feat(desktop): invite owned agents from standalone forums

[loganj]

Summary

In Desktop's standalone Forums, selecting an owned agent from another device could leave a post or reply unsendable if the agent had not joined the forum. This adds Invite / Cancel to the send flow so you can resolve membership without leaving your draft.

• Invite checks response policy and your permission to add members, adds the agent to the forum, waits for refreshed membership, then rechecks authorization before posting to the original destination. Membership is forum-wide, not limited to one post.
• Cancel / Escape keeps the text, attachments and selected recipients for retry. Unlike chat's Do nothing / Send anyway, this dialog has no reference-only send choice. Invite is disabled while pending; Cancel remains available.
• Leaving the source post/reply cancels its pending invitation, even if you return. Errors remain visible, focus returns to the initiating editor when appropriate, and late completion cannot resume a cancelled post or interfere with a newer attempt.
• A rejected send restores text, uploaded media and exact selected recipients to the source draft only if no newer edit, deletion, upload intent or send supersedes it. Clipboard verification settles before recipient capture, with stale edits/navigation fenced out.

Related issue

Targets main after #7124 merged. This PR reuses its publication checks and draft protection; the five forum commits have been replayed unchanged onto the merged parent. Owned-agent discovery (#7122) is already merged. Split from #7114.

Forum creation/templates, channel-less Notes and local-agent management are unchanged. Duplicate-name binding from #7133 is already merged and retained by this stack. Inviting does not start a remote agent or promise that it is online or will reply.

Testing

Forum composer lifecycle tests, including clipboard-settlement cases, and TypeScript/changed-file formatting checks passed after the restack. Earlier invitation, focus and transport-recovery browser coverage is retained, not claimed as a fresh full browser run on this head. See live CI for current-head results. Browser evidence uses mock IPC; no full local just ci pass or native/live-relay validation is claimed.

To try it: open a forum post or reply, select an owned nonmember agent and send. Cancel, then retry without reselecting; Invite should add that agent before posting. Deny the add to check the visible error and retained draft. Navigate away/back during a pending invitation or rejected send; no stale publication or overwrite of a newer draft should occur.

Earlier mock-browser capture, not current-head runtime proof. Error and successful-post captures; no before-state/native capture available.

Limits: cancellation cannot undo accepted membership changes or dispatched posts; authorization and publication are not atomic. Recovery is same-window, subject to browser storage limits, and is not a durable in-flight send journal: reload/crash can lose a pending snapshot. Cross-window coordination and in-flight upload custody are unchanged. The parent's legacy member-agent compatibility does not establish ownership for nonmember invitations.

[jedwards27]

Reviewed exact head 8eba950a86be1a4d0d5847315d140c862eabee01 against base 7ffead0f8ae128782991153054abd388e4ff04d9.

Two author-actionable defects remain:

1. [P1] Same-forum thread navigation can publish the preserved reply to the thread the user left. ForumComposer suspends submission while the Invite dialog is open, but useForumMentionPreparation defines freshness only by channelId. ForumView reuses the same unkeyed thread panel/composer when selectedPostId changes within a forum. If a user begins a reply/invite on thread A, navigates to thread B while the add is pending, and the add completes, the continuation remains current and invokes the submitter captured for A while B is visible. Besides surprising publication, the accepted membership side effect cannot be rolled back. The new navigation test covers only a channel change, so it does not exercise this boundary.

   Author action: bind the pending attempt to the source visit/thread identity (or remount the reply composer by selectedPostId) and add an A→B same-forum deferred-add regression proving no reply publishes to either thread and draft recovery remains owned by the correct source. This also restores the source-visit contract documented in docs/remote-mention-routing.md.

2. [P2] The newly exposed forum Invite dialog is not keyboard/focus or async-error accessible. An exact-head Playwright probe observed document.activeElement === BODY after the alert dialog opened and again after Escape dismissed it; the changing invitation error had no alert/live-region semantics. The implementation uses ordinary Buttons rather than the available Radix AlertDialogCancel / AlertDialogAction primitives, and the dynamically inserted error is an unannotated paragraph. Keyboard users therefore do not enter the decision controls or return to the preserved composer, and assistive technology is not notified when Invite fails.

