dsh-cindy-host 0.1.36 → 0.1.37

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.1.37 — 2026-11-06
+
+- Use explicit source-order history snapshots for both validated persistence and the hot fallback reader. Preserve legacy raw order, reconcile live reasoning through native history-live client identities, and page by source cuts; unknown cursors now fail explicitly rather than silently skipping history.
+- Fold raw thinking pushes only for the subscribed controller that successfully received a current history page. Reset this disposable state on read/send failure and lifecycle changes, preserve pending-read trailing refreshes, and fence replies against stale relay generations.
+- Coalesce interim reasoning at 1s with latest-wins deduplication and serialized UTF-8 budgets (32 KiB/s, 64 KiB burst/snapshot). Bound automatic preview ranges to 5 rows/6 KiB without truncating full details or delaying terminal retirement. These are Host-side safeguards, not handset white-screen acceptance or proof that every device's failure is resolved.
+
 ## 0.1.36 — 2026-11-06
 
 - Project proven native interruption identities and timestamp tuples consistently into session list/get, boundaries and reconnect updates. Clear non-pending/hidden/running presentation without fabricating transcript-clear or completion facts.

package/README.md

@@ -4,12 +4,12 @@ A Host-side adapter connecting current Cindy clients to DeepSeek Harness.
 
 ## Requirements and installation
 
-Version **0.1.36** adds native interruption banner/status metadata, owner-scoped interruption acknowledgement and error dismissal, and guarded manual continuation with verified native plan-mode off. It retains the earlier safe diagnostics, question synchronization, authentication, reasoning streaming and native capability subsets.
+Version **0.1.37** stabilizes source-order history pagination, per-controller history delivery state and bounded interim reasoning updates. It retains 0.1.36's interruption controls and the earlier diagnostics, question synchronization, authentication and native capability subsets. Host regressions do not establish that handset white-screen issues are resolved.
 
 It supports the exact **DSH 0.2.2-alpha.2** carrier, while retaining `0.2.1-rc.3`, `0.2.1-rc.4` and `0.2.1-rc.5`. Alpha requires **Node.js >=24.9** (tested with 24.12); the older carriers retain this plugin's Node.js >=22.16 minimum. Agent/session/settings peers and alpha Schemastery are explicitly allowed, not a blanket promise for future prereleases. The full Web installation gate uses DSH **0.2.1-rc.5**; alpha core-contract checks do not establish alpha Web/relay/handset acceptance. Install through the Desktop DSH plugin manager. CLI-managed profiles can use:
 
 ```sh
-dsh plugin --profile <profile> add dsh-cindy-host@0.1.36
+dsh plugin --profile <profile> add dsh-cindy-host@0.1.37
 ```
 
 Reload the Host plugin after installation. A full DSH restart is separate. Keep existing Cindy sign-in, device identity and settings; do not run two Host processes with the same identity.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-cindy-host",
-  "version": "0.1.36",
+  "version": "0.1.37",
   "private": false,
   "description": "Cindy 手机客户端连接 DSH 的 Host 侧插件：会话/消息/审批/todo/goal 的手机通道，以及配套的设置卡片",
   "license": "MIT",

package/src/cindy-message-row.js

@@ -286,7 +286,7 @@ const RENDERABLE_SOURCE_KINDS = new Set(['user', 'model', 'tool']);
  *   user turn — the `clientId` the controller minted for the prompt.
  * @returns one row per renderable content block, in order.
  */
-export function toCindyMessageRows(message, { sessionId, createdAt, now = () => new Date(), promptClientId = null }) {
+export function toCindyMessageRows(message, { sessionId, createdAt, now = () => new Date(), promptClientId = null, reasoningIdentity = null }) {
   const rows = [];
   // Canonical DSH results use a tool-role message with root outcome/call ID,
   // not the legacy user-role nested tool-result block. Keep both formats.
@@ -372,7 +372,12 @@ export function toCindyMessageRows(message, { sessionId, createdAt, now = () =>
         if (typeof block.text !== 'string' || block.text === '') return;
         // Thinking is a structured native role on both Cindy clients. Unlike
         // ordinary prose, a string here is discarded by mobile normalizeThinking.
-        rows.push({ ...base, content: { text: block.text } });
+        // Native history-live refs resolve by clientId after the durable id replaces the live id.
+        const identity = reasoningIdentity;
+        const logical = Number.isSafeInteger(identity?.turn) && identity.turn >= 0
+          && Number.isSafeInteger(identity?.step) && identity.step >= 0
+          ? `${sessionId}:reasoning-stream:${identity.turn}:${identity.step}:${index}` : clientId;
+        rows.push({ ...base, clientId: logical, content: { text: block.text } });
         return;
       case 'tool-call':
         rows.push({
@@ -437,6 +442,7 @@ export function toCindyMessages(messages, { sessionId, now = () => new Date() })
     createdAt: entry.createdAt,
     now,
     promptClientId: entry.promptClientId ?? null,
+    reasoningIdentity: entry.reasoningIdentity ?? null,
   }));
   const rows = [];
   for (const group of perMessage.reverse()) rows.push(...group);

