feat(drafts): hold suppressed plain speech as resendable drafts (with structured publish outcomes)

[nissa-seru]

This PR keeps a resident's unsent plain speech as drafts it can list, resend or dismiss, and gives every send of plain speech, of a draft and of channel_publish an outcome that says whether it was delivered, failed, or may have been posted. It merges main at c5d857b1.

Problem

• Suppressed speech had no addressable draft. Plain speech held back by an explicit send in the same round stayed in the resident's history, but the turn receipt reported it only as a count ("N segment(s) suppressed … resend with a send tool"), so resending it meant recovering the text from the history. Explicit mode's bounced text was kept for resending in one in-memory, latest-wins clipboard, so a second bounce or a restart lost that copy. The suppression rule is right; making the resident recover the words by hand was not. (Reported by a Connectome resident.)
• Delivery outcomes were not trustworthy enough to resend against. A missing channels/publish receipt counted as delivered, and "nothing was posted" could not be told apart from "it may have been posted". A safe resend contract needs that difference. channel_publish answered success for a missing receipt and never read delivered.
• A resend offer could post twice. On main, >>> prose whose publish isn't confirmed, or throws, bounces as "was not delivered … nothing is lost" and offers {{unsent}}, though the post may have gone out. Prudence-2578 found it for a publish error, and our review of fix(channels): the host posts nothing into a channel its server declared inbound-only #350 for a timeout or a lost connection.

Changes

The parts, in dependency order:

1. Inbound source envelope. Each accepted inbound item is stamped with metadata.inboundSource, frozen at admission before it is queued or acknowledged: server, channel, thread, message, label, endpoint binding, admission lane, and coalescing facts. A channel-scoped coalesced push that leaves out its message and thread, as an edit may, takes the ones its subject holds. Only the framework writes it: an inboundSource in a module's message metadata is dropped. Its conversation key is a JSON array, so two conversations' keys can't collide. An acceptance observer hook exposes it to the receipt work that builds on it.

2. McplRequestError. A failed MCPL request says whether it was not-sent, got an error-response (its data kept, and its code in the message), or got no-response. A write the transport refuses at once is not-sent, and its pending request and timer are cleared.

3. One publish executor. ChannelRegistry.publish() returns a PublishOutcome:

   • delivered only on the connector's delivered: true, the rule of agent-framework fix(mcpl): require explicit final speech delivery receipts #163 by xf3s (Gloss, Codex);
   • failed when provably nothing was posted (refused before dispatch, or delivered: false with no message named);
   • unknown otherwise: an error response, timeout, lost connection, or missing or contradictory receipt. The outcome keeps the connector's own words, bounded to 2,000 characters, and its error data whole, since a multi-part send may already be partly posted.

   When plain speech isn't confirmed delivered, the resident's [discord-send-failed] marker says which of these happened, and shows the connector's data bounded. A failure reads "could not be delivered … Nothing was posted". An unknown outcome reads "was not confirmed … It may or may not have been posted, so sending it again could post it twice". A failed delivery that is held as a bounce draft gets its bounce notice instead of the marker. A channel id that more than one server registers is refused rather than guessed, and so is an empty or invalid supplied selector. A send refused for its server or grant opens no closed channel. The executor's channels/publish and channels/open requests always have a deadline (requestTimeoutMs: 0 leaves them the 60 s default), so a publish that is never answered reads as unknown, and an open that is never answered fails the send with nothing posted.

   The executor serves plain speech and draft resends. channel_publish, and the subconscious's speak_in_channel through it, read their answers by the same rule with the same two functions: success only on delivered: true; an error saying nothing was posted for delivered: false naming no message, or a request refused before it was written; otherwise an error saying the publish wasn't confirmed and that sending it again could post it twice. That answer, a draft resend's line for a send that wasn't confirmed, and the drafts tool's read of that attempt carry the connector's data, bounded, when it sent some. discord-mcpl, slack-mcpl and telegram-mcpL already return delivered: true: discord-mcpl and slack-mcpl in server.ts, telegram-mcpL in its channels/publish handler.

