@kortix/sdk 0.13.4 → 0.13.7

package/dist/browser/stores/sync-store.js

@@ -1,6 +1,7 @@
 "use client";
 import { create } from "zustand";
 import { commitSessionRewind, isWithinRewindWindow, stageSessionRewind, } from "../../core/session/rewind.js";
+import { isRetryableTurnError } from "../../core/turns/open-turn.js";
 import { ascendingId } from "./sync-store/ascending-id.js";
 import { Binary } from "./sync-store/binary.js";
 import { writeStreamCache } from "./sync-store/stream-cache.js";
@@ -32,10 +33,85 @@ export function sameSessionStatus(a, b) {
         return true;
     return a.attempt === b.attempt && a.message === b.message && a.next === b.next;
 }
+/**
+ * WHO minted a status-bearing event handed to `applyEvent`. A tab-synthesized
+ * event (`markSessionIdleLocally`, `markSessionAbortedLocally`, the hydrate
+ * snapshot fill) carries `synthetic: true` — a field no wire `Event` has — and
+ * its status write lands with `'local'` origin so it can never contradict the
+ * control plane's turn authority (`WorkingStreamInput.origin`). Everything off
+ * the wire stays `'wire'`.
+ */
+function syntheticEventOrigin(event) {
+    return event?.synthetic === true
+        ? "local"
+        : "wire";
+}
 function isTextLikePart(part) {
     return part.type === "text" || part.type === "reasoning";
 }
 // ============================================================================
+// Locating things in a list that is NOT id-sorted.
+//
+// `Binary.search` requires ascending ids. None of this store's lists are
+// reliably ascending, for two independent reasons:
+//
+//  1. optimistic messages are appended out of order on purpose (see
+//     `optimisticRemove`, which says so), and
+//  2. OpenCode 1.18.15 retired the invariant that ids ascend with time
+//     altogether — `MessageV2.latest()` orders by `time.created`, with the id
+//     only as a tie-break, and `MessageV2.page()` (every transcript read this
+//     store performs) has ALWAYS ordered by `time_created`.
+//
+// A binary HIT is still trustworthy: `Binary.search` reports `found` only on an
+// exact id match. A binary MISS is not — on an unsorted list it is a coin
+// flip, and treating it as proof of absence is how `upsertPart` spliced a
+// duplicate part (restarting the visible stream), `removePart` no-opped (a
+// cancelled tool call stayed on screen), and `applyPartDelta` dropped deltas
+// (the assistant appeared to hang mid-sentence).
+// ============================================================================
+/**
+ * How coarsely `sessionActivityAt` is stamped.
+ *
+ * One second: far finer than any consumer needs (the projection compares it
+ * against observations bounded in tens of seconds) and coarse enough that a
+ * runtime streaming at ~140ms per frame updates it once, not seven times.
+ */
+const ACTIVITY_STAMP_RESOLUTION_MS = 1_000;
+/** The index of `id` in `list`, or `-1`. Binary first, linear on a miss. */
+function indexOfId(list, id, idOf) {
+    const result = Binary.search(list, id, idOf);
+    if (result.found && list[result.index] !== undefined && idOf(list[result.index]) === id) {
+        return result.index;
+    }
+    return list.findIndex((item) => idOf(item) === id);
+}
+/**
+ * Where a message the current snapshot did not contain belongs: the first
+ * position holding a strictly newer message, or the end.
+ *
+ * Ordered by `time.created` with the id as the ONLY tie-break — the same order
+ * the server's own `MessageV2.latest()` uses, and the key `MessageV2.page()`
+ * pages by. That keeps a locally-known message (an SSE arrival, a re-keyed
+ * stub) in the sequence the next page read will produce. A message with no
+ * readable `time` — every `session.error` stub this store mints — cannot be
+ * dated and goes last, which is where the newest thing we know about belongs.
+ */
+function insertIndexByTime(list, message) {
+    const created = message.time?.created;
+    if (created === undefined)
+        return list.length;
+    for (let index = 0; index < list.length; index++) {
+        const other = list[index].time?.created;
+        if (other === undefined)
+            continue;
+        if (other > created)
+            return index;
+        if (other === created && list[index].id > message.id)
+            return index;
+    }
+    return list.length;
+}
+// ============================================================================
 // Store Implementation
 // Track optimistic message IDs so we can remove them when the server sends
 // the real user message (which has a different, server-generated ID).
@@ -271,26 +347,52 @@ function untrackStub(sessionID, stubId) {
 }
 /** The stub id for the turn `userId` opened.
  *
- *  Derived from the user message's own id, for two reasons. It is IDEMPOTENT —
- *  a second `session.error` for the same turn finds the stub it already made
- *  instead of appending another. And it SORTS immediately after that user
- *  message: every id the store handles has the same length, so an id that
- *  extends `userId` byte for byte precedes every id greater than `userId` and
- *  follows `userId` itself. Position and `parentID` therefore agree, whichever
- *  of the two a reader uses. */
+ *  Derived from the user message's own id so it is IDEMPOTENT — a second
+ *  `session.error` for the same turn finds the stub it already made instead of
+ *  appending another. The stub is always PLACED directly after its user
+ *  message (see `rekeyStubParent` and `hydrate`), and carries `parentID`;
+ *  neither its position nor its linkage is inferred from the id. */
 const stubIdFor = (userId) => `${userId}_error`;
 /** A stub id as seen from a list that has no tracking map to hand (`hydrate`'s
  *  incoming server snapshot, which can never legitimately contain one). */
 const isStubShaped = (id) => id.endsWith("_error");
+/** The index in `messages` of the assistant message answering the turn
+ *  `parentId` opened, or `-1`.
+ *
+ *  `parentID` is the linkage `groupMessagesIntoTurns` reads and the only
+ *  authoritative one. A wire assistant message that carries none is matched by
+ *  TIME instead — `time.created` at or after the prompt's. It used to be
+ *  matched by `m.id > parentId`, on the rationale "ids ascend, so a greater id
+ *  is a later message". OpenCode 1.18.15 retired that invariant (turn exit now
+ *  reads `lastAssistant.parentID === lastUser.id`, and `MessageV2.latest()`
+ *  orders by `time.created`), and the comparison failed both ways: a real
+ *  reply with a lower id left a stale `session.error` stub beside it, and an
+ *  EARLIER turn's parentless reply with a higher id deleted the only record
+ *  that this turn failed (the 2026-08-19 `ModelNotFound` report).
+ *
+ *  A parentless candidate that cannot be dated — because it carries no `time`,
+ *  or because the prompt itself is not in `messages` — is not a match: keeping
+ *  a stub that turns out to be redundant is recoverable on the next snapshot;
+ *  deleting the only evidence of a failed turn is not.
+ *
+ *  With no parent turn to speak of, any assistant message answers. */
+function findAssistantForTurn(messages, parentId) {
+    const parentCreated = parentId
+        ? messages.find((m) => m.id === parentId)?.time?.created
+        : undefined;
+    return messages.findIndex((m) => m.role === "assistant" &&
+        !isStubShaped(m.id) &&
+        (!parentId ||
+            m.parentID === parentId ||
+            (!m.parentID &&
+                parentCreated !== undefined &&
+                m.time?.created !== undefined &&
+                m.time.created >= parentCreated)));
+}
 /** Does `messages` hold an assistant message answering the turn `parentId`
- *  opened? `parentID` is the linkage `groupMessagesIntoTurns` reads; the id
- *  comparison covers a wire assistant message that carries none (ids ascend,
- *  so a greater id is a later message). With no parent turn to speak of, any
- *  assistant message answers. */
+ *  opened? See {@link findAssistantForTurn}. */
 function hasAssistantForTurn(messages, parentId) {
-    return messages.some((m) => m.role === "assistant" &&
-        !isStubShaped(m.id) &&
-        (!parentId || m.parentID === parentId || (!m.parentID && m.id > parentId)));
+    return findAssistantForTurn(messages, parentId) !== -1;
 }
 /** Move this session's `session.error` stubs from the optimistic user message
  *  `fromId` onto the server's own copy of that prompt, `toId`.
