fix(native-chat): a turn a proven crash cut short reads interrupted

[brennanb2025]

	Files	Added	Deleted	Net
Test	12	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1278	$\color{#cf222e}{\Huge{\mathbf{−}}}$​36	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1242
Prod	15	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​291	$\color{#cf222e}{\Huge{\mathbf{−}}}$​104	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​187

Scope: which chat this affects

• Structured chat only. This PR changes the experimental structured native chat, which runs the agent through its SDK. It is behind the experimentalStructuredNativeChat setting, which is off by default (src/shared/default-global-settings.ts:137).
• Default chat view: no change. The default chat view, backed by a terminal and reading the agent's transcript, does not use this code, and nothing about it changes.
• Terminals: no change. Plain terminals and terminal-backed chats behave exactly as before.

ELI5

When Orca crashes while an agent is answering, the next launch finds that agent's process gone and closes off the unfinished answer. It used to label that answer "couldn't confirm", as if Orca did not know what happened, even though it had just checked and knew the agent was dead. Now the answer is marked as interrupted, shows how long the agent actually worked, and says the agent stopped.

What Changed

Before: after a crash mid-reply and a relaunch, the cut-off turn was settled as unverifiable:

• no "Worked for …" line and no fold: the turn stayed fully expanded with every tool row;
• no explanation row;
• the same as a chat Orca truly could not reach.

After: the turn is settled as interrupted:

• it shows "Worked for …" and folds like any ended turn (desktop and mobile);
• it gains the row "Claude stopped while this response was in progress. You can continue in this conversation." (naming whichever agent it was);
• the chat that was on screen when Orca crashed shows "Couldn't confirm" for a few seconds after relaunch, until Orca has proved the old agent gone (by checking its process, or by stopping it if it outlived Orca); then it changes to interrupted, "Worked for N", with no send needed;
• a chat whose agent Orca could not prove gone (lost contact, an owner on another host, an identity it could not verify) still reads unverifiable, with no end time and no row.

Words used below:

• Ownership record (the code calls it a lease): Orca's saved record of which agent process owns a chat. While the agent runs, Orca renews it about every 10 s, and refuses to renew unless the process still matches the one it recorded.
• Proof of death (death evidence): what Orca writes on that record when it has proved the agent died, with the time it found out.
• Process check (probe): Orca asking the operating system whether the recorded process is still running.
• Timeline (journal): the chat's saved rows. A row is "live" when the agent's activity produced it, and "recovered" when Orca wrote it afterwards while cleaning up a crash.

Mechanism:

• Which deaths count as proven. The turn's verdict now follows one fact: whether the ownership record carries a proof of death. With one, the turn is interrupted; without one, it stays unverifiable. Orca writes a proof only when it saw the process exit, or when a process check found the process gone or replaced by a different one. Every release that proved nothing writes none. The "has this agent exited" answer already uses the same rule, so the two cannot disagree, and there is no separate list of kinds to keep in step.
• When the turn ended. A seen exit ends at the exit. A death found by a process check ends at the last time Orca proved the agent alive. It never ends after the check or before the turn began, and falls back to the check's time when no proof of life was recorded. The end becomes the shown duration, so ending at the check would count the time Orca itself was down: a crash overnight would read "Worked for 9h".
• Why the last proof of life is needed. The timeline only gets a row when the agent reports something. Claude reports a shell command once when it starts and again when it finishes, so in QA a crash 26 s into a command read "Worked for 2s". The ownership-record renewal every 10 s is a proof of life Orca already writes to disk. The proof of death now keeps the last renewal from before the death, as a new optional field lastProvenAliveAt, so the shown duration is at most about one renewal short however quiet the agent was.
• Why timeline rows don't count. An earlier revision ended the turn at the later of the proof of life and the last live timeline row. But a timeline row does not say who wrote it: the user's send, Orca's delivery rows and Orca's status notes are live rows too, and a send can be accepted into a crashed chat before the proof of death lands. Readiness review reproduced it: a send at 3,605,000 into a turn whose agent was last proven alive at 210 ended the turn at the send, reading "Worked for 1h". Only the renewal is a fact about the agent alone. It costs at most one renewal interval: in QA, 0.6 s on a streaming Claude reply and nothing on a silent command, which was already bound by the renewal.
• Never before the turn began. The last renewal can predate the turn: a renewal at t−3 s, a turn started at t, a crash at t+5 s. The end is then the turn's start (the later of when it was requested and when the provider opened it), so a crash within one renewal of the turn's start can read "Worked for 0s", a lower bound, rather than ending before it began.
• Where it is captured. One function writes the proof of death from a process check, for both a relaunch and a recovery that stops a leftover agent. It copies the record's last renewal time, never later than the check, so a clock that stepped back still writes a valid interval. The other writers (a seen exit when a chat is closed, a failed start) leave it out: a seen exit already ends at the exit, and a start that failed before a process existed had nothing to prove alive.
• Whose death it is. A proof of death now names the owner it is about, as ownerFence: the generation number (fence) the record held for that owner. The turn's timeline rows already carry the fence of the owner that wrote them. Each running turn is judged by the fence of the row that created it, which the timeline derives from its rows on every open, with nothing stored. A running turn is interrupted only by a proof naming its own owner; a proof about any other owner leaves it unverifiable, with no end. Why it matters: after a crash, a new start reserves a new fence, which clears the relaunch's proof about the old owner. If that start then fails before the old turn is settled, the record's proof is about the start's own agent (a watched exit at the failure, or recovery later finding the agent it left behind gone). Main ended the old turn there, an hour after the crash, with the start's reason in the row; now it says Orca can't confirm. Carrying the relaunch's proof forward so that turn reads interrupted is a follow-up. Every writer sets the field: a process check, a failed start, and closing the last view. A record without ownerFence (written by an older build) keeps main's rule: a watched exit reads interrupted at the exit, and everything else reads unverifiable. Always reading unverifiable would regress the upgrade case, where an older build saw an exit mid-turn but quit before settling it.
• A chat read before the check is revised when the proof arrives. On desktop the chat on screen at relaunch reads its timeline before startup has checked any agent process. Opening a crashed chat's timeline settles whatever the dead Orca left running, and at that moment nothing has proved the agent gone, so the turn is settled unverifiable. The saved session store now tells the host, once a write is committed, which chat just gained a proof of death, whichever step wrote it: the startup check, a recovery that stops an agent that outlived Orca, a failed start, or a seen exit. If that chat is open, the host queues that same settle for it behind the chat's other work, and the settle now also moves an unverifiable turn to interrupted when the proof names the owner that wrote it. Any later open of the chat re-runs it too, so a revision that could not be written converges the next time the chat opens. It only ever moves unverifiable to interrupted, never back, and never from an older build's proof, which names no owner. A second run finds nothing to change and writes nothing. The explanation row is named after the proof it explains (the chat, the owner's fence, and when the death was found), so a retry after a settle that was only partly written revises that row instead of adding a second one. Each write batch keeps its own per-attempt id, because a retry splits only what is left into batches, and reusing an earlier batch's id would make the journal skip that batch as already written. It cannot touch a newer agent's turn: a proof exists only while the record is released, a new start clears it, and the newer agent's turns carry its own fence. Because the trigger sits where every proof is written, a new kind of proof needs no extra call. One side effect: when an agent's exit is seen but the turn's own settlement write fails, recording the exit now retries the settle at once, where main left the turn running until the chat was next opened. Quit stops listening first and waits for any settle already queued. Clients see the change as an ordinary timeline update.
• Parking a chat for recovery no longer claims the agent was alive. On relaunch, a chat whose agent Orca cannot drive is parked for recovery, and parking used to stamp the renewal time with the relaunch. Nothing at that moment vouched for the agent through its connection: either the check could not tell, or it found an agent that outlived Orca but whose output no longer reached anyone. Recovery then stops that agent and records its death from the same record, so the turn would have counted the downtime. The three places that park a chat (relaunch, and two failed-start paths) now leave the renewal time alone; the record's own last-updated time still moves.
• The explanation row. Main now words this row from the agent's name alone and never puts a proof's detail into it, since that detail is Orca's log text. This PR does not change the row's words; it only decides when the row is added.

Unchanged for the user (every reader checked): sidebar, mobile and dashboard status dots, Smart Sort, notifications, the resume-after-restart offer (a crash writes no resume marker) and send gating. These read "running or not", or the turn's outcome, which this settle does not set.

Related display change: #23467 changes the folded line for these turns from "Worked for N" to "Interrupted after N", and shows the unproven case as "Couldn't confirm". This PR supplies the end time that line reads.

Why

The unverifiable state exists for deaths Orca cannot prove, such as lost contact with an SSH host. Using it for a local process Orca has just proven gone told the user less than Orca knew.

Alternatives considered:

• The later of the last proof of life and the last live timeline row (this PR's previous revision). It is up to 10 s closer for a chatty agent, but a row does not say who wrote it, so a send accepted before the proof of death ended the turn at the send and counted the downtime. Counting only rows of certain kinds still counts Orca's own status notes, and telling the agent's rows apart would need a new saved field on every row.
• End at the last live row alone (an earlier revision). It is right for a chatty agent, but its error has no limit: a silent command or long hidden reasoning writes no rows, so the undercount grows with the command.
• Keep excluding parked chats when capturing, instead of fixing the stamp. That adds a second rule beside the one that writes the wrong time. Fixing the stamp makes the renewal time mean one thing everywhere.
• List which proof kinds count. That is a second copy of a fact the record already carries: a proof is written only when death was proved. Reading its presence keeps the turn verdict and the exit answer from disagreeing.
• End the turn at the check's time. That is simpler, but the duration would include the downtime, which is wrong in the one place the end time is shown.
• Keep unverifiable when the process was replaced by another. A verified mismatch is positive evidence that the recorded process no longer exists, so it proves the death as much as a missing process does.