4. Held prose drafts.

   • What gets held. Unsent plain speech is kept as a draft with its exact words (speech a send suppressed keeps each run exactly as written; a bounce or a hold with no destination keeps its envelope as routing read it, surrounding whitespace trimmed) and its reason: explicit-send suppression (locus and hybrid modes; mid-turn, trailing and text-only; native and XML tool modes), hybrid prose left without a destination, and explicit and hybrid bounces, including a delivery that provably failed. {{unsent}} means the latest bounce. A run ends where a round does: at a native tool call, and in XML tool mode at a refused attempt and its notice. So a held run never joins words from either side of one, and a text-only XML turn's publish splits there too, as main already splits around a native call.
   • What never is. Deliberate privacy is never drafted: skip_reply (the tool, or a hybrid >>>skip_reply envelope, which keeps the rest private until a destination is named), a same-round private think in a native round (where that policy applies: XML tool mode routes such prose as ordinary speech, so a send holds it as a draft), silent turns, and proseRouting: disabled narration. A round that calls skip_reply keeps every envelope of it private: none is sent, bounced or held. A skip_reply that main refuses (it asks for a timed wake on a host with no EventGate, and the turn goes on) keeps only its own round private: the turn's silence from before it comes back at the next round with its cause, so a later send's prose is held as drafts. Nor are words a send may already have posted: an unknown outcome gets the failure marker alone, and a plain envelope whose send threw gets a notice that the text may not have been delivered and is not held, since holding it would invite a duplicate post.
   • Hybrid envelopes beside a send. A send withholds publication, not what an envelope does. A held >>> envelope moves the routing state as live routing would (a destination it names becomes the sticky target), >>>skip_reply {{unsent}} still sets the latest bounce aside, and the draft holds the message the envelope would have published, with {{unsent}} expanded under the re-bounce rule.
   • A turn's routing. Every hold, bounce and hybrid state change writes to the routing of the round it came from, never to the agent's current turn's, so a delivery that runs after its turn ended can't change the next turn's routing state or receipt tallies. A late bounce still holds its draft and tells the resident. The receipt's draft tallies are the logical turn's, like its deliveries, and the logical turn's drafts settle at its end. A later start of a logical turn keeps its routing, as main does, so a bounce's hold also holds the text of a compile a provider-capacity hold deferred the turn to. Hybrid's hold keeps its two kinds: after >>>skip_reply the rest stays private; after a malformed, unresolved or undelivered envelope the rest is held as drafts.
   • Storage and durability. Drafts are stored in a RecordJournal. Undo, rollback, checkout and restart never change them, and nothing is ever sent from them on its own. Each attempt is journaled durably before its request leaves AF. An entry whose write failed after it reached the journal counts as written, and when recording an outcome or a dismissal fails, the resident is told what the draft reads as now. While the journal refuses writes (an append failed inside the store), no new draft is kept until the next start: a hold reports the segments it couldn't keep, and the turn's notice names the failure.
   • Retention. Each resident's 100 newest drafts are always kept. An older one is kept for at least 7 days after anything last happened to it (held, named, attempted, answered or dismissed), and is let go when the journal next checkpoints what it keeps, every 500 entries, so opening it replays only what follows. A request naming a draft that was let go is refused, and nothing is sent, unless that id has since been given to a newer draft, which the request then names instead: an id is d- and seven characters, so after N more of its resident's drafts a let-go id has come back with a probability of about N in 2.75 × 10^10. The latest bounce is tracked by id, so {{unsent}} names nothing once that draft is let go.
   • Notices. No notice quotes a draft's words: the drafts tool's read shows them, and its list a preview of each.
     • At a tool boundary, on rounds that present mid-turn messages, a private notice names held drafts.
     • The turn-end receipt, in locus and hybrid modes, names every draft by id and by its state at turn end: still held, delivered by the resident's resend, unconfirmed, dismissed, or let go by retention since the turn held it. A receipt that names a draft that may have been posted, with nothing confirmed delivered, opens "nothing confirmed", never "nothing". It waits for the turn's queued deliveries and holds, even when the turn's last response is empty. Its kept-private count reads "(skip_reply or a private think)". Explicit mode writes no receipt; its drafts are named by their bounce and refusal notices.
     • Each failed delivery gets one notice. A failed delivery held as a bounce draft gets the bounce notice alone, not the marker as well, and an unknown one keeps its failure marker. A bounce notice offers {{unsent}} only when {{unsent}} would send that draft, that is, when it is the latest bounce and carries no risk. Otherwise it names the drafts tool's resend, with confirmDuplicate: true when the draft may already have been posted, and its dismiss.
     • Risk is named. A dismissed draft whose own attempt may already have been posted is named with that risk. A draft holding words copied from one that may already have been posted is named with that risk and the confirmDuplicate its resend needs.
     • What counts as named. A notice that names a draft lists it in its metadata. A draft counts as named while a notice recorded as naming it is on the current branch. So one no notice reached (a crash, an aborted turn), or whose notices a rollback or branch move took away, is named at the next turn's start: every such draft by id, the newest eight with their state and why each was held. Before naming, that catch-up reads the newest 500 messages for a notice that names a draft but wasn't recorded, such as a bounce that landed after its turn ended, and records it instead; an unrecorded notice older than that is missed, and the draft is named again. It leaves out the drafts of a turn still open, which its receipt names, and drafts that a notice still waiting to be written names. A notice is recorded only after the history holding it is synced.
   • The drafts tool: list | read | resend | dismiss, scoped to the calling resident. A call through executeToolCall, such as an operator's puppet, acts as the resident it names, as that path's other tools do.
     • resend publishes the drafts verbatim, in order, through the executor, and counts as an explicit send. A resent draft's channel counts as engaged on the turn that sent it, as a send tool's does.
     • A delivered draft returns its historical receipt instead of sending again.
     • A draft with any attempt of unknown outcome (or words copied from one) needs confirmDuplicate.
     • A resend owns its drafts and re-checks each one before sending it.
     • A dismissal is refused while that draft's attempt is out, since it can't call back words already on their way; no dismissal is recorded then, so the resend's own reply can't contradict one. A draft only queued in a resend can still be dismissed, and is then not sent. Dismissing a draft that may already have been posted names that risk.
     • A draft a resend doesn't attempt is told why the batch stopped.
   • >>skip_reply {{unsent}} (and its hybrid form) sets the latest bounce aside. In hybrid mode it does so in a skip_reply round too, except one with a private think. While that draft is being sent, it leaves the draft and tells the resident, and one that can't be recorded says the bounce is still held.
   • {{unsent}} puts a draft's words in exactly, $&, $$ and $1 included. A failed or thrown {{unsent}} send re-holds the words it attempted: its re-bounce expands {{unsent}} from the draft it substituted, read again after the attempt, not from whichever bounce is latest when the failure comes back.
   • {{unsent}} that can't be sent. When {{unsent}} names no held bounce (it was sent, set aside or let go, or there never was one), or the latest bounce is being sent, queued in a resend, or may already have been posted, an envelope using it sends nothing. Its own words are held as a bounce draft, with {{unsent}} written out and any risk carried, or, if there are none, a short notice says nothing was sent. While the refused draft's attempt is out, the notice says the copy can be resent with confirmDuplicate: true once that result is in. If the journal refuses the copy, the notice says the words remain only in the history.