@@ -543,6 +645,9 @@ export const useSyncStore = create()((set, get) => ({
     messages: {},
     parts: {},
     sessionStatus: {},
+    sessionStatusOrigin: {},
+    sessionStatusAt: {},
+    sessionActivityAt: {},
     diffs: {},
     todos: {},
     sessionRevert: {},
@@ -571,9 +676,15 @@ export const useSyncStore = create()((set, get) => ({
             next[linearIdx] = message;
             return { messages: { ...s.messages, [sessionID]: next } };
         }
-        // New message — insert at sorted position via binary search.
+        // New message — placed by `time.created`, the key the server's own
+        // `MessageV2.page()` orders by. It used to go in at the binary index,
+        // which was only ever meaningful while `hydrate` re-sorted the
+        // transcript by id. It no longer does (the page order IS the order),
+        // and ids stopped ascending with time in OpenCode 1.18.15 — so an
+        // id-sorted insert dropped a brand-new SSE message into the MIDDLE of
+        // the transcript. See `insertIndexByTime`.
         const next = [...list];
-        next.splice(result.index, 0, message);
+        next.splice(insertIndexByTime(next, message), 0, message);
         return { messages: { ...s.messages, [sessionID]: next } };
     }),
     removeMessage: (sessionID, messageID) => set((s) => {
@@ -739,16 +850,32 @@ export const useSyncStore = create()((set, get) => ({
             return { parts: { ...s.parts, [messageID]: next } };
         });
     },
-    setStatus: (sessionID, status) => set((s) => {
+    setStatus: (sessionID, status, origin = "wire") => set((s) => {
         // A value that did not change is not news. `useSessionWorking` stamps
         // its stream observation from this object's IDENTITY, so an
         // equal-valued rewrite that minted a new object re-started
         // `STREAM_OBSERVATION_MAX_MS` from zero on every write — the bound
         // that stops a dead stream from deciding was never reached. See
         // `sameSessionStatus`.
-        if (sameSessionStatus(s.sessionStatus[sessionID], status))
-            return s;
-        return { sessionStatus: { ...s.sessionStatus, [sessionID]: status } };
+        if (sameSessionStatus(s.sessionStatus[sessionID], status)) {
+            // The VALUE is not news, but who said it can be: a wire frame
+            // landing over a fabricated one (or the reverse) changes what the
+            // frame is allowed to decide. Update only the origin — the status
+            // object keeps its identity so nothing re-stamps a stale value.
+            // The arrival stamp DOES move: an origin flip is a new observation
+            // (`use-session-working` re-stamps on it for the same reason).
+            if ((s.sessionStatusOrigin[sessionID] ?? "wire") === origin)
+                return s;
+            return {
+                sessionStatusOrigin: { ...s.sessionStatusOrigin, [sessionID]: origin },
+                sessionStatusAt: { ...s.sessionStatusAt, [sessionID]: Date.now() },
+            };
+        }
+        return {
+            sessionStatus: { ...s.sessionStatus, [sessionID]: status },
+            sessionStatusOrigin: { ...s.sessionStatusOrigin, [sessionID]: origin },
+            sessionStatusAt: { ...s.sessionStatusAt, [sessionID]: Date.now() },
+        };
     }),
     setDiff: (sessionID, diffs) => set((s) => ({
         diffs: { ...s.diffs, [sessionID]: diffs },
@@ -779,12 +906,20 @@ export const useSyncStore = create()((set, get) => ({
             return s;
         return { sessionRevert: { ...s.sessionRevert, [sessionId]: null } };
     }),
-    applyCommittedRevert: (sessionId, boundaryId, watermark) => set((s) => {
+    applyCommittedRevert: (sessionId, boundaryId, watermark, hiddenIds) => set((s) => {
         const list = s.messages[sessionId];
         if (!list || list.length === 0) {
             return { sessionRevert: { ...s.sessionRevert, [sessionId]: null } };
         }
-        const rewind = { messageId: boundaryId, watermark, staged: false };
+        // `hiddenIds` is the set captured when the rewind was staged, and it
+        // is what decides. `watermark` only still answers for a caller that
+        // has no captured set — see `isWithinRewindWindow`.
+        const rewind = {
+            messageId: boundaryId,
+            watermark,
+            ...(hiddenIds ? { hiddenIds } : {}),
+            staged: false,
+        };
         const removedIds = [];
         const kept = list.filter((m) => {
             if (isWithinRewindWindow(m.id, rewind)) {
@@ -883,11 +1018,27 @@ export const useSyncStore = create()((set, get) => ({
         get().removeMessage(sessionID, messageID);
     },
     registerOptimisticEcho: (sessionID, optimisticID, echoID) => {
-        if (!isOptimistic(sessionID, optimisticID))
-            return;
         if (optimisticID === echoID)
             return;
-        recordOptimisticEcho(sessionID, optimisticID, echoID);
+        // The caller always names the id the ROW reports as this prompt's origin
+        // — its `wire_message_id`, the id this tab minted and painted. That id
+        // stops being optimistic the moment the FIRST echo supersedes it, and
+        // after a Stop takes the prompt back out of the runtime the bubble on
+        // screen is that echo (`reclaimRemovedMessage` re-marks it optimistic),
+        // not the wire id. Registering against the wire id alone therefore did
+        // nothing on every second and later re-mint, and the drain re-mints on
+        // every one of them: the re-delivery's echo then matched no alias, and
+        // with more than one send in flight the ordinal fallback correctly
+        // refuses to guess — so the echo was dropped and the prompt stayed on
+        // screen as a bubble nothing would ever confirm.
+        //
+        // Follow the chain to the id that IS on screen and register from there.
+        const live = isOptimistic(sessionID, optimisticID)
+            ? optimisticID
+            : optimisticEchoes.get(sessionID)?.get(optimisticID);
+        if (!live || live === echoID || !isOptimistic(sessionID, live))
+            return;
+        recordOptimisticEcho(sessionID, live, echoID);
     },
     reclaimRemovedMessage: (sessionID, messageID) => {
         // See `controlPlaneOwnedIds`: a removal of a message the control plane
@@ -933,6 +1084,18 @@ export const useSyncStore = create()((set, get) => ({
             };
         });
     },
+    noteSessionActivity: (sessionID, atMs) => {
+        if (!sessionID)
+            return;
+        const now = atMs ?? Date.now();
+        const previous = get().sessionActivityAt[sessionID];
+        // Quantized: a busy runtime emits parts every few tens of milliseconds and
+        // nothing reads this to the millisecond. Without the floor, every
+        // subscriber re-renders at the stream's own rate for a timestamp.
+        if (previous !== undefined && now - previous < ACTIVITY_STAMP_RESOLUTION_MS)
+            return;
+        set((s) => ({ sessionActivityAt: { ...s.sessionActivityAt, [sessionID]: now } }));
+    },
     clearOptimisticMessages: (sessionID) => {
         set((s) => {
             const list = s.messages[sessionID];
@@ -970,10 +1133,18 @@ export const useSyncStore = create()((set, get) => ({
         for (const message of existingMessages)
             delete nextParts[message.id];
         deleteOrphanPartBuckets(nextParts, [sessionID]);
+        const nextActivity = { ...s.sessionActivityAt };
+        delete nextActivity[sessionID];
         return {
             messages: { ...s.messages, [sessionID]: [] },
             parts: nextParts,
+            sessionActivityAt: nextActivity,
             sessionStatus: { ...s.sessionStatus, [sessionID]: { type: "idle" } },
+            // Fabricated, not observed — a cache handoff says nothing about
+            // whether the runtime is running. Marked local so it can never
+            // veto the control plane's open turn (`WorkingStreamInput.origin`).
