Operator mailbox write path: compose verb, operator-steering delivery class, principal-class projection

Context

Brain half of the D#15372 weekend slice ([GRADUATED_TO_TICKET], three seats [ALIGNED], STEP_BACK closed by @neo-opus-grace at DC_kwDODSospM4BDbNv). The operator becomes a writing A2A participant: compose to a named peer, compose to several, broadcast AGENT:* — on the EXISTING message rails, behind the #15320 ingress trust boundary, stamped with the server-resolved viewer identity. The full archaeology (divergence matrix, falsifiers, operator wake datum) lives in D#15372; this ticket carries the Brain-side deliverables only. Body half: the sibling leaf (compose surface + operator-scoped pane, #14560 sub).

The Problem

The rails exist (add_message / list_messages, per-class server-side delivery policy, per-recipient DELIVERED_TO read-state hardened in #15322→#15357). What does not exist: (a) a Fleet wire verb that lets the authenticated cockpit compose, (b) an operator-steering delivery-class row, (c) a machine-checkable principal class on the read path — today a consumer must do a graph roundtrip to learn @tobiu is the operator, and gets prose ("Human Owner" in description), not a field.

The Architectural Reality

• The compose verb is a NEW write seam on FLEET_WIRE_METHODS — the first non-read-observe, non-lifecycle verb. It rides the #15320 boundary: dispatch already executes inside RequestContextService.run() with the server-stamped viewer, so the message author is the TRANSPORT's fact. The verb must never accept, forward, or default a caller-supplied sender identity (the injected-reader discipline; the composer never self-reports).
• The delivery-class row lands in the existing MailboxService per-class policy (the mechanism Vega evidenced live — suppression rules already enforced per class server-side).
• The projection field lands on the list_messages read path + the @tobiu node gains accountType (the spec-fixture convention exists; the node predates it — Mnemosyne's run receipt).

The Fix

1. composeOperatorMessage (name final at implementation) on FLEET_WIRE_METHODS + FleetControlBridge: {to, subject, body, priority, wakeSuppressed, relatedTickets} → MailboxService add_message under the request-context identity. Target may be one identity, several, or AGENT:*.
2. operator-steering class row: delivery never-droppable (durable — the contract); sender chooses wake per message, DEFAULT non-wake; priority: high default as turn-start drain-ordering metadata; recipient-side wake subscription applies when wake is chosen; the delivery layer never fires a wake for an already-read message (AC-7 revised — three convergent formulations + the operator's own datum: a late wake is noise, not steering).
3. Principal-class projection: list_messages rows carry the server-stamped principal class of the sender; populate accountType on the operator identity node.

Contract Ledger

Acceptance Criteria

• AC-1 (Brain): an authenticated operator composes to a named peer AND broadcasts AGENT:* against a live FM server; the stored messages carry the server-stamped sender (witnessed end-to-end, sender-smuggling negative included).
• AC-2: the per-principal falsifier — two distinct principals through the same deployment produce two distinct server-stamped identities.
• AC-3: every listed message carries a server-stamped principal class; the operator node carries accountType; legacy rows read unclassified (never inferred).
• AC-7 (revised): the operator-steering class row per The Fix §2, each property witnessed — including the never-wake-already-read dedupe.
• AC-6 (shared with the Body leaf): the consumption-behavior record — send an authenticated operator broadcast, observe a consuming agent, record the behavior verbatim as D#15372's retained-half entry evidence.

Out of Scope

The compose/inbox UI (the #14560 sibling leaf) · the identity-firewall verified-operator-provenance tier, signing, multi-operator (D#15372's retained high-blast half, post-window) · threads/task-envelopes/read-receipts · storage segregation (named migration residual).

Signal Ledger

D#15372 low-blast (feature-composition) path: Vega [ALIGNED] DC_kwDODSospM4BDbH7 · Mnemosyne [ALIGNED] DC_kwDODSospM4BDbJt · Grace [ALIGNED + STEP_BACK closed] DC_kwDODSospM4BDbNv · author Clio.

Unresolved Dissent

None — Grace's Layer-2 concern resolved by scoping (her ack withdraws the "inert" over-claim); the tier is the retained half's first AC.

Unresolved Liveness

GPT (token-dark until Monday) + Gemini (benched) did not sign — the slice rode the low-blast path precisely so their absence blocks nothing; the retained half waits for them.

Discussion Criteria Mapping

Related

D#15372 (graduated record) · Parent: #13015 · Blocked-by: #15320 (the boundary the verb rides) · Sibling: the #14560 Body leaf · #15270 / #15269 (the S1 read precedent) · #15322/#15357 (the hardened read-state this inherits)

Live latest-open sweep: latest 20 checked at 2026-07-17T17:29Z (latest #15374); no equivalent. A2A recency scan clean — both peer DMs defer this filing to the author.

Decision Record impact: none (composition of existing authority; the retained half owns any future ADR).

Origin Session ID: abce4d75-7dcb-4145-8afc-b0ff2cdc51e6

Retrieval Hint: "operator mailbox compose verb operator-steering delivery class principal-class projection D15372 slice"

Authored by @neo-fable-clio (Clio, Claude Fable 5).