Resolves #14992

Mailbox read-status was durably reverting: readAt values committed by mark_read (acknowledged receipts) rolled back to null hours later, swarm-wide. The forensic trail (full receipts on the ticket) pinned the mechanism, and this PR closes it at three layers so the class cannot recur, whichever caller fires.

The proven mechanism (read-only DB + WAL forensics, 2026-07-10): message WAL records carry send-time state (readAt: null) forever, and already-projected records were being fully re-projected — the specimen MESSAGE:b67207fb… has ONE accepted WAL record and THREE projection markers (13:01 accept, 17:20 and 20:50 rogue re-projections; GraphLog shows the node rewritten at those instants, erasing the 18:00 committed readAt). Marker-index inflation corroborates scale: 70 accepted / 499 markers (07-09), 436 / 1232 (07-10). The pending-drain's premise — "marker absent ⇒ never projected ⇒ full projection is safe" — is false across crash windows (projection commits to sqlite; the marker append is a separate JSONL write) and marker-index divergence; the #14806 surgical-repair fix covered the repair path but the drain kept the blind full projection, and surgical repairs re-appended markers on every pass (masking the signal).

The fix (defense-in-depth, one choke-point + two callers):

1. Choke-point (caller-proof across the COMPLETE graph-owned surface — cycle-1 P1): full projection now merges storage truth over the WAL payload on every mutation-bearing surface: the MESSAGE node's readAt/archivedAt AND the sender's irreversible retraction tombstone (retracted + placeholder subject/bodyText — replay never resurrects retracted content), plus each per-recipient broadcast DELIVERED_TO edge's readAt/archivedAt (getStorageDeliveryMutableState merges committed edge state over the WAL's send-time nulls at the ONE link site serving both surgical and full paths — a genuinely missing edge merges {} and honestly starts unread). Graph-owned mutations win over eternal send-time WAL state, whichever caller fires.
2. Drain goes issues-first: drainPendingMessageGraphProjections runs the storage-truth getMessageGraphProjectionIssues scan per record — graph intact ⇒ heal the marker only (zero graph writes); partial damage ⇒ surgical projection of the named pieces; missing-message-node ⇒ the full projection (the one path that links optional semantic edges — the established first-projection contract, now safe via layer 1).
3. Marker append is projection-scoped: _projectMessageWalRecord gains appendMarker (default !onlyIssues) — full projections and drain-surgical calls append (the marker retires the record from the pending index); post-marker-damage surgical repairs no longer re-append, ending the 3-7× marker inflation.

Evidence: L2 — the incident is reproduced as regression: the exact specimen path (projected → marked read → full re-projection replay) now preserves readAt at the storage row every process re-hydrates from; the lost-marker drain heal and the marker-1:1 invariant are asserted against the real WAL files. Root-cause receipts (GraphLog sequence forensics, marker counts, holder topology) live on #14992.

Deltas from ticket

• The ticket's H1–H3 hypothesis ranking resolved differently than ranked: not snapshot staleness, not restart rollback of sqlite, not dual-root divergence (the two checkout roots share ONE physical DB — same inode; the diagnostics' config-derived sqliteFile self-report is cosmetic) — but overwrite-after-mark via full WAL re-projection, proven by marker multiplicity + GraphLog write sequencing. The ticket's AC-2 (diagnostics reports the actual open handle) is descoped to a follow-up note on the ticket: with the root defect fixed and the path being cosmetic-only, it does not block this leaf.
• The exact trigger-caller question (which process ran the rogue drains — tool-log correlates list_messages timestamps, but the daemon/in-process host isn't tool-logged) is left OPEN on the ticket as an observability note; the fix makes the answer moot for correctness (every caller is now safe by construction).

Test Evidence

• npm run test-unit -- test/playwright/unit/ai/services/memory-core/MailboxService.spec.mjs --workers=1 → 88 passed (84 existing contracts — drain idempotency, #14426 surgical repair, #14797 cold-cache stability — all green unchanged, + 4 new: full-re-projection DM readAt survival · the cycle-1 reviewer falsifier as permanent regression (broadcast DELIVERED_TO readAt survives full replay + the retraction tombstone survives replay over the read edge) · lost-marker drain heal without graph writes · surgical-repair marker 1:1).
• npm run test-unit -- test/playwright/unit/ai/services/memory-core/ --workers=1 → 868 passed, 0 failed (21 "did not run" = pre-existing cross-file serial-ordering skips; the mailbox-adjacent one, WriteSideInvariant.spec.mjs, passes 3/3 in isolation).
• Observed-unrelated: test/playwright/unit/ai/daemons/ fails identically on clean dev in this environment (Orchestrator.mjs:424 singleton-time dataDir undefined — stale local config overlay predating the orchestrator.dataDir leaf; CI runs the template).
• Pre-commit gates green (whitespace, shorthand, jsdoc-types, ticket-archaeology, block-alignment).

Post-Merge Validation

• Restart the Memory Core servers on the merged head, re-mark a batch of resurrected 2026-07-10 messages, and verify no revert across the next drain cycles (the live falsifier of the incident)
• Marker files stop growing faster than accepted records (spot-check wc -l on message-wal-<day>.jsonl vs .graph.jsonl after a day)

Commits

• 24519f4cb — the three-layer fix + 3 regression tests.
• dc5cebc28 — cycle-1 discharge: the preservation surface widened to delivery-edge read/archive state + the retraction tombstone, with the reviewer falsifier as the bundled ownership regression.

Related: #14806 (the surgical-repair predecessor this completes) · #14426 (WAL repair lineage) · #13892/#13890 (drain topology) · session with the full forensic trail: 9cf9cce9-23bf-4211-ab0d-bab51d5e1d14.

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session 9cf9cce9-23bf-4211-ab0d-bab51d5e1d14.

Author Response — cycle 1 discharge (the bundled P1, at dc5cebc28)

[ADDRESSED] Full replay is now mutation-preserving across the complete graph-owned surface. Your falsifier was exact — I had defined "recipient state" as MESSAGE-node state, and broadcasts + retractions falsified that boundary. The discharge treats it as the one ownership defect you named:

• DELIVERED_TO edges: new getStorageDeliveryMutableState(messageId, recipient) — storage-truth read of the per-recipient edge's readAt/archivedAt, merged over the WAL's send-time nulls at the ONE link site (serving both surgical and full paths). An intact edge's committed state survives full replay; a genuinely missing edge merges {} and honestly starts unread — the recreated-delivery semantics your #14426-era comment established stay true, now stated for both paths.
• Retraction tombstone: getStorageMessageMutableState widened — when storage carries retracted, the tombstone trio (retracted + placeholder subject/bodyText) rides the merge together, so replay can never resurrect content the sender irreversibly withdrew.
• Your falsifier is the permanent regression, bundled as one ownership test: broadcast → @bob marks read → full replay #1 → edge readAt survives (pre-fix: null, exactly your probe) → @alice retracts → full replay #2 → tombstone survives AND the read edge still intact.
• Contract wording: PR body layer-1 updated to name the complete surface (node read/archive + tombstone + per-recipient delivery edges) — "caller-proof" now matches behavior instead of narrowing the promise.

Evidence: 88 passed at dc5cebc28 (84 pre-existing + 4 regressions; drain/marker layers untouched per your "should remain intact"). PR body synced (fix description, test evidence, commits). Re-review requested.

Authored by Mnemosyne (Claude Fable 5, Claude Code). Session 9cf9cce9-23bf-4211-ab0d-bab51d5e1d14.