refactor(native-chat): structured chat failures always reach the diagnostics log

[brennanb2025]

	Files	Added	Deleted	Net
Test	145	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1491	$\color{#cf222e}{\Huge{\mathbf{−}}}$​308	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1183
Prod	76	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​944	$\color{#cf222e}{\Huge{\mathbf{−}}}$​238	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​706

ELI5

When something behind a native chat goes wrong in a way the app deliberately carries on past (a late reply from the agent could not be saved, provider events could not be written to the chat history, a provider start or exit could not be delivered), the desktop app threw the error away. Nobody could find out afterwards what happened. Now every one of those failures is written to the app's diagnostics log file, so it can be found after the fact. A failure that keeps repeating is written once every five minutes with a count, so it cannot crowd everything else out of that file.

What Changed

The problem. The structured chat runtime took an optional onError({ scope, error }) callback. The desktop app (and the headless orcad host, which builds the runtime through the same OrcaRuntimeService call) never passed one, so these failures were silently dropped: a late dispatch settlement, releasing sends an idle provider never answered, provider events the chat journal would not take, provider start/exit events the host could not take, and about a dozen more routed through the host's optional onEventSinkError. A couple of scopes had ad-hoc console.warn fallbacks (#23964), and the chat host had 38 more scattered console.warn calls. In a packaged desktop build the main process has no console to read, so those reached nobody either.

What is different for the user. Nothing visible in the UI. Failures the app carries on past now land in <userData>/logs/main.trace.ndjson (on macOS ~/Library/Application Support/Orca/logs/main.trace.ndjson), the file the "share diagnostics" bundle already collects. Each entry is a failed span named agentSession.<scope> (for example agentSession.late-settlement) with the session id, a one-line message, and the error with its stack, its code (errorCode, plus SQLite's errorErrcode), a refusal's reason (refusalReason) and up to three causes by name and message (errorCause). The headless orcad host now keeps its own trace file, <data-root>/logs/orcad.trace.ndjson (default ~/.orca/logs/), with every trace span it emits (git commands, worktree paths, terminal spawns, structured-chat failures and the rest; documented in docs/reference/orcad-operations.md), and prints each chat entry to stderr, which its service manager captures. The local file is skipped when ORCA_DIAGNOSTICS_DISABLED=1 or in CI, same as every other trace. A logs folder that cannot be opened (permissions, a read-only mount) now leaves tracing off with one warning instead of stopping the desktop app or orcad from starting.

Mechanism.

• The runtime and the host take one required logger (warn/error, each with a message and fields that always carry a scope). The optional onError, onEventSinkError, onLeaseReconcileFailure, onLegacyRecordImportReport and onNoteFailed callbacks are gone; every site that used them, and every console.warn in the host (src/main/native-chat/agent-session-wire/), reports through the logger under its own scope.
• The host hands the same logger straight to each collaborator that reports: the delivery loop, idle sweep, queued-message drain, lease renewer, event sink, conversation map, and provider start/exit settlement. None of them takes an error callback any more. The event sink keeps one hook, onFailed, which is not reporting: it is how the host decides to stop a provider whose journal failed. The dead-generation settlement returns its failure instead of reporting it, so each caller logs it under its own scope (and a closing chat keeps it as the thrown error's cause).
• A chat read whose conversation will not open (open-for-read) now reports through the host's logger, as its write twin already did. So do the callers outside the host that already hold it: chat-tab bookkeeping on open, close, restore and tab-index seed, a failed close's tab restore, a removed workspace's tab drop, a created chat's tab publication, and a created chat's launch prompt.
• createStructuredAgentSessionLogger() is the production logger: a failed span in the local trace sink plus the console. OrcaRuntimeService passes it, so desktop and orcad both get it. It writes a repeated entry at most once per 5 minutes, carrying suppressed: <count> of the repeats it swallowed; it tracks at most 256 such entries. An entry repeats only when everything it would write is the same: level, scope, message, every field, and the error's name, message, code, refusal reason and cause chain (a value that is not an error is compared by its contents). Swallowed repeats are counted on the next write of that entry; if the failure stops, that count is never written. Test loggers record everything.
• orcad installs the same local trace sink as the desktop at startup under its own file name (src/main/orcad/orcad-observability.ts), closes it last in its cleanup (after every quit handler), and flushes it on process exit, so a 15-second shutdown deadline, a failed start or an uncaught exception keeps what was buffered.
• Reporting can never break the operation it reports: the runtime install and the host constructor wrap the logger so a logger that throws falls back to console.warn and returns. This keeps fix(native-chat): a failed startup chat-lease save no longer puts the app into "Session restore failed" #23964's guarantee and makes it hold everywhere, not only for the lease reconcile.
• Because the runtime's only production caller is a @ts-nocheck file, the install refuses without a logger, the same way it already refuses without a Claude auth policy. A wiring test pins that the runtime passes a logger that reaches the trace sink.
• Recovery-capsule and restart-offer failures still log no error object. Existing tests pin that those errors can carry a chat's private recovery payload; they now log the scope and session id instead of a bare string.

