[brennanb2025]

	Files	Added	Deleted	Net
Test	43	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​927	$\color{#cf222e}{\Huge{\mathbf{−}}}$​1896	$\color{#cf222e}{\Huge{\mathbf{−}}}$​969
Prod	53	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​1396	$\color{#cf222e}{\Huge{\mathbf{−}}}$​1462	$\color{#cf222e}{\Huge{\mathbf{−}}}$​66

ELI5

You can queue messages behind a running chat turn. Two things went wrong with them. First, if the agent refused a queued message, it was supposed to come back as a card that holds the queue until you press its own Send or Delete; but when a bookkeeping save failed, the card silently vanished and the next message went out. Second, if you pressed Stop (or Orca restarted) after a queued message had already been handed to the agent, Orca put it back in the queue and sent it again later, even though the agent may already have had it. The only guard against that double send was matching the agent's echo of the text, and that guard kept producing new bugs. Now each queued message lives in the chat's own saved record, and a message that may have reached the agent stays in the conversation instead of going back to the queue.

What Changed

The problem.

• Queued cards lived in their own database table, and a refusal had to update that table in a separate save. When that save failed (and its repair also failed), the queue thought the refused message had gone out: it sent the next card, and the refused card disappeared.
• After a Stop or a restart, a queued or steered message that Orca had already handed to the agent went back to the queue whenever the agent's answer carried no failure, and Resume or your next send sent it again. Whether it went back was decided by the kind of rejection, not by proof the agent never got it. A Codex interrupt, for example, reports every message it never echoed as cancelled, even one that reached the model.
• The only correction was to look for a later echo from the agent with the same text and withdraw the card. Nothing ties an echo to one particular send, so this produced bugs in both directions during review: one echo withdrew too few cards (a double send) or too many (a lost card). The same double send is tracked in STA-11036.

What you see now.

• Press Stop after a queued or steered message was handed to the agent and before the agent confirmed it: the message stays in the conversation as the interrupted turn's message. If no turn had opened yet, it reads "Stopped manually", the same as a message you sent directly and stopped. It is never put back in the queue or sent again automatically. The cards behind it stay queued, and Resume sends them.
• A message Orca can prove never reached the agent waits in the queue again, as before: one Orca was still holding, one stopped before or while the agent was still preparing it (for example Claude applying the message's model choice, or Codex still opening the previous turn), or one Claude reports it removed without running it.
• A refused message still comes back as a blocking card that needs its own Send or Delete. Resume can't release it. That now holds after a failed save, a rewind, a replacement of the chat's history, and a restart.
• Normal queue flows (queue, edit, delete, steer, send in order, refused card Send or Delete) look and behave the same as before.

The mechanism.

• Every queued message is part of the chat's journal, the record the conversation itself is saved in. A new queue entry kind records queue, edit, move, hold and withdraw, and each action writes its entries in one transaction. Handing a card to the agent is the send entry that already names the card. A refusal writes only the rejection the delivery path already writes; the returned card and its hold on the queue are worked out from it when the journal is read. The old queue table, its settlement writer, its repair and the derived-card view are deleted.
• One rule decides what a stopped hand-off becomes (queuedHandOffOutcome). A failure brings the card back as a blocking card. Proof the agent never got it puts the card back to waiting. Proof means the host still held it, or whoever settled it recorded that it never reached the agent (Claude's report that it removed a queued message unrun now records this). Anything else is in doubt: the card stays spent and its message shows as unconfirmed, using the existing "couldn't confirm" state that every client already draws. This is worked out each time the journal is read, from the stored rejection, so nothing new is saved.
• The echo text matching and all its bookkeeping are deleted. The restart check against the agent's history no longer decides that a queued hand-off was not sent, and reopening a chat no longer holds the queue for a message that can't come back.

Existing queued cards (moving from the old table).

• Cards saved by an earlier build move into the journal once, when the chat opens, in one transaction. Running it twice does nothing. Until a card is moved it still shows and every action works on it: the action moves that one card in its own transaction, and a rewind moves every remaining card first. If the move fails, a message that may already have reached the agent remains visible in the conversation and is never sent again automatically.
• An earlier build put a card back to waiting after a Stop and cleared its link, so the card's own hand-offs in the journal decide on upgrade:
  • Unchanged, and its latest hand-off may have reached the agent: it becomes a message in the conversation (the interrupted turn's message, or "Stopped manually") and is not sent again.
  • Edited since, or sent again since: it is held as a "Paused" card that needs its own Send or Delete. The queue sends the cards behind it.
  • No hand-off on record, or only ones that provably never left Orca: an ordinary waiting card, as before.
• Claude cards already sitting in a paused queue at upgrade become messages and aren't resent, because the earlier build didn't record Claude's report that it removed them unrun. The same Stop after the upgrade does put them back to waiting.
• A card an earlier build put back to waiting after a restart, because the agent's history lacked its text, is also spent on upgrade: that check was a guess from absence too.
• Refused, sent and deleted cards move as before. A card whose outcome can't be read is kept hidden and never resent.

Compatibility. No new saved field and no wire change. The upgrade's held card uses one new host-only value of the existing hold reason, published as a plain hold. The host now publishes an existing state ("couldn't confirm", or a stopped direct send) where it used to publish a returned card, and desktop, phone and older clients already draw both. Everything runs on the host that owns the chat, including over SSH.

STA-11036 (a delivered queued message sent twice). After this PR it can't happen: nothing puts a message that may have reached the agent back in the queue, so there is nothing to send twice and no echo to match. No separate card write exists any more either, so a failed save can't lose the outcome.

Fixed in review.

• One update confirming two queued messages withdrew only the first, so the second was sent again.
• A card from an earlier build whose hand-off was still unconfirmed was dropped by the move, so a later refusal could not bring it back.
• A rewind after a failed move lost an earlier build's refused card, and the card behind it was sent.
• One echo from the agent withdrew every queued card with the same text, so an identical message queued later was lost; it then withdrew only one card.
• The echo matching that the first and last of these fixes changed is now deleted, along with the two remaining identical-text cases it still had.

Why

Both bugs came from the queue deciding something it couldn't know from what it stored.