   Author action: use the alert-dialog action/cancel primitives or explicit autofocus/restore handling, make the changing error an alert/live region, and add regression coverage for initial safe focus, Escape/Cancel focus restoration, and error announcement. Preserve the shared chat behavior as well.

Validation at this exact, clean head: git diff --check passed; just desktop-check and just desktop-typecheck passed; pnpm build:e2e passed; isolated Playwright forum-agent-invitation.spec.ts passed 8/8. Required CI reported green, including Desktop Core, four Desktop Smoke shards, relay/integration jobs, macOS build, Semgrep, zizmor, and DCO. The broader just desktop-test reviewer run was interrupted after roughly five minutes without an observed assertion failure, so that is a confidence gap rather than author rework. Native packaged Tauri/accessibility observation also remains a reviewer/release verification gap, not a separate author defect.

[jedwards27]

Review verdict: request changes

Reviewed base 7ffead0f8ae128782991153054abd388e4ff04d9 through exact live head 8eba950a86be1a4d0d5847315d140c862eabee01, integrating both assigned lanes. Two author-actionable defects remain.

1. Same-forum thread navigation does not invalidate a pending reply invitation

ForumComposer retains the captured submission continuation while Invite is pending (desktop/src/features/forum/ui/ForumComposer.tsx:225-251), while useForumMentionPreparation scopes freshness only to channelId (desktop/src/features/forum/ui/useForumMentionPreparation.ts:30-31,50-52,117-120). ForumView reuses the unkeyed thread panel/composer when selectedPostId changes (desktop/src/features/forum/ui/ForumView.tsx:131-166; ForumThreadPanel.tsx:331-339). Navigating thread A→B in one forum therefore leaves the attempt current; completing Invite can resume the captured reply to A while B is displayed.

Author action: bind pending preparation to source visit/thread identity (or remount by selectedPostId) and add a held-add A→B regression proving no reply publishes and draft recovery remains attached to the correct source.

2. The Invite dialog breaks keyboard-focus and error-announcement behavior

NonMemberMentionDialog does not use the Radix action/cancel primitives or explicit autofocus handling, and its dynamic failure text has no alert/live-region semantics (desktop/src/features/messages/ui/NonMemberMentionDialog.tsx:35-85). An exact-head production-build probe observed BODY focused after open and after Escape; the visible async error had no alert/live attributes. This newly exposed forum journey therefore neither moves focus safely into the modal, restores it to the preserved composer, nor announces invitation failure to assistive technology.

Author action: establish safe initial focus and focus restoration, expose changing failure text as an alert/live region, and add regressions for open, Escape/Cancel, and failure semantics while preserving the shared chat behavior.

Verification

Focused forum E2E passed 8/8; check/typecheck and E2E build passed. The incomplete broad local suite and absent packaged-native journey are reviewer/release confidence gaps, not additional author rework.

— :bot: Jude’s code review agent

[loganj]

Response to your original exact-head review (both body findings; there are no inline review threads to resolve).

Addressed in 67812105430e5d4d3f82bf952e67f55839de0702, on routing base 1144465d00273cf74b7c22544ae5a3299bd98560:

1. P1 source-visit publication: keyed composer/thread visits and generation/pending-owner fences invalidate A when navigating to B—even within one forum and on A→B→A. Deferred-add production/browser regressions assert no stale reply publication and source-owned draft restoration; old completion cannot release a newer retry. Accepted membership is not rolled back.
2. P2 dialog accessibility: safe initial Cancel focus, source-checked deferred composer restoration after Escape/Cancel, enabled forum cancellation during add, and changing errors with role=alert. Existing chat Do nothing/Send anyway is retained. Forum + shared focus browser evidence is 16/16; shared browser baseline 67/67.

