[steipete]

Fix send identity and receipt handling for stale direct chats and tracked sends.

• Pass the database-verified participant route to the AppleScript attachment fallback.
• Report when AppleScript actually recovers through that participant, then check compatible direct chats on the same account and service. Reject conflicting receipts across chats.
• Require the requested tracked UUID to appear as a new outgoing row in the target chat before reporting success. A missing or rewritten identity remains retry-unsafe uncertainty.

Refs #388, #394, and #385. Regression tests use synthetic SQLite databases, injected transports, and AppleScript operations replaced with fixtures. No messages, identity changes, or live database edits were performed. Validation and exact-head CI are recorded below before merge.

Validation: baseline regression fixtures fail; the combined candidate passes 17 CLI and 11 core fixture tests, final integrated focused macOS tests, and make lint. The documented Linux gate passed on Crabbox. Independent P2 review is clean. Full macOS/Linux and CodeQL checks run at this PR head.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[chatgpt-codex-connector]

Codex Review Summary: ✅ Completed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-11-14T07:06:09.034730Z	4dd9b56	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[clawsweeper]

Codex review: needs changes before merge.

What this changes

This PR adds stale-chat attachment recovery, recovered-chat receipt matching, and persisted UUID verification for tracked sends.

Example: A tracked send requests UUID 6B3A5202-2D11-4E22-A813-AA3A89121E8F, but Messages persists A9DD330E-5007-467F-8B9B-FE8938E3878B.

• Before: RPC reports success using the requested UUID even though that identity is absent from message history.
• After: RPC returns may_have_completed with retry_safe false when the requested UUID cannot be verified.

Review scores

Measure	Result	What it means
Overall readiness	🦪 silver shellfish (2/6)	Useful, focused repairs with fixture coverage, but a resolved-chat mismatch blocks the tracked-send implementation.
Proof confidence	🦐 gold shrimp (3/6)	This maintainer-authored PR is outside the contributor proof gate; supplied fixtures exercise command wiring, recovery selection, and tracked polling, while live Messages dispatch and persistence remain unproven.
Patch quality	🦪 silver shellfish (2/6)	1 actionable review finding remain.

Product

Kind: Bug fix · Worth it: Yes · Fix scope: Partial
User problem: Affected sends either fail before dispatch, report uncertainty after delivery, or return a tracked identity that never appears in message history.
Reason: The maintainer-authored direction repairs documented failures conservatively; rewritten-attempt reconciliation requested in #385 remains outside this patch, which correctly uses Refs.

Merge readiness

⛔ Needs changes before merge - 1 item remains

Keep this PR open: it addresses confirmed send failures, but tracked receipt verification must follow the helper’s resolved chat.

Priority: P1
Reviewed head: 4dd9b56d48eb365172956c71306cf588ad83d149

Before merge

• Verify tracked receipts against the resolved chat GUID (P2) - This passes the original request target even though the helper returns the actual resolved chat in data["chatGuid"]. For example, a stale iMessage;-;friend@example.com target can be materialized through chatForIMHandle into any;-;friend@example.com. SendMessage.inc replaces the target with that chat’s GUID before acknowledging dispatch, but hasTrackedSendReceipt requires exact equality with the original target. A new outgoing row containing the exact requested UUID in the resolved chat therefore times out as may_have_completed. Use the helper’s resolved chat GUID for verification and add an RPC regression where the requested and returned chat GUIDs differ.

Findings

• [P2] Verify tracked receipts against the resolved chat GUID — Sources/imsg/RPCServer+SendHandlers.swift:205-207

Agent review details

How this fits together

CLI and RPC commands resolve chat targets, dispatch through AppleScript or the injected Messages helper, and inspect read-only chat.db receipts before returning send results.

flowchart TD
  A[CLI or RPC request] --> B[Chat target resolver]
  B --> C[AppleScript transport]
  B --> D[Injected Messages helper]
  C --> E[Messages database]
  D --> E
  E --> F[Receipt verification]
  F --> G[Success or delivery uncertainty]

Loading

Technical review

Best possible solution:

Verify the exact outgoing tracked UUID in the helper’s resolved chat while preserving account-bound recovery and retry-unsafe uncertainty.

Do we have a high-confidence way to reproduce the issue?

Current main and the affected-release reports establish the original failures; the introduced target mismatch is traceable through helper resolution, acknowledgment, and receipt SQL without executing target code.

Is this the best way to solve the issue?

The shared recovery and exact-UUID approach fits the existing contract, but receipt verification must consume the resolved destination already returned by the helper.

Full review comments:

• [P2] Verify tracked receipts against the resolved chat GUID — Sources/imsg/RPCServer+SendHandlers.swift:205-207
  This passes the original request target even though the helper returns the actual resolved chat in data["chatGuid"]. For example, a stale iMessage;-;friend@example.com target can be materialized through chatForIMHandle into any;-;friend@example.com. SendMessage.inc replaces the target with that chat’s GUID before acknowledging dispatch, but hasTrackedSendReceipt requires exact equality with the original target. A new outgoing row containing the exact requested UUID in the resolved chat therefore times out as may_have_completed. Use the helper’s resolved chat GUID for verification and add an RPC regression where the requested and returned chat GUIDs differ.
  Confidence: 0.94

Overall correctness: patch is incorrect
Overall confidence: 0.94

AGENTS.md: found and applied where relevant.

Codex review notes: model internal, reasoning medium; reviewed against 9070f71a2d9c.

