# A Message Is Not Accepted Until Codex Accepts It

The new Work Room composer looked simple: type a follow-up, press Enter, and
keep talking to the same Codex thread. Its first implementation had a subtle
lie. Host put the text in a mailbox and immediately acknowledged it. The browser
cleared the draft. If the native turn completed before Codex drained that
mailbox, the message had never reached Codex and the one recoverable copy was
already gone.

Calling that acknowledgement a success confused two different facts. A mailbox
enqueue says that ConnectOnion accepted responsibility for a message. It does
not say that the native provider accepted the message. The same difference
appears after a terminal turn: starting a worker says nothing about whether
`thread/resume` and `turn/start` will succeed.

We considered keeping the fast acknowledgement and adding a second warning on
failure. That still made the browser discard the operator's only draft before
the important operation finished. We instead narrowed the promise. A positive
`PROVIDER_INPUT_ACK` now means one of two precise outcomes:

- Codex accepted `turn/steer` for the active native turn; or
- an owned terminal thread resumed and `turn/start` returned a new native turn.

Everything before that is routing progress, not delivery. The browser holds the
draft while it waits. A rejection, a terminal race, or a timeout therefore
leaves the exact text available to retry instead of asking a person to remember
what disappeared.

The direct path stays equally narrow. A live message steers the app-server turn.
A terminal one atomically claims only the caller's own durable Codex invocation,
then calls the Codex tool directly. Neither route sends an outer `INPUT` frame
or calls `Agent.input()`, so the COAI model never gets a chance to rewrite a
native Work Room conversation.

That one acknowledgement distinction also made the UI calmer. The composer can
be honest about “sending” without inventing a local chat bubble; the native user
message appears only after Codex starts the turn, and the assistant response
arrives as a bounded native message. The Work Room can show the current
conversation, one current state, and optional real visual evidence without
trying to compensate for a missing delivery guarantee with more panels.

The regression tests now cover both halves: Host does not emit a false positive
ACK for a queue, and the native adapter emits one only after successful steering
or native turn start. This is the same rule as scoped Stop: intent, delivery,
and outcome are different states, and the browser should never render them as
one fact.