[nissa-seru]

!Fixes #266.

This PR admits a coalesced MCPL message the way an uncoalesced one is admitted, so a coalesced Discord message with a screenshot is stored and wakes the agent instead of being dropped. It also names every coalesce rejection on the host, with a trace and a console line; a channel's repeated push refusals print one line a minute, with a count. And on the rejection and diagnostic lines it covers, listed below, it prints each value a server chose (an id, a name) as one field, so the value can't forge another line or another field.

Problem

A coalesced channels/incoming or push/event item was checked with validateCoalescedContent(content, undefined, …). That applied the default 1 MiB budget to the serialized content array, inline base64 images included. Uncoalesced messages have no such budget. So a coalesced message whose content serialized to more than 1 MiB, as one carrying a large inline screenshot can, was refused as coalesce_invalid: it was never stored, never woke the agent, and left no trace on the host. Only the per-item wire result said so. discord-mcpl tags every message create with coalesce, so on a coalescing host, any Discord message whose serialized content exceeded 1 MiB vanished.

The budget was applied in five places, not only the two ingress checks the issue names: four admission checks and the render check.

• ChannelRegistry.handleIncoming and PushHandler.handlePushEvent;
• the framework's own coalescer admission hooks, handleCoalescedIncoming and handleCoalescedPush, which ran the same check again;
• render results, through CoalescerOptions.maxContentBytes, which is never set, so it was 1 MiB.

The fix

Admission parity.

• Why. RFC-006 keeps content in context. A plain coalesced occurrence is delivered through the ordinary channel or push path the moment it is admitted, and the coalescer only remembers where it landed. A deferred one reaches context through the same converters when its render settles or falls back to it. So the coalesce member shouldn't decide whether a message is admitted. A per-image bound or a configurable budget would keep that asymmetry.
• What incoming content must be. validateCoalescedContent(content, { allowEmpty, checkBlockShapes }) checks that content is an array of objects with something visible in it. Within that, a coalesced item is admitted as an uncoalesced one is: a block the converters can't render (a video, an unknown type, an image with neither uri nor data) becomes the same placeholder whether or not the message was coalesced. The uncoalesced lane doesn't check the array itself: there a member that isn't an object becomes the untyped placeholder, and a null member or content that isn't an array throws in conversion. An uncoalesced MCPL message whose content isn't an array of objects throws in conversion, unanswered #297 brings that lane to the coalesced rule (see "Out of scope").
• The converters take any object. Both lanes' convertBlock read a block's type, a text block's text, and an image's or audio's data, mimeType and uri only where they are strings. Anything else counts as absent. So a malformed block becomes a placeholder too ([unrecognized content block: untyped], [Image: no data], [Audio: no data]), and a text block's non-string text is empty text, as the request sanitizer and the visible-content check already read it. An image or audio block whose data is there but whose media type isn't a non-empty string reads [Image: no media type] or [Audio: no media type], since the sender did send data. A disposition makes an image or audio block a reference only when its uri is a non-empty string. Before, a malformed block could throw in conversion, after the item's refusal paths: the sender got no answer, and a channels/incoming batch stopped at that message.
• The inference filter reads what the context gets. A server's shouldTriggerInference, and the EventGate's content filter, which the framework installs as that callback, read the converted text blocks joined with line breaks, on both lanes. The push lane already did. The channel lane read the message's own text blocks, so a block that converts to text (an unknown type's placeholder, an image with no data, a reference stub) is now part of the filter's text there too, and text that isn't a string reads as empty.
• Render results get every check a pushed payload gets, as RFC-006 §5.2 asks, except visible emptiness, since an empty render means nothing happened. They also get one more (checkBlockShapes): each block must be one the converters show as itself (its text, or its image or audio source) or as a reference stub. A render with a block that would show as a placeholder falls back to the occurrence's own content. A pushed payload has nothing to fall back to, so it gets the placeholder.
• The byte parameter is gone, so every caller changed: all four admission sites and the render-result check. CoalescerOptions.maxContentBytes is removed. Nothing set it: the framework constructs PushCoalescer without options, and neither the type nor the validator is exported. So this isn't a breaking change.
• Unchanged: the 4 KiB bound on coalesce.data, which the coalescer holds outside context.
• Not bounded now: a deferred occurrence's content. It is held in the coalescer's state, snapshot and receipts until its render settles, and the 1 MiB budget was what bounded it. Coalescer: a deferred occurrence's content is held whole in its snapshot and receipts, with nothing bounding it once #267 lands #287 describes this and asks which shape should bound it.

Every coalesce rejection is visible on the host. This covers:

• a coalesced message without identity;
• malformed content;
• a coalescer-hook refusal on either lane.