Differences from the common pattern

Comparable desktop agent hosts, on a restart, close a conversation's active turn as interrupted (or mark the session errored) from state they already hold, best effort. This PR matches that for a proven local death. Deviations:

• End time. Those hosts stamp the interruption at detection time. This PR ends it at the last proof of life, because the end drives the shown duration. None of them carries a heartbeat into the turn's end; Orca's renewal is its own fact.
• A provisional verdict first. Those hosts settle once, at detection. Here the open can run before detection, so a chat on screen at relaunch first reads "Couldn't confirm" and is revised to interrupted when the check (or a recovery that stops an agent that outlived Orca) proves the death, usually within seconds. The alternatives were to make every read wait for the startup check (up to about 14 s before a chat shows anything) or to have a read run the process check itself; both put the check in the path of reading a chat.
• Unproven deaths. Those hosts have no separate state for a death they could not prove. Orca keeps unverifiable for that case: its execution host can lose contact with an agent without the agent being dead.

Linked Issue

Part of the native-chat "a chat never gets stuck" series. Follows #22820, which made a recorded proof of death mean the death was actually proven.

Visual Proof

Full-app QA of this PR's final head (728d3ec9bc2) against its merge base with main (ccdb324b63e), from identical starting states per arm, on a remote macOS machine with the real Claude CLI. The Electron main process was killed with kill -9 mid-turn, left down about 90 s, then relaunched with the same profile and the chat on screen. The Codex rows come from an earlier full run on a second Mac (real Codex CLI, isolated background build, head c32dd598bc); their silent command ended at the last proof of life, which is what the final rule does.

	Before (base)	After (this PR)
Claude running sleep 120, crash about 28 s in, chat ON SCREEN at relaunch	"sleep 120 · 1 failed" only: no duration, no explanation, and it never changes	The first frame with the chat already reads "Worked for 18s", folded
Claude, fold opened		Exactly one "Claude stopped while this response was in progress. You can continue in this conversation." row; no process-id text
Claude, the next message		Answered, with no duplicate row
An owner this host cannot check (seeded as a remote host)		Stays "Couldn't confirm" with no row, unchanged for 35 s
Codex running a silent sleep 120 (c32dd598bc)	No duration, no explanation	"Worked for 26s" for 29.4 s of real work
Codex, fold opened (c32dd598bc)		"Codex stopped while this response was in progress…"

• The duration is a lower bound. It ends at the last time Orca proved the agent alive (renewed about every 10 s), so it can read up to one renewal interval short, and it never counts the time Orca was down. In the final run the last renewal came 9.1 s before the kill: "Worked for 18s" for about 28 s of work.
• "Couldn't confirm", then "Worked for N": in every live run the proof of death was written (about 1 s after the renderer was ready) before the chat first painted, so the chat showed its final state immediately. The path where a chat reads first and then changes is pinned by the host-level tests below.
• A normal reply, a clean quit and a relaunch re-settle nothing, with no renderer or main-process errors.
• The status words ("Interrupted", "Couldn't confirm") on the tab, sidebar and folded header come from fix(agent-status): a turn a crash cut off reads Interrupted, an unproven end Couldn't confirm #23467; this PR changes the turn's recorded outcome and its duration.
• The launcher for these runs refused a home that resolved to the machine's real home, ran with rig-local HOME and config folders, and had agent hooks off. The real ~/.codex and ~/.claude config files were hashed before and after every run and did not change.

Testing

• I manually tested these changes locally
• Automated tests added/updated

New and changed tests (each shown red with its core line removed or restored):