Independent review found a subsequent repair regression (failed dispatched A after returning with no new intent); source-key recovery now preserves text/uploaded media/exact refs without overwriting newer intent or replaying send. Final desktop 6016/6016; four old-source failure/new-source pass recovery assertions; six independent edge probes and expected media-snapshot mutation failure. Three new browser cases eventually pass: the initial empty-fill deletion fixture failed, then Select All/Backspace plus pre-release emptiness assertion passed the isolated rerun. That history is preserved, not called a clean initial 3/3.

Latest-source TypeScript and normal OSS/internal frontend artifact matrix pass; final scoped static/size/E2E build evidence reused where exact. Updated PR body records provenance, prepared screenshots and limitations. Packaged-native accessibility, live relay/signed ownership and root security authorization remain separate; no formal review is dismissed. Requesting fresh formal review of this exact head, not treating local scoped approval as yours.

[loganj]

Response to the integrated review verdict, separately preserving the response to both original review bodies. GitHub exposes no inline thread for either finding, so these linked comments are the response records; no formal review is resolved/dismissed by the author.

The repair is 67812105430e5d4d3f82bf952e67f55839de0702, base 1144465d00273cf74b7c22544ae5a3299bd98560.

• Finding 1: ForumView/ForumComposer keyed source visits and hook generation/pending-object ownership stop held-add A→B/A→B→A continuations from publishing. Production-seam and real-editor/mock-IPC browser regressions cover source-owned recovery, cancellation/retry, stale completion and no replay. The additional independently found dispatched-reply regression is repaired under shared source-key authority; newer edits/deletion/new sends win.
• Finding 2: NonMemberMentionDialog explicitly focuses the safe action and announces async failure (role=alert); deferred close restoration checks the captured connected source editor. Escape/Cancel and shared chat are covered. Cancel stays available during a forum add.

Final 6016 desktop tests pass. Reused 16 forum/focus and 67 shared browser passes for unchanged scope; three new recovery browser cases eventually pass (two initially, deletion after correcting an empty-fill fixture with actual keyboard deletion and an emptiness assertion). Independent 6/6 edge probes plus a failing media-snapshot mutant make the cleanup/recovery claim falsifiable. Latest normal OSS/internal artifact matrix + TypeScript pass; scoped static, file-size and E2E build passed. All committed blobs match the reviewed frozen candidate; no publisher source edits.

The body includes exact evidence, prior-failure history and limits. This resolves the author-actionable implementation work, not native/release confidence or root/routing security gates. Fresh exact-head technical review and hosted CI are still required.

[jedwards27]

:bot: Jude’s code review agent — APPROVE exact head 67812105430e5d4d3f82bf952e67f55839de0702 against base 1144465d00273cf74b7c22544ae5a3299bd98560.

Both assigned lanes found no remaining author-actionable defect.

The changed head closes the prior blockers:

• Pending forum reply intent is keyed by source visit/thread identity. Same-forum A→B→A navigation, held membership add, late completion, cancellation, recovery, and publication retain the captured source authority rather than resuming against the wrong thread.
• The Invite alert dialog now gives safe initial focus to Cancel/Do nothing, restores focus to the current source editor after Cancel or Escape, and exposes asynchronous failure with role="alert".
• Authorization is checked before membership add and again against refreshed membership before publication. Draft identity, attachments, references, retry, and shared-chat behavior remain coherent.

Exact-head evidence:

• Production-seam lifecycle suite: 21/21.
• Production-build Playwright forum invitation suite: 19/19.
• Desktop check, typecheck, file-size validation, direct TypeScript typecheck, E2E production build, and git diff --check: PASS.
• Completed hosted DCO, Desktop builds, integration shards, relay artifact, token guard, and security scanners: green. Desktop Core and four smoke shards were still pending at the final snapshot; no PR-caused required-gate failure was observed.

Confidence gaps, not author action:

• Packaged Tauri plus real screen-reader behavior was not observed. Verification owner: release/native QA for an optional assistive-technology smoke.
• Native/real-relay membership-add-to-publication atomicity cannot be proven by browser mocks. Verification owner: native integration/release validation; no reproducible defect was found.
• Remaining hosted Desktop Core/smoke completion is owned by CI. Author action: none unless a current-head required gate fails.

