From 340e7e4561369d1e1c9a235f45c4a73da4ec5071 Mon Sep 17 00:00:00 2001
From: Haoxiang Cheng <2739441541@qq.com>
Date: Fri, 9 Oct 2026 21:44:02 +0800
Subject: [PATCH 1/4] feat(admin): link trace equity charts to decisions

---
 dashboard/backend/api/routers/admin_traces.py | 40 ++++++++++
 .../tests/test_admin_analytics_frontend.py    |  2 +-
 .../backend/tests/test_admin_page_modules.py  |  3 +-
 .../backend/tests/test_admin_page_shell.py    |  5 +-
 .../tests/test_admin_trace_performance.py     | 53 ++++++++++++
 .../tests/test_admin_traces_frontend.py       | 16 ++++
 .../backend/tests/test_app_composition.py     |  1 +
 dashboard/frontend/admin.css                  |  2 +
 dashboard/frontend/admin.html                 |  5 +-
 .../frontend/js/admin-trace-performance.js    | 80 +++++++++++++++++++
 dashboard/frontend/js/admin-traces.js         | 40 +++++++---
 .../2026-10-09-admin-trace-performance.md     |  7 ++
 12 files changed, 238 insertions(+), 16 deletions(-)
 create mode 100644 dashboard/backend/tests/test_admin_trace_performance.py
 create mode 100644 dashboard/frontend/js/admin-trace-performance.js
 create mode 100644 docs/superpowers/plans/2026-10-09-admin-trace-performance.md

diff --git a/dashboard/backend/api/routers/admin_traces.py b/dashboard/backend/api/routers/admin_traces.py
index 1a770aa3..7b8e9c5e 100644
--- a/dashboard/backend/api/routers/admin_traces.py
+++ b/dashboard/backend/api/routers/admin_traces.py
@@ -77,3 +77,43 @@ def list_trace_events(
     return trace_store.list_events(
         trace_id, after_sequence=after_sequence, limit=limit
     )
+
+
+@router.get("/{trace_id}/performance")
+def get_trace_performance(trace_id: str):
+    """Resolve equity by the exact run ID, never by agent or nearest date."""
+    import math
+    from dashboard.backend.database import db
+
+    trace = trace_store.get_trace(trace_id)
+    if trace is None:
+        raise HTTPException(status_code=404, detail="Trace not found")
+    run_id = trace.get("run_id")
+    run = db.get_run(run_id) if run_id else None
+    points = []
+    if run:
+        for row in db.get_equity_curve(run_id):
+            equity = row.get("equity")
+            if isinstance(equity, (int, float)) and not isinstance(equity, bool) and math.isfinite(equity):
+                points.append({"timestamp": row["timestamp"], "equity": equity})
+    # Metrics use the full series; drawing uses a bounded sample including endpoints.
+    peak = None
+    drawdown = 0.0
+    for point in points:
+        peak = point["equity"] if peak is None else max(peak, point["equity"])
+        if peak > 0:
+            drawdown = max(drawdown, (peak - point["equity"]) / peak)
+    count = len(points)
+    initial = (run or {}).get("initial_equity")
+    baseline = initial if isinstance(initial, (int, float)) and math.isfinite(initial) and initial >= 0 else (points[0]["equity"] if points else 0)
+    metrics = {
+        "return_pct": ((points[-1]["equity"] / baseline - 1) * 100) if points and baseline > 0 else None,
+        "max_drawdown_pct": drawdown * 100 if points else None,
+    }
+    if count > 1000:
+        points = [points[round(i * (count - 1) / 999)] for i in range(1000)]
+    return {
+        "run_id": run_id, "source": "run_equity" if points else "unavailable",
+        "points": points, "point_count": count, "sampled": count > 1000,
+        "metrics": metrics, "partial": trace.get("status") != "completed",
+    }
diff --git a/dashboard/backend/tests/test_admin_analytics_frontend.py b/dashboard/backend/tests/test_admin_analytics_frontend.py
index de1d4a7d..81c97933 100644
--- a/dashboard/backend/tests/test_admin_analytics_frontend.py
+++ b/dashboard/backend/tests/test_admin_analytics_frontend.py
@@ -165,7 +165,7 @@ def test_app_lifecycle_and_cache_versions_are_wired():
     assert 'app.js?v=158' in APP_HTML
     assert 'js/admin-tabs.js?v=12' in APP_HTML
     for tag in (
-        'href="admin.css?v=11"',
+        'href="admin.css?v=12"',
         'src="js/admin-shell.js?v=8"',
         'src="js/credit-format.js?v=1"',
         'src="js/admin-live.js?v=1"',
diff --git a/dashboard/backend/tests/test_admin_page_modules.py b/dashboard/backend/tests/test_admin_page_modules.py
index e715b6c2..e8a60aaf 100644
--- a/dashboard/backend/tests/test_admin_page_modules.py
+++ b/dashboard/backend/tests/test_admin_page_modules.py
@@ -24,7 +24,7 @@
 # exact, not a subset, so adding a verb is a test failure rather than a silent
 # pass. Deleting the verb list and dropping api_key from the prohibited names
 # would have left two tests that run, pass, and protect nothing.
-READ_MODULES = ("admin-shell.js", "admin-live.js", "admin-overview.js", "admin-users.js", "admin-traces.js")
+READ_MODULES = ("admin-shell.js", "admin-live.js", "admin-overview.js", "admin-users.js", "admin-traces.js", "admin-trace-performance.js")
 WRITE_MODULES = {
     "admin-providers.js": {"PUT", "POST", "DELETE"},
     # The absorbed credits console mutates groups, roles, grants and the pool.
@@ -48,6 +48,7 @@
     "admin-providers.js": "AdminProviders",
     "admin-credits.js": "AdminCredits",
     "admin-traces.js": "AdminTraces",
+    "admin-trace-performance.js": "AdminTracePerformance",
 }
 
 CREDENTIAL = re.compile(r"\w*(?:api_key|secret|credential|token|password)\w*", re.I)
diff --git a/dashboard/backend/tests/test_admin_page_shell.py b/dashboard/backend/tests/test_admin_page_shell.py
index bd144084..d82cb959 100644
--- a/dashboard/backend/tests/test_admin_page_shell.py
+++ b/dashboard/backend/tests/test_admin_page_shell.py
@@ -27,7 +27,8 @@
     "js/admin-providers.js?v=1",
     # The absorbed credits console (design N2/PR2).
     "js/admin-credits.js?v=4",
-    "js/admin-traces.js?v=1",
+    "js/admin-trace-performance.js?v=1",
+    "js/admin-traces.js?v=2",
 ]
 
 # This guard's whole job is "no inline script anywhere in this page", so a
@@ -92,7 +93,7 @@ def test_gate_module_loads_first_and_every_script_is_pinned():
 
 
 def test_stylesheet_is_admin_css_and_the_page_does_not_inherit_styles_css():
-    assert '<link rel="stylesheet" href="admin.css?v=11">' in ADMIN_HTML
+    assert '<link rel="stylesheet" href="admin.css?v=12">' in ADMIN_HTML
     assert "styles.css" not in ADMIN_HTML
     assert "@import" not in ADMIN_CSS
     assert "cdn.jsdelivr.net" not in ADMIN_HTML
diff --git a/dashboard/backend/tests/test_admin_trace_performance.py b/dashboard/backend/tests/test_admin_trace_performance.py
new file mode 100644
index 00000000..afd4ae4f
--- /dev/null
+++ b/dashboard/backend/tests/test_admin_trace_performance.py
@@ -0,0 +1,53 @@
+import pytest
+from fastapi import HTTPException
+from dashboard.backend.api.routers import admin_traces as api
+from dashboard.backend.database import db
+
+
+def test_exact_run_and_bounded_points(monkeypatch):
+    monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: {'run_id': 'exact', 'status': 'failed'})
+    calls = []
+    def run(run_id):
+        calls.append(run_id)
+        return {'initial_equity': 100}
+    monkeypatch.setattr(db, 'get_run', run)
+    monkeypatch.setattr(db, 'get_equity_curve', lambda _: [{'timestamp': str(i), 'equity': 100 + i} for i in range(2001)])
+    result = api.get_trace_performance('trace')
+    assert calls == ['exact']
+    assert len(result['points']) == 1000
+    assert result['points'][0]['equity'] == 100
+    assert result['points'][-1]['equity'] == 2100
+    assert result['partial'] and result['sampled']
+    assert result['metrics']['return_pct'] == 2000
+
+
+def test_missing_result_is_not_a_flat_curve(monkeypatch):
+    monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: {'run_id': 'gone', 'status': 'completed'})
+    monkeypatch.setattr(db, 'get_run', lambda _: None)
+    result = api.get_trace_performance('trace')
+    assert result['source'] == 'unavailable'
+    assert result['points'] == []
+    assert result['metrics']['return_pct'] is None
+
+
+def test_missing_trace_is_404(monkeypatch):
+    monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: None)
+    with pytest.raises(HTTPException) as exc:
+        api.get_trace_performance('missing')
+    assert exc.value.status_code == 404
+
+
+def test_invalid_equity_is_excluded_and_drawdown_uses_full_series(monkeypatch):
+    monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: {'run_id': 'r', 'status': 'completed'})
+    # A real metadata row is nonempty.
+    monkeypatch.setattr(db, 'get_run', lambda _: {'run_id': 'r'})
+    monkeypatch.setattr(db, 'get_equity_curve', lambda _: [{'timestamp': str(i), 'equity': v} for i, v in enumerate([100, None, float('nan'), 80, 110])])
+    result = api.get_trace_performance('t')
+    assert len(result['points']) == 3
+    assert result['metrics']['max_drawdown_pct'] == 20
+
+
+def test_performance_route_keeps_admin_dependency():
+    from dashboard.backend.api.auth import require_admin
+    route = next(r for r in api.router.routes if r.path.endswith('/performance'))
+    assert require_admin in [dependency.call for dependency in route.dependant.dependencies]
diff --git a/dashboard/backend/tests/test_admin_traces_frontend.py b/dashboard/backend/tests/test_admin_traces_frontend.py
index 1a16c8d6..c71f7f71 100644
--- a/dashboard/backend/tests/test_admin_traces_frontend.py
+++ b/dashboard/backend/tests/test_admin_traces_frontend.py
@@ -11,6 +11,7 @@
 def _eval(expression: str) -> object:
     return run_node(
         SHELL,
+        source("admin-trace-performance.js"),
         TRACES,
         f"Promise.resolve({expression}).then((result) => console.log(JSON.stringify(result)));",
     )
@@ -50,3 +51,18 @@ def test_timeline_keeps_order_and_serializes_payload_as_text():
 def test_empty_trace_states_are_explicit():
     assert _eval("window.AdminTraces.renderTraceRows({items: []}).children[0].textContent") == "No traces yet."
     assert _eval("window.AdminTraces.renderEventTimeline([]).children[0].textContent") == "No events recorded yet."
+
+
+def test_performance_filters_invalid_snapshots_and_uses_market_time():
+    result = _eval("window.AdminTracePerformance.series([{event_type:'decision_recorded', occurred_at:'2026-10-09', payload:{decision_at:'2026-05-04T10:00:00Z',state:{equity:100}}}, {event_type:'decision_recorded',payload:{decision_at:'bad',state:{equity:99}}}], null)")
+    assert result['snapshots'] is True
+    assert len(result['points']) == 1
+    assert result['points'][0]['timestamp'] == '2026-05-04T10:00:00Z'
+
+
+def test_failed_performance_renders_partial_and_links_by_decision_id():
+    result = _eval("(() => { const n = window.AdminTracePerformance.render({status:'failed'}, [{sequence_no:1,event_type:'decision_recorded',decision_id:'d',payload:{decision_at:'2026-05-04T10:00:00Z',state:{equity:100}}},{sequence_no:2,event_type:'decision_recorded',payload:{decision_at:'2026-05-04T11:00:00Z',state:{equity:90}}},{sequence_no:3,event_type:'execution_result',decision_id:'d',payload:{fills:[{side:'BUY',symbol:'AAPL'}]}}],null); return {text:n.textContent, circles:byTag(n,'circle').length, buttons:byTag(n,'button').map(b=>b.textContent)}; })()")
+    assert 'Run failed' in result['text']
+    assert 'Snapshot change: -10.00%' in result['text']
+    assert result['circles'] == 1
+    assert result['buttons'][1] == 'Execution'
diff --git a/dashboard/backend/tests/test_app_composition.py b/dashboard/backend/tests/test_app_composition.py
index 4a75e345..8f64885f 100644
--- a/dashboard/backend/tests/test_app_composition.py
+++ b/dashboard/backend/tests/test_app_composition.py
@@ -155,6 +155,7 @@
     ("GET", "/api/admin/traces"),
     ("GET", "/api/admin/traces/{trace_id}"),
     ("GET", "/api/admin/traces/{trace_id}/events"),
+    ("GET", "/api/admin/traces/{trace_id}/performance"),
     ("POST", "/api/admin/bootstrap"),
     ("POST", "/api/algo/chat"),
     ("GET", "/api/algo/defaults"),
diff --git a/dashboard/frontend/admin.css b/dashboard/frontend/admin.css
index 32ca8e9e..5faf3f3a 100644
--- a/dashboard/frontend/admin.css
+++ b/dashboard/frontend/admin.css
@@ -497,3 +497,5 @@ dialog::backdrop{background:rgba(0,0,0,.64)}
 .credits-chart-swatch.credits-chart-platform{background:var(--accent)}
 .credits-chart-swatch.credits-chart-byok{background:var(--violet)}
 .credits-chart-swatch.credits-chart-purchased{background:var(--green)}
+
+.trace-performance{margin:24px 0;padding:20px;border:1px solid #334155;border-radius:8px}.trace-performance svg{width:100%;display:block;max-height:360px}.trace-performance-notice{color:#fbbf24}.trace-performance-links{display:flex;flex-wrap:wrap;gap:8px;max-height:180px;overflow:auto}.trace-event:focus{outline:2px solid #38bdf8}
diff --git a/dashboard/frontend/admin.html b/dashboard/frontend/admin.html
index 66fa89b6..d84f2315 100644
--- a/dashboard/frontend/admin.html
+++ b/dashboard/frontend/admin.html
@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>ATL Admin</title>
   <link rel="icon" href="favicon.svg">
-  <link rel="stylesheet" href="admin.css?v=11">
+  <link rel="stylesheet" href="admin.css?v=12">
   <!-- The absorbed sections (N2/PR2) and the app chrome: component styles
        extracted from the app-wide stylesheet, which this page still must not
        inherit wholesale (its 15k lines would restyle the shell). -->
@@ -22,7 +22,8 @@
   <script src="js/admin-users.js?v=1" defer></script>
   <script src="js/admin-providers.js?v=1" defer></script>
   <script src="js/admin-credits.js?v=4" defer></script>
-  <script src="js/admin-traces.js?v=1" defer></script>
+  <script src="js/admin-trace-performance.js?v=1" defer></script>
+  <script src="js/admin-traces.js?v=2" defer></script>
 </head>
 <body>
   <!-- Icon sprite (design §6). Markup, not script, so the no-inline-script
diff --git a/dashboard/frontend/js/admin-trace-performance.js b/dashboard/frontend/js/admin-trace-performance.js
new file mode 100644
index 00000000..ed9ae87b
--- /dev/null
+++ b/dashboard/frontend/js/admin-trace-performance.js
@@ -0,0 +1,80 @@
+/** Read-only equity context for one trace; market time is not event wall time. */
+(function () {
+  'use strict';
+  const svgNS = 'http://www.w3.org/2000/svg';
+  function series(events, performance) {
+    const snapshots = (events || []).filter(e => e.event_type === 'decision_recorded')
+      .map(e => ({ timestamp: e.payload?.decision_at, equity: e.payload?.state?.equity, event: e }));
+    const raw = performance?.points?.length ? performance.points : snapshots;
+    const points = raw.filter(p => typeof p.equity === 'number' && Number.isFinite(p.equity) && Number.isFinite(Date.parse(p.timestamp)))
+      .map(p => ({ ...p, time: Date.parse(p.timestamp) })).sort((a, b) => a.time - b.time);
+    return { points, snapshots: raw === snapshots };
+  }
+  function render(trace, events, performance) {
+    const el = window.AdminShell.el;
+    const panel = el('section', 'trace-performance');
+    panel.appendChild(el('h2', '', 'Trading performance'));
+    const { points, snapshots } = series(events, performance);
+    panel.appendChild(el('p', 'muted', snapshots
+      ? 'Decision equity snapshots · market time (UTC). Sampled observations, not the complete backtest result.'
+      : 'Run equity · market time (UTC). One observed outcome, not expected return.'));
+    if (trace.status !== 'completed') panel.appendChild(el('p', 'trace-performance-notice',
+      trace.status === 'failed' ? 'Run failed. Recorded performance is incomplete; inspect the failure in the timeline.' : 'Run in progress. Recorded performance is incomplete.'));
+    if (performance?.unavailable) panel.appendChild(el('p', 'muted', 'Performance refresh unavailable. Showing recorded snapshots or previously loaded data.'));
+    if (points.length < 2) {
+      panel.appendChild(el('p', 'panel-empty', points.length ? 'Only one equity observation is available; a curve requires two.' : 'No equity observations recorded for this run.'));
+      return panel;
+    }
+    let peak = points[0].equity, dd = 0;
+    points.forEach(p => { peak = Math.max(peak, p.equity); if (peak > 0) dd = Math.max(dd, (peak - p.equity) / peak * 100); });
+    const ret = snapshots ? (points[0].equity > 0 ? (points.at(-1).equity / points[0].equity - 1) * 100 : null) : performance.metrics?.return_pct;
+    const drawdown = snapshots ? dd : performance.metrics?.max_drawdown_pct;
+    const pct = v => typeof v === 'number' && Number.isFinite(v) ? `${v.toFixed(2)}%` : '—';
+    panel.appendChild(el('p', '', `${snapshots ? 'Snapshot change' : 'Return'}: ${pct(ret)} · ${snapshots ? 'Observed' : 'Maximum'} drawdown: ${pct(drawdown)}`));
+    const chart = document.createElementNS(svgNS, 'svg');
+    chart.setAttribute('viewBox', '0 0 900 260'); chart.setAttribute('role', 'img');
+    chart.setAttribute('aria-label', 'Equity over historical market time');
+    const min = points.reduce((v, p) => Math.min(v, p.equity), Infinity), max = points.reduce((v, p) => Math.max(v, p.equity), -Infinity);
+    const span = max - min || Math.max(Math.abs(max) * .01, 1);
+    const x = t => 75 + (t - points[0].time) / (points.at(-1).time - points[0].time || 1) * 800;
+    const y = v => 210 - (v - min) / span * 180;
+    function shape(tag, attrs, text) {
+      const n = document.createElementNS(svgNS, tag);
+      Object.entries(attrs).forEach(([k, v]) => n.setAttribute(k, String(v)));
+      if (text !== undefined) n.textContent = text;
+      chart.appendChild(n); return n;
+    }
+    [min, min + span / 2, min + span].forEach(v => {
+      shape('line', { x1: 75, x2: 875, y1: y(v), y2: y(v), stroke: 'currentColor', opacity: '.15' });
+      shape('text', { x: 68, y: y(v) + 4, 'text-anchor': 'end', fill: 'currentColor', 'font-size': 12 }, v.toFixed(2));
+    });
+    const plotted = points.length > 1000 ? Array.from({length: 1000}, (_, i) => points[Math.round(i * (points.length - 1) / 999)]) : points;
+    shape('polyline', { points: plotted.map(p => `${x(p.time)},${y(p.equity)}`).join(' '), fill: 'none', stroke: '#38bdf8', 'stroke-width': 2 });
+    [points[0], points.at(-1)].forEach((p, i) => shape('text', { x: i ? 875 : 75, y: 245, 'text-anchor': i ? 'end' : 'start', fill: 'currentColor', 'font-size': 12 }, new Date(p.time).toISOString().slice(0, 16).replace('T', ' ')));
+    const decisions = new Map((events || []).filter(e => e.decision_id && e.event_type === 'decision_recorded').map(e => [e.decision_id, e]));
+    const links = el('div', 'trace-performance-links');
+    (events || []).filter(e => e.event_type === 'execution_result' && e.payload?.fills?.length).forEach(e => {
+      const decision = decisions.get(e.decision_id);
+      if (!decision) return;
+      const time = Date.parse(decision.payload?.decision_at);
+      const equity = decision.payload?.state?.equity;
+      const label = e.payload.fills.map(f => `${f.side} ${f.symbol}`).join(', ');
+      const jump = target => { const n = document.getElementById(`trace-event-${target.sequence_no}`); n?.scrollIntoView?.({block: 'center', behavior: 'smooth'}); n?.focus?.({preventScroll: true}); };
+      if (Number.isFinite(time) && typeof equity === 'number' && Number.isFinite(equity) && time >= points[0].time && time <= points.at(-1).time) {
+        // A marker indicates the decision snapshot, not equity at fill time.
+        const marker = shape('circle', { cx: x(time), cy: Math.max(30, Math.min(210, y(equity))), r: 5, fill: '#fbbf24', tabindex: 0, role: 'button', 'aria-label': `Decision: ${label}` });
+        marker.addEventListener('click', () => jump(decision));
+        marker.addEventListener('keydown', event => { if (event.key === 'Enter' || event.key === ' ') { event.preventDefault(); jump(decision); } });
+      }
+      const button = el('button', 'auth-btn auth-btn-secondary', `${label} · ${decision.payload?.decision_at || 'Unknown market time'}`);
+      button.setAttribute('type', 'button'); button.addEventListener('click', () => jump(decision)); links.appendChild(button);
+      const execution = el('button', 'auth-btn auth-btn-secondary', 'Execution');
+      execution.setAttribute('type', 'button'); execution.addEventListener('click', () => jump(e)); links.appendChild(execution);
+    });
+    panel.appendChild(chart);
+    panel.appendChild(el('p', 'muted', 'Trade markers identify decision snapshots. Select a trade to inspect its reasoning or execution.'));
+    panel.appendChild(links);
+    return panel;
+  }
+  window.AdminTracePerformance = { series, render };
+})();
diff --git a/dashboard/frontend/js/admin-traces.js b/dashboard/frontend/js/admin-traces.js
index cfbd88c7..4d5cff33 100644
--- a/dashboard/frontend/js/admin-traces.js
+++ b/dashboard/frontend/js/admin-traces.js
@@ -89,6 +89,8 @@
     }
     items.forEach((event) => {
       const item = node('li', 'trace-event');
+      item.setAttribute('id', `trace-event-${event.sequence_no}`);
+      item.setAttribute('tabindex', '-1');
       const heading = node('div', 'trace-event-head');
       heading.appendChild(node('span', 'trace-sequence', `#${value(event.sequence_no)}`));
       heading.appendChild(node('strong', '', shell().humanize(event.event_type)));
@@ -133,7 +135,7 @@
     return section;
   }
 