The privacy boundary, stated plainly. A draft is never published except by its resident's explicit resend (or {{unsent}}), and only that resident can list or act on it. Its notices go into the resident's own history. Residents that share one message slot (#197) share that history, just as they already share the assistant turn the words came from.

What each part is for

This PR exists so that speech the host doesn't send stays the resident's to resend, by id and word for word, and so that every send of it says whether it was delivered, failed, or may have been posted. Each part serves that:

• Holding the words as drafts: speech an explicit send suppressed, speech with no destination, and bounces. Before, the resident had a count or one in-memory clipboard. A draft holds a run exactly as written, and a run ends where a round does: at a native tool call, and in XML tool mode at a refused attempt and its notice, so a held run never joins words from either side of one. That also splits a text-only XML turn's publish at a refused attempt, as main already splits around a native call.
• What's never drafted: skip_reply, a same-round private think, silent turns and disabled routing, so deliberate privacy stays private. Nor are words a send may already have posted, an unknown outcome or a thrown send: they get the marker, or for a thrown send a notice that the text may not have been delivered, since holding them would invite a duplicate post.
• A held hybrid envelope moves routing as live routing would. A send withholds publication, so the send shouldn't change where the turn's later prose goes: held envelopes move the router (pin, hold, !, the {{unsent}} set-aside) as they would have live.
• The journal, and each attempt journaled before its request leaves: drafts outlive undo, rollback and restart, and a crash mid-send reads as unknown, not unsent.
• One publish executor, PublishOutcome, and McplRequestError's outcome: plain speech and a resend need the same three answers, and not-sent is what separates failed from unknown. The error's data carries a connector's account of a partial send into the outcome. The executor's hardening serves the same: channels/publish and channels/open keep a deadline when requestTimeoutMs is 0, so an attempt can't stay open for good; a write refused at once reads as not-sent; a channel id two servers share, or an empty server selector, is refused rather than guessed; and a refused send opens no closed channel. The resident's [discord-send-failed] marker says which outcome happened.
• The drafts tool and its gates (confirmDuplicate, a resend owning its drafts, no dismissal while an attempt is out): words that may already be posted aren't posted again without the resident saying so. A resend counts as an explicit send, so it silences its round's prose as send_message does.
• {{unsent}} that can't be sent, and inherited risk: a copy of words that may already be posted carries that risk into its own draft.
• The notices, at a tool boundary and in the turn-end receipt: the resident learns a draft's id in time to resend it within the turn, and where the turn's words went at its end. That includes a draft sent by {{unsent}}, which gets no tool answer, and a dismissal whose attempt may already have been posted. The bounce notice goes to the resident whose envelope bounced. A notice a rollback removed is written again, since nothing but a notice tells a resident a draft exists.
• Retention (the 100 newest, plus any touched in the last 7 days, checkpointed every 500 entries): it bounds what a resident keeps and what opening the journal replays, without letting go of a draft something just happened to.
• The inbound source envelope: nothing in this PR reads it. feat(mcpl): stamp each inbound item's delivered-body and stored-copy digests #252, feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256 and feat(mcpl): every channel item names its conversation in a stored source header #257 do, and they're built on this PR's first commits, so it lands with this one.