package/src/dsh-input-delivery.js

@@ -1,5 +1,5 @@
 import { createAttachmentMaterializer, hostAttachmentsOf } from './host-attachments.js';
-import { foldSessionEvent } from './dsh-message-fold.js';
+import { historySnapshotFromEvents } from './dsh-message-fold.js';
 import { interruptedTurnClosers } from '@deepseek-ai/dsh-session';
 import { turnStateFromEvents } from './turn-error.js';
 import { continuationKind } from './continuation-protocol.js';
@@ -57,7 +57,14 @@ export function createDshInputDeliveryBackend({getServices,sessionController,get
       // session or agent must never be diagnosed as a crashed writer.
       const cold=!s.sessions.get(sid)&&typeof s.agents?.get==='function'&&!s.agents.get(sid);
       const events=cold?[...persisted,...interruptedTurnClosers(persisted)]:persisted;
-      const rows=[];for(const event of events){const folded=foldSessionEvent(event,{sessionId:sid});folded.forEach((row,index)=>{const rowid=event.seq*65536+index;if(!Number.isSafeInteger(rowid))throw deliveryError('DELIVERY_EVIDENCE_CORRUPT','Message order exceeds the safe protocol range');rows.push({...row,rowid});});}return rows.reverse();},
+      // Preserve the raw newest-first order/rowid contract while including the same
+      // public live overlay as history. Receipt evidence still reads the native log only.
+      return historySnapshotFromEvents(events, sid, { rowids: true }).rows.reverse();},
+    async historySnapshot(sid) {
+      const persisted = await readLog(sid); const s = services();
+      const cold = !s.sessions.get(sid) && typeof s.agents?.get === 'function' && !s.agents.get(sid);
+      return historySnapshotFromEvents(cold ? [...persisted, ...interruptedTurnClosers(persisted)] : persisted, sid);
+    },
     async evidence(sid){const events=await readLog(sid);const proof=durableInputEvidence(events,sid);const agent=getServices().agents?.get(sid);return {...proof,running:agent?.status==='running',live:agent!==undefined};},
     async prepare(sid,row,{resolveAttachmentRef,mode='queue'}={}){
       assertNoStructuredSessionReferences(row);

package/src/dsh-message-fold.js

@@ -16,7 +16,7 @@
  * history, and model requests all share, so a second copy here would drift.
  */
 import { deriveEventMessage, isAppendSurfaceEvent } from '@deepseek-ai/dsh-session/surface';
-import { createReasoningStream } from './reasoning-stream.js';
+import { createHistoryProjection } from './history-snapshot.js';
 import { turnDiagnosticRow, turnStateFromEvents } from './turn-error.js';
 import { advanceInterruptionMetadata } from './diagnostic-presentation.js';
 import { toCindyMessageRows, toCindyMessages, hydrateImageAttachments } from './cindy-message-row.js';
@@ -107,7 +107,8 @@ export function foldSessionEvent(event, { sessionId, now = () => new Date() }) {
   const createdAt = Number.isFinite(event.time) ? new Date(event.time).toISOString() : now().toISOString();
   // The controller's own id for a submitted prompt travels with the row so it
   // can retire the copy it showed optimistically.
-  return toCindyMessageRows(message, { sessionId, createdAt, now, promptClientId: promptRpcIdOf(event) });
+  return toCindyMessageRows(message, { sessionId, createdAt, now, promptClientId: promptRpcIdOf(event),
+    reasoningIdentity: event.type === 'assistant/message' ? event.data : null });
 }
 
 /** The `source` a message carries, whichever shape the surface handed over. */
@@ -291,6 +292,18 @@ function widenNewestPage(options) {
   return { ...options, limit: NEWEST_WINDOW_ROWS };
 }
 
+/** Shared public display fold; never changes input delivery evidence. */
+export function displayEventRows(event, context) {
+  const todo = entryForTodoWrite(event);
+  return todo ? toCindyMessageRows(todo.message, { ...context, createdAt: todo.createdAt }) : foldSessionEvent(event, context);
+}
+
+export function historySnapshotFromEvents(events, sessionId, options = {}) {
+  const projection = createHistoryProjection(sessionId);
+  for (const event of events) projection.consume(event, displayEventRows(event, { sessionId }));
+  return projection.snapshot(options);
+}
+
 /**
  * Render one DSH `todo/write` snapshot as the row the phone draws its plan card from.
  *
@@ -377,53 +390,25 @@ export function createMessageReader({
   const seeding = new Map();
   let clock = 0;
 
-  /** Fold one session's log into message entries, in log order. */
+  /** One fold feeds both the legacy raw order and the explicit history snapshot. */
   async function entriesFor(sessionId) {
     const snapshot = await readSessionLog(sessionId);
     const events = Array.isArray(snapshot?.events) ? snapshot.events : [];
     const entries = [];
-    const reasoning = createReasoningStream(sessionId);
+    const history = createHistoryProjection(sessionId);
     let lastSeq = null;
     let nativeMetadata = null;
     let nativeValid = true;
     for (const event of events) {
       if (event === null || typeof event !== 'object') continue;
-      // Every event's seq counts, not only the ones that render: contiguity is a
-      // property of the log, and a caller comparing against renders would read a
-      // gap as "nothing happened here".
       if (!Number.isSafeInteger(event.seq) || event.seq < 0 || (lastSeq !== null && event.seq !== lastSeq + 1)) nativeValid = false;
       if (Number.isFinite(event.seq)) lastSeq = event.seq;
       nativeMetadata = advanceInterruptionMetadata(nativeMetadata, event, sessionId);
-      reasoning.consume(event);
-      const diagnostic = turnDiagnosticRow(event, sessionId);
-      if (diagnostic) {
-        entries.push({ rows: [diagnostic] });
-        continue;
-      }
-      const todo = entryForTodoWrite(event);
-      if (todo !== null) {
-        entries.push(todo);
-        continue;
-      }
-      if (!isAppendSurfaceEvent(event)) continue;
-      let message;
-      try {
-        message = deriveEventMessage(event);
-      } catch {
-        // One unprojectable event must not cost the whole transcript; the same
-        // rule the surface fold applies per node.
-        continue;
-      }
-      if (message === null || message === undefined) continue;
-      entries.push({
-        message,
-        createdAt: Number.isFinite(event.time) ? new Date(event.time).toISOString() : now().toISOString(),
-        // Same reason as the live fold: the durable read has to identify a user
-        // turn by the id the controller minted, or its optimistic copy survives.
-        promptClientId: promptRpcIdOf(event),
-      });
+      const rows = displayEventRows(event, { sessionId, now });
+      history.consume(event, rows);
+      if (rows.length) entries.push({ rows });
     }
-    return { entries, lastSeq, reasoning, nativeValid, nativeMetadata: nativeValid ? nativeMetadata : null };
+    return { entries, lastSeq, history, reasoning: history.reasoning, nativeValid, nativeMetadata: nativeValid ? nativeMetadata : null };
   }
 
