apple-tools-mcp 2.0.6 → 2.0.8

package/README.md

@@ -446,6 +446,7 @@ Two arguments are available on **every** write tool:
 - **Deletes always need `confirm: true`** — `mail_trash`, `calendar_remove`, `contacts_remove`, and `contacts_edit` when it clears every email or phone. Without it the call returns a `CONFIRMATION REQUIRED` preview and changes nothing. There is no bulk delete tool and no silent mass delete: one id per call.
 - **Multi-recipient sends always need `confirm: true`** — `mail_send` / `mail_forward` when `to` + `cc` + `bcc` total more than one address, `mail_reply` with `reply_all: true`, and `messages_send` to multiple handles or to a group chat. A single-recipient send runs on the first call.
 - **`mail_draft` is exempt from the recipient rule** because a draft is never delivered.
+- **`dry_run` and confirm-blocked calls are not deliveries.** Planned writes return `ok: false`, `planned: true`, `delivered: false`, and MCP sets `isError: true`, so a client that only checks `isError` cannot treat a preview as sent. The text is `DRY RUN` / `CONFIRMATION REQUIRED` and never `verified in Sent`. Re-run with `dry_run=false` (and `confirm=true` when required) to actually send.
 - Responses name what happened (tool, ids, recipients, titles) and never echo message bodies — including on the error path.
 - Writes never invent data. A missing or malformed `message_id`, `event_id`, `contact_id`, `chat_id`, or recipient is refused with a message saying so. Calendar times must be explicit local datetimes (`YYYY-MM-DD HH:MM`); natural language such as "next Tuesday" is rejected for writes.
 
@@ -465,13 +466,17 @@ Two arguments are available on **every** write tool:
 
 **Compose is not quoted.** `mail_send` / `mail_draft` (plain and html) call `make new outgoing message` **without** AppleScript `content:` so `newMessage` is a real Mail object, then paste the body into the compose window (System Events). Mail's `mailto` command was shipped in 2.0.4 and **fails on Mini/MacBook Mail**: it does not return an outgoing message (`newMessage` undefined, AppleScript **-2753**). On current Mail (Ventura+, FB11734014) `content` / `html content` store the body as a citation: every plain-text line prefixed with `>`, plus a `multipart/alternative` HTML part wrapped in `<blockquote type="cite">`. Desktop Mail often hides the bar with inline styles; iOS Mail paints the whole body purple with a left quote bar — even when the subject is not `Re:`/`Fwd:` and there is no `In-Reply-To`. Reply and forward still quote the original, which is expected.
 
-Paste uses System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) in addition to Automation → Mail. That Accessibility deny is not a Mail Automation deny (`-1743` / `-10004`). Body focus uses `text area` / `scroll area` and `UI element whose role is "AXWebArea"` — never the System Events class `web area`, which does not compile on macOS 26.x (**-2741**, “Expected class name but found identifier”).
+Paste uses System Events, so **node needs Accessibility** (Privacy & Security → Accessibility) in addition to Automation → Mail. That Accessibility deny is not a Mail Automation deny (`-1743` / `-10004`). Body focus uses `text area` / `scroll area` / `text field` and `UI element whose role is "AXWebArea"` — never the System Events class `web area`, which does not compile on macOS 26.x (**-2741**, “Expected class name but found identifier”).
 
-**Manual prove (2.0.6 on the Mac host):** `mail_send` a short plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. Inspect each Sent `.emlx`: the text/plain part must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`, no **-2741** on body focus).
+**Compose body focus (2.0.8).** After `make new outgoing message`, To and Subject are AppleScript properties (never paste). Cmd-V runs only after the caret leaves the header: a tall `AXWebArea` (HTML compose body), a tall `text area` (plain compose; short To/Subject fields are skipped), Subject then Tab, or a click in the lower two-thirds of the compose window. If focus is still a header field, the tool raises `BODY_FOCUS_FAILED` and does **not** paste. After paste it checks To/Cc/Bcc counts, the exact subject, and that the native body contains the intended text. A mismatch is `BODY_PASTE_MISDIRECTED`: the outgoing message is deleted and nothing is sent. Quote-prefix Sent prove and Sent/Outbox verify stay gated on this paste-focus contract — a MacBook 2.0.7 live `mail_send` with Accessibility allowed still hit `BODY_PASTE_MISDIRECTED` when Cmd-V landed in To/Subject (`ATP-207-SENT-PROVE-20260921-084048`).
+
+**mail_send success is Sent/Outbox verify (2.0.7).** AppleScript `send` returning without throw is not enough. After a real send the tool looks in **Sent** and **Outbox** and reports success only if the message is there. The success text names the delivery state (`mailbox: sent` + `delivery: sent`, or `mailbox: outbox` + `delivery: outbox` while still sending). If verify misses, the tool returns a failure (`isError`) — not success. Hang/timeout recover matches **To + subject** (and Message-ID when compose captured one). It never matches subject alone (short subjects like `test` are unsafe). `from` / account selection is out of scope; Mail's default From is used.
+
+**Manual prove (2.0.8 on the Mac host):** `mail_send` a short plain message and a short `body_format: "html"` message whose body looks like ordinary paragraphs (for example `<p>Quick note</p>`), neither with a `Re:`/`Fwd:` subject. The caret must land in the **body** (not To/Subject): no `BODY_FOCUS_FAILED` / `BODY_PASTE_MISDIRECTED`, and the intended text must be in the native body before send. Inspect each Sent `.emlx`: the text/plain part must not prefix every body line with `>`, and any HTML alternative must not wrap the whole body in `<blockquote type="cite">`. Compose must succeed (no `-2753` / undefined `newMessage`, no **-2741** on body focus). That quote-prefix dual-host Sent prove is a separate bar from the 2.0.7 verify contract.
 
