[rufalupa666-netizen]

What happened in production

Three times in one week a private WebUI reply from a connectome-host resident was published to a Discord channel. The resident had not called a send tool.

In 0.30.0 (630e2a3a07), speech.locus defaults to 'delivery', and the changelog says a turn with no locus "falls back only to an open all-except tune-out's excepted channel, and otherwise keeps its prose private". So a private surface's turn still takes a channel while a focus holds, and under 'latest-inbound'. At main's 0f11975e48, an operator's TUI message answered in plain text while a focus held work was published in work. Under 'latest-inbound', after a mention in noisy was answered, it was published in noisy. Two tests in test/all-except-e2e.test.ts pin those two cases, and both fail at 0f11975e48 (Tests, below).

Scope and guarantee

This section and the next two are the author's, updated by us for the rework described under "Our part".

A turn that private input opens, or takes in, publishes none of its plain speech to a channel for the rest of the turn. Private input is a private surface's message, or what work a private turn started brings back: a script's wake message, what an agent derived or spawned during a private turn sends back, what a run handed mail from such work sends, and mail an agent sends while its own turn is private. A private surface is a sender whose messages name no channel: the WebUI, TUI, CLI, headless and API callers. Its messages are the external-message and api:message events whose metadata.channelId names no channel, apart from the framework's own MCPL tool-list notice, an external-message no operator wrote. Explicit send tools and explicit prose envelopes still reach a channel the agent names. While a turn is private, an envelope's body goes where it names, but the envelope sets no sticky destination, so later plain speech stays on the surface, as the turn's notice says.

"Takes in" covers three of the four timings R1-1 named, R1-1a to R1-1c below. One rule decides each of them: private input makes the turn private, whatever else its start, batch or tool boundary holds, and nothing later in the turn makes it public again.

• R1-1a, a mid-tool injection: a tool boundary that injects a private surface's message makes its turn private from there. So does the round after a tool's results, when it takes in a private wake that arrived while the tool ran.
• R1-1b, a later request in the same batch: a start whose batch holds a private wake is private, whatever else the batch holds, and so is a gate debounce window that holds a private message.
• R1-1c, a budget-restart batch: since main's fix(turns): handle a stream cancel() that throws; start a continuation without the wakes batched with it #762, a budget restart takes in no wake. A private message stored during the turn makes the budget restart private, as the first start to read it, and the message's own wake starts a private turn after it.
• Private input stored before a start: a start that is the first to read a private surface's message is private, though the message's own wake may still wait in a gate window, or the message woke nothing. That covers a message stored while the agent was idle, at a turn's end, at a tool boundary that ends the turn or belongs to a silent turn, at a start's flush, or at resume().

A turn that becomes private loses its locus, its trigger channel and its sticky >> or >>> destination, and, unless it's a silent heartbeat tick with no speech to place, a [routing] notice tells the agent why: private input came in, an operator's message or what a private turn's work brought back. It doesn't become a channel's again. A round written before the turn became private, and delivered after it, still posts where its envelopes name.

R1-1d, content already read, stays out. What's private is the turn, not the operator's words: once a start has read an operator's message, a later turn isn't private for it, though its context still holds the message, unless that turn is an operator's retake (D4 below). Neither is another resident reading the same message slot. That is #256's work: its speech routes keep a turn's route with its content.

Current architecture

Line numbers in this description are src/framework.ts's at this head.

• isNonChannelSurfaceEvent says whether an event is a private surface's. The framework's inboundSource surface stamp now follows the same rule, so it stamps a stored message as a surface's exactly when isNonChannelSurfaceEvent counts it as a private surface's.
• InferenceRequest.nonChannelOrigin marks a private wake, by the direct path and by the gate's debounced wake (WakeProvenance.nonChannelOrigin, which then names no route). A request that continues a turn's work carries that turn's id instead (CALLER_TURNS): its budget restart, its tool results' re-inference, a ! continuation, its auto-continuation, a bounce's wake, a rewind's retry, its re-send after its retries run out (feat(turns): send a turn's trigger again when its retries run out on a transient failure, with delays of 2, 8 and 32 minutes, and alert on an hour of stated waits #846), and the wakes below. An operator's nudge or unstick, or the API's inference.request, carries a mark of its own (RETAKE) instead, judged where its start reads the context (below). A start that makes its turn private marks its own wake too, so a provider hold's copy of it for the turn's retry carries the mark.
• The framework records which turns are private, by turn id: the 4,096 highest private ids, and a floor below which an id is no longer known and counts as private. The floor starts at the id counter's value when the framework is made. A script's report deferred across an update's restart names no turn of the next run: the restore sets its turn id to 0, which counts as private.
• Work a turn started is judged by that turn as it stands when the work comes back, at the start that reads it, so a turn that took in private input after starting it counts, even after the work's request was queued. Each request that continues a turn's work carries that turn's id, kept when wakes merge, and the start judges them in one place. That covers a script's wake_agent() and a script left running reporting its end, by the start turn the isolate records; a self-wake armed with skip_reply's wake_in_seconds, and a sleep's wake, by the turn that armed them; and the resident's turn after a tune-out cancel it asked for, the end of a focus included (src/tune-out/coordinator.ts:1122).
• What that work brings back is private input when its turn is private as the message is stored or injected, as a private surface's message is (isPrivateInput). That covers a script's wake message, which carries its start turn under CALLER_TURN_KEY, and what a private turn's Dendrite work sends. An agent derived from, or spawned by, an agent whose turn is open and private (:10815), and an ephemeral run handed mail from such work (:11681), are marked on their record (AgentRecord.privateTurn), and a resumed job keeps the mark. Their results and messages, the notice that a restart interrupted them, and mail an agent sends while its own turn is open and private (sentFromPrivateWork, :11650), a reader fork's report included, are stored with dendrite.privateTurn, which isPrivateInput reads (:29947). A turn that reads such a message is private, and a tool boundary that injects it makes its turn private from there. Only the framework writes the key and the mark: a server's copy drops dendrite whole, as on 0.30.0, and callerTurnId with it, and a module's two write paths drop both (withoutPrivateWorkMarks, :424).
• The scheduler makes a start private when any request in its batch is a private wake, or continues a turn that is private as it stands then (one some()), continuations included. Judging there, where the work is read, counts a turn that turned private after the request was queued. The quiesce key and a provider hold's dedup keep a private wake apart from others, and wakes merged there or into a start keep the turns they continue (carryWakes), so merging never drops either.
• main now starts a turn's continuation alone (fix(turns): handle a stream cancel() that throws; start a continuation without the wakes batched with it #762), a budget restart or a tool-result guard's retry: the requests that waited in its batch go back to the queue and start a turn of their own after it. Each of them first takes the open turn's id as a turn it continues (continuesTurns) and keeps its own marks (markWaitedOnTurn, src/framework.ts:15723–15726). So by the rule above, its start is private when that turn is private then, or when the request is a private wake itself. A quiesce that parks the requests beside a continuation marks them the same way.
• Storing private input for its own agent, anywhere but a tool boundary, marks the agent (notePrivateInput). Its next start that can publish is private. The mark is spent once that start's stream begins, so a silent heartbeat start, or a start that parks or ends before its stream, leaves it to the next.
• A retake's start is private exactly when the agent's stored history on its current branch holds private input by the marks above (isPrivateInput): a surface's stamp, or a private turn's id. It reads getAllMessages(), the cached view the turn's compile reads next, so input the context now shows only in a summary still counts, and input that was hidden, shed or removed, or is on another branch, doesn't. Nothing is kept about the retake between turns.
• TurnRouting.nonChannelOrigin is set when a private start opens the turn. makeTurnPrivate sets it when a start that continues the turn takes in a private wake or stored private input, or when a boundary injects private input. Once set, it stays set for the turn. A private turn's start routes to no channel and is addressed in none, whichever wakes joined it. Its telemetry still says who woke it.
• While a turn is private, no envelope sets its sticky destination (pinTurn). That includes an envelope that a send held as a draft, and one in a round that was queued before the turn became private and delivered after it on the speech chain.
• A private turn's plain speech is kept private in every mode. In locus and hybrid modes its receipt counts it (privateSuppressed) and says it went to no channel. Without that it would reach routing with no locus and be reported as a failed send. In explicit mode it isn't bounced into a draft to resend: a notice says it was kept private and how to publish (keepPrivateTurnProse). Nor is an envelope that bounces in a private turn, in hybrid and explicit mode, because it names no destination, names a channel that doesn't resolve, or its delivery fails, words it adds to an {{unsent}} resend included: the bounce notice says the words were kept private, or, when the send threw, that they may have gone out. Only a bare {{unsent}} resend keeps the draft it sent. Where an earlier draft is held as the latest bounce, either notice says {{unsent}} still names that draft, not these words. Words a send holds back are held as drafts, as in any turn. In locus and hybrid mode a send holds back speech going where it may have posted, or, when the framework can't read where it posted, speech going anywhere (fix(prose): an explicit send holds plain speech only where it may have posted #824). A private turn's unprefixed speech, and an envelope of its that names no destination or names a channel that doesn't resolve, have no destination, so no send holds them back (sendHoldAt's privateTurn).
• A private turn's channel_publish without channelId is refused at the model's own dispatch, judged by the turn the call was made in as it stands, a conversation fork's included, and its round doesn't count the refused call as a send. The refusal answers as the dispatcher's other refusals do, so its result carries refused (ToolResult.refused), and the tool-result guard's notice for a withheld one says the tool didn't run. A script's channel_publish that names no channel, an empty channelId included, is refused when the turn that started the script is private as it stands at the call. Otherwise it goes where 0.30.0 sends it.
• In locus and hybrid mode, a private turn tells its resident which channels' messages it holds, and that its plain speech reaches none of them, in a [routing] notice: at a start that takes in a channel's wake (a batch's, a gate debounce window's channel messages, or a wake that continues the open turn), at a live tool boundary that injects a message that addressed the agent or follows up where the turn sent, and at the turn's next start for such messages it stored with no live stream to tell, those noted before it turned private included. Each channel is named once in the turn, by this notice or by 0.30.0's notice that someone addressed the agent from another channel, whichever comes first, since both read and write 0.30.0's record of the channels named (TurnRouting.addressedElsewhere, :21704). Under 'delivery', a private turn's tool boundary runs 0.30.0's notice, then this one (:16705–16709). Under 'latest-inbound', this one runs where 0.30.0 re-pins. In explicit and disabled mode no channel's message moves where plain speech goes, in any turn, so no channel is named.
• A private turn's channel_open opens the channel for incoming traffic and moves neither the locus nor the trigger channel. Nor does its entry into an all-except hold (focus, or tune_out with scope: 'all-except'), which on 0.30.0 gives an open turn with no locus the excepted channel (:36960), and the hold's answer says the turn's plain speech stays private. Its .sleep announcement isn't posted: outside explicit mode it has no locus, and in explicit mode, where the announcement goes to the turn's >> target, a private turn has none, even after an envelope of its names a channel. When the model refuses (a refusal stop), a private turn's refusal reacts on no message, and its failure record names no channel.
• 0.30.0 stores the routing it last told each agent of (rememberAnnouncedLocus). A private turn's notice that its speech now reaches no channel is stored the same way (:21745), so after a restart the agent's next room turn is told its channel again, as it is without a restart.
• SpeechContext.nonChannelOrigin tells speech handlers a private turn's speech is private, and the built-in Discord module posts none of it.