-  function renderTraceDetail(trace, events, context = {}) {
+  function renderTraceDetail(trace, events, context = {}, performance = null) {
     const section = node('section', 'trace-detail-panel');
     const breadcrumb = node('nav', 'breadcrumb');
     breadcrumb.setAttribute('aria-label', 'Breadcrumb');
@@ -159,6 +161,7 @@
       metrics.appendChild(metric);
     });
     section.appendChild(metrics);
+    if (window.AdminTracePerformance) section.appendChild(window.AdminTracePerformance.render(trace, events, performance));
     const title = node('h2', 'trace-section-title', 'Timeline');
     section.appendChild(title);
     section.appendChild(renderEventTimeline(events));
@@ -234,19 +237,21 @@
     try {
       let trace = await shell().request(`/api/admin/traces/${encodeURIComponent(traceId)}`);
       const events = await loadAllEvents(traceId);
+      const performance = await loadPerformance(traceId);
       const terminal = [...events].reverse().find((event) => ['run_completed', 'run_failed'].includes(event.event_type));
       if (terminal) trace = await refreshTraceEnvelope(traceId);
       if (!shell().isCurrent(SURFACE, seq)) return;
       state.traceId = traceId;
       state.context = { ...context };
       state.trace = trace;
+      state.performance = performance;
       state.events = events;
       state.nextSequence = state.events.length ? state.events[state.events.length - 1].sequence_no : 0;
       state.stale = false;
       const host = element('tracesView');
       if (!host) return;
       shell().clear(host);
-      host.appendChild(renderTraceDetail(trace, state.events, context));
+      host.appendChild(renderTraceDetail(trace, state.events, context, state.performance));
       if (trace.status === 'running') startPolling();
     } catch (error) {
       if (await shell().handleAccessLost(error)) return;
@@ -262,27 +267,37 @@
     }
   }
 
+  async function loadPerformance(traceId, previous = null) {
+    try { return await shell().request(`/api/admin/traces/${encodeURIComponent(traceId)}/performance`); }
+    catch (_error) { return { ...(previous || {}), unavailable: true }; }
+  }
+
   async function pollEvents() {
     if (!state.traceId || !state.trace || state.trace.status !== 'running') return;
+    const traceId = state.traceId;
+    const seq = shell().nextSeq(SURFACE);
     try {
-      const fresh = await loadAllEvents(state.traceId, state.nextSequence);
-      if (fresh.length) {
+      const fresh = await loadAllEvents(traceId, state.nextSequence);
+      const performance = await loadPerformance(traceId, state.performance);
+      const envelope = await refreshTraceEnvelope(traceId);
+      if (!shell().isCurrent(SURFACE, seq) || state.traceId !== traceId) return;
+      state.trace = envelope;
+      state.performance = performance;
+      {
         state.events = state.events.concat(fresh.filter((event) => event.sequence_no > state.nextSequence));
         state.nextSequence = state.events.length ? state.events[state.events.length - 1].sequence_no : state.nextSequence;
-        const terminal = [...state.events].reverse().find((event) => ['run_completed', 'run_failed'].includes(event.event_type));
-        if (terminal) {
-          state.trace = await refreshTraceEnvelope(state.traceId);
-        }
+
         const host = element('tracesView');
         if (host && state.trace) {
           shell().clear(host);
-          host.appendChild(renderTraceDetail(state.trace, state.events, state.context));
+          host.appendChild(renderTraceDetail(state.trace, state.events, state.context, state.performance));
         }
       }
       state.stale = false;
       if (state.trace.status === 'running') state.pollTimer = setTimeout(pollEvents, 3000);
     } catch (error) {
       if (await shell().handleAccessLost(error)) return;
+      if (!shell().isCurrent(SURFACE, seq) || state.traceId !== traceId) return;
       state.stale = true;
       const host = element('tracesView');
       if (host) renderStaleNotice(host, 'Showing recorded events; refresh failed.');
@@ -296,7 +311,12 @@
   }
 
   function onRoute(event) {
-    if (event.detail.route !== SURFACE) return;
+    if (event.detail.route !== SURFACE) {
+      stopPolling();
+      shell().nextSeq(SURFACE);
+      state.traceId = null;
+      return;
+    }
     if (event.detail.id) loadDetail(event.detail.id, event.detail.query || {});
     else loadList();
   }
diff --git a/docs/superpowers/plans/2026-10-09-admin-trace-performance.md b/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
new file mode 100644
index 00000000..ddcad1a0
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
@@ -0,0 +1,7 @@
+# Admin trace performance
+
+Approved scope: a lightweight equity chart with decision/execution navigation, live refresh, and explicit missing/partial states.
+
+1. Data: admin-only trace performance endpoint resolves only the exact trace.run_id. Return bounded chart points from existing equity storage; missing results allow the UI to use recorded decision snapshots. Never infer a run by agent name or date.
+2. UI: SVG chart above timeline, market-time axis, sample return/drawdown, execution links joined by decision_id. Distinguish snapshot performance from final backtest metrics; do not invent equity at execution times.
+3. Validation: test access control, missing run, invalid values, sampling, decision linkage, failure/empty states. Refresh performance while running with stale-response protection. Keep previous data on refresh failure. Fetch main and inspect PR state before publishing.

From 14907cff94365d155fb0c219f394a2751fd3f95e Mon Sep 17 00:00:00 2001
From: Haoxiang Cheng <2739441541@qq.com>
Date: Sat, 10 Oct 2026 00:29:53 +0800
Subject: [PATCH 2/4] feat(admin): group trace timeline and export exact-run
 reports

---
 dashboard/backend/api/routers/admin_traces.py | 41 +++++++++
 dashboard/backend/domain/traces/export.py     | 81 ++++++++++++++++++
 dashboard/backend/domain/traces/repository.py |  6 ++
 .../domain/traces/repository_postgres.py      |  7 ++
 .../tests/test_admin_analytics_frontend.py    |  2 +-
 .../backend/tests/test_admin_page_modules.py  |  7 +-
 .../backend/tests/test_admin_page_shell.py    |  7 +-
 .../backend/tests/test_admin_trace_export.py  | 85 +++++++++++++++++++
 .../tests/test_admin_traces_frontend.py       | 15 +++-
 .../backend/tests/test_app_composition.py     |  2 +
 dashboard/frontend/admin.css                  |  2 +
 dashboard/frontend/admin.html                 |  7 +-
 .../frontend/js/admin-trace-performance.js    |  2 +-
 dashboard/frontend/js/admin-trace-timeline.js | 78 +++++++++++++++++
 dashboard/frontend/js/admin-traces.js         | 67 +++++++++------
 .../2026-10-09-admin-trace-performance.md     |  8 ++
 16 files changed, 381 insertions(+), 36 deletions(-)
 create mode 100644 dashboard/backend/domain/traces/export.py
 create mode 100644 dashboard/backend/tests/test_admin_trace_export.py
 create mode 100644 dashboard/frontend/js/admin-trace-timeline.js

diff --git a/dashboard/backend/api/routers/admin_traces.py b/dashboard/backend/api/routers/admin_traces.py
index 7b8e9c5e..e428f6e8 100644
--- a/dashboard/backend/api/routers/admin_traces.py
+++ b/dashboard/backend/api/routers/admin_traces.py
@@ -117,3 +117,44 @@ def get_trace_performance(trace_id: str):
         "points": points, "point_count": count, "sampled": count > 1000,
         "metrics": metrics, "partial": trace.get("status") != "completed",
     }
+
+
+@router.get("/{trace_id}/export")
+def export_trace(trace_id: str, format: str = Query(default="json", pattern="^(json|markdown)$")):
+    from fastapi.responses import StreamingResponse
+    from starlette.background import BackgroundTask
+    from dashboard.backend.domain.traces.export import build_export
+
+    trace = trace_store.get_trace(trace_id)
+    if trace is None:
+        raise HTTPException(status_code=404, detail="Trace not found")
+    file = build_export(trace_store, _public_trace(trace), format)
+    def chunks():
+        try:
+            while chunk := file.read(65536):
+                yield chunk
+        finally:
+            file.close()
+    extension = 'json' if format == 'json' else 'md'
+    return StreamingResponse(chunks(), media_type='application/json' if format == 'json' else 'text/markdown',
+                             headers={'Content-Disposition': f'attachment; filename="agent-trace.{extension}"', 'Cache-Control': 'no-store'},
+                             background=BackgroundTask(file.close))
+
+
+@router.get("/{trace_id}/backtest")
+def get_trace_backtest(trace_id: str):
+    """Administrator view across owners, resolved only by the trace's run ID."""
+    from dashboard.backend.database import db
+    from dashboard.backend.domain.traces.export import redact
+    trace = trace_store.get_trace(trace_id)
+    if trace is None:
+        raise HTTPException(status_code=404, detail="Trace not found")
+    run = db.get_run(trace.get('run_id')) if trace.get('run_id') else None
+    if run is None:
+        return {'available': False, 'run_id': trace.get('run_id')}
+    fields = ('run_id', 'agent_name', 'model_name', 'mode', 'start_date', 'end_date',
+              'initial_equity', 'final_equity', 'total_return', 'max_drawdown', 'sharpe_ratio',
+              'num_trades', 'llm_calls', 'llm_decisions', 'input_tokens', 'output_tokens', 'est_cost_usd')
+    return {'available': True, 'run_id': trace['run_id'],
+            'run': {key: run.get(key) for key in fields},
+            'configuration': redact(run.get('metadata') or {})}
diff --git a/dashboard/backend/domain/traces/export.py b/dashboard/backend/domain/traces/export.py
new file mode 100644
index 00000000..e36167ca
--- /dev/null
+++ b/dashboard/backend/domain/traces/export.py
@@ -0,0 +1,81 @@
+"""Versioned, redacted trace exports with a fixed event-sequence boundary."""
+import html
+import json
+import re
+from datetime import datetime, timezone
+from tempfile import SpooledTemporaryFile
+
+_PRIVATE = re.compile(r'api[_-]?key|authorization|cookie|password|secret|token|email|session|browser|user_id|actor_id', re.I)
+_EMAIL = re.compile(r'[\w.+-]+@[\w.-]+\.[a-zA-Z]{2,}')
+_BEARER = re.compile(r'(?i)\bBearer\s+[^\s"<>]+')
+_KEY = re.compile(r'\b(?:sk-|sk_)[A-Za-z0-9_-]{12,}')
+
+
+def redact(value):
+    if isinstance(value, dict):
+        return {key: '[REDACTED]' if _PRIVATE.search(str(key)) else redact(child) for key, child in value.items()}
+    if isinstance(value, list):
+        return [redact(child) for child in value]
+    if isinstance(value, str):
+        return _KEY.sub('[REDACTED]', _BEARER.sub('[REDACTED]', _EMAIL.sub('[REDACTED]', value)))
+    return value
+
+
+def build_export(store, trace, format):
+    """Build completely before sending headers; spill larger files to disk."""
+    captured_at = datetime.now(timezone.utc).isoformat()
+    cutoff = store.event_high_watermark(trace['trace_id'])
+    header = {'schema_version': 1, 'captured_at': captured_at,
+              'through_sequence': cutoff, 'incomplete_run': trace.get('status') != 'completed',
+              'artifact_policy': 'References and metadata only; attachments are not bundled.',
+              'trace': redact(trace)}
+    file = SpooledTemporaryFile(max_size=1024 * 1024, mode='w+b')
+    def write(text):
+        file.write(text.encode('utf-8'))
+    def dump(value):
+        return json.dumps(value, ensure_ascii=False, indent=2)
+    def block(value):
+        # An HTML-safe code block even when a message contains backticks.
+        return '\n<pre>\n' + html.escape(dump(value)) + '\n</pre>\n'
+    try:
+        if format == 'json':
+            write(dump(header)[:-2] + ',\n  "events": [\n')
+        else:
+            write('# Agent trace report\n\n')
+            write(f'Captured at: {captured_at}\n\nThrough event sequence: {cutoff}\n\n')
+            write('Run is incomplete.\n\n' if header['incomplete_run'] else 'Run completed.\n\n')
+            write('Artifact references only; attachments are not bundled.\n\n## Run overview\n' + block(header['trace']) + '\n## Timeline\n')
+        cursor = 0
+        first = True
+        while cursor < cutoff:
+            page = store.list_events(trace['trace_id'], after_sequence=cursor, limit=100)
+            rows = [e for e in page['items'] if cursor < e['sequence_no'] <= cutoff]
+            if not rows:
+                raise RuntimeError('Trace changed or event page missing during export')
+            for event in rows:
+                clean = redact(event)
+                if format == 'json':
+                    write(('' if first else ',\n') + dump(clean))
+                else:
+                    write(f'\n### Event {event["sequence_no"]}: {html.escape(str(clean.get("event_type", "event")))}\n\n')
+                    write('Recorded: ' + html.escape(str(clean.get('occurred_at', 'Not recorded'))) + '\n\n')
+                    payload = clean.get('payload') or {}
+                    if isinstance(payload, dict):
+                        reasons = payload.get('reasoning_summaries') or [payload.get('reasoning_summary')]
+                        if isinstance(reasons, list):
+                            for reason in reasons:
+                                if isinstance(reason, str) and reason:
+                                    write('Reason: ' + html.escape(reason) + '\n\n')
+                        for label in ('error_code', 'message', 'fills', 'actions', 'rejected'):
+                            if payload.get(label):
+                                write(html.escape(label.replace('_', ' ').title()) + ': ' + html.escape(dump(payload[label])) + '\n\n')
+                    write('<details><summary>Technical details</summary>\n' + block(clean) + '\n</details>\n')
+                first = False
+            cursor = rows[-1]['sequence_no']
+        if format == 'json':
+            write('\n]}\n')
+        file.seek(0)
+        return file
+    except Exception:
+        file.close()
+        raise
diff --git a/dashboard/backend/domain/traces/repository.py b/dashboard/backend/domain/traces/repository.py
index 778aaad4..297ce3ae 100644
--- a/dashboard/backend/domain/traces/repository.py
+++ b/dashboard/backend/domain/traces/repository.py
@@ -343,6 +343,12 @@ def append_events(self, *, trace_id: str, events: Sequence[Dict[str, Any]]) -> i
             )
         return len(fresh)
 
