dsh-code 1.0.3 → 1.0.4

package/src/provider-settings.ts

@@ -34,6 +34,21 @@ interface LlmFace {
     readonly settingsPath: readonly string[]
     readonly declared?: boolean
   }[]
+  /**
+   * Registered endpoint model discovery; absent on an older service. The
+   * request is a draft (provider route and/or baseURL, optional one-shot
+   * key); the reply is candidate metadata for adoption, never a write.
+   */
+  discoverModels?(
+    settingsNs: string,
+    request: { readonly provider?: string; readonly baseURL?: string; readonly api?: string; readonly apiKey?: string },
+    signal?: AbortSignal,
+  ): Promise<readonly {
+    readonly id: string
+    readonly name?: string
+    readonly contextWindow?: number
+    readonly maxTokens?: number
+  }[]>
 }
 
 /** One redacted settings descriptor (subset of `SettingsDescriptor`). */
@@ -71,11 +86,19 @@ interface ProviderEventsFace {
   on(event: string, listener: (...args: unknown[]) => void): () => void
 }
 
+/** One resolved credential value; never rendered, never persisted by callers. */
+interface CredentialValueFace {
+  readonly value: string
+  readonly source: string
+}
+
 /** The subset of the `credentials` service this module reads and writes. */
 interface CredentialsFace {
   describe(ref: string): Promise<CredentialFactsFace>
   set(ref: string, value: string): Promise<void>
   unset(ref: string): Promise<void>
+  /** Same-process value resolution; absent on an older service. */
+  resolve?(ref: string): Promise<CredentialValueFace | undefined>
 }
 
 /* ------------------------------------------------------------------ *
@@ -152,6 +175,7 @@ function configurationOf(profile: unknown): ProviderConfiguration {
   })
   return {
     ...(typeof record.baseURL === 'string' && record.baseURL.trim() !== '' ? { baseURL: record.baseURL } : {}),
+    ...(typeof record.api === 'string' && record.api.trim() !== '' ? { api: record.api } : {}),
     models,
   }
 }
@@ -211,9 +235,100 @@ export interface ProviderModelSettings {
 /** The small, portable subset of a provider profile the terminal edits. */
 export interface ProviderConfiguration {
   readonly baseURL?: string
+  /**
+   * Wire protocol the stored profile names (e.g. `openai-responses`), when it
+   * names one. Load-only: the editor never writes it, but endpoint discovery
+   * passes it so the listing speaks the same protocol as real requests.
+   */
+  readonly api?: string
   readonly models: readonly ProviderModelSettings[]
 }
 