   /** Drop the least recently used transcripts, keeping the window bounded. */
@@ -503,9 +488,9 @@ export function createMessageReader({
         // invalidation also detaches this flight so a post-invalidation read starts
         // fresh; an older completion must never overwrite that newer generation.
         if (seeding.get(sessionId) === flight && !flight.dirty) {
-          touch(sessionId, { rows, reasoning: read.reasoning, seq: read.lastSeq, at: clock, nativeValid: read.nativeValid, nativeMetadata: read.nativeMetadata });
+          touch(sessionId, { rows, history: read.history, reasoning: read.reasoning, seq: read.lastSeq, at: clock, nativeValid: read.nativeValid, nativeMetadata: read.nativeMetadata });
         }
-        return transcripts.get(sessionId) ?? { rows, reasoning: read.reasoning, nativeMetadata: read.nativeMetadata };
+        return transcripts.get(sessionId) ?? { rows, history: read.history, reasoning: read.reasoning, nativeMetadata: read.nativeMetadata };
       } finally {
         // Failure is not an authoritative empty transcript. Release this flight
         // on success or rejection, without deleting a newer read's ownership.
@@ -560,7 +545,7 @@ export function createMessageReader({
     if (entry.nativeValid !== false) entry.nativeMetadata = advanceInterruptionMetadata(entry.nativeMetadata, event, sessionId);
     entry.seq = seq;
     entry.at = ++clock;
-    entry.reasoning.consume(event);
+    // The history projection owns the raw overlay reducer too.
     // A live todo snapshot becomes the same `TodoWrite` row the durable read produces, so
     // the phone's plan card updates while the plan is being worked rather than only when
     // the transcript is re-read.
@@ -568,6 +553,7 @@ export function createMessageReader({
     const rows = todoEntry === null
       ? foldSessionEvent(event, { sessionId, now })
       : toCindyMessageRows(todoEntry.message, { sessionId, createdAt: todoEntry.createdAt, now });
+    entry.history.consume(event, rows);
     // Newest first: this event is the newest thing in the log, so its rows are the
     // new head of the array, in block order.
     if (rows.length > 0) entry.rows = [...rows, ...entry.rows];
@@ -615,6 +601,7 @@ export function createMessageReader({
    * The array is the cache's own, so callers treat it as read-only.
    */
   readMessages.all = async (sessionId) => visibleRows(await ensureTranscript(sessionId));
+  readMessages.historySnapshot = async (sessionId) => (await ensureTranscript(sessionId)).history.snapshot();
   // Recovery deliberately bypasses the transcript cache: stale history cannot
   // decide whether the *current* turn has ended. Runtime generation guards the read.
   readMessages.turnState = async (sessionId) => {

package/src/dsh-plugin.js

@@ -687,9 +687,9 @@ export function buildDshSource(ctx, serviceName, options = {}) {
      * The work-grouped history window the controller prefers once it has seen
      * `history-view-v1`.
      *
-     * Grouping runs over the same cached transcript the raw window pages
-     * (`readMessages.all`), so the two views can never disagree about what the session
-     * contains — and neither of them re-reads the log to answer.
+     * History consumes an explicit source-order snapshot, not the raw window's legacy
+     * array order. Prefer the flushed/validated durable backend when available; the
+     * fallback reader shares its cached fold and reasoning reducer with its raw window.
      */
     const deliveryServices = { sessions: undefined, persistence: undefined, agents: undefined };
     ctx.inject(['sessions', 'sessionPersistence', 'agents'], deliveryCtx => {
@@ -709,7 +709,11 @@ export function buildDshSource(ctx, serviceName, options = {}) {
     const historyView = readMessages === undefined
       ? undefined
       : createHistoryViewController({
-        rows: committedRows,
+        snapshot: async (sessionId) => {
+          const snapshot = await (inputDeliveryBackend.available()
+            ? inputDeliveryBackend.historySnapshot(sessionId) : readMessages.historySnapshot(sessionId));
+          return { ...snapshot, rows: options.projectMessages?.(snapshot.rows) ?? snapshot.rows };
+        },
         // The turn state has to be **wired** here; the controller's own default is `() => false`.
         // That default is why a running turn was never marked `isStreaming`, which cost two things
         // at once and looked like a client problem both times: the phone drew no live card, and

package/src/history-delivery-state.js

@@ -0,0 +1,32 @@
+/** Disposable transport state, scoped to an accepted controller and its subscription lease. */
+export function createHistoryDeliveryState(canWatch) {
+  const controllers = new Map();
+  function forget(deviceId, sessionId) {
+    if (sessionId === undefined) controllers.delete(deviceId);
+    else { const sessions = controllers.get(deviceId); sessions?.delete(sessionId); if (!sessions?.size) controllers.delete(deviceId); }
+  }
+  function ready(deviceId, sessionId) {
+    if (!canWatch(deviceId, sessionId)) { forget(deviceId, sessionId); return false; }
+    return controllers.get(deviceId)?.get(sessionId)?.ready === true;
+  }
+  function begin(frame) {
+    if (frame.payload?.channel !== 'local-db:messages:view') return null;
+    const sessionId = frame.payload.args?.[0];
+    if (typeof sessionId !== 'string' || !canWatch(frame.src, sessionId)) return null;
+    const sessions = controllers.get(frame.src) ?? new Map();
+    const latest = !(typeof frame.payload.args?.[1]?.before === 'string' && frame.payload.args[1].before !== '');
+    const token = { deviceId: frame.src, sessionId, latest, dirty: false,
+      ready: !latest && sessions.get(sessionId)?.ready === true };
+    sessions.set(sessionId, token); controllers.set(frame.src, sessions);
+    return token;
+  }
+  function finish(token, success) {
+    if (!token || controllers.get(token.deviceId)?.get(token.sessionId) !== token) return false;
+    if (!success || !canWatch(token.deviceId, token.sessionId)) { forget(token.deviceId, token.sessionId); return false; }
+    if (token.latest) token.ready = true;
+    const dirty = token.dirty; token.dirty = false;
+    return dirty;
+  }
+  function changed(sessionId) { for (const sessions of controllers.values()) { const state = sessions.get(sessionId); if (state) state.dirty = true; } }
+  return { ready, begin, finish, changed, forget, clear: () => controllers.clear() };
+}

