[brennanb2025]

ELI5

An unconfirmed message gets at most eight automatic delivery probes after its original send, including across pane changes and renderer reloads. It stays parked until Resume checking. Launch callers observe authoritative acceptance even when a pane wins the send claim.

Ownership

One synchronous current-state outbox transition owns durable recovery progress, dispatch reservations and incarnation settlement in the main renderer. Ordinary completions require the current revision and incarnation; host acceptance may retire the matching incarnation after its revision advances. Storage commits precede acceptance publication. Persisted dispatching becomes uncertain when its live claim is lost, so restart and orderly release spend the saved recovery allowance. Explicit Retry renews incarnation or rotates a rejected operation; Resume preserves operation/body/fingerprint without retryUnknown.

Staging retains a settlement handle before publication. Joined callers share acceptance, including acceptance before the launch receipt resolves. Missing queue state alone never proves delivery. Launch writers respect FIFO and durable refusal blocking. Removed/replaced operations retire active claims; terminal observations remove pending indexes. Completed receipts remain weakly keyed by externally retained staging handles. Completed caller memberships and unusable fallback closures retire independently of unfinished delivery/fallback work.

Storage evidence and cancellation lifetime

Only readable queues authorize mutations or successful no-ops. Unavailable reads and invalid JSON/envelopes do not invoke transition callbacks or overwrite stored bytes. Missing keys and valid empty arrays are readable empty states. A rejected entry invalidates the whole queue; conservative optional-recovery normalization remains. This is not exhaustive cross-field/clock/identity validation.

Failed persistence settles affected observations unavailable without publishing acceptance or discard. These receipts are final and never later upgraded to acceptance. Per-entry/claim failures target only the supplied incarnation; unreadable bulk transitions settle pending session observations unavailable.

Session/workspace-bound cancellation authority is established before staging, independently of launch deduplication, caller membership and fallback lifetime. It retains only identity and current operation/incarnation keys, not prompt bodies, create parameters or completed caller closures. Caller retirement checks readable empty-state evidence; unavailable or blocked delivery alone cannot dispose this authority. Positive durable removal releases its subscription and metadata.

A later cancellation request transfers the captured keys into the separate persistence obligation even after caller registration retires. The target set then freezes: later enqueues and explicit Retry incarnations survive. Failed reads/writes return false and retain the obligation. Explicit cancellation API retry or a subsequent successful outbox commit can retry it. Positive removal/replacement/absence of targeted incarnations permits retirement and matching focus-intent abandonment. Retries remain deferred/coalesced, exact-record fenced, and free of timer/self-scheduling loops.

Mounted Resume after failed completion persistence

The common dispatch owner publishes live-claim changes to mounted recovery. An ordinary dispatch left durably dispatching after a failed completion exposes Resume checking once its live claim is absent and no host-journal observation suppresses recovery. The action reads through the existing revision/incarnation-fenced transition, converts the orphan to uncertainty and reserves the saved allowance before another dispatch. It does not require remount or fabricate a successful durable transition for display. Failed recovery writes keep the action paused; a stale Resume handler cannot reclaim a successor's live dispatch. Explicit budget-exhausted Resume still grants the existing new allowance.

Scope and limits

Addresses STA-6052 and the shared automatic-probe-lifetime portion of STA-6202; neither full issue is complete. The rejected quota-failed-new-send accumulation diagnosis is excluded. Eight probes is initial policy: 79 seconds of scheduled backoff plus RPC latency, not an empirical threshold or wall-clock SLA.

Scope is one main-renderer session-keyed localStorage partition, not distributed or cross-realm locking. No transport/wire/opcode, Git command, provider API or host-authority change. SSH acceptance stays execution-host-owned and contact loss unverifiable; folder/session identifiers remain opaque.

Cancellation intent remains in-memory, not reload-durable, with no new product cancellation retry UI. Restoring storage access alone emits no retry event. Close callers separately close host sessions/tabs; tab removal does not prove local discard, and local discard does not reverse host delivery. Permanent failures may retain metadata for the renderer lifetime. Host-observed and explicit-force delivery retain their existing recovery policies; no blanket all-storage-errors recovery claim is made. Initial unavailable display fallback, malformed cross-field/clock values and downgrade metadata loss remain limits.

Validation at 257ba542c0bd11f4d14358da5e61d915e321996b

• 176 focused tests pass across 22 files, including pre-request read/write failure, pending-create cancellation, frozen targets, accepted/discarded disposal, mounted recovery, concurrent/live/stale claims, saved allowance and existing R3/R4 controls.
• The two fresh correctness oracles pass. Independent reruns reproduce 176/176 focused tests and the unchanged prior selection at 40 pass/3 cancellation-argument-shape failures out of 43. The author copy passes 43/43 but changes four assertions, including one already-passing staging-refusal assertion, to broad worktree/session matching. A further independent copy preserves that original staging-refusal oracle and changes only the three cancellation assertions to exact worktree/session/agent identity, excluding create parameters; it passes 43/43 with all other behavioral assertions unchanged. These selections overlap focused coverage and are not additional distinct coverage.
• Four committed-source ablations fail as intended: authority lifetime 2/2, notification 3/5, live-claim protection 1/5, saved allowance 2/5. Every restoration uses cp/cmp, nonzero symbol checks and clean tracked source. An initial ablation exposed test-spy cleanup leakage; a test-only commit fixes it and the final measurements supersede that count. Independent committed-head reruns reproduce all four sensitivities and verified restorations.
• Explicit sequential node/web/CLI TypeScript projects, changed-file oxlint and fresh hidden main/preload/dev-renderer build pass.
• Actual Close tab was exercised with a synthetic read fault active before cancellation and, separately, activated at the click. Before-request registration was already idle; both closes retained one payload, zero removals and pending cancellation while unreadable. After restoration, diagnostic cancellation API retry returned true/idle with zero retained payloads.
• Actual Resume checking was exercised while the pane remained mounted after failed completion persistence. A failed click stayed actionable; restoration and another click reserved probe four from a saved three, then sent an identical request without retryUnknown. Synthetic acceptance cleared the outbox while the original unavailable receipt stayed false. Renderer token and subscription count stayed unchanged.