• The refused card vanished because the queue kept a second saved copy of a fact the chat already holds. Keeping the card in the chat's own record removes that whole class of bug instead of guarding the copy. The common pattern also keeps each queued message as one record with its attempts, changed in the same transaction as the action.
• The double send happened because a message that may have reached the agent was put back in the queue, then "corrected" by text matching. The common pattern never returns a handed-over message to the queue: its outcome stays on that attempt, and resending is never automatic. Orca's delivery rule is the same: Orca never decides a message was not sent because something is missing, and never resends a message it can't confirm.

Differences from the common pattern and from the plan:

• Stopped message after a failed upgrade import. Temporary: an already-open chat that reconnects or pages older history after a failed upgrade import shows the stopped message only after reopen; tracked in STA-11608. The follow-up fixes history publication and preserves older clients’ approval controls.
• The refused card's hold is worked out from the refusal, not saved as a flag. Intended: a stored flag is a second write that can fail on its own, and nothing rebuilds it.
• Resume does not release a refused card. Intended: Orca's product rule is that only the card's own Send or Delete releases it. The common pattern's Resume clears the hold, and it leaves a failed message in the transcript instead of returning a card.
• The unconfirmed message has no resend action yet. Temporary: Stage B, tracked in STA-11448, adds Send, Edit and Delete on such a message. Until then a steered message that Codex most likely dropped on interrupt reads as sent, and you send it again yourself if you need to.
• The "unconfirmed" outcome is worked out from the stored rejection each time the journal is read, not saved as its own entry. Intended: one derivation covers live chats, reopened chats and upgraded chats, with no rewrite of saved data.
• Claude's "removed unrun" report counts as proof only for queued messages. Intended: on a direct send the same flag would change what Stop does to it, which is outside this PR.
• After a crash while a queued message was being handed over, the message stays as an unconfirmed message and is never resent; a direct send in the same case still goes through the history check and can read "not sent" with Retry. Temporary until Native chat: a message is never marked not delivered after a crash, and reopening a chat stops reading the transcript #30580, which removes that history check for direct sends too, so both behave the same.
• If a Stop closes Claude while a queued message is still waiting behind another one inside Orca's own hand-off queue to Claude, that card comes back as a blocking "couldn't hand to Claude" card (press its Send) instead of quietly waiting again. Temporary: tracked in STA-11660. The follow-up treats that unwritten failure during a Stop the same as the Stop itself.
• In an OpenCode chat, a queued message left unconfirmed (a crash mid hand-over, or the agent exiting before it answers) makes each later reopen of that chat read OpenCode's own history again, up to 5 seconds, until /clear. Temporary until Native chat: a message is never marked not delivered after a crash, and reopening a chat stops reading the transcript #30580, which removes the history check that would otherwise settle it. Nothing is lost or resent.
• An earlier build's card that was edited or sent again after a Stop is held with the plain "Paused" caption, and the cards behind it send first. Intended: the held card might already have reached the agent, so only its own Send may send it; this is how an existing held card already behaves, and reusing the plain hold needs no new UI or client change.
• An earlier build's card whose echo already arrived before the upgrade can show as two messages. Intended: rare, limited to cards saved by an earlier build, and it is never sent again; telling them apart would bring back the text matching this PR deletes.
• In one chat, a queued message stopped this way gets a tick on the message rail, while a direct send stopped the same way does not. Temporary (cosmetic): Stage B, tracked in STA-11448, adds the same recovery card for both kinds.
• Unresolved cards are written again when the chat's history is replaced or rolled over. Intended: Orca deletes the journal epoch in those cases, so unresolved queue facts must move with it. The new copy, including a returned card's refusal, is written in the same transaction that deletes the original, so only one copy exists at a time.
• Cards saved by an earlier build are still read from the old table until they are moved, and each action moves its own card. Intended: the plan allowed the old reader only for the one-time move. Keeping it means that if the move fails, the cards stay visible and usable and a refused card still holds the queue.
• Deleted cards are no longer remembered for a short window after the move or after the chat's history is replaced. Intended: only a retried request (after a lost acknowledgement) for a card deleted before that point is affected; it is now told the message is missing or may already be in the chat, instead of "withdrawn". Current clients send each request once.
• A moved /compact card that came back refused, but whose command already ran, now reads as done and disappears after the upgrade. Intended: the command did run; main kept showing the card.
• Rolling the chat's history over keeps a card that was never handed over waiting. Intended: it never went out, and nothing in the shipped app rolls history over today.
• Queue entries are saved in record format 4, so an older build opens such a chat read-only, including an older server sharing the same SSH host. Intended: users don't downgrade Orca, and the earlier format-3 change works the same way.

Not changed here: Claude can still refuse an omitted effort after an earlier override (STA-11572), or Fast when the agent reports a disabling reason other than a user preference or required opt-in. The incoming model-choice change removed the earlier missing-positive catalog Fast check; its old STA-11451 trace no longer applies to this head. The remaining checks are inherited from main and owned by the separate Claude model-switch work. This review does not claim they are aligned or waived.

Not changed here: A later send carries a stopped request’s text, and the agent may answer that earlier request. Real QA reproduced the same behavior on main using the same saved chat; this PR does not change it.

Linked Issue

Part of the native-chat send lifecycle work. Not a GitHub issue. Tracked in STA-11036 (a delivered queued message sent twice); see the STA-11036 paragraph above.

Visual Proof

The current head is ef47118d3bc3693423ab185726da758a0a350d6d, after the latest main merge. All 44 CI checks finished (27 successful, 17 skipped); the bounded source review found no new proven merge regression, and four named lifecycle files passed all 25 tests. Exact-head real-agent QA passed Claude ordinary queue/drain, Stop with actual Resume and normal close/reopen, plus Codex Stop with actual Resume and normal close/reopen. The owner's final M4Air takeover also passed Codex ordinary queue/drain, image A removal and B replacement with edited text, and three cards waiting together then draining naturally in order. Codex's own saved record confirms the edited text and byte-identical B, no A or original text, and one reply each: “Blue, with a white letter B.”, “Q2-OK”, “Q3-OK”. The app was stopped by its recorded PID, admission1488 is done, and the owner's real-config hashes match. Current-head screenshots and the full results are in the single review status comment.