Differences from the common pattern

Where this differs from the common pattern. Each item is Intended (kept, with why) or Temporary (with the follow-up that removes it).

• Intended: the logger is an explicit dependency rather than ambient. The common pattern also allows picking the logger up from the surrounding runtime context, but Orca has no such context to resolve from: its tracer exposes no handle to the active span, and most of these failures fire from timers and detached promise handlers with no active span, so an ambient span-attached logger would drop them to the console.
• Intended: entries go into the existing trace file, not a dedicated log file. That file is Orca's one local diagnostics file, already rotated (10 MB x 10), redacted and collected by the diagnostic bundle; writing log lines into a local trace file is part of the common pattern.
• Intended: a repeated failure is written once per 5 minutes with a count. This follows the common pattern of throttling a noisy log per key over a time window (the swallowed count carried on the next write, at most 256 keys, and no count written once the failure stops), applied here at the logger rather than at one call site. The reason: in Orca every entry is a new record in the one shared, rotated diagnostics file, and two reporters repeat on their own: lease renewal every 10 seconds per open chat, and the status feed on every journal publication. A persistent lease-renewal failure across 10 open chats would write about 130 MB a day and rotate the crash and IPC records the bundle exists for out of the 100 MB family; that volume is computed from the timer and record size, not observed. Because an entry repeats only when everything it writes is the same, a failure that changes (another cause, code, refusal reason or field) is written at once.
• Intended: recovery-capsule and restart-offer failures log no error object. Existing Orca tests (structured-agent-session-restart-teardown.test.ts, structured-agent-session-restart-ownership.test.ts) pin that these errors can carry a chat's private recovery payload; they now check every level the logger received, not only the console.
• Temporary: these structured-chat failures still go to console.warn/console.error only, because none of them holds the host. Follow-up: give the journal database the host's logger, and pass it to the orchestration and session-environment callers.
  • Chat journal (src/main/native-chat/agent-session-journal/): journal-database.ts:218, journal-per-session-import.ts:255, journal-per-session-source.ts:136, journal-queued-messages.ts:309, journal-restart-reconciliation.ts:104, journal-row-writer.ts:86.
  • Runtime, no host in hand: structured-agent-session-tab-retirement.ts:77, structured-session-child-identity-env.ts:89, rpc/methods/structured-agent-session-precommit-refusal.ts:60 (a create refused before the host committed anything).
  • Orchestration: rpc/methods/orchestration-structured-worker-session.ts:193 and :349, orchestration/structured-mailbox-pointer-host.ts:73, orchestration/structured-session-mail-target.ts:121, orca-runtime-get-pty-record-for-pane-key.ts:216.
  • WSL transcript gate: native-chat/wsl-transcript-fs-gate.ts:260.
• Temporary: a remote orcad's trace stays on that host; the desktop's share-diagnostics bundle does not collect it. Failures of a chat whose execution host is a remote orcad are in that host's <data-root>/logs/orcad.trace.ndjson, reachable over SSH only. Follow-up: serve the host's trace over the runtime RPC so the desktop bundle includes it for paired hosts.