+            sessionStatusOrigin: { ...s.sessionStatusOrigin, [sessionID]: "local" },
+            sessionStatusAt: { ...s.sessionStatusAt, [sessionID]: Date.now() },
             diffs: { ...s.diffs, [sessionID]: [] },
             todos: { ...s.todos, [sessionID]: [] },
             sessionRevert: { ...s.sessionRevert, [sessionID]: null },
@@ -1055,394 +1226,464 @@ export const useSyncStore = create()((set, get) => ({
         touchSessionMessageRows(sessionID, { msgs, partRefs, result });
         return result;
     },
-    hydrate: (sessionID, msgs, opts) => set((s) => {
-        // An authoritative load — the disk repaint itself, or a reconcile —
-        // re-establishes the session, so its entry is no longer a fragment.
-        evictedSessions.delete(sessionID);
-        const cmp = (a, b) => a < b ? -1 : a > b ? 1 : 0;
-        const tombstones = cancelledMessageIds.get(sessionID);
-        const incoming = msgs
-            .filter((m) => !!m?.info?.id && !tombstones?.has(m.info.id))
-            .map((m) => m.info)
-            .sort((a, b) => cmp(a.id, b.id));
-        const fromCache = opts?.source === "cache";
-        if (fromCache) {
-            for (const m of incoming)
-                trackId(cacheSourcedIds, sessionID, m.id);
-        }
-        // A RUNTIME read settles the cache's provisional messages: the ones
-        // it contains are real; the ones it lacks but whose position it
-        // COVERS (at or above the oldest message it returned) never existed
-        // there and are dropped. Older ones are history the bounded tail did
-        // not reach — kept, still provisional.
-        let droppedPhantoms = null;
-        const provisional = fromCache ? undefined : cacheSourcedIds.get(sessionID);
-        if (provisional && provisional.size > 0 && incoming.length > 0) {
-            const oldestIncoming = incoming[0].id;
-            const incomingIds = new Set(incoming.map((m) => m.id));
-            for (const id of [...provisional]) {
-                if (incomingIds.has(id)) {
-                    untrackId(cacheSourcedIds, sessionID, id);
-                    continue;
-                }
-                if (cmp(id, oldestIncoming) >= 0 && !isOptimistic(sessionID, id)) {
-                    untrackId(cacheSourcedIds, sessionID, id);
-                    (droppedPhantoms ??= new Set()).add(id);
+    hydrate: (sessionID, msgs, opts) => {
+        // Set inside the updater below when a RUNTIME read shows the transcript
+        // moved while its tail is still open — the runtime's own output reaching
+        // this tab by pull instead of push. Stamped after the set() commits.
+        let stampRuntimeActivity = false;
+        set((s) => {
+            // An authoritative load — the disk repaint itself, or a reconcile —
+            // re-establishes the session, so its entry is no longer a fragment.
+            evictedSessions.delete(sessionID);
+            const tombstones = cancelledMessageIds.get(sessionID);
+            // NOT re-sorted. `MessageV2.page()` orders by `time_created`
+            // server-side and always has, so the snapshot arrives in the only
+            // order that is true. Re-deriving one from id strings was wrong the
+            // moment OpenCode 1.18.15 retired "ids ascend with time" — and the
+            // mobile store did the same re-sort with `localeCompare`, which is
+            // not even byte order, so the two hosts disagreed on identical data.
+            const incoming = msgs
+                .filter((m) => !!m?.info?.id && !tombstones?.has(m.info.id))
+                .map((m) => m.info);
+            const fromCache = opts?.source === "cache";
+            if (fromCache) {
+                for (const m of incoming)
+                    trackId(cacheSourcedIds, sessionID, m.id);
+            }
+            // A RUNTIME read settles the cache's provisional messages: the ones
+            // it contains are real; the ones it lacks but whose position it
+            // COVERS (at or above the oldest message it returned) never existed
+            // there and are dropped. Older ones are history the bounded tail did
+            // not reach — kept, still provisional.
+            //
+            // The bound is derived by VALUE, not by position: `incoming` is now the
+            // server's own page order, which is not an id order, so `incoming[0].id`
+            // is no longer the smallest id in the page. (That this comparison is an
+            // id comparison at all is a separate open question — see B-note in
+            // deliberately left as-is here.)
+            let droppedPhantoms = null;
+            const provisional = fromCache ? undefined : cacheSourcedIds.get(sessionID);
+            if (provisional && provisional.size > 0 && incoming.length > 0) {
+                let oldestIncoming = incoming[0].id;
+                for (const m of incoming)
+                    if (m.id < oldestIncoming)
+                        oldestIncoming = m.id;
+                const incomingIds = new Set(incoming.map((m) => m.id));
+                for (const id of [...provisional]) {
+                    if (incomingIds.has(id)) {
+                        untrackId(cacheSourcedIds, sessionID, id);
+                        continue;
+                    }
+                    if (id >= oldestIncoming && !isOptimistic(sessionID, id)) {
+                        untrackId(cacheSourcedIds, sessionID, id);
+                        (droppedPhantoms ??= new Set()).add(id);
+                    }
                 }
             }
-        }
-        // T16 — a `session.error` stub assistant message is reconciled
-        // PER TURN, after the optimistic correlation below has run (see
-        // `pendingStubs`). It only ever stood in for the assistant message
-        // its own turn never produced, so the question is not "does this
-        // session have an assistant message" — an earlier turn's answer is
-        // no answer at all — but "does the server now answer THAT turn".
-        // Re-adopt a stub that arrives IN the snapshot. The transcript cache
-        // mirrors `messages[sessionID]` to IndexedDB, stubs included, so the
-        // first paint after a reload brings one back — while
-        // `stubAssistantIds` (module state) did not survive the reload. An
-        // unadopted stub is unreconcilable: it would sit beside the server's
-        // own reply forever. Only the runtime ever produces these ids, so
-        // nothing else can be mistaken for one.
-        for (const info of incoming) {
-            if (info.role !== "assistant" || !isStubShaped(info.id))
-                continue;
-            if (!info.error)
-                continue;
-            if (stubAssistantIds.get(sessionID)?.has(info.id))
-                continue;
-            trackStub(sessionID, info.id, info.parentID ?? null);
-        }
-        const trackedStubIds = stubAssistantIds.get(sessionID);
-        /** Stubs held back from the merge below until their parent turn is
-         *  known (an optimistic parent may be superseded by the server's own
-         *  copy in this very snapshot). */
-        const pendingStubs = [];
-        // Merge incoming messages with existing ones — never delete messages
-        // that exist in the sync store but are missing from the fetch (they may
-        // be from a newer turn that the server hasn't persisted yet).
-        const existingAll = s.messages[sessionID] ?? [];
-        const existing = droppedPhantoms
-            ? existingAll.filter((m) => !droppedPhantoms.has(m.id))
-            : existingAll;
-        const merged = [];
-        const seen = new Set();
-        // Which optimistic user messages has the server actually echoed?
-        //
-        // This test used to be EXISTENTIAL: "if this page holds any real user
-        // message at all, every optimistic user message is a duplicate". In an
-        // ongoing conversation that is always true — the page is full of
-        // earlier turns — so a message sent one second ago, which the server
-        // had provably never received, was deleted along with its text. The
-        // window was wide open by construction: the rehydrate that calls this
-        // only runs for sessions whose status is `busy`, and the optimistic
-        // add is what sets `busy`. Sending armed the thing that deleted the
-        // send.
-        //
-        // The rule is now identity-based, in two passes.
