dsh-cindy-host 0.1.34 → 0.1.35

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.35 — 2026-11-05
+
+- Show distinct native interruption, cancellation, sign-out, output-limit and blocked-turn notices without inventing model failures. Keep explicit native scheduled/started retries nonterminal, with safe known-code/count/delay details and stable live/history identities.
+- Match native cold-query diagnostic recovery only when both the native session and Agent are absent. Apply display-only interrupted-turn closers without changing stored events, receipt evidence or live tool outcomes; restore notices before terminal envelopes under the existing authorization and generation guards.
+- Render canonical tool-role results alongside legacy nested results, preserving call pairing, output and error/unknown-outcome markers. Extend Host diagnostic regressions and the opt-in actual mobile contract; source tests are not handset or arbitrary desktop-UI parity certification.
+
 ## 0.1.34 — 2026-11-05
 
 - Project durable native failed turns as stable, sanitized error rows and terminal maker events in both cold history and live delivery. Preserve native failure/retry ownership, expose only fixed known-code messages and validated HTTP status, and repair reconnect state without stopping newer turns or leaking provider diagnostics.

package/README.md

@@ -4,12 +4,12 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.34** improves native/phone question synchronization and cancellation, and safely displays durable model/turn failures. It retains 0.1.33's regional authentication UI, public reasoning streaming and native capability subsets.
+Version **0.1.35** adds native interruption, cancellation, output-limit and retry notices, cold-session diagnostic recovery and canonical tool-result pairing. It retains 0.1.34's question synchronization and safe model-failure display, plus the earlier regional authentication, reasoning streaming and native capability subsets.
 
 It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.34
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.35
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.34",
+  "version": "0.1.35",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",

package/src/cindy-message-row.js

@@ -288,12 +288,22 @@ const RENDERABLE_SOURCE_KINDS = new Set(['user', 'model', 'tool']);
  */
 export function toCindyMessageRows(message, { sessionId, createdAt, now = () => new Date(), promptClientId = null }) {
   const rows = [];
+  // Canonical DSH results use a tool-role message with root outcome/call ID,
+  // not the legacy user-role nested tool-result block. Keep both formats.
+  if (message?.role === 'tool') {
+    if (message.source?.kind !== undefined && message.source.kind !== 'tool') return rows;
+    if (typeof message.toolCallId !== 'string' || !message.toolCallId) return rows;
+    const id = `${sessionId}:${message.id}:0`;
+    return [{ id, clientId: id, sessionId, role: 'tool_result', toolUseId: message.toolCallId, agentMeta: null,
+      createdAt: createdAt ?? now().toISOString(),
+      content: { text: flattenToolResult(message.content), isError: message.isError === true } }];
+  }
   const role = ROW_ROLE_BY_MESSAGE_ROLE.get(message?.role);
   // `system` (the prompt injection), a hook's injected turn, or any role this
   // Host has never seen: none of them is something a participant said.
   if (role === undefined) return rows;
   const blocks = Array.isArray(message?.content) ? message.content : [];
-  // DSH records a tool result as a `user`-role message whose source is
+  // Older DSH messages record a tool result as a `user`-role message whose source is
   // `{kind: 'tool'}`. Its content block is what makes it a result row; a *text*
   // block on such a message is not the user speaking, so it is not rendered as
   // one.