+    def event_high_watermark(self, trace_id: str) -> int:
+        """Freeze the export boundary before walking append-only event pages."""
+        with self._get_connection() as conn:
+            row = conn.execute("SELECT COALESCE(MAX(sequence_no), 0) AS sequence_no FROM agent_trace_events WHERE trace_id = ?", (trace_id,)).fetchone()
+            return int(row["sequence_no"])
+
     def list_events(
         self, trace_id: str, *, after_sequence: int = 0, limit: int = 100
     ) -> Dict[str, Any]:
diff --git a/dashboard/backend/domain/traces/repository_postgres.py b/dashboard/backend/domain/traces/repository_postgres.py
index 1675a336..2cc566fd 100644
--- a/dashboard/backend/domain/traces/repository_postgres.py
+++ b/dashboard/backend/domain/traces/repository_postgres.py
@@ -321,6 +321,13 @@ def append_events(self, *, trace_id: str, events: Sequence[Dict[str, Any]]) -> i
                 )
         return len(fresh)
 
+    def event_high_watermark(self, trace_id: str) -> int:
+        """Freeze the export boundary before walking append-only event pages."""
+        with self._get_connection() as conn:
+            with conn.cursor() as cur:
+                cur.execute("SELECT COALESCE(MAX(sequence_no), 0) AS sequence_no FROM agent_trace_events WHERE trace_id = %s", (trace_id,))
+                return int(cur.fetchone()["sequence_no"])
+
     def list_events(
         self, trace_id: str, *, after_sequence: int = 0, limit: int = 100
     ) -> Dict[str, Any]:
diff --git a/dashboard/backend/tests/test_admin_analytics_frontend.py b/dashboard/backend/tests/test_admin_analytics_frontend.py
index 81c97933..6e03b521 100644
--- a/dashboard/backend/tests/test_admin_analytics_frontend.py
+++ b/dashboard/backend/tests/test_admin_analytics_frontend.py
@@ -165,7 +165,7 @@ def test_app_lifecycle_and_cache_versions_are_wired():
     assert 'app.js?v=158' in APP_HTML
     assert 'js/admin-tabs.js?v=12' in APP_HTML
     for tag in (
-        'href="admin.css?v=12"',
+        'href="admin.css?v=13"',
         'src="js/admin-shell.js?v=8"',
         'src="js/credit-format.js?v=1"',
         'src="js/admin-live.js?v=1"',
diff --git a/dashboard/backend/tests/test_admin_page_modules.py b/dashboard/backend/tests/test_admin_page_modules.py
index e8a60aaf..ff150b5a 100644
--- a/dashboard/backend/tests/test_admin_page_modules.py
+++ b/dashboard/backend/tests/test_admin_page_modules.py
@@ -24,7 +24,7 @@
 # exact, not a subset, so adding a verb is a test failure rather than a silent
 # pass. Deleting the verb list and dropping api_key from the prohibited names
 # would have left two tests that run, pass, and protect nothing.
-READ_MODULES = ("admin-shell.js", "admin-live.js", "admin-overview.js", "admin-users.js", "admin-traces.js", "admin-trace-performance.js")
+READ_MODULES = ("admin-shell.js", "admin-live.js", "admin-overview.js", "admin-users.js", "admin-traces.js", "admin-trace-performance.js", "admin-trace-timeline.js")
 WRITE_MODULES = {
     "admin-providers.js": {"PUT", "POST", "DELETE"},
     # The absorbed credits console mutates groups, roles, grants and the pool.
@@ -49,6 +49,7 @@
     "admin-credits.js": "AdminCredits",
     "admin-traces.js": "AdminTraces",
     "admin-trace-performance.js": "AdminTracePerformance",
+    "admin-trace-timeline.js": "AdminTraceTimeline",
 }
 
 CREDENTIAL = re.compile(r"\w*(?:api_key|secret|credential|token|password)\w*", re.I)
@@ -196,7 +197,9 @@ def test_exact_endpoints_and_query_names():
         assert query_name in ALL, query_name
     assert "section, limit:" in MODULES["admin-users.js"]
     for rejected in ("'status'", "start_date", "provider_id'", "model_id'", "'cohort'", "analyticsUser", "adminTab=analytics"):
-        assert rejected not in ALL, rejected
+        # These are rejected analytics query names, not backtest config fields.
+        analytics_sources = "\n".join(MODULES[name] for name in ("admin-shell.js", "admin-live.js", "admin-overview.js", "admin-users.js"))
+        assert rejected not in analytics_sources, rejected
 
 
 def test_no_live_route_and_no_chartjs():
diff --git a/dashboard/backend/tests/test_admin_page_shell.py b/dashboard/backend/tests/test_admin_page_shell.py
index d82cb959..5d0bffa4 100644
--- a/dashboard/backend/tests/test_admin_page_shell.py
+++ b/dashboard/backend/tests/test_admin_page_shell.py
@@ -27,8 +27,9 @@
     "js/admin-providers.js?v=1",
     # The absorbed credits console (design N2/PR2).
     "js/admin-credits.js?v=4",
-    "js/admin-trace-performance.js?v=1",
-    "js/admin-traces.js?v=2",
+    "js/admin-trace-timeline.js?v=1",
+    "js/admin-trace-performance.js?v=2",
+    "js/admin-traces.js?v=3",
 ]
 
 # This guard's whole job is "no inline script anywhere in this page", so a
@@ -93,7 +94,7 @@ def test_gate_module_loads_first_and_every_script_is_pinned():
 
 
 def test_stylesheet_is_admin_css_and_the_page_does_not_inherit_styles_css():
-    assert '<link rel="stylesheet" href="admin.css?v=12">' in ADMIN_HTML
+    assert '<link rel="stylesheet" href="admin.css?v=13">' in ADMIN_HTML
     assert "styles.css" not in ADMIN_HTML
     assert "@import" not in ADMIN_CSS
     assert "cdn.jsdelivr.net" not in ADMIN_HTML
diff --git a/dashboard/backend/tests/test_admin_trace_export.py b/dashboard/backend/tests/test_admin_trace_export.py
new file mode 100644
index 00000000..e034e5d9
--- /dev/null
+++ b/dashboard/backend/tests/test_admin_trace_export.py
@@ -0,0 +1,85 @@
+import json
+import pytest
+from fastapi.testclient import TestClient
+from dashboard.backend.app import app
+from dashboard.backend.api.auth import require_admin
+from dashboard.backend.api.routers import admin_traces as api
+from dashboard.backend.domain.traces.repository import TraceStore
+from dashboard.backend.domain.traces.export import build_export, redact
+
+
+def test_export_reads_all_pages_but_excludes_new_events(tmp_path, monkeypatch):
+    store = TraceStore(tmp_path / 'traces.db')
+    trace = store.create_trace(trace_id='t', run_id='r')
+    for i in range(205):
+        store.append_event(trace_id='t', event_type='decision_recorded', actor_type='agent', payload={'reason':'hold'})
+    original = store.event_high_watermark
+    def boundary(trace_id):
+        cutoff = original(trace_id)
+        store.append_event(trace_id='t', event_type='run_completed', actor_type='system', payload={})
+        return cutoff
+    monkeypatch.setattr(store, 'event_high_watermark', boundary)
+    with build_export(store, trace, 'json') as file:
+        result = json.load(file)
+    assert len(result['events']) == 205
+    assert result['through_sequence'] == 205
+    assert result['incomplete_run'] is True
+    assert [e['sequence_no'] for e in result['events']] == list(range(1, 206))
+
+
+def test_redaction_and_markdown_escape(tmp_path):
+    assert redact({'api_key':'abc', 'user_id':2, 'message':'contact a@example.com Bearer abc123'}) == {'api_key':'[REDACTED]', 'user_id':'[REDACTED]', 'message':'contact [REDACTED] [REDACTED]'}
+    store = TraceStore(tmp_path / 'traces.db')
+    trace = store.create_trace(trace_id='t', run_id='r')
+    store.append_event(trace_id='t', event_type='run_failed', actor_type='system', payload={'message':'<script>bad()</script>```'})
+    with build_export(store, trace, 'markdown') as file:
+        text = file.read().decode()
+    assert '<script>' not in text
+    assert '&lt;script&gt;' in text
+    assert 'Run is incomplete' in text
+
+
+@pytest.mark.parametrize('suffix', ['export?format=json', 'export?format=markdown', 'backtest'])
+def test_new_endpoints_reject_non_admin(suffix):
+    response = TestClient(app).get('/api/admin/traces/missing/' + suffix)
+    assert response.status_code in (401, 403)
+
+
+def test_admin_can_view_other_owners_exact_backtest(monkeypatch):
+    from dashboard.backend.database import db
+    monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: {'run_id':'other-owner-run'})
+    def get_run(run_id):
+        assert run_id == 'other-owner-run'
+        return {'run_id':run_id, 'owner_user_id':99, 'session_id':'private', 'initial_equity':1000, 'metadata':{'api_key':'private'}}
+    monkeypatch.setattr(db, 'get_run', get_run)
+    app.dependency_overrides[require_admin] = lambda: {'id':1,'is_admin':True}
+    try:
+        response = TestClient(app).get('/api/admin/traces/t/backtest')
+        assert response.status_code == 200
+        assert response.json()['run']['run_id'] == 'other-owner-run'
+        assert 'private' not in response.text
+    finally:
+        app.dependency_overrides.pop(require_admin, None)
+
+
+@pytest.mark.parametrize('format,extension', [('json', 'json'), ('markdown', 'md')])
+def test_export_http_download_and_validation(tmp_path, monkeypatch, format, extension):
+    store = TraceStore(tmp_path / 'http-traces.db')
+    store.create_trace(trace_id='download', run_id='r')
+    store.append_event(trace_id='download', event_type='run_started', actor_type='system', payload={})
+    monkeypatch.setattr(api, 'trace_store', store)
+    app.dependency_overrides[require_admin] = lambda: {'id': 1, 'is_admin': True}
+    try:
+        client = TestClient(app)
+        response = client.get('/api/admin/traces/download/export', params={'format': format})
+        assert response.status_code == 200
+        assert response.headers['cache-control'] == 'no-store'
+        assert response.headers['content-disposition'] == f'attachment; filename="agent-trace.{extension}"'
+        if format == 'json':
+            assert len(response.json()['events']) == 1
+        else:
+            assert 'Event 1: run_started' in response.text
+        assert client.get('/api/admin/traces/missing/export').status_code == 404
+        assert client.get('/api/admin/traces/download/export?format=invalid').status_code == 422
+    finally:
+        app.dependency_overrides.pop(require_admin, None)
diff --git a/dashboard/backend/tests/test_admin_traces_frontend.py b/dashboard/backend/tests/test_admin_traces_frontend.py
index c71f7f71..10f4fd43 100644
--- a/dashboard/backend/tests/test_admin_traces_frontend.py
+++ b/dashboard/backend/tests/test_admin_traces_frontend.py
@@ -12,6 +12,7 @@ def _eval(expression: str) -> object:
     return run_node(
         SHELL,
         source("admin-trace-performance.js"),
+        source("admin-trace-timeline.js"),
         TRACES,
         f"Promise.resolve({expression}).then((result) => console.log(JSON.stringify(result)));",
     )
@@ -43,9 +44,9 @@ def test_timeline_keeps_order_and_serializes_payload_as_text():
         "  return {events: node.children.map((item) => item.textContent), pre: byTag(node, 'pre').map((item) => item.textContent)};"
         "})()"
     )
-    assert result["events"][0].startswith("#1Run Started")
+    assert "#1 Run Started" in result["events"][0]
     assert "<safe>" in result["pre"][0]
-    assert result["events"][1].startswith("#2Decision Recorded")
+    assert "#2 Decision Recorded" in result["events"][1]
 
 
 def test_empty_trace_states_are_explicit():
@@ -66,3 +67,13 @@ def test_failed_performance_renders_partial_and_links_by_decision_id():
     assert 'Snapshot change: -10.00%' in result['text']
     assert result['circles'] == 1
     assert result['buttons'][1] == 'Execution'
+
+
+def test_groups_only_by_explicit_links_and_keeps_event_order():
+    result = _eval("window.AdminTraceTimeline.groupEvents([{sequence_no:1,event_type:'data_retrieval',step_id:'s'},{sequence_no:2,event_type:'decision_recorded',step_id:'s',decision_id:'d'},{sequence_no:3,event_type:'execution_result',decision_id:'d'},{sequence_no:4,event_type:'run_failed'}]).map(g=>g.events.map(e=>e.sequence_no))")
+    assert result == [[1, 2, 3], [4]]
+
+
+def test_failure_opens_by_default_and_explicit_collapse_is_preserved():
+    result = _eval("(() => {const events=[{sequence_no:1,event_type:'run_failed',payload:{error_code:'timeout'}}];return [window.AdminTraceTimeline.render(events).children[0].children[0].open,window.AdminTraceTimeline.render(events,{'event:1':false}).children[0].children[0].open];})()")
+    assert result == [True, False]
diff --git a/dashboard/backend/tests/test_app_composition.py b/dashboard/backend/tests/test_app_composition.py
index 8f64885f..c804e530 100644
--- a/dashboard/backend/tests/test_app_composition.py
+++ b/dashboard/backend/tests/test_app_composition.py
@@ -156,6 +156,8 @@
     ("GET", "/api/admin/traces/{trace_id}"),
     ("GET", "/api/admin/traces/{trace_id}/events"),
     ("GET", "/api/admin/traces/{trace_id}/performance"),
+    ("GET", "/api/admin/traces/{trace_id}/export"),
+    ("GET", "/api/admin/traces/{trace_id}/backtest"),
     ("POST", "/api/admin/bootstrap"),
     ("POST", "/api/algo/chat"),
     ("GET", "/api/algo/defaults"),
diff --git a/dashboard/frontend/admin.css b/dashboard/frontend/admin.css
index 5faf3f3a..1a4f78d6 100644
--- a/dashboard/frontend/admin.css
+++ b/dashboard/frontend/admin.css
@@ -499,3 +499,5 @@ dialog::backdrop{background:rgba(0,0,0,.64)}
 .credits-chart-swatch.credits-chart-purchased{background:var(--green)}
 