Only synthetic RPC call/subscription boundaries and a fresh matching synthetic HOME/E2E/user-data profile were used; shipping controllers and real UI remained loaded. Listener commands/PIDs, app identity and target/profile were verified. Nine uncropped captures were inspected. The synthetic folder cannot load files; no real credentials or live-host delivery were used. The owned app and CDP session were stopped and both ports became empty. Setup reloads were instrumentation installation, not recovery/crash proof. Real worktree-create cancellation UI, authenticated reconnect/attachments/late host acceptance, Notes/continuation UI, process crashes, Windows/Linux and real SSH remain unverified.

Reliability contract

Invariant (agent-session.outbox-ownership): one main-renderer operation/incarnation owns durable progress and acceptance; unreadable or failed persistence cannot establish successful delivery or cancellation. Pre-request cancellation authority outlives disposable caller registration, and an ordinary orphaned dispatch exposes mounted Resume while preserving its saved allowance and excluding live successors.

Failure source: STA-6052/shared probe-lifetime work and the independently reproduced stale-writer, restart-budget, observer-retirement, pre-request cancellation and mounted failed-persistence schedules on preceding revisions of this PR. Oracles: exact-head finite tests require eight additional probes, no stale revision/incarnation rewind, final unavailable receipts, one live caller after 64 completions, failed cancellation followed by successful targeted retry, and mounted Resume reserving probe four from three with unchanged request and no retryUnknown. Independent committed-source ablations must fail those ownership/release/live-claim/allowance oracles.

Gate: no matching entry exists in config/reliability-gates.jsonc; manifest integration is an explicitly accepted coordinator review gap for this PR. The finite controls and red/green ablations are review evidence, not a promoted blocking reliability gate. Diagnostics are the per-test JSON/logs, restoration receipts and synthetic full-app/backing-state evidence described above.

Performance budget: eight additional probes, one recovery timer per mounted owner with lifecycle cleanup, no cancellation polling/self-retry loop, and retirement proportional to live obligations are covered by deterministic tests. Current-key replacement scales with the session queue, claim notification with mounted subscribers, and storage still parses/sorts/serializes whole queues. Production latency/heap remain unmeasured, explicitly accepted coordinator review gaps. No fixed global metadata bound is claimed; permanent storage failure can retain metadata for the renderer lifetime.

Provider/platform surface	Coverage or gap
Local and daemon PTY	Input/resize/exit/replay and process ownership are unaffected by this renderer outbox diff; no new PTY runtime validation claimed.
SSH/remote	Renderer target behavior is covered synthetically; acceptance remains execution-host-owned and contact loss unverifiable. Real SSH/authenticated host behavior remains unverified.
WSL	Process/path primitives are unchanged; live WSL session flows remain unverified.
Mobile/relay	Runtime/wire mechanisms are unchanged; this main-renderer budget is not a mobile or distributed budget claim. Mobile/client behavior is unverified here.
macOS/Linux/Windows	macOS hidden synthetic UI evidence was audited; Windows/Linux rendered behavior remains unverified.

These accepted documentation/integration gaps do not waive required manual validation, grant merge permission or accept all remaining readiness gaps. The scope and manual limitations above remain explicit.

Review

Independent architecture/code review found no product issues at 257ba542c0bd11f4d14358da5e61d915e321996b, with independent control/ablation reruns and audited author rendered evidence. The corrected evidence wording here is independently approved; the historical author adaptation count is superseded by the exact account above. This is scoped code/architecture clearance, not READY or merge approval. Separately coordinated required manual validation and final publication/readback remain gates. The PR remains draft; no related Linear drafts are approved or published.

Author: @BrennanKB5

[brennanb2025]

Author validation at 951997b810273d434bb374118d1c0f203008692a — fresh independent code review pending, not READY.

• Functional correctness: 56 focused tests pass at this head, including eight-probe exhaustion/remount/fence behavior, late acceptance/FIFO, quota failures, legacy/malformed storage, and safe resume versus explicit force Retry. Exhaustion ablation failed three tests; storage-ownership ablation failed both quota cases; exact committed bytes were restored and checks passed.
• Architectural fit: recovery progress/deadlines/parking now belong to the durable operation; the hook only schedules persisted transitions. Eight attempts is a provisional explicit policy (79 seconds of accumulated delays plus RPC time). Review must challenge whether this lifecycle and storage failure behavior remove the root cause.
• Precedent: reused current outbox identity-preserving request construction, host reconciliation, and legacy storage parsing. Those provide identity/settlement precedent, not an existing durable retry budget; no external alignment claimed.
• Validation limits: node/web/CLI typechecks, changed-file lint, and hidden Electron build passed on unchanged product bytes before the final test-cleanup commit. Full app CDP captures show seeded parked state and the real Resume checking action retaining operation/body/no force flag. Synthetic session authentication/read failed, so live reconnect, attachment rendering and late host acknowledgment are automated boundary evidence only; Windows/Linux/real SSH manual QA is outstanding. No native rebuild, real account/profile access, merge or ticket closure.

