fix(native-chat): show a message Orca accepted and then failed to deliver as "Not sent" in the chat

[brennanb2025]

	Files	Added	Deleted	Net
Test	45	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​2377	$\color{#cf222e}{\Huge{\mathbf{−}}}$​276	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​2101
Prod	28	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​577	$\color{#cf222e}{\Huge{\mathbf{−}}}$​209	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​368

ELI5

A message you sent in a desktop structured chat could vanish after Orca crashed. Orca had taken the message, then couldn't deliver it, and the only thing that would have shown it was a copy the app keeps in browser storage, which a crash often never saves. Now the chat always shows that message, marked "Not sent" with the reason, at the point where it failed. Orca reads it from its own chat history, so a crash can't erase it.

What Changed

The problem as you saw it.

• You send a message. Orca records it and answers "got it". Then, before the agent receives it, something goes wrong: Orca is killed, the app quits mid-turn, the agent fails to start, or a message sent into a running turn is never picked up.
• Orca marks that message rejected in the chat's history. Reopen the chat, and the message isn't there at all. There's no error and no hint to send it again.
• Even when the message did show, it looked different depending on luck. If the browser-storage copy had been saved, you saw "Not sent" with a Retry button. If it hadn't, you saw nothing.

Why it happened. The desktop chat hid every rejected message unless that browser-storage copy (the outbox) still held it. The outbox is saved lazily, so after a crash it is often missing. Orca's own history still had the message and the reason it failed; the chat just never drew it.

Before: after a crash, a message Orca accepted and then rejected disappears. Without a crash, it shows "Not sent" with a Retry, at the bottom of the chat.

After (desktop):

• The message shows where it was rejected, marked "Not sent" with the reason in Orca's words. For example: "Orca restarted before this message was sent."
• If the agent failed to start, the messages it failed read only "Your message was not sent." They sit directly above the "did not start" row, which says why.
• A message Orca recorded has no Retry button. To send it again, you send it again; it is a new message. No "Not sent" message has any button. While Orca's row for it is not loaded yet, the saved outbox copy shows it instead, and goes away by itself once that row loads.
• A message Orca refused before recording it, for example while the chat history couldn't be read, keeps its Retry. Only the outbox ever had it, so Retry is the only way to send it.
• A message you took back with Stop stays hidden; its text already went back to your composer.
• A rejected message that is held as a queued card above the composer shows as that card, not also as a row.
• A rejected /compact stays hidden, as before. The command reports its own failure in the composer.

Mechanism.

• The host owns the position. When the host records a rejection, its history reducer moves the message to the rejection's place in the journal, in no turn. This covers a message that waited behind a running turn, one delivered into a turn and then rejected, and one sent directly. It mirrors how the host already places a queued message where it is handed over. A message whose delivery is only in doubt never moves: it may have reached the agent, so it stays a plain message.
  • The new position travels in the same journal updates and history pages clients already read, so a recent rejection is always on the newest loaded page.
• A failed start is written in one step. The queued messages' rejections and the "did not start" row now go into the journal in one transaction (a new JournalRowWriter.enqueueRows), rejections first. No reader ever sees one without the other, and the messages read above the row. If a Stop withdrew every queued message first, nothing is written: the failed start failed no one.
• The outbox lets go once the host's record is held. When the chat holds the host's rejected record of a message, the outbox drops its copy and saves that drop, so the chat no longer reads as owing a delivery. The host's row is the message from then on.
  • Placing the message at its rejection had to come with this change: once the outbox lets go, a message drawn where it was sent was drawn nowhere when that point was older than the loaded page (reproduced in review). On main the outbox copy had covered that case.
  • This brings part of step 3 of the planned outbox removal forward. The outbox now lets go of every message Orca recorded and then rejected, and those messages lose their Retry. The rest of that step, and the outbox's removal itself, are unchanged and still to come.
• Retry is decided from what is stored, the same way on every open. If the outbox entry says the host recorded the message, it has no Retry and no other control. If the host refused it without recording it, it keeps Retry.
• One rule decides what the chat shows, and the per-message notices use the same rule:
  • withdrawn by Stop: hidden;
  • held by a queued card (a draft's hand-off, or a card under the same id): hidden;
  • a command: hidden;
  • superseded by a later copy of the same text, sent once the rejection was known: hidden.
• The outbox writes only on change. Its reconcile returns the same entries and list when a journal batch settles nothing, so streaming writes nothing to storage. A copy Orca recorded and rejected owes no delivery, so it never keeps a hidden chat reading its history.
• Stable notices. A new batch that leaves every "Not sent" message unchanged keeps the same notice objects, so no row re-renders.