package/src/dsh-input-delivery.js

@@ -1,5 +1,6 @@
 import { createAttachmentMaterializer, hostAttachmentsOf } from './host-attachments.js';
 import { foldSessionEvent } from './dsh-message-fold.js';
+import { interruptedTurnClosers } from '@deepseek-ai/dsh-session';
 import { queuedRowFromController } from './host-input-queue.js';
 import { deliveryError } from './host-input-delivery-store.js';
 import { assertNoStructuredSessionReferences } from './session-reference-boundary.js';
@@ -36,7 +37,14 @@ export function createDshInputDeliveryBackend({getServices,sessionController,get
   const backend={
     available(){try{services();return true;}catch{return false;}},
     stop(){active=false;},
-    async readRows(sid){const events=await readLog(sid);const rows=[];for(const event of events){const folded=foldSessionEvent(event,{sessionId:sid});folded.forEach((row,index)=>{const rowid=event.seq*65536+index;if(!Number.isSafeInteger(rowid))throw deliveryError('DELIVERY_EVIDENCE_CORRUPT','Message order exceeds the safe protocol range');rows.push({...row,rowid});});}return rows.reverse();},
+    async readRows(sid){
+      const persisted=await readLog(sid);const s=services();
+      // Match native session-query cold reads. This is a display-only overlay;
+      // evidence()/receipts still read the untouched persisted prefix. A live
+      // session or agent must never be diagnosed as a crashed writer.
+      const cold=!s.sessions.get(sid)&&typeof s.agents?.get==='function'&&!s.agents.get(sid);
+      const events=cold?[...persisted,...interruptedTurnClosers(persisted)]:persisted;
+      const rows=[];for(const event of events){const folded=foldSessionEvent(event,{sessionId:sid});folded.forEach((row,index)=>{const rowid=event.seq*65536+index;if(!Number.isSafeInteger(rowid))throw deliveryError('DELIVERY_EVIDENCE_CORRUPT','Message order exceeds the safe protocol range');rows.push({...row,rowid});});}return rows.reverse();},
     async evidence(sid){const events=await readLog(sid);const proof=durableInputEvidence(events,sid);const agent=getServices().agents?.get(sid);return {...proof,running:agent?.status==='running',live:agent!==undefined};},
     async prepare(sid,row,{resolveAttachmentRef,mode='queue'}={}){
       assertNoStructuredSessionReferences(row);

package/src/dsh-message-fold.js

@@ -17,7 +17,7 @@
  */
 import { deriveEventMessage, isAppendSurfaceEvent } from '@deepseek-ai/dsh-session/surface';
 import { createReasoningStream } from './reasoning-stream.js';
-import { turnErrorRow, turnStateFromEvents } from './turn-error.js';
+import { turnDiagnosticRow, turnStateFromEvents } from './turn-error.js';
 import { toCindyMessageRows, toCindyMessages, hydrateImageAttachments } from './cindy-message-row.js';
 
 /** Default page size when the controller does not ask for one. */
@@ -82,8 +82,8 @@ export const TRANSCRIPT_CACHE_SESSIONS = 3;
  */
 export function foldSessionEvent(event, { sessionId, now = () => new Date() }) {
   if (event === null || typeof event !== 'object') return [];
-  const error = turnErrorRow(event, sessionId);
-  if (error) return [error];
+  const diagnostic = turnDiagnosticRow(event, sessionId);
+  if (diagnostic) return [diagnostic];
   if (!isAppendSurfaceEvent(event)) return [];
   let message;
   try {
@@ -390,9 +390,9 @@ export function createMessageReader({
       // gap as "nothing happened here".
       if (Number.isFinite(event.seq)) lastSeq = event.seq;
       reasoning.consume(event);
-      const error = turnErrorRow(event, sessionId);
-      if (error) {
-        entries.push({ rows: [error] });
+      const diagnostic = turnDiagnosticRow(event, sessionId);
+      if (diagnostic) {
+        entries.push({ rows: [diagnostic] });
         continue;
       }
       const todo = entryForTodoWrite(event);

package/src/dsh-plugin.js

@@ -2033,6 +2033,7 @@ export function apply(ctx, config) {
     // Make the failed history row readable before publishing its terminal identity.
     // Everything above is synchronous, so a new turn cannot interleave here.
     if (event?.type === 'turn/end' && typeof runtime.pushTurnIdle === 'function') runtime.pushTurnIdle(sessionId, event);
+    if (typeof runtime.pushSessionDiagnostic === 'function') runtime.pushSessionDiagnostic(sessionId, event);
     // Chunks are intentionally absent from deriveEventMessage. Publish a temporary
     // thinking overlay too, retiring it before the durable assistant rows below.
     runtime.pushSessionReasoning?.(sessionId, event, {