 .trace-performance{margin:24px 0;padding:20px;border:1px solid #334155;border-radius:8px}.trace-performance svg{width:100%;display:block;max-height:360px}.trace-performance-notice{color:#fbbf24}.trace-performance-links{display:flex;flex-wrap:wrap;gap:8px;max-height:180px;overflow:auto}.trace-event:focus{outline:2px solid #38bdf8}
+
+.trace-group{border:1px solid #334155;border-radius:8px;margin:12px 0}.trace-group-summary{padding:16px;cursor:pointer}.trace-group-summary span{display:block;margin-top:6px}.trace-event-group{list-style:none}.trace-group .trace-event{margin:8px 16px}.trace-technical summary,.trace-run-overview summary{cursor:pointer;padding:12px 0}.trace-downloads{display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin:20px 0}.trace-reason{border-left:2px solid #38bdf8;padding-left:12px}
diff --git a/dashboard/frontend/admin.html b/dashboard/frontend/admin.html
index d84f2315..25f4fae0 100644
--- a/dashboard/frontend/admin.html
+++ b/dashboard/frontend/admin.html
@@ -5,7 +5,7 @@
   <meta name="viewport" content="width=device-width, initial-scale=1">
   <title>ATL Admin</title>
   <link rel="icon" href="favicon.svg">
-  <link rel="stylesheet" href="admin.css?v=12">
+  <link rel="stylesheet" href="admin.css?v=13">
   <!-- The absorbed sections (N2/PR2) and the app chrome: component styles
        extracted from the app-wide stylesheet, which this page still must not
        inherit wholesale (its 15k lines would restyle the shell). -->
@@ -22,8 +22,9 @@
   <script src="js/admin-users.js?v=1" defer></script>
   <script src="js/admin-providers.js?v=1" defer></script>
   <script src="js/admin-credits.js?v=4" defer></script>
-  <script src="js/admin-trace-performance.js?v=1" defer></script>
-  <script src="js/admin-traces.js?v=2" defer></script>
+  <script src="js/admin-trace-timeline.js?v=1" defer></script>
+  <script src="js/admin-trace-performance.js?v=2" defer></script>
+  <script src="js/admin-traces.js?v=3" defer></script>
 </head>
 <body>
   <!-- Icon sprite (design §6). Markup, not script, so the no-inline-script
diff --git a/dashboard/frontend/js/admin-trace-performance.js b/dashboard/frontend/js/admin-trace-performance.js
index ed9ae87b..709df36f 100644
--- a/dashboard/frontend/js/admin-trace-performance.js
+++ b/dashboard/frontend/js/admin-trace-performance.js
@@ -59,7 +59,7 @@
       const time = Date.parse(decision.payload?.decision_at);
       const equity = decision.payload?.state?.equity;
       const label = e.payload.fills.map(f => `${f.side} ${f.symbol}`).join(', ');
-      const jump = target => { const n = document.getElementById(`trace-event-${target.sequence_no}`); n?.scrollIntoView?.({block: 'center', behavior: 'smooth'}); n?.focus?.({preventScroll: true}); };
+      const jump = target => window.AdminTraceTimeline?.reveal(target.sequence_no);
       if (Number.isFinite(time) && typeof equity === 'number' && Number.isFinite(equity) && time >= points[0].time && time <= points.at(-1).time) {
         // A marker indicates the decision snapshot, not equity at fill time.
         const marker = shape('circle', { cx: x(time), cy: Math.max(30, Math.min(210, y(equity))), r: 5, fill: '#fbbf24', tabindex: 0, role: 'button', 'aria-label': `Decision: ${label}` });
diff --git a/dashboard/frontend/js/admin-trace-timeline.js b/dashboard/frontend/js/admin-trace-timeline.js
new file mode 100644
index 00000000..a3b29409
--- /dev/null
+++ b/dashboard/frontend/js/admin-trace-timeline.js
@@ -0,0 +1,78 @@
+/** Group recorded events by explicit decision/step IDs, with optional raw detail. */
+(function () {
+  'use strict';
+  function groupEvents(events) {
+    const stepDecisions = new Map();
+    events.forEach(e => { if (e.step_id && e.decision_id) {
+      if (!stepDecisions.has(e.step_id)) stepDecisions.set(e.step_id, new Set());
+      stepDecisions.get(e.step_id).add(e.decision_id);
+    } });
+    const groups = new Map();
+    events.forEach(e => {
+      const matches = stepDecisions.get(e.step_id);
+      const decision = e.decision_id || (matches?.size === 1 ? [...matches][0] : null);
+      const key = decision ? `decision:${decision}` : e.step_id ? `step:${e.step_id}` : `event:${e.sequence_no}`;
+      if (!groups.has(key)) groups.set(key, []);
+      groups.get(key).push(e);
+    });
+    return [...groups].map(([key, events]) => ({ key, events }));
+  }
+  function summary(event) {
+    const p = event.payload || {};
+    const actions = [p.fills, p.actions, p.executed].find(a => Array.isArray(a) && a.length) || [];
+    const orders = Array.isArray(actions) ? actions.slice(0, 3).map(a => [a.side || a.action, a.symbol, a.shares == null ? '' : `${a.shares} shares`].filter(Boolean).join(' ')).join('; ') : '';
+    return orders || p.error_code || (typeof p.message === 'string' ? p.message.slice(0, 160) : '') || window.AdminShell.humanize(event.event_type || 'event');
+  }
+  function render(events, openState = {}) {
+    const el = window.AdminShell.el;
+    const list = el('ol', 'trace-timeline');
+    if (!events?.length) { list.appendChild(el('li', 'panel-empty', 'No events recorded yet.')); return list; }
+    groupEvents(events).forEach(group => {
+      const li = el('li', 'trace-event-group');
+      const details = el('details', 'trace-group');
+      details.setAttribute('data-trace-expand', group.key);
+      const failed = group.events.some(e => /failed|error/.test(e.event_type) || e.payload?.error_code);
+      details.open = Object.hasOwn(openState, group.key) ? openState[group.key] : failed;
+      const decision = group.events.find(e => e.event_type === 'decision_recorded');
+      const last = group.events.at(-1);
+      const outcome = group.events.find(e => e.event_type === 'execution_result') || decision || last;
+      const heading = el('summary', 'trace-group-summary');
+      heading.appendChild(el('strong', '', `${decision ? 'Decision' : window.AdminShell.humanize(group.events[0].event_type)} · ${summary(outcome)}`));
+      const marketTime = decision?.payload?.decision_at;
+      heading.appendChild(el('span', 'muted', `${marketTime ? 'Market ' + window.AdminShell.formatTimestamp(marketTime) : 'Recorded ' + window.AdminShell.formatTimestamp(last.occurred_at)} · ${group.events.length} events${failed ? ' · Failed' : ''}`));
+      details.appendChild(heading);
+      group.events.forEach(e => {
+        const item = el('div', 'trace-event');
+        item.setAttribute('id', `trace-event-${e.sequence_no}`); item.setAttribute('tabindex', '-1');
+        item.appendChild(el('h3', '', `#${e.sequence_no} ${window.AdminShell.humanize(e.event_type)}`));
+        item.appendChild(el('p', 'muted', `Recorded ${window.AdminShell.formatTimestamp(e.occurred_at)} · ${e.actor_type || 'Unknown actor'}`));
+        item.appendChild(el('p', '', summary(e)));
+        const reasons = e.payload?.reasoning_summaries || [e.payload?.reasoning_summary];
+        if (Array.isArray(reasons)) reasons.filter(r => typeof r === 'string' && r).forEach(r => item.appendChild(el('p', 'trace-reason', r)));
+        const raw = el('details', 'trace-technical');
+        const rawKey = `raw:${e.sequence_no}`;
+        raw.setAttribute('data-trace-expand', rawKey); raw.open = Boolean(openState[rawKey]);
+        raw.appendChild(el('summary', '', 'Technical details (JSON)'));
+        const json = el('pre', 'trace-event-payload');
+        json.textContent = JSON.stringify(e, null, 2);
+        raw.appendChild(json);
+        item.appendChild(raw); details.appendChild(item);
+      });
+      li.appendChild(details); list.appendChild(li);
+    });
+    return list;
+  }
+  function capture(host) {
+    const state = {};
+    host.querySelectorAll('[data-trace-expand]').forEach(n => { state[n.getAttribute('data-trace-expand')] = n.open; });
+    return state;
+  }
+  function reveal(sequence) {
+    const target = document.getElementById(`trace-event-${sequence}`);
+    if (!target) return;
+    let parent = target.parentElement;
+    while (parent) { if (parent.tagName === 'DETAILS') parent.open = true; parent = parent.parentElement; }
+    target.scrollIntoView?.({block: 'center', behavior: 'smooth'}); target.focus?.({preventScroll: true});
+  }
+  window.AdminTraceTimeline = { groupEvents, summary, render, capture, reveal };
+})();
diff --git a/dashboard/frontend/js/admin-traces.js b/dashboard/frontend/js/admin-traces.js
index 4d5cff33..dbbb7bb5 100644
--- a/dashboard/frontend/js/admin-traces.js
+++ b/dashboard/frontend/js/admin-traces.js
@@ -81,30 +81,7 @@
   }
 
   function renderEventTimeline(events) {
-    const list = node('ol', 'trace-timeline');
-    const items = Array.isArray(events) ? events : [];
-    if (!items.length) {
-      list.appendChild(node('li', 'panel-empty', 'No events recorded yet.'));
-      return list;
-    }
-    items.forEach((event) => {
-      const item = node('li', 'trace-event');
-      item.setAttribute('id', `trace-event-${event.sequence_no}`);
-      item.setAttribute('tabindex', '-1');
-      const heading = node('div', 'trace-event-head');
-      heading.appendChild(node('span', 'trace-sequence', `#${value(event.sequence_no)}`));
-      heading.appendChild(node('strong', '', shell().humanize(event.event_type)));
-      heading.appendChild(node('time', '', shell().formatTimestamp(event.occurred_at)));
-      item.appendChild(heading);
-      const meta = [event.actor_type, event.step_id, event.decision_id, event.artifact_id, event.parent_event_id ? `parent ${event.parent_event_id}` : null]
-        .filter((part) => part !== null && part !== undefined && part !== '')
-        .map((part) => String(part));
-      if (meta.length) item.appendChild(node('p', 'trace-event-meta', meta.join(' · ')));
-      const payload = node('pre', 'trace-event-payload', payloadText(event.payload));
-      item.appendChild(payload);
-      list.appendChild(item);
-    });
-    return list;
+    return window.AdminTraceTimeline.render(events, state.openState || {});
   }
 
   function renderTraceList(payload) {
@@ -161,6 +138,46 @@
       metrics.appendChild(metric);
     });
     section.appendChild(metrics);
+    const config = trace?.initial_input || events.find(e => e.event_type === 'run_started')?.payload?.config_summary || {};
+    const overview = node('details', 'trace-run-overview');
+    overview.setAttribute('data-trace-expand', 'run-configuration');
+    overview.open = Boolean(state.openState?.['run-configuration']);
+    overview.appendChild(node('summary', '', 'Run configuration'));
+    const fields = [['Agent', trace?.agent_id], ['Run', trace?.run_id], ['Model', config.model || config.model_name], ['Market / data source', config.market || config.data_source], ['Start date', config.start_date], ['End date', config.end_date], ['Initial capital', config.initial_capital ?? config.initial_equity]];
+    fields.forEach(([label, v]) => overview.appendChild(node('p', '', `${label}: ${v == null ? 'Not recorded' : String(v)}`)));
+    const configRaw = node('details'); configRaw.appendChild(node('summary', '', 'Recorded configuration (JSON)'));
+    configRaw.appendChild(node('pre', 'trace-event-payload', payloadText(config))); overview.appendChild(configRaw);
+    section.appendChild(overview);
+    const report = node('details', 'trace-backtest-report');
+    report.setAttribute('data-trace-expand', 'backtest-report');
+    report.appendChild(node('summary', '', 'View this backtest · admin read-only'));
+    const reportBody = node('div'); report.appendChild(reportBody);
+    let reportLoaded = false;
+    report.addEventListener('toggle', async () => {
+      if (!report.open || reportLoaded) return;
+      reportLoaded = true; reportBody.textContent = 'Loading backtest…';
+      try {
+        const data = await shell().request(`/api/admin/traces/${encodeURIComponent(trace.trace_id)}/backtest`);
+        shell().clear(reportBody);
+        if (!data.available) { reportBody.textContent = 'No stored backtest result for this exact run. Trace events remain available.'; return; }
+        Object.entries(data.run).forEach(([key, v]) => reportBody.appendChild(node('p', '', `${shell().humanize(key)}: ${v == null ? 'Not recorded' : String(v)}`)));
+        const raw = node('details'); raw.appendChild(node('summary', '', 'Recorded backtest configuration'));
+        raw.appendChild(node('pre', 'trace-event-payload', payloadText(data.configuration))); reportBody.appendChild(raw);
+      } catch (error) {
+        if (await shell().handleAccessLost(error)) return;
+        reportLoaded = false; reportBody.textContent = 'Backtest details unavailable. Close and reopen to retry.';
+      }
+    });
+    report.open = Boolean(state.openState?.['backtest-report']);
+    section.appendChild(report);
+    const downloads = node('div', 'trace-downloads');
+    [['json', 'Export JSON'], ['markdown', 'Export Markdown']].forEach(([format, label]) => {
+      const link = node('a', 'auth-btn auth-btn-secondary', label);
+      link.setAttribute('href', `/api/admin/traces/${encodeURIComponent(trace.trace_id)}/export?format=${format}`);
+      link.setAttribute('download', ''); downloads.appendChild(link);
+    });
+    downloads.appendChild(node('span', 'muted', 'All recorded events · running traces export a fixed snapshot'));
+    section.appendChild(downloads);
     if (window.AdminTracePerformance) section.appendChild(window.AdminTracePerformance.render(trace, events, performance));
     const title = node('h2', 'trace-section-title', 'Timeline');
     section.appendChild(title);
@@ -241,6 +258,7 @@
       const terminal = [...events].reverse().find((event) => ['run_completed', 'run_failed'].includes(event.event_type));
       if (terminal) trace = await refreshTraceEnvelope(traceId);
       if (!shell().isCurrent(SURFACE, seq)) return;
+      if (state.traceId !== traceId) state.openState = {};
       state.traceId = traceId;
       state.context = { ...context };
       state.trace = trace;
@@ -289,6 +307,7 @@
 
         const host = element('tracesView');
         if (host && state.trace) {
+          state.openState = window.AdminTraceTimeline.capture(host);
           shell().clear(host);
           host.appendChild(renderTraceDetail(state.trace, state.events, state.context, state.performance));
         }
diff --git a/docs/superpowers/plans/2026-10-09-admin-trace-performance.md b/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
index ddcad1a0..8cc00726 100644
--- a/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
+++ b/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
@@ -5,3 +5,11 @@ Approved scope: a lightweight equity chart with decision/execution navigation, l
 1. Data: admin-only trace performance endpoint resolves only the exact trace.run_id. Return bounded chart points from existing equity storage; missing results allow the UI to use recorded decision snapshots. Never infer a run by agent name or date.
 2. UI: SVG chart above timeline, market-time axis, sample return/drawdown, execution links joined by decision_id. Distinguish snapshot performance from final backtest metrics; do not invent equity at execution times.
 3. Validation: test access control, missing run, invalid values, sampling, decision linkage, failure/empty states. Refresh performance while running with stale-response protection. Keep previous data on refresh failure. Fetch main and inspect PR state before publishing.
+
+## Follow-up: readable timeline and export (2026-10-10)
+
+Approved: collapsed event summaries, decision/step grouping, raw JSON behind a second disclosure, failed groups open by default, and preserving disclosure state on polling. Group only through explicit IDs; never infer relationships from adjacent timestamps. Trade navigation opens the matching decision group.
+
+Admin backtest details use an admin-gated exact-run projection across owners, rather than redirecting to the session-filtered trading interface. Display only stored fields and explicit missing-result states.
+
+Exports: admin-only JSON and Markdown, schema version and snapshot timestamp, fixed highest event sequence, all pages through that sequence, sensitive-field redaction, artifact references only. Build the output in a spooled temporary file before returning headers. Test >100 events, concurrent append, permission rejection, readable/escaped Markdown, and cross-owner exact-run lookup.

