feat(native-chat): keep a message a Stop took back on screen, with one stop row after it

[brennanb2025]

	Files	Added	Deleted	Net
Test	17	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​2903	$\color{#cf222e}{\Huge{\mathbf{−}}}$​78	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​2825
Prod	29	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​966	$\color{#cf222e}{\Huge{\mathbf{−}}}$​95	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​871

Base main: #24864, #24369 ("Stopping…") and #25073 are all on main.

Builds on #25073 (the submittedSequence and answeredInTurn fields), which is on main as 9def4b9ba19.

ELI5

When you press Stop before the agent has started on your message, the message used to vanish from the chat and its text reappeared in your typing box. Other devices just lost it. Now the message stays in the chat, with one line saying it was stopped, and your typing box is left alone. A Stop never loses what you sent.

What Changed

The problem.

• A Stop can take back a message before the agent starts it. Orca then removed the message from the transcript and pasted its text back into the composer of the window that sent it.
• Nothing on screen said what had happened. On a phone, or on any desktop other than the sender's, the message simply disappeared.
• With the message gone there was no run left for a stop row to describe. In live testing, "Cancellation requested." landed under the previous finished turn, so that earlier turn read as if it had been cancelled. fix(native-chat): a Stop binds only the turn it actually stopped #24864 stopped writing that row as a stopgap and named this follow-up.

Before / after:

Situation	Before	After
A Stop takes back a message before the agent starts it	The message disappears; its text is pasted into the sender's composer	The message stays where it was sent, followed by "Stopped before the agent started"; the composer is untouched
Several messages taken back by the same Stop	All disappear; their text is pasted together	All stay, with one "Stopped before the agent started" row after the last of them
The same chat on a phone or another desktop	The message disappears	Same as the sender: the message and the row
The agent had opened a turn for the message (echoed or not), and the Stop interrupted it	The message disappears; the turn's "Interrupted after N" header sits on its own	The message stays in that turn; its "Interrupted after N" header and the turn's own "Cancellation requested." are the stop, and no third row is added
A message sent into a turn the agent was already running (a steer) that the Stop took back	The message disappears	The message is drawn after that turn's "Cancellation requested.", followed by "Stopped before the agent started". The host now says which turn it joined, so it could be drawn inside that turn later; this PR does not do that
A message waiting for a running turn to finish (for example behind /compact), or sent just before the agent opened its turn, that the Stop took back	The message disappears	The message and its row are drawn after that turn's own rows, where the Stop took it back
A queued card's send taken back by a Stop	The card returns, paused	Unchanged
A message this window had not yet passed to the host when you pressed Stop	Its text is pasted after whatever you typed	Its text comes back into the composer if the composer is empty. Otherwise it stays below the conversation as "Message was not sent." with Retry, and the composer keeps what you typed
A message refused for any other reason	"Message was not sent." with Retry	Unchanged

To send a stopped message again, copy it (user messages already have a Copy button on desktop, and selectable text on the phone) and send it.

Mechanism.

