desktop: classify automatic agent prefills

[matt2e]

Now that we remember the last used agent and prefill the composer, my "Drafts" section of inbox is filled with them and so the draft list becomes useless

Summary

• classify local composer snapshots as user-authored draft or automatic agent-prefill
• keep automatic agent prefills durable across navigation and restart while excluding them from Inbox draft rows and counts
• preserve classification through editor updates, attachments, optimistic sends, failure recovery, and exact-snapshot clearing
• fail visible for legacy, malformed, or ambiguous records and retain real drafts independently from prefills

Testing

• just ci
• desktop focused tests: 88 passed
• desktop full suite: 5,693 passed
• persistent-agent Playwright suite: 19 passed with CI=true

Originating Buzz thread: buzz://message?channel=3f523dd6-60dc-490c-a6f2-dbe4a3d36b62&id=3ca818c1e673109f8966daafc80a2b38746e9da5a44230f028d546d3c784cc42

[jedwards27]

:bot: Jude’s code review agent — REQUEST CHANGES on exact head 8ae0122276709ed790d004f33ffb9bef6d55e7cc (base c856be0fb954c9e5267d622841098c24e3381e8f).

Required fix

P2 — exact-snapshot ownership omits mention identity, allowing a newer draft to be deleted or overwritten.

markDraftSentEntry compares content, channel, media, spoilers, and entryKind, but not mentionRefs (desktop/src/features/messages/lib/useDrafts.ts:600-620). While a send is in flight, a newer draft under the same key can have identical visible text such as @Same Name but resolve that name to a different pubkey. Completion of the older send then treats the newer record as the submitted snapshot and deletes it.

The canceled-send recovery guard has the same omission (desktop/src/features/messages/ui/useMentionSendFlow.ts:354-379), so failure recovery can replace a newer draft’s mention routing with stale identities from the attempted send.

A causal test reproduced the successful-send case: save identical visible content with mention pubkey A, replace the same key with mention pubkey B, then complete A’s snapshot; the B draft was deleted (loadDraftEntry returned undefined).

Author action: include mentionRefs in both sent-snapshot matching and canceled-draft equality (prefer a shared full-snapshot comparator), pass the submitted mention refs into markDraftSent, and add causal regressions for same-visible-text/different-pubkey on successful completion and failure recovery.

Verification owner: author for the patch and regression tests; reviewer for refreshed exact-head integration.

Integrated validation

At this exact head:

• Full Desktop unit suite passed: 5,695/5,695.
• Focused changed tests passed: 88/88.
• Typecheck, pnpm --dir desktop check, and git diff --check passed; checkout was clean and remained on the pinned head.
• The complete persistent-agent-audience browser E2E file passed 19/19, covering navigation/reload, Inbox exclusion, edit cancellation, failed-send restoration, delayed send, and automatic-mention UI.
• A causal Inbox mutation made the new navigation/reload assertion fail as intended, supporting the selector’s effectiveness.
• Live Desktop integration shards and the release candidate passed when last sampled. Remaining Desktop Core/build/smoke jobs were still settling. Mark Previous Review Stale failed because its GitHub App received a 403 while attempting to post review-administration metadata; that is not the product defect driving this verdict.

Other inspected paths were coherent: malformed/legacy prefills fail visible as ordinary drafts, Inbox rows and counts share the filtered selector, authored edits/media promote monotonically to drafts, classification survives edit cancel and send recovery, and prefill retention cannot evict real drafts.

Confidence gaps (not additional author actions)

Real native WebView restart and accessibility behavior were not observed locally. Browser E2E covers the user journey and DOM-visible state, not native-only lifecycle or AX behavior. Release/native validation owns that residual verification.

[jedwards27]

Verdict: REQUEST CHANGES

Reviewed: c856be0fb954c9e5267d622841098c24e3381e8f..8ae0122276709ed790d004f33ffb9bef6d55e7cc (exact head 8ae0122276709ed790d004f33ffb9bef6d55e7cc)

Risk: high — this changes persisted message-composer classification and optimistic send/failure-recovery ownership, where a stale async completion can delete or overwrite a newer draft.

Behavior/contracts traced: persisted schema normalization and legacy/malformed fail-visible behavior; draft/prefill ownership transitions; Inbox row/count exclusion; navigation/reload; edits, attachments, optimistic send and failure restoration; exact-snapshot clearing; renderer E2E behavior and CI/release gates. The change is aligned with the stated durable-prefill/zero-noise product intent and does not alter relay, Nostr, Tauri IPC, or release contracts.

Blocking concrete defect (P2): the “exact” snapshot omits mention identity

markDraftSentEntry compares content, channel, media, spoilers, and classification, but not mentionRefs (desktop/src/features/messages/lib/useDrafts.ts:600-620). Its caller likewise does not supply the sent snapshot's mention refs (desktop/src/features/messages/ui/useMentionSendFlow.ts:570-578). If an in-flight send and a newer same-text draft resolve @Same Name to different pubkeys, completion of the older send deletes the newer draft.

The failure-recovery ownership guard has the same omission (desktop/src/features/messages/ui/useMentionSendFlow.ts:354-379), so an older failed send can overwrite newer mention identities with stale refs. Those identities determine recipients; equal visible text is not equal message state.

A temporary causal regression test persisted @Same Name for agent A, replaced the same key/text with agent B, then completed A's sent snapshot. Expected B to remain; actual loadDraftEntry was undefined (0 passed / 1 failed). The test was removed and the checkout returned clean.

Author action: include mentionRefs in sent-snapshot matching and the canceled-draft equality guard—prefer one full persisted-snapshot comparator—pass savedMentionRefs through markDraftSent, and add causal success and failure-recovery tests for same visible text with different pubkeys.

Verification owner: author for the patch/regression tests; :bot: Jude’s code review agent for refreshed exact-head integration.

Validation at exact head

• pnpm --dir desktop test — 5,695 passed, 0 failed.
• pnpm typecheck — passed.
• pnpm check — passed (existing repository warnings only).
• pnpm build:e2e, then complete persistent-agent-audience Playwright smoke — 19/19 passed, covering navigation/reload, Inbox exclusion, edit cancel, failed-send restoration, delayed send, and automatic-mention UI.
• Causal Inbox-selector mutation made the new navigation/reload assertion fail as expected (expected 0 draft rows, received 1); exact head was restored and rebuilt.
• git diff --check — passed; final exact-head worktrees were clean.
• Live CI sampled at review time: Desktop release candidate, relay E2E, and both Desktop integration shards passed; Desktop Core/build/smoke shards were still pending. Mark Previous Review Stale was red in review-workflow metadata, not demonstrated product code.

Manual/native evidence: browser E2E exercised the complete visible journey. Real Tauri restart and accessibility semantics were not run.

Residual risk / confidence gaps: native WebView lifecycle and AX behavior remain release/native-validation ownership; pending CI remains CI ownership. Neither changes the blocking author action above.