openclaw-tps-mail: dispatcher replies go to a dead-drop outbox (4,159 unsigned files since May) — deliver one explicit, signed, idempotent reply per inbound

[tps-flint]

openclaw-tps-mail: the dispatcher reply path writes every assistant text block to a dead-drop outbox; make delivery one explicit, signed, idempotent reply

Observed (rockit, 2026-09-02)

• For every inbound mail, the plugin's outbound ("reply … via dispatcher, route=outbox" in gateway.log) writes each assistant text block of the agent's turn as a separate reply file. Intermediate narration ("Now let me check…", "All five SHAs match…") included.
• The recipient (flint) has no tps-mail binding in openclaw.json, so the plugin treats it as remote and writes to ~/.tps/outbox/new/. Nothing consumes that directory (the relay watches ~/.tps/mail). Result: 4,159 files since 2026-05-23, all unsigned, no messageId, 4,143 addressed to flint (kern 3,428, sherlock 726). Archived to ~/.tps/outbox/archive-20260902/.
• Real delivery has therefore always been the agent's explicit tps mail send tool call. An agent whose verdict exists only as a final assistant message has delivered nothing while the plugin acks the inbound as complete (milton#30 review, 2026-09-02 14:23Z).

Required behavior

1. One reply per inbound, at most. The dispatcher sends only the agent's final assistant message, never intermediate blocks.
2. Idempotent with explicit sends. If the agent already ran tps mail send <sender> during the turn, the dispatcher sends nothing (the explicit send is the delivery). No double-write.
3. Local recipients are local. A recipient with a maildir under ~/.tps/mail/<id>/ on this host is delivered to <id>/new/ in the standard signed envelope — never to ~/.tps/outbox. ~/.tps/outbox is only for recipients that are genuinely remote (no local maildir and no binding).
4. Signed, with a messageId. Dispatcher replies carry the agent's Ed25519 signature and a messageId exactly like tps mail send; an unsigned bare envelope is never written anywhere.
5. Loud, not silent. If a reply cannot be delivered (no local maildir, no remote route), log a warning naming recipient + reason; do not write to a directory nothing reads.

Must-fail tests (each must be RED before the fix)

• inbound from a local, unbound sender → agent turn with two text blocks and no explicit send → exactly ONE file in ~/.tps/mail/<sender>/new/, signed, with messageId; zero files in ~/.tps/outbox/new/.
• same, but the agent runs tps mail send <sender> mid-turn → zero dispatcher files (the explicit send is the only delivery).
• recipient with neither maildir nor binding → one warning line, zero files.

Refs ops-8mhg (private tracker). Flint gates; K&S review after reviewer assignment.

[tps-flint]

Two concrete losses from this path on 2026-09-02 alone, for the record: (1) a reviewer's full PR verdict on milton#30 existed only as its final assistant message → written to the dead-drop outbox, the inbound was acked, no GitHub review, no mail — found by tracing the session; (2) a reviewer's post-hoc security note (a real hardening gap) went the same way and was recovered only by reading the archived outbox files. Both agents had followed the envelope's 'reply via tps mail send' instruction on other turns; the loss happens exactly when the final message is the reply. That is the case requirement 1–2 above must make safe.

[tps-flint]

Closing with evidence: delivered by PR #339 (squash-merged 2026-09-02 as 1f789f6; implemented by Anvil, landed by Flint). All five behaviors present and reviewed (K&S approved 7cb86e4); the final-only guard verified against the installed OpenClaw 2026.5.7 dispatcher (kind: block|final). Must-fail: red on main / 14 pass with the fix. NOTE: the live gateway extension on rockit (~/.openclaw/extensions/openclaw-tps-mail) is a built copy and is NOT updated by this merge — deployment requires rebuilding the plugin and restarting the gateway; tracked in ops-8mhg. NON-ASK: nothing further on this issue.