[antra-tess]

Problem

Every prose routing mode that delivers unprefixed speech (locus, hybrid) lets the host decide where it goes: the channel that woke the turn, a re-pin on an addressed message, the agent's own channel_open. Some agents want the reverse: one destination they choose, held across turns, that nothing moves until they move it, including pointing it at drafts so nothing is posted.

Changes

• proseRouting: "locked": every turn's locus is the agent's lock, heartbeat turns included. Nothing moves it automatically: not the trigger channel, an addressed message or engaged-channel follow-up (under either speech.locus rule), channel_open, or an all-except tune-out's focus channel.
• prose_locus tool, offered only to locked agents and refused for others:
  • {} reports where plain speech goes.
  • to: "#channel" | "@person" | <id> resolves the way a >> target does (resolveProseTarget, forSpeech, the turn's own channels). An ambiguous or unknown name is refused with candidates and moves nothing.
  • to: "drafts" holds plain speech as no-destination drafts. There's no per-round notice; the turn's [delivered] receipt names them.
  • A move is written to framework/state (proseLocks) before it applies. It reaches the calling turn's later rounds (same-round prose keeps the locus it had) and every later turn, and it survives restarts. A puppet or host call moves only later turns.
• AgentConfig.proseLock is the destination until the agent first chooses. It's resolved at each turn's start, so a channel that registers later is picked up then. With neither a choice nor proseLock, speech is held as drafts. If the stored choice can't be read, speech is held as drafts (fail-closed) rather than falling back to the recipe's.
• Locked-to-drafts turns have no channel. activeChannelResolver returns locus ?? null, so a send tool called with no channel has no trigger-channel default, and sleep posts no announcement.
• Kept from locus mode:
  • send silencing (sendCallIds include locked)
  • receipts
  • the mid-turn addressed-elsewhere [routing] notice, now under either locus rule, with arrivals noticed at the next start. The wording drops "this turn".
  • announce-on-change: the turn after any lock change opens with a [routing] notice of where speech lands, prose_locus moves included, so a rewind that drops the exchange still leaves the agent told. A proseLock channel that registers late is announced too.
• Who doesn't lock: a locked agent's conversation fork routes as locus mode (bound to home). Its ephemeral run routes as disabled and publishes no plain speech: in locus mode its narration between tool calls could post to the inferred channel. Neither is offered the tool (proseRoutingOf).
• Turns routed only at their end (membrane's XML path): a move holds the rest of the turn's plain speech as drafts, since which words came before it can't be told (heldForMove).
• Agent-facing text:
  • a one-time [prose-routing] primer on switching in;
  • the prose_locus description and results;
  • a routing line in channel_open's result;
  • locked variants of the closed-channel invitation's option 1 and the tune-out result.
• Docs: docs/locked-prose-routing.md, a changelog fragment, and the AgentConfig docs.

Companion PR

connectome-host: recipe accepts agent.proseRouting: "locked" and agent.proseLock and passes them through: anima-research/connectome-host#603. Merge this one first. The host PR needs a release containing it, since AgentConfig.proseRouting doesn't type "locked" before. This PR changes nothing for agents that don't set the mode.

Tests

• New test/locked-prose-routing.test.ts, 9 tests:
  • the lock beats the trigger channel, and the primer is written once;
  • an addressed DM mid-turn moves nothing under delivery or latest-inbound and is announced;
  • prose_locus moves later rounds and later turns, and survives a restart, outranking proseLock;
  • drafts hold with a receipt and no per-round notice;
  • no lock means drafts;
  • a heartbeat speaks into the lock;
  • an unresolved target moves nothing;
  • channel_open moves nothing and says so;
  • the tool is offered and refused by mode.
• Affected suites after rebasing onto main (locked-prose-routing, present-while-acting, heartbeat, explicit-prose-routing, prose-drafts, publish-default-locus, trunk-channel-routing, batched-wake-locus, routing-baseline-restart, auto-continue, all-except-e2e, outgoing-stream, conversation-routing, channel-registry-routing): 786 pass / 0 fail. The full suite is left to CI.
• tsc --noEmit is clean. The connectome-host side typechecks against this branch.
• Five review rounds are addressed in 9d29c9b, ecc3f07, f42d19f, 48b8db1 and d3ed631 (triage in the thread). Affected suites after them: 970 / 0 across 20 files, with locked-prose-routing at 30 tests.
• Module speech handlers (onAgentSpeech, such as the in-process Discord module) receive final speech in every mode, this one included. That's documented, not changed here.
• CI's first run caught one failure in send-into-closed-channel (a stand-in agent without proseRouting). It's fixed in f571896: an unset mode reads as locus, as before. All 12 CI jobs pass on f571896, including the full Build & Test suite.

Not verified

• Not run against a live Discord or Eidoverse server: the tests use a stub channel registry.
• There's no turn-start notice when the waking message came from a channel other than the lock (e.g. a DM to an agent locked to a public channel). Only the mid-turn addressed-elsewhere notice and the end-of-turn receipt say where the speech went. The trigger doesn't record whether the message addressed the agent, so this is deliberately left out of this PR.
• The agent-facing text above hasn't been tried with residents.

---

• Changelog fragment added — changelog.d/feat-prose-routing-locked.added.md

🤖 Generated with Claude Code

[anima-review]

Automatic review of 4678b1a3df4e.

Findings, most severe first:

• 1. blocker at src/framework.ts:25545, src/framework.ts:26331, src/framework.ts:26429, src/framework.ts:25524, src/framework.ts:25570, src/framework.ts:26436, src/framework.ts:26070, src/framework.ts:21517: The XML/legacy fallback routes all of a turn's prose at the final locus, so a prose_locus move redirects earlier prose. Failing case: With no roundContent, start locked to drafts, write sensitive prose alongside prose_locus({to:'#public'}), and finish the turn: the fallback publishes that earlier prose to #public instead of holding it as a draft.
• 2. should fix at src/framework.ts:21517, src/framework.ts:21532, src/framework.ts:21533, src/framework.ts:21551, src/framework.ts:24359: An out-of-turn prose_locus move advances the announcement baseline, so the agent is never told of the new lock. Failing case: While the agent is speaking in #main, a host or puppet moves its stored lock to #ops; the active turn stays in #main as intended, but the next turn starts in #ops without a routing notice because the baseline already says #ops.
• 3. should fix at src/framework.ts:18325, src/framework.ts:36802, src/framework.ts:37370, src/framework.ts:37371: The invitation and routing results recommend prose_locus without checking whether the agent may use it. Failing case: A locked agent whose allowed tools exclude prose_locus receives an invitation or channel_open/tune_out result saying prose_locus can move its speech, but that tool is not offered and a call is refused.
• 4. should fix at src/framework.ts:21517, src/framework.ts:21536, docs/locked-prose-routing.md:66: The prose_locus result wrongly claims out-of-turn moves apply to the open turn's later rounds. Failing case: A host calls prose_locus to move the lock while the agent has an open turn: the result says its later rounds now go to the new destination, but those rounds retain the old locus.
• 5. minor at src/framework.ts:21413, src/framework.ts:21421, src/framework.ts:21449, src/framework.ts:21415, docs/locked-prose-routing.md:87, change-text.md:15: A malformed stored prose lock is read as no choice, so routing falls back to the recipe destination instead of failing closed. Failing case: After an agent has chosen drafts, damage its stored proseLocks entry to null or an object missing channelId while its recipe points to a public channel; its next plain speech is posted to that channel rather than held as drafts.
• 6. minor at src/framework.ts:26262, src/framework.ts:25545, src/framework.ts:29506, test/locked-prose-routing.test.ts:274, docs/locked-prose-routing.md:72, docs/locked-prose-routing.md:60, src/framework.ts:5178: Locked speech is not held as drafts without a channel registry, contrary to the primer and docs; the tests stub the registry. Failing case: Configure a locked agent without MCPL servers and without a proseLock, then wake it to produce text: the primer says the text is held as drafts, but no draft or delivery receipt is created and the drafts tool is unavailable.
• 7. minor at src/framework.ts:18322, src/framework.ts:21517, docs/locked-prose-routing.md:46: The locked invitation reads the persisted lock instead of the open turn's frozen locus, giving wrong reply instructions. Failing case: An open turn is locked to A, a host moves its stored lock to B without moving that turn, and a closed-channel invitation for B arrives mid-turn: option 1 says plain speech goes to B although the current turn still posts to A.
• 8. minor at src/framework.ts:21524, src/framework.ts:25211, src/framework.ts:25214: Moving the lock to drafts leaves the cached typingChannel stale, so moving back does not restart typing. Failing case: During one stream, move the lock from A to drafts and then back to A; the second move finds A equal to the stale typingChannel and leaves A without a typing indicator for the remaining rounds.
• 9. minor at src/framework.ts:18302, src/framework.ts:18322, src/framework.ts:17619, src/framework.ts:17632: A shared closed-channel invitation states one agent's lock for every recipient, misinforming the others. Failing case: A closed-channel message addresses two locked agents, one locked to that channel and one locked elsewhere: the shared invitation uses the delivery agent's lock, so at least one recipient can be told to reply in plain speech to a channel where its reply will not land.
• 10. minor at src/framework.ts:21428, src/framework.ts:21429, src/framework.ts:21431: Writing locks into a plain object loses the lock for an agent named __proto__. Failing case: A locked agent named __proto__ calls prose_locus to choose drafts or a channel; the call reports success, but no own lock entry is stored and a later turn or restart falls back to its recipe.
• 11. minor at src/framework.ts:21532, src/framework.ts:21551, src/framework.ts:24305: The announcement baseline is not reconciled with branch changes, so an undone lock notice is never restored. Failing case: The agent moves from #main to #ops and then its history is moved back before the prose_locus result; framework/state and the in-memory baseline still say #ops, so the next turn sends to #ops without restoring any notice on the new head.
• 12. minor at src/framework.ts:23463, src/framework.ts:23466, src/framework.ts:23483, src/framework.ts:23493: The locked-mode primer is marked complete before its message is stored, so a failure suppresses it permanently. Failing case: Entering locked mode writes proseRoutingPrimed=locked, then the process stops or addMessage fails before the primer lands; subsequent turns see the marker and never explain locked routing or prose_locus to the agent.
• 13. minor at test/locked-prose-routing.test.ts:291, test/locked-prose-routing.test.ts:296, src/framework.ts:24329: The heartbeat test doesn't verify the heartbeat turn state, so ordinary locked routing satisfies it. Failing case: If heartbeat detection stops marking routing.heartbeat, the queued request still produces Beat at the lock and no heartbeat notice, so this test passes without exercising a heartbeat turn.
• 14. minor at test/locked-prose-routing.test.ts:77, test/locked-prose-routing.test.ts:301, src/mcpl/channel-registry.ts:4520, src/mcpl/channel-registry.ts:4532: The target-resolution tests use a stub that ignores own-channel precedence and forSpeech. Failing case: Removing own or forSpeech from the prose_locus resolution call leaves these tests passing, although a turn's ambiguous own channel can resolve to the wrong server or an inbound-only channel can be accepted as a speech lock.
• 15. minor at test/locked-prose-routing.test.ts:264, test/locked-prose-routing.test.ts:282: The draft tests check only receipt text, not that the stored draft holds the speech and can be resent. Failing case: If the hold path records a draft containing the wrong text or a non-resendable draft while still adding its ID to the receipt, both tests pass despite losing the intended speech.
• 16. minor at test/locked-prose-routing.test.ts:341, src/framework.ts:21402: The tool-offering test does not cover a locked agent's forks or ephemeral runs, which should use locus mode. Failing case: If proseRoutingOf returns the configured mode for every agent, this test still passes even though locked conversation forks and ephemeral runs are offered prose_locus and route with a lock instead of locus semantics.
• 17. minor at docs/locked-prose-routing.md:110, src/framework.ts:21551, src/framework.ts:21443: An unreadable-lock notice is skipped when the baseline is null or unavailable, contrary to the docs. Failing case: After a restart, if reading framework/state fails, both the lock and the persisted announcement baseline are unavailable; announceLocusIfChanged treats null as the unremarkable initial state and emits no warning that speech is being held.

[nissa-seru]

@antra-tess #244, also open, adds homeChannel. Like this pull request's AgentConfig.proseLock, it's an operator setting that names where a turn's plain speech goes: proseLock until a locked agent chooses its own destination, and homeChannel for a turn no channel triggered, such as a heartbeat, under locus routing. Both change which channel a turn's plain speech goes to: this pull request in src/framework.ts, where a turn in locked mode takes the agent's prose lock as its locus, and #244 in src/mcpl/channel-registry.ts, where homeChannel comes after a fork's home and the active channel. So whichever merges second has to fit the other.

Oscar-1808 wrote this, and Fiona-2757 read it.

— Oscar-1808

[antra-tess]

Thanks for the review of 4678b1a3. I checked every finding against the code. The fixes are in 9d29c9b1, one commit, with tests. Fixed means the fix is in that commit; Declined gives the reason.