The PR remains draft for exact-head independent review and any remaining validation the reviewer requires.

[brennanb2025]

Independent exact-head review of PR #19537 at 951997b810273d434bb374118d1c0f203008692a: CHANGES REQUESTED — not CLEAN or READY.

Finding: P2 — Persisted recovery is still writable by stale and independent component owners

src/renderer/src/components/native-chat/use-structured-agent-session-recovery.ts:21-35,48-66 reserves from a component's outboxRef and replaces the entire stored queue without checking an authoritative operation revision or claiming the reservation. The ref-identity check fences only that component. Meanwhile use-structured-agent-session-outbox.ts:59-63 does not invalidate dispatch callbacks on unmount; its catch at :184-206 can write the old component's queue after a newer instance has advanced or parked the same operation.

A finite real-hook regression on unchanged committed product source reproduces:

• Start probe 1, unmount while its RPC is pending, reopen and exhaust the remaining budget. Reject the old RPC: persisted attempts change from 8/parked to 1/unparked. Reopen again: 15 total automatic probes, without Resume checking.
• The same rollback needs no exceptionally long RPC: settle the old request after three seconds, after the new owner has reserved attempt 3. Storage rewinds to attempt 1; reopening produces 9 probes.
• Mount two hook owners for the same session/operation and advance bounded fake timers: 16 probes, although storage reports an exhausted eight-attempt budget. This is a hook-boundary concurrency reproduction, not a manually demonstrated duplicate-pane path. The unmount/reopen failure independently establishes the shipping lifecycle defect.
• Positive control: one owner without a late predecessor callback performs eight probes and remains parked across remount.

These are manifestations of one missing ownership boundary. Persisting counters does not make reservations exclusive or progress monotonic within a recovery budget. Replace component-authored queue snapshots with a serialized, authoritative operation transition owner that coordinates all writers, consumes each reservation once, and prevents obsolete completions from restoring old budget/queue state. Explicit Resume checking may renew a budget; ordinary callbacks must not. Route late authoritative acceptance through the current owner so it can settle the operation and advance FIFO, while preserving operation identity, refusal handling, remote fence checks, and the separate force Retry contract. Adding only an unmount boolean would leave the concurrent-owner failure intact.

Functional correctness

Independently reran 56 existing focused tests, five files, zero failures, including outbox, recovery policy/hook, session and rendered-pane integration. Added a finite review harness: four tests, three expected-contract failures and one passing control, all nonzero test counts. The failures are enumerated above; they contradict operation-wide bounded lifetime despite the existing green suite. The harness imports the real shipping hook/storage/policy and mocks the transport boundary; it is not live network evidence. It leaves product bytes unchanged.

Architectural fit

The original failure is unlimited cumulative probing with attempts owned/reset by component lifecycle. Durable per-operation budget/deadline/parking and safe same-operation recovery are appropriate, but this implementation only removes the sequential ref-reset case; mutation authority still resides in each hook instance. The requested ownership correction is incomplete. Eight probes is an explicit initial policy: 79 seconds of scheduled delays plus RPC latency, not a measured optimum, inherited policy, or wall-clock completion SLA. The three-second reproduction does not depend on an unbounded RPC timeout.

Concrete precedent and deviations

Inspected src/shared/structured-agent-session-outbox.ts:100-119,164-185: correlated host settlement and identity/fingerprint-preserving request construction are reused. structured-agent-session-outbox-storage.ts:14-48 supplies legacy dispatching-to-unconfirmed reading and fallible whole-queue writes. These match identity and persistence reuse, not atomic recovery ownership. No external-reference alignment is claimed. No replacement transport, Git, provider-specific API, or execution-host policy is needed to state the invariant; contact loss remains unverifiable.

Validation and remaining gaps

Shipping path inspected: NativeChatView.tsx:12 mounts the session-keyed pane, use-structured-agent-session.ts:78 invokes the outbox hook, and the new recovery hook uses the same stored entries. Perf audit: deterministic request counts expose the failed operation-wide budget; no host stress or contention was run. Source review found no new broad scans, subprocess fanout, or timer lacking ordinary effect cleanup. Timer cleanup alone does not revoke outstanding write authority.

Existing tests exercise reservation/queued-transition write failures, ordinary deadline continuity, legacy entries, malformed metadata shapes, fence changes, late host acceptance/FIFO, and safe Resume versus force Retry. Storage read errors still collapse to an empty queue in the existing reader; subsequent transition writes remain fallible, and the parser accepts finite deadlines without validating all cross-field consistency. Those are residual persistence/deadline risks, not separately claimed new proven findings here. Downgraded writers can discard optional recovery metadata, as the PR correctly discloses.