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.34';
+export const HOST_PLUGIN_VERSION = '0.1.35';

package/src/host.js

@@ -36,7 +36,7 @@ import { SessionReadModel } from './session-read-model.js';
 import { ProjectionReadModelSink } from './projection-read-model-sink.js';
 import { publishLifecycle, runningStatusEvent, turnEventFor } from './session-publisher.js';
 import { createReasoningPublisher } from './reasoning-publisher.js';
-import { turnErrorRow, turnErrorPayload } from './turn-error.js';
+import { turnDiagnosticRow, turnDiagnosticPayload } from './turn-error.js';
 import { acceptLink } from './host-authorization.js';
 import { AuthorizationPolicy } from './authorization-policy.js';
 import { HostStatus } from './host-status.js';
@@ -925,12 +925,18 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   }
 
   /** Send a native terminal identity once per authorized subscription/connection. */
-  function sendNativeTerminal(deviceId, sessionId, payload, identity) {
+  function sendNativeTerminal(deviceId, sessionId, payload, identity, row) {
     if (stopped || !active || !acceptedControllers.has(deviceId) || !policy.canAccept(deviceId) || sessionIsHidden(sessionId)
       || !sessionSubscribers.get(sessionId)?.has(deviceId)) return false;
     const key = terminalAnnounceKey(deviceId, sessionId);
     const stamp = `${generation}:${subscriptionLeases.get(key) ?? 0}:${identity}`;
     if (terminalIdentities.get(key) === stamp) return false;
+    // Reconnect must restore the actual diagnostic, not merely stop a spinner.
+    if (row) {
+      const notice = { sessionId, message: row };
+      recordPush(sessionId, 'local-db:messages:created', offlineDevices.has(deviceId) ? 0 : 1, notice);
+      send({ v: PROTOCOL_VERSION, kind: 'push', dst: deviceId, payload: { channel: 'local-db:messages:created', payload: notice } });
+    }
     recordPush(sessionId, 'maker:event', offlineDevices.has(deviceId) ? 0 : 1, payload);
     send({ v: PROTOCOL_VERSION, kind: 'push', dst: deviceId, payload: { channel: 'maker:event', payload } });
     if (!offlineDevices.has(deviceId)) {
@@ -978,7 +984,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       if (!valid() || !live || typeof live.running !== 'boolean') return;
       if (live.running) {
         setCachedRunning(sessionId, true);
-        const payload = { sessionId, event: runningStatusEvent() };
+        const payload = { sessionId, event: runningStatusEvent(state.retryNotice?.content ?? 'running') };
         recordPush(sessionId, 'maker:event', 1, payload);
         send({ v: PROTOCOL_VERSION, kind: 'push', dst: deviceId, payload: { channel: 'maker:event', payload } });
         return;
@@ -987,8 +993,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       if ((nativeBoundaries.get(sessionId)?.seq ?? -1) > state.boundarySeq) return;
       // No await after the final guard: a new boundary cannot interleave with send.
       setCachedRunning(sessionId, false);
-      const payload = state.error ? turnErrorPayload(state.error) : { sessionId, event: { type: 'done' } };
-      sendNativeTerminal(deviceId, sessionId, payload, `end:${state.boundarySeq}`);
+      const diagnostic = state.error ?? state.notice;
+      const payload = diagnostic ? turnDiagnosticPayload(diagnostic) : { sessionId, event: { type: 'done' } };
+      sendNativeTerminal(deviceId, sessionId, payload, `end:${state.boundarySeq}`, diagnostic);
     } catch {
       if (!valid()) return;
       // Never reflect arbitrary upstream exception prose into remote diagnostics.
@@ -1363,7 +1370,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    */
   function pushSessionUpdate(sessionId, channel, payload) {
     if (channel === 'maker:input:projection' && activeDelivery) payload = activeDelivery.currentProjection(sessionId, [], payload);
-    const guarded = payload?.message?.role === 'error' || payload?.event?.type === 'error';
+    const guarded = channel === 'local-db:messages:created' || channel === 'maker:event';
     const devices = guarded
       ? new Set([...(sessionSubscribers.get(sessionId) ?? [])].filter(id => !sessionIsHidden(sessionId) && acceptedControllers.has(id) && policy.canAccept(id)))
