fix(native-chat): never delete chat history on read; a chat Orca can't load says why once

config/reliability-gates.jsonc

@@ -639,7 +639,7 @@
       "protection": "partial",
       "owner": "agent-session-runtime",
       "layer": "runtime-unit",
-      "surfaces": ["structured chat journal replay", "structured chat recovery"],
+      "surfaces": ["structured chat journal replay", "structured chat damaged history"],
       "platforms": ["macos", "linux", "windows"],
       "providers": ["local", "remote-runtime"],
       "coveredPlatforms": ["macos"],
@@ -648,25 +648,36 @@
       "motivatingLinks": [
         "https://github.com/stablyai/orca/blob/main/src/main/native-chat/agent-session-journal/journal-open.ts"
       ],
-      "invariant": "Replay preserves latest revisions, original item order, fences, aliases, submissions, repair precedence, read-only schema latching and cursor cleanup while retaining live items rather than all historical bodies.",
-      "oracle": "Replay 2,048 16 KiB revisions into one latest item with less than 8 MiB sampled live heap growth; preserve prefix and future-schema latching after a gap, malformed suffix repair precedence, and hold no SQLite read snapshot across reduction (a mid-replay checkpoint is not busy). Existing journal and subscriber tests cover replayed content and recovery.",
+      "invariant": "Replay preserves latest revisions, original item order, fences, aliases, submissions, a newer schema winning over damage and cursor cleanup while retaining live items rather than all historical bodies; damage fails the load and deletes nothing.",
+      "oracle": "Replay 2,048 16 KiB revisions into one latest item with less than 8 MiB sampled live heap growth; name a future-schema row read past a gap, name the first damage, fail a damaged load with every row kept, and hold no SQLite read snapshot across reduction (a mid-replay checkpoint is not busy). Existing journal and subscriber tests cover replayed content.",
       "commands": [
+        // As the 2026-09-11 evidence run ran it; the recovery test it names went with the read-time repair.
         "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts src/main/native-chat/agent-session-wire/agent-session-journal-recovery.test.ts",
-        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts"
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts",
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts src/main/native-chat/agent-session-journal/journal-damage.test.ts"
       ],
       "testFiles": [
         "src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts",
-        "src/main/native-chat/agent-session-journal/journal-corruption-repair.test.ts"
+        "src/main/native-chat/agent-session-journal/journal-damage.test.ts"
       ],
       "assertionRefs": [
         {
           "file": "src/main/native-chat/agent-session-journal/journal-streaming-replay.test.ts",
           "assertions": [
             "releases superseded revision bodies while reducing a long journal",
             "holds no read snapshot while reducing, so a checkpoint can pass mid-replay",
-            "keeps the prefix but latches read-only for a future row beyond a gap",
-            "keeps gap repair precedence when a later row is malformed",
-            "rejects an unanchored prefix before a later gap"
+            "reads past a gap to a future row, which names the newer row and no damage",
+            "names the first damage when a later row is malformed too",
+            "names a missing epoch row before a later gap"
+          ]
+        },
+        {
+          "file": "src/main/native-chat/agent-session-journal/journal-damage.test.ts",
+          "assertions": [
+            "fails to load and keeps every row: %s",
+            "reads past damage to a newer build's row, which fails the load as a newer Orca's instead",
+            "is refused when it is written, and the chat still loads with every other row",
+            "is founded afresh on open, with nothing deleted, and takes writes"
           ]
         }
       ],
@@ -679,6 +690,15 @@
           "result": "passed",
           "durationSeconds": 7.71,
           "summary": "245 tests passed across 22 files. Retained-heap oracle fails on baseline at 68.6 MB and passes under 8 MiB with streaming; gap/schema and cursor-cleanup assertions passed."
+        },
+        {
+          "date": "2026-10-02",
+          "runner": "local",
+          "platform": "macos",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/main/native-chat/agent-session-journal src/main/native-chat/agent-session-wire/agent-session-history-page.test.ts src/main/native-chat/agent-session-wire/agent-session-history-forward-read-budget.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-subscribers.test.ts",
+          "result": "passed",
+          "durationSeconds": 5.56,
+          "summary": "450 tests passed across 42 files, run as the vitest invocation the test script makes. Damage fails the load with every row kept; the retained-heap, newer-row-past-a-gap and cursor-cleanup assertions passed."
         }
       ],
       "runtimeBudget": {