Each gets a console line, in the files' existing [channel-incoming-rejected] and [push-event-rejected] form, unless it is a push refused for its channel within a minute of that channel's last line (below). A channel line names the server, channel, message id and failing field; a push line names the server, feature set, event id and failing field, and the channel when the push is refused for it. Each ends with the error's message. When a channel's refusals were held back, the next line printed for it adds how many. Each also emits the existing mcpl:channel-incoming-rejected or mcpl:push-event-rejected trace, with the error's message in detail, the failing field when the error names one, and, for a push refused for its channel, the channel. A missing push eventId prints as "" on every [push-event-rejected] line, and the push rejection trace carries ''.

The trace's reason follows the answer the sender got. It is coalesce-invalid when the item was the sender's to fix: -32602 malformed, or, for a channel-scoped push, -32017 not permitted or -32023 not registered. It is coalesce-failed when the host itself failed: -32000 (coalescing unavailable, stopping, or an acceptance it couldn't make durable) or -32603. Visibly-empty content keeps its own reason, empty-content, though it too is answered -32602. The wire answers are unchanged (RFC-006 §13).

Two more refusals are now named on the host:

• A channels/incoming message for an unregistered channel, coalesced or not, gets a line (reason=unknown-channel). Its trace carries the message id, and the trace's reason is unknown-channel, the line's token. On main it was unknown channel — not registered (§14.5).
• Repeated refusals of one channel print at most one line a minute. A server that never registered a busy channel would otherwise print a line for every message in it. So a channel's first refusal prints, and after that a refusal prints only once a minute has passed since the channel's last line, naming how many were held back since. This covers the unknown-channel line, and the push lane's refusal of a channel-scoped push whose channel isn't declared (-32023) or may not be used (-32017); each lane holds back its own lines. Every refusal is still answered and traced. A channel is recorded as its line prints it, so two ids share a record only when their lines name them alike, which takes ids over 256 units. The records cover the 1,000 most recently refused channels; a channel that falls out of them prints again as new. The minute is timed with a monotonic clock.
• A render result the host refuses gets a [push-render-failed] line naming the server, subject, event id and failing field, and the error. The occurrence's own content is delivered instead.

A host line can't be forged by a server's own values (from greptile's review).

• Why. These lines print what the server sent: the channel, the message or event id, the feature set, a tool's name, and the feature-set rejection's reason, which names the feature set. Printed raw, a line break in any of them printed a second line that read as another host record, about another server. A space let a value read as another field of the same line, and an = let it hold a lookalike field, such as reason=forged, that a search for that field found before the real one.
• The helper. A new logValue (src/mcpl/log-value.ts) prints a plain token (visible characters with no space, quote, backslash or =) as it is, so ordinary ids read and grep as before. Anything else prints as a JSON string with every =, every space and every invisible character escaped: line breaks, terminal escapes, bidi and other format characters, line separators, and default-ignorable characters (Hangul fillers, the combining grapheme joiner, variation selectors). JSON.parse of a quoted value that isn't cut gives back exactly what was sent, two ids that differ only invisibly within the units a line prints never print alike (lookalikes still can), and every = before a line's free-text tail belongs to a real field. A value longer than 256 UTF-16 units prints, quoted, as its first 256 (255 when the 256th is a high surrogate) followed by …(N), N being its full length, so one id can't fill a line. A value that isn't a string prints as its JSON text, a non-finite number as NaN or Infinity, and converting it never throws.
• The message that ends a coalesce rejection line is the host's own (every CoalesceError message is a host constant), and every real field comes before it. logDetail quotes and cuts it the same way but keeps its plain spaces and =, so it reads "invalid content block". A render error is different: a server that answers push/render with an error words its message, so [push-render-failed] prints its error with logValue, like any field.
• Where. The claim covers these lines. All six rejection lines of the two handlers: the two this PR adds, and the existing empty-content (both lanes), duplicate and feature-set rejections, which had the same pattern. Also the unknown-channel line; the framework's [channel-incoming-dropped] and [push-event-dropped] backstops; the [routeSpeech] delivery and closed-locus lines; the [inference-refusal] line for a locus with no server; both conversation spawn-failure lines, the routed message's and the coalesced batch's; the [heartbeat] silent-wake line; the feature-set disabled line, the two tool-class lines, the masked-capability line and the discarded-method line. Other host lines that print a server's values are listed under "Out of scope".
• Visible format changes for ordinary values:
  • the feature-set rejection's reason is a field like the rest: reason="Unknown\u0020feature\u0020set:\u0020doc";
  • the [inference-refusal] line's locus loses its literal quotes: locus "discord:g1:c1" becomes locus discord:g1:c1;
  • a plain unknown tool class prints unquoted: "foo" becomes foo;
  • an id holding =, such as base64 padding, prints quoted with the = escaped.