 Emails are addressed by their RFC822 **Message-ID**. Pass `message_id`, or pass the `file_path` from `mail_search` / `mail_recent` and the server reads the Message-ID out of the `.emlx` headers for you. `mail_archive` moves the message to its account's Archive (or All Mail) mailbox; `mail_trash` moves it to that account's Trash.
 
-**Send timeout vs TCC — check Sent before retrying.** `mail_send` / `mail_reply` / `mail_forward` can hang after Mail has already put the message in Sent. That hang is a **timeout** (`ETIMEDOUT` / `-1712` / AppleEvent timed out), not a TCC deny. The same hang-vs-TCC split applies to **find / reply / open before send** — an Allowed `ETIMEDOUT` there is never `MAIL_TCC_GUIDANCE`. Real Mail Automation denials report **`-1743`**, **`-10004`**, or “not authorized to send Apple events”. After a send hang the tool looks in Sent (and Outbox) and returns **success** if the message is there — never label a delivered send as TCC fail or timeout. Replies match `In-Reply-To` or an exact recent `Re:` + original subject (the fallback compose does not set reply headers). Forwards match the intended recipient plus an exact `Fwd:` subject or the original Message-ID in a forwarded body — not `In-Reply-To`, and not an unrelated `Fwd:` that only shares a To. Neither scan treats the original itself as this send. If Sent-verify misses, the error tells you it was a hang and to check Sent. **Clients must Sent-check before retrying a timed-out send**; retrying a message that already landed sends a second copy. This is not a silent TCC grant.
+**Send timeout vs TCC — check Sent before retrying.** `mail_send` / `mail_reply` / `mail_forward` can hang after Mail has already put the message in Sent. That hang is a **timeout** (`ETIMEDOUT` / `-1712` / AppleEvent timed out), not a TCC deny. The same hang-vs-TCC split applies to **find / reply / open before send** — an Allowed `ETIMEDOUT` there is never `MAIL_TCC_GUIDANCE`. Real Mail Automation denials report **`-1743`**, **`-10004`**, or “not authorized to send Apple events”. After a send hang the tool looks in Sent (and Outbox) and returns **success** if the message is there — never label a delivered send as TCC fail or timeout. Replies match `In-Reply-To` or an exact recent `Re:` + original subject (the fallback compose does not set reply headers). Forwards match the intended recipient plus an exact `Fwd:` subject or the original Message-ID in a forwarded body — not `In-Reply-To`, and not an unrelated `Fwd:` that only shares a To. Compose (`mail_send`) matches the intended **To plus exact subject** (and Message-ID when available), never subject alone. Neither scan treats the original itself as this send. A real send that returns without throw is also verified the same way before success. If Sent-verify misses, the error tells you it was a hang (or a verify-miss after send returned) and to check Sent. **Clients must Sent-check before retrying a timed-out send**; retrying a message that already landed sends a second copy. This is not a silent TCC grant.
 
 ### Messages write tool
 

package/index.js

@@ -27,7 +27,8 @@ import {
   WRITE_TOOL_DEFINITIONS,
   isWriteTool,
   dispatchWriteTool,
-  executeWriteToolLocally
+  executeWriteToolLocally,
+  mcpWriteResult
 } from "./lib/writeTools.js";
 import { startWriteBridgeServer, defaultSocketPath } from "./lib/writeBridge.js";
 import { closeEventKitSession, ensureEventKitSession } from "./lib/eventKitSession.js";
@@ -1373,10 +1374,7 @@ server.setRequestHandler(CallToolRequestSchema, async (request) => {
         socketPath: WRITE_SOCKET_PATH,
         log: (msg) => console.error(msg)
       });
-      return {
-        content: [{ type: "text", text: writeResult.message }],
-        ...(writeResult.ok === false ? { isError: true } : {})
-      };
+      return mcpWriteResult(writeResult);
     }
 
     switch (name) {

package/lib/appleScript.js

@@ -353,7 +353,7 @@ export const MAIL_SEND_TIMEOUT_GUIDANCE =
   "Mail AppleScript timed out (ETIMEDOUT / -1712 / AppleEvent timed out) — this is a find/reply/send hang (including find/reply/open before send), not a TCC / Automation deny. " +
   "Real Mail Automation denials report -1743, -10004, or \"not authorized to send Apple events\". " +
   "A timeout can happen after Mail already delivered the message. Check Sent (and Outbox) for this send before retrying; a retry after a successful delivery sends a second copy. " +
-  "This tool verifies Sent when a send hangs; if nothing is there yet, wait and look again rather than immediately resending.";
+  "This tool verifies Sent/Outbox when a send hangs (To + subject, Message-ID when available — never subject alone); if nothing is there yet, wait and look again rather than immediately resending.";
 