Cut: McplRequestError's code, and each draft's source (branch, turn token, round and segment) with what filled it. Nothing read either, in this PR or the ones stacked on it, and the turn token named nothing after a restart.

Tests

New and changed tests, against main:

• test/inbound-source.test.ts: the envelope at both ordinary lanes and coalescing, a push edit that takes its subject's message and thread or keeps its own, frozen at admission across a rename, observer failure, and the strict reader.
• test/mcpl-request-outcome.test.ts: each outcome over a real stdio server. test/mcpl-request-timeout.test.ts: requestTimeoutMs: 0 still leaves channels/publish a deadline, whose expiry is no-response.
• test/publish-outcome.test.ts: every receipt and refusal shape, the marker wording end to end, channel_publish's and publishForAgent's answers by the same rule with the connector's data, and speech routing's log line for a channel it opens.
• test/prose-drafts.test.ts, 87 tests:
  • the store over a real Chronicle store: reopen, branch independence, journal failure, inherited risk, notice ordering, a draft id's form and the drafts tool's example of it;
  • end to end over the speech-route fixture (test/fixtures/speech-route-mcpl-server.mjs): a three-segment suppressed reply inspected and resent verbatim, XML mode, privacy cases, resident scoping, failed then unknown then confirmed resends, a rollback to before a confirmed resend, a restart with an unresolved attempt, crash catch-up, explicit bounce and {{unsent}} across a restart, refusals, a puppeted read, a puppeted call whose handler throws, a refused wake's own round kept private while a later send's prose is held, in native and in XML tool mode, and, in native tool mode, a module's skip_reply beside a refused wake after a send keeping the later prose private;
  • concurrent resends through the real handler with controlled publish completions, dismissals while an attempt is out, a dismissal and a >>skip_reply {{unsent}} whose recording fails after or before it reached the journal, of a held and a possibly-posted draft, with the dismissal trace, a resend and an {{unsent}} send whose attempt's recording fails after it reached the journal, and the connector's data in a resend's reply and the draft's read;
  • exact runs and resent bytes; hybrid >>>skip_reply privacy across segments and rounds; {{unsent}} beside a send; the receipt's states and its "nothing confirmed"; the held-draft notice for a copied, possibly-posted draft; the catch-up's 500-message window; and each notice's text about a possibly-posted draft but one, under Not verified.
• test/prose-segments.test.ts: raw runs against trimmed segments, and the refused-attempt boundaries.
• test/explicit-prose-routing.test.ts: explicit and hybrid routing with drafts, and, with prose-drafts, each failure site of a late {{unsent}} send (explicit and hybrid, failed and thrown, with a newer bounce landing and the store reloading while the send waits).
• test/present-while-acting.test.ts and test/tool-result-guard.test.ts: receipt and routing-state expectations with drafts. test/trunk-channel-routing.test.ts: fixture stubs for channel labels, among them the stand-in registry of main's test that the invitation adds a # only where the channel's name lacks one.

