Merge origin/master into task/command-feedback-master

packages/client/runtime/src/client/contract/session-history.ts

@@ -9,6 +9,8 @@ export interface SessionHistorySnapshot {
   state: 'cold' | 'loading' | 'ready' | 'error'
   error: RpcError | null
   hasMore: boolean
+  /** Absolute sequence of the first loaded raw event, or zero for an empty window. */
+  baseSeq: number
   inspection: SessionHistoryInspection
 }
 
@@ -17,11 +19,17 @@ export interface SessionHistoryFace
   extends ObservableSnapshot<SessionHistorySnapshot> {
   readonly sessionId: SessionId
   /**
-   * Load the tail and exhaust every available older page.
-   * @param signal - Consumer lifetime; abort is observed between page requests.
-   * @returns When the available ledger is complete or stops advancing.
+   * Load the current tail without reading older pages.
+   * @param signal - Consumer lifetime.
+   * @returns When the tail is ready or loading fails.
    */
-  loadAll(signal?: AbortSignal): Promise<void>
+  loadTail(signal?: AbortSignal): Promise<void>
+  /**
+   * Prepend one older page when the current window has a predecessor.
+   * @param signal - Consumer lifetime.
+   * @returns Whether the loaded window advanced.
+   */
+  loadOlder(signal?: AbortSignal): Promise<boolean>
 }
 
 /** Runtime service resolving independent history sources. */

packages/client/runtime/src/client/contract/session.ts

@@ -8,7 +8,9 @@
  * dispatch) stay on the class, invisible out here.
  */
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
-import type { RpcResult, SessionId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  MessageId, QueueAction, RpcResult, SessionId,
+} from '@deepseek-ai/dsh-client-connection/client'
 import type { ConversationSnapshot } from '../sessions/conversation.ts'
 import type { ObservableSnapshot } from './store.ts'
 
@@ -37,10 +39,25 @@ export interface ISession {
    */
   prompt(content: ContentBlock[], mode: 'queue' | 'steer'): Promise<RpcResult<{ accepted: true }>>
   /**
-   * Cancel the running turn.
+   * Apply one edit, remove, or strict steer action to a still-pending queue occurrence.
+   * @param itemId - agent-owned inbox occurrence identity.
+   * @param action - requested queue operation.
+   * @returns acceptance, or a business/transport error.
+   */
+  updateQueue(itemId: MessageId, action: QueueAction): Promise<RpcResult<{ accepted: true }>>
+  /**
+   * Cancel the running turn. Pending queued work remains and resumes in FIFO
+   * order after the Host reaches cancellation quiescence.
    * @returns acceptance, or the business error.
    */
   cancel(): Promise<RpcResult<{ accepted: true }>>
+  /**
+   * Rename this session (explicit user title; pins it against automatic
+   * regeneration).
+   * @param title - raw title text (the host normalizes acceptance).
+   * @returns the normalized accepted title and its event seq, or the business error.
+   */
+  rename(title: string): Promise<RpcResult<{ title: string; seq: number }>>
   /**
    * Extend the history window backwards (older messages pagination).
    * @returns completion; failures land in snapshot.openState/loadingOlder.

packages/client/runtime/src/client/contract/sessions.ts

@@ -8,8 +8,11 @@
  * explicit act of widening what features may do to the sessions domain.
  */
 import type { Context } from 'cordis'
-import type { SessionId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  RpcResult, SessionId, SubagentAddress,
+} from '@deepseek-ai/dsh-client-connection/client'
 import type { HostObservable, SessionMaybeProvideInfo } from '@deepseek-ai/dsh-client-ui-slots'
+import type { SessionSearchResultItem } from '../sessions/manager.ts'
 import type {
   SessionBinding, SessionListState, SessionProvideDescriptor,
 } from '../sessions/service.ts'
@@ -22,13 +25,64 @@ export interface ISessions {
   readonly list: ObservableSnapshot<SessionListState>
   /** Atomic current-session provide projection (the renderer host's `sessions.provideInfo` feed). */
   readonly currentProvideInfo: HostObservable<SessionMaybeProvideInfo>
+  /**
+   * The `session.search` result bound the wire schema fixes, exposed to
+   * presentation as injected data. Not per-connection state: every transport
+   * (fixture included) reports the same number.
+   */
+  readonly searchResultLimit: number
   /**
    * Select a session as current.
    * @param id - session id (must exist in the list; unknown ids fail loud).
    */
   open(id: SessionId): void
+  /**
+   * Open a healthy catalog child through its exact direct-parent address.
+   * @param address - catalog-derived parent and child ids.
+   */
+  openSubagent(address: SubagentAddress): void
+  /**
+   * Resolve an already discovered direct-parent address without opening it.
+   * @param id - possible addressed child id.
+   * @returns the retained address, when present.
+   */
+  subagentAddress(id: SessionId): SubagentAddress | undefined
+  /**
+   * Mark whether a catalog menu is consuming live membership updates.
+   * @param parentSessionId - catalog owner.
+   * @param open - current menu state.
+   */
+  setSubagentCatalogOpen(parentSessionId: SessionId, open: boolean): void
+  /**
+   * Refresh one direct-child catalog.
+   * @param parentSessionId - catalog owner.
+   * @returns completion of the current or newly started refresh.
+   */
+  refreshSubagents(parentSessionId: SessionId): Promise<void>
   /** Clear the current selection into the no-session view state. */
   clear(): void
+  /**
+   * Search the Host's visible message-content index. Results stay
+   * request-local; the list snapshot remains the metadata authority.
+   * @param query - non-blank literal phrase.
+   * @param signal - cancellation for a superseded search.
+   * @returns bounded results, or a business/transport error.
+   */
+  search(
+    query: string,
+    signal: AbortSignal,
+  ): Promise<RpcResult<{ items: SessionSearchResultItem[]; hasMore: boolean }>>
+  /**
+   * Fork a session from a completed-turn prefix of the source; on resolution
+   * the child is in the list store and `open()` can target it.
+   * @param opts - source session id, the optional event seq anchoring the
+   *   cut (the boundary is the first turn/end at or after it; an in-log
+   *   anchor in an open turn is unavailable rather than clipped backward),
+   *   and whether to increment an inherited durable title before resolving.
+   * @returns the child session id.
+   * @throws when the fork fails, or when a requested child-title rename fails after creation.
+   */
+  fork(opts: { sessionId: SessionId; atSeq?: number; increaseTitle?: boolean }): Promise<SessionId>
   /**
    * Register a per-session standard-props provider (hooks become `use<Name>`
    * selector hooks on the render side; props spread verbatim).

packages/client/runtime/src/client/contract/workspaces.ts

@@ -76,4 +76,11 @@ export interface IWorkspaces {
    * @returns the updated Workspace view.
    */
   insertSessionBefore(workspaceId: WorkspaceId, sessionId: SessionId, beforeSessionId?: SessionId): Promise<WorkspaceView>
+  /**
+   * Archive a session into the registry-global set (hidden from grouping
+   * surfaces; session log and accounting slot remain). Archiving the current
+   * session clears the selection into the New Session view state.
+   * @param sessionId - session to archive.
+   */
+  archiveSession(sessionId: SessionId): Promise<void>
 }

packages/client/runtime/src/client/index.ts

@@ -31,7 +31,8 @@ export type { IWorkspaces } from './contract/workspaces.ts'
 export type {
   SessionBinding, SessionListState, SessionProvideContribution, SessionProvideDescriptor, SessionSummary,
 } from './sessions/service.ts'
-export type { SessionListPhase } from './sessions/manager.ts'
+export type { SessionListPhase, SessionSearchResultItem, SubagentCatalogSnapshot } from './sessions/manager.ts'
+export type { SubagentAddress } from '@deepseek-ai/dsh-client-connection/client'
 export type { WorkspaceListPhase } from './workspaces/manager.ts'
 export type { WorkspaceListState } from './workspaces/service.ts'
 export type {
@@ -44,20 +45,26 @@ export type {
 } from './contract/store.ts'
 export type {
   AssistantBlock, AssistantMessageNode, AssistantProvenanceView, AssistantRequestConfig,
-  AssistantTiming, CodeSubCall, CommandNode, ComposerPhase, ContextMessageNode, ConversationNode,
-  ConversationSnapshot, QueuedMessage, RunningToolCall,
-  SteeringMessageNode, TodoItem, ToolResultNode, UnknownSurfaceNode, UserMessageNode,
+  AssistantTiming, CodeSubCall, CommandNode, CompactionSummaryNode, ComposerPhase,
+  ContextMessageNode, ConversationNode, ConversationSnapshot, ModelRetryNode, QueuedMessage,
+  RunningToolCall,
+  SteeringMessageNode, TodoItem, ToolResultNode, TurnErrorNode, UnknownSurfaceNode, UserMessageNode,
 } from './sessions/conversation.ts'
 export type {
   ConversationContext, ConversationContextOriginKind,
 } from './sessions/conversation-context.ts'
+export type {
+  ContextProvenanceView, ContextRole, KnownContextForm,
+} from './sessions/context-provenance.ts'
 export type {
   ConversationPromptSnapshot, RequestInspectionSnapshot, RequestPromptChange, RequestView,
 } from './sessions/request-inspection.ts'
 export type { ConversationHistoryProjection } from './session-history/history-fold.ts'
 export type { SessionHistoryInspection } from './sessions/history.ts'
 export { PendingWait } from './sessions/pending.ts'
-export type { PendingInteraction, PendingKind, PendingPayloads } from './sessions/pending.ts'
+export type {
+  PendingInteraction, PendingInteractionStatus, PendingKind, PendingPayloads,
+} from './sessions/pending.ts'
 // Projection value store (session-projection RFC, push model): host-computed
 // whole values per key; domains ship projection support with zero client code.
 export type {
@@ -122,6 +129,28 @@ declare module 'cordis' {
      * @mode emit
      */
     'commands/changed'(): void
+    /**
+     * One settings namespace's resolved value changed on the host
+     * (host/settings-changed passthrough). Subscribers refetch
+     * `settings.describe`; the frame carries no values.
+     * @mode emit
+     * @param ns - the namespace whose resolved value changed.
+     */
+    'settings/changed'(ns: string): void
+    /**
+     * One credential reference's state changed on the host
+     * (host/credentials-changed passthrough). The ref is an
+     * environment-variable NAME — never a value.
+     * @mode emit
+     * @param ref - the reference whose configured state changed.
+     */
+    'credentials/changed'(ref: string): void
+    /**
+     * The host provider topology changed (host/models-changed passthrough).
+     * Subscribers refetch `llm.providers`/`llm.models`/`session.models`.
+     * @mode emit
+     */
+    'models/changed'(): void
     /**
      * A connection generation was (re-)established. Wire-derived caches must
      * treat their state as stale and repull (commands directory; the queue
@@ -170,8 +199,13 @@ export function apply(ctx: Context): void {
       sessions.handleHostEnvelope(envelope)
       workspaces.handleHostEnvelope(envelope)
       // Typed-event bridge: the session layer ignores registry frames (no
-      // session routing); consumers (command directory caches) subscribe on ctx.
-      if (envelope.payload.type === 'host/commands-changed') ctx.emit('commands/changed')
+      // session routing); consumers (command directory caches, the settings
+      // and model surfaces) subscribe on ctx.
+      const frame = envelope.payload
+      if (frame.type === 'host/commands-changed') ctx.emit('commands/changed')
+      else if (frame.type === 'host/settings-changed') ctx.emit('settings/changed', frame.ns)
+      else if (frame.type === 'host/credentials-changed') ctx.emit('credentials/changed', frame.ref)
+      else if (frame.type === 'host/models-changed') ctx.emit('models/changed')
       try {
         sessionHistory.handleHostEnvelope(envelope)
       } catch (error) {

packages/client/runtime/src/client/session-history/history-fold.ts

@@ -11,11 +11,15 @@ import type {
   PartialAssistant, RunningToolCall,
 } from '../sessions/conversation.ts'
 import { toAssistantBlocks } from '../sessions/conversation.ts'
+import { contextForm, contextProvenance } from '../sessions/context-provenance.ts'
+import { SteeringHistory } from '../sessions/steering-history.ts'
 import type {
   ConversationContext, ConversationContextOriginKind,
 } from '../sessions/conversation-context.ts'
 import type { ConversationPromptSnapshot } from '../sessions/request-inspection.ts'
 import { PartialAccumulator } from '../sessions/partial.ts'
+import type { AssistantStepMetadata } from '../sessions/assistant-timing.ts'
+import { indexAssistantStepTiming, settledAssistantTiming } from '../sessions/assistant-timing.ts'
 
 interface CallIndexEntry {
   name: string
@@ -30,11 +34,6 @@ interface FoldedContext {
   originSeq?: number
 }
 
-interface AssistantStepMetadata {
-  stepStartTime: number | null
-  firstTokenTime: number | null
-}
-
 /** Immutable conversation projections derived only from the history source. */
 export interface ConversationHistoryProjection {
   eventNodes: readonly ConversationNode[]
@@ -45,22 +44,10 @@ export interface ConversationHistoryProjection {
   codeDispatches: ReadonlyMap<string, readonly CodeSubCall[]>
 }
 
-function assistantStepKey(turn: number, step: number): string {
-  return `${turn}\u0000${step}`
-}
-
-// Trajectory owns surface-window reconstruction so its immutable ledger does
-// not depend on Chat's live fold adapter or Session's mutable state.
-/* jscpd:ignore-start */
-function paddingEvent(seq: number): SessionEvent {
-  return { type: 'noop/padding', seq, time: 0, data: {} } as unknown as SessionEvent
-}
-
 function replacementCrossesWindowHead(event: SessionEvent, baseSeq: number): boolean {
   if (!isSurfaceEvent(event) || event.surfaceOp === 'append') return false
   return event.surfaceOp.start < baseSeq || event.surfaceOp.end < baseSeq
 }
-/* jscpd:ignore-end */
 
 function contextOriginKind(event: SessionEvent | undefined): ConversationContextOriginKind {
   if (event?.type !== 'user/message') return 'rewrite'
@@ -72,39 +59,61 @@ function contextOriginKind(event: SessionEvent | undefined): ConversationContext
   return 'rewrite'
 }
 
-function isTokenDelta(chunk: SessionEvent<'assistant/chunk'>['data']['chunk']): boolean {
-  switch (chunk.type) {
-    case 'text-delta':
-    case 'reasoning-delta':
-      return chunk.text !== ''
-    case 'tool-call-delta':
-      return chunk.argumentsDelta !== '' || chunk.name !== undefined
-    default:
-      return false
-  }
-}
-
 function foldContexts(events: readonly SessionEvent[]): readonly FoldedContext[] {
   const replay: SessionEvent[] = []
+  const originalSeqs: number[] = []
+  const rebasedSeqByOriginal = new Map<number, number>()
   const surface = new SurfaceManager(replay)
   const contexts: FoldedContext[] = []
   let generation = 0
   let originSeq: number | undefined
+  const originalNodes = () => surface.nodes.map((seq) => {
+    const original = originalSeqs[seq]
+    if (original === undefined) throw new Error(`rebased surface seq ${seq} has no origin`)
+    return original
+  })
   for (const event of events) {
-    if (isSurfaceEvent(event) && event.surfaceOp !== 'append') {
+    if (!isSurfaceEvent(event)) continue
+    if (event.surfaceOp !== 'append') {
       contexts.push({
         generation,
-        nodes: [...surface.nodes],
+        nodes: originalNodes(),
         ...(originSeq === undefined ? {} : { originSeq }),
       })
       generation++
       originSeq = event.seq
     }
-    replay.push(event)
+    const rebasedSeq = replay.length
+    const {
+      sourceEventSeqs: rawSources,
+      ...eventWithoutSources
+    } = event as SessionEvent & { sourceEventSeqs?: readonly number[] }
+    const mappedSourceEventSeqs = rawSources?.flatMap((seq) => {
+      const rebased = rebasedSeqByOriginal.get(seq)
+      return rebased === undefined ? [] : [rebased]
+    })
+    const sourceEventSeqs = mappedSourceEventSeqs?.length === 0
+      ? undefined
+      : mappedSourceEventSeqs
+    const surfaceOp = event.surfaceOp === 'append'
+      ? event.surfaceOp
+      : {
+        ...event.surfaceOp,
+        start: rebasedSeqByOriginal.get(event.surfaceOp.start) ?? event.surfaceOp.start,
+        end: rebasedSeqByOriginal.get(event.surfaceOp.end) ?? event.surfaceOp.end,
+      }
+    originalSeqs.push(event.seq)
+    rebasedSeqByOriginal.set(event.seq, rebasedSeq)
+    replay.push({
+      ...eventWithoutSources,
+      seq: rebasedSeq,
+      surfaceOp,
+      ...(sourceEventSeqs === undefined ? {} : { sourceEventSeqs }),
+    } as SessionEvent)
   }
   contexts.push({
     generation,
-    nodes: [...surface.nodes],
+    nodes: originalNodes(),
     ...(originSeq === undefined ? {} : { originSeq }),
   })
   return contexts
@@ -119,6 +128,7 @@ function materializeNode(
   resultView: ToolResultView | null,
   assistantTiming: AssistantTiming | undefined,
   requestConfig: AssistantRequestConfig | undefined,
+  steering: boolean,
 ): ConversationNode {
   switch (event.type) {
     case 'user/message':
@@ -126,6 +136,15 @@ function materializeNode(
         return {
           kind: 'context', seq: event.seq, time: event.time,
           content: event.data.content, source: event.data.source,
+          provenance: contextProvenance(event.data.source),
+          form: contextForm(event.data.source),
+        }
+      }
+      if (steering) {
+        return {
+          kind: 'steering', messageId: event.data.id,
+          seq: event.seq, time: event.time,
+          content: event.data.content, source: event.data.source,
         }
       }
       return {
@@ -144,11 +163,6 @@ function materializeNode(
         ...(requestConfig === undefined ? {} : { requestConfig }),
         ...(assistantTiming === undefined ? {} : { timing: assistantTiming }),
       }
-    case 'steering/message':
-      return {
-        kind: 'steering', seq: event.seq, time: event.time, turn: event.data.turn,
-        content: event.data.message.content, source: event.data.message.source,
-      }
     case 'tool/result': {
       const result = event.data.message.content[0]
       const callId = String(event.data.message.source.callId)
@@ -330,11 +344,13 @@ export function projectConversationHistory(
   entries: readonly HistoryEntry[],
 ): ConversationHistoryProjection {
   const events = entries.map(entry => entry.event)
+  const steeringHistory = new SteeringHistory()
+  const steeringSeqs = new Set<number>()
+  for (const event of events) {
+    if (steeringHistory.apply(event)) steeringSeqs.add(event.seq)
+  }
   const baseSeq = events[0]?.seq ?? 0
-  const padded = [
-    ...Array.from({ length: baseSeq }, (_, seq) => paddingEvent(seq)),
-    ...events,
-  ]
+  const eventsBySeq = new Map(events.map(event => [event.seq, event]))
   const callIndex = new Map<string, CallIndexEntry>()
   const resultViews = new Map<number, ToolResultView>()
   const assistantSteps = new Map<string, AssistantStepMetadata>()
@@ -361,6 +377,7 @@ export function projectConversationHistory(
       contextGeneration++
       if (activePrompt !== undefined) promptsByContext.set(contextGeneration, activePrompt)
     }
+    indexAssistantStepTiming(assistantSteps, event)
     if (event.type === 'request/header') {
       activeRequestConfig = event.data.header.config
       activePrompt = {
@@ -369,30 +386,10 @@ export function projectConversationHistory(
         tools: event.data.header.tools ?? [],
       }
       promptsByContext.set(contextGeneration, activePrompt)
-    } else if (event.type === 'step/start') {
-      assistantSteps.set(
-        assistantStepKey(event.data.turn, event.data.step),
-        { stepStartTime: event.time, firstTokenTime: null },
-      )
-    } else if (event.type === 'assistant/chunk' && isTokenDelta(event.data.chunk)) {
-      const key = assistantStepKey(event.data.turn, event.data.step)
-      const current = assistantSteps.get(key) ?? {
-        stepStartTime: null,
-        firstTokenTime: null,
-      }
-      if (current.firstTokenTime === null) {
-        assistantSteps.set(key, { ...current, firstTokenTime: event.time })
-      }
     } else if (event.type === 'assistant/message') {
       assistantTimings.set(
         event.seq,
-        {
-          ...(assistantSteps.get(assistantStepKey(event.data.turn, event.data.step)) ?? {
-            stepStartTime: null,
-            firstTokenTime: null,
-          }),
-          completedTime: event.time,
-        },
+        settledAssistantTiming(assistantSteps, event.data.turn, event.data.step, event.time),
       )
       if (activeRequestConfig !== undefined) {
         assistantRequestConfigs.set(event.seq, activeRequestConfig)
@@ -404,7 +401,7 @@ export function projectConversationHistory(
   const materialize = (seq: number): ConversationNode | undefined => {
     const cached = nodeCache.get(seq)
     if (cached !== undefined) return cached
-    const event = padded[seq]
+    const event = eventsBySeq.get(seq)
     if (event === undefined || !isSurfaceEligibleType(event.type)) return
     const node = materializeNode(
       event,
@@ -412,6 +409,7 @@ export function projectConversationHistory(
       resultViews.get(seq) ?? null,
       assistantTimings.get(seq),
       assistantRequestConfigs.get(seq),
+      steeringSeqs.has(seq),
     )
     nodeCache.set(seq, node)
     return node
@@ -430,7 +428,7 @@ export function projectConversationHistory(
     }]
   } else {
     try {
-      contexts = foldContexts(padded).map((context): ConversationContext => {
+      contexts = foldContexts(events).map((context): ConversationContext => {
         const nodes = context.nodes.flatMap((seq) => {
           const node = materialize(seq)
           return node === undefined ? [] : [node]
@@ -443,7 +441,7 @@ export function projectConversationHistory(
             nodes,
           }
         }
-        const originEvent = padded[context.originSeq]
+        const originEvent = eventsBySeq.get(context.originSeq)
         return {
           id: context.generation,
           parentId: context.generation - 1,

packages/client/runtime/src/client/session-history/source.ts

@@ -1,12 +1,16 @@
 import type {
   HistoryEntry, IApiClient, MuxFrame, RpcError, SessionId,
 } from '@deepseek-ai/dsh-client-connection/client'
+import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 import { transportError } from '@deepseek-ai/dsh-host-apiproxy/api'
 import type {
   SessionHistoryFace, SessionHistorySnapshot,
 } from '../contract/session-history.ts'
-import { createHistoryInspection } from '../sessions/history.ts'
+import {
+  compactHistoryInspectionEntries, createHistoryInspection,
+} from '../sessions/history.ts'
 import { Notifier } from '../sessions/notifier.ts'
+import { isVisibleAssistantChunk, PartialAccumulator } from '../sessions/partial.ts'
 
 const HISTORY_PAGE_MESSAGES = 50
 
@@ -16,7 +20,8 @@ function isAborted(signal: AbortSignal | undefined): boolean {
 
 /** Independent raw-history owner used only by inspection consumers. */
 export class SessionHistorySource implements SessionHistoryFace {
-  private entries: readonly HistoryEntry[] = []
+  private entries: HistoryEntry[] = []
+  private inspectionEntries: readonly HistoryEntry[] = []
   private baseSeq = 0
   private hasMore = false
   private state: SessionHistorySnapshot['state'] = 'cold'
@@ -33,6 +38,8 @@ export class SessionHistorySource implements SessionHistoryFace {
     entries: readonly HistoryEntry[]
     value: SessionHistorySnapshot['inspection']
   } | null = null
+  private streamPublishToken: object | null = null
+  private streamPartial: PartialAccumulator | null = null
   private snapshotCache: SessionHistorySnapshot
   private readonly notifier = new Notifier(() => {
     this.snapshotCache = this.buildSnapshot()
@@ -68,37 +75,29 @@ export class SessionHistorySource implements SessionHistoryFace {
   }
 
   /**
-   * Load the tail and exhaust all available older pages.
+   * Load the current tail without reading older pages.
    * @param signal - Consumer lifetime.
-   * @returns When paging completes, fails to advance, or is aborted.
+   * @returns When the tail is ready or loading fails.
    */
-  async loadAll(signal?: AbortSignal): Promise<void> {
-    if (signal?.aborted === true) return
+  async loadTail(signal?: AbortSignal): Promise<void> {
+    if (isAborted(signal)) return
     this.trackConsumer(signal)
     await this.open()
-    while (
-      !isAborted(signal)
-      && this.state === 'ready'
-      && this.hasMore
-    ) {
-      const previousBaseSeq = this.baseSeq
-      await this.loadOlder()
-      if (isAborted(signal) || this.baseSeq === previousBaseSeq) return
-    }
   }
 
-  /** Rebuild and page for whichever mounted consumers survive a reconnect. */
-  private async loadForConsumers(): Promise<void> {
+  /**
+   * Prepend one older page when the current window has a predecessor.
+   * @param signal - Consumer lifetime.
+   * @returns Whether the loaded window advanced.
+   */
+  async loadOlder(signal?: AbortSignal): Promise<boolean> {
+    if (isAborted(signal)) return false
+    this.trackConsumer(signal)
     await this.open()
-    while (
-      this.hasConsumer()
-      && this.state === 'ready'
-      && this.hasMore
-    ) {
-      const previousBaseSeq = this.baseSeq
-      await this.loadOlder()
-      if (!this.hasConsumer() || this.baseSeq === previousBaseSeq) return
-    }
+    if (isAborted(signal)) return false
+    const previousBaseSeq = this.baseSeq
+    await this.loadOlderPage()
+    return this.baseSeq !== previousBaseSeq
   }
 
   /**
@@ -125,7 +124,7 @@ export class SessionHistorySource implements SessionHistoryFace {
     if (this.state !== 'cold') {
       this.state = 'cold'
       this.error = null
-      this.notifier.markDirty()
+      this.publishDirtyNow()
     }
   }
 
@@ -139,12 +138,13 @@ export class SessionHistorySource implements SessionHistoryFace {
     this.liveBuffer = []
     this.subscribedLastSeq = null
     this.entries = []
+    this.inspectionEntries = []
     this.baseSeq = 0
     this.hasMore = false
     this.state = 'cold'
     this.error = null
-    this.notifier.markDirty()
-    void this.loadForConsumers()
+    this.publishDirtyNow()
+    void this.open()
   }
 