+/** One model an endpoint reported about itself (mirrors `LlmDiscoveredModel`). */
+export interface DiscoveredModelView {
+  /** Model id the endpoint accepts. */
+  readonly id: string
+  /** Human-readable name when the endpoint supplies one. */
+  readonly name?: string
+  /** Context window when disclosed; adoption still owes it if absent. */
+  readonly contextWindow?: number
+  /** Output cap when disclosed. */
+  readonly maxTokens?: number
+}
+
+/** One model an endpoint reported about itself (mirrors LlmDiscoveredModel). */
+export interface DiscoveredModelView {
+  /** Model id the endpoint accepts. */
+  readonly id: string
+  /** Human-readable name when the endpoint supplies one. */
+  readonly name?: string
+  /** Context window when disclosed; adoption still owes it if absent. */
+  readonly contextWindow?: number
+  /** Output cap when disclosed. */
+  readonly maxTokens?: number
+}
+
+/**
+ * The seven canonical reasoning levels a reasoningEfforts key may name -
+ * pi-ai's THINKING_LEVELS. A pi-ai upgrade that adds or removes one fails
+ * upstream's own drift gate; this mirror exists so the terminal editor can
+ * validate drafts without importing the pi-ai package.
+ */
+export const REASONING_EFFORT_LEVELS = ['off', 'minimal', 'low', 'medium', 'high', 'xhigh', 'max'] as const
+
+/**
+ * One stored reasoningEfforts declaration: a display-level to wire-value map
+ * (null sends no reasoning parameter), an explicit false disabling the
+ * picker, or undefined leaving the entry to inherit.
+ */
+export type ReasoningEffortsValue = Record<string, string | null> | false | undefined
+
+/** Whether a raw extras value is a declared efforts dict (non-empty, non-false). */
+export function isDeclaredReasoningEfforts(value: unknown): value is Record<string, string | null> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value) && Object.keys(value).length > 0
+}
+
+/**
+ * Parse the setup page's compact efforts draft into a storable declaration.
+ * Grammar: empty = clear back to inherit; the single token "false" = disable
+ * the picker; otherwise space-separated level:wire pairs where level is one
+ * of REASONING_EFFORT_LEVELS and wire is any non-empty string or the literal
+ * "null" (send no parameter).
+ */
+export function parseReasoningEffortsDraft(draft: string):
+  | { readonly ok: true; readonly value: ReasoningEffortsValue }
+  | { readonly ok: false; readonly error: string } {
+  const text = draft.trim()
+  if (text === '') return { ok: true, value: undefined }
+  if (text === 'false') return { ok: true, value: false }
+  const value: Record<string, string | null> = {}
+  for (const token of text.split(/\s+/u)) {
+    const split = token.indexOf(':')
+    if (split <= 0 || split === token.length - 1) {
+      return { ok: false, error: 'each entry needs level:wire, got "' + token + '"' }
+    }
+    const level = token.slice(0, split)
+    const wire = token.slice(split + 1)
+    if (!(REASONING_EFFORT_LEVELS as readonly string[]).includes(level)) {
+      return { ok: false, error: '"' + level + '" is not a level; use one of ' + REASONING_EFFORT_LEVELS.join('/') }
+    }
+    if (level in value) {
+      return { ok: false, error: 'level "' + level + '" appears twice' }
+    }
+    value[level] = wire === 'null' ? null : wire
+  }
+  return { ok: true, value }
+}
+
+/** Serialize a stored declaration back to the compact draft form (stored key order preserved). */
+export function serializeReasoningEfforts(value: unknown): string {
+  if (value === false) return 'false'
+  if (!isDeclaredReasoningEfforts(value)) return ''
+  return Object.entries(value)
+    .map(([level, wire]) => level + ':' + (wire === null ? 'null' : String(wire)))
+    .join(' ')
+}
+
 /**
  * One provider row in the TUI provider-management panel: the configurable
  * directory entry joined with its settings profile and credential facts.
@@ -551,6 +666,95 @@ export async function saveProviderConfiguration(
   }
 }
 