Case	What it pins	Change that turns it red
Verdict from a seen exit, a missing process, a replaced process, and no proof	Interrupted at the exit; interrupted at the last proof of life, never after the check; the check's time when no proof of life was recorded; unverifiable with no proof	Only a seen exit counts (2 red); end at the check's time (2 red); no proof reads interrupted (1 red)
Relaunch after a crash mid-turn, process check finds it gone (whole host, read restore and attach)	Interrupted at the last proof of life, or at the turn's start when that renewal predates it; the default "provider stopped" row appears; no status claims a turn outcome	The same three changes (4 red)
Relaunch with an agent on a host this one cannot check	Stays unverifiable: no end time, no row	No proof reads interrupted (red)
Seen exit before a quit (regression)	Keeps its exit time; the row names the agent, not the exit's detail	—
A command whose output kept streaming past the last renewal, then a proven death (real timeline)	Ends at the last proof of life, not at a row written after it	The previous revision's end rule (red: ends at the later row)
A crash with the agent's last row at 200 and last proof of life at 210, the reopen finding no proof yet, a send accepted at 3,605,000, then the proof at 3,606,000 (real timeline)	Ends at 210, not at the send	The previous revision's end rule, the later of the proof of life and the last live row (red: ends at 3,605,000)
A proven death whose last proof of life predates the turn's start	Ends at the turn's start, never before it	Drop the clamp (5 red: the unit test and 4 relaunch tests whose seeded renewal predates the turn)
Verdict with a last proof of life before and after the check, and with none; a seen exit with one	Ends at the proof of life, never after the check, and at the check when none was recorded; a seen exit still ends at the exit	Drop the proof of life from the end rule (red)
Claude-shaped crash mid-tool: one Bash row at T, renewal at T+25 s, relaunch an hour later, process gone (whole host, read the way a client reads)	Ends at T+25 s and shows "Worked for 27s" through the display's own timing code	Drop the proof of life from the end rule (red: ends at T, 2 s)
The same crash, but the agent outlived Orca: the check finds it running, recovery stops it, then finds it gone	The proof of death keeps the pre-crash renewal, and the turn ends at T+25 s	Stamp the relaunch time when parking for recovery (red: ends at the relaunch, counting the hour)
A failed start parked for recovery, before and after the agent proved itself, then its death recorded	The renewal time keeps the last proof of life, and the proof of death carries it	Stamp the failure time when parking (2 red)
Saved store: relaunch after a renewal, then reload; a proof an older build wrote; an impossible interval	The new field round-trips; an old proof loads unchanged; a proof of life after the check is set aside like any other invalid record	Drop the field's validation (red)
The proof of death records the last renewal, never after the check	The field is the renewal time; a clock that stepped back writes the check's time	Drop the capture (8 red across files); drop the cap (red)
A send or a reader opens a crashed chat nobody had open (the open-time settle from #22821)	A proven death reads interrupted; one nothing proved stays unverifiable	Only a seen exit counts (2 red)
A start after the crash spawns an agent and fails without proving it gone; recovery later finds that agent gone; a new start settles the old turn (whole host)	The old turn is unverifiable: the proof is about the newer agent	Judge any turn by the latest proof (red: ends at the relaunch, an hour after the crash)
A start after the crash fails and cleanup watches its agent exit; a new start settles the old turn (whole host)	The old turn is unverifiable, not ended at the failed start	Same (red); leave the owner out of a failed start's proof (red)
Verdict with a proof about another owner, an older build's proof, and a turn whose writer is unknown	Another owner's proof and an unknown writer: unverifiable. An older build's watched exit: interrupted at the exit; its probe proof: unverifiable	Judge by any owner (red); older builds' proofs always unverifiable (4 red, including 2 upgrade tests for chats left mid-turn)
The crash left a send in doubt, which the reopen settles at the new fence (whole host, both paths)	The turn still ends at the last proof of life, reading about 27 s	Take the turn's owner from the newest row instead of the row that created it (2 red)
Every proof-of-death writer (process check, ownerless reservation, failed start ×3, closing the last view past a recovery floor)	Each names the owner it released	Drop the field from each writer (red each); a malformed ownerFence is set aside like any invalid record
The chat is read (and subscribed to) before the startup check; the check then proves the owner gone (whole host)	Reads unverifiable, then interrupted at the last renewal, "Worked for 27s", one explanation row; the subscriber is sent both	Drop the revision (4 red); don't re-run the settle when a proof is written (5 red)
The chat is read before the startup check, and its agent outlived Orca: the check finds it running, recovery stops it, then finds it gone (whole host, no send)	The turn goes from unverifiable to interrupted at the last renewal, and no agent is started	Re-run the settle only after the startup check, as this PR's previous revision did (red: stays unverifiable); don't re-run it when a proof is written (red)
An agent exits mid-turn and the timeline refuses the exit's own settlement write once (main's test, adapted)	Settled in place with the row naming the agent, the chat still open, no new agent; refusing the retry too still leaves the reopen, the read after a restart and the next send to settle it (main's tests for those now refuse the retry as well)	Don't re-run the settle when a proof is written (red: stays running)
The saved store's notice: a failed write, the startup check's proof, a later unrelated write, a listener that unsubscribed	Told exactly once, after the proof is on the record; never for a write that proved nothing	Tell for any record that holds a proof (red); the previous revision's callback on the startup check only (red)
A start after the crash runs the check itself while the chat is open, and its new agent is already writing a turn (whole host)	The old turn is interrupted; the new agent's running turn is left alone	Re-run the settle without requiring a proof (red: the new turn reads unverifiable)
The revision's write fails, then the chat closes and is opened again	Stays unverifiable (no running turn), then the reopen revises it to interrupted	Drop the revision (red)
A turn settled unverifiable, then proofs about another owner, from an older build, and about its own owner, settled twice	Only its own owner's proof revises it, once; the second run writes nothing	Revise from any owner's proof (red); revise from an older build's proof (red); add the explanation row on every run (2 red)
A settle too big for one write batch: the second batch fails, then the settle runs again (real timeline)	Every turn ends interrupted, with exactly one explanation row	Name the row by the attempt, as before (red: two rows); reuse the batch ids across attempts too (red: 199 turns left running)
v1.4.211 opens a store this build wrote after a proven death	Reads the record and keeps both new fields	A compatibility pin: this build cannot turn it red, because the older validator ignores unknown keys by design

