a controller from explicit IO and lifecycle collaborators.
+     * @param dependencies - Injected transport, command, scheduling, and disposal ports.
+     */
+    constructor(dependencies) {
+        this.dependencies = dependencies;
+        const stored = dependencies.layout?.read();
+        if (stored)
+            this.#state = { ...this.#state, view: { ...this.#state.view, ...stored } };
+    }
+    /**
+     * Read the current immutable model state.
+     * @returns Current broker facts and local view state.
+     */
+    get state() {
+        return this.#state;
+    }
+    /**
+     * Observe state transitions.
+     * @param listener - Listener invoked after each state change.
+     * @returns Removal callback.
+     */
+    subscribe(listener) {
+        if (this.#disposed)
+            return () => undefined;
+        this.#listeners.add(listener);
+        return () => this.#listeners.delete(listener);
+    }
+    /**
+     * Hydrate authoritative facts and begin ordered reduction.
+     * @returns Completion after the initial snapshot is installed.
+     */
+    async start() {
+        if (this.#disposed || this.#state.connection === "incompatible")
+            return;
+        const generation = ++this.#generation;
+        this.#snapshotCancel?.();
+        this.#snapshotCancel = undefined;
+        this.#streamCancel?.();
+        this.#streamCancel = undefined;
+        this.#recoveryCancel?.();
+        this.#recoveryCancel = undefined;
+        this.#replacementCancel?.();
+        this.#replacementCancel = undefined;
+        try {
+            await this.#replace(generation);
+            if (!this.#active(generation) || this.#state.connection !== "healthy")
+                return;
+            this.#openStream(generation);
+        }
+        catch {
+            if (this.#active(generation))
+                this.#recover();
+        }
+    }
+    /**
+     * Submit a command without locally changing broker facts.
+     * @param command - Versioned operator command.
+     * @returns Broker admission result.
+     */
+    execute(command) {
+        if (this.#disposed)
+            return Promise.reject(new Error("TUI model is disposed"));
+        const request = this.dependencies.command.execute(command);
+        const cancel = () => {
+            request.cancel();
+        };
+        this.#commandCancels.add(cancel);
+        return request.promise.finally(() => this.#commandCancels.delete(cancel));
+    }
+    /**
+     * Start one local command and record its output as it arrives.
+     *
+     * Ignored while a run is already in progress, so a repeated key cannot start a second child.
+     * @param command - Executable to run.
+     * @param args - Arguments passed to the executable.
+     * @param size - Terminal dimensions the child lays its output out for.
+     */
+    startLocalRun(command, args, size) {
+        if (this.#disposed || this.#state.run?.outcome.kind === "running")
+            return;
+        const port = this.dependencies.localCommand;
+        const line = [command, ...args].join(" ");
+        if (!port) {
+            this.#set({
+                ...this.#state,
+                run: {
+                    id: ++this.#runGeneration,
+                    command: line,
+                    chunks: [],
+                    received: 0,
+                    truncated: false,
+                    outcome: { kind: "failed", reason: "no local command port is configured" },
+                },
+            });
+            return;
+        }
+        // The child's own generation, not the broker connection's: a stream that drops and recovers has
+        // no bearing on a process already running on this machine.
+        const generation = ++this.#runGeneration;
+        this.#set({
+            ...this.#state,
+            run: { id: generation, command: line, chunks: [], received: 0, truncated: false, outcome: { kind: "running" } },
+        });
+        this.#runSession = port.run(command, args, size, (event) => {
+            if (this.#disposed || this.#runGeneration !== generation)
+                return;
+            const run = this.#state.run;
+            if (!run || run.outcome.kind !== "running")
+                return;
+            if (event.type === "output") {
+                this.#set({
+                    ...this.#state,
+                    run: { ...run, received: run.received + 1, ...bounded([...run.chunks, event.bytes], run.truncated) },
+                });
+                return;
+            }
+            this.#runSession = null;
+            this.#set({
+                ...this.#state,
+                run: {
+                    ...run,
+                    outcome: event.type === "exit" ? { kind: "exited", code: event.code } : { kind: "failed", reason: event.reason },
+                },
+            });
+        });
+    }
+    /**
+     * Send operator input to the running child.
+     *
+     * Ignored unless a child is running, so a key pressed as the run ends cannot reach a dead process.
+     * @param bytes - Sequence already encoded for the child's terminal.
