[brennanb2025]

The problem

When Orca sends a chat message and doesn't hear back in time (a slow agent, a dropped connection, a Stop at the wrong moment), it can't know whether the agent got the message. Before this change, the desktop gave up after 30 seconds, removed the message bubble and put the text back in the composer with a red notice. The agent often had received it, so pressing Send again sent it twice. Queued follow-ups had the same weakness: after a Stop or a restart, a held or edited follow-up could lose its place, its edit, or the record of whether it had already gone out. And when a Codex chat was continued outside Orca, a reconnect could drop the whole newly fetched history if one turn had changed between two reads.

What changes for users

• A message whose delivery is uncertain stays in the chat as an ordinary message, once, in its original place. The spinner stops at the deadline. Nothing goes back into the composer, nothing is resent automatically, and no warning or recovery button appears. When the agent's reply or a receipt arrives later, it attaches to that same message without disturbing anything typed since. A user's Stop still reads "Interrupted".
• Opening a new chat (for example Notes → New agent → Chat) gets the same treatment: an uncertain first message doesn't lock Send, Continue or the model picker, and isn't sent twice.
• Queued follow-ups keep their exact text (including edits), images, options, order and held state across Stop, Resume, restart and upgrade. Resume sends only the ones that are really waiting. A refused follow-up still holds the queue until the user acts on it.
• Rewind ("Rewind to here") removes the later messages from the conversation while Orca keeps its own record of what was already delivered, so a late reply can't resurrect them or cause a resend. Marking a workspace read also clears covered notifications after a rewound chat has gone idle, without reopening that chat.
• Codex history acquired after a reconnect, or from turns run outside Orca, is imported once and in order even when a turn finished between two reads. A conflicting item is skipped on its own; the rest of the history still appears.
• Phones that support it keep the uncertain message as an ordinary message too, and never put its text back into the phone's composer.

How it works

Each chat's saved journal is the single source of truth for what was sent, queued, held, refused or confirmed. Accepted queued follow-ups are recorded in one transaction before dispatch. Ordinary sends that have not been admitted remain in memory, and later proof (a reply, a receipt, a journal row) is matched to the original message. Historical receipt replay requires exact client IDs. Live Codex replies without a client message ID use a constrained match on text, image count and pending-send order. Anything Orca shows about recovery (which original a reply belongs to, which queued card replaced which) is worked out from that saved record when needed rather than saved separately. This is the common pattern for agent chat apps.

The saved format is main's current chat format. This PR adds one optional saved value: the point a rewind moved the conversation to, saved only after a rewind (or an imported history) that actually moves it. Chats written by the previous storage that are changed for the first time get the existing "written by a newer build" marker. Background maintenance of the journal uses main's compactor unchanged. Deleted and already-sent follow-ups stay in the chat's record (so a late reply still matches its original), and the checked send, Stop, publish and reconnect paths avoid rebuilding that retained history. The 19-phase operation-count tests cover 10 versus 100 withdrawn and dispatched cards; tree navigation can grow logarithmically, and cold opening still reads saved history. Existing current-chat status rendering remains a separate cost already on main.

Intended differences

• Downgrade. An older Orca refuses to open a chat that holds the new rewind point, or an older chat that this build changed for the first time, and shows "This chat was saved by a newer Orca. Update Orca to open it." It deletes nothing; updating again opens the chat with everything intact. Intended: owner ruling 10-31, one-release downgrade refuses only chats holding the new context fact or newly marked pre-outcome chats; older-build rewind drops late-confirmation tracking beyond the rewind point, matching the common pattern of older builds dropping what they don't know.
• Quit or crash before the agent receives a message can lose that in-memory message. Intended: matches the common pattern, owner ruling 10-29.
• Released readers (.57 and v1.4.237) keep their bundled caption and controls. The repeated generic "Your message was not sent." caption on an original failed image and its exact retry row is owner-approved for released readers only; current readers show the failure once. Released phones keep main's Copy/Select, any device-local preview, idle Send and exact Delete for genuine or previously saved retry choices. Intended: same as main for released phones; the image bytes aren't reachable remotely.
• A Codex history item that contradicts one already saved (a different tool at the same address, or a backward state) is skipped with whatever depends on it, rather than replacing what the chat already shows.