1. Fixed. Confirmed: with no roundContent, nothing is routed mid-turn, and the end sends every segment to the turn's final locus. A prose_locus move during such a stream now holds all of that stream's plain speech as drafts, sending none of it to either destination. The move's result says this turn's speech is held and the new destination applies from the next turn (TurnRouting.lockMoves, endRouted). The new test runs the XML-path stream (drafts → #ops) and fails without the fix: the text was posted to #ops.
2. Fixed. A move that doesn't reach the calling turn leaves the announce baseline alone, so the next turn starts with [routing] Your plain speech now lands in …. Tested.
3. Fixed. channel_open, tune_out and the invitation name prose_locus only where canAgentUseTool allows it, as the primer already did. Tested with an allowedTools that leaves it out.
4. Fixed. An out-of-turn move's result says it applies "from your next turn" and that a turn under way keeps where it was. Docs updated.
5. Fixed. A stored entry that names no destination now reads as an unreadable choice and holds speech as drafts, instead of reading as no choice. Tested with the recipe pointing at a channel.
6. Declined. Without a channel registry, no mode publishes plain speech or keeps drafts: routing and the drafts tool both need it, and there's no channel to post to. A locked agent with no MCPL channel servers has nowhere to speak, so the primer's wording costs nothing there.
7. Fixed. The invitation reads the open locked turn's locus, falling back to the stored lock. Tested with an out-of-turn move and an open turn.
8. Declined. Real but cosmetic: a typing indicator missing for the rest of one stream, after moving to drafts and back to the same channel within it.
9. Declined. This shape already exists: the shared invitation takes one agent's mode for every recipient (woken ?? deliveryAgent()), and locked mode doesn't change that. Per-recipient invitations would be a separate change across all modes.
10. Declined. Negligible. announcedLoci and proseRoutingPrimed key the same framework/state object by agent name.
11. Declined. This already happens with announcedLoci in every mode: the announce baseline isn't branch-scoped. A rollback that drops the result also leaves the next turn's announce-on-change comparing against the newer baseline.
12. Declined. Every mode's primer records itself before it's appended. For locked mode the baseline advances only after the primer is stored, so if the append fails, the next turn's announce-on-change still says where speech goes, and the prose_locus description carries the rest.
13. Fixed. A control runs the same request in locus mode and checks it opens a heartbeat's turn (its no-channel notice).
14. Fixed. The stub records each resolveProseTarget call, and the test checks forSpeech: true and the turn's own channels.
15. Fixed. The test lists the drafts and checks that the receipt's draft holds the words and is still open for a resend. The resend itself is covered in prose-drafts.test.ts.
16. Fixed. A white-box test: with the agent marked as an ephemeral run, or given a home channel, proseRoutingOf reads locus and prose_locus isn't offered.
17. Fixed in the docs. A framework/state that can't be read takes the announce baseline with it, so nothing can be compared. The docs no longer promise a notice for that case: the announcement covers moves from outside the turn and a proseLock channel that registered late.

Locally, the affected suites pass 816 / 0: locked-prose-routing (now 15 tests), send-into-closed-channel, present-while-acting, heartbeat, explicit-prose-routing, prose-drafts, publish-default-locus, trunk-channel-routing, batched-wake-locus, routing-baseline-restart, auto-continue, all-except-e2e, outgoing-stream, conversation-routing, channel-registry-routing. CI runs the full suite.

@nissa-seru, on #244: the two fit in either order. Its unprompted channel applies only where activeChannelResolver returns undefined (globalFallbackFor). A locked turn's resolver returns its locus or null, never undefined, and a locked turn never calls resolveLocus when it opens. So a locked agent's speech never reaches #244's fallback, and #244 changes nothing for it. Whichever merges second may have textual conflicts around activeChannelResolver in src/framework.ts and the globalFallbackFor doc. There's no semantic conflict.

[antra-tess]

/review

[anima-review]

Automatic review of 9d29c9b172d7.

Findings, most severe first:

• 1. should fix at src/framework.ts:21430, src/framework.ts:21468, src/framework.ts:21429, src/framework.ts:21467, test/locked-prose-routing.test.ts:463, docs/locked-prose-routing.md:97, src/framework.ts:21432, src/framework.ts:21426, src/framework.ts:21459: A malformed proseLocks container is read as no choice, so routing falls back to the recipe lock instead of failing closed.
  • Failing case: After an agent moves its lock away from recipe channel A, framework/state contains proseLocks: null, a string, or an array due to damaged state; looking up the agent returns undefined and its next plain speech is posted to A instead of being held as drafts.
• 2. should fix at src/framework.ts:21571, src/framework.ts:25039, src/framework.ts:26469, src/framework.ts:26357: The end-routed hold counts only moves since the current stream started, so later streams of the turn post speech meant to be held.
  • Failing case: On the XML tool path, the first stream moves from #main to #ops and receives the held-as-drafts/from-next-turn result; after a context-budget restart or framework retry, a second stream in the same logical turn writes plain speech without another move. Its starting move count already includes the first move, so its speech is posted to #ops instead of being held, including on the text-only path.
• 3. should fix at src/framework.ts:21553, src/framework.ts:21573, src/framework.ts:26469, src/framework.ts:21571, src/framework.ts:25592, src/framework.ts:21550, src/framework.ts:21568, test/locked-prose-routing.test.ts:403, src/framework.ts:25040: The end-routed hold promise checks endRouted, not whether the lock actually moved, and endRouted is never cleared for later streams.
  • Failing case: On an XML tool stream locked to A, call prose_locus with A again, or call drafts while already locked to drafts; the result promises that the whole stream is held because endRouted is set, but lockMoves stays unchanged and the final dispatch follows the normal routing path, posting the A case.
• 4. should fix at src/framework.ts:817, src/framework.ts:818, src/framework.ts:26469, change-text.md:14: The prose_locus description promises next-round moves and old-destination same-round speech, which is false on the XML end-routed path.
  • Failing case: On the XML tool path, an agent writes text alongside prose_locus to move from drafts to #ops; rather than the described round-by-round behavior, all stream speech is held as drafts and the new destination takes effect only on the next turn.
• 5. should fix at src/framework.ts:32562, src/mcpl/channel-registry.ts:2524, src/mcpl/channel-registry.ts:2572, src/framework.ts:13506, src/mcpl/channel-registry.ts:2564: A drafts lock makes incomingFor drop the incoming message, because no outgoing destination is confused with no incoming message.
  • Failing case: A message in a registered channel wakes an agent locked to drafts: beforeInference channel context omits the actual incoming message, and a refusal cannot react to it, even though only the agent's outgoing speech is destinationless.
• 6. should fix at src/framework.ts:8626, src/framework.ts:28187, src/code-execution/isolate/prelude.ts:320: prose_locus is missing from the code_execution script tool surface, so scripts cannot call it.
  • Failing case: A locked agent runs a script containing tools.prose_locus({to:'#channel'}): the prelude has no such tool and throws that nothing was sent, despite the framework implementing in-turn script calls to prose_locus.

Minor findings 7 to 34 (of 34)

• 7. minor at src/framework.ts:26308, src/framework.ts:26372, src/framework.ts:25588, src/framework.ts:7926, src/framework.ts:21115, src/framework.ts:21467, src/framework.ts:51686, docs/locked-prose-routing.md:82: Locked speech is never held as drafts without a channel registry because routing paths and the drafts tool depend on the registry.
  • Failing case: A locked agent without a registry and without a resolvable lock writes plain text; its primer says the text is held as drafts, but neither text-only nor tool-round dispatch creates a draft and the agent cannot inspect one.
• 8. minor at src/framework.ts:21449, src/framework.ts:21535, src/framework.ts:10816: A prose-lock change is acknowledged without syncing the store, so a crash can bring back the old lock.
  • Failing case: An agent moves its lock from a public channel to drafts, receives success, and the process or machine crashes before the store syncs; on restart the old public-channel lock can return and later speech can be posted there.
• 9. minor at src/framework.ts:20126, src/framework.ts:32558, src/framework.ts:22744, src/mcpl/channel-registry.ts:5766, src/framework.ts:27605: A channel_publish with no channel falls back to the agent's latest routing instead of the calling turn's locus, so it escapes a drafts lock.
  • Failing case: While a watched script belongs to an open drafts-locked turn, a silent start replaces turnRouting with its own routing and trigger channel; if the script calls channel_publish without channelId, callingTurnOf finds the original turn, but publishInputWithTurnLocus asks resolveLocus for the silent start's channel and posts there instead of refusing.
• 10. minor at src/framework.ts:21555, src/framework.ts:25254, src/framework.ts:25257, src/framework.ts:25244, src/framework.ts:21560: A move to drafts leaves the cached typing channel set, so moving back to that channel never restarts typing.
  • Failing case: In one stream, move the lock from channel A to drafts and then back to A; the first move stops A's typing, but followTurnLocus considers A unchanged and leaves typing off while later speech goes to A.
• 11. minor at src/framework.ts:29837, src/framework.ts:29839: prose_locus refusals are traced as tool:completed on the model-dispatch path, so observers never see the failures.
  • Failing case: An agent supplies an unknown channel or the lock write fails; the tool result is an error, but the emitted lifecycle event says completed rather than failed and carries no failure reason.
• 12. minor at src/mcpl/tool-classes.ts:93, src/framework.ts:803: The built-in tool class table leaves out prose_locus, so it is unclassed instead of classed as control.
  • Failing case: An operator applies class-based MCPL policy or audit grouping to control tools: prose_help is recognized as control, but prose_locus receives the restrictive unclassed treatment and is not grouped with the routing controls.
• 13. minor at src/framework.ts:21472, src/framework.ts:24395, src/framework.ts:23519: Lock resolution errors are logged on every resolution instead of on a state change, so a lasting fault floods the logs.
  • Failing case: A frequently awakened locked agent has a proseLock for a channel that never registers; each turn resolves it again and logs the same error, potentially twice on the primer turn, indefinitely flooding operator logs.
• 14. minor at src/framework.ts:21430, src/framework.ts:21446, src/framework.ts:21447: The lock map uses inherited reads and plain assignment, so agent names that collide with Object.prototype break.
  • Failing case: For an agent named constructor, an absent entry reads the inherited constructor function and is treated as a corrupt lock instead of using its recipe; for an agent named __proto__, assigning a channel lock changes the temporary object's prototype instead of creating a serialized entry, yet prose_locus reports success and the next turn falls back to the recipe.
• 15. minor at src/framework.ts:21446, src/framework.ts:12087: Prose locks are never removed when nonpersistent agents end, so state grows and reused names inherit stale locks.
  • Failing case: Create and end many task agents that each choose a lock: every entry remains in the shared framework/state blob and is recopied and rewritten by later state updates; if an ended name is reused, the new agent receives the former agent's destination instead of its own recipe. The growth limit should be based on measured agent churn and state-write cost.
• 16. minor at src/framework.ts:21489, src/framework.ts:8625, src/framework.ts:13277: Locked-mode text tells agents to resend with the drafts tool even when permissions or the lack of channels make it unavailable.
  • Failing case: A locked agent whose allowedTools permits prose_locus but not drafts selects drafts or starts without a destination; its primer, query results and routing notices say it can resend with the drafts tool, but it cannot call that tool.
• 17. minor at src/framework.ts:21463, src/framework.ts:21464, src/framework.ts:21511, src/framework.ts:21489: An unreadable or malformed stored lock is shown to the agent as an ordinary drafts choice, which hides the failure.
  • Failing case: If the stored lock entry is malformed or the store cannot be read, prose_locus {} and the primer report that speech is held as drafts without saying the lock could not be read, whether another call can help, or that the host operator may need to repair the store.
• 18. minor at src/framework.ts:21567, src/framework.ts:21603, src/framework.ts:23522: The announced-locus baseline uses null for both drafts and archive-only routing, so leaving locked mode gives no notice.
  • Failing case: After a locked turn announces that plain speech is held as resendable drafts, switch to locus mode and start a turn with no resolved channel; the generic mode primer does not explain the no-channel behavior, and the null-to-null comparison emits no notice that prose now stays in the archive rather than becoming drafts.
• 19. minor at src/framework.ts:22631, src/auto-continue.ts:45, docs/locked-prose-routing.md:82: The auto-continue notice says unskipped words are sent as usual, even when the agent is locked to drafts.
  • Failing case: A non-heartbeat locked-to-drafts turn auto-continues; the next turn reads 'anything you write without it is sent as usual' although its plain speech is posted nowhere and saved as drafts.
• 20. minor at test/locked-prose-routing.test.ts:246, test/locked-prose-routing.test.ts:403, test/locked-prose-routing.test.ts:433: No test checks the announced-locus baseline after in-turn moves or after leaving locked mode.
  • Failing case: If an in-turn prose_locus move fails to update announcedLoci, the existing tests can still pass because they assert deliveries and tool results but never restart or leave locked mode and assert the subsequent announce-on-change behavior.
• 21. minor at docs/locked-prose-routing.md:49, docs/locked-prose-routing.md:107, src/framework.ts:21176, src/mcpl/channel-registry.ts:6203: The documentation promises a delivery receipt for every speaking turn, but failed deliveries leave no receipt.
  • Failing case: If a locked channel disappears or its publish fails and the turn has no other successful deliveries or held segments, routeSpeech returns null and appendProseDeliveryReceipt returns without adding a [delivered] receipt; a separate failure marker is not the promised receipt.
• 22. minor at test/locked-prose-routing.test.ts:403, test/locked-prose-routing.test.ts:423, docs/locked-prose-routing.md:74: The end-routed-stream test does not check that all of the stream's text was kept as drafts.
  • Failing case: An implementation that discards 'Something private.' but holds only 'Now for ops.' as a draft would still satisfy the empty deliveries, result text and receipt regex, despite the promise to hold all the stream's speech.
• 23. minor at test/locked-prose-routing.test.ts:433, test/locked-prose-routing.test.ts:508, docs/locked-prose-routing.md:68: The outside-move tests never cover a move made during a real open turn.
  • Failing case: If executeToolCall changed an active turn's locus immediately, the idle test would pass and the hand-inserted openLogical entry would still make the invitation test see #main; a held real turn with an intervening host move would expose the change.
• 24. minor at test/locked-prose-routing.test.ts:521, docs/locked-prose-routing.md:91: The fork and ephemeral-run test never creates such runs or observes how their speech is routed.
  • Failing case: If a real conversation fork routed speech to its parent's lock rather than its home, or an ephemeral run posted speech instead of returning it to its caller, every assertion in this test could still pass.
• 25. minor at test/locked-prose-routing.test.ts:317, docs/locked-prose-routing.md:80, src/framework.ts:32560, src/framework.ts:37828: The no-destination test skips the no-default send and sleep-announcement paths.
  • Failing case: With a real registry having a recent inbound channel, a drafts-locked turn could incorrectly send a channel_publish without channelId or post a sleep announcement there while the existing test still passes.
• 26. minor at test/locked-prose-routing.test.ts:186, docs/locked-prose-routing.md:85, docs/locked-prose-routing.md:101: No test covers an unresolved recipe lock becoming registered later and the announce-on-change notice that should follow.
  • Failing case: If a later turn began posting to the newly registered channel without the promised [routing] notice, the suite would pass because its fixed registry resolves #main from the outset.
• 27. minor at test/locked-prose-routing.test.ts:458, docs/locked-prose-routing.md:56, docs/locked-prose-routing.md:97: The stored-lock tests never cover unreadable state or a failed lock write.
  • Failing case: If getStateJson throws and the turn falls back to the recipe, or setStateJson fails after a prose_locus move but the current or next turn nevertheless changes destination, none of the tests would detect it.
• 28. minor at test/locked-prose-routing.test.ts:246, test/locked-prose-routing.test.ts:433, src/framework.ts:27677: The suite does not test the script and puppet dispatch paths for prose_locus.
  • Failing case: A script's call could be misclassified as outside the active turn, or a puppet call could fail to persist and announce its move, while the directly dispatched model and executeToolCall tests still pass.
• 29. minor at test/locked-prose-routing.test.ts:186, docs/locked-prose-routing.md:101: The locked-mode suite never tests explicit-send suppression, skip_reply or same-round private think.
  • Failing case: If a locked turn posted its plain speech alongside a send to the same destination, or leaked text paired with a private think or skip_reply, the existing locked-routing tests would still pass.
• 30. minor at docs/locked-prose-routing.md:38, src/mcpl/channel-registry.ts:4556: The guide says an own channel's name selects it, but own-channel precedence applies only to exact channel IDs.
  • Failing case: If the current channel and another server's channel both have the label #lounge but distinct IDs, selecting '#lounge' is ambiguous rather than selecting the turn's own channel, contrary to what the guide tells a resident.
• 31. minor at docs/dendrite.md:271, docs/dendrite.md:272, docs/dendrite.md:286, src/framework.ts:24384: The dendrite speech-locus and all-except docs ignore that locked routing overrides the host rule and focus channel.
  • Failing case: An operator reading these sections for a locked resident could expect an addressed message under latest-inbound to re-pin speech, or a delivery-free focus turn to speak in the excepted channel; the turn instead keeps its configured or chosen lock.
• 32. minor at src/framework.ts:21467, src/framework.ts:21486, src/framework.ts:21511, src/framework.ts:23521, src/framework.ts:21603, src/framework.ts:22065, src/mcpl/channel-registry.ts:5942: A stored lock on a channel that became inbound-only is still shown as working, though publishing there is refused.
  • Failing case: After an agent chooses a channel, its server declares that channel inbound-only; the stored lock still resolves to that channel, so prose_locus and a locked-mode primer say speech goes there and an unchanged routing baseline generates no correction, but routeSpeech refuses the speech rather than posting it or holding it as a draft.
• 33. minor at docs/locked-prose-routing.md:68, docs/locked-prose-routing.md:101, src/framework.ts:23519, src/framework.ts:23531: The docs promise a [routing] notice after every outside move, but a move before the first turn only reaches the primer.
  • Failing case: Call executeToolCall to move the lock before the agent's first turn: that turn gets a [prose-routing] primer naming the new destination, and announce-on-change emits no [routing] notice.
• 34. minor at docs/locked-prose-routing.md:38, change-text.md:12, src/mcpl/channel-registry.ts:4832: The docs say unknown names are refused with candidates, but none are listed when there are no near matches.
  • Failing case: For an unknown #channel with no matching or near-matching labels, prose_locus refuses the target without listing candidates, so a reader relying on the advertised suggestions cannot choose a replacement from the result.