Why

The common pattern is one logger for every reported failure, never a per-failure callback, with log lines kept in a local file as well as the console. A per-scope optional callback is what caused this bug: forgetting to pass it compiles fine and drops the failure silently. A required dependency cannot be forgotten. Writing into the existing trace sink, rather than a new log file, means no new file to rotate, redact or collect; the diagnostic bundle and its redactor already handle it. The error's cause chain is written out, as is common when serializing errors.

Linked Issue

Found while building #23964.

Visual Proof

N/A: no UI change. The change is what gets written to the diagnostics log file.

Testing

• src/main/runtime/structured-agent-session-failure-logging.test.ts (new): a scoped failure from each previously dropped path (late settlement, unanswered dispatch, provider start/exit delivery, journal event sink) reaches an injected logger; a logger that throws never throws out; the production logger writes a failed agentSession.<scope> span to the trace sink; the install refuses without a logger and hands the host a guarded one. The delivery loop, idle sweep and queued-message drain each log a failed step under their scope.
• structured-agent-session-logger.test.ts (new): 30 repeats on a 10-second timer write one entry, and the next after the window carries suppressed: 29; different sessions, scopes, levels, messages and errors are never merged, including two refusals with one code and different causes, one message under another error name, and two different non-error values; the tracked set is bounded; an entry carries the error's code, SQLite errcode and a depth-capped cause chain, with no cause's own fields.
• orca-runtime-structured-status-sink-wiring.test.ts: the logger the runtime hands the host writes an agentSession.<scope> failed span into an installed trace sink (a logger that writes nowhere fails it).
• src/main/orcad/orcad-observability.test.ts (new): orcad writes <data-root>/logs/orcad.trace.ndjson (and no main.trace.ndjson), flushes buffered lines on process exit, still starts with tracing off when its logs folder cannot be opened, installs before the runtime and closes after every quit handler.
• journal-open-failure.test.ts, structured-agent-session-restore-without-import.test.ts: a chat read whose journal will not open logs open-for-read with the session id, once per failure.
• The chat-tab, create and launch-prompt tests assert their new scopes; the restart privacy tests inspect every entry the logger received, at every level.
• Ablations: removing each logger call (late settlement, unanswered dispatch, lifecycle delivery, journal event sink, lease reconcile, delivery loop and its failure recording, idle sweep, queued drain, lease renewal, journal delivery, provider exit settlement, open-for-read and its wiring, the chat-tab, create and launch-prompt sites), the throw guard, the host's guard, the install assertion, the trace span write, the repeat suppression, its count, its bound, and each part of its key (the whole entry, the error's name, a stable rendering of a non-error value, the refusal reason), the cause chain and code, the desktop wiring (removed, or replaced by a logger that writes nowhere), the orcad sink install and entry wiring, its file name, exit flush and close order, the fail-soft install, and a payload logged at error level each turns its test red. The workspace-removal tab drop has no test.
• 621 related test files pass (native-chat, structured runtime and RPC, Codex/Claude structured tests excluding the real-CLI suites, structured e2e unit tests including the cross-version wire suite, orcad and observability unit tests).
• Typecheck (tsconfig.node.json) passes.
• Manual check on a second Mac (dev builds, fresh isolated profiles, hidden window): before the first launch, the old chat-records file <userData>/agent-sessions/agent-sessions.json was made unreadable (chmod 000). This build wrote the failure to main.trace.ndjson; origin/main (9ed7b39) wrote no agentSession line there and only printed a console warning. Both builds otherwise started and rendered normally. Redacted entry from this build (stack shortened):