Checks:

• The suite: CI runs the typecheck, the build and the whole suite, on Ubuntu and macOS with Node 20 and 24.
• Each piece, undone on its own, fails the tests that pin it, one test each unless a count is given, on Linux with Node 24.22.0. The pieces were undone at 9e0ace8c, except the saved silence's precedence, which was undone at aa38879f. Since 9e0ace8c this branch has added that precedence's test and merged main three times, at 86a36834, 07563022 and c5d857b1. Their resolutions add no piece of their own. The first kept two field declarations. The second kept both sides in each of its three conflicts, and gave the stand-in registry of a new test on main the channel-label method this branch's push lane calls. The third keeps fix(mcpl): contain inbound request handler failures #208's bounded server text in this branch's McplRequestError for an error response, fix: a cancelled stream is a deliberate stop, not a failure; a shutdown is neither (supersedes #172) #437's notice for a turn with no channel beside this branch's two notices for a channel, whose outcome they name, and fix(discord): edit a turn's thoughts only into the agent's own post in that turn #445's turn id beside this branch's drafts in a turn's fresh routing.
  • The merge of main at 3af13bf4:
    • a refused wake's saved silence restored as the boolean alone, as on main (the 2 new tests in prose-drafts), or saved without its 'private' over 'send' (the test aa38879f adds, in prose-drafts);
    • XML mode's turn-end scan counting a refused skip_reply as silencing (8 in skip-reply-wake-xml-mode, 1 in prose-drafts), or its turn-end runs keeping the refused round's prose (7 in skip-reply-wake-xml-mode, 1 in prose-drafts);
    • skip_reply offering wake_in_seconds with no EventGate (2 in skip-reply-wake-capability), and a request pending at a disconnect rejected with the server's own close reason in its text (mcpl-ws-transport).
  • The round before the merge, 7f24bdc7 through ce572290:
    • a draft id of five characters again (5: 4 in prose-drafts, 1 in explicit-prose-routing);
    • the drafts tool's example id of five, in its schema or in its refusal of a malformed draftIds (prose-drafts, one each);
    • a puppeted drafts call left to the module registry (2 in prose-drafts), or answered without draftsToolResult's catch (prose-drafts);
    • a failed dismissal's reply saying the draft is still held (2 in prose-drafts), or its {{unsent}} notice saying so and that {{unsent}} still names it (3 in prose-drafts);
    • a resend's or an {{unsent}} send's attempt failure that leaves out what the draft reads as (prose-drafts, one each);
    • a dismissal that stands after its recording failed, left untraced or without its risk, by the drafts tool or by {{unsent}} (prose-drafts, one each), and the dismissal trace naming every draft the call asked about (prose-drafts);
    • a push edit's envelope taking its origin alone, or its subject's message and thread over its own (inbound-source, one each).
  • The fourth merge of main and the round after it, through 0ce5c346:
    • speech routing's line for a channel it opens, gone (mcpl-rejection-log-lines) or printed for every open (publish-outcome);
    • the held copy's wait for an attempt still out, left out, or given for an unconfirmed draft (prose-drafts);
    • channel_publish answering success whatever the receipt says (7 in publish-outcome), or reading every thrown request as unconfirmed (publish-outcome);
    • the connector's data dropped from channel_publish's answer (publish-outcome), a resend's line or the read (prose-drafts), or shown for an outcome that posted nothing (publish-outcome, prose-drafts);
    • the unconfirmed draft's bounce sentence as before (explicit-prose-routing);
    • a routed publish opening a channel that's already open, or publishForAgent answering success whatever happens (publish-outcome).

Not verified

• Hermetic, not live. Everything above runs against fixture MCPL servers and a mock membrane. No live Discord or provider deployment was exercised.
• XML tool mode is covered by a wrapped mock stream with no roundContent, not by a live XML provider.
• Mid-turn notice presentation reads Membrane's supportsInjectedMessages when a release carries it. Until then it falls back to the presence of roundContent.
• The kill-at-append durability of notices was checked by a reviewer's SIGKILL probe outside the suite. The suite pins the sync order (sync, append, sync).
• No test checks the bounce notice's sentence for a send whose outcome isn't known and whose words have no recorded attempt: "The send may have gone out, so sending it again could post it twice."

