fix(native-chat): the host writes chat failures for a person, with a typed fact beside them

[brennanb2025]

	Files	Added	Deleted	Net
Test	100	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​4758	$\color{#cf222e}{\Huge{\mathbf{−}}}$​425	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​4333
Prod	136	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​4083	$\color{#cf222e}{\Huge{\mathbf{−}}}$​1053	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​3030

Merge order: #22821 has merged into main, so its permanent chat-history rows are now on main. This PR changes what those rows store, so it must merge before the next release. #22944 has also merged; its sidebar "was the last request a failure" check now takes its answer from this PR's classifier instead of reading the reason text.

Scope: which chat this affects

• Structured chat only. This changes the experimental structured native chat (the experimentalStructuredNativeChat setting, off by default). Terminal agents and the terminal-backed chat view are unchanged.
• Host side, shared types, and the shared refusal copy table. This PR changes what the host writes and returns, and grows the refusal copy table that fix(native-chat): say a refused chat write in plain words, and keep it with the write it describes #22999 added. Other desktop screens (held messages, Discard, Send again rows, the launch strip, the retry-status line, the unreadable-history pane) are the follow-up desktop PR.

ELI5

When a chat message could not be sent, or the agent failed to start, Orca saved its own debugging text into the chat's history, for example "The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in." That history is permanent, so no later fix to the chat screen could clean it up. Now Orca writes a plain sentence a person can read ("Claude stopped before it finished starting. Send your message to try again."), plus a typed label saying what went wrong, and keeps the agent's own words separate from Orca's.

What Changed

Before

• Failure text was whatever error Orca had at hand where the error was caught: refusal prose, exception messages, the agent's error output, file-system errors, and internal code words. It was saved into the chat's permanent history as-is.
• A failed start often said "The provider stopped…" even when the agent never ran (Orca could not launch it, Orca itself failed, or the agent refused to resume), and the agent's own explanation was dropped.
• When the host turned a request away, it sent back only a code such as agent_session_operation_invalid. One code covered situations as different as "this conversation was cleared" (retrying can never work) and "wait for the current reply" (retrying later will work), so the app could not choose an honest next step.
• A chat that could not be created showed the raw exception under "Chat could not be started." Claude's API retries wrote one red row per attempt reading "rate_limit", with the raw retry data behind Details.
• Several places judged separately whether a message that was not sent should count as a failure.

After

• Words chosen when the failure is recorded. Every place in the host that saves a failure row or a "message not sent" reason gets its sentence from one shared function (agentSessionFailureWords), together with a typed cause: a fixed list of situations, plus the agent's own text when there is some. The sentence type can only come from that function, so no writer can pair a hand-written sentence with a cause. Older desktop and phone builds show the sentence as it is; newer builds read the cause.
• The agent's words kept apart. Text the agent wrote is captured where Orca receives it (Claude and Codex error output, Codex request errors, compaction errors), marked as written for a person or for a log, and capped at 512 characters. Log text never enters the sentence. Nothing guesses who wrote a string after the fact.
• Honest start failures. Only an exit Orca actually saw reads " stopped before it finished starting."; any other failed start reads " couldn't start." or "couldn't restart.", each with the next step ("Send your message to try again.", or "Run /clear again." after /clear). Not signed in, history too large, a Claude account switch in progress, account variables that conflict with a managed account, and a WSL-only Claude account each get their own sentence, identical on the first answer and on a repeat of the same request.
• Refusals typed by code. A refusal is now one shape per code, with optional details holding that code's own reason and facts (for example "the agent is still responding", "the agent is waiting for an answer", "the last /clear didn't finish", "this chat is still open in a terminal agent"). A reason the code does not list fails to compile. There is no catch-all reason: a place that cannot tell what happened sends the code with no details. The older fields released apps read at the top level of a refusal (which process runs the chat, the restart counter, a question's revision and answer, a rewind reason) are now filled in exactly one place, from the details. A refusal the host throws carries the same details in the error's data, with its code and message unchanged. The host's record of each request, used so a retry is answered the same way, stores the details too.
• One copy table. fix(native-chat): say a refused chat write in plain words, and keep it with the write it describes #22999's table (code × kind of request → words) grows to code × reason × kind of request, and the compiler checks every reason has words. fix(native-chat): say a refused chat write in plain words, and keep it with the write it describes #22999's rows stay as the fallback for older hosts and unknown reasons. Failure causes use the shared sentence function, so each situation has one source of words. A new read-history request kind covers a chat whose history cannot be loaded. Two new shared files hold the non-copy halves: agent-session-write-failure.ts (request kinds, a queued message's saved failure and its parsing) and agent-session-write-notice-copy.ts (the sentence list); the copy table itself stays in agent-session-refusal-notice.ts.
• Saved failures on queued messages. The desktop's queue of messages not yet confirmed saves each message's last failure. That saved failure gains an optional typed reason (plus rewind reason and whether the chat's process is proven gone) and the recorded rejection's cause; old saved entries load unchanged. A stored "process proven gone" only lets Retry use a fresh request id; the message keeps its place in the queue.
• One reader of "was this a failure". classifyDispatchRejection decides from a table that must list every cause, and fix(native-chat): a request that failed reads as failed #22944's sidebar check now asks it too, so the sidebar and the chat always agree. A message withdrawn by Stop, one lost to an Orca restart, one lost to a chat close, and one the agent never received after a restart do not count as failures; a cause this build cannot read is treated the same way instead of guessing. Every "not sent" row must carry its cause, and only causes that can apply to a message are accepted; both are enforced by the compiler.
• Leaks closed. A refused chat create now carries the curated sentence, with the raw error in the log. Claude's API retries write one row per retry run ("Claude is rate-limited and retrying." or "Claude hit a temporary problem and is retrying."), with the retry data behind Details as log text. A send into a chat whose /clear never finished says so ("The last /clear didn't finish. Start a new chat to continue.") instead of claiming the chat was cleared. A chat history that cannot be opened is either proven corrupt by the database ("Unable to load this chat.") or temporarily unavailable ("Orca couldn't open this chat's history right now. Try again."); an older host's bare code never promises either.
• Honest mid-response stops. " stopped while this response was in progress. You can continue in this conversation." is written only when Orca saw the agent's own process exit while it was not closing it, for Claude and Codex alike; when Orca itself closed the agent (for example because it could not save the agent's output), the row says Orca ran into a problem instead.
• One writer per failed start. When a start fails, the first place that records it decides the row and the words on every message it rejects; a later exit report no longer rewrites that row, so the row and the messages always agree.

Why

Failure text was decided wherever an error happened to be caught, then saved permanently into chat history. No later client fix could clean it, and one error code covered situations needing opposite next steps. The host now writes a plain sentence plus a typed cause at the moment it records the failure, and keeps the agent's own words separate. Old clients read the sentence, and new ones can choose an honest action from the cause.

The mechanism is one function that turns a cause into its sentence, used by every writer, with the compiler refusing a sentence that did not come from it. So a new failure cannot be recorded without also being classified, and a classification cannot drift from its words. The agent's words travel as a separate value from the moment Orca receives them, so the sentence never has to be picked apart later to decide what is safe to show.

Why not reword on the client only. A client table can reword a refusal it receives, but it cannot clean a sentence already saved in the chat's history, it cannot help older app versions that print the saved sentence, and it cannot tell the agent's "not signed in" from Orca's "ENOENT" inside one string. A remote host also cannot rely on every connected client being new enough.

Why one table per code with typed details. A single code cannot choose an honest next step, and an earlier draft's flat list of causes shared by all codes let a code carry a cause it can never produce. With one shape per code, each code lists only its own reasons and facts, the compiler rejects anything else, and the copy table is checked for completeness over every reason of every code.