Why

Orca already keeps every message it accepts, with the reason it failed. Drawing the chat from that history makes the failure visible on every reopen, crash or not, instead of depending on a second copy a crash can lose. It also means one stored fact always looks the same. This is the common pattern: a message the server recorded and then rejected stays in the conversation with its error, and there is no per-message Retry; you send it again.

Alternatives considered:

• Make the outbox save synchronously. That narrows the crash window but keeps two sources of truth, which have disagreed before.
• Leave the message at the point where it was sent. A message that waited behind a long turn would jump hundreds of rows up. If that point was older than the loaded page, the chat drew it nowhere at all; the review reproduced this.
• Keep the old start-failure write order (row, then rejections) and move only the messages. The failed messages then read below "did not start". Swapping the order as two separate writes would open a moment with neither the queued message nor the row, where a second "did not start" row could be written. One atomic write avoids either problem.

Differences from the common pattern

• Intended: a later copy of the same text hides an earlier rejected one, but only if the later copy was sent after the rejection was known. With this PR, Retry no longer resends a message Orca recorded under a new id, so it creates no new pairs. The rule now covers history already in existing chats, plus Orca's own messages that it re-delivers under a new id. Orca-observed failures without it:
  • Earlier versions' Retry resent a rejected message under a new id, so existing chats contain rejected-then-resent pairs that would all show a stale "Not sent" copy after the update.
  • Orca re-delivers its own messages (orchestration pointers) under new ids. A real journal held four rejected copies of one such message, and without this rule all four draw as "Not sent".
  • A deliberate repeat sent before the first one failed stays visible.
• Intended: the message is drawn where it was rejected, not where it was sent. Drawn where it was sent, a message that waited behind a long turn jumped hundreds of rows up, and when that point was older than the loaded page it was drawn nowhere at all (reproduced in review). At the rejection it is always on the newest page.
• Temporary: the phone still hides these messages and puts a rejected message's text back in its composer. Follow-up: the phone draws rejected messages in place, as the desktop now does, and stops restoring the text.
• Temporary: the host's conversation outline does not list rejected messages. Their rail tick appears once their page is loaded. Follow-up: include them in the outline behind a client capability, because older desktops hide these rows.
• Temporary: with no Retry on a message Orca recorded, its images can't be resent with one click. Text can be copied. Follow-up: composer recall derived from the chat's own messages, including attachments.
• Temporary: a copy saved before a crash can stand in for Orca's row until that row's page loads. If the chat reopens and Orca's record of the rejection is older than the loaded page, the saved copy shows the message as "Not sent" with its reason and no controls, exactly once, at the end of the chat; it goes away by itself when that page loads. The follow-up that removes the desktop outbox entirely also removes these copies.
• Temporary, landing order with fix(native-chat): keep a message accepted before a quit or crash as a held card #24660: a rejected message held as a queued card is hidden while that card exists. Kept cards exist only once fix(native-chat): keep a message accepted before a quit or crash as a held card #24660 lands, and fix(native-chat): keep a message accepted before a quit or crash as a held card #24660 records the fact durably on the rejected message (keptAsQueuedMessageId). Whichever of the two PRs lands second switches this rule to that field, so editing or deleting a kept card never brings the row back for users.

Linked Issue

None (maintainer). Follow-up to #24461.

Visual Proof

Live run on a separate Mac against a hidden dev build of this branch. The crash and failed-start shots are from the final head 50c957b; the in-doubt, Stop and upgrade shots are from 7f7636e (later commits change only how the outbox settles its copies).

Killed while the agent was still starting; after relaunch, one "Not sent" row with the reason and no controls:

The same, in a new chat where it is the only message (not hidden behind the empty "start a chat" view):

Killed one second after a message sent into a running turn: its delivery is in doubt, so it stays a plain message, once, never "Not sent":

The agent failed to start: "Your message was not sent." sits above the "did not start" row (same after relaunch):

Stop on a message waiting behind /compact: no row; its text is back in the composer:

Upgrade: before, on main, "Not sent" with Retry; after Retry delivered it, the same profile on this branch shows only the delivered copy, no stale "Not sent" copy:

Testing

• Host: placement. journal-rejected-message-placement.test.ts:

  • A queued message, a message delivered into a turn, and a direct send each move to their rejection, in no turn.
  • The moved message reaches subscribers and the newest page.
  • A message in doubt does not move and is not drawn "Not sent".