Earlier failed driver/setup attempts are preserved separately and never counted as passes: ticket1381 ordinary-Codex method, ticket1439 unavailable attachment method, ticket1475 preparation parse error, and the loop's initial ticket1488 dev app exit. The owner traced that exit to the dev parent watchdog and corrected the rig for the successful takeover. Stale Settings copy about immediate image sends predates this PR and is owned by the B1 recovery follow-up; no current-head copy fix is claimed.

The upgrade and phone evidence below belongs to the earlier 293bb8254496 head. Those unchanged flows were excluded from the latest bounded rerun by the lane owner; the screenshots retain their original head labels. Grok remains covered by tests only under Brennan’s usage waiver. The queue is feature gated in shipped builds; the app tests use only the approved test capability advertisement and read-only store exposure.

Earlier completed review and QA (293bb8254496)

CI was green on earlier head 293bb82544967f097081040cb21d7d55ce17636c, including the WSL retry; GitHub reports no merge conflicts. Main is merged, 19 targeted files passed (347 tests), and the final source/readiness review found no new proven regression with the inherited and temporary differences recorded above. Grok was covered by tests only: three named shared adapter/lifecycle files passed (53 tests) under Brennan's usage waiver.

Desktop QA on this head carried genuine Claude and Codex chats from the previous e9bfdafc1ddd build through an actual restart/upgrade. Both reopened through Session History and produced two new real replies each. Both completed ordinary queue/drain with one delivery and reply. Codex also completed queued image replacement and text editing: Save delivered the exact blue replacement PNG and edited text, followed by the real BLUE_ONLY_1168 reply. These were fresh builds with the approved test-only queue capability advertisement and read-only store exposure; queue availability is feature gated in the shipped build.

The remaining desktop checks passed under M4Air admission1227 on this same head. Three cards waited together during a real Codex turn and drained in order, with one host submission, accepted dispatch, native input and real reply for each. A separate running turn was stopped with a card queued: it stayed Paused with no delivery during the bounded observation, then the actual Resume control delivered it once and produced one real reply. The earlier incomplete attempts remain recorded separately. Both desktop rigs are stopped and their profiles/evidence preserved.

One additional observation: the native sleeping command remained live after Stop while the queue correctly stayed paused. This run establishes queue pause and delivery behavior; it does not establish that Stop terminated the command, or that this observation is a regression. Final-head native iOS phone QA also passed: one actual mobile Send showed one queued card, drained normally to one real Codex reply, and stayed correct after workspace re-entry. Host journal and independent provider receipts each confirm exactly one delivery and reply. The first harness-only attempt sent no mobile message and remains incomplete; one diagnosed, approved correction produced the accepted evidence. The final review is complete on this head. The failed-import history publication repair remains a separate follow-up tracked in STA-11608.

Earlier-head desktop evidence (293bb8254496, ticket1168)

Both saved chats after upgrade, with the previous reply and two new real replies:

Claude	Codex

Ordinary queue/drain completed with Claude; the image flow below also shows Codex's completed ordinary queued reply:

Codex queued image/text before editing, the blue replacement in the editor, and the real reply after Save:

Before Edit	Replacement ready to Save	Delivered replacement and reply

The running turn ended while the editor was open, so Save drained immediately; no saved card still waiting was captured. Retained journal and provider records confirm one delivery of the edited text and exact replacement PNG bytes.

Earlier-head desktop FIFO and Stop/Resume (293bb8254496, ticket1227)

Three cards waited together, then each produced one real reply in order:

Three waiting	Drained in order

Stop kept the queued card paused; the actual Resume control delivered it once and produced one real reply:

Paused	After Resume

Pre-merge desktop evidence (e9bfdafc1ddd)

Image edit and actual delivered replacement

Editing queued card	Actual send

Stop holds the queue; Resume sends each card once

Paused	After Resume

Old chats after restart: two real replies each

Claude	Codex

Three queued messages, in order, once each

Inherited stopped-text carry reproduced on merged main

Earlier-head native iOS phone evidence (293bb8254496, ticket1169)

The actual paired iOS app sent one message while a real Codex turn ran. One queued card drained normally to one real reply; reopening the workspace kept the message and reply without reviving the card.

Paired native app	Queued card	Normal drain and real reply	After workspace re-entry

The invalid older QA host remains visible beside the fresh connected host in the pairing screenshot. The test used the fresh host and a new chat throughout. This is ordinary iOS Codex coverage; Android, mobile images/editing/FIFO/Stop/Resume/restart/upgrade and the failed-import retained-history follow-up were not repeated on phone.

Pre-merge native iOS phone evidence (e9bfdafc1ddd)

Phone coverage is this ordinary Codex flow only; Android, images, multi-card FIFO, editing, Stop/Resume, restart and upgrade were not repeated on phone.

Paired native app	Queued card	Normal drain and real reply

Earlier-head evidence

The evidence below is from earlier reviewed heads, ending at e9513f8. The desktop results above are from e9bfdaf; the older screenshots below do not certify this head.

Real Electron QA on a separate Mac, with the real Codex and Claude Code CLIs (both builds used the same local switch that turns on mid-turn queuing, which is hidden in shipped builds). Every flow matched main: queuing and draining, Edit, Delete, Steer, Stop and Resume, restart, /compact, a refused card, and the upgrade. The Stop-after-hand-over change could not be shown live: both agents confirm a handed-over message within milliseconds, so a Stop clicked from the UI always lands after the confirmation, on main and on this branch alike. That case is covered by the automated tests. A final smoke run on Windows at the last head (real Codex and Claude) passed all eight flows, including a Stop 46 ms after hand-over (the message stays in the conversation and is never resent) and a Stop while the agent was still starting up (the card waits again).