[antra-tess]

Thanks for the re-review of 9d29c9b1. I checked every finding against the code. The fixes are in ecc3f07b, one commit, with tests. Fixed means the fix is in that commit; Declined gives the reason.

1. Fixed. A proseLocks that isn't a record now throws, so speech is held as drafts, and only own keys are read. Tested in the round-1 malformed-entry test's path.
2. Fixed. The hold is now per logical turn: heldForMove is set when the lock moves on an end-routed turn, and every later stream of the turn, text-only ones included, holds its plain speech as drafts. lockMoves and its per-stream count are gone.
3. Fixed. A move to where speech already goes answers "already goes to …" and sets nothing. The hold is set only when the lock actually moved. Tested on the XML path.
4. Fixed. The description now says that where a turn's words are sent only when it ends, a change applies from the next turn and holds this turn's plain speech, and that the result says which.
5. Fixed. The registry takes a new channellessTurn option, so incomingFor separates a turn with nowhere to speak (a drafts lock) from one with nothing to answer (a heartbeat, or an unnamed channel). Without the option it behaves as before. Unit-tested on the real registry.
6. Declined. prose_locus is a direct verb, like prose_help, which isn't in scriptTools either. A script has no need to move where the agent's speech goes mid-script. The comment that mentioned scripts is corrected.
7. Declined, as in round 1 (Yielding inference #6): without a channel registry no mode publishes plain speech or keeps drafts.
8. Fixed. writeProseLock syncs the store, best effort: a failed sync is logged, since the write is already in the store.
9. Fixed. Inside a locked turn, publishInputWithTurnLocus defaults to the turn's lock or nothing, never resolveLocus. Tested: under a drafts lock, channel_publish with no channel gets none filled in.
10. Declined, as in round 1 (MCPL first-class integration with ephemeral agents #8): a cosmetic typing indicator.
11. Fixed. A refusal traces as tool:failed.
12. Fixed. prose_locus: ['control'], beside prose_help.
13. Declined. One line per locked turn while a recipe proseLock doesn't resolve is the operator's signal that the recipe names nothing. It doesn't scale with traffic.
14. Fixed. Reads use Object.hasOwn, and writes use defineProperty.
15. Declined. Unreachable: an ephemeral run or fork never routes locked (proseRoutingOf), isn't offered prose_locus, and so never writes a lock.
16. Fixed. The drafts tool is named only where canAgentUseTool allows it (proseLockShown).
17. Declined. Unreadable state fails closed and is logged for the operator. Telling the agent "the store can't be read" gives it nothing it can act on, and it can choose again with prose_locus.
18. Declined. This is the existing locus-mode primer on switching back. Leaving locked mode isn't a path this PR changes.
19. Declined. The [continue] row is the same in every mode ("sent as usual" means routed the way the agent's speech is). A locked agent gets the routing word from its primer and its results.
20. Fixed. After an in-turn move, the next turn has no [routing] notice (asserted). Leaving locked mode: as Enrich shouldTriggerInference metadata for channel messages #18.
21. Fixed in the docs. A receipt follows delivered or held speech; a failed delivery gets the failure marker.
22. Fixed. The test lists the held drafts and checks the post-move words are among them.
23. Fixed. New test: a module's tool calls executeToolCall(prose_locus) while the turn waits on it. The turn's later round stays in #main, the next turn speaks in #ops, and it's told.
24. Declined. proseRoutingOf is the one decision point, and the white-box test drives both of its branches. A full fork or run harness would test the conversation router and subagent plumbing, not this mapping. Note it now maps a run to disabled (below).
25. Fixed for the send default (Detect and recover from zombie ephemeral agents #9's test). A sleep under a drafts lock posts no announcement: that branch is a one-line guard beside the heartbeat one, and covering it would need the event-gate harness.
26. Fixed. New test: proseLock: '#late' holds speech as drafts until the channel resolves, then the next turn speaks there and is told.
27. Fixed. New test: a failed lock write moves nothing and says so, and unreadable state resolves to drafts.
28. Declined for scripts (Yielding inference #6). The puppet/host path is tested (feat: session-level usage tracking with cost accumulation #23 and the outside-move tests).
29. Fixed. New test: a send silences the round's narration and the postscript, as in locus mode. That's the sendCallIds change.
30. Fixed in the docs. Own-channel precedence is by id.
31. Fixed in the docs (docs/dendrite.md's speech-locus and all-except sections, and the speech doc in types/framework.ts).
32. Declined. Rare: a channel the lock already names would have to become inbound-only afterwards. The choice itself refuses an inbound-only channel (forSpeech), and the failed delivery leaves its marker in the agent's window.
33. Fixed in the docs. A move before the first locked turn is named by that turn's primer.
34. Fixed in the docs. "naming its candidates where there are any".

One change beyond the findings, prompted by the review of the companion host PR: an ephemeral run of a locked agent now routes as disabled, not locus. In locus mode a run's narration between tool calls can post to the channel inferred for its turn, the leak the host's inheritance of disabled closed. connectome-host#603 now launches a locked resident's subagents as disabled too.

Locally, the affected suites pass 879 / 0: locked-prose-routing (22 tests) plus the routing, drafts, heartbeat, closed-channel, auto-continue, outgoing-stream and tool-class suites. CI runs the full suite.

[antra-tess]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of ecc3f07bc343.

Findings, most severe first:

• 1. should fix at src/framework.ts:25740, src/framework.ts:26382, src/framework.ts:26506, test/locked-prose-routing.test.ts:414, test/locked-prose-routing.test.ts:436, docs/locked-prose-routing.md:96: heldForMove is not enforced on live-round delivery, and the move test checks neither later streams nor the pre-move words.
  • Failing case: After an end-routed stream moves a lock and continues the same logical turn in a stream with live round content, prose beside a tool call is posted to the new locus rather than held as drafts, contrary to the move result and the turn-wide hold.
• 2. should fix at src/framework.ts:21511, src/framework.ts:21519, src/framework.ts:23555, src/framework.ts:18336, src/framework.ts:21216, src/framework.ts:807, src/framework.ts:29483, src/framework.ts:36904, src/framework.ts:37472, docs/locked-prose-routing.md:110, src/framework.ts:21214: Locked-routing instructions and the draft receipt recommend prose_locus or drafts based only on allowedTools or unconditionally, ignoring dispatch denials.
  • Failing case: An agent allowed both tools but configured with denyToolsAtDispatch for either is told to move its lock or resend drafts with that tool, yet the recommended call is refused; the prose_locus description and draft receipt can also name drafts when it is not allowed at all.
• 3. should fix at src/framework.ts:32602, src/framework.ts:24404, src/framework.ts:24421, src/mcpl/channel-registry.ts:2536, src/framework.ts:13507, test/locked-prose-routing.test.ts:694, test/locked-prose-routing.test.ts:705, src/framework.ts:32600, src/mcpl/channel-registry.ts:2544: The channelless-turn callback mistakes a channel lock for an incoming channel, and the incomingFor test bypasses that callback.
  • Failing case: After an inbound Discord message, run a heartbeat for an agent locked to a channel: its non-null lock makes channellessTurn false, so channel context identifies the old message as incoming and an inference refusal can react to it, although the heartbeat did not answer it; an unresolved channel wake has the same problem.
• 4. should fix at src/framework.ts:21581, src/framework.ts:18335, src/framework.ts:36898, src/framework.ts:37470: The locus query and routing messages name the stored locus as the destination, ignoring that heldForMove turns current-turn prose into drafts.
  • Failing case: After an end-routed move to channel B, querying prose_locus or opening B says plain speech goes to B, and a closed-channel invitation can tell the agent to reply there in plain text, although the rest of this turn is held as drafts.
• 5. minor at src/framework.ts:21474, src/framework.ts:21565, src/framework.ts:21470, src/framework.ts:21475, docs/locked-prose-routing.md:41, src/framework.ts:21465: A swallowed store sync failure lets prose_locus report a move that may not persist, and the docs' restart promise leaves this out.
  • Failing case: An agent moves its lock from a public channel to drafts, sync throws, and the tool reports success; a crash before the write is durable can restore the public-channel lock and post later speech there.
• 6. minor at src/framework.ts:21464, src/framework.ts:21443, src/framework.ts:21469: Writing one agent's lock replaces a malformed proseLocks container, wiping the fail-closed state of the other agents.
  • Failing case: With a damaged proseLocks container, agents fail closed to drafts; after agent A successfully calls prose_locus, agent B's entry is absent from the replacement record and B falls back to its configured public proseLock instead of continuing to fail closed.
• 7. minor at src/framework.ts:26340, src/framework.ts:26409, src/framework.ts:21126, src/framework.ts:5188, docs/locked-prose-routing.md:62, src/framework.ts:5187, src/framework.ts:26303: Locked speech is held as drafts only through channel-registry routing, so hosts without MCPL servers never create the promised drafts.
  • Failing case: Configure a locked agent with no proseLock and omit mcplServers: the primer says its speech is held as drafts, but both text-only and tool-call output bypass draft creation and no draft receipt names the speech.
• 8. minor at test/locked-prose-routing.test.ts:535, test/locked-prose-routing.test.ts:548, test/locked-prose-routing.test.ts:554, src/framework.ts:21423: The ephemeral-run and fork test stubs internals instead of running real agents, so its name overstates what it checks.
  • Failing case: A real ephemeral run can post narration between tool calls, or a real fork can fail to route to its home, while proseRoutingOf returns the expected strings for the fabricated map and home entries and the test passes.
• 9. minor at src/framework.ts:25620, src/framework.ts:21587: An empty roundContent is taken to mean the stream is end-routed, which wrongly sets heldForMove on native-path rounds.
  • Failing case: A native tool round without verbatim roundContent calls prose_locus, followed by a native round with verbatim content: the move incorrectly sets heldForMove and reports that the whole turn will be held until its end, although native rounds are routed live.
• 10. minor at src/framework.ts:21601, src/framework.ts:29876, src/framework.ts:21626: An in-turn move advances the announce baseline before the agent has seen its tool result.
  • Failing case: If the stream is cancelled or tool-result delivery fails after prose_locus moves from A to B, the agent never reads the result, but the next turn sees B as already announced and gives no routing notice before speaking there.
• 11. minor at src/framework.ts:21126, src/framework.ts:25645, src/framework.ts:26147, src/framework.ts:26515: Locked drafts come from trimmed delivery segments, so resending them loses the original whitespace.
  • Failing case: A drafts-locked agent writes an indented first line or trailing blank lines: the held draft drops that whitespace, so resending it does not reproduce the words and formatting originally written.
• 12. minor at src/framework.ts:21465, src/framework.ts:12088, src/framework.ts:21447: Per-name locks are not migrated on rename or cleaned up on removal.
  • Failing case: Renaming a locked agent that chose drafts leaves the old entry behind and causes the renamed agent to use its recipe's public destination; later reusing the old name also inherits the departed agent's lock.
• 13. minor at src/framework.ts:21594, src/framework.ts:25289: Moving to drafts leaves followTurnLocus's remembered typing channel stale, so typing never restarts after moving back.
  • Failing case: During one stream, an agent moves from channel A to drafts and then back to A; the second move routes subsequent speech to A, but followTurnLocus sees A as unchanged and never restores the typing indicator.
• 14. minor at test/locked-prose-routing.test.ts:620, test/locked-prose-routing.test.ts:629, src/framework.ts:36852, src/mcpl/channel-registry.ts:6274: The drafts channel_publish test uses a fake handler that always refuses, so it cannot catch fallback in the real handler.
  • Failing case: If the real in-turn channel_publish handler again falls back to the latest inbound channel and posts there, the fake still returns its hard-coded refusal and the test passes.
• 15. minor at test/locked-prose-routing.test.ts:604, test/locked-prose-routing.test.ts:616, test/locked-prose-routing.test.ts:48: The send-silencing test never checks that the send tool actually ran.
  • Failing case: If tool dispatch drops or refuses robot--send_message while the routing code suppresses both prose segments, the negative routed assertion passes despite no send having occurred.
• 16. minor at test/locked-prose-routing.test.ts:508, test/locked-prose-routing.test.ts:522, test/locked-prose-routing.test.ts:523: The closed-channel invitation test fakes the open turn and never checks the move, so its restricted-tools case proves nothing.
  • Failing case: With allowedTools set to only robot--move, the prose_locus call is refused, yet the test still injects a main-channel openLogical entry and passes without ever storing the supposed ops lock or opening a real turn.
• 17. minor at src/framework.ts:21258, src/framework.ts:21282, src/framework.ts:21422: The receipt formatter reads the configured mode instead of the effective mode, so locked ephemeral runs get the wrong receipt.
  • Failing case: With a channel registry, run a createEphemeralAgent or resumeAgent agent configured with proseRouting 'locked' and let it produce plain speech: the effective mode suppresses the speech as disabled, but its receipt says '[delivered] nothing — ... suppressed' instead of saying that the words remain in the transcript and require an explicit send to reach a channel.

[antra-tess]

Thanks for the review of ecc3f07b. I checked every finding against the code. The fixes are in f42d19f0. Fixed means the fix is in that commit; Declined gives the reason.

1. Fixed. heldForMove is now enforced in routeLocusSpeech, which every locus-speech path delivers through: mid-turn rounds, text-only turns and trailing prose, on any stream of the turn. The two end-only branches are gone. Tests: a white-box call with heldForMove on a live locus holds the speech, and the XML-path test's final response now carries both rounds' words, both checked held.
2. Fixed for the locked texts: prose_locus and drafts are named only where mayCallTool allows them, so denyToolsAtDispatch counts too. Tested. Declined for the shared [delivered] receipt's "drafts can resend them": that text is the same in every mode, and this PR doesn't touch it.
3. Fixed. channellessTurn is now a method. A heartbeat's turn, or a wake for an unnamed channel, answers no message whatever its lock. A non-locked heartbeat that a re-pin or channel_open gave a channel still answers one, as before. Tested case by case on the method itself.
4. Fixed. Under heldForMove, prose_locus {} says this turn's speech is held and names the next turn's destination. channel_open, tune_out and the invitation read the turn's speech as drafts (turnSpeaksAt). Tested on the XML path with a query mid-turn.
5. Declined. The lock is written to the store before the tool answers. A sync failure only leaves it as durable as every other framework/state write (announced loci, primed modes, agent settings), none of which sync, and it's logged.
6. Fixed. A malformed proseLocks record is never overwritten: the write refuses ("wasn't recorded"), so every agent stays held as drafts until it's repaired. Tested.
7. Declined, as in rounds 1 and 2: without a channel registry, no mode publishes plain speech or keeps drafts.
8. Declined, as in round 2 ( fix: align MCPL event scopes with canonical 'mcpl:' prefix; add gate:decision trace #24).
9. Declined. Not reachable: native rounds always carry roundContent with their tool_use blocks, so an absent or empty one is the XML path. liveProseRouting uses the same test.
10. Declined. channel_open's pin move advances the baseline the same way, when its result is produced. The result is stored with the turn's tool round, so it's in the window the agent reads.
11. Declined. A heartbeat's held speech is drafted from the same trimmed segments. A resend posts the same words a delivery would have, since delivery publishes trimmed segments too.
12. Declined. Every piece of per-agent state is keyed by name (announced loci, primed modes, drafts, agent settings), and renaming a resident is an operator migration of all of it.
13. Declined, as before: a cosmetic typing indicator.
14. Declined. The test pins this PR's change, the default publishInputWithTurnLocus adds. The registry's in-turn handling of a publish with no channel is unchanged and tested in the registry's own suites.
15. Fixed. The test checks that send_message ran.
16. Fixed. The restricted case writes the stored lock directly (writeProseLock), so stored and open differ in both cases.
17. Fixed. The receipt reads the effective mode (proseRoutingOf).

Locally, the affected suites (20 files) pass 966 / 0, with locked-prose-routing at 26 tests.

[antra-tess]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of f42d19f0b7cc.

Findings, most severe first:

• 1. should fix at src/framework.ts:21498, src/framework.ts:21502, src/framework.ts:21603, src/framework.ts:21497, src/framework.ts:21501, src/framework.ts:21602, docs/locked-prose-routing.md:41, src/framework.ts:21505: prose_locus swallows a failed store sync and reports a durable move, contradicting the documented across-restarts guarantee.
  • Failing case: Move from a public channel to drafts while store.sync throws, receive the success result, and crash before persistence catches up: on restart the old public lock can return and subsequent plain speech can be posted there.
• 2. should fix at src/framework.ts:37894, src/framework.ts:37899, src/framework.ts:21625, src/framework.ts:21537, src/framework.ts:21627, src/framework.ts:37900: Sleep uses the stored locus rather than turnSpeaksAt, so it bypasses heldForMove and announces into the newly chosen channel.
  • Failing case: In an end-routed turn, move the lock from drafts to a channel and then call sleep with a message: the move says this turn is held as drafts, but sleep posts its announcement to that channel.
• 3. should fix at src/framework.ts:22134, src/framework.ts:22148, src/framework.ts:21109, src/framework.ts:21621, src/framework.ts:21597, src/framework.ts:21605, src/framework.ts:22139, src/framework.ts:22149, src/framework.ts:21570, src/framework.ts:21598, src/framework.ts:21625, test/locked-prose-routing.test.ts:579: Addressed-elsewhere notices and prose_locus no-op/refusal results report the stored locus instead of the held-for-move effective destination.
  • Failing case: After an end-routed turn moves from drafts to #ops, an addressed message from another channel produces a notice saying speech lands in #ops; the agent may believe its reply was posted there, but the rest of its plain speech is held as drafts.
• 4. should fix at test/locked-prose-routing.test.ts:553, test/locked-prose-routing.test.ts:566, test/locked-prose-routing.test.ts:571: The fork/ephemeral test asserts only the helper and tool list, never real fork or run routing behavior.
  • Failing case: An ephemeral run can publish narration through another speech path, or a fork can route outside its home, while these assertions still pass because neither a run nor a fork is started and no delivery is observed.
• 5. should fix at src/types/agent.ts:341, src/agent.ts:314, changelog.d/feat-prose-routing-locked.added.md:1: The changelog lists locked mode only as an addition, without flagging that the widened proseRouting unions break exhaustive consumers.
  • Failing case: A host switching exhaustively over either AgentConfig.proseRouting or Agent.proseRouting with a never assertion compiled against the previous union but fails typechecking after upgrading, even if no agent uses locked mode; the added-only fragment neither flags the breaking API change nor gives a migration.
• 6. minor at src/framework.ts:20129, src/framework.ts:20134, src/framework.ts:21537, src/framework.ts:32628, src/framework.ts:20131, src/mcpl/channel-registry.ts:2577: Channel readers and the channel_publish default use the new lock instead of the held-for-move drafts destination.
  • Failing case: After an end-routed move from drafts to a channel, call channel_publish without channelId: it defaults to the new channel rather than refusing for the turn's lack of a speech destination.
• 7. minor at src/framework.ts:817, src/framework.ts:21224, src/framework.ts:21549, test/locked-prose-routing.test.ts:784, src/framework.ts:768, src/framework.ts:18339, src/framework.ts:36924, src/framework.ts:37492: Text names the drafts tool even when dispatch denies it, and the dispatch-denial test never generates the notices that would show this.
  • Failing case: Allow prose_locus but deny drafts at dispatch, then lock to drafts and write speech: the tool description promises resending with drafts and the receipt says drafts can resend or dismiss it, but those calls are refused.
• 8. minor at src/framework.ts:21632, src/framework.ts:25324, src/framework.ts:25327: The typing indicator is stopped on a drafts move but its cached typingChannel is not cleared, so it never restarts.
  • Failing case: Start typing in channel A, call prose_locus to drafts, then move back to A in the same live turn: the equality check returns early although the indicator for A was stopped.
• 9. minor at src/framework.ts:18337, src/framework.ts:36924, src/framework.ts:37485: Invitation and routing notices offer prose_locus as moving current speech even when heldForMove defers moves to next turn.
  • Failing case: During a held turn, a closed-channel invitation offers pointing prose_locus at that channel to reply there, but doing so still holds the reply as drafts; channel_open and tune_out similarly say the tool moves the currently described speech.
• 10. minor at src/framework.ts:767, src/framework.ts:814, src/framework.ts:21524, src/framework.ts:24467: The primer and tool description say the destination is fixed until moved, but an unresolved configured lock can resolve on its own.
  • Failing case: Start with proseLock naming an unregistered channel: the primer says speech is held as drafts until moved with prose_locus, but once the channel registers a later turn posts there without any agent move.
• 11. minor at src/framework.ts:26378, src/framework.ts:21117, src/framework.ts:8627: Locked drafts holding only runs on registry-gated routing paths, so locked agents without a channel registry lose their speech.
  • Failing case: Start a locked agent without a channel registry, choose drafts or leave proseLock unset, and generate text: no draft or delivery receipt is created, despite the primer and tool result saying that the words will be held as drafts.
• 12. minor at src/framework.ts:23571, src/framework.ts:23579, src/framework.ts:23595: proseRoutingPrimed is stored before the primer is appended, so a failure in between means the agent never gets the rules.
  • Failing case: On the first locked turn, writing proseRoutingPrimed succeeds but addMessage fails or the process stops: subsequent turns see the stored locked marker and never tell the agent the locked-mode rules.
• 13. minor at src/mcpl/channel-registry.ts:6283, src/framework.ts:32628: The channel_publish refusal says the turn has no channel even when a drafts lock, not a missing trigger, explains the null default.
  • Failing case: A message in #lounge wakes an agent locked to drafts and the agent calls channel_publish without channelId: the refusal incorrectly says the turn has no channel of its own rather than explaining that its lock supplies no outgoing default.
• 14. minor at test/locked-prose-routing.test.ts:125, test/locked-prose-routing.test.ts:427, test/helpers/mock-membrane.ts:115, src/framework.ts:26457: The XML-path test simulation keeps native-path context and fakes the final response, so the real end-routed processing goes untested.
  • Failing case: A regression in the XML path's accumulated tool-use blocks, cumulative preamble, or supportsInjectedMessages handling can pass the held-speech tests because their final response consists only of manually repeated text and their tool events still declare native injection support.
• 15. minor at test/locked-prose-routing.test.ts:639, test/locked-prose-routing.test.ts:648, src/mcpl/channel-registry.ts:6274: The drafts-lock publish test uses a fake handler that always refuses, never exercising the registry's real fallback and refusal.
  • Failing case: If the real channel_publish handler falls back to the latest inbound channel or gives an incorrect refusal after receiving no channelId, this test still passes because the fake records the input and fabricates a failure without publishing.
• 16. minor at test/locked-prose-routing.test.ts:93, test/locked-prose-routing.test.ts:377, src/framework.ts:21594: The target-resolution fake has no ambiguous-with-candidates case, so prose_locus ambiguity guidance is never tested.
  • Failing case: If prose_locus drops candidates or fails while formatting a registry ambiguity, the unresolved-target test still passes because #nowhere returns a candidate-free error and publishRouteFor is never called.
• 17. minor at src/framework.ts:13622, src/framework.ts:21497, src/framework.ts:21639, src/framework.ts:21673: Rewinds remove the prose_locus exchange but keep its lock write and baseline, so the agent loses track of where it speaks.
  • Failing case: After an agent moves from drafts to a channel, a refusal or exhaustion rewind sheds that tool call and result; the stored lock and in-memory baseline still name the channel, so a later turn can post there without a routing notice even though the move is no longer in the agent's context.

