Require owned provider spawn and one host-awaited open

config/reliability-gates.jsonc

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-09-11",
+  "updatedAt": "2026-10-13",
   "policy": {
     "maturityLevels": ["experimental", "soak", "blocking", "accepted-gap", "deprecated"],
     "blockingPromotion": {
@@ -1478,14 +1478,14 @@
       "invariant": "One structured-send operation id causes at most one provider dispatch. Each user Send on phone or desktop is a new action with a fresh id and one request; neither automatically resends an ambiguous action. The host retains the original action's outcome, and a later phone Send remains possible with equal text, after remount, or when phone storage fails. Repeated transmission of the same operation remains protected by host deduplication.",
       "oracle": "Inject adapter/RPC acknowledgement loss, caller replacement, logical-client close after response, auth recovery with a written request, missing host submissions, legacy pending rows, stale fences, expiry, mobile remount, and phone storage refusal. Assert at most one dispatch for repeated transmission of one operation. For a later phone Send, assert a fresh id and second delivery while the original host entry remains unknown; equal images use current uploaded paths and delivery fields follow current host capabilities.",
       "commands": [
-        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
         "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir mobile test ../mobile/src/session/mobile-structured-send-new-action.test.ts ../mobile/src/session/use-mobile-structured-agent-session-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-queued.test.tsx ../mobile/src/session/mobile-structured-send-delivery.test.ts ../mobile/src/session/use-mobile-structured-agent-session-background-tasks.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-newer-approval-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-read-failure.test.tsx ../mobile/src/session/use-mobile-structured-agent-session.test.tsx ../mobile/src/session/use-mobile-structured-agent-session-prompt-cancel.test.tsx ../mobile/src/session/mobile-native-chat-image-attachment.test.ts ../mobile/src/session/use-mobile-native-chat-image-attachments.test.ts ../mobile/src/session/use-mobile-structured-native-chat-send-bridge.test.ts ../mobile/src/mobile-web-shell/page-storage-keys.test.ts ../mobile/src/mobile-web-shell/bridge/page-async-storage.test.ts ../mobile/src/mobile-web-shell/use-page-host-snapshot.test.tsx ../mobile/src/mobile-web-shell/bridge-host-init.test.ts ../mobile/src/transport/mobile-relay-rpc-session.test.ts ../mobile/src/transport/rpc-client-delivery-ambiguity.test.ts ../mobile/src/transport/stable-logical-rpc-client.test.ts --maxWorkers=2"
       ],
       "testFiles": [
         "src/shared/agent-session-operation-ledger.test.ts",
         "src/shared/structured-agent-session-send-evidence.test.ts",
         "src/main/runtime/agent-session-operation-admission.test.ts",
-        "src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts",
+        "src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts",
         "src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts",
         "src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts",
         "src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts",
@@ -1582,13 +1582,13 @@
           "summary": "Nineteen focused mobile files passed 241 tests for fresh Send identity, remount, attachment paths, storage refusal, mixed host capabilities, queued cards, and written-request ambiguity."
         },
         {
-          "date": "2026-10-06",
+          "date": "2026-10-13",
           "runner": "local",
           "platform": "macos",
-          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send-idempotency.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
           "result": "passed",
-          "durationSeconds": 14,
-          "summary": "Eleven focused host, shared, renderer, and orchestration files passed 173 tests after the desktop outbox gave way to the in-memory sender, which makes one request per send and never resends."
+          "durationSeconds": 6.47,
+          "summary": "Eleven focused host, shared, renderer and orchestration files passed 196 tests, including unknown send outcomes, reused message IDs and host replay without duplicate dispatch. The retained send-idempotency suite replaces the removed branch-by-branch refusal matrix."
         }
       ],
       "runtimeBudget": {

config/scripts/vitest-sqlite-runtime-files.mjs

@@ -179,8 +179,6 @@ export const SQLITE_RUNTIME_INCLUDE = [
   'src/main/native-chat/agent-session-wire/structured-agent-session-start-failure-writer.test.ts',
   'src/main/native-chat/agent-session-wire/structured-agent-session-startup-attempt-host.test.ts',
   'src/main/native-chat/agent-session-wire/structured-agent-session-startup-attempt-registrations.test.ts',
-  'src/main/native-chat/agent-session-wire/structured-agent-session-startup-picks.test.ts',
-  'src/main/native-chat/agent-session-wire/structured-agent-session-startup-permission-mode.test.ts',
   'src/main/native-chat/agent-session-wire/structured-agent-session-startup-reconcile-failure.test.ts',
   'src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child-work.test.ts',
   'src/main/native-chat/agent-session-wire/structured-agent-session-status-feed-child.test.ts',