Runs (latest, with the end at the last proof of life): vitest over the ten files this rule touches (the verdict, the crash-turn end, the stale-turn open and send-open, unexpected exit, the wedged-profile relaunch, surface lifetime, the journal reducer and store, and death-evidence persistence): 155 tests pass. The earlier full run over src/main/native-chat, src/main/runtime/agent-session*, src/main/runtime/structured*, src/shared/agent-session* and src/shared/structured-agent* (298 files, 2,863 tests) predates this change. The two cross-version downgrade tests against v1.4.211 pass in CI. pnpm tc:node and pnpm tc:web are clean, oxlint on the changed files is clean, and check:code-quality:changed and audit:anti-slop pass.

Review

Mixed versions and saved data:

• No wire change. interrupted with an end time is an existing timeline state that every client already renders.
• Two new saved fields, both optional, on the proof of death in the host's own session store: lastProvenAliveAt and ownerFence. They never reach the renderer, mobile or a remote client.
• Why a field, and why this one: a death is an interval, from the last time Orca proved the agent alive to the check that found it gone. The proof already stored the upper end; the new field is the lower end. It has to be saved because recording the death overwrites the renewal time, so the fact is gone once the record moves. Saving the lower end rather than a finished turn end leaves the turn's end derived when it is settled, and would also answer "how long was Orca down" later.
• Why ownerFence, and why the fence is enough: a proof of death is a fact about one owner, and a released record no longer holds that owner. The fence is the record's generation key. It moves only when a new owner reserves (always to a new number, never reused, even after the store falls back to its backup) and when an owner is released, and only a reservation can take on a process. So a fence names exactly one owner, and the process identity (pid, start time) adds nothing the turn could be matched on: timeline rows carry the fence, not the process. It has to be saved because the fence the dead owner held is gone from the record once it is released, and it cannot be reliably worked out afterwards: a release usually moves the fence one step, but a floor raised when the store falls back to its backup silently breaks that inference, so it is recorded when the death is.
• Downgrade: v1.4.211 checks only the proof's kind, detail and time, so it keeps and ignores both fields. Pinned by a cross-version test that opens, with v1.4.211's record store, a store this build wrote after a proven death.
• A proof an older build wrote names no owner, so it keeps that build's rule: a watched exit ends the turn at the exit, and anything else leaves it unverifiable, as on main. This applies only to a proof the older build recorded itself; a crash under an older build is proved at the relaunch, which this build writes. A chat an older build parked for recovery still carries that build's relaunch stamp; if this build then records its death, the end can include the downtime up to that older relaunch, for that one turn.

Who reads the renewal time (lastRenewedAt, found by renaming the field and typechecking the node and web projects):

• withLease in agent-session-lease-transitions.ts:39 copies it into the record's last-updated time. Nothing but the validator reads that, and the three parking transitions now set it themselves.
• The record validator in agent-session-record.ts: requires a safe integer.
• deathEvidenceFor in agent-session-lease-adjudication.ts: the new reader.
• Tests only otherwise. Every other hit is a write: reservation, spawn seen, identity proved, renewal, provider handle recorded, timeline checkpoint (no production caller), release, recorded death and clearing a free record.
• The renewer does not read it; it renews on a timer and skips parked chats.

Carrying the old owner's proof forward (follow-up): when a start after the crash fails before the old turn is settled, that turn now reads unverifiable, because the start's reservation cleared the relaunch's proof about its owner. Settling the old turn when the reservation is granted, or keeping the proof per owner, would let it read interrupted. That changes the order of acquisition, which is outside this PR.

Sidebar and tab display follow in a stacked PR: this PR fixes the turn's lifecycle and verdict on the host (the chat transcript). The sidebar, tab and mobile status still show a crash-cut chat as done, because on main no status display reads a turn's outcome yet; that display vocabulary arrives with #22944. A small PR stacked on #22944 adds two host-observed outcomes derived from this lifecycle: interruption (a proven mid-turn death, shown as Interrupted and ranked as news, never a user cancellation) and unconfirmed (an ending Orca cannot prove, shown as "Couldn't confirm").

Merge order with #22944: #22944 (on the accept-then-deliver stack) demotes turns stopped by the user in attention and sorting. It reads a turn's outcome, which this settle never sets, so a crash-cut turn is not classified as a user cancellation. The restart test here asserts that no status carries a turn outcome, which covers the composition from this side. Once both are on main, a test through #22944's agentTurnStoppedByUser should be added.