+     */
+    writeToLocalRun(bytes) {
+        if (this.#disposed || this.#state.run?.outcome.kind !== "running")
+            return;
+        this.#runSession?.write(bytes);
+    }
+    /**
+     * Tell the running child its terminal has been resized.
+     *
+     * Ignored unless a child is running, for the same reason input is.
+     * @param columns - Columns the child now has.
+     * @param rows - Rows the child now has.
+     */
+    resizeLocalRun(columns, rows) {
+        if (this.#disposed || this.#state.run?.outcome.kind !== "running")
+            return;
+        this.#runSession?.resize(columns, rows);
+    }
+    /**
+     * Discard a finished run, leaving a run still in progress alone.
+     */
+    clearLocalRun() {
+        if (this.#disposed || this.#state.run?.outcome.kind === "running")
+            return;
+        this.#runSession = null;
+        this.#set({ ...this.#state, run: null });
+    }
+    /**
+     * End the running child and report the run as abandoned.
+     *
+     * The outcome is recorded here rather than awaited from the port, because the operator asked to stop
+     * waiting: a child that ignores the signal would otherwise keep them in the overlay it is stuck in.
+     * Whatever that child reports afterwards is dropped, because the run is no longer running.
+     */
+    cancelLocalRun() {
+        const run = this.#state.run;
+        if (this.#disposed || run?.outcome.kind !== "running")
+            return;
+        this.#runSession?.stop();
+        this.#runSession = null;
+        this.#set({ ...this.#state, run: { ...run, outcome: { kind: "cancelled" } } });
+    }
+    /**
+     * Set one side pane's dragged width.
+     *
+     * Storing is deliberately not done here: this runs once per cell of pointer travel, and the store
+     * is a blocking write.
+     *
+     * The pane on the far side is pinned to the width it currently renders at. Left as a preference the
+     * layout has not yet honoured, it would be re-clamped against the new request and shift under a
+     * pointer that never touched it.
+     * @param pane - Which side pane the operator dragged.
+     * @param columns - Cells the dragged pane should occupy, before any clamping the layout applies.
+     * @param oppositeColumns - Cells the pane on the far side of the agent log currently renders at.
+     */
+    resizePane(pane, columns, oppositeColumns) {
+        if (this.#disposed)
+            return;
+        this.updateView((view) => ({
+            ...view,
+            ...(pane === "tree"
+                ? { treeColumns: columns, messageLogColumns: oppositeColumns }
+                : { treeColumns: oppositeColumns, messageLogColumns: columns }),
+        }));
+    }
+    /** Store the pane widths the operator has finished dragging, for later runs to adopt. */
+    commitPaneLayout() {
+        if (this.#disposed)
+            return;
+        const { treeColumns, messageLogColumns } = this.#state.view;
+        this.dependencies.layout?.write({ treeColumns, messageLogColumns });
+    }
+    /**
+     * Update local view state only.
+     * @param update - Pure local view transformation.
+     */
+    updateView(update) {
+        if (this.#disposed)
+            return;
+        this.#set({ ...this.#state, view: update(this.#state.view) });
+    }
+    /**
+     * Select one traffic row, marking an accepted delivery read by the act of showing it.
+     * @param entry - Traffic row the operator moved onto.
+     */
+    viewTraffic(entry) {
+        if (this.#disposed)
+            return;
+        const unread = new Set(this.#state.unreadMessageIds);
+        if (entry.kind === "accepted_delivery")
+            unread.delete(entry.messageId);
+        this.#set({
+            ...this.#state,
+            unreadMessageIds: unread,
+            view: { ...this.#state.view, trafficId: entry.trafficId },
+        });
+    }
+    /** Dispose stream, recovery work, listeners, and composition resources once. */
+    dispose() {
+        if (this.#disposed)
+            return;
+        this.#disposed = true;
+        this.#generation += 1;
+        this.#runGeneration += 1;
+        this.#runSession?.stop();
+        this.#runSession = null;
+        this.#snapshotCancel?.();
+        this.#snapshotCancel = undefined;
+        this.#streamCancel?.();
+        this.#recoveryCancel?.();
+        this.#recoveryCancel = undefined;
+        this.#replacementCancel?.();
+        this.#replacementCancel = undefined;
+        for (const cancel of this.#commandCancels)
+            cancel();
+        this.#commandCancels.clear();
+        this.dependencies.disposal.dispose();
+        this.#set({ ...this.#state, connection: "disposed" });
+        this.#listeners.clear();
+    }
+    async #replace(generation) {
+        const request = this.dependencies.snapshot.fetch();
+        const cancel = () => {
+            request.cancel();
+        };
+        this.#snapshotCancel?.();
+        this.#snapshotCancel = cancel;
+        try {
+            const value = await request.promise;
+            const snapshot = validateOperatorSnapshot(value);
+            if (!this.#active(generation))
+                return;
+            if (this.#state.connection !== "healthy")
+                this.reportDiagnostic("info", "connection", `connected: snapshot at sequence ${String(snapshot.cursor.sequence)}`);
+            // A fetched snapshot is installed as a fresh start rather than a replacement, so unread identities
+            // begin empty from it.