{"type":"effect-span","name":"agentSession.legacy-record-import","durationMs":0,"attributes":{"level":"warn","message":"importing the chat records file did not complete","outcome":"unavailable","errorCause":["Error: EACCES: permission denied, open '~/<profile>/agent-sessions/agent-sessions.json'"]},"events":[],"exit":{"_tag":"Failure","cause":"Error: agent_session_store_corrupt\n    at … ensureStructuredAgentSessionHost …"}}

• Not checked by hand: a failure during a live chat (for example the chat history refusing provider events), which needs a running agent; the unit tests above cover those paths.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

Review

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

No wire change: the logger is host-internal, so mixed client and host versions are unaffected. SSH: the execution host logs its own failures to its own file; nothing new crosses the wire. Volume: status-sink and observer failures that previously printed to an unread console now also add spans to the rotated trace file, at most one per repeated failure per 5 minutes. orcad now records the same span families as the desktop, up to 100 MB on each host.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[brennanb2025]

Review status: ready for review (head 3a54c6d)

The problem. Some structured-chat failures that the app deliberately carries on past were thrown away on desktop. Examples: a late reply that could not be saved, provider events the chat history refused, a provider start or exit that could not be delivered, and an unreadable old chat-records file. The chat runtime only reported them through optional callbacks, and the desktop never passed those callbacks. A few failures went to console.warn, which nobody can read in a packaged build. So after something went wrong there was no record of it.

What changes for you. Nothing in the UI. These failures are now written to the diagnostics trace file, <userData>/logs/main.trace.ndjson, which the "share diagnostics" bundle already collects. Each one is a failed entry named agentSession.<scope>, with the chat's id, the error, its code and its causes. A failure that keeps repeating is written once every 5 minutes with a count, so it cannot push crash records out of the file. The headless host writes its own file, <data-root>/logs/orcad.trace.ndjson. If the logs folder can't be opened, either app now starts with tracing off and one warning, instead of failing to start.

Fixed during review (each with tests, plus an ablation that turns the test red):

• A persistent failure on a repeating path, such as lease renewal every 10 s per chat, would have flooded the shared trace file. Repeats are now throttled per distinct failure. A later fix made "distinct" cover the error's cause, code and refusal reason, so a changed failure is still written at once.
• Trace entries dropped the error's cause and code. For example, an unreadable records file lost the underlying EACCES. Both are now written: causes by name and message only, at most three deep.
• A chat read whose history would not open still only warned to the console. It now uses the logger, and so do seven runtime sites that already held the host: chat-tab bookkeeping on open, close and restore, the tab-index seed, the workspace-removal tab drop, created-chat tab publication, and the launch prompt.
• The headless host used the desktop's file name. It now has its own file, as both common designs do. It now also starts even when its logs folder can't be opened, closes its trace file after its other shutdown steps, and flushes it on exit.
• The desktop wiring test only checked that a logger existed. It now proves entries reach the trace file. The privacy tests now inspect every log level, not just console.warn.
• Merged current main and moved main's new Stop path onto the logger. Fixed a static-analysis failure (Reflect.get) that CI caught.

Deferred (P3, not fixing here):

• Rename the logger to a general main-process logger. That is a move and rename, with no redesign.
• The never-throw guard is applied in three places, two of them redundant.
• Diagnostics status still reports tracing as on after the file failed to open.
• The headless host's shutdown-order test matches source text.
• The workspace-removal tab drop has no test.
• Once a throttled failure stops, its last swallowed count is never written.
• Throttling stops working with more than 256 distinct failures repeating at once.
• Some structured-chat sites outside the host still use console.warn. They are listed as Temporary in the body.
• A remote headless host's trace stays on that host and isn't in the desktop bundle. It is listed as Temporary.
• Not this PR's change: the headless host never stops the chat runtime on shutdown. That is already true on main.

