[nwparker]

	Files	Added	Deleted	Net
Test	4	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​188	$\color{#cf222e}{\Huge{\mathbf{−}}}$​20	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​168
Prod	5	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​57	$\color{#cf222e}{\Huge{\mathbf{−}}}$​14	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​43

ELI5

Sending review notes to Claude or Codex can leave the notes parked in the composer because the renderer sends Enter only 50 ms after a separate paste RPC. On supporting runtimes, notes now use the existing host-owned prompt transaction and wait for its submission verifier.

What Changed

• Advertise optional guarded prompt support on terminal.agentStatus only for proven settlement agents.
• Allow guarded combined text/Enter only through sendTerminalAgentPrompt, retaining exact PTY and permission checks before both writes.
• Route notes through that transaction; retain the current fallback for older/unsupported hosts and never re-paste after an ambiguous verified result.
• Add local/paired notes regressions and guarded durable receipt replay coverage.

Why

The execution host already owns paste ingestion timing, serialization, cancellation and submission verification. Reusing that path removes the notes caller's independent timer without introducing another verifier.

Linked Issue

Partial coverage of STA-5642 (notes path) and STA-4495 (remaining caller asymmetry). No complete historical ticket closure is claimed. Exact dispositions for all 18 assigned reports are included below; the working report remains local and untracked.

Existing open work is preserved: startup/recipe bindings #18996 / #16716, CLI attribution #18020, automation completion #18087, large-paste core #15698 / #18196, composer proof #18022, receipt/non-turn handling #16198, and shell startup #15275. This draft does not duplicate those fixes or change their branches.

Visual Proof

Incomplete for the changed interaction. Rebuilt this worktree and launched it with ORCA_BACKGROUND_LAUNCH=1, an isolated app profile, and CDP; verified app.getIdentity and inspected the hidden welcome-screen screenshot. No workspaces or agent sessions were opened. This proves rendering/startup only, not before/after notes delivery.

Stopped validation after startup unexpectedly granted managed hook trust in the real Codex home as well as the isolated runtime home. The app-profile override does not isolate provider bootstrap; the existing E2E home-isolation harness is required for further live proof. No user configuration rollback or session cleanup was attempted. The validation detail below records the precise source and observations.

Testing

• I manually tested the notes interaction with live providers
• Automated tests added/updated

All tests and app launches used ORCA_BACKGROUND_LAUNCH=1. On macOS: 129 tests passed across eight focused runtime/renderer suites; pnpm tc:node, pnpm tc:web, focused oxlint, changed-code quality, and diff whitespace checks passed. Deterministic coverage includes Windows/POSIX/SSH write-host ingestion, permission/cancellation, local/paired notes routing, old-host fallback, and guarded idempotent receipt replay. No live Windows/WSL/SSH provider run.

Review

New clients require the additive support flag; old clients ignore it. Unsupported or changed targets cannot downgrade a guarded combined send into shell input. Renderer calls do not yet supply durable orchestration request IDs, and the incumbent verifier's limitations for local slash commands and pre-existing drafts remain.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer content copied.

Checklist

• Focused change, self-reviewed, compatibility considered
• Problem, behavior and validation explained
• Before/after interaction proof attached
• Full lint/test/build matrix passes (focused checks above only)

Exact issue accounting

No complete historical ticket closure is claimed by this draft.