-        const existingIds = new Set(existing.map((m) => m.id));
-        // The echo may arrive under the optimistic message's OWN id: the host
-        // minted the wire id and painted the bubble with it. That is a
-        // confirmation, not a duplicate — release the marks so the message is
-        // ordinary from here (the sweep leaves it alone, real parts win), and
-        // bridge its optimistic parts until real ones land.
-        for (const m of incoming) {
-            if (m.role !== "user" || !isOptimistic(sessionID, m.id))
-                continue;
-            releaseConfirmedOptimisticId(sessionID, m.id, m.id);
-            const optimisticParts = s.parts[m.id];
-            const entry = msgs.find((x) => x.info.id === m.id);
-            if ((entry?.parts?.length ?? 0) === 0 && optimisticParts?.length) {
-                trackId(bridgedPartIds, sessionID, m.id);
+            // T16 — a `session.error` stub assistant message is reconciled
+            // PER TURN, after the optimistic correlation below has run (see
+            // `pendingStubs`). It only ever stood in for the assistant message
+            // its own turn never produced, so the question is not "does this
+            // session have an assistant message" — an earlier turn's answer is
+            // no answer at all — but "does the server now answer THAT turn".
+            // Re-adopt a stub that arrives IN the snapshot. The transcript cache
+            // mirrors `messages[sessionID]` to IndexedDB, stubs included, so the
+            // first paint after a reload brings one back — while
+            // `stubAssistantIds` (module state) did not survive the reload. An
+            // unadopted stub is unreconcilable: it would sit beside the server's
+            // own reply forever. Only the runtime ever produces these ids, so
+            // nothing else can be mistaken for one.
+            for (const info of incoming) {
+                if (info.role !== "assistant" || !isStubShaped(info.id))
+                    continue;
+                if (!info.error)
+                    continue;
+                if (stubAssistantIds.get(sessionID)?.has(info.id))
+                    continue;
+                trackStub(sessionID, info.id, info.parentID ?? null);
             }
-        }
-        // Pass 0 — candidate echoes. A real user message we have NEVER seen
-        // before may be the server's copy of something still in flight. One we
-        // already held is history, and history cannot supersede the present.
-        // This single condition is what fixes the reported bug.
-        const candidateEchoes = incoming.filter((m) => m.role === "user" &&
-            !isOptimistic(sessionID, m.id) &&
-            !existingIds.has(m.id));
-        const unclaimedEchoes = new Set(candidateEchoes.map((m) => m.id));
-        // Pass 1 — exact correlation by part id. Hosts generate the text part
-        // id up front and send it WITH the prompt precisely so the echo
-        // updates the same part, which makes this an identity match rather
-        // than a guess.
-        const echoByPartId = new Map();
-        for (const echo of candidateEchoes) {
-            const entry = msgs.find((m) => m.info.id === echo.id);
-            for (const p of entry?.parts ?? []) {
-                if (p?.id)
-                    echoByPartId.set(p.id, echo.id);
+            const trackedStubIds = stubAssistantIds.get(sessionID);
+            /** Stubs held back from the merge below until their parent turn is
+             *  known (an optimistic parent may be superseded by the server's own
+             *  copy in this very snapshot). */
+            const pendingStubs = [];
+            // Merge incoming messages with existing ones — never delete messages
+            // that exist in the sync store but are missing from the fetch (they may
+            // be from a newer turn that the server hasn't persisted yet).
+            const existingAll = s.messages[sessionID] ?? [];
+            const existing = droppedPhantoms
+                ? existingAll.filter((m) => !droppedPhantoms.has(m.id))
+                : existingAll;
+            const merged = [];
+            const seen = new Set();
+            // Which optimistic user messages has the server actually echoed?
+            //
+            // This test used to be EXISTENTIAL: "if this page holds any real user
+            // message at all, every optimistic user message is a duplicate". In an
+            // ongoing conversation that is always true — the page is full of
+            // earlier turns — so a message sent one second ago, which the server
+            // had provably never received, was deleted along with its text. The
+            // window was wide open by construction: the rehydrate that calls this
+            // only runs for sessions whose status is `busy`, and the optimistic
+            // add is what sets `busy`. Sending armed the thing that deleted the
+            // send.
+            //
+            // The rule is now identity-based, in two passes.
+            const existingIds = new Set(existing.map((m) => m.id));
+            // ---- Runtime-read activity evidence. ----
+            // Movement on a transcript this tab ALREADY held, with the tail still
+            // open, observed by a runtime read: the runtime is producing output
+            // right now, whatever the stream's last status frame claimed. Guards,
+            // each load-bearing (asserted in the test file): an initial fill is
+            // history, not movement; a completed tail is a finished turn and must
+            // not paint busy on a returning tab; a cache repaint is this tab's own
+            // disk, not the runtime speaking.
+            if (!fromCache && existingAll.length > 0) {
+                const tail = incoming[incoming.length - 1];
+                const tailOpen = !!tail &&
+                    tail.role === "assistant" &&
+                    !tail.time?.completed &&
+                    !tail.error;
+                if (tailOpen) {
+                    stampRuntimeActivity =
+                        incoming.some((m) => !existingIds.has(m.id)) ||
+                            msgs.some((entry) => {
+                                const mid = entry?.info?.id;
+                                if (!mid || isOptimistic(sessionID, mid) || !existingIds.has(mid)) {
+                                    return false;
+                                }
+                                const prev = s.parts[mid];
+                                if (!prev || prev.length === 0)
+                                    return (entry.parts?.length ?? 0) > 0;
+                                const prevById = new Map(prev.map((p) => [p.id, p]));
+                                return (entry.parts ?? []).some((p) => {
+                                    if (!p?.id)
+                                        return false;
+                                    const prevPart = prevById.get(p.id);
+                                    if (!prevPart)
+                                        return true;
+                                    return (isTextLikePart(p) &&
+                                        isTextLikePart(prevPart) &&
+                                        (p.text?.length ?? 0) > (prevPart.text?.length ?? 0));
+                                });
+                            });
+                }
             }
-        }
-        // Start with all incoming messages
-        for (const m of incoming) {
-            merged.push(m);
-            seen.add(m.id);
-        }
-        // Add any existing messages not in incoming (optimistic or from live SSE).
-        // Optimistic messages go at the end to avoid clock-skew sorting issues;
-        // non-optimistic ones are inserted at their sorted position.
-        const deferredOptimistic = [];
-        const supersededOptimistic = [];
-        /** optimistic id → the incoming message that superseded it. */
-        const supersededBy = new Map();
-        const unmatchedOptimisticUsers = [];
-        for (const m of existing) {
-            if (!seen.has(m.id)) {
-                if (trackedStubIds?.has(m.id)) {
-                    // Placed (or dropped) after the correlation passes below,
-                    // because where it belongs depends on what happened to the
-                    // user message it is parented to.
-                    pendingStubs.push(m);
+            // The echo may arrive under the optimistic message's OWN id: the host
+            // minted the wire id and painted the bubble with it. That is a
+            // confirmation, not a duplicate — release the marks so the message is
+            // ordinary from here (the sweep leaves it alone, real parts win), and
+            // bridge its optimistic parts until real ones land.
+            for (const m of incoming) {
+                if (m.role !== "user" || !isOptimistic(sessionID, m.id))
                     continue;
+                releaseConfirmedOptimisticId(sessionID, m.id, m.id);
+                const optimisticParts = s.parts[m.id];
+                const entry = msgs.find((x) => x.info.id === m.id);
+                if ((entry?.parts?.length ?? 0) === 0 && optimisticParts?.length) {
+                    trackId(bridgedPartIds, sessionID, m.id);
                 }
-                if (isOptimistic(sessionID, m.id)) {
-                    if (m.role !== "user") {
-                        deferredOptimistic.push(m);
+            }
+            // Pass 0 — candidate echoes. A real user message we have NEVER seen
+            // before may be the server's copy of something still in flight. One we
+            // already held is history, and history cannot supersede the present.