• Shared message projection (src/shared/structured-agent-session-message-projection.ts, used by desktop and phone):
  • A user message whose submission was rejected as withdrawn (the cancelled fact, or its older marker) is no longer hidden. A queued card's hand-off is still left out: the card holds its text.
  • It gets one client-drawn row after it (presentation: 'stopped-before-start', src/shared/native-chat-stopped-before-start.ts), shared by consecutive taken-back messages. The row is skipped when a turn opened for the message: that turn's interrupted end already says it was stopped.
  • A message the Stop took back is drawn at its own journal row. Since fix(native-chat): show a message Orca accepted and then failed to deliver as "Not sent" in the chat #24710 the host moves a rejected message's row to the row that rejected it, in no turn, so that is where the Stop took it back. It is drawn past the end of every turn whose opener the journal wrote before that row, so it never splits the exchange it waited on. That is one comparison in journal order, never a clock.
  • Several messages the Stop took back with their own stop rows keep the order they were sent in, by where each was sent (submittedSequence, feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073). The move erased that from the row itself.
  • A steer the Stop took back is no exception: the host takes a rejected message out of its turn, so it is drawn after that turn like any other. The host now names the turn it joined (answeredInTurn with via: 'steer', feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073), which would allow drawing it inside that turn later. This PR does not.
  • On a host that publishes neither field, the earlier placement rules apply instead (Temporary); see Mixed versions.
  • Other rejections stay hidden, as before.
• Turn anchors (structuredAgentTurnAnchors in src/shared/native-chat-turn-membership.ts):
  • Codex reports a turn open before it echoes the send, so until the echo the turn record names the provider's key.
  • A send the Stop took back before that echo opens a turn when the host says it did: its submission names that turn and says Codex answered the send's start request with it (answeredInTurn, via: 'start', feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073). It is then drawn as that turn's opener, just before the record, with no row of its own. A send the host states was answered into no turn (null) opens none.
  • A send steered into the turn (via: 'steer') opens nothing, even when the turn's real first message is on an older page that is not loaded yet.
  • When the turn's record names a first message that is loaded, that message keeps the turn, whatever the host says about a stopped send.
  • A turn whose record names itself, one the provider resumed on its own, is opened by no send.
  • When the loaded history starts after that turn's record, and a row of that turn is loaded, the send is drawn just before that turn's first loaded row, still with no row of its own. If no row of that turn is loaded, it is drawn on its own with its stop row, until the older history loads.
  • A rejection with no answeredInTurn at all was written before the host was upgraded to name turns. It is matched to a turn by the rule used before:
    • Intended, kept for good: where the host publishes where it was sent (submittedSequence), by journal order: sent before the turn's record and taken back after it. This is history an older host wrote, served by a host with feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073, which has moved its row to the take-back. It is a permanent compatibility branch, not a stopgap: old chats keep those rows, and no host version floor removes them. It is safe to keep because it draws those rows exactly as this client drew them before the host named turns; review confirmed that on 51 of 51 end-to-end cases.
    • Temporary: otherwise, on a host without feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073, by its row's place and times: sent before the record (by its row's place, or by accept time against the turn's start) and taken back after the turn started. It goes once no supported remote host lacks the fields; see Mixed versions.
• Desktop draws the row through the same path as the Stop's own status rows ("Cancellation requested."), in its own words from all six catalogs. The row never folds behind a settled turn. The phone draws the row's English text, as it does every other status line.
• Rail and outline:
  • The conversation outline the host serves for older history keeps its old rule: it leaves out sends a Stop took back.
  • The message rail gives them no tick either, so the rail and the outline agree.
• Composer:
  • The host-withdrawal refill (useStructuredAgentSessionWithdrawnRestore().byHost) is removed.
  • The sender's own Stop step gives back entries the host never received, but only into an empty composer (no text and no images).
  • Entries the composer cannot take, including where no composer shows the chat, stay in the outbox as not sent, on their Retry. That outbox is their only copy.
  • The phone: a send whose answer says a Stop took it back is not handed back to the draft, which since fix(mobile-chat): a failed message's text is added to the draft, and an expired resend no longer blocks that text #25149 adds a failed message's text to it: the chat already draws it with its stop row. A first answer like that reads as sent, as on desktop. A resend the phone could not tell from a new send of the same text (its earlier answer was lost) is sent once more under a fresh id: the stopped one provably never ran. Every other refusal still goes back to the draft.
• Host: unchanged apart from comments. fix(native-chat): a Stop binds only the turn it actually stopped #24864 already writes no "Cancellation requested." for a Stop whose only effect was taking the send back.

Why

The common pattern keeps a stopped message on screen with one stop row after it, and leaves the composer alone. There is no per-message Retry for a stopped message, and re-running it is the person's own action. This PR adopts that.

Alternatives considered:

• Keep refilling the composer and only fix where "Cancellation requested." lands. The message would still vanish on every other device, and a row with no message above it still has nothing to describe.
• Have the host write the stop row. See the first difference below.

Differences from the common pattern

Difference	Label
The stop row is derived on each client from the stored rejection, not stored as its own host event.	Intended. Orca records the withdrawal as the send's rejection, and every client reads it from that one record. A host-written row would reach clients that still hide the message, and live testing showed exactly that row landing under the previous finished turn, as if that turn had been cancelled. Deriving it keeps the row with the message it describes on every client that shows the message.
A message the Stop took back is drawn past the end of the exchange it waited on, not inside it at the row that took it back. The common pattern has the host assign the position and the client draw it there. Orca does the first part (the host moves the message's row to where it was taken back) but draws the message after that exchange rather than at the row.	Intended. Drawn at that row, it sat between an earlier message's reply and that reply's own stop note, or above output that streamed after the Stop, which reads as the agent answering after the stop row. Live testing and review found exactly that, three times.
A message this window had not yet passed to the host comes back only into an empty composer; otherwise it is kept, across restarts, as "Message was not sent." with its own Retry. The common pattern puts it back into an empty draft and shows an error; nothing is stored.	Intended. The common shape lost the text whenever the composer held something: an earlier version of this PR did exactly that, and its own test pinned the loss. A kept entry needs a way to be cleared, and the not-sent row's Retry is that way. Without it, nothing would ever remove the stored entry.
A message the Stop took back after its turn opened, but before the agent echoed it, is drawn as that turn's opener, just before its record, with no row of its own. The host moved its row past the turn's record, to where it was taken back.	Intended. The turn's interrupted end is its stop. Drawn at the moved row, the turn's "Cancellation requested." sat above the message, and the message got a second stop row. As in the common pattern, the host says which run the message belongs to (answeredInTurn) and the client draws it there.
Plain sends the host accepted but had not yet passed to the agent are shown as taken back. The common pattern holds them in a paused queue.	Temporary. Orca holds these as paused cards once the queued-messages capability rolls out (#21062). Until then, plain sends have no card form.

