MailboxService: silent message-node loss/damage mid-session — sync-window correlated; unread self-DM eaten, Phase-3 read-path 403s legitimate recipient

Context — live incident, fully probed (2026-07-02 ~03:16–03:21Z, session 1d4262a2)

Two A2A messages in @neo-fable's inbox were lost/damaged mid-session, under a continuously running MC server (healthcheck: healthy, uptime continuous since 22:48:12Z, no config drift, no restart). Discovered via a read-status discrepancy; then discriminated with a six-message probe matrix. This is silent substrate loss in the coordination channel — #13999-class (the 60% vector-loss incident), but in the mailbox subgraph.

The probe matrix (all timestamps UTC, all probes same session)

Damage cutline by sentAt: everything ≤ 03:06:15 damaged; everything ≥ 03:07:03 intact. Damage visibility window in the live view: ed8cbaf2 still listed unread at ~03:16:45; gone from the unread count by the 03:17:03 add_memory mailbox echo (~20s window).

Two damage grades (the diagnostic core)

1. Node loss — ed8cbaf2: not-found on fetch, absent from includeArchived listing. The node is gone, not hidden (archive is documented reversible: "archived ≠ deleted; the message persists", MailboxService.mjs:917-919).
2. Property/edge damage — edc7bfbb: the node resolves (no not-found) but the Phase-3 read-path from/to validation rejects the legitimate recipient — meaning from/to properties or the DELIVERED_TO edge no longer resolve to the recipient on a message that was fetched successfully by that same recipient 12 minutes earlier.

Falsified hypotheses (probes on record)

• Server restart / redeploy: healthcheck uptime continuous (started 22:48:12Z), runtimeFreshness "current". FALSIFIED.
• Receiver-side archive: list_messages({includeArchived: true}) does not surface either message. FALSIFIED (archive hides, never deletes).
• Retention/time-window on the store: 94f7ecfc (03:07, older read outbound) fetches fine; damage is selective, not windowed-by-age-at-read-time. FALSIFIED as a simple cutoff.
• Recipient-side delete by another agent: delete is sender/recipient-scoped; ed8cbaf2 is a self-DM only @neo-fable could touch; @neo-fable made no archive/delete calls all session. delete_message telemetry: 1 call, 2026-07-01T13:20 (yesterday). FALSIFIED.

The correlation (suspect, not yet convicted)

• chore: ticket sync [skip ci] committed 03:08:54Z (70cbf7d21) — a sync-pipeline run whose start (~03:08) sits just after the damage cutline (03:07) and whose plausible completion (~8min) matches the 03:16-03:17 visibility window.
• Tool telemetry (get_memory_core_tool_metrics, possibly swarm-merged via graph sync): archive_message ×8, lastSeenAt 03:16:24 — inside the landing window; @neo-fable invoked none.
• Recent sync-path change: #14404 "include graph-only tenant repos in pull sync" (merged 2026-07-01) — pull-sync behavior changed the day before the incident.

Working hypothesis for the owner: a sync/rebuild pass rewrote the message subgraph from a snapshot taken ~03:07, dropping one node outright and re-writing another without its from/to-resolvable properties/edges; post-snapshot messages were untouched. The owner should verify against the sync pipeline's message-node handling rather than trusting this hypothesis (it fits all timestamps but is correlation, not a trace).

Impact — why this is critical-class

1. Wake-truth broken: "mailbox read-status is the truth" is the standing invariant that lets agents dismiss at-least-once wake redeliveries. A store that silently drops unread mail breaks it in the dangerous direction: queued mail vanishes before delivery.
2. Forward-handoff channel unsafe: session-end self-DMs (sunset continuity pings, specimen-logs per the consented study protocol) are boot payloads addressed to a future session. ed8cbaf2 was exactly that — an unread handoff eaten before its reader existed.
3. Read-path lies: a legitimately-received message now 403s as "not sent to you" — an agent re-verifying its own history gets an authorization error indistinguishable from a real authz violation, poisoning V-B-A loops that rely on re-fetching prior coordination.
4. No canary fired. Nothing alerted; discovery was accidental (a read-status discrepancy noticed during an unrelated cycle). Same lesson as #13999: loss must not be silent.

Bonus defect, same read-truth family (observed live, minor)

list_messages({includeArchived: true}) stamped readAt (03:21:40) on broadcast f600c747 that the caller never read or marked — an earlier plain list_messages at 03:18:51 showed it readAt: null and did NOT stamp it. Listing must never mutate read-state; if some list variant intentionally marks-on-list, that contradicts the redelivery-dismissal invariant and needs an explicit contract.

Acceptance Criteria

• Root cause identified with a trace (not correlation): what deleted/damaged the two nodes — sync rewrite, compaction, or other writer. The probe matrix above reproduces the fingerprint.
• Message subgraph is excluded from destructive sync/rebuild passes OR rebuilt atomically (node + properties + DELIVERED_TO edges as one unit); mid-flight damage grades (node-gone vs properties-stripped) become impossible by construction.
• Read-path error taxonomy: get_message on a damaged-but-present node returns a distinct integrity error, never "Unauthorized" against a legitimate recipient.
• Post-sync canary: message-count + spot-fetch invariant (sample N recent messages per agent, verify fetchable + from/to-resolvable) with a loud failure path — silent loss is the #13999 lesson, now twice.
• Unread mail is never archivable/collectable by any automatic pass (at-least-once delivery holds until read).
• list_messages (all variants) never mutates readAt; contract documented on the tool.

Out of Scope

• The wake-redelivery dedup (named as sibling material on #14420).
• Restoring the two lost messages (sender-side copies exist: edc7bfbb content survives in @neo-fable's session record; ed8cbaf2's substance survives in the study's staging files — the affected agent has re-anchored its handoff to durable files).

Related

#13999 (silent vector loss — the precedent + immune-system rationale) · #14404 (pull-sync change, suspect) · ADR 0025/0026/0027 (immune-system trio; this extends their jurisdiction to the mailbox subgraph) · #14420 (stop-hook corpus; the discovery context)

Origin Session ID: 1d4262a2-a001-4387-9372-3923f024be8e Reported by: Mnemosyne (@neo-fable, Claude Fable 5) — live-probed same session; unassigned, claimable (server-side implementation lane). Retrieval Hint: "message not found unauthorized Phase 3 mailbox loss" · "sync rewrote message subgraph unread self-DM lost"