+            // This single condition is what fixes the reported bug.
+            const candidateEchoes = incoming.filter((m) => m.role === "user" &&
+                !isOptimistic(sessionID, m.id) &&
+                !existingIds.has(m.id));
+            const unclaimedEchoes = new Set(candidateEchoes.map((m) => m.id));
+            // Pass 1 — exact correlation by part id. Hosts generate the text part
+            // id up front and send it WITH the prompt precisely so the echo
+            // updates the same part, which makes this an identity match rather
+            // than a guess.
+            const echoByPartId = new Map();
+            for (const echo of candidateEchoes) {
+                const entry = msgs.find((m) => m.info.id === echo.id);
+                for (const p of entry?.parts ?? []) {
+                    if (p?.id)
+                        echoByPartId.set(p.id, echo.id);
+                }
+            }
+            // Start with all incoming messages
+            for (const m of incoming) {
+                merged.push(m);
+                seen.add(m.id);
+            }
+            // Add any existing messages not in incoming (optimistic or from live SSE).
+            // Optimistic messages go at the end to avoid clock-skew sorting issues;
+            // non-optimistic ones are inserted at their sorted position.
+            const deferredOptimistic = [];
+            const supersededOptimistic = [];
+            /** optimistic id → the incoming message that superseded it. */
+            const supersededBy = new Map();
+            const unmatchedOptimisticUsers = [];
+            for (const m of existing) {
+                if (!seen.has(m.id)) {
+                    if (trackedStubIds?.has(m.id)) {
+                        // Placed (or dropped) after the correlation passes below,
+                        // because where it belongs depends on what happened to the
+                        // user message it is parented to.
+                        pendingStubs.push(m);
                         continue;
                     }
-                    const echoId = (s.parts[m.id] ?? [])
-                        .map((p) => echoByPartId.get(p.id))
-                        .find((id) => !!id);
-                    if (echoId) {
-                        supersededOptimistic.push(m.id);
-                        supersededBy.set(m.id, echoId);
-                        unclaimedEchoes.delete(echoId);
+                    if (isOptimistic(sessionID, m.id)) {
+                        if (m.role !== "user") {
+                            deferredOptimistic.push(m);
+                            continue;
+                        }
+                        const echoId = (s.parts[m.id] ?? [])
+                            .map((p) => echoByPartId.get(p.id))
+                            .find((id) => !!id);
+                        if (echoId) {
+                            supersededOptimistic.push(m.id);
+                            supersededBy.set(m.id, echoId);
+                            unclaimedEchoes.delete(echoId);
+                        }
+                        else {
+                            // Undecided until pass 2 — it may still pair with an
+                            // echo whose parts the server has not persisted yet.
+                            unmatchedOptimisticUsers.push(m);
+                        }
                     }
                     else {
-                        // Undecided until pass 2 — it may still pair with an
-                        // echo whose parts the server has not persisted yet.
-                        unmatchedOptimisticUsers.push(m);
+                        // By TIME, not by a binary index over ids the snapshot never
+                        // ordered that way — see `insertIndexByTime`.
+                        merged.splice(insertIndexByTime(merged, m), 0, m);
                     }
                 }
-                else {
-                    const r = Binary.search(merged, m.id, (x) => x.id);
-                    merged.splice(r.index, 0, m);
-                }
-            }
-        }
-        // Pass 2 — ordinal fallback, for an echo the server accepted but whose
-        // parts have not landed yet (no part ids to match on). Restricted to
-        // DISPATCHED messages: one that has not been POSTed cannot be a
-        // duplicate of anything the server holds, so it is never eligible.
-        // That restriction is what keeps a message sent from another tab from
-        // consuming this tab's in-flight bubble.
-        const claimed = new Set();
-        for (const m of unmatchedOptimisticUsers) {
-            // Alias first: the inbox row announced this message's echo id.
-            const alias = optimisticEchoes.get(sessionID)?.get(m.id);
-            if (alias && unclaimedEchoes.has(alias) && !claimed.has(alias)) {
-                claimed.add(alias);
-                supersededOptimistic.push(m.id);
-                supersededBy.set(m.id, alias);
             }
-        }
-        const claimable = candidateEchoes.filter((m) => unclaimedEchoes.has(m.id) && !claimed.has(m.id));
-        let next = 0;
-        for (const m of unmatchedOptimisticUsers) {
-            if (supersededBy.has(m.id))
-                continue;
-            const echo = isDispatched(sessionID, m.id) &&
-                // Known-different echo → never consume someone else's.
-                !optimisticEchoes.get(sessionID)?.get(m.id)
-                ? claimable[next]
-                : undefined;
-            if (echo) {
-                next += 1;
-                supersededOptimistic.push(m.id);
-                supersededBy.set(m.id, echo.id);
+            // Pass 2 — ordinal fallback, for an echo the server accepted but whose
+            // parts have not landed yet (no part ids to match on). Restricted to
+            // DISPATCHED messages: one that has not been POSTed cannot be a
+            // duplicate of anything the server holds, so it is never eligible.
+            // That restriction is what keeps a message sent from another tab from
+            // consuming this tab's in-flight bubble.
+            const claimed = new Set();
+            for (const m of unmatchedOptimisticUsers) {
+                // Alias first: the inbox row announced this message's echo id.
+                const alias = optimisticEchoes.get(sessionID)?.get(m.id);
+                if (alias && unclaimedEchoes.has(alias) && !claimed.has(alias)) {
+                    claimed.add(alias);
+                    supersededOptimistic.push(m.id);
+                    supersededBy.set(m.id, alias);
+                }
             }
-            else {
-                deferredOptimistic.push(m);
+            const claimable = candidateEchoes.filter((m) => unclaimedEchoes.has(m.id) && !claimed.has(m.id));
+            let next = 0;
+            for (const m of unmatchedOptimisticUsers) {
+                if (supersededBy.has(m.id))
+                    continue;
+                const echo = isDispatched(sessionID, m.id) &&
+                    // Known-different echo → never consume someone else's.
+                    !optimisticEchoes.get(sessionID)?.get(m.id)
+                    ? claimable[next]
+                    : undefined;
+                if (echo) {
+                    next += 1;
+                    supersededOptimistic.push(m.id);
+                    supersededBy.set(m.id, echo.id);
+                }
+                else {
+                    deferredOptimistic.push(m);
+                }
             }
-        }
-        // Clean up superseded optimistic IDs, remembering which runtime id
-        // each one became.
-        for (const id of supersededOptimistic) {
-            const echoId = supersededBy.get(id);
-            if (echoId) {
-                releaseConfirmedOptimisticId(sessionID, id, echoId);
-                recordOptimisticEcho(sessionID, id, echoId);
+            // Clean up superseded optimistic IDs, remembering which runtime id
+            // each one became.
+            for (const id of supersededOptimistic) {
+                const echoId = supersededBy.get(id);
+                if (echoId) {
+                    releaseConfirmedOptimisticId(sessionID, id, echoId);
+                    recordOptimisticEcho(sessionID, id, echoId);
+                }
+                else {
+                    releaseOptimisticId(sessionID, id);
+                }
             }
-            else {
-                releaseOptimisticId(sessionID, id);
+            // Append surviving optimistic messages at the end
+            for (const m of deferredOptimistic) {
+                merged.push(m);
             }
-        }
-        // Append surviving optimistic messages at the end
-        for (const m of deferredOptimistic) {
-            merged.push(m);
-        }
-        // Now place (or retire) each `session.error` stub, with its turn
-        // finally settled. Three outcomes, in order:
-        //
-        //  - its user message was superseded by the server's own copy in this
-        //    snapshot → the stub follows it, re-keyed onto the real id;
-        //  - the server now holds a real assistant message for that turn →
-        //    the stub was a stand-in for exactly that message, so it goes;
-        //  - otherwise → it stays, directly after its user message. This is
-        //    the case the reported bug turned on: the `reconcileTail` that
-        //    every `session.error` triggers returns a transcript with NO
-        //    reply for the failed turn, and dropping the stub there left the
-        //    user staring at their own prompt and nothing else.