Follows the common pattern:

• the stopped message stays in the chat: where it was taken back, in no turn (a steer included), or, if it was waiting on a turn, right after that turn;
• one stop row follows it;
• the composer is not refilled;
• no Retry on a stopped message;
• a queued card stays paused.

Mixed versions. The host publishes two more optional fields on each submission (#25073):

• submittedSequence: where the journal wrote it, worked out fresh from the session's recorded history each time it is read and never stored.
• answeredInTurn: on a rejected message, the turn Codex answered it into and how it joined it, or null when the host recorded no turn. It is stored on the rejection row, and absent from rejections written before it existed.

Rule 1 of the wire doc applies: an older client ignores them, and #25073's cross-version test shows the two latest released clients draw a page and an incremental update carrying them exactly as they draw the same without them. No RPC method or stream frame changes, and the host-served conversation outline keeps its old rule.

• No released host moves a rejected message's row yet. fix(native-chat): show a message Orca accepted and then failed to deliver as "Not sent" in the chat #24710, which does, is on main and in no release tag. So the hosts a new client meets are:
  • Released hosts (before fix(native-chat): show a message Orca accepted and then failed to deliver as "Not sent" in the chat #24710): the row stays where the message was sent, and neither field is published.
  • A host built from main after fix(native-chat): show a message Orca accepted and then failed to deliver as "Not sent" in the chat #24710 but before feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073: the row moves, but neither field is published. No released host is in this state.
  • A host with feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073: both fields ship together, so the rules above for every rejection it writes. Rejections written before the host was upgraded carry no answeredInTurn, and are placed by journal order as described under Turn anchors (Intended, kept for good).
• New client, host without the fields (Temporary): the earlier placement rules apply, and they read clocks. They are correct on released hosts, which do not move rows; on a host built from main in between, they are the best guess available.
  • The message is drawn after the latest row of anything sent before it, and after every turn that opened by then.
  • Several taken-back messages keep the order of their accept times, so two accepted in the same millisecond keep the order the client happens to hold them in.
  • A Codex message taken back before Codex echoed it is matched to its turn by row order or accept time, and by start time against the take-back. After a restart, Codex rewrites turn start times to whole seconds, so a turn whose start lands in the same millisecond as the take-back can be misread.
  • Nothing is lost in either case. These rules are removed once no supported remote host lacks the fields.
• New client, older host, other limits:
  • A host from before fix(native-chat): a Stop binds only the turn it actually stopped #24864 never takes back a Codex send whose turn never opened. That send stays "unconfirmed" with Retry, as today.
  • A host from before fix(claude): a Stop naming the running turn acts at once, and a Stop in the gap is no longer lost #23861 can still write its own "Cancellation requested." for a Stop that only took back queued sends, so a new client shows that row and its own.
  • A turn record without a start time (older hosts) does not claim a send taken back before its echo, so that send gets its own row beside the turn's.
• Older client, newer host: unchanged. A released client hides every rejected message, so where the host puts its row changes nothing it draws, and it refills the sender's composer as today.

Known limit: a long chat loads its newest history first. If that loaded part starts after an earlier message whose turn is still on screen, and a later message the Stop took back follows, the stopped message and its row can show above that earlier turn's reply or stop note until you scroll up and the older history loads. On a host without #25073's fields, it can also show with no row of its own at the top of the earlier message's turn, as if it had started that turn. Review found these by loading every possible starting point of 47 end-to-end cases on the real host with the fake Codex, and re-ran that sweep on this change. For rejections a host with the fields wrote, only the first shape remains: the second, and a third (the turn's "Cancellation requested." above the message that started it), are gone. For rejections written before the host was upgraded, the second and third shapes remain, exactly as before this change.

