fix(native-chat): no saved outbox on the desktop; one send at a time, and the host owns what it accepted

config/reliability-gates.jsonc

@@ -1466,27 +1466,25 @@
       "providers": ["local", "ssh", "remote-runtime", "mobile"],
       "coveredPlatforms": ["macos"],
       "coveredProviders": ["local", "mobile"],
-      "coverageNotes": "Deterministic host, renderer, direct/Relay transport, and mobile hook tests cover durable identity, caller changes, journal loss, acknowledgement loss, expiry, and remount. The host code is execution-location neutral, but live SSH/remote runtimes and physical iOS/Android lifecycle are not exercised.",
+      "coverageNotes": "Deterministic host, direct/Relay transport, and mobile hook tests cover durable identity, caller changes, journal loss, acknowledgement loss, expiry, and mobile remount; renderer tests cover the desktop's single request per send, its 30 s bound and the hand-back. The host code is execution-location neutral, but live SSH/remote runtimes and physical iOS/Android lifecycle are not exercised.",
       "motivatingLinks": ["https://github.com/stablyai/orca/pull/20133"],
-      "invariant": "One structured-send operation id causes at most one provider dispatch. A recorded or transport-ambiguous send reuses that id across retry, caller reconnect, client remount, and journal recovery; only a terminal rejection may rotate to a first delivery.",
+      "invariant": "One structured-send operation id causes at most one provider dispatch. On the phone a transport-ambiguous send reuses that id for every resend and caller reconnect, across remount and journal recovery. The desktop never resends: each send makes one request, and an ambiguous or unanswered one, or one still out after 30 s, hands the text back to check; a send unsettled at a reload or crash is not resent. Only a terminal rejection may rotate to a first delivery.",
       "oracle": "Inject adapter acknowledgement loss, RPC response loss, caller replacement, logical-client close after response, auth recovery with a written request, missing journal submissions, legacy pending rows, stale fences, operation expiry, mobile remount, and durable-journal capacity. Assert one provider dispatch or one operation id for every ambiguous retry, fresh identity only after rejection, and no eviction of ambiguous mobile ids.",
       "commands": [
-        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-disposition.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.probe.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
+        "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
         "ORCA_BACKGROUND_LAUNCH=1 pnpm --dir mobile test ../mobile/src/session/mobile-native-chat-image-attachment.test.ts ../mobile/src/session/use-mobile-native-chat-image-attachments.test.ts ../mobile/src/session/mobile-structured-send-operation-journal.test.ts ../mobile/src/session/mobile-structured-send-delivery.test.ts ../mobile/src/session/use-mobile-structured-agent-session-send.test.tsx ../mobile/src/session/use-mobile-structured-agent-session.test.tsx ../mobile/src/transport/mobile-relay-rpc-session.test.ts ../mobile/src/transport/rpc-client-delivery-ambiguity.test.ts ../mobile/src/transport/stable-logical-rpc-client.test.ts"
       ],
       "testFiles": [
         "src/shared/agent-session-operation-ledger.test.ts",
-        "src/shared/structured-agent-session-send-disposition.test.ts",
+        "src/shared/structured-agent-session-send-evidence.test.ts",
         "src/main/runtime/agent-session-operation-admission.test.ts",
         "src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts",
         "src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts",
         "src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts",
         "src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts",
         "src/main/runtime/orchestration/structured-pointer-operation-id.test.ts",
-        "src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx",
+        "src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts",
         "src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx",
-        "src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx",
-        "src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.probe.test.tsx",
         "src/renderer/src/lib/launch-structured-agent-session.test.ts",
         "mobile/src/session/mobile-native-chat-image-attachment.test.ts",
         "mobile/src/session/use-mobile-native-chat-image-attachments.test.ts",
@@ -1551,19 +1549,21 @@
           "assertions": ["keeps a synchronous pre-write relay failure definite"]
         },
         {
-          "file": "src/shared/structured-agent-session-send-disposition.test.ts",
-          "assertions": ["never rotates $state operation after its host tombstone expires"]
+          "file": "src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts",
+          "assertions": [
+            "gives back at once, as unconfirmed, a send whose request threw, and never sends it again"
+          ]
         }
       ],
       "evidenceRuns": [
         {
-          "date": "2026-10-04",
+          "date": "2026-10-06",
           "runner": "local",
           "platform": "macos",
-          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-disposition.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/use-structured-agent-session-outbox.test.tsx src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.test.tsx src/renderer/src/components/native-chat/NativeChatStructuredSessionDelivery.probe.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
+          "command": "ORCA_BACKGROUND_LAUNCH=1 pnpm test src/shared/agent-session-operation-ledger.test.ts src/shared/structured-agent-session-send-evidence.test.ts src/main/runtime/agent-session-operation-admission.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-refusal-retry.test.ts src/main/native-chat/agent-session-wire/structured-agent-session-send.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-delivery.test.ts src/main/runtime/orchestration/structured-mailbox-pointer-host.test.ts src/main/runtime/orchestration/structured-pointer-operation-id.test.ts src/renderer/src/components/native-chat/structured-agent-session-message-sender.test.ts src/renderer/src/components/native-chat/use-structured-agent-session.test.tsx src/renderer/src/lib/launch-structured-agent-session.test.ts",
           "result": "passed",
-          "durationSeconds": 42.3,
-          "summary": "Thirteen focused host, shared, renderer, and orchestration files passed 197 tests after the delivery probe tests moved to their own file."
+          "durationSeconds": 14,
+          "summary": "Eleven focused host, shared, renderer, and orchestration files passed 173 tests after the desktop outbox gave way to the in-memory sender, which makes one request per send and never resends."
         },
         {
           "date": "2026-09-12",