Broad sequential node/web/CLI typechecks, ablation reruns, a fresh hidden Electron build and manual UI checks were deferred by coordination after the proven design failure. Author-reported typechecks, two committed-source ablations and seeded hidden-pane Resume checking remain author evidence, not independently rerun proof. No app or browser process was launched in this review. Live authenticated reconnect, rendered attachments, late acknowledgment, Windows/Linux and real SSH remain unverified; the author’s seeded unauthenticated rendering must not be broadened into those claims.

The PR body was read standalone first and accurately limits STA-6052/STA-6202 to automatic probe lifetime, excludes the contradicted quota-failed-new-enqueue story, and withholds whole-ticket closure/READY. Its claim of operation-owned recovery must be corrected by implementation. Final local HEAD, git ls-remote origin refs/pull/19537/head, and GitHub PR API all independently agree on the reviewed SHA. No product edits, merges, ticket posts, private profiles or unrelated cleanup occurred.

[brennanb2025]

Author correction pushed at 94c6bd06aed46b67ac78f8be5d7e92f350cf7667. Every production outbox write now passes through current-state serialized transitions with conditional revision/incarnation ownership; stale callbacks and concurrent owners share one durable eight-probe budget. Launch writers use the same owner, and revision stamping stays linear in queue size.

Validation: 90 tests across seven files passed; all three sequential explicit typechecks, changed-file lint, and fresh hidden Electron build passed. Final-head ablations failed the intended two revision controls and one force-Retry incarnation control, followed by exact restoration and eleven passing ownership tests. Fresh full-app Resume proof and instrumented Chromium lifecycle/storage controls are documented in the rewritten body; the latter use a substituted transport import and do not establish live authenticated reconnect or a duplicate-pane product route.

Fresh independent exact-head review is pending. Draft remains not READY; no merge or ticket closure. Remaining manual gaps include authenticated reconnect/attachments/late host acceptance, Windows/Linux, and real SSH.

[brennanb2025]

Independent exact-head review at 94c6bd06aed46b67ac78f8be5d7e92f350cf7667: CHANGES REQUESTED — not CLEAN or READY.

P2 — Orphaned first dispatch bypasses the budget after renderer restart. use-structured-agent-session-outbox.ts:77-80 converts orphaned dispatching entries without recovery metadata directly to queued. That is the ordinary shape of a pending first send. A restart therefore issues another send without reserving a recovery attempt. Independent real-hook control preserving crash-surviving storage and discarding owner memory observed 12 calls across 12 finite restart cycles, with no recovery field, versus a ceiling of one original send plus eight probes. The same schedule starting with an existing recovery budget stops at eight. This is a simulated renderer-loss schedule using real hook/storage modules and mocked transport, not an actual Electron crash test. Treat every orphaned persisted dispatch as uncertain and reserve recovery durably before another send; missing local claims do not establish non-delivery.

P2 — A pane winning the launch claim falsely settles the launch caller as undelivered. structured-agent-session-launch-prompt.ts:34-36,88-92 treats an unsuccessful claim as delivery failure. Stage a launch prompt, let the mounted local pane claim its RPC, invoke launch settlement for the same entry, then resolve that RPC accepted: one RPC, queue empty, but delivered:false and no onPromptDelivered. Launch-owned acceptance is a passing positive control. Publication/adoption can precede launch resolution (structured-agent-session-launch-recovery.ts:34-48); consumers use the callback for notes-delivered state, continuation notification and closing recovery UI. Launch callers must observe shared authoritative operation settlement regardless of which producer wins dispatch; do not restore duplicate sends or infer acceptance from queue absence.

Functional judgment: the previous rewind/concurrent-owner schedules are fixed. Independently reran 90 focused tests / seven files, all passing, plus four prior adversarial controls, all passing. The new boundary harness has two passing positive controls and four failing assertions: the two findings above, plus separate preexisting limitations (launch refusal lacks durable blocking and a failed completion write leaves no mounted recovery action). Those latter observations are not claimed as new regressions; the PR's blanket refusal-blocking claim needs qualification.

Architecture judgment: keep the synchronous current-state transition owner, but complete its durable initial-dispatch/restart and observable-settlement contract. The original send is separate from the eight recovery probes; its reservation must survive realm death before callback. Revision/incarnation checks solve the original stale-writer problem, but components and launch callers should observe one operation result rather than equate claim ownership with outcome.

Precedent/scope judgment: inspected all production writers and the main-window/default-partition versus separate dashboard-partition producers. Identity/fingerprint and host reconciliation are reused; centralized transition ownership is new. No distributed or cross-renderer mutex is established or claimed. Host acceptance remains authoritative; no transport, provider or Git changes are needed.

Validation: final-head revision ablation failed two of eleven controls; incarnation ablation failed one. Exact copy/cmp restoration, nonzero predicate checks and clean product diff were followed by 11/11 restored tests passing. Exact-head author node/web/CLI compilation evidence was reused with log hashes verified. No independent fresh Electron/manual run is claimed; actual renderer crash, authenticated reconnect, attachments, live-host late acceptance, Windows/Linux and real SSH remain gaps. Eight probes remains policy, not an empirical threshold; scope remains STA-6052/STA-6202 automatic probe lifetime only.

[brennanb2025]

Author restart/settlement correction is pushed at daf83559a1640f5aadfcd69a69133ba38d7982fc; local, remote branch, pull ref and PR API agree. Orphaned first sends now spend the durable eight-probe recovery allowance, and launch callers observe matching operation acceptance independently of the winning dispatcher.