+            this.observeSnapshot(structuredClone(snapshot), false);
+        }
+        finally {
+            if (this.#snapshotCancel === cancel)
+                this.#snapshotCancel = undefined;
+        }
+    }
+    #openStream(generation) {
+        if (!this.#active(generation))
+            return;
+        const cursor = this.#state.snapshot?.cursor ?? null;
+        const cancel = this.dependencies.stream.open(cursor, (observation) => {
+            if (!this.#active(generation))
+                return;
+            switch (observation.type) {
+                case "event":
+                    this.#receive(observation.event);
+                    return;
+                case "snapshot":
+                    this.observeSnapshot(observation.snapshot, observation.replacement);
+                    return;
+                case "diagnostic":
+                    this.#observeDiagnostic(observation.diagnostic);
+                    return;
+                case "resync":
+                    this.#recover();
+                    return;
+                case "incompatible":
+                    this.observeIncompatible();
+                    return;
+                case "live":
+                    this.#observeLive();
+                    return;
+                case "resync_pending":
+                    this.#awaitReplacement();
+                    return;
+                case "resync_progress":
+                    this.#extendReplacement();
+                    return;
+                default: {
+                    const unhandled = observation;
+                    return unhandled;
+                }
+            }
+        }, () => {
+            if (this.#active(generation))
+                this.#recover();
+        });
+        if (!this.#active(generation))
+            cancel();
+        else
+            this.#streamCancel = cancel;
+    }
+    #receive(event) {
+        const snapshot = this.#state.snapshot;
+        if (!snapshot || this.#disposed || this.#state.connection === "incompatible")
+            return;
+        const result = classifyOperatorEvent(snapshot.cursor, event);
+        if (result.type === "duplicate")
+            return;
+        if (result.type === "incompatible_version") {
+            this.observeIncompatible();
+            return;
+        }
+        if (result.type !== "apply") {
+            this.#recover();
+            return;
+        }
+        this.#recoveryAttempts = 0;
+        const next = reduce(snapshot, result.event);
+        const unread = new Set(this.#state.unreadMessageIds);
+        if (result.event.event.type === "traffic_upserted" &&
+            result.event.event.traffic.kind === "accepted_delivery" &&
+            !acceptedIds(snapshot.traffic).has(result.event.event.traffic.messageId)) {
+            unread.add(result.event.event.traffic.messageId);
+            this.#knownMessageIds.add(result.event.event.traffic.messageId);
+        }
+        const ids = acceptedIds(next.traffic);
+        for (const id of unread)
+            if (!ids.has(id))
+                unread.delete(id);
+        this.#knownMessageIds = ids;
+        this.#set({
+            ...this.#state,
+            snapshot: next,
+            unreadMessageIds: unread,
+            healthByAgentId: health(next),
+            view: reconcileView(this.#state.view, next, this.#state.snapshot),
+        });
+    }
+    #recover() {
+        if (this.#disposed || this.#state.connection === "incompatible" || this.#recoveryCancel)
+            return;
+        this.#replacementCancel?.();
+        this.#replacementCancel = undefined;
+        // Every failed reconnect re-enters here; only the entry into recovering reports that the stream stopped.