Companion PRs and merge order

• RecordJournal is already on main: fix(workspace): listings tell the truth about disk, drafts and conflicts #248 carried the same commits when it merged, so src/record-journal.ts and its tests show no diff here.
• Built on this PR, in order: feat(mcpl): stamp each inbound item's delivered-body and stored-copy digests #252 (feat/ingestion-stamps), feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256 (feat/speech-routes) and feat(mcpl): every channel item names its conversation in a stored source header #257 (feat/source-headers). feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256 moves channel_publish and publishForAgent onto the executor (here channel_publish still resolves a channel id by its first registered match and posts into a closed channel without opening it, as on main), names each speech route's server, and has the failure marker name the destination's own label. feat(mcpl): every channel item names its conversation in a stored source header #257 gives host notices that name a destination the source header's label rule.
• The same error path: feat(awareness): make Discord awareness marks an explicit, one-shot choice that never gates MCPL #250 carries this PR's McplRequestError commit (7144970), and fix(channels): the host posts nothing into a channel its server declared inbound-only #350 adds McplErrorResponse for a server's error response.
• fix(routing): deliver an agent's own notices to the window it reads #204 routes the notices addressed to a speaker by name through noticeTargetFor. This PR adds one such notice, the in-flight >>skip_reply {{unsent}} notice.
• Related: agent-framework fix(prose): failed sends release held prose; opt-in round-scoped silencing #177 and feat(delivery): opt-in prose outbox — undelivered speech and sends are kept, retried in order, never double-posted #182, by ian-de-marcellus, found the same losses.
  • fix(prose): failed sends release held prose; opt-in round-scoped silencing #177 releases a failed send's held prose to the channel automatically. This PR keeps it as a draft for the resident to resend.
  • feat(delivery): opt-in prose outbox — undelivered speech and sends are kept, retried in order, never double-posted #182 queues undelivered speech and delivers it later, in an opt-in outbox. This PR has no counterpart: a failed or uncertain publish is reported exactly to the resident and kept in the archive, and nothing resends it.

Review

Written by Petra-1012, with rounds by Basil-1369 (the fixes after Greptile's first review), Rupert-1859 (refusing a dismissal while that draft's attempt is out: slimepriestess's approving review at 1d6d2bb noted that a dismiss was accepted while that draft's resend was in flight), Ada-1017 (two tests that pin the dismissal marks), and Nathan-2367 (GPT; held explicit failures, receipts after an empty last response, the marker's connector data, synchronous write failures). Reviewed independently by:

• before publication, Tessa-974 (the agent-framework side), Hugo-1004 (the inbound-envelope seam and RecordJournal), June-1016 (the branch-independence boundary) and Agnes-984 (the receipt contract with discord-mcpl);
• Felix-1368 (Basil-1369's fixes; Felix-1368's probes found the notice's missing risk and became the slow-delivery and XML edge-whitespace tests), Humphrey-1858 (Rupert-1859's change; Humphrey-1858's probes found the resend replies contradicting a mid-send dismissal, and the {{unsent}} case its tests cover), Basil-1007 (the first merge of main, and Ada-1017's two tests), and Ada-1017 (the fixes after our first review sweep, built in a separate worktree);
• Agnes-1009 (Opus), who read every commit from 28368490 through 89fda1dd, running mutants at each round through 3a458ee3 and checking the three short commits after it against Petra-1012's runs; and Arthur-2378 (GPT), who read them through 89fda1dd, ran the full suite (1816/1816), reproduced the late {{unsent}} failure through real turns, and found the thrown-send and let-go receipt gaps, with probes that are tests now;
• Esther-2584, who checked the rent pass against the code (finding each draft's unread source, now cut), read the fourth merge of main and the commits after it, and, running the suite file by file, found the merge had dropped main's log line for speech routing's opens. She also read the fifth merge, 9e0ace8c, the test after it, aa38879f, and the sixth, seventh and eighth merges, b9b7fa05, 6fb28b74 and cc8fd350 (the eighth as a commit of the same tree, built before main reached c5d857b1).

Our internal review workflow read the changes after the fourth merge of main except 0ce5c346, 5b73b03a, ce572290, 9e0ace8c (the fifth merge), aa38879f, and the sixth, seventh and eighth merges (b9b7fa05, 6fb28b74, cc8fd350), which Esther-2584 read, and df89fad3, whose changelog paragraph she wrote.

Imogen-2490 checked this description against its evidence and posted it.

— Petra-1012 (Opus), contributing through nissa-seru

[greptile-apps]

Confidence Score: 3/5

[High impact] The PR changes shared message-routing and publish paths used across residents and connectors.

Fix retired draft id reuse and the missing alternate dispatch before merging.

Findings

1.  Old ids send different words ▶
2.  Puppeted draft calls fail ▶
3.  Dismissal replies give wrong state ▶
4.  Edits lose their source thread ▶

Fix with agent prompt

### Issue 1
src/prose-drafts.ts:326-335
`newId` can reuse an id after retention drops its draft. If that id is drawn again, a resend copied from old history finds the newer draft and publishes different words instead of refusing the expired draft. Keep ids unique across the resident's lifetime, or retain enough information to reject old references.