src/main/acp/acp-structured-acquire.ts

@@ -39,7 +39,7 @@ export async function acquireAcpStructuredSession(input: {
   acquire: StructuredAgentSessionAcquireInput
   deps: AcpStructuredSessionAdapterDeps
   generation: string
-  /** The acquire was aborted; checked until the spawn, after which `track` hands it the connection. */
+  /** The spawn was aborted; checked until the spawn, after which `track` hands it the connection. */
   abandoned: () => boolean
   /** Registers the connection so a close during the acquire can stop it. */
   track: (connection: AcpStructuredConnection) => void
@@ -269,7 +269,7 @@ export async function acquireAcpStructuredSession(input: {
   session = child
   assertAcpStartingSession(child, input.abandoned)
   return {
-    acquisition: { process, acquisitionGeneration: generation, providerChildPhase: 'starting' },
+    acquisition: { process, acquisitionGeneration: generation },
     session: child
   }
 }

src/main/acp/acp-structured-adapter.test-support.ts

@@ -6,10 +6,8 @@ export { FakeAcpChild, PID } from './acp-scripted-connection.test-fixture'
 import { vi } from 'vitest'
 import { z } from 'zod'
 import type { AgentJournalMessageItem } from '../../shared/agent-session-journal-types'
-import type {
-  StructuredAgentSessionLifecycleEvent,
-  StructuredAgentSessionStartedEvent
-} from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionLifecycleEvent } from '../native-chat/agent-session-wire/structured-agent-session-adapter'
+import type { StructuredAgentSessionProviderOpenResult } from '../native-chat/agent-session-wire/structured-agent-session-provider-open-contract'
 import {
   openProviderTimelineRig,
   SESSION,
@@ -56,7 +54,7 @@ export type AcpAdapterRig = {
   spawned: string[]
   lifecycle: StructuredAgentSessionLifecycleEvent[]
   readonly ended: Extract<StructuredAgentSessionLifecycleEvent, { type: 'ended' }>[]
-  started(): StructuredAgentSessionStartedEvent
+  started(): StructuredAgentSessionProviderOpenResult
   openFailure(): unknown
   settled: Parameters<NonNullable<AcpStructuredSessionAdapterDeps['onDispatchSettledLate']>>[0][]
   acquire(options?: {
@@ -89,6 +87,7 @@ export async function openAcpAdapterRig(
   const lifecycle: StructuredAgentSessionLifecycleEvent[] = []
   const settled: AcpAdapterRig['settled'] = []
   let openFailure: unknown
+  let opened: StructuredAgentSessionProviderOpenResult | null = null
   const startListeners = new Set<() => void>()
   const spec = options.spec ?? GROK
   const resolveLaunch: AcpStructuredSessionAdapterDeps['resolveLaunch'] =
@@ -173,16 +172,16 @@ export async function openAcpAdapterRig(
       return lifecycle.filter((event) => event.type === 'ended')
     },
     started: () => {
-      const event = lifecycle.findLast((entry) => entry.type === 'started')
-      if (event?.type !== 'started') {
+      if (!opened) {
         throw new Error('ACP session has not started')
       }
-      return event
+      return opened
     },
     openFailure: () => openFailure,
     settled,
     acquire: async (acquireOptions = {}) => {
       openFailure = undefined
+      opened = null
       const acquisition = await adapter.acquire({
         identity: {
           sessionId: SESSION,
@@ -203,19 +202,12 @@ export async function openAcpAdapterRig(
       })
       if (acquireOptions.waitForStart !== false) {
         try {
-          const opened = await adapter.open({
+          opened = await adapter.open({
             sessionId: SESSION,
             fence: acquireOptions.fence ?? 1,
-            acquisitionGeneration: acquisition.acquisitionGeneration ?? null,
+            acquisitionGeneration: acquisition.acquisitionGeneration,
             signal: acquireOptions.signal ?? new AbortController().signal
           })
-          lifecycle.push({
-            ...opened,
-            type: 'started',
-            sessionId: SESSION,
-            fence: acquireOptions.fence ?? 1,
-            acquisitionGeneration: acquisition.acquisitionGeneration ?? ''
-          })
         } catch (error) {
           openFailure = error
           await adapter.closeSession(SESSION)