Overlap: #23131 has a test that asserts unverifiable for this case; whichever lands second flips it. #22821, now on main, also settles when a send or a reader opens the chat; its test asserted unverifiable for a proven death, and this PR flips it. #22835, now on main, pins that a read before the startup check settles the turn; its test asserted unverifiable, and now asserts unverifiable, then interrupted. #22835 also pins that a turn whose exit settlement could not be written is settled by the next open; that test now refuses the in-place retry as well, so it still pins the open.

Merging main: main has since moved the fold that settles a sent message's delivery into its own file, which this PR had also done to stay under the reducer's line limit; this PR now uses main's file. Main also rewrote this settle's explanation row (see "The explanation row"), which superseded this PR's own copy change.

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Known weaknesses

• The duration can read up to about 10 s short. A process-checked death ends at the last renewal, which Orca writes about every 10 s, so the work between that renewal and the death is not counted. The duration never counts the time Orca was down. In QA: 22 s for 26.6 s of work (Claude, silent command), 26 s for 29.4 s (Codex, silent command), and about 15 s for 18.6 s (Claude, streaming reply).
• A crash within one renewal of the turn's start can read "Worked for 0s". When the last renewal came before the turn started, the turn ends at its start, never before it: a lower bound, not the real work time.

Notes

• SSH and remote hosts: a death is proven only on the execution host that owns the process. For an agent on another host the check cannot answer and writes no proof, so its turn stays unverifiable, per docs/reference/ssh-execution-boundary.md.
• Windows: the same process checks; no platform-specific change.
• Folder workspaces: not affected.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

Author X handle: @BrennanKB5

[brennanb2025]

Status: ready for review. Head 286b1b3f1e, based on main, CI green (23 pass, 0 fail).

Review: eight review loops, the last one clean. Design changes made along the way, each with tests that fail when the change is removed:

• A crash-cut turn ends at the later of Orca's last proof that the agent was alive and its last output, never counting downtime.
• Each proof of death names the agent run it describes, and a turn only takes a verdict from its own agent's proof.
• A chat on screen before the startup check first reads "Couldn't confirm", then changes to "Worked for N" once the proof lands. That change fires from the one place proofs are written, so recovery and future writers trigger it too.
• The explanation row is keyed by the death it explains, so retries never duplicate it.

Live QA (full app): Claude on a remote Mac and Codex on a second Mac, crash mid-turn then relaunch, compared with base. All scenarios pass; details and screenshots are in Visual Proof.

• Claude mid-sleep 120: "Worked for 22s" for 26.6 s of work. Codex mid-silent sleep 120: "Worked for 26s" for 29.4 s. Base shows no duration or explanation.
• An owner Orca can't check stays "Couldn't confirm". A normal reply, quit and relaunch re-settle nothing.
• In these runs the proof landed before the chat first painted, so the brief "Couldn't confirm" step wasn't visible; host-level tests pin it.

Known limits:

• The duration can read up to one liveness-check interval (about 10 s) short.
• If a message is sent in the seconds before the startup check, the explanation row lands after it.
• The status words in the tab, sidebar and folded header come from fix(agent-status): a turn a crash cut off reads Interrupted, an unproven end Couldn't confirm #23467.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: c6699a35-10b9-4b73-9cbc-05a6c41b781e

📥 Commits

Reviewing files that changed from the base of the PR and between 0b0beb5 and 728d3ec.

📒 Files selected for processing (2)

• src/main/runtime/agent-session-record-store.ts
• src/shared/agent-session-lease-adjudication.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds owner-fence and last-proven-alive data to session death evidence. Journal items retain their creation fence, and settlement uses matching evidence to determine turn state and completion time. The record store notifies listeners when death evidence changes, allowing conversation delivery to schedule resettlement for indexed open sessions. Tests cover evidence persistence and validation, delayed settlement, retries, and cross-version reads.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 728d3

Crash recovery now uses owner-matched death evidence to revise eligible turns. No concrete user-facing regression is established, so the change appears mergeable after normal checks.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 728d3

The change is limited to opt-in structured chat and does not show a new attacker entry point. A timing gap may leave an interrupted answer with an outdated status if ownership changes before queued recovery work runs.

Retained concerns

• Low · reliability · inferred: If a new owner reservation clears committed death evidence before a queued resettlement reads the record, the prior owner's open turn may retain an unverifiable rather than interrupted verdict. Reachability of that ordering on production attach paths remains unconfirmed.

Security review details

Security Blast Radius

• inferred — The inspected listener operates within the structured chat host and exposes session IDs to its internal consumer, not a direct network or agent-controlled callback registration path. The supplied intent places structured chat behind an off-by-default setting.

Trust Boundaries and Controls

• observed — The production listener acts only for indexed sessions and schedules serialized resettlement; the settlement path uses recorded death evidence and per-item owner fences rather than treating every turn as belonging to one owner.

Resilience and Maintainability Implications

• observed — Resettlement errors are reported and left for a later open or acquisition to rederive; the inspected production listener tracks its queued task rather than synchronously throwing from the notification.