Temporary follow-ups

• The terminal-phone uncertainty warning stays as it is, tracked in STA-12534.
• A saved host-path image that the phone can't load still shows main's placeholder, tracked in STA-12378.
• Exact provider-history receipt replay is Codex-only today, tracked in A Claude chat shows the turns made outside it #31615, OpenCode and Grok chats show the turns made outside them #31616 and A Pi chat shows the turns made outside it #31618.
• Steers held inside an agent adapter (ACP) are outside this change.

Verified in the running app

Mac, real Claude and Codex through the team's load balancers, test copies with throwaway homes. The targeted rewind, edited-queue, restart and Resume run below passed on 9953fa9f6067d6a681e8803e92f0e59a6bbf94b6. The existing table records earlier app runs carried forward for their unchanged flows; those runs were not repeated on this head.

In the targeted run, both agents completed real replies before an idle, empty-queue rewind. Rewind retained the earlier reply, removed the selected later turn and returned its exact text to the composer; after clearing that draft normally, a distinct new message received a real reply. While each agent was working, two follow-ups were queued, the first was edited through Edit/Save, and Stop read "Interrupted". One graceful restart of the same test profile preserved the original waiting card IDs, edited text, saved options and order, without submitting anything. Reopened queues read "Queued · 2" with no header Resume. In each chat, one fresh real turn followed by Stop exposed "Paused · 2"; clicking its header Resume once sent the edited first card and then the second, each once, with real successful replies and an empty queue. The earlier reply remained, the rewound turn stayed absent, and no earlier or deleted card was replayed. Claude's first card had no explicit saved effort; its second saved Medium. Codex saved High for both.

This run did not exercise ordinary provider-failure chronology or a rewind with cards still queued; those remain contract evidence. Codex needed a correction to the disposable test profile's unreachable provider endpoint and two bounded preparation retries; only the final held pair is restart/Resume proof. The preserved initial interrupted run was traced to an accepted renderer Stop, with an extra driver Escape strongly supported as its cause rather than directly captured. No attributable PR defect was established by that interruption.

Agent	After rewind: A retained, T in composer	After restart: Queued · 2	Fresh turn stopped: Paused · 2 / Resume	W1 then W2 real replies; empty queue
Claude	Rewind	Reopen	Before Resume	Replies
Codex	Rewind	Reopen	Before Resume	Replies

Flow	Result	Screenshot
Upgrade from current main with a held, edited follow-up after a real Stop (Claude and Codex)	Each card reopened with its edited text in its original place, nothing sent on its own; its own Send sent it once and got a real reply; a composer send then got a real reply; no deleted or sent card came back	Claude after reopen · Codex after sends
A real Codex turn run outside Orca (with a shell tool call), then an ordinary Send in Orca	The outside message, the tool call with its output and the answer appeared once, in order, after a "Continued outside this chat." line, and the new message got its reply	Codex after import
Stop with two queued follow-ups, then Resume (Claude and Codex)	The turn read "Interrupted" and the queue "Paused · 2"; Resume sent both once, in order, with real replies	Claude · Codex
"Rewind to here" in Claude, then a new message	Later messages left the conversation, the new message got its reply	Claude after rewind
Downgrade to current main, then upgrade again	The rewound chat was refused with the newer-Orca message and nothing a reader uses was erased; the other chat opened normally; after updating again both chats were intact	Refused on the older build · After updating again
/clear with a held follow-up (Claude and Codex)	The held follow-up was not sent on its own; its Send sent it once after the clear with a real reply	Claude · Codex
Pi chat (Windows): two sends and a queued send, restart, reopen, then a new send	History reopened with every row once and in order, nothing resent, the queued send went once, the new send got a real reply	Pi after reopen
Ordinary send past the 30-second deadline (Claude and Codex)	The message stayed once, the spinner stopped, a later message and two real replies followed, the newer draft was kept	Claude · Codex · main, for comparison
New chat from Notes past the deadline (Claude and Codex)	Model picker and Send stayed usable after the reply arrived; two real replies; Notes kept	Claude · Codex · main, for comparison
Codex send with no answer yet, then Stop	The message stayed once, the turn read "Interrupted", nothing was resent and the newer draft was kept	Codex after Stop
Phone (iOS simulator): uncertain message	Stayed as an ordinary message with Send available, then reconciled	Phone