Known limit (reachability not verified): a message Codex quietly folded into a turn already running, which Orca had not heard of yet, is recorded as having started that turn. If that turn has no user message of its own (for example, one Codex ran on its own), or its first message is on an older page that is not loaded yet, the stopped message is drawn as the head of that turn. With the first message loaded, the first message keeps the turn.

Known limit (not new): a Codex rewind rebuilds the transcript from the provider's own items plus Orca's turn rows. A message a Stop took back is neither, so it drops from the transcript before the rewind point, as every withdrawn message already did.

What this removes:

• fix(native-chat): a Stop binds only the turn it actually stopped #24864's Intended row "a Stop that took back a message whose turn never opened leaves no Stop row" now matches the common pattern.
• Both follow-ups in fix(native-chat): a Stop binds only the turn it actually stopped #24864's Notes are covered: the composer refill, and the "Worked for N" header on a taken-back message.

Linked Issue

Follow-up to #24864 and #24369. Closes STA-9337 (https://linear.app/stably/issue/STA-9337), with #25073: a stopped message is placed by journal order and the host's named turn instead of clocks wherever the host publishes the fields.

Visual Proof

Live desktop QA on a separate Mac, against a background build of this branch (9f3cd5e5), driving native Codex chats backed by a stand-in Codex. The stand-in can open a turn and never echo the message, and can hold a steer without echoing it. Desktop only; the phone draws from the same shared projection and is covered by tests.

A Stop after the turn opened but before Codex echoed the message. The message keeps its turn: "Interrupted after 11s" sits on it, with no "Stopped before the agent started" row. "Cancellation requested." is inside the turn, shown when it is expanded.

Collapsed	Expanded

A message steered into a running turn, then taken back by the Stop. It is drawn after that turn's "Cancellation requested.", with its own row.

A Stop before the agent started the message. The message stays where it was sent, with one "Stopped before the agent started" row, and the composer is not refilled. Before this PR the message disappeared and its text was pasted back into the composer.

An older chat, written before the host recorded these fields, opened on the new host. Its stopped message ("Phone1 m4 never opens") draws with one stop row, and no "Cancellation requested." sits above a message that owns its turn.

Also checked in the same run: two messages queued behind /compact and stopped before the echo (the first keeps its turn; the second, steered in, is drawn after it with its own row); every chat draws the same after a window reload; and the journal rows record answeredInTurn as start, steer or null as described above.

Testing

• I manually tested these changes locally (live desktop QA on a separate Mac with a stand-in Codex, at 9f3cd5e5; see Visual Proof)
• Automated tests added/updated, or explained why not below

New tests:

• src/shared/structured-agent-session-message-projection-stopped-before-start.test.ts (25). Each case that depends on the host is built in the host's own shape: on a host that publishes submittedSequence, the taken-back message's row sits where it was taken back, in no turn.
  • the message stays with one row after it;
  • the typed fact and the older marker read the same;
  • consecutive messages share one row;
  • a message a turn opened for stays in that turn, with no row, before and after the provider's echo, including when its row moved past that turn's record to the take-back;
  • a turn does not claim it when the turn's record came before the message was sent, or after it was taken back;
  • a steer the Stop took back, named as steered into its turn, is drawn after that turn's "Cancellation requested.", with its own row, on both host versions;
  • a message never handed over is drawn after the turn it waited behind, and a follow-up sent before the agent opened its turn is drawn after that turn's rows;
  • two messages queued during /compact, the first passed to the agent and the second not, stay in send order after one Stop takes both back, and one a later Stop took stays below one an earlier Stop took;
  • a message the Stop took back stays below everything sent before it, including an earlier message's whole exchange, whether it had finished or was still streaming when the Stop came, on both host versions;
  • two messages keep the order they were sent in, whatever their clocks say;
  • where accept times tie and the client holds the stopped message first, its moved row still puts it below the exchange before the Stop;
  • a queued card's hand-off and other refusals stay hidden.
• src/shared/native-chat-stopped-send-turn.test.ts (17), which turn a message taken back before its echo opens:
  • the message the host says started the turn opens it, not an earlier message taken back across it;
  • in history written before the host named turns, served by a host that publishes where each was sent: the message sent before the turn's record and taken back after it opens it, the first sent when two were, and a turn recorded before it was sent is not its;
  • a message the host states was answered into no turn opens none: a Claude rejection beside a turn Claude resumed on its own, and one before a later Codex record;
  • a message naming a way of joining this build does not know opens none;
  • an echoed first message the turn's record names keeps the turn, even from a stopped message the host says started it (a start Codex folded into a running turn);
  • a turn the provider resumed on its own is opened by no message;
  • a message the host states it named none for opens none, though it was sent before the record and taken back after;
  • a message taken back inside the turn another stopped message opened is drawn after that turn;
  • a steer: with an accepted first message, it is drawn after the turn with its own row; with the first message also taken back, the first message keeps the turn and the steer is drawn after it; with the first message on an older page, it still opens nothing; on a page that starts inside the turn, it keeps its own row;
  • on a page that starts after the turn's record, the message that started the turn is drawn before the turn's first loaded row with no row of its own, unless a loaded user message of that turn is there.
• src/renderer/src/components/native-chat/NativeChatMessageList.stopped-before-start.test.tsx (7), rendered on desktop:
  • placement after the previous turn, with no header of its own;
  • no "Working for" clock survives;
  • one row for consecutive messages;
  • "Interrupted after N" and no row for a turn that opened, before and after the echo;
  • the row is styled as the Stop's own status rows;
  • the row stays visible under a settled turn on a host that states no turn scopes.
• mobile/src/session/mobile-native-chat-stopped-before-start.test.tsx: the phone's projection, turn status and row text.
• Two guard tests for the phone, mobile/src/session/mobile-native-chat-merged-snapshot-parity.test.ts and mobile-native-chat-merged-snapshot-parity-hooks.test.tsx. They use a made-up chat shaped like the one in QA: a long history, a message sent while a Stop was ending a turn, then a message the agent never started, taken back when the agent exited.
  • The phone's chat, built up from the host's live updates, shows exactly what a freshly opened phone shows, after every update and from every point the phone could have joined. That includes a chat long enough that the phone first loads only its latest part.
  • The "Stopped before the agent started" row is in the phone's drawn list at every update from the one that took the message back on.
  • The second test runs the phone's own chat screen code, for a phone that sent the message itself (with its own pending copy) and sees the host's "Stopping" status.
• native-chat-rail-outline-parity.test.ts: the outline and the rail both leave out a send a Stop took back, while the transcript draws it.
• End to end, src/main/runtime/structured-agent-session-codex-stopped-send-order.test.ts, with the real host and the fake Codex:
  • a second send made while Codex still holds the first send's answer, then a Stop: the first send's turn opens after the second was accepted and streams after the Stop, and the stopped second send and its row are drawn after that turn's output, never between its header and its output;
  • a send, a Stop while the turn has not opened, and a second send while Stopping: the stopped message and its row stay above the second exchange after a restart whose resume reports turn start times in whole seconds.
• End to end, src/main/runtime/structured-agent-session-codex-turn-end-settlement.test.ts, with the real host and the fake Codex:
  • a Stop on a turn that never opened, after a finished turn: the client draws the message and then the row, and no "Cancellation requested." exists;
  • a Stop on a turn that opened before the echo: the turn anchors on the message and no row of its own is drawn. This passes unchanged on top of fix(native-chat): show a message Orca accepted and then failed to deliver as "Not sent" in the chat #24710's row move.

Updated tests:

• structured-agent-session-withdrawn-message-restore.test.tsx:
  • a host withdrawal leaves the composer as it is;
  • the sender's own Stop gives back only into an empty composer;
  • when the composer holds text or an image, or no composer shows the chat, the message stays in the outbox as not sent, text and images.
• use-structured-agent-session-outbox-withdrawal.test.tsx and use-structured-agent-session-outbox.draft-hand-off.test.tsx: updated to the same rules.
• Three of fix(native-chat): show a message Orca accepted and then failed to deliver as "Not sent" in the chat #24710's tests in structured-agent-session-message-projection.rejected-in-place.test.ts pinned a withdrawn message as hidden, the rule this PR replaces:
  • "stays when the same body was only sent before it, or by a copy a Stop withdrew": the withdrawn copy is now drawn too, and it still does not hide the failed copy, which is drawn as not sent;
  • "keeps a message a Stop withdrew hidden" is now "draws a message a Stop withdrew, with its stop row, and no delivery notice";
  • the phone's "still hides every accepted-then-rejected message" is now "still hides a message the host failed to deliver, but draws one a Stop withdrew": the restart-rejected message stays hidden.
  • Each checks that the stop row comes right after the withdrawn message.