Validation: 106 focused tests and the four original independent lifetime controls pass; four committed-source ablations fail their intended assertions with verified copy/cmp/predicate restoration; sequential explicit node/web/CLI typechecks, lint and fresh hidden Electron builds pass. The labeled shipping-hook fixture completed 12 actual renderer reloads with one initial call plus eight probes, then parking; another fixture observed one pane RPC and three exactly-once caller notifications. Full real-pane Resume and labeled fixture captures are in the rewritten body.

The newest independent boundary harness is 5/6: its preexisting completion-write-failure recovery-action control still fails, and the body explicitly says remount remains necessary. RPCs in reload/settlement fixtures are synthetic, not live-host evidence or process crashes; authenticated flows, live-host acceptance, real consumer flows, Windows/Linux and SSH manual checks remain gaps. The earlier fake-clock reload attempt stalled and is not passing evidence.

Fresh independent exact-head architecture/code review is required. This PR remains draft, not CLEAN or READY; no merge, Linear update or whole-ticket completion is claimed.

[brennanb2025]

Independent architecture/code review at exact head daf8355: CHANGES REQUESTED, not CLEAN or READY. Local HEAD, remote branch/PR ref and independent GitHub API agree. The prior orphan-first-dispatch budget bypass and lost-claim delivery finding are corrected.

P2 — Terminal persistence failure is not owned consistently. structured-agent-session-outbox-transitions.ts:30-40,66-67 settles unavailable only through its per-entry wrapper. Journal reconciliation (use-structured-agent-session-outbox.ts:100-108) and discard (structured-agent-session-launch-outbox.ts:37-38) use the bulk transition and leave the new launch observer waiting at structured-agent-session-launch-prompt.ts:113 after a failed write. A real-hook control stages a launch, fails persistence of accepted journal evidence, restores storage, and resolves the original RPC unknown: after 160 seconds of finite fake time, the caller is still pending, the entry is unconfirmed, error is null and no Resume action exists. No indefinitely pending transport is required. Successful journal persistence and failed RPC-acceptance persistence are positive controls: they respectively settle accepted and unavailable. Failed discard also leaves the caller pending; the actual cancel producer ignores that persistence result. Centralize terminal failure/observer disposal for all producers, preserving payloads and never fabricating accepted/discarded from a failed write. The old missing Resume display can remain a separately disclosed limitation; these new hanging-observer consequences cannot be dismissed as that old residual.

P2 — Longer observation lifetime retains completed caller history. structured-agent-session-launch-callers.ts:129-138,162,218-225 removes settled promises from the active-results set but retains callers and their fallback callbacks in group.entries; structured-agent-session-launch.ts:125-136 retains the group while any delivery is pending. A finite source schedule completes 64 overlapping caller deliveries, then exhausts recovery for the final operation: one parked operation / one active result / 65 caller registrations / 65 fallback callbacks. All transport has settled. The actual new-tab fallback closes over launch args, including prompt and Notes delivery callbacks. The WeakMap is not itself a strong receipt-history map; the separate launch registry is the proven root. The inherited group cleanup policy needs to match the newly extended parked-observation lifetime. Retire per-caller registrations and obsolete fallback closures when their obligations end, preserving externally held receipts and unresolved payloads.

Validation is deliberately separated:

• Independently rerun focused suite: 106/106, nine files; original lifetime schedules: 4/4; additional refusal-fallback/continuation controls: 10/10, two files.
• Previous boundary harness: 5 pass / 1 fail (known completion-error Resume assertion).
• New edge harness: 2 pass / 4 fail (journal write failure, failed discard, caller retention, finite unknown RPC after failed journal acceptance), exit 1. Two distinct ownership findings, not four inflated findings.
• Exact-head author node/web/CLI/build/ablation evidence reused and hash-audited; no independent broad compilation or new product ablation.
• Author evidence comprises seeded real-pane Resume captures, 12 actual renderer reloads with synthetic RPC transport, and a labeled one-RPC/three-caller fixture. Reloads are not process crashes, and that fixture is not a real Notes/continuation consumer flow. No new independent rendered validation or live-host/platform/SSH proof is claimed.

The serialized operation owner, durable budget and explicit shared acceptance are appropriate; complete their failure and consumer-retirement contract rather than add component guards. Inspected shared identity/fingerprint/journal and local storage precedent; observable settlement ownership is new, not inherited atomic precedent. No additional direct outbox storage producer was found; launch FIFO and structured refusal blocking now pass. Scope remains STA-6052/STA-6202 automatic probe lifetime only; eight additional probes is initial policy, not empirical. No quota-new-send diagnosis, full-ticket completion, merge or closure claim.

Durable review and source harness: .qa/next-batch-author/restart-settlement-independent-review.md/json, restart-independent-edges.test.tsx, and matching logs. Product bytes and earlier evidence are preserved.

[brennanb2025]

Author R3/R4 correction pushed at e9c73bd57280e33c22cb5bf5729b4b871ca63b1e; fresh independent exact-head review pending, not CLEAN or READY. Prior reviewer findings are not self-cleared.

The common operation owner now ends affected observations as unavailable when persistence fails, including journal/discard, without publishing durable acceptance or discard. Cancellation returns false before cancellation/abandonment when discard fails. Completed caller memberships and obsolete fallback closures retire after their obligations settle; external receipts and unresolved parked work remain valid.