-        for (const stub of pendingStubs) {
-            const trackedParent = trackedStubIds?.get(stub.id) ?? null;
-            const parentId = (trackedParent && supersededBy.get(trackedParent)) || trackedParent;
-            untrackStub(sessionID, stub.id);
-            // The server DOES hold a reply for this turn — the stub stood in
-            // for exactly that message, so it goes. Its error moves onto the
-            // real message first, unless the server's copy carries one of its
-            // own: `session.error` is the runtime's report of THIS turn
-            // failing, and the transcript read that follows it does not always
-            // carry the failure back (the same race
-            // `use-opencode-events`'s cache patch exists for). Dropping the
-            // stub against an error-free server copy would erase the only
-            // evidence the turn failed.
-            if (hasAssistantForTurn(incoming, parentId)) {
-                const replyIdx = merged.findIndex((m) => m.role === "assistant" &&
-                    !isStubShaped(m.id) &&
-                    (!parentId || m.parentID === parentId || (!m.parentID && m.id > parentId)));
-                const reply = replyIdx === -1 ? undefined : merged[replyIdx];
-                const stubError = stub.error;
-                if (reply && !reply.error && stubError) {
-                    merged[replyIdx] = { ...reply, error: stubError };
+            // Now place (or retire) each `session.error` stub, with its turn
+            // finally settled. Three outcomes, in order:
+            //
+            //  - its user message was superseded by the server's own copy in this
+            //    snapshot → the stub follows it, re-keyed onto the real id;
+            //  - the server now holds a real assistant message for that turn →
+            //    the stub was a stand-in for exactly that message, so it goes;
+            //  - otherwise → it stays, directly after its user message. This is
+            //    the case the reported bug turned on: the `reconcileTail` that
+            //    every `session.error` triggers returns a transcript with NO
+            //    reply for the failed turn, and dropping the stub there left the
+            //    user staring at their own prompt and nothing else.
+            for (const stub of pendingStubs) {
+                const trackedParent = trackedStubIds?.get(stub.id) ?? null;
+                const parentId = (trackedParent && supersededBy.get(trackedParent)) || trackedParent;
+                untrackStub(sessionID, stub.id);
+                // The server DOES hold a reply for this turn — the stub stood in
+                // for exactly that message, so it goes. Its error moves onto the
+                // real message first, unless the server's copy carries one of its
+                // own: `session.error` is the runtime's report of THIS turn
+                // failing, and the transcript read that follows it does not always
+                // carry the failure back (the same race
+                // `use-opencode-events`'s cache patch exists for). Dropping the
+                // stub against an error-free server copy would erase the only
+                // evidence the turn failed.
+                if (hasAssistantForTurn(incoming, parentId)) {
+                    const replyIdx = findAssistantForTurn(merged, parentId);
+                    const reply = replyIdx === -1 ? undefined : merged[replyIdx];
+                    const stubError = stub.error;
+                    if (reply && !reply.error && stubError) {
+                        merged[replyIdx] = { ...reply, error: stubError };
+                    }
+                    continue;
+                }
+                const stubId = parentId ? stubIdFor(parentId) : stub.id;
+                const placed = stubId === stub.id && stub.parentID === (parentId ?? undefined)
+                    ? stub
+                    : { ...stub, id: stubId, ...(parentId ? { parentID: parentId } : {}) };
+                trackStub(sessionID, stubId, parentId);
+                const parentIdx = parentId ? merged.findIndex((m) => m.id === parentId) : -1;
+                if (parentIdx !== -1) {
+                    merged.splice(parentIdx + 1, 0, placed);
+                    continue;
+                }
+                // Its user message is not in the transcript at all. Linear on a
+                // miss so a re-keyed stub never lands twice (`stubIdFor(parentId)`
+                // can name a stub already merged), and by time otherwise — a stub
+                // carries no `time`, so it goes last.
+                if (indexOfId(merged, placed.id, (x) => x.id) === -1) {
+                    merged.splice(insertIndexByTime(merged, placed), 0, placed);
                 }
-                continue;
-            }
-            const stubId = parentId ? stubIdFor(parentId) : stub.id;
-            const placed = stubId === stub.id && stub.parentID === (parentId ?? undefined)
-                ? stub
-                : { ...stub, id: stubId, ...(parentId ? { parentID: parentId } : {}) };
-            trackStub(sessionID, stubId, parentId);
-            const parentIdx = parentId ? merged.findIndex((m) => m.id === parentId) : -1;
-            if (parentIdx !== -1) {
-                merged.splice(parentIdx + 1, 0, placed);
-                continue;
             }
-            const r = Binary.search(merged, placed.id, (x) => x.id);
-            if (!r.found)
-                merged.splice(r.index, 0, placed);
-        }
-        // Merge parts: for each message, reconcile by part ID.
-        // If a message is optimistic (still in optimisticIds), keep existing
-        // parts entirely — they're from the client and shouldn't be overwritten.
-        // Otherwise, incoming parts win (server is authoritative), but keep
-        // any extra parts from SSE that aren't in the fetch response.
-        const newParts = { ...s.parts };
-        if (droppedPhantoms)
-            for (const id of droppedPhantoms)
+            // Merge parts: for each message, reconcile by part ID.
+            // If a message is optimistic (still in optimisticIds), keep existing
+            // parts entirely — they're from the client and shouldn't be overwritten.
+            // Otherwise, incoming parts win (server is authoritative), but keep
+            // any extra parts from SSE that aren't in the fetch response.
+            const newParts = { ...s.parts };
+            if (droppedPhantoms)
+                for (const id of droppedPhantoms)
+                    delete newParts[id];
+            // When superseding an optimistic user message, bridge its parts to
+            // the real user message ID if the server hasn't sent parts yet.
+            // Mirrors the message.updated SSE handler (see above) — without
+            // this, a fetch/hydrate that races ahead of parts persistence
+            // would drop the user's text and render an empty bubble.
+            // Bridge along the pairing established above, not to "whichever real
+            // user message came first". With more than one message in flight the
+            // first-match version could graft one message's text onto another's
+            // bubble; `supersededBy` names the exact echo each optimistic message
+            // lost to.
+            for (const id of supersededOptimistic) {
+                const echoId = supersededBy.get(id);
+                const bridge = newParts[id];
                 delete newParts[id];
-        // When superseding an optimistic user message, bridge its parts to
-        // the real user message ID if the server hasn't sent parts yet.
-        // Mirrors the message.updated SSE handler (see above) — without
-        // this, a fetch/hydrate that races ahead of parts persistence
-        // would drop the user's text and render an empty bubble.
-        // Bridge along the pairing established above, not to "whichever real
-        // user message came first". With more than one message in flight the
-        // first-match version could graft one message's text onto another's
-        // bubble; `supersededBy` names the exact echo each optimistic message
-        // lost to.