   /** Stop future refresh work after the host removes the session. */
@@ -155,6 +155,8 @@ export class SessionHistorySource implements SessionHistoryFace {
     this.openPromise = null
     this.olderPromise = null
     this.liveBuffer = []
+    this.streamPublishToken = null
+    this.streamPartial = null
   }
 
   private open(): Promise<void> {
@@ -188,7 +190,7 @@ export class SessionHistorySource implements SessionHistoryFace {
   private async doOpen(generation: number): Promise<void> {
     this.state = 'loading'
     this.error = null
-    this.notifier.markDirty()
+    this.publishDirtyNow()
     try {
       let { result } = await this.api.sessions.history({
         sessionId: this.sessionId,
@@ -222,11 +224,11 @@ export class SessionHistorySource implements SessionHistoryFace {
       /* v8 ignore next -- transportError always returns the error branch. */
       this.error = folded.ok ? null : folded.error
     } finally {
-      if (generation === this.generation) this.notifier.markDirty()
+      if (generation === this.generation) this.publishDirtyNow()
     }
   }
 
-  private loadOlder(): Promise<void> {
+  private loadOlderPage(): Promise<void> {
     if (this.olderPromise !== null) return this.olderPromise
     if (this.state !== 'ready' || !this.hasMore) return Promise.resolve()
     const generation = this.generation
@@ -252,6 +254,7 @@ export class SessionHistorySource implements SessionHistoryFace {
           return
         }
         this.entries = [...older, ...this.entries]
+        this.inspectionEntries = compactHistoryInspectionEntries([...this.entries])
         this.baseSeq = older[0]?.event.seq ?? this.baseSeq
         this.hasMore = result.value.hasMore
       } catch (error) {
@@ -261,7 +264,7 @@ export class SessionHistorySource implements SessionHistoryFace {
     const settled = operation.finally(() => {
       if (this.olderPromise !== settled) return
       this.olderPromise = null
-      this.notifier.markDirty()
+      this.publishDirtyNow()
     })
     this.olderPromise = settled
     return settled
@@ -283,10 +286,11 @@ export class SessionHistorySource implements SessionHistoryFace {
       this.entries = [...prefix, ...tail]
     }
     this.baseSeq = this.entries[0]?.event.seq ?? 0
+    this.inspectionEntries = compactHistoryInspectionEntries([...this.entries])
     const buffered = this.liveBuffer
     this.liveBuffer = []
     for (const entry of buffered) this.appendLive(entry)
-    this.notifier.markDirty()
+    this.publishDirtyNow()
   }
 
   private acceptLive(entry: HistoryEntry): void {
@@ -301,14 +305,84 @@ export class SessionHistorySource implements SessionHistoryFace {
       void this.repairGap()
       return
     }
+    if (
+      entry.event.type === 'assistant/chunk'
+      && entry.event.data.chunk.type !== 'usage'
+    ) {
+      if (!this.appendIncrementalChunk(entry, entry.event)) return
+      this.publishStreamDirty()
+      return
+    }
     this.appendLive(entry)
-    this.notifier.markDirty()
+    this.publishDirtyNow()
   }
 
   private appendLive(entry: HistoryEntry): void {
     const tailSeq = this.tailSeq()
     if (tailSeq !== null && entry.event.seq <= tailSeq) return
-    this.entries = [...this.entries, entry]
+    this.entries.push(entry)
+    this.inspectionEntries = [...this.inspectionEntries, entry]
+    if (entry.event.type === 'assistant/message') {
+      this.inspectionEntries = compactHistoryInspectionEntries(this.inspectionEntries)
+    }
+  }
+
+  /** Append a chunk against the cached finalized projection; false means no visible publish. */
+  private appendIncrementalChunk(
+    entry: HistoryEntry,
+    event: SessionEvent<'assistant/chunk'>,
+  ): boolean {
+    const { turn, step, chunk } = event.data
+    if (!isVisibleAssistantChunk(chunk.type)) {
+      const inspection = this.currentInspection()
+      this.appendLive(entry)
+      this.inspectionCache = { entries: this.inspectionEntries, value: inspection }
+      return false
+    }
+    const base = this.currentInspection()
+    if (
+      this.streamPartial === null
+      || this.streamPartial.turn !== turn
+      || this.streamPartial.step !== step
+    ) {
+      const current = base.partial
+      this.streamPartial = new PartialAccumulator(
+        turn,
+        step,
+        current?.turn === turn && current.step === step ? current.blocks : [],
+      )
+    }
+    this.streamPartial.push(chunk)
+    this.appendLive(entry)
+    this.inspectionCache = {
+      entries: this.inspectionEntries,
+      value: { ...base, partial: this.streamPartial.toPartial() },
+    }
+    return true
+  }
+
+  /** Coalesce token-stream projection and rendering work to one publish per browser frame. */
+  private publishStreamDirty(): void {
+    if (this.streamPublishToken !== null) return
+    const token = {}
+    this.streamPublishToken = token
+    const publish = () => {
+      if (this.streamPublishToken !== token) return
+      this.streamPublishToken = null
+      this.notifier.markDirty()
+    }
+    if (typeof globalThis.requestAnimationFrame === 'function') {
+      globalThis.requestAnimationFrame(publish)
+    } else {
+      queueMicrotask(publish)
+    }
+  }
+
+  /** Publish structural changes immediately and invalidate an older scheduled stream publish. */
+  private publishDirtyNow(): void {
+    this.streamPublishToken = null
+    this.streamPartial = null
+    this.notifier.markDirty()
   }
 
   private async repairGap(): Promise<void> {
@@ -335,18 +409,24 @@ export class SessionHistorySource implements SessionHistoryFace {
   }
 
   private buildSnapshot(): SessionHistorySnapshot {
-    if (this.inspectionCache?.entries !== this.entries) {
-      const entries = this.entries
+    return {
+      state: this.state,
+      error: this.error,
+      hasMore: this.hasMore,
+      baseSeq: this.baseSeq,
+      inspection: this.currentInspection(),
+    }
+  }
+
+  /** Inspection pinned to the source's current immutable entry array. */
+  private currentInspection(): SessionHistorySnapshot['inspection'] {
+    if (this.inspectionCache?.entries !== this.inspectionEntries) {
+      const entries = this.inspectionEntries
       this.inspectionCache = {
         entries,
         value: createHistoryInspection(() => entries),
       }
     }
-    return {
-      state: this.state,
-      error: this.error,
-      hasMore: this.hasMore,
-      inspection: this.inspectionCache.value,
-    }
+    return this.inspectionCache.value
   }
 }

packages/client/runtime/src/client/sessions/assistant-timing.ts

@@ -0,0 +1,84 @@
+// Shared assistant step-timing fold: both transcript projections (the live
+// window adapter and the trajectory history fold) derive AssistantTiming from
+// the same step/start -> first token delta -> assistant/message sequence, so
+// the derivation lives once here instead of drifting per projection.
+
+import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
+import type { AssistantTiming } from './conversation.ts'
+
+/** Pre-finalize timing boundaries for one assistant step (start + first token). */
+export interface AssistantStepMetadata {
+  stepStartTime: number | null
+  firstTokenTime: number | null
+}
+
+/**
+ * Composite map key for one assistant step.
+ * @param turn - turn number from the event payload.
+ * @param step - step number from the event payload.
+ * @returns collision-free `turn`/`step` key (NUL separator).
+ */
+export function assistantStepKey(turn: number, step: number): string {
+  return `${turn}\u0000${step}`
+}
+
+/**
+ * Whether a chunk carries visible model output (first-token boundary). Empty
+ * deltas (heartbeats, empty tool-call frames) do not count as a first token.
+ * @param chunk - the assistant/chunk payload.
+ * @returns true when the chunk contains a non-empty text/reasoning/tool delta.
+ */
+export function isTokenDelta(chunk: SessionEvent<'assistant/chunk'>['data']['chunk']): boolean {
+  switch (chunk.type) {
+    case 'text-delta':
+    case 'reasoning-delta':
+      return chunk.text !== ''
+    case 'tool-call-delta':
+      return chunk.argumentsDelta !== '' || chunk.name !== undefined
+    default:
+      return false
+  }
+}
+
+/**
+ * Fold one event into the per-step timing index: step/start opens the entry,
+ * the first non-empty token delta stamps first-token time once. Other event
+ * types are no-ops.
+ * @param steps - the mutable per-step index, keyed by {@link assistantStepKey}.
+ * @param event - the raw window event.
+ */
+export function indexAssistantStepTiming(steps: Map<string, AssistantStepMetadata>, event: SessionEvent): void {
+  if (event.type === 'step/start') {
+    steps.set(
+      assistantStepKey(event.data.turn, event.data.step),
+      { stepStartTime: event.time, firstTokenTime: null },
+    )
+  } else if (event.type === 'assistant/chunk' && isTokenDelta(event.data.chunk)) {
+    const key = assistantStepKey(event.data.turn, event.data.step)
+    const current = steps.get(key) ?? { stepStartTime: null, firstTokenTime: null }
+    if (current.firstTokenTime === null) {
+      steps.set(key, { ...current, firstTokenTime: event.time })
+    }
+  }
+}
+
+/**
+ * Settle one finalized assistant message's timing from its step entry; a step
+ * whose start or first token fell outside the window yields null boundaries.
+ * @param steps - the per-step index built by {@link indexAssistantStepTiming}.
+ * @param turn - the assistant/message turn number.
+ * @param step - the assistant/message step number.
+ * @param completedTime - the assistant/message event timestamp (epoch ms).
+ * @returns the node-ready timing record.
+ */
+export function settledAssistantTiming(
+  steps: ReadonlyMap<string, AssistantStepMetadata>,
+  turn: number,
+  step: number,
+  completedTime: number,
+): AssistantTiming {
+  return {
+    ...(steps.get(assistantStepKey(turn, step)) ?? { stepStartTime: null, firstTokenTime: null }),
+    completedTime,
+  }
+}

packages/client/runtime/src/client/sessions/context-provenance.ts

@@ -0,0 +1,116 @@
+// Context provenance projection: the role and the human-facing producer name
+// of one logged non-user `user/message`, read from its durable `source` alone.
+// The client keeps no table of known plugin ids — a renamed or newly mounted
+// producer must never need a client release to stay identifiable, and a resumed
+// or foreign log must project the same way as a live one.
+
+/**
+ * Which model-facing role a logged non-user message plays.
+ *
+ * `recall` marks material lifted out of another session's log; `inject` marks
+ * every other producer-supplied context. Mid-turn steering is the third role
+ * the transcript distinguishes, but it has its own event and node kind
+ * (`steering/message` / `SteeringMessageNode`) and never reaches here.
+ */
+export type ContextRole = 'inject' | 'recall'
+
+/** Role and producer name presented for one logged non-user message. */
+export interface ContextProvenanceView {
+  /** The role this context plays in the model-facing conversation. */
+  role: ContextRole
+  /**
+   * Producer name for the row header, taken from the durable source: the
+   * instruction paths, the referenced session titles, the plugin id, or the
+   * bare source kind for a producer this UI version does not know. Null only
+   * when the source carries no readable kind at all.
+   */
+  label: string | null
+}
+
+/** One durable source narrowed to the readable-record shape; null for anything else. */
+function asRecord(value: unknown): Record<string, unknown> | null {
+  return typeof value === 'object' && value !== null && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null
+}
+
+/** A record field read as a non-empty string, or null. */
+function readString(record: Record<string, unknown>, key: string): string | null {
+  const value = record[key]
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+/** Distinct non-empty `field` values of an array-valued source member, in first-seen order. */
+function collect(source: Record<string, unknown>, member: string, field: string): string[] {
+  const list = source[member]
+  if (!Array.isArray(list)) return []
+  const seen: string[] = []
+  for (const entry of list) {
+    const record = asRecord(entry)
+    const value = record === null ? null : readString(record, field)
+    if (value !== null && !seen.includes(value)) seen.push(value)
+  }
+  return seen
+}
+
+/** A collected name list rendered as one label; null when the list is empty. */
+function joined(names: string[]): string | null {
+  return names.length > 0 ? names.join(', ') : null
+}
+
+/**
+ * Project one durable message source onto its transcript role and producer name.
+ *
+ * The source arrives over the wire as opaque JSON (`MessageSource` is
+ * merge-extensible, so no client-side union can be exhaustive), and a durable
+ * log may predate or postdate this UI; every unreadable shape therefore
+ * degrades to `inject` with whatever name the record still carries.
+ * @param source - the logged `user/message` source, exactly as recorded.
+ * @returns the role and producer name to present for this context.
+ */
+export function contextProvenance(source: unknown): ContextProvenanceView {
+  const record = asRecord(source)
+  const kind = record === null ? null : readString(record, 'kind')
+  if (record === null || kind === null) return { role: 'inject', label: null }
+  switch (kind) {
+    // Cross-session snapshots are the one durable source that carries another
+    // session's material; its references name the sessions they were read from.
+    case 'session-reference':
+      return { role: 'recall', label: joined(collect(record, 'references', 'label')) ?? kind }
+    // Workspace instructions name the files they were reconciled from, which
+    // identifies the producer far better than the plugin id would.
+    case 'workspace-instructions':
+      return { role: 'inject', label: joined(collect(record, 'changes', 'path')) ?? kind }
+    case 'plugin':
+      return { role: 'inject', label: readString(record, 'plugin') ?? kind }
+    // Documented default arm of the merge-extensible source map: an unknown
+    // producer still identifies itself by its own durable kind.
+    default:
+      return { role: 'inject', label: kind }
+  }
+}
+
+/**
+ * Context forms this UI version renders with a dedicated presentation. The
+ * durable vocabulary (`ContextForm` in `dsh-llm`) may already be wider — an
+ * unrecognized or absent value degrades to the opaque presentation rather than
+ * dropping the row, so a log written by a newer or foreign producer still
+ * renders.
+ */
+const KNOWN_FORMS = ['instructions', 'catalog', 'snapshot', 'notice', 'relay', 'recall'] as const
+
+/** One durable context form this UI version knows how to present. */
+export type KnownContextForm = typeof KNOWN_FORMS[number]
+
+/**
+ * Read the producer-declared form off one durable message source.
+ * @param source - the logged `user/message` source, exactly as recorded.
+ * @returns the form when this UI version presents it, otherwise null (opaque).
+ */
+export function contextForm(source: unknown): KnownContextForm | null {
+  const record = asRecord(source)
+  const form = record === null ? null : readString(record, 'form')
+  return form !== null && (KNOWN_FORMS as readonly string[]).includes(form)
+    ? form as KnownContextForm
+    : null
+}

packages/client/runtime/src/client/sessions/conversation.ts

@@ -4,12 +4,15 @@
 // string here (narrow to real brands when convenient).
 
 import type { CommandId } from '@deepseek-ai/dsh-commands/brand'
+import type { MessageId } from '@deepseek-ai/dsh-llm/brand'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
+import type { LlmRetryEventData } from '@deepseek-ai/dsh-llm-retry/types'
 import type { TodoItem } from '@deepseek-ai/dsh-session/types'
 import type {
-  RpcError, SessionId, ToolCallView, ToolResultView,
+  RpcError, SessionId, SubagentAddress, ToolCallView, ToolResultView,
 } from '@deepseek-ai/dsh-client-connection/client'
 import type { PendingInteraction } from './pending.ts'
+import type { ContextProvenanceView, KnownContextForm } from './context-provenance.ts'
 export type { TodoItem }
 
 /** Request configuration recorded for one provider call. */
@@ -100,13 +103,14 @@ export interface AssistantMessageNode {
   interrupted?: true
 }
 
-/** A steering message injected mid-turn. */
+/** A human message admitted from the next-step inbox while a turn was running. */
 export interface SteeringMessageNode {
   kind: 'steering'
+  /** Stable message identity shared with its pre-admission inbox occurrence. */
+  messageId: MessageId
   seq: number
   /** Unix epoch ms from the source session event. */
   time: number
-  turn: number
   content: readonly ContentBlock[]
   source: unknown
 }
@@ -119,6 +123,36 @@ export interface ContextMessageNode {
   time: number
   content: readonly ContentBlock[]
   source: unknown
+  /** Role and producer name projected from `source` ({@link contextProvenance}). */
+  provenance: ContextProvenanceView
+  /** Producer-declared information form ({@link contextForm}); null presents as opaque. */
+  form: KnownContextForm | null
+}
+
+/** Durable notice that a closed failed step is waiting for a model-request retry. */
+export type ModelRetryNode = LlmRetryEventData & {
+  kind: 'model-retry'
+  seq: number
+  /** Unix epoch ms from the llm/retry session event. */
+  time: number
+  /**
+   * Client-derived lifecycle: scheduled until a retry turn starts, started
+   * once it does, or cancelled when the failed turn aborts first.
+   */
+  retryState: 'scheduled' | 'started' | 'cancelled'
+}
+
+/** Durable terminal failure for a turn that has no scheduled retry. */
+export interface TurnErrorNode {
+  kind: 'turn-error'
+  /** Seq of the owning turn/end event. */
+  seq: number
+  /** Unix epoch ms from the turn/end event. */
+  time: number
+  turn: number
+  step: number
+  message: string
+  code?: string
 }
 
 /** A tool result paired (when in-window) with its call head. */
@@ -142,7 +176,32 @@ export interface ToolResultNode {
   resultView: ToolResultView | null
 }
 
-/** Fallback for surface events this UI version does not know. */
+/**
+ * One landed compaction, marked at the checkpoint's own log position. The
+ * conversation it shadowed on the model surface stays in the transcript above
+ * it: the marker reports where the model stopped seeing that history, it does
+ * not replace it. The framed checkpoint payload is an instruction envelope
+ * written for the model and never renders.
+ */
+export interface CompactionSummaryNode {
+  kind: 'compaction'
+  /** Seq of the replacement `user/message` that landed the checkpoint. */
+  seq: number
+  /** Unix epoch ms of the checkpoint event. */
+  time: number
+  /** Summary text from the checkpoint's `compact/summary` provenance; null when
+   *  the window cut left that provenance outside (the marker is then not expandable). */
+  summary: string | null
+}
+
+/**
+ * Fallback for surface events this UI version does not know: the documented
+ * default arm of `SessionEventMap`, which is merge-extensible, so the
+ * projection's switch cannot end in `assertNever`. No event produces this node
+ * today — `isAppendSurfaceEvent` admits only the four types in core's
+ * `SurfaceEventType`, and each has its own arm — and it exists so widening that
+ * set core-side degrades to a raw row instead of dropping the event silently.
+ */
 export interface UnknownSurfaceNode {
   kind: 'unknown'
   seq: number
@@ -155,7 +214,7 @@ export interface UnknownSurfaceNode {
 /**
  * One slash-command lifecycle folded from the log-only `command/run` /
  * `command/done` pair (paired by commandId, mirroring tool call↔result).
- * Log-only events never enter the surface fold, so the FoldAdapter indexes
+ * Log-only events are not surface events, so the TranscriptAdapter indexes
  * them separately and merges the nodes into the flow by seq. A window cut
  * between the pair soft-falls like tool pairs: a done with no in-window run
  * still builds a node (name/args null), and a run with no done renders as
@@ -186,8 +245,11 @@ export type ConversationNode =
   | AssistantMessageNode
   | SteeringMessageNode
   | ContextMessageNode
+  | ModelRetryNode
+  | TurnErrorNode
   | ToolResultNode
   | CommandNode
+  | CompactionSummaryNode
   | UnknownSurfaceNode
 
 /**
@@ -197,7 +259,7 @@ export type ConversationNode =
  * {@link RunningToolCall} (rows derive the running state from the shape,
  * exactly as for native calls) and its `tool/code-dispatch` settlement
  * replaces it in place with the {@link ToolResultNode} form. Never part of
- * the surface `nodes` flow — sub-calls live under their parent via
+ * the transcript `nodes` flow — sub-calls live under their parent via
  * {@link ConversationSnapshot.codeDispatches}. `callId` is the deterministic
  * sub-call id (`<parent>:code:<n>`); the call side carries the sub-tool name
  * and its JSON-stringified logged arguments; `content`/`isError` are the
@@ -219,10 +281,18 @@ export interface RunningToolCall {
 }
 
 
-/** One queued-message row mirrored from `session/queued` frames (key: the enqueueing prompt's rpcId when wire-sourced). */
+/** One transient inbox occurrence from the authoritative `session/queue` snapshot. */
 export interface QueuedMessage {
-  readonly key: string
+  readonly id: MessageId
+  /** Stable message identity used for transient-to-durable steering handoff. */
+  readonly messageId: MessageId
+  /** Agent-resolved placement; only queued rows accept queue mutations. */
+  readonly placement: 'queued' | 'steering' | 'context'
+  /** Complete content used to render pending steering before it becomes durable. */
+  readonly content: readonly ContentBlock[]
   readonly preview: string
+  /** Complete editable text; null when the message contains non-text blocks. */
+  readonly text: string | null
 }
 
 /** In-progress assistant output (chunk accumulator product). */
@@ -266,10 +336,12 @@ export interface PromptError {
 /** The immutable snapshot contract Session hands to uSES (see the web client architecture RFC). */
 export interface ConversationSnapshot {
   sessionId: SessionId
-  /** Surface fold product (finalized conversation nodes in surface order). */
+  /** Human transcript plus retry notices and interrupted-turn terminal nodes in event order. */
   nodes: readonly ConversationNode[]
-  /** Fold degradation flag (cross-window replace defense): when true, nodes come from the lenient linear scan. */
-  foldDegraded: boolean
+  /** Exact in-window `turn/start` time and optional matching `turn/end` time. */
+  turnTimings: ReadonlyMap<number, { readonly startTime: number; readonly endTime?: number }>
+  /** In-window completed turn number -> its `turn/end` event seq. */
+  turnEnds: ReadonlyMap<number, number>
   partial: PartialAssistant | null
   runningCalls: readonly RunningToolCall[]
   /**
@@ -280,9 +352,14 @@ export interface ConversationSnapshot {
    */
   codeDispatches: ReadonlyMap<string, readonly CodeSubCall[]>
   pending: readonly PendingInteraction[]
-  /** Read-only inbox mirror (session/queued frames + mux-open baseline; cleared by the leave-running flip). */
+  /** Authoritative transient inbox snapshot, including queued and steering placements. */
   queue: readonly QueuedMessage[]
   running: boolean
+  /**
+   * Catalog-discovered continuation address. Its parent availability controls
+   * human input; null means ordinary session transport.
+   */
+  subagent: { address: SubagentAddress; parentAvailable: boolean } | null
   /** Input-area shape (see {@link ComposerPhase}); derived here, switched on by consumers. */
   composerPhase: ComposerPhase
   /** Set after host/session-removed; the UI grays out and disables input. */

packages/client/runtime/src/client/sessions/failure-display.ts

@@ -0,0 +1,13 @@
+/**
+ * Convert a durable failure into copy that is safe to expose in the GUI.
+ * @param failure - Failure value preserved by the session event.
+ * @returns Display-safe copy for client projections.
+ */
+export function displayFailureMessage(failure: unknown): string {
+  if (failure === null || typeof failure !== 'object') return String(failure)
+  const record = failure as { code?: unknown; message?: unknown }
+  // Provider AUTH messages may echo a masked or partially preserved credential.
+  // Keep the raw diagnostic in the session log, but never project it into UI state.
+  if (record.code === 'AUTH') return 'API key is invalid'
+  return typeof record.message === 'string' ? record.message : JSON.stringify(failure)
+}