config/scripts/pr-code-change-scope-cross-version-send-path.test.mjs

@@ -8,7 +8,6 @@ describe('cross-version wire routing for the send path', () => {
     'src/shared/agent-session-wire-refusals.ts',
     'src/shared/structured-agent-session-mutation.ts',
     'src/shared/structured-agent-session-send-mutation.ts',
-    'src/shared/structured-agent-session-outbox.ts',
     'src/main/runtime/rpc/core.ts',
     'src/main/runtime/rpc/errors.ts',
     'src/main/runtime/rpc/rpc-streaming-dispatcher.ts',
@@ -23,9 +22,7 @@ describe('cross-version wire routing for the send path', () => {
   })
 
   it.each([
-    'src/shared/structured-agent-session-outbox-admission.ts',
-    'src/shared/structured-agent-session-outbox-delivery.ts',
-    'src/shared/structured-agent-session-outbox-stop-withdrawal.ts',
+    'src/shared/structured-agent-session-send-evidence.ts',
     'src/shared/structured-agent-session-composer.ts',
     'src/shared/structured-agent-session-reducer.ts',
     'src/main/runtime/orchestration/send-agent-turn.ts',

config/scripts/pr-code-change-scope.mjs

@@ -193,7 +193,6 @@ const CROSS_VERSION_WIRE_PREFIXES = [
   // fingerprint the host's ledger and journal re-derive.
   'src/shared/structured-agent-session-mutation.ts',
   'src/shared/structured-agent-session-send-mutation.ts',
-  'src/shared/structured-agent-session-outbox.ts',
   'src/shared/agent-session-record',
   'src/shared/agent-session-provider-handle',
   'src/shared/agent-session-journal-',

mobile/src/session/mobile-structured-agent-session-send.ts

@@ -2,7 +2,7 @@ import type { AgentSessionSendResult } from '../../../src/shared/agent-session-w
 import {
   structuredAgentSessionSendBody,
   type StructuredAgentSessionAttachment
-} from '../../../src/shared/structured-agent-session-outbox'
+} from '../../../src/shared/structured-agent-session-send-mutation'
 import {
   structuredAgentSessionDomainFingerprint,
   structuredAgentSessionPayloadFingerprint

mobile/src/session/mobile-structured-queued-message-cards.ts

@@ -6,7 +6,7 @@ import { readWholeAgentSessionFailureFact } from '../../../src/shared/agent-sess
 import type { AgentJournalSubmission } from '../../../src/shared/agent-session-journal-types'
 import { agentSessionWriteNoticeEnglish } from '../../../src/shared/agent-session-refusal-notice'
 import { dispatchWasWithdrawn } from '../../../src/shared/structured-agent-session-dispatch-rejection'
-import { structuredAgentSessionAttemptFailureParts } from '../../../src/shared/structured-agent-session-send-disposition'
+import { structuredAgentSessionAttemptFailureParts } from '../../../src/shared/structured-agent-session-rejection-words'
 import {
   QUEUED_MESSAGE_PAUSED_SEND_FAILED,
   type AgentSessionQueuedMessage,