mobile/src/session/MobileNativeChatOverlay.tsx

@@ -80,6 +80,7 @@ export function MobileNativeChatOverlay({
         folded={folded}
         status={session.status}
         error={session.error}
+        readFailedFinally={session.readFailedFinally === true}
         agent={controller.nativeChatAgent}
         agentWorking={controller.nativeChatAgentWorking}
         canStop={controller.nativeChatCanStop}

mobile/src/session/MobileNativeChatPermission.test.ts

@@ -145,4 +145,56 @@ describe('MobileNativeChatPermission', () => {
     expect(content.findAllByProps({ children: 'raw json that must not be shown' })).toHaveLength(0)
     expect(actions.findAllByProps({ children: 'Approve plan' })).toHaveLength(1)
   })
+
+  describe("a subject of a kind this build cannot draw: a newer Orca's", () => {
+    const NEEDS_NEWER_ORCA = 'This request needs a newer version of Orca.'
+
+    async function renderNewer(detail: string | undefined) {
+      const onRespond = vi.fn(async () => true)
+      const onCancel = vi.fn(async () => true)
+      await act(async () => {
+        renderer = create(
+          createElement(MobileNativeChatPermission, {
+            permission: {
+              title: 'Review proposed change',
+              ...(detail ? { detail } : {}),
+              // A subject kind a newer build wrote; this build draws only plans.
+              subject: JSON.parse('{"kind":"diff","path":"a.ts"}'),
+              prompt: { itemId: 'approval-1', expectedRevision: 2 },
+              options: [
+                { label: 'Approve', send: 'allow' },
+                { label: 'Deny', send: 'deny' }
+              ]
+            },
+            onRespond,
+            onCancel
+          })
+        )
+      })
+      const actions = renderer!.root.findByProps({ testID: 'native-chat-approval-actions' })
+      return { onRespond, onCancel, options: actions.findAllByType('Pressable') }
+    }
+
+    it('with no detail: says so, answers nothing, and only its cancel reaches the host', async () => {
+      const { onRespond, onCancel, options } = await renderNewer(undefined)
+      expect(
+        renderer!.root.findByProps({ testID: 'native-chat-approval-needs-newer-orca' }).props
+          .children
+      ).toBe(NEEDS_NEWER_ORCA)
+      expect(options).toHaveLength(2)
+      expect(options.every((option) => option.props.disabled === true)).toBe(true)
+      const cancel = renderer!.root.findByProps({ accessibilityLabel: 'Cancel' })
+      expect(cancel.props.disabled).toBe(false)
+      await act(async () => cancel.props.onPress())
+      expect(onCancel).toHaveBeenCalledWith({ itemId: 'approval-1', expectedRevision: 2 })
+      expect(onRespond).not.toHaveBeenCalled()
+    })
+
+    it('with a detail: shows it, and still approves nothing', async () => {
+      const { options } = await renderNewer('# Release')
+      const content = renderer!.root.findByProps({ testID: 'native-chat-approval-content' })
+      expect(content.findAllByProps({ children: '# Release' })).toHaveLength(1)
+      expect(options.every((option) => option.props.disabled === true)).toBe(true)
+    })
+  })
 })

mobile/src/session/MobileNativeChatPermission.tsx

@@ -3,6 +3,10 @@ import { Pressable, ScrollView, StyleSheet, Text, View } from 'react-native'
 import { ShieldQuestion, X } from 'lucide-react-native'
 import { MobileMarkdown } from '../components/MobileMarkdown'
 import { colors, radii, spacing, typography } from '../theme/mobile-theme'
+import {
+  isNewerApprovalSubject,
+  isPlanApprovalSubject
+} from '../../../src/shared/agent-session-approval-subject'
 import type { MobileChatPermission } from './mobile-native-chat-permission'
 