packages/client/runtime/src/client/sessions/fold-adapter.ts

@@ -1,283 +0,0 @@
-// FoldAdapter: core SurfaceManager wiring + node materialization cache.
-// Padding sentinels solve the paged-window seq offset (core fold asserts seq === index);
-// a cross-window replace throw degrades to a lenient linear scan (foldDegraded —
-// the degradation lives in one branch function in this file, zero scattered removal points).
-
-import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
-// Subpath export (package.json exports "./surface", alias added for this): all value imports
-// go through it — the package root points at lib/index.js (needs a build) which the vite
-// browser bundle cannot resolve; surface.ts has no Node dependencies.
-import {
-  SurfaceManager, isSurfaceEligibleType, isSurfaceEvent,
-} from '@deepseek-ai/dsh-session/surface'
-import type { CommandId } from '@deepseek-ai/dsh-commands/brand'
-import type { ToolCallView, ToolEventView, ToolResultView } from '@deepseek-ai/dsh-client-connection/client'
-import type { CommandNode, ConversationNode } from './conversation.ts'
-import { toAssistantBlocks } from './conversation.ts'
-
-/** In-window tool/call index entry (result-card backfill + runningCalls material). */
-export interface CallIndexEntry {
-  name: string
-  argsRaw: string
-  turn: number
-  step: number
-  /** Unix epoch ms of the tool/call event. */
-  time: number
-  /** Wire view riding the tool/call (envelope-level; never inside the event). */
-  callView: ToolCallView | null
-}
-
-/** Non-surface sentinel used to preserve paged-window sequence offsets.
- * `noop/padding` is deliberately not a real event type, so it cannot acquire
- * surface behavior; this cast is the only synthetic event entry point.
- */
-function paddingEvent(seq: number): SessionEvent {
-  return { type: 'noop/padding', seq, time: 0, data: {} } as unknown as SessionEvent
-}
-
-function replacementCrossesWindowHead(event: SessionEvent, baseSeq: number): boolean {
-  if (!isSurfaceEvent(event) || event.surfaceOp === 'append') return false
-  return event.surfaceOp.start < baseSeq || event.surfaceOp.end < baseSeq
-}
-
-/** One event -> UI node (pure function; the six-variant ConversationNode union). */
-function materializeNode(
-  event: SessionEvent,
-  callIndex: ReadonlyMap<string, CallIndexEntry>,
-  resultView: ToolResultView | null,
-): ConversationNode {
-  switch (event.type) {
-    case 'user/message':
-      // Injected context (plugin/goal source) folds to a context node, not a
-      // user message; only a direct human prompt is a user node.
-      if (event.data.source.kind !== 'user') {
-        return {
-          kind: 'context', seq: event.seq, time: event.time,
-          content: event.data.content, source: event.data.source,
-        }
-      }
-      return {
-        kind: 'user', seq: event.seq, time: event.time,
-        content: event.data.content, source: event.data.source,
-      }
-    case 'assistant/message':
-      return {
-        kind: 'assistant', seq: event.seq, time: event.time,
-        turn: event.data.turn, step: event.data.step,
-        blocks: toAssistantBlocks(event.data.message.content), usage: event.data.usage,
-      }
-    case 'steering/message':
-      return {
-        kind: 'steering', seq: event.seq, time: event.time, turn: event.data.turn,
-        content: event.data.message.content, source: event.data.message.source,
-      }
-    case 'tool/result': {
-      const result = event.data.message.content[0]
-      const callId = String(event.data.message.source.callId)
-      const call = callIndex.get(callId)
-      return {
-        kind: 'tool-result', seq: event.seq, time: event.time,
-        callId,
-        call: call ? { name: call.name, argsRaw: call.argsRaw } : null,
-        callTime: call?.time ?? null,
-        content: result.content, isError: result.isError === true,
-        ...(event.data.error !== undefined ? { error: event.data.error } : {}),
-        meta: event.data.meta,
-        callView: call?.callView ?? null,
-        resultView,
-      }
-    }
-    /* v8 ignore next 2 -- defensive arm: fold output only carries the four
-    surface-eligible types, and each has a case above; reachable only if core
-    adds an eligible type. */
-    default:
-      return {
-        kind: 'unknown', seq: event.seq, time: event.time,
-        type: event.type, data: (event as { data?: unknown }).data,
-      }
-  }
-}
-
-/** Window fold over the core SurfaceManager (sentinel padding for the seq offset; degrades to a linear scan on cross-window replace). */
-export class FoldAdapter {
-  /** padded = [sentinel x baseSeq, ...window events]; SurfaceManager borrows this reference for lazy incremental folding. */
-  private padded: SessionEvent[] = []
-  private baseSeq = 0
-  private surface = new SurfaceManager(this.padded)
-  private nodeCache = new Map<number, ConversationNode>()
-  private degraded = false
-  private callIdx = new Map<string, CallIndexEntry>()
-  /** Wire result views keyed by the tool/result event's seq (views ride the envelope, not the event). */
-  private resultViews = new Map<number, ToolResultView>()
-  /**
-   * Command lifecycle nodes by commandId (insertion = run order). The
-   * `command/run`/`command/done` pair is log-only, so the surface fold never
-   * emits it; this index folds the pair (done settles its run's node in
-   * place) and nodes() merges the products into the flow by seq. Window cuts
-   * soft-fall like tool pairs: a done with no in-window run still builds a
-   * node.
-   */
-  private commandIdx = new Map<string, CommandNode>()
-  /** Window revision (bumped on reset/append) keying the nodes() result cache: an unchanged
-   *  window returns the previous ARRAY reference, not just cached elements — the snapshot's
-   *  reference-stability contract (§A.9.4) starts here. */
-  private rev = 0
-  private nodesResult: { rev: number; value: { nodes: ConversationNode[]; degraded: boolean } } | null = null
-
-  /** In-window tool/call index (Session uses it for runningCalls and result-card backfill). */
-  get callIndex(): ReadonlyMap<string, CallIndexEntry> {
-    return this.callIdx
-  }
-
-  /**
-   * Window rebuild (after open/resync/page prepend): new padded array, new
-   * SurfaceManager, cleared cache, rebuilt callIndex.
-   * @param events - the new window contents (seq-ascending).
-   * @param baseSeq - seq of the window head (sentinels pad below it).
-   * @param views - per-event wire views aligned with `events` by index (undefined slots for view-less events).
-   */
-  reset(events: readonly SessionEvent[], baseSeq: number, views?: readonly (ToolEventView | undefined)[]): void {
-    this.rev++
-    this.baseSeq = baseSeq
-    this.padded = []
-    for (let i = 0; i < baseSeq; i++) this.padded.push(paddingEvent(i))
-    for (const event of events) this.padded.push(event)
-    this.surface = new SurfaceManager(this.padded)
-    this.nodeCache.clear()
-    this.degraded = events.some(event => replacementCrossesWindowHead(event, baseSeq))
-    this.callIdx = new Map()
-    this.resultViews.clear()
-    this.commandIdx = new Map()
-    for (let i = 0; i < events.length; i++) {
-      const event = events[i]
-      /* v8 ignore next -- dense-array guard: i stays within events.length, so the undefined arm needs a sparse array no caller builds. */
-      if (event !== undefined) {
-        this.indexCall(event, views?.[i])
-        this.indexCommand(event)
-      }
-    }
-  }
-
-  /**
-   * Tail append (live session/event): push into the same array (incremental
-   * lazy fold applies) + incremental callIndex upkeep.
-   * @param event - the live event (seq = window tail + 1).
-   * @param view - host-computed tool view paired with the event when it is a tool call/result; indexed for card rendering.
-   */
-  append(event: SessionEvent, view?: ToolEventView): void {
-    this.rev++
-    this.padded.push(event)
-    if (replacementCrossesWindowHead(event, this.baseSeq)) this.degraded = true
-    this.indexCall(event, view)
-    this.indexCommand(event)
-  }
-
-  /**
-   * Current node array + degradation flag. Same revision -> same array
-   * reference (memo boundary); node object references always come from the per-seq cache.
-   * @returns the fold projection for the current window revision.
-   */
-  nodes(): { nodes: ConversationNode[]; degraded: boolean } {
-    if (this.nodesResult !== null && this.nodesResult.rev === this.rev) return this.nodesResult.value
-    let seqs: readonly number[]
-    if (this.degraded) {
-      seqs = this.degradedSeqs()
-    } else {
-      try {
-        seqs = this.surface.nodes
-      } catch (error) {
-        console.error('[web-runtime] surface fold failed, degrading to linear scan:', error)
-        this.degraded = true
-        seqs = this.degradedSeqs()
-      }
-    }
-    const out: ConversationNode[] = []
-    for (const seq of seqs) {
-      const cached = this.nodeCache.get(seq)
-      if (cached !== undefined) {
-        out.push(cached)
-        continue
-      }
-      const event = this.padded[seq]
-      /* v8 ignore next -- sparse guard: both seq sources (surface fold and degradedSeqs) only emit indexes present in padded. */
-      if (event === undefined) continue
-      const node = materializeNode(event, this.callIdx, this.resultViews.get(seq) ?? null)
-      this.nodeCache.set(seq, node)
-      out.push(node)
-    }
-    // Command nodes fold outside the surface (log-only events); merge by seq.
-    // Both inputs are seq-ascending (surface order and run-index insertion
-    // order share the log order), so one linear merge keeps flow order.
-    let nodes = out
-    if (this.commandIdx.size > 0) {
-      nodes = []
-      const commands = [...this.commandIdx.values()]
-      let next = 0
-      for (const node of out) {
-        for (let cmd = commands[next]; cmd !== undefined && cmd.seq < node.seq; cmd = commands[++next]) {
-          nodes.push(cmd)
-        }
-        nodes.push(node)
-      }
-      for (let cmd = commands[next]; cmd !== undefined; cmd = commands[++next]) nodes.push(cmd)
-    }
-    const value = { nodes, degraded: this.degraded }
-    this.nodesResult = { rev: this.rev, value }
-    return value
-  }
-
-  /** Degradation branch: lenient linear scan ignoring surfaceOp/replace (all surface-eligible events in append order). */
-  private degradedSeqs(): number[] {
-    const seqs: number[] = []
-    for (let i = this.baseSeq; i < this.padded.length; i++) {
-      const event = this.padded[i]
-      if (event !== undefined && isSurfaceEligibleType(event.type)) seqs.push(event.seq)
-    }
-    return seqs
-  }
-
-  /** Fold one command lifecycle event into its node (run mints, done settles in place; done-only soft-falls). */
-  private indexCommand(event: SessionEvent): void {
-    // Log-only plugin events: the host-side dsh-commands declaration cannot
-    // enter the client program, so this wire consumer narrows structurally
-    // (the same posture as tool/code-dispatch in session.ts).
-    if ((event.type as string) === 'command/run') {
-      const data = event.data as unknown as { commandId: CommandId; name: string; args?: string }
-      this.commandIdx.set(data.commandId, {
-        kind: 'command', seq: event.seq, time: event.time,
-        commandId: data.commandId, name: data.name, args: data.args ?? null, outcome: null,
-      })
-      return
-    }
-    if ((event.type as string) !== 'command/done') return
-    const data = event.data as unknown as { commandId: CommandId; kind: 'success' | 'error'; text?: string }
-    const run = this.commandIdx.get(data.commandId)
-    const outcome = { kind: data.kind, ...data.text === undefined ? {} : { text: data.text } }
-    if (run === undefined) {
-      // Cross-window cut: the run page fell out of the window — build the
-      // node from the done alone (same soft-fall as a call-less tool result).
-      this.commandIdx.set(data.commandId, {
-        kind: 'command', seq: event.seq, time: event.time,
-        commandId: data.commandId, name: null, args: null, outcome,
-      })
-      return
-    }
-    // Settle in place: a fresh node object (published references stay immutable).
-    this.commandIdx.set(data.commandId, { ...run, outcome })
-  }
-
-  private indexCall(event: SessionEvent, view?: ToolEventView): void {
-    if (event.type === 'tool/result') {
-      if (view?.for === 'result') this.resultViews.set(event.seq, view.view)
-      return
-    }
-    if (event.type !== 'tool/call') return
-    this.callIdx.set(String(event.data.callId), {
-      name: event.data.name, argsRaw: event.data.arguments, turn: event.data.turn, step: event.data.step,
-      time: event.time,
-      callView: view?.for === 'call' ? view.view : null,
-    })
-    // No backfill into already-materialized tool-result nodes for this callId
-    // (window order puts the call before its result; cannot happen on the normal path).
-  }
-}

packages/client/runtime/src/client/sessions/history.ts

@@ -7,6 +7,24 @@ import type { ConversationContext } from './conversation-context.ts'
 import { projectConversationHistory } from '../session-history/history-fold.ts'
 import { inspectRequests, type RequestView } from './request-inspection.ts'
 
+function assistantStepKey(turn: number, step: number): string {
+  return `${turn}\u0000${step}`
+}
+
+function isFirstTokenCandidate(entry: HistoryEntry): boolean {
+  const event = entry.event
+  if (event.type !== 'assistant/chunk') return false
+  switch (event.data.chunk.type) {
+    case 'text-delta':
+    case 'reasoning-delta':
+      return event.data.chunk.text !== ''
+    case 'tool-call-delta':
+      return event.data.chunk.argumentsDelta !== '' || event.data.chunk.name !== undefined
+    default:
+      return false
+  }
+}
+
 /** Lazily derived inspection data for one immutable session-history window. */
 export interface SessionHistoryInspection {
   eventNodes: readonly ConversationNode[]
@@ -19,6 +37,47 @@ export interface SessionHistoryInspection {
   codeDispatches: ReadonlyMap<string, readonly CodeSubCall[]>
 }
 
+/**
+ * Remove completed-step token payloads that no inspection projection reads.
+ * The first visible token preserves timing, usage chunks preserve accounting,
+ * and unfinished steps retain every chunk for live or interrupted content.
+ * @param entries - Contiguous raw history entries in sequence order.
+ * @returns A projection-equivalent, usually much smaller entry ledger.
+ */
+export function compactHistoryInspectionEntries(
+  entries: readonly HistoryEntry[],
+): readonly HistoryEntry[] {
+  const completedSteps = new Set<string>()
+  for (const { event } of entries) {
+    if (event.type === 'assistant/message') {
+      completedSteps.add(assistantStepKey(event.data.turn, event.data.step))
+    }
+  }
+
+  const firstTokenSteps = new Set<string>()
+  const compacted: HistoryEntry[] = []
+  let changed = false
+  for (const entry of entries) {
+    const event = entry.event
+    if (event.type !== 'assistant/chunk') {
+      compacted.push(entry)
+      continue
+    }
+    const key = assistantStepKey(event.data.turn, event.data.step)
+    if (!completedSteps.has(key) || event.data.chunk.type === 'usage') {
+      compacted.push(entry)
+      continue
+    }
+    if (isFirstTokenCandidate(entry) && !firstTokenSteps.has(key)) {
+      firstTokenSteps.add(key)
+      compacted.push(entry)
+    } else {
+      changed = true
+    }
+  }
+  return changed ? compacted : entries
+}
+
 /**
  * Create a lazy inspection projection over an immutable history window.
  * Conversation consumers retain the cheap wrapper; only Trajectory snapshots

packages/client/runtime/src/client/sessions/lineage.ts

@@ -3,13 +3,17 @@
 // Orphaned lineage degrades to root level; cycles fail soft and emit as roots.
 
 import type { SessionId, SessionSummary } from '@deepseek-ai/dsh-client-connection/client'
+import type { SessionProjectionMap } from '@deepseek-ai/dsh-session-projection/types'
+import type { PendingInteractionStatus } from './pending.ts'
 
 /** Host list summary enriched with the latest mux-projected durable title. */
 export interface TitledSessionSummary extends SessionSummary {
   title?: string
+  /** Current host-computed projection values for list consumers. */
+  projectionValues?: Readonly<Partial<SessionProjectionMap>>
 }
 
-/** One flattened session-list row (summary + lineage indent depth + live pending-approval bit). */
+/** One flattened session-list row with lineage depth and live pending interaction. */
 export interface SessionListEntry {
   sessionId: SessionId
   title?: string
@@ -18,9 +22,13 @@ export interface SessionListEntry {
   /** Empty-log bit mirrored from the summary; lists hide blank sessions (filtering stays with the consumer). */
   blank: boolean
   parentSessionId?: SessionId
+  /** Coarse durable origin for navigation filtering; not a continuation capability. */
+  origin?: 'subagent'
   cwd?: string
-  /** An approval question is pending on this session (mux-frame derived; the sidebar's amber dot). */
-  waitingApproval: boolean
+  /** Current host-computed projection values for list consumers. */
+  projectionValues?: Readonly<Partial<SessionProjectionMap>>
+  /** User interaction currently blocking this session, derived from live mux frames. */
+  pendingInteraction?: PendingInteractionStatus
   /** Lineage indent depth: root = 0; the UI just multiplies by the indent width. */
   depth: number
 }
@@ -30,10 +38,13 @@ export interface SessionListEntry {
  * follows the established input order; this projection never re-sorts a
  * hydrated list from mutable timestamps.
  * @param summaries - the host's session.list items.
- * @param waitingApproval - sessions with a pending approval question (manager-owned live fact; absent = false).
+ * @param pendingInteractions - current manager-owned interaction status by session.
  * @returns display rows in render order.
  */
-export function flattenLineage(summaries: readonly TitledSessionSummary[], waitingApproval?: ReadonlySet<SessionId>): SessionListEntry[] {
+export function flattenLineage(
+  summaries: readonly TitledSessionSummary[],
+  pendingInteractions?: ReadonlyMap<SessionId, PendingInteractionStatus>,
+): SessionListEntry[] {
   const byId = new Map<SessionId, TitledSessionSummary>()
   for (const s of summaries) byId.set(s.sessionId, s)
 
@@ -57,7 +68,12 @@ export function flattenLineage(summaries: readonly TitledSessionSummary[], waiti
       return
     }
     visited.add(s.sessionId)
-    out.push({ ...s, waitingApproval: waitingApproval?.has(s.sessionId) ?? false, depth })
+    const pendingInteraction = pendingInteractions?.get(s.sessionId)
+    out.push({
+      ...s,
+      ...(pendingInteraction === undefined ? {} : { pendingInteraction }),
+      depth,
+    })
     const kids = children.get(s.sessionId)
     if (kids === undefined) return
     for (const kid of kids) walk(kid, depth + 1)

packages/client/runtime/src/client/sessions/manager.ts

@@ -2,13 +2,17 @@
 // dispatch entry + list state, constructed and held by SessionsService (one per client runtime).
 // List data never enters zustand; React connects via subscribe/getListSnapshot.
 
-import type { IApiClient, HostFrame, MuxFrame, RpcError, RpcRequest, RpcResult, SessionId, SessionSummary, WorkspaceId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  IApiClient, HostFrame, MuxFrame, RpcError, RpcRequest, RpcResult, SessionId,
+  SessionSummary, SubagentAddress, SubagentCatalog, WorkspaceId,
+} from '@deepseek-ai/dsh-client-connection/client'
 // Value import from the inline-safe wire layer (not the connection plugin):
 // plugin-to-plugin value imports are a bundle purity error.
 import { transportError } from '@deepseek-ai/dsh-host-apiproxy/api'
 import { mergeOrderedBaseline } from '../ordered-baseline.ts'
 import type { SessionListEntry, TitledSessionSummary } from './lineage.ts'
 import { flattenLineage } from './lineage.ts'
+import type { PendingInteractionStatus } from './pending.ts'
 // Type-only merge edge: the title domain's client-namespace outlet declares
 // the 'title' projection key this manager projects into list rows (and any
 // useProjection('title') consumer reads). Zero value imports by construction.
@@ -27,6 +31,12 @@ import { Session } from './session.ts'
  */
 export type SessionListPhase = 'pending' | 'ready'
 
+/** Request-local content hit returned to sidebar search consumers. */
+export interface SessionSearchResultItem {
+  sessionId: SessionId
+  snippet: string
+}
+
 /** Immutable session-list snapshot for useSessionList. */
 export interface SessionListSnapshot {
   items: readonly SessionListEntry[]
@@ -36,6 +46,22 @@ export interface SessionListSnapshot {
   /** Arrival lifecycle (see {@link SessionListPhase}); `state` stays the pull-activity axis. */
   phase: SessionListPhase
   error: RpcError | null
+  subagentsByParent: Readonly<Record<SessionId, SubagentCatalogSnapshot>>
+  currentAddress: SubagentAddress | undefined
+}
+
+/** One parent-addressed durable catalog projected through the sessions snapshot. */
+export interface SubagentCatalogSnapshot extends SubagentCatalog {
+  state: 'loading' | 'ready' | 'error'
+  error: RpcError | null
+}
+
+interface CatalogInflight {
+  readonly promise: Promise<void>
+  readonly expandableRows: Set<SessionId>
+  readonly activityRows: Map<SessionId, 'running' | 'inactive'>
+  /** Removal-time invalidation replayed over the response this request predates. */
+  parentAvailableOverride: false | undefined
 }
 
 type SessionListMutation =
@@ -45,23 +71,44 @@ type SessionListMutation =
   /** Local first-send flip: the sender clears blank without waiting for a host frame. */
   | { kind: 'engaged'; sessionId: SessionId }
 
-/** Per-session cap for pre-instantiation approval/question buffering (low-frequency frames; a few dozen covers any real backlog). */
-const PENDING_BUFFER_CAP = 32
+/** Stable identity of a frame retained until an uninstantiated Session can consume it. */
+function bufferedRequestKey(envelope: RpcRequest<MuxFrame>): string | undefined {
+  const frame = envelope.payload
+  switch (frame.type) {
+    case 'approval/requested': return `a:${frame.approvalId}`
+    case 'question/requested': return `q:${envelope.rpcId}`
+    case 'session/queue': return 'queue'
+    /* v8 ignore next -- pendingBuffers contains only the three frame types above. */
+    default: return undefined
+  }
+}
 
+/** Match ui-question's binary plan-review routing at the wire boundary. */
+function questionInteractionStatus(
+  questions: Extract<MuxFrame, { type: 'question/requested' }>['questions'],
+): PendingInteractionStatus {
+  if (questions.length !== 1) return 'question'
+  const question = questions[0] as typeof questions[number]
+  const intent = question.intent
+  if (intent?.kind !== 'plan-review' || question.detail === undefined) return 'question'
+  if (question.multiSelect === true) return 'question'
+  const options = question.options ?? []
+  if (options.length > 2) return 'question'
+  return options.some(option => option.label === intent.approve) ? 'plan-review' : 'question'
+}
 
 /** Instance cluster + frame entry + the session list (see the web client architecture RFC). */
 export class SessionManager {
   private readonly sessions = new Map<SessionId, Session>()
-  /** Approval/question frame buffer for uninstantiated sessions: pending interactions never hit
-   *  history (cannot be backfilled on open), the one frame class that must not take the
-   *  drop-and-backfill path; replayed and cleared on instantiation. Bounded per session (these
-   *  frames are low-frequency; overflow drops oldest) and dropped on session-removed (audit S7). */
+  /** Pre-instantiation buffer for answerable requests and the queued-turn snapshot, which history
+   *  cannot reconstruct on open. Live requests remain until resolution; queue and replay duplicates
+   *  compact by identity. Instantiation replays and clears it, while removal drops it (audit S7). */
   private readonly pendingBuffers = new Map<SessionId, RpcRequest<MuxFrame>[]>()
-  /** Outstanding approval questions per session, keyed by approvalId (idempotent under mux-open
-   *  replays of the same requested frame). Manager-owned rather than read off Session instances
-   *  because the sidebar must light up for sessions never instantiated. Cleared per connection
-   *  generation — the reopen replay re-adds still-pending questions — and on session-removed. */
-  private readonly waitingApprovals = new Map<SessionId, Set<string>>()
+  /** Outstanding answerable interactions per session, keyed by their stable request identity.
+   *  Manager-owned rather than read off Session instances because the sidebar must light up for
+   *  sessions never instantiated. Cleared per connection generation — the reopen replay re-adds
+   *  still-pending requests — and on session-removed. */
+  private readonly pendingInteractions = new Map<SessionId, Map<string, PendingInteractionStatus>>()
   /** Per-session projection value stores, retained independently of instance arrival (the
    *  title-snapshot precedent, generalized): push frames land here whether or not the Session
    *  is instantiated (list rows read the 'title' key), and an instantiated Session adopts the
@@ -75,6 +122,13 @@ export class SessionManager {
   private listInflight: Promise<void> | null = null
   /** Mutations arriving after a list request starts are replayed over its response. */
   private listMutations: SessionListMutation[] | null = null
+  private readonly addresses = new Map<SessionId, SubagentAddress>()
+  private readonly catalogs = new Map<SessionId, SubagentCatalogSnapshot>()
+  private readonly catalogInflight = new Map<SessionId, CatalogInflight>()
+  /** Catalog owners whose membership changed while a pull was in flight: one trailing refresh after it settles. */
+  private readonly catalogStale = new Set<SessionId>()
+  private readonly openCatalogs = new Set<SessionId>()
+  private readonly catalogDebounce = new Map<SessionId, ReturnType<typeof setTimeout>>()
 
   private selected: SessionId | undefined
 
@@ -95,22 +149,50 @@ export class SessionManager {
   constructor(
     private readonly api: IApiClient,
     restoredSelection?: SessionId,
+    restoredAddress?: SubagentAddress,
   ) {
     this.selected = restoredSelection
+    if (restoredAddress !== undefined) this.addresses.set(restoredAddress.childSessionId, restoredAddress)
     this.listSnapshotCache = this.buildListSnapshot()
   }
 
   // ---- Selection ----
 
   /**
-   * Select a listed Session.
-   * @param sessionId - listed Session id.
+   * Select a listed Session or a retained catalog-addressed child.
+   * @param sessionId - listed or catalog-addressed Session id.
    */
   select(sessionId: SessionId): void {
-    if (!this.summaries.some(summary => summary.sessionId === sessionId)) {
+    const address = this.navigationAddress(sessionId)
+    if (!this.summaries.some(summary => summary.sessionId === sessionId) && address === undefined) {
       throw new Error(`sessions.select: unknown session ${sessionId}`)
     }
+    if (address !== undefined) this.addresses.set(sessionId, address)
+    this.sessions.get(sessionId)?.configureSubagent(
+      address,
+      address === undefined
+        ? false
+        : this.catalogs.get(address.parentSessionId)?.parentAvailable ?? false,
+    )
     this.selected = sessionId
+    void this.refreshSubagents(sessionId)
+    this.notifier.notifyNow()
+  }
+
+  /**
+   * Select a healthy child through its durable direct-parent address.
+   * @param address - catalog-derived parent and child ids.
+   */
+  selectSubagent(address: SubagentAddress): void {
+    const catalog = this.catalogs.get(address.parentSessionId)
+    const entry = catalog?.entries.find(candidate => candidate.id === address.childSessionId)
+    if (entry === undefined || entry.kind !== 'child' || entry.mode !== address.mode) {
+      throw new Error(`sessions.selectSubagent: ${address.childSessionId} is not a healthy catalog child`)
+    }
+    this.addresses.set(address.childSessionId, address)
+    this.sessions.get(address.childSessionId)?.configureSubagent(address, catalog?.parentAvailable ?? false)
+    this.selected = address.childSessionId
+    void this.refreshSubagents(address.childSessionId)
     this.notifier.notifyNow()
   }
 
@@ -120,6 +202,32 @@ export class SessionManager {
     this.notifier.notifyNow()
   }
 
+  /**
+   * Return the durable catalog address retained for one child.
+   * @param sessionId - possible addressed child id.
+   * @returns The direct-parent address, when navigation discovered one.
+   */
+  subagentAddress(sessionId: SessionId): SubagentAddress | undefined {
+    return this.addresses.get(sessionId)
+  }
+
+  /**
+   * Resolve an address for breadcrumb navigation without retaining transport authority.
+   * @param sessionId - possible child id in an already-loaded catalog.
+   * @returns A retained or catalog-derived direct-parent address.
+   */
+  navigationAddress(sessionId: SessionId): SubagentAddress | undefined {
+    const retained = this.addresses.get(sessionId)
+    if (retained !== undefined) return retained
+    for (const [parentSessionId, catalog] of this.catalogs) {
+      const child = catalog.entries.find(entry => entry.kind === 'child' && entry.id === sessionId)
+      if (child?.kind === 'child') {
+        return { parentSessionId, childSessionId: sessionId, mode: child.mode }
+      }
+    }
+    return undefined
+  }
+
   // ---- Instance management ----
 
   /**
@@ -159,13 +267,23 @@ export class SessionManager {
       if (summary !== undefined) {
         session.handleBlank(summary.blank)
         session.handleRunning(summary.running)
+      } else {
+        const address = this.addresses.get(sessionId)
+        const child = address === undefined ? undefined : this.catalogs.get(address.parentSessionId)?.entries
+          .find(entry => entry.kind === 'child' && entry.id === sessionId)
+        if (child?.kind === 'child') session.handleRunning(child.activity === 'running')
       }
     }
     return session
   }
 
   private createSession(sessionId: SessionId): Session {
+    const address = this.addresses.get(sessionId)
     return new Session(sessionId, this.api, {
+      ...(address === undefined ? {} : {
+        address,
+        parentAvailable: this.catalogs.get(address.parentSessionId)?.parentAvailable ?? false,
+      }),
       // The sender's local first-send flip mirrors into the list row so the
       // session surfaces (lists filter on blank) before any host frame lands.
       onEngaged: (engaged) => {
@@ -188,6 +306,99 @@ export class SessionManager {
     return store
   }
 