Provenance checked

• Account-bound stale direct-chat recovery keeps the original intent (fix: recover stale direct chat targets before dispatch #246: Recover only a proven pre-dispatch missing-chat lookup through the verified participant on the original account.)
• Resolved-route and service-isolated receipt verification keeps the original intent (fix: verify sends against the resolved delivery route #269: Verify the successful delivery route rather than confirming an unrelated receipt from an abandoned route.)
• Unique staged attachment receipts keeps the original intent (fix: wait for attachment-only send receipts #329: Wait for delayed joins and require one unique outgoing staged-path receipt.)
• Effective-service receipt filtering keeps the original intent (fix(send): verify iMessage sends that land in an SMS-labelled any;-; chat #373: Accept stale-labelled neutral chats without accepting opposite-service message receipts.)
• Tracked UUID success contract changes intended behavior with a stated reason (feat(rpc): add caller-owned tracked send IDs #235: Give callers an exact message identity for timeout reconciliation without text-and-time guessing.)
• Routing diagnostics documentation keeps the original intent (bbd6b93: Document stored routing metadata as diagnostics rather than controls for selecting an outgoing alias.)

Testing

Proof path: in-process harness.

Security

None.

Evidence

Acceptance criteria:

• Add an RPC regression whose exact UUID is persisted only in the helper’s returned canonical chat; demonstrate failure before the repair and success afterward.
• swift test --filter RPCTrackedSend
• swift test --filter TrackedReceipt
• make lint
• make test

What I checked:

• Repository policy applied: Read the complete root AGENTS.md; no nested AGENTS.md, maintainer-notes directory, or pr-simplify skill was present. (AGENTS.md:1, 4dd9b56d48eb)
• Verified introduced patch: Reviewed the pinned introduction diff, including production changes, regression fixtures, documentation, and changelog; main retains the missing attachment metadata and stale-chat receipt restriction. (Sources/imsg/SentMessageVerifier.swift:89, 4dd9b56d48eb)
• Resolved chat identity is authoritative: The helper can materialize a direct chat through chatForIMHandle, replaces the requested target with the resolved chat GUID, and returns that GUID in its acknowledgment. (Sources/IMsgHelper/SendMessage.inc:74, 4dd9b56d48eb)
• Introduced receipt target mismatch: The new verifier receives the original bridgeChatGUID, while its SQL accepts only exact chat GUID or identifier equality; a receipt in the helper’s differently named resolved chat is excluded. (Sources/imsg/RPCServer+SendHandlers.swift:206, 4dd9b56d48eb)
• Affected releases and credited reports: send.tracked returns ok, but Messages saves the message under a different GUID #385 reports rewritten tracked identities on v0.20.0; send-attachment: AppleScript fallback lacks #246 stale direct-chat recovery (-1728 for a GUID absent from live chats) #388 reports missing attachment recovery on v0.21.0; send: a recovered stale direct chat reports may_have_completed although the message was delivered #394 supplies staged macOS observations of receipts entering another chat.
• Validation boundary: The complete PR body and discussion supply synthetic SQLite, injected-transport, and substituted AppleScript validation, with no live delivery attempted; exact-head macOS and Linux checks passed, while Swift CodeQL remained in progress. (Tests/imsgTests/TrackedSendReceiptTests.swift:8, 4dd9b56d48eb)

Likely related people:

• Peter Steinberger: Raw commit cdc09c1 adds Sources/imsg/SentMessageVerifier.swift:76 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: cdc09c1f2de8; files: Sources/imsg/SentMessageVerifier.swift)
• clawSean: Raw commit 268912b adds Sources/imsg/RPCServer+Handlers.swift:119 relative to its recorded parents. This identifies author metadata, not feature responsibility or a PR merger. (role: source-line author; confidence: high; commits: 268912be7189; files: Sources/imsg/RPCServer+Handlers.swift)

Preflight source

Source unknown. Source comparison at the observed PR snapshot only. Completion is self-reported; body, policy, tests, execution, and report bytes are not verified.

Labels

Label changes:

• add P1: The linked affected-release reports establish broken attachment delivery and incorrect tracked-send results in active messaging workflows.
• add merge-risk: 🚨 compatibility: The new exact target check can turn a successfully persisted tracked send into delivery uncertainty when the helper resolves a different canonical chat GUID.
• add rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• add status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Label justifications:

• P1: The linked affected-release reports establish broken attachment delivery and incorrect tracked-send results in active messaging workflows.
• merge-risk: 🚨 compatibility: The new exact target check can turn a successfully persisted tracked send into delivery uncertainty when the helper resolves a different canonical chat GUID.
• rating: 🦪 silver shellfish: Overall readiness is 🦪 silver shellfish; proof is 🦐 gold shrimp and patch quality is 🦪 silver shellfish.
• status: ⏳ waiting on author: ClawSweeper has contributor-facing work open and is waiting for author action.

Rating scale

6/6 🦀 challenger crab · 5/6 🦞 diamond lobster · 4/6 🐚 platinum hermit · 3/6 🦐 gold shrimp · 2/6 🦪 silver shellfish · 1/6 🧂 unranked krab. Overall follows the weaker of proof and patch quality; ✨ marks media proof (a screenshot, video, or linked artifact) that directly shows the changed behavior.

Workflow

ClawSweeper edits this one comment on every review. Comment @clawsweeper re-review for a fresh review only. Repair and merge execution lanes are retired.

Reviewed November 14, 2026, 2:18 AM ET / 07:18 UTC.