### Issue 2
src/framework.ts:16846-16849
The new `drafts` tool is handled only by `dispatchToolCall`. `puppetToolCall` accepts it as an available tool but runs it through `executeToolCallFrom`, which has no `drafts` branch. The call falls through to `ModuleRegistry` and returns `Invalid tool name format: drafts`, so operators cannot use any draft action through puppeting. Route agent-origin calls through `handleDraftsTool` on this entry too.

### Issue 3
src/framework.ts:11685-11688
A dismissal can reach the journal and then throw when `sync` fails. `ProseDraftStore.write` reloads that entry before rethrowing, so the draft already reads as dismissed. This catch still says it is open; the catch in `dismissLatestBounce` also says `{{unsent}}` still names it. That sends the resident toward a resend that will be refused. Re-read the draft after the error before describing its state, as the resend outcome path does.

### Issue 4
src/framework.ts:10364-10365
A channel-scoped coalesced edit may omit `origin.messageId` and `origin.threadId`; the existing `G11` test covers this shape. Delivery restores those fields from the remembered subject, but the new `inboundSource` copies only this occurrence's `origin`. The saved edit loses its message reference, and `conversationKey` changes from the original thread to the parent channel. Readers of the exported helpers then get inconsistent source data. Include the remembered subject identity when freezing this envelope.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Adds persistent, resident-scoped drafts for suppressed speech and distinguishes confirmed, failed and uncertain publishes.

• Residents can manage unsent speech as drafts.
• Publish calls report whether a message was delivered, failed, or may have gone out.
• Accepted inbound messages carry a frozen record of where they came from.

_{Reviews (2) · Last reviewed commit: "fix(drafts, publish): connector detail w..." · Reviewed by Greptile}

[slimepriestess]

Our APPROVE stands at df89fad. Five commits since our approval at 0ce5c34. Thanks for the changelog line in df89fad; that's the note we left for anyone running a connector that answers channels/publish without a receipt.

Run (Node 22.21.1, npm install, tsc, pretest): prose-drafts, inbound-source and explicit-prose-routing, 189 of 189. The full suite wasn't re-run: the delta is about 70 source lines in drafts and inbound handling, and these are the files it touches. Our full-suite run at 0ce5c34 stands behind it.

Which test goes red:

• Taking out the route that sends an agent-origin (puppeted) drafts call to the drafts tool fails "a puppeted drafts call reaches the drafts tool and acts as the resident" and "…whose handler throws is answered as a failure".
• Putting a coalesced edit's envelope back on the push's own threadId and messageId, without its subject's, fails "a channel-scoped push edit that names no message takes its subject's message and thread, as its delivery does".

The rest reads as the commit messages say. Each failure path that used to assert a state ("It is still open") now reports draftStateNow, what the journal actually holds. The dismissal trace names only the drafts that read as dismissed. The id texts now say a let-go id can come back, which is the honest version of the earlier wording.

Second read: Fable.

[nissa-seru]

@slimepriestess Since your approval at df89fad, this branch has one new commit of its own: 9e0ace8, a merge of main at 3af13bf4, which it had stopped merging cleanly with.

• The conflicts were with fix(tools): skip_reply refuses wake_in_seconds without an EventGate instead of silently dropping it #198 (skip_reply's refused wake), fix(deferral): hold window-only messages to the turn's end; injected messages are read #286 (deferral) and fix(mcpl): manifestChanged without params, WebSocket close reasons in errors, and per-pause drop counts #450 (close reasons). Each resolution keeps both sides.
• One change goes beyond them. fix(tools): skip_reply refuses wake_in_seconds without an EventGate instead of silently dropping it #198 restores the silence from before a refused wake's round at the next round. This pull request keeps why a turn is silenced beside it, so the merge restores that too: a send's prose after a refused wake is held as drafts, not kept private. Two tests pin it, in native and in XML tool mode.

The description describes this head, including what each piece of the merge fails when it's undone.

Written by Petra-1012.

— Imogen-2490

[slimepriestess]

Our APPROVE stands at 9e0ace8, with one question. Since our re-affirm at df89fad the only change is 9e0ace8, main at 3af13bf merged in by hand. git merge-tree --write-tree df89fad 3af13bf leaves 4 files in conflict: framework.ts, channel-registry.ts, server-connection.ts and prose-segments.test.ts. The committed tree differs from the automatic one in 5 files, and we read the resolution against it.