Not exercised in the app: a phone draft typed at the exact moment of the phone's timeout, and creating a chat while no proof at all has arrived; tests cover both. Saving across all older chat formats, refusal sets for each older reader, compaction of saved records and the operation counts at 10× scale are covered by tests.

Tracked in STA-11448, STA-11165 and STA-11117 case A. The Codex history repair is tracked in STA-13077. Includes image recovery from #28650.

Author: @BrennanKB5

	Files	Added	Deleted	Net
Test	163	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​19697	$\color{#cf222e}{\Huge{\mathbf{−}}}$​2464	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​17233
Prod	314	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​12844	$\color{#cf222e}{\Huge{\mathbf{−}}}$​3077	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​9767

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 42a0072
• Latest commit, not reviewed: 304e087

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

Walkthrough

The changes add Codex receipt matching and history reconciliation, and distinguish turn completion from confirmed delivery. The journal tracks unresolved input attempts and can present eligible sends as recovery cards, including sends with image content. Session and queue flows retain those cards across relevant lifecycle changes. Chat notices gain retry and edit actions, while PTY sends report whether a write was submitted, uncertain, or not started. Mobile drafts retain attachments across uncertain sends, and detached queued edits can return unsaved text to the originating composer.

Merge Risk: Low · previous review 42a00

The change adds recovery cards for unconfirmed chat sends. A few edge cases remain: some receipts for steer messages may not be matched, some send waits may take longer to settle, retry text can be misclassified in rare cases, and the journal may store extra data on an accepted-send record. None of these looks likely to cause serious harm, but they are worth fixing before or soon after merge.

Pre-merge checks: 4

Check name	Status	Explanation
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.
Title check		The title clearly summarizes the main change: preserving chat inputs when delivery is uncertain or interrupted by Stop.
Description check		The description is detailed and covers the problem, user-facing changes, implementation, risks, visual proof, and testing. It uses different headings from the template and does not include a Fixes #…

Full details: Description check

Explanation

The description is detailed and covers the problem, user-facing changes, implementation, risks, visual proof, and testing. It uses different headings from the template and does not include a Fixes # line, but it links and names related issues; these omissions do not make the description incomplete overall.

Finishing Touches

Generate docstrings

• Commit to this branch
• Create a new PR

Fix failing CI checks

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[coderabbitai]

Actionable comments posted: 5

🧹 Nitpick comments: 1

src/main/native-chat/agent-session-journal/journal-queued-messages.ts: 1

74-74: 🚀 Performance & Scalability | 🔵 Trivial | ⚡ Quick win

revision() now does O(items + submissions) work on every call.

list() calls revision() first, so every get, list and publication read pays this cost. workViewKey() calls working(). That call runs journal.runningTurn(), which scans all journal items. It also iterates all submissions twice and builds a new current-work object through recoveryWork().

Previously revision() was O(1). During streaming, each publish and each get in a loop, such as in withdraw, repeats this scan.

Memoize the work-view part. Key it on lastSequence, queue.revision, and a cheap signal that heldSends changed. Alternatively, compute workViewKey() only on a cache-miss path.