Alternatives considered

• Store a code word in the saved reason instead of a sentence. Released apps print any reason they do not recognise, so a new code word would appear raw on builds already in the field. A sentence reads correctly everywhere.
• Rewrite rejected messages when a later report disagrees. A "not sent" message is final and older apps may already have read it, so the first writer decides instead.

Differences from the common pattern

• The common pattern decides a stored failure's words on the server before saving it, and types errors as a union keyed by code, each code with its own details and reason list. This PR matches both.
• Deviation: typed details are optional on the wire, where the common pattern requires them for the codes that have them. Hosts and apps update independently here, and an older host sends none; the code-level words are the fallback.
• Deviation: the host also saves the sentence beside the cause, because released apps print it and a remote host cannot rely on the app to word it.

Linked Issue

No separate issue. Reported during live QA of #22918: after an idle stop and restart, the chat showed "Expected runtime fence 1; the session is at 3." #22812 removed that refusal; #22999 and this PR make every other failure readable.

Visual Proof

Live QA on a Mac (M4 MacBook Air) with dev builds, driven through Playwright over the Chrome DevTools Protocol with the window hidden. A stand-in claude makes every structured start exit with the error line claude: not signed in (rig), so a failed start is repeatable. "Before" is #22821's head (8f66a25); "after" is this PR (11b23cc; later commits change no screen these scenarios show, and the stand-in's exit is a real exit, so it still reads "stopped"). The planned QA agent hit its weekly usage limit before the final round, so the reviewing agent ran the same scripts itself over the test machine's shell.

Two messages queued behind a start that fails. Before: every row and the not-sent reason carry Orca's debugging text and the agent's error output. After: plain sentences naming the agent, with the next step.

Before (#22821)	After (this PR)

One message while the start fails.

Before (#22821)	After (this PR)

Chat create refused, and Retry once the agent can start. An earlier build of this branch (as on main) showed the raw exception under "Chat could not be started."; the refusal's message is now the curated sentence. That path depends on a race and did not come up in the final run, so it is covered by unit tests only. After Retry, the reply arrives and the error notice clears; the earlier failure rows stay as history.

Launch strip (earlier build)	After Retry (this PR)

Final head, after merging #22835 (d07508a). A failed start reads the same plain sentence on the row, the notice and the sidebar ("Failed"). A Stop pressed while a second message was queued behind a running reply left that message under "Cancellation requested." / "Working…" for minutes; that is an existing main bug that #23553 fixes (Stop does not ask Claude to withdraw queued messages when its capabilities read as empty), not this PR. Stop is not offered while a message waits on a start, which #23026 covers.

Failed start (final head)	Stop with a queued message (existing main bug, #23553)

Testing

• I manually tested these changes locally
• Automated tests added/updated
• Live (macOS, remote M4 MacBook Air): a failed start with two queued messages and with one message, on fix(native-chat): a message is accepted, then delivered #22821 and on this PR; Retry after the agent can start on this PR; after merging fix(native-chat): the conversation outlives its agent #22835, a failed start again and a Stop with a queued message (see Visual Proof). No agent error output, "stream-json" or "The provider" appeared anywhere on screen after the change.
• Checks at the final head: typecheck, full lint on every changed file, the changed-lines quality gate, the low-evidence and type-aware audits, React Doctor, the five localization checks, and the mobile typecheck.
• Suites, run in batches: native-chat host and journal (about 1,640 tests), Claude and Codex structured (about 900), runtime structured and RPC, shared (about 9,800), renderer native-chat and lib, and mobile session (about 1,800). The Claude real-CLI test needs a real signed-in CLI and was excluded.
• Every fix was checked by reverting it and watching its test fail. Several checks are compile-time: a reason a code does not list, a missing copy row for a reason, a missing verdict for a cause, a "not sent" row without its cause, a status-only cause on a message, and a new way for the agent process to end without a mapping all fail the typecheck.
• Mixed versions pinned by tests: an old saved queued message loads unchanged; a cause this build cannot read is not a failure; the fixed code words older apps recognise read the same; the older top-level refusal fields match the previous build field by field; the first answer and the repeat of a refused create read the same sentence; old saved rows written with the earlier cause shape still parse.
• Not run live: SSH-hosted chats, Linux and Windows. All wording is chosen on the host that runs the agent, no transport or platform code changed, and the unit tests run on every platform in CI, so the live macOS run covers what changed. Mobile screens were not run live; the phone reads the same shared table, and its typecheck and session tests pass.

Needs native review

30 new app strings (components.native-chat.writeNotice.*) were translated by hand into Spanish (es), French (fr), Korean (ko), Chinese (zh) and Japanese (ja). Please have a native reader check them.

Known weaknesses

• English start-failure sentences in translated builds. Refusal notices that reuse a start-failure sentence show it in English on translated desktop builds (sentences the host saves are English anyway). Owner: desktop follow-up PR.
• Details on thrown refusals are not read yet. The host sends them in the error's data; the app still picks words for a thrown refusal by its code. Owner: desktop follow-up PR.
• Unreadable-history pane. The words for a corrupt or unavailable chat history exist and are exported, but the chat pane still shows the raw code; it must pass the refusal's reason through so the two read differently. Owner: desktop follow-up PR (or perf(native-chat): chat tabs list from saved state, and history opens on first use #23131).
• A /clear that never finished stays stuck. Every later send, /compact and /clear on that chat is refused until a new chat is started; this PR only makes the refusal say so. Owner: fix(native-chat): an unfinished /clear or refused Codex rewind no longer locks the chat #23524.
• Codex rewind that the agent applied but still reports can fail every later reopen of that chat; only a new chat recovers. Reachable only from programmatic clients today.
• A /clear whose new conversation fails before any process starts appears to throw out of /clear rather than record a failed command. Older than this PR; not verified.
• Repeat of a refused create after a mid-start record conflict answers with a different code than the first answer (agent_session_operation_invalid). Older than this PR; no user-visible harm found; follow-up recorded.
• Close that fails after stopping the agent. Queued messages then read as a failed start or exit rather than "chat closed", as on main.
• Unverified race. If Orca begins closing Claude before its exit event arrives, a start failure reads "couldn't restart" instead of "stopped before it finished starting". Still honest; the agent's words stay behind Details.
• A failed /clear replacement start keeps its situation but not the agent's own words behind Details.
• Downgrade. An older desktop build ignores the new typed fields on a saved queued message and shows the code-level words; no saved entry is dropped by this PR. Held-message state belongs to the desktop follow-up and is not introduced here.
• Chat history that fails to open on a read still reaches the app as a generic runtime error carrying the raw error text; only writes classify it as corrupt or unavailable (older than this PR). Owner: desktop follow-up.
• The idle sweep's stop reason is a hand-written sentence held in memory only; it is never saved or shown (the row and messages use the hostStopped sentence), noted for completeness.
• Codex killed by its own connection. When Orca's connection ends Codex because Codex broke the protocol, sent an oversized record, or its input pipe broke, the row still says "Codex stopped…". Codex triggered those, so they were left as they are.
• Fixed during review: walking a nested error that contains itself was unbounded; it is now bounded (11b23cc).