package/src/history-snapshot.js

@@ -0,0 +1,58 @@
+import { createReasoningStream } from './reasoning-stream.js';
+
+/** Internal source-order projection. Cut metadata/retired bodies stay local; raw rowid is an existing wire field. */
+export function createHistoryProjection(sessionId) {
+  const reasoning = createReasoningStream(sessionId);
+  const stored = new Map();
+  const retired = new Map();
+  let ordinal = 0;
+  let liveBase = 0;
+  let scope = null;
+  let live = [];
+  const compare = (a, b) => a[0] - b[0] || a[1] - b[1];
+
+  function consume(event, rows = []) {
+    const position = ordinal++;
+    const before = live;
+    reasoning.consume(event);
+    const entries = reasoning.entries();
+    const nextScope = entries[0]?.scope ?? null;
+    if (entries.length && scope !== nextScope) liveBase = position;
+    scope = nextScope;
+    live = entries.map(({ row, index }) => ({ row, position: [liveBase, index] }));
+    const current = new Set(live.map(entry => entry.row.clientId));
+    for (const entry of before) {
+      if (!current.has(entry.row.clientId)) retired.set(entry.row.clientId, entry.position);
+    }
+    rows.forEach((row, index) => stored.set(row.id, { row, position: [position, index] }));
+  }
+
+  function snapshot({ rowids = false } = {}) {
+    const entries = [...stored.values(), ...live].sort((a, b) => compare(a.position, b.position));
+    const rows = entries.map(entry => {
+      if (!rowids) return entry.row;
+      const rowid = entry.position[0] * 65536 + entry.position[1];
+      if (!Number.isSafeInteger(rowid) || entry.position[1] >= 65536) throw Object.assign(new Error('Message order exceeds the safe protocol range'), { code: 'DELIVERY_EVIDENCE_CORRUPT' });
+      return { ...entry.row, rowid };
+    });
+    const ids = new Map();
+    rows.forEach((row, index) => {
+      ids.set(row.id, index);
+      if (row.role === 'thinking') {
+        ids.set(`history-live:${row.clientId}`, index);
+        // Pre-upgrade reasoning-stream IDs are the logical clientId itself.
+        ids.set(row.clientId, index);
+      }
+    });
+    const retiredCuts = new Map(retired);
+    return { rows, resolve(id, { cut = false } = {}) {
+      if (ids.has(id)) return ids.get(id);
+      const key = typeof id === 'string' && id.startsWith('history-live:') ? id.slice(13) : id;
+      const position = cut ? retiredCuts.get(key) : undefined;
+      if (!position) return -1;
+      const index = entries.findIndex(entry => compare(entry.position, position) >= 0);
+      return index < 0 ? rows.length : index;
+    } };
+  }
+  return { consume, snapshot, reasoning };
+}

package/src/host-history-view-limits.js

@@ -1,12 +1,11 @@
 /**
- * The history view's page budgets, mirrored from the Cindy contract.
+ * Conservative Host page budgets within the Cindy v1 contract.
  *
  * Stated here rather than imported because this Host composes the protocol over the wire,
- * not the package: `@cindy/maker-shared/message-window` publishes
- * `HISTORY_VIEW_PAGE_ITEMS = 20`, `HISTORY_VIEW_PAGE_BYTES = 256 * 1024`,
- * `HISTORY_DETAIL_PAGE_BYTES = 256 * 1024`, and `HISTORY_VIEW_VERSION = 1`. A change on
- * the Cindy side shows up as a failing test here instead of a page the phone silently
- * truncates.
+ * not the package. The current Cindy v1 view ceiling is 1 MiB, with 20 items and
+ * a 256 KiB detail page. This Host deliberately keeps its view budget at 256 KiB;
+ * a smaller service budget is compatible and avoids increasing mobile load. These
+ * values are Host budgets, not an assertion that all current upstream limits match.
  */
 
 /** Items one `local-db:messages:view` page may carry. */

package/src/host-history-view.js

@@ -29,8 +29,8 @@
  *  - `intent` replaces the set of expanded work keys wholesale; it is advisory.
  *  - An error whose text matches `isHistoryViewUnavailable` sends the controller back to
  *    the raw window. `UNSUPPORTED_CAPABILITY` is therefore how this Host *deliberately*
- *    declines a session it cannot project (a transcript past the scan budget) — the same
- *    lever the reference uses.
+ *    declines an unavailable projection capability, never a large or stale session.
+ *    Per-session missing references use retryable NOT_FOUND/BAD_REQUEST instead.
  *
  * Grouping here is by **DSH turn boundary as the controller can see it**: a row whose role
  * is `user` starts a work group, and everything up to the next one belongs to it. The
@@ -129,8 +129,8 @@ function isActivityRow(row) {
  *   default) derives it: a transcript that does not end in an answer is still being written.
  * @returns items in **chronological** order, oldest first.
  */
-export function groupHistoryItems(rows, { running = null, maxWorkRows = WORK_ITEM_MAX_ROWS } = {}) {
-  const chronological = [...rows].reverse();
+export function groupHistoryItems(rows, { running = null, maxWorkRows = WORK_ITEM_MAX_ROWS, chronological: inSourceOrder = false } = {}) {
+  const chronological = inSourceOrder ? rows : [...rows].reverse();
   const items = [];
   let run = [];
 
@@ -159,6 +159,7 @@ export function groupHistoryItems(rows, { running = null, maxWorkRows = WORK_ITE
 
 /** Rows of the live tail a streaming work item shows without being expanded. */
 export const WORK_PREVIEW_ROWS = 5;
+export const WORK_PREVIEW_BYTES = 6 * 1024;
 