+        if (this.#state.connection !== "recovering")
+            this.reportDiagnostic("warning", "connection", "recovering: the authoritative stream stopped");
+        this.#set({ ...this.#state, connection: "recovering" });
+        this.#streamCancel?.();
+        this.#streamCancel = undefined;
+        const generation = ++this.#generation;
+        const delayMs = reconnectDelayMs(this.#recoveryAttempts);
+        this.#recoveryAttempts = Math.min(this.#recoveryAttempts + 1, TUI_RECONNECT_MAX_ATTEMPT);
+        this.#recoveryCancel = this.dependencies.scheduler.schedule(() => {
+            this.#recoveryCancel = undefined;
+            if (!this.#active(generation))
+                return;
+            this.dependencies.reconnect.reconnect();
+            // A model holding a snapshot resumes from its cursor: the broker replays what was missed, or
+            // answers with a replacement snapshot when the journal cannot reach that position. Only a model
+            // that never hydrated has no cursor to offer and must pay for a whole transfer.
+            if (this.#state.snapshot) {
+                this.#openStream(generation);
+                return;
+            }
+            void this.#replace(generation)
+                .then(() => {
+                if (this.#active(generation) && this.#state.connection === "healthy")
+                    this.#openStream(generation);
+            })
+                .catch(() => {
+                if (this.#active(generation))
+                    this.#recover();
+            });
+        }, delayMs);
+    }
+    #awaitReplacement() {
+        if (this.#disposed || this.#state.connection === "incompatible" || this.#replacementCancel)
+            return;
+        this.reportDiagnostic("warning", "connection", "resyncing: the broker refused the resumed cursor");
+        this.#replacementArmedAt = this.dependencies.now();
+        this.#armReplacementTimeout();
+    }
+    /**
+     * Push the replacement deadline back out because a chunk of the owed transfer just landed.
+     *
+     * Without this, a transfer that legitimately outruns one fixed window (a large snapshot over a
+     * backpressured socket) can never finish: recovery tears it down at the deadline, reconnects,
+     * resumes at the same cursor, and is offered the same replacement — a livelock. A no-op when no
+     * replacement is currently owed, since a stray progress signal then names nothing to extend, and
+     * once TUI_REPLACEMENT_TOTAL_LIMIT_MS has passed since the wait began, so continuing progress alone
+     * cannot hold the wait open forever.
+     */
+    #extendReplacement() {
+        if (this.#disposed || this.#state.connection === "incompatible" || !this.#replacementCancel)
+            return;
+        const armedAt = this.#replacementArmedAt ?? this.dependencies.now();
+        if (this.dependencies.now() - armedAt >= TUI_REPLACEMENT_TOTAL_LIMIT_MS)
+            return;
+        this.#replacementCancel();
+        this.#armReplacementTimeout();
+    }
+    #armReplacementTimeout() {
+        const generation = this.#generation;
+        this.#replacementCancel = this.dependencies.scheduler.schedule(() => {
+            this.#replacementCancel = undefined;
+            if (!this.#active(generation))
+                return;
+            this.#recover();
+        }, TUI_REPLACEMENT_TIMEOUT_MS);
+    }
+    #observeLive() {
+        if (this.#disposed || this.#state.connection !== "recovering")
+            return;
+        this.reportDiagnostic("info", "connection", "resumed: the authoritative stream is live");
+        this.#set({ ...this.#state, connection: "healthy" });
+    }
+    /**
+     * Record one operator-visible condition, whoever observed it.
+     * @param diagnostic - Content-free description of what was observed.
+     */
+    #observeDiagnostic(diagnostic) {
+        if (this.#disposed)
+            return;
+        const diagnostics = [...this.#state.diagnostics, diagnostic];
+        this.#set({ ...this.#state, diagnostics: diagnostics.slice(-TUI_DIAGNOSTIC_LIMIT) });
+    }
+    /**
+     * Record a condition this client observed, stamped from the model's own clock.
+     * @param severity - Attention the condition asks for.
+     * @param scope - Subsystem the condition arose in.
+     * @param summary - Content-free description, in the words the diagnostics log shows.
+     */
+    reportDiagnostic(severity, scope, summary) {
+        this.#observeDiagnostic({ at: this.dependencies.now(), origin: "client", severity, scope, summary });
+    }
+    #set(state) {
+        this.#state = state;
+        for (const listener of this.#listeners) {
+            listener(state);
+        }
+    }
+    #active(generation) {
+        return !this.#disposed && generation === this.#generation;
+    }
+    /**
+     * Install a complete transport snapshot through the same authoritative replacement path.
+     * @param snapshot - Validated operator snapshot, held by the model from here on.
+     * @param replacement - Whether the snapshot answers a resync, so unread identities that survived the gap are kept.