Validation: 116 focused tests, ten consumer controls, four original lifetime controls and all six independent R3/R4 edge controls pass; three explicit sequential TypeScript projects, changed-file lint and fresh hidden builds pass. Three committed-source ablations fail the intended controls and restored source passes. Full hidden-pane captures and labeled synthetic Chromium fixtures were inspected, including 64 completed receipts plus one parked caller with zero obsolete fallback callbacks and 73 RPCs.

The older Resume-display assertion still fails (five pass/one fail in the prior boundary harness); failed observation hangs are corrected, mounted persistence recovery is not claimed solved. Live-host delivery, real Notes/continuation/cancellation UI, authenticated reconnect, attachments, process crashes, Windows/Linux and SSH remain unverified. Earlier twelve-reload evidence belongs to daf8355 and was not repeated here. Local, remote branch, pull ref and GitHub API agree on this head; draft remains open, with no ticket closure or related Linear publication.

[brennanb2025]

Independent correction review at e9c73bd57280e33c22cb5bf5729b4b871ca63b1e: CHANGES REQUESTED — not CLEAN or READY. Local, remote branch/pull ref and GitHub API agree; product source was read-only.

P2, R3 follow-up: failed cancellation loses its retry registration after launch publication. The early false return at src/renderer/src/lib/structured-agent-session-launch.ts:308-309 does not preserve the registration once failed discard settles its delivery observation unavailable. structured-agent-session-launch-callers.ts:157-160 then removes the last delivery obligation and calls onSettled; launch.ts:132-136 cleans up the registry. A finite test using real start/cancel/registry/outbox/caller modules resolves create/publication and send unknown, fails discard storage, restores storage, and flushes settlement: initial cancel false, status idle, retry cancel false, original payload retained, zero intent-abandon calls. All 24 existing launch controls pass; this added published-case control fails. The existing cancellation test covers only a still-pending create.

Keep common unavailable settlement and per-caller retirement, but make cancellation persistence/retry an explicitly owned obligation independent of terminal delivery receipts. Do not retain completed fallback closures or leave observers pending merely to pin the registry. Actual tab-close and worktree-creation consumers ignore the boolean and have separate host-close behavior; they do not establish successful durable cancellation or an actionable retry surface. Cancellation registration/retry claims need this lifecycle correction and evidence.

Independently passed 116 focused tests/11 files, the original six edge controls, four lifetime controls, and ten refusal-fallback/continuation controls. The six edges now confirm unavailable journal/discard failure without false acceptance and one retained caller/zero obsolete callbacks after 64 completions plus parking. The older boundary harness remains 5 pass/1 fail solely for the disclosed missing mounted Resume action; the new cancellation harness is 24 pass/1 fail. The common observer hang is corrected, but the cancellation consequence prevents a blanket clean lifecycle judgment.

Audited 7 source hashes and 67 author-evidence hashes, all matching, including author three-check compilation/three-ablation evidence; those are author runs. Inspected six full-app author captures: seeded unauthenticated Resume UI and labeled shipping-hook synthetic transport/storage diagnostics, not real Notes/continuation/cancellation UI or live-host delivery. No independent app launch or broad build rerun was performed. Twelve actual renderer reloads remain earlier daf83559 evidence, not current-head reruns. Real consumer UI, authenticated reconnect/attachments/late host acceptance, process crashes, Windows/Linux and SSH remain unverified; no related issue publication or closure is approved.

[brennanb2025]

Author cancellation correction at 9634184fdfc8ecb9f1a10841dabfc0928df5ea3f: failed discard now owns a separate session/incarnation persistence obligation after delivery/fallback settlement. The published-case independent harness is 25/25; 125 focused controls in 17 files, six independent edges, four lifetime controls, both sensitive ablations, all three sequential TypeScript checks and fresh hidden Electron build pass. The old mounted Resume boundary remains 5 pass/1 fail and is explicitly disclosed.

The real tab-close button was exercised with synthetic host responses and a targeted storage failure: tab removed, delivered:false, one retained payload, cancellation pending; diagnostic cancel retry after storage restoration persisted removal and returned idle. This is not live-host or a product retry-UI claim. In-memory retry, reload durability and host-close authority are distinguished in the rewritten body and captures.

Fresh independent exact-head architecture/code/wording review is required; prior CHANGES REQUESTED is not self-cleared, and this draft is not CLEAN or READY. No Linear posts or merges.

[brennanb2025]

Independent review at 9634184fdfc8ecb9f1a10841dabfc0928df5ea3f: CHANGES REQUESTED — not CLEAN or READY. Local HEAD, remote branch/pull ref and independent GitHub API agree.

P2: failed storage reads can falsely complete cancellation and erase retry ownership. src/renderer/src/lib/structured-agent-session-launch-cancellation.ts:55-67 treats transition ok as proof of removal/absence, then deletes the obligation and abandons the intent. But storage.ts returns an empty queue when getItem throws, and transitions.ts:15-18 returns ok for an unchanged empty queue without writing. Independent finite reproduction after published unknown delivery and an initial failed discard: retry returns true, status becomes idle, abandonment fires once, zero removal calls occur, and the payload remains after reads recover; the next cancel returns false. The new harness passes 25 controls and fails this one assertion (exit 1).