Upgrade: a profile made by a main build, then opened by this branch

Main build, at quit	This branch, after opening the same profile

Stop right after a queued message is handed over (Codex)

Main	This branch

A refused queued message (failed start), then Send

Main	This branch

Testing

• structured-agent-session-queued-stop-row.test.ts, a card handed over and stopped before the agent confirms it:
  • a steered card stopped inside a Codex turn stays as that turn's unconfirmed message, drawn the same by the shared view older clients use;
  • the next card, stopped before its turn opens, reads "Stopped manually";
  • neither card goes back to the queue; Resume sends only the card behind them;
  • a restart afterwards holds nothing.
• structured-agent-session-stop-aborts-start.test.ts: a queued card stopped before the agent call, or while the agent prepares it, waits again under the Stop.
• claude-structured-message-options.test.ts: a Stop while Claude applies a message's model choice is a stop, not a refusal; a real refusal still is one.
• structured-agent-session-claude-queued-stop.test.ts: a card sent into a running Claude turn, which Claude reports cancelled unrun, comes back paused and is not sent twice.
• journal-dispatch-settlement.test.ts: the one rule. A Stop puts a card back to waiting only with proof the agent never got it; a restart or close before hand-over puts it back to waiting; a failure returns the card.
• structured-agent-session-queued-legacy-import.test.ts:
  • cards from an earlier build, in every saved state, read the same before and after the move;
  • an unchanged card stopped after hand-over is spent and drawn as a stopped message; an edited one is held, skipped by the queue, and sent by its own Send;
  • a failed first move leaves the cards visible and usable, and each action moves only its own card;
  • a rewind while the move has failed moves the cards first, and a refused one stays refused;
  • the next open moves the rest, and the open after that writes nothing.
• structured-agent-session-queued-refused-card.test.ts, the refused card through the host: it holds the cards behind it through a rewind, a history rollover, a restart and a Resume; its Send is refused again and still holds; Delete releases it and the next card sends.
• The Claude unit tests for command lifecycle, control actions and queued Stop are updated for the "removed unrun" report. The echo-matching test is deleted with the code.
• I manually tested these changes locally
• Automated tests added/updated, or explained why not below

Notes

Ensure no issues in: Security, Cross-platform support (Linux, Windows, Mac), Remote SSH, Mobile, general backwards compatibility, performance

• SSH and mixed versions: host-owned, with the same published card and message shapes.
• Mobile reads the same list and draws messages through the same shared view.

Checklist

• This PR is small and focused
• I explained what changed and why
• Before/after screenshots or videos attached for UI changes, or N/A with reason
• Self-reviewed for correctness, security, and performance
• Cross-platform, SSH/remote, and path/shortcut impact considered (or N/A)
• pnpm lint, pnpm typecheck, pnpm test, and pnpm build pass (CI will cover)

Author: @BrennanKB5

[coderabbitai]

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

• Last reviewed commit: 88c44a9
• Latest commit, not reviewed: b99ed06

Use the following commands to manage reviews:

• @coderabbitai resume to resume automatic reviews.
• @coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

• ▶️ Resume reviews
• 🔍 Trigger review

📝 Walkthrough

Queued cards now derive from journal rows and reducer state rather than standalone SQLite draft storage. Queue writes, hand-offs, holds, withdrawals, and context clears use journal queue plans. The change adds import support for readable legacy rows and restates retained cards during epoch changes. Tests cover refusal behavior across rewind, rollover, restart, Resume, resend, and deletion.

Priority: ⬆️ High

Merge Risk: 🟡 Moderate · up to 88c44

A legacy queued card can be lost during import when two cards match one delivery echo. Fix echo pairing before merging.

Pre-merge checks: 3 · 2

Failed checks: 2 warnings

Check name	Status	Explanation	Resolution
Docstring Coverage		Docstring coverage is 51.04% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 96 functions across 62 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check		The description is detailed and covers the main change, rationale, testing, visual evidence, compatibility, and checklist. However, the required Linked Issue section does not link an actual issue; it …	Add a direct link to the issue addressed by this PR, complete the Review section, and select or explain the Agent skill upstream boundary checkbox. Also update the lint, typecheck, test, and build checklist with the actual verification stat…

Passed checks: 3 passed

Check name	Status	Explanation
Title check		The title clearly identifies the main change: storing queued messages in the chat record so refused messages cannot be skipped.
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description is detailed and covers the main change, rationale, testing, visual evidence, compatibility, and checklist. However, the required Linked Issue section does not link an actual issue; it explicitly says “Not a GitHub issue” and only references STA-11036. The Review section is also empty, and the Agent skill upstream boundary section is not completed.

Resolution

Add a direct link to the issue addressed by this PR, complete the Review section, and select or explain the Agent skill upstream boundary checkbox. Also update the lint, typecheck, test, and build checklist with the actual verification status or CI coverage.

✨ Finishing Touches: 💡 1

📝 Generate docstrings: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[brennanb2025]

Review loop status: ready for Brennan's review

The problem. In a native chat, messages can wait in a queue while the agent is busy. When the agent refuses a queued message, Orca's rule is that the message comes back as a "returned" card. The cards behind it then wait until you Send or Delete it. The card's state was saved in a separate write from the chat's record of the refusal. If that write failed, and the later repair write also failed, the card still read as "handed off". The queue then sent the next message past the refused one. The refused card also disappeared: its Send said "already sent" and its Delete did nothing.

What changes for users. When saves succeed, nothing you see changes. When those writes fail, the refused message now still comes back as a blocking card, and Send, Delete and Edit on it work. Every reader now works out a card's state from the chat's own saved record, so a failed save can no longer make the queue skip a refused message.

Review. One full round with four independent reviewers: the queue journal, the host and clients, a main-vs-branch trace of everything the user sees, and an architecture challenger. That was followed by the readiness checklist. They found no P0, P1 or P2 problems, so no code fixes were needed. The challenger kept the design: it is the same move earlier fixes made for the Stop and restart pauses, which were also changed to derive their state from the chat's record. The common transactional alternative writes its queue hold after the commit and only logs a failure, so it has this same bug.