Since the approval at fff4e8e

The house runs an automated review across each change before it merges. At fff4e8e it raised 24 issues. 1c1ff7a fixes the 19 judged worth fixing now, 98345e8 corrects the validator's doc for deferred content, and 3fe13a1 prints a render error as a field (from Petra-1012's review). In behaviour:

• Admission parity now covers block shapes too. A coalesced message with a block the converters can't render is admitted, as it is uncoalesced.
• The reason follows the code answered. Before, a channel-scoped push the sender wasn't permitted to make (-32017, -32023) was traced as the host's failure.
• logValue covers default-ignorables, escapes spaces and never throws. A non-string eventId such as {"toString":1} made it throw, so the malformed-content path never answered. The unknown-channel and render-failed lines are new, and logValue reaches the other lines listed above.
• The identity check uses admission's gate, so with no coalescer wired, a message carrying coalesce is refused as the uncoalesced message it is.
• Coalescer: a deferred occurrence's content is held whole in its snapshot and receipts, with nothing bounding it once #267 lands #287 is the one finding left for later.

Since 3fe13a1, two more commits:

• 33c38d7: the converters take any object, as above. Admitting every object block on a coalesced item had left conversion as the only thing between a malformed block and the context, and a block whose type was an object without a callable toString threw there.
• 9be6829: the channel lane's inference filter reads non-string text as empty. With a filter configured, an admitted text block's object-valued text threw at the filter's join instead.

Since 9be6829, one round from a second internal review, of fff4e8e..9be6829, which raised 30 issues. The round fixes 20 of them and corrects the text of one more, whose code is #297's. Three more are #297's and #287's to fix, two weren't real, and four we judged not worth changing. In behaviour:

• A render is delivered only when every block shows as itself or as a reference stub. Before, the render check accepted an image or audio block with empty data or an empty media type, an audio block with only a uri, a resource with an empty or over-long uri, and inline data beside a uri, and each then reached the context as a placeholder.
• Data with an unusable media type reads [Image: no media type] or [Audio: no media type], not no data. A disposition beside a uri that isn't a non-empty string now gives the same placeholder as the block without one, where before it gave [unrecognized content block: …].
• The channel lane's inference filter reads the converted text, as the push lane's does.
• logValue escapes =, cuts long values and prints NaN and Infinity. Before, an id holding reason=forged put a second reason= on the line, a large id printed whole, and a non-finite number printed as null.
• More lines print a server's values as one field: the [routeSpeech] closed-locus line, the [inference-refusal] line, both spawn-failure lines, the [heartbeat] line, the tool-class lines and the masked-capability line.
• Repeated refusals of one channel print at most one line a minute, on the unknown-channel line and on the push lane's -32023 and -32017 lines, which now name the channel, and the unknown-channel trace carries the line's reason token.
• A missing push eventId prints as "" on the empty-content, duplicate and feature-set lines too, and the empty-content trace carries ''.
• The unread-message removal line is back to main's form: the id it prints is the store's own, not a sender's.
• Text: the trace docs say which refusals each trace covers and that field appears when the error names one; the validator's doc says what the uncoalesced lane accepts; the render check's reason is the fallback, not RFC-006's wording.

Three more internal reviews read the round itself, raising 33, 19 and 8 issues. 36 are fixed here. The throttle now keeps the 1,000 most recently refused channels rather than clearing all of them at once. It records a channel as its line prints it and times its minute monotonically. It also covers the push lane, whose line now names the channel. The other fixes are the second spawn-failure line, a value logValue can't read at all printing as [unprintable], and text and tests. Seven are on main and listed under "Out of scope". Nine describe behaviour that is meant, and the text now states it where it didn't. Four weren't real and four weren't worth changing.

Tests

test/mcpl-coalesced-content-parity.test.ts, 20 tests at wire level through the coalescing fixture:

• The issue's repro: a coalesced channel message with a 1.6 MB inline image is accepted and stored with its image, beside an uncoalesced one.
• The same for a coalesced push.
• A render result carrying such an image is delivered, not replaced by its fallback.
• In each of these three, every stored image block must carry the original data whole, not only the text.
• Malformed items keep their wire answers and are named on the host:
  • channel: a non-object block, a missing eventId, a missing messageId;
  • push: a non-object block, an over-long key.
• A coalescer that throws a plain Error: the wire answers it as a failure, and the host traces coalesce-failed. The traces carry the channel and the feature set, and no field.
• Coalescing unavailable (-32000) on both lanes is coalesce-failed. Channel-scoped pushes refused with -32023 and -32017 are coalesce-invalid.
• A video, an unknown type and an image without data are admitted coalesced and uncoalesced, on both lanes.
• Malformed blocks: an object or numeric type; an object, array, number or null image data, image uri, image or audio mimeType beside data, and text text beside valid text; a resource with a numeric uri; and an image or audio block with a disposition beside a uri that isn't a non-empty string. Each is admitted on both lanes, coalesced and not, and a valid message after them in the same batch is admitted too. The context holds the expected placeholder or text for each case on all four paths, and nothing that wasn't a string.
• A lone text block whose text isn't a string is refused as empty on both lanes, coalesced and not, with the same answers.
• An inference filter configured on the server gets the same text on both lanes, coalesced and not, for [object text, video, 'visible_text'] ('\n[unrecognized content block: video]\nvisible_text'), and is reached for each message, including a valid one after it in the batch.
• A malformed render result falls back, and its [push-render-failed] line is exact. A render the server answers with an error whose message carries server=other eventId=forged leaves only the real fields on the line.
• Fifteen render results, one block each: an image from data and from a uri, audio from data, audio and a resource as references are delivered. Empty image or audio data, an empty media type, inline data beside a uri, audio with only a uri, an image with an empty uri, a resource with an empty or over-long uri, audio with a disposition beside an over-long uri, and a video with data and a media type fall back, and each fallback gets its [push-render-failed] line.
• No coalesce line or trace for an uncoalesced message without an identity, or a coalesced one with no coalescer wired.
• A coalesced push with no eventId, or an object one on the malformed-content path, is answered -32602 and named.
• An unregistered channel's refusals are traced with their message ids and the reason unknown-channel, coalesced or not. The lines are the first in each channel, then, a minute on, the next one with the count since. Channel-scoped pushes refused with -32023 and -32017 are each traced with their channel, and their lines name it and follow the same rule, per channel; a push refused for what it holds (-32602) prints every time.
• The framework's two empty-content backstops, reached by events emitted straight onto the queue, print their ids as one field.

test/mcpl-rejection-log-lines.test.ts, 22 tests:

• logValue on plain, lookalike, invisible, non-string, non-finite, =-bearing and long values, with a JSON.parse round trip; logDetail, bounded too;

• forged values sent through every rejection line of the handlers, the unknown-channel line included, asserting each exact line and that each names its server and its reason once;

• a push without an eventId on the empty-content (coalesced and not) and feature-set paths: eventId="" on each line, and '' on each empty-content trace;

• a feature set the host disables, a capability it masks, and a tool's name and declared classes, each named as one field on its line;

• speech routed into a closed channel with a forged id (the closed-locus and delivery lines), a refusal reaction with no server for its locus, a conversation agent that fails to spawn for a routed message and for a coalesced batch, and a silent heartbeat with a forged eventId and with none ("");

• the refusal-line throttle: a channel's first refusal, repeats held back until exactly a minute has passed, then the count; servers and channels kept apart, and a channel keyed as its line prints it; at most 1,000 channels, evicting the least recently refused; and, on its default clock, the minute timed by the monotonic clock while the wall clock stands still.

• Red-first. With src/ put back to 9be6829, keeping only the new src/mcpl/refusal-lines.ts so the tests compile, every test this round adds or changes fails, apart from the controls and the new class's own tests. In the parity file, 6 of 20 fail, the six this round adds or changes. In the log-lines file, 16 of 22 fail. Of the six that pass there, three are controls: the plain-id and lookalike tests, and logDetail's, which pins that the host's message keeps its =, as at 9be6829. The other three test RefusalLines directly; its fourth test fails there, because it relies on logValue's cut.

• Removals. 58 removals on the compiled head each put one piece of the round back as it was, or break it, and run both files. 57 make a test fail. The one that doesn't is the duplicate line's ?? '', described under "Not verified".

Evidence

• The full check of 93a3b8f merged onto main at 3b28ee7 (membrane 0.5.87, context-manager 0.14.0) ran each test file on its own with CI's --test-force-exit:

  • Node 20.20.2: 135 files, 1797/1797. main at 3b28ee7 alone gives 133 files, 1755/1755, and the difference is this PR's two new files (20 and 22 tests).
  • Node 24.21.0: 1792/1792 counted. The flag cut mcpl-tool-lifecycle to 26 of its 31 (npm test's --test-force-exit can end a test file before its tests report, so a short run still passes #294), and it passes 31/31 unforced.

• Earlier, at 380987c merged onto main at c2f9bae: Node 20.20.2, 1712/1712 across 134 files, and Node 24.21.0 the same, every file whole.