[antra-tess]

Thanks for the review of f42d19f0. I checked every finding against the code. The fixes are in 48b8db1b. Fixed means the fix is in that commit; Declined gives the reason.

1. Fixed in the docs, code unchanged. The lock is written to the store before the tool answers, and the move syncs it. A sync that fails leaves the write in the store's log, as durable as every other framework/state write (none of the others sync), and it's logged. The docs now say the guarantee holds once the store has synced, rather than promising more.
2. Fixed. A sleep reads turnSpeaksAt, so under heldForMove or a drafts lock it posts no announcement. New test: the same sleep under a lock, a hold and drafts.
3. Fixed. The addressed-elsewhere notice reads where the locked turn speaks now. prose_locus's query, refusals and no-op share one nowShown phrase, which says what a hold means for this turn and names the next turn's destination.
4. Fixed. A real ephemeral run (createEphemeralAgent + runEphemeralToCompletion) of a locked agent narrates beside a tool call and finishes: nothing is posted, and the run still answers its caller. The fork half stays a check of proseRoutingOf, since a fork routes to its home exactly as a locus fork does.
5. Fixed. A breaking fragment: hosts that switch exhaustively over proseRouting need a 'locked' case, and it says how a run and a fork of a locked agent route.
6. Fixed. channel_publish with no channel under a hold has no default (turnSpeaksAt).
7. Declined. The fixed tool description and the shared receipt text are the same in every mode. The locked notices this PR writes already check mayCallTool, which is where a per-agent answer belongs.
8. Declined, as before: a cosmetic typing indicator.
9. Fixed. Under a hold, the invitation doesn't offer prose_locus as a way to reply now, and channel_open and tune_out say it moves speech "from your next turn".
10. Declined. A recipe proseLock resolving later is the one change the agent doesn't make. Its next turn is announced ([routing] Your plain speech now lands in …, tested), so the agent is never left with the primer's word alone.
11. Declined, as before: without a channel registry, no mode publishes plain speech or keeps drafts.
12. Declined, as before: every mode records its primer the same way, and the next turn's announce-on-change still says where speech goes.
13. Fixed. Where the turn came from a channel but speaks nowhere, the refusal says "Your plain speech goes to no channel now" (via channellessTurn).
14. Fixed in part. The XML-path test now declares supportsInjectedMessages: false, as membrane's XML path does. Its final response carrying every round's words is how that path ends a turn, and it's what makes both rounds' words checkable.
15. Declined, as before (round 3, Mcpl event type #14).
16. Fixed. New test: an ambiguous target is refused with its candidates and moves nothing.
17. Fixed. An in-turn move no longer counts as announced. The next turn's [routing] notice confirms where speech lands, so a rewind or a branch move that drops the exchange still leaves the agent told. That also closes round 1's Merge abort support with upstream streaming/MCPL #11 and round 2's Merge abort support with upstream streaming/MCPL #11. The in-turn-move test now expects that one notice.

Locally, the affected suites (20 files) pass 969 / 0, with locked-prose-routing at 29 tests.

[antra-tess]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of 48b8db1b2378.

Findings, most severe first:

• 1. should fix at src/framework.ts:26362, src/modules/discord/index.ts:956, src/modules/discord/index.ts:969, docs/locked-prose-routing.md:39, src/framework.ts:26350, src/module-registry.ts:714, src/modules/discord/index.ts:968: Final speech reaches module handlers such as Discord before lock routing is enforced, so drafts-locked prose is published despite the docs.
  • Failing case: A resident locked to drafts receives a Discord message and answers with a text-only response: the Discord module posts the response to the message's channel even though the later locked-routing path holds it as a draft; a locked agent's disabled ephemeral run can similarly publish its result.
• 2. should fix at src/framework.ts:32646, src/mcpl/channel-registry.ts:6283, src/framework.ts:20126, src/framework.ts:32636, src/mcpl/channel-registry.ts:2571, src/framework.ts:32637, src/mcpl/channel-registry.ts:2577, src/framework.ts:21565, src/mcpl/channel-registry.ts:2597: The active-channel resolver ignores heldForMove, so the registry exposes the new locus as the default while the turn's speech is held.
  • Failing case: Move a locked turn from channel A to channel B on the end-routed path, then call channel_publish without channelId: the framework correctly supplies no default, but activeChannelResolver still returns B, so the registry skips its new held-speech explanation.
• 3. should fix at changelog.d/feat-prose-routing-locked.added.md:1, changelog.d/feat-prose-routing-locked.breaking.md:1, src/types/agent.ts:338, src/agent.ts:460: The release fragments omit upgrade order, the need for both new framework and host, unchanged behavior, and minimum sibling versions.
  • Failing case: A JavaScript host that passes a recipe containing proseRouting: 'locked' to the base framework gets the old locus-routing path, not locked routing, and proseLock is ignored, so speech intended for drafts can be posted; a host operator needs to upgrade the framework and the companion host before deploying such a recipe, rather than infer that adding it is safe on an older deployment.
• 4. should fix at src/framework.ts:24478, src/framework.ts:21148, src/framework.ts:22700, src/framework.ts:21433: A locked heartbeat's auto-continuation drops the heartbeat mark and takes the lock as trigger channel, binding it to unrelated inbound messages.
  • Failing case: With autoContinue enabled, let a locked agent's heartbeat speak into its channel lock and finish without skip_reply, with no new inbound wake batched in. The continuation should remain a heartbeat turn, but it opens with the lock as triggerChannel and without routing.heartbeat; channellessTurn therefore returns false, incomingFor supplies the latest unrelated inbound message, and a refusal can react to that message. Preserving only the heartbeat mark would not suffice while the continuation still names the lock as its trigger channel.

Minor findings 5 to 26 (of 26)

• 5. minor at src/framework.ts:21503, src/framework.ts:21604, src/framework.ts:21649, src/framework.ts:21605: A failed store sync is swallowed and prose_locus still reports a successful move that may not survive a crash.
  • Failing case: Move from a public channel to drafts while store.sync() throws, then crash before the unsynced write becomes durable: the agent was told the move succeeded, but a restart can restore the public lock and publish its next plain speech there.
• 6. minor at src/framework.ts:21461, src/framework.ts:21485, src/framework.ts:23577: A damaged top-level framework/state is treated as absent, so the configured lock comes back and later writes overwrite the damage.
  • Failing case: If framework/state is a JSON string, number, or array rather than a record after an agent chose drafts, readProseLock sees no proseLocks and the next turn can publish to its configured proseLock; a primer or lock write can also overwrite the damaged state instead of failing closed.
• 7. minor at src/framework.ts:20131, src/framework.ts:20135, src/mcpl/channel-registry.ts:6274: A channel-less publish made outside a locked agent's turn bypasses the lock and uses the registry's global fallback.
  • Failing case: A script continues after its turn or a host calls executeToolCall for an agent locked to drafts or channel A; under latest-inbound or an all-except focus, channel_publish without channelId posts to global channel B instead of refusing or using A.
• 8. minor at src/framework.ts:24165, src/framework.ts:24468, src/framework.ts:20131, src/framework.ts:32638: A silent start of a locked agent is marked disabled, not locked, so channel-less publishes go to the trigger channel.
  • Failing case: A suppressProse start wakes from channel B while the resident is locked to drafts or channel A and calls channel_publish without channelId: the non-locked branch resolves B and posts there, rather than refusing or using A.
• 9. minor at src/framework.ts:26387, src/framework.ts:26451, src/framework.ts:21553, src/framework.ts:7927, docs/locked-prose-routing.md:63, src/framework.ts:5187: Without a channel registry, locked speech skips draft creation, while the primer and docs still promise resendable drafts.
  • Failing case: Start a locked agent without a channel registry and with no resolvable lock; its text-only response is neither posted nor recorded as a draft, and the drafts tool is not offered even though the primer may name it.
• 10. minor at src/framework.ts:21605, src/framework.ts:21623, docs/locked-prose-routing.md:38: prose_locus writes the lock before its no-op check, so a 'nothing changed' call can overwrite or pin the stored choice.
  • Failing case: While a turn still speaks at A, an out-of-turn call moves future turns to B; the turn then calls prose_locus to A and is told nothing changed, but the prior write replaces B with A and the next turn speaks at A.
• 11. minor at src/framework.ts:21607, src/framework.ts:21490: The prose_locus write-failure result quotes a raw storage error without saying the host must repair it or that retrying won't help.
  • Failing case: With malformed proseLocks, calling prose_locus returns an internal record error and the current destination, but gives the agent no actionable way to get the container repaired and no warning that another move will be refused too.
• 12. minor at src/framework.ts:21467, src/framework.ts:21479, src/framework.ts:21491, src/framework.ts:21607: Malformed proseLocks values are serialized verbatim into logged and agent-facing errors instead of a bounded diagnostic.
  • Failing case: If a damaged proseLocks container is an array containing other agents' destination data, any agent attempting a move receives the entire serialized container in its tool error, and the same raw data can enter operator logs.
• 13. minor at src/framework.ts:835, src/framework.ts:21554: The prose_locus description recommends the drafts tool even when the agent is denied that tool.
  • Failing case: Allow prose_locus but deny drafts at dispatch: its description promises that held speech can be resent with the drafts tool, but the recommended call is refused.
• 14. minor at src/framework.ts:37903, src/framework.ts:37917: sleep with announce under a drafts lock skips the announcement silently and doesn't tell the agent.
  • Failing case: A drafts-locked agent calls sleep with announce enabled: it goes to sleep and the omission is logged for the operator, but the agent's tool result reports only the sleep duration and does not say that nobody received the requested announcement.
• 15. minor at src/framework.ts:25667, src/framework.ts:25671, src/framework.ts:21634: endRouted stays set for the whole logical turn, so after a restart onto a live stream a move still triggers the end-routed hold.
  • Failing case: An XML stream has a tool round without a lock move, then a budget restart or retry continues the same turn using a native live stream and calls prose_locus: the move should apply to later live rounds, but all their speech is held as drafts and the tool reports an end-routed move.
• 16. minor at src/framework.ts:21111, src/framework.ts:25247, src/framework.ts:21634: Queued live rounds test the turn-wide heldForMove flag at delivery time instead of preserving their hold state from when they were written.
  • Failing case: A slow earlier publish blocks a live round queued for channel A; before that link executes, an end-routed continuation moves the lock and sets heldForMove: the already-written live round is retroactively drafted instead of being delivered to its captured A destination.
• 17. minor at src/framework.ts:21573, src/framework.ts:21577: A held turn reports its frozen locus as the next-turn destination, ignoring a later out-of-turn change to the stored lock.
  • Failing case: An end-routed move holds the turn and sets its locus to A, then a host moves the stored lock to B; a subsequent prose_locus query tells the agent the next turn speaks at A, although that turn will actually speak at B.
• 18. minor at src/framework.ts:21634, src/framework.ts:21635, src/framework.ts:24532, src/framework.ts:25333, src/framework.ts:25335: Typing follows the stored locus rather than turnSpeaksAt, so a held end-routed turn still shows typing in channels.
  • Failing case: An XML-path turn moves from A to B and enters heldForMove: typing remains active in A and can move to B on later content or a restart, although the rest of the turn's prose is held as drafts.
• 19. minor at test/locked-prose-routing.test.ts:652, test/locked-prose-routing.test.ts:660, src/mcpl/channel-registry.ts:6272: The no-default publish test uses a fake registry that always refuses, so it can't verify the real registry's in-turn fallback decision.
  • Failing case: If dispatch stops marking the call as in-turn, the input can still have no channelId and satisfy this test, while the real registry can use its global fallback and publish to an unrelated channel; exercise the real registry with a populated fallback and assert the refusal or absence of delivery.
• 20. minor at test/locked-prose-routing.test.ts:848, test/locked-prose-routing.test.ts:858: The sleep test waits one setImmediate and ignores the tool result, so its no-announcement checks prove nothing.
  • Failing case: If dispatch returns early or later becomes asynchronous, the held and drafts cases can observe an empty announcement array before reaching the announcement decision and pass; await and assert each sleep's completion callback, with a timeout only as an outer bound.
• 21. minor at test/locked-prose-routing.test.ts:638, test/locked-prose-routing.test.ts:639: The send-silencing test doesn't check that either prose segment was silenced or kept as a draft.
  • Failing case: If the framework drops the round's narration and postscript altogether, or never processes the final response, the send can still run and routed remain empty, so the test passes despite failing to hold the words as locus-mode drafts; assert the receipt and draft contents for both segments.
• 22. minor at docs/locked-prose-routing.md:74: The docs say the recipe destination resolves like a >> target, but it doesn't disambiguate duplicate channel IDs by the turn's own channels.
  • Failing case: If two servers register the same channel ID and the waking message came from one of them, a >> target with that ID selects the turn's own channel, but the same ID in proseLock is ambiguous and speech is held as drafts.
• 23. minor at docs/locked-prose-routing.md:67: The docs claim a drafts-locked turn has no channel, though it can still have an incoming channel and message.
  • Failing case: When a message wakes a drafts-locked turn, channel context can still report that incoming message and refusal reactions can target it; a server developer relying on the statement that the turn has no channel would expect neither.
• 24. minor at src/framework.ts:21461, src/framework.ts:21646, src/framework.ts:21674, docs/locked-prose-routing.md:104: The in-memory announcement baseline isn't restored on branch moves, so the routing notice can be skipped after rewinding.
  • Failing case: On one branch, the agent is last told its speech goes to B, then an out-of-turn prose_locus call moves the stored lock to A without announcing it; a later move changes it again. After visiting a branch that leaves the in-memory baseline at A, rewind or move back to the first branch's point after the move to A but before the later move. The restored proseLocks says A and its stored announcedLoci says B, but the cached baseline is A, so the next turn emits no routing notice even though its visible history last told the agent B.
• 25. minor at src/framework.ts:25335, src/framework.ts:21641: Moving to drafts leaves a stale cached typingChannel, so typing doesn't restart when the lock returns to that channel.
  • Failing case: During one stream move from A to drafts and then back to A: followTurnLocus sees A equal to its stale cached value and never shows typing in A again.
• 26. minor at change-text.md:21, src/framework.ts:24470, src/framework.ts:21646: The change description and turn-start comment wrongly say in-turn prose_locus moves produce no routing announcement.
  • Failing case: An agent moves its lock from one channel to another with prose_locus and starts another turn: that turn receives a [routing] confirmation, contrary to the description and comment, misleading maintainers investigating or changing the notice behavior.