+/**
+ * Interrogate a provider endpoint for the models it really serves, through
+ * the model-discovery capability the provider's settings namespace
+ * registered — the same pipe the official Web Models page uses. The request
+ * is a draft: a typed key forces direct endpoint interrogation (gateway
+ * truth), while an empty key lets the harness resolve the route's stored
+ * credential; with neither baseURL nor route the adapter answers from its
+ * own knowledge.
+ * @param ctx - context carrying the `llm` service (optional discovery).
+ * @param target - provider row whose settings namespace serves the draft.
+ * @param request - typed key and/or endpoint override for this one probe.
+ * @param signal - caller cancellation (panel navigation aborts the probe).
+ * @returns the advertised models in endpoint order, deduplicated.
+ */
+export async function discoverProviderModels(
+  ctx: Context,
+  target: ProviderTargetView,
+  request: { readonly apiKey?: string; readonly baseURL?: string },
+  signal?: AbortSignal,
+): Promise<readonly DiscoveredModelView[]> {
+  if (target.settingsNs.length === 0) {
+    throw new ProviderSettingsError(`provider "${target.provider}" has no managed settings namespace; its models cannot be discovered here`)
+  }
+  const llm = ctx.get('llm') as LlmFace | undefined
+  if (llm?.discoverModels === undefined) {
+    throw new ProviderSettingsError('model discovery is unavailable in this profile; enter models by hand')
+  }
+  const typedKey = request.apiKey?.trim()
+  const baseURL = request.baseURL?.trim()
+  const hasUrl = baseURL !== undefined && baseURL !== ''
+  let oneShotKey = typedKey
+  // A filled endpoint means the user wants THAT endpoint's real list: sending
+  // the route id alongside would make the adapter short-circuit to its
+  // installed catalog (official providers) and ignore the URL entirely. The
+  // probe therefore goes out as a draft — with the typed key, or with the
+  // stored credential resolved once for this request (never displayed,
+  // never persisted; exactly what provider-mode resolution does internally).
+  if (hasUrl && (oneShotKey === undefined || oneShotKey === '')) {
+    const credentialsService = ctx.get('credentials') as CredentialsFace | undefined
+    const ref = target.credentialRef ?? target.suggestedRef
+    if (credentialsService?.resolve !== undefined && ref !== undefined) {
+      try {
+        // Call resolve AS A METHOD on the service: destructured off it the
+        // call loses `this` and throws on the provider's first field read
+        // (the same lesson loadProviderSettings documents for listProviders).
+        const resolved = await credentialsService.resolve(ref)
+        oneShotKey = resolved?.value
+      } catch {
+        // A failed resolution degrades to an unauthenticated probe; the
+        // endpoint's own 401 names the problem better than we can.
+      }
+    }
+  }
+  const draft = hasUrl
+    ? {
+      ...(oneShotKey !== undefined && oneShotKey !== '' ? { apiKey: oneShotKey } : {}),
+      baseURL: baseURL!,
+      ...target.configuration.api === undefined ? {} : { api: target.configuration.api },
+    }
+    : {
+      // No endpoint override: the route's own knowledge answers (the official
+      // catalog for builtin providers — richer than any listing).
+      provider: target.provider,
+    }
+  try {
+    const discovered = signal === undefined
+      ? await llm.discoverModels(target.settingsNs, draft)
+      : await llm.discoverModels(target.settingsNs, draft, signal)
+    // Defensive dedupe in endpoint order (the service dedupes too; an older
+    // one must not leak duplicate rows into the checkable list).
+    const seen = new Set<string>()
+    const rows: DiscoveredModelView[] = []
+    for (const model of discovered) {
+      if (typeof model.id !== 'string' || model.id.trim() === '' || seen.has(model.id)) continue
+      seen.add(model.id)
+      rows.push({
+        id: model.id,
+        ...model.name === undefined ? {} : { name: model.name },
+        ...model.contextWindow === undefined ? {} : { contextWindow: model.contextWindow },
+        ...model.maxTokens === undefined ? {} : { maxTokens: model.maxTokens },
+      })
+    }
+    return rows
+  } catch (error) {
+    if (signal?.aborted === true) throw error
+    throw new ProviderSettingsError(singleLine(messageOf(error)))
+  }
+}
+
 /**
  * Remove the currently named credential without touching the provider
  * profile. Only the resolved profile's own reference is unset; a dormant or

package/src/questions.ts

@@ -80,6 +80,26 @@ export function mountQuestionProvider(ctx: Context): QuestionStore {
   }
 
   if (service !== undefined) {
+    // Capability guard against contract drift: the pinned release exposes
+    // registerProvider, but an upstream alignment may replace it with the
+    // 'user-questions/request' waterfall. Degrade to the permanently-empty
+    // store (the no-service path) instead of failing startup with a
+    // TypeError on a missing method.
+    if (typeof (service as unknown as { registerProvider?: unknown }).registerProvider !== 'function') {
+      return {
+        subscribe(listener: () => void): () => void {
+          listeners.add(listener)
+          return () => {
+            listeners.delete(listener)
+          }
+        },
+        getSnapshot(): QuestionSnapshot {
+          return snapshot
+        },
+        submit(): void {},
+        cancel(): void {},
+      }
+    }
     service.registerProvider({
       ask(request: AskUserQuestionRequest): Promise<AskUserQuestionAnswer> {
         return new Promise((resolve, reject) => {

package/src/render/lines.ts

@@ -3,6 +3,7 @@
 import { promptDisplayText, type TranscriptEntry } from './projection.ts'
 import type { ToolDetail } from './tool-detail.ts'
 import { renderMarkdown, visibleColumns, type MdStyle } from './markdown.ts'
+import { graphemeWidth, splitGraphemes } from './width.ts'
 import { formatTokens } from './status.ts'
 import { displayText, truncateColumns } from './text.ts'
 