Hardening Proposals

• proposed — Preserve the committed owner-fenced proof until its corresponding journal settlement has consumed it, or pass that proof with the notification, so a later reservation cannot erase the evidence needed by queued recovery work.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 39.58% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 48 functions across 27 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: proven native-chat crashes now settle a cut-short turn as interrupted. The wording is slightly awkward but remains specific and understandable.
Description check	✅ Passed	The description is comprehensive and follows the repository template. It explains the user impact, mechanism, rationale, linked issues, visual proof, testing, compatibility considerations, known weakn…

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

✅ No new issues found.

Reviewed changes

• A proven crash now reads interrupted, not unverifiable. The verdict keys on whether the ownership record carries a proof of death that names the turn's owner (ownerFence) rather than on the proof's kind alone. A probe-proven death ends the turn at max(lastProvenAliveAt, journal.lastLiveActivityAt()), capped at the probe's observedAt, so the duration never counts Orca's downtime. Older-build evidence (no ownerFence) keeps main's rule.
• Two new optional record fields. ownerFence and lastProvenAliveAt on AgentSessionDeathEvidence, validated (lastProvenAliveAt <= observedAt, ownerFence >= 0) and set by every proof writer. Never sent over the wire; a v1.4.211 downgrade test confirms an older store ignores them.
• Journal tracks what the provider actually wrote. lastLiveActivityAt excludes recovered rows (crash reconciliation is not the provider working), and itemFences records the generation that created each item so a turn is judged only by its own owner's proof.
• An open chat is revised when the proof arrives. AgentSessionRecordStore.onDeathEvidence fires post-commit for each record given a new proof; the delivery layer queues a serialized resettleOpenStructuredAgentSessionConversation for open chats and stops listening on dispose. provenUnverifiableTurnRevisions only moves unverifiable → interrupted, and the explanation row is keyed by the death it explains so retries add one row.
• A lease parked in recovery no longer claims the agent was alive. Restart and failed-acquisition parking keep lastRenewedAt and move updatedAt instead.

Tests read as genuine coverage: I ran the new structured-agent-session-crash-turn-end.test.ts (9 pass) and the five edited test files (64 pass). I also independently probed the store-notification path (every deathEvidence write is one-shot and reference-stable on unrelated writes; all transact callbacks are synchronous) and the turn-end arithmetic (completedAt >= startedAt holds because a judged turn's creating row is always live; the lastSeen > 0 guard prevents a zero end).

ℹ️ The turn end leans on a journal-global live-activity bound

turnVerdictFromDeathEvidence uses journal.lastLiveActivityAt(), a maximum over every live row in the journal, not just the judged owner's rows. This is safe today only because the host's ordering guarantees no other owner's live rows exist when a turn is judged, but the bound's name suggests a scoping the code does not enforce, so a future change that judges a turn later in the lifecycle could silently inherit a newer owner's activity. No change requested — flagging the invariant so it survives refactors.

Technical details

# Title
`lastLiveActivityAt()` is journal-global; the verdict assumes single-owner journals at judge time

## Affected sites
- `src/main/native-chat/agent-session-wire/structured-agent-session-stale-turn-verdict.ts:53` — `Math.max(evidence.lastProvenAliveAt ?? 0, journal.lastLiveActivityAt())`
- `src/main/native-chat/agent-session-journal/journal-reducer.ts:85` — updates the journal-wide max, with no fence parameter
- `src/main/native-chat/agent-session-wire/structured-agent-session-crash-turn-end.test.ts:353` — "never touches the turn a start after the crash is writing" pins the current ordering: `turn-1` ends at `LAST_RENEWED_AT` although `turn-2`'s live row is present later in the test

## Required outcome
None currently — this is informational. The invariant to preserve: when `settleStaleStructuredAgentSessionState` judges a turn, the only live rows in the journal belong to the turn's own owner (guaranteed because a reservation clears `deathEvidence`, and the settle runs before a new child's buffered events land).

## Suggested approach (optional)
If the global bound is ever loosened, scope the live-activity read to the judged owner's fence (the journal already tracks `itemFences`) rather than changing call order.

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the single commit since the prior Pullfrog review (286b1b3 → e5cf5a0), which re-scopes where a crash-cut turn gets its end time.

• Owner-scoped provider activity. The journal-global lastLiveActivityAt is gone; the reducer now keeps providerActivityAt: Map<fence, ts> and the verdict reads journal.lastProviderActivityAt(evidence.ownerFence). This closes the prior review's informational note directly — a newer owner's live rows can no longer inflate the judged turn's end.
• Only the provider child's own output counts. New isLiveProviderOutput classifies rows — item/tombstone/lifecycle-batch count when live, submission/dispatch/epoch never do. A send accepted into a crashed chat before the proof no longer ends the turn at the send.
• Two regression tests pin both paths (structured-agent-session-stale-turn-verdict.test.ts): a send accepted before the proof, and a newer owner's work. Each goes red on the old global bound.