Verified:

• Five independent reviews of the full PR and each round of fixes.
• A readiness checklist found no P0, P1 or P2 issues.
• The node typecheck passes, about 620 related test files pass, and CI is green.
• Manual QA on a second Mac with dev builds and fresh isolated profiles: an unreadable old chat-records file produced an agentSession.legacy-record-import entry in main.trace.ndjson, with an EACCES cause. On origin/main the file had no such entry, only a console line. Both builds otherwise ran normally.

Not verified:

• A failure during a live chat was not forced by hand, because it needs a running, logged-in agent. Unit tests cover those paths.
• Not every provider's error text was traced. Provider error messages now reach the trace file after secret redaction. No path was found that puts prompt text into one.
• The headless host's new file was checked by unit tests only, not on a real headless install.

[greptile-apps]

Confidence Score: 5/5

[Medium risk] Adds structured logging to chat failure handling.

No blocking finding is recorded for this PR.

Summary

The PR routes structured native-chat failures through a required logger into local diagnostic traces and adds a trace file for orcad. It also adds repeat suppression and updates related tests and documentation.

_{Reviews (1) · Last reviewed commit: "fix(native-chat): read an error's code a..."}

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

📝 Walkthrough

Walkthrough

The change introduces structured agent-session logging with scoped warnings and errors, repeat suppression, bounded error serialization, and non-throwing logger wrappers. Agent-session runtime, journal, delivery, queue, status, restart, and settlement paths now use injected loggers instead of callback or console reporting. Tests provide logger fixtures and assert structured entries. Orcad now writes and flushes a dedicated trace file during runtime shutdown.

Priority: ⬇️ Low

Merge Risk: 🔵 Low · up to 3a54c

Failure logging is now centralized and structured. Raw non-Error failure values could land in local diagnostics, which is a small privacy concern worth tightening before or soon after merge.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 3a54c

Failure logging improves troubleshooting, but arbitrary error values can carry private content into console output. Trace files have redaction and restricted file permissions. No new remote access or privilege expansion was established, and actual sensitive-payload reachability remains uncertain.

Retained concerns

• Low · security · observed: The new reporting contract accepts arbitrary error values and additional fields, then forwards the original fields to console without applying the trace redactor at that boundary. Newly reported failures therefore make diagnostic privacy depend on producer payloads and console collection policy. Trace redaction limits the file-output exposure, but does not govern this separate console route; actual sensitive production payloads and attacker reachability remain unproven.

Security review details

Security Blast Radius

• inferred — The evidenced exposure is diagnostic data within the affected desktop or headless host, its local trace storage, and any separately configured console collector. The sources reviewed do not establish cross-tenant access, a remote secret-bearing input path, or additional execution privileges; those limits are uncertainty rather than proof of isolation.

Security Findings and Attack Paths

• observed — The canonical security assessment retains a low-severity sensitive-data-exposure finding at non-Error attribute extraction. Source confirms whole-value forwarding toward trace redaction and original-field forwarding to console. Inspected callers supply caught errors, but an attacker-controlled sensitive payload reaching these outputs has not been demonstrated.

Trust Boundaries and Controls

• observed — Trace serialization recursively removes sensitive key families and redacts strings before persistence. Local trace storage requests directory mode 0700 and file mode 0600, with best-effort permission tightening. These controls apply to trace storage, not automatically to console capture or its readers.

Resilience and Maintainability Implications

• inferred — The diagnostic channel remains best-effort rather than a durable security audit channel. Repeat admission occurs before output succeeds, trace push failures are swallowed, and closed sinks ignore pushes. A failed initial write can therefore consume the repeat window without producing a trace record, although console remains a separate output attempt.

Hardening Proposals

• proposed — Define allowlisted diagnostic metadata and apply a common sanitization policy before both trace and console emission. Normalize unknown thrown values into bounded diagnostic descriptions instead of relying on every producer to exclude private payloads.