---

ℹ️ Review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: db4ae28d-7fd6-4fa1-9a0a-40c62c697bc0

📥 Commits

Reviewing files that changed from the base of the PR and between b4ee652 and 0a43e23.

📒 Files selected for processing: 69

• mobile/src/session/use-mobile-structured-native-chat-send-bridge.test.ts
• mobile/src/session/use-mobile-structured-native-chat-send-bridge.ts
• mobile/src/session/use-mobile-structured-queued-edit.ts
• mobile/src/session/use-mobile-structured-sends.test.tsx
• mobile/src/session/use-mobile-structured-sends.ts
• src/main/codex/codex-dispatch-receipt-correlation.ts
• src/main/codex/codex-history-import-plan.ts
• src/main/codex/codex-history-journal-view.ts
• src/main/codex/codex-structured-dispatch-echo.ts
• src/main/codex/codex-structured-journal-contracts.ts
• src/main/codex/codex-structured-journal-items.ts
• src/main/codex/codex-structured-session-acquire.ts
• src/main/codex/codex-structured-session-adapter.ts
• src/main/codex/codex-structured-session-journal.ts
• src/main/codex/codex-structured-session-start.ts
• src/main/codex/codex-structured-session-state.ts
• src/main/codex/codex-structured-sign-in.test.ts
• src/main/codex/codex-structured-thread-catch-up.ts
• src/main/codex/codex-structured-thread-history-pages.ts
• src/main/codex/codex-structured-turn-cancellation.ts
• src/main/codex/codex-structured-turn-end-settlement.test.ts
• src/main/codex/codex-structured-turn-end-settlement.ts
• src/main/codex/codex-structured-turn-start.ts
• src/main/native-chat/agent-session-journal/journal-lifecycle-batch-appender.ts
• src/main/native-chat/agent-session-journal/journal-queue-events.ts
• src/main/native-chat/agent-session-journal/journal-queue-fold.ts
• src/main/native-chat/agent-session-journal/journal-queue-retention.ts
• src/main/native-chat/agent-session-journal/journal-queued-messages.ts
• src/main/native-chat/agent-session-journal/journal-reducer.ts
• src/main/native-chat/agent-session-journal/journal-store-contracts.ts
• src/main/native-chat/agent-session-journal/journal-unconfirmed-recovery.test.ts
• src/main/native-chat/agent-session-journal/journal-unconfirmed-recovery.ts
• src/main/native-chat/agent-session-journal/journal-unsent-send-hold.spec.ts
• src/main/native-chat/agent-session-journal/journal-unsent-send-hold.ts
• src/main/native-chat/agent-session-journal/queued-message-pause.ts
• src/main/native-chat/agent-session-journal/queued-message-table.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-current-work.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-current-work.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-leftover-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-opening-send.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-edit.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-publication.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-wiring.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-journal-projection.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-taken-stop-settle.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unopened-send-withdrawal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unopened-send-withdrawal.ts
• src/main/runtime/structured-agent-session-codex-turn-end-settlement.test.ts
• src/main/runtime/structured-agent-session-dispatch-followups.ts
• src/renderer/src/components/native-chat/NativeChatComposer.tsx
• src/renderer/src/components/native-chat/NativeChatMessageRow.tsx
• src/renderer/src/components/native-chat/NativeChatResolvedView.tsx
• src/renderer/src/components/native-chat/NativeChatUserMessageRow.tsx
• src/renderer/src/components/native-chat/native-chat-composer-types.ts
• src/renderer/src/components/native-chat/use-native-chat-composer-handle.ts
• src/renderer/src/components/native-chat/use-native-chat-pending-delivery.test.tsx
• src/renderer/src/components/native-chat/use-native-chat-pending-delivery.ts
• src/renderer/src/components/native-chat/use-native-chat-pty-composer-send.ts
• src/renderer/src/components/settings/ChatBehaviorSetting.test.tsx
• src/renderer/src/components/settings/chat-behavior-search.ts
• src/renderer/src/i18n/locales/en.json
• src/shared/agent-session-failure-copy.ts
• src/shared/agent-session-failure-words.ts
• src/shared/agent-session-failure.ts
• src/shared/structured-agent-session-dispatch-rejection.ts