@@ -53,14 +54,17 @@ export function styledLines(segments: readonly StyledSegment[], columns: number)
 
   for (const segment of segments) {
     const safe = displayText(segment.text).replaceAll('\t', '  ').replaceAll('\r', '')
-    for (const char of safe) {
-      if (char === '\n') {
+    // Grapheme clusters, never bare code points: a ZWJ family or a flag is
+    // one terminal cell run, and splitting it would both split the glyph
+    // across rows and double-count its width against the budget.
+    for (const cluster of splitGraphemes(safe)) {
+      if (cluster === '\n') {
         flush()
         continue
       }
-      const cells = visibleColumns(char)
+      const cells = graphemeWidth(cluster)
       if (used > 0 && used + cells > width) flush()
-      appendSegment(current, char, segment.style)
+      appendSegment(current, cluster, segment.style)
       used += cells
     }
   }
@@ -76,7 +80,10 @@ export function textLines(text: string, columns: number, style: LineStyle = 'pla
 /** Prefix every wrapped physical row without exceeding the column budget. */
 function prefixedStyledLines(segments: readonly StyledSegment[], columns: number, prefix: string, prefixStyle: LineStyle = 'plain'): readonly StyledLine[] {
   const width = Math.max(1, Math.floor(columns))
-  const prefixWidth = Math.min(width, visibleColumns(prefix))
+  // Keep one column for the body even when the prefix alone would fill the
+  // row: a prefix allowed to claim the whole width pushed prefix+body one
+  // column past the budget on very narrow terminals.
+  const prefixWidth = Math.min(width - 1, visibleColumns(prefix))
   const bodyWidth = Math.max(1, width - prefixWidth)
   return styledLines(segments, bodyWidth).map(line => ({
     segments: [lineSegment(prefix, prefixStyle), ...line.segments],
@@ -120,14 +127,14 @@ function hangingStyledLines(
   }
   for (const segment of segments) {
     const safe = displayText(segment.text).replaceAll('\t', '  ').replaceAll('\r', '')
-    for (const char of safe) {
-      if (char === '\n') {
+    for (const cluster of splitGraphemes(safe)) {
+      if (cluster === '\n') {
         flush()
         continue
       }
-      const cells = visibleColumns(char)
+      const cells = graphemeWidth(cluster)
       if (used > 0 && used + cells > budget) flush()
-      appendSegment(current, char, segment.style)
+      appendSegment(current, cluster, segment.style)
       used += cells
     }
   }
@@ -155,7 +162,10 @@ function hangingTextLines(
 /** Markdown rows re-hardened so a single long word cannot escape the budget. */
 export function markdownLines(text: string, columns: number): readonly StyledLine[] {
   const width = Math.max(1, Math.floor(columns))
-  const parsed = renderMarkdown(displayText(text), Math.max(10, width))
+  // The markdown pass formats at the real width — a 10-column floor on a
+  // narrower terminal silently pushed rows past the budget (styledLines
+  // re-hardens long words at `width` either way).
+  const parsed = renderMarkdown(displayText(text), width)
   return parsed.flatMap(line => styledLines(
     line.segments.map(segment => lineSegment(segment.text, segment.style)),
     width,
@@ -280,7 +290,7 @@ export function transcriptEntryLines(
       // Every reply row carries the composer's two-column gutter, so reply
       // text aligns with the input cursor (Codex LIVE_PREFIX alignment); the
       // wrap budget shrinks by the same amount so no line double-wraps.
-      const body = markdownLines(entry.text, Math.max(10, width - 2))
+      const body = markdownLines(entry.text, Math.max(1, width - 2))
         .map(line => ({ segments: [{ text: '  ', style: 'plain' as const }, ...line.segments] }))
       // A cancelled stream's delivered prefix settles as this entry; one
       // bounded dim marker row distinguishes it from a completed reply.
@@ -330,7 +340,9 @@ export function transcriptEntryLines(
         : `  ⧉ compaction failed: ${entry.error}`, width, 'dim')
     case 'retry':
       return textLines(
-        `  ↻ retry ${entry.attempt}/${entry.max} · ${entry.code} · ${Math.round(entry.delayMs / 100) / 10}s`,
+        entry.mode === 'always'
+          ? `  ↻ retry ${entry.attempt} · ${entry.code} · ${Math.round(entry.delayMs / 100) / 10}s`
+          : `  ↻ retry ${entry.attempt}/${entry.max} · ${entry.code} · ${Math.round(entry.delayMs / 100) / 10}s`,
         width,
         entry.state === 'running' ? 'warn' : 'dim',
       )

package/src/render/markdown.ts

@@ -9,7 +9,7 @@
  * @module @deepseek-ai/dsh-code/render/markdown
  */
 
-import { stringWidth } from './width.ts'
+import { graphemeWidth, splitGraphemes, stringWidth } from './width.ts'
 