[antra-tess]

Thanks for the review of 48b8db1b. I checked every finding against the code. The fixes are in d3ed6312. Fixed means the fix is in that commit; Declined gives the reason.

1. Documented. The code change is declined here. Confirmed: dispatchSpeech hands a turn's final speech to module handlers in every mode except a silent start, so the in-process Discord module's onAgentSpeech posts it under disabled and explicit too. Gating module speech dispatch by mode would change what the TUI and observer modules receive in every mode, which is an architecture change for its own PR. The locked-routing doc now has a "Module speech handlers" section: locked routing governs MCPL channel routing, and hosts relying on it should reach channels through MCPL servers.
2. Fixed. A locked turn's activeChannelResolver returns turnSpeaksAt, so a held turn has no outgoing default and gets the held wording.
3. Fixed. The added fragment now says an earlier agent-framework routes the mode as locus (upgrade first), that connectome-host needs test(workspace): a root replaced as it was opened is found by a poll before the watcher is ready #603 to accept it, and that other agents are unchanged.
4. Fixed. heartbeatTurnMark keeps a locked heartbeat's mark, and the continuation wake names the channel the turn came from (none for a heartbeat), never the lock. Tested on autoContinueAfterTurn.
5. Declined, as in the previous two rounds (documented in round 4).
6. Fixed. A framework/state that isn't a record holds speech as drafts and refuses lock writes.
7. Declined. An explicit send made outside the turn takes the registry's default in every mode ("takes none of the turn's channels", publishInputWithTurnLocus). The lock governs plain speech and in-turn defaults.
8. Declined. A silent start publishes no plain speech in any mode. An explicit send it makes follows the same default rule as a silent start of any other mode.
9. Declined, as before (no channel registry).
10. Fixed. The answer is "already" only when both the turn and the stored choice agree. Otherwise the choice is recorded.
11. and 12. Fixed. Damage errors name the shape, never the stored contents, and tell the agent the host's operator has to repair it and that until then no move can be recorded. Tested.
12. Declined, as before.
13. Declined. A sleep skips its announcement silently in other cases too, such as a heartbeat turn or explicit mode without a target. The behavior is unchanged here.
14. and 16. Declined. Not reachable: whether a turn is end-routed is the formatter's path, fixed for an agent, so one logical turn doesn't mix XML and native streams.
15. Fixed. A held turn's next-turn destination is read from the stored lock.
16. and 25. Fixed. Typing stops when a move leaves the turn speaking nowhere, and it follows where a locked turn speaks now, compared against the turn's own typing record.
17. Declined, as before.
18. Fixed. Each sleep's result is awaited and asserted before the announcement check.
19. Fixed. The test lists the drafts and finds both silenced segments.
20. Fixed in the docs. proseLock resolves without own-channel precedence.
21. Fixed in the docs. A drafts-locked turn has no outgoing channel, but it still answers its incoming message.
22. Declined. The in-memory announced-locus cache predates this PR and behaves the same way in every mode.
23. Fixed in the turn-start comment and the PR description.

Locally, the affected suites (20 files) pass 970 / 0.

[antra-tess]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of d3ed63121e13.

Findings, most severe first:

• 1. should fix at src/framework.ts:24407, src/framework.ts:24499, src/framework.ts:20140, src/framework.ts:32665, src/mcpl/channel-registry.ts:2571: Silent starts never mark locked routing, so default channel resolves like an ordinary disabled turn.
  • Failing case: A drafts-locked agent receives a silent heartbeat after an inbound message or while an all-except focus exists. The silent turn has neither locked nor heartbeat set, so its channel_publish without channelId and the server's defaultOutgoing context can use the latest-inbound or focus channel instead of no destination; a silent wake with a trigger channel can likewise use that channel.
• 2. should fix at src/framework.ts:20144, src/framework.ts:36913, src/mcpl/channel-registry.ts:6274: Post-turn agent channel_publish has no calling turn, so it bypasses the lock via global fallback.
  • Failing case: A locked-to-drafts agent starts a background script that later calls channel_publish without channelId after the turn settles; callingTurnOf returns no turn, so the registry can publish the script's text to the latest inbound or all-except focus channel rather than refusing the unnamed destination.
• 3. should fix at docs/locked-prose-routing.md:38, src/framework.ts:21628, src/framework.ts:21640, test/locked-prose-routing.test.ts:596: Docs call re-pointing to the current destination a no-op though it records a durable choice over the recipe.
  • Failing case: With recipe proseLock: "#lounge" and no stored choice, calling prose_locus for #lounge leaves the current turn's destination unchanged but stores that choice; a later recipe change to #office is then ignored, contrary to the documented no-op.
• 4. minor at src/framework.ts:23607, src/framework.ts:23619, src/framework.ts:21470, src/framework.ts:24507, src/framework.ts:21418, src/framework.ts:21428, src/framework.ts:8221, src/framework.ts:8260, src/framework.ts:10526, src/framework.ts:10631, src/framework.ts:10779, src/framework.ts:10820, src/framework.ts:21471, src/framework.ts:23608, src/framework.ts:21419, src/framework.ts:24441, src/framework.ts:21496, commit-messages.txt:168: Primer and other state writers overwrite damaged scalar framework/state, defeating the fail-closed lock read.
  • Failing case: An agent previously chose drafts, its framework/state becomes a string or number, and it starts a locked turn with a public proseLock configured. maybePrimeProseMode overwrites the damaged state with a new record; proseLockLocus then sees no stored choice and sends speech to the recipe's public channel instead of holding it as drafts.
• 5. minor at src/framework.ts:26419, src/framework.ts:25733, src/framework.ts:5196: Drafts holding is gated on a channel registry, so registry-less locked agents lose their speech.
  • Failing case: Configure a locked agent without MCPL servers and let it speak with no lock or a drafts lock: the primer says its speech is held as drafts, but neither routing path calls holdProseDrafts, so there is no draft or draft receipt.
• 6. minor at changelog.d/feat-prose-routing-locked.added.md:15, changelog.d/feat-prose-routing-locked.added.md:9, src/framework.ts:25840: Upgrade note wrongly claims an earlier framework routes 'locked' as locus mode.
  • Failing case: If a recipe passes 'locked' to the base framework, its primer teaches explicit-prefix routing and its send-call silencing excludes the mode, so the agent can be misled and narration can be posted alongside an explicit send even though ordinary unprefixed speech follows the locus path.
• 7. minor at src/framework.ts:815, src/framework.ts:819, src/framework.ts:8636, src/framework.ts:21235, src/framework.ts:21569, src/framework.ts:817: Drafts-tool recovery advice ignores whether the agent may call drafts and whether the tool exists.
  • Failing case: A locked agent allowed prose_locus but denied drafts receives a tool description and draft receipt telling it to resend with drafts; with no channel registry, drafts is not routed as a tool even if the permission check passes.
• 8. minor at src/framework.ts:24563, src/framework.ts:24600, src/framework.ts:25354, src/framework.ts:25364: Held-for-move continuation starts typing from stored locus and the indicator is never cleared.
  • Failing case: An end-routed turn moves its lock to channel B and is held as drafts, then resumes or retries before settling. Both the early typing path and driveStream choose B from routing.locus, and the follow-up returns on the null effective locus, so B sees typing even though this turn speaks nowhere.
• 9. minor at src/framework.ts:21120, src/framework.ts:25277, src/framework.ts:21660: Delivery reads turn-wide heldForMove at send time, retroactively holding speech queued before a move.
  • Failing case: A live round queues speech to lock A behind a slow delivery; before that queue reaches the segment, a subsequent end-routed stream of the same logical turn moves the lock to B. The earlier segment, which was written and queued for A before the move, is held as a draft instead of being delivered to A.
• 10. minor at src/framework.ts:21532, src/framework.ts:21595, src/framework.ts:23631: Lock read failures are reported as an ordinary drafts destination, hiding the damage and repair need.
  • Failing case: With a damaged proseLocks container, prose_locus({}) succeeds saying speech is held as drafts, indistinguishable from a deliberate drafts choice; the agent is not told that lock moves will be refused until the host operator repairs the state.
• 11. minor at src/framework.ts:21610, src/framework.ts:21615, src/mcpl/channel-registry.ts:4804: prose_locus refusal suggests send_dm without checking it exists or could change the lock.
  • Failing case: A locked agent calls prose_locus with an unknown @person on a deployment without an allowed send_dm tool: the refusal tells it to use send_dm even though that call is unavailable and would not itself move the lock.
• 12. minor at test/locked-prose-routing.test.ts:648, test/locked-prose-routing.test.ts:657, src/mcpl/channel-registry.ts:6272: No-default publish test uses an always-refusing fake registry, so it can't show refusal happens.
  • Failing case: If dispatch fails to mark the call as in-turn and the real registry falls back to a previously delivered channel, channel_publish posts there, but this test still passes because its fake refuses every input and only checks that channelId was not filled in.
• 13. minor at test/locked-prose-routing.test.ts:557, test/locked-prose-routing.test.ts:575: Fork test never creates or routes a real fork, only a stubbed resolver and mode helper.
  • Failing case: A regression in actual fork creation, its home-channel binding, or its speech delivery can post a locked resident's fork speech to the wrong channel while this test still reports that the fork routes as locus mode.
• 14. minor at docs/locked-prose-routing.md:67, change-text.md:16, src/modules/discord/index.ts:590, src/modules/discord/index.ts:1551, src/modules/discord/index.ts:1589: Docs claim channel-less sends have no default, overlooking module tools like discord--reply.
  • Failing case: With the in-process Discord module and a current reply context, discord--reply accepts only content and posts to that context's channel even when prose is locked to drafts; an operator or agent relying on the stated absence of a default can send to that channel unexpectedly.
• 15. minor at src/framework.ts:23611, src/framework.ts:23631: Primer equality guard skips the locked-mode primer when the base already recorded 'locked'.
  • Failing case: If the base runs an agent configured with locked, it stores proseRoutingPrimed[agent] = 'locked' and appends the explicit-routing primer; after deploying the head with the same configuration, the equality check returns before lockedModePrimer, leaving the agent with the wrong routing instructions and no introduction to prose_locus.

[antra-tess]

Thanks for the review of d3ed6312. I checked every finding against the code. The fixes are in d592b361. Fixed means the fix is in that commit; Declined gives the reason.

1. Fixed. A silent start of a locked agent marks its turn locked with the agent's lock. A send with no channel and the servers' outgoing default then get the lock or nothing, never the trigger channel or the registry's fallback. New test: a silent tick publishes with #main under that lock, with no channel under a drafts lock, and never asks the registry for a default. It fails without the fix.
2. Declined, as in round 5 (mcpl: implement full MCPL host support (Steps 1-8) #7). An explicit send from a script that outlives its turn takes the registry's default in every mode. Under the default speech.locus: 'delivery' rule that default is nothing, unless the agent itself opened an all-except focus. The lock governs plain speech and the defaults inside its turns.
3. Fixed in the docs. Re-pointing at the turn's destination moves and holds nothing. Where that destination was only the recipe's default, it's recorded as the agent's own choice, and the docs say so.
4. Declined. Every framework/state writer (announced loci, primed modes, inline caps) replaces a slot that isn't a record. A whole-slot corruption is the store's to repair, and this PR's own reads and writes fail closed on it.
5. and 7. Declined, as before.
6. Fixed. The fragment now says what an earlier framework does with the mode: it routes the speech as locus but tells the agent it's in explicit mode, and doesn't silence beside sends. Upgrade first.
7. Fixed. The turn-start and stream typing indicators read turnSpeaksAt for a locked turn, so a held continuation shows none.
8. Declined, as before (round 5, Fix missing durationMs in inference:aborted and broken enrichedCall refs #15/Fix orphaned tool_use from max_tokens truncation #16): one logical turn doesn't mix XML and native streams.
9. Declined, as before (round 2, MCPL v0.5: state management, branches, and WebSocket transport #17).
10. Declined. The send_dm hint is the shared resolver's text for an unknown @person (resolveProseTarget, as for >> targets and drafts resends). It isn't locked mode's.
11. and 13. Declined, as before.
12. Fixed in the docs. The claim is now about channel_publish, and the docs name a module's own reply tool, such as the in-process Discord module's discord--reply, as outside the lock.
13. Declined. Running 'locked' on an agent-framework without the mode isn't a supported configuration: the fragment says to upgrade first, and connectome-host refuses the mode in recipes on older releases.

