@@ -13,6 +13,21 @@ function sleep(ms: number): Promise<void> {
   return new Promise((resolve) => setTimeout(resolve, ms));
 }
 
+/**
+ * Classifies a `getBuildLogs` failure during a follow/first-page fetch as fatal
+ * (surface + exit) vs transient (retry). A client error (4xx) is permanent —
+ * the build is gone, access was revoked, or the CLI is too old (426
+ * `cli_outdated`) — so retrying can't fix it; it is fatal, matching how the rest
+ * of the CLI surfaces 426 (see `deploy-errors.ts`, `github-cmd.ts`). The sole
+ * exception is 429 (rate limit), which IS transient. Everything else
+ * (5xx/timeout/DO-read blip) is transient and retried through.
+ */
+export function isFatalFollowError(err: unknown): boolean {
+  return (
+    err instanceof PlatformApiError && err.status >= 400 && err.status < 500 && err.status !== 429
+  );
+}
+
 /**
  * Pure follow-loop: repeatedly fetch pages since a cursor, write each new
  * line, and stop when the build reaches a terminal status. `fetchPage`,
@@ -121,12 +136,8 @@ async function runBuildLogsCommand(
     ? (line: string): void => appendFileSync(args.output!, `${line}\n`)
     : (line: string): void => console.log(line);
 
-  // Auth/not-found errors are fatal (the build is gone or access was revoked);
-  // everything else is a transient blip we retry through. Hoisted so the SAME
+  // `isFatalFollowError` decides fatal vs transient (see its doc). The SAME
   // policy governs both the first-page fetch below and the follow loop.
-  const isFatal = (err: unknown): boolean =>
-    err instanceof PlatformApiError &&
-    (err.status === 401 || err.status === 403 || err.status === 404);
   const onRetry = (err: unknown): void =>
     log.warn(
       `build: transient error while following (${err instanceof Error ? err.message : String(err)}); retrying…`,
@@ -142,7 +153,7 @@ async function runBuildLogsCommand(
       first = await client.getBuildLogs(projectId, buildId, 0);
       break;
     } catch (err) {
-      if (isFatal(err)) {
+      if (isFatalFollowError(err)) {
         if (err instanceof PlatformApiError && err.status === 404) {
           log.error(`build: Build '${buildId}' not found for this project.`);
         } else {
@@ -187,7 +198,7 @@ async function runBuildLogsCommand(
       sleep,
       since: first.lastSeq,
       status,
-      isFatal,
+      isFatal: isFatalFollowError,
       onRetry,
     }));
   }
 
@@ -1,11 +1,36 @@
 import { describe, expect, it } from 'vite-plus/test';
-import { followBuildLogs } from '../../src/cli/build-cmd.ts';
-import type { BuildLogsResponse } from '../../src/cli/client.ts';
+import { followBuildLogs, isFatalFollowError } from '../../src/cli/build-cmd.ts';
+import { PlatformApiError, type BuildLogsResponse } from '../../src/cli/client.ts';
 
 function page(partial: Partial<BuildLogsResponse>): BuildLogsResponse {
   return { lines: [], lastSeq: 0, status: 'building', terminal: false, external: null, ...partial };
 }
 
+function apiError(status: number, body = '{}'): PlatformApiError {
+  return new PlatformApiError('build logs', status, body);
+}
+
+describe('isFatalFollowError', () => {
+  it('treats every 4xx except 429 as fatal (including 426 cli_outdated)', () => {
+    // 426 is the reviewer's case: a too-old CLI must exit, not retry forever.
+    for (const status of [400, 401, 403, 404, 409, 410, 422, 426]) {
+      expect(isFatalFollowError(apiError(status))).toBe(true);
+    }
+  });
+
+  it('treats 429 (rate limit) as transient — the tail must survive it', () => {
+    expect(isFatalFollowError(apiError(429))).toBe(false);
+  });
+
+  it('treats 5xx and non-PlatformApiError failures as transient', () => {
+    expect(isFatalFollowError(apiError(500))).toBe(false);
+    expect(isFatalFollowError(apiError(502))).toBe(false);
+    expect(isFatalFollowError(apiError(503))).toBe(false);
+    expect(isFatalFollowError(new Error('network blip'))).toBe(false);
+    expect(isFatalFollowError('nope')).toBe(false);
+  });
+});
+
 describe('followBuildLogs', () => {
   it('polls from the cursor, writes new lines in order, and stops when terminal', async () => {
     const pages: Array<BuildLogsResponse> = [
@@ -97,4 +122,45 @@ describe('followBuildLogs', () => {
       }),
     ).rejects.toThrow('unauthorized');
   });
+
+  it('under the real predicate, a 426 cli_outdated rethrows (surfacing the upgrade message)', async () => {
+    await expect(
+      followBuildLogs({
+        fetchPage: () =>
+          Promise.reject(
+            apiError(426, '{"error":"cli_outdated","message":"Upgrade: npm i -g void@latest"}'),
+          ),
+        write: () => {},
+        sleep: () => Promise.resolve(),
+        since: 1,
+        status: 'building',
+        pollMs: 0,
+        isFatal: isFatalFollowError,
+      }),
+    ).rejects.toThrow('Upgrade: npm i -g void@latest');
+  });
+
+  it('under the real predicate, a 429 is retried (not fatal)', async () => {
+    let call = 0;
+    const retries: Array<unknown> = [];
+    const result = await followBuildLogs({
+      fetchPage: () => {
+        call += 1;
+        if (call === 1) {
+          return Promise.reject(apiError(429, '{"error":"rate_limited"}'));
+        }
+        return Promise.resolve(page({ lastSeq: 5, status: 'complete', terminal: true }));
+      },
+      write: () => {},
+      sleep: () => Promise.resolve(),
+      since: 4,
+      status: 'building',
+      pollMs: 0,
+      isFatal: isFatalFollowError,
+      onRetry: (err) => retries.push(err),
+    });
+
+    expect(retries).toHaveLength(1); // the 429 was retried, not thrown
+    expect(result).toEqual({ status: 'complete', terminal: true });
+  });
 });