• Host: atomic start failure.

  • journal-queued-rejection-batch.test.ts: rejections first, then the row; a row that can't be written writes neither; a Stop that withdraws every queued message first means nothing is written.
  • journal-row-writer.test.ts: rows written together roll back together.
  • Existing tests still pass: "draws the messages it failed above the error row" and the two view-start tests.

• Desktop.

  • structured-agent-session-message-projection.rejected-in-place.test.ts: in-place drawing; host words with no Retry; the start-failure wording; the supersede rule either way; withdrawn; queued-card and hand-off hiding; /compact; an older host's position; the phone option.
  • use-structured-agent-session-outbox-rejection-cause.test.tsx: the outbox lets go once the host's record is held, and storage is cleared; the same stored rejection has no Retry and no other control on a first and a second open; the copy goes away with no user action once its row loads (live batch, reopen, older page).
  • structured-agent-session-delivery-notices.test.ts: refusals keep Retry; host-recorded messages carry no control.
  • structured-agent-session-message-projection.recorded-copy.test.ts: a recorded copy goes away with no user action in every case (new host live, reopen, older host's older page), never carries a control, and is never sent again.
  • use-structured-agent-session-delivery-notices.test.tsx: notices stay the same objects across unchanged batches.
  • use-structured-agent-session.rejected-card.test.tsx: queued card ids flow from the session controller.

• Ablations. Each rule was removed in turn, and a test went red.

• Totals. 429 test files covering the journal, the host session wire, and native chat pass (3992 tests). The changed-code quality gate, React Doctor, and oxlint on changed files pass.

• I manually tested these changes locally

• Automated tests added/updated, or explained why not below

Review

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• Mixed versions. The journal row format does not change, but what the host publishes does, in two ways:

  • A rejected message now carries the position of its rejection.
  • A failed start's rows arrive as one group, rejections first.

  Older desktops and the phone hide rejected messages, so they see no change. An older desktop whose outbox still holds the message draws that copy at the new position. An older host does not move anything, so this desktop shows the message at its original position. When that position is older than the loaded page, the outbox copy keeps showing it (in Orca's words, no controls) until that page loads, and then the host's row takes over. If a crash also lost the outbox copy, the message appears only once you scroll back to it.

• Legacy chats. In a chat whose failed start was written by an older version (row first, then rejections), the failed messages read just below the "did not start" row instead of above it. This is cosmetic; new chats read above.

• SSH and remote hosts. The placement is computed by whichever host owns the chat, from its own journal. Clients only read it. Loss of contact is never read as a rejection.

• Folder workspaces. No dependence on workspace type.

• Performance. Moving a message is one map update per rejection. The notices and the command set are recomputed only for chats with a "Not sent" message, and they are kept identical across unchanged batches.

Checklist

• This PR is small and focused (it is focused on one bug, but touches the host's journal writer to make the failed-start write atomic)
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[brennanb2025]

Review status

The problem. In the desktop chat, a message you sent could vanish. Orca had accepted it, then failed to deliver it: Orca restarted, the chat closed, the agent failed to start, or a message sent into a running turn was never picked up. The chat only showed such a message while a copy saved in browser storage still had it, and a crash often loses that copy. So after a crash the message was simply gone. Without a crash it showed "Not sent" with a Retry button, so the same failure looked different depending on luck.

What changes for you (desktop).

• A message Orca accepted and then failed to deliver always shows, marked "Not sent" with the reason, at the point where it failed. It is read from Orca's own chat history, so a crash can't erase it.
• Those messages carry no button at all; you send the text again. A message Orca refused before ever recording it keeps its Retry.
• When the agent fails to start, the failed messages read "Your message was not sent." just above the "did not start" row.
• A message sent into a running turn whose delivery is only in doubt after a crash stays a normal message; it is never marked "Not sent", because it may have reached the agent.
• A message taken back with Stop, a failed /compact, and a message held as a queued card stay hidden, as before.