src/main/acp/acp-structured-missing-model.test.ts

@@ -2,7 +2,6 @@ import { readFileSync } from 'node:fs'
 import { describe, expect, it } from 'vitest'
 import { isPersistedAgentSessionRecord } from '../../shared/agent-session-record'
 import { agentSessionRecordFixture } from '../../shared/agent-session-record.test-fixture'
-import { nativeSessionOptionsFromReport } from '../native-chat/agent-session-wire/structured-agent-session-option-restoration'
 import { replaceAgentSessionRecordOptions } from '../runtime/agent-session-record-options'
 import { agentSessionStoreDraftRowWrites } from '../runtime/agent-session-store-draft'
 import type { AgentSessionStoreState } from '../runtime/agent-session-store-state'
@@ -45,10 +44,7 @@ function writtenOptions(provider: string, reader: AcpStructuredOptions) {
     unreadableRecords: new Map(),
     sessionTabs: null
   }
-  // What the host writes from the report a started child sends.
-  const options = nativeSessionOptionsFromReport({
-    reported: reader.read().current
-  })
+  const options = reader.reported()
   const changed = replaceAgentSessionRecordOptions(record, {
     sessionId: record.sessionId,
     fence: record.lease.runtimeFence,
@@ -67,7 +63,7 @@ function writtenOptions(provider: string, reader: AcpStructuredOptions) {
 }
 
 describe('ACP sessions without a reported model', () => {
-  it('writes the captured Windows OMP startup through the live reader and shared normalizer', async () => {
+  it('writes the captured Windows OMP startup through the provider reader', async () => {
     const reader = new AcpStructuredOptions()
     reader.adoptSession(response)
     expect(reader.read()).toEqual({

src/main/acp/acp-structured-publish-at-spawn.test.ts

@@ -85,7 +85,7 @@ describe('ACP child published before its handshake', () => {
         .open({
           sessionId: SESSION,
           fence: 1,
-          acquisitionGeneration: acquired.acquisitionGeneration ?? null,
+          acquisitionGeneration: acquired.acquisitionGeneration,
           signal: new AbortController().signal
         })
         .catch((error: unknown) => error)
@@ -146,7 +146,7 @@ describe('ACP child published before its handshake', () => {
       rig.adapter.open({
         sessionId: SESSION,
         fence: 1,
-        acquisitionGeneration: acquired.acquisitionGeneration ?? null,
+        acquisitionGeneration: acquired.acquisitionGeneration,
         signal: new AbortController().signal
       })
     ).rejects.toMatchObject({ reason: 'notSignedIn' })

src/main/acp/acp-structured-session-adapter-lifecycle.test.ts

@@ -339,7 +339,7 @@ describe('ACP startup that never answers', () => {
       .open({
         sessionId: SESSION,
         fence: 1,
-        acquisitionGeneration: acquired.acquisitionGeneration ?? null,
+        acquisitionGeneration: acquired.acquisitionGeneration,
         signal: new AbortController().signal
       })
       .catch((error: unknown) => error)
@@ -348,7 +348,6 @@ describe('ACP startup that never answers', () => {
     expect(await opening).toBeInstanceOf(Error)
     expect(rig.child().exited).toBe(true)
     expect(rig.ended).toMatchObject([{ cause: 'requested-close' }])
-    expect(rig.lifecycle.some((event) => event.type === 'started')).toBe(false)
   })
 
   it('leaves a published child alone when the acquisition signal aborts later', async () => {
@@ -368,7 +367,7 @@ describe('ACP startup that never answers', () => {
       .open({
         sessionId: SESSION,
         fence: 1,
-        acquisitionGeneration: acquired.acquisitionGeneration ?? null,
+        acquisitionGeneration: acquired.acquisitionGeneration,
         signal: new AbortController().signal
       })
       .catch((error: unknown) => error)
@@ -392,7 +391,7 @@ describe('ACP startup that never answers', () => {
       .open({
         sessionId: SESSION,
         fence: 1,
-        acquisitionGeneration: acquired.acquisitionGeneration ?? null,
+        acquisitionGeneration: acquired.acquisitionGeneration,
         signal: new AbortController().signal
       })
       .catch((error: unknown) => error)