-        for (const id of supersededOptimistic) {
-            const echoId = supersededBy.get(id);
-            const bridge = newParts[id];
-            delete newParts[id];
-            if (!echoId || !bridge?.length)
-                continue;
-            const echoEntry = msgs.find((m) => m.info.id === echoId);
-            const serverHasParts = (echoEntry?.parts?.length ?? 0) > 0;
-            if (serverHasParts || newParts[echoId]?.length)
-                continue;
-            newParts[echoId] = bridge;
-            trackId(bridgedPartIds, sessionID, echoId);
-        }
-        for (const m of msgs) {
-            if (!m?.info?.id)
-                continue;
-            const mid = m.info.id;
-            if (isOptimistic(sessionID, mid))
-                continue; // Don't touch optimistic parts
-            const inParts = m.parts
-                .filter((p) => !!p?.id)
-                .sort((a, b) => cmp(a.id, b.id));
-            // If this message still carries bridged optimistic parts, a hydrate
-            // snapshot with real parts should replace them immediately. Otherwise
-            // reconcile-by-extras can keep both copies and duplicate user text.
-            if (hasTrackedId(bridgedPartIds, sessionID, mid) && inParts.length > 0) {
-                untrackId(bridgedPartIds, sessionID, mid);
-                newParts[mid] = inParts;
-                continue;
-            }
-            const exParts = newParts[mid];
-            if (!exParts || exParts.length === 0) {
-                newParts[mid] = inParts;
-                continue;
+                if (!echoId || !bridge?.length)
+                    continue;
+                const echoEntry = msgs.find((m) => m.info.id === echoId);
+                const serverHasParts = (echoEntry?.parts?.length ?? 0) > 0;
+                if (serverHasParts || newParts[echoId]?.length)
+                    continue;
+                newParts[echoId] = bridge;
+                trackId(bridgedPartIds, sessionID, echoId);
             }
-            // Reconcile by key: incoming parts are generally authoritative,
-            // but for text/reasoning parts during active streaming, SSE-accumulated
-            // parts may have MORE content than the server snapshot (the
-            // server may return empty/stale text for in-progress parts).
-            // In that case, prefer the existing (SSE) version.
-            const exById = new Map(exParts.map((p) => [p.id, p]));
-            const inIds = new Set(inParts.map((p) => p.id));
-            const extras = exParts.filter((p) => !inIds.has(p.id));
-            const reconciled = inParts.map((inP) => {
-                const exP = exById.get(inP.id);
-                if (!exP)
+            for (const m of msgs) {
+                if (!m?.info?.id)
+                    continue;
+                const mid = m.info.id;
+                if (isOptimistic(sessionID, mid))
+                    continue; // Don't touch optimistic parts
+                // Parts, not messages: this sort is untouched by the message-order
+                // work and keeps its own byte-order comparison.
+                const inParts = m.parts
+                    .filter((p) => !!p?.id)
+                    .sort((a, b) => (a.id < b.id ? -1 : a.id > b.id ? 1 : 0));
+                // If this message still carries bridged optimistic parts, a hydrate
+                // snapshot with real parts should replace them immediately. Otherwise
+                // reconcile-by-extras can keep both copies and duplicate user text.
+                if (hasTrackedId(bridgedPartIds, sessionID, mid) && inParts.length > 0) {
+                    untrackId(bridgedPartIds, sessionID, mid);
+                    newParts[mid] = inParts;
+                    continue;
+                }
+                const exParts = newParts[mid];
+                if (!exParts || exParts.length === 0) {
+                    newParts[mid] = inParts;
+                    continue;
+                }
+                // Reconcile by key: incoming parts are generally authoritative,
+                // but for text/reasoning parts during active streaming, SSE-accumulated
+                // parts may have MORE content than the server snapshot (the
+                // server may return empty/stale text for in-progress parts).
+                // In that case, prefer the existing (SSE) version.
+                const exById = new Map(exParts.map((p) => [p.id, p]));
+                const inIds = new Set(inParts.map((p) => p.id));
+                const extras = exParts.filter((p) => !inIds.has(p.id));
+                const reconciled = inParts.map((inP) => {
+                    const exP = exById.get(inP.id);
+                    if (!exP)
+                        return inP;
+                    // For text/reasoning parts: prefer whichever has more text content.
+                    // This prevents hydrate from clobbering SSE-streamed content
+                    // with an empty/stale server snapshot during active streaming.
+                    if (isTextLikePart(inP) &&
+                        isTextLikePart(exP) &&
+                        exP.text.length > inP.text.length) {
+                        return exP;
+                    }
                     return inP;
-                // For text/reasoning parts: prefer whichever has more text content.
-                // This prevents hydrate from clobbering SSE-streamed content
-                // with an empty/stale server snapshot during active streaming.
-                if (isTextLikePart(inP) &&
-                    isTextLikePart(exP) &&
-                    exP.text.length > inP.text.length) {
-                    return exP;
+                });
+                // T16 — dedupe extras by content identity. An "extra" is an
+                // existing part whose id the incoming snapshot no longer has — the
+                // server may simply not have persisted it yet (kept, as before), OR
+                // the server RE-ISSUED the same content under a NEW part id (a real
+                // defect: the old SSE-accumulated twin stayed in `exParts` forever,
+                // duplicating the text inside this one message). Distinguish the two
+                // conservatively: drop an extra only when it is text-like AND its own
+                // accumulated text is a PREFIX of (or equal to) some incoming
+                // text-like part of the SAME type — i.e. the incoming copy confidently
+                // re-issues it, not merely resembles it. Non-text-like extras (tool,
+                // permission, file, step, …) are never dropped by content — they carry
+                // distinct identity per id and a coincidental text match doesn't apply
+                // to them at all.
+                //
+                // F1 review finding: an extra still tracked in `deltaActiveParts` (this
+                // session is actively applying deltas to it right now) is EXEMPT from
+                // this filter regardless of what it prefixes. The heuristic above
+                // assumes a text-prefix match means the server re-issued the SAME
+                // content under a new id and the extra is an abandoned twin — but a
+                // live streaming target is never abandoned, and dropping it here also
+                // permanently blocks its later deltas (their event ids would already
+                // be recorded as applied — see `applyPartDelta`'s not-found path).
+                const survivingExtras = extras.filter((extra) => {
+                    if (hasTrackedId(deltaActiveParts, sessionID, extra.id))
+                        return true;
+                    if (!isTextLikePart(extra) || extra.text.length === 0)
+                        return true;
+                    return !inParts.some((inP) => inP.type === extra.type &&
+                        isTextLikePart(inP) &&
+                        inP.text.startsWith(extra.text));
+                });
+                for (const ep of survivingExtras) {
+                    const r = Binary.search(reconciled, ep.id, (p) => p.id);
+                    if (!r.found)
+                        reconciled.splice(r.index, 0, ep);
                 }
-                return inP;
-            });
-            // T16 — dedupe extras by content identity. An "extra" is an
-            // existing part whose id the incoming snapshot no longer has — the
-            // server may simply not have persisted it yet (kept, as before), OR
-            // the server RE-ISSUED the same content under a NEW part id (a real
-            // defect: the old SSE-accumulated twin stayed in `exParts` forever,
-            // duplicating the text inside this one message). Distinguish the two
-            // conservatively: drop an extra only when it is text-like AND its own
-            // accumulated text is a PREFIX of (or equal to) some incoming
-            // text-like part of the SAME type — i.e. the incoming copy confidently
-            // re-issues it, not merely resembles it. Non-text-like extras (tool,
-            // permission, file, step, …) are never dropped by content — they carry
-            // distinct identity per id and a coincidental text match doesn't apply
-            // to them at all.
-            //
-            // F1 review finding: an extra still tracked in `deltaActiveParts` (this
-            // session is actively applying deltas to it right now) is EXEMPT from
-            // this filter regardless of what it prefixes. The heuristic above
-            // assumes a text-prefix match means the server re-issued the SAME
-            // content under a new id and the extra is an abandoned twin — but a
-            // live streaming target is never abandoned, and dropping it here also
-            // permanently blocks its later deltas (their event ids would already
-            // be recorded as applied — see `applyPartDelta`'s not-found path).