Requirements, and the tests that pin each

Each requirement says what someone meets, and its tests assert that: what reaches a channel (every routeSpeech and deliverSpeech call the registry gets, a call with no locus included), what the resident is told, a tool's result, typing, or what modules hear. Tests are named by their titles, mostly in turn-trigger-provenance, and a title cut short is quoted with "…". turn-trigger-provenance and explicit-prose-routing run on stand-in channel registries that give a turn with no channel a fallback channel (test/turn-trigger-provenance.test.ts:414; test/explicit-prose-routing.test.ts:128 and :2320), as a focus hold and 'latest-inbound' do on 0.30.0. A test whose rule changes what happens only where such a fallback exists has a title ending ", even where a fallback exists (a focus hold or 'latest-inbound')", cut here.

• A1. A surface's message whose metadata.channelId names no channel is private, a source added later included; one that names a channel routes as on 0.30.0. "treats an unknown future external-message source as private", "a WebUI turn after Discord traffic freezes null and keeps prose private", "a WebUI turn overrides even a resident home channel", "an API message that names no channel opens a private turn", and main's tests whose triggers now name their channel.
• A2. The framework's own notices aren't private input, and a module or server can't make its message count as a private turn's work. "a turn woken by the framework's own MCPL tool-list notice speaks as on main" and "a turn woken by a module's event with the notice's fields is private", "a module's message that carries a private turn's key leaves a channel turn speaking in its channel" and the same test with "work mark" for "key", and ingress-host-keys for a server's copy.
• B1. A private turn publishes none of the plain speech it writes once private, in every mode, whatever wakes joined it. A round written before it turned private goes where it was written to, and sets no destination for what follows. "a private turn's round speech stays on its surface…", "a private turn's words beside a send to a known place, and after it, are kept private…" (and beside a send whose place the framework can't read), "a private turn's text-only reply counts each segment…", "hybrid keeps a private turn's unprefixed prose on its surface", "a private hybrid turn's speech with no target…", "a round written before the turn turned private, delivered after it…", "a held turn's retry speaks in no channel when an operator's message stored during the hold makes the turn private" (held-turn-retry), the two incident tests in all-except-e2e, "under 'delivery', an operator's message while a focus holds is answered in no channel" and "under 'latest-inbound', an operator's message after a room was answered is answered in no channel", and every test below that asserts nothing was routed.
• B2. Deliberate sends still reach the channel named, and no envelope gives a private turn a sticky destination. "a deliberate envelope is delivered alike in a private turn and a channel one…", "a private turn's own envelope posts its body where it names…", "hybrid mode: a private turn's envelope a send held sets no target, so its later plain speech stays private", "a private turn's channel_publish that names a channel goes there…", "a script's channel_publish that names its channel goes there, in a private turn too".
• B3. A private turn's words are counted as kept private, and the resident is told so as a decision, not a failure. They aren't drafted or offered for resend, with one exception: an envelope that names a channel that resolves, beside a send that may have posted there, is held as a draft, as in any turn. "an explicit-mode turn that had (or had no) destination is told it's private…", "a private hybrid turn's envelope that names no destination keeps its words private, with no draft…" (and one that names a channel that does not resolve, or a channel whose delivery fails, in hybrid and in explicit mode), "hybrid mode: a private turn's envelope that names a channel that does not resolve, beside a send to a known place, keeps its words private, with no draft", "hybrid mode: beside a send whose place the framework can't read, a private turn's envelope that names no destination keeps its words private, with no draft" (and one that names a channel that does not resolve), "hybrid mode: beside a send whose place the framework can't read, a private turn's envelope that names a channel is held as a draft, since the send may have posted there", "a private hybrid turn's round that calls the drafts tool holds none of its plain words as a draft" (and in explicit mode), "a private hybrid turn's kept-private notice says which earlier draft {{unsent}} still names" (and in explicit mode), "a private hybrid turn's resend that adds its own words to {{unsent}} holds no new draft when its delivery fails" (and when it throws, and in explicit mode), "a private hybrid turn's bare {{unsent}} resend whose delivery fails keeps the draft it sent, and offers it again" (and in explicit mode), "a private turn's bounce wakes a turn whose plain words stay private…", "a private turn that takes in more private input is told nothing again", "a locus/explicit/disabled-mode room start that a stored operator message makes private is told why…", "a disabled-mode turn is told once…", "a turn whose private notice cannot be stored is private all the same", "a private turn whose draft may already have been posted says nothing is confirmed…", and in routing-baseline-restart, "a channel turn made private is what the agent was last told, after a restart too". No false [discord-send-failed] can be stored: that marker comes only from a failed route, and the routed assertions above see every call the framework makes.
• B4. A private turn's channel_publish with no channel is refused, the model's by its own turn, as a refusal (refused), and a script's by its start turn, and the description says so. "a private turn's channel_publish that names no channel is refused, and says how to name one", a conversation fork's included, "a channel_publish that names no channel is judged by the turn it was made in…", "a script's channel_publish that names no channel is refused in a private turn…", "a script's refusal in a private turn points to channel_list only for an agent that may call it", "a script left running past a private turn's end is refused…", "channel_publish's description says…", and the round's accounting: "…counts its channel_publish that names no channel as no send…", "…is no send on the fallback path either…", "XML tool mode: a private turn's refused channel_publish silences nothing…".
• B5. Nothing else picks a channel for a private turn. "channel_open keeps a private turn private…", "channel_open of an inbound-only channel in a private turn…", "a private turn's sleep announcement is posted nowhere…" and "in explicit mode, a turn that wrote a >> target and then sleeps announces nowhere, private from its start" (and "…private from a tool boundary", beside "…announces there, as a channel turn"), "a private turn's refusal reacts in no channel", "a private turn's refusal rewind retries privately, and its record names no channel…", "a private surface's turn posts no speech and edits its thoughts into no message" (discord-thoughts-own-turn), "a private turn's speech reaches modules marked private", "a turn that turns private at a boundary shows its speech handlers no channel…", and in all-except-e2e, "a private turn that enters a focus keeps no channel, and is told its plain speech stays private".
• C1. A tool boundary that injects private input makes the turn private from there. "a boundary that injects a private surface's message makes the room's turn private from there…", "an ADDRESSED mid-turn injection moves no private turn's locus", and "a room's turn whose boundary injects what a private turn's work brought back is private from there".
• C2, C3. A start whose batch holds a private wake, a gate window's included, is private, and so is a continuation that takes one in. "a batch that holds a private surface's wake is private…", "a gate window with a private message, which nothing stores, and an addressed room message wakes one private turn…", "a room's wake that continues an open private turn leaves it private…", "a continuation that takes in a private wake makes its channel turn private from there…", and E1's tests of a wake that waited on a private turn's continuation.
• C4. The first start to read private input stored before it is private. "a private message stored while the agent is idle makes its next start private, and only that one", "a private surface's message a start's flush stores makes that start's turn private…", "a silent start leaves the mark…" (B4 shows the silent start is private: its channel_publish with no channel is refused, where the same start with no private input doesn't refuse it), "a budget restart that reads a stored private message is told so, unless it's silent", "a silent turn's boundary that stores private input…", "a boundary that ends the turn leaves it a channel turn…".
• D1. What a turn derives speaks where it would. "a ' !' continuation of a private turn speaks in no channel…" (and of a channel turn, as on 0.30.0), "a private (or room's) turn's auto-continuation…", "a private turn's refusal rewind retries privately…", "a retry after inference failures shed history, from a private turn, speaks in no channel…", "a private turn's bounce wakes a turn whose plain words stay private…", and "a late bounce from a private turn, landing while a channel turn is live, …" (and the reverse). For the re-send after a turn's retries run out (feat(turns): send a turn's trigger again when its retries run out on a transient failure, with delays of 2, 8 and 32 minutes, and alert on an hour of stated waits #846): "a turn private at a tool boundary by an operator message that wakes nothing whose retries run out is sent again in no channel", the same by an operator message that wakes it, "a turn opened by a private surface whose retries run out is sent again in no channel", and "a turn of a channel whose retries run out is sent again in its channel, as on main".
• D2. Work a turn started wakes a turn that speaks where that turn would as it stands when the work comes back. Each wake is armed by the model's own call in the turn: "a skip_reply's wake, armed by the model in a private turn, speaks in no channel…", "a sleep's wake, armed by the model in a private turn, …", "a script the model left running in a private turn wakes turns that speak in no channel, by wake_agent() and by its failure", in tune-out-e2e, "under 'latest-inbound', the resident's turn after its own tune_out cancel" "speaks in no channel when a private turn cancelled"; and in all-except-e2e, "under 'latest-inbound', the turn a focus cancel wakes speaks in no channel when a private turn cancelled"; each beside its channel-turn case, which speaks as on 0.30.0; and "a script's wake queued while its turn was a channel's speaks in no channel once that turn turns private first…".
• D3. What that work brings back is private input while its turn is private. "what a private turn's work brought back, stored while the agent is idle, makes its next start private", and C1's third test.
• D4. An operator's retake (nudge, unstick, or the API's inference.request) is private exactly when the agent's stored history holds private input as it starts, on the branch the context is on then, however the context came to end there. With none, it speaks as on 0.30.0. "a nudge after a private turn speaks in no channel…", "a nudge after a channel turn speaks as on main, in the fallback channel", "an unstick after a private turn speaks in no channel…", "an inference request through the API after a private turn speaks in no channel…" (and after a channel turn, as on 0.30.0), "a nudge asked for while a channel turn runs, which then takes in private input, speaks in no channel…", "a nudge after the host's own undo, twice, back to a private question speaks in no channel…" (connectome-host's /undo: cm.branchAt and cm.switchBranch), "a nudge after a channel turn that followed a private exchange speaks in no channel…", "a nudge after the host's own undo, twice, back past a private exchange speaks as on main, in the fallback channel", "an unstick after the operator hides messages, in a context that never held private input, speaks as on main, in the fallback channel", "after a restart, a nudge following a channel turn speaks as on main, in the fallback channel" and "…following a private turn speaks in no channel…", "a nudge after a channel turn and a silent heartbeat tick that took in a stored private message speaks in no channel", "a nudge parked behind an auxiliary call, while the host removes the private exchange before it, speaks as on main, in the fallback channel", "a nudge merged with a channel's wake after a private turn speaks in no channel…".
• D5. Work from a private turn that comes back after a restart stays private. "a private turn's script report deferred across an update's restart, naming an earlier run's turn id above the next run's floor, keeps the next run's start out of every channel, and leaves a later turn its channel", and the same with the report's own id as a control.
• D6. What an agent derived or spawned during a private turn sends back is private input, and so is what a run handed mail from such work sends, and mail an agent sends while its own turn is private. "agent mail sent while the sender's turn is open" "is answered in no channel, when the turn was private"; "an agent derived or spawned while its parent's turn is open" "derived, returns a result its parent answers in no channel, when the turn was private", and the same for one spawned; "spawned outside any turn and handed mail from a private turn, returns a result its parent answers in no channel"; each beside its room's case, answered "where a channel-less turn's speech goes"; and in dendrite-lifecycle, "a fork a restart interrupted wakes its parent into a private turn, when it was derived while a private turn was open", beside "…into an ordinary turn, when it was derived in another turn".
• E1. A channel message that meets private input gets no inferred reply in its channel, a message whose wake waited on a private turn's continuation included, and in locus and hybrid mode the private turn names its channel, once, before it replies, unless the message's wake is dropped once the turn has read and answered it, as an ambient or system message's is (fix(scheduler): drop a stored message's wake once a request has read and answered the message #819); explicit and disabled mode name none. "a room's wake that arrives while a private turn runs waits for its budget restart, then starts a turn of its own that speaks in no channel", and the same during a quiesce, beside a channel turn's, which speaks in its channel, as on 0.30.0; "a stored room message whose wake waits for a private turn's budget restart starts a turn of its own that speaks in no channel", beside a channel turn's, whose wake is dropped once the restart has answered in its channel, as on 0.30.0; "a stored room message tagged ambient, whose wake waits for a private turn's budget restart, starts no turn once the restart has answered, reaches no channel, and isn't named", and the same for one tagged system; in turn-continuation, "starts a wake held ahead of a private turn's guard retry as a private turn of its own"; "a private start that takes in a room's message names the room before the reply…", "a room's turn made private by a stored operator message names the room it was woken for", "a room's wake that continues an open private turn names the room", "a channel's message is named once in a private turn…", "a private turn's boundary that injects a room's addressed message names the room…", "under 'delivery', a private turn's boundary that injects an unaddressed follow-up where the turn sent names the room with the injections", "a private (or room's) turn's boundary over budget…", "a gate wake names its window's channel messages…", "an addressed arrival … is named at the next start…", "an arrival removed before the private turn's next start isn't named", "a private start that takes in a wake for a channel no server registered names it on one line, with its notice openings marked", and the explicit and disabled mode starts above. A room message that comes while a turn waits to be sent again (feat(turns): send a turn's trigger again when its retries run out on a transient failure, with delays of 2, 8 and 32 minutes, and alert on an hour of stated waits #846): "a room message that comes while a private turn waits to be sent again starts it at once, and gets no reply in the room", beside "a room message that comes while a channel turn waits to be sent again starts it at once, and is answered in the room, as on main".
• E2. Merges keep a private wake private. "a quiesce keeps a private wake apart from another with the same reason…", "a quiesce that keeps one of two parked wakes keeps the other's channels on it…", "a provider hold that holds a private wake beside an equal one wakes a turn that speaks in no channel".
• F1. Channel turns, heartbeats and push events with no private input route as on 0.30.0. main's tests in agent-allowed-tools, code-execution, cut-off-calls, explicit-prose-routing, outgoing-stream, present-while-acting, tool-input-unparseable, tool-result-guard and tool-wrapper-prose-guard-integration, whose triggers now name their channel, and each parameterized test's channel-turn case.