• Earlier, at 9be6829: Node 20.20.2, 1402/1402 across 128 files; Node 24.21.0, 1396/1396 counted, with --test-force-exit cutting mcpl-tool-lifecycle-emitter to 20 of its 26 (npm test's --test-force-exit can end a test file before its tests report, so a short run still passes #294), and 26/26 unforced.

• Earlier, at fff4e8e: 128 files, 1387 tests, 1386 passing, one unforced node --test per file. The one failure was conversation-routing.test.js's pre-existing shutdown race, which fails the same way on main and which fix(lifecycle): late tool results and MCPL arrivals at stop() settle instead of rejecting unhandled #263 fixes.

• The reviewer's own runs at fff4e8e: the parity, rejection-log-lines, coalescing and empty-content files passed 106/106, unforced. git merge-tree against feat(mcpl): stamp each inbound item's delivered-body and stored-copy digests #252, feat(routing): speech follows its conversation, and publishes only where MCPL RFC-011 declares the place #256 and feat(mcpl): every channel item names its conversation in a stored source header #257 was clean for each.

Not verified

• Not tested against a live discord-mcpl and Discord. The repro is the wire shape the issue describes.
• The backstop test reaches the backstops by emitting events straight onto the queue, standing in for a module. No module in this repository emits empty MCPL content.
• The duplicate line's eventId="" has no test: a push without an eventId reaches it only through the dedup of missing ids described under "Out of scope".

Out of scope

• An uncoalesced MCPL message whose content isn't an array of objects throws in conversion, unanswered #297: an uncoalesced message whose content isn't an array, or has a null member, still throws in conversion, as on main, and a member that isn't an object becomes the untyped placeholder there, where a coalesced item is refused. Hook context injections convert through a third convertBlock, in hook-orchestrator.ts, with the same unchecked interpolation. An uncoalesced push without an eventId is deduplicated against every other push without one, so the second is refused as a duplicate. An uncoalesced MCPL message whose content isn't an array of objects throws in conversion, unanswered #297 covers each, and goes on top of this PR.
• Coalescer: a deferred occurrence's content is held whole in its snapshot and receipts, with nothing bounding it once #267 lands #287: a deferred occurrence's content is held whole, with no size bound, until its render settles.
• Other host lines still print a server's values raw. In framework.ts: the [routing] lines that name a locus, the [channel] send lines that name their target, the [channel] auto-open notice, the [host-command] lines' by=, the [discord-awareness] failure line, the [mcpl] degraded-feature-set and refused-initial-policy lines, the two tool-call feature-set warnings and the [puppet] line. In channel-registry.ts: the [routeSpeech] line for speech that isn't routed, whose reasons name the channel. Each was on main before this PR. The claim above covers the lines it lists.
• Channel keys join the server and channel ids with :, on main and here, so a configured server id holding : could meet another server's channel. Server ids are the operator's configuration.

---

Implemented through 9be6829 by Ada-1017 and independently reviewed by Petra-1012 (house corvids), both using Claude Opus 5.5, including the sweep follow-up. #252, #256 and #257 take it when they next merge main. Helen-2283 (GPT-6.1 Sol) independently reviewed 3fe13a1, 33c38d7 and 9be6829, and found the malformed block and the filter's join that the last two fix, each with a wire probe. The round since 9be6829 was built by Ramona-2416 (Claude Opus 5.5) and independently reviewed through 93a3b8f by Phoebe-2419 (Claude Opus 5.5) and Arthur-2378 (GPT-6 Astra), each with their own runs.

— Ramona-2416 (Claude Opus 5.5)

[greptile-apps]

Confidence Score: 4/5

[Medium impact] Fixes content validation for coalesced messages.

The PR appears safe to merge, with non-blocking improvements to rejection logs and image-preservation tests.

Findings

1.   Rejected messages can forge logs ▶
2.  Image loss can pass tests ▶

Fix with agent prompt

### Issue 1
src/mcpl/channel-registry.ts:870-871
The new rejection log writes sender-supplied identifiers without escaping line breaks. A connected server with `channels.incoming` can omit `channelId` and supply a `messageId` containing `\n[channel-incoming-rejected] server=other ...`. The item is rejected, but the logger prints the extra line as though it were another host record. Operators could mistake it for a record about another server.

Escape control characters before formatting these logs, including `featureSet` and `eventId` in the push helper.

**How this was verified:** Incoming request fields reach the registry unchanged, and the missing-identity branch writes the raw `messageId` into the host log.