🚥 Pre-merge checks | ✅ 4 | ❓ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Docstring Coverage	❓ Inconclusive	Docstring coverage is 35.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 34 functions across 50 files. (171 skippe…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly and concisely describes the main change: routing structured chat failures to the diagnostics log.
Description check	✅ Passed	The description is detailed and covers the required explanation, changes, rationale, testing, visual proof, review notes, and checklist. It references issue #23964, but it does not use the template's …

Full details: Docstring Coverage

Explanation

Docstring coverage is 35.29% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 34 functions across 50 files. (171 skipped: 1 unsupported, 170 over the file limit.)

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/main/native-chat/agent-session-wire/structured-agent-session-logger.ts (1)

114-116: 🔒 Security & Privacy | 🛡️ Detected with Advanced Tier | 🔵 Trivial | ⚡ Quick win

Sensitive Data Exposure

Exploitability: Difficult
CWE: CWE-532 — Insertion of Sensitive Information into Log File

Sanitize non-Error values in both trace attributes and console output.

errorAttributes stores every non-Error value as error, and the tracer writes span attributes to the local diagnostic trace. The console path also prints the original fields object. Changing only errorAttributes would leave the same value in console diagnostics.

Reduce non-Error values to their type, plus code when it is a string or number. Remove the raw error field from the console payload. Update the test that expects { code: 'busy', attempt: 1 }.

Proposed change

@@
-      print(
-        `[agent-session] ${scope}: ${message}`,
-        suppressed > 0 ? { ...fields, suppressed } : fields
-      )
+      const printFields = { scope, ...rest, ...errorAttributes(error) }
+      print(
+        `[agent-session] ${scope}: ${message}`,
+        suppressed > 0 ? { ...printFields, suppressed } : printFields
+      )
@@
   if (!(error instanceof Error)) {
-    return { error }
+    if (typeof error !== 'object' || error === null) {
+      return { error: String(error) }
+    }
+    const code = codeValue('code' in error ? (error as { code?: unknown }).code : undefined)
+    return { error: '[non-error value]', ...(code !== undefined ? { errorCode: code } : {}) }
   }

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: 03445c40-392b-445e-9037-33b4f6fa23a0

📥 Commits

Reviewing files that changed from the base of the PR and between d4ae6a9 and 3a54c6d.

📒 Files selected for processing (221)