Co-developed with qa-engineer, the connectome-host resident that hit this.

Our part

Where this differs from the R1-1 fix in Anarchid's first review. Its point 3 kept requeueing channel requests so they still get their own turn. This head takes a channel request that meets private input into the private turn instead, or, where main now starts the turn's continuation alone, into a private turn of its own after it. An ambient or system message's wake there starts no turn: it's dropped once the continuation has read and answered the message (#819). In locus and hybrid mode, a [routing] notice tells the resident which channels' messages the turn holds before it replies, so it can answer the room with a send, and the turn's receipt says its speech was kept private. Requeueing the request would bring back the gate window's parts and the ordering between the two kinds of turn that running them as separate turns needed. That machinery was most of what this pull request's earlier rounds added, and still let the room's turn read the operator's words.

#789, a module's request that can't say whose turn's work it continues, stays open: this change gives a module's request and message no turn, as 0.30.0 gives them none.

Against main at 0f11975e48, the change is +695 −243 lines in src and +3,461 −84 in test. Of the src lines it adds, by each line's first characters, 589 are code, 70 are comment lines and 36 are blank.

Where main's recent changes meet this one (merged at 2021d49d, then at 36f27982, which merged with no conflict, then at 8ff287dd, then at e85c57db, then at 62a126c7, then at 630e2a3a07, and then at 0f11975e48). In a round that calls the drafts tool (#716), an unprefixed line written while a channel turn has no destination is held as a draft, as on 0.30.0, and a private turn's is kept private, never drafted. A continuation that now starts alone (#762) is the case under E1 above. A private turn's refused channel_publish carries refused, so the guard's withheld notice (#810) says the tool didn't run. In locus and hybrid mode, an explicit send now holds back plain speech going where it may have posted, or, when the framework can't read where it posted, speech going anywhere (#824). A private turn's unprefixed speech, and an envelope of its that names no destination or names a channel that doesn't resolve, have no destination, so no send holds them back: they are kept private beside any send, and such an envelope bounces as a private turn's bounce does, with no draft. Where #824 delivers a hybrid segment no send held, the private turn's rule applies, as at every other hybrid delivery, and an envelope a send held sets no target in a private turn. #819 drops a stored message's wake once a request that read the message has been answered, for the kinds its changelog names: channel messages other than a conversation fork's, push events, a module event's one message, background-script wakes and the gate's self-wake notices. A private surface's message isn't one of them, so its wake isn't dropped, as on 0.30.0 (src/framework.ts:17111). For a wake that carries a channel, the agent must also have published into that channel since, unless the message's server tagged it ambient (chat:ambient) or system (chat:system, #830's notices). A private turn publishes into no channel unless it names one, so a room message's wake that waited on a private turn's continuation still starts a turn of its own, which speaks in no channel. An ambient or system message's wake needs no publish, so once a continuation has read and answered the message, its wake is dropped and starts no turn, as "a stored room message tagged ambient, whose wake waits for a private turn's budget restart, starts no turn once the restart has answered, reaches no channel, and isn't named" asserts, and the test whose title names a message tagged system asserts the same. On 0.30.0 such a message gets no reply of its own either. A private turn whose start takes in such a message's wake names the message's channel, as "a gate wake names its window's channel messages…" asserts for an ambient one. #843 carries an explicit send's hold into the starts that continue a turn: the error policy's retries, a provider hold's retry and a context-budget restart. A carried hold goes through the same sendHoldAt as a send's own (src/framework.ts:1679), so a private turn's speech with no destination still takes no hold: after a send whose place the framework can't read, a private turn's budget restart keeps its words private, where a channel turn's are held. #817's refusal of a cut-off round's calls and #830's notice mark are next to lines this change touches, and each is kept as 0.30.0 has it. #846 sends a persistent agent's turn again when its retries run out on a transient failure, after 2, 8 and 32 minutes (src/framework.ts:862), as a copy of the turn's trigger (:6565). Here that copy also carries the exhausted turn's id, as every other request a turn derives does, so its start is judged by that turn: a private turn's re-send speaks in no channel, and a channel turn's goes where #846 sends it. With these tests and without that change, a turn made private at a tool boundary by an operator's message that woke nothing kept the room's wake as its trigger, and its re-send answered in the room (red first, below). A room message that comes during the wait starts the turn at once, with the re-send merged in (:19478), so for a private turn that start is private and the room message gets no reply in the room. The notice that names the channels a private turn holds messages from now passes a channel id no server registered through #852's suppliedValue (src/framework.ts:21710). Where #858 has skip_reply name the heartbeat's earlier wake, the merge keeps the self-wake's turn. #861 has a heartbeat's turn take no channel and hold its plain speech as a draft. Here a heartbeat's turn that takes in private input, from an operator's private wake in its batch, an operator's stored message its start reads, or one that makes it private at a tool boundary, keeps its words private with no draft, as any private turn does. One that is private from its start, from a private wake or a stored message, gets no notice that its words are held. A heartbeat's turn with no private input holds its words as a draft, as on 0.30.0.

The merge of 630e2a3a07, 0.30.0 with #546's Dendrite (dd5f21c18f), and the six commits after it.

• 0.30.0's 'delivery' default. Under it, 0.30.0's changelog gives a turn with no locus only an open focus's channel as a fallback, and 'latest-inbound' brings back the most recent inbound channel after that. So under the default, a private surface's turn on 0.30.0 already reaches no channel unless a focus holds. Some parts change what happens only where a fallback exists, and "What each part is for" below says which.
• 0.30.0's notice that someone addressed the agent from another channel and this pull request's notice now share one record of the channels named in a turn (TurnRouting.addressedElsewhere), which replaces this branch's channelsNamed. In a private turn under 'delivery', 0.30.0's notice names a room whose message addressed the agent at a tool boundary, and this one names an unaddressed follow-up where the turn sent (E1).
• The conflicts, as git's diff3 conflict style shows them: 18 blocks, 12 of them in src/framework.ts, 2 in src/mcpl/channel-registry.ts, 2 in src/tune-out/coordinator.ts, and one each in test/ingress-host-keys.test.ts and test/tune-out-e2e.test.ts. Eleven keep both sides. Seven carry this branch's lines into code 0.30.0 restructured:
  • a conversation agent's end now runs through 0.30.0's releaseAgentRuntime, which drops the agent's stored-private-input mark (:11954). disposeConversationAgent calls it when an agent is live under the name (:17890), and otherwise drops the mark itself (:17902);
  • dispatchChannelToolCall refuses a private turn's publish first, and takes a fork's home from 0.30.0's homeOf;
  • a later start of a private turn names its held arrivals' channels, and any other turn follows 0.30.0, which re-pins under 'latest-inbound' and gives its notice under 'delivery';
  • handleTuneOutTool takes the calling turn from both dispatch sites, and its per-channel cancel passes it on (:36944);
  • channel_publish's description and channelId's are 0.30.0's, each with this pull request's sentence or clause added.
• The commits after the merge: 9778fcdd94 stores a private turn's notice with the routing 0.30.0 records each agent was last told; f8d1ea7f87 keeps a private turn that enters a focus private, and the turn that the focus's end wakes when that private turn ends it; 8c5e233696 makes a private turn's derived, spawned and mailed work come back as private input, and drops the mark from what a module stores; 09a83cd3ca adds the two incident tests; aee5c62180 rewrites the changelog fragments against 0.30.0; and 566cbb1a18 renames the tests whose rule changes what happens only where a fallback exists.
• Tests changed for 0.30.0: in turn-trigger-provenance, a hand-built routing gets addressedElsewhere, a fork's home is set on its registry record, "a private turn's boundary that injects a room's addressed message names the room with the injections, and moves nothing" asserts that 0.30.0's notice names it once, and "a room's turn's boundary over budget leaves an addressed message to its restart, which stays in its channel" asserts the reply in the room. tune-out-e2e's cancel tests run under 'latest-inbound'. 0.30.0's new test in agent-allowed-tools names world:commons, as this branch's other tests there do. 0.30.0's tests in routing-baseline-restart read this branch's no-channel notice, and all-except-e2e's focus answer gains the private exception.

The merge of 0f11975e48 (191fc24821, this head). After 630e2a3a07, main took ten pull requests: #866, #864, #873, #874, #877, #872, #881, #875, #378 and #876. The merge conflicted in two places, and each keeps both sides: in src/gate/event-gate.ts, this branch's sleepTurnId field sits beside main's rewritten note on dispose(), and in test/turn-trigger-provenance.test.ts, both sides' imports are kept, main's MembraneError on this branch's @animalabs/membrane line. #881 removed EventGate.resumeSleep(), with its call in src/framework.ts and its tests in test/event-gate-sleep.test.ts, and at this head nothing in src or test names it. At this head, the test files main changed since 630e2a3a07 and those this branch changes pass together (Tests).

main's comments (R6-4). Our comment pass took out each of main's comments that held a sentence this change made false. The sentences that still hold are back, verbatim: sameInferenceRequest's doc, the quiesce key's reason, and "Conversation forks act only on their home channel." Each sentence that stays out is false once private input makes a turn private:

• resumesLogicalTurn's "takes in no new input, and keeps the turn's locus, trigger channel and tool-call count", and TurnRouting's "none of them re-decides the locus, drops a sticky destination …": a start that continues the turn with private input drops its locus, trigger channel and sticky destination.
• triggerChannel's "A turn that channel_opens a channel moves it there" and "Kept across the turn's streams …": a private turn's open sets nothing, and makeTurnPrivate deletes the trigger channel at a continuing start or a tool boundary.
• locus's "Frozen when the turn opens (home channel for a fork, else the trigger channel, else the global default) …": a private turn opens with none.
• pin's "set by each >> (hybrid: >>>) prefix that resolves", and "Sticky within the turn …" at the explicit-mode pin: no envelope sets it while the turn is private.
• arrivals' "The turn's next start clears them all, and … first re-pins to the newest one still in the agent's store": a private turn's next start names them instead.
• "Every other start of the turn keeps its locus", and at the typing indicator "Once a turn has a locus it always has one": makeTurnPrivate removes it.
• The fork rule's second sentence: a private fork turn's channel_publish without channelId is refused, not sent home.
• At channel_open: "a channel_open's result … moves its locus while the turn is still open", "plants the agent's feet in the opened channel" and "MOVES the current turn's locus": a private turn's open moves no locus.
• The channel registry's "the agent was told its prose stays in the archive; honor that": the notice now says the speech stays on the surface the agent was addressed from.
• addressedElsewhere's doc, new in 0.30.0, "Under speech.locus: 'delivery', the channels the turn has already told the agent it was addressed from while busy …": the set now also holds the channels a private turn's notice names, under either setting, whether or not their messages addressed the agent.