+  /**
+   * Refresh one direct-child catalog, reusing its in-flight request.
+   * @param parentSessionId - catalog owner.
+   */
+  refreshSubagents(parentSessionId: SessionId): Promise<void> {
+    const existing = this.catalogInflight.get(parentSessionId)
+    if (existing !== undefined) return existing.promise
+    const previous = this.catalogs.get(parentSessionId)
+    const expandableRows = new Set<SessionId>()
+    const activityRows = new Map<SessionId, 'running' | 'inactive'>()
+    this.catalogs.set(parentSessionId, {
+      entries: previous?.entries ?? [],
+      parentAvailable: previous?.parentAvailable ?? false,
+      state: 'loading',
+      error: null,
+    })
+    this.notifier.markDirty()
+    const operation = (async () => {
+      try {
+        const { result } = await this.api.subagents.list({ parentSessionId })
+        if (result.ok) {
+          const parentAvailable = this.catalogInflight.get(parentSessionId)?.parentAvailableOverride
+            ?? result.value.parentAvailable
+          this.catalogs.set(parentSessionId, {
+            ...result.value,
+            entries: this.withCatalogMutations(result.value.entries, expandableRows, activityRows),
+            parentAvailable,
+            state: 'ready',
+            error: null,
+          })
+          for (const [childId, address] of this.addresses) {
+            if (address.parentSessionId !== parentSessionId) continue
+            this.sessions.get(childId)?.handleSubagentParentAvailable(parentAvailable)
+          }
+        } else {
+          this.catalogs.set(parentSessionId, {
+            entries: this.withCatalogMutations(
+              previous?.entries ?? [], expandableRows, activityRows,
+            ),
+            parentAvailable: this.catalogInflight.get(parentSessionId)?.parentAvailableOverride
+              ?? previous?.parentAvailable ?? false,
+            state: 'error',
+            error: result.error,
+          })
+        }
+      } catch (error: unknown) {
+        const folded = transportError<never>(error)
+        this.catalogs.set(parentSessionId, {
+          entries: this.withCatalogMutations(
+            previous?.entries ?? [], expandableRows, activityRows,
+          ),
+          parentAvailable: this.catalogInflight.get(parentSessionId)?.parentAvailableOverride
+            ?? previous?.parentAvailable ?? false,
+          state: 'error',
+          error: folded.ok ? null : folded.error,
+        })
+      } finally {
+        this.catalogInflight.delete(parentSessionId)
+        // Re-arm the trailing pull before the dirty notify: the response the
+        // caller observed predates the stale-marking change, so the follow-up
+        // refresh is the only carrier of that change.
+        if (this.catalogStale.delete(parentSessionId)) void this.refreshSubagents(parentSessionId)
+        this.notifier.markDirty()
+      }
+    })()
+    this.catalogInflight.set(parentSessionId, {
+      promise: operation,
+      expandableRows,
+      activityRows,
+      parentAvailableOverride: undefined,
+    })
+    return operation
+  }
+
+  /**
+   * Mark whether a catalog menu is consuming live membership updates.
+   * @param parentSessionId - catalog owner.
+   * @param open - current menu state.
+   */
+  setSubagentCatalogOpen(parentSessionId: SessionId, open: boolean): void {
+    if (open) {
+      this.openCatalogs.add(parentSessionId)
+      void this.refreshSubagents(parentSessionId)
+    } else {
+      this.openCatalogs.delete(parentSessionId)
+      const timer = this.catalogDebounce.get(parentSessionId)
+      if (timer !== undefined) {
+        clearTimeout(timer)
+        this.catalogDebounce.delete(parentSessionId)
+      }
+    }
+  }
+
   // ---- List surface ----
 
   /** Full refresh via session.list (single-flight: an in-flight call is reused). */
@@ -248,6 +459,24 @@ export class SessionManager {
     return this.listInflight
   }
 
+  /**
+   * Search visible session message content without adding transient query
+   * state to the list snapshot.
+   * @param query - non-blank literal phrase.
+   * @param signal - cancellation for superseded UI queries.
+   * @returns the Host result or a folded transport error.
+   */
+  async search(
+    query: string,
+    signal: AbortSignal,
+  ): Promise<RpcResult<{ items: SessionSearchResultItem[]; hasMore: boolean }>> {
+    try {
+      return (await this.api.sessions.search({ query }, signal)).result
+    } catch (error: unknown) {
+      return transportError(error)
+    }
+  }
+
   /**
    * Contract session.create; on success merge into summaries immediately (no
    * wait for the next refresh). A created session is blank by definition
@@ -289,6 +518,40 @@ export class SessionManager {
     }
   }
 
+  /**
+   * Contract session.fork; on success merge the child into summaries
+   * immediately (same synchronous-addressability guarantee as create). The
+   * child carries the source's history, so it is never blank; lineage rides
+   * parentSessionId so the list nests it under its source. A child published
+   * before Workspace attachment fails is also reconciled into the list.
+   * @param opts - source session and the optional seq anchoring the cut.
+   * @returns the fork result (the child session id).
+   */
+  async fork(
+    opts: { sessionId: SessionId; atSeq?: number },
+  ): Promise<RpcResult<{ sessionId: SessionId }>> {
+    try {
+      const source = this.summaries.find(s => s.sessionId === opts.sessionId)
+      const { result } = await this.api.sessions.fork({
+        sessionId: opts.sessionId,
+        ...opts.atSeq === undefined ? {} : { atSeq: opts.atSeq },
+      })
+      const childId = result.ok
+        ? result.value.sessionId
+        : workspaceAttachSessionId(result.error)
+      if (childId !== undefined) {
+        this.recordMutation({ kind: 'upsert', summary: {
+          sessionId: childId, updatedAt: Date.now(), running: false, blank: false,
+          parentSessionId: opts.sessionId,
+          ...(source?.cwd !== undefined ? { cwd: source.cwd } : {}),
+        } })
+      }
+      return result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
   /**
    * Insert-or-enrich a locally synthesized summary: a new id prepends; an
    * existing entry only gains fields it lacks (the session-added frame and the
@@ -326,6 +589,26 @@ export class SessionManager {
     return this.listSnapshotCache
   }
 
+  /** Add or refresh one stable pending-interaction identity. */
+  private trackPending(sessionId: SessionId, key: string, status: PendingInteractionStatus): void {
+    let interactions = this.pendingInteractions.get(sessionId)
+    if (interactions === undefined) {
+      interactions = new Map()
+      this.pendingInteractions.set(sessionId, interactions)
+    }
+    if (interactions.get(key) === status) return
+    interactions.set(key, status)
+    this.notifier.markDirty()
+  }
+
+  /** Settle one pending-interaction identity without disturbing sibling waits. */
+  private resolvePending(sessionId: SessionId, key: string): void {
+    const interactions = this.pendingInteractions.get(sessionId)
+    if (interactions === undefined || !interactions.delete(key)) return
+    if (interactions.size === 0) this.pendingInteractions.delete(sessionId)
+    this.notifier.markDirty()
+  }
+
   // ---- ConnectionController sinks (wired by boot) ----
 
   /**
@@ -351,53 +634,67 @@ export class SessionManager {
       // them so last-wins cannot pin a phantom value over recomputed truth.
       this.projectionStores.get(frame.sessionId)?.truncate(frame.lastSeq)
       this.notifier.markDirty()
-      // New mux-generation baseline: buffered session/queued frames belong to
-      // the previous generation and the host is about to resend the live
-      // snapshot — drop them, or every reconnect appends a duplicate batch
-      // (and enough reconnects push real approval/question frames past the
-      // cap). Same re-baseline signal Session uses for its own mirror.
+      // New mux-generation baseline: discard the previous queue snapshot.
+      // The host omits session/queue when the live queue is empty, so retaining
+      // it could replay stale work when the Session is instantiated later.
+      // This is the same re-baseline signal Session uses for its own mirror.
       const buffered = this.pendingBuffers.get(frame.sessionId)
       if (buffered !== undefined) {
-        const kept = buffered.filter(item => item.payload.type !== 'session/queued')
+        const kept = buffered.filter(item => item.payload.type !== 'session/queue')
         if (kept.length !== buffered.length) {
           if (kept.length === 0) this.pendingBuffers.delete(frame.sessionId)
           else this.pendingBuffers.set(frame.sessionId, kept)
         }
       }
     }
-    // List-level waiting-approval bit (the sidebar amber dot): tracked here for
-    // every session, instantiated or not; approvalId keys make replays idempotent.
+    // List-level pending-interaction status (the sidebar amber dot): tracked
+    // for every session, instantiated or not; stable keys make replays idempotent.
     if (frame.type === 'approval/requested') {
-      let ids = this.waitingApprovals.get(frame.sessionId)
-      if (ids === undefined) this.waitingApprovals.set(frame.sessionId, ids = new Set())
-      if (!ids.has(frame.approvalId)) {
-        ids.add(frame.approvalId)
-        this.notifier.markDirty()
-      }
+      this.trackPending(frame.sessionId, `a:${frame.approvalId}`, 'approval')
     } else if (frame.type === 'approval/resolved') {
-      const ids = this.waitingApprovals.get(frame.sessionId)
-      if (ids !== undefined && ids.delete(frame.approvalId)) {
-        if (ids.size === 0) this.waitingApprovals.delete(frame.sessionId)
-        this.notifier.markDirty()
-      }
+      this.resolvePending(frame.sessionId, `a:${frame.approvalId}`)
+    } else if (frame.type === 'question/requested') {
+      this.trackPending(
+        frame.sessionId,
+        `q:${envelope.rpcId}`,
+        questionInteractionStatus(frame.questions),
+      )
+    } else if (frame.type === 'question/resolved') {
+      this.resolvePending(frame.sessionId, `q:${frame.questionRpcId}`)
     }
     const session = this.sessions.get(frame.sessionId)
     if (session === undefined) {
-      // Approval/question/queued frames never hit history: buffer for replay on
-      // instantiation; everything else drops (not instantiated — history fully
-      // backfills on open).
+      // Answerable requests never hit history: retain each live identity until
+      // instantiation, compacting replay duplicates and resolutions so list
+      // status cannot outlive the PendingWait the user would need to answer.
+      // Queue is a latest-value snapshot; everything else drops because open
+      // backfills it from history.
       switch (frame.type) {
         case 'approval/requested':
-        case 'approval/resolved':
         case 'question/requested':
-        case 'question/resolved':
-        case 'session/queued': {
+        case 'session/queue': {
           const buffer = this.pendingBuffers.get(frame.sessionId) ?? []
-          buffer.push(envelope)
-          if (buffer.length > PENDING_BUFFER_CAP) buffer.splice(0, buffer.length - PENDING_BUFFER_CAP)
+          const key = frame.type === 'approval/requested'
+            ? `a:${frame.approvalId}`
+            : frame.type === 'question/requested' ? `q:${envelope.rpcId}` : 'queue'
+          const prior = buffer.findIndex(item => bufferedRequestKey(item) === key)
+          if (prior === -1) buffer.push(envelope)
+          else buffer[prior] = envelope
           this.pendingBuffers.set(frame.sessionId, buffer)
           return
         }
+        case 'approval/resolved':
+        case 'question/resolved': {
+          const buffer = this.pendingBuffers.get(frame.sessionId)
+          if (buffer === undefined) return
+          const key = frame.type === 'approval/resolved'
+            ? `a:${frame.approvalId}`
+            : `q:${frame.questionRpcId}`
+          const prior = buffer.findIndex(item => bufferedRequestKey(item) === key)
+          if (prior !== -1) buffer.splice(prior, 1)
+          if (buffer.length === 0) this.pendingBuffers.delete(frame.sessionId)
+          return
+        }
         default:
           return
       }
@@ -416,22 +713,65 @@ export class SessionManager {
         this.mergeSummary({
           sessionId: frame.sessionId, updatedAt: Date.now(), running: false, blank: frame.blank,
           ...(frame.parentSessionId !== undefined ? { parentSessionId: frame.parentSessionId } : {}),
+          ...(frame.origin !== undefined ? { origin: frame.origin } : {}),
           ...(frame.cwd !== undefined ? { cwd: frame.cwd } : {}),
         })
         this.sessions.get(frame.sessionId)?.handleBlank(frame.blank)
+        if (frame.origin === 'subagent' && frame.parentSessionId !== undefined) {
+          this.markCatalogParentExpandable(frame.parentSessionId)
+        }
+        if (frame.parentSessionId !== undefined
+          && (this.selected === frame.parentSessionId || this.openCatalogs.has(frame.parentSessionId))) {
+          this.scheduleCatalogRefresh(frame.parentSessionId)
+        }
         return
       }
       case 'host/session-removed': {
-        this.recordMutation({ kind: 'remove', sessionId: frame.sessionId })
-        this.sessions.get(frame.sessionId)?.handleRemoved() // instance survives (resident-instance rule), only flagged in the snapshot
+        const summary = this.summaries.find(candidate => candidate.sessionId === frame.sessionId)
+        const durableSubagent = summary?.origin === 'subagent' || this.addresses.has(frame.sessionId)
+        this.recordMutation(durableSubagent
+          ? { kind: 'status', sessionId: frame.sessionId, running: false }
+          : { kind: 'remove', sessionId: frame.sessionId })
+        this.updateCatalogActivity(frame.sessionId, false)
+        if (durableSubagent) {
+          // An Activation detaching is not durable child deletion:
+          // keep its lineage and conversation while returning it to idle.
+          this.sessions.get(frame.sessionId)?.handleRunning(false)
+        } else {
+          this.sessions.get(frame.sessionId)?.handleRemoved()
+        }
         this.pendingBuffers.delete(frame.sessionId) // a removed session's buffered frames must not replay on a future instantiation
-        this.waitingApprovals.delete(frame.sessionId) // a removed session cannot wait on anyone
-        this.projectionStores.delete(frame.sessionId) // removed sessions drop their projection rows with the instance
+        this.pendingInteractions.delete(frame.sessionId) // a removed session cannot wait on anyone
+        if (!durableSubagent) this.projectionStores.delete(frame.sessionId)
+        // A pull already in flight was requested before this removal and can
+        // carry the pre-removal parentAvailable:true, which would resurrect
+        // the writable editor this invalidation just closed. Replay false over
+        // that response and queue one trailing refresh so the post-removal
+        // host truth converges.
+        const inflightCatalog = this.catalogInflight.get(frame.sessionId)
+        if (inflightCatalog !== undefined) {
+          inflightCatalog.parentAvailableOverride = false
+          this.catalogStale.add(frame.sessionId)
+        }
+        // The removed session can no longer be the delivery owner of its
+        // catalog: invalidate availability immediately. Removal schedules no
+        // catalog refresh, and without this an addressed child keeps a
+        // writable editor against a dead continuation owner until an
+        // unrelated refresh (or forever, for a closed menu).
+        const ownedCatalog = this.catalogs.get(frame.sessionId)
+        if (ownedCatalog !== undefined && ownedCatalog.parentAvailable) {
+          this.catalogs.set(frame.sessionId, { ...ownedCatalog, parentAvailable: false })
+        }
+        for (const [childId, address] of this.addresses) {
+          if (address.parentSessionId !== frame.sessionId) continue
+          this.sessions.get(childId)?.handleSubagentParentAvailable(false)
+        }
         return
       }
       case 'host/session-status': {
         this.recordMutation({ kind: 'status', sessionId: frame.sessionId, running: frame.running })
         this.sessions.get(frame.sessionId)?.handleRunning(frame.running)
+        this.updateCatalogActivity(frame.sessionId, frame.running)
         return
       }
       case 'host/agent-error': {
@@ -447,20 +787,19 @@ export class SessionManager {
    * The moment a connection generation dies (before any next-generation frame
    * can arrive — onConnected waits for the readiness handshake while replayed
    * frames flow from stream open, so clearing there would race the replay):
-   * drop generation-scoped live state. Approvals resolved while disconnected
-   * send no frame, so the stale bits and the buffered answerable frames must
-   * not survive into the next generation — the mux-open replay re-adds every
-   * still-pending question with its live rpcId.
-   */
+   * drop generation-scoped live state. Interactions resolved while disconnected
+   * send no frame, so stale statuses and buffered answerable frames must not
+   * survive into the next generation — mux-open replay re-adds every still-pending
+   * request with its live rpcId.
+  */
   handleDisconnected(): void {
-    if (this.waitingApprovals.size > 0) {
-      this.waitingApprovals.clear()
+    if (this.pendingInteractions.size > 0) {
+      this.pendingInteractions.clear()
       this.notifier.markDirty()
     }
     for (const [sessionId, buffer] of [...this.pendingBuffers]) {
       const kept = buffer.filter(item =>
-        item.payload.type !== 'approval/requested' && item.payload.type !== 'approval/resolved'
-        && item.payload.type !== 'question/requested' && item.payload.type !== 'question/resolved')
+        item.payload.type !== 'approval/requested' && item.payload.type !== 'question/requested')
       if (kept.length === buffer.length) continue
       if (kept.length === 0) this.pendingBuffers.delete(sessionId)
       else this.pendingBuffers.set(sessionId, kept)
@@ -470,27 +809,121 @@ export class SessionManager {
   /** After each connection generation: refresh the session baseline and rebuild opened windows. */
   handleConnected(): void {
     void this.refreshList()
+    const selectedAddress = this.selected === undefined ? undefined : this.addresses.get(this.selected)
+    if (selectedAddress !== undefined) void this.refreshSubagents(selectedAddress.parentSessionId)
+    if (this.selected !== undefined) void this.refreshSubagents(this.selected)
+    for (const parentSessionId of this.openCatalogs) void this.refreshSubagents(parentSessionId)
     for (const session of this.sessions.values()) void session.resync()
   }
 
+  /** Debounce membership refetches while one parent catalog is selected or open. */
+  private scheduleCatalogRefresh(parentSessionId: SessionId): void {
+    if (this.catalogDebounce.has(parentSessionId)) return
+    const timer = setTimeout(() => {
+      this.catalogDebounce.delete(parentSessionId)
+      // The in-flight response predates the membership frame that scheduled
+      // this callback. Queue one post-settlement pull instead of treating an
+      // ordinary overlapping read as evidence that catalog membership changed.
+      if (this.catalogInflight.has(parentSessionId)) {
+        this.catalogStale.add(parentSessionId)
+        return
+      }
+      void this.refreshSubagents(parentSessionId)
+    }, 50)
+    this.catalogDebounce.set(parentSessionId, timer)
+  }
+
+  /** Apply one Agent-driver transition to loaded and in-flight catalogs. */
+  private updateCatalogActivity(childSessionId: SessionId, running: boolean): void {
+    const activity = running ? 'running' as const : 'inactive' as const
+    for (const inflight of this.catalogInflight.values()) {
+      inflight.activityRows.set(childSessionId, activity)
+    }
+    let changed = false
+    for (const [parentSessionId, catalog] of this.catalogs) {
+      if (!catalog.entries.some(entry =>
+        entry.kind === 'child' && entry.id === childSessionId && entry.activity !== activity)) continue
+      const entries = catalog.entries.map((entry) => {
+        if (entry.kind !== 'child' || entry.id !== childSessionId) return entry
+        return { ...entry, activity }
+      })
+      changed = true
+      this.catalogs.set(parentSessionId, { ...catalog, entries })
+    }
+    if (changed) this.notifier.markDirty()
+  }
+
+  /** Preserve and project a positive expandability hint after one direct subagent publishes. */
+  private markCatalogParentExpandable(parentSessionId: SessionId): void {
+    this.applyCatalogParentExpandable(parentSessionId)
+    for (const inflight of this.catalogInflight.values()) inflight.expandableRows.add(parentSessionId)
+  }
+
+  /** Apply one positive expandability hint to every loaded catalog containing that unique row id. */
+  private applyCatalogParentExpandable(parentSessionId: SessionId): void {
+    let changed = false
+    for (const [catalogParentId, catalog] of this.catalogs) {
+      if (!catalog.entries.some(entry =>
+        entry.kind === 'child' && entry.id === parentSessionId && !entry.hasChildren)) continue
+      const entries = catalog.entries.map((entry) => {
+        if (entry.kind !== 'child' || entry.id !== parentSessionId || entry.hasChildren) return entry
+        return { ...entry, hasChildren: true }
+      })
+      changed = true
+      this.catalogs.set(catalogParentId, { ...catalog, entries })
+    }
+    if (changed) this.notifier.markDirty()
+  }
+
+  /** Fold request-local row mutations into one catalog result before publication. */
+  private withCatalogMutations(
+    entries: SubagentCatalog['entries'],
+    expandableRows: ReadonlySet<SessionId>,
+    activityRows: ReadonlyMap<SessionId, 'running' | 'inactive'>,
+  ): SubagentCatalog['entries'] {
+    return entries.map((entry) => {
+      if (entry.kind !== 'child') return entry
+      const activity = activityRows.get(entry.id)
+      if (!expandableRows.has(entry.id) && activity === undefined) return entry
+      return {
+        ...entry,
+        ...expandableRows.has(entry.id) ? { hasChildren: true } : {},
+        ...activity === undefined ? {} : { activity },
+      }
+    })
+  }
+
   private buildListSnapshot(): SessionListSnapshot {
     const merged: TitledSessionSummary[] = this.summaries.map((summary) => {
       // List rows read the generic 'title' projection key (host-computed unit
       // value; the bespoke session/title frame is retired).
-      const title = this.projectionStores.get(summary.sessionId)?.get('title')
-      return typeof title === 'string' && title !== ''
-        ? { ...summary, title }
-        : summary
+      const projectionStore = this.projectionStores.get(summary.sessionId)
+      const title = projectionStore?.get('title')
+      const projectionValues = projectionStore?.values()
+      return {
+        ...summary,
+        ...(typeof title === 'string' && title !== '' ? { title } : {}),
+        ...(projectionValues === undefined ? {} : { projectionValues }),
+      }
     })
-    const fresh = flattenLineage(merged, new Set(this.waitingApprovals.keys()))
+    const pendingInteractions = new Map<SessionId, PendingInteractionStatus>()
+    for (const [sessionId, interactions] of this.pendingInteractions) {
+      const statuses = [...interactions.values()]
+      // The composer selects the first question ahead of approval. Mirror that
+      // answer order so the sidebar names the interaction the user can act on.
+      const status = statuses.find(candidate => candidate !== 'approval') ?? statuses[0]
+      if (status !== undefined) pendingInteractions.set(sessionId, status)
+    }
+    const fresh = flattenLineage(merged, pendingInteractions)
     const items = fresh.map((entry) => {
       const prev = this.entryCache.get(entry.sessionId)
       if (
         prev !== undefined && prev.updatedAt === entry.updatedAt && prev.running === entry.running
         && prev.blank === entry.blank
         && prev.parentSessionId === entry.parentSessionId && prev.cwd === entry.cwd
-        && prev.title === entry.title && prev.depth === entry.depth
-        && prev.waitingApproval === entry.waitingApproval
+        && prev.origin === entry.origin && prev.title === entry.title && prev.depth === entry.depth
+        && prev.pendingInteraction === entry.pendingInteraction
+        && prev.projectionValues === entry.projectionValues
       ) return prev
       this.entryCache.set(entry.sessionId, entry)
       return entry
@@ -501,7 +934,8 @@ export class SessionManager {
     const sameOrder = items.length === this.itemsCache.length && items.every((e, i) => e === this.itemsCache[i])
     if (!sameOrder) this.itemsCache = items
     const selected = this.selected
-    const current = selected !== undefined && items.some(item => item.sessionId === selected)
+    const current = selected !== undefined
+      && (items.some(item => item.sessionId === selected) || this.addresses.has(selected))
       ? selected
       : undefined
     return {
@@ -510,6 +944,8 @@ export class SessionManager {
       state: this.listState,
       phase: this.listPhase,
       error: this.listError,
+      subagentsByParent: Object.fromEntries(this.catalogs),
+      currentAddress: current === undefined ? undefined : this.addresses.get(current),
     }
   }
 }
@@ -528,9 +964,11 @@ function applyMutation(summaries: readonly SessionSummary[], mutation: SessionLi
         ...(existing.cwd === undefined && mutation.summary.cwd !== undefined ? { cwd: mutation.summary.cwd } : {}),
         ...(existing.parentSessionId === undefined && mutation.summary.parentSessionId !== undefined
           ? { parentSessionId: mutation.summary.parentSessionId } : {}),
+        ...(existing.origin === undefined && mutation.summary.origin !== undefined
+          ? { origin: mutation.summary.origin } : {}),
       }
       if (filled.cwd === existing.cwd && filled.parentSessionId === existing.parentSessionId
-        && filled.blank === existing.blank) return [...summaries]
+        && filled.origin === existing.origin && filled.blank === existing.blank) return [...summaries]
       return summaries.map(summary => summary.sessionId === mutation.summary.sessionId ? filled : summary)
     }
     case 'remove':

packages/client/runtime/src/client/sessions/notifier.ts

@@ -1,5 +1,6 @@
-// Notifier: subscription + microtask-batched notification primitive shared by Session and
-// SessionManager. Semantics: N markDirty calls collapse into one microtask flush;
+// Notifier: subscription + batched notification primitive shared by Session and
+// SessionManager. Semantics: N markDirty calls collapse into one microtask flush, while
+// N markFrameDirty calls collapse into one animation-frame flush;
 // the flush rebuilds the snapshot cache BEFORE notifying (useSyncExternalStore requires a stable
 // getSnapshot reference). With no listeners the rebuild is skipped and only the dirty bit is set
 // (keeps frame storms cheap); the next getSnapshot rebuilds lazily.
@@ -9,12 +10,13 @@
 // swallow the notification — push subscribers (object-layer watchers) would
 // otherwise starve whenever any reader pulls first.
 