 /**
  * One work item for a run of activity rows.
@@ -190,8 +191,14 @@ function workItem(run, streaming) {
   // streaming group. Without it, folding activity into work items meant a long turn showed
   // nothing but a spinner: measured, the phone sat on 「一直在思考中转圈」 for minutes while
   // this Host pushed 100+ rows that were all inside a collapsed group.
-  if (streaming && run.length > 0) {
-    const tail = run.slice(Math.max(0, run.length - WORK_PREVIEW_ROWS));
+  const tail = [];
+  let previewBytes = 0;
+  if (streaming) for (let index = run.length - 1; index >= 0 && tail.length < WORK_PREVIEW_ROWS; index -= 1) {
+    const size = itemBytes(run[index]);
+    if (previewBytes + size > WORK_PREVIEW_BYTES) break;
+    tail.unshift(run[index]); previewBytes += size;
+  }
+  if (tail.length > 0) {
     const previewFirst = tail[0];
     const previewLast = tail[tail.length - 1];
     summary.preview = {
@@ -222,13 +229,15 @@ function itemBytes(item) {
 /**
  * Build the reader behind the three view channels.
  *
- * @param options - `rows` (the transcript reader's whole-transcript accessor),
+ * @param options - `snapshot` (explicit source-order rows and reference resolver),
+ *   or `rows` for legacy callers with a strictly newest-first array,
  *   `sessionRunning` (whether the session is in a turn right now, for `isStreaming`),
  *   and the page/scan limits.
  * @returns `{ page, details, intent, expandedFor }`.
  */
 export function createHistoryViewController({
   rows,
+  snapshot,
   sessionRunning = () => false,
   pageItems = HISTORY_PAGE_ITEMS,
   pageBytes = HISTORY_PAGE_BYTES,
@@ -263,16 +272,20 @@ export function createHistoryViewController({
     if (typeof sessionId !== 'string' || sessionId === '') {
       return { ok: false, code: 'BAD_REQUEST', message: 'history view needs a session' };
     }
-    if (typeof rows !== 'function') {
+    if (typeof rows !== 'function' && typeof snapshot !== 'function') {
       return { ok: false, code: 'NOT_AVAILABLE', message: 'this DSH Host cannot project session history' };
     }
     let all;
     try {
-      all = await rows(sessionId);
+      all = typeof snapshot === 'function' ? await snapshot(sessionId) : await rows(sessionId);
     } catch {
       return { ok: false, code: 'NOT_FOUND', message: 'this session has no readable transcript' };
     }
-    if (!Array.isArray(all)) return { ok: false, code: 'INTERNAL', message: 'the transcript could not be read' };
+    if (Array.isArray(all)) {
+      const chronological = [...all].reverse();
+      all = { rows: chronological, resolve: id => chronological.findIndex(row => row.id === id) };
+    }
+    if (!Array.isArray(all?.rows) || typeof all.resolve !== 'function') return { ok: false, code: 'INTERNAL', message: 'the transcript could not be read' };
     // Long transcripts are **served**, not refused.
     //
     // This was `all.length > scanMaxRows → UNSUPPORTED_CAPABILITY`, on the reasoning that the
@@ -293,7 +306,7 @@ export function createHistoryViewController({
     // `UNSUPPORTED_CAPABILITY` and `CHANNEL_NOT_ALLOWED` are therefore reserved for "this Host
     // has no projection capability at all" — a deployment fact — and never for a property of
     // one session. See ADR-0007's decision evolution.
-    return { ok: true, rows: all };
+    return { ok: true, rows: all.rows, resolve: all.resolve };
   }
 
   /**
@@ -304,23 +317,17 @@ export function createHistoryViewController({
   async function page(sessionId, before = undefined) {
     const read = await transcriptFor(sessionId);
     if (read.ok !== true) return read;
-    const items = groupHistoryItems(read.rows, {
-      running: typeof sessionRunning === 'function' ? sessionRunning(sessionId) === true : null,
-    });
-
-    // `before` names a row inside the older part of the transcript: everything at or after
-    // it has already been sent, so the next page starts strictly older than that item.
-    let end = items.length;
+    let endRow = read.rows.length;
     if (typeof before === 'string' && before !== '') {
-      const index = items.findIndex((item) => firstIdOf(item) === before
-        || (item.type === 'work' && item.summary.lastMessageId === before));
-      if (index >= 0) end = index;
-      else {
-        // A cursor this Host cannot place: answer the oldest page we have rather than the
-        // newest one again, which is what re-serving the same rows would amount to.
-        end = Math.min(items.length, pageItems);
-      }
+      endRow = read.resolve(before, { cut: true });
+      if (endRow < 0) return { ok: false, code: 'NOT_FOUND', message: 'history cursor is no longer in this session' };
     }
+    // Cut by source position before grouping: an anchor may now lie inside a merged work.
+    const items = groupHistoryItems(read.rows.slice(0, endRow), {
+      chronological: true,
+      running: !before && (typeof sessionRunning === 'function' ? sessionRunning(sessionId) === true : null),
+    });
+    const end = items.length;
     const selected = [];
     let bytes = 1024;
     for (let index = end - 1; index >= 0; index -= 1) {
@@ -354,16 +361,16 @@ export function createHistoryViewController({
     const firstId = typeof ref?.firstMessageId === 'string' ? ref.firstMessageId : '';
     const lastId = typeof ref?.lastMessageId === 'string' ? ref.lastMessageId : '';
     if (firstId === '' || lastId === '') return { ok: false, code: 'BAD_REQUEST', message: 'a work range needs both endpoints' };
-    // The transcript is newest first; the range is inclusive in log order.
-    const chronological = [...read.rows].reverse();
-    const from = chronological.findIndex((row) => row.id === firstId);
-    const to = chronological.findIndex((row) => row.id === lastId);
+    // Both endpoints and the forward cursor resolve against one source-order snapshot.
+    const chronological = read.rows;
+    const from = read.resolve(firstId);
+    const to = read.resolve(lastId);
     if (from < 0 || to < 0 || to < from) return { ok: false, code: 'NOT_FOUND', message: 'this work range is no longer in the transcript' };
     const range = chronological.slice(from, to + 1);
     let start = 0;
     if (typeof after === 'string' && after !== '') {
-      const index = range.findIndex((row) => row.id === after);
-      if (index < 0) return { ok: false, code: 'BAD_REQUEST', message: 'the detail cursor is outside this work range' };
+      const index = read.resolve(after) - from;
+      if (index < 0 || index >= range.length) return { ok: false, code: 'BAD_REQUEST', message: 'the detail cursor is outside this work range' };
       start = index + 1;
     }
     const messages = [];