Sentences that hold but depend on one of those stay out with it: arrivals' "One removed meanwhile … isn't there for the agent to answer", which explains the re-pin's check; "A message no tool boundary of the turn weighed can still move it", whose "it" is the locus a start no longer always keeps; and, above channel_open's result, the 2026-07-21 fix's history and the announcement sent with the tool result, which lastAnnouncedLocus records, since the announcement they name is a locus move a private turn's open doesn't make.

What callers notice, against 0.30.0:

• A turn opened from a private surface publishes none of its plain speech, and nor does a turn after it takes in private input. On 0.30.0 the first takes an open focus's channel, or under 'latest-inbound' the most recent inbound channel, and otherwise publishes nothing either (What happened in production).
• A channel message that shares a start, a debounce window or an open turn with private input gets no inferred reply in its channel. Where main now starts the turn's continuation alone (fix(turns): handle a stream cancel() that throws; start a continuation without the wakes batched with it #762), the message's wake starts a private turn of its own after it, unless it is dropped once the turn has read and answered the message, as an ambient or system message's is (fix(scheduler): drop a stored message's wake once a request has read and answered the message #819). A channel message whose start is the first to read a private message stored before it gets no inferred reply in its channel either. The private message it reads may be one that woke nothing. In locus and hybrid mode, a [routing] notice names the channels whose messages the private turn holds. The changelog files this as breaking, in non-channel-origin-locus.breaking.md.
• A turn that becomes private gets a [routing] notice saying so, whatever destination it had, and loses its sticky destination. A silent heartbeat tick, which has no speech to place, gets no notice.
• In explicit mode, a private turn's unprefixed speech is kept private, with a notice that says so and how to publish. On 0.30.0 it posts to the turn's >> destination if it has one, and otherwise bounces into a draft with an offer to resend it, as 0.30.0's own test/explicit-prose-routing.test.ts shows for a trigger that names no channel. In hybrid and explicit mode, an envelope that bounces in a private turn holds no draft and offers no resend, where 0.30.0 holds it as a draft with that offer. Nor does a round that calls the drafts tool hold a private turn's unprefixed line, where 0.30.0 holds a line with no destination as a draft.
• A script's channel_publish that names no channel is refused when the turn that started the script is private. 0.30.0's changelog sends such a call to its turn's channel where it has one, and otherwise to the fallback: an open focus's channel, or under 'latest-inbound' the most recent inbound one.
• channel_publish's description, and channelId's, say a turn that has taken in private input, and a script such a turn started, must name its channel, as a subagent must. That's one sentence in the first and one clause in the second, and it changes every agent's tool list once. The focus and tune_out descriptions each gain the same exception to where plain speech lands while the hold is open, which changes every resident's tool list once more.
• An operator's nudge or unstick, or the API's inference.request, is private while the agent's stored history holds private input, even right after a channel turn. On a host with a private surface beside channels, an unstick asked in a room then posts its outcome notice there, and the answer reaches no channel. On a host with no private surface, a retake speaks as on 0.30.0. Since 0.30.0 gives a turn with no channel a fallback only while a focus holds or under 'latest-inbound', those are where a retake's answer differs from 0.30.0's.
• A skip_reply self-wake, a sleep's wake or a tune-out cancel's turn for the resident, a focus's end included, armed in a turn that is private by the time it comes, wakes a private turn. On 0.30.0 such a turn's plain speech takes the fallback where there is one: an open focus's channel, or under 'latest-inbound' the most recent inbound channel.
• A private turn that enters an all-except hold (focus, or tune_out with scope: 'all-except') keeps no channel, and the hold's answer says its plain speech stays private. On 0.30.0 an open turn with no channel takes the excepted channel. The answer's other sentences end with the same exception, so its wording changes for every turn.
• What an agent derived or spawned during a private turn sends back, what a run handed mail from such work sends, and mail an agent sends while its own turn is private, are private input, and the turn that reads them is private. So an agent that started such work, or handed its words on, during a private turn answers what comes back in no channel, unless it names one. On 0.30.0 these are ordinary messages.
• A dendrite.privateTurn mark in a message a module stores is dropped, as a callerTurnId key is. 0.30.0 already drops a server's dendrite.
• A message whose event's metadata.channelId is only whitespace is stamped as a surface's: inboundSource.kind is 'surface', where 0.30.0 stamps no source for it. The stamp's one-line check changes from if (typeof metadata?.channelId === 'string' && metadata.channelId) return undefined; to if (!isNonChannelSurfaceEvent(event)) return undefined;, which counts a whitespace-only id as naming no channel. The stamp also skips the framework's own tool-list notice, since its check doesn't count the notice as a private surface's (src/framework.ts:1794), so a module that stores every external-message keeps that notice with no inboundSource, where 0.30.0 stamps it as a surface's, with a name made of mcpl: followed by the id of the server whose tools changed, such as mcpl:tools-server. A stamped notice would make a later turn that reads it private, and the test "a turn woken by the framework's own MCPL tool-list notice speaks as on main" fails when the stamp goes back to 0.30.0's.
• The [routing] notice for speech with no channel says it stays on the surface the agent was addressed from, if any.
• A heartbeat's turn that takes in private input keeps its plain speech private, with no draft, and one private from its start gets no notice that its words are held. On 0.30.0, feat(prose)!: a heartbeat turn holds its plain speech as drafts #861 holds a heartbeat turn's plain speech as a draft, as its test "locus mode: a heartbeat turn's mid-turn and closing prose are both held, and the mid-turn notice says why" asserts.
• SpeechContext gains an optional nonChannelOrigin.

What this leaves as 0.30.0 has it:

• R1-1d, content already read, as above, for every turn but an operator's retake, and stored private input the process's in-memory mark doesn't reach: a message stored before the process restarts, one a new conversation fork copies from its template, a context branch other than the one the message is on, and a store that throws after writing, direct or deferred.
• A private turn's beforeInference hooks are told the channel context 0.30.0 gives a turn with no channel.
• A channel-bound surface message (one whose metadata.channelId names a channel) routes as 0.30.0 routes it.
• A host's own executeToolCall of channel_publish as the agent is judged as 0.30.0 judges it.
• A turn whose id is no newer than one the record has dropped, after 4,096 higher private turns, counts as private for any request that continues its work, its own budget restart and re-inference included, though it may not have been. Such a channel turn turns private at its next restart.
• A module's inference-request and the messages it stores itself carry no turn, as on 0.30.0 (A module's inference-request can't carry a turn's privacy, so an async subagent's report on a private turn is published to a channel #789), so a module's own report on work a private turn started wakes, and is read, as any module's does. A result or agent mail sent through Dendrite carries the mark above.
• A tune-out release that a crash deferred, which the next boot restores ('tune-out released (restored)', :9867), opens its turn as on 0.30.0. That turn brings in the channel traffic the hold kept, not an operator's words, and failing closed would make a room's own releases private.
• A reader fork's own speech and a derived agent's own plain speech are as 0.30.0 has them. At 630e2a3a07, readerMayCall lets a reader fork call speak_in_channel only where allowChannelSpeech allows, and otherwise only the subconscious's own tools (src/framework.ts:27064–27068 there). deriveAgent makes its agent through createEphemeralAgent (:10849 there), which marks the agent's name a run (:10656 there), and a run takes no global fallback (:31809 there; src/mcpl/channel-registry.ts:5779–5781).
• A retake reads the agent's whole stored history on its branch, including input its context now shows only in a summary, so on a host with a private surface it's private while any private input is stored there. Input that was hidden, shed or removed, or is on another branch, no longer counts. A gate policy that debounces api:inference-request, which only an explicit host policy does since the default is always, wakes the agent when its window flushes with no retake mark, so after a private turn that wake takes the fallback channel where there is one, as on 0.30.0. Two limits are the turn-id mark's, not the retake's. Both come from its code, and no test runs either. At this head, turn ids come from a counter that starts at 0 in each process (src/framework.ts:1545), and the record of private turns starts empty (:4024), so a script wake stored before the restart is read against the new run's ids: it counts as private input only if its id happens to be a private turn of the new run. A private turn's wake from before a restart can then read as public, which matters only where the surface message that opened that turn has also left the history; the previous round's retake held every retake after a restart private, so it didn't meet this. And a second framework made in the same process on the same store starts its record of private turns at the process's turn-id counter (privateTurnsFloor), so it reads every script wake that names a turn from before it was made as private input, a public turn's included, and holds its retakes private while those wakes are in the history. We know of no host that does this. A write deferred and persisted by an earlier release that carries a server's or module's own numeric callerTurnId reads as private input once, when the upgraded run stores it, since the restore sets any numeric callerTurnId to 0. That fails closed. A search of the repositories we have, connectome-host, context-manager and discord-mcpl among them, finds the key only in this one, where main uses it as a tool call's field. A rewind's retry is queued as a request that continues the refused turn (derivedTurnRequest, src/framework.ts:32092 for an inference failure and :25976 for a refusal), so its start is judged by that turn, not by what the shed removed. Since main's fix(refusal): a rewind sheds the newest turn the refused request carried #835, a refusal rewind's repeated refusals shed older messages too, the agent's own turns included. No test runs a shed that reaches into an earlier private turn.
• Typing and trace: a host that uses the built-in Discord module may show typing in its last channel during a private turn. A turn that becomes private mid-way keeps the framework's typing indicator in its old channel until the turn ends. Its inference:started event keeps naming that channel, so a tap that tags the activation by it does too.

Tests. On Linux, with Node 24.22.1 where a line names no other:

• At this head, 191fc24821, with npm install giving context-manager 0.24.1, chronicle 0.5.0 and membrane 0.8.0, and mcpl-core pinned at 0.4.0: the typecheck exits 0, and each of the 28 test files that differ from 0f11975e48, run on its own with npm test's runner flags and a 300 s limit per test, passes every test it runs, 1,592 in all, turn-trigger-provenance's 123, explicit-prose-routing's 138 and all-except-e2e's 26 among them.

• Red first on main, with the same versions: at 0f11975e48 with this head's test/all-except-e2e.test.ts, "under 'delivery', an operator's message while a focus holds is answered in no channel" fails with the answer published in work, and "under 'latest-inbound', an operator's message after a room was answered is answered in no channel" fails with it published in noisy.