Each placement rule was checked by breaking it and watching its tests fail, at this head (6 files: the two placement test files, turn membership, desktop rendering, and the two end-to-end files):

• the host's named turn ignored: 5, including the end-to-end test;
• null read as "written before the field": 2;
• a rejection without the field read as null: 5, in the two shared placement files and the desktop render test (the end-to-end tests stay green, since the real host always writes the field);
• older history placed by times only, not journal order: 2;
• any way of joining allowed to open a turn, not only start: 3;
• a steered message allowed to open its turn: 2;
• the host's named turn allowed to override a loaded first message: 1;
• a turn that names itself claimable: 1;
• the first message of a turn measured at its moved row, not where it is drawn: 1;
• no placement on a page that starts inside the turn: 1;
• the "past the end of every turn opened before it" rule off: 10;
• older host, the floor from earlier sends off: 3;
• the send-order rule off: 1.

The phone guard tests turn red when each layer is broken on purpose: the phone dropping part of an update (the taken-back message's new state, a removed row, a newer version of a message or status), the list hiding the stop row, and the chat screen's own list (rows held back until the next send, a list refilled in place, or two rows sharing a key).

Run locally:

• At cc6d83826cf (fixes from a review of the main merge: the Spanish "Stopped before the agent started" line restored, a phone test that compared nothing now reads "Stopping…", and one stale comment): the changed phone test, the outbox test and 4 language-file tests pass; phone tsc and the phone tests-typecheck ratchet pass. The full 10 desktop + 7 phone file set was not re-run at this head. CI: 16 pass, 16 skipped, 0 fail.
• At a200a857519 (base main, after feat(native-chat): the chat reads "Stopping…" from your Stop until the turn actually ends #24369 merged): CI 16 pass, 16 skipped, 0 fail, mergeable. This PR's own diff against main is unchanged line for line by the main merge (45 files). This head's tests: 10 desktop files (105 tests) and 7 phone files (67 tests) pass. tc:web, tc:node, phone tsc and the phone tests-typecheck ratchet pass. oxlint is clean on every changed file (desktop and phone configs). Merging main changed three tests mechanically for main's API: the dropped NO_CARDS argument, the three-argument projection call, and the new live-line mock.
• At 38567b27758 (this head, after merging feat(native-chat): the chat reads "Stopping…" from your Stop until the turn actually ends #24369 at 970c6a10eb5, which carries main through Add a Chat settings page for structured native chat #25685): this PR's own root test files plus the rewind and Stop tests that share its code (15 files): 197 pass. tc:web passes from a fresh build cache. The phone's files were not re-run locally; CI runs them.
• At ac6d23a3a03: this PR's own test files and their neighbours (22 files, including feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073's tests and the Codex echo, steer, options, adapter and late-settlement tests): 323 tests pass. The phone's 3 files: 13 pass.
• Before that, after the send-order helper replaced the non-null assertions: the placement, turn membership, desktop render, rejected-in-place and both end-to-end files (7 files, 108 tests), and the phone's 3 files (13 tests), pass.
• At ac6d23a3a03, the cross-version wire suite, run serially: 15 of 19 files pass, including feat(native-chat): publish where each submission was sent and the turn a stopped one was answered into #25073's downgrade test. The other 4 cannot load locally: this worktree's installed packages predate main's new stream-json version, and they fail on that import before running a test. CI runs them, and they pass there.
• At ac6d23a3a03, tc:node and tc:web reported only that same missing stream-json module, in main's files. Mobile tsc and the mobile tests typecheck ratchet pass.
• oxlint and the changed-code quality gate pass.

On a phone (Android emulator, with temporary diagnostic logging):

• After a message the agent never started and a Stop from the desktop, the phone showed "Stopped before the agent started" under the message within about 6 seconds of the Stop. This held on a fresh chat and on a long chat with a message sent while stopping just before.
• An earlier phone run once showed that row only after the next message was sent. The two runs with logging did not reproduce it, and its cause is not known.
• The one live failure seen in these runs was the connection itself: under very heavy machine load, the desktop dropped the phone's connection and the phone did not reconnect. That earlier run's logs show no reconnect, so this does not explain it. It is tracked in STA-9496 (https://linear.app/stably/issue/STA-9496).