 /** Style classes the renderer emits; the app maps them to colors/props. */
 export type MdStyle = 'plain' | 'bold' | 'italic' | 'boldItalic' | 'code' | 'accent' | 'accentBold' | 'dim' | 'strike'
@@ -60,15 +60,17 @@ function wrapUnits(segments: readonly MdSegment[]): readonly WrapUnit[] {
       if (word !== '') units.push({ text: word, style: segment.style })
       word = ''
     }
-    for (const char of segment.text) {
-      if (char === ' ') {
+    // Grapheme clusters keep ZWJ families, flags, and combining sequences
+    // whole; a cluster wider than one cell is its own break opportunity.
+    for (const cluster of splitGraphemes(segment.text)) {
+      if (cluster === ' ') {
         flushWord()
-        units.push({ text: char, style: segment.style })
-      } else if (visibleColumns(char) > 1) {
+        units.push({ text: cluster, style: segment.style })
+      } else if (graphemeWidth(cluster) > 1) {
         flushWord()
-        units.push({ text: char, style: segment.style })
+        units.push({ text: cluster, style: segment.style })
       } else {
-        word += char
+        word += cluster
       }
     }
     flushWord()
@@ -99,7 +101,7 @@ function wrapSegments(segments: readonly MdSegment[], width: number): readonly (
   const append = (unit: WrapUnit): void => {
     const columns = visibleColumns(unit.text)
     if (used === 0 && columns > limit) {
-      for (const char of unit.text) appendAtom({ text: char, style: unit.style })
+      for (const cluster of splitGraphemes(unit.text)) appendAtom({ text: cluster, style: unit.style })
       return
     }
     if (used + columns <= limit || current.length === 0) {
@@ -121,7 +123,7 @@ function wrapSegments(segments: readonly MdSegment[], width: number): readonly (
     }
     flush()
     if (columns > limit) {
-      for (const char of unit.text) appendAtom({ text: char, style: unit.style })
+      for (const cluster of splitGraphemes(unit.text)) appendAtom({ text: cluster, style: unit.style })
     } else {
       appendAtom(unit)
     }
@@ -336,12 +338,12 @@ function hardWrapSegments(segments: readonly MdSegment[], width: number): readon
     used = 0
   }
   for (const segment of segments) {
-    for (const char of segment.text) {
-      const cells = visibleColumns(char)
+    for (const cluster of splitGraphemes(segment.text)) {
+      const cells = graphemeWidth(cluster)
       if (used > 0 && used + cells > width) flush()
       const previous = current.at(-1)
-      if (previous?.style === segment.style) previous.text += char
-      else current.push({ text: char, style: segment.style })
+      if (previous?.style === segment.style) previous.text += cluster
+      else current.push({ text: cluster, style: segment.style })
       used += cells
     }
   }

package/src/render/projection.ts

@@ -159,6 +159,8 @@ export interface RetryEntry {
   kind: 'retry'
   /** Correlation id shared with the matching `llm/retry-started`. */
   retryId: string
+  /** Retry policy mode from the event: `always` has no attempt cap. */
+  mode: 'normal' | 'always'
   /** Attempt ordinal and its cap. */
   attempt: number
   max: number
@@ -166,7 +168,11 @@ export interface RetryEntry {
   code: string
   /** Backoff wait before the next attempt, in ms. */
   delayMs: number
-  /** `running` while the backoff waits, `done` once the attempt started. */
+  /**
+   * `running` while the backoff waits, `done` once the attempt started — or
+   * when the turn ended first (the turn-end sweep finalizes orphans so they
+   * never pin the settled boundary).
+   */
   state: 'running' | 'done'
 }
 
@@ -328,6 +334,25 @@ function textOf(content: readonly ContentBlock[]): string {
   return content.filter(block => block.type === 'text').map(block => block.text).join('')
 }
 