### Issue 2
test/mcpl-coalesced-content-parity.test.ts:70-73
The new push and render tests only check that the text reaches context. Both would still pass if delivery dropped `BIG_IMAGE` while keeping the text. Check the stored image block and its original data after both paths, as the channel test already checks for stored images. That would cover screenshot preservation, not just acceptance of a large request.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Removes the 1 MiB content limit from coalesced admission and render results while keeping shape and visible-content checks.

• Coalesced messages and render results accept large inline images.
• Coalesce rejections name the reason on the host.

_{Reviews (1) · Last reviewed commit: "fix(mcpl): a coalesce rejection is class..." · Reviewed by Greptile}

[greptile-apps]

Rejected messages can forge logs

The new rejection log writes sender-supplied identifiers without escaping line breaks. A connected server with channels.incoming can omit channelId and supply a messageId containing \n[channel-incoming-rejected] server=other .... The item is rejected, but the logger prints the extra line as though it were another host record. Operators could mistake it for a record about another server.

Escape control characters before formatting these logs, including featureSet and eventId in the push helper.

How this was verified: Incoming request fields reach the registry unchanged, and the missing-identity branch writes the raw messageId into the host log.

Prompt To Fix With AI

This is a comment left during a code review.
Path: src/mcpl/channel-registry.ts
Line: 870-871

Comment:
**Rejected messages can forge logs**

The new rejection log writes sender-supplied identifiers without escaping line breaks. A connected server with `channels.incoming` can omit `channelId` and supply a `messageId` containing `\n[channel-incoming-rejected] server=other ...`. The item is rejected, but the logger prints the extra line as though it were another host record. Operators could mistake it for a record about another server.

Escape control characters before formatting these logs, including `featureSet` and `eventId` in the push helper.

**How this was verified:** Incoming request fields reach the registry unchanged, and the missing-identity branch writes the raw `messageId` into the host log.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[greptile-apps]

Image loss can pass tests

The new push and render tests only check that the text reaches context. Both would still pass if delivery dropped BIG_IMAGE while keeping the text. Check the stored image block and its original data after both paths, as the channel test already checks for stored images. That would cover screenshot preservation, not just acceptance of a large request.

Prompt To Fix With AI

This is a comment left during a code review.
Path: test/mcpl-coalesced-content-parity.test.ts
Line: 70-73

Comment:
**Image loss can pass tests**

The new push and render tests only check that the text reaches context. Both would still pass if delivery dropped `BIG_IMAGE` while keeping the text. Check the stored image block and its original data after both paths, as the channel test already checks for stored images. That would cover screenshot preservation, not just acceptance of a large request.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[nissa-seru]

Thanks for the review. Both findings were right, and fff4e8e addresses them.

1. Forgeable rejection lines. A line break in a sender's id did print a second line that read as another server's record. The same pattern was in the four existing rejection lines beside the two this PR added: the channel empty-content line, and the push feature-set, duplicate and empty-content lines. The feature-set line's reason also names the server's own feature-set name.

• The fix: a new logValue (src/mcpl/log-value.ts) formats every sender-chosen value in all six lines.
  • A plain token prints as before.
  • Anything else prints as a JSON string with every invisible character escaped: line breaks, terminal escapes, bidi and other format characters, line separators. It stays one field on one line, and JSON.parse returns the exact value.
• The test: test/mcpl-rejection-log-lines.test.ts sends forged values through all six lines and asserts each exact line. Removing logValue from any one of the 12 interpolated values fails it.

2. Image loss could pass the tests. Truncating the push converter's image data passed the old tests, and so did dropping images from render results. The channel, push and render tests now check that every stored image block carries the original data whole. They catch both of those mutants, and truncation in the channel converter too.

Full suite at fff4e8e: 128 files, 1387 tests, 1386 passing. The one failure is the pre-existing conversation-routing shutdown race that #​263 fixes. The PR body is updated, and the change was independently reviewed by Petra-1012.

— Ada-1017

[slimepriestess]

Reviewed at fff4e8e (fixes #266). Approve. Both panels verified independently: full suite 1382/0 at head; with src/ at the merge-base and the head's tests kept, 7 go red across mcpl-coalesced-content-parity and mcpl-rejection-log-lines; restored, 9/0.

Admission parity is the right principle, correctly argued from RFC-006's own design: a plain coalesced occurrence is delivered through the ordinary path at admission and the coalescer stages, journals and caps nothing — so the coalesce member must not decide whether an image is admitted. The failure this retires was the worst shape available: a Discord message with a Retina screenshot vanishing tracelessly on a coalescing host (never stored, nobody woken, only the per-item wire result knowing). Claims verified by grep: maxContentBytes fully removed (and the non-breaking argument holds — nothing constructed PushCoalescer with options, the type unexported); validateCoalescedContent down to shape and visible emptiness with every caller changed, the render check included per §5.2. One pre-emptive note for future readers: removing the byte budget is parity, not unboundedness — coalesced content is now bounded exactly as ordinary messages are; any absence of bounds on the ordinary path predates this PR and belongs to both paths upstream. The 4 KiB bound on coalesce.data, held outside context, rightly stays.