Deferred (P3, not fixed here):

• Each queue read rebuilds a short change key over the cached handed-off cards. There is no SQL and no parsing; the cost is microseconds at realistic sizes.
• The refusal hook scans all of the session's cards once per refused hand-off; main did a single update.
• While a repair keeps failing, every journal commit retries it and logs a warning, with no backoff. Main does the same. Follow-up candidate.
• Known limit, now worded more precisely in the PR body: if the hook and every repair fail and the chat is then rewound, the returned card leaves the queue and the next one sends. Main had already sent it by then.
• Two concerns were traced and refuted. (1) An action's first catch-up write can't fail in a case where main's own action on that row would have worked. (2) A rewind can't bring a used-up command card back as a blocking card.

Verified.

• CI is green on this head, ba0681beacc5c008f7ad66d03441818f6ec9f192 (the PR checks passed gate passed), and the merge state is CLEAN.
• Real Electron QA ran on main and the branch with the real signed-in Claude CLI, driven by Grok over the Chrome DevTools Protocol (CDP), on an isolated test copy. Mid-turn queueing is hidden in shipped builds, so both arms got the same local, uncommitted patch that turns it on.
• Results matched on both arms:
  • three messages queued behind a long turn drain in order;
  • Stop pauses the queue and Resume sends in order;
  • Edit and Delete on queued cards;
  • Send now ("Steer") on the second card;
  • restarting the app with cards queued shows the same cards;
  • a /compact sent mid-turn queues and then runs (shipped path, no patch);
  • a plain send works.
• On the branch, a queued message whose start failed came back live as a returned card ("Your message was not sent.", with Send and Delete). The card behind it read "Waiting — a message ahead needs attention".

Not verified.

• The PR's own failure case (card writes failing) can't be produced in a running app. Automated tests cover it.
• The failed-start returned card wasn't captured on main, because the QA lease ran out. The code trace shows main behaves the same when saves succeed.
• After a restart, continuing the chat failed on both arms. That's a QA setup artifact: the test pointed Claude at its real home, so Orca didn't find the transcript to resume.

QA noticed these on both arms. The PR didn't cause them; they're listed for the lane:

• After a restart, queued cards read "Queued" with no Resume on the queue.
• A failed start says so in several places: the card, plus stacked red rows that tell you to send a message that is still sitting in the card.
• Queued cards still offer "Steer" when nothing is running.

For Brennan's review

Flow	main	branch
Three queued behind a long turn
Drained in order
Stop, paused
After Resume
Edit and Delete settled
Send now (Steer) settled
Before restart
/compact queued (shipped)
Failed start: returned card	not captured

Three places where a human judgment matters:

1. effectiveQueuedCard: a stored "handed off" card whose message was refused reads as returned, waiting or spent. This is the whole behavior change, and it applies only when the stored row is out of date.
2. Each action stores its own card before acting (also lines 148, 214, 234 and 286). Send, Delete, Edit, /clear and the failed-send hold now write the card's settled state inside their own transaction first. If that write fails, the action fails, but on main that card had no working action at all.
3. revision(): published lists refresh when only the derived state changes, at a small per-read cost (deferred P3 above).

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to GitHub limitations.

⚠️ Outside diff range comments (2)

🟠 Major · Remove the stale third argument in clearContext. It breaks… · queued-message-pause.spec.ts:72

src/main/native-chat/agent-session-journal/queued-message-pause.spec.ts:72
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Remove the stale third argument in clearContext. It breaks the CI typecheck.

This PR changes JournalContextController.clear to take two parameters: boundary and receipt (journal-context-controller.ts Line 26). The clearContext helper still passes `caller-clear-${clock}` as a third argument. pnpm run typecheck:ci fails at Line 72 with TS2554: "Expected 2 arguments, but got 3". This failure blocks the PR checks. Delete the argument. The other callers in this PR, such as agent-session-attachment-claims.test.ts, already pass only two arguments.

🐛 Proposed fix

   function clearContext(journal: AgentSessionJournal) {
     return journal.context.clear(
       { operationId: `clear-${++clock}`, afterFence: 0, clearedAt: clock },
-      { write: () => {}, committed: () => {} },
-      `caller-clear-${clock}`
+      { write: () => {}, committed: () => {} }
     )
   }

Source: Pipeline failures

🟠 Major · Add the missing queue fixture. · journal-unknown-row-kind.spec.ts:120-135

src/main/native-chat/agent-session-journal/journal-unknown-row-kind.spec.ts:120-135
🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Add the missing queue fixture.

rowOfEveryKind() requires one entry for every JournalRow['kind'], but it omits queue. TypeScript therefore reports TS2741, and pnpm run typecheck:ci fails.

Suggested fix

 import {
   AGENT_JOURNAL_THREAD_SCOPE,
+  AGENT_SESSION_JOURNAL_QUEUE_SCHEMA_VERSION,
   AGENT_SESSION_JOURNAL_SCHEMA_VERSION,
   type AgentJournalItemIdentity,
   type AgentSessionJournalIdentity
 } from '../../../shared/agent-session-journal-types'
@@
       'lifecycle-batch': {
         ...base,
         seq: 6,
         kind: 'lifecycle-batch',
         settlementId: 's',
         mutations: [{ kind: 'tombstone', itemId: 'i', revision: 3 }]
-      }
+      },
+      queue: {
+        ...base,
+        v: AGENT_SESSION_JOURNAL_QUEUE_SCHEMA_VERSION,
+        seq: 7,
+        kind: 'queue',
+        messageId: 'q',
+        change: { op: 'withdrawn' }
+      }

🧹 Nitpick comments: 1

src/main/native-chat/agent-session-wire/structured-agent-session-queued-refused-card.test.ts: 1

120-120: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Assert that Resume succeeds.

If rig.resume() returns an error, the cards can remain held and the later assertions can still pass. Check the result so this test verifies the successful Resume path.

Proposed change

-  await rig.resume()
+  expect(await rig.resume()).toMatchObject({ ok: true })

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: d6ecd96d-09bd-4eab-8ecd-7aaebe1e5b49

📥 Commits

Reviewing files that changed from the base of the PR and between ba0681b and 4db1581.