 // Renders a detected agent permission ask as a card with tappable options.
@@ -19,6 +23,8 @@ function MobileNativeChatPermissionImpl({
 }): React.JSX.Element {
   const [submitting, setSubmitting] = useState(false)
   const submittingRef = useRef(false)
+  // A newer Orca's subject: its detail is shown, and only the card's cancel answers.
+  const newerSubject = isNewerApprovalSubject(permission.subject)
   const hasContext = Boolean(
     permission.description ||
     permission.decisionReason ||
@@ -93,7 +99,7 @@ function MobileNativeChatPermissionImpl({
               {permission.matchedAskRule.source}
             </Text>
           ) : null}
-          {permission.subject?.kind === 'plan' ? (
+          {isPlanApprovalSubject(permission.subject) ? (
             <View>
               <MobileMarkdown content={permission.subject.text} />
               {permission.subject.filePath ? (
@@ -103,6 +109,11 @@ function MobileNativeChatPermissionImpl({
           ) : permission.detail ? (
             <Text style={styles.detail}>{permission.detail}</Text>
           ) : null}
+          {newerSubject ? (
+            <Text testID="native-chat-approval-needs-newer-orca" style={styles.detail}>
+              This request needs a newer version of Orca.
+            </Text>
+          ) : null}
         </ScrollView>
       ) : null}
       <View testID="native-chat-approval-actions" style={styles.options}>
@@ -114,11 +125,12 @@ function MobileNativeChatPermissionImpl({
               style={({ pressed }) => [
                 styles.option,
                 isPrimary ? styles.optionPrimary : styles.optionSecondary,
-                pressed && !submitting && styles.optionPressed
+                pressed && !submitting && styles.optionPressed,
+                newerSubject && styles.disabled
               ]}
               hitSlop={6}
               onPress={() => respond(option.send)}
-              disabled={submitting}
+              disabled={submitting || newerSubject}
             >
               <Text style={[styles.optionText, isPrimary && styles.optionTextPrimary]}>
                 {option.label}
@@ -212,6 +224,9 @@ const styles = StyleSheet.create({
   optionPressed: {
     opacity: 0.7
   },
+  disabled: {
+    opacity: 0.5
+  },
   optionText: {
     color: colors.textPrimary,
     fontSize: typography.bodySize,

mobile/src/session/MobileNativeChatView.test.ts

@@ -93,6 +93,9 @@ type Overrides = {
   keyboardInset?: number
   hasMore?: boolean
   onLoadEarlier?: () => void
+  status?: Parameters<typeof MobileNativeChatView>[0]['status']
+  error?: string
+  readFailedFinally?: boolean
 }
 
 function assistantTurn(id: string, text: string): NativeChatMessage {
@@ -214,6 +217,39 @@ describe('MobileNativeChatView', () => {
     })
   }
 
+  // A read no retry gets past takes the whole pane, even over a transcript already on screen: its
+  // words alone, and nothing that could only be refused again.
+  it('leaves only the words of a read that failed for good, over a loaded transcript', async () => {
+    const loaded = [assistantTurn('m1', 'earlier reply')]
+    const words = 'This chat was saved by a newer Orca. Update Orca to open it.'
+    const shown = (text: string) =>
+      renderer!.root.findAll((node) => node.type === 'Text' && node.props.children === text)
+    const composers = () => renderer!.root.findAll((node) => node.type === 'Composer')
+    const lists = () => renderer!.root.findAll((node) => node.type === 'FlatList')
+    const failure = {
+      messages: loaded,
+      folded: loaded,
+      status: 'error' as const,
+      error: words,
+      canStop: true,
+      permission: { title: 'Approve?', options: [{ label: 'Allow', send: '1' }] },
+      // A resend answered unknown says nothing beside the read's words.
+      sendErrorMessage: 'Message unconfirmed — check chat before retrying'
+    }
+    await render({ ...failure, readFailedFinally: true })
+    expect(shown(words)).toHaveLength(1)
+    expect(composers()).toHaveLength(0)
+    expect(lists()).toHaveLength(0)
+    expect(banners()).toHaveLength(0)
+    expect(renderer!.root.findAllByProps({ accessibilityLabel: 'Stop the agent' })).toHaveLength(0)
+
+    // A failure that can clear keeps the transcript and the composer.
+    await update({ ...failure, error: "Orca couldn't open this chat's history right now." })
+    expect(listIds()).toEqual(['m1'])
+    expect(composers()).toHaveLength(1)
+    expect(banners()).toHaveLength(1)
+  })
+
   it('renders the route-reported failure verbatim', async () => {
     await render({ sendErrorMessage: 'Permission reply failed' })
 

mobile/src/session/MobileNativeChatView.tsx

@@ -53,6 +53,8 @@ type Props = MobileQueuedSlotProps & {
   folded: NativeChatMessage[]
   status: MobileNativeChatStatus
   error?: string
+  /** The read failed for good (damage, a newer Orca's chat): its error takes the whole pane. */
+  readFailedFinally?: boolean
   /** Resolved agent for this chat; names the empty-state copy (desktop parity). */
   agent?: string | null
   agentWorking?: boolean
@@ -145,6 +147,7 @@ export function MobileNativeChatView({
   folded,
   status,
   error,
+  readFailedFinally = false,
   agent,
   agentWorking,
   canStop = agentWorking,
@@ -307,6 +310,18 @@ export function MobileNativeChatView({
   const showLoading = status === 'loading' && messages.length === 0
 