Review

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• Mixed versions. Every addition is an optional field. Older apps ignore failure, rejection, details and error.data, and read the sentence and the older top-level refusal fields, which are unchanged. Older hosts send none of them, and newer apps fall back to the code-level words and the fixed code words. The "withdrawn" and "queue full" code words are byte-identical; a failed hand-over is stored as the bare provider_write_failed code word, which released apps already replace with their own words. Reasons on messages whose delivery is in doubt are unchanged.
• What older builds read differently. Start failures, attachment and compaction failures, the create refusal, a /clear that never finished, and Claude's API retries now read as a curated sentence instead of Orca's raw error text.
• SSH. All wording is chosen on the host that runs the agent; nothing about transport changes.
• Orca stopping a start that never finished. When Orca stops an agent that never finished starting (the idle sweep fix(native-chat): the conversation outlives its agent #22835 added), the row and each waiting message read " never finished starting, so Orca stopped it." with its own cause, hostStopped. It counts as a failure: Orca stopped the agent because its start hung, so the message never ran.

Checklist

• This PR is small and focused (it is not small: it changes every host failure writer and the refusal shape together, because a partial change would leave writers choosing words in two ways)
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[brennanb2025]

Review status (stays a draft)

Head: d187bee. Base is now main: #22821 merged as bfe476f, and this branch merged main in 4eb3633. #22944 has merged too, and its sidebar verdict now comes from this PR's classifier. This PR must merge before the next release, because #22821's permanent chat-history rows are on main and this PR changes what they store. CI: green at d187bee (34 passed, 12 skipped, 0 pending, 0 failed), including static analysis, typecheck, all eight test shards, cross-version wire compatibility and the RPC recording pin.

Review loops

• Loops 1–3 fixed:
  • attachment refusals naming the limit they broke (3592e14);
  • the chat tab table refusing with a typed reason (0ce944a);
  • Codex's own compaction refusal words (0188573);
  • an unreadable record no longer promising an update fixes it (570eff5);
  • sentences instead of code words for a restart or close (dd05f06);
  • logging an unreadable attachment (34a1e43).
• Architecture challenge after loop 3. The same kind of finding kept coming back, so a separate review challenged the design. Verdict: refine. Writers could choose a sentence and a cause separately, and some guessed the cause. Loop 4 applied the fixes:
  • one function for sentence and cause, with a sentence type only it can produce (7243c96);
  • the compaction outcome typed where the agent's message is seen (44672f5, e9e40b9);
  • empty and non-user messages no longer typed as attachment problems (ac5e9c8);
  • a failed start without an observed exit no longer blames the agent (d19f909).
• Refusals typed by code (approved design change): 93c5747, 73bc984.
• Loop 5 found start refusals still guessing "the provider stopped". Fixed in 4634735, 2927227, b532cd9, e60047d.
• Loop 6 clean. Follow-ups directed during review:
  • the create refusal's message is the curated sentence (79327d4);
  • Claude API retries become one sentence row (96a12ea);
  • /clear-aware next steps (d2ef1b6);
  • the agent is named in start failures (f160988, 82e6a2c);
  • typed account refusals before the process starts (0a50e3f, 248c23c).
• Merge of fix(native-chat): a message is accepted, then delivered #22821, which by then contained fix(native-chat): say a refused chat write in plain words, and keep it with the write it describes #22999 (64be90f), then the grown copy table and saved shape (d1506de, 1e168ab).
• Loop 7 clean, plus a refusal for a /clear that never finished (12e30c7).
• Loop 8 clean, plus:
  • the "was this a failure" table (574e2ac);
  • a queued message keeps its place when its process is proven gone (c7b4330);
  • a bounded nested-error walk (11b23cc).
• Loop 9 clean, plus:
  • the read-history words (2e89498);
  • one exhaustive table for how the agent process ended (e839453);
  • a host test for a close that fails after stopping the agent (57f1d54).
• Directed after loop 9:
  • corrupt vs temporarily unavailable history, decided from the database's own error code (f4320d4);
  • the first writer decides a failed start's row, so the row and its messages always agree (53b2f63);
  • Orca's own Claude startup faults no longer read as the agent stopping (b36f709).
• Loop 10 clean over all of that, including the main merges.
• Directed after loop 10:
  • mid-response stops name the agent and blame it only for an exit Orca observed, for Claude (e8f0a5b) and Codex (7117793);
  • fix(native-chat): a request that failed reads as failed #22944 merged; its string-based verdict is gone and its sidebar check reads the classifier, with an agreement test over every cause, code word and an unknown cause (c360017, 4b33dcf).
• Final focused review clean over those commits and the merges; git diff origin/main...HEAD holds only this PR's files.

Readiness checklist

• Start of review: ran.
• End (at 12e30c7): ready with notes, no blockers. The notes were the English start-failure sentences in translated notices (known weakness) and the unbounded nested-error walk, since fixed in 11b23cc.

Mobile compatibility

No blocker.

• The only mobile code change is where two shared helpers are imported from.
• Released phone builds read the curated sentences and the unchanged code words, get message plus the unchanged top-level refusal fields, and ignore the new optional details, failure and rejection fields.
• No pairing, protocol, route or saved phone state changed. The phone does not save the send queue.
• Newer phone builds get the grown copy table from shared code. Mobile typecheck and session tests pass.

Seen during QA

Rig: a Mac M4 Air, dev builds, Playwright over the DevTools protocol with the window hidden. A stand-in claude fails every structured start with the error line claude: not signed in (rig). The planned QA agent hit its weekly usage limit, so the final round was run by the reviewing agent over the test machine's shell with the same scripts. No codex was launched in any rig terminal pane.

Two queued messages, and one message, while the start fails

• Before (fix(native-chat): a message is accepted, then delivered #22821): each row and the not-sent reason read "The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in (rig)."
• After: "Claude stopped before it finished starting. Send your message to try again." No agent error output appears anywhere on screen.

Retry once the agent can start

• The reply arrives and the notice clears.

Launch strip for a refused create

• It showed the raw exception on main and on an earlier build of this branch.
• It is now the curated sentence.
• That path depends on a race and did not come up in the final run; unit tests cover it.

Failure sentence shown three times: not caused by this PR

• fix(native-chat): a message is accepted, then delivered #22821 shows the same layout: one row per failed start (the open's start and the send's start; two processes at open give one row), plus the composer's own reason.
• The host writes one row per start, and this PR makes that row and its messages always agree.
• The per-start rows come from fix(native-chat): a message is accepted, then delivered #22821's start on open and start on send, and the composer reason is app code.

Raw rate_limit rows with the retry data: fixed here

• These were on main since feat(native-chat): Codex structured native chat restructure #16729: one error row per Claude retry message.
• Now there is one row per retry run, "Claude is rate-limited and retrying.", with the data behind Details as log text.
• Owner of that message type: claude-structured-provider-fallback.ts with claude-api-retry-row.ts.

Two queued messages share one not-sent notice

• App behaviour, the same before and after; owner is the desktop follow-up.

Known gaps (not this PR)

• A /clear that never finished stays stuck. Every later send, /compact and /clear is refused until a new chat is started. This PR only makes the refusal say so. Owner: fix(native-chat): an unfinished /clear or refused Codex rewind no longer locks the chat #23524.
• Codex rewind the agent applied but still reports can fail every later reopen of that chat. Reachable only from programmatic clients today.
• Details on thrown refusals are not read yet. The host sends them in the error's data. Owner: desktop follow-up.
• English start-failure sentences show in translated desktop notices. Owner: desktop follow-up.
• Unreadable-history pane. The words for corrupt vs unavailable history exist and are exported, but the pane still shows the raw code. It must pass the reason through so the two read differently. Owner: desktop follow-up / perf(native-chat): chat tabs list from saved state, and history opens on first use #23131.
• A /clear whose new conversation fails before any process starts appears to throw rather than record a failed command. Older than this PR; unverified.
• A failed /clear replacement start keeps its situation but not the agent's own words behind Details.
• Repeating a create refused mid-start answers with agent_session_operation_invalid instead of the first answer's code. Older than this PR; follow-up recorded.
• A close that fails after stopping the agent makes queued messages read as a failed start or exit rather than "chat closed", as on main.
• Codex killed by its own connection (protocol violation, oversized record, broken input pipe) still reads "Codex stopped…"; Codex triggered those.
• Unverified race. If Orca begins closing Claude before its exit event arrives, a start failure reads "couldn't restart" instead of "stopped before it finished starting". It is still honest.
• Translations. 30 new strings were hand-translated into es, fr, ko, zh and ja and need a native check.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 6e8a9eff-f863-4411-8cea-9fe43e91c053

📥 Commits

Reviewing files that changed from the base of the PR and between f6bca9f and 58cf1ee.

