fix(native-chat): after a crash, show an unconfirmed message as sent with one chat notice instead of guessing from the transcript

docs/reference/agent-status-store.md

@@ -107,9 +107,12 @@ ingests the summary into the hook server as a status row:
 
 Sessions with no request (`status === null`) produce no row. A request is a
 turn record, an assistant message, a user message the provider journaled itself
-(history, an older host), an accepted or unanswered send, or a send the agent or
-its start refused; a send that was withdrawn, or left undelivered by a
-restart or a close, fails nobody and makes nothing listable.
+(history, an older host), an accepted or unanswered send, a send left in doubt
+by a crash, a dead agent, its turn's end, a Stop or a start that threw (drawn as
+sent; it adds no verdict of its own), or a
+send the agent or its start refused; a send that was withdrawn, or refused
+because a restart or a close came before it was handed over, fails nobody and
+makes nothing listable.
 `summary.turnOutcome` is the latest request's verdict: its turn's outcome, or
 `failure` for a send the agent or its start refused (a send that joined a running
 turn is answered by that turn). The row also publishes `interrupted` from

docs/reference/remote-wire-compatibility.md

@@ -245,6 +245,16 @@ The cross-version suite derives the old client's list by removing this capabilit
 baseline's own list, per the rule above, so the downgrade stays exercised after a release ships
 it.
 
+The same boundary carries a second downgrade, `agent-session.crash-doubted-send.v1`
+(`structured-agent-session-recovered-send-capability.ts`). A send a crash or a dead agent left in
+doubt for good (`unknown` with `recovered`) is drawn as an ordinary sent message, as is an older
+host's inferred `not_delivered`; a client that predates that reading drew the first unconfirmed,
+with a Retry that held its queue, and hid the second. So whatever
+`structuredAgentSessionSubmissionSettlement` reads as sent reaches such a client as `accepted`, the
+one state it already draws as sent, on history, the live stream and a replayed send's reply. The
+journal keeps the real facts. Both compositions live in
+`structured-agent-session-client-projection.ts`, so history and the stream cannot disagree.
+
 ## Known debt: JSON-RPC errors drop Node's string code
 
 An error raised on an SSH host crosses the relay as JSON-RPC, and

mobile/src/session/mobile-structured-send-delivery.test.ts

@@ -13,30 +13,30 @@ function accepted(
 }
 
 describe('mobileStructuredSendDelivery', () => {
-  it('keeps the operation id for every unknown, host-recorded or ack-lost', () => {
-    // The one answer that may be a delivery. Spending the id here turns the next
-    // identical send into a second copy in front of the model.
+  it('keeps the operation id when the reply was lost, so a retry stays a replay', () => {
+    // The host may never have recorded it; rotating here is what sent one message five times.
     expect(mobileStructuredSendDelivery({ status: 'unknown' })).toEqual({
       outcome: 'unknown',
       operationIdSpent: false,
       error: null
     })
-    expect(mobileStructuredSendDelivery(accepted('unknown'))).toEqual({
-      outcome: 'unknown',
-      operationIdSpent: false,
-      error: null
-    })
   })
 
-  it('reports a written send as sent and spends its id', () => {
-    // `pending` is written and awaiting the provider's acknowledgement — not doubt.
-    for (const dispatchState of ['accepted', 'pending'] as const) {
+  it('reports a written send as sent and spends its id, in doubt or not', () => {
+    // `pending` awaits the provider's acknowledgement; `unknown` is doubt the host recorded and
+    // the chat draws as sent. Typing it again is a new message, as on the desktop.
+    for (const dispatchState of ['accepted', 'pending', 'unknown'] as const) {
       expect(mobileStructuredSendDelivery(accepted(dispatchState))).toEqual({
         outcome: 'accepted',
         operationIdSpent: true,
         error: null
       })
     }
+    expect(mobileStructuredSendDelivery(accepted('rejected', 'not_delivered'))).toEqual({
+      outcome: 'accepted',
+      operationIdSpent: true,
+      error: null
+    })
   })
 