• docs/reference/orcad-operations.md
• src/main/agent-hooks/first-work-branch-rename.test.ts
• src/main/claude/claude-api-retry-idle-sweep.test.ts
• src/main/claude/claude-api-retry-row.test.ts
• src/main/claude/claude-background-wake-retention.test.ts
• src/main/claude/claude-context-usage-restart.test.ts
• src/main/claude/claude-context-usage-unloaded-turn.test.ts
• src/main/claude/claude-stream-json-connection.test.ts
• src/main/claude/claude-structured-journal-translation-background-tasks.test.ts
• src/main/claude/claude-structured-journal-translation.test.ts
• src/main/claude/claude-structured-provider-fallback.test.ts
• src/main/claude/claude-structured-session-reading-control.test.ts
• src/main/claude/claude-subagent-resume-after-restart.test.ts
• src/main/claude/claude-subagent-roster.test.ts
• src/main/codex/codex-provider-retry-idle-sweep.test.ts
• src/main/codex/codex-structured-journal-goal-resume.test.ts
• src/main/codex/codex-structured-journal-goal-revision.test.ts
• src/main/codex/codex-structured-journal-subagent-readers.test.ts
• src/main/codex/codex-structured-journal-translation-settlement.test.ts
• src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts
• src/main/codex/codex-structured-journal-translation.test.ts
• src/main/codex/codex-structured-journal-turn-settles-once-journal.test.ts
• src/main/codex/codex-structured-question-order.test.ts
• src/main/native-chat/agent-session-journal/journal-open-failure.test.ts
• src/main/native-chat/agent-session-journal/journal-open-failure.ts
• src/main/native-chat/agent-session-journal/journal-per-session-import.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-accept-then-deliver.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-acquisition-options.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-adopted-import.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-agent-start.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-append-delivery.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-at-rest-commands.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-flow.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-orchestration.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-attach-test-conversation.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-background-task-channel.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-chat-stop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-compact-stop.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-echo-working.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-option-queue.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-queued-stop.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-root-exit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-claude-stop-ends-session.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-close-verdict.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-codex-stop-row.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-close.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-lifetime.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-stop.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversations.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversations.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-crash-mid-start.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-crash-turn-end.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-dead-generation-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-delivery-loop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-sink-queue.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-sink.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-eviction.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-eviction.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-owner-verdict.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-failed-create-sink-release.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-forget-status.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-grouped-prompt.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-delivery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-runtime-state.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-tabs.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-teardown.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-test-abandon.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-test-harness.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-types.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-idle-sweep.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-import-mismatch.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-journal-corruption.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-late-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-lease-renewer.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-legacy-handoff-record.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-log-repeats.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-logger-test-support.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-logger.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-logger.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-main-agent-working-agreement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-admission.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-mutation-context.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-operation-settlement.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-operation-start-refusal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-option-settlement.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-options-read.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-owed-work-release.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-pre-spawn-first-answer.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-processless-reservation.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-prompt-cancel.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-child-record.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-restore.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-provider-started.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig.test-fixture.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-mutations.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-stop.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-wiring.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-read-restore.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-readable-restorer.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-recovered-turn-clock.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-recovery-exits.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-resolved-append.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-rest-test-rig.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-cap.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-continuation.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-failure-ledger.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-records.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-offer-withdrawal.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-ownership.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-reconcile.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-restore.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-host.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-resume-wiring.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-status-publication.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-teardown.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restore-without-import.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-reveal.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-rewind-at-rest.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-rewind.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-rewind.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-block.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-open-stale-turn.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-preparation.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-send-restarts-failed-start.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-settled-attach-retry.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-startup-failure-exit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-startup-reconcile-failure.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child-work.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-children.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-clock.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-feed.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-status-reentry.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-subagent-recency.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-surface-lifetime.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-thread-goal.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unexpected-exit.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-view-start-after-failed-start.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-wedged-profile-migration.test.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.test.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts
• src/main/native-chat/agent-session-wire/structured-rewind-recovery.ts
• src/main/observability/index.ts
• src/main/observability/logs-directory.ts
• src/main/orcad/orcad-entry.ts
• src/main/orcad/orcad-observability.test.ts
• src/main/orcad/orcad-observability.ts
• src/main/runtime/agent-session-legacy-record-import.test.ts
• src/main/runtime/claude-structured-session-integration.test.ts
• src/main/runtime/orca-runtime-close-structured-agent-session-tab.ts
• src/main/runtime/orca-runtime-get-worktree-ps.ts
• src/main/runtime/orca-runtime-restore-structured-agent-session-tabs-once.ts
• src/main/runtime/orca-runtime-structured-status-sink-wiring.test.ts
• src/main/runtime/rpc/methods/agent-launch-structured-prompt.test.ts
• src/main/runtime/rpc/methods/agent-launch-structured-prompt.ts
• src/main/runtime/rpc/methods/structured-agent-session-adoption-replay.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-at-rest.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-create-tab-publication.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-create.ts
• src/main/runtime/rpc/methods/structured-agent-session-hold.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-precommit-refusal.test.ts
• src/main/runtime/rpc/methods/structured-agent-session-rpc.test-fixture.ts
• src/main/runtime/rpc/methods/structured-chat-tab-table.test.ts
• src/main/runtime/runtime-worktree-agent-rows-verdict.test.ts
• src/main/runtime/runtime-worktree-structured-agent-rows-liveness.test.ts
• src/main/runtime/structured-agent-session-close.test.ts
• src/main/runtime/structured-agent-session-close.ts
• src/main/runtime/structured-agent-session-codex-turn-end-settlement.test.ts
• src/main/runtime/structured-agent-session-dispatch-followups.ts
• src/main/runtime/structured-agent-session-failure-logging.test.ts
• src/main/runtime/structured-agent-session-host-refusal.test.ts
• src/main/runtime/structured-agent-session-install-failure.test.ts
• src/main/runtime/structured-agent-session-integration.test.ts
• src/main/runtime/structured-agent-session-journal-open.ts
• src/main/runtime/structured-agent-session-lifecycle-delivery.ts
• src/main/runtime/structured-agent-session-record-import-install.test.ts
• src/main/runtime/structured-agent-session-runtime-exit.test.ts
• src/main/runtime/structured-agent-session-runtime.test.ts
• src/main/runtime/structured-agent-session-runtime.ts
• src/main/runtime/structured-agent-session-spawn-token-descendants.test.ts
• src/main/runtime/structured-agent-session-startup-reconcile.test.ts
• src/main/runtime/structured-agent-session-startup-tab-restore.test.ts
• src/main/runtime/structured-agent-session-tab-index-seed.ts
• src/main/runtime/structured-chat-coordinator-mail.test.ts
• src/main/runtime/structured-child-records-switch.test.ts
• src/main/runtime/structured-claude-pending-rewind.test.ts
• src/main/runtime/structured-claude-scripted-runtime-test-support.ts
• src/main/runtime/structured-codex-child-work-runtime.test.ts
• src/main/runtime/structured-codex-session-rpc-test-harness.ts
• src/main/runtime/structured-session-worktree-teardown.ts
• tests/e2e/codex-child-approval-activity-row.unit.test.ts
• tests/e2e/cross-version-wire/cross-version-agent-session-wire.unit.test.ts
• tests/e2e/structured-agent-session-read-owner.unit.test.ts
• tests/e2e/structured-chat-owner-status-activation.unit.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.