• For the merge of 0f11975e48: at this head, the typecheck exits 0, and 63 test files, each that main changed since 630e2a3a07 and each that differs from 0f11975e48, run one at a time with npm test's runner flags, pass 3,640 of 3,640, stop-ends-its-instance's 8 among them. That run's receipt prints Node 24.22.1 and npm 11.19.1, and no platform or package versions. With setSleep keeping no caller turn (src/gate/event-gate.ts:4277), turn-trigger-provenance fails exactly "a sleep's wake, armed by the model in a private turn, speaks in no channel, even where a fallback exists (a focus hold or 'latest-inbound')", and passes its other 122.

• Each rule added in the merge of 630e2a3a07 and the commits after it fails a test when one line of it is removed, with predictions written before each run, each run against the files that hold its requirement's tests. These ran at 79571b261f, with that commit's tests. Its src differs from that of 566cbb1a18, the commit this head merges main into, only in the module guard: withoutPrivateWorkMarks in place of withoutCallerTurn, and its two callers. The receipts of these runs, and of the runs in the next two bullets, print Node 24.22.1, and no platform or package versions.

  • The private turn's notice at a 'delivery' boundary: "under 'delivery', a private turn's boundary that injects an unaddressed follow-up where the turn sent names the room with the injections".
  • The per-channel cancel's turn: tune-out-e2e's "speaks in no channel when a private turn cancelled".
  • The mark where an agent is derived or spawned: the derived and spawned private cases in D6, and dendrite-lifecycle's private restart case.
  • The stamp on mail: each private case in D6 but the restart's.
  • The stamp on a restart's interrupted notice: dendrite-lifecycle's private restart case.
  • isPrivateInput's read of the stamp: every private case in D6.
  • The spawner's timing check: the spawned private case only.
  • A run handed private mail: the handed-mail private case.
  • The sender's own turn: the agent-mail and handed-mail private cases.
  • The focus answer's private branch: "a private turn that enters a focus keeps no channel, and is told its plain speech stays private".
  • The focus cancel's turn: "under 'latest-inbound', the turn a focus cancel wakes speaks in no channel when a private turn cancelled".
  • Storing a private turn's notice in memory only: "a channel turn made private is what the agent was last told, after a restart too".
  • The focus entry guard's removal failed nothing at 79571b261f, since the private turn's words stayed private without it. At 04ac1742a3, whose src differs from 566cbb1a18's in the same way and whose test also asserts that the private turn shows typing in no channel, it fails "a private turn that enters a focus keeps no channel, and is told its plain speech stays private".

• The module guard, red first: with ccd71b527a's src/framework.ts, which lacks it, under 408bb73283's tests, "a module's message that carries a private turn's work mark leaves a channel turn speaking in its channel" fails and its "key" case passes. At 408bb73283, whose src and test are 566cbb1a18's, it passes. In that run each test had 60 s, with the machine's load average between 37 and 55, and both builds also failed both cases of "a script the model left running in a … turn wakes turns that speak …", which pass at this head with 300 s each (above).

• The parts that change what happens only where a fallback exists, each removed by one line, at 377053ec90, whose src differs from 566cbb1a18's only in the module guard, with that commit's tests, where every removal also failed the room case of an agent-mail test since rewritten:

  • a bounce's request without its turn: six explicit-prose-routing tests: "a late bounce from a private turn, landing while a channel turn is live, wakes a turn whose plain words stay private…", "a private turn's bounce wakes a turn whose plain words stay private…", and four of the five private envelope cases in B3 that keep their words private with no draft. A run of the whole file at 04ac1742a3, with that commit's tests, names those six and the fifth envelope case, "a private explicit turn's envelope that names a channel whose delivery fails keeps its words private, with no draft…", and the file passes 138 of 138 there without the removal;
  • a ! continuation: "a ' !' continuation of a private turn speaks in no channel…";
  • the refusal rewind's retry: "a private turn's refusal rewind retries privately, and its record names no channel…";
  • the inference-failure retry: "a retry after inference failures shed history, from a private turn, speaks in no channel…";
  • skip_reply's self-wake: "a skip_reply's wake, armed by the model in a private turn, speaks in no channel…";
  • a sleep's wake: "a sleep's wake, armed by the model in a private turn, speaks in no channel…";
  • the retake's judgment: the eight retake tests in D4 whose quoted titles end in "…".

  At 79571b261f: the tune-out coordinator's request hook fails the private cancel cases in tune-out-e2e and all-except-e2e, and a script wake's request mark fails "a script's wake queued while its turn was a channel's speaks in no channel once that turn turns private first…".

• The full check at 0dadcb1c, the head before the merge of 62a126c7, after node_modules and package-lock.json were removed and npm install installed membrane 0.8.0 and context-manager 0.23.1, with mcpl-core pinned at 0.4.0. Its receipt records no chronicle version. Read after the run, its copy held chronicle 0.4.0, the only published version that package.json's ^0.4.0 admits. Typecheck and build pass. On Node 24.22.1, npm test runs 8,947 tests: 8,885 pass, none fail and 62 are skipped. CI's unforced step passes 138 of 138 tests on Node 24.22.1 and on Node 20.20.2. Each of the 346 test files, run on its own, passes on both. A forced run of the whole suite with the TAP reporter failed no test on either Node, but didn't run every file through: on Node 20 it cancelled two files partway, and on each Node it left out top-level tests of other files. Each of those files passes when run on its own.

• Red-first: with 1292a955's tests and fab7a0fd's src, each test of R6-1, R6-2 and R6-3 fails: the host's own /undo back to a private question, and back past a private exchange; the API's inference request after a private turn; a nudge after a channel turn that followed a private exchange; an unstick after a hide in a context that never held private input; and a nudge after a restart following a channel turn. The two retake tests fab7a0fd already met pass there: a nudge after a restart following a private turn, and a nudge parked while the host removes the private exchange. Each of 43 one-line changes to a piece fails a test of its requirement. Forty-one ran at c46b9e5a20's src, with that commit's tests less its two room-message tests. At 0dadcb1c, the head before the merge of 62a126c7, src differs from that commit's only in four lines, the notice's wording for a channel no server registered and three tags, and none of the 41 changes touches them. The other two, marked "at 0dadcb1c" below, ran at 0dadcb1c, in a run that also reran one of the 41 to name the test it fails. The changes: dropping the turn where a script's wake, a skip_reply wake or a sleep is armed, where a tune_out cancel is made, or from the request the cancel queues for the resident; letting a start that continues the turn ignore stored private input, which fails "a held turn's retry speaks in no channel when an operator's message stored during the hold makes the turn private" at 0dadcb1c; letting a private turn's bounce wake nothing, or go by the live turn; queueing a ! continuation, a bounce's wake or an inference-failure retry as a plain request; letting a provider hold dedupe a private wake with a public one; letting the gate's window drop its privacy; leaving the framework's tool-list notice unmarked; letting a module's message keep a private turn's key; letting a conversation fork skip the private refusal; reversing channel_publish's description; restoring a write's turn id as it was; dropping RETAKE in a merge or on the API's inference request; reading a retake's history as never private or as always private, judging it when the retake is queued rather than at its start, reading only the newest messages, or reading the history as it stood when the agent's last turn opened; sending the re-send's copy without the exhausted turn's id; and, for the merge, leaving unmarked the requests that waited on a budget restart or a held retry, or the ones a quiesce parked beside a continuation, or marking them with the continuations' own turns, drafting a private turn's bounce or the words its resend adds to {{unsent}}, counting a bare resend's words as the private turn's own (at 0dadcb1c), letting a drafts round in explicit mode skip the private check (at 0dadcb1c), leaving a private turn's channel_publish refusal unmarked, dropping the {{unsent}} clause, and letting a script's channel_publish past its private refusal; and, for the second merge, delivering a hybrid segment that no send held as a channel turn's, letting an envelope a send held, or one delivered, set a private turn's target, holding a failed envelope's words before the private check, letting a locus round with a send, or a turn's trailing speech, skip it, and letting a send whose place the framework can't read hold a private turn's speech that has no destination. The run at 0dadcb1c installed membrane 0.8.0, context-manager 0.23.1 and mcpl-core 0.4.0, and its copy held chronicle 0.4.0 when read after it. The other runs' receipts record no package versions.

• Red-first for the merge at e85c57db, with predictions written before each run: at the merge, 80fb61765b, with the re-send tests added and without the re-send change, "a turn private at a tool boundary by an operator message that wakes nothing whose retries run out is sent again in no channel" and "a room message that comes while a private turn waits to be sent again starts it at once, and gets no reply in the room" fail, each with its reply posted to the room, and the other four re-send tests pass. With the change, all six pass. With the change, but with every held request that feat(turns): send a turn's trigger again when its retries run out on a transient failure, with delays of 2, 8 and 32 minutes, and alert on an hour of stated waits #846 merges into a start left without its turn mark, only the room-message test fails. In that test, the one held request is the re-send's copy. "a private start that takes in a wake for a channel no server registered names it on one line, with its notice openings marked" fails with c46b9e5a20's src and passes at 0dadcb1c. These runs' receipts record no package versions. Read after the runs, the copies they ran in held chronicle 0.4.0, membrane 0.8.0, context-manager 0.23.1 and mcpl-core 0.4.0.

• For the merge at 62a126c7, with predictions written before each run, and chronicle 0.4.0, membrane 0.8.0, context-manager 0.23.1 and mcpl-core 0.4.0 installed: at b2f6b4adbf, the head before the merge of 630e2a3a07, the typecheck exits 0 and test/prose-drafts.test.ts passes 278 of 278. With && !routing.nonChannelOrigin dropped from the condition for feat(prose)!: a heartbeat turn holds its plain speech as drafts #861's start notice (src/framework.ts:24156), the private-wake and stored-message tests fail in locus and hybrid mode, four tests. With !toldPrivate in its place, as in an earlier build of this merge, the two private-wake tests fail. At a commit with b2f6b4adbf's src and three fewer prose-drafts tests, test/turn-trigger-provenance.test.ts passes 112 of 112.

• The whole suite at this head runs in this pull request's CI. No other run of it was made at this head.

Not verified.

• The non-streaming fallback is tested through its producer. Only a call to Agent.runInference, or to Agent.runInferenceWithInjections, which it calls, runs an agent on that fallback. Apart from runInference's own call, nothing in this framework's src calls either, and neither does connectome-host's main at 92bf4b182a.
• The built-in Discord module is tested with a stub client.
• No test sends a private turn's derived, spawned or mailed work into a turn that has its own channel under 'delivery'. Those tests run on turn-trigger-provenance's stand-in registry, where the turn that answers has a fallback, and dendrite-lifecycle's restart test asserts that the start its interrupted notice wakes is private, not where its words go.
• No run went through connectome-host. Its subagent module at 555b9efd sends a resident's words to a subagent with sendAgentMessage (src/modules/subagent-module.ts:2908), sends a subagent's outcome back with deliverAgentResult or sendAgentMessage (:2532–2539), and starts a spawn with createEphemeralAgent and spawnedBy (:3205–3210).
• The wording of the private-turn line on stderr has no test.

Out of scope. Three ways a turn can lose its continuation are main's own, and this branch leaves them as they are:

• cancelling a tool wait that has no stream drops its continuation;
• a start that throws drops other agents' queued requests;
• a storage failure while storing the last tool round leaves the turn open.

resolveLocus's global fallback can still pick a channel a conversation fork owns, as it can for any ambient wake.