Issue	Disposition and evidence
STA-4495	Partial: notes now reuse the shipped verifier; silent-success half already changed in v1.4.187 per latest corrective comment. Core composer/receipt work remains in #18022 / #16198.
STA-2380	Pending existing #10020 for launchAgent/quiescence trust gate; Codex MCP input-missing variant explicitly outside that PR and not reproduced here.
STA-3793	Pending: Codex MCP cold-start loss not exercised by this notes repair; historical presence/readiness asymmetry is not closure evidence.
STA-2655	Pending: comments identify both composer-pending and input-missing variants; no blanket historical closure. Related #10020 / #18022.
STA-2912	Pending existing #15698 (large atomic paste) and #18196 (render-gate ingestion floor). Main already has size-dependent host ingestion; no duplicate core patch.
STA-4318	Pending: Windows/macOS Claude worker symptoms remain outside notes caller coverage; #18022 / #16198 overlap.
STA-5642	Partial: notes half fixed through host transaction. Startup agent-paste-draft.ts remains separate and overlaps #16716 / #18996; 50 ms fallback retained for old hosts.
STA-5951	Pending existing #18020: interactive CLI launchAgent inference already has a focused open fix, including remote clients.
STA-6211	Partial mechanism coverage only: notes change does not close worker cold delivery or wrong-pane capability binding; latter belongs to identity worker. #18022 addresses composer proof.
STA-5869	Pending: manual Enter recovery/capability revocation is orchestration core, overlapping #16198 / #15941; no timeout inflation here.
STA-6779	Pending: automation reuse still calls renderer submit helper; selected-session submission and #18996 integration need validation. Resource worker owns reuse ownership.
STA-6437	Pending existing #15275 late shell-ready startup-command repair; shell readiness is distinct from agent readiness and untouched. Current daemon startup tests already exercise shell-ready routing.
STA-6432	Pending existing #18087: fresh working-to-done completion fence; no duplicate automation edit.
STA-6755	Pending existing #18996: configured Enter/Ctrl+Enter setting and recipe/reuse submit bytes. Do not claim fixed by routing notes.
STA-5379	Pending: historical Git AI action recipe symptom not reproduced; startup caller overlaps #18996 / #16716.
STA-5150	Pending existing #16198 and #16290: local slash-command/non-turn verdict and dirty composer refusal are distinct. Notes errors never trigger automatic re-paste, but no new local-command success outcome.
STA-6763	Pending: description is title-only; comments propose timeout inflation without measured evidence. No arbitrary acknowledgment-window change.
STA-2631	Partial existing guards regression-tested; current verifier already blocks permission sequences. Historical trust/Antigravity scrollback detection requires live provider reproduction; #10020 is adjacent.

All PR numbers above link under https://github.com/stablyai/orca/pull/<number> and were found open when checked, not treated as merged fixes.

Recorded validation detail

• All commands used ORCA_BACKGROUND_LAUNCH=1.
• pnpm tc:node and pnpm tc:web: passed.
• Focused oxlint, changed-code quality (native/type-aware/React Doctor: zero findings), and git diff --check: passed.
• Final focused regressions: 8 files, 129 tests passed, including Windows ingestion, runtime submission, RPC guard, durable receipt replay, old-host notes fallback, and new local/paired notes tests.
• New coverage: single large notes RPC on local/paired targets, wait for verified result, permission refusal, no automatic replay after ambiguous failure, guarded transaction routing/rechecks, signal forwarding, rejection after settlement support changes, durable guarded receipt replay without duplicate body/Enter.
• Existing focused suites cover Windows/POSIX host ingestion, SSH Windows write-host selection, permission/cancellation, small/large prompt verification, durable receipts, and old-host focused/explicit notes paths. These are deterministic tests on macOS, not live Windows/SSH/WSL end-to-end proof.
• Coordinator supplied the Electron skill after local lookup failed. Rebuilt and launched this worktree hidden with isolated ORCA_DEV_USER_DATA_PATH, CDP 9341 and renderer 5183; app.getIdentity confirmed this checkout. Inspected /tmp/orca-prompt-hidden-renderer.png: empty workspace welcome screen, zero terminal sessions. This is startup/render proof only, not before/after notes-delivery evidence; manual checklist remains unchecked.
• Validation stopped after startup unexpectedly logged two codex-trust-grant messages with host=native, wrote=true (8 managed hook entries). Isolated app profile does not fully isolate provider bootstrap. Escalated to coordinator, launched no agents, performed no config rollback; stopped only recorded validation process tree and verified both ports closed. Own-profile ledger confirms the two affected homes: /Users/nwparker/.codex and /tmp/orca-prompt-delivery-validation-profile/codex-runtime-home/home, each 8 entries. Source is codex-real-home-hook-install.ts real-home grant with useDefaultCodexHome: true; native launcher deletes CODEX_HOME. Existing tests/e2e/helpers/electron-home-isolation.ts is the required full home boundary. ORCA_DISABLE_CODEX_TRUST_RPC alone does not prevent all hook/config writes.