mobile/src/session/mobile-structured-send-delivery.ts

@@ -35,7 +35,7 @@ import type { AgentJournalSubmission } from '../../../src/shared/agent-session-j
 import type { AgentSessionSendResult } from '../../../src/shared/agent-session-wire'
 import { agentSessionRefusalOperationState } from '../../../src/shared/agent-session-refusal-retry'
 import { agentSessionWriteNoticeEnglish } from '../../../src/shared/agent-session-refusal-notice'
-import { structuredAgentSessionRejectionNotice } from '../../../src/shared/structured-agent-session-send-disposition'
+import { structuredAgentSessionRejectionNotice } from '../../../src/shared/structured-agent-session-rejection-words'
 import { dispatchWasWithdrawn } from '../../../src/shared/structured-agent-session-dispatch-rejection'
 import type { MobileNativeChatSendOutcome } from './mobile-native-chat-send'
 import type { StructuredAgentSessionMutationCallResult } from './mobile-structured-agent-session-rpc'

mobile/src/session/use-mobile-structured-send-with-outcome.ts

@@ -9,7 +9,7 @@ import { pendingPromptsAllUnanswerableHere } from '../../../src/shared/agent-ses
 import {
   structuredAgentSessionSendBody,
   type StructuredAgentSessionAttachment
-} from '../../../src/shared/structured-agent-session-outbox'
+} from '../../../src/shared/structured-agent-session-send-mutation'
 import type { StructuredAgentSessionComposerOptions } from '../../../src/shared/structured-agent-session-composer'
 import type { StructuredAgentSessionState } from '../../../src/shared/structured-agent-session-reducer'
 import type { RpcClient } from '../transport/rpc-client'

src/main/claude/claude-structured-history-window.test.ts

@@ -5,7 +5,7 @@ import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises'
 import { tmpdir } from 'node:os'
 import { join } from 'node:path'
 import { afterEach, beforeEach, describe, expect, it } from 'vitest'
-import { structuredAgentSessionSendBody } from '../../shared/structured-agent-session-outbox'
+import { structuredAgentSessionSendBody } from '../../shared/structured-agent-session-send-mutation'
 import { structuredAgentSessionPayloadFingerprint } from '../../shared/structured-agent-session-mutation'
 import { computeAgentSessionPayloadFingerprint } from '../../shared/agent-session-mutation-envelope'
 import { reconcileSubmissions } from '../native-chat/agent-session-journal/journal-submission-reconciler'

src/main/native-chat/agent-session-journal/journal-dispatch-doubt-reasons.ts

@@ -11,6 +11,8 @@
 // exists to remove, and a user who wants the message sent anyway rotates the id
 // — one re-typed message, and a first delivery by construction.
 
+import { STRUCTURED_AGENT_SESSION_SUBMISSION_MISSING } from '../../../shared/structured-agent-session-send-evidence'
+
 /** A previous process wrote the message and died before learning its outcome. */
 export const DISPATCH_DOUBT_HOST_RESTARTED = 'host_restarted_before_acknowledgement'
 
@@ -21,7 +23,7 @@ export const DISPATCH_DOUBT_PROVIDER_EXITED = 'provider_exited_before_acknowledg
 export const DISPATCH_DOUBT_PERSISTENCE_FAILED = 'dispatch_result_persistence_failed'
 
 /** The operation tombstone survived recovery but its journal submission did not. */
-export const DISPATCH_DOUBT_SUBMISSION_MISSING = 'durable_send_submission_missing'
+export const DISPATCH_DOUBT_SUBMISSION_MISSING = STRUCTURED_AGENT_SESSION_SUBMISSION_MISSING
 
 /** The provider reported its thread not running with no turn open, so nothing is
  *  left that could still acknowledge the message. */

src/main/native-chat/agent-session-wire/structured-agent-session-host-test-data.ts