Projection cost. The message projection runs on every streaming update, on desktop and on the phone, so the Stop placement must cost nothing in a chat without a stopped message and grow only with what is loaded. A chat with no stopped message skips placement entirely, and the turn-claim index is built only when a taken-back message exists. Otherwise the turn anchors, the row lookup and (on an older host only) the earlier-send floor are built once per update, and each stopped message is placed with a binary search over the turns' furthest rows, not a rescan of every row. The earlier benchmark was run on the previous placement and has not been re-run on this one.

Review

Agent skill upstream boundary

• Not applicable, or this change follows docs/reference/agent-skill-sharing-upstream-boundary.md and copies or mechanically translates no upstream skill-installer source, tests, fixtures, registry entries, path tables, comments, or documentation.

Notes

• SSH/remote: the execution host computes the published position and records the turn from its own journal; clients only draw them. Nothing about where work runs changes.
• Mobile: the phone gets the same projection and draws the row.
• Cross-platform: no platform-dependent code.
• Backwards compatibility: see Mixed versions above.

Checklist

• This PR is small and focused
• I explained what changed and why (ELI5, the user-facing before/after, the mechanism, and why over the alternatives)
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (or CI will cover; local preferred)

[brennanb2025]

Review status: draft, base main, head cc6d838

The problem. If you pressed Stop before the agent started on your message, the message vanished from the chat and its text reappeared in your typing box. Other devices just lost it, and a "Cancellation requested." line could land under the previous, finished turn.

What changes for you.

• A message a Stop takes back before the agent starts it stays in the chat where you sent it, with one line: "Stopped before the agent started". Your typing box is left alone, and every device shows the same thing.
• Nothing you sent is lost. Text the host never received still shows as "Message was not sent." with Retry.
• Several taken-back messages keep the order you sent them in.

The stack: #24864, #24369 ("Stopping…") and #25073 (the host publishes where each message was sent and answered) are on main. This PR is now based on main, and its diff is only its own change (45 files).

Verified.

• CI at cc6d838: 16 pass, 16 skipped, 0 fail. One earlier run lost its package job to GitHub's setup-node action crashing before any code ran ("Unexpected end of JSON input"); the re-run passed.
• Merging main, including feat(native-chat): the chat reads "Stopping…" from your Stop until the turn actually ends #24369 and fix(native-chat): keep a message accepted before a quit or crash as a held card #24660: fix(native-chat): keep a message accepted before a quit or crash as a held card #24660 (a message kept as a held card after a quit or crash) changed the same projection and phone-send code.
  • Its "kept as a card" rule runs first, so a card always owns its text. This PR's "taken back by a Stop" rule follows.
  • This PR's own lines are unchanged by the merge.
  • Three tests changed mechanically for main's API.
• A review of the merge found one real bug, fixed at cc6d838. The merge left the Spanish translation file with two "notices" sections, and the later one won, so Spanish lost "Stopped before the agent started". The line now sits in the one section, as in English; no language file has a duplicate key, and all six carry the line.
  • Also fixed: a phone test meant to compare "Stopping…" between two ways of loading the chat read the wrong field, so it compared nothing. It now sees "Stopping…" during the Stop.
  • And one stale comment that said a taken-back message goes back to the typing box.
• Tests: at cc6d838, the changed phone test, the outbox test and 4 language-file tests pass, and phone tsc and the phone tests-typecheck ratchet pass. The full set (10 desktop files, 7 phone files) was not re-run at this head; it last passed at a200a85, and the changes since are a language-file move, one comment and one test. tc:web, tc:node, phone tsc and the phone tests-typecheck ratchet pass, and oxlint is clean on every changed file.
• Live desktop QA, on a separate Mac with a stand-in Codex, at 9f3cd5e (round 16, screenshots in the PR body). Cases 1 to 5 passed. In case 6, the first chat read empty for about 6 s after it was activated. That was filed separately as STA-9571 (low), and this PR's rows are drawn once the read fills. Since then only merges have touched this branch; this PR's own lines are unchanged.

Not verified.

• Live QA on this head. The changes since round 16 are merges, covered by the tests above.
• The phone, live. Earlier Android rounds are advisory until Brennan confirms them himself; one phone check (a steered message's stop row) was inconclusive. Phone behaviour is covered by unit tests.
• A real Claude or Codex agent, and SSH hosts. Covered by tests, not run live.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: acea8f4d-0d34-4090-ad50-28968b548e6b

📥 Commits

Reviewing files that changed from the base of the PR and between a200a85 and cc6d838.