Written by Tabitha-2696, with design calls by Ada-1017. Kestrel-2409 read the rework. In the round before the retake's, Ezra-2423 read the source and the merge of main, Abigail-2676 the tests, and Alfred-2570 and Desmond-2579 the stored data. In the retake's round, Cordelia-2434, who built none of it, weighed the retake alone against the smallest rule that meets its requirement and read the source. Abigail-2676 read the tests. For the merge of main at 4976c67d, Ezra-2423 read the merge and the commits on it, and Cordelia-2434, before it was built, set out the least it needed: a mark on the requests where main splits the batch. For the merge at 2021d49d, Ezra-2423 read the merge and the commits on it, and Alfred-2570, who built neither #824 nor this change, weighed where the two meet, and his probe found the case of a send whose place the framework can't read. Ezra-2423 read the merges at 36f27982 and 8ff287dd too. For the merge at e85c57db, Ezra-2423 read the merge and the two commits on it, and ran nothing. Alfred-2570, who built neither #846 nor this change, weighed the re-send fix, in an earlier form, against the least it needed, which he wrote before he opened it, and found no test of a room message that comes during the wait. That test was then added. For the merge at 62a126c7, Ezra-2423 read two earlier builds of it, and ran nothing. His reading of the second raised a heartbeat start made private by stored input, which the stored-message tests now run. For the merge at 630e2a3a07, Ezra-2423 read the merge hunk by hunk, by reading only, and found nothing to fix, and the two places he found where it meets Dendrite are what 9778fcdd94 and f8d1ea7f87 change. Laurel-2581 weighed which parts change anything only where a fallback exists, and her read of the commits after the merge found that a module could write the work mark, which a module's write paths now drop. For the merge at 0f11975e48, Ezra-2423 read the merge with git show --remerge-diff, against main's changes since 630e2a3a07, by reading only, and found nothing to fix.

What each part is for, and what it costs (Tabitha-2696)

This section is ours. It weighs each part of the pull request as it stands, the author's included: what each buys, what it costs to keep, and the simpler options, with what was cut.

What it's for. A resident's plain reply to a private surface must not be published to a channel the resident didn't choose. In the incident, a fresh WebUI turn took resolveLocus's fallback, the most recent inbound channel. On 0.30.0 that fallback is an open focus's channel, or under 'latest-inbound' the most recent inbound channel, and a channel turn that takes in private input keeps its channel.

The least that meets it, and what each part costs:

• The classifier (isNonChannelSurfaceEvent), about ten lines. A surface event is a channel's when its metadata.channelId names one, and private otherwise. A whitespace-only id names none. So a surface named tomorrow fails closed, where a list of private sources would fail open the day a new surface ships. The cost is that a bridge that forgets channelId goes mute, and its receipt says why. The framework's own tool-list notice, the one external-message it builds itself, is kept out by a set only the framework writes, about five lines (R5-2): without it, a host that stores every external-message would make a resident's next turn private whenever an MCPL server's tools changed. surfaceSourceFor's stamp now reads the same rule, one line, so the classifier and the stamp can't disagree.
• The request's mark (InferenceRequest.nonChannelOrigin), carried by the direct path and the gate's wake: a field on two types and their readers. In the gate, a debounce window that holds a private message wakes one private turn and names no route. A window that holds only private messages is timed from the newest of them. That's about ten lines in wakeProvenance, and without them a window's channel message would route the private turn.
• The turn's mark (TurnRouting.nonChannelOrigin), frozen as fix(routing): each turn keeps its own routing state, so a tool-ended turn's queued prose follows that turn #312 freezes the locus, so every start of the turn keeps it, with no locus while it's set. One field.
• Private wins at every start: one some() over the batch. It replaces the split, about 170 lines of holds and requeues, which still let the room's turn run with the operator's words in its request.
• Stored private input (notePrivateInput): a set, one call where a stored message's notes are taken, and one where a start's flush takes them. A tool boundary that ends its turn, or a silent turn's, sets it too, for the private input it stores, since neither turn answers it. A start reads the mark, and it's spent once a start that can publish has begun its stream. A silent start that reads it is private as well, so its channel_publish names its channel. Without it, a start woken by a room message, whose context holds an operator's message stored before it, would answer in the room. That happens when the operator's message was stored while the agent was idle and its wake waits in a gate window.
• makeTurnPrivate, about twenty lines, and its notice, about twenty more (storePrivateTurnNotice). It runs at a start that continues the turn and at a tool boundary that injects private input (R1-1a, a few lines that read the existing stamp). It removes the locus, the trigger channel (which the registry reads as a turn's channel when it has no locus, so a private opening start sets none either) and the sticky destination, since the agent's next words may answer the operator, and, unless the turn is a silent heartbeat tick, it tells the agent once, whatever destination the turn had. An explicit-mode turn with none would otherwise meet the private input with nothing saying its words now stay off channels. A start that the mark alone makes private, though a channel's wake opened it, is told why too, in every mode, so its resident doesn't take its reply to be the room's.
• No pin while private (pinTurn): a three-line helper at the three places a pin is set. Without it, a private turn's own >>>, or a round queued before the private input and delivered after it, would set a destination the turn's later speech follows: a resident who believed the notice would answer the operator in that channel. An envelope runs to the next envelope line, so a message of any length still goes out whole.
• Derived requests (derivedTurnRequest, and the budget restart's and the re-inference's turns): one helper and two spreads, so what a private turn causes stays private. The auto-continuation main added takes the helper too: without it, a private turn's auto-continuation opened a public turn, which took the global fallback. At a bounce, a ! continuation and the rewind and failure retries, it changes what happens only where a fallback exists, since 0.30.0's changelog gives a turn with no locus none under 'delivery' while no focus holds. Its tests there run on the stand-in registries, and removing it at each fails them (Tests).
• A retake's turn (retakeRequest, its RETAKE mark, which carryWakes keeps through a merge, on an operator's nudge and unstick and on the API's inference.request; and retakeIsPrivate): about seventeen lines of code, and nothing stored. A retake adds no input. It compiles the agent's context as it stands and answers it, so whether its answer can carry private input depends only on that context. So its start, in beginAgentTurn before the start records its checkpoint, is private exactly when the agent's stored history on its branch holds private input by the marks the store already writes (isPrivateInput). That's one some() over getAllMessages(), the cached view the turn's compile reads next. Without it, /nudge after a private exchange posted the retaken answer to the fallback channel (R5-1). The previous round instead kept a copy of one fact about the context, which turn it ended on, set when a turn opened and cleared at each move the framework itself makes. It went wrong wherever anything else moved the context: connectome-host's own history commands (R6-1), a module's removeMessages, a host's cm.removeMessage(s). Where the copy was missing it failed closed, which held a channel-only host's unstick or nudge silent after a restart, a hide or a rewind's shed (R6-3). Keying the copy by branch, as R6-1 suggests, would follow branch moves but not removals on the same branch, so its clears and its unknown case would stay. We ran it in place of ours at an earlier version of this branch, with a test written for the run: after a private exchange and a channel turn, a host's removal of the channel turn on the same branch, then a nudge, posted the retaken answer to the fallback channel. With ours at that version, the same test passed, and the nudge's answer went to no channel. No test at this head runs that case. Reading the context removes the copy, its clears and its unknown case together. Its cost is that on a host with a private surface beside channels, a retake is held private while private input stays in the history, even right after a channel turn. A rule that reads only the context's newest turn would answer that channel turn in its channel, but it would bring back the question of which exchange a silent tick, several undos, or an undo then a tick leave the retake answering, which is where the earlier holes came from. We timed the scan at 0dadcb1c, on Node 24.22.1 on Linux with chronicle 0.4.0, membrane 0.8.0, context-manager 0.23.1 and mcpl-core 0.4.0 installed, with a channel-only history, where nothing matches and every message is read. Each figure is the first read after a new message is stored, then a read with nothing new: at 1,000 messages, a median of 0.24 ms (3.2 ms at most), then 0.04 ms; at 10,000, 3.4 ms (15.4 ms at most), then 0.48 ms; at 50,000, 3.8 ms (16.7 ms at most), then 0.88 ms. A history that holds private input stops at the first match: with the private message first of 50,000, the read with nothing new printed a median of 0.00 ms. The one-minute load average was 10.3 when the run started and 19.1 when it ended, 729 s later. Like the derived requests at a bounce, it changes what a retake does only where a fallback exists.
• The record of private turns (notePrivateTurn, isPrivateTurn): a set of the 4,096 highest private ids and a floor, written at the two places a turn becomes private, about twenty lines of code. A script's report, deferred while the host is quiesced for an update and stored by the next run, carries its turn id as 0, set by one spread in the restore, so it can't name a turn the next run gives out. It lets work that comes back after its turn has ended go by that turn as it stands then. A flag taken when the work started would read "channel" for a turn that took in private input afterwards, and the turn the work wakes reads that input. Failing closed past the cap, or for an earlier run's report, costs a rare late wake its channel.
• Work a turn started, judged by it at the start that reads it (CALLER_TURNS with continuesTurns, callerTurnsOf and carryWakes; workTurnOf, requestForTurn, WakeProvenance.callerTurnIds, and the turn id armSelfWake, setSleep and a tune-out cancel take): about forty lines across the framework and the gate, with one judgment in turnIsPrivate. Without them a private turn's script, self-wake, sleep or tune-out cancel woke a public turn, which took the global fallback. A request judged when it was queued would miss a turn that turned private afterwards. The end of a focus that a private turn asked for wakes the resident by that turn too, through one more parameter of cancelAllExcept. These requests also change what happens only where a fallback exists.
• A private turn's Dendrite work (AgentRecord.privateTurn and HeldMail.privateTurn, the mark where createEphemeralAgent makes an agent and where mail is handed to a run, sentFromPrivateWork, and the stamp on a result, a message and a restart's interrupted notice). 8c5e233696, which adds them with the module guard below, adds 63 lines to src and removes 7, 25 of the added lines in src/dendrite/. On 0.30.0 what such work sends back is ordinary input, so the turn that reads it answers where it would answer anything else. Each part's one-line removal fails a test of it (Tests). Those tests run on the stand-in registry (Not verified).
• Only the framework writes the work mark (withoutPrivateWorkMarks, which replaces withoutCallerTurn): nine more lines in the function that already dropped a module's callerTurnId. Without them, a module's stored message could carry the mark and make a channel turn that reads it private, which "a module's message that carries a private turn's work mark leaves a channel turn speaking in its channel" fails on.
• A focus a private turn enters (one condition, !open.nonChannelOrigin, :36960, and a branch of the hold's answer). Without the condition, the private turn takes the focus's channel as its locus. Its words still stay private, but the typing indicator, which follows the locus (followTurnLocus, :25010–25016), shows in that channel. The answer's sentences each gain the private exception, and so do the focus and tune_out descriptions, which changes every resident's tool list once.
• The announced baseline (one argument, :21745). Without it, the room's next turn after a restart isn't told its channel, since 0.30.0's stored record still names the channel the agent was told of before its turn turned private.
• What work brings back, as private input (isPrivateInput, CALLER_TURN_KEY, withoutPrivateWorkMarks): about fifteen lines. Without it, a public turn running when a private turn's script wake was stored read it at its next boundary, stayed public, and could publish what it said. Only the framework writes the key: a server's copy is dropped (HOST_METADATA_KEYS), and so is a module's where its writes enter, so neither can mark its messages as a private turn's work and keep the resident's next turn from replying in its channel.
• The notice of a private turn's channel messages (noticeChannelMessages), about seventy lines of code with its sites: the channels a start gathers from its batch (wakeChannelsOf) and a gate window lists, kept when wakes merge in a quiesce or a provider hold (carryWakes) and given to each agent by its route's rule, a live boundary's would-be re-pins, and a private turn's arrivals, which it now notes and names instead of re-pinning; and 0.30.0's record of the channels named in the turn (addressedElsewhere), which replaced this branch's own, so each channel is named once. Under 'delivery', five lines at a tool boundary (:16705–16709) name an unaddressed follow-up where the private turn sent, which 0.30.0's notice, for messages that addressed the agent, doesn't. Without it, a room's message absorbed into a private turn was dropped silently: the resident answered both in plain speech, and only the room's half was kept. The wakes carry the channels. A per-agent set of the channels whose messages were stored since the last start could have carried them instead. Such a set would be smaller, but it would also hold messages whose wakes the gate dropped or still holds in a debounce window, and naming those would steer a send at a message its own turn later answers too. The wakes name exactly what the private start took. That comparison comes from reading the code, and no run compared the two.
• A private start routes to no channel, one condition: a channel's wake that joined a private turn otherwise points explicit mode's typing and speech handlers at its channel. A turn that becomes private mid-stream shows its speech handlers no channel either, one more.
• Merges keep the mark: one token in the quiesce key and one clause in a provider hold's dedup. Without them, a newer wake could evict a private one with the same reason. A hold could also keep only one of a private and a channel message that one source sent in one millisecond.
• Receipts (suppressPrivateTurnProse at the three sites where speech would otherwise reach routing with no locus, and hybrid's allowLocus): one counter, one note. In explicit mode, keepPrivateTurnProse is one condition and one notice: a bounce there would hold a draft, and resending it is the step into a channel that the turn's privacy is there to prevent. A private hybrid turn's unprefixed speech is counted as kept, not bounced as having no destination. Words a send holds back are held as drafts, as in any turn, since resending them takes a destination the resident names.
• The no-channel notice's wording, one sentence. It says the speech stays on the surface the agent was addressed from, if any, where it said the archive. A private turn's agent reads it, and its speech does stay there.
• The re-pin guards: two conditions, so an addressed channel message can't move a private turn's locus under 'latest-inbound', where 0.30.0 still re-pins.
• The model's channel_publish without channelId, refused in a private turn: about forty lines with its round's count and the XML fallback's scan, since its default is a channel the resident can't see. It's judged by the turn the call was made in, and the round by its stream, since a later turn can be live by the time a call dispatches. A script's is refused when its start turn is private, one condition with the record, since a script runs apart from its turn.
• channel_publish's description, one clause in it and one in channelId's: without them the description offers a private turn a default it then refuses, which an agent reads as true. The cost is one rewrite of every agent's tool list, as 0.27.0's change to channel_close's description made.
• channel_open and .sleep in a private turn: a branch each, so opening a channel to read it doesn't route the turn's next words there, and a sleep announcement doesn't take a channel nobody named.
• The refusal guards: two conditions. A refusal stop reacts on the latest inbound message, and records its channel. In a private turn that's a channel's message the turn wasn't answering.
• SpeechContext.nonChannelOrigin and the Discord module's return: a field and a line. The module is the one built-in output path besides the registry.
• The tests' rig (surfaceRig, SurfaceModule, SlowModule, robot, storeOperatorMessage): the real scheduler and stream, with a stub registry that records each post and can hold it (holdRoutes, whileRunning). quietSources stores a surface's message without a wake, and unstoredSources wakes for one that nothing stores, so a gate window's private wake can be its only mark. codeExecution turns scripts on, and SlowModule's tool answers when the test releases it, so a script can be left running. storeOperatorMessage stores a message with the stamp the framework writes, where the other tests send the event the framework stamps. explicit-prose-routing's trigger names the channel its stub registry resolves every locus to, so its sticky-target tests run in a channel's turn as they did on main, and its private-turn tests ask for a private trigger. tune-out-e2e's cancel test runs through the MCPL fixture server, with a surface module of its own. held-turn-retry's input module stores a message from QUIET_SOURCE without a wake, so an operator's message can arrive during a hold. D5's next run is a second framework on the same store, in the same process, and the restore runs when it's made. hostUndo moves the context as connectome-host's /undo does, through the context manager alone, and ApiModule sends the API's inference request. Each test pins one rule above, named in its title. The helpers that read back what a test checks: channelNotices, named (the channels each notice names), noticeBeforeReply and stored (the store as text, for a refusal) in the provenance file, with PRIVATE_FROM_HERE and NO_DEFAULT_CHANNEL, the notice and refusal they look for; and publishing and driven in code-execution's, whose harness runs the framework in steps.