📒 Files selected for processing: 67

• src/main/native-chat/agent-session-attachments/agent-session-attachment-claims.test.ts
• src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts
• src/main/native-chat/agent-session-journal/journal-closed-sets.test.ts
• src/main/native-chat/agent-session-journal/journal-context-clear.ts
• src/main/native-chat/agent-session-journal/journal-context-controller.ts
• src/main/native-chat/agent-session-journal/journal-dispatch-reducer.ts
• src/main/native-chat/agent-session-journal/journal-dispatch-settlement.ts
• src/main/native-chat/agent-session-journal/journal-epoch-controller.ts
• src/main/native-chat/agent-session-journal/journal-epoch-replacement.spec.ts
• src/main/native-chat/agent-session-journal/journal-epoch-replacement.ts
• src/main/native-chat/agent-session-journal/journal-epoch-rollover.ts
• src/main/native-chat/agent-session-journal/journal-queue-events.ts
• src/main/native-chat/agent-session-journal/journal-queue-fold.ts
• src/main/native-chat/agent-session-journal/journal-queue-import.ts
• src/main/native-chat/agent-session-journal/journal-queue-retention.ts
• src/main/native-chat/agent-session-journal/journal-queued-message-contracts.test.ts
• src/main/native-chat/agent-session-journal/journal-queued-messages.ts
• src/main/native-chat/agent-session-journal/journal-reducer.ts
• src/main/native-chat/agent-session-journal/journal-row-schema.ts
• src/main/native-chat/agent-session-journal/journal-row-writer.ts
• src/main/native-chat/agent-session-journal/journal-store-collaborators.ts
• src/main/native-chat/agent-session-journal/journal-store-contracts.ts
• src/main/native-chat/agent-session-journal/journal-store.ts
• src/main/native-chat/agent-session-journal/journal-submission-hook.ts
• src/main/native-chat/agent-session-journal/journal-submission-queued-link.spec.ts
• src/main/native-chat/agent-session-journal/journal-submission-writer.ts
• src/main/native-chat/agent-session-journal/journal-unsent-send-hold.spec.ts
• src/main/native-chat/agent-session-journal/journal-unsent-send-hold.ts
• src/main/native-chat/agent-session-journal/queued-message-bookkeeping-failure.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.ts
• src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts
• src/main/native-chat/agent-session-journal/queued-message-holds.ts
• src/main/native-chat/agent-session-journal/queued-message-pause.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-positions.ts
• src/main/native-chat/agent-session-journal/queued-message-retention.ts
• src/main/native-chat/agent-session-journal/queued-message-settlement.ts
• src/main/native-chat/agent-session-journal/queued-message-store.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-stored-row.ts
• src/main/native-chat/agent-session-journal/queued-message-table.ts
• src/main/native-chat/agent-session-journal/queued-message-text-update.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-text-update.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-clear-rewind.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-codex-version-recovery.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-conversation-open.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-ended-prompt-cancel.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-event-recovery.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-host-lifetime.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-action-receipts.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-card-holds.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-edit.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-legacy-import.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig.test-fixture.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-messages.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-mutations.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-refused-card.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-send-answer.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-withdrawn-draft.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-stop-event.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-unsent-send-hold.test.ts
• src/main/native-chat/agent-session-wire/structured-conversation-command.ts
• src/main/runtime/agent-session-conversation-clear-commit.test.ts
• src/main/runtime/structured-agent-session-failure-logging.test.ts
• src/shared/agent-session-journal-types.ts

💤 Files with no reviewable changes: 14

• src/main/native-chat/agent-session-journal/queued-message-bookkeeping-failure.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-retention.ts
• src/main/native-chat/agent-session-journal/journal-submission-hook.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-message-rig.test-fixture.ts
• src/main/native-chat/agent-session-journal/queued-message-holds.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-restart-interruption-test-harness.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-withdrawn-draft.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-codex-version-recovery.test.ts
• src/main/native-chat/agent-session-journal/journal-queued-message-contracts.test.ts
• src/main/native-chat/agent-session-journal/queued-message-store.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-positions.ts
• src/main/native-chat/agent-session-journal/queued-message-edit-leases.test.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-pause.ts
• src/main/native-chat/agent-session-journal/queued-message-settlement.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 0 remain after this review.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: fb158b77-c26b-4396-93ac-139adc564e4f

📥 Commits

Reviewing files that changed from the base of the PR and between 4db1581 and e096d5f.

📒 Files selected for processing: 18

• config/scripts/vitest-node-runtime-files.mjs
• src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts
• src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts
• src/main/native-chat/agent-session-journal/journal-context-rewind.ts
• src/main/native-chat/agent-session-journal/journal-queue-fold.ts
• src/main/native-chat/agent-session-journal/journal-queue-import.ts
• src/main/native-chat/agent-session-journal/journal-queued-messages.ts
• src/main/native-chat/agent-session-journal/journal-row-writer.ts
• src/main/native-chat/agent-session-journal/journal-store.ts
• src/main/native-chat/agent-session-journal/journal-unknown-row-kind.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.ts
• src/main/native-chat/agent-session-journal/queued-message-pause.spec.ts
• src/main/native-chat/agent-session-wire/structured-agent-session-queued-legacy-import.test.ts
• src/shared/agent-session-turn-record.test.ts
• tests/e2e/cross-version-wire/agent-session-newer-chat-refusal.unit.test.ts
• tests/e2e/cross-version-wire/agent-session-stop-event-downgrade.unit.test.ts
• tests/e2e/cross-version-wire/kept-card-downgrade.unit.test.ts

💤 Files with no reviewable changes: 2

• src/main/codex/codex-structured-journal-translation-turn-lifecycle.test.ts
• src/main/native-chat/agent-session-journal/command-receipt-transaction.spec.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 1 remain after this review.

[brennanb2025]

Final review and real-agent QA complete on the current head b99ed06eec7a584f43e47234a947b5e1fba28baf. Main was merged once more before merging (another PR touched one of this PR's files). One Codex reviewer then checked every incoming change against what this PR rewrote: queued-message storage, import of old queued messages, Stop and handover, Claude's cancellation retry, Codex history catch-up and delivery receipts. It found no regressions. CI is green on this head.