From 858f8d4dfb3bae878102e4c407711df847485d45 Mon Sep 17 00:00:00 2001
From: Haoxiang Cheng <2739441541@qq.com>
Date: Sat, 10 Oct 2026 18:20:48 +0800
Subject: [PATCH 3/4] feat(admin): align trace detail with backtest workspace

---
 dashboard/frontend/admin.css          |  3 +++
 dashboard/frontend/js/admin-traces.js | 21 +++++++++++++++------
 2 files changed, 18 insertions(+), 6 deletions(-)

diff --git a/dashboard/frontend/admin.css b/dashboard/frontend/admin.css
index 1a4f78d6..10342fcf 100644
--- a/dashboard/frontend/admin.css
+++ b/dashboard/frontend/admin.css
@@ -501,3 +501,6 @@ dialog::backdrop{background:rgba(0,0,0,.64)}
 .trace-performance{margin:24px 0;padding:20px;border:1px solid #334155;border-radius:8px}.trace-performance svg{width:100%;display:block;max-height:360px}.trace-performance-notice{color:#fbbf24}.trace-performance-links{display:flex;flex-wrap:wrap;gap:8px;max-height:180px;overflow:auto}.trace-event:focus{outline:2px solid #38bdf8}
 
 .trace-group{border:1px solid #334155;border-radius:8px;margin:12px 0}.trace-group-summary{padding:16px;cursor:pointer}.trace-group-summary span{display:block;margin-top:6px}.trace-event-group{list-style:none}.trace-group .trace-event{margin:8px 16px}.trace-technical summary,.trace-run-overview summary{cursor:pointer;padding:12px 0}.trace-downloads{display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin:20px 0}.trace-reason{border-left:2px solid #38bdf8;padding-left:12px}
+
+/* Trace analysis workspace: configuration, evidence, and executions stay aligned. */
+.trace-three-column{display:grid;grid-template-columns:220px minmax(0,1fr) 280px;gap:12px;align-items:start;margin-top:14px}.trace-context-rail,.trace-trading-log{position:sticky;top:16px;background:var(--bg-card);border:1px solid var(--border-color);border-radius:8px;padding:14px}.trace-analysis-column{min-width:0}.trace-context-rail .trace-run-overview,.trace-context-rail .trace-backtest-report{border:0;border-bottom:1px solid var(--border-color);border-radius:0;padding-bottom:10px;margin-bottom:10px}.trace-context-rail .trace-downloads{display:grid;gap:8px;margin:10px 0}.trace-context-rail .trace-downloads .muted{font-size:11px}.trace-log-head{display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid var(--border-color);padding-bottom:11px;margin-bottom:2px}.trace-log-head h2{font-size:16px;margin:0}.trace-log-item{padding:14px 0;border-bottom:1px solid var(--border-color)}.trace-log-item:last-child{border-bottom:0}.trace-log-order{font-weight:800;color:#54dfa5}.trace-log-item p{margin:6px 0 0;font-size:12px}@media(max-width:900px){.trace-three-column{display:block}.trace-context-rail,.trace-trading-log{position:static;margin-bottom:12px}}
diff --git a/dashboard/frontend/js/admin-traces.js b/dashboard/frontend/js/admin-traces.js
index dbbb7bb5..20c72812 100644
--- a/dashboard/frontend/js/admin-traces.js
+++ b/dashboard/frontend/js/admin-traces.js
@@ -138,6 +138,10 @@
       metrics.appendChild(metric);
     });
     section.appendChild(metrics);
+    const columns = node('div', 'trace-three-column');
+    const leftRail = node('aside', 'trace-context-rail');
+    const centerColumn = node('div', 'trace-analysis-column');
+    const rightRail = node('aside', 'trace-trading-log');
     const config = trace?.initial_input || events.find(e => e.event_type === 'run_started')?.payload?.config_summary || {};
     const overview = node('details', 'trace-run-overview');
     overview.setAttribute('data-trace-expand', 'run-configuration');
@@ -147,7 +151,7 @@
     fields.forEach(([label, v]) => overview.appendChild(node('p', '', `${label}: ${v == null ? 'Not recorded' : String(v)}`)));
     const configRaw = node('details'); configRaw.appendChild(node('summary', '', 'Recorded configuration (JSON)'));
     configRaw.appendChild(node('pre', 'trace-event-payload', payloadText(config))); overview.appendChild(configRaw);
-    section.appendChild(overview);
+    leftRail.appendChild(overview);
     const report = node('details', 'trace-backtest-report');
     report.setAttribute('data-trace-expand', 'backtest-report');
     report.appendChild(node('summary', '', 'View this backtest · admin read-only'));
@@ -169,7 +173,7 @@
       }
     });
     report.open = Boolean(state.openState?.['backtest-report']);
-    section.appendChild(report);
+    leftRail.appendChild(report);
     const downloads = node('div', 'trace-downloads');
     [['json', 'Export JSON'], ['markdown', 'Export Markdown']].forEach(([format, label]) => {
       const link = node('a', 'auth-btn auth-btn-secondary', label);
@@ -177,11 +181,16 @@
       link.setAttribute('download', ''); downloads.appendChild(link);
     });
     downloads.appendChild(node('span', 'muted', 'All recorded events · running traces export a fixed snapshot'));
-    section.appendChild(downloads);
-    if (window.AdminTracePerformance) section.appendChild(window.AdminTracePerformance.render(trace, events, performance));
+    leftRail.appendChild(downloads);
+    if (window.AdminTracePerformance) centerColumn.appendChild(window.AdminTracePerformance.render(trace, events, performance));
     const title = node('h2', 'trace-section-title', 'Timeline');
-    section.appendChild(title);
-    section.appendChild(renderEventTimeline(events));
+    centerColumn.appendChild(title);
+    centerColumn.appendChild(renderEventTimeline(events));
+    const fills = events.flatMap(e => (e.event_type === 'execution_result' ? (e.payload?.fills || []) : [])).slice(0, 50);
+    const logHead = node('div', 'trace-log-head'); logHead.append(node('h2', '', 'Trading log'), node('span', 'eyebrow', `${fills.length} fills`)); rightRail.appendChild(logHead);
+    if (!fills.length) rightRail.appendChild(node('p', 'panel-empty', 'No execution fills recorded.'));
+    fills.forEach(fill => { const item = node('article', 'trace-log-item'); const side = String(fill.side || fill.action || 'ORDER').toUpperCase(); item.append(node('div', 'trace-log-order', `${side} ${value(fill.symbol || 'Unknown symbol')}`), node('p', 'muted', `${fill.quantity ?? fill.shares ?? '—'} shares · ${fill.price == null ? 'Price not recorded' : fill.price}`)); const decision = events.find(e => e.event_type === 'decision_recorded' && e.decision_id === fill.decision_id); if (decision?.payload?.reasoning_summary) item.append(node('p', 'trace-reason', decision.payload.reasoning_summary)); rightRail.appendChild(item); });
+    columns.append(leftRail, centerColumn, rightRail); section.appendChild(columns);
     return section;
   }
 

From f73bc57630c347f29374780b6c2fa8575615343d Mon Sep 17 00:00:00 2001
From: FlyM1ss <felixflyingt@gmail.com>
Date: Tue, 13 Oct 2026 13:06:30 -0400
Subject: [PATCH 4/4] fix(admin): address trace detail review findings

- Poll the trace envelope before events (then events + performance in
  parallel), so a run that finishes between reads cannot stop polling with
  its last flush and terminal event unread; re-render only on change and
  restore focus.
- Trading log: link fills through the execution event's decision_id and the
  per-action reasoning_summaries; show the latest 50 newest-first with the
  true count.
- Backtest report: fetch once per trace+status, so restoring `open` on each
  re-render no longer refetches; read llm_model (agent_runs has no
  model_name).
- Performance: report the run's stored total_return / max_drawdown instead
  of recomputing against the first equity mark.
- Export: status from the events inside the boundary (failed != incomplete);
  word-based key redaction (token counts stay visible); Markdown-escape agent
  text; linear-time email/newline handling.
- Null-guard renderTraceDetail; tokenise colours, drop dead timeline rules,
  bound the sticky rails; restore the rejected-query-name scan on all read
  modules.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 dashboard/backend/api/routers/admin_traces.py |  32 ++-
 dashboard/backend/domain/traces/export.py     | 136 ++++++++--
 .../backend/tests/test_admin_page_modules.py  |   8 +-
 .../backend/tests/test_admin_trace_export.py  |  85 ++++++-
 .../tests/test_admin_trace_performance.py     |  27 +-
 .../tests/test_admin_traces_frontend.py       | 124 +++++++++
 dashboard/frontend/admin.css                  |  12 +-
 .../frontend/js/admin-trace-performance.js    |  11 +-
 dashboard/frontend/js/admin-trace-timeline.js |   5 +-
 dashboard/frontend/js/admin-traces.js         | 239 +++++++++++++-----
 .../2026-10-09-admin-trace-performance.md     |   7 +
 11 files changed, 566 insertions(+), 120 deletions(-)

diff --git a/dashboard/backend/api/routers/admin_traces.py b/dashboard/backend/api/routers/admin_traces.py
index e428f6e8..3c94ad2f 100644
--- a/dashboard/backend/api/routers/admin_traces.py
+++ b/dashboard/backend/api/routers/admin_traces.py
@@ -84,6 +84,7 @@ def get_trace_performance(trace_id: str):
     """Resolve equity by the exact run ID, never by agent or nearest date."""
     import math
     from dashboard.backend.database import db
+    from dashboard.backend.domain.backtesting.metrics import calculate_max_drawdown
 
     trace = trace_store.get_trace(trace_id)
     if trace is None:
@@ -96,19 +97,26 @@ def get_trace_performance(trace_id: str):
             equity = row.get("equity")
             if isinstance(equity, (int, float)) and not isinstance(equity, bool) and math.isfinite(equity):
                 points.append({"timestamp": row["timestamp"], "equity": equity})
-    # Metrics use the full series; drawing uses a bounded sample including endpoints.
-    peak = None
-    drawdown = 0.0
-    for point in points:
-        peak = point["equity"] if peak is None else max(peak, point["equity"])
-        if peak > 0:
-            drawdown = max(drawdown, (peak - point["equity"]) / peak)
+    # Report the run's own stored figures, so this chart and the backtest panel
+    # beside it (and the results page) show one return for one run. The stored
+    # total_return is measured against initial capital; agent_runs.initial_equity
+    # is the first equity mark, which already carries first-bar fees.
+    def finite(value):
+        return isinstance(value, (int, float)) and not isinstance(value, bool) and math.isfinite(value)
+
+    stored_return = (run or {}).get("total_return")
+    stored_drawdown = (run or {}).get("max_drawdown")
+    if finite(stored_drawdown):
+        drawdown = abs(stored_drawdown)
+    elif points:
+        # Metrics use the full series; drawing uses a bounded sample including endpoints.
+        drawdown = abs(calculate_max_drawdown(points))
+    else:
+        drawdown = None
     count = len(points)
-    initial = (run or {}).get("initial_equity")
-    baseline = initial if isinstance(initial, (int, float)) and math.isfinite(initial) and initial >= 0 else (points[0]["equity"] if points else 0)
     metrics = {
-        "return_pct": ((points[-1]["equity"] / baseline - 1) * 100) if points and baseline > 0 else None,
-        "max_drawdown_pct": drawdown * 100 if points else None,
+        "return_pct": stored_return * 100 if points and finite(stored_return) else None,
+        "max_drawdown_pct": drawdown * 100 if points and drawdown is not None else None,
     }
     if count > 1000:
         points = [points[round(i * (count - 1) / 999)] for i in range(1000)]
@@ -152,7 +160,7 @@ def get_trace_backtest(trace_id: str):
     run = db.get_run(trace.get('run_id')) if trace.get('run_id') else None
     if run is None:
         return {'available': False, 'run_id': trace.get('run_id')}
-    fields = ('run_id', 'agent_name', 'model_name', 'mode', 'start_date', 'end_date',
+    fields = ('run_id', 'agent_name', 'llm_model', 'mode', 'start_date', 'end_date',
               'initial_equity', 'final_equity', 'total_return', 'max_drawdown', 'sharpe_ratio',
               'num_trades', 'llm_calls', 'llm_decisions', 'input_tokens', 'output_tokens', 'est_cost_usd')
     return {'available': True, 'run_id': trace['run_id'],
diff --git a/dashboard/backend/domain/traces/export.py b/dashboard/backend/domain/traces/export.py
index e36167ca..0ac5e4c1 100644
--- a/dashboard/backend/domain/traces/export.py
+++ b/dashboard/backend/domain/traces/export.py
@@ -2,18 +2,61 @@
 import html
 import json
 import re
+import shutil
 from datetime import datetime, timezone
 from tempfile import SpooledTemporaryFile
 
-_PRIVATE = re.compile(r'api[_-]?key|authorization|cookie|password|secret|token|email|session|browser|user_id|actor_id', re.I)
-_EMAIL = re.compile(r'[\w.+-]+@[\w.-]+\.[a-zA-Z]{2,}')
+# Key matching is per word, not per substring: ``token`` must catch
+# ``refresh_token`` and ``accessToken`` without blanking ``input_tokens`` or
+# ``llm_max_output_tokens``, and ``session``/``browser`` are identities only
+# as a whole key or with ``id`` -- ``open_session_excluded`` is configuration.
+# Stems are sensitive anywhere in a key once separators and case are dropped
+# (``x-api-key``, ``XAPIKey``, ``client_secret``).
+_SENSITIVE_STEMS = (
+    'apikey', 'authorization', 'bearer', 'cookie', 'credential', 'email',
+    'passwd', 'password', 'privatekey', 'secret',
+)
+# Sensitive only as the end of a word or of two adjacent words, so
+# ``session_id``, ``sessionId`` and ``sessionid`` all match.
+_SENSITIVE_SUFFIXES = ('token', 'sessionid', 'browserid', 'userid', 'actorid')
+_SENSITIVE_KEYS = frozenset({'session', 'browser'})
+_CAMEL = re.compile(r'([a-z0-9])([A-Z])')
+# The lookbehind starts a match only at the head of a run: without it a long
+# run with no ``@`` is re-scanned from every offset, quadratic in its length,
+# and agent text reaches this up to the store's 64 KiB payload cap.
+_EMAIL = re.compile(r'(?<![\w.+-])[\w.+-]+@[\w.-]+\.[a-zA-Z]{2,}')
 _BEARER = re.compile(r'(?i)\bBearer\s+[^\s"<>]+')
 _KEY = re.compile(r'\b(?:sk-|sk_)[A-Za-z0-9_-]{12,}')
+# Inline constructs an agent could use to plant a link, an image beacon or
+# formatting in an admin's Markdown viewer. Line-start constructs (headings,
+# lists, setext rules) are prevented by folding newlines, since every line this
+# module writes starts with its own label. ``&``, ``<`` and ``>`` are left to
+# ``html.escape``, whose entities must not be broken apart.
+_MARKDOWN_PUNCTUATION = re.compile(r'([\\`*_\[\]()!~])')
+_TERMINAL_EVENTS = {'run_completed': 'completed', 'run_failed': 'failed'}
+_RUN_STATUS_LINE = {
+    'completed': 'Run completed.',
+    'failed': 'Run failed.',
+    'running': 'Run is incomplete: it was still running at capture.',
+}
+
+
+def _key_words(key):
+    return [word for word in re.split(r'[^a-z0-9]+', _CAMEL.sub(r'\1_\2', str(key)).lower()) if word]
+
+
+def _is_sensitive_key(key):
+    words = _key_words(key)
+    compact = ''.join(words)
+    if compact in _SENSITIVE_KEYS or any(stem in compact for stem in _SENSITIVE_STEMS):
+        return True
+    candidates = words + [first + second for first, second in zip(words, words[1:])]
+    return any(word.endswith(_SENSITIVE_SUFFIXES) for word in candidates)
 
 
 def redact(value):
     if isinstance(value, dict):
-        return {key: '[REDACTED]' if _PRIVATE.search(str(key)) else redact(child) for key, child in value.items()}
+        return {key: '[REDACTED]' if _is_sensitive_key(key) else redact(child) for key, child in value.items()}
     if isinstance(value, list):
         return [redact(child) for child in value]
     if isinstance(value, str):
@@ -21,61 +64,106 @@ def redact(value):
     return value
 