What the review changed (the PR now differs substantially from the first version):

• The host's history is now the only thing that shows such a message: the browser-storage copy lets go once the host's record is loaded, and those messages lose Retry. This brings part of the planned outbox removal forward.
• The host places a rejected message where it was rejected, not where it was sent. Before, a message that waited behind a long turn jumped hundreds of rows up, or wasn't drawn at all when that point wasn't loaded.
• A failed start now writes its rejections and its "did not start" row in one step, rejections first. If Stop already took back every waiting message, nothing is written.
• A later copy of the same text hides an earlier rejected one only if it was sent after the rejection, so a deliberate repeat stays visible.
• A rejected message held by a queued card no longer shows twice, as a card and as a row.
• Whether Retry shows is decided from what is stored, the same on every reopen. A saved copy of a message Orca recorded never has a control: it goes away by itself once Orca's own row for it loads.
• Newer desktop with an older host: the saved copy keeps showing the message until its place in the history loads, then goes away by itself.
• The outbox writes to storage only when something changed, not on every streamed update.

Deferred (each is listed under "Differences from the common pattern" in the PR description):

• If the chat reopens after a crash and Orca's record of the rejection is older than the loaded page, the saved copy shows "Not sent" with its reason and no controls until that page loads. Removing the desktop outbox (the planned follow-up) removes these copies.
• The phone still hides these messages and puts the text back in its composer. Follow-up: the phone draws them in place.
• The conversation outline doesn't list them; their rail tick appears once their page loads. Follow-up: list them behind a client capability.
• Images in a rejected message can't be resent with one click; the text can be copied. Follow-up: composer recall built from the chat's own messages.
• Landing order with fix(native-chat): keep a message accepted before a quit or crash as a held card #24660: kept cards exist only with fix(native-chat): keep a message accepted before a quit or crash as a held card #24660, which records keptAsQueuedMessageId; whichever PR lands second switches the hiding rule to that field, so editing or deleting a kept card never brings the row back for users.
• Smaller items: chats written by an older version show failed-start messages below the "did not start" row; a moved message's hover time is its rejection time; a failed /compact rejected after the command stopped waiting is reported nowhere, as on main; with an older host, a kept copy can briefly ignore the same-text rule until its page loads.

Verified.

• On the final head 50c957b: typecheck (node and web) passes, CI is green (PR Checks, Mobile Checks), and 433 related test files (4,002 tests) pass locally. Every new rule was removed in turn and a test went red.
• Live, on a separate Mac against a hidden dev build of this branch, five scenarios passed (screenshots in the description):
  • crash while a message waited to be sent: one "Not sent" row with the reason, no Retry, also when it is the chat's only message;
  • crash right after a message sent into a running turn: a plain message, shown once;
  • agent fails to start: "Your message was not sent." above the "did not start" row;
  • Stop on a waiting message: no row, text back in the composer;
  • upgrade from main after a Retry: only the delivered copy, no stale "Not sent" copy.

Not verified.

• Live: a message Orca refuses without recording it, which should keep Retry. The test setup couldn't trigger a refusal; unit tests cover it.
• Live: newer desktop with an older host. Unit tests only.
• The phone (unchanged by design), SSH and Windows were not run live.
• The crash and failed-start scenarios were re-run and passed on the final head 50c957b (no control of any kind on the "Not sent" row). The in-doubt, Stop and upgrade scenarios were run on 7f7636e; later commits change only how the browser-storage copy is released, which is covered by unit tests.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

🧰 Additional context used

📚 Code guidelines (1)

AGENTS.md — auto-discovered

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: c98573d1-5cfe-4564-9306-2e7b0340b211

📥 Commits

Reviewing files that changed from the base of the PR and between 50c957b and 7c7a4c6.

📒 Files selected for processing (14)

• src/main/native-chat/agent-session-journal/journal-pending-submission-recovery.ts
• src/main/native-chat/agent-session-journal/journal-row-writer.test.ts
• src/main/native-chat/agent-session-journal/journal-row-writer.ts
• src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
• src/renderer/src/components/native-chat/NativeChatStructuredSession.tsx
• src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx
• src/renderer/src/components/native-chat/structured-agent-session-outbox-retry.ts
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox-admission.test.tsx
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox-relaunch-hold.test.tsx
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
• src/shared/native-chat-types.ts
• src/shared/structured-agent-session-outbox.ts
• src/shared/structured-agent-session-send-disposition.ts

🚧 Files skipped from review as they are similar to previous changes (2)

• src/shared/structured-agent-session-send-disposition.ts
• src/shared/native-chat-types.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The change records queued rejections in the same journal batch as failed-start rows. Rejected messages retain their journal rejection position and can render as unsent messages on desktop. Outbox reconciliation now uses loaded journal rows, while host-recorded rejections use Dismiss instead of Retry. Message projection and session hooks accept queue and journal-row state. Tests cover placement, reconciliation, notices, queue behavior, and mobile projection.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to 7c7a4