+/**
+ * Snapshot-isolate one anchors block (Maps and their nested Sets): a view
+ * already handed to the renderer must never observe a later fold through a
+ * shared container. The collections are small and turn-bounded, so cloning
+ * per event is cheap next to the entries copy the reducer already makes.
+ */
+function cloneViewAnchors(anchors: TranscriptView['anchors']): TranscriptView['anchors'] {
+  return {
+    stepStart: new Map(anchors.stepStart),
+    toolStart: new Map(anchors.toolStart),
+    firstChunkAt: new Map(anchors.firstChunkAt),
+    compactionTokens: new Map(anchors.compactionTokens),
+    lastPruneTokens: anchors.lastPruneTokens,
+    turnFiles: new Map([...anchors.turnFiles].map(([turn, files]) => [turn, new Set(files)])),
+    turnSteps: new Map(anchors.turnSteps),
+    turnTools: new Map([...anchors.turnTools].map(([turn, tools]) => [turn, new Set(tools)])),
+  }
+}
+
 /** Durable image references in their model-visible order. */
 function imagesOf(content: readonly ContentBlock[]): readonly ImageBlock['attachment'][] {
   return content.filter((block): block is ImageBlock => block.type === 'image').map(block => block.attachment)
@@ -410,6 +435,10 @@ function pendingText(content: readonly ContentBlock[]): string {
  * @returns the view after the event; the input view is never mutated.
  */
 export function projectEvent(view: TranscriptView, event: SessionEvent): TranscriptView {
+  // Fold against a private anchors block so the documented contract holds —
+  // "the input view is never mutated" — even for the in-place anchor sweeps
+  // below; without this, every handed-out view shared live Maps.
+  view = { ...view, anchors: cloneViewAnchors(view.anchors) }
   switch (event.type) {
     case 'user/message': {
       // A queued row retires when its durable user message lands (the agent
@@ -467,10 +496,16 @@ export function projectEvent(view: TranscriptView, event: SessionEvent): Transcr
       const { target, start, removedCount = 0, inserted } = event.data
       const ids = view.pending[target]
       const removed = ids.slice(start, start + removedCount)
+      // In-place upstream semantics: the kernel's authoritative fold is
+      // `inbox.splice(start, removedCount, ...inserted)` — inserted ids land
+      // AT the splice position (prepend/replace shapes), never at the tail.
+      // A tail append diverged the id order, so later coordinate-based events
+      // (next-turn head claims, positioned remove/replace) tombstoned the
+      // wrong pending row.
       const nextIds = [
         ...ids.slice(0, start),
-        ...ids.slice(start + removedCount),
         ...inserted.map(message => message.id),
+        ...ids.slice(start + removedCount),
       ]
       let entries = view.entries
       if (removed.length > 0) {
@@ -714,8 +749,26 @@ export function projectEvent(view: TranscriptView, event: SessionEvent): Transcr
         for (const callId of turnToolSet) view.anchors.toolStart.delete(callId)
         view.anchors.turnTools.delete(event.data.turn)
       }
+      // Orphaned retry/command rows can never be resolved after the turn
+      // ends: an aborted retry backoff returns upstream without its
+      // `llm/retry-started`, and crash repair synthesizes only tool/step/
+      // turn closers. Left `running` they pin the settled boundary forever,
+      // so the turn end finalizes them exactly like the anchor sweep above.
+      let orphans = false
+      const swept = view.entries.map((entry) => {
+        if (entry.kind === 'retry' && entry.state === 'running') {
+          orphans = true
+          return { ...entry, state: 'done' as const }
+        }
+        if (entry.kind === 'command' && entry.state === 'running') {
+          orphans = true
+          return { ...entry, state: 'error' as const, summary: 'interrupted before the turn ended' }
+        }
+        return entry
+      })
+      const entries = orphans ? swept : view.entries
       if (appended.length === 0) {
-        return { ...view, busy: false, busySince: 0, streaming: '', streamingReasoning: '' }
+        return { ...view, busy: false, busySince: 0, streaming: '', streamingReasoning: '', entries }
       }
       return {
         ...view,
@@ -723,7 +776,7 @@ export function projectEvent(view: TranscriptView, event: SessionEvent): Transcr
         busySince: 0,
         streaming: '',
         streamingReasoning: '',
-        entries: [...view.entries, ...appended],
+        entries: [...entries, ...appended],
       }
     }
     case 'llm/retry': {
@@ -735,6 +788,7 @@ export function projectEvent(view: TranscriptView, event: SessionEvent): Transcr
         entries: [...view.entries, {
           kind: 'retry',
           retryId: data.retryId,
+          mode: data.mode,
           attempt: data.retry,
           max: 'maxRetries' in data ? data.maxRetries : data.retry,
           code: data.failure.code,
@@ -995,6 +1049,31 @@ function indexList(map: Map<string, number[]>, id: string): number[] {
   return list
 }
 