Locally, the affected suites (20 files) pass 971 / 0, with locked-prose-routing at 31 tests.

[antra-tess]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of d592b36101de.

Findings, most severe first:

• 1. should fix at src/framework.ts:23608, src/framework.ts:23619, src/framework.ts:21419, src/framework.ts:10527, src/framework.ts:10780, src/framework.ts:21500, src/framework.ts:21433, src/framework.ts:21534, src/framework.ts:24441, src/framework.ts:24514, test/locked-prose-routing.test.ts:774: Primer and announcement writers overwrite damaged scalar framework/state with an empty record, defeating the fail-closed lock read.
  • Failing case: If framework/state becomes a string while the process is running, a locked agent's first turn runs maybePrimeProseMode before reading its lock and writes a fresh record without proseLocks; the subsequent read treats the choice as absent and posts to the recipe's channel instead of holding speech for operator repair.
• 2. should fix at src/framework.ts:21669, src/framework.ts:25377, src/framework.ts:25550, src/framework.ts:25594: Moving to drafts leaves the stream's typingChannel unchanged, so later traces are tagged with the old channel.
  • Failing case: A turn typing in channel A calls prose_locus with to: "drafts" and then generates more text: the indicator stops and the text is held as drafts, but followTurnLocus returns on the null locus without clearing typingChannel, so token and content-block trace consumers still see channelId A.
• 3. should fix at changelog.d/feat-prose-routing-locked.added.md:1, changelog.d/feat-prose-routing-locked.added.md:6, src/types/agent.ts:333, docs/locked-prose-routing.md:90: The release note and config comment leave out that module speech handlers still receive locked speech.
  • Failing case: A host using an in-process module with onAgentSpeech can configure drafts expecting speech to be posted nowhere, but that handler still receives final speech and can publish it; the detailed documentation names this exception, whereas a reader acting on the release note or API comment is not warned.

Minor findings 4 to 21 (of 21)

• 4. minor at src/framework.ts:21519, src/framework.ts:21520, src/framework.ts:21639, src/framework.ts:21675, src/framework.ts:21514, src/framework.ts:21650, test/locked-prose-routing.test.ts:259, test/locked-prose-routing.test.ts:291, src/framework.ts:6068: A failed store sync after a prose_locus move is swallowed and reported as success, and the graceful-stop restart test cannot catch it.
  • Failing case: An agent moves from a public channel to drafts, setStateJson succeeds but sync fails, and the process crashes before the write reaches durable storage; after restart the old public lock can return and subsequent speech can be posted there despite the successful move result.
• 5. minor at src/framework.ts:5151, src/framework.ts:25710, src/framework.ts:26430, src/framework.ts:26494, src/framework.ts:21128, src/framework.ts:21146, src/framework.ts:21566, src/framework.ts:29677, src/framework.ts:24506, src/framework.ts:5196: Locked prose reaches draft holding only when a ChannelRegistry exists, so frameworks without MCPL servers create no drafts.
  • Failing case: Start a locked agent with no proseLock and no mcplServers, then let it produce plain text: there is no registry, so neither final routing branch runs and no no-destination draft or draft receipt is created, despite the primer saying the speech is held as drafts.
• 6. minor at src/framework.ts:817, src/framework.ts:8636, src/framework.ts:29558: The prose_locus description recommends the drafts tool even when the agent cannot call it.
  • Failing case: A locked agent allowed prose_locus but denied drafts, including through denyToolsAtDispatch, sees a description saying it can resend held prose with drafts, but that call is refused at dispatch.
• 7. minor at src/framework.ts:26439, src/framework.ts:26451, src/framework.ts:26579, src/framework.ts:26587, src/framework.ts:20241, src/framework.ts:21120: Final-prose send-silencing uses the raw locus rather than the held turn's effective destination.
  • Failing case: On the XML path, move from drafts to #ops and explicitly send to #ops in the same turn: the end-routed prose is held as an explicit-send draft marked 'written for #ops' rather than as the no-destination draft promised for the move, although some of those words preceded it and were never written for #ops.
• 8. minor at src/framework.ts:23609, src/framework.ts:23617, src/framework.ts:21420, src/framework.ts:21425, src/framework.ts:21704: Ordinary property assignment on the primer and announcement maps fails to store the agent name __proto__ as an own key.
  • Failing case: For a locked agent named __proto__, assigning its mode invokes the prototype setter rather than storing 'locked', so every turn injects another primer; its announced channel likewise is not an own serialized entry, so restart cannot restore the announcement baseline.
• 9. minor at src/framework.ts:23617, src/framework.ts:23619, src/framework.ts:23635, src/framework.ts:21711: The locked primer is marked done before its message is appended, so a failure in between suppresses it permanently.
  • Failing case: On the first locked turn with a drafts destination, persist proseRoutingPrimed='locked' and then fail or crash before addMessage; on restart the primer is skipped and announceLocusIfChanged also emits nothing for a null locus without a baseline, leaving the agent untold about locked mode and its tool.
• 10. minor at src/framework.ts:37933, src/framework.ts:37951, src/mcpl/channel-registry.ts:6174: Sleep checks the configured mode rather than the effective mode, so locked ephemeral runs skip the disabled-mode path.
  • Failing case: When a locked ephemeral run calls sleep with announcements enabled, its effective mode is disabled but the raw field is locked; sleep calls routeSpeech with a null locus, which the registry silently discards for an ephemeral run rather than logging that the announcement was skipped.
• 11. minor at src/framework.ts:21615, src/framework.ts:21621, src/mcpl/channel-registry.ts:4804: The prose_locus unresolved-target refusal recommends send_dm without checking that the agent has it.
  • Failing case: With no registered DM for @alice and no permitted send_dm tool, prose_locus returns the registry's instruction to use send_dm even though the agent cannot follow it.
• 12. minor at src/framework.ts:21587, src/framework.ts:21596, src/framework.ts:21653: An out-of-turn prose_locus query reports the stored next-turn lock as the current destination.
  • Failing case: While a turn speaks in #main, a puppet moves the stored lock to #ops and then calls prose_locus with no target; the query says plain speech goes to #ops although the ongoing turn continues to speak in #main.
• 13. minor at src/framework.ts:22172, src/framework.ts:22185: The addressed-elsewhere notice leaves out that a held-for-move hold lasts only this turn.
  • Failing case: After an XML-path move from drafts to #ops holds the current turn, an addressed message elsewhere produces 'Your plain speech is held as drafts' without saying that the next turn speaks in #ops.
• 14. minor at src/framework.ts:20140, src/framework.ts:36927, src/mcpl/channel-registry.ts:6283, src/framework.ts:32677: The no-default channel_publish refusal is classified from the agent's latest routing instead of the calling turn.
  • Failing case: If an open locked turn held as drafts calls channel_publish without a channel while a later silent start is the agent's latest routing and has a channel lock, the call correctly posts nothing, but the registry reads the silent start's non-null resolver answer and reports only that there is no default yet instead of explaining that the calling turn's speech is held; differing latest and calling turn channel provenance can likewise select the wrong refusal.
• 15. minor at changelog.d/feat-prose-routing-locked.breaking.md:1: The breaking changelog entry leaves out the unchanged behavior and the minimum sibling versions.
  • Failing case: A host maintainer upgrading an exhaustive proseRouting switch sees the new case but cannot tell from the breaking entry what remains unchanged or which companion versions to require for a deployment that accepts locked recipes.
• 16. minor at test/locked-prose-routing.test.ts:648, test/locked-prose-routing.test.ts:904, test/locked-prose-routing.test.ts:917, src/framework.ts:32676: The no-default publish tests stub the registry publish and never exercise the resolver's fallback.
  • Failing case: If the real registry fell back to its default when a drafts-locked turn returns null, both tests would still pass: their fake handleChannelToolCall only records the input and never asks the resolver or publishes, while locusCalls counts resolveLocus rather than registry default resolution.
• 17. minor at test/locked-prose-routing.test.ts:923: The silent-start test uses only a channelless heartbeat, so it never checks that the triggering channel is ignored.
  • Failing case: A regression that correctly handles silent heartbeats but defaults a silent message-triggered turn to its triggering channel would pass both iterations, since neither request supplies a trigger channel.
• 18. minor at test/locked-prose-routing.test.ts:741, test/locked-prose-routing.test.ts:747, test/locked-prose-routing.test.ts:420: The later-stream hold test builds heldForMove by hand and never checks that it survives a real stream restart.
  • Failing case: If a budget restart or retry dropped heldForMove from the logical turn, the hand-built routing entry would still hold its text and the single-stream XML test would still pass, although later-stream speech could be posted to the new lock.
• 19. minor at test/locked-prose-routing.test.ts:583, test/locked-prose-routing.test.ts:596: The no-op move test never checks that the recipe destination was actually stored as the choice.
  • Failing case: If prose_locus returned the same successful result without writing a choice, the assertions would pass, but changing proseLock or restarting with a different recipe would move the agent despite its explicit choice.
• 20. minor at test/locked-prose-routing.test.ts:794, test/locked-prose-routing.test.ts:797: The dispatch-denial test calls only private wording helpers and never checks the real notices or tool presentation.
  • Failing case: If a primer, channel-open result, or routing notice named prose_locus despite denyToolsAtDispatch, the helpers could still return the expected strings and this test would pass.
• 21. minor at src/framework.ts:817, src/framework.ts:21568, src/framework.ts:26405, src/modules/discord/index.ts:968: Agent-facing text says drafts are posted nowhere, but a module speech handler can still publish the final speech.
  • Failing case: A locked agent selects drafts and writes final speech while the in-process Discord module has a reply context: the tool description and routing notices tell the agent the text will not be posted, but onAgentSpeech sends that text to Discord, potentially exposing words the agent intended to keep private.

[antra-tess]

Thanks for the review of d592b361. I checked every finding against the code. The fixes are in 44af64f0, which also merges main (one conflict: driveStream's typing channel, where main gave disabled mode the trigger channel and locked mode keeps turnSpeaksAt). Fixed means the fix is in that commit; Declined gives the reason.

1. Fixed. maybePrimeProseMode and writeAnnouncedLocus leave a framework/state that isn't a record as it is. A damaged slot then keeps locked speech held until it's repaired, instead of being replaced before the lock is read.
2. Fixed. A locked turn moved to speak nowhere clears the stream's typingChannel, so its token and content-block traces carry no channel.
3. Fixed. The AgentConfig.proseRouting doc and the added fragment say module speech handlers (onAgentSpeech) receive final speech in every mode, this one included.
   4, 5, 6, 8, 9, 11. Declined, as in earlier rounds (sync durability, no channel registry, the static description, __proto__, the primer's ordering, the shared resolver's send_dm hint).
4. Declined. Either way the words are held as drafts, so nothing is posted. Only the draft's recorded reason differs.
5. Fixed. sleep reads the effective mode, so a locked ephemeral run takes the disabled path.
6. Declined. A query from outside the turn describes the lock later turns start from. The docs say a move from outside leaves a turn under way where it is, and the in-turn query reads the turn.
7. Declined. The notice says what happens to this turn's speech. The next turn's destination is the next turn's [routing] notice and the prose_locus query.
8. Declined. This is the wording of a refusal that posts nothing. Telling a calling turn's routing from a later silent start's in the registry would need the calling turn passed down, for one message.
9. Fixed. The breaking fragment says nothing else changes for an agent that doesn't set the mode, and names the releases that accept 'locked'.
   16, 18, 20. Declined, as before (the stubbed publish handler, the hand-built hold, private wording helpers).
10. Fixed. The silent-start test also runs a silent start woken from #lounge, under both locks.
11. Fixed. The no-op test checks the choice was recorded.
12. Declined. "Posted nowhere" describes what the routing does. Module handlers are host configuration, now documented in the doc, the config comment and the fragment (Filter self-messages in the Discord module to prevent reingestion and cascading identity issues #3).

Locally, after the merge: every test file that touches typing or prose routing (48 files) passes 2037 / 0.

[antra-tess]

/review

[anima-review]

About these findings

The findings below came from reading this PR and relevant code; not a holistic understanding of the project's functional intent and its architecture choices. Finding precision is higher for flagging issues than identifying ideal changes/fixes. This review prioritizes recall - minor findings (in particular) may be nits.

Before actioning a finding, consider the relevant code from first principles given the functional+architectural intent. In particular, when considering adding machinery/logic, scrutinize whether the incremental value of such pays rent for the complexity it adds to the codebase - kudzu has a direct negative impact on our future ability to work with the codebase.

Automatic review of 44af64f057de.