📒 Files selected for processing (3)

• src/main/claude/claude-api-retry-idle-sweep.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds typed failure facts and refusal details across agent-session adapters, journals, runtime handling, and native-chat clients. Claude adds API-retry journal rows and typed attachment failures. Claude and Codex exit paths classify provider exits separately from host faults. Compaction uses explicit outcomes. Renderer notice handling and locale files add messages for session and history states.

Priority: ➖ Normal

Merge Risk: 🔵 Low · up to 58cf1

Queued messages may still incorrectly blame the provider when Orca evicts a session. The PR is mergeable with owner awareness of that wording issue.

Security Architecture Review

Security architecture risk: 🟡 Moderate · up to 58cf1

Typed failures appear to improve the separation between readable chat messages and provider diagnostics, while preserving recovery safeguards. Review is still warranted because diagnostics can accompany durable failure facts, and their handling at every client-facing boundary has not been established.

Retained concerns

• Medium · security · inferred: Typed rejection facts can carry bounded provider diagnostics into durable session data, but the available evidence does not establish that every downstream client-facing reader excludes log-audience detail. This is an exposure question, not a verified disclosure.

Security review details

Security Blast Radius

• inferred — The relevant exposure is the structured-chat session and its durable history and consumers, rather than a demonstrated new provider credential or session-creation authority. The feature is described as off by default.

Security Findings and Attack Paths

• inferred — Provider-supplied diagnostic text is the input of interest: it can accompany a failure fact, but the examined wording path does not interpolate it into the curated reason. No client-visible disclosure or bypass was verified.

Trust Boundaries and Controls

• observed — Resume checks lease reconciliation, recovery, record presence, provider support, and resumability before attachment; the new diagnostic-bearing outcome is handled by an internal delivery loop. Its complete downstream read boundary remains untraced.

Resilience and Maintainability Implications

• observed — Recovery keeps uncertain deliveries distinct from settled refusals, and typed rejection facts take precedence over contradictory prose. Those behaviors support stable ownership and failure classification across replay.

Hardening Proposals

• proposed — Make the diagnostic audience rule explicit at durable-history and RPC serialization boundaries, so log-audience provider text cannot be rendered as a chat reason or returned where only person-facing text is intended.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 35.40% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 113 functions across 102 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary change: structured native-chat failures now use person-readable text with typed failure facts.
Description check	✅ Passed	The description is comprehensive and follows the required structure. It explains the user impact, implementation, rationale, testing, visual proof, compatibility, limitations, and checklist status. It…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

src/shared/agent-session-journal-schemas.ts (1)

205-209: 🗄️ Data Integrity & Integration | 🔵 Trivial | ⚡ Quick win

Preserve failure metadata in the rewind record type.

AgentSessionRewindRecord is inferred from AgentSessionRewindRecordSchema, which embeds AgentJournalItemBodySchema. Because FailureFact omits attachment and retry, the retained-body type does not expose these fields. Rewind consumers then narrow the body back to AgentJournalItemBody with a cast. The admissibility guards retain runtime keys because they use only .success; this is a schema-derived type loss.

Suggested schema change

 const FailureFact = z.object({
   kind: z.string().min(1),
   detail: z.object({ text: z.string(), audience: z.string().min(1) }).optional(),
-  refusal: z.object({ code: z.string().min(1), details: z.looseObject({}).optional() }).optional()
+  refusal: z.object({ code: z.string().min(1), details: z.looseObject({}).optional() }).optional(),
+  attachment: z.looseObject({}).optional(),
+  retry: z.looseObject({}).optional()
 })

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 940d6db9-1489-4c7f-9c2d-cbe83ccae1f7

📥 Commits

Reviewing files that changed from the base of the PR and between 67581dd and d187bee.

📒 Files selected for processing (224)