-/** Subscription + microtask-batched notification primitive (shared by Session and SessionManager). */
+/** Subscription + batched notification primitive (shared by Session and SessionManager). */
 export class Notifier {
   private listeners = new Set<() => void>()
   private dirty = false
   private notifyPending = false
-  private scheduled = false
+  private scheduled: 'none' | 'microtask' | 'frame' = 'none'
+  private scheduleGeneration = 0
 
   /** @param rebuild - snapshot rebuild function injected by the owner (writes the owner's snapshotCache). */
   constructor(private readonly rebuild: () => void) {}
@@ -35,19 +37,16 @@ export class Notifier {
   markDirty(): void {
     this.dirty = true
     this.notifyPending = true
-    if (this.scheduled) return
-    this.scheduled = true
-    queueMicrotask(() => {
-      this.scheduled = false
-      if (!this.notifyPending) return
-      if (this.listeners.size === 0) return // lazy: no subscribers; dirty (if still set) rebuilds on next getSnapshot
-      this.notifyPending = false
-      if (this.dirty) {
-        this.dirty = false
-        this.rebuild()
-      }
-      for (const listener of this.listeners) listener()
-    })
+    if (this.scheduled === 'microtask') return
+    this.schedule('microtask')
+  }
+
+  /** Stream-change entry: mark dirty and publish the cumulative state at most once per frame. */
+  markFrameDirty(): void {
+    this.dirty = true
+    this.notifyPending = true
+    if (this.scheduled !== 'none') return
+    this.schedule(typeof globalThis.requestAnimationFrame === 'function' ? 'frame' : 'microtask')
   }
 
   /**
@@ -57,11 +56,8 @@ export class Notifier {
   notifyNow(): void {
     this.dirty = true
     this.notifyPending = true
-    if (this.listeners.size === 0) return // lazy: same as markDirty, next getSnapshot rebuilds
-    this.notifyPending = false
-    this.dirty = false
-    this.rebuild()
-    for (const listener of this.listeners) listener()
+    this.invalidateSchedule()
+    this.flush()
   }
 
   /**
@@ -73,4 +69,35 @@ export class Notifier {
     this.dirty = false
     this.rebuild()
   }
+
+  private schedule(kind: 'microtask' | 'frame'): void {
+    const generation = ++this.scheduleGeneration
+    this.scheduled = kind
+    const publish = () => {
+      if (generation !== this.scheduleGeneration) return
+      this.scheduled = 'none'
+      this.flush()
+    }
+    if (kind === 'frame') {
+      globalThis.requestAnimationFrame(publish)
+    } else {
+      queueMicrotask(publish)
+    }
+  }
+
+  private invalidateSchedule(): void {
+    this.scheduleGeneration++
+    this.scheduled = 'none'
+  }
+
+  private flush(): void {
+    if (!this.notifyPending) return
+    if (this.listeners.size === 0) return // lazy: dirty (if still set) rebuilds on next getSnapshot
+    this.notifyPending = false
+    if (this.dirty) {
+      this.dirty = false
+      this.rebuild()
+    }
+    for (const listener of this.listeners) listener()
+  }
 }

packages/client/runtime/src/client/sessions/partial.ts

@@ -6,6 +6,19 @@ import type { StreamChunk } from '@deepseek-ai/dsh-llm/types'
 import type { AssistantBlock, PartialAssistant } from './conversation.ts'
 import { toAssistantBlock } from './conversation.ts'
 
+/**
+ * Whether a stream chunk changes the partial assistant projection shown by the UI.
+ * @param type - Stream chunk discriminant.
+ * @returns Whether publishing the accumulated partial can change the visible snapshot.
+ */
+export function isVisibleAssistantChunk(type: string): boolean {
+  return type === 'block-start'
+    || type === 'text-delta'
+    || type === 'reasoning-delta'
+    || type === 'tool-call-delta'
+    || type === 'block-end'
+}
+
 /** assistant/chunk accumulator: folds StreamChunks into AssistantBlock[] with block-level immutability. */
 export class PartialAccumulator {
   // Sparse on purpose: block-start may arrive out of order, leaving holes until compaction.
@@ -13,8 +26,18 @@ export class PartialAccumulator {
   private changed = true
   private snapshot: PartialAssistant
 
-  constructor(readonly turn: number, readonly step: number) {
-    this.snapshot = { turn, step, blocks: [] }
+  /**
+   * @param turn - Owning agent turn.
+   * @param step - Owning model step.
+   * @param initialBlocks - Materialized prefix when accumulation begins after history replay.
+   */
+  constructor(
+    readonly turn: number,
+    readonly step: number,
+    initialBlocks: readonly AssistantBlock[] = [],
+  ) {
+    this.blocks = [...initialBlocks]
+    this.snapshot = { turn, step, blocks: initialBlocks }
   }
 
   /**

packages/client/runtime/src/client/sessions/pending.ts

@@ -15,6 +15,9 @@ export interface PendingPayloads {
 /** Pending-interaction discriminant (the keys of PendingPayloads). */
 export type PendingKind = keyof PendingPayloads
 
+/** Session-list summary of the user action currently blocking progress. */
+export type PendingInteractionStatus = 'approval' | 'plan-review' | 'question'
+
 /** Kind-discriminated union of concrete waits: narrowing on `kind` types `payload`. */
 export type PendingInteraction = { [K in PendingKind]: PendingWait<K> }[PendingKind]
 

packages/client/runtime/src/client/sessions/projection-store.ts

@@ -74,6 +74,7 @@ interface Channel {
 export class ProjectionValueStore {
   private readonly rows = new Map<string, Row>()
   private readonly channels = new Map<string, Channel>()
+  private valuesCache: Readonly<Partial<SessionProjectionMap>> | undefined
   /** Coarse any-key channel (no snapshot cache to rebuild: reads hit rows directly). */
   private readonly anyNotifier = new Notifier(() => {})
 
@@ -98,6 +99,19 @@ export class ProjectionValueStore {
     return this.rows.get(key)?.value
   }
 
+  /**
+   * Read every current projection value as one reference-stable snapshot.
+   * @returns The same frozen value map until a row changes.
+   */
+  values(): Readonly<Partial<SessionProjectionMap>> {
+    if (this.valuesCache === undefined) {
+      this.valuesCache = Object.freeze(Object.fromEntries(
+        [...this.rows].map(([key, row]) => [key, row.value]),
+      ))
+    }
+    return this.valuesCache
+  }
+
   /**
    * Subscribe to any-key changes (microtask-batched) — the manager's list
    * rebuild channel.
@@ -160,6 +174,7 @@ export class ProjectionValueStore {
   }
 
   private changed(key: string): void {
+    this.valuesCache = undefined
     this.channels.get(key)?.notifier.markDirty()
     this.anyNotifier.markDirty()
   }

packages/client/runtime/src/client/sessions/request-inspection.ts

@@ -8,6 +8,7 @@ import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 import type {
   AssistantProvenanceView, AssistantRequestConfig,
 } from './conversation.ts'
+import { displayFailureMessage } from './failure-display.ts'
 
 export type {
   AssistantProvenanceView, AssistantRequestConfig,
@@ -35,40 +36,55 @@ export interface RequestPromptChange {
   previous?: ConversationPromptSnapshot
 }
 
-/** One provider request reconstructed from durable request lifecycle events. */
-export interface RequestView {
-  /** Request category; compaction is a purpose, not a separate projection. */
-  purpose: 'assistant' | 'compaction'
+/** Lifecycle fields shared by ordinary generation and compaction requests. */
+interface RequestViewBase {
   /** Sequence that opened the operation represented by this request. */
   startSeq: number
-  turn: number
-  /** Agent-loop step, or zero for a direct compaction request. */
-  step: number
   startedAt: number
   completedAt: number | null
   status: 'running' | 'complete' | 'error'
   error?: string
-  /** Effective ordinary request input, inherited until a later header changes it. */
-  prompt?: ConversationPromptSnapshot
-  /** Prompt change logged while preparing this request. */
-  promptChange?: RequestPromptChange
   provenance?: AssistantProvenanceView
   requestConfig?: AssistantRequestConfig
   usage?: unknown
   /** Assistant message or compaction summary sequence produced by this request. */
   resultSeq?: number
+}
+
+/** One ordinary assistant generation reconstructed from durable request events. */
+interface AssistantRequestView extends RequestViewBase {
+  purpose: 'assistant'
+  turn: number
+  /** Agent-loop step that issued this request. */
+  step: number
+  /** Effective ordinary request input, inherited until a later header changes it. */
+  prompt?: ConversationPromptSnapshot
+  /** Prompt change logged while preparing this request. */
+  promptChange?: RequestPromptChange
+  /** Retry ordinal scheduled after a failed ordinary request. */
+  retry?: number
+  maxRetries?: number
+  retryDelayMs?: number
+}
+
+/** One compaction provider request, either turn-owned or standalone between turns. */
+interface CompactionRequestView extends RequestViewBase {
+  purpose: 'compaction'
+  /** Owning turn, or `null` when manual compaction ran between turns. */
+  turn: number | null
+  /** Direct compaction requests do not consume an agent-loop step. */
+  step: 0
   /** Compaction replacement message sequence, when one was committed. */
   replacementSeq?: number
   /** Safe compaction summary projection. */
   summary?: readonly ContentBlock[]
   /** Complete compaction provider output before the safe projection. */
   rawOutput?: readonly ContentBlock[]
-  /** Retry ordinal scheduled after a failed ordinary request. */
-  retry?: number
-  maxRetries?: number
-  retryDelayMs?: number
 }
 
+/** One provider request reconstructed from durable request lifecycle events. */
+export type RequestView = AssistantRequestView | CompactionRequestView
+
 /** Immutable request-centric projection derived from one history window. */
 export interface RequestInspectionSnapshot {
   requests: readonly RequestView[]
@@ -78,7 +94,8 @@ export interface RequestInspectionSnapshot {
 /**
  * Derive the request-centric read model from one immutable history window.
  * Compaction participates as a request purpose rather than a parallel
- * top-level collection.
+ * top-level collection. A leading resume/change header exposes its prompt but
+ * cannot project a change until the preceding header enters the window.
  * @param entries - Contiguous raw session history.
  * @returns Requests and call-time schemas derived from that history.
  */
@@ -110,7 +127,7 @@ interface CompactionStartEvent {
   type: 'compact/start'
   seq: number
   time: number
-  data: { turn: number }
+  data: { turn: number | null }
 }
 
 interface CompactionSummaryEvent {
@@ -131,7 +148,7 @@ interface CompactionEndEvent {
   type: 'compact/end'
   seq: number
   time: number
-  data: { turn: number; error?: string }
+  data: { turn: number | null; error?: string }
 }
 
 function requestKey(turn: number, step: number): string {
@@ -202,6 +219,7 @@ function promptChange(
   prompt: ConversationPromptSnapshot,
   event: SessionEvent<'request/header'>,
 ): RequestPromptChange | undefined {
+  if (previous === undefined && event.data.reason !== 'initial') return
   const systemChanged = previous !== undefined && previous.system !== prompt.system
   const toolsChanged = previous !== undefined
     && JSON.stringify(previous.tools) !== JSON.stringify(prompt.tools)
@@ -224,14 +242,26 @@ function promptChange(
 function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[] {
   const requests: RequestView[] = []
   const ordinaryByStep = new Map<string, number>()
+  const lastStepByTurn = new Map<number, string>()
   let activeStep: string | undefined
   let activePrompt: ConversationPromptSnapshot | undefined
   let activeCompaction: number | undefined
 
-  const update = (index: number | undefined, change: Partial<RequestView>): void => {
+  const updateAssistant = (
+    index: number | undefined,
+    change: Partial<Omit<AssistantRequestView, 'purpose'>>,
+  ): void => {
     if (index === undefined) return
     const request = requests[index]
-    if (request !== undefined) requests[index] = { ...request, ...change }
+    if (request?.purpose === 'assistant') requests[index] = { ...request, ...change }
+  }
+  const updateCompaction = (
+    index: number | undefined,
+    change: Partial<Omit<CompactionRequestView, 'purpose'>>,
+  ): void => {
+    if (index === undefined) return
+    const request = requests[index]
+    if (request?.purpose === 'compaction') requests[index] = { ...request, ...change }
   }
 
   for (const sourceEvent of events) {
@@ -239,6 +269,7 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
       const { turn, step } = sourceEvent.data
       const key = requestKey(turn, step)
       ordinaryByStep.set(key, requests.length)
+      lastStepByTurn.set(turn, key)
       requests.push({
         purpose: 'assistant',
         startSeq: sourceEvent.seq,
@@ -263,7 +294,7 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
       }
       const change = promptChange(activePrompt, prompt, sourceEvent)
       activePrompt = prompt
-      update(activeStep === undefined ? undefined : ordinaryByStep.get(activeStep), {
+      updateAssistant(activeStep === undefined ? undefined : ordinaryByStep.get(activeStep), {
         prompt,
         requestConfig: prompt.config,
         ...(change === undefined ? {} : { promptChange: change }),
@@ -278,8 +309,11 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
         requestKey(sourceEvent.data.turn, sourceEvent.data.step),
       )
       const request = index === undefined ? undefined : requests[index]
-      update(index, {
-        usage: addTokenUsage(request?.usage, sourceEvent.data.chunk.usage),
+      updateAssistant(index, {
+        usage: addTokenUsage(
+          request?.purpose === 'assistant' ? request.usage : undefined,
+          sourceEvent.data.chunk.usage,
+        ),
       })
       continue
     }
@@ -288,7 +322,7 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
         requestKey(sourceEvent.data.turn, sourceEvent.data.step),
       )
       const request = index === undefined ? undefined : requests[index]
-      update(index, {
+      updateAssistant(index, {
         completedAt: sourceEvent.time,
         status: 'complete',
         resultSeq: sourceEvent.seq,
@@ -296,7 +330,9 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
           provider: sourceEvent.data.message.source.provider,
           model: sourceEvent.data.message.source.model,
         },
-        ...(request?.usage !== undefined || sourceEvent.data.usage === undefined
+        ...(request?.purpose === 'assistant'
+          && request.usage !== undefined
+          || sourceEvent.data.usage === undefined
           ? {}
           : { usage: sourceEvent.data.usage }),
       })
@@ -306,8 +342,8 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
       const key = requestKey(sourceEvent.data.turn, sourceEvent.data.step)
       const index = ordinaryByStep.get(key)
       const request = index === undefined ? undefined : requests[index]
-      if (request?.status === 'running') {
-        update(index, {
+      if (request?.purpose === 'assistant' && request.status === 'running') {
+        updateAssistant(index, {
           completedAt: sourceEvent.time,
           status: 'error',
         })
@@ -317,25 +353,37 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
     }
     if ((sourceEvent.type as string) === 'llm/retry') {
       const event = sourceEvent as unknown as RetryEvent
-      update(ordinaryByStep.get(requestKey(event.data.turn, event.data.step)), {
+      updateAssistant(ordinaryByStep.get(requestKey(event.data.turn, event.data.step)), {
         status: 'error',
-        error: event.data.failure.message,
+        error: displayFailureMessage(event.data.failure),
         retry: event.data.retry,
         maxRetries: event.data.maxRetries,
         retryDelayMs: event.data.delayMs,
       })
       continue
     }
-    if (sourceEvent.type === 'turn/end' && sourceEvent.data.reason.kind === 'error') {
-      const reason = sourceEvent.data.reason
-      update(ordinaryByStep.get(requestKey(sourceEvent.data.turn, reason.step)), {
-        status: 'error',
-        error: 'failure' in reason ? reason.failure.message : reason.message,
-      })
+    if (sourceEvent.type === 'turn/end') {
+      const lastStep = lastStepByTurn.get(sourceEvent.data.turn)
+      if (sourceEvent.data.reason.kind === 'error') {
+        updateAssistant(lastStep === undefined ? undefined : ordinaryByStep.get(lastStep), {
+          status: 'error',
+          error: displayFailureMessage(sourceEvent.data.reason.error),
+        })
+      }
+      lastStepByTurn.delete(sourceEvent.data.turn)
       continue
     }
 
     const type = sourceEvent.type as string
+    if (type === 'session/end-seed' && activeCompaction !== undefined) {
+      updateCompaction(activeCompaction, {
+        completedAt: sourceEvent.time,
+        status: 'error',
+        error: 'Compaction was interrupted before completion.',
+      })
+      activeCompaction = undefined
+      continue
+    }
     if (type === 'compact/start') {
       const event = sourceEvent as unknown as CompactionStartEvent
       activeCompaction = requests.length
@@ -352,7 +400,7 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
     }
     if (type === 'compact/summary' && activeCompaction !== undefined) {
       const event = sourceEvent as unknown as CompactionSummaryEvent
-      update(activeCompaction, {
+      updateCompaction(activeCompaction, {
         resultSeq: event.seq,
         summary: event.data.summary,
         ...(event.data.rawOutput === undefined ? {} : { rawOutput: event.data.rawOutput }),
@@ -375,12 +423,12 @@ function deriveRequests(events: readonly SessionEvent[]): readonly RequestView[]
       && activeCompaction !== undefined
       && isCompactionSource(sourceEvent.data.source)
     ) {
-      update(activeCompaction, { replacementSeq: sourceEvent.seq })
+      updateCompaction(activeCompaction, { replacementSeq: sourceEvent.seq })
       continue
     }
     if (type !== 'compact/end' || activeCompaction === undefined) continue
     const event = sourceEvent as unknown as CompactionEndEvent
-    update(activeCompaction, {
+    updateCompaction(activeCompaction, {
       completedAt: event.time,
       status: event.data.error === undefined ? 'complete' : 'error',
       ...(event.data.error === undefined ? {} : { error: event.data.error }),

packages/client/runtime/src/client/sessions/service.ts

@@ -4,7 +4,7 @@
  * session-scoped surface keys off — migrated here from ui-layout per the
  * slot-parity design), Agent scope tree (mintScope pattern: no-op plugin
  * Fiber + ctx.extend scope tag; one scope per session, agent id === session
- * id), stable SessionBinding cache, ancestry walk.
+ * id), stable SessionBinding cache, breadcrumb-route projection.
  *
  * Scope lifecycle is stage-driven: a scope is minted lazily on first
  * resolution (pure — resolution has no side effects and is render-safe);
@@ -16,17 +16,24 @@
  * survives frozen (read-only view) until the stage moves on.
  */
 import type { Context, Fiber } from 'cordis'
-import type { IApiClient, RpcError, SessionId, WorkspaceId } from '@deepseek-ai/dsh-client-connection/client'
+import type {
+  IApiClient, RpcError, RpcResult, SessionId, SubagentAddress, WorkspaceId,
+} from '@deepseek-ai/dsh-client-connection/client'
+// Value import from the inline-safe wire layer (not the connection plugin):
+// plugin-to-plugin value imports are a bundle purity error.
+import { SESSION_SEARCH_RESULT_LIMIT } from '@deepseek-ai/dsh-host-apiproxy/api'
 import type {
   HostObservable, SessionMaybeProvideInfo, SessionProvideInfo,
 } from '@deepseek-ai/dsh-client-ui-slots'
+import type { SessionProjectionMap } from '@deepseek-ai/dsh-session-projection/types'
 import type { SnapshotStore } from '../contract/store.ts'
 import { createSnapshotStore } from '../contract/store.ts'
 import type { SessionFace } from '../contract/session.ts'
 import type { ISessions } from '../contract/sessions.ts'
 import { createScope, scopeOf as scopeTagOf } from '../agents/scope.ts'
 import { SessionManager } from './manager.ts'
-import type { SessionListPhase } from './manager.ts'
+import type { SessionListPhase, SessionSearchResultItem, SubagentCatalogSnapshot } from './manager.ts'
+import type { PendingInteractionStatus } from './pending.ts'
 import { SessionProvideChannel } from './provide.ts'
 import type { Session } from './session.ts'
 
@@ -39,9 +46,11 @@ export interface SessionSummary {
   displayTitle: string
   cwd?: string
   parentId?: SessionId
+  /** Coarse durable origin for navigation filtering; not a continuation capability. */
+  origin?: 'subagent'
   running: boolean
-  /** An approval question is pending on this session (sidebar amber-dot state). */
-  waitingApproval: boolean
+  /** User interaction currently blocking this session (sidebar amber-dot state). */
+  pendingInteraction?: PendingInteractionStatus
   /**
    * Empty-log bit (host summary derivation mirror). New Session reuses a blank
    * one targeting the same workspace. Filtering stays with the consumer: the
@@ -50,6 +59,8 @@ export interface SessionSummary {
    */
   blank: boolean
   updatedAt: number
+  /** Current host-computed projection values retained by the object layer. */
+  projectionValues?: Readonly<Partial<SessionProjectionMap>>
 }
 
 /**
@@ -58,11 +69,23 @@ export interface SessionSummary {
  * sidebar highlighting and SessionProvider share one fact source).
  */
 export interface SessionListState {
+  /** Host-list order; addressed breadcrumb-only rows are excluded. */
   ids: SessionId[]
+  /** Host rows plus the current addressed subagent route used by navigation. */
   byId: Record<SessionId, SessionSummary>
   current: SessionId | undefined
   /** Arrival lifecycle projected 1:1 from the manager snapshot (see SessionListPhase): empty-with-ready means "truly no sessions". */
   phase: SessionListPhase
+  /** Direct durable catalogs keyed by their selected parent address. */
+  subagentsByParent: Readonly<Record<SessionId, SubagentCatalogSnapshot>>
+  /** Current session's catalog-derived address, absent on ordinary navigation. */
+  currentAddress: SubagentAddress | undefined
+}
+
+/** Persisted navigation cell: address survives refresh for correct history routing. */
+interface SessionSelection {
+  sessionId?: SessionId
+  subagentAddress?: SubagentAddress
 }
 
 /** Structured session-create failure. */
@@ -81,6 +104,22 @@ export class SessionCreateError extends Error {
   }
 }
 
+/** Structured session-fork failure. */
+export class SessionForkError extends Error {
+  override readonly name = 'SessionForkError'
+
+  /**
+   * @param rpcError - Host business or folded transport error.
+   * @param sourceSessionId - the session the fork was cut from.
+   */
+  constructor(
+    readonly rpcError: RpcError,
+    readonly sourceSessionId: SessionId,
+  ) {
+    super(`session fork failed: ${rpcError.code}: ${rpcError.message}`)
+  }
+}
+
 /** Session assembly handle for SessionProvider/inject factories (identity-stable per session). */
 export interface SessionBinding {
   readonly sessionId: SessionId
@@ -121,6 +160,24 @@ function displayTitleOf(title: string | undefined, cwd: string | undefined, id:
   return id
 }
 
+/**
+ * Increment a trailing fork number while preserving its half-width or
+ * full-width parentheses; an unnumbered title starts with ` (1)`.
+ * @param title - source session's durable title.
+ * @returns the title assigned to the fork child.
+ */
+function increasedForkTitle(title: string): string {
+  const ascii = /^(.*?)\((\d+)\)$/u.exec(title)
+  if (ascii?.[1] !== undefined && ascii[2] !== undefined) {
+    return `${ascii[1]}(${BigInt(ascii[2]) + 1n})`
+  }
+  const fullWidth = /^(.*?)（(\d+)）$/u.exec(title)
+  if (fullWidth?.[1] !== undefined && fullWidth[2] !== undefined) {
+    return `${fullWidth[1]}（${BigInt(fullWidth[2]) + 1n}）`
+  }
+  return `${title} (1)`
+}
+
 interface ScopeRecord {
   fiber: Fiber
   ctx: Context
@@ -153,8 +210,15 @@ export interface SessionProvideDescriptor {
   resolve(binding: SessionBinding): SessionProvideContribution
 }
 
-/** Root sessions service: list store, current selection, object-layer manager, scope tree, bindings, ancestry. */
+/** Root sessions service: list store, current selection, object-layer manager, scope tree, bindings, and breadcrumb routes. */
 export class SessionsService implements ISessions {
+  /**
+   * The wire schema's own result bound, re-exposed for presentation plugins as
+   * injected data. Not per-connection state: the `session.search` response
+   * schema caps `items` at this constant, so every transport (fixture included)
+   * reports the same number.
+   */
+  readonly searchResultLimit = SESSION_SEARCH_RESULT_LIMIT
   /** List snapshot store (list RPC + host stream increments; re-pulled on reconnect) — the useSessions standard feed, current included. */
   readonly list: SnapshotStore<SessionListState>
   /** The object-layer instance cluster and frame dispatch entry. */
@@ -175,7 +239,7 @@ export class SessionsService implements ISessions {
    * selection survives transient list states (reconnect re-pull) and
    * resurfaces when its session returns.
    */
-  private readonly selection: SnapshotStore<{ sessionId?: SessionId }>
+  private readonly selection: SnapshotStore<SessionSelection>
 
   private readonly scopes = new Map<SessionId, ScopeRecord>()
   /** The provide channel (roster, materialization rules, current projection) — shared with the test runtime's double. */
@@ -194,13 +258,18 @@ export class SessionsService implements ISessions {
    * @param ctx - client root context (scope fibers mount under it).
    * @param api - wire client shared with every Session.
    */
-  constructor(private readonly rootCtx: Context, api: IApiClient) {
-    this.selection = createSnapshotStore<{ sessionId?: SessionId }>(
+  constructor(
+    private readonly rootCtx: Context,
+    api: IApiClient,
+  ) {
+    this.selection = createSnapshotStore<SessionSelection>(
       {},
       { persist: { name: 'dsh.sessions.current' } })
-    this.manager = new SessionManager(api, this.selection.getSnapshot().sessionId)
+    const restored = this.selection.getSnapshot()
+    this.manager = new SessionManager(api, restored.sessionId, restored.subagentAddress)
     this.list = createSnapshotStore<SessionListState>({
       ids: [], byId: {}, current: undefined, phase: 'pending',
+      subagentsByParent: {}, currentAddress: undefined,
     })
     // The manager owns wire truth; the store is its projection. Manager
     // notifications are already microtask-batched.
@@ -246,14 +315,48 @@ export class SessionsService implements ISessions {
   }
 
   /**
-   * Select a session as current. Unknown ids fail loud instead of navigating
-   * nowhere.
-   * @param id - session id (must exist in the list store).
+   * Select a listed or retained catalog-addressed session as current.
+   * @param id - listed or addressed session id.
    */
   open(id: SessionId): void {
     this.manager.select(id)
   }
 
+  /**
+   * Open a healthy catalog child through its direct-parent address.
+   * @param address - catalog-derived parent and child ids.
+   */
+  openSubagent(address: SubagentAddress): void {
+    this.manager.selectSubagent(address)
+  }
+
+  /**
+   * Resolve an already discovered direct-parent address without opening it.
+   * Feature plugins use this to avoid Agent-bound RPCs in persisted child views.
+   * @param id - possible addressed child id.
+   * @returns The retained address, when present.
+   */
+  subagentAddress(id: SessionId): SubagentAddress | undefined {
+    return this.manager.subagentAddress(id)
+  }
+
+  /**
+   * Inform the runtime whether a catalog menu is consuming membership updates.
+   * @param parentSessionId - selected parent.
+   * @param open - menu state.
+   */
+  setSubagentCatalogOpen(parentSessionId: SessionId, open: boolean): void {
+    this.manager.setSubagentCatalogOpen(parentSessionId, open)
+  }
+
+  /**
+   * Refresh one direct-child catalog.
+   * @param parentSessionId - catalog owner.
+   */
+  refreshSubagents(parentSessionId: SessionId): Promise<void> {
+    return this.manager.refreshSubagents(parentSessionId)
+  }
+
   /**
    * Clear the current selection so the layout shows the no-session empty
    * state (new-session affordance and the workspace preselection flow).
@@ -273,6 +376,20 @@ export class SessionsService implements ISessions {
     return this.manager.refreshList()
   }
 