       : sessionSubscribers.get(sessionId);
@@ -1450,7 +1457,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       // nothing, which is the same class of failure as the bug being fixed.)
       const provider = typeof options.resolveCapabilities === 'function' ? options.resolveCapabilities() : undefined;
       const hydrate = provider?.hydrateImages;
-      if (message?.role !== 'error' && typeof hydrate === 'function') await hydrate([message]);
+      if (!['error', 'system'].includes(message?.role) && typeof hydrate === 'function') await hydrate([message]);
     } catch {
       // Un-hydrated is still worth sending.
     }
@@ -1816,16 +1823,16 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       for (const deviceId of sessionSubscribers.get(sessionId) ?? []) void restoreWatchedTurnState(deviceId, sessionId);
       return;
     }
-    const error = turnErrorRow(event, sessionId);
-    const failed = event?.data?.reason?.kind === 'error';
-    if (failed && !error) {
+    const diagnostic = turnDiagnosticRow(event, sessionId);
+    const requiresNotice = diagnostic !== null || ['error', 'interrupted', 'max-tokens', 'aborted', 'blocked'].includes(event?.data?.reason?.kind);
+    if (requiresNotice && !diagnostic) {
       recordHandlerError('turn-error', new Error('Invalid native failed-turn identity; history resynchronization required'));
       pushHistoryViewChanged(sessionId);
       return;
     }
     if (event && Number.isSafeInteger(event.seq)) {
       if ((nativeBoundaries.get(sessionId)?.seq ?? -1) >= event.seq) return;
-      nativeBoundaries.set(sessionId, { seq: event.seq });
+      nativeBoundaries.set(sessionId, { seq: event.seq, turn: event.data?.turn });
     }
     turnVersions.set(sessionId, (turnVersions.get(sessionId) ?? 0) + 1);
     const timer = pendingReconciles.get(sessionId);
@@ -1839,8 +1846,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     // tells it first — and the re-link repair depends on that record meaning "it arrived", so a
     // device the relay calls unreachable must not be written into it.
     const watchers = [...(sessionSubscribers.get(sessionId) ?? [])];
-    if (failed) {
-      const payload = turnErrorPayload(error);
+    if (requiresNotice) {
+      const payload = turnDiagnosticPayload(diagnostic);
       for (const deviceId of watchers) sendNativeTerminal(deviceId, sessionId, payload, `end:${event.seq}`);
       // Error detail never goes to list subscribers or unwatched controllers.
       publishRowTurnState(sessionId, false);
@@ -2000,7 +2007,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   function announceTurnRunning(sessionId, event) {
     if (event && Number.isSafeInteger(event.seq)) {
       if ((nativeBoundaries.get(sessionId)?.seq ?? -1) >= event.seq) return;
-      nativeBoundaries.set(sessionId, { seq: event.seq });
+      nativeBoundaries.set(sessionId, { seq: event.seq, turn: event.data?.turn });
     }
     turnVersions.set(sessionId, (turnVersions.get(sessionId) ?? 0) + 1);
     setCachedRunning(sessionId, true);
@@ -2845,6 +2852,18 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     /** Push one live session message to the controllers watching that session. */
     pushSessionMessage,
     pushSessionReasoning: reasoningPublisher.noteEvent,
+    // Only explicit native scheduled/started retry events assert ongoing work.
+    // Failed attempts alone never terminate or start a turn.
+    pushSessionDiagnostic: (sessionId, event) => {
+      if (!['llm/retry', 'llm/retry-started'].includes(event?.type)) return;
+      const row = turnDiagnosticRow(event, sessionId);
+      const boundary = nativeBoundaries.get(sessionId);
+      if (!row || (boundary?.seq ?? -1) >= event.seq
+        || (boundary?.turn !== undefined && boundary.turn !== event.data?.turn)) return;
+      turnVersions.set(sessionId, (turnVersions.get(sessionId) ?? 0) + 1);
+      setCachedRunning(sessionId, true);
+      pushSessionUpdate(sessionId, 'maker:event', { sessionId, event: runningStatusEvent(row.content) });
+    },
     /**
      * Announce a real turn boundary to a session's watchers.
      *

