Mailbox: archiveMessage / deleteMessage + retracted-marker semantics

Context

Parent #10139 phase 2. Lifecycle beyond read — archive (processed, out of default view) + retract (sender-side only, preserving thread context). Separate from markRead: read ≠ done.

The Problem

Conflating read with archive forces agents to hoard (never mark read) or destroy (lose audit trail). Conflating delete with "vanish everywhere" breaks reply-chains where retracted messages leave unexplained holes in threaded context.

The Architectural Reality

• Message nodes (prior sub) have readAt, archivedAt, retracted properties.
• Graph edges (IN_REPLY_TO, PART_OF_THREAD) continue to reference retracted messages with a marker — node persists, body/subject replaced by placeholder.

The Fix

• archiveMessage(id) — receiver-side, sets archivedAt. Default listMessages excludes archived; {includeArchived: true} surfaces.
• deleteMessage(id) — sender-side retraction. Marks retracted: true, clears bodyText/subject to [retracted by sender], preserves node + edges so thread context survives.
• Optional purgeMessage (hard delete for sender + receivers) — deferred, not v1.

Acceptance Criteria

• archiveMessage tool; only recipient can archive (enforced via SENT_TO → caller check)
• deleteMessage tool; only sender can retract (enforced via SENT_BY → caller check)
• Retracted messages appear in receiver views as [retracted by sender]; threading preserved
• Archived default-excluded from listMessages; opt-in flag surfaces
• Tests: archive-by-non-recipient rejected; delete-by-non-sender rejected; retracted still reachable via thread traversal

Out of Scope

• Time-limited retraction window (retractions are permanent decisions)
• Permanent hard-delete (purgeMessage) — deferred

Avoided Traps

• Hard-delete retracted messages from receiver inbox. Rejected. Thread context rot: reply-chains become incoherent if a mid-thread message vanishes silently.

Related

• Parent: #10139
• Depends on: Message schema sub
• Sibling: Healthcheck sub (excludes archived from preview)
• Files: ai/mcp/server/memory-core/, mailbox tool handlers

Origin Session ID: 71dc3cd8-d39d-48e1-ac62-e240ca67d1a5