   const lockReason = useSettledMobileNativeChatInputLock(inputLockReason)
+  const emptyStateView = emptyState ? (
+    <View style={styles.center}>
+      <Text style={styles.emptyTitle}>{emptyState.title}</Text>
+      <Text style={styles.emptySubtitle}>{emptyState.subtitle}</Text>
+    </View>
+  ) : null
+
+  // Whatever was already on screen: nothing here can act on a chat that cannot load, and its words
+  // say why once, as a fresh open's do.
+  if (readFailedFinally && emptyStateView) {
+    return <View style={[styles.root, { paddingBottom: bottomPad }]}>{emptyStateView}</View>
+  }
 
   return (
     <View style={[styles.root, { paddingBottom: bottomPad }]}>
@@ -354,14 +369,7 @@ export function MobileNativeChatView({
                 turns.waitingRows,
                 renderItem
               )}
-              ListEmptyComponent={
-                emptyState ? (
-                  <View style={styles.center}>
-                    <Text style={styles.emptyTitle}>{emptyState.title}</Text>
-                    <Text style={styles.emptySubtitle}>{emptyState.subtitle}</Text>
-                  </View>
-                ) : null
-              }
+              ListEmptyComponent={emptyStateView}
             />
           </GestureDetector>
           {/* Jump-to-latest control. */}

mobile/src/session/mobile-structured-agent-session-rpc.ts

@@ -55,13 +55,18 @@ class AgentSessionRpcResponseError extends Error {
   }
 }
 
+/** The refusal a failed read met, from a thrown error or a stream's error frame. */
+export function agentSessionReadFailureRefusal(failure: unknown) {
+  return readAgentSessionErrorRefusal(
+    typeof failure === 'object' && failure !== null && 'error' in failure ? failure.error : failure
+  )
+}
+
 /** A failed read of a chat's history as the pane shows it, from a thrown error or a stream's error
  *  frame (`{ message, error }`): a thrown refusal's message is its bare code, so its words come
  *  from the refusal in the error's data. */
 export function agentSessionReadFailureText(failure: unknown): string {
-  const refusal = readAgentSessionErrorRefusal(
-    typeof failure === 'object' && failure !== null && 'error' in failure ? failure.error : failure
-  )
+  const refusal = agentSessionReadFailureRefusal(failure)
   if (refusal) {
     return agentSessionWriteNoticeEnglish(
       agentSessionWriteNoticeParts(agentSessionRefusalFailure(refusal), 'read-history')

mobile/src/session/mobile-structured-agent-session-thrown-refusal.test.ts

@@ -1,6 +1,7 @@
 import { describe, expect, it } from 'vitest'
 import type { RpcClient } from '../transport/rpc-client'
 import {
+  agentSessionReadFailureRefusal,
   agentSessionReadFailureText,
   callAgentSession,
   requestStructuredAgentSessionMutation
@@ -43,6 +44,18 @@ describe('a refusal the host threw', () => {
     expect(agentSessionReadFailureText({ type: 'error', message: 'Connection interrupted' })).toBe(
       'Connection interrupted'
     )
+    // The refusal itself rides beside the words, so the view can tell a failure no retry gets past.
+    expect(
+      agentSessionReadFailureRefusal({
+        type: 'error',
+        message: THROWN_JOURNAL_REFUSAL.message,
+        error: THROWN_JOURNAL_REFUSAL
+      })
+    ).toEqual(THROWN_JOURNAL_REFUSAL.data.refusal)
+    expect(agentSessionReadFailureRefusal(thrown)).toEqual(THROWN_JOURNAL_REFUSAL.data.refusal)
+    expect(
+      agentSessionReadFailureRefusal({ type: 'error', message: 'Connection interrupted' })
+    ).toBeUndefined()
   })
 
   it("fails a write with the refusal's words, not as unconfirmed", async () => {

mobile/src/session/use-mobile-native-chat-session.ts

@@ -35,6 +35,9 @@ export type MobileNativeChatSession = {
    *  wait for this to clear. */
   transcriptLoading: boolean
   error?: string
+  /** The read failed for good (damage, or a newer Orca's chat): the error says why, once, and
+   *  there is nothing to send into. */
+  readFailedFinally?: boolean
   /** True when an older page may exist (the last read filled the window). */
   hasMore: boolean
   /** Whether an older-history page is currently loading. */