 
+def markdown_text(value):
+    """Agent-supplied text as inert Markdown: no links, images, or headings.
+    The exact text stays in the event's escaped ``<pre>`` block."""
+    flat = ' '.join(str(value).splitlines())
+    return _MARKDOWN_PUNCTUATION.sub(r'\\\1', html.escape(flat, quote=False))
+
+
+def run_status(trace, events_status):
+    """The run's state as of the export boundary.
+
+    A terminal event inside the boundary is authoritative: the trace row is read
+    before the boundary is fixed, and the store appends the terminal event before
+    it updates the row, so a row can still say ``running`` for an export that
+    holds ``run_completed``. A terminal row with no terminal event (a store that
+    never wrote one) is believed as read."""
+    if events_status:
+        return events_status
+    status = (trace or {}).get('status')
+    return status if status in ('completed', 'failed') else 'running'
+
+
 def build_export(store, trace, format):
     """Build completely before sending headers; spill larger files to disk."""
     captured_at = datetime.now(timezone.utc).isoformat()
     cutoff = store.event_high_watermark(trace['trace_id'])
-    header = {'schema_version': 1, 'captured_at': captured_at,
-              'through_sequence': cutoff, 'incomplete_run': trace.get('status') != 'completed',
-              'artifact_policy': 'References and metadata only; attachments are not bundled.',
-              'trace': redact(trace)}
+    body = SpooledTemporaryFile(max_size=1024 * 1024, mode='w+b')
     file = SpooledTemporaryFile(max_size=1024 * 1024, mode='w+b')
-    def write(text):
-        file.write(text.encode('utf-8'))
+
+    def write(target, text):
+        target.write(text.encode('utf-8'))
+
     def dump(value):
         return json.dumps(value, ensure_ascii=False, indent=2)
+
     def block(value):
         # An HTML-safe code block even when a message contains backticks.
         return '\n<pre>\n' + html.escape(dump(value)) + '\n</pre>\n'
+
     try:
-        if format == 'json':
-            write(dump(header)[:-2] + ',\n  "events": [\n')
-        else:
-            write('# Agent trace report\n\n')
-            write(f'Captured at: {captured_at}\n\nThrough event sequence: {cutoff}\n\n')
-            write('Run is incomplete.\n\n' if header['incomplete_run'] else 'Run completed.\n\n')
-            write('Artifact references only; attachments are not bundled.\n\n## Run overview\n' + block(header['trace']) + '\n## Timeline\n')
         cursor = 0
         first = True
+        events_status = None
         while cursor < cutoff:
             page = store.list_events(trace['trace_id'], after_sequence=cursor, limit=100)
             rows = [e for e in page['items'] if cursor < e['sequence_no'] <= cutoff]
             if not rows:
                 raise RuntimeError('Trace changed or event page missing during export')
             for event in rows:
+                events_status = _TERMINAL_EVENTS.get(event.get('event_type'), events_status)
                 clean = redact(event)
                 if format == 'json':
-                    write(('' if first else ',\n') + dump(clean))
+                    write(body, ('' if first else ',\n') + dump(clean))
                 else:
-                    write(f'\n### Event {event["sequence_no"]}: {html.escape(str(clean.get("event_type", "event")))}\n\n')
-                    write('Recorded: ' + html.escape(str(clean.get('occurred_at', 'Not recorded'))) + '\n\n')
+                    write(body, f'\n### Event {event["sequence_no"]}: {markdown_text(clean.get("event_type", "event"))}\n\n')
+                    write(body, 'Recorded: ' + markdown_text(clean.get('occurred_at', 'Not recorded')) + '\n\n')
                     payload = clean.get('payload') or {}
                     if isinstance(payload, dict):
                         reasons = payload.get('reasoning_summaries') or [payload.get('reasoning_summary')]
                         if isinstance(reasons, list):
                             for reason in reasons:
                                 if isinstance(reason, str) and reason:
-                                    write('Reason: ' + html.escape(reason) + '\n\n')
+                                    write(body, 'Reason: ' + markdown_text(reason) + '\n\n')
                         for label in ('error_code', 'message', 'fills', 'actions', 'rejected'):
-                            if payload.get(label):
-                                write(html.escape(label.replace('_', ' ').title()) + ': ' + html.escape(dump(payload[label])) + '\n\n')
-                    write('<details><summary>Technical details</summary>\n' + block(clean) + '\n</details>\n')
+                            detail = payload.get(label)
+                            if not detail:
+                                continue
+                            name = label.replace('_', ' ').title()
+                            if isinstance(detail, str):
+                                write(body, f'{name}: {markdown_text(detail)}\n\n')
+                            else:
+                                # Structured values carry agent text too (an
+                                # action's reasoning), so they go in a block.
+                                write(body, f'{name}:\n{block(detail)}\n')
+                    write(body, '<details><summary>Technical details</summary>\n' + block(clean) + '\n</details>\n')
                 first = False
             cursor = rows[-1]['sequence_no']
+        # The header is written after the walk so its status describes exactly
+        # the events through ``cutoff``, not the row as it was read earlier.
+        status = run_status(trace, events_status)
+        exported_trace = redact({**trace, 'status': status})
+        header = {'schema_version': 1, 'captured_at': captured_at,
+                  'through_sequence': cutoff, 'run_status': status,
+                  'incomplete_run': status == 'running',
+                  'artifact_policy': 'References and metadata only; attachments are not bundled.',
+                  'trace': exported_trace}
+        if format == 'json':
+            write(file, dump(header)[:-2] + ',\n  "events": [\n')
+        else:
+            write(file, '# Agent trace report\n\n')
+            write(file, f'Captured at: {markdown_text(captured_at)}\n\nThrough event sequence: {cutoff}\n\n')
+            write(file, _RUN_STATUS_LINE[status] + '\n\n')
+            write(file, 'Artifact references only; attachments are not bundled.\n\n## Run overview\n' + block(exported_trace) + '\n## Timeline\n')
+        body.seek(0)
+        shutil.copyfileobj(body, file)
         if format == 'json':
-            write('\n]}\n')
+            write(file, '\n]}\n')
         file.seek(0)
         return file
     except Exception:
         file.close()
         raise
+    finally:
+        body.close()
diff --git a/dashboard/backend/tests/test_admin_page_modules.py b/dashboard/backend/tests/test_admin_page_modules.py
index ff150b5a..d76ec6fb 100644
--- a/dashboard/backend/tests/test_admin_page_modules.py
+++ b/dashboard/backend/tests/test_admin_page_modules.py
@@ -196,10 +196,12 @@ def test_exact_endpoints_and_query_names():
     ):
         assert query_name in ALL, query_name
     assert "section, limit:" in MODULES["admin-users.js"]
+    # The trace detail reads a recorded backtest config (`config.start_date`):
+    # a property of stored data, not a query name. Only that read is exempt --
+    # every read module, the trace modules included, is still scanned.
+    query_sources = ALL.replace("config.start_date", "")
     for rejected in ("'status'", "start_date", "provider_id'", "model_id'", "'cohort'", "analyticsUser", "adminTab=analytics"):
-        # These are rejected analytics query names, not backtest config fields.
-        analytics_sources = "\n".join(MODULES[name] for name in ("admin-shell.js", "admin-live.js", "admin-overview.js", "admin-users.js"))
-        assert rejected not in analytics_sources, rejected
+        assert rejected not in query_sources, rejected
 
 
 def test_no_live_route_and_no_chartjs():
diff --git a/dashboard/backend/tests/test_admin_trace_export.py b/dashboard/backend/tests/test_admin_trace_export.py
index e034e5d9..3cd9555c 100644
--- a/dashboard/backend/tests/test_admin_trace_export.py
+++ b/dashboard/backend/tests/test_admin_trace_export.py
@@ -36,7 +36,9 @@ def test_redaction_and_markdown_escape(tmp_path):
         text = file.read().decode()
     assert '<script>' not in text
     assert '&lt;script&gt;' in text
-    assert 'Run is incomplete' in text
+    # A failed run is not an incomplete one.
+    assert 'Run failed.' in text
+    assert 'incomplete' not in text
 
 
 @pytest.mark.parametrize('suffix', ['export?format=json', 'export?format=markdown', 'backtest'])
@@ -50,13 +52,15 @@ def test_admin_can_view_other_owners_exact_backtest(monkeypatch):
     monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: {'run_id':'other-owner-run'})
     def get_run(run_id):
         assert run_id == 'other-owner-run'
-        return {'run_id':run_id, 'owner_user_id':99, 'session_id':'private', 'initial_equity':1000, 'metadata':{'api_key':'private'}}
+        return {'run_id':run_id, 'owner_user_id':99, 'session_id':'private', 'initial_equity':1000, 'llm_model':'deepseek-v4-pro', 'metadata':{'api_key':'private'}}
     monkeypatch.setattr(db, 'get_run', get_run)
     app.dependency_overrides[require_admin] = lambda: {'id':1,'is_admin':True}
     try:
         response = TestClient(app).get('/api/admin/traces/t/backtest')
         assert response.status_code == 200
         assert response.json()['run']['run_id'] == 'other-owner-run'
+        # agent_runs stores the model as llm_model; there is no model_name column.
+        assert response.json()['run']['llm_model'] == 'deepseek-v4-pro'
         assert 'private' not in response.text
     finally:
         app.dependency_overrides.pop(require_admin, None)
@@ -78,8 +82,83 @@ def test_export_http_download_and_validation(tmp_path, monkeypatch, format, exte
         if format == 'json':
             assert len(response.json()['events']) == 1
         else:
-            assert 'Event 1: run_started' in response.text
+            assert 'Event 1: run\\_started' in response.text
         assert client.get('/api/admin/traces/missing/export').status_code == 404
         assert client.get('/api/admin/traces/download/export?format=invalid').status_code == 422
     finally:
         app.dependency_overrides.pop(require_admin, None)
+
+
+def test_redaction_matches_key_words_not_substrings():
+    config = {
+        'llm_max_output_tokens': 2000, 'open_session_excluded': True,
+        'llm_execution': {'input_tokens': 10, 'output_tokens': 20},
+        'refresh_token': 'x', 'accessToken': 'x', 'x-api-key': 'x', 'apiKey': 'x',
+        'session_id': 'x', 'sessionId': 'x', 'browser_id': 'x', 'session': 'x',
+        'owner_user_id': 1, 'client_secret': 'x', 'notification_email': 'x',
+        'accesstoken': 'x', 'XAPIKey': 'x', 'sessionid': 'x', 'actor_id': 'x', 'trace_id': 'kept',
+    }
+    result = redact(config)
+    assert result['llm_max_output_tokens'] == 2000
+    assert result['open_session_excluded'] is True
+    assert result['llm_execution'] == {'input_tokens': 10, 'output_tokens': 20}
+    assert result['trace_id'] == 'kept'
+    for key in ('refresh_token', 'accessToken', 'x-api-key', 'apiKey', 'session_id', 'sessionId',
+                'browser_id', 'session', 'owner_user_id', 'client_secret', 'notification_email',
+                'accesstoken', 'XAPIKey', 'sessionid', 'actor_id'):
+        assert result[key] == '[REDACTED]', key
+
+
+def test_export_status_follows_the_events_it_contains(tmp_path):
+    """The row is read before the boundary is fixed, and the store appends the
+    terminal event before it marks the row: an export holding run_completed
+    must not call the run incomplete."""
+    store = TraceStore(tmp_path / 'traces.db')
+    trace = store.create_trace(trace_id='t', run_id='r')
+    assert trace['status'] == 'running'
+    store.append_event(trace_id='t', event_type='run_completed', actor_type='system', payload={})
+    with build_export(store, trace, 'json') as file:
+        result = json.load(file)
+    assert result['run_status'] == 'completed'
+    assert result['incomplete_run'] is False
+    assert result['trace']['status'] == 'completed'
+    with build_export(store, trace, 'markdown') as file:
+        assert 'Run completed.' in file.read().decode()
+
+
+def test_markdown_export_neutralizes_agent_links_and_images(tmp_path):
+    store = TraceStore(tmp_path / 'traces.db')
+    trace = store.create_trace(trace_id='t', run_id='r')
+    reasoning = '![x](https://attacker.example/beacon?id=1) [Reset creds](https://phish.example)\n# Forged heading'
+    store.append_event(trace_id='t', event_type='decision_recorded', actor_type='agent',
+                       payload={'reasoning_summaries': [reasoning], 'actions': [{'symbol': 'AAPL', 'reasoning': reasoning}]})
+    with build_export(store, trace, 'markdown') as file:
+        text = file.read().decode()
+    outside_pre = []
+    inside = False
+    for line in text.splitlines():
+        if line == '<pre>':
+            inside = True
+        elif line == '</pre>':
+            inside = False
+        elif not inside:
+            outside_pre.append(line)
+    rendered = '\n'.join(outside_pre)
+    reason = next(line for line in outside_pre if line.startswith('Reason: '))
+    assert reason == 'Reason: \\!\\[x\\]\\(https://attacker.example/beacon?id=1\\) \\[Reset creds\\]\\(https://phish.example\\) # Forged heading'
+    assert '](' not in rendered.replace('\\](', '')
+    assert not any(line.startswith('# Forged') for line in outside_pre)
+
+
+def test_redaction_and_markdown_text_stay_linear_on_long_agent_text():
+    """Agent text reaches the export up to the store's 64 KiB payload cap. The
+    email pattern used to re-scan a long ``@``-less run from every offset, and a
+    whitespace-folding pattern did the same to long blank runs: ~20 s of the
+    web process's one CPU for one 64 KiB string."""
+    import time
+    from dashboard.backend.domain.traces.export import markdown_text
+    started = time.perf_counter()
+    redact('a' * 60000)
+    markdown_text(' ' * 60000)
+    assert time.perf_counter() - started < 1.0
+    assert redact('mail x.y+z@mail.example.co now') == 'mail [REDACTED] now'
diff --git a/dashboard/backend/tests/test_admin_trace_performance.py b/dashboard/backend/tests/test_admin_trace_performance.py
index afd4ae4f..9776b505 100644
--- a/dashboard/backend/tests/test_admin_trace_performance.py
+++ b/dashboard/backend/tests/test_admin_trace_performance.py
@@ -9,7 +9,7 @@ def test_exact_run_and_bounded_points(monkeypatch):
     calls = []
     def run(run_id):
         calls.append(run_id)
-        return {'initial_equity': 100}
+        return {'initial_equity': 100, 'total_return': 20.0}
     monkeypatch.setattr(db, 'get_run', run)
     monkeypatch.setattr(db, 'get_equity_curve', lambda _: [{'timestamp': str(i), 'equity': 100 + i} for i in range(2001)])
     result = api.get_trace_performance('trace')
@@ -51,3 +51,28 @@ def test_performance_route_keeps_admin_dependency():
     from dashboard.backend.api.auth import require_admin
     route = next(r for r in api.router.routes if r.path.endswith('/performance'))
     assert require_admin in [dependency.call for dependency in route.dependant.dependencies]
+
+
+def test_metrics_are_the_runs_stored_figures(monkeypatch):
+    """One run, one return: the chart reports what the backtest panel and the
+    results page report, not a recomputation against the first equity mark
+    (which already carries first-bar fees)."""
+    monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: {'run_id': 'r', 'status': 'completed'})
+    monkeypatch.setattr(db, 'get_run', lambda _: {
+        'run_id': 'r', 'initial_equity': 99950, 'total_return': 0.01, 'max_drawdown': -0.025,
+    })
+    monkeypatch.setattr(db, 'get_equity_curve', lambda _: [
+        {'timestamp': '1', 'equity': 99950}, {'timestamp': '2', 'equity': 101000},
+    ])
+    metrics = api.get_trace_performance('t')['metrics']
+    assert metrics['return_pct'] == 1.0
+    assert metrics['max_drawdown_pct'] == 2.5
+
+
+def test_return_is_not_invented_when_the_run_stored_none(monkeypatch):
+    monkeypatch.setattr(api.trace_store, 'get_trace', lambda _: {'run_id': 'r', 'status': 'completed'})
+    monkeypatch.setattr(db, 'get_run', lambda _: {'run_id': 'r', 'initial_equity': 100})
+    monkeypatch.setattr(db, 'get_equity_curve', lambda _: [
+        {'timestamp': '1', 'equity': 100}, {'timestamp': '2', 'equity': 120},
+    ])
+    assert api.get_trace_performance('t')['metrics']['return_pct'] is None
diff --git a/dashboard/backend/tests/test_admin_traces_frontend.py b/dashboard/backend/tests/test_admin_traces_frontend.py
index 10f4fd43..f671c431 100644
--- a/dashboard/backend/tests/test_admin_traces_frontend.py
+++ b/dashboard/backend/tests/test_admin_traces_frontend.py
@@ -77,3 +77,127 @@ def test_groups_only_by_explicit_links_and_keeps_event_order():
 def test_failure_opens_by_default_and_explicit_collapse_is_preserved():
     result = _eval("(() => {const events=[{sequence_no:1,event_type:'run_failed',payload:{error_code:'timeout'}}];return [window.AdminTraceTimeline.render(events).children[0].children[0].open,window.AdminTraceTimeline.render(events,{'event:1':false}).children[0].children[0].open];})()")
     assert result == [True, False]
+
+
+# Drives loadDetail through the route event, then one poll, against the stub's
+# ordered fetch queue. `settle` lets the awaited request chain drain.
+_ROUTE_THEN_POLL = """
+const settle = () => new Promise((resolve) => setTimeout(resolve, 0));
+const host = register('tracesView', document.createElement('div'));
+const envelope = (status) => ({ok: true, status: 200, body: {trace_id: 't', run_id: 'r', status}});
+const page = (items) => ({ok: true, status: 200, body: {items, has_more: false}});
+const performance = {ok: true, status: 200, body: {points: [], point_count: 0, metrics: {}}};
+async function openRunningTrace() {
+  fetchQueue.push(envelope('running'), page([{sequence_no: 1, event_type: 'decision_recorded', decision_id: 'd'}]), performance);
+  document.dispatchEvent(new CustomEvent('admin:route', {detail: {route: 'traces', id: 't'}}));
+  for (let i = 0; i < 5; i += 1) await settle();
+  window.AdminTraces.stopPolling();
+}
+"""
+
+
+def test_poll_reads_the_envelope_before_events_so_a_finished_run_keeps_its_tail():
+    """The store appends run_completed before it marks the trace completed. Reading
+    events first and the envelope second let a trace finish between the two reads:
+    the poll saw 'completed', stopped, and the last flush never loaded."""
+    result = _eval(
+        "(async () => {" + _ROUTE_THEN_POLL +
+        "  await openRunningTrace();"
+        "  const before = fetchCalls.length;"
+        "  fetchQueue.push(envelope('completed'), page([{sequence_no: 2, event_type: 'execution_result', decision_id: 'd'}, {sequence_no: 3, event_type: 'run_completed'}]), performance);"
+        "  await window.AdminTraces.pollEvents();"
+        "  window.AdminTraces.stopPolling();"
+        "  return {calls: fetchCalls.slice(before).map(([url]) => url), text: host.textContent};"
+        "})()"
+    )
+    assert result["calls"][0] == "/api/admin/traces/t"
+    assert result["calls"][1].startswith("/api/admin/traces/t/events?after_sequence=1")
+    assert result["calls"][2] == "/api/admin/traces/t/performance"
+    assert "#3 Run Completed" in result["text"]
+
+
+def test_poll_without_changes_keeps_the_rendered_tree():
+    result = _eval(
+        "(async () => {" + _ROUTE_THEN_POLL +
+        "  await openRunningTrace();"
+        "  const first = host.children[0];"
+        "  fetchQueue.push(envelope('running'), page([]), performance);"
+        "  await window.AdminTraces.pollEvents();"
+        "  const unchanged = host.children[0] === first;"
+        "  fetchQueue.push(envelope('running'), page([{sequence_no: 2, event_type: 'execution_result', decision_id: 'd'}]), performance);"
+        "  await window.AdminTraces.pollEvents();"
+        "  window.AdminTraces.stopPolling();"
+        "  return {unchanged, rerendered: host.children[0] !== first};"
+        "})()"
+    )
+    assert result == {"unchanged": True, "rerendered": True}
+
+
+def test_an_open_backtest_report_is_fetched_once_per_trace_status():
+    result = _eval(
+        "(async () => {"
+        "  const report = {ok: true, status: 200, body: {available: true, run_id: 'r', run: {llm_model: 'deepseek-v4-pro'}, configuration: {}}};"
+        "  async function openReport(trace) {"
+        "    const panel = byClass(window.AdminTraces.renderTraceDetail(trace, []), 'trace-backtest-report')[0];"
+        "    panel.open = true;"
+        "    await panel.listeners.toggle[0]();"
+        "    return panel;"
+        "  }"
+        "  fetchQueue.push(report);"
+        "  await openReport({trace_id: 't', status: 'running'});"
+        "  const rerendered = await openReport({trace_id: 't', status: 'running'});"
+        "  const whileRunning = fetchCalls.filter(([url]) => url.endsWith('/backtest')).length;"
+        "  fetchQueue.push(report);"
+        "  await openReport({trace_id: 't', status: 'completed'});"
+        "  return {whileRunning, afterCompletion: fetchCalls.filter(([url]) => url.endsWith('/backtest')).length, text: rerendered.textContent};"
+        "})()"
+    )
+    assert result["whileRunning"] == 1
+    assert result["afterCompletion"] == 2
+    assert "Llm Model: deepseek-v4-pro" in result["text"]
+
+
+def test_trading_log_takes_each_fills_reason_from_its_decision():
+    """Tape fills carry no decision_id and decisions record reasoning_summaries
+    (a list, one per action), so the log links through the execution event."""
+    result = _eval(
+        "(() => {"
+        "  const events = ["
+        "    {sequence_no: 1, event_type: 'decision_recorded', decision_id: 'd1', payload: {"
+        "      actions: [{symbol: 'AAPL', action: 'BUY', shares: 10, reason: 'momentum'}, {symbol: 'MSFT', action: 'SELL', shares: 5, reason: 'trim'}],"
+        "      reasoning_summaries: ['momentum', 'trim']}},"
+        "    {sequence_no: 2, event_type: 'execution_result', decision_id: 'd1', payload: {fills: ["
+        "      {timestamp: '2026-05-04T14:00:00Z', symbol: 'MSFT', side: 'SELL', shares: 5, price: 300},"
+        "      {timestamp: '2026-05-04T14:00:00Z', symbol: 'AAPL', side: 'BUY', shares: 10, price: 150}]}},"
+        "  ];"
+        "  const log = byClass(window.AdminTraces.renderTraceDetail({trace_id: 't', status: 'completed'}, events), 'trace-trading-log')[0];"
+        "  return byClass(log, 'trace-log-item').map((item) => ["
+        "    byClass(item, 'trace-log-order')[0].textContent, (byClass(item, 'trace-reason')[0] || {}).textContent]);"
+        "})()"
+    )
+    # Newest first.
+    assert result == [["BUY AAPL", "momentum"], ["SELL MSFT", "trim"]]
+
+
+def test_trading_log_shows_the_latest_fills_and_the_true_count():
+    result = _eval(
+        "(() => {"
+        "  const fills = Array.from({length: 60}, (_, i) => ({symbol: `S${i}`, side: 'BUY', shares: 1, price: 1}));"
+        "  const log = byClass(window.AdminTraces.renderTraceDetail({trace_id: 't', status: 'running'}, [{sequence_no: 1, event_type: 'execution_result', payload: {fills}}]), 'trace-trading-log')[0];"
+        "  const items = byClass(log, 'trace-log-item');"
+        "  return {head: byClass(log, 'eyebrow')[0].textContent, count: items.length, first: byClass(items[0], 'trace-log-order')[0].textContent};"
+        "})()"
+    )
+    assert result == {"head": "Latest 50 of 60 fills", "count": 50, "first": "BUY S59"}
+
+
+def test_trace_detail_tolerates_missing_trace_or_events():
+    result = _eval(
+        "(() => {"
+        "  const empty = (node) => byClass(node, 'panel-empty').map((item) => item.textContent);"
+        "  return [empty(window.AdminTraces.renderTraceDetail({trace_id: 't', status: 'running'}, null)),"
+        "          empty(window.AdminTraces.renderTraceDetail(null, []))];"
+        "})()"
+    )
+    for texts in result:
+        assert "No events recorded yet." in texts
diff --git a/dashboard/frontend/admin.css b/dashboard/frontend/admin.css
index 10342fcf..d6756015 100644
--- a/dashboard/frontend/admin.css
+++ b/dashboard/frontend/admin.css
@@ -289,12 +289,8 @@ th:first-child,td:first-child{padding-left:0}
 .trace-section-title{margin:30px 0 12px;font-size:18px}
 .trace-timeline{display:grid;gap:12px;margin:0;padding:0;list-style:none}
 .trace-event{padding:16px 18px;border:1px solid var(--line);border-radius:4px;background:var(--surface)}
-.trace-event-head{display:flex;align-items:center;gap:10px;flex-wrap:wrap}
-.trace-event-head time{margin-left:auto;color:var(--muted);font-size:11px}
-.trace-sequence{color:var(--accent);font-family:ui-monospace,SFMono-Regular,Menlo,monospace;font-size:11px}
-.trace-event-meta{margin:8px 0 0;color:var(--muted);font-size:11px}
 .trace-event-payload{overflow:auto;margin:12px 0 0;padding:10px;background:var(--bg);color:var(--text);font:11px/1.5 ui-monospace,SFMono-Regular,Menlo,monospace;white-space:pre-wrap;overflow-wrap:anywhere}
-@media(max-width:680px){.trace-metrics{grid-template-columns:repeat(2,1fr)}.trace-metrics .detail-metric{padding:14px 10px}.trace-event-head time{width:100%;margin-left:0}}
+@media(max-width:680px){.trace-metrics{grid-template-columns:repeat(2,1fr)}.trace-metrics .detail-metric{padding:14px 10px}}
 .users-table td .row-action{min-height:32px;padding:4px 10px;font-size:12px}
 .pager{display:flex;align-items:center;gap:12px;margin-top:14px;color:var(--muted);font-size:12px}
 .pager span{flex:1}
@@ -498,9 +494,9 @@ dialog::backdrop{background:rgba(0,0,0,.64)}
 .credits-chart-swatch.credits-chart-byok{background:var(--violet)}
 .credits-chart-swatch.credits-chart-purchased{background:var(--green)}
 