[pullfrog]

ℹ️ Minor suggestions only — one comment typo and one small status-surface edge case.

Reviewed changes

• Optional failure callbacks become a required logger. The structured chat runtime and host now take one required logger (warn/error, each carrying a scope); onError, onEventSinkError, onLeaseReconcileFailure, onLegacyRecordImportReport and onNoteFailed are gone, and every site — plus the host's scattered console.warns — reports under its own scope.
• Production logger writes failed agentSession.<scope> spans. createStructuredAgentSessionLogger() records the span with level, message, session id, the error's code/errcode/refusal reason and a depth-capped cause chain, then mirrors to the console; reporting is wrapped so a throw can never escape into the operation it reports.
• Repeat suppression. A stable key over everything the entry writes swallows identical repeats for 5 minutes, carrying the swallowed count, bounded at 256 tracked entries.
• orcad gets its own trace file and fail-soft install. <data-root>/logs/orcad.trace.ndjson, installed before the runtime, closed after every quit handler and flushed on exit; an unopenable logs folder now warns and leaves tracing off instead of failing startup.
• Privacy kept on recovery-payload paths. Recovery-capsule, restart-offer and note failures log scope/session id only, and the restart-teardown tests now inspect every recorded entry, not just the console.

I read the whole diff and ran the new structured-agent-session-logger (7), structured-agent-session-failure-logging (11) and orcad-observability (4) suites; all 22 pass. The repeat-suppression boundary/eviction cases and the install-without-logger guard are pinned by tests that would fail if the behavior regressed.

ℹ️ Nitpicks

• initObservability sets consent.localFileEnabled before calling installLocalSink; when the sink cannot be opened, getDiagnosticsStatus() still reports local-file tracing as enabled (src/main/observability/index.ts:142-165) even though no sink is active. Harmless today — the tracer's active sink is unset, so nothing writes — but the diagnostics status surface would claim tracing is on when it is off.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using DeepSeek Flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

Stray comma before the em dash, and this line is much longer than the surrounding comment. Reflowing it keeps the file's comment rhythm.

Suggested change

	// under, that the verdict comes from the settlement waiter rather than the send result, — and those belong next to the collaborator that consumes them
	// under, that the verdict comes from the settlement waiter rather than the send result — and those
	// belong next to the collaborator that consumes them