+     */
+    observeSnapshot(snapshot, replacement) {
+        if (this.#disposed || this.#state.connection === "incompatible")
+            return;
+        const ids = acceptedIds(snapshot.traffic);
+        const unread = replacement
+            ? new Set([...this.#state.unreadMessageIds].filter((id) => ids.has(id)))
+            : new Set();
+        if (replacement)
+            for (const id of ids)
+                if (!this.#knownMessageIds.has(id))
+                    unread.add(id);
+        this.#knownMessageIds = ids;
+        this.#recoveryAttempts = 0;
+        if (replacement) {
+            this.#replacementCancel?.();
+            this.#replacementCancel = undefined;
+            this.reportDiagnostic("info", "connection", `resynced: replacement snapshot installed at sequence ${String(snapshot.cursor.sequence)}`);
+        }
+        this.#set({
+            ...this.#state,
+            snapshot,
+            unreadMessageIds: unread,
+            healthByAgentId: health(snapshot),
+            connection: "healthy",
+            view: reconcileView(this.#state.view, snapshot, this.#state.snapshot),
+        });
+    }
+    /**
+     * Apply one transport event using normal ordered reduction.
+     * @param event - Untrusted event envelope from the operator stream, validated here before it is applied.
+     */
+    observeEvent(event) {
+        this.#receive(event);
+    }
+    /** Start bounded recovery after an explicit transport resync. */
+    observeResync() {
+        this.#recover();
+    }
+    /** End stream application after an incompatible transport observation. */
+    observeIncompatible() {
+        if (!this.#disposed && this.#state.connection !== "incompatible") {
+            this.#generation += 1;
+            this.#snapshotCancel?.();
+            this.#snapshotCancel = undefined;
+            this.#recoveryCancel?.();
+            this.#recoveryCancel = undefined;
+            this.#replacementCancel?.();
+            this.#replacementCancel = undefined;
+            this.#streamCancel?.();
+            this.#streamCancel = undefined;
+            this.reportDiagnostic("error", "connection", "incompatible: the broker serves another protocol version");
+            this.#set({ ...this.#state, connection: "incompatible" });
+        }
+    }
+}
+function initialState() {
+    return {
+        snapshot: null,
+        unreadMessageIds: new Set(),
+        healthByAgentId: new Map(),
+        connection: "cold",
+        run: null,
+        diagnostics: [],
+        view: {
+            focus: "tree",
+            selection: null,
+            trafficId: null,
+            collapsedRepositories: new Set(),
+            hiddenRepositories: new Set(),
+            hiddenExpanded: false,
+            archivedSections: new Map(),
+            followAgentLog: true,
+            treeColumns: null,
+            messageLogColumns: null,
+            overlay: { kind: "none" },
+            overlayReturnFocus: "tree",
+            contextActionIndex: 0,
+            actionIndex: 0,
+        },
+    };
+}
+function reconnectDelayMs(attempt) {
+    return Math.min(TUI_RECONNECT_BASE_DELAY_MS * 2 ** attempt, TUI_RECONNECT_MAX_DELAY_MS);
+}
+function acceptedIds(traffic) {
+    return new Set(traffic.flatMap((entry) => (entry.kind === "accepted_delivery" ? [entry.messageId] : [])));
+}
+function health(snapshot) {
+    return new Map(snapshot.agents.map((agent) => [agent.id, selectOperatorAgentHealth(agent, snapshot.traffic)]));
+}
+function reconcileView(view, snapshot, previous) {
+    // A workspace collapses as it becomes archived, and every archived one is collapsed on the first
+    // snapshot. Only the transition collapses, so an operator who opens one keeps it open.
+    const archivedBefore = previous ? archivedOperatorRepositoryIds(previous.agents) : new Set();
+    const collapsedRepositories = new Set(view.collapsedRepositories);
+    for (const id of archivedOperatorRepositoryIds(snapshot.agents)) {
+        if (!archivedBefore.has(id))
+            collapsedRepositories.add(id);
+    }
+    const repositoryIds = new Set(snapshot.repositories.map((repository) => repository.id));
+    const agentIds = new Set(snapshot.agents.map((agent) => agent.id));
+    const messageIds = acceptedIds(snapshot.traffic);
+    const trafficIds = new Set(snapshot.traffic.map((traffic) => traffic.trafficId));
+    const hiddenRepositories = new Set([...view.hiddenRepositories].filter((id) => repositoryIds.has(id)));
+    const selection = selectionSurviving(view.selection, repositoryIds, agentIds, hiddenRepositories);
+    const trafficId = view.trafficId !== null && !trafficIds.has(view.trafficId) ? null : view.trafficId;
+    return {
+        ...view,
+        selection,
+        trafficId,
+        overlay: reconcileOverlay(view.overlay, repositoryIds, agentIds, messageIds, expirableIds(snapshot.traffic)),
+        collapsedRepositories: new Set([...collapsedRepositories].filter((id) => repositoryIds.has(id))),
+        hiddenRepositories,
+        archivedSections: new Map([...view.archivedSections].filter(([id]) => repositoryIds.has(id))),
+    };
+}
+/**
+ * Keep a tree selection only while the row it names can still be shown.