-.trace-performance{margin:24px 0;padding:20px;border:1px solid #334155;border-radius:8px}.trace-performance svg{width:100%;display:block;max-height:360px}.trace-performance-notice{color:#fbbf24}.trace-performance-links{display:flex;flex-wrap:wrap;gap:8px;max-height:180px;overflow:auto}.trace-event:focus{outline:2px solid #38bdf8}
+.trace-performance{margin:24px 0;padding:20px;border:1px solid var(--line);border-radius:8px}.trace-performance svg{width:100%;display:block;max-height:360px}.trace-performance-notice{color:var(--amber)}.trace-performance-links{display:flex;flex-wrap:wrap;gap:8px;max-height:180px;overflow:auto}.trace-event:focus{outline:2px solid var(--accent)}
 
-.trace-group{border:1px solid #334155;border-radius:8px;margin:12px 0}.trace-group-summary{padding:16px;cursor:pointer}.trace-group-summary span{display:block;margin-top:6px}.trace-event-group{list-style:none}.trace-group .trace-event{margin:8px 16px}.trace-technical summary,.trace-run-overview summary{cursor:pointer;padding:12px 0}.trace-downloads{display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin:20px 0}.trace-reason{border-left:2px solid #38bdf8;padding-left:12px}
+.trace-group{border:1px solid var(--line);border-radius:8px;margin:12px 0}.trace-group-summary{padding:16px;cursor:pointer}.trace-group-summary span{display:block;margin-top:6px}.trace-event-group{list-style:none}.trace-group .trace-event{margin:8px 16px}.trace-technical summary,.trace-run-overview summary{cursor:pointer;padding:12px 0}.trace-downloads{display:flex;align-items:center;gap:12px;flex-wrap:wrap;margin:20px 0}.trace-reason{border-left:2px solid var(--accent);padding-left:12px}
 
 /* Trace analysis workspace: configuration, evidence, and executions stay aligned. */
-.trace-three-column{display:grid;grid-template-columns:220px minmax(0,1fr) 280px;gap:12px;align-items:start;margin-top:14px}.trace-context-rail,.trace-trading-log{position:sticky;top:16px;background:var(--bg-card);border:1px solid var(--border-color);border-radius:8px;padding:14px}.trace-analysis-column{min-width:0}.trace-context-rail .trace-run-overview,.trace-context-rail .trace-backtest-report{border:0;border-bottom:1px solid var(--border-color);border-radius:0;padding-bottom:10px;margin-bottom:10px}.trace-context-rail .trace-downloads{display:grid;gap:8px;margin:10px 0}.trace-context-rail .trace-downloads .muted{font-size:11px}.trace-log-head{display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid var(--border-color);padding-bottom:11px;margin-bottom:2px}.trace-log-head h2{font-size:16px;margin:0}.trace-log-item{padding:14px 0;border-bottom:1px solid var(--border-color)}.trace-log-item:last-child{border-bottom:0}.trace-log-order{font-weight:800;color:#54dfa5}.trace-log-item p{margin:6px 0 0;font-size:12px}@media(max-width:900px){.trace-three-column{display:block}.trace-context-rail,.trace-trading-log{position:static;margin-bottom:12px}}
+.trace-three-column{display:grid;grid-template-columns:220px minmax(0,1fr) 280px;gap:12px;align-items:start;margin-top:14px}.trace-context-rail,.trace-trading-log{position:sticky;top:16px;max-height:calc(100vh - 32px);overflow:auto;background:var(--bg-card);border:1px solid var(--border-color);border-radius:8px;padding:14px}.trace-analysis-column{min-width:0}.trace-context-rail .trace-run-overview,.trace-context-rail .trace-backtest-report{border:0;border-bottom:1px solid var(--border-color);border-radius:0;padding-bottom:10px;margin-bottom:10px}.trace-context-rail .trace-downloads{display:grid;gap:8px;margin:10px 0}.trace-context-rail .trace-downloads .muted{font-size:11px}.trace-log-head{display:flex;align-items:center;justify-content:space-between;border-bottom:1px solid var(--border-color);padding-bottom:11px;margin-bottom:2px}.trace-log-head h2{font-size:16px;margin:0}.trace-log-item{padding:14px 0;border-bottom:1px solid var(--border-color)}.trace-log-item:last-child{border-bottom:0}.trace-log-order{font-weight:800;color:var(--green)}.trace-log-item p{margin:6px 0 0;font-size:12px}@media(max-width:900px){.trace-three-column{display:block}.trace-context-rail,.trace-trading-log{position:static;max-height:none;overflow:visible;margin-bottom:12px}}
diff --git a/dashboard/frontend/js/admin-trace-performance.js b/dashboard/frontend/js/admin-trace-performance.js
index 709df36f..8a0bf5ab 100644
--- a/dashboard/frontend/js/admin-trace-performance.js
+++ b/dashboard/frontend/js/admin-trace-performance.js
@@ -3,7 +3,7 @@
   'use strict';
   const svgNS = 'http://www.w3.org/2000/svg';
   function series(events, performance) {
-    const snapshots = (events || []).filter(e => e.event_type === 'decision_recorded')
+    const snapshots = (Array.isArray(events) ? events : []).filter(e => e.event_type === 'decision_recorded')
       .map(e => ({ timestamp: e.payload?.decision_at, equity: e.payload?.state?.equity, event: e }));
     const raw = performance?.points?.length ? performance.points : snapshots;
     const points = raw.filter(p => typeof p.equity === 'number' && Number.isFinite(p.equity) && Number.isFinite(Date.parse(p.timestamp)))
@@ -18,8 +18,8 @@
     panel.appendChild(el('p', 'muted', snapshots
       ? 'Decision equity snapshots · market time (UTC). Sampled observations, not the complete backtest result.'
       : 'Run equity · market time (UTC). One observed outcome, not expected return.'));
-    if (trace.status !== 'completed') panel.appendChild(el('p', 'trace-performance-notice',
-      trace.status === 'failed' ? 'Run failed. Recorded performance is incomplete; inspect the failure in the timeline.' : 'Run in progress. Recorded performance is incomplete.'));
+    if (trace?.status !== 'completed') panel.appendChild(el('p', 'trace-performance-notice',
+      trace?.status === 'failed' ? 'Run failed. Recorded performance is incomplete; inspect the failure in the timeline.' : 'Run in progress. Recorded performance is incomplete.'));
     if (performance?.unavailable) panel.appendChild(el('p', 'muted', 'Performance refresh unavailable. Showing recorded snapshots or previously loaded data.'));
     if (points.length < 2) {
       panel.appendChild(el('p', 'panel-empty', points.length ? 'Only one equity observation is available; a curve requires two.' : 'No equity observations recorded for this run.'));
@@ -51,9 +51,10 @@
     const plotted = points.length > 1000 ? Array.from({length: 1000}, (_, i) => points[Math.round(i * (points.length - 1) / 999)]) : points;
     shape('polyline', { points: plotted.map(p => `${x(p.time)},${y(p.equity)}`).join(' '), fill: 'none', stroke: '#38bdf8', 'stroke-width': 2 });
     [points[0], points.at(-1)].forEach((p, i) => shape('text', { x: i ? 875 : 75, y: 245, 'text-anchor': i ? 'end' : 'start', fill: 'currentColor', 'font-size': 12 }, new Date(p.time).toISOString().slice(0, 16).replace('T', ' ')));
-    const decisions = new Map((events || []).filter(e => e.decision_id && e.event_type === 'decision_recorded').map(e => [e.decision_id, e]));
+    const items = Array.isArray(events) ? events : [];
+    const decisions = new Map(items.filter(e => e.decision_id && e.event_type === 'decision_recorded').map(e => [e.decision_id, e]));
     const links = el('div', 'trace-performance-links');
-    (events || []).filter(e => e.event_type === 'execution_result' && e.payload?.fills?.length).forEach(e => {
+    items.filter(e => e.event_type === 'execution_result' && e.payload?.fills?.length).forEach(e => {
       const decision = decisions.get(e.decision_id);
       if (!decision) return;
       const time = Date.parse(decision.payload?.decision_at);
diff --git a/dashboard/frontend/js/admin-trace-timeline.js b/dashboard/frontend/js/admin-trace-timeline.js
index a3b29409..c4d8754d 100644
--- a/dashboard/frontend/js/admin-trace-timeline.js
+++ b/dashboard/frontend/js/admin-trace-timeline.js
@@ -26,8 +26,9 @@
   function render(events, openState = {}) {
     const el = window.AdminShell.el;
     const list = el('ol', 'trace-timeline');
-    if (!events?.length) { list.appendChild(el('li', 'panel-empty', 'No events recorded yet.')); return list; }
-    groupEvents(events).forEach(group => {
+    const items = Array.isArray(events) ? events : [];
+    if (!items.length) { list.appendChild(el('li', 'panel-empty', 'No events recorded yet.')); return list; }
+    groupEvents(items).forEach(group => {
       const li = el('li', 'trace-event-group');
       const details = el('details', 'trace-group');
       details.setAttribute('data-trace-expand', group.key);
diff --git a/dashboard/frontend/js/admin-traces.js b/dashboard/frontend/js/admin-traces.js
index 20c72812..f4fc1bcf 100644
--- a/dashboard/frontend/js/admin-traces.js
+++ b/dashboard/frontend/js/admin-traces.js
@@ -3,6 +3,8 @@
   'use strict';
 
