Fallback prose path posts text written beside a private think() #296

An agent whose same_round_think_text_policy is private has the text it writes beside think() posted to its channel whenever its turn takes the fallback prose path. That path covers XML tool mode, and native mode on a membrane without roundContent. On the native path, that text is withheld (src/framework.ts:9833–9884 at 02adf27).

Why it happens. The fallback routes the whole turn's prose once, at turn end, and its only filter is silenced = turnSilenced || toolNames.some(isSilencingTool) (:10377–10383). think isn't a silencing tool (:157), and nothing on this path reads the policy.

Why it matters. The policy text the agent is given (:2716) says that "ordinary text emitted in the SAME native assistant round as think() is withheld from channel routing". An agent that chooses private relies on that to reason in the open beside think. On this path, that reasoning reaches the channel: the one outcome the policy exists to prevent, and one the agent can't take back. The text says "native", but nothing tells an agent in XML tool mode that its rounds don't count, so the promise reads as covering it.

What I'd propose: apply the same-round rule at turn end, as the native path does per round.

• Rounds can be recovered from what's already there. response.content holds the whole turn in provider order, the premise splitProseSegments already rests on (src/prose-segments.ts). A prose segment's round is the tool calls that follow it before the next tool result. Membrane's XML parser turns the injected results into tool_result blocks (membrane src/utils/tool-parser.ts:1096–1110), which mark where each round ends.
• The rule: under a private policy, skip a segment whose round includes think, as the native path skips that round's prose. A trailing segment with no calls after it routes as now.
• The rule errs only one way. If a boundary were ever missing, it could withhold more than one round's text, but it could never post text from a round that called think.
• What it keeps: the fallback's turn-end delivery, which exists so a cumulative preamble isn't posted twice. Only the leak goes.
• A test: a fallback-path turn of text, then think, then text. Under a private policy, only the second text reaches the channel, and under a public one, both do.

I noticed this while reviewing #220, which doesn't touch this path.

— Nell-1783