+  /**
+   * Search the Host's visible message-content index. Results stay
+   * request-local; the list snapshot remains the metadata authority.
+   * @param query - non-blank literal phrase.
+   * @param signal - cancellation for a superseded search.
+   * @returns bounded results or a business/transport error.
+   */
+  search(
+    query: string,
+    signal: AbortSignal,
+  ): Promise<RpcResult<{ items: SessionSearchResultItem[]; hasMore: boolean }>> {
+    return this.manager.search(query, signal)
+  }
+
   /**
    * Route a mux stream envelope into the Session object layer.
    * @param envelope - validated mux stream envelope.
@@ -317,6 +434,48 @@ export class SessionsService implements ISessions {
     return result.value.sessionId
   }
 
+  /**
+   * Fork a session from a completed-turn prefix of the source (same
+   * synchronous-addressability guarantee as {@link SessionsService.create}:
+   * on resolution the child is in the list store and open() can target it).
+   * @param opts - source session id, the optional event seq anchoring the
+   *   cut (the boundary is the first turn/end at or after it; an in-log
+   *   anchor in an open turn is unavailable rather than clipped backward),
+   *   and whether to increment an inherited durable title before resolving.
+   *   A fractional anchor floors to a real event seq: the frozen nodes of an
+   *   interrupted turn carry flow-ordering seqs between two events, and the
+   *   wire takes integers only.
+   * @returns the child session id.
+   * @throws {SessionForkError} with the source id.
+   * @throws {Error} when a requested child-title rename fails after creation.
+   */
+  async fork(opts: {
+    sessionId: SessionId
+    atSeq?: number
+    increaseTitle?: boolean
+  }): Promise<SessionId> {
+    const sourceTitle = opts.increaseTitle
+      ? this.list.getSnapshot().byId[opts.sessionId]?.title
+      : undefined
+    const result = await this.manager.fork({
+      sessionId: opts.sessionId,
+      // Flooring lands inside the anchor's own turn (every turn opens with a
+      // turn/start), so the host's first-turn/end-at-or-after cut still ends
+      // on that turn — never clipped back to the previous one.
+      ...(opts.atSeq === undefined ? {} : { atSeq: Math.floor(opts.atSeq) }),
+    })
+    if (!result.ok) throw new SessionForkError(result.error, opts.sessionId)
+    this.projectList()
+    const childId = result.value.sessionId
+    if (sourceTitle !== undefined) {
+      const child = this.binding(childId)?.session
+      if (child === undefined) throw new Error(`fork child "${childId}" is not locally addressable`)
+      const renamed = await child.rename(increasedForkTitle(sourceTitle))
+      if (!renamed.ok) throw new Error(`fork child rename failed: ${renamed.error.code}: ${renamed.error.message}`)
+    }
+    return childId
+  }
+
   /**
    * Resolve an Agent-scoped context view (use-and-discard).
    * @param id - session id (the agent identity — 1:1 same axis).
@@ -404,33 +563,15 @@ export class SessionsService implements ISessions {
      * cannot miss; kept so a future current writer cannot crash the notify. */
     if (record !== undefined) {
       void record.session.open()
+      void this.manager.refreshSubagents(current)
     }
   }
 
-  /**
-   * Breadcrumb feed: walk parentId links inside the list store.
-   * @param id - session id.
-   * @returns summaries from root ancestor to the session itself (empty when unknown; a broken link stops the walk).
-   */
-  ancestry(id: SessionId): SessionSummary[] {
-    const { byId } = this.list.getSnapshot()
-    const chain: SessionSummary[] = []
-    let cursor: SessionId | undefined = id
-    while (cursor !== undefined) {
-      const summary: SessionSummary | undefined = byId[cursor]
-      if (summary === undefined || chain.includes(summary)) break
-      chain.unshift(summary)
-      cursor = summary.parentId
-    }
-    return chain
-  }
-
   /**
    * Lazily mint the scope + binding for an eligible session. Eligibility and
-   * prune share one predicate (decision 12): listed on the host — a scope is
-   * born when its session enters the client's view (list mirror row from the
-   * baseline pull, a create() echo, or the session-added frame) and dies with
-   * the prune when the row leaves.
+   * prune share one predicate (decision 12): listed on the host or selected
+   * through a retained subagent address. Breadcrumb-only ancestors remain
+   * summary data and do not keep scopes alive.
    */
   private resolve(id: SessionId): ScopeRecord | undefined {
     const existing = this.scopes.get(id)
@@ -454,14 +595,17 @@ export class SessionsService implements ISessions {
     return record
   }
 
-  /** The one aliveness predicate shared by scope mint and prune: host-listed. */
+  /** The one aliveness predicate shared by scope mint and prune: host-listed or currently addressed. */
   private eligible(id: SessionId): boolean {
-    return this.list.getSnapshot().byId[id] !== undefined
+    const { ids, current } = this.list.getSnapshot()
+    return current === id || ids.includes(id)
   }
 
   /** Project the manager's list snapshot into the store (title derivation is display-only). */
   private projectList(): void {
-    const { items, current, phase } = this.manager.getListSnapshot()
+    const {
+      items, current, phase, subagentsByParent, currentAddress,
+    } = this.manager.getListSnapshot()
     const ids: SessionId[] = []
     const byId: Record<SessionId, SessionSummary> = {}
     for (const entry of items) {
@@ -470,12 +614,47 @@ export class SessionsService implements ISessions {
         id: entry.sessionId,
         displayTitle: displayTitleOf(entry.title, entry.cwd, entry.sessionId),
         running: entry.running,
-        waitingApproval: entry.waitingApproval,
         blank: entry.blank,
         updatedAt: entry.updatedAt,
+        ...(entry.pendingInteraction === undefined
+          ? {}
+          : { pendingInteraction: entry.pendingInteraction }),
+        ...(entry.projectionValues === undefined
+          ? {}
+          : { projectionValues: entry.projectionValues }),
         ...(entry.title !== undefined ? { title: entry.title } : {}),
         ...(entry.cwd !== undefined ? { cwd: entry.cwd } : {}),
         ...(entry.parentSessionId !== undefined ? { parentId: entry.parentSessionId } : {}),
+        ...(entry.origin !== undefined ? { origin: entry.origin } : {}),
+      }
+    }
+    if (current !== undefined && currentAddress !== undefined) {
+      const seen = new Set<SessionId>()
+      let address: SubagentAddress | undefined = currentAddress
+      while (address !== undefined && !seen.has(address.childSessionId)) {
+        const childId = address.childSessionId
+        seen.add(childId)
+        const child = subagentsByParent[address.parentSessionId]?.entries
+          .find(entry => entry.kind === 'child' && entry.id === childId)
+        if (child?.kind !== 'child') break
+        const displayTitle = child.label ?? childId
+        const summary = byId[childId]
+        if (summary === undefined) {
+          byId[childId] = {
+            id: childId,
+            displayTitle,
+            parentId: address.parentSessionId,
+            origin: 'subagent',
+            running: child.activity === 'running',
+            blank: false,
+            updatedAt: 0,
+          }
+        } else if (summary.displayTitle !== displayTitle) {
+          byId[childId] = { ...summary, displayTitle }
+        }
+        const parent = byId[address.parentSessionId]
+        if (parent !== undefined && parent.origin !== 'subagent') break
+        address = this.manager.navigationAddress(address.parentSessionId)
       }
     }
     const persisted = this.selection.getSnapshot().sessionId
@@ -483,16 +662,22 @@ export class SessionsService implements ISessions {
     // stays on empty; the in-memory selection still resurfaces a masked id.
     if (current === undefined) {
       if (persisted !== undefined) this.selection.set({})
-    } else if (byId[current] !== undefined && persisted !== current) {
-      this.selection.set({ sessionId: current })
+    } else if (byId[current] !== undefined
+      && (persisted !== current
+        || this.selection.getSnapshot().subagentAddress?.childSessionId !== currentAddress?.childSessionId
+        || this.selection.getSnapshot().subagentAddress?.parentSessionId !== currentAddress?.parentSessionId
+        || this.selection.getSnapshot().subagentAddress?.mode !== currentAddress?.mode)) {
+      this.selection.set({
+        sessionId: current,
+        ...(currentAddress === undefined ? {} : { subagentAddress: currentAddress }),
+      })
     }
-    this.list.set({ ids, byId, current, phase })
-    this.pruneScopes(byId)
+    this.list.set({ ids, byId, current, phase, subagentsByParent, currentAddress })
+    this.pruneScopes()
   }
 
   /** Tear down scope + instance for no-longer-eligible sessions off stage; the staged one defers until the stage moves. */
-  private pruneScopes(byId: Record<SessionId, SessionSummary>): void {
-    void byId
+  private pruneScopes(): void {
     for (const [id, record] of this.scopes) {
       if (this.eligible(id)) continue
       if (id === this.watched) {

packages/client/runtime/src/client/sessions/session.ts

@@ -2,32 +2,42 @@
 
 import type { Context } from 'cordis'
 import type { ContentBlock } from '@deepseek-ai/dsh-llm/types'
+import type { LlmRetryEventData } from '@deepseek-ai/dsh-llm-retry/types'
 import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
 import type {
-  HistoryEntry, IApiClient, MuxFrame, RpcError, RpcId, RpcResult,
-  SessionId, ToolEventView,
+  HistoryEntry, IApiClient, MessageId, MuxFrame, QueueAction, RpcError,
+  RpcId, RpcResponse, RpcResult, SessionId, SubagentAddress, ToolEventView,
 } from '@deepseek-ai/dsh-client-connection/client'
 // Value import from the inline-safe wire layer (not the connection plugin):
 // plugin-to-plugin value imports are a bundle purity error.
 import { transportError } from '@deepseek-ai/dsh-host-apiproxy/api'
 import type { SessionFace } from '../contract/session.ts'
 import type {
-  CodeSubCall, ComposerPhase, ConversationNode, ConversationSnapshot, OpenState,
-  PromptError, QueuedMessage, RunningToolCall,
+  CodeSubCall, ComposerPhase, ConversationNode, ConversationSnapshot, ModelRetryNode,
+  OpenState, PromptError, QueuedMessage, RunningToolCall,
 } from './conversation.ts'
 import type { PendingInteraction } from './pending.ts'
 import { PendingWait } from './pending.ts'
-import { FoldAdapter } from './fold-adapter.ts'
+import { TranscriptAdapter } from './transcript-adapter.ts'
+import { displayFailureMessage } from './failure-display.ts'
 import { Notifier } from './notifier.ts'
-import { PartialAccumulator } from './partial.ts'
+import { isVisibleAssistantChunk, PartialAccumulator } from './partial.ts'
 import { ProjectionValueStore } from './projection-store.ts'
 import type { ProjectionsBaseline } from './projection-store.ts'
 
 /** Messages requested per history page. */
 export const PAGE_MESSAGES = 50
 
+// Browser bundles cannot value-import the host timeout library. This protocol
+// bound is pinned to @deepseek-ai/dsh-timeout's MAX_TIMER_DELAY_MS in tests.
+const MAX_RETRY_DELAY_MS = 2_147_483_647
+
 /** Manager-owned observers of a Session object's local state edges. */
 export interface SessionOptions {
+  /** Catalog-discovered address selecting non-activating subagent transport. */
+  address?: SubagentAddress
+  /** Whether the exact direct parent Agent was live at the latest catalog read. */
+  parentAvailable?: boolean
   /**
    * First ACCEPTED prompt on a blank session (fires at most once, on the
    * prompt RPC's success response): the manager mirrors the blank→false flip
@@ -48,14 +58,6 @@ export interface SessionOptions {
 /** Queue-row preview cap: the dock renders one line, the full content never leaves the host mirror. */
 const QUEUE_PREVIEW_CHARS = 200
 
-/** Internal inbox-mirror entry: the snapshot row plus the retirement-matching fields the frames carry. */
-interface QueuedEntry {
-  row: QueuedMessage
-  steering: boolean
-  /** JSON-serialized MessageSource (steering retirement matches by source, the host-mirror precedent). */
-  sourceJson: string
-}
-
 /** Single-line queue-row preview: text blocks flattened, non-text as tags, capped by code point. */
 function queuePreviewOf(content: readonly ContentBlock[]): string {
   const flat = content
@@ -65,6 +67,12 @@ function queuePreviewOf(content: readonly ContentBlock[]): string {
   return chars.length > QUEUE_PREVIEW_CHARS ? `${chars.slice(0, QUEUE_PREVIEW_CHARS).join('')}…` : flat
 }
 
+/** Recover complete composer text only when editing cannot discard non-text blocks. */
+function queueTextOf(content: readonly ContentBlock[]): string | null {
+  if (!content.every(block => block.type === 'text')) return null
+  return content.map(block => block.text).join('')
+}
+
 /**
  * Owns a session's event window, derived conversation state, and observable
  * snapshot. React bindings remain outside this data layer. Features see only
@@ -87,12 +95,15 @@ export class Session implements SessionFace {
    *  passes drop all writes once the generation moves on. */
   private openGeneration = 0
   private loadingOlder = false
-  private readonly foldAdapter = new FoldAdapter()
+  private readonly transcript = new TranscriptAdapter()
   private partial: PartialAccumulator | null = null
   private openCalls = new Map<string, RunningToolCall>()
-  /** Interrupted-turn terminal nodes (frozen partial text / aborted tool cards), merged into the flow by seq.
-   *  Derived from window events (turn/end sweep) — rebuilt by rebuildDerivedFromWindow like partial/openCalls. */
-  private frozenNodes: ConversationNode[] = []
+  /** Last entered step per turn, folded from step/start for terminal error placement. */
+  private lastStepByTurn = new Map<number, number>()
+  /** Operational notices and interrupted-turn terminal nodes merged into the flow by seq.
+   *  Derived from window events and rebuilt with partial/openCalls; the transcript is
+   *  seq-monotonic, so a plain seq merge preserves event order. */
+  private derivedNodes: ConversationNode[] = []
   private pending = new Map<string, PendingInteraction>()
   // Revision counters preserve array identity when derived content is unchanged, so
   // React.memo children survive unrelated snapshot swaps (chunk storms must not re-render every
@@ -102,19 +113,30 @@ export class Session implements SessionFace {
   private callsCache: { rev: number; value: RunningToolCall[] } | null = null
   private pendingRev = 0
   private pendingCache: { rev: number; value: PendingInteraction[] } | null = null
-  /** Inbox mirror (session/queued frames + mux-open baseline). Queue frames never hit history,
-   *  so this is stream-only state: reconnect clears it and the fresh baseline re-populates. */
-  private queued: QueuedEntry[] = []
+  private derivedRev = 0
+  private nodesCache: { projected: readonly ConversationNode[]; derivedRev: number; value: readonly ConversationNode[] } | null = null
+  /** Exact turn timing retained from the raw window so presentation never
+   *  infers elapsed time from transcript content. */
+  private turnTimings = new Map<number, { startTime: number; endTime?: number }>()
+  private turnTimingsRev = 0
+  private turnTimingsCache: { rev: number; value: ConversationSnapshot['turnTimings'] } | null = null
+  /** Completed turn boundaries retained from the raw window so presentation
+   *  actions never infer a safe fork point from transcript content alone. */
+  private turnEnds = new Map<number, number>()
+  private turnEndsRev = 0
+  private turnEndsCache: { rev: number; value: ReadonlyMap<number, number> } | null = null
+  /** Authoritative stream-only inbox snapshot; pending work never hits history. */
+  private queued: QueuedMessage[] = []
   private queueRev = 0
   private queueCache: { rev: number; value: QueuedMessage[] } | null = null
-  private frozenRev = 0
-  private nodesCache: { folded: readonly ConversationNode[]; frozenRev: number; value: readonly ConversationNode[] } | null = null
   /** `run_code` sub-dispatches by parent callId (window-derived, like openCalls). Appends
    *  copy-on-write the per-parent array so published snapshot references never mutate. */
   private codeDispatches = new Map<string, readonly CodeSubCall[]>()
   private dispatchesRev = 0
   private dispatchesCache: { rev: number; value: ReadonlyMap<string, readonly CodeSubCall[]> } | null = null
   private running = false
+  private address: SubagentAddress | undefined
+  private parentAvailable = false
   /**
    * Sticky send marker, private input of the composerPhase derivation: set
    * synchronously before prompt()'s first await, never reset — the blank →
@@ -170,6 +192,8 @@ export class Session implements SessionFace {
     private readonly options: SessionOptions = {},
   ) {
     this.projections = options.projections ?? new ProjectionValueStore()
+    this.address = options.address
+    this.parentAvailable = options.parentAvailable ?? false
     this.snapshotCache = this.buildSnapshot()
   }
 
@@ -209,7 +233,21 @@ export class Session implements SessionFace {
     this.notifier.markDirty()
     let result: RpcResult<{ accepted: true }>
     try {
-      result = (await this.api.sessions.prompt({ sessionId: this.sessionId, mode, content })).result
+      if (this.address === undefined) {
+        result = (await this.api.sessions.prompt({ sessionId: this.sessionId, mode, content })).result
+      } else if (this.address.mode === 'one-shot') {
+        result = {
+          ok: false,
+          error: {
+            code: 'subagent-not-resumable',
+            message: 'one-shot subagent conversations are read-only',
+            details: { childSessionId: this.address.childSessionId },
+          },
+        }
+      } else {
+        const routed = (await this.api.subagents.prompt({ ...this.address, content })).result
+        result = routed.ok ? { ok: true, value: { accepted: true } } : routed
+      }
     } catch (error) {
       result = transportError(error)
     }
@@ -234,11 +272,34 @@ export class Session implements SessionFace {
     return result
   }
 
+  /** Apply one operation to a still-pending queue occurrence. */
+  async updateQueue(itemId: MessageId, action: QueueAction): Promise<RpcResult<{ accepted: true }>> {
+    try {
+      return (await this.api.sessions.updateQueue({ sessionId: this.sessionId, itemId, action })).result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
   /**
-   * Stop: contract session.cancel 1:1; failures land in promptError (same error-strip display slot).
+   * Stop the active turn while the Host preserves pending inbox work; failures
+   * land in promptError (same error-strip display slot).
    * @returns the cancel result.
    */
   async cancel(): Promise<RpcResult<{ accepted: true }>> {
+    if (this.address !== undefined) {
+      const result: RpcResult<{ accepted: true }> = {
+        ok: false,
+        error: {
+          code: 'subagent-delivery-unavailable',
+          message: 'subagent activation cancellation is unavailable',
+          details: { childSessionId: this.address.childSessionId },
+        },
+      }
+      this.promptError = { op: 'stop', error: result.error }
+      this.notifier.markDirty()
+      return result
+    }
     let result: RpcResult<{ accepted: true }>
     try {
       result = (await this.api.sessions.cancel({ sessionId: this.sessionId })).result
@@ -252,6 +313,25 @@ export class Session implements SessionFace {
     return result
   }
 
+  /**
+   * Rename: contract session.rename 1:1. On success settle the 'title'
+   * projection cell from the response's `{title, seq}` under the store's
+   * higher-seq-wins rule (the push frame arriving later is a no-op replay),
+   * so the list row and any useProjection('title') reader update without
+   * waiting for the mux frame.
+   * @param title - raw title text (the host normalizes acceptance).
+   * @returns the rename result (normalized accepted title + title event seq).
+   */
+  async rename(title: string): Promise<RpcResult<{ title: string; seq: number }>> {
+    try {
+      const { result } = await this.api.sessions.rename({ sessionId: this.sessionId, title })
+      if (result.ok) this.projections.apply('title', result.value.title, result.value.seq)
+      return result
+    } catch (error) {
+      return transportError(error)
+    }
+  }
+
   /**
    * Execute one slash-command line against this session's agent — pure
    * admission semantics (the host executor durably logs the lifecycle;
@@ -285,9 +365,7 @@ export class Session implements SessionFace {
     this.loadingOlder = true
     this.notifier.markDirty()
     try {
-      const { result } = await this.api.sessions.history({
-        sessionId: this.sessionId, beforeSeq: this.baseSeq, maxMessages: PAGE_MESSAGES,
-      })
+      const { result } = await this.history({ beforeSeq: this.baseSeq, maxMessages: PAGE_MESSAGES })
       if (!result.ok) return // keep the window as-is; do not overwrite openError (open already succeeded)
       const older = result.value.events
       if (older.length === 0) {
@@ -306,7 +384,7 @@ export class Session implements SessionFace {
       /* v8 ignore next -- the ?? arm needs older[0] undefined, but the empty-page branch above already returned. */
       this.baseSeq = older[0]?.event.seq ?? this.baseSeq
       this.hasMore = result.value.hasMore
-      this.foldAdapter.reset(this.events, this.baseSeq, this.views) // prepend forces a rebuild (sentinel count changed)
+      this.transcript.reset(this.events, this.views) // prepend forces a rebuild (the window grew at the head)
       this.rebuildDerivedFromWindow()
     } catch (error) {
       console.error('[web-runtime] loadOlder failed:', error)
@@ -374,20 +452,18 @@ export class Session implements SessionFace {
   handleMuxEnvelope(rpcId: RpcId, frame: MuxFrame): void {
     switch (frame.type) {
       case 'session/event': {
-        this.retireQueued(frame.event)
         this.acceptLiveEvent(frame.event, frame.view)
         return
       }
-      case 'session/queued': {
-        const message = frame.message
-        // Row key: the enqueueing prompt's rpcId when it rode this wire (the
-        // provisional-echo reconciliation key); otherwise the frame envelope id.
-        const key = 'rpcId' in message.source ? String(message.source.rpcId) : `f:${rpcId}`
-        this.queued.push({
-          row: { key, preview: queuePreviewOf(message.content) },
-          steering: frame.steering,
-          sourceJson: JSON.stringify(message.source),
-        })
+      case 'session/queue': {
+        this.queued = frame.items.map(item => ({
+          id: item.id,
+          messageId: item.message.id,
+          placement: item.placement,
+          content: item.message.content,
+          preview: queuePreviewOf(item.message.content),
+          text: queueTextOf(item.message.content),
+        }))
         this.queueRev++
         this.notifier.markDirty()
         return
@@ -440,15 +516,6 @@ export class Session implements SessionFace {
    * @param running - the new running state.
    */
   handleRunning(running: boolean): void {
-    // Leave-running sweep (host queuedMirror precedent): discard paths (cancel,
-    // terminal steering drop) have no per-entry frame, so ANY not-running signal
-    // with a nonempty mirror clears it — checked before the equality return so a
-    // stale replay on an already-idle session still sweeps.
-    if (!running && this.queued.length > 0) {
-      this.queued = []
-      this.queueRev++
-      this.notifier.markDirty()
-    }
     // Turn-start conversion: a blank session never runs, so the first
     // running:true proves another端's first message landed (设计稿 2.2).
     if (running && this.blankBit) {
@@ -460,6 +527,32 @@ export class Session implements SessionFace {
     this.notifier.markDirty()
   }
 
+  /**
+   * Install or clear the catalog-discovered transport address. A changed
+   * address rebuilds an already-open window through its new history route.
+   * @param address - direct parent/child address, or undefined for ordinary transport.
+   * @param parentAvailable - latest exact-parent availability hint.
+   */
+  configureSubagent(address: SubagentAddress | undefined, parentAvailable = false): void {
+    const same = this.address?.parentSessionId === address?.parentSessionId
+      && this.address?.childSessionId === address?.childSessionId
+      && this.address?.mode === address?.mode
+    this.address = address
+    this.parentAvailable = parentAvailable
+    if (!same && this.openState !== 'cold') void this.resync()
+    else this.notifier.markDirty()
+  }
+
+  /**
+   * Update only the parent availability hint from a catalog refresh.
+   * @param available - whether the exact direct parent is live.
+   */
+  handleSubagentParentAvailable(available: boolean): void {
+    if (this.parentAvailable === available) return
+    this.parentAvailable = available
+    this.notifier.markDirty()
+  }
+
   /**
    * Blank-bit relay from the authoritative summary source (list baseline and
    * the session-added frame). Monotone: once any signal (local first send,
@@ -514,7 +607,7 @@ export class Session implements SessionFace {
     this.openError = null
     this.notifier.markDirty()
     try {
-      let { result } = await this.api.sessions.history({ sessionId: this.sessionId, maxMessages: PAGE_MESSAGES })
+      let { result } = await this.history({ maxMessages: PAGE_MESSAGES })
       if (generation !== this.openGeneration) return
       if (!result.ok) {
         this.openState = 'error'
@@ -525,7 +618,7 @@ export class Session implements SessionFace {
       // Gap detection (§D.3-4): baseline past the window tail and liveBuffer did not cover it -> pull the tail page once more.
       const tailSeq = this.windowTailSeq()
       if (this.subscribedLastSeq !== null && tailSeq !== null && this.subscribedLastSeq > tailSeq) {
-        result = (await this.api.sessions.history({ sessionId: this.sessionId, maxMessages: PAGE_MESSAGES })).result
+        result = (await this.history({ maxMessages: PAGE_MESSAGES })).result
         if (generation !== this.openGeneration) return
         if (result.ok) this.installWindow(result.value.events, result.value.hasMore, result.value.projections)
       }
@@ -553,7 +646,7 @@ export class Session implements SessionFace {
     this.views = entries.map(e => e.view)
     this.baseSeq = this.events[0]?.seq ?? 0
     this.hasMore = hasMore
-    this.foldAdapter.reset(this.events, this.baseSeq, this.views)
+    this.transcript.reset(this.events, this.views)
     this.rebuildDerivedFromWindow()
     if (projections !== undefined) this.projections.seed(projections)
     const buffered = this.liveBuffer
@@ -568,14 +661,27 @@ export class Session implements SessionFace {
     if (tailSeq !== null && event.seq <= tailSeq) return // replay overlap, drop
     this.events.push(event)
     this.views.push(view)
-    this.foldAdapter.append(event, view)
+    this.transcript.append(event, view)
+    this.handoffPendingSteering(event)
     this.applyEventSideEffects(event, view)
   }
 