The change shows rejected messages in place with the host's reason and no Retry. No concrete merge-blocking issue was found in the supplied material.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 7c7a4

The change improves recovery of failed messages while preserving the reviewed conversation and write controls. No introduced security issue was established. Risk remains low rather than minimal because complete verification of session switching and compatibility with earlier behavior was not available.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

• inferred — The inspected effects concern conversation-message persistence, local retry state, and display. The reviewed notice path adds no independent transport authority, and the writer retains session-bound insertion. These observations do not establish complete cross-conversation isolation for unverified read paths.

Trust Boundaries and Controls

• observed — Retry looks up entries in the specified session's outbox and changes only the matching client-message identity. Storage reads use session-specific keys and parse entries against that session. Send-result handling discards results from superseded dispatch generations.

Resilience and Maintainability Implications

• observed — Batch planning runs on the serialized write lane and consults current queued submissions and applied settlement identities. Database failure invokes rollback handling before row adoption. Re-reading unchanged reconciliation state preserves object identity and avoids additional writes.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 31.18% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 93 functions across 57 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: showing a host-recorded delivery failure as “Not sent” in chat. It is specific, though longer than ideal.
Description check	✅ Passed	The description covers the required sections with detailed change rationale, visual proof, testing, compatibility notes, and checklist status. The manual-testing checkbox is unchecked despite reported…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

ℹ️ No critical issues — one path where the new "Not sent" rule is bypassed.

Reviewed changes

• Host journal placement. A rejected dispatch row now moves its message item to the rejection sequence, in no turn (placeRejectedMessage), covering queued, handed-over, and direct sends; a message in doubt does not move. The host owns the position, so a recent rejection always lands on the newest loaded page.
• Atomic start-failure write. JournalRowWriter.enqueueRows writes the queued-message rejections and the lifecycle "did not start" row in one transaction, rejections first, driven by a new JournalLifecycleBatchInput.rejectsQueued. Nothing is written when a Stop withdrew every queued message first.
• Outbox lets go, and Retry becomes Dismiss. reconcileStructuredAgentSessionOutbox moves to its own module and drops an entry once the rejected submission's own row is loaded; structuredAgentSessionEntryRejectedByHost makes a host-recorded rejection offer Dismiss and no Retry, and owesDelivery stops counting such an entry.
• One rule for what shows. structuredAgentSessionRejectedShownInPlace decides in-place drawing (withdrawn, queued-card-held, commands, and a copy superseded by a later same-fingerprint send are hidden); desktop delivery notices use the same rule and are held stable across unchanged batches.
• Mobile passes rejectedInPlace: false and is otherwise unchanged.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

The outbox-drawn copy bypasses the new supersede rule. structuredAgentSessionRejectedShownInPlace hides the host item when a later submission with the same payloadFingerprint was submitted at/after its resolvedAt, but optimistic here is filtered only against journalled (visible items), and reconcileStructuredAgentSessionOutbox keeps a rejected entry whenever its own row is not in the loaded items. So when the superseded message's host row is outside the loaded/retained window (the client retains only the newest items but mergeSubmissions keeps up to 256 submissions), its outbox entry still draws — a delivered resent row plus a stale Not sent row for the earlier copy. I reproduced this: items = [seed, resent], submissions = [seed, old(rejected), resent], outbox = [old(rejectedByHost)] renders three user rows, with old as unsent.

Technical details

# Supersede rule not applied to the outbox-drawn copy

## Affected sites
- `src/shared/structured-agent-session-message-projection.ts:69-72` — the supersede rule that hides the host item.
- `src/shared/structured-agent-session-message-projection.ts:88` — `optimistic` starts from the reconcile, which keeps a rejected entry until its own item loads.
- `src/shared/structured-agent-session-message-projection.ts:134-135` — the optimistic rows are filtered only against `journalled` (visible items).
- `src/shared/structured-agent-session-outbox-reconcile.ts:30-42` — keeps a rejected entry when its row is not in `items`.
- `src/shared/structured-agent-session-reducer.ts:199-203` / `structured-agent-session-item-retention.ts:21-38` — submissions survive item trimming, so a rejected submission can outlive its item.