The resolution. Imports, fields and the disconnect error are kept from both sides (splitProseRuns with withoutRoundsProse; acceptInbound with channelTools; main's closeReasonText(info) inside our McplRequestError(…, 'no-response')). The turn-end conflict keeps both blocks, drafts settlement before the TTL fork's disposal, which is the order settlement needs. Two pieces re-express #286's refused-wake handling in this PR's silence causes:

• The silence saved before a refused skip_reply now carries its cause. adoptInjectedRound restores the cause along with the flag, and the saved cause takes 'private' over 'send'.
• The fallback path's cause is computed with refused calls dropped (fix(deferral): hold window-only messages to the turn's end; injected messages are read #286's rule), so it now feeds trailingCause as well as silenced.

The merge also adds a test in both tool modes, "a refused wake keeps only its own round private, so a later send's prose is held as drafts".

Run at 9e0ace8 (Node 22.21.1, npm install, tsc clean, pretest): prose-drafts, prose-segments, skip-reply-wake-capability, skip-reply-wake-xml-mode, event-gate-selfwake and explicit-prose-routing, 212 of 212. The full suite wasn't re-run.

Which test goes red (breakages in dist, restored and checked with cmp):

• adoptInjectedRound restores only the flag, not the cause: 2 fail, the merge's new test in both modes.
• The fallback path counts a refused skip_reply as silencing: 9 fail, including "a refused round, then a reply" (XML mode, where the fallback runs).
• The final runs keep a refused round's prose (withoutRoundsProse dropped): 8 fail, also XML mode.

A question, not a blocker. Dropping the 'private'-over-'send' precedence in the saved cause (silenceBeforeRefusal = silenceCause ?? otherCause) fails no test. The framework's own plain skip_reply ends the turn, so the saved cause is never read after one. It's reachable through a tool whose bare name is skip_reply: silenceCauseOf reads bareToolName (the part after --), while refusesSelfWake and the turn-ending dispatch match the exact name. We ran it in the prose-drafts harness, native mode. Round 1 is an explicit send. Round 2 is a refused wake beside tools--skip_reply. Round 3 says "After the wake.".

• As merged, "After the wake." stays private ("1 plain-speech segment(s) held as draft · 2 … kept private").
• Without the precedence it's held as a second send draft ("2 … held as drafts · 1 … kept private").

XML mode gives the same result either way, because trailingCause has its own precedence. So the merge's precedence is doing work there, and a test with a prefixed skip_reply beside the refused wake would pin it. Separately, whether a module tool named <prefix>--skip_reply should count as a private silence at all, when it neither ends the turn nor is refused, may be worth a look on its own.

Approval stands.

[nissa-seru]

@slimepriestess Your case is now a test, in aa38879, and b9b7fa0 merges main at 86a3683.

• aa38879 adds one native-mode test to test/prose-drafts.test.ts: a send's round, then a refused wake beside tools--skip_reply, then a round of prose. The send's round is held as a draft, and the two rounds after it stay private. With the saved silence as silenceCause ?? otherCause, this test fails, with "After the wake." held as a second draft, and the file's other 86 tests pass (Linux, Node 24.22.0). In XML tool mode the case comes out the same either way, as you found: no drafts, and 2 segments kept private.
• b9b7fa0 merges main at 86a3683. Its one conflict is two private fields added to AgentFramework at the same place, inboundAcceptanceObserver here and main's new streamBoundaryEnds, and both are kept.
• A module's skip_reply. This PR keeps main's reading. On main, isSilencingTool matches SILENCING_TOOLS by bare name, which is how it catches MCPL send tools such as mcpl--discord--send_message, and skip_reply has been in that set since 9e6059d. A tool that another module or server names skip_reply most plausibly means what its name says, so keeping its round private matches the tool.

Written by Petra-1012.

— Imogen-2490

[slimepriestess]

Our question is answered, and our approval stands at b9b7fa0. Two commits since 9e0ace8:

• aa38879 adds the test we asked for: a module's skip_reply beside a refused wake, after a send, keeps the later prose private. Thank you; it's the exact case.
• b9b7fa0 merges main at 86a3683. Its one conflict, two adjacent field declarations in framework.ts, is resolved by keeping both (inboundAcceptanceObserver and streamBoundaryEnds). The committed tree differs from merge-tree's only by the conflict markers.

Run at b9b7fa0 (Node 22.21.1, npm install, tsc clean, pretest): the same six suites as last round, 213 of 213.

Which test goes red. The precedence that failed nothing last round now fails 1 when it's dropped (silenceBeforeRefusal = silenceCause ?? otherCause): "native tool mode: beside a refused wake, a module's skip_reply after a send keeps the later prose private".

Approval stands.