fix(notes): reuse verified host prompt delivery

[nwparker]

	Files	Added	Deleted	Net
Test	4	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​188	$\color{#cf222e}{\Huge{\mathbf{−}}}$​20	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​168
Prod	5	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​57	$\color{#cf222e}{\Huge{\mathbf{−}}}$​14	$\color{#1a7f37}{\Huge{\mathbf{+}}}$​43

ELI5

Sending review notes to Claude or Codex can leave the notes parked in the composer because the renderer sends Enter only 50 ms after a separate paste RPC. On supporting runtimes, notes now use the existing host-owned prompt transaction and wait for its submission verifier.

What Changed

• Advertise optional guarded prompt support on terminal.agentStatus only for proven settlement agents.
• Allow guarded combined text/Enter only through sendTerminalAgentPrompt, retaining exact PTY and permission checks before both writes.
• Route notes through that transaction; retain the current fallback for older/unsupported hosts and never re-paste after an ambiguous verified result.
• Add local/paired notes regressions and guarded durable receipt replay coverage.

Why

The execution host already owns paste ingestion timing, serialization, cancellation and submission verification. Reusing that path removes the notes caller's independent timer without introducing another verifier.

Linked Issue

Partial coverage of STA-5642 (notes path) and STA-4495 (remaining caller asymmetry). No complete historical ticket closure is claimed. Exact dispositions for all 18 assigned reports are included below; the working report remains local and untracked.

Existing open work is preserved: startup/recipe bindings #18996 / #16716, CLI attribution #18020, automation completion #18087, large-paste core #15698 / #18196, composer proof #18022, receipt/non-turn handling #16198, and shell startup #15275. This draft does not duplicate those fixes or change their branches.

Visual Proof

Incomplete for the changed interaction. Rebuilt this worktree and launched it with ORCA_BACKGROUND_LAUNCH=1, an isolated app profile, and CDP; verified app.getIdentity and inspected the hidden welcome-screen screenshot. No workspaces or agent sessions were opened. This proves rendering/startup only, not before/after notes delivery.

Stopped validation after startup unexpectedly granted managed hook trust in the real Codex home as well as the isolated runtime home. The app-profile override does not isolate provider bootstrap; the existing E2E home-isolation harness is required for further live proof. No user configuration rollback or session cleanup was attempted. The validation detail below records the precise source and observations.

Testing

• I manually tested the notes interaction with live providers
• Automated tests added/updated

All tests and app launches used ORCA_BACKGROUND_LAUNCH=1. On macOS: 129 tests passed across eight focused runtime/renderer suites; pnpm tc:node, pnpm tc:web, focused oxlint, changed-code quality, and diff whitespace checks passed. Deterministic coverage includes Windows/POSIX/SSH write-host ingestion, permission/cancellation, local/paired notes routing, old-host fallback, and guarded idempotent receipt replay. No live Windows/WSL/SSH provider run.

Review

New clients require the additive support flag; old clients ignore it. Unsupported or changed targets cannot downgrade a guarded combined send into shell input. Renderer calls do not yet supply durable orchestration request IDs, and the incumbent verifier's limitations for local slash commands and pre-existing drafts remain.

Agent skill upstream boundary

• Not applicable; no upstream skill-installer content copied.

Checklist

• Focused change, self-reviewed, compatibility considered
• Problem, behavior and validation explained
• Before/after interaction proof attached
• Full lint/test/build matrix passes (focused checks above only)

Exact issue accounting

No complete historical ticket closure is claimed by this draft.