## Required outcome
- A rejected submission hidden by the supersede rule (or by a queued card, a command, or a withdrawal) must not draw from its outbox copy either; the transcript should show only `resent`.
- The documented fallback must still hold: a rejected message whose host row is not loaded but which is not hidden by the rule keeps drawing from its outbox copy.

## Suggested approach
- Give the outbox path the same hiding decision as the item path — pass `queuedMessageIds`/`commandItemIds` into the reconcile (or the projection's optimistic filter), or have `structuredAgentSessionRejectedShownInPlace` also return the hidden set so `structuredAgentSessionEntryRejectedByHost` entries can be dropped.

## Open questions for the human
- Is a lingering outbox copy acceptable until the outbox is removed, given the stale row carries a Dismiss?

[pullfrog]

ℹ️ No new issues in this delta — the prior finding still stands.

Reviewed changes (delta against the prior review at 831e8eb1)

• Dismiss removed. 804ca8c69d drops the Dismiss action from host-recorded rejection notices and the outbox hook. A host-recorded rejected copy now renders as text with no control on every mount, and leaves only when its row loads. The notices no longer build the outboxDraws set, and dismiss is gone from useStructuredAgentSessionOutbox and the session controller.
• Tests updated. use-structured-agent-session-outbox-admission.test.tsx, structured-agent-session-delivery-notices.test.ts, the recorded-copy/older-host projection tests, and use-structured-agent-session-delivery-notices.test.tsx now assert no control and self-retirement. All pass locally (38 tests across the five touched suites).

The prior review's finding is unaffected: the shared projection and reconcile are unchanged by this delta, so a superseded rejected message whose host row is outside the loaded window still draws its outbox copy.

  ^{｜ Fix it ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

ℹ️ No critical issues — minor suggestion inline. The head is unchanged since the prior pullfrog review at 50c957b783, so this re-confirms the one previously flagged path and finds nothing new.

Reviewed changes

• Host journal placement. A rejected dispatch row now moves its message item to the rejection sequence, in no turn (placeRejectedMessage), covering queued, handed-over, and direct sends; a message in doubt does not move.
• Atomic start-failure write. JournalRowWriter.enqueueRows writes the queued-message rejections and the lifecycle "did not start" row in one transaction, rejections first, driven by a new JournalLifecycleBatchInput.rejectsQueued. Nothing is written when a Stop withdrew every queued message first.
• Outbox lets go. reconcileStructuredAgentSessionOutbox moves to its own module and drops an entry once the rejected submission's own row is loaded; structuredAgentSessionEntryRejectedByHost makes a host-recorded rejection offer no Retry, and owesDelivery stops counting such an entry.
• One rule for what shows. structuredAgentSessionRejectedShownInPlace decides in-place drawing (withdrawn, queued-card-held, commands, and a copy superseded by a later same-fingerprint send are hidden); desktop delivery notices use the same rule and are held stable across unchanged batches.
• Mobile passes rejectedInPlace: false and is otherwise unchanged.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using deepseek-v4.1-flash (free via Pullfrog for OSS) ｜ 𝕏}

[pullfrog]

A rejected submission hidden by the supersede rule still draws from its outbox entry here whenever its host row is outside the loaded window, so a stale "Not sent" can appear beside the delivered resend. The reconcile gates the outbox copy only on the row being loaded, not on structuredAgentSessionRejectedShownInPlace; the projection then draws that entry as unsent at structured-agent-session-message-projection.ts:88.

Technical details

# Superseded rejected copy still draws from the outbox

## Affected sites
- `src/shared/structured-agent-session-outbox-reconcile.ts:30` — the `rejected` branch returns the entry whenever the submission's row is not loaded, with no supersede check.
- `src/shared/structured-agent-session-message-projection.ts:88` — those entries then map to `unsent` rows, bypassing `structuredAgentSessionRejectedShownInPlace`.

## Why it is reachable
- An older host leaves a rejected message at its sent position, which can be outside the loaded page; the outbox copy is kept for exactly that case. If a later same-`payloadFingerprint` copy was sent at/after the rejection's `resolvedAt`, the in-place rule suppresses the journal row but not this retained copy. The new `recorded-copy` test covers "row outside the window" and the `rejected-in-place` test covers supersede, but not both at once.

## Required outcome
- A rejected submission the in-place rule suppresses must not reappear as a "Not sent" row from its retained outbox copy.

## Suggested approach
- Have the reconcile consult the same rule as the projection (or accept the `shown` set) so an entry whose submission is superseded is dropped/skipped, not only one whose row is loaded.