[oliver-mee]

I adapted this notes-send change into a combined browser test checkout and exercised the paired desktop path with browser hosting set to This device. The test picks an element, saves an annotation and uses Send to target a real PTY receiver running the existing slow-composer fixture.

The receiver confirmed bracketed-paste framing, the expected annotation text and one submitted Enter, with zero premature or swallowed Enters. The paired Electron test passed. Both Node and renderer typechecks also passed on that integration checkout.

This is evidence for the approach, not acceptance of this exact PR head: it needed adaptation to the combined checkout, and this branch is currently conflicted. The fixture must start the receiver after capturing the annotation, otherwise terminal creation interferes with the browser interaction. No live model request or Windows acceptance is claimed.

[oliver-mee]

I refreshed the integration proof onto main ba6599eab plus the existing client-hosted controls branch, without carrying the superseded profile implementation. The adapted notes transaction and fixture are preserved on test/notes-current-main at fd54bbddd, for reuse here rather than a competing notes PR.

52 focused prompt-delivery, receipt and notes tests pass, along with Node and renderer typechecks. The paired Electron Send test passed against the rebuilt app: the real PTY receiver reported contractOk: true, bracketed-paste framing, the expected marker, exactly one received Enter, zero premature Enters and zero swallowed Enters.

The first app run failed before Send because the hidden-window viewport menu did not reopen. The fixture now closes it by its actual trigger state rather than sending blind Escape keys; the next run passed. That failure is retained, not hidden as a clean initial run. This remains adapted integration evidence, not acceptance of this PR's exact head, and it does not claim Windows, installed packages or live model requests.

[oliver-mee]

The notes port is now isolated from the browser-controls integration: 3940045c46 contains only nine notes/runtime files on main c2b336444, with Neil credited as co-author. There is no separate competing PR.

55 focused tests, Node/renderer typechecks and scoped lint pass. Disabling the guarded transaction makes four new tests fail; restoring it returns all 55 to passing. The additional tests cover refused submission and no replay after an ambiguous result.

Standalone Electron acceptance is now included in follow-up d3a5eeebbb: create a saved review note, choose the existing synthetic Codex receiver from the real Send menu, and verify the slow-composer PTY received bracketed paste, the expected marker and exactly one Enter, with zero premature or swallowed Enters. This uses the rebuilt standalone application with isolated home/profile, not the browser-controls integration.

The initial run failed before Send because the synthetic receiver had no discoverable idle target. The fixture now supplies idle status through the real agent-hook endpoint before opening the menu; the next run passes. The earlier failure trace is retained. No live model/provider request or Windows acceptance is claimed. The earlier paired proof remains separate integration evidence.

Standalone paired-host acceptance is now published in ce5a264f2. A separate hidden Electron client pairs to an isolated headless host, saves a review note, selects the host's synthetic Codex receiver in the actual Send menu and submits through the real host PTY. The receiver assertions pass: bracketed paste, expected marker, exactly one Enter, zero premature or swallowed Enters. The paired client records no direct SSH attempt. Both processes use the standalone notes implementation, with the existing unchanged app build; no browser-controls integration or model request is involved.

The new scenario passes with retries disabled. Scoped lint passes. This is two genuinely paired application processes on one macOS machine; it is not physical two-machine or Windows acceptance. The source remains a credited port, not ancestry of the original PR head, and these results do not transfer to that original head.

Machine-readable acceptance receipt.