   const SURFACE = 'traces';
+  const TERMINAL_EVENTS = ['run_completed', 'run_failed'];
+  const TRADING_LOG_LIMIT = 50;
   const state = {
     traceId: null, trace: null, events: [], nextSequence: 0,
     pollTimer: null, stale: false, context: {}, listItems: [], listHasMore: false, listNextCursor: 0,
@@ -138,60 +140,147 @@
       metrics.appendChild(metric);
     });
     section.appendChild(metrics);
+    const items = Array.isArray(events) ? events : [];
     const columns = node('div', 'trace-three-column');
-    const leftRail = node('aside', 'trace-context-rail');
     const centerColumn = node('div', 'trace-analysis-column');
-    const rightRail = node('aside', 'trace-trading-log');
-    const config = trace?.initial_input || events.find(e => e.event_type === 'run_started')?.payload?.config_summary || {};
-    const overview = node('details', 'trace-run-overview');
-    overview.setAttribute('data-trace-expand', 'run-configuration');
-    overview.open = Boolean(state.openState?.['run-configuration']);
-    overview.appendChild(node('summary', '', 'Run configuration'));
-    const fields = [['Agent', trace?.agent_id], ['Run', trace?.run_id], ['Model', config.model || config.model_name], ['Market / data source', config.market || config.data_source], ['Start date', config.start_date], ['End date', config.end_date], ['Initial capital', config.initial_capital ?? config.initial_equity]];
+    if (window.AdminTracePerformance) centerColumn.appendChild(window.AdminTracePerformance.render(trace, items, performance));
+    const title = node('h2', 'trace-section-title', 'Timeline');
+    centerColumn.appendChild(title);
+    centerColumn.appendChild(renderEventTimeline(items));
+    columns.append(renderContextRail(trace, items), centerColumn, renderTradingLog(items));
+    section.appendChild(columns);
+    return section;
+  }
+
+  // A <details> whose open state survives the poll's re-render: capture()
+  // records every [data-trace-expand] before the old tree is cleared.
+  function disclosure(className, key, label) {
+    const details = node('details', className);
+    details.setAttribute('data-trace-expand', key);
+    details.open = Boolean(state.openState?.[key]);
+    details.appendChild(node('summary', '', label));
+    return details;
+  }
+
+  function renderContextRail(trace, events) {
+    const rail = node('aside', 'trace-context-rail');
+    const config = trace?.initial_input || events.find((event) => event.event_type === 'run_started')?.payload?.config_summary || {};
+    const overview = disclosure('trace-run-overview', 'run-configuration', 'Run configuration');
+    const fields = [
+      ['Agent', trace?.agent_id], ['Run', trace?.run_id], ['Model', config.model || config.model_name],
+      ['Market / data source', config.market || config.data_source], ['Start date', config.start_date],
+      ['End date', config.end_date], ['Initial capital', config.initial_capital ?? config.initial_equity],
+    ];
     fields.forEach(([label, v]) => overview.appendChild(node('p', '', `${label}: ${v == null ? 'Not recorded' : String(v)}`)));
-    const configRaw = node('details'); configRaw.appendChild(node('summary', '', 'Recorded configuration (JSON)'));
-    configRaw.appendChild(node('pre', 'trace-event-payload', payloadText(config))); overview.appendChild(configRaw);
-    leftRail.appendChild(overview);
-    const report = node('details', 'trace-backtest-report');
-    report.setAttribute('data-trace-expand', 'backtest-report');
-    report.appendChild(node('summary', '', 'View this backtest · admin read-only'));
-    const reportBody = node('div'); report.appendChild(reportBody);
-    let reportLoaded = false;
+    const configRaw = disclosure('', 'run-configuration-json', 'Recorded configuration (JSON)');
+    configRaw.appendChild(node('pre', 'trace-event-payload', payloadText(config)));
+    overview.appendChild(configRaw);
+    rail.appendChild(overview);
+    if (!trace?.trace_id) return rail;
+    rail.appendChild(renderBacktestReport(trace));
+    const downloads = node('div', 'trace-downloads');
+    [['json', 'Export JSON'], ['markdown', 'Export Markdown']].forEach(([format, label]) => {
+      const link = node('a', 'auth-btn auth-btn-secondary', label);
+      link.setAttribute('href', `/api/admin/traces/${encodeURIComponent(trace.trace_id)}/export?format=${format}`);
+      link.setAttribute('download', '');
+      downloads.appendChild(link);
+    });
+    downloads.appendChild(node('span', 'muted', 'All recorded events · running traces export a fixed snapshot'));
+    rail.appendChild(downloads);
+    return rail;
+  }
+
+  // One request per trace and status, shared by every re-render: the poll
+  // rebuilds this panel, and restoring `open` fires `toggle` on the new
+  // element. A status change re-fetches once, because the stored result is
+  // written when the run finishes.
+  function loadBacktestReport(trace) {
+    const key = `${trace.trace_id}:${trace.status}`;
+    if (state.report?.key !== key) {
+      const promise = shell().request(`/api/admin/traces/${encodeURIComponent(trace.trace_id)}/backtest`);
+      state.report = { key, promise };
+      promise.catch(() => {
+        if (state.report?.promise === promise) state.report = null;
+      });
+    }
+    return state.report.promise;
+  }
+
+  function renderBacktestReport(trace) {
+    const report = disclosure('trace-backtest-report', 'backtest-report', 'View this backtest · admin read-only');
+    const body = node('div');
+    report.appendChild(body);
+    let shown = false;
     report.addEventListener('toggle', async () => {
-      if (!report.open || reportLoaded) return;
-      reportLoaded = true; reportBody.textContent = 'Loading backtest…';
+      if (!report.open || shown) return;
+      shown = true;
+      body.textContent = 'Loading backtest…';
       try {
-        const data = await shell().request(`/api/admin/traces/${encodeURIComponent(trace.trace_id)}/backtest`);
-        shell().clear(reportBody);
-        if (!data.available) { reportBody.textContent = 'No stored backtest result for this exact run. Trace events remain available.'; return; }
-        Object.entries(data.run).forEach(([key, v]) => reportBody.appendChild(node('p', '', `${shell().humanize(key)}: ${v == null ? 'Not recorded' : String(v)}`)));
-        const raw = node('details'); raw.appendChild(node('summary', '', 'Recorded backtest configuration'));
-        raw.appendChild(node('pre', 'trace-event-payload', payloadText(data.configuration))); reportBody.appendChild(raw);
+        const data = await loadBacktestReport(trace);
+        shell().clear(body);
+        if (!data?.available) {
+          body.textContent = 'No stored backtest result for this exact run. Trace events remain available.';
+          return;
+        }
+        Object.entries(data.run || {}).forEach(([key, v]) => body.appendChild(node('p', '', `${shell().humanize(key)}: ${v == null ? 'Not recorded' : String(v)}`)));
+        const raw = disclosure('', 'backtest-configuration-json', 'Recorded backtest configuration');
+        raw.appendChild(node('pre', 'trace-event-payload', payloadText(data.configuration)));
+        body.appendChild(raw);
       } catch (error) {
         if (await shell().handleAccessLost(error)) return;
-        reportLoaded = false; reportBody.textContent = 'Backtest details unavailable. Close and reopen to retry.';
+        shown = false;
+        body.textContent = 'Backtest details unavailable. Close and reopen to retry.';
       }
     });
-    report.open = Boolean(state.openState?.['backtest-report']);
-    leftRail.appendChild(report);
-    const downloads = node('div', 'trace-downloads');
-    [['json', 'Export JSON'], ['markdown', 'Export Markdown']].forEach(([format, label]) => {
-      const link = node('a', 'auth-btn auth-btn-secondary', label);
-      link.setAttribute('href', `/api/admin/traces/${encodeURIComponent(trace.trace_id)}/export?format=${format}`);
-      link.setAttribute('download', ''); downloads.appendChild(link);
+    return report;
+  }
+
+  // Fills carry no decision_id; their execution_result event does, and the
+  // decision's reasoning is per action, so a fill takes the reason of the
+  // action on its symbol (and side, when both name one).
+  function fillReason(decision, fill) {
+    const payload = decision?.payload || {};
+    const actions = Array.isArray(payload.actions) ? payload.actions : [];
+    const reasons = Array.isArray(payload.reasoning_summaries) ? payload.reasoning_summaries : [];
+    const side = String(fill.side || '').toUpperCase();
+    const onSymbol = (action) => action && action.symbol === fill.symbol;
+    let index = actions.findIndex((action) => onSymbol(action) && String(action.action || action.side || '').toUpperCase() === side);
+    if (index < 0) index = actions.findIndex(onSymbol);
+    const matched = index < 0 ? null : (reasons[index] || actions[index].reason || actions[index].reasoning);
+    if (typeof matched === 'string' && matched) return matched;
+    const distinct = [...new Set(reasons.filter((reason) => typeof reason === 'string' && reason))];
+    return distinct.length === 1 ? distinct[0] : null;
+  }
+
+  function renderTradingLog(events) {
+    const rail = node('aside', 'trace-trading-log');
+    const decisions = new Map(events
+      .filter((event) => event.event_type === 'decision_recorded' && event.decision_id)
+      .map((event) => [event.decision_id, event]));
+    const fills = events.flatMap((event) => (
+      event.event_type === 'execution_result' && Array.isArray(event.payload?.fills)
+        ? event.payload.fills.map((fill) => ({ fill, decision: decisions.get(event.decision_id) }))
+        : []
+    ));
+    // Newest first, so a running trace shows its latest fills without scrolling.
+    const shown = fills.slice(-TRADING_LOG_LIMIT).reverse();
+    const count = `${fills.length} fill${fills.length === 1 ? '' : 's'}`;
+    const head = node('div', 'trace-log-head');
+    head.append(node('h2', '', 'Trading log'), node('span', 'eyebrow', shown.length < fills.length ? `Latest ${shown.length} of ${count}` : count));
+    rail.appendChild(head);
+    if (!fills.length) rail.appendChild(node('p', 'panel-empty', 'No execution fills recorded.'));
+    shown.forEach(({ fill, decision }) => {
+      const item = node('article', 'trace-log-item');
+      const side = String(fill.side || fill.action || 'ORDER').toUpperCase();
+      item.append(
+        node('div', 'trace-log-order', `${side} ${value(fill.symbol || 'Unknown symbol')}`),
+        node('p', 'muted', `${fill.quantity ?? fill.shares ?? '—'} shares · ${fill.price == null ? 'Price not recorded' : fill.price}`),
+      );
+      const reason = fillReason(decision, fill);
+      if (reason) item.appendChild(node('p', 'trace-reason', reason));
+      rail.appendChild(item);
     });
-    downloads.appendChild(node('span', 'muted', 'All recorded events · running traces export a fixed snapshot'));
-    leftRail.appendChild(downloads);
-    if (window.AdminTracePerformance) centerColumn.appendChild(window.AdminTracePerformance.render(trace, events, performance));
-    const title = node('h2', 'trace-section-title', 'Timeline');
-    centerColumn.appendChild(title);
-    centerColumn.appendChild(renderEventTimeline(events));
-    const fills = events.flatMap(e => (e.event_type === 'execution_result' ? (e.payload?.fills || []) : [])).slice(0, 50);
-    const logHead = node('div', 'trace-log-head'); logHead.append(node('h2', '', 'Trading log'), node('span', 'eyebrow', `${fills.length} fills`)); rightRail.appendChild(logHead);
-    if (!fills.length) rightRail.appendChild(node('p', 'panel-empty', 'No execution fills recorded.'));
-    fills.forEach(fill => { const item = node('article', 'trace-log-item'); const side = String(fill.side || fill.action || 'ORDER').toUpperCase(); item.append(node('div', 'trace-log-order', `${side} ${value(fill.symbol || 'Unknown symbol')}`), node('p', 'muted', `${fill.quantity ?? fill.shares ?? '—'} shares · ${fill.price == null ? 'Price not recorded' : fill.price}`)); const decision = events.find(e => e.event_type === 'decision_recorded' && e.decision_id === fill.decision_id); if (decision?.payload?.reasoning_summary) item.append(node('p', 'trace-reason', decision.payload.reasoning_summary)); rightRail.appendChild(item); });
-    columns.append(leftRail, centerColumn, rightRail); section.appendChild(columns);
-    return section;
+    return rail;
   }
 
   function renderStaleNotice(host, message) {
@@ -261,13 +350,16 @@
     stopPolling();
     const seq = shell().nextSeq(SURFACE);
     try {
-      let trace = await shell().request(`/api/admin/traces/${encodeURIComponent(traceId)}`);
-      const events = await loadAllEvents(traceId);
-      const performance = await loadPerformance(traceId);
-      const terminal = [...events].reverse().find((event) => ['run_completed', 'run_failed'].includes(event.event_type));
-      if (terminal) trace = await refreshTraceEnvelope(traceId);
+      // Envelope first: the store appends a terminal event before it marks the
+      // trace terminal, so events read after a terminal envelope are complete.
+      let trace = await refreshTraceEnvelope(traceId);
+      const [events, performance] = await Promise.all([loadAllEvents(traceId), loadPerformance(traceId)]);
+      if (trace.status === 'running' && hasTerminalEvent(events)) trace = await refreshTraceEnvelope(traceId);
       if (!shell().isCurrent(SURFACE, seq)) return;
-      if (state.traceId !== traceId) state.openState = {};
+      if (state.traceId !== traceId) {
+        state.openState = {};
+        state.report = null;
+      }
       state.traceId = traceId;
       state.context = { ...context };
       state.trace = trace;
@@ -299,27 +391,50 @@
     catch (_error) { return { ...(previous || {}), unavailable: true }; }
   }
 
+  function hasTerminalEvent(events) {
+    return events.some((event) => TERMINAL_EVENTS.includes(event.event_type));
+  }
+
+  function performanceSignature(performance) {
+    return JSON.stringify([
+      performance?.point_count, performance?.unavailable, performance?.partial,
+      performance?.metrics, performance?.points?.[performance.points.length - 1],
+    ]);
+  }
+
   async function pollEvents() {
     if (!state.traceId || !state.trace || state.trace.status !== 'running') return;
     const traceId = state.traceId;
     const seq = shell().nextSeq(SURFACE);
     try {
-      const fresh = await loadAllEvents(traceId, state.nextSequence);
-      const performance = await loadPerformance(traceId, state.performance);
+      // Envelope before events (see loadDetail): a trace that turns terminal
+      // between the two reads is caught by the next poll, never by stopping
+      // with its last flush and terminal event unread.
       const envelope = await refreshTraceEnvelope(traceId);
+      const [fresh, performance] = await Promise.all([
+        loadAllEvents(traceId, state.nextSequence),
+        loadPerformance(traceId, state.performance),
+      ]);
       if (!shell().isCurrent(SURFACE, seq) || state.traceId !== traceId) return;
+      const added = fresh.filter((event) => event.sequence_no > state.nextSequence);
+      const changed = added.length > 0
+        || state.stale
+        || envelope.status !== state.trace.status
+        || envelope.ended_at !== state.trace.ended_at
+        || performanceSignature(performance) !== performanceSignature(state.performance);
       state.trace = envelope;
       state.performance = performance;
-      {
-        state.events = state.events.concat(fresh.filter((event) => event.sequence_no > state.nextSequence));
-        state.nextSequence = state.events.length ? state.events[state.events.length - 1].sequence_no : state.nextSequence;
-
-        const host = element('tracesView');
-        if (host && state.trace) {
-          state.openState = window.AdminTraceTimeline.capture(host);
-          shell().clear(host);
-          host.appendChild(renderTraceDetail(state.trace, state.events, state.context, state.performance));
-        }
+      state.events = state.events.concat(added);
+      state.nextSequence = state.events.length ? state.events[state.events.length - 1].sequence_no : state.nextSequence;
+      const host = element('tracesView');
+      // Re-render only on a change: a rebuild drops focus, selection and any
+      // disclosure capture() cannot see, every three seconds otherwise.
+      if (changed && host) {
+        state.openState = window.AdminTraceTimeline.capture(host);
+        const focusedId = document.activeElement?.id;
+        shell().clear(host);
+        host.appendChild(renderTraceDetail(state.trace, state.events, state.context, state.performance));
+        if (focusedId) document.getElementById(focusedId)?.focus?.({ preventScroll: true });
       }
       state.stale = false;
       if (state.trace.status === 'running') state.pollTimer = setTimeout(pollEvents, 3000);
diff --git a/docs/superpowers/plans/2026-10-09-admin-trace-performance.md b/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
index 8cc00726..6d9c857f 100644
--- a/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
+++ b/docs/superpowers/plans/2026-10-09-admin-trace-performance.md
@@ -13,3 +13,10 @@ Approved: collapsed event summaries, decision/step grouping, raw JSON behind a s
 Admin backtest details use an admin-gated exact-run projection across owners, rather than redirecting to the session-filtered trading interface. Display only stored fields and explicit missing-result states.
 
 Exports: admin-only JSON and Markdown, schema version and snapshot timestamp, fixed highest event sequence, all pages through that sequence, sensitive-field redaction, artifact references only. Build the output in a spooled temporary file before returning headers. Test >100 events, concurrent append, permission rejection, readable/escaped Markdown, and cross-owner exact-run lookup.
+
+## Review fixes (2026-10-13)
+
+- Polling reads the trace envelope before events. The store appends a terminal event before it marks the trace terminal, so events read after a terminal envelope are complete; the reverse order could stop polling with the last flush unread. The detail view re-renders only when events, status or performance changed.
+- Performance reports the run's stored `total_return` and `max_drawdown`, the figures the backtest panel shows, rather than a recomputation against the first equity mark.
+- The trading log links fills to reasoning through the execution event's `decision_id` (fills carry none) and the per-action `reasoning_summaries`, and shows the latest 50 fills newest first with the true count.
+- Exports take their status from the events inside the boundary, report failed runs as failed, match sensitive keys by word (token counts and `open_session_excluded` stay visible), escape agent text in Markdown so it cannot plant links or images, and use linear-time patterns on agent text.