+  /** Retire the first matching live steering occurrence when its durable message takes over. */
+  private handoffPendingSteering(event: SessionEvent): void {
+    if (event.type !== 'user/message') return
+    const message = event.data
+    const index = this.queued.findIndex(item =>
+      item.placement === 'steering' && item.messageId === message.id)
+    if (index === -1) return
+    this.queued = this.queued.filter((_item, candidate) => candidate !== index)
+    this.queueRev++
+  }
+
   /** Land a live session/event (open/repair in flight -> buffer; overlapping seq -> drop;
    *  a seq gap -> buffer + tail-page repull instead of appending a hole (audit S3: a gap is an
-   *  expected reconnect-window artifact, repaired by refetch — never fed to the fold to trip
-   *  its continuity assertion into the degraded view). */
+   *  expected reconnect-window artifact, repaired by refetch). The window stays one contiguous
+   *  raw range, which is what lets the transcript render every event between its ends and lets a
+   *  compaction checkpoint find its own provenance. */
   private acceptLiveEvent(event: SessionEvent, view?: ToolEventView): void {
     if (this.openState === 'loading' || this.stitching) {
       this.liveBuffer.push({ event, view })
@@ -589,6 +695,10 @@ export class Session implements SessionFace {
       return
     }
     this.appendLive(event, view)
+    if (event.type === 'assistant/chunk') {
+      if (isVisibleAssistantChunk(event.data.chunk.type)) this.notifier.markFrameDirty()
+      return
+    }
     this.notifier.markDirty()
   }
 
@@ -601,7 +711,7 @@ export class Session implements SessionFace {
     this.stitching = true
     const generation = this.openGeneration
     try {
-      const { result } = await this.api.sessions.history({ sessionId: this.sessionId, maxMessages: PAGE_MESSAGES })
+      const { result } = await this.history({ maxMessages: PAGE_MESSAGES })
       // Failure or superseded by a full resync: drop — the resync path rebuilds and clears the buffer itself.
       if (result.ok && generation === this.openGeneration && this.openState === 'open') {
         this.installWindow(result.value.events, result.value.hasMore, result.value.projections)
@@ -613,30 +723,29 @@ export class Session implements SessionFace {
     }
   }
 
-  /** Consumption-event retirement, mirroring the host queuedMirror rules: a message-triggered
-   *  turn/start claims the oldest non-steering entry; a steering/message drains the oldest
-   *  steering entry with the same source (loop-authored steering matches nothing and drops none). */
-  private retireQueued(event: SessionEvent): void {
-    if (this.queued.length === 0) return
-    let index = -1
-    if (event.type === 'turn/start') {
-      if (event.data.trigger.kind !== 'message') return
-      index = this.queued.findIndex(entry => !entry.steering)
-    } else if (event.type === 'steering/message') {
-      const source = JSON.stringify(event.data.message.source)
-      index = this.queued.findIndex(entry => entry.steering && entry.sourceJson === source)
-    } else {
+  /** Per-event side effects (right column of the §A.9 dispatch table):
+   *  chunk/retry projection and openCalls add-remove. */
+  private applyEventSideEffects(event: SessionEvent, view?: ToolEventView): void {
+    const eventType = event.type as string
+    if (eventType === 'llm/retry') {
+      const data = parseRetryEventData(event.data)
+      if (data === null) {
+        console.error(`[web-runtime] ignored malformed llm/retry event at seq ${event.seq}`)
+        return
+      }
+      if (this.partial !== null && this.partial.turn === data.turn && this.partial.step === data.step) {
+        this.partial = null
+      }
+      this.derivedNodes.push({
+        kind: 'model-retry',
+        seq: event.seq,
+        time: event.time,
+        retryState: 'scheduled',
+        ...data,
+      })
+      this.derivedRev++
       return
     }
-    if (index < 0) return
-    this.queued.splice(index, 1)
-    this.queueRev++
-    this.notifier.markDirty()
-  }
-
-  /** Per-event side effects (right column of the §A.9 dispatch table):
-   *  chunk accumulation / partial clear on finalize / openCalls add-remove. */
-  private applyEventSideEffects(event: SessionEvent, view?: ToolEventView): void {
     // The `tool/code-dispatch-start`/`tool/code-dispatch` pair is declared by
     // the host-side dsh-tools plugin whose types cannot enter the client
     // program (its host Context merges collide with the client's), so this
@@ -697,8 +806,17 @@ export class Session implements SessionFace {
       return
     }
     switch (event.type) {
+      case 'turn/start':
+        this.lastStepByTurn.set(event.data.turn, 0)
+        this.turnTimings.set(event.data.turn, { startTime: event.time })
+        this.turnTimingsRev++
+        return
+      case 'step/start':
+        this.lastStepByTurn.set(event.data.turn, event.data.step)
+        return
       case 'assistant/chunk': {
         const { turn, step, chunk } = event.data
+        this.settleScheduledRetry('started', turn)
         if (this.partial === null || this.partial.turn !== turn || this.partial.step !== step) {
           this.partial = new PartialAccumulator(turn, step)
         }
@@ -725,6 +843,34 @@ export class Session implements SessionFace {
         return
       }
       case 'turn/end': {
+        const lastStep = this.lastStepByTurn.get(event.data.turn) ?? 0
+        const timing = this.turnTimings.get(event.data.turn)
+        if (timing !== undefined) {
+          this.turnTimings.set(event.data.turn, { ...timing, endTime: event.time })
+          this.turnTimingsRev++
+        }
+        this.turnEnds.set(event.data.turn, event.seq)
+        this.turnEndsRev++
+        if (event.data.reason.kind === 'aborted') {
+          this.settleScheduledRetry('cancelled', event.data.turn)
+        }
+        if (
+          event.data.reason.kind === 'error'
+          && !this.derivedNodes.some(node => node.kind === 'model-retry' && node.turn === event.data.turn)
+        ) {
+          const failure = event.data.reason.error
+          this.derivedNodes.push({
+            kind: 'turn-error',
+            seq: event.seq,
+            time: event.time,
+            turn: event.data.turn,
+            step: lastStep,
+            message: displayFailureMessage(failure),
+            code: failure.code,
+          })
+          this.derivedRev++
+        }
+        if (event.data.reason.kind === 'error') this.settleScheduledRetry('started', event.data.turn)
         // Aborted turns never finalize. The accumulated partial is VALUE, not residue: freeze it
         // into an interrupted terminal node (pulse stops, text survives) instead of deleting it.
         // Shared by live and window-replay paths, so a refresh reconstructs the same frozen node
@@ -734,12 +880,12 @@ export class Session implements SessionFace {
           const visible = blocks.some(b => (b.kind === 'text' || b.kind === 'reasoning' ? b.text !== '' : true))
           if (visible) {
             // Fractional seq: strictly after every event of this turn (all < turn/end seq), before the next turn.
-            this.frozenNodes.push({
+            this.derivedNodes.push({
               kind: 'assistant', seq: event.seq - 0.9, time: event.time,
               turn: this.partial.turn, step: this.partial.step,
               blocks, interrupted: true,
             })
-            this.frozenRev++
+            this.derivedRev++
           }
           this.partial = null
         }
@@ -749,7 +895,7 @@ export class Session implements SessionFace {
           this.openCalls.delete(callId)
           this.callsRev++
           // The spinner card becomes an interrupted terminal card (never vanishes mid-flow).
-          this.frozenNodes.push({
+          this.derivedNodes.push({
             kind: 'tool-result', seq: event.seq - 0.8 + callOffset++ * 0.01, time: event.time,
             callId,
             call: { name: call.name, argsRaw: call.argsRaw },
@@ -757,8 +903,9 @@ export class Session implements SessionFace {
             content: [], isError: true, error: { name: 'Interrupted', code: 'interrupted' },
             callView: call.callView, resultView: null,
           })
-          this.frozenRev++
+          this.derivedRev++
         }
+        this.lastStepByTurn.delete(event.data.turn)
         return
       }
       default:
@@ -766,15 +913,41 @@ export class Session implements SessionFace {
     }
   }
 
-  /** Re-derive state (partial/openCalls/frozenNodes) from raw window events after a rebuild — keeps
-   *  paging/stitching consistent, and makes the live freeze and the history replay converge on the
-   *  same interrupted nodes (chunks are logged, so the replayed sweep re-freezes identical text). */
+  /**
+   * Settle the newest scheduled retry, optionally restricted to its failed turn.
+   * @param retryState - next client projection state to publish.
+   * @param turn - failed turn required for cancellation; omitted for the next retry turn start.
+   */
+  private settleScheduledRetry(
+    retryState: Exclude<ModelRetryNode['retryState'], 'scheduled'>,
+    turn?: number,
+  ): void {
+    const index = this.derivedNodes.findLastIndex(node =>
+      node.kind === 'model-retry'
+      && node.retryState === 'scheduled'
+      && (turn === undefined || node.turn === turn))
+    if (index < 0) return
+    const node = this.derivedNodes[index]
+    /* v8 ignore next -- findLastIndex's predicate narrows the indexed node only at runtime. */
+    if (node?.kind !== 'model-retry') return
+    this.derivedNodes[index] = { ...node, retryState }
+    this.derivedRev++
+  }
+
+  /** Re-derive state (partial/openCalls/derivedNodes) from raw window events after a rebuild — keeps
+   *  paging/stitching consistent, and makes live handling and history replay converge on the same
+   *  retry notices and interrupted nodes. */
   private rebuildDerivedFromWindow(): void {
     this.partial = null
     this.openCalls.clear()
+    this.lastStepByTurn.clear()
     this.callsRev++
-    this.frozenNodes = []
-    this.frozenRev++
+    this.derivedNodes = []
+    this.derivedRev++
+    this.turnTimings = new Map()
+    this.turnTimingsRev++
+    this.turnEnds = new Map()
+    this.turnEndsRev++
     this.codeDispatches = new Map()
     this.dispatchesRev++
     for (let i = 0; i < this.events.length; i++) {
@@ -790,22 +963,28 @@ export class Session implements SessionFace {
   }
 
   private buildSnapshot(): ConversationSnapshot {
-    const { nodes: folded, degraded } = this.foldAdapter.nodes()
-    // Frozen interrupted nodes ride fractional seqs: a stable merge keeps them in flow order.
-    // The merged array is cached on (folded reference, frozenRev) so an unchanged flow keeps its
-    // reference across snapshot swaps (§A.9.4).
+    const projected = this.transcript.nodes()
+    // Derived interruption nodes ride fractional seqs while retry notices keep their event seq.
+    // The transcript is seq-monotonic, so sorting the union preserves flow order. Cache the
+    // merge on (projected reference, derivedRev) to retain identity across unrelated swaps.
     let nodes: readonly ConversationNode[]
-    if (this.nodesCache !== null && this.nodesCache.folded === folded && this.nodesCache.frozenRev === this.frozenRev) {
+    if (this.nodesCache !== null && this.nodesCache.projected === projected && this.nodesCache.derivedRev === this.derivedRev) {
       nodes = this.nodesCache.value
     } else {
-      nodes = this.frozenNodes.length === 0
-        ? folded
-        : [...folded, ...this.frozenNodes].sort((a, b) => a.seq - b.seq)
-      this.nodesCache = { folded, frozenRev: this.frozenRev, value: nodes }
+      nodes = this.derivedNodes.length === 0
+        ? projected
+        : [...projected, ...this.derivedNodes].sort((a, b) => a.seq - b.seq)
+      this.nodesCache = { projected, derivedRev: this.derivedRev, value: nodes }
     }
     if (this.callsCache === null || this.callsCache.rev !== this.callsRev) {
       this.callsCache = { rev: this.callsRev, value: [...this.openCalls.values()] }
     }
+    if (this.turnTimingsCache === null || this.turnTimingsCache.rev !== this.turnTimingsRev) {
+      this.turnTimingsCache = { rev: this.turnTimingsRev, value: new Map(this.turnTimings) }
+    }
+    if (this.turnEndsCache === null || this.turnEndsCache.rev !== this.turnEndsRev) {
+      this.turnEndsCache = { rev: this.turnEndsRev, value: new Map(this.turnEnds) }
+    }
     if (this.pendingCache === null || this.pendingCache.rev !== this.pendingRev) {
       this.pendingCache = { rev: this.pendingRev, value: [...this.pending.values()] }
     }
@@ -813,19 +992,23 @@ export class Session implements SessionFace {
       this.dispatchesCache = { rev: this.dispatchesRev, value: new Map(this.codeDispatches) }
     }
     if (this.queueCache === null || this.queueCache.rev !== this.queueRev) {
-      this.queueCache = { rev: this.queueRev, value: this.queued.map(entry => entry.row) }
+      this.queueCache = { rev: this.queueRev, value: this.queued }
     }
     const partial = this.partial?.toPartial() ?? null
     return {
       sessionId: this.sessionId,
       nodes,
-      foldDegraded: degraded,
+      turnTimings: this.turnTimingsCache.value,
+      turnEnds: this.turnEndsCache.value,
       partial,
       runningCalls: this.callsCache.value,
       pending: this.pendingCache.value,
       codeDispatches: this.dispatchesCache.value,
       queue: this.queueCache.value,
       running: this.running,
+      subagent: this.address === undefined
+        ? null
+        : { address: this.address, parentAvailable: this.parentAvailable },
       composerPhase: derivePhase(
         // Command lifecycle nodes are not conversation: running /permission
         // or /plan on a fresh session keeps the hero (the client mirror of
@@ -843,6 +1026,69 @@ export class Session implements SessionFace {
       lastAgentError: this.lastAgentError,
     }
   }
+
+  /** Select ordinary or addressed history transport from the stored browser fact. */
+  private history(payload: { beforeSeq?: number; maxMessages?: number }): Promise<RpcResponse<{
+    events: HistoryEntry[]
+    hasMore: boolean
+    projections?: ProjectionsBaseline
+  }>> {
+    return this.address === undefined
+      ? this.api.sessions.history({ sessionId: this.sessionId, ...payload })
+      : this.api.subagents.history({ ...this.address, ...payload })
+  }
+}
+
+/** Validate the plugin-owned payload at the session-event wire boundary. */
+function parseRetryEventData(value: unknown): LlmRetryEventData | null {
+  if (value === null || typeof value !== 'object') return null
+  const data = value as Record<string, unknown>
+  const failure = data.failure
+  if (failure === null || typeof failure !== 'object') return null
+  const failureData = failure as Record<string, unknown>
+  if (!nonNegativeSafeInteger(data.turn)
+    || !nonNegativeSafeInteger(data.step)
+    || typeof data.provider !== 'string'
+    || data.provider.length === 0
+    || typeof data.policyKey !== 'string'
+    || data.policyKey.length === 0
+    || !positiveSafeInteger(data.retry)
+    || typeof data.delayMs !== 'number'
+    || !Number.isFinite(data.delayMs)
+    || data.delayMs < 0
+    || data.delayMs > MAX_RETRY_DELAY_MS
+    || typeof failureData.message !== 'string'
+    || failureData.message.length === 0
+    || typeof failureData.code !== 'string'
+    || failureData.code.length === 0) return null
+  if (data.mode === 'normal') {
+    if (!positiveSafeInteger(data.maxRetries) || data.retry > data.maxRetries) return null
+  } else if (data.mode === 'always') {
+    if ('maxRetries' in data) return null
+  } else {
+    return null
+  }
+  if (failureData.status !== undefined
+    && (typeof failureData.status !== 'number'
+      || !Number.isInteger(failureData.status)
+      || failureData.status < 100
+      || failureData.status > 599)) return null
+  if (failureData.providerRetryAfterMs !== undefined
+    && (typeof failureData.providerRetryAfterMs !== 'number'
+      || !Number.isFinite(failureData.providerRetryAfterMs)
+      || failureData.providerRetryAfterMs <= 0)) return null
+  if (failureData.requestId !== undefined
+    && (typeof failureData.requestId !== 'string'
+      || failureData.requestId.length === 0)) return null
+  return data as unknown as LlmRetryEventData
+}
+
+function nonNegativeSafeInteger(value: unknown): value is number {
+  return typeof value === 'number' && Number.isSafeInteger(value) && value >= 0
+}
+
+function positiveSafeInteger(value: unknown): value is number {
+  return nonNegativeSafeInteger(value) && value > 0
 }
 
 /**

packages/client/runtime/src/client/sessions/steering-history.ts

@@ -0,0 +1,65 @@
+/** Reconstruct durable steering identity from the event-sourced agent inbox. */
+
+import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
+
+type InboxTarget = 'next-turn' | 'next-step'
+
+/** Minimal pending identity retained while replaying durable inbox splices. */
+interface PendingIdentity {
+  readonly id: string
+}
+
+/** Client-side structural view of the host-owned inbox event. */
+interface InboxSplice {
+  readonly target: InboxTarget
+  readonly start: number
+  readonly removedCount?: number
+  readonly inserted: readonly PendingIdentity[]
+  readonly outcome?: 'canceled'
+}
+
+/**
+ * Incrementally identifies `user/message` events claimed from the next-step
+ * inbox. The agent loop records all admitted input as `user/message`; the
+ * preceding `agent/inbox/spliced` events preserve whether it came from the
+ * queued-turn list or the next-step list.
+ */
+export class SteeringHistory {
+  private readonly inbox: Record<InboxTarget, PendingIdentity[]> = {
+    'next-turn': [],
+    'next-step': [],
+  }
+
+  private readonly claimedNextStep = new Set<string>()
+
+  /** Clear all replay state before rebuilding a history window. */
+  reset(): void {
+    this.inbox['next-turn'] = []
+    this.inbox['next-step'] = []
+    this.claimedNextStep.clear()
+  }
+
+  /**
+   * Apply one event and report whether it is a durable human steering message.
+   * @param event - next raw session event in sequence order.
+   * @returns true only for a user-origin message previously claimed from `next-step`.
+   */
+  apply(event: SessionEvent): boolean {
+    if ((event.type as string) === 'agent/inbox/spliced') {
+      this.applySplice(event.data as unknown as InboxSplice)
+      return false
+    }
+    if (event.type !== 'user/message') return false
+    const id = event.data.id
+    if (!this.claimedNextStep.delete(id)) return false
+    return event.data.source.kind === 'user'
+  }
+
+  /** Replay one host-validated inbox splice. */
+  private applySplice({ target, start, removedCount = 0, inserted, outcome }: InboxSplice): void {
+    const removed = this.inbox[target].splice(start, removedCount, ...inserted)
+    for (const identity of inserted) this.claimedNextStep.delete(identity.id)
+    if (target !== 'next-step' || outcome === 'canceled') return
+    for (const identity of removed) this.claimedNextStep.add(identity.id)
+  }
+}