@@ -6,7 +6,7 @@ import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-ses
 import type { AgentSessionExecutionLocation } from '../../../shared/agent-session-record'
 import { projectNativeChatTranscriptMessages } from '../../../shared/native-chat-transcript-projection'
 import { projectStructuredAgentSessionMessages } from '../../../shared/structured-agent-session-message-projection'
-import { createStructuredAgentSessionOutboxEntry } from '../../../shared/structured-agent-session-outbox'
+import { structuredAgentSessionSendBody } from '../../../shared/structured-agent-session-send-mutation'
 import { attachFingerprintFields } from './structured-agent-session-attach'
 import type { AgentSessionAttachParams } from './structured-agent-session-attach'
 
@@ -74,17 +74,13 @@ export function hostTestDrawnRowIds(
   snapshot: AgentJournalSnapshot,
   sent: readonly { clientMessageId: string; text: string }[]
 ): string[] {
-  const outbox = sent.map((message) => ({
-    ...createStructuredAgentSessionOutboxEntry({
-      ...message,
-      sessionId: HOST_TEST_SESSION,
-      attachments: [],
-      queuedAt: HOST_TEST_NOW
-    }),
-    state: 'dispatching' as const
+  const optimistic = sent.map((message) => ({
+    clientMessageId: message.clientMessageId,
+    body: structuredAgentSessionSendBody(message.text, []),
+    queuedAt: HOST_TEST_NOW
   }))
   return projectNativeChatTranscriptMessages(
-    projectStructuredAgentSessionMessages(snapshot.items, outbox, snapshot.submissions, {
+    projectStructuredAgentSessionMessages(snapshot.items, optimistic, snapshot.submissions, {
       rejectedInPlace: true
     })
   ).map(({ id }) => id)

src/main/native-chat/agent-session-wire/structured-agent-session-unsent-send-hold.test.ts

@@ -9,7 +9,7 @@ import { agentSessionFailureWords } from '../../../shared/agent-session-failure-
 import { computeAgentSessionPayloadFingerprint } from '../../../shared/agent-session-mutation-envelope'
 import type { AgentMessageSource } from '../../../shared/agent-session-message-source'
 import { projectStructuredAgentSessionMessages } from '../../../shared/structured-agent-session-message-projection'
-import { createStructuredAgentSessionOutboxEntry } from '../../../shared/structured-agent-session-outbox'
+import { structuredAgentSessionSendBody } from '../../../shared/structured-agent-session-send-mutation'
 import { AgentSessionJournal } from '../agent-session-journal/journal-store'
 import { JournalQueuedMessages } from '../agent-session-journal/journal-queued-messages'
 import { openAgentSessionJournal } from '../agent-session-journal/journal-store-factory'
@@ -254,15 +254,11 @@ describe('the next accepted turn releases a kept card', () => {
     if (!page.ok) {
       throw new Error('history refused')
     }
+    // The sending desktop's own bubble, had it not settled yet.
     const lingering = {
-      ...createStructuredAgentSessionOutboxEntry({
-        clientMessageId: id,
-        sessionId: SESSION,
-        text: 'the kept words',
-        attachments: [],
-        queuedAt: 1
-      }),
-      state: 'rejected' as const
+      clientMessageId: id,
+      body: structuredAgentSessionSendBody('the kept words', []),
+      queuedAt: 1
     }
     const shown = projectStructuredAgentSessionMessages(
       page.page.items,

src/main/runtime/rpc/methods/agent-launch-structured-prompt.test.ts

@@ -9,7 +9,7 @@
 import { describe, expect, it, vi } from 'vitest'
 import { commitStructuredAgentSessionLaunchPrompt } from './agent-launch-structured-prompt'
 import { structuredAgentSessionPayloadFingerprint } from '../../../../shared/structured-agent-session-mutation'
-import { structuredAgentSessionSendBody } from '../../../../shared/structured-agent-session-outbox'
+import { structuredAgentSessionSendBody } from '../../../../shared/structured-agent-session-send-mutation'
 import type { StructuredAgentSessionHost } from '../../../native-chat/agent-session-wire/structured-agent-session-host'
 import { recordingStructuredAgentSessionLogger } from '../../../native-chat/agent-session-wire/structured-agent-session-logger-test-support'