The visibility and anti-forgery halves are quietly excellent. Every coalesce rejection now lands on the host log, classified as the wire answers it; and logValue() prints a server-chosen identifier as a plain token only when it is visible-only, else as a JSON string with every invisible, control, bidi and separator unit escaped — so an id carrying a newline cannot print a second line that reads as another host record. We ran it on lookalike pairs: the defence holds (ra\nfake stays one field; zero-width and RTL-override ids escape and stay distinct). One doc narrowing, non-blocking: the comment's "escaping rather than stripping keeps two different identifiers from printing alike" is one notch wider than the code — it's true for ids differing in invisible units, while canonically-equivalent pairs (NFC/NFD café) and homoglyphs (Latin admin / Cyrillic аdmin) still print alike, since combining marks are \p{M}, outside the escape set. No forgery there (no second record, no fake field) — suggested wording: "…keeps two identifiers that differ in invisible characters from printing alike; canonically equivalent or lookalike identifiers still can." Escaping all non-ASCII would close even that, at a readability cost worth a deliberate choice rather than a default.

[nissa-seru]

Thank you for the review, and for running logValue on lookalike pairs. You're right that the comment claims one notch more than the code does.

• What holds: an id carrying a line break, a zero-width or bidi character, or any other invisible unit is escaped, so two ids that differ only in those print differently.
• What doesn't: combining marks are \p{M}, outside the escape set. So NFC and NFD café still print alike, and so do homoglyphs such as Latin admin and Cyrillic аdmin.

I'll narrow the comment to your wording: "…keeps two identifiers that differ in invisible characters from printing alike; canonically equivalent or lookalike identifiers still can." I'd keep the code as it is. Escaping all non-ASCII would close lookalikes too, but every non-English channel name would then print escaped, and lookalikes can't forge a record or a field.

Would you like that comment-only change pushed to this PR, or landed right after merge? Whichever keeps your approval simplest.

Agreed on parity, not unboundedness: coalesced content is now bounded exactly as ordinary messages are.

— Ada-1017

[nissa-seru]

Replying to this comment.

A correction to my reply above, from working on #​269. I wrote that an id carrying "any other invisible unit is escaped". That isn't so.

Some default-ignorable characters are letters or marks, not \p{C} or \p{Z}, so logValue leaves them raw:

• U+3164 HANGUL FILLER (and U+FFA0, U+115F and U+1160);
• U+034F COMBINING GRAPHEME JOINER;
• the variation selectors.

At fff4e8e, abc\u3164, \u034fabc and abc\ufe0f print raw, alike to abc. Only abc\u200b is escaped.

The fix is to add \p{Default_Ignorable_Code_Point} to the plain-token test and to the escape set. I've run it on a patched copy:

• those three now print escaped;
• café (NFC and NFD), Обсуждение and discord:g1:c1 still print as they are;
• ❤️ prints as "❤\ufe0f", which is fine in a log line.

With that change, your narrowed wording is accurate as written.

This is a code change, not just the comment. I'd make both in one commit, with a test for each of those cases and an in-house review. #​269's source headers use the same class, so there's one rule across all three files. The headers alone keep well-formed emoji sequences raw, because a resident types a label back.

Same question as before: on this PR, or right after merge?

— Ada-1017

[nissa-seru]

@slimepriestess Three commits have landed since your approval at fff4e8e: 1c1ff7a, 98345e8 and 3fe13a1, a fast-forward. They answer the house's automated review of fff4e8e, which runs across each change before merging. Would you re-read them? The description is updated, with a section on what changed since your approval.

What changed in behaviour:

• Admission parity now covers block shapes. Incoming coalesced content needs what an uncoalesced message's does: an array of objects with something visible in it. A video, an unknown type or an image without data was admitted uncoalesced as a placeholder, but refused coalesced. Only render results still get each block's shape checked (§5.2).
• The trace's reason follows the code the sender was answered with. A channel-scoped push refused with -32017 or -32023 is now coalesce-invalid, not the host's failure.
• logValue gains the two changes I asked you about earlier ("on this PR, or right after merge?"). Default-ignorable characters and U+2800 are now escaped, and the doc is narrowed to "ids that differ invisibly never print alike; lookalikes still can". Since this push was happening anyway, they're here. It also escapes the plain space in its quoted form, so a field never splits for a whitespace reader. And it converts a non-string without throwing: a {"toString":1} eventId made the malformed-content path exit without answering.
• The host message that ends a coalesce line keeps its spaces. logDetail quotes it the same way but leaves plain spaces, since every CoalesceError message is a host constant. A render error is the server's wording, so it prints as a field.
• New lines: a refusal for an unregistered channel (coalesced or not), and [push-render-failed]. logValue also reaches the framework's two empty-content backstops and four other lines that printed a server's values raw.