[jedwards27]

Review verdict: approve

Reviewed base 1144465d00273cf74b7c22544ae5a3299bd98560 through exact live head 67812105430e5d4d3f82bf952e67f55839de0702, integrating both assigned systems/integration and product/UI/accessibility lanes. The two defects from the prior head are resolved; no author-actionable defect remains.

• Source authority is now keyed to the forum post/thread visit. Pending invitation and publication continuations are invalidated across same-forum A→B navigation, while source-key draft recovery preserves the exact content, attachments, and selected identity without overwriting newer A or B intent or replaying publication.
• Membership add and final publication authorization use the captured channel, with a fresh authoritative revalidation after membership refresh. Cancellation invalidates late add/validation completion; transport failure recovery follows the same source-key ownership rules.
• The alert dialog places initial focus on the safe action, restores the current source editor after Cancel or Escape, keeps cancellation available while Invite is pending, and exposes asynchronous failures with role="alert". Shared-chat behavior remains covered.

Exact-head evidence: production-seam lifecycle tests passed 21/21 in my clean checkout; the product lane's production-build Playwright run passed 19/19 with invite/error/sent screenshots visually inspected; desktop check, typecheck, file-size validation, and production E2E build passed across the assigned lanes. At submission time, macOS and integration checks had passed; Desktop Core and four smoke shards were still running without a reported failure. Their completion remains CI-owned and requires no author action unless they expose a PR-caused failure.

Residual confidence gap: packaged Tauri with a real relay and real screen reader was not observed. Author action: none. Verification owner: release/QA for an optional packaged-native assistive-technology and add→publish smoke.

— :bot: Jude’s code review agent

[loganj]

Rebased forum descendant — fresh head 870a2a1eb06a24f401dd5ead3e85b101d63255d4

Replayed the three forum commits onto #7124 at e66b949cabcf06f2871e610f6ad3e3136b1c2f16. The only range-diff is contextual smoke registration; invitation/publication authorization, navigation cancellation and source-draft recovery behavior are unchanged. This remains a dependent PR, not an independent main-based change.

Exact-head local evidence:

• Full Desktop JS suite: 6124 passed.
• Forum + remote-owned-mention Chromium journeys: 37 passed, using mock IPC (not live-relay proof).
• Desktop checks/typecheck/E2E build passed, with the existing shared dependency-metadata warning.
• Full Tauri workspace test command: 3253 passed, 20 ignored. Initial compile exceeded the 600-second execution window; incremental rerun completed successfully. The original timeout is retained.
• just ci was attempted again: root formatting/clippy passed; Desktop's pnpm wrapper attempted dependency reconciliation and stopped because it would purge the shared modules without a TTY. No purge or peer-file changes were made. This is not a full local CI pass; fresh hosted checks remain required.

All 13 outgoing objects retain the configured signatures and required attribution/DCO. Explicit lease publication replaced 67812105; no merge, review dismissal, or gate bypass. Requesting fresh automated review of the rebased head. Existing substantive review history remains intact.

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head 416a0f387020f562da7bb4ad6cb30f83b6545201 against base a49846a738c2ce2eae28eeea3d5e627ca97b6ba4.

No unresolved author-actionable defect remains after independent systems/integration and product/UI review.

The changed-head delta adds a post-settlement composer-revision/visit-authority fence before invitation preparation. The integrated review verified source/thread ownership, exact-recipient held membership add, fresh final authorization, cancellation and late-completion invalidation, navigation/A→B→A isolation, dispatch-failure draft/media recovery, accessible Invite/Cancel/Escape and focus/error behavior, and persistence compatibility. Removing the new fence made the targeted stale clipboard-settlement regression fail; the exact head was restored and clean before verdict.

Exact-head evidence integrated: Desktop units 6,352/6,352; forum lifecycle 25/25; production-bound forum invitation Playwright 19/19; desktop check, typecheck, production build, file-size, git diff --check, four hosted smoke shards, Windows/macOS builds, integration, DCO, Semgrep, and zizmor passed.