   it('does not report a retained payload replay as a new accepted send', () => {

mobile/src/session/mobile-structured-send-delivery.ts

@@ -11,19 +11,21 @@
 // ledger and never puts it back on the wire. Releasing the id turns that replay
 // into a genuine second delivery, which is why only a settled answer releases it:
 //
-//   accepted/pending — the send happened. The id is spent; a later identical
-//     message is a new message and must carry a new id.
+//   accepted/pending/unknown — the host recorded the send, and the chat draws it
+//     as sent even when a crash or a dead agent left its delivery in doubt. The id
+//     is spent; a later identical message is a new message, which is how the chat
+//     continues, and must carry a new id.
 //   rejected — a terminal refusal or rejected submission spends a fresh id. A
 //     pending-admission refusal, or any refusal after earlier transport doubt,
 //     keeps it because neither proves a retained delivery did not happen.
-//   unknown — the one answer that KEEPS its id, whether it came from the host or
-//     from an ack-loss on the way back. The message may be with the provider, so
-//     the retry has to stay a replay. Rotating here is what sent one message to a
-//     model five times.
+//   no answer — an ack-loss on the way back KEEPS its id: the host may not have
+//     recorded the message, so the retry has to stay a replay. Rotating here is
+//     what sent one message to a model five times.
 
 import type { AgentSessionSendResult } from '../../../src/shared/agent-session-wire'
 import { agentSessionRefusalOperationState } from '../../../src/shared/agent-session-refusal-retry'
 import { structuredAgentSessionRejectionNotice } from '../../../src/shared/structured-agent-session-send-disposition'
+import { structuredAgentSessionSubmissionSettlement } from '../../../src/shared/structured-agent-session-submission-settlement'
 import type { MobileNativeChatSendOutcome } from './mobile-native-chat-send'
 import type { StructuredAgentSessionMutationCallResult } from './mobile-structured-agent-session-rpc'
 
@@ -61,10 +63,10 @@ export function mobileStructuredSendDelivery(
     }
   }
   const submission = result.value.submission as AgentSessionSendResult['submission'] | undefined
-  if (!submission || submission.dispatchState === 'unknown') {
+  if (!submission) {
     return { outcome: 'unknown', operationIdSpent: false, error: null }
   }
-  if (submission.dispatchState === 'rejected') {
+  if (structuredAgentSessionSubmissionSettlement(submission) === 'refused') {
     return {
       outcome: 'rejected',
       operationIdSpent: true,

mobile/src/session/mobile-structured-send-operation-journal.test.ts

@@ -171,18 +171,19 @@ describe('mobile structured send operation journal', () => {
       clientMessageId: operationId,
       fence: 1,
       payloadFingerprint,
-      dispatchState: 'unknown' as const,
+      dispatchState: 'pending' as const,
       providerItemId: null,
-      reason: 'ack lost',
+      reason: null,
       submittedAt: NOW,
-      resolvedAt: NOW
+      resolvedAt: null
     }
 
     await clearMobileStructuredSettledSendOperations({ submissions: [submission] })
     expect(values.size).toBe(1)
 
+    // Doubt the host recorded is settled too: the chat draws it as sent.
     await clearMobileStructuredSettledSendOperations({
-      submissions: [{ ...submission, dispatchState: 'accepted', reason: null }]
+      submissions: [{ ...submission, dispatchState: 'unknown', reason: 'ack lost' }]
     })
     expect(values.size).toBe(0)
   })

mobile/src/session/mobile-structured-send-operation-journal.ts

@@ -185,7 +185,7 @@ export async function clearMobileStructuredSettledSendOperations(input: {
 }): Promise<void> {
   const settled = new Set(
     input.submissions.flatMap((submission) =>
-      submission.dispatchState === 'accepted' || submission.dispatchState === 'rejected'
+      submission.dispatchState !== 'pending'
         ? [`${submission.payloadFingerprint}\u0000${submission.clientMessageId}`]
         : []
     )

src/cli/runtime/websocket-transport.test.ts

@@ -19,6 +19,7 @@ import { addEnvironmentFromPairingCode } from './environments'
 import { RuntimeClientError } from './types'
 import {
   AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
+  AGENT_SESSION_RECOVERED_SEND_CAPABILITY,
   AGENT_SESSION_TURN_ITEM_CAPABILITY,
   AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
   AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,
@@ -76,6 +77,7 @@ describe('CLI remote WebSocket transport', () => {
           AGENT_SESSION_BACKGROUND_TASK_STOP_CAPABILITY,
           AGENT_SESSION_BACKGROUND_TASK_ROW_STOP_CAPABILITY,
           AGENT_SESSION_TURN_ITEM_CAPABILITY,
+          AGENT_SESSION_RECOVERED_SEND_CAPABILITY,
           SESSION_TAB_CLOSE_INTENT_RUNTIME_CAPABILITY,
           SESSION_TABS_AUTHORITATIVE_INVENTORY_RUNTIME_CAPABILITY,
           AGENT_SESSION_BOUNDARY_RUNTIME_CAPABILITY,