• mobile/src/session/mobile-structured-agent-session-rpc.ts
• mobile/src/session/mobile-structured-operation-id-retirement.test.ts
• src/main/claude/claude-api-retry-row.test.ts
• src/main/claude/claude-api-retry-row.ts
• src/main/claude/claude-stream-json-connection.test.ts
• src/main/claude/claude-stream-json-connection.ts
• src/main/claude/claude-structured-auth-parity.test.ts
• src/main/claude/claude-structured-compaction.test.ts
• src/main/claude/claude-structured-compaction.ts
• src/main/claude/claude-structured-control-actions.test.ts
• src/main/claude/claude-structured-dispatch-admission.test.ts
• src/main/claude/claude-structured-dispatch-attachment-rejection.test.ts
• src/main/claude/claude-structured-dispatch-content.ts
• src/main/claude/claude-structured-dispatch.test.ts
• src/main/claude/claude-structured-dispatch.ts
• src/main/claude/claude-structured-init-proof.ts
• src/main/claude/claude-structured-launch-resolution.test.ts
• src/main/claude/claude-structured-launch-resolution.ts
• src/main/claude/claude-structured-options.ts
• src/main/claude/claude-structured-prompt-ownership.test.ts
• src/main/claude/claude-structured-provider-fallback.ts
• src/main/claude/claude-structured-session-acquisition.ts
• src/main/claude/claude-structured-session-adapter-turns.test.ts
• src/main/claude/claude-structured-session-adapter.ts
• src/main/claude/claude-structured-session-exit-blame.test.ts
• src/main/claude/claude-structured-session-exit-lifecycle.ts
• src/main/claude/claude-structured-session-recovery.test.ts
• src/main/claude/claude-structured-session-startup-state.ts
• src/main/claude/claude-structured-session-state.ts
• src/main/codex/codex-app-server-connection.test.ts
• src/main/codex/codex-app-server-exit-error.test.ts
• src/main/codex/codex-app-server-exit-error.ts
• src/main/codex/codex-app-server-record-dispatch.ts
• src/main/codex/codex-app-server-request-error.ts
• src/main/codex/codex-structured-compaction-refusal.test.ts
• src/main/codex/codex-structured-dispatch-admission.test.ts
• src/main/codex/codex-structured-session-acquire.ts
• src/main/codex/codex-structured-session-adapter-lifecycle.test.ts
• src/main/codex/codex-structured-session-adapter.test.ts
• src/main/codex/codex-structured-session-adapter.ts
• src/main/codex/codex-structured-session-close.ts
• src/main/codex/codex-structured-session-exit-blame.test.ts
• src/main/codex/codex-structured-turn-start.ts
• src/main/native-chat/agent-session-journal/journal-crash-boundary.test.ts
• src/main/native-chat/agent-session-journal/journal-dispatch-reason-bound.test.ts
• src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts
• src/main/native-chat/agent-session-journal/journal-open-failure.test.ts
• src/main/native-chat/agent-session-journal/journal-open-failure.ts
• src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
• src/main/native-chat/agent-session-journal/journal-reducer.test.ts
• src/main/native-chat/agent-session-journal/journal-reducer.ts
• src/main/native-chat/agent-session-journal/journal-restart-reconciliation.test.ts
• src/main/native-chat/agent-session-journal/journal-restart-reconciliation.ts
• src/main/native-chat/agent-session-journal/journal-row-builders.ts
• src/main/native-chat/agent-session-journal/journal-row-schema.ts
• src/main/native-chat/agent-session-journal/journal-store-close.test.ts
• src/main/native-chat/agent-session-journal/journal-store-contracts.ts
• src/main/native-chat/agent-session-journal/journal-store.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-adapter-router.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-failure.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-reconciliation.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-refusal.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-failure-text.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-hold-resume.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-holds.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-option-error.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-prompt-state.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-refusal-details.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-refusal-message.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-replay-outcome.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-row.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns-options.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns-prompt.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts
• src/main/native-chat/agent-session-wire/structured-compaction-recovery.test.ts
• src/main/native-chat/agent-session-wire/structured-compaction-recovery.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command-admission.test.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command-admission.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command-controller.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts
• src/main/native-chat/agent-session-wire/structured-rewind-journal-body.test.ts
• src/main/native-chat/agent-session-wire/structured-rewind-journal-body.ts
• src/main/native-chat/agent-session-wire/structured-rewind-refusal.ts
• src/main/native-chat/agent-session-wire/structured-session-compaction.test.ts
• src/main/native-chat/agent-session-wire/structured-session-compaction.ts
• src/main/native-chat/agent-session-wire/unhandled-provider-frame.ts
• src/main/native-chat/claude-structured-managed-account-support.ts
• src/main/native-chat/structured-agent-session-history-adoption.ts
• src/main/runtime/agent-session-conversation-command-record.ts
• src/main/runtime/agent-session-lease-transitions.ts
• src/main/runtime/agent-session-operation-admission.test.ts
• src/main/runtime/agent-session-provider-handle-transition.ts
• src/main/runtime/agent-session-record-options.ts
• src/main/runtime/agent-session-record-store-tab-table.test.ts
• src/main/runtime/agent-session-record-store.ts
• src/main/runtime/agent-session-recovery-capsule-entries.ts
• src/main/runtime/agent-session-recovery-capsule.test.ts
• src/main/runtime/agent-session-reservation-admission.ts
• src/main/runtime/agent-session-surface-release-transition.ts
• src/main/runtime/agent-session-tab-table.ts
• src/main/runtime/claude-structured-exit-mid-response.test.ts
• src/main/runtime/claude-structured-failed-start-resume.test.ts
• src/main/runtime/claude-structured-resumed-start-failure.test.ts
• src/main/runtime/claude-structured-send-held-for-startup.test.ts
• src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
• src/main/runtime/claude-structured-session-integration.test.ts
• src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts
• src/main/runtime/orca-runtime-get-structured-agent-session-create-support.ts
• src/main/runtime/rpc/errors.test.ts
• src/main/runtime/rpc/errors.ts
• src/main/runtime/rpc/methods/agent-launch-replay.test.ts
• src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
• src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
• src/main/runtime/rpc/methods/structured-agent-session-create.ts
• src/main/runtime/rpc/methods/structured-agent-session-gate.ts
• src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.ts
• src/main/runtime/rpc/methods/structured-agent-session-reveal.ts
• src/main/runtime/rpc/methods/structured-agent-session.ts
• src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts
• src/main/runtime/structured-claude-runtime-adapter.ts
• src/main/runtime/structured-claude-scripted-runtime-test-support.ts
• src/main/sqlite/sqlite-read-failure.ts
• src/renderer/src/components/native-chat/agent-session-write-notice-text.test.ts
• src/renderer/src/components/native-chat/agent-session-write-notice-text.ts
• src/renderer/src/components/native-chat/structured-agent-session-outbox-storage.test.ts
• src/renderer/src/components/native-chat/use-structured-agent-session-mutate.ts
• src/renderer/src/components/native-chat/use-structured-agent-session-write-refusal.test.tsx
• src/renderer/src/i18n/en-runtime-required.json
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/es.json
• src/renderer/src/i18n/locales/fr.json
• src/renderer/src/i18n/locales/ja.json
• src/renderer/src/i18n/locales/ko.json
• src/renderer/src/i18n/locales/zh.json
• src/renderer/src/lib/structured-agent-session-launch-options.ts
• src/renderer/src/lib/structured-agent-session-launch-prompt.ts
• src/shared/agent-session-conversation-command.ts
• src/shared/agent-session-failure-words.test.ts
• src/shared/agent-session-failure-words.ts
• src/shared/agent-session-failure.test.ts
• src/shared/agent-session-failure.ts
• src/shared/agent-session-journal-schemas.test.ts
• src/shared/agent-session-journal-schemas.ts
• src/shared/agent-session-journal-types.ts
• src/shared/agent-session-lease-adjudication.test.ts
• src/shared/agent-session-lease-adjudication.ts
• src/shared/agent-session-mutation-envelope.test.ts
• src/shared/agent-session-mutation-envelope.ts
• src/shared/agent-session-operation-ledger.test.ts
• src/shared/agent-session-operation-ledger.ts
• src/shared/agent-session-refusal-details.ts
• src/shared/agent-session-refusal-notice.test.ts
• src/shared/agent-session-refusal-notice.ts
• src/shared/agent-session-refusal-retry.test.ts
• src/shared/agent-session-refusal-retry.ts
• src/shared/agent-session-wire-refusals.test.ts
• src/shared/agent-session-wire-refusals.ts
• src/shared/agent-session-write-failure.test.ts
• src/shared/agent-session-write-failure.ts
• src/shared/agent-session-write-notice-copy.ts
• src/shared/native-chat-types.ts
• src/shared/structured-agent-session-dispatch-rejection.test.ts
• src/shared/structured-agent-session-dispatch-rejection.ts
• src/shared/structured-agent-session-latest-request.test.ts
• src/shared/structured-agent-session-latest-request.ts
• src/shared/structured-agent-session-outbox.ts
• src/shared/structured-agent-session-projection.test.ts
• src/shared/structured-agent-session-projection.ts
• src/shared/structured-agent-session-send-disposition.test.ts
• src/shared/structured-agent-session-send-disposition.ts
• src/shared/structured-agent-session-status-block.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Map evict to a host fault, not a provider failure.

ENDED_CHILD_FAILURE sends an Orca-initiated eviction through providerEndFailure. When ended.failure is absent, that returns providerExited or providerStartFailed. Queued messages then read as if the provider stopped. The PR's rule is that only the child's own exit blames the provider, and host-stop already maps to { hostFault: true }.

• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts#L274-L275: return { hostFault: true } for evict unless ended.failure?.kind === 'providerExited'.
• src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts#L754-L757: expect hostFault and the matching verdict for both evict cases.

🐛 Proposed fix

-  evict: providerEndFailure
+  // Orca chose to stop the child; only a recorded provider exit blames the provider.
+  evict: (ended) =>
+    ended.failure?.kind === 'providerExited' ? providerEndFailure(ended) : { hostFault: true }

Please confirm whether provider blame for evict was intentional.

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	// Reached only when an eviction's stop landed and a later step failed, leaving the conversation.
	evict: providerEndFailure
	// Reached only when an eviction's stop landed and a later step failed, leaving the conversation.
	// Orca chose to stop the child; only a recorded provider exit blames the provider.
	evict: (ended) =>
	ended.failure?.kind === 'providerExited' ? providerEndFailure(ended) : { hostFault: true }

📍 Affects 2 files

• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts#L274-L275 (this comment)
• src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts#L754-L757

[pullfrog]

ℹ️ No critical issues — one exit-attribution edge worth a look.