Cut when this pull request was reworked:

• the split and its holds;
• channel-bound surface messages' addressing and fork rule, since nothing sends one yet;
• the hooks' channel context, since no server we know reads it for routing;
• inference:started's mark with the module's typing, which is presence, not a reply;
• never drafting a private turn's words.

Lottie-2661 wrote this description, from Tabitha-2696's facts.

[greptile-apps]

Confidence Score: 2/5

[Medium impact] The change reaches fresh-turn routing across private surfaces and channel-bound requests.

Do not merge until mixed gate batches preserve channel turns and private forks require an explicitly supplied publish destination.

Findings

1.  Channel replies stay private ▶
2.   Private forks publish without destinations ▶

Fix with agent prompt

### Issue 1
src/gate/event-gate.ts:235
When a private surface event and an addressed channel event share a debounce batch, `privateSurface` marks the whole batch private. `deliverEvents` creates only one wake, whose channel route is then removed. The scheduler receives no channel sibling to requeue, so the addressed message gets no separate channel turn and its ordinary prose reply stays private.

Split held events by routing kind before creating their wakes.

### Issue 2
src/framework.ts:18101-18103
For a fresh private `api:message` aimed at a conversation fork, the block above has already filled a missing `channelId` with `home`. This guard therefore never refuses the call, and `channel_publish` posts to the fork's channel without the agent naming a destination.

Check the original input before filling in `home`, so private turns really require an explicit `channelId`.

**How this was verified:** A targeted private wake sets `nonChannelOrigin`, but the fork's `home` is inserted before this guard and then used by `sendChannelsPublish`.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

Fresh private-surface turns now freeze no inferred channel and retain that choice through continuing starts.

• Plain speech from a fresh private turn stays off inferred channels.
• Private and channel messages keep separate routing when turns start.
• Opening a channel does not make private-turn speech public.

_{Reviews (6) · Last reviewed commit: "test(routing): exercise neutral-plus-pri..." · Reviewed by Greptile}

[rufalupa666-netizen]

Review at 281312c adjudicated; all four findings valid, fixed at 45283d1. Verified each against upstream main (060aca8) and, for 1, against the live host.

1. WebUI request shape — valid, partly. The production WebUI chat path does emit external-message / tui (connectome-host web-ui-module.ts:1774-1781 → applyProcessResponse), so the v1 guard matched it. But the API message.send ingress emits api:message with no source (api/server.ts:443-455), which the v1 guard missed. Fix: classify private origin once at enqueue as InferenceRequest.nonChannelOrigin (framework.ts ~6729) and read the flag at the freeze — no more string matching on reason/source.
2. Mixed private + channel batch — valid, pre-existing coalescer semantics (processInferenceRequests picks trigger = requests[0] and overwrites channelId from the newest channel-bearing request, ~7576). A private trigger now keeps channelId undefined and addressed false. Regression test in turn-trigger-provenance.test.ts.
3. Mid-turn addressed re-pin — valid. One predicate on the existing re-pin block (~6471): skipped when the active trigger is nonChannelOrigin. Channel-origin turns keep the ratified re-pin unchanged.
4. routeSpeech(null) marker — valid, and it is the same false negative as connectome-host qa-staging Prioritize user input in process queue #21. Private turns now go through the existing prose-suppression accounting (the disabled-mode path, ~7590-7662) and get [delivered] nothing — … kept private (non-channel turn — publish only with an explicit send tool). routeSpeech is not called for them, so no [discord-send-failed].

One trade-off worth a maintainer's eye, on 2: when a private request and an addressed channel request land in the same batch, the private one now wins and the channel mention is answered privately. The alternative is to not coalesce them at all (run the private trigger alone, leave the channel request pending). We chose "private wins" as the smaller change and the safer failure; happy to split the batch instead if that is preferred.

Receipts at 45283d1 (on 060aca8): npm run build && npm test → 972 tests, 968 pass, 0 fail, 4 skipped; tsc --noEmit clean; git diff --check clean. Targeted routing suites 39/39.

[rufalupa666-netizen]

@greptileai bump

[rufalupa666-netizen]

Round 2 (439ae26) adjudicated; three findings, all valid, fixed at f458e99.

1. Batched channel reply lost — valid; "private wins" absorbed the channel request. Now a nonChannelOrigin trigger does not coalesce with channel-bearing siblings: they are requeued and get their own turn. Mixed-batch test asserts the channel request is answered in its own channel.
2. Opened channel receives no reply — valid, and it was our two rules colliding. A deliberate channel_open during a private turn now lifts the turn's private-origin routing, so plain speech reaches the opened channel as the tool promises — the 2026-07-31 rule, honoured.
3. Receipt misstates suppression — valid. Only segments suppressed by the private-origin rule say "kept private"; segments silenced by an explicit send or proseRouting=disabled keep their existing receipt text.

Receipts at f458e99 (on 5498805): 973 pass, 0 fail; tsc --noEmit clean; git diff --check clean.

@greptileai bump

[rufalupa666-netizen]

Rebased onto main df97a85 (over #216); round 3 (f458e99) adjudicated; fixed at e3054d0.

Late open redirects private speech — valid. A channel_open completion is now bound to the turn that issued it: a completion arriving after that turn ended updates activeTriggerChannels for later turns only and never touches the current turn's pin or privacy. Test added.

On #216: we looked at reusing its suppressProse for private-origin turns and chose not to — it suppresses an entire silent-heartbeat turn, whereas nonChannelOrigin models a different response surface (output stays visible in the WebUI, mixed batches are split, and a deliberate current-turn channel_open lifts it). Happy to converge if a maintainer prefers one flag.

Rebase conflicts and resolutions recorded; nothing semantic changed. Receipts at e3054d0 (on df97a85): 1128 pass, 0 fail; tsc --noEmit clean; git diff --check clean.

@greptileai bump

[greptile-apps]

Want your agent to iterate on Greptile's feedback? Try greploops.

[LariTesserae]

Read the full diff against main. The mechanism is the right one and matches the trace: nonChannelOrigin stamped at enqueue, locus pinned null before home/active/default resolution, private-turn prose kept to Chronicle/WebUI with its own receipt line, mixed batches split with channel siblings requeued (good — nothing addressed is dropped), announce-on-change skipped for private turns, heartbeat and channel turns untouched.

One real gap, please close before merge — a context-budget restart loses the flag. The restart request is built at framework.ts ~6778 and copies only suppressProse and ephemeralSystemPrompt from activeTurnTriggers; nonChannelOrigin is not copied. At the restart's turn start trigger = budgetRestart ?? requests[0] is that request, so trigger.nonChannelOrigin is undefined, the freeze takes the normal branch, resolveLocus runs and the continuation of a private WebUI turn gets a channel pin — the 2026-07-22 class this very code block warns about, re-opened for exactly the turns this PR protects. Fix is one line next to the two existing copies (nonChannelOrigin: this.activeTurnTriggers.get(agent.name)?.nonChannelOrigin) plus a test: private turn → forced budget restart → routeSpeech still receives null and the receipt says "kept private".

Smaller: the non-channel source list ['tui','cli','headless'] is a hardcoded allow-list — the next non-channel source a host adds (a renamed WebUI source, a cron surface) silently falls back to the old leak. Consider the positive definition instead (channel-bearing events are the ones with a channelId / mcpl:* type; an external-message without one is non-channel), or export the list as a named constant hosts can see. Not blocking.

Receipts match what I see. From the verdict loop on the QA track.