Issue	Disposition and evidence
STA-4495	Partial: notes now reuse the shipped verifier; silent-success half already changed in v1.4.187 per latest corrective comment. Core composer/receipt work remains in #18022 / #16198.
STA-2380	Pending existing #10020 for launchAgent/quiescence trust gate; Codex MCP input-missing variant explicitly outside that PR and not reproduced here.
STA-3793	Pending: Codex MCP cold-start loss not exercised by this notes repair; historical presence/readiness asymmetry is not closure evidence.
STA-2655	Pending: comments identify both composer-pending and input-missing variants; no blanket historical closure. Related #10020 / #18022.
STA-2912	Pending existing #15698 (large atomic paste) and #18196 (render-gate ingestion floor). Main already has size-dependent host ingestion; no duplicate core patch.
STA-4318	Pending: Windows/macOS Claude worker symptoms remain outside notes caller coverage; #18022 / #16198 overlap.
STA-5642	Partial: notes half fixed through host transaction. Startup agent-paste-draft.ts remains separate and overlaps #16716 / #18996; 50 ms fallback retained for old hosts.
STA-5951	Pending existing #18020: interactive CLI launchAgent inference already has a focused open fix, including remote clients.
STA-6211	Partial mechanism coverage only: notes change does not close worker cold delivery or wrong-pane capability binding; latter belongs to identity worker. #18022 addresses composer proof.
STA-5869	Pending: manual Enter recovery/capability revocation is orchestration core, overlapping #16198 / #15941; no timeout inflation here.
STA-6779	Pending: automation reuse still calls renderer submit helper; selected-session submission and #18996 integration need validation. Resource worker owns reuse ownership.
STA-6437	Pending existing #15275 late shell-ready startup-command repair; shell readiness is distinct from agent readiness and untouched. Current daemon startup tests already exercise shell-ready routing.
STA-6432	Pending existing #18087: fresh working-to-done completion fence; no duplicate automation edit.
STA-6755	Pending existing #18996: configured Enter/Ctrl+Enter setting and recipe/reuse submit bytes. Do not claim fixed by routing notes.
STA-5379	Pending: historical Git AI action recipe symptom not reproduced; startup caller overlaps #18996 / #16716.
STA-5150	Pending existing #16198 and #16290: local slash-command/non-turn verdict and dirty composer refusal are distinct. Notes errors never trigger automatic re-paste, but no new local-command success outcome.
STA-6763	Pending: description is title-only; comments propose timeout inflation without measured evidence. No arbitrary acknowledgment-window change.
STA-2631	Partial existing guards regression-tested; current verifier already blocks permission sequences. Historical trust/Antigravity scrollback detection requires live provider reproduction; #10020 is adjacent.

All PR numbers above link under https://github.com/stablyai/orca/pull/<number> and were found open when checked, not treated as merged fixes.

Recorded validation detail

• All commands used ORCA_BACKGROUND_LAUNCH=1.
• pnpm tc:node and pnpm tc:web: passed.
• Focused oxlint, changed-code quality (native/type-aware/React Doctor: zero findings), and git diff --check: passed.
• Final focused regressions: 8 files, 129 tests passed, including Windows ingestion, runtime submission, RPC guard, durable receipt replay, old-host notes fallback, and new local/paired notes tests.
• New coverage: single large notes RPC on local/paired targets, wait for verified result, permission refusal, no automatic replay after ambiguous failure, guarded transaction routing/rechecks, signal forwarding, rejection after settlement support changes, durable guarded receipt replay without duplicate body/Enter.
• Existing focused suites cover Windows/POSIX host ingestion, SSH Windows write-host selection, permission/cancellation, small/large prompt verification, durable receipts, and old-host focused/explicit notes paths. These are deterministic tests on macOS, not live Windows/SSH/WSL end-to-end proof.
• Coordinator supplied the Electron skill after local lookup failed. Rebuilt and launched this worktree hidden with isolated ORCA_DEV_USER_DATA_PATH, CDP 9341 and renderer 5183; app.getIdentity confirmed this checkout. Inspected /tmp/orca-prompt-hidden-renderer.png: empty workspace welcome screen, zero terminal sessions. This is startup/render proof only, not before/after notes-delivery evidence; manual checklist remains unchecked.
• Validation stopped after startup unexpectedly logged two codex-trust-grant messages with host=native, wrote=true (8 managed hook entries). Isolated app profile does not fully isolate provider bootstrap. Escalated to coordinator, launched no agents, performed no config rollback; stopped only recorded validation process tree and verified both ports closed. Own-profile ledger confirms the two affected homes: /Users/nwparker/.codex and /tmp/orca-prompt-delivery-validation-profile/codex-runtime-home/home, each 8 entries. Source is codex-real-home-hook-install.ts real-home grant with useDefaultCodexHome: true; native launcher deletes CODEX_HOME. Existing tests/e2e/helpers/electron-home-isolation.ts is the required full home boundary. ORCA_DISABLE_CODEX_TRUST_RPC alone does not prevent all hook/config writes.