packages/client/runtime/src/client/sessions/transcript-adapter.ts

@@ -0,0 +1,355 @@
+// TranscriptAdapter: the human transcript projected from the raw event window
+// in LOG order. The model-visible surface deliberately shadows replaced ranges,
+// so it is the wrong source for conversation a reader already saw; this adapter
+// keeps every append-origin event at its own log position and contributes one
+// marker node per landed compaction checkpoint. Node order is therefore
+// seq-monotonic by construction — no surface fold, no padding sentinels, no
+// seq === index assertion to satisfy, and no degradation branch.
+
+import type { SessionEvent } from '@deepseek-ai/dsh-session/types'
+// Subpath export (package.json exports "./surface", alias added for this): all value imports
+// go through it — the package root points at lib/index.js (needs a build) which the vite
+// browser bundle cannot resolve; surface.ts has no Node dependencies.
+import { isAppendSurfaceEvent, isReplacementSurfaceEvent } from '@deepseek-ai/dsh-session/surface'
+import type { CommandId } from '@deepseek-ai/dsh-commands/brand'
+// Cordis-free leaf subpath (the dsh-commands/brand shape): the seam's own
+// declaration of the checkpoint source, reachable as a TYPE from this program.
+// The package ROOT is not — it reaches dsh-session's root, whose Context merge
+// declares the HOST `sessions: SessionStore` against this program's
+// `sessions: ISessions` (TS2717, the one-program-per-side rule in
+// docs/development.md).
+import type { COMPACT_CHECKPOINT_SOURCE } from '@deepseek-ai/dsh-compact/checkpoint'
+import type { ToolCallView, ToolEventView, ToolResultView } from '@deepseek-ai/dsh-client-connection/client'
+import type { CommandNode, CompactionSummaryNode, ConversationNode } from './conversation.ts'
+import { toAssistantBlocks } from './conversation.ts'
+import { contextForm, contextProvenance } from './context-provenance.ts'
+import { SteeringHistory } from './steering-history.ts'
+import type { AssistantStepMetadata } from './assistant-timing.ts'
+import { indexAssistantStepTiming, settledAssistantTiming } from './assistant-timing.ts'
+
+/**
+ * The compaction seam's checkpoint plugin, pinned to the seam's own declaration
+ * at COMPILE time: renaming it there fails this annotation (`TS2322`). The
+ * import stays type-only because a value import would fail the client purity
+ * gate (`packages/client/tsdown.client.ts`) — cross-plugin value imports are
+ * forbidden in a browser bundle — while an erased type never reaches it.
+ */
+const COMPACT_PLUGIN: typeof COMPACT_CHECKPOINT_SOURCE.plugin = 'compact'
+
+/** In-window tool/call index entry used to materialize result cards. */
+interface CallIndexEntry {
+  name: string
+  argsRaw: string
+  turn: number
+  step: number
+  /** Unix epoch ms of the tool/call event. */
+  time: number
+  /** Wire view riding the tool/call (envelope-level; never inside the event). */
+  callView: ToolCallView | null
+}
+
+/** One event -> UI node (pure function; the ten-variant ConversationNode union). */
+function materializeNode(
+  event: SessionEvent,
+  callIndex: ReadonlyMap<string, CallIndexEntry>,
+  resultView: ToolResultView | null,
+  steering: boolean,
+  stepTimings: ReadonlyMap<string, AssistantStepMetadata>,
+): ConversationNode {
+  switch (event.type) {
+    case 'user/message':
+      // Injected context (plugin/goal source) folds to a context node, not a
+      // user message; only a direct human prompt is a user node. A compaction
+      // checkpoint never reaches here (isCompactCheckpoint routes it away).
+      if (event.data.source.kind !== 'user') {
+        return {
+          kind: 'context', seq: event.seq, time: event.time,
+          content: event.data.content, source: event.data.source,
+          provenance: contextProvenance(event.data.source),
+          form: contextForm(event.data.source),
+        }
+      }
+      if (steering) {
+        return {
+          kind: 'steering', messageId: event.data.id,
+          seq: event.seq, time: event.time,
+          content: event.data.content, source: event.data.source,
+        }
+      }
+      return {
+        kind: 'user', seq: event.seq, time: event.time,
+        content: event.data.content, source: event.data.source,
+      }
+    case 'assistant/message':
+      return {
+        kind: 'assistant', seq: event.seq, time: event.time,
+        turn: event.data.turn, step: event.data.step,
+        blocks: toAssistantBlocks(event.data.message.content), usage: event.data.usage,
+        timing: settledAssistantTiming(stepTimings, event.data.turn, event.data.step, event.time),
+      }
+    case 'tool/result': {
+      const result = event.data.message.content[0]
+      const callId = String(event.data.message.source.callId)
+      const call = callIndex.get(callId)
+      return {
+        kind: 'tool-result', seq: event.seq, time: event.time,
+        callId,
+        call: call ? { name: call.name, argsRaw: call.argsRaw } : null,
+        callTime: call?.time ?? null,
+        content: result.content, isError: result.isError === true,
+        ...(event.data.error !== undefined ? { error: event.data.error } : {}),
+        meta: event.data.meta,
+        callView: call?.callView ?? null,
+        resultView,
+      }
+    }
+    /* v8 ignore next 2 -- defensive arm: only the four surface-eligible types
+    can be append-origin, and each has a case above; reachable only if core
+    adds an eligible type. */
+    default:
+      return {
+        kind: 'unknown', seq: event.seq, time: event.time,
+        type: event.type, data: (event as { data?: unknown }).data,
+      }
+  }
+}
+
+/**
+ * Whether an event is a landed compaction checkpoint — all three conditions,
+ * matching the terminal's `isCompactCheckpoint`: a `user/message`, carrying the
+ * compaction seam's checkpoint plugin source, that REPLACED a surface range. A
+ * plugin-sourced `user/message` that appends is injected context (a
+ * session-reference card), not a compaction; a replacement `tool/result` is an
+ * in-place prune and a replacement `assistant/message` a generic rewrite, and
+ * both mark no boundary in the conversation.
+ * @param event - the raw window event.
+ * @returns true when the event compacted a surface range.
+ */
+function isCompactCheckpoint(event: SessionEvent): boolean {
+  if (event.type !== 'user/message') return false
+  const source = event.data.source
+  return source.kind === 'plugin' && source.plugin === COMPACT_PLUGIN
+    && isReplacementSurfaceEvent(event)
+}
+
+/** Whether an event contributes a node to the human transcript. */
+function isTranscriptEvent(event: SessionEvent): boolean {
+  return isAppendSurfaceEvent(event) || isCompactCheckpoint(event)
+}
+
+/**
+ * Concatenated text of a `compact/summary` payload, or null when it carries no
+ * usable text. The payload is a `ContentBlock[]` whose union is
+ * merge-extensible, so a non-text block is skipped rather than discarding the
+ * text beside it; a payload with no text block at all falls to null through the
+ * empty check.
+ */
+function compactSummaryText(event: SessionEvent): string | null {
+  const summary = (event.data as unknown as { summary?: unknown }).summary
+  if (!Array.isArray(summary)) return null
+  let text = ''
+  for (const block of summary as readonly unknown[]) {
+    const candidate = block as { type?: unknown; text?: unknown }
+    if (candidate.type !== 'text' || typeof candidate.text !== 'string') continue
+    text += candidate.text
+  }
+  return text.trim() === '' ? null : text
+}
+
+/**
+ * One landed checkpoint -> the human-facing compaction marker. The summary text
+ * comes from the checkpoint's own provenance (`sourceEventSeqs` names the
+ * `compact/summary` event), never from the framed checkpoint payload, which is
+ * an instruction envelope written for the model. A window cut that left the
+ * provenance outside soft-falls to `summary: null` (a non-expandable marker),
+ * the same posture as a call-less tool result.
+ */
+function materializeCompaction(
+  checkpoint: SessionEvent,
+  eventIndex: ReadonlyMap<number, SessionEvent>,
+): CompactionSummaryNode {
+  const sources = (checkpoint as SessionEvent & { sourceEventSeqs?: number[] }).sourceEventSeqs
+  let summary: string | null = null
+  for (const seq of sources ?? []) {
+    const candidate = eventIndex.get(seq)
+    if (candidate === undefined || (candidate.type as string) !== 'compact/summary') continue
+    summary = compactSummaryText(candidate)
+    break
+  }
+  return { kind: 'compaction', seq: checkpoint.seq, time: checkpoint.time, summary }
+}
+
+/** Log-ordered human transcript over a paged raw event window (never consults surface order). */
+export class TranscriptAdapter {
+  /** Window events by seq: provenance lookup for a checkpoint's summary. */
+  private eventIndex = new Map<number, SessionEvent>()
+  /** Transcript nodes in log order; copy-on-write so a published array never mutates. */
+  private projected: ConversationNode[] = []
+  private callIdx = new Map<string, CallIndexEntry>()
+  /** Per-step timing boundaries (step/start + first token delta), consumed when the step's assistant/message materializes. */
+  private stepTimings = new Map<string, AssistantStepMetadata>()
+  /** Wire result views keyed by the tool/result event's seq (views ride the envelope, not the event). */
+  private resultViews = new Map<number, ToolResultView>()
+  /** Durable inbox replay used to distinguish next-step human input from queued prompts. */
+  private readonly steeringHistory = new SteeringHistory()
+  /**
+   * Command lifecycle nodes by commandId (insertion = run order). The
+   * `command/run`/`command/done` pair is log-only, so it is not a surface
+   * event and never joins the transcript projection; this index folds the pair
+   * (done settles its run's node in place) and nodes() merges the products in
+   * by seq. Window cuts soft-fall like tool pairs: a done with no in-window
+   * run still builds a node.
+   */
+  private commandIdx = new Map<string, CommandNode>()
+  /** Projection revision, bumped only when a transcript node or a command node actually
+   *  changed, keying the nodes() result cache: an unchanged projection returns the previous
+   *  ARRAY reference, not just cached elements — the snapshot's reference-stability contract
+   *  (§A.9.4) starts here, and a chunk storm bumps nothing at all. */
+  private rev = 0
+  private nodesResult: { rev: number; value: readonly ConversationNode[] } | null = null
+
+  /**
+   * Window rebuild (after open/resync/page prepend): re-index the raw window
+   * and re-project the transcript.
+   * @param events - the new window contents (seq-ascending).
+   * @param views - per-event wire views aligned with `events` by index (undefined slots for view-less events).
+   */
+  reset(events: readonly SessionEvent[], views?: readonly (ToolEventView | undefined)[]): void {
+    this.rev++
+    this.eventIndex = new Map()
+    this.callIdx = new Map()
+    this.resultViews.clear()
+    this.commandIdx = new Map()
+    this.steeringHistory.reset()
+    const steeringSeqs = new Set<number>()
+    this.stepTimings = new Map()
+    for (let i = 0; i < events.length; i++) {
+      const event = events[i]
+      /* v8 ignore next -- dense-array guard: i stays within events.length, so the undefined arm needs a sparse array no caller builds. */
+      if (event === undefined) continue
+      this.eventIndex.set(event.seq, event)
+      this.indexCall(event, views?.[i])
+      this.indexCommand(event)
+      if (this.steeringHistory.apply(event)) steeringSeqs.add(event.seq)
+      indexAssistantStepTiming(this.stepTimings, event)
+    }
+    // Indexes first, then project: a tool/result materializes against the
+    // complete call index, and a checkpoint against the complete event index.
+    const projected: ConversationNode[] = []
+    for (const event of events) {
+      if (isTranscriptEvent(event)) projected.push(this.materialize(event, steeringSeqs.has(event.seq)))
+    }
+    this.projected = projected
+  }
+
+  /**
+   * Tail append (live session/event): index the event and, when it belongs to
+   * the transcript, extend the projection by one copy-on-write node so a
+   * published array never mutates. An event that changes no node (a chunk
+   * storm) bumps no revision, so nodes() keeps returning the same array
+   * reference.
+   * @param event - the live event (seq = window tail + 1).
+   * @param view - host-computed tool view paired with the event when it is a tool call/result; indexed for card rendering.
+   */
+  append(event: SessionEvent, view?: ToolEventView): void {
+    this.eventIndex.set(event.seq, event)
+    this.indexCall(event, view)
+    const steering = this.steeringHistory.apply(event)
+    indexAssistantStepTiming(this.stepTimings, event)
+    if (this.indexCommand(event)) this.rev++
+    if (!isTranscriptEvent(event)) return
+    this.projected = [...this.projected, this.materialize(event, steering)]
+    this.rev++
+  }
+
+  /**
+   * The current transcript node array. Same revision -> same array reference
+   * (memo boundary); node objects are materialized once, so an unchanged node
+   * keeps its identity across appends.
+   * @returns transcript nodes in log order, command nodes merged in by seq.
+   */
+  nodes(): readonly ConversationNode[] {
+    if (this.nodesResult !== null && this.nodesResult.rev === this.rev) return this.nodesResult.value
+    // Command nodes fold outside the transcript (log-only events); merge by
+    // seq. Both inputs are seq-ascending (log order and run-index insertion
+    // order are the same order), so one linear merge keeps flow order.
+    let nodes = this.projected
+    if (this.commandIdx.size > 0) {
+      nodes = []
+      const commands = [...this.commandIdx.values()]
+      let next = 0
+      for (const node of this.projected) {
+        for (let cmd = commands[next]; cmd !== undefined && cmd.seq < node.seq; cmd = commands[++next]) {
+          nodes.push(cmd)
+        }
+        nodes.push(node)
+      }
+      for (let cmd = commands[next]; cmd !== undefined; cmd = commands[++next]) nodes.push(cmd)
+    }
+    this.nodesResult = { rev: this.rev, value: nodes }
+    return nodes
+  }
+
+  /** Materialize one transcript event against the complete current indexes. */
+  private materialize(event: SessionEvent, steering: boolean): ConversationNode {
+    return isCompactCheckpoint(event)
+      ? materializeCompaction(event, this.eventIndex)
+      : materializeNode(
+        event,
+        this.callIdx,
+        this.resultViews.get(event.seq) ?? null,
+        steering,
+        this.stepTimings,
+      )
+  }
+
+  /**
+   * Fold one command lifecycle event into its node (run mints, done settles in
+   * place; done-only soft-falls).
+   * @returns whether the command index changed, so callers can bump the revision.
+   */
+  private indexCommand(event: SessionEvent): boolean {
+    // Log-only plugin events: the host-side dsh-commands declaration cannot
+    // enter the client program, so this wire consumer narrows structurally
+    // (the same posture as tool/code-dispatch in session.ts).
+    if ((event.type as string) === 'command/run') {
+      const data = event.data as unknown as { commandId: CommandId; name: string; args?: string }
+      this.commandIdx.set(data.commandId, {
+        kind: 'command', seq: event.seq, time: event.time,
+        commandId: data.commandId, name: data.name, args: data.args ?? null, outcome: null,
+      })
+      return true
+    }
+    if ((event.type as string) !== 'command/done') return false
+    const data = event.data as unknown as { commandId: CommandId; kind: 'success' | 'error'; text?: string }
+    const run = this.commandIdx.get(data.commandId)
+    const outcome = { kind: data.kind, ...data.text === undefined ? {} : { text: data.text } }
+    if (run === undefined) {
+      // Cross-window cut: the run page fell out of the window — build the
+      // node from the done alone (same soft-fall as a call-less tool result).
+      this.commandIdx.set(data.commandId, {
+        kind: 'command', seq: event.seq, time: event.time,
+        commandId: data.commandId, name: null, args: null, outcome,
+      })
+      return true
+    }
+    // Settle in place: a fresh node object (published references stay immutable).
+    this.commandIdx.set(data.commandId, { ...run, outcome })
+    return true
+  }
+
+  private indexCall(event: SessionEvent, view?: ToolEventView): void {
+    if (event.type === 'tool/result') {
+      if (view?.for === 'result') this.resultViews.set(event.seq, view.view)
+      return
+    }
+    if (event.type !== 'tool/call') return
+    this.callIdx.set(String(event.data.callId), {
+      name: event.data.name, argsRaw: event.data.arguments, turn: event.data.turn, step: event.data.step,
+      time: event.time,
+      callView: view?.for === 'call' ? view.view : null,
+    })
+    // No backfill into already-materialized tool-result nodes for this callId
+    // (window order puts the call before its result; cannot happen on the normal path).
+  }
+}

packages/client/runtime/src/client/slots.ts

@@ -2,14 +2,14 @@
  * SlotsService: the cordis Service layer of the slot system over the pure
  * SlotCore (ui-slots owns registration semantics, the declaration ledger,
  * the load-time validations, and the unload cascade). This layer owns what
- * needs the runtime: the 'slots/changed' event bridge, register through the
- * caller's ctx.effect (fiber unload collects registrations), the renderer
- * install seam (install()/renderSlot('root') + the SlotRendererHost face),
- * and the store INSTANCE axis — handle x scope key -> create/cache, dropped
- * with the last holding entry, session instances cleared (with persisted
- * state) on scope death.
+ * needs the runtime: the 'slots/changed' event bridge, register and
+ * declaration injection through the caller's ctx.effect (fiber unload
+ * collects both), the renderer install seam (install()/renderSlot('root') +
+ * the SlotRendererHost face), and the store INSTANCE axis — handle x scope
+ * key -> create/cache, dropped with the last holding entry, session instances
+ * cleared (with persisted state) on scope death.
  */
-/* eslint-disable @typescript-eslint/no-redundant-type-constituents --
+/* oxlint-disable typescript/no-redundant-type-constituents --
  * `keyof SlotMap & string` is the declare-merge key pattern: SlotMap only
  * holds this package's 'root' row in this compilation unit, but consumers
  * merge keys in; the rule fires on the narrow-map view, not on real
@@ -18,7 +18,7 @@ import { Service } from 'cordis'
 import type { Context } from 'cordis'
 import { SlotCore } from '@deepseek-ai/dsh-client-ui-slots'
 import type {
-  OwnerOf, SlotEntryDef, SlotMap, SlotRenderer, SlotRendererHost,
+  LocaleFace, OwnerOf, SlotEntryDef, SlotMap, SlotRenderer, SlotRendererHost,
   SlotScope, SlotSpec, StoreDecl, StoredEntry, StoreInstanceLike,
 } from '@deepseek-ai/dsh-client-ui-slots'
 
@@ -70,18 +70,24 @@ interface ErasedRegisterOptions {
   select?: (owner: never) => unknown
   /** Chain-slot explicit ordering override (ascending; registration order otherwise). */
   priority?: number
+  /** Declared dictionary namespace (the renderer synthesizes the `t` seat from it). */
+  locale?: string
   registrant?: string
 }
 
 /** Erased core call face (the service re-erases at its own boundary; the core's typed face targets end callers). */
 interface ErasedCore { register(options: object, component: unknown): () => void }
 
+/** One synchronous effect installed while an injected slot declaration is live. */
+type SlotInjectionEffect = (() => void) | Iterable<() => void, void, void>
+
 /** cordis Service layer of the slot system; see the module doc for the split with SlotCore. */
 export class SlotsService extends Service {
   private readonly _core = new SlotCore()
   /** Store-instance axis: handle -> mounted scope, refcount, resolved instances. */
   private readonly _stores = new Map<EngineStoreHandle, StoreAxisRecord>()
   private _renderer: SlotRenderer | undefined
+  private _locale: LocaleFace | undefined
   private _host: SlotRendererHost | undefined
 
   /**
@@ -111,6 +117,85 @@ export class SlotsService extends Service {
    */
   declare readonly register: SlotCore['register']
 
+  /**
+   * Install an effect for each declaration lifetime of a slot. The callback
+   * runs synchronously when the declaration already exists; otherwise it runs
+   * inside the declaring `register()` call after the declaration is committed.
+   * Collapse disposes the effect and a later declaration runs it again.
+   * Callback effects are synchronous disposers; iterable effects install
+   * transactionally and dispose in reverse order. The controller belongs to
+   * the caller's fiber, so plugin unload cancels a pending wait and removes any
+   * active contribution.
+   *
+   * @param key - declared SlotMap key to depend on.
+   * @param callback - creates one disposer or an iterable of disposers.
+   * @returns idempotent disposer for the wait and active effect.
+   * @throws callback setup failures synchronously when the slot is already declared.
+   */
+  inject(key: keyof SlotMap & string, callback: () => SlotInjectionEffect): () => void {
+    const ctx = this.ctx
+    const disposeController = ctx.effect(() => {
+      let active: (() => void) | undefined
+      let activeEpoch: number | undefined
+      let stopped = false
+      let unsubscribe = (): void => {}
+
+      const stop = (): void => {
+        if (stopped) return
+        // Failure callers retire the injection permanently: a delayed setup
+        // failure never retries on a later declaration.
+        stopped = true
+        unsubscribe()
+        const dispose = active
+        active = undefined
+        activeEpoch = undefined
+        dispose?.()
+      }
+
+      const reconcile = (): void => {
+        if (stopped) return
+        const spec = this._core.specDynamic(key)
+        const epoch = this._core.declarationEpoch(key)
+        if (active !== undefined && activeEpoch === epoch) return
+        const dispose = active
+        active = undefined
+        activeEpoch = undefined
+        dispose?.()
+        if (spec === undefined) return
+        // A declaration lifetime is a nested Cordis effect. This gives
+        // generator callbacks the same transactional setup, reverse teardown,
+        // diagnostics tree, and idempotence as every other plugin effect.
+        const disposeEffect = ctx.effect(callback, `slots.inject(${JSON.stringify(key)}): declaration`)
+        active = () => { void disposeEffect() }
+        activeEpoch = epoch
+      }
+
+      const changed = (): void => {
+        try {
+          reconcile()
+        } catch (error) {
+          if ((error as { code?: unknown } | null)?.code === 'INACTIVE_EFFECT') {
+            stop()
+            return
+          }
+          stop()
+          const failure = error instanceof Error ? error : new Error(String(error))
+          queueMicrotask(() => { throw failure })
+        }
+      }
+
+      unsubscribe = this._core.subscribeDeclaration(key, changed)
+      try {
+        reconcile()
+      } catch (error) {
+        stop()
+        throw error
+      }
+      return stop
+    }, `slots.inject(${JSON.stringify(key)})`)
+    return () => { void disposeController() }
+  }
+
   /**
    * Install the shell's renderer (web-react's createSlotRenderer product).
    * Boot-once: a second install throws. Runs through the caller's ctx.effect,
@@ -127,6 +212,23 @@ export class SlotsService extends Service {
     }, 'slots.install()')
   }
 
+  /**
+   * Install the locale face backing the `t` standard seat (the locale
+   * plugin's product; same boot-once discipline as the renderer install).
+   * Runs through the caller's ctx.effect, so the installing fiber's unload
+   * uninstalls the face.
+   * @param face - namespace binder + revision observable.
+   */
+  installLocale(face: LocaleFace): void {
+    if (this._locale !== undefined) throw new Error('locale face already installed (installLocale() is boot-once)')
+    this.ctx.effect(() => {
+      this._locale = face
+      return () => {
+        if (this._locale === face) this._locale = undefined
+      }
+    }, 'slots.installLocale()')
+  }
+
   /**
    * The single ctx-level render entry: the shell renders 'root'; every other
    * key renders inside components through the props renderSlot face. All
@@ -246,6 +348,12 @@ export class SlotsService extends Service {
     if (workspaces === undefined) {
       throw new Error("renderSlot('root') before the workspaces service mounted — boot order puts runtime apply first")
     }
+    // `locale` is a live getter: the face installs (and, under HMR, swaps)
+    // on the locale plugin's own fiber lifetime, while this host object is
+    // built once — a captured value would strand renders on a dead face. The
+    // alias is required: `this` inside the getter is the host literal.
+    // oxlint-disable-next-line typescript/no-this-alias
+    const service = this
     this._host = {
       subscribe: (key, fn) => this._core.subscribe(key, fn),
       getVersion: key => this._core.getVersion(key),
@@ -259,6 +367,7 @@ export class SlotsService extends Service {
         provideInfo: sessions.currentProvideInfo,
       },
       workspaces: { list: workspaces.list },
+      get locale() { return service._locale },
     }
     return this._host
   }
@@ -310,6 +419,6 @@ export class SlotsService extends Service {
     // The core's overloads proved the shares; the implementation works on
     // the erased view (same pattern as the core's own implementation arm).
     const options = rawOptions as ErasedRegisterOptions
-    // eslint-disable-next-line @typescript-eslint/no-misused-promises -- synchronous cleanup; direct return preserves disposer identity
+    // oxlint-disable-next-line typescript/no-misused-promises -- synchronous cleanup; direct return preserves disposer identity
     return this.ctx.effect(() => this['_register'](options, component), 'slots.register()')
   }

packages/client/runtime/src/client/workspaces/manager.ts

@@ -14,6 +14,14 @@ export type WorkspaceListPhase = 'pending' | 'ready'
 /** Immutable workspace-list snapshot. */
 export interface WorkspaceListSnapshot {
   items: readonly WorkspaceView[]
+  /**
+   * Registry-global archive set in Host order (hidden from grouping
+   * surfaces; accounting slots retained). A plain array, not a Set: public
+   * snapshot state stays in the store engine's plain-data vocabulary
+   * (immer drafts reject Sets without the MapSet plugin); membership
+   * lookups build their own transient Set where they need one.
+   */
+  archivedSessionIds: readonly SessionId[]
   state: 'idle' | 'loading' | 'error'
   phase: WorkspaceListPhase
   error: RpcError | null
@@ -28,11 +36,21 @@ export class WorkspaceManager {
   private items: Workspace[] = []
   private itemViewsSource: readonly Workspace[] | null = null
   private itemViewsCache: readonly WorkspaceView[] = []
+  // Full-snapshot state (list response / unary response / changed frame all
+  // carry the complete set), so deltas never merge — installs replace.
+  private archivedSessionIds: readonly SessionId[] = []
   private state: WorkspaceListSnapshot['state'] = 'idle'
   private phase: WorkspaceListPhase = 'pending'
   private error: RpcError | null = null
   private inflight: Promise<void> | null = null
   private refreshFrames: WorkspaceDelta[] | null = null
+  /**
+   * True once a frame or unary echo installed the archive set while a list
+   * request was in flight: that install is newer than the pending baseline,
+   * so the baseline's (older) set must not roll it back — the archive
+   * mirror of replaying refreshFrames over the item baseline.
+   */
+  private archivedSupersedesRefresh = false
   /**
    * Ids this process has seen removed, kept for the connection's lifetime so
    * a late changed frame or a stale baseline row cannot resurrect a deleted
@@ -77,6 +95,7 @@ export class WorkspaceManager {
           items = items.filter(workspace => !this.removedIds.has(workspace.workspaceId))
           for (const delta of frames) items = applyWorkspaceDelta(items, delta)
           this.installViews(items)
+          if (!this.archivedSupersedesRefresh) this.installArchived(result.value.archivedSessionIds)
           this.state = 'idle'
           this.phase = 'ready'
         } else {
@@ -90,6 +109,7 @@ export class WorkspaceManager {
         this.error = folded.ok ? null : folded.error
       } finally {
         this.refreshFrames = null
+        this.archivedSupersedesRefresh = false
         this.inflight = null
         this.notifier.markDirty()
       }
@@ -158,6 +178,18 @@ export class WorkspaceManager {
     return result
   }
 
+  /**
+   * Archive one session in the registry-global set, then install the
+   * returned full set without waiting for the changed frame.
+   * @param sessionId - session to archive.
+   * @returns the wire result.
+   */
+  async archiveSession(sessionId: SessionId): Promise<RpcResult<{ archivedSessionIds: SessionId[] }>> {
+    const { result } = await this.api.workspace.archiveSession({ sessionId })
+    if (result.ok) this.installArchived(result.value.archivedSessionIds)
+    return result
+  }
+
   /**
    * Host-frame entry. Non-workspace frames are ignored so the runtime can
    * fan one host stream out to both object managers.
@@ -166,6 +198,9 @@ export class WorkspaceManager {
   handleHostEnvelope(envelope: RpcRequest<HostFrame>): void {
     if (envelope.payload.type === 'host/workspace-changed') this.upsert(envelope.payload.workspace)
     else if (envelope.payload.type === 'host/workspace-removed') this.remove(envelope.payload.workspaceId)
+    else if (envelope.payload.type === 'host/archived-sessions-changed') {
+      this.installArchived(envelope.payload.archivedSessionIds)
+    }
   }
 
   /** Re-pull the baseline after each connection generation. */
@@ -194,12 +229,26 @@ export class WorkspaceManager {
   private buildSnapshot(): WorkspaceListSnapshot {
     return {
       items: this.itemViews(),
+      archivedSessionIds: this.archivedSessionIds,
       state: this.state,
       phase: this.phase,
       error: this.error,
     }
   }
 
+  /**
+   * Replace the archive set when membership actually changed (array identity
+   * backs Object.is short-circuits). Host snapshots are append-ordered, so
+   * positional comparison is exact, not merely heuristic.
+   */
+  private installArchived(archivedSessionIds: readonly SessionId[]): void {
+    if (this.refreshFrames !== null) this.archivedSupersedesRefresh = true
+    if (archivedSessionIds.length === this.archivedSessionIds.length
+      && archivedSessionIds.every((id, index) => id === this.archivedSessionIds[index])) return
+    this.archivedSessionIds = [...archivedSessionIds]
+    this.notifier.markDirty()
+  }
+
   /** Upsert one Host view, optionally retaining the local object that materialized it. */
   private upsert(view: WorkspaceView, identity?: Workspace): void {
     if (this.removedIds.has(view.workspaceId)) return

packages/client/runtime/src/client/workspaces/service.ts

@@ -14,6 +14,14 @@ import { WorkspaceManager, type WorkspaceListPhase } from './manager.ts'
 /** Workspace list plus the two-baseline readiness and default-target projection. */
 export interface WorkspaceListState {
   items: readonly WorkspaceView[]
+  /**
+   * Registry-global archive set in Host order: grouping surfaces hide these
+   * sessions everywhere (workspace groups and the ungrouped bucket) while
+   * their session logs and workspace accounting slots remain. A plain array
+   * (store-engine vocabulary; immer drafts reject Sets) — membership lookups
+   * build their own transient Set.
+   */
+  archivedSessionIds: readonly SessionId[]
   state: 'idle' | 'loading' | 'error'
   phase: WorkspaceListPhase
   error: RpcError | null
@@ -58,7 +66,7 @@ export class WorkspacesService implements IWorkspaces {
   constructor(ctx: Context, private readonly api: IApiClient, private readonly sessions: SessionsPort) {
     this.manager = new WorkspaceManager(api)
     this.list = createSnapshotStore<WorkspaceListState>({
-      items: [], state: 'idle', phase: 'pending', error: null,
+      items: [], archivedSessionIds: [], state: 'idle', phase: 'pending', error: null,
       baselinesReady: false, recentWorkspaceId: undefined,
     })
     this.manager.subscribe(() => { this.project() })
@@ -86,12 +94,20 @@ export class WorkspacesService implements IWorkspaces {
     // would miss the reuse scan and mint another hidden blank session.
     const inflight = this.connecting.get(workspaceId)
     if (inflight !== undefined) return inflight
-    // Reuse: blank && same canonical cwd (workspace.path is the host realpath
-    // canon; summary cwd is the session header passthrough of the same canon).
+    // Reuse requires workspace membership (id in sessionIds AND same
+    // canonical cwd — the host's own membership rule), never cwd alone:
+    // a cwd match can belong to no account (sessions the CLI/TUI birthed at
+    // the host cwd, or a deleted/recreated registration) and reusing it
+    // would open a session no grouping surface shows under this workspace.
+    // An archived blank is never reused either: reuse would open a session
+    // no grouping surface can show, so New Session mints a fresh one instead.
+    const archived = this.list.getSnapshot().archivedSessionIds
     const sessions = this.sessions.list.getSnapshot()
     for (const id of sessions.ids) {
       const summary = sessions.byId[id]
-      if (summary !== undefined && summary.blank && summary.cwd === workspace.path) return summary.id
+      if (summary !== undefined && summary.blank && summary.cwd === workspace.path
+        && workspace.sessionIds.includes(summary.id)
+        && !archived.includes(summary.id)) return summary.id
     }
     const attempt = this.sessions.create({ workspaceId })
       .finally(() => { this.connecting.delete(workspaceId) })
@@ -249,6 +265,17 @@ export class WorkspacesService implements IWorkspaces {
     if (!result.ok) throw new Error(`workspace delete failed: ${result.error.code}: ${result.error.message}`)
   }
 
+  /**
+   * Archive a session into the registry-global set. Clearing an archived
+   * current selection is the projection sweep's job (one rule for the local
+   * echo and a remote tab's frame alike).
+   * @param sessionId - session to archive.
+   */
+  async archiveSession(sessionId: SessionId): Promise<void> {
+    const result = await this.manager.archiveSession(sessionId)
+    if (!result.ok) throw new Error(`session archive failed: ${result.error.code}: ${result.error.message}`)
+  }
+
   /**
    * Move a session within its Workspace's manual order (DOM-insertBefore-like).
    * @param workspaceId - owning workspace.
@@ -291,8 +318,17 @@ export class WorkspacesService implements IWorkspaces {
     const workspace = this.manager.getSnapshot()
     const sessions = this.sessions.list.getSnapshot()
     const baselinesReady = workspace.phase === 'ready' && sessions.phase === 'ready'
+    // An archived current selection clears into the New Session view state —
+    // a hidden row must not stay open behind the list. Sweeping here covers
+    // every install path with one rule: the local unary echo, another tab's
+    // changed frame, and a reconnect baseline restoring a persisted
+    // selection that was archived while this client was away.
+    if (sessions.current !== undefined && workspace.archivedSessionIds.includes(sessions.current)) {
+      this.sessions.clear()
+    }
     this.list.set({
       items: workspace.items,
+      archivedSessionIds: workspace.archivedSessionIds,
       state: workspace.state,
       phase: workspace.phase,
       error: workspace.error,

packages/client/runtime/src/invariant.ts

@@ -4,7 +4,7 @@
  */
 
 /* jscpd:ignore-start */
-/* eslint-disable @typescript-eslint/no-redundant-type-constituents --
+/* oxlint-disable typescript/no-redundant-type-constituents --
  * `keyof SlotMap & string` is the declare-merge key pattern: SlotMap is empty
  * in this compilation unit (intersection reads `never`) but consumers merge
  * keys in; the rule fires on the empty-map view, not on real redundancy. */