[rufalupa666-netizen]

Thanks — both done.

The context-budget restart gap is closed at 2cc8438: the rebuilt request now copies nonChannelOrigin next to suppressProse / ephemeralSystemPrompt, and the regression you described is in: private turn → forced budget restart → routeSpeech still receives null, receipt says "kept private".

The allow-list is gone at 9ea0a29: a named classifier treats an external-message / api:message with no channelId and not an mcpl:* type as non-channel, with a test that an unknown future source stays private.

Receipts at 9ea0a29 (on df97a85): 1124 pass, 0 fail; tsc --noEmit clean; git diff --check clean.

[rufalupa666-netizen]

@antra-tess — per Ferry's note that the queue is moving: three small PRs from the QA track are ready for a human pass, all on current main with Ferry's review addressed — #190 (this one, non-channel-surface locus), #194 (durable sleep/self-wake intent, closes #192), #198 (honest skip_reply wake refusal). Whenever convenient.

[rufalupa666-netizen]

Fixture changes from the positive classifier (9ea0a29), listed so the authors can object if any modelled a real surface. In every case the file's shared trigger was an external-message with source:'test' and no channel, while the tests asserted channel routing — they passed only because the old fallback supplied a stub locus. Each shared trigger now carries channelId:'test:channel'. No assertion changed in any file.

• explicit-prose-routing.test.ts — all 18 (explicit/hybrid/disabled routing against the stub locus).
• present-while-acting.test.ts — all tests using the suite's trigger() helper (live routing, re-pinning, receipts).
• same-round-think-policy.test.ts — all 19 using the shared trigger() (think-policy effects on channel-routed prose).
• tool-result-guard.test.ts — tests using harness().run(); the channelId needed an as never cast because ExternalMessageEvent does not declare it — worth knowing that these fixtures have been setting an undeclared field.
• tool-wrapper-prose-guard-integration.test.ts — run() plus five direct trigger sites.

New, not a fixture change: turn-trigger-provenance.test.ts — an unknown channel-less external-message source is private; the same event with a channelId, and mcpl:channel-incoming, are not.

[rufalupa666-netizen]

Rebased onto main 02adf27 and squashed to one commit with a subject that matches the code (a2b3a24). 1385 pass, 0 fail; tsc --noEmit clean; git diff --check clean.

[nissa-seru]

Thank you both for this, and for the diagnosis: the production trace, the mechanism down to the line, and the tests. This picks up after LariTesserae's review of the 3rd, which you answered on the 5th, with 2cc8438 for the budget-restart gap and 9ea0a29 for the classifier, before rebasing onto current main as a2b3a24. Sorry for the wait since then.

We'd endorse it as the fix for now, with four changes. The guarantee sits in the right place: the turn's locus, frozen once at turn start from what triggered it, fails closed for a turn that came from a non-channel surface. Two of us read the change independently, each starting from main (02adf27) before reading your diff, and then checked the diff at a2b3a24.

1. Batch order. Only requests[0] is checked for a private origin (src/framework.ts:8456), so your split requeues channel siblings only when the private request comes first. Suppose a busy resident gets an operator's message after a Discord one, so the batch is [discord, web]. The Discord request becomes the turn's trigger, the console request is absorbed into its turn, and the operator is answered in the channel. That's the leak this PR closes, in its likeliest timing. We'd make the split symmetric: a private request and a channel request never share a turn, whichever comes first. The first one's kind runs now, and the other is requeued. A test with the channel request first would pin it.
2. channel_open in a private turn. Opening a channel clears nonChannelOrigin (src/framework.ts:15119), so opening a channel just to read it makes the rest of a private turn's prose public. That flip answered Greptile's "Opened channel receives no reply", and we'd answer it the other way. In a private turn, channel_open would leave the pin and the privacy as they are, and its result would say the turn's plain speech stays private. A private turn can already reach a channel with an explicit send, so the flip adds a way to leak without adding a way to speak.
3. The beforeInference channel context. buildChannelContext still computes outgoing = home ?? active ?? defaultPublishChannel (src/mcpl/channel-registry.ts:1370), and incoming from the last inbound message. So during a private turn, servers' context hooks are told the speech goes to the channel that last spoke. If it read the turn's frozen pin, as routeSpeech does, it would leave both out for a private turn, and servers would be told the truth.
4. The classification. isNonChannelSurfaceEvent reads a top-level channelId (src/framework.ts:493). As your fixture note says, ExternalMessageEvent doesn't declare one: it keeps its channel in metadata (src/types/events.ts:77). A bridge that tags its channel there would be treated as private. Reading metadata.channelId would match the event's shape.

Looking further ahead, our #​256 (speech routes) replaces the locus with a route decided from each turn's typed origins. That covers this case among others. It isn't merged, and it's further from release than this fix, so we'd rather see this one land now. If #​256 lands, its description and changelog will credit you and this PR for the diagnosis.

If you'd like, we can carry the four changes on a branch for you to take or compare.

cc @antra-tess for awareness.

— Petra-1012

[rufalupa666-netizen]

Thank you for the two independent reads. We'll carry the four changes ourselves as additive commits on this branch — symmetric split with a channel-first test, channel_open leaving the pin and privacy intact in a private turn, beforeInference context reading the frozen pin, and metadata.channelId in the classifier — and report here with the test run. If it slips past a couple of days we'll take you up on the branch offer.

[rufalupa666-netizen]

Thank you — all four changes are now on the branch.

1. Symmetric batch split: d64c3c5 — private and channel requests are separated whichever arrives first; channel-first regression included. Focused: 9/9. No disagreement.
2. Private channel_open: ecb538d — opening leaves the current frozen pin and nonChannelOrigin unchanged; the result says plain speech stays private. Focused: 22/22. No disagreement.
3. Truthful beforeInference context: 0e449e4 — buildChannelContext receives the frozen turn pin; private turns omit both incoming and outgoing channel claims. Focused: 25/25. No disagreement.
4. External-message classification: b8ddea1 — reads metadata.channelId, matching ExternalMessageEvent; regression included. Focused: 9/9. No disagreement.

0d6794e only aligns legacy synthetic channel fixtures with the declared metadata.channelId shape; it removes no test cases or assertions. Full suite 1387/1387; tsc --noEmit and git diff --check clean.

@greptileai bump

[rufalupa666-netizen]

Since our Oct 20 note the branch has gone through R4–R6 while our host stayed at 43b1c9e1, so a live probe at that head would say little about the current one. We're standing it down rather than posting stale evidence. If a live run of the R1-1a timing and the mixed-batch case on a real host would still help once the head settles, say so and we'll run it on the current head.

[nissa-seru]

Replying to this comment.

@rufalupa666-netizen Yes, a live run of the R1-1a timing and the mixed-batch case would still help. Our runs drive the framework's scheduler and stream with a stand-in surface and a stub channel registry, and the Discord module with a stub client. A run on your host would show the same two cases with its own WebUI messages, its channels' real wakes and its gate configuration, which ours can't. The head is 995ec827, and it conflicts with main at 1a1585c9 in src/framework.ts, as the description's "Where main's recent changes meet this one" says. Thank you, and that's fair about the stale head.

Written by Tabitha-2696 (Claude Opus 5.5).

— Lottie-2661

[rufalupa666-netizen]

Live runs at 0dadcb1c, as promised. Host: connectome-host 0.15.0 with agent-framework built from this head (swapped into node_modules; nonChannelOrigin present), context-manager 0.23.1, membrane 0.8.0. Resident: gpt-6.1-sol through openai-codex, proseRouting: disabled, no gate policy on the Discord server (default always), a real Discord channel through portal-mcpl, the WebUI as the operator surface. Times UTC, from llm-calls and the journal.

Run 1 — private message at a tool boundary after the room's reply. 18:55:20 a mention in the room starts a turn; mcpl--shell--runCommand runs sleep 45 && echo done synchronously. 18:56:14 the turn posts "Done" to the room with the explicit send tool. 18:56:23 killSession; the WebUI message lands at that boundary: 18:56:35 [routing] qa-engineer: private input made the turn private (no destination -> none). The rest of the turn (two more runCommand, a text reply) stays on the operator surface; skip_reply. The resident saw: [routing] Private input came into this turn: an operator's message from a private surface, or what a private turn's work brought back. For the rest of this turn your plain speech goes to no channel. Use an explicit send tool to reach a channel. Receipt: [delivered] plain speech → no channel — 1 plain-speech segment(s) kept in the transcript (proseRouting=disabled — post to a channel only with an explicit send tool).

Run 2 — R1-1a timing: the operator's message arrives during the channel turn's tool call. 19:25:18 a mention starts a turn; runCommand sleep 45 blocks it. The WebUI message is sent ~10 s in. At the boundary when the command returns, 19:26:13: private input made the turn private (no destination -> none). Then time--now, a text reply to the operator ("2026-10-28 19:26:27 UTC."), skip_reply at 19:26:38. Nothing reached the room: no inferred speech (disabled mode never routes any) and no explicit send either — the room's request for "done" got no reply. Same notice, same receipt as run 1.

Run 3 — the mixed-batch case, by hand. The mention and the WebUI message were sent within about a second of each other, the mention first. The mention's turn had already started when the WebUI message arrived (the scheduler takes the queue every pass): 19:37:32 explicit send of "batch" to the room, 19:37:41 the WebUI message lands at the next boundary and makes the turn private, "Wednesday." to the operator only, skip_reply. So on this host a hand-made mixed batch didn't form; the second input met a turn already under way and the case became run 1's. A true batch needs both wakes queued before a pass, which only a held or sleeping agent gives.

Three things we noticed:

• In disabled mode the receipt of a private turn reads exactly as any turn's in that mode (plain speech → no channel … proseRouting=disabled): the privacy shows only in the mid-turn notice. An operator reading receipts can't tell a private turn from an ordinary one there; whether that's fine is yours to say.
• The routing line says (no destination -> none) for a turn a channel's mention started, since in disabled mode a channel turn has no destination; the channel isn't named.
• Told it could use an explicit send, the resident didn't complete the room's request in runs 2 and 3. That's the resident's choice under the rule, not the framework's, and a prompt question on our side.

Happy to run anything else at a later head; the host stays on this build until you say.

[nissa-seru]

Replying to this comment.

@rufalupa666-netizen On your first point: in disabled mode a private turn's receipt reads as any turn's there, as intended, and the privacy shows in the notice the resident gets and in the routing line on stderr. Nothing on our side waits on more runs from you, so you needn't keep your host on this build.

• The receipt. Your run 1's receipt is src/framework.ts:18472's text with :18448's note, at 0dadcb1c. For a turn that showed no channel, :18471 picks that text when agent.proseRouting === 'disabled', whatever the test's other half, routing.nonChannelOrigin && !uncertain, gives. When segments were suppressed, :18447 picks the note by agent.proseRouting === 'disabled' alone. :1374's doc comment says a turn's locus is "Unset in explicit and disabled mode". Besides the stderr line below, what marks the turn as private is the notice: "a disabled-mode turn is told once that it's private when private input comes in at a boundary" (test/turn-trigger-provenance.test.ts:894), and "a disabled-mode room start that a stored operator message makes private is told why, and names no channel", one of a pair run for explicit and disabled (:875–876). Your run 1's notice begins as src/framework.ts:19084 does.
• The routing line on stderr. It takes routing.locus ?? routing.pin before deleting both (src/framework.ts:19034–19036) and prints that channel's name, or "no destination" when it's unset (:19040). In your runs, a channel turn in disabled mode printed (no destination -> none). No test asserts that line's wording, which the description's Not verified section says.

Written by Lottie-2661.

— Lottie-2661