src/main/claude/claude-api-retry-idle-sweep.test.ts

@@ -58,6 +58,9 @@ beforeEach(async () => {
   closeSession = vi.fn(async () => true)
   const store = await openTestAgentSessionRecordStore(root)
   const adapter: StructuredAgentSessionAdapter = {
+    open: async () => ({
+      reportedOptions: { model: '' }
+    }),
     acquire: async ({ fence, spawnToken, events }) => {
       sink = events ?? null
       return {

src/main/claude/claude-structured-effort-default-at-rest.test.ts

@@ -17,7 +17,6 @@ import type { StructuredAgentSessionMutationContext } from '../native-chat/agent
 import { readStructuredAgentSessionOptions } from '../native-chat/agent-session-wire/structured-agent-session-options-read'
 import { claudeAndCodexAgents } from '../native-chat/agent-session-wire/structured-agent-session-adapter-router-test-support'
 import { composeCodexSessionOptionCatalog } from '../codex/codex-structured-model-catalog'
-import { nativeSessionOptionsFromReport } from '../native-chat/agent-session-wire/structured-agent-session-option-restoration'
 import {
   ClaudeStructuredSessionAdapter,
   type ClaudeStructuredSessionEvent
@@ -401,8 +400,7 @@ describe('Claude effort default at rest', () => {
 
     const reported = (await claudeOpened(adapter, SESSION)).reportedOptions
     expect(reported).not.toHaveProperty('effort')
-    // The record the start persists names the listed row the catalog learned under.
-    const record = restingRecord(nativeSessionOptionsFromReport({ reported: reported }))
+    const record = restingRecord({ model: 'opus[1m]' })
     expect(record.options).toEqual({ model: 'opus[1m]' })
     expect((await readAtRest(store, record)).current.effort).toBe('medium')
     expect(record.options).toEqual({ model: 'opus[1m]' })

src/main/claude/claude-structured-session-acquisition.ts

@@ -266,7 +266,7 @@ export async function acquireClaudeSession({
       )
     }
     // The host calls open after publication and holds input until it settles.
-    return { ...publication.acquisition, providerChildPhase: 'starting' }
+    return publication.acquisition
   } catch (error) {
     unbindReadingControl?.()
     const acquisitionError = await resolveClaudeAcquisitionError({

src/main/claude/claude-structured-session-startup.test.ts

@@ -23,7 +23,7 @@ describe('Claude host-awaited open', () => {
     const claude = fakeClaude({ initDelayMs: 12_000 })
     const { adapter, events } = adapterFor(claude)
     const acquisition = await adapter.acquire(ACQUIRE)
-    expect(acquisition).toMatchObject({ providerChildPhase: 'starting', process: { pid: 4321 } })
+    expect(acquisition).toMatchObject({ process: { pid: 4321 } })
     expect(acquisition.link).toBeUndefined()
     expect(claude.connections[0].calls).toEqual([])
     expect(events.some((event) => event.type === 'options')).toBe(false)
@@ -129,7 +129,7 @@ describe('Claude host-awaited open', () => {
     const open = adapter.open({
       sessionId: 'session-1',
       fence: 7,
-      acquisitionGeneration: acquisition.acquisitionGeneration ?? null,
+      acquisitionGeneration: acquisition.acquisitionGeneration,
       signal: controller.signal
     })
     controller.abort(new Error('host start expired'))

src/main/claude/claude-structured-session-state.ts

@@ -170,7 +170,7 @@ export type ClaudeSession = {
   confirmedOptions: Set<string>
   /** The model the child was launched with, as `--model`; null when it runs the CLI's own. */
   launchedModel: string | null
-  /** The launch left the saved Fast out, so the start applies it once the settings are read. */
+  /** Fast was omitted from launch settings and needs confirmation at message input. */
   fastModeAtStart: boolean
   /** CLI-advertised protocol capabilities from init; gates interrupt-receipt handling. */
   capabilities: readonly string[]