💤 Files with no reviewable changes: 1

• src/main/native-chat/agent-session-wire/structured-agent-session-unopened-send-withdrawal.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: a77e6930-6c8f-4dec-a8f6-8350549de96a

📥 Commits

Reviewing files that changed from the base of the PR and between 7a40d8c and 42a0072.

📒 Files selected for processing: 51

• mobile/src/session/mobile-native-chat-draft-store.ts
• mobile/src/session/mobile-native-chat-payload-ownership.test.ts
• mobile/src/session/use-mobile-native-chat-file-attachments.ts
• mobile/src/session/use-mobile-native-chat-image-attachments.test.ts
• mobile/src/session/use-mobile-native-chat-image-attachments.ts
• mobile/src/session/use-mobile-native-chat-session-lane.ts
• mobile/src/session/use-mobile-structured-queued-edit.test.tsx
• mobile/src/session/use-mobile-structured-queued-edit.ts
• src/main/codex/codex-dispatch-receipt-correlation.ts
• src/main/codex/codex-history-journal-view.ts
• src/main/codex/codex-structured-dispatch-echo.test.ts
• src/main/codex/codex-structured-dispatch-echo.ts
• src/main/codex/codex-structured-thread-catch-up-echo.spec.ts
• src/main/codex/codex-structured-thread-catch-up.test.ts
• src/main/codex/codex-structured-thread-catch-up.ts
• src/main/codex/codex-structured-thread-history-pages.ts
• src/main/codex/codex-structured-turn-start.ts
• src/main/native-chat/agent-session-journal/journal-context-rewind.ts
• src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
• src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
• src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
• src/main/native-chat/agent-session-journal/journal-input-obligations.ts
• src/main/native-chat/agent-session-journal/journal-queue-fold.ts
• src/main/native-chat/agent-session-journal/journal-queue-retention.ts
• src/main/native-chat/agent-session-journal/journal-queued-messages.ts
• src/main/native-chat/agent-session-journal/journal-reducer.ts
• src/main/native-chat/agent-session-journal/journal-rewind-submission-retirement.ts
• src/main/native-chat/agent-session-journal/journal-store.spec.ts
• src/main/native-chat/agent-session-journal/journal-store.ts
• src/main/native-chat/agent-session-journal/journal-submission-fold.ts
• src/main/native-chat/agent-session-journal/journal-unconfirmed-recovery.test.ts
• src/main/native-chat/agent-session-journal/journal-unconfirmed-recovery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-publish.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-current-work.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-open.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-publication.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-progress.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-stopped-history-selection.ts
• src/main/runtime/rpc/methods/structured-agent-session-wire-contracts.test.ts
• src/renderer/src/components/native-chat/native-chat-composer-types.ts
• src/renderer/src/components/native-chat/native-chat-observed-send.ts
• src/renderer/src/components/native-chat/native-chat-pending.ts
• src/renderer/src/components/native-chat/native-chat-pty-send-queue.ts
• src/renderer/src/components/native-chat/native-chat-recovery-ownership.test.tsx
• src/renderer/src/components/native-chat/native-chat-runtime-image-send.ts
• src/renderer/src/components/native-chat/native-chat-runtime-send.ts
• src/renderer/src/components/native-chat/use-native-chat-pending-delivery.ts
• src/renderer/src/components/native-chat/use-native-chat-pty-composer-send.ts

💤 Files with no reviewable changes: 2

• src/main/native-chat/agent-session-journal/journal-context-rewind.ts
• src/main/native-chat/agent-session-journal/journal-rewind-submission-retirement.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.