+ * @param selection - Selection held before the projection changed.
+ * @param repositoryIds - Repositories the new projection holds.
+ * @param agentIds - Agents the new projection holds.
+ * @param hiddenRepositories - Hidden repositories that survive in the new projection; the hidden section exists only while any do.
+ * @returns The same selection, or null when its row is gone.
+ */
+function selectionSurviving(selection, repositoryIds, agentIds, hiddenRepositories) {
+    switch (selection?.kind) {
+        case "workspace":
+        case "archived":
+            return repositoryIds.has(selection.repositoryId) ? selection : null;
+        case "agent":
+            return agentIds.has(selection.agentId) ? selection : null;
+        case "hidden":
+            return hiddenRepositories.size > 0 ? selection : null;
+        case undefined:
+            return selection;
+    }
+}
+function expirableIds(traffic) {
+    return new Set(traffic.flatMap((entry) => (entry.kind === "accepted_delivery" && isTuiExpirable(entry) ? [entry.messageId] : [])));
+}
+function reconcileOverlay(overlay, repositoryIds, agentIds, messageIds, expirable) {
+    const closed = { kind: "none" };
+    switch (overlay.kind) {
+        case "agent_identity":
+            return agentIds.has(overlay.agentId) ? overlay : closed;
+        case "archive_confirm":
+            return agentIds.has(overlay.agentId) ? overlay : closed;
+        case "full_message":
+            return messageIds.has(overlay.messageId) ? overlay : closed;
+        case "expire_confirm":
+            // A delivery that settled while the operator was being asked would only be refused by the broker.
+            return expirable.has(overlay.messageId) ? overlay : closed;
+        case "context_menu":
+            if (overlay.target === "agent")
+                return agentIds.has(overlay.agentId) ? overlay : closed;
+            if (overlay.target === "message")
+                return messageIds.has(overlay.messageId) ? overlay : closed;
+            return repositoryIds.has(overlay.repositoryId) ? overlay : closed;
+        case "none":
+        case "actions":
+        case "action_run":
+        case "help":
+        case "log":
+            return overlay;
+    }
+}
+function reduce(snapshot, envelope) {
+    const next = structuredClone(snapshot);
+    const event = envelope.event;
+    const apply = (values, value, id) => {
+        const index = values.findIndex((candidate) => id(candidate) === id(value));
+        if (index < 0)
+            values.push(value);
+        else
+            values[index] = value;
+    };
+    switch (event.type) {
+        case "repository_upserted":
+            apply(next.repositories, event.repository, (value) => value.id);
+            next.repositories.sort((a, b) => a.rootPath.localeCompare(b.rootPath) || a.id.localeCompare(b.id));
+            break;
+        case "repository_removed":
+            next.repositories = next.repositories.filter((value) => value.id !== event.repositoryId);
+            break;
+        case "agent_upserted":
+            apply(next.agents, event.agent, (value) => value.id);
+            next.agents.sort((a, b) => a.registeredAt - b.registeredAt || a.id.localeCompare(b.id));
+            break;
+        case "agent_removed":
+            next.agents = next.agents.filter((value) => value.id !== event.agentId);
+            break;
+        case "traffic_upserted":
+            apply(next.traffic, event.traffic, (value) => value.trafficId);
+            next.traffic.sort((a, b) => a.trafficPosition - b.trafficPosition);
+            break;
+        case "traffic_removed":
+            next.traffic = next.traffic.filter((value) => value.trafficId !== event.trafficId);
+            break;
+    }
+    next.cursor = { protocolVersion: OPERATOR_PROTOCOL_VERSION, epoch: envelope.epoch, sequence: envelope.sequence };
+    next.epoch = envelope.epoch;
+    return next;
+}