I confirmed the classifier is exhaustive over all six JournalRow kinds, that every Orca settlement batch writes recovered: true (so Orca's own post-crash writes cannot count as provider activity), and that the two changed test files pass (62 tests).

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes

Reviewed the single new commit ed7cce41 (since e5cf5a0), which replaces the per-fence provider-activity bound with a renewal-only end rule.

• Timeline rows no longer bound the turn end. providerActivityAt, isLiveProviderOutput, lastProviderActivityAt and lastLiveActivityAt are all removed, and turnVerdictFromDeathEvidence no longer takes the journal. A probe-proven death now ends at min(lastProvenAliveAt ?? observedAt, observedAt). This sidesteps the earlier revision's weakness — a timeline row does not say who wrote it, so a send accepted into the crashed chat could end the turn at the send.
• A floor at the turn's start. settledLifecycle clamps completedAt up to max(requestedAt ?? 0, startedAt ?? 0), so a renewal that predates the turn cannot end it before it began.
• journal-store-restore.ts revert. The open/restore recovered: true stamp is gone, consistent with no reader of that flag remaining for this feature.

I verified the stated invariant holds: the clamp cannot push the end past the probe, because requestedAt is a host-clock value (the submission row's ts) and so began <= observedAt. No references to the removed symbols remain, git diff origin/main...HEAD -- journal-store-restore.ts is empty (net-zero vs main), and the changed tests pass — stale-turn-verdict (20) + journal-reducer (40), plus crash-turn-end (9), send-open-stale-turn (5), stale-turn-open (3), and wedged-profile-migration (19).

  ^{｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[greptile-apps]

Confidence Score: 4/5

[High risk] Rewrites how agent session crashes are settled and tracked.

The PR is not yet safe to merge because a proof committed during conversation opening can leave the visible turn unverifiable.

Findings

1.  Death proof missed during opening ▶

Summary

The PR uses owner-specific proof of death to settle crash-cut structured-chat turns as interrupted, records their last proven-alive time for the displayed duration, and revises an open chat when proof arrives later.

• Adds persisted death-evidence fields, journal fence tracking, and regression tests for restart and recovery paths.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart LR
  A[Open journal] --> B[Settle running turn provisionally]
  C[Death proof commits] --> D{Session indexed?}
  D -- Yes --> E[Queue resettle]
  D -- No --> F[No resettle queued]
  B --> G[Index session]
  F --> G

Loading

_{Reviews (2) · Last reviewed commit: "Merge remote-tracking branch 'origin/mai..."}

[greptile-apps]

Death proof missed during opening When a chat starts opening before restart reconciliation, it reads the record before opening its journal and registering in sessions. If proof of death commits during that opening, this callback sees no registered session and queues no resettle. The open can then use its earlier record to mark the turn unverifiable, leaving the on-screen chat that way until it is reopened instead of changing it to interrupted when the proof arrives.

[brennanb2025]

Status: ready for review. Head 728d3ec9bc2, based on main, CI green (34 pass, 0 fail), mergeable. This replaces the earlier status comment.

Since the last status comment:

• The end of a crash-cut turn is now only the last time Orca proved the agent alive, capped at the proof of death and never before the turn started. The earlier rule also took the agent's last timeline row, but a row doesn't say who wrote it, so a message sent before the proof of death stretched the turn over the downtime. A readiness check reproduced that ("Worked for 1h"), and it can't happen now.
• Main merged in twice, with only this PR's changes remaining each time.

Review: eight review loops plus a confirming pass on the last change, all clean at the end. Every design change has tests that fail when the change is removed.

Readiness check: passed with no findings at this head. It ran twice, at 286b1b3f1e and at the final head, but not at the very start of the review; that's disclosed here. A remaining, unproven risk: if another session's startup check records this chat's proof of death in the moment between a send reading the chat and settling it, the chat keeps "Couldn't confirm" (main's current behaviour) until the next send or reopen.

Live QA at this head (a remote Mac with the real Claude CLI; details and screenshots in Visual Proof):

• A crash 28 s into sleep 120, with the chat on screen: the first frame already reads "Worked for 18s", with one "Claude stopped…" row and no process-id text. Base shows no duration or explanation.
• An owner this host can't check stays "Couldn't confirm". A normal reply, quit and relaunch re-settle nothing.
• The earlier Codex run (real Codex CLI): "Worked for 26s" for 29.4 s of work.

Known limits:

• The duration can read up to about 10 s short (one liveness renewal). A crash within one renewal of the turn's start can read "Worked for 0s".
• The live runs never showed the brief "Couldn't confirm" step, because the proof landed before the chat painted; host-level tests pin it.
• The status words on the tab, sidebar and folded header come from fix(agent-status): a turn a crash cut off reads Interrupted, an unproven end Couldn't confirm #23467.