A real Claude and Codex re-run on this head (M4Air, ticket 1625; instrumented QA build that switches on the still-dark mid-turn queue, source restored after) passed both flows for both agents:

• Queue while working: two messages queued during a running turn showed as cards in order, then each was delivered once, in order, with its own reply. The agents' own session records confirm it.
• Stop, then Resume: a queued message stayed unsent for 10 s after Stop, then Resume delivered it once with one reply. (For Claude, Stop landed before its shell command started, so Stop during a running Claude command wasn't exercised here; the earlier head covered it.)

The image-edit flow below passed on the previous head ef47118; nothing it depends on changed in the merge. Real config hashes were unchanged.

Queued messages could disappear after a refused send or be sent twice after Stop/restart because the queue kept a separate saved outcome. This PR keeps each queued message in the conversation record; a message that may have reached the agent stays in the conversation and is never automatically queued again.

Final review and real-agent QA complete on ef47118d3bc3693423ab185726da758a0a350d6d. The bounded source review found no new proven merge regression, four named lifecycle test files passed all 25 tests, and the full workflow finished with 27 successful and 17 skipped checks. The final whole-mechanism comparison and readiness review are recorded in the private ledger. No production change was needed in this final round.

Current-head desktop checks passed. The earlier exact-head run passed Claude ordinary queue/drain, Claude Stop → Paused → actual Resume, Claude normal close/reopen, Codex Stop → Paused → actual Resume, and Codex normal close/reopen. The owner's final M4Air takeover then completed Codex ordinary queue/drain, queued image replacement/text editing, and three-card FIFO on this same head using the real Codex CLI.

During an actual running sleep 420 turn, the driver dropped image A, queued the original text, opened the card's Edit message action, removed A, dropped B, changed the text and saved. Two further messages were queued, so all three cards waited together. With no Steer, individual-card Send or Stop, they drained naturally in order. Codex's own saved record contains the edited text and exact replacement B bytes, no A or original text, then the replies “Blue, with a white letter B.”, “Q2-OK” and “Q3-OK”, once each. The app was stopped by its recorded PID; admission1488 is done and the owner's before/after real-config hashes match.

Grok waived by Brennan (10-21): "We're out of grok usage right now. So skip it and test w/ unit tests"

Grok has tests-only evidence from the earlier 293bb825 head (three named adapter/lifecycle files, 53 tests), not a newly claimed current-head provider run. Required changed agents Claude and Codex were exercised on the current head. Queue availability remains feature gated in shipped builds; QA used the approved test-only capability advertisement and read-only store exposure.

Retained limitations and follow-ups. The incoming model-choice change removed the old missing-positive model-catalog Fast refusal. Inherited omitted-default restoration (STA-11572) and the separate reported-disabled-Fast restriction remain qualified, without an alignment claim or waiver. The temporary Claude unwritten Stop failure returned-card exception (STA-11660), failed-import retained/live/reconnecting/paged-history correction after reopen (STA-11608), and recovery work in STA-11448/#30580 remain as documented below. Stopped-text carry is unchanged. Stop evidence proves queue pause/resume, not native sleeping-command cancellation. Stale Settings copy saying image messages send immediately predates this PR; the owner assigned its correction to the B1 recovery follow-up. No completed fix of that copy is claimed here.

Evidence boundaries. Upgrade and native-phone evidence below is from 293bb825, clearly historical; the owner excluded those unchanged paths from this bounded current-head rerun. Earlier ticket1381 ordinary-Codex method failure, ticket1439 unavailable attachment method, ticket1475 preparation parse error, and the loop's initial ticket1488 app exit remain separate incomplete attempts. None is counted as a pass. The owner traced the dev app exit to its parent-process watchdog and corrected the rig before the accepted takeover. The takeover's preliminary sleep 300 setup is also separate from the accepted sleep 420 flow.

Current-head final Codex evidence (ef47118d3bc, owner takeover1488)

Current-head driver preparation failure (ef47118d3bc, ticket1475)

The whole-window screenshot shows onboarding over the empty Codex chat. No acceptance input or CDP file-drop call occurred; this is setup evidence only.

Current-head incomplete attachment setup (ef47118d3bc, ticket1439)

These screenshots show Settings and the empty configured Codex chat before any base turn or queued card. They do not demonstrate queue delivery or image replacement.

Settings	Empty configured chat at the method blocker

Current-head desktop evidence (ef47118d3bc, ticket1381)

Claude: ordinary queued message and real reply:

Claude: Paused, reply after actual Resume, and reopened chat:

Codex: queued during a real command, Paused, and reply after actual Resume:

Codex: reopened same chat with no duplicate or queue:

Historical completed review on 293bb825 follows. These older results are retained as earlier-head evidence. The owner excluded the unchanged upgrade and phone paths from the current short recheck.

Queued messages could disappear after a refused send or be sent twice after Stop/restart because the queue kept a separate saved outcome. This PR keeps each queued message in the conversation record; a message that may have reached the agent stays in the conversation and is never automatically queued again.

Final review complete on 293bb82544967f097081040cb21d7d55ce17636c. CI is green on this head, including the WSL retry, and GitHub reports no merge conflicts. Main is merged and 19 targeted test files passed (347 tests). The final source/readiness review found no new proven regression and completed the mechanism comparison with the inherited and temporary differences below. Final-head desktop QA completed the Claude and Codex upgrade/reopen, two real replies each, ordinary queue/drain, and image replacement/text-edit delivery checks. Three simultaneously queued cards in order and queued Stop/Resume also passed in the subsequent exact-head desktop run. Final-head native iOS phone QA passed the actual mobile Send, queued card, normal drain, real Codex reply and workspace re-entry checks, with one delivery and reply confirmed in host and provider records. Required agents follow the PR's changed agent folders: Claude and Codex. Supplemental provider attempts do not count as passes. Grok was covered by tests only: acp-structured-session-adapter.test.ts, acp-structured-session-adapter-lifecycle.test.ts and acp-structured-host-lifecycle.test.ts passed (53 tests) on this head.