The separate persistence owner correctly fixes the preceding caller-retirement coupling for readable storage. Preserve it and the R3/R4 unavailable settlement, fallback/caller retirement, external receipts, generation and incarnation fencing. Carry explicit read failure through target acquisition and retirement so unavailable storage cannot prove absence; do not indiscriminately recapture later operations on retry. The preexisting empty fallback does not excuse this new successful-cancellation/abandonment consequence, and the current retirement wording needs correction.

Independent validation: 146 focused tests in 17 files pass (an overlapping selection, not the author's identical 125-test selection); original published harness 25/25, edges 6/6, lifetime 4/4 pass. Older boundaries remain 5 pass/1 fail, solely failed completion persistence exposes a recovery action without remount. Zero skipped/zero-count runs. All 5 source and 60 author evidence hashes match; audited three sequential tsc exits, hidden build and 6/7 + 1/7 ablation failures/restores, without independent compiler/build/ablation execution.

Inspected concrete transition/storage/settlement, identity/fingerprint, launch/fallback and close-consumer source. Reuse matches those mechanisms; cancellation lifetime is new and its retirement evidence remains incomplete. No external-reference alignment claimed. The owner holds no completed caller history; retry/disposal counts pass, with queue-size costs and in-memory-only/permanent-failure limits explicitly retained.

Inspected all three full-app captures and instrumentation: actual tab-close button with synthetic RPC/storage, followed by labeled diagnostic API retry. This is neither product cancellation retry UI nor live-host evidence. Close consumers ignore the boolean and host close remains separate. No independent app launch, crash or cancellation recovery reload; authenticated host, worktree-create cancellation UI, Notes/continuation UI, Windows/Linux and real SSH remain gaps. The author reading-order deviation and initial wrapper exit ambiguity remain disclosed; final body readback matches the saved artifact. No overall findings self-cleared, Linear publication approved, or readiness inferred.

[brennanb2025]

Author readable-outbox correction pushed at c2d4c3d401bbf7c1e0db924587f0e32145a39c0f. Fresh independent exact-head architecture/code and wording review is pending; prior CHANGES REQUESTED remains, not CLEAN or READY.

The storage/transition authority now distinguishes readable, unavailable and invalid state; an unreadable queue cannot authorize a write or successful no-op. Live launch target tracking preserves captured incarnation authority when cancellation's initial read fails. Focused tests pass 166/166 in 19 files; the independent read-error control changes from 25 pass/1 fail to 26 pass. Final ablations fail 7/15 and 2/2, then restore byte-exactly; sequential node/web/CLI typechecks, lint and fresh hidden Electron build pass.

Actual tab-close with a read fault activated at the click preserves pending cancellation, one payload and zero writes; unreadable retry returns false, then read restoration plus diagnostic API retry returns true/idle/retained0. This is synthetic-host real-route evidence with labeled diagnostic overlays, not product retry UI or live-host validation.

A separate unresolved schedule is preserved prominently in the body: pane mount while storage is unreadable can settle delivery unavailable and retire launch registration before cancellation is requested. The finite real-hook characterization observes idle before close, cancel false before/after restoration, retained1 and abandon0. This does not fabricate success, but does not preserve later cancellation authority; fresh review must judge architectural fit and scope. The old mounted Resume-action control also remains 5 pass/1 fail. No blanket cancellation/reload/live-host guarantee, merge, or related Linear publication is claimed.

[brennanb2025]

Fresh independent architecture review of c2d4c3d401bbf7c1e0db924587f0e32145a39c0f: CHANGES REQUESTED — not CLEAN or READY. Local HEAD, remote branch/pull ref and independent GitHub API agree; no product edits were made.

P2: cancellation authority must survive caller cleanup before a cancellation request. structured-agent-session-launch.ts:129-142 disposes the target tracker with completed caller registration; :256-273 cannot create a cancellation obligation without that registration. Independently reproduced the disclosed finite real-hook schedule: published unknown send, getItem failure, then pane mount with null fence/empty submissions. Unavailable observation settles delivery and retires the registry. Observed idle before close, cancel false while unreadable and after restoration, retained payloads 1, abandonment calls 0. A fresh correctness oracle fails on restored cancellation returning false.

This resolves the requested scope/architecture judgment: the gap is in scope and requires a focused ownership correction. Preserve session/incarnation cancellation authority independently before the request, then freeze/transfer it to the existing requested persistence owner; retire it only on positive removal/replacement/absence evidence. Keep final unavailable receipts, completed caller/fallback disposal, weak external receipts, revision/incarnation fences and finite deferred retries. Do not pin completed callers or rewrite the transport.

P2, previously disclosed: mounted completion-write failure still has no Resume action. use-structured-agent-session-outbox.ts:134-145,217-221 reports failed persistence then forgets its live claim, leaving dispatching state; the recovery projection requires unconfirmed state and does not receive this failure. The existing boundary oracle again fails solely failed completion persistence exposes a recovery action without remount. Provide an actionable mounted recovery path that reconciles readable orphan uncertainty and preserves the saved probe allowance and operation/body identity. This is an existing gap, not newly introduced by the latest correction.

The prior read-error false-success finding is corrected. Independent focused validation passes 166/166 in 19 files; independent controls are 41 pass/2 fail in 5 files (43 total): read-error 26/26, edges 6/6, lifetime 4/4, older boundaries 5/6, fresh pre-request 0/1. Zero skips. Overlapping controls are not summed as distinct coverage. R3/R4 serialization, orphan budgeting, shared acceptance and completed caller retirement remain supported by the passing controls.