Reviewed changes

• One wording point for host failures: agentSessionFailureWords turns a typed fact into the sentence a row or rejected message carries, beside the typed failure/rejection value; the legacy markers released clients hide are preserved for the same rows.
• Typed failure facts and per-code refusal details: new agent-session-failure.ts and agent-session-refusal-details.ts, with compiler-checked completeness so a new kind or reason must be classified and worded before it compiles.
• A single rejection classifier: classifyDispatchRejection is now the only reader of "was this a failure", and the sidebar check from #22944 asks it too.
• Provider words kept apart: ProviderDiagnostic carries a person/log audience and is attached where Orca receives the provider's text; providerExitObserved marks a first-hand child exit.
• Start-failure row and rejected messages agree: one wording point and one shared fact, with a guard so the exit settlement cannot reword a row the delivery loop already wrote.
• Child-end outcomes table: structuredAgentSessionEndedChildFailure maps every end cause to what it means for queued messages.
• Consumers: the renderer and mobile read the shared copy table, plus a new read-history write kind.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

providerExitObserved is set unconditionally by the connection's onExit callback, and Orca reaches that callback after it has reaped a live child itself. When the SDK reader throws (or child.on('error') / stdin.on('error') fires) while the root is still alive, claude-stream-json-connection.ts calls tree.reap() — Orca's own killRoot() — without setting closing; the root's later exit event still fires onExit, so withObservedProviderExit marks it and this branch blames the provider. That is the opposite of the comment above and of the hostFault arm, which is meant to cover exactly an Orca-caused close.

Technical details

# Orca-induced reap is reported as `providerExited`

## Affected sites
- `src/main/claude/claude-stream-json-connection.ts` — reader catch (`!closing && !exited` → `void tree.reap()`), `child.on('error')`, `child.stdin.on('error')`. `tree.reap()` → `judgeTree()` → `killRoot()`.
- `src/main/claude/claude-structured-session-acquisition.ts:183-189` — the `onExit` callback marks every error it receives with `withObservedProviderExit(error)`, so a reap-induced exit is indistinguishable from the child's own exit.
- `src/main/claude/claude-structured-session-exit-lifecycle.ts:100-104` — after a proven start, `providerExitObserved(exit.error)` is then always true for this route, choosing `providerExited` over `hostFault`.

## Required outcome
- A proven-start exit that Orca itself induced (fault-path `tree.reap()` / Orca kill) should not read as `providerExited`; only a child that ended without Orca killing it should. The user-facing difference is "Claude stopped while this response was in progress" vs "Orca ran into a problem, so this didn't go through."

## Suggested approach (optional)
- Distinguish the connection's fault-initiated reap from an unassisted exit (the connection already tracks `closing` for `close()`; the fault reap needs a comparable signal the `onExit` callback can consult), and skip `withObservedProviderExit` when Orca initiated the kill.

## Open questions for the human
- Is an Orca-side transport/reader fault while the child is live considered the same accepted known-weakness as the documented Codex case ("Codex killed by its own connection")? If so, the inline comment at the marking site and the exit-lifecycle comment should say that, rather than asserting only the child's own exit blames the provider.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 8ad7028a-f41b-493f-8c86-27d06e5e0fbd

📥 Commits

Reviewing files that changed from the base of the PR and between d187bee and d07508a.

📒 Files selected for processing (79)

• src/main/claude/claude-structured-options.ts
• src/main/native-chat/agent-session-journal/journal-reducer-rejection-fact.test.ts
• src/main/native-chat/agent-session-journal/journal-reducer.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-adapter.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-client-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-mutations.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-runner.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-set.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-open.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unanswered-dispatch-release.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts
• src/main/runtime/agent-session-record-options.ts
• src/main/runtime/claude-structured-exit-mid-response.test.ts
• src/main/runtime/claude-structured-resumed-start-failure.test.ts
• src/main/runtime/claude-structured-send-held-for-startup.test.ts
• src/main/runtime/claude-structured-send-restart-dies-before-dispatch.test.ts
• src/main/runtime/claude-structured-startup-fault-is-not-an-exit.test.ts
• src/main/runtime/rpc/methods/orchestration-structured-worker-session.test.ts
• src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
• src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
• src/main/runtime/rpc/methods/structured-agent-session.ts
• src/renderer/src/i18n/en-runtime-required.json
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/es.json
• src/renderer/src/i18n/locales/fr.json
• src/renderer/src/i18n/locales/ja.json
• src/renderer/src/i18n/locales/ko.json
• src/renderer/src/i18n/locales/zh.json
• src/shared/agent-session-failure-words.ts
• src/shared/agent-session-failure.ts
• src/shared/agent-session-journal-schemas.ts
• src/shared/agent-session-journal-types.ts
• src/shared/agent-session-refusal-details.ts
• src/shared/agent-session-refusal-notice.test.ts
• src/shared/agent-session-refusal-notice.ts
• src/shared/agent-session-write-notice-copy.ts
• src/shared/native-chat-types.ts
• src/shared/structured-agent-session-dispatch-rejection.test.ts
• src/shared/structured-agent-session-dispatch-rejection.ts
• src/shared/structured-agent-session-projection.ts

🚧 Files skipped from review as they are similar to previous changes (7)

• src/main/runtime/rpc/methods/orchestration-structured-worker-session.ts
• src/renderer/src/i18n/locales/ko.json
• src/renderer/src/i18n/locales/fr.json
• src/renderer/src/i18n/locales/es.json
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/ja.json
• src/renderer/src/i18n/locales/zh.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

[coderabbitai]

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Tell the person to start a new chat when a start is refused because the history is corrupt.

START_REFUSAL_RESUMABLE marks agent_session_journal_unreadable as resumable for every reason. couldNot therefore adds startRetry(context) ("Send your message to try again.") even when fact.refusal.details.reason === 'journalCorrupt'. src/shared/agent-session-refusal-notice.ts says that no retry reads past damage (journalCorrupt: causeWords('historyUnusable', 'hostFinding')). The two sentences for the same chat disagree. The status-row sentence promises that a retry can work, and that retry fails the same way.

Check the reason before the code-level lookup. This is the same approach the function already uses for claimConflicted.

Proposed fix

     const code = fact.refusal?.code
-    return code && !START_REFUSAL_RESUMABLE[code]
+    const corrupt = fact.refusal?.details?.reason === 'journalCorrupt'
+    return corrupt || (code && !START_REFUSAL_RESUMABLE[code])
       ? `${failed} ${START_NEW_CHAT}`
       : `${failed}${startRetry(context)}`

Also applies to: 125-128

[pullfrog]

ℹ️ No new issues in the latest commits — one PR-description inconsistency worth reconciling, plus the still-open exit-attribution thread from the previous review.

Reviewed changes

Reviewed the three commits pushed since the prior pullfrog review (d187bee → d07508a): the merge of main and the integration fixes on top of it.

• Removed Orca's raw error text from an operation-start refusal: ensureStructuredAgentSessionAgentForOperation now logs the thrown error and returns a generic agent_session_owner_restart_failed (words "The agent couldn't restart."), instead of putting the raw exception in the refusal message released clients print.
• Typed the at-rest option-pick refusal: a key the provider would not accept is now refuse('agent_session_operation_invalid', { reason: 'optionRejected' }), matching the same pick on a running agent.
• Filed the restart-continuation refusal's code and details: refusedBy now reads the refusal reference off the rejected message (readAgentSessionFailureFact(rejection)?.refusal) and the resume host throws it as AgentSessionRefusalError, so the failure ledger keeps the code and its details again — which the renderer's resumeFailureGuidance keys on.
• Typed a host-stopped hung start as hostStopped: structuredAgentSessionEndedChildFailure maps host-stop to the new hostStopped fact (sentence " never finished starting, so Orca stopped it.") instead of the generic hostFault, with classifier (undelivered, verdict failure), copy table, and test coverage.
• Cleared merged test debt: pinned the close and host-stop rows to their typed facts and awaited the now-async journalSnapshot/history readers.

