Summary
The invariant that MessagesPersisted must never precede a Message frame carrying one of the ids it publishes is currently held by convention plus a test net, not by a mechanism. A new publication site gets no compile-time help and will silently violate it.
Why this matters
The invariant is not cosmetic. edit_message checks only stored ∖ client — under-reporting deletes rows the user can still see, while over-reporting is safe. A client that unions MessagesPersisted into its view and then drops mid-stream can therefore pass the guard with an incomplete transcript, and the server truncates content the client is still displaying.
That is exactly what happened: a review found the slash-command path publishing before yielding. Fixing it turned up two further instances nobody had reported — the hook-blocked prompt, and the elicitation seam.
The current state
messages_then_persisted is the ordered seam and it is opt-in. persisted_event can still be called directly and its event yielded before the messages it names. Twelve publication sites were audited and their reasoning recorded in the code, and three tests cover five turn shapes — which is what caught the two unreported instances. But that is a net, not a guarantee.
Suggested direction
Make persisted_event private to a module that can only emit through the ordered seam, so constructing the event without ordering it is not expressible. That converts an audited convention into a mechanism, and the audit stops needing to be repeated every time someone adds a site.
Worth doing when someone next touches this area rather than as standalone churn.
Provenance
Recorded during the #59 blocker fix, by the engineer who did the audit — as the thing that would stop the audit being necessary again.
Summary
The invariant that
MessagesPersistedmust never precede aMessageframe carrying one of the ids it publishes is currently held by convention plus a test net, not by a mechanism. A new publication site gets no compile-time help and will silently violate it.Why this matters
The invariant is not cosmetic.
edit_messagechecks onlystored ∖ client— under-reporting deletes rows the user can still see, while over-reporting is safe. A client that unionsMessagesPersistedinto its view and then drops mid-stream can therefore pass the guard with an incomplete transcript, and the server truncates content the client is still displaying.That is exactly what happened: a review found the slash-command path publishing before yielding. Fixing it turned up two further instances nobody had reported — the hook-blocked prompt, and the elicitation seam.
The current state
messages_then_persistedis the ordered seam and it is opt-in.persisted_eventcan still be called directly and its event yielded before the messages it names. Twelve publication sites were audited and their reasoning recorded in the code, and three tests cover five turn shapes — which is what caught the two unreported instances. But that is a net, not a guarantee.Suggested direction
Make
persisted_eventprivate to a module that can only emit through the ordered seam, so constructing the event without ordering it is not expressible. That converts an audited convention into a mechanism, and the audit stops needing to be repeated every time someone adds a site.Worth doing when someone next touches this area rather than as standalone churn.
Provenance
Recorded during the #59 blocker fix, by the engineer who did the audit — as the thing that would stop the audit being necessary again.