Confidence gaps, not author rework: Desktop Core remained in progress without observed failure at submission; native screen-reader and real-shell observation were not run. Author action: none unless Core fails causally. Verification owner: CI/integration for Core completion; native accessibility/release QA for optional platform observation.

Any new head invalidates this approval.

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head 416a0f387020f562da7bb4ad6cb30f83b6545201 against base a49846a738c2ce2eae28eeea3d5e627ca97b6ba4.

No unresolved author-actionable defect was found in the changed-head review.

The re-review range-diffed from previously reviewed head 14d30d18a00fb2a5c0cd46b2847a8842a6bb140c and found one new semantic patch: the composer now captures draft authority before pending pasted-mention settlement and fences continuation on unmount, navigation/return, or authored revision change before invitation preparation (desktop/src/features/forum/ui/ForumComposer.tsx:342-363). The surrounding integration paths retain exact selected-recipient and bot-role membership adds, fresh authorization before publish, cancellation/late-completion invalidation, and source-key/revision-owned draft and media recovery (useForumMentionPreparation.ts:35-168, ForumComposer.tsx:374-404, useForumDraftRecovery.ts:25-93). No persistence schema or native storage format changes were introduced.

Exact-head verification on clean worktrees:

• just desktop-check — passed
• just desktop-typecheck — passed
• just desktop-test — 6,352/6,352 passed
• just desktop-build — passed
• production-bound forum invitation Playwright suite — 19/19 passed
• targeted forum lifecycle suite — 25/25 passed
• causal mutation removing the new post-settlement fence failed the intended stale clipboard-settlement regression, then the exact head was restored cleanly

The production-bound suite covers Invite/Cancel/Escape, focus restoration, visible error and keyboard Retry behavior, exact successful p tags, revoked/finally unauthorized recipients, navigation while pending, A→B→A during add and publish, reference-only shared chat, and dispatch-failure draft/media recovery. Screenshots were coherent.

Residual confidence gaps do not require author rework: native VoiceOver/NVDA announcement timing and a real native GUI/IPC pass were not directly observed; browser E2E uses mock IPC as documented in docs/forum-agent-invitation.md:20-24. Optional native accessibility/release QA owns that assurance. At final review submission, all completed applicable hosted checks were green, while Desktop Domain / Desktop Core remained in progress; required CI must complete successfully before integration.

Any new head invalidates this approval.

[jedwards27]

Verdict: APPROVE
Reviewed: 0b303f805e4420eae682087555075c5a7472e40e..b4dd19cfae1fbeb8ffb93c049f3338af688f42e2 (exact head b4dd19cfae1fbeb8ffb93c049f3338af688f42e2)
Risk: high — forum publication now invites selected non-member agents and must preserve exact recipient authorization, draft ownership, cancellation, and failure recovery across asynchronous membership and transport boundaries.

Behavior/contracts traced: source-key/revision ownership before clipboard settlement; exact intended-agent capture; membership revalidation before add and again before publish; cancellation/navigation/unmount fencing; failed-dispatch recovery of text, completed media, and exact mention refs; shared non-member-dialog keyboard/focus behavior; legacy-safe draft persistence.

Findings: no blocking or non-blocking defect found. The restacked five-patch series was reviewed fresh; three patches are patch-identical to the prior series, while the material delta adds the originating-visit clipboard fence and reconciles the parent head's exact-recipient smoke coverage.

Author action: none.
Verification owner: CI/release owns required-gate disposition and optional packaged-Tauri/native assistive-technology observation.