📒 Files selected for processing (3)

• mobile/src/session/mobile-native-chat-merged-snapshot-parity-hooks.test.tsx
• src/renderer/src/i18n/locales/es.json
• src/shared/structured-agent-session-outbox-reconcile.ts

🚧 Files skipped from review as they are similar to previous changes (1)

• src/renderer/src/i18n/locales/es.json

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 4 remain after this review.

---

📝 Walkthrough

Walkthrough

The change adds transcript projection and placement for sends withdrawn before the agent starts. It updates mobile send delivery and composer restoration behavior. Chat rendering displays a localized stopped-before-start notice and excludes those messages from rail ticks. New tests cover turn placement, outbox behavior, host journal frames, and parity between incremental mobile updates and fresh snapshots.

Priority: ➖ Normal

Merge Risk: ⚪ Minimal · up to cc6d8

Withdrawn messages can remain visible with localized stop text. No actionable merge-blocking risk is evident; merge after normal checks.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 45.78% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 83 functions across 39 files. (1 skipped:…	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: Stop-withdrawn messages remain visible with one stop row after them.
Description check	✅ Passed	The description covers the change, rationale, linked issue, visual proof, testing, compatibility, and notes. It reports validation gaps, leaves the Review section blank, and does not check the full li…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Docstring Coverage

Explanation

Docstring coverage is 45.78% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 83 functions across 39 files. (1 skipped: 1 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Commit to this branch
• Create a new PR

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2868e28d-d9f9-4295-8a16-602d3585c45c

📥 Commits

Reviewing files that changed from the base of the PR and between 4c35516 and a200a85.

📒 Files selected for processing (45)

• mobile/src/session/mobile-native-chat-host-journal-frames.test-fixture.ts
• mobile/src/session/mobile-native-chat-merged-snapshot-parity-hooks.test.tsx
• mobile/src/session/mobile-native-chat-merged-snapshot-parity.test.ts
• mobile/src/session/mobile-native-chat-stop-journal.test-fixture.ts
• mobile/src/session/mobile-native-chat-stopped-before-start.test.tsx
• mobile/src/session/mobile-structured-agent-session-send-bypass.test.ts
• mobile/src/session/mobile-structured-agent-session-send.ts
• mobile/src/session/mobile-structured-send-delivery.test.ts
• mobile/src/session/mobile-structured-send-delivery.ts
• mobile/src/session/use-mobile-native-chat-drafts-glued-pending.test.ts
• mobile/src/session/use-mobile-structured-agent-session-send.test.tsx
• mobile/tsconfig.json
• src/main/native-chat/agent-session-wire/structured-agent-session-stop-note-withdrawn-send.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-turns-cancel.ts
• src/main/runtime/structured-agent-session-codex-stopped-send-order.test.ts
• src/renderer/src/components/native-chat/NativeChatMessageList.stopped-before-start.test.tsx
• src/renderer/src/components/native-chat/NativeChatMessageRow.tsx
• src/renderer/src/components/native-chat/native-chat-message-rail-items.ts
• src/renderer/src/components/native-chat/native-chat-rail-outline-parity.test.ts
• src/renderer/src/components/native-chat/native-chat-stopped-before-start-row.ts
• src/renderer/src/components/native-chat/native-chat-transcript-slots.ts
• src/renderer/src/components/native-chat/structured-agent-session-message-projection.rejected-in-place.test.ts
• src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.test.tsx
• src/renderer/src/components/native-chat/structured-agent-session-withdrawn-message-restore.ts
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox-ownership.ts
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox-withdrawal.test.tsx
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox.draft-hand-off.test.tsx
• src/renderer/src/components/native-chat/use-structured-agent-session-outbox.ts
• src/renderer/src/components/native-chat/use-structured-agent-session-stop.ts
• src/renderer/src/i18n/locales/en.json
• src/renderer/src/i18n/locales/es.json
• src/renderer/src/i18n/locales/fr.json
• src/renderer/src/i18n/locales/ja.json
• src/renderer/src/i18n/locales/ko.json
• src/renderer/src/i18n/locales/zh.json
• src/shared/agent-session-conversation-outline.ts
• src/shared/native-chat-send-order.ts
• src/shared/native-chat-stopped-before-start.ts
• src/shared/native-chat-stopped-send-turn.test.ts
• src/shared/native-chat-turn-membership.ts
• src/shared/native-chat-types.ts
• src/shared/structured-agent-session-dispatch-rejection.ts
• src/shared/structured-agent-session-message-projection-stopped-before-start.test.ts
• src/shared/structured-agent-session-message-projection.ts
• src/shared/structured-agent-session-outbox-stop-withdrawal.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.