package/src/host-version.js

@@ -4,4 +4,4 @@
  */
 export const HOST_APP_VERSION = '0.1.82';
 /** Actual npm release, separate from the Cindy compatibility identity. */
-export const HOST_PLUGIN_VERSION = '0.1.36';
+export const HOST_PLUGIN_VERSION = '0.1.37';

package/src/host.js

@@ -36,6 +36,7 @@ import { SessionReadModel } from './session-read-model.js';
 import { ProjectionReadModelSink } from './projection-read-model-sink.js';
 import { publishLifecycle, runningStatusEvent, turnEventFor } from './session-publisher.js';
 import { createReasoningPublisher } from './reasoning-publisher.js';
+import { createHistoryDeliveryState } from './history-delivery-state.js';
 import { turnDiagnosticRow, turnDiagnosticPayload } from './turn-error.js';
 import { advanceInterruptionMetadata, diagnosticOwner, interruptionFields, projectDismissedErrors } from './diagnostic-presentation.js';
 import { acceptLink } from './host-authorization.js';
@@ -315,6 +316,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   const subscribers = new Set();
   /** Devices following one session's live stream: `sessionId -> Set<deviceId>`. */
   const sessionSubscribers = new Map();
+  const historyDelivery = createHistoryDeliveryState((deviceId, sessionId) =>
+    acceptedControllers.has(deviceId) && policy.canAccept(deviceId) && !sessionIsHidden(sessionId)
+      && sessionSubscribers.get(sessionId)?.has(deviceId) === true);
   /**
    * Sessions a controller has attached to at least once in this process.
    *
@@ -710,7 +714,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   }
 
   function send(frame) {
-    if (ws === null || typeof ws.send !== 'function') return;
+    if (ws === null || typeof ws.send !== 'function' || (ws.readyState !== undefined && ws.readyState !== 1)) return false;
     // The relay **rejects** a frame over `MAX_FRAME_BYTES` outright — it does not
     // truncate it, and the controller waiting on that frame is left until its own
     // deadline. So an oversized frame is refused here, where it is observable, rather
@@ -721,12 +725,14 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       frameRefusals.push({ at: now().toISOString(), kind: typeof frame?.kind === 'string' ? frame.kind : null, bytes });
       if (frameRefusals.length > FRAME_REFUSAL_LOG_LIMIT) frameRefusals.splice(0, frameRefusals.length - FRAME_REFUSAL_LOG_LIMIT);
       frameRefusalTotal += 1;
-      return;
+      return false;
     }
     try {
       ws.send(JSON.stringify(frame));
+      return true;
     } catch {
       // A send that throws belongs to the socket's own error path.
+      return false;
     }
   }
 
@@ -1125,6 +1131,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   function markDeviceUnreachable(deviceId) {
     if (typeof deviceId !== 'string' || deviceId === '') return;
     offlineDevices.add(deviceId);
+    historyDelivery.forget(deviceId);
     for (const sessionId of watchedSessionsByDevice.get(deviceId) ?? []) renewTurnLease(deviceId, sessionId);
   }
 
@@ -1229,6 +1236,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       if (result.ok) {
         directoryEpoch++;
         acceptedControllers.delete(deviceId);
+        historyDelivery.forget(deviceId);
         observeRemindersSource();
         subscribers.delete(deviceId);
         status.removeDevice(deviceId);
@@ -1307,6 +1315,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       if (topic === 'sessions') subscribers.delete(deviceId);
       else if (topic.startsWith('session:')) {
         const sessionId = topic.slice('session:'.length);
+        historyDelivery.forget(deviceId, sessionId);
         renewTurnLease(deviceId, sessionId);
         const devices = sessionSubscribers.get(sessionId);
         if (devices === undefined) continue;
@@ -1318,6 +1327,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
 
   /** Drop every subscription a device holds, on disconnect. */
   function forgetSubscriptions(deviceId) {
+    historyDelivery.forget(deviceId);
     subscribers.delete(deviceId);
     for (const [sessionId, devices] of sessionSubscribers) {
       devices.delete(deviceId);
@@ -1448,9 +1458,14 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   function pushSessionUpdate(sessionId, channel, payload) {
     if (channel === 'maker:input:projection' && activeDelivery) payload = activeDelivery.currentProjection(sessionId, [], payload);
     const guarded = channel === 'local-db:messages:created' || channel === 'maker:event';
+    const thinking = channel === 'local-db:messages:created' && payload?.message?.role === 'thinking';
     const devices = guarded
       ? new Set([...(sessionSubscribers.get(sessionId) ?? [])].filter(id => !sessionIsHidden(sessionId) && acceptedControllers.has(id) && policy.canAccept(id)))
       : sessionSubscribers.get(sessionId);
+    // Only a successfully delivered view opts this controller out of raw thinking.
+    if (thinking && devices) for (const deviceId of devices) {
+      if (historyDelivery.ready(deviceId, sessionId)) devices.delete(deviceId);
+    }
     const watchers = devices === undefined ? 0 : devices.size;
     const reachable = devices === undefined ? 0 : [...devices].filter((deviceId) => !offlineDevices.has(deviceId)).length;
     recordPush(sessionId, channel, reachable, payload);
@@ -1476,6 +1491,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
   const reasoningPublisher = createReasoningPublisher({
     push: pushSessionUpdate, invalidate: pushHistoryViewChanged,
     watched: (sessionId) => watchersFor(sessionId) > 0,
+    rawNeeded: (sessionId) => [...(sessionSubscribers.get(sessionId) ?? [])].some(deviceId =>
+      acceptedControllers.has(deviceId) && policy.canAccept(deviceId) && !historyDelivery.ready(deviceId, sessionId)),
+    now: () => Number(now()),
     setTimeout: setTimeoutImpl, clearTimeout: clearTimeoutImpl,
   });
 