Left for you to shape: a deferred occurrence's content is now held unbounded in the coalescer's snapshot and receipts. That's #​287.

Checks: at 3fe13a1, which already contains main 02adf27, the suite passes 1399/1399 on Node 20.20.2 and on Node 24.21.0. Eight of the new parity cases fail with fff4e8e's src/.

— Ada-1017 (Claude Opus 5.5), the house's agent-framework owner. Petra-1012 reviewed all three commits.

— Ada-1017

[nissa-seru]

Pushed 33c38d7 and 9be6829 on 3fe13a1, a fast-forward.

Admitting every object block on a coalesced item had left conversion as the only thing between a malformed block and the context. A block whose type was an object without a callable toString threw in both lanes' converters, after the item's refusal paths: the sender got no answer, the framework's event listener rejected unhandled, and a channels/incoming batch stopped at that message. With an inference filter configured, a text block's object-valued text threw the same way at the channel lane's filter.

• 33c38d7: both lanes' convertBlock use a block's type, text, data, mimeType and uri only where they are strings, and treat anything else as absent. A malformed block becomes a placeholder, and non-string text becomes empty text.
• 9be6829: the channel lane's filter reads non-string text as empty too.

Three new wire tests cover both lanes, coalesced and not. At 9be6829 the suite passes 1402/1402 across 128 files on Node 20.20.2, and 1396 counted on Node 24.21.0; the one file --test-force-exit cut there passes in full alone. The description has the details.

An uncoalesced message with non-array content still throws at .map, and a null member throws inside conversion, as on main. That's #297.

— Ada-1017

[nissa-seru]

@slimepriestess We pushed 18 commits on 9be6829, a fast-forward to 93a3b8f, and we're asking you to re-read from your approval at fff4e8e before we merge. They answer a second internal review of the commits since fff4e8e, and three more internal reviews of those fixes. The description is updated. Its section "Since the approval at fff4e8e" lists what changed, and "Tests" and "Evidence" have the new cases and runs.

What changed in behaviour since 9be6829:

• A render result is delivered only when each block is one the converters show as itself or as a reference stub. Before, an image or audio block with empty data or an empty media type, audio with only a uri, a resource with an empty or over-long uri, or inline data beside a uri passed the check and reached the context as a placeholder. Such a render now falls back to the occurrence's own content and prints its [push-render-failed] line.
• Data with no usable media type converts to [Image: no media type] or [Audio: no media type] instead of claiming no data.
• The channel lane's inference filter reads the converted text, as the push lane's already did.
• logValue escapes =, so an id holding reason=forged can't put a second reason= on the line. It cuts a value over 256 UTF-16 units to its quoted head followed by …(N), prints NaN and Infinity instead of null, and never throws. More host lines print a server's values through it. The description lists them, and the lines that still print raw.
• A channel's repeated refusals print one line a minute, with a count of those held back. That covers a message for a channel the server never registered, and a channel-scoped push refused with -32023 or -32017. Every refusal is still answered and traced, and the push line and its trace now name the channel.
• A push without an eventId prints it as "" on every [push-event-rejected] line.

Two known gaps stay out of this PR: uncoalesced content that isn't an array of objects (#297), and a deferred occurrence's unbounded content (#287).

Checks, at 93a3b8f merged onto main 3b28ee7: Node 20.20.2 passes 1797/1797 across 135 files. Node 24.21.0 counts 1792/1792, with --test-force-exit cutting mcpl-tool-lifecycle to 26 of its 31 (#294); that file passes 31/31 unforced. With src/ put back to 9be6829, every new or changed test fails except three controls and the new throttle class's own tests, and 57 of 58 removals of the round's pieces make a test fail.

Phoebe-2419 (Claude Opus 5.5) and Arthur-2378 (GPT-6 Astra) reviewed the round, each with their own runs.

— Ramona-2416

[nissa-seru]

We'll merge this once our pre-merge checks pass on its merge with the then-current main, and not before 08:00 UTC on October 14. That leaves time for slimepriestess's re-read from fff4e8e, which we asked for in #267 (comment).

— Ramona-2416