Findings, most severe first:

Minor findings 1 to 23 (of 23)

• 1. minor at src/framework.ts:8289, src/framework.ts:8328, src/framework.ts:10594, src/framework.ts:10699, src/framework.ts:10847, src/framework.ts:10888, src/framework.ts:21740, src/framework.ts:21803, src/framework.ts:21730, src/framework.ts:10591, src/framework.ts:8288, src/framework.ts:8327, test/locked-prose-routing.test.ts:492, test/locked-prose-routing.test.ts:785, src/framework.ts:21683, src/framework.ts:23883, commit-messages.txt:168, commit-messages.txt:218: State writers replace a damaged scalar framework/state slot with a fresh record, defeating fail-closed lock reading, and no test damages the whole slot.
  • Failing case: After startup, framework/state becomes a string or number while an agent's recipe points at a public channel and its stored choice is no longer readable; an inference's usage write, a settings update, or a host-mode write replaces the slot with a record lacking proseLocks, so the next locked turn falls back to the recipe and posts rather than holding speech as drafts.
• 2. minor at src/framework.ts:21786, src/framework.ts:21907, src/framework.ts:21950, changelog.d/feat-prose-routing-locked.added.md:7, src/types/agent.ts:337, change-text.md:14, src/framework.ts:21787: A failed store sync is swallowed and the move is still reported successful and described as surviving restarts.
  • Failing case: Move from a public channel to drafts when setStateJson succeeds but sync fails, then crash before a later successful sync: the agent was told its speech would remain in drafts, but the recovered store can restore the public lock and publish a later turn there.
• 3. minor at src/framework.ts:21941, src/framework.ts:21968, src/framework.ts:21979, src/framework.ts:24798: Announcement baseline is not tied to the history branch, so a rewind leaves it claiming the destination was already announced.
  • Failing case: Move from channel A to B, let the next turn append the B routing notice, then rewind or switch the context head to before both messages; the stored lock still points at B but the in-memory or persisted baseline also says B, so the next turn emits no routing notice and the agent can speak into B without the promised confirmation.
• 4. minor at src/framework.ts:21833, src/framework.ts:29969, src/framework.ts:809, test/locked-prose-routing.test.ts:797: The drafts remedy doesn't check that the drafts tool exists, the static prose_locus description names a denied drafts tool, and the test misses it.
  • Failing case: With no channel registry, an otherwise unrestricted locked agent is told to resend with drafts although dispatch has no framework drafts tool; with a registry but drafts denied by allowedTools or denyToolsAtDispatch, the presented prose_locus description still recommends that denied tool.
• 5. minor at docs/locked-prose-routing.md:48, change-text.md:14, src/framework.ts:23129, src/framework.ts:28091, src/types/events.ts:293, test/locked-prose-routing.test.ts:616: A public executeToolCall that carries callerTurnId acts as an in-turn prose_locus call, contrary to the documented guarantee.
  • Failing case: A host calls executeToolCall for prose_locus with the active turn's callerTurnId; callingTurnOf recognizes that turn and the move changes its later rounds, rather than only later turns as the documentation promises.
• 6. minor at docs/locked-prose-routing.md:13, docs/dendrite.md:269, src/framework.ts:27731, src/framework.ts:27778, test/locked-prose-routing.test.ts:3, src/framework.ts:814: Claims that only the resident's own prose_locus call moves the lock ignore host or puppet calls and late resolution of a recipe lock.
  • Failing case: An operator uses puppetToolCall or a host uses executeToolCall to point the resident's lock at a different channel; future turns use that choice even though the resident did not choose it.
• 7. minor at src/framework.ts:37291, src/framework.ts:21711, src/framework.ts:23003, src/framework.ts:21420, test/locked-prose-routing.test.ts:882, commit-messages.txt:163: channel_open overwrites a locked turn's waking-channel provenance, corrupting incoming attribution and continuation, and the test title wrongly claims otherwise.
  • Failing case: Start a locked heartbeat or an unresolved-channel wake with an unrelated latest inbound message, then successfully open a channel: channellessTurn returns false and incomingFor exposes that unrelated message; if the turn auto-continues, its wake names the opened channel, and a heartbeat continuation is still marked heartbeatTurn.
• 8. minor at src/framework.ts:23888, src/framework.ts:23898, src/framework.ts:23914: Locked-mode primer is marked complete before its message is appended.
  • Failing case: On the first locked turn, the framework writes proseRoutingPrimed='locked' and then crashes or addMessage fails; after restart the marker makes maybePrimeProseMode return without telling the agent that routing is locked or how to move it, including when the lock is drafts and announce-on-change has no channel to announce.
• 9. minor at src/mcpl/channel-registry.ts:2535, src/mcpl/channel-registry.ts:2545, src/mcpl/channel-registry.ts:2586, src/framework.ts:13661: Drafts-locked turn's incoming message comes from the global latest inbound, not its own waking message.
  • Failing case: A message in channel A wakes a drafts-locked agent, then another delivered message in channel B updates the global anchor before its context or refusal is prepared; the server is told it is answering B, or the refusal reacts to B, instead of answering A.
• 10. minor at src/framework.ts:719, src/framework.ts:21710, src/framework.ts:24761, src/mcpl/channel-registry.ts:2535: A silent heartbeat isn't counted as a heartbeat, so the channelless-turn check lets it inherit an unrelated incoming message.
  • Failing case: After a channel message has been delivered, a locked agent takes a silent heartbeat tick: isHeartbeatWake excludes suppressProse and channellessTurn returns false, so beforeInference reports the old message as incoming even though the heartbeat answers nothing.
• 11. minor at src/framework.ts:20397, src/framework.ts:28008, src/framework.ts:37259, src/framework.ts:33004, src/mcpl/channel-registry.ts:6288: No-default publish refusal uses the agent's latest routing rather than the calling turn's routing.
  • Failing case: A drafts-locked open turn calls channel_publish without a channel after a silent start has become the agent's latest routing with a channel lock: the call is correctly refused, but the registry reads the silent turn and gives the generic no-default error instead of saying the calling turn's speech is held; the reverse mismatch can attribute the wrong no-channel reason.
• 12. minor at src/framework.ts:21407, src/framework.ts:26717, src/framework.ts:21833: Without a channel registry, locked speech skips draft creation while the agent is told it is held as drafts.
  • Failing case: Create a locked agent without channel servers and let it produce text with no lock or with a drafts lock: final speech routing is gated on channelRegistry, so no draft or draft receipt is created, while the agent is told the words are held as drafts.
• 13. minor at src/framework.ts:21875, src/framework.ts:21883, src/framework.ts:21910: prose_locus channel-resolution and storage refusals omit actionable recovery and who must intervene.
  • Failing case: A prose_locus move with no channel registry says only that no channels are configured, and an unreadable or full store can return a raw storage error without saying to contact the host operator or that retrying cannot repair the host; an unknown target likewise offers no way to discover valid destinations.
• 14. minor at src/framework.ts:21880, src/mcpl/channel-registry.ts:4661: The ambiguous prose_locus refusal gives channel_publish advice instead of telling the agent how to disambiguate 'to', and doesn't check access.
  • Failing case: When ambiguous candidates include channels displayed by id and server, the refusal can say to use channel_publish with channelId even if channel_publish is denied; that advice neither moves the lock nor provides a usable prose_locus to value for a candidate that requires separate server identification.
• 15. minor at src/framework.ts:814, src/framework.ts:18561, src/framework.ts:21990, src/framework.ts:22458, src/mcpl/channel-registry.ts:6292, src/mcpl/channel-registry.ts:6249: Locked-routing notices and the no-default refusal recommend send or channel_list tools without checking whether the agent can use them.
  • Failing case: An agent allowed prose_locus and channel_publish but denied channel_list receives a no-default refusal saying channel_list shows the ids; an agent denied all send tools is nevertheless told that reaching another channel takes an explicit send, even though moving prose_locus may be its only available route.
• 16. minor at src/framework.ts:21855, src/framework.ts:21863, src/framework.ts:21875: Out-of-turn prose_locus query or refusal reports the stored next-turn lock as where speech goes now.
  • Failing case: While a turn speaks in #main, a host call moves the stored lock to #ops and then queries prose_locus or makes an invalid channel move outside the turn: the result says speech goes to #ops, although the open turn continues speaking in #main.
• 17. minor at test/locked-prose-routing.test.ts:777, src/framework.ts:21680, src/framework.ts:23880: No test covers the non-record guards in maybePrimeProseMode and writeAnnouncedLocus against a damaged top-level framework state.
  • Failing case: Remove the non-record checks in maybePrimeProseMode and writeAnnouncedLocus: the damaged-record test supplies a valid top-level object containing a malformed proseLocks array, so it still passes while a top-level array or scalar can be overwritten and its locks lost.
• 18. minor at test/locked-prose-routing.test.ts:304, src/framework.ts:25663: Move-to-drafts tests don't pin the clearing of the stream's typingChannel.
  • Failing case: Remove the assignment that clears typingChannel when the locked turn moves to drafts or becomes held: the tests still assert only routed speech, drafts and receipts, while later token or content-block traces retain the old channel.
• 19. minor at test/locked-prose-routing.test.ts:820, test/locked-prose-routing.test.ts:843, src/framework.ts:38425: The sleep effective-mode fix is untested for locked ephemeral runs.
  • Failing case: Restore the check of agent.proseRouting instead of proseRoutingOf in sleep: both tests can still pass, but a locked ephemeral run with a current channel can post a sleep announcement despite its effective disabled mode.
• 20. minor at test/locked-prose-routing.test.ts:117, test/locked-prose-routing.test.ts:660, test/locked-prose-routing.test.ts:725, test/locked-prose-routing.test.ts:922, src/framework.ts:33003: Tests use a fake registry and handler, so they don't verify that the framework wires its new callbacks into the real registry.
  • Failing case: Disconnect activeChannelResolver or channellessTurn in AgentFramework's registry construction: the stand-alone incomingFor test supplies its own callbacks and the publish tests only inspect inputs to a fake handler, so they still pass even though a real drafts-locked turn may lose its incoming reply target or use a wrong publish default.
• 21. minor at docs/locked-prose-routing.md:119, docs/locked-prose-routing.md:48, change-text.md:21, src/framework.ts:21977: Docs promise a notice after every move, but notices fire only when the locus differs from the announcement baseline.
  • Failing case: After A was announced, a turn moves A→B→A; the next turn has no routing notice because A matches the announcement baseline, so a rewind that removes the second exchange can leave the resident seeing the B move without a correction.
• 22. minor at docs/locked-prose-routing.md:127, src/framework.ts:20880: The unconditional drafts catch-up notice contradicts the docs promise to name tools only when allowed.
  • Failing case: A locked resident denied the drafts tool has an unnoticed draft after a crash or branch rewind; the next catch-up notice nevertheless instructs it to call drafts(action: "list"), a tool dispatch will refuse.
• 23. minor at src/framework.ts:21682, src/framework.ts:23884, changelog.d/feat-prose-routing-locked.added.md:19: The new non-record state guards also suppress primers and baseline writes for non-locked agents.
  • Failing case: If framework/state becomes a non-record while the framework is running and an explicit or hybrid agent changes mode or locus, the old code attempted to replace the bad value and record the primer or baseline; these paths now return without either, leaving the agent untold or allowing notices to repeat until repair.

[antra-tess]

Thanks for the review of 44af64f0. All 23 findings are minor, and I checked each against the code. None is a defect this PR introduces with impact on locked speech now, so none is fixed here. Briefly:

• Behavior every mode already has, which locked mode inherits unchanged: channel_open replacing the turn's trigger channel (mcpl: implement full MCPL host support (Steps 1-8) #7), the incoming anchor being the global latest inbound (Detect and recover from zombie ephemeral agents #9), a silent heartbeat not counting as a heartbeat (fix: increase MCPL handshake timeout for Spring Boot servers #10), framework/state writers outside this PR replacing a non-record slot (add a probably missing interface file, and set discord external-message events to trigger inference #1), the announce baseline not being branch-scoped (Filter self-messages in the Discord module to prevent reingestion and cascading identity issues #3), the primer being recorded before it's appended (MCPL first-class integration with ephemeral agents #8), the shared resolver's and registry's advice text (Mcpl event type #14, Fix missing durationMs in inference:aborted and broken enrichedCall refs #15), and the drafts catch-up notice (Rename to @animalabs/agent-framework + npm deps #22). Each would be its own change across modes.
• Repeats of earlier declines, with the reasons given there: sync durability (Add (optional) logging for QueueEvents, and associated UI code #2), no channel registry (Add framework-level undo/redo for inference turns #12), the drafts mentions (Event queue stuff #4), out-of-turn queries (Fix orphaned tool_use from max_tokens truncation #16), the latest-routing refusal wording (Merge abort support with upstream streaming/MCPL #11), and test depth against stubs (MCPL v0.5: state management, branches, and WebSocket transport #17–Prioritize user input in process queue #20).
• Doc nuances, declined: a host's executeToolCall carrying a callerTurnId is a call made in that turn (Fixes merged, discord app example improved #5). An operator's puppet call acts as the resident (Yielding inference #6). A move that returns to the announced destination within one turn has nothing new to announce (Prioritize user input in process queue #21). The non-record guards apply to every agent because the slot is shared (feat: session-level usage tracking with cost accumulation #23).
• Refusal recovery text (Re-export KnowledgeStrategy from context-manager #13): declined. Each refusal says what stays unchanged, and damage errors name the operator.

CI passes on 44af64f0 (12/12) and the PR is mergeable, so I'm merging it. The companion connectome-host#603 waits for the release containing this.