Validation at matching clean head:

• just desktop-check — PASS (repository diagnostics only)
• just desktop-typecheck — PASS
• just desktop-test — PASS, 6,434/6,434
• just desktop-build — PASS, including protected-artifact matrix
• focused composer lifecycle — PASS, 25/25
• desktop/tests/e2e/forum-agent-invitation.spec.ts — PASS, 19/19
• focused production-built smoke including mention-recipients.spec.ts — PASS, 39/39
• causal mutation removing the pre-invitation clipboard fence made its regression test fail (2 !== 0); restoring exact head returned the tree clean
• git diff --check 0b303f805e4420eae682087555075c5a7472e40e...HEAD — PASS

Required smoke reconciliation: hosted shards 2 and 3 are red, but the failures do not establish a PR-caused defect. The PR-specific forum suite passed 19/19 in the same shard-2 job and independently at exact head. Shard 2's final failures are broad message-edit/attachment/history cases; the historical-recipient case passed in the focused 39/39 rerun, and the attachment failure was already classified flaky after retry. Shard 3's persistent-agent-audience failure is identical at the same test line on the exact base run 33891898259; that base run also failed unrelated profile/workflow/navigation/thread tests across shards, while the candidate failures additionally span onboarding and overscroll files outside this PR's changed production surface. This is base-wide/broad-shard harness instability, not causal evidence against the forum change. The red required checks still own merge readiness; they do not create author rework without a causal defect.

Manual/native evidence: browser-bound production-build interaction covers dialog focus/Escape, alert semantics, cancellation, invite denial/failure, exact recipient routing, navigation, A→B→A ownership, and transport recovery. Packaged Tauri, live relay, VoiceOver, and NVDA were not directly observed.

Residual risk: native announcement timing and signed packaged-runtime ownership remain unobserved. Any head change invalidates this approval.

The base branch was changed.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is d595806fc3b9c9758992e39b9b51cbb5f55791b0...3da45b81ba82b7cb7186ef0d011715b3f39a361a.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review 3da45b81ba82b7cb7186ef0d011715b3f39a361a to authorize a new review.
Any previous review applies only to its recorded range.

[jedwards27]

Verdict: APPROVE
Reviewed: d595806fc3b9c9758992e39b9b51cbb5f55791b0..3da45b81ba82b7cb7186ef0d011715b3f39a361a (exact head 3da45b81ba82b7cb7186ef0d011715b3f39a361a)
Risk: high — user-authored Forum drafts, exact recipient identity, channel membership mutation, async cancellation, and late publication/recovery all cross one send flow.

Behavior/contracts traced: owned nonmember selection → response-policy and actor authorization → forum-wide add → membership refresh → final authorization → exact p-tag publication; Cancel/Escape, navigation, held add/publication, clipboard settlement, optimistic draft clear, transport rejection, attachment/recipient recovery, newer-intent fencing, focus, and accessible error/retry behavior.

Findings: no blocking or non-blocking code defect found. The five patches are patch-equivalent to the previously reviewed stack after restack. The new clipboard-settlement fence captures the authored revision before awaiting paste binding and refuses stale continuation after unmount or revision change (desktop/src/features/forum/ui/ForumComposer.tsx:342-363). Production-seam mutation of that fence fails the new lifecycle regression, so the guard is causally covered.

Both independent lanes cleared this exact head. Systems review confirmed destination/attempt/mount identity fencing, post-add cache refresh, final authorization, and revision-scoped recovery. Product/UI review exercised post and reply Invite, Cancel/Escape, denial/error retry, policy revocation, navigation, duplicate-name identity preservation, loading/inert state, focus restoration, and visible alerts.

Author action: none.
Verification owner: CI/release gate for the two still-running exact-head jobs; release/native QA for optional real Tauri/VoiceOver and live signed-membership observation.

Validation at matching clean HEAD: Desktop package tests 6,435/6,435; pnpm --dir desktop check; pnpm --dir desktop typecheck; pnpm --dir desktop build:e2e; changed Forum Playwright smoke 19/19; git diff --check; causal clipboard-fence mutation; additional same-name/retry adversarial supplement 19/19. Current hosted checks have no failures; all completed Desktop builds/integration/smoke shards, DCO, Semgrep, and zizmor are green. Desktop Core and smoke shard 4 remained in progress at the final freshness fence.

Manual/native evidence: distinct browser-rendered Invite, success, and failure artifacts were inspected at 1280×720. No real packaged Tauri, VoiceOver/NVDA speech, or live relay membership transaction was independently witnessed.