Audited 9 current source hashes, 96 correction evidence hashes and 18 prior independent evidence hashes, all matching. Inspected concrete storage/transition/settlement and consumer mechanisms; no external alignment claimed. Inspected the three full-app author captures and synthetic RPC instrumentation: the actual close surface succeeds in preserving cancellation when the read fault starts at the click, followed by a diagnostic API retry. This does not cover authority loss before the request or constitute live-host/product retry-UI evidence. No independent app launch, compilation or ablation was performed; the test slot is released. Independent rendered failing-schedule checks, real host/platform/reconnect/crash validation and formal reliability/performance budgets remain gaps.

Current body accurately discloses the limitations and matches its saved artifact. Disclosure does not clear the ownership defects; no related issue publication, completion or readiness approval follows.

[brennanb2025]

Author correction at 257ba542c0bd11f4d14358da5e61d915e321996b; fresh independent exact-head architecture/code and wording review is pending. Prior CHANGES REQUESTED is not self-cleared: not CLEAN or READY, PR remains draft.

Both fresh P2 mechanisms were corrected. Cancellation identity now exists before staging and survives caller retirement using session/workspace metadata and current incarnation keys; requested targets freeze independently. Mounted recovery subscribes to live dispatch ownership and exposes an actionable Resume for the unobserved ordinary orphan left by failed completion persistence, preserving the saved allowance and rejecting still-live claims.

Validation: 176 focused tests in 22 files; 43/43 prior independent controls with three mock argument assertions adapted to the intentionally reduced abandonment identity (unadapted: 40 pass/3 shape failures). The two fresh correctness oracles pass. Four committed-source ablations fail 2/2, 3/5, 1/5 and 2/5, with cp/cmp/nonzero-symbol restoration; an initial test-spy cleanup defect is fixed in the final test-only commit. Final sequential node/web/CLI typechecks, lint and fresh hidden Electron build pass.

Observed actual UI in a fresh synthetic profile: Close tab with read failure active before the request and separately at the click preserves pending cancellation/one payload/zero removals, then diagnostic API retry after restoration removes it. Actual mounted Resume stays actionable on write failure, then reserves probe four from saved three and sends an identical request without retryUnknown, with unchanged renderer token and subscription count. Synthetic acceptance clears the outbox without upgrading the original unavailable receipt. Nine full-app captures were inspected; the rewritten body links representative evidence.

RPC call/subscription boundaries are synthetic; no real credentials or live-host result is claimed. Cancellation remains in-memory with no product cancellation retry UI; host-observed/explicit-force recovery policies, initial unavailable display, malformed/downgrade limits remain. Real worktree-create cancellation UI, authenticated reconnect/attachments/late acceptance, Notes/continuation, process crashes and Windows/Linux/real SSH remain unverified. The owned hidden app is stopped and ports are empty; no Linear publication or merge occurred.

[brennanb2025]

Independent review at 257ba542c0bd11f4d14358da5e61d915e321996b: no product issues found within the documented single-main-renderer scope. Functional/architectural review is CLEAN; this is not READY or merge approval.

Independent reruns pass 176 focused tests in 22 files and reproduce all four committed-source ablation sensitivities (2/2, 3/5, 1/5 and 2/5 failures), with verified copy/cmp/symbol restoration and clean tracked source. The unchanged prior selection is 40/43 with three cancellation argument-shape failures. Correction to the earlier author count: its adapted copy changes four assertions, including one already-passing staging-refusal assertion; broad worktree/session matching alone does not prove unchanged oracles. A further independent copy preserves the original staging-refusal assertion, changes only the three cancellation assertions to exact worktree/session/agent identity without create params, and passes 43/43. Other behavioral assertions remain unchanged; overlapping counts are not additive.

The independent review inspected all nine uncropped author captures plus action, identity, listener, profile and cleanup receipts. They support real Close/Resume UI actions with synthetic RPC/storage boundaries and final unavailable receipts; they do not prove live-host delivery or product cancellation retry UI. No independent app launch is claimed by this review.

The located terminal-session-reliability skill was applied. Missing reliability-manifest integration and unmeasured production latency/heap are explicitly accepted coordinator review gaps, supported by finite count/cleanup and red/green evidence; required manual validation and remaining platform/host/reload gaps are not waived. Exact corrected PR-body wording is independently approved for coordinator publication/readback; publication and separately coordinated required manual validation remain gates. No related Linear drafts are approved or published.

[brennanb2025]

Correction to the earlier author validation summary at 257ba542c0bd11f4d14358da5e61d915e321996b: three tests failed in the unadapted 43-test selection, but the author copy changed four abandonment assertions, including an already-passing staging-refusal assertion, to broad worktree/session matching. Independent reruns preserve the original staging-refusal oracle and use exact worktree/session/agent equality only for the three cancellation assertions; all 43 pass without changing other behavioral assertions. The historical author report remains preserved, and this clarification supersedes its assertion-change count; it does not expand synthetic evidence into live-host validation or establish READY.

[brennanb2025]

Closing as obsolete: main no longer has the code this PR changes, or already behaves as it intended. The desktop outbox was removed by #25959 (0f9f199, 'no saved outbox on the desktop'). The outbox storage, hook and shared modules this PR changes are

(Stale-PR cleanup 2026-10-20, approved by Brennan. Reopen if something here is still missing on main.)