+/**
+ * Finalize replay rows the ended turn left `running`, mirroring the reducer's
+ * turn-end orphan sweep: an orphaned retry settles `done`, an orphaned command
+ * settles `error` with an interruption note. Only the id-indexed rows are
+ * visited, so the sweep stays O(retries+commands of the log), never a scan.
+ */
+function finalizeReplayOrphans(acc: ReplayAccumulator): void {
+  for (const list of acc.retryIndex.values()) {
+    for (const index of list) {
+      const entry = acc.entries[index]
+      if (entry !== undefined && entry.kind === 'retry' && entry.state === 'running') {
+        acc.entries[index] = { ...entry, state: 'done' }
+      }
+    }
+  }
+  for (const list of acc.commandIndex.values()) {
+    for (const index of list) {
+      const entry = acc.entries[index]
+      if (entry !== undefined && entry.kind === 'command' && entry.state === 'running') {
+        acc.entries[index] = { ...entry, state: 'error', summary: 'interrupted before the turn ended' }
+      }
+    }
+  }
+}
+
 /**
  * Apply an id-keyed update to every row that registered the id, mirroring the
  * copy-on-write reducer's full-array map semantics (all matching rows update,
@@ -1103,11 +1182,15 @@ export function replayProjectEvent(acc: ReplayAccumulator, event: SessionEvent):
           }
         }
       }
+      // Mirror the reducer's in-place order: inserted ids join at the splice
+      // position (upstream `splice(start, removedCount, ...inserted)`), never
+      // at the tail — the id list must stay coordinate-compatible with every
+      // later inbox event.
+      ids.splice(start, 0, ...inserted.map(message => message.id))
       for (const message of inserted) {
         const images = imagesOf(message.content)
         appendReplayEntry(acc, { kind: 'pending', messageId: message.id, target, text: pendingText(message.content), ...(images.length === 0 ? {} : { images }) })
         indexList(acc.pendingIndex, message.id).push(acc.entries.length - 1)
-        ids.push(message.id)
         acc.ops += 1
       }
       return true
@@ -1298,6 +1381,7 @@ export function replayProjectEvent(acc: ReplayAccumulator, event: SessionEvent):
         for (const callId of turnToolSet) acc.toolStart.delete(callId)
         acc.turnTools.delete(event.data.turn)
       }
+      finalizeReplayOrphans(acc)
       acc.busy = false
       acc.busySince = 0
       for (const entry of appended) appendReplayEntry(acc, entry)
@@ -1310,6 +1394,7 @@ export function replayProjectEvent(acc: ReplayAccumulator, event: SessionEvent):
       appendReplayEntry(acc, {
         kind: 'retry',
         retryId: data.retryId,
+        mode: data.mode,
         attempt: data.retry,
         max: 'maxRetries' in data ? data.maxRetries : data.retry,
         code: data.failure.code,
@@ -1474,15 +1559,17 @@ function materializeReplayView(acc: ReplayAccumulator, copy: boolean): Transcrip
     goal: acc.goal,
     pending: { 'next-turn': [...acc.pendingTurn], 'next-step': [...acc.pendingStep] },
     stats: acc.stats,
+    // Handed-out views get their own anchors snapshot: the accumulator keeps
+    // folding its live containers, and no consumer may observe that.
     anchors: {
-      stepStart: acc.stepStart,
-      toolStart: acc.toolStart,
-      firstChunkAt: acc.firstChunkAt,
-      compactionTokens: acc.compactionTokens,
+      stepStart: new Map(acc.stepStart),
+      toolStart: new Map(acc.toolStart),
+      firstChunkAt: new Map(acc.firstChunkAt),
+      compactionTokens: new Map(acc.compactionTokens),
       lastPruneTokens: acc.lastPruneTokens,
-      turnFiles: acc.turnFiles,
-      turnSteps: acc.turnSteps,
-      turnTools: acc.turnTools,
+      turnFiles: new Map([...acc.turnFiles].map(([turn, files]) => [turn, new Set(files)])),
+      turnSteps: new Map(acc.turnSteps),
+      turnTools: new Map([...acc.turnTools].map(([turn, tools]) => [turn, new Set(tools)])),
     },
   }
 }