I ran the touched suites locally (dispatch-rejection, operation-start-refusal, delivery-loop, provider-child-record, restart-continuation, restart-ownership, restart-offer-withdrawal, restart-failure-filing, refusal-details, failure-text) — all green.

ℹ️ hostStopped is classified as a failure, which the PR description says it must not be

The PR's Notes section says a hostStopped rejection kind should be added "with no verdict (an Orca-chosen stop is not a failure)", but the classifier gives it verdict: 'failure', so the sidebar check from #22944 will report the last request as Failed. The commit message deliberately says the message "counts as failed", so the code is almost certainly the intended half and the description is stale — worth reconciling so the next reader knows which rule holds.

Technical details

# `KIND_VERDICT.hostStopped` contradicts the PR body's stated rule

## Affected sites
- `src/shared/structured-agent-session-dispatch-rejection.ts:126` — `hostStopped: 'failure'` in `KIND_VERDICT`.
- `src/shared/structured-agent-session-dispatch-rejection.test.ts:57` — pins `['hostStopped', 'undelivered', 'failure']`.
- PR body, "Notes" section — "adds `hostStopped` to SubmissionRejectionKind with no verdict (an Orca-chosen stop is not a failure)".

## Required outcome
- The description and the classifier agree on the verdict. If `failure` is right (a send Orca stopped because the agent hung did not reach the agent, so the user must resend), update the notes; if "no verdict" is right, the sidebar should not flag this send.

## Notes
- No code change requested if `failure` is intended; this is a description/consistency question only.

</details>

<!--
Pullfrog review metadata. These findings were written against d07508a;
if commits have landed on brennanb2025/chat-failure-facts since, treat every specific bug, file, or
line callout as POTENTIALLY STALE and re-diff before acting on it.

- Mode: IncrementalReview (delta against prior pullfrog review)
- Files reviewed: 235
- Commits reviewed: 3
- Base: main (6835b9b4e3)
- Head: brennanb2025/chat-failure-facts (d07508a)
- Reviewed commits:
  - ad336b38b8 — fix(native-chat): route the conversation-outlives-agent writers through the typed refusals
  - 2b4f8c3549 — fix(native-chat): a start Orca stopped because it never finished reads as that
  - d07508afa3 — test(native-chat): pin the merged close and host-stop rows to their typed facts
- Prior pullfrog review: d187bee (https://github.com/stablyai/orca/pull/23116#pullrequestreview-5334961155)
-->


<!-- PULLFROG_DIVIDER_DO_NOT_REMOVE_PLZ -->
<sup><a href="https://pullfrog.com"><picture><source media="(prefers-color-scheme: dark)" srcset="https://pullfrog.com/logos/frog-white-full-18px.png"><img src="https://pullfrog.com/logos/frog-green-full-18px.png" width="9px" height="9px" style="vertical-align: middle; " alt="Pullfrog"></picture></a>&nbsp;&nbsp;｜ [Fix it ➔](https://pullfrog.com/trigger/stablyai/orca/23116?action=fix&review_id=5335673353) ｜ [View workflow run](https://github.com/stablyai/orca/actions/runs/36394515683/job/108837898950) ｜ Using `DeepSeek Flash` (free via [Pullfrog for OSS](https://pullfrog.com/for-oss)) ｜ [𝕏](https://x.com/pullfrogai)</sup>

[pullfrog]

ℹ️ No critical issues — the delta is a small, correct consistency fix; one sibling-read gap is noted in the body.

Reviewed changes

Reviewed the one commit pushed since the prior pullfrog review (d07508a → f6bca9f).

• Typed the read accessor's refusals: conversation now throws agentSessionRefusalError for a missing record (agent_session_identity_required / recordMissing) — both before the lock and when host.open returns null — and for an adapter that cannot run the chat (structured_agent_session_unsupported / hostUnsupported), the same reasons revealStructuredAgentSession already used. Wire code and message are unchanged; the reason rides only in error.data.refusal.
• Covered it end to end: structured-agent-session-at-rest.test.ts asserts the missing-record read returns the code plus data.refusal.details.reason = 'recordMissing', and the unsupported case returns runtime_error with message structured_agent_session_unsupported plus reason = 'hostUnsupported', and adds vi.restoreAllMocks() to teardown.

I ran structured-agent-session-at-rest.test.ts locally (15 passed) and traced the mapping in runtime/rpc/errors.ts: agent_session_identity_required is in AGENT_SESSION_RPC_ERROR_CODES (passthrough), structured_agent_session_unsupported is not — both wire shapes match the commit's claim.

ℹ️ Two sibling reads still emit the bare code with no reason

agentSession.options and agentSession.handoffStatus reach the same "missing record" and "host cannot run this chat" situations through their own lookups, which still throw new Error(code) rather than a typed refusal, so they keep returning the code with no data.refusal. The commit's goal — a read of a chat this host cannot open says why — is not reached for those two reads.

Technical details

# Sibling reads bypass the typed accessor

## Affected sites
- `src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts:27-30` — `readStructuredAgentSessionOptionsAtRest` throws `new Error('agent_session_identity_required')`; `readStructuredAgentSessionOptions` reaches it for a missing record (line 101) before it calls `context.conversation` (line 103), so `agentSession.options` still returns the bare code.
- `src/main/native-chat/agent-session-wire/structured-agent-session-owner-status.ts:12-19` — `structuredAgentSessionOwnerStatus` throws bare `agent_session_identity_required` / `structured_agent_session_unsupported`, even though its own comment says "Same refusal as reveal"; `agentSession.handoffStatus` is the reader.

## Required outcome
- Both reads name the same situations with the same reasons as `conversation` and reveal, so a newer client can tell "this chat no longer exists" / "this host cannot run it" apart for options and handoffStatus too. Wire code and message stay as they are today.

## Suggested approach (optional)
- Throw `agentSessionRefusalError(code, { reason: 'recordMissing' | 'hostUnsupported' })` at both sites, mirroring `conversation-lifetime.ts` / `reveal.ts`.

## Open questions for the human
- If these two are intentionally outside this commit's scope, a follow-up ticket would keep the "reads say why" claim from looking universal.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[brennanb2025]

Review status (update)

Head: 58cf1ee. Base is now main: #22821 merged as bfe476f, and this branch merged main in 4eb3633. #22944 has merged too, and its sidebar verdict now comes from this PR's classifier. This PR must merge before the next release, because #22821's permanent chat-history rows are on main and this PR changes what they store. CI: green at 58cf1ee (37 passed, 12 skipped, 0 pending, 0 failed), including static analysis, typecheck, all eight test shards and cross-version wire compatibility.