Grok waived by Brennan (10-21): "We're out of grok usage right now. So skip it and test w/ unit tests"

Completed desktop checks on this head. Genuine Claude and Codex chats created by the previous e9bfdafc1ddd build were carried through an actual restart/upgrade, reopened through Session History, and each produced two new real replies. Both agents completed an ordinary queued message after a real running turn, with one delivery and reply confirmed in retained records. Editing a queued Codex message removed the red image, added the blue image, changed the text, and saved once; normal drain delivered the edited text and exact replacement PNG bytes, followed by the real BLUE_ONLY_1168 reply. The tested builds used the approved test-only queue capability advertisement and read-only store exposure; queue availability is feature gated in the shipped build.

Additional desktop checks passed on this head. In the corrected FIFO run, all three cards visibly waited together during a real Codex turn, then each produced one real reply in order. Records join each card to exactly one host submission, accepted dispatch, native input and reply. A separate Stop test retained its queued card as Paused with zero delivery during a bounded observation; the actual Resume control then delivered it once and produced one real reply. Earlier setup/driver failures and the incomplete two-card attempt remain separate evidence, never passes. Both rigs are stopped and profiles preserved.

Observed limitation: the native sleeping command remained live after Stop while the queue stayed paused. This establishes queue pause and delivery behavior, not termination of that command. No main comparison or PR attribution was established for this observation. The lane owner is tracking that possibly inherited command-cancellation behavior separately; no additional Stop reproduction or process-cancellation change was made here.

Temporary difference: an already-open chat that reconnects or pages older history after a failed upgrade import shows the stopped message only after reopen; tracked in STA-11608. The owner has ruled that history publication and older-client approval controls will be repaired in that separate follow-up. This PR keeps its snapshot correction. The final main merge and source comparison are complete. The final-head native phone check is complete. The ordinary small-history phone re-entry does not exercise or close the failed-import retained-history follow-up.

Not changed here: a later send can carry an earlier stopped request's text, and the agent may answer that earlier request. The same saved-chat experiment on merged main produced the same six-message provider sequence as the branch. This is inherited behavior; there is no demonstrated false cancellation proof or queue regression. Pause loss across restart also reproduced on main. Claude can still refuse an omitted effort after an earlier override (STA-11572), or Fast when a listed model lacks positive capability evidence (STA-11451). These checks are inherited from main and owned by separate work; this review does not claim they are aligned or waived.

Coverage limits: saved opus[1m]/unlisted picker choices, native OS clipboard/drop and a literal returned-card Send button were not exercised in this desktop run. Rare failed-import rollback and uncertain-delivery cases have automated/source evidence, separate from the real QA. These limits are retained in the review ledger. Final-head phone coverage is the ordinary Codex flow only; Android, images, multi-card FIFO, editing, Stop/Resume, restart and upgrade were not repeated on phone.

For Brennan's review: final-head screenshots below cover the completed desktop and native iOS checks. Separately labelled pre-merge screenshots remain historical evidence. The history publication repair remains tracked in STA-11608.

Final-head desktop evidence (293bb8254496, ticket1168)

Both saved chats after upgrade, with the previous reply and two new real replies:

Claude	Codex

Ordinary queue/drain completed with Claude; the image flow below also shows Codex's completed ordinary queued reply:

Codex queued image/text before editing, the blue replacement in the editor, and the real reply after Save:

Before Edit	Replacement ready to Save	Delivered replacement and reply

The running turn ended while the editor was open, so Save drained immediately; no saved card still waiting was captured. Retained journal and provider records confirm one delivery of the edited text and exact replacement PNG bytes.

Final-head desktop FIFO and Stop/Resume (293bb8254496, ticket1227)

Three cards waited together, then each produced one real reply in order:

Three waiting	Drained in order

Stop kept the queued card paused; the actual Resume control delivered it once and produced one real reply:

Paused	After Resume

Native phone acceptance and cleanup. One actual native Send of Reply exactly PHONE_QUEUE_1169 occurred during a real Codex turn. Its queued ID links to one host submission, one accepted dispatch, one native input and one real PHONE_QUEUE_1169 reply. One native workspace re-entry retained that result with no card. The initial harness-only attempt had zero mobile Sends and remains incomplete; the approved corrected attempt is separate. Fresh host/mobile/native builds were verified on this exact head, with the same disclosed test-only queue advertisement. All owned app/server/helper processes are stopped, the owned simulator is shut down, and the machine admission is released.

Final-head native iOS phone evidence (293bb8254496, ticket1169)

The actual paired iOS app sent one message while a real Codex turn ran. One queued card drained normally to one real reply; reopening the workspace kept the message and reply without reviving the card.

Paired native app	Queued card	Normal drain and real reply	After workspace re-entry

The invalid older QA host remains visible beside the fresh connected host in the pairing screenshot. The test used the fresh host and a new chat throughout. This is ordinary iOS Codex coverage; Android, mobile images/editing/FIFO/Stop/Resume/restart/upgrade and the failed-import retained-history follow-up were not repeated on phone.

Historical pre-merge evidence (e9bfdafc1ddd; does not certify final head)

Image edit and actual delivered replacement

Editing queued card	Actual send

Stop holds the queue; Resume sends each card once

Paused	After Resume

Old chats after restart: two real replies each

Claude	Codex

Three queued messages, in order, once each

Inherited stopped-text carry reproduced on merged main

Pre-merge native iOS phone: pair, queue, drain and reply

Paired native app	Queued card	Normal drain and real reply

For Brennan's review: the current-head galleries show the edited attachment, natural three-message drain, both agents' actual Resume and close/reopen results. Earlier main/branch upgrade and Stop comparisons retain their original head labels. The remaining user-facing recovery differences and follow-up ownership are stated above; no new product decision is requested by this final round.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 8348c0cf-199c-41b6-993e-2121da8b5bda

📥 Commits

Reviewing files that changed from the base of the PR and between 6b66b65 and 88c44a9.

📒 Files selected for processing: 4

• src/main/native-chat/agent-session-journal/journal-queue-fold.ts
• src/main/native-chat/agent-session-journal/journal-queue-import.ts
• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.ts

🚧 Files skipped from review as they are similar to previous changes: 3

• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.spec.ts
• src/main/native-chat/agent-session-journal/queued-message-delivered-echo.ts
• src/main/native-chat/agent-session-journal/journal-queue-fold.ts

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 5 remain after this review.