-            const survivingExtras = extras.filter((extra) => {
-                if (hasTrackedId(deltaActiveParts, sessionID, extra.id))
-                    return true;
-                if (!isTextLikePart(extra) || extra.text.length === 0)
-                    return true;
-                return !inParts.some((inP) => inP.type === extra.type &&
-                    isTextLikePart(inP) &&
-                    inP.text.startsWith(extra.text));
-            });
-            for (const ep of survivingExtras) {
-                const r = Binary.search(reconciled, ep.id, (p) => p.id);
-                if (!r.found)
-                    reconciled.splice(r.index, 0, ep);
+                newParts[mid] = reconciled;
             }
-            newParts[mid] = reconciled;
-        }
-        return {
-            messages: { ...s.messages, [sessionID]: merged },
-            parts: newParts,
-        };
-    }),
+            return {
+                messages: { ...s.messages, [sessionID]: merged },
+                parts: newParts,
+            };
+        });
+        // Outside the updater: `noteSessionActivity` runs its own set(), and the
+        // stamp is quantized there. This is the evidence `projectWorking`'s
+        // content-first rule needs to outrank a stale wire idle frame whose veto
+        // would otherwise silence every fresh `/turn` read for the rest of a turn
+        // the SSE stream stopped reporting (prod, 2026-08-26).
+        if (stampRuntimeActivity)
+            get().noteSessionActivity(sessionID);
+    },
     reset: () => {
         optimisticIds.clear();
         dispatchedOptimisticIds.clear();
@@ -1463,6 +1704,9 @@ export const useSyncStore = create()((set, get) => ({
             messages: {},
             parts: {},
             sessionStatus: {},
+            sessionStatusOrigin: {},
+            sessionStatusAt: {},
+            sessionActivityAt: {},
             diffs: {},
             todos: {},
             sessionRevert: {},
@@ -1491,6 +1735,12 @@ export const useSyncStore = create()((set, get) => ({
         const store = get();
         switch (event.type) {
             case "message.updated": {
+                {
+                    const info = event.properties?.info;
+                    const sid = info?.sessionID ?? event.properties?.sessionID;
+                    if (sid)
+                        get().noteSessionActivity(sid);
+                }
                 const info = event.properties.info;
                 if (!info?.sessionID)
                     return;
@@ -1589,14 +1839,17 @@ export const useSyncStore = create()((set, get) => ({
                                 const list = s.messages[info.sessionID] ?? [];
                                 // Remove all optimistic user messages
                                 const without = list.filter((m) => !optIds.includes(m.id));
-                                // Insert the real message at sorted position
-                                const r = Binary.search(without, info.id, (m) => m.id);
+                                // Place the real message. Linear on a miss, then by TIME: a
+                                // false miss spliced a SECOND copy of a message already in
+                                // the transcript, at a binary index that means nothing on a
+                                // list the server never ordered by id.
+                                const at = indexOfId(without, info.id, (m) => m.id);
                                 let next = [...without];
-                                if (r.found) {
-                                    next[r.index] = info;
+                                if (at !== -1) {
+                                    next[at] = info;
                                 }
                                 else {
-                                    next.splice(r.index, 0, info);
+                                    next.splice(insertIndexByTime(next, info), 0, info);
                                 }
                                 // A turn that failed before this confirmation arrived
                                 // has a `session.error` stub keyed to the optimistic id
@@ -1645,6 +1898,14 @@ export const useSyncStore = create()((set, get) => ({
                 const part = event.properties.part;
                 if (!part?.messageID)
                     return;
+                // The runtime just produced output. This is the evidence
+                // `projectWorking` trusts above every observer — see
+                // `sessionActivityAt`.
+                {
+                    const sid = part.sessionID ?? event.properties?.sessionID;
+                    if (sid)
+                        get().noteSessionActivity(sid);
+                }
                 const eventSessionID = event.properties?.sessionID;
                 let resolvedSessionID = part.sessionID ?? eventSessionID;
                 if (!resolvedSessionID) {
@@ -1659,9 +1920,10 @@ export const useSyncStore = create()((set, get) => ({
                 const existingMsgs = resolvedSessionID
                     ? get().messages[resolvedSessionID]
                     : undefined;
-                const bsResult = existingMsgs && Binary.search(existingMsgs, part.messageID, (m) => m.id);
-                const exists = existingMsgs && ((bsResult && bsResult.found && existingMsgs[bsResult.index]?.id === part.messageID) ||
-                    existingMsgs.some((m) => m.id === part.messageID));
+                // The `.some()` alone is authoritative; the binary search that used
+                // to sit beside it as a first disjunct could only agree with it or
+                // miss on a list that is not id-sorted.
+                const exists = existingMsgs?.some((m) => m.id === part.messageID);
                 if (!exists && resolvedSessionID) {
                     store.upsertMessage(resolvedSessionID, {
                         id: part.messageID,
@@ -1746,13 +2008,13 @@ export const useSyncStore = create()((set, get) => ({
             case "session.status": {
                 const props = event.properties;
                 if (props.sessionID && props.status)
-                    store.setStatus(props.sessionID, props.status);
+                    store.setStatus(props.sessionID, props.status, syntheticEventOrigin(event));
                 return;
             }
             case "session.idle": {
                 const sessionID = event.properties.sessionID;
                 if (sessionID)
-                    store.setStatus(sessionID, { type: "idle" });
+                    store.setStatus(sessionID, { type: "idle" }, syntheticEventOrigin(event));
                 // Streaming finished for THIS session — clear only its own delta
                 // tracking so future message.part.updated snapshots for it are
                 // accepted normally. Never the whole map: another session may
@@ -1772,8 +2034,23 @@ export const useSyncStore = create()((set, get) => ({
                     return;
                 const sid = props.sessionID;
                 const error = props.error;
-                // Mark session idle — errors terminate the response.
-                store.setStatus(sid, { type: "idle" });
+                // Most errors terminate the response. A RETRYABLE one does not:
+                // OpenCode stamps `data.isRetryable === true` and keeps writing the
+                // SAME assistant message, and apps/api reaches the same conclusion
+                // from this same event (`isTerminalTurnEnd`,
+                // apps/api/src/projects/sandbox-deadline-policy.ts:295). Writing
+                // `idle` here made a live turn byte-identical to a finished one, and
+                // `endedByRuntime` (core/session/working.ts) then vetoed the still-open
+                // ledger row with no time bound — the Stop button disappeared mid-turn
+                // and the partial answer read as complete.
+                //
+                // The status slot is LEFT ALONE rather than set to `retry`: the frame
+                // already there is the runtime's own last word, and overwriting it
+                // would re-stamp its arrival time and restart every freshness window
+                // that depends on it.
+                if (!isRetryableTurnError(error)) {
+                    store.setStatus(sid, { type: "idle" }, syntheticEventOrigin(event));
+                }
                 // Clear only this session's delta tracking — see the idle handler
                 // above and the comment above deltaActiveParts.
                 deltaActiveParts.delete(sid);
@@ -1871,7 +2148,10 @@ export const useSyncStore = create()((set, get) => ({
                 if (props.sessionID && props.messageID) {
                     const tracked = get().sessionRevert[props.sessionID];
                     if (tracked) {
-                        store.applyCommittedRevert(props.sessionID, props.messageID, tracked.watermark);
+                        // The captured set only describes the boundary it was staged for.
+                        // A `.committed` naming a different one falls back to the legacy
+                        // range rather than deleting the wrong trajectory.
+                        store.applyCommittedRevert(props.sessionID, props.messageID, tracked.watermark, tracked.messageId === props.messageID ? tracked.hiddenIds : undefined);
                     }
                     else {
                         // F2 — no tracked local record (fresh mount / second tab that