@@ -1485,6 +1503,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
    */
   function pushHistoryViewChanged(sessionId) {
     if (typeof sessionId !== 'string' || sessionId === '') return;
+    historyDelivery.changed(sessionId);
     if (watchersFor(sessionId) === 0) return;
     if (historyViewPushes.has(sessionId)) return;
     const timer = setTimeoutImpl(() => {
@@ -2052,6 +2071,9 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       (channel, count, payload) => recordPush(sessionId, channel, count, payload));
   }
   function publishSessionMeta(sessionId, patch) {
+    if (patch?.clearedAt !== undefined || patch?.status === 'deleted' || patch?.status === 'archived') {
+      for (const deviceId of sessionSubscribers.get(sessionId) ?? []) historyDelivery.forget(deviceId, sessionId);
+    }
     publishRowPatch(sessionId, { ...patch, updatedAt: now().toISOString() });
   }
 
@@ -2491,6 +2513,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
       case 'link-open': {
         if (typeof frame.id !== 'string' || typeof frame.src !== 'string') return;
         if (!policy.canAccept(frame.src)) return;
+        historyDelivery.forget(frame.src);
         for (const sessionId of watchedSessionsByDevice.get(frame.src) ?? []) renewTurnLease(frame.src, sessionId);
         // A link-open is itself proof the relay has a route to this device.
         markDeviceReachable(frame.src);
@@ -2521,6 +2544,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         for (const sessionId of watchedSessionsByDevice.get(frame.src) ?? []) renewTurnLease(frame.src, sessionId);
         filePeer.closePeer(frame.src);
         acceptedControllers.delete(frame.src);
+        historyDelivery.forget(frame.src);
         observeRemindersSource();
         status.upsertDevice(frame.src, { isController: false });
         status.refreshConnectionState();
@@ -2553,18 +2577,28 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
         // Listing-only controllers never send `link-open`; an invoke is itself
         // proof that the phone reached this Host, so it links the device too.
         if (!acceptedControllers.has(frame.src)) linkController(frame.src);
+        const historyRead = historyDelivery.begin(frame);
+        const invokeGeneration = generation;
+        const invokeSocket = ws;
         void handleInvoke(frame).then(
           (reply) => {
             // `null` means the request was unaddressable; the relay guard above
             // already rejects those, so this only defends the invariant.
-            if (reply === null) return;
+            if (reply === null || invokeGeneration !== generation || invokeSocket !== ws) {
+              historyDelivery.finish(historyRead, false); return;
+            }
             // Fitting and sending are Host code on a reply that ultimately came from DSH, so
             // they are exactly where an unexpected shape would surface — and a throw from
             // inside a `.then` callback is an unhandled rejection, which this process treats
             // as fatal. The controller still needs an answer, so it gets one.
             try {
-              send(fitReplyToFrame(reply, frame));
+              const fitted = fitReplyToFrame(reply, frame);
+              const sent = send(fitted);
+              const page = fitted?.payload?.result;
+              const complete = sent && fitted?.payload?.ok === true && page?.version === 1 && Array.isArray(page.items);
+              if (historyDelivery.finish(historyRead, complete)) pushHistoryViewChanged(historyRead.sessionId);
             } catch (error) {
+              historyDelivery.finish(historyRead, false);
               recordHandlerError('invoke-reply', error);
               send({
                 v: PROTOCOL_VERSION,
@@ -2579,6 +2613,8 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
             // Named with the channel: seven identical `TimeoutError`s in the diagnostics after one
             // restart were unattributable, and "which read is missing its budget" is the whole
             // question. `frame.payload.channel` is the only thing that answers it.
+            historyDelivery.finish(historyRead, false);
+            if (invokeGeneration !== generation || invokeSocket !== ws) return;
             recordHandlerError(`invoke:${typeof frame?.payload?.channel === 'string' ? frame.payload.channel : '?'}`, error);
             send({ v: PROTOCOL_VERSION, kind: 'invoke-result', id: frame.id, dst: frame.src, payload: { ok: false, error: { code: 'INTERNAL', message: 'DSH Host failed to serve this channel' } } });
           },
@@ -2741,6 +2777,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     // would push to a link that is gone.
     clearHistoryViewPushes();
     reasoningPublisher.clear();
+    historyDelivery.clear();
     acceptedControllers.clear();
     subscribers.clear();
     sessionSubscribers.clear();
@@ -2810,6 +2847,7 @@ export async function startHost(initialSource, settings = DEFAULT_HOST_SETTINGS,
     // to have moved them. `replace` never writes back — see `session-flags.js`.
     sessionFlags.replace(next?.sessionFlags);
     policy.update(next);
+    historyDelivery.clear();
     observeRemindersSource();
     filePeer.pruneUnauthorized();
     fileExports.pruneUnauthorized();

package/src/reasoning-publisher.js

@@ -1,8 +1,16 @@
+import { createHash } from 'node:crypto';
 import { createReasoningStream } from './reasoning-stream.js';
 