Review loops

• Loops 1–3 fixed:
  • attachment refusals naming the limit they broke (3592e14);
  • the chat tab table refusing with a typed reason (0ce944a);
  • Codex's own compaction refusal words (0188573);
  • an unreadable record no longer promising an update fixes it (570eff5);
  • sentences instead of code words for a restart or close (dd05f06);
  • logging an unreadable attachment (34a1e43).
• Architecture challenge after loop 3. The same kind of finding kept coming back, so a separate review challenged the design. Verdict: refine. Writers could choose a sentence and a cause separately, and some guessed the cause. Loop 4 applied the fixes:
  • one function for sentence and cause, with a sentence type only it can produce (7243c96);
  • the compaction outcome typed where the agent's message is seen (44672f5, e9e40b9);
  • empty and non-user messages no longer typed as attachment problems (ac5e9c8);
  • a failed start without an observed exit no longer blames the agent (d19f909).
• Refusals typed by code (approved design change): 93c5747, 73bc984.
• Loop 5 found start refusals still guessing "the provider stopped". Fixed in 4634735, 2927227, b532cd9, e60047d.
• Loop 6 clean. Follow-ups directed during review:
  • the create refusal's message is the curated sentence (79327d4);
  • Claude API retries become one sentence row (96a12ea);
  • /clear-aware next steps (d2ef1b6);
  • the agent is named in start failures (f160988, 82e6a2c);
  • typed account refusals before the process starts (0a50e3f, 248c23c).
• Merge of fix(native-chat): a message is accepted, then delivered #22821, which by then contained fix(native-chat): say a refused chat write in plain words, and keep it with the write it describes #22999 (64be90f), then the grown copy table and saved shape (d1506de, 1e168ab).
• Loop 7 clean, plus a refusal for a /clear that never finished (12e30c7).
• Loop 8 clean, plus:
  • the "was this a failure" table (574e2ac);
  • a queued message keeps its place when its process is proven gone (c7b4330);
  • a bounded nested-error walk (11b23cc).
• Loop 9 clean, plus:
  • the read-history words (2e89498);
  • one exhaustive table for how the agent process ended (e839453);
  • a host test for a close that fails after stopping the agent (57f1d54).
• Directed after loop 9:
  • corrupt vs temporarily unavailable history, decided from the database's own error code (f4320d4);
  • the first writer decides a failed start's row, so the row and its messages always agree (53b2f63);
  • Orca's own Claude startup faults no longer read as the agent stopping (b36f709).
• Loop 10 clean over all of that, including the main merges.
• Directed after loop 10:
  • mid-response stops name the agent and blame it only for an exit Orca observed, for Claude (e8f0a5b) and Codex (7117793);
  • fix(native-chat): a request that failed reads as failed #22944 merged; its string-based verdict is gone and its sidebar check reads the classifier, with an agreement test over every cause, code word and an unknown cause (c360017, 4b33dcf).
• Final focused review clean over those commits and the merges.
• After fix(native-chat): the conversation outlives its agent #22835 merged: merged main (3f4f601, 06d9f6e), re-applying this PR's typed words onto fix(native-chat): the conversation outlives its agent #22835's reshaped functions; routed three of fix(native-chat): the conversation outlives its agent #22835's new writers through typed refusals (ad336b3) and its new read entry (f6bca9f).
• New cause hostStopped (2b4f8c3): when Orca's idle sweep stops a start that never finished, the row and waiting messages read " never finished starting, so Orca stopped it." It counts as a failure.
• Corrupt history now reads "Unable to load this chat." (99003be), with no suggested step, per Brennan's ruling.
• Claude API retries still keep a chat awake: every retry frame revises the run's single row, and each revision is a journal write that renews the idle clock. Pinned by a test that retries for 50 simulated minutes without the chat being swept (58cf1ee).
• Focused review of the fix(native-chat): the conversation outlives its agent #22835 merge: one issue found and fixed (f6bca9f); otherwise clean.

Readiness checklist

• Start of review: ran.
• End (at 12e30c7): ready with notes, no blockers. The notes were the English start-failure sentences in translated notices (known weakness) and the unbounded nested-error walk, since fixed in 11b23cc.

Mobile compatibility

No blocker.

• The only mobile code change is where two shared helpers are imported from.
• Released phone builds read the curated sentences and the unchanged code words, get message plus the unchanged top-level refusal fields, and ignore the new optional details, failure and rejection fields.
• No pairing, protocol, route or saved phone state changed. The phone does not save the send queue.
• Newer phone builds get the grown copy table from shared code. Mobile typecheck and session tests pass.

Seen during QA

Rig: a Mac M4 Air, dev builds, Playwright over the DevTools protocol with the window hidden. A stand-in claude fails every structured start with the error line claude: not signed in (rig). The planned QA agent hit its weekly usage limit, so the final round was run by the reviewing agent over the test machine's shell with the same scripts. No codex was launched in any rig terminal pane.

Two queued messages, and one message, while the start fails

• Before (fix(native-chat): a message is accepted, then delivered #22821): each row and the not-sent reason read "The provider stopped before it finished starting: claude stream-json exited (code 1): claude: not signed in (rig)."
• After: "Claude stopped before it finished starting. Send your message to try again." No agent error output appears anywhere on screen.

Retry once the agent can start

• The reply arrives and the notice clears.

Launch strip for a refused create

• It showed the raw exception on main and on an earlier build of this branch.
• It is now the curated sentence.
• That path depends on a race and did not come up in the final run; unit tests cover it.

Failure sentence shown three times: not caused by this PR

• fix(native-chat): a message is accepted, then delivered #22821 shows the same layout: one row per failed start (the open's start and the send's start; two processes at open give one row), plus the composer's own reason.
• The host writes one row per start, and this PR makes that row and its messages always agree.
• The per-start rows come from fix(native-chat): a message is accepted, then delivered #22821's start on open and start on send, and the composer reason is app code.

Raw rate_limit rows with the retry data: fixed here

• These were on main since feat(native-chat): Codex structured native chat restructure #16729: one error row per Claude retry message.
• Now there is one row per retry run, "Claude is rate-limited and retrying.", with the data behind Details as log text.
• Owner of that message type: claude-structured-provider-fallback.ts with claude-api-retry-row.ts.

Two queued messages share one not-sent notice

• App behaviour, the same before and after; owner is the desktop follow-up.

QA after the #22835 merge (final head, same rig):

• Failed start: passes. The rows, the notice and the sidebar ("Failed") read "Claude stopped before it finished starting. Send your message to try again." with no raw text.
• Stop with a second message queued behind a running reply: the queued message stayed under "Cancellation requested." / "Working…" for minutes. This is an existing main bug fixed by fix(claude): withdraw a follow-up queued behind a stopped turn instead of dropping it silently #23553, not caused by this PR.
• No Stop control while a message waits on a start: this belongs to fix(native-chat): Stop is there from the moment a message is sent #23026.

Known gaps (not this PR)

• Chat history that fails to open on a read still reaches the app as a generic runtime error with the raw text; only writes classify it. Owner: desktop follow-up.
• A /clear that never finished stays stuck. Every later send, /compact and /clear is refused until a new chat is started. This PR only makes the refusal say so. Owner: fix(native-chat): an unfinished /clear or refused Codex rewind no longer locks the chat #23524.
• Codex rewind the agent applied but still reports can fail every later reopen of that chat. Reachable only from programmatic clients today.
• Details on thrown refusals are not read yet. The host sends them in the error's data. Owner: desktop follow-up.
• English start-failure sentences show in translated desktop notices. Owner: desktop follow-up.
• Unreadable-history pane. The words for corrupt vs unavailable history exist and are exported, but the pane still shows the raw code. It must pass the reason through so the two read differently. Owner: desktop follow-up / perf(native-chat): chat tabs list from saved state, and history opens on first use #23131.
• A /clear whose new conversation fails before any process starts appears to throw rather than record a failed command. Older than this PR; unverified.
• A failed /clear replacement start keeps its situation but not the agent's own words behind Details.
• Repeating a create refused mid-start answers with agent_session_operation_invalid instead of the first answer's code. Older than this PR; follow-up recorded.
• A close that fails after stopping the agent makes queued messages read as a failed start or exit rather than "chat closed", as on main.
• Codex killed by its own connection (protocol violation, oversized record, broken input pipe) still reads "Codex stopped…"; Codex triggered those.
• Unverified race. If Orca begins closing Claude before its exit event arrives, a start failure reads "couldn't restart" instead of "stopped before it finished starting". It is still honest.
• Translations. 30 new strings were hand-translated into es, fr, ko, zh and ja and need a native check.