Residual risk: mock IPC does not prove OS assistive speech or a signed live membership transaction. Renderer crash/reload during an in-flight transport remains explicitly outside this PR's durable-recovery contract (docs/forum-agent-invitation.md:49-52). These are confidence gaps, not author-actionable defects. Any new head invalidates this approval.

— :bot: Jude’s code review agent

[jedwards27]

:bot: Jude’s code review agent — APPROVE at exact head 3da45b81ba82b7cb7186ef0d011715b3f39a361a against base d595806fc3b9c9758992e39b9b51cbb5f55791b0.

No concrete defect remains.

Integrated review

• The changed-head delta adds a clipboard-settlement fence: it captures the composer revision before awaiting paste binding and refuses to continue after unmount or an authored revision change (ForumComposer.tsx:342-363). A causal mutation deleting that fence made clipboard settlement after edit cannot prepare another forum draft fail (2 !== 0); restored exact head passed.
• Invitation candidates are resolved selected Forum agents, excluding managed agents and current members, and are revalidated before membership addition and publication (useForumMentionPreparation.ts:67-169). Membership addition uses the captured channel and awaits member-cache invalidation; final relay-agent validation receives that same destination (channels/hooks.ts:826-864, agentMentionRevalidation.ts:113-145).
• Attempt, channel, mount, and revision identity fence Cancel/Escape, navigation, late membership/publication completion, newer attempts, and clipboard settlement (useForumMentionPreparation.ts:28-57,121-168, ForumComposer.tsx:342-363).
• Failed transport recovery snapshots exact text, media, and mention references before optimistic clear, then restores only when keyed/revision ownership is still valid; it does not overwrite newer intent or call a departed editor (ForumComposer.tsx:374-409, useForumDraftRecovery.ts:25-94). Draft authority is relay+identity scoped and reset invalidates retained handles (useDrafts.ts:127-205).
• The changed Forum E2E journey passed 19/19 twice after a fresh E2E build. It covers post/reply Invite, Cancel, Escape during held membership addition, visible add failures and retry, policy revocation, navigation during held add/publication, A→B→A draft/media/exact-recipient custody, transport failure recovery, and exact publication recipients (desktop/tests/e2e/forum-agent-invitation.spec.ts:109-640).
• An adversarial supplement added a duplicate-display-name owned agent and retried denied/error states in the same dialog without reselection. All retries published only the selected pubkey. It also verified disabled in-flight Invite, enabled Cancel, inert source form, Escape close, and editor focus restoration.
• Artifact inspection covered distinct Invite, success, and three failure states. Copy truthfully explains invitation versus draft-preserving Cancel; safe initial focus, role="alert", enabled retry, and preserved intended mention were present (NonMemberMentionDialog.tsx:39-112, ForumComposer.tsx:532-545,608-781).

Exact-head verification

• pnpm test: 6,435/6,435 pass on the full Desktop package rerun. (An initial run had one failure in unchanged useKnownAgentPubkeys.test.mjs; the required full rerun passed.)
• pnpm typecheck: pass.
• just desktop-check: pass; only existing non-fatal warnings outside the PR files.
• CI=1 pnpm test:e2e -- forum-agent-invitation.spec.ts: 19/19 pass.
• Differential file-size gate and git diff --check base...HEAD: pass.
• Hosted required workflow 33898423361: success at exact head, including Desktop Core, all four smoke shards, Windows build, macOS build, and relay/integration gates selected for this diff.
• GitHub/API/fetched/local head matched; PR is mergeable; no unresolved review threads were found during preflight.

Residual confidence gaps

• Deterministic browser/mock-IPC validation establishes rendered semantics, focus, keyboard behavior, and exact payloads, but not OS VoiceOver speech or a real signed relay membership transaction. Native ownership/membership enforcement is explicitly outside this frontend PR (docs/forum-agent-invitation.md:20-24). Author action: none. Verification owner: release/native QA with a seeded owned nonmember relay agent.
• Renderer crash/reload during in-flight transport remains outside this PR’s durable-recovery contract and is documented as such (docs/forum-agent-invitation.md:49-52).

Any head or base movement invalidates this approval pending delta review.