package/src/turn-error.js

@@ -1,6 +1,8 @@
-/** Display-only projection of a durable failed turn. DSH owns failure and retry policy. */
+/** Display-only native turn diagnostics. DSH owns failure, recovery and retry policy. */
 const SAFE_MESSAGES = new Map([
   ['AUTH', 'Model authentication failed. Check the provider configuration.'],
+  ['ACCOUNT_SIGNED_OUT', '任务已因退出 DeepSeek 登录而停止。'],
+  ['ACCOUNT_SIGN_IN_REQUIRED', '请先登录 DeepSeek，并确认请求地址支持账号认证。'],
   ['MISSING_CREDENTIAL', 'Model credentials are missing. Check the provider configuration.'],
   ['INVALID_CREDENTIAL', 'Model credentials are invalid. Check the provider configuration.'],
   ['RATE_LIMIT', 'The model request was rate limited.'],
@@ -20,16 +22,20 @@ export function turnErrorRow(event, sessionId) {
   if (typeof sessionId !== 'string' || !sessionId || !Number.isSafeInteger(event.seq) || event.seq < 0) return null;
   // No wall-clock fallback: cold replay and live delivery must produce identical rows.
   if (!Number.isFinite(event.time) || !Number.isFinite(new Date(event.time).getTime())) return null;
-  const failure = event.data.reason.error;
+  const content = safeFailureContent(event.data.reason.error);
+  const id = `${sessionId}:turn-error:${event.seq}`;
+  return { id, clientId: id, sessionId, role: 'error', toolUseId: null, agentMeta: null,
+    createdAt: new Date(event.time).toISOString(), content };
+}
+
+/** One safe allowlist for terminal model failures and scheduled retry details. */
+export function safeFailureContent(failure) {
   const code = SAFE_MESSAGES.has(failure?.code) ? failure.code : null;
   const status = Number.isInteger(failure?.status) && failure.status >= 100 && failure.status <= 599 ? failure.status : null;
   const detail = [code, status === null ? null : `HTTP ${status}`].filter(Boolean).join('; ');
   const message = (SAFE_MESSAGES.get(code) ?? 'This turn failed. See the local DSH diagnostics for details.')
     + (detail ? ` (${detail})` : '');
-  const id = `${sessionId}:turn-error:${event.seq}`;
-  return { id, clientId: id, sessionId, role: 'error', toolUseId: null, agentMeta: null,
-    createdAt: new Date(event.time).toISOString(),
-    content: { message, reason: 'dsh-turn-error', ...(code ? { code } : {}), ...(status === null ? {} : { status }) } };
+  return { message, reason: 'dsh-turn-error', ...(code ? { code } : {}), ...(status === null ? {} : { status }) };
 }
 
 /** The maker envelope and the history row share one durable identity. */
@@ -38,10 +44,63 @@ export function turnErrorPayload(row) {
     data: { ...row.content, isTerminal: true, willRetry: false } } };
 }
 