-/** Coalesce token-sized updates; a final message synchronously retires its preview. */
-export function createReasoningPublisher({ push, invalidate, watched,
-  setTimeout: schedule = setTimeout, clearTimeout: cancel = clearTimeout, intervalMs = 100 }) {
+export const REASONING_INTERVAL_MS = 1000;
+export const REASONING_RATE_BYTES = 32 * 1024;
+export const REASONING_BURST_BYTES = 64 * 1024;
+export const REASONING_SNAPSHOT_BYTES = 64 * 1024;
+
+/** Latest-wins interim snapshots. Full bodies remain readable; terminal deletion never waits. */
+export function createReasoningPublisher({ push, invalidate, watched, rawNeeded = watched,
+  setTimeout: schedule = setTimeout, clearTimeout: cancel = clearTimeout, now = Date.now,
+  intervalMs = REASONING_INTERVAL_MS, rateBytes = REASONING_RATE_BYTES,
+  burstBytes = REASONING_BURST_BYTES, maxSnapshotBytes = REASONING_SNAPSHOT_BYTES }) {
   const sessions = new Map();
 
   function drop(sessionId) {
@@ -10,18 +18,42 @@ export function createReasoningPublisher({ push, invalidate, watched,
     if (state?.timer !== null && state?.timer !== undefined) cancel(state.timer);
     sessions.delete(sessionId);
   }
-
+  function later(sessionId, state, delay = intervalMs) {
+    if (state.timer !== null) return;
+    state.timer = schedule(() => flush(sessionId, state), delay);
+    state.timer?.unref?.();
+  }
   function flush(sessionId, state) {
     if (state.timer !== null) cancel(state.timer);
     state.timer = null;
+    if (sessions.get(sessionId) !== state) return;
     if (!watched(sessionId)) { drop(sessionId); return; }
     const ids = new Set(state.rows.map(row => row.clientId));
     const removed = [...state.known].filter(id => !ids.has(id));
-    if (removed.length > 0) push(sessionId, 'local-db:messages:deleted', { sessionId, clientIds: removed });
-    for (const message of state.rows) push(sessionId, 'local-db:messages:created', { sessionId, message });
+    if (removed.length) push(sessionId, 'local-db:messages:deleted', { sessionId, clientIds: removed });
+    for (const id of removed) state.sent.delete(id);
     state.known = ids;
+    const clock = now();
+    state.tokens = Math.min(burstBytes, state.tokens + Math.max(0, clock - state.tokenAt) * rateBytes / 1000);
+    state.tokenAt = clock;
+    let retryMs = 0;
+    if (rawNeeded(sessionId)) for (const message of state.rows) {
+      const payload = { sessionId, message };
+      const serialized = JSON.stringify(payload);
+      const stamp = createHash('sha256').update(serialized).digest('hex');
+      if (state.sent.get(message.clientId) === stamp) continue;
+      const bytes = Buffer.byteLength(serialized, 'utf8');
+      // Do not cut an interim prefix and label it full content. A page/explicit details
+      // (or the durable final row) owns delivery of unusually large reasoning bodies.
+      if (bytes > maxSnapshotBytes || bytes > burstBytes) continue;
+      if (bytes > state.tokens) { retryMs = Math.max(retryMs, Math.ceil((bytes - state.tokens) * 1000 / rateBytes)); continue; }
+      push(sessionId, 'local-db:messages:created', payload);
+      state.tokens -= bytes;
+      state.sent.set(message.clientId, stamp);
+    }
     invalidate(sessionId);
-    if (state.rows.length === 0) drop(sessionId);
+    if (!state.rows.length) drop(sessionId);
+    else if (retryMs > 0) later(sessionId, state, Math.max(intervalMs, retryMs));
   }
 
   function noteEvent(sessionId, event, cached = {}) {
@@ -29,25 +61,20 @@ export function createReasoningPublisher({ push, invalidate, watched,
     let state = sessions.get(sessionId);
     if (!state) {
       if (event?.type !== 'assistant/chunk' && !(cached.before?.length > 0)) return;
-      state = { stream: createReasoningStream(sessionId), rows: [], known: new Set(), timer: null };
+      state = { stream: createReasoningStream(sessionId), rows: [], known: new Set(), sent: new Map(),
+        timer: null, tokens: burstBytes, tokenAt: now() };
       sessions.set(sessionId, state);
     }
-    // A controller can open the session mid-block and read its preview before this
-    // publisher sees any chunks. Include those cached identities when retiring it.
     for (const row of cached.before ?? []) state.known.add(row.clientId);
     const changed = state.stream.consume(event);
     const next = cached.after ?? state.stream.rows();
-    if (!changed && next.length === 0 && state.known.size === 0) { drop(sessionId); return; }
-    if (!changed && event?.type !== 'assistant/message' && event?.type !== 'turn/end' && event?.type !== 'step/end') return;
+    if (!changed && !next.length && !state.known.size) { drop(sessionId); return; }
+    if (!changed && !['assistant/message', 'turn/end', 'step/end'].includes(event?.type)) return;
     state.rows = next;
     const immediate = event?.type !== 'assistant/chunk' || event.data?.chunk?.type === 'block-end';
     if (immediate) flush(sessionId, state);
-    else if (state.timer === null) {
-      state.timer = schedule(() => flush(sessionId, state), intervalMs);
-      state.timer?.unref?.();
-    }
+    else later(sessionId, state);
   }
-
   function clear() { for (const sessionId of sessions.keys()) drop(sessionId); }
   return { noteEvent, clear };
 }

package/src/reasoning-stream.js

@@ -44,15 +44,16 @@ export function createReasoningStream(sessionId) {
     return isDelta || isEnd;
   }
 
-  function rows() {
-    return [...blocks].flatMap(([index, block]) => {
+  function entries() {
+    return [...blocks].sort(([a], [b]) => a - b).flatMap(([index, block]) => {
       const content = block.chunks.join('');
       if (!content) return [];
-      const id = `${sessionId}:reasoning-stream:${key}:${index}`;
-      return [{ id, clientId: id, sessionId, role: 'thinking', content: { text: content, isStreaming: block.isStreaming },
-        toolUseId: null, agentMeta: null, createdAt: block.createdAt, isStreaming: block.isStreaming }];
+      const clientId = `${sessionId}:reasoning-stream:${key}:${index}`;
+      return [{ scope: key, index, row: { id: `history-live:${clientId}`, clientId, sessionId, role: 'thinking', content: { text: content, isStreaming: block.isStreaming },
+        toolUseId: null, agentMeta: null, createdAt: block.createdAt, isStreaming: block.isStreaming } }];
     });
   }
 
-  return { consume, rows, clear };
+  const rows = () => entries().map(entry => entry.row);
+  return { consume, rows, entries, clear };
 }