+/** User-visible desktop turn tails, kept separate from model failures. Never
+ * infer an interruption from an ordinary aborted turn or an arbitrary string. */
+export function turnDiagnosticRow(event, sessionId) {
+  const failure = turnErrorRow(event, sessionId);
+  if (failure) return failure;
+  if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || !Number.isFinite(event.time)
+    || !Number.isFinite(new Date(event.time).getTime()) || typeof sessionId !== 'string' || !sessionId) return null;
+  let content;
+  const data = event.data;
+  if (event.type === 'turn/end') {
+    const reason = data?.reason;
+    switch (reason?.kind) {
+      case 'interrupted':
+        content = '任务已停止：DSH 进程在本轮完成前退出（例如被强制结束、崩溃或关闭超时），重新启动后本轮已中止。未完成的工具调用结果未知。';
+        break;
+      case 'max-tokens':
+        content = '已达到输出 token 上限。回答被截断，已有输出保留在对话中。发送“继续”可让模型接着输出。';
+        break;
+      case 'blocked': content = '本轮执行被阻止，未正常完成。原生结束事件未提供更多原因。'; break;
+      case 'aborted':
+        content = reason.reason?.kind === 'hook' && reason.reason.reason === 'deepseek-account/signed-out'
+          ? '任务已因退出 DeepSeek 登录而停止。'
+          : reason.reason?.kind === 'user' ? '任务已停止：用户取消了本轮执行。'
+          : reason.reason?.kind === 'parent' ? '任务已停止：上级任务取消了本轮执行。'
+          : reason.reason?.kind === 'disposed' ? '任务已停止：本轮运行实例已被释放。'
+          : '任务已停止：本轮执行已被取消。';
+        break;
+      default:
+        if (!reason || typeof reason.kind !== 'string' || ['completed', 'forked'].includes(reason.kind)) return null;
+        content = '本轮已结束。当前 Host 尚不能显示此结束原因的详细信息，请在 DSH 桌面查看。';
+        break;
+    }
+  } else if (event.type === 'llm/retry') {
+    if (!['normal', 'always'].includes(data?.mode) || !Number.isSafeInteger(data?.retry) || data.retry < 1 || !Number.isFinite(data.delayMs) || data.delayMs < 0) return null;
+    const maximum = data.mode === 'always' ? '不限' : Number.isSafeInteger(data.maxRetries) && data.maxRetries >= data.retry ? data.maxRetries : null;
+    if (maximum === null) return null;
+    content = `模型请求失败，DSH 已安排重试（${data.retry}/${maximum}），等待 ${Math.max(1, Math.ceil(data.delayMs / 1000))} 秒。${safeFailureContent(data.failure).message}`;
+  } else if (event.type === 'llm/retry-started') {
+    if (!Number.isSafeInteger(data?.retry) || data.retry < 1) return null;
+    content = `DSH 已开始第 ${data.retry} 次模型请求重试。`;
+  } else return null;
+  const id = `${sessionId}:turn-notice:${event.seq}`;
+  return { id, clientId: id, sessionId, role: 'system', toolUseId: null, agentMeta: null,
+    createdAt: new Date(event.time).toISOString(), content };
+}
+
+/** Notices close the running flag without pretending cancellation is a model failure. */
+export function turnDiagnosticPayload(row) {
+  return row.role === 'error' ? turnErrorPayload(row) : { sessionId: row.sessionId, persistId: row.clientId,
+    event: { type: 'done', data: { message: row.content, reason: 'dsh-turn-notice' } } };
+}
+
 /** Latest native turn boundary, not the latest error in an arbitrary history page. */
 export function turnStateFromEvents(events, sessionId) {
   if (!Array.isArray(events)) throw new TypeError('Native turn recovery requires a session event snapshot');
   let boundary = null;
+  let retryNotice = null;
   let seq = -1;
   for (const event of events) {
     if (!Number.isSafeInteger(event?.seq) || event.seq < 0 || event.seq <= seq
@@ -49,12 +108,17 @@ export function turnStateFromEvents(events, sessionId) {
       throw new TypeError('Native turn recovery requires ordered unique event sequences');
     }
     seq = event.seq;
-    if (event.type === 'turn/start' || event.type === 'turn/end') boundary = event;
+    if (event.type === 'turn/start' || event.type === 'turn/end') { boundary = event; retryNotice = null; }
+    else if (['step/start', 'assistant/message'].includes(event.type)) retryNotice = null;
+    else if (boundary?.type === 'turn/start' && boundary.data?.turn === event.data?.turn
+      && ['llm/retry', 'llm/retry-started'].includes(event.type)) retryNotice = turnDiagnosticRow(event, sessionId);
   }
   if (!boundary) return null;
-  if (boundary.type === 'turn/start') return { seq, boundarySeq: boundary.seq, running: true, error: null };
-  const error = turnErrorRow(boundary, sessionId);
+  if (boundary.type === 'turn/start') return { seq, boundarySeq: boundary.seq, running: true, error: null, ...(retryNotice ? { retryNotice } : {}) };
+  const diagnostic = turnDiagnosticRow(boundary, sessionId);
+  const error = diagnostic?.role === 'error' ? diagnostic : null;
   // A malformed failure is not evidence of a successful ending.
   if (boundary.data?.reason?.kind === 'error' && !error) throw new TypeError('Invalid native failed-turn identity');
-  return { seq, boundarySeq: boundary.seq, running: false, error };
+  if (['interrupted', 'max-tokens', 'blocked', 'aborted'].includes(boundary.data?.reason?.kind) && !diagnostic) throw new TypeError('Invalid native turn-notice identity');
+  return { seq, boundarySeq: boundary.seq, running: false, error, ...(diagnostic?.role === 'system' ? { notice: diagnostic } : {}) };
 }