 /**
  * Messages writes are a separate Automation target from Mail / Contacts / Calendar.

package/lib/calendarWrite.js

@@ -22,6 +22,7 @@ import {
 } from "./appleScript.js";
 import {
   planWrite,
+  plannedWriteResult,
   validateEventId,
   validateEventKitId,
   validateCalendarName,
@@ -772,7 +773,7 @@ export function calendarAdd(args = {}) {
     `${alerts.minutes.length ? ` with alerts ${alerts.minutes.join(", ")} min before` : ""}`;
 
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   // Non-recurring creates MUST go through EventKit. Mini 8be6cd5: EventKit
   // add failed (likely writeOnly cannot list calendars) and we silently
@@ -1037,7 +1038,7 @@ export function calendarEdit(args = {}) {
 
   const summary = `update event ${eventId}: ${changed.join(", ")}`;
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const preferEventKit = Boolean(eventKitId) || eventId.includes(":");
   if (preferEventKit && !recurrence.rule) {
@@ -1219,7 +1220,7 @@ export function calendarRemove(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   // writeOnly cannot re-query; prefer the EventKit session that cached
   // the EKEvent from create. One-shot lookup is a full-access fallback.
@@ -1339,7 +1340,7 @@ export function calendarRsvp(args = {}) {
 
   const summary = `RSVP ${responseRaw} to event ${eventId}`;
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildRsvpScript({ eventId, status: RSVP_STATUS[responseRaw], attendeeEmail }),

package/lib/contactsWrite.js

@@ -20,6 +20,7 @@ import {
 import { safeOpenApp } from "./shell.js";
 import {
   planWrite,
+  plannedWriteResult,
   normalizeList,
   isEmailAddress,
   isPhoneNumber,
@@ -254,7 +255,7 @@ export function contactsAdd(args = {}, deps = {}) {
     `${phones.phones.length ? ` and ${phones.phones.length} phone number(s)` : ""}`;
 
   const plan = planWrite({ action, summary, dryRun: isFlagTrue(args.dry_run), confirm: isFlagTrue(args.confirm) });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const properties = {};
   if (firstName.text) properties["first name"] = firstName.text;
@@ -357,7 +358,7 @@ export function contactsEdit(args = {}, deps = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const ready = ensureContactsAppReady(deps);
   if (!ready.ok) return { ok: false, message: failure(action, summary, ready) };
@@ -413,7 +414,7 @@ export function contactsRemove(args = {}, deps = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const ready = ensureContactsAppReady(deps);
   if (!ready.ok) return { ok: false, message: failure(action, summary, ready) };

package/lib/mailWrite.js

@@ -7,10 +7,12 @@
  * is resolved to a Message-ID by reading the .emlx headers, so callers never
  * have to invent an identifier.
  *
- * After a send/reply/forward hang, Sent (and Outbox) is checked before the
- * tool reports failure. A message already in Sent is success — never a TCC
- * fail. ETIMEDOUT / -1712 is a timeout (find/reply/open before send too);
- * -1743 / -10004 is a hard deny.
+ * After a real send (and after a send/reply/forward hang), Sent and Outbox
+ * are checked before the tool reports success. AppleScript `send` returning
+ * without throw is not enough. A message already in Sent or still in Outbox
+ * is success — never a TCC fail. Hang recover matches To + subject (and
+ * Message-ID when available), never subject alone. ETIMEDOUT / -1712 is a
+ * timeout (find/reply/open before send too); -1743 / -10004 is a hard deny.
  */
 
 import fs from "fs";
@@ -29,6 +31,7 @@ import {
 } from "./appleScript.js";
 import {
   planWrite,
+  plannedWriteResult,
   validateEmailList,
   validateBody,
   validateSubject,
@@ -152,6 +155,9 @@ export function probeMailAutomation() {
 
 export const ACCESSIBILITY_DENIED_SENTINEL = "ACCESSIBILITY_DENIED";
 export const BODY_PASTE_MISDIRECTED_SENTINEL = "BODY_PASTE_MISDIRECTED";
+export const BODY_FOCUS_FAILED_SENTINEL = "BODY_FOCUS_FAILED";
+/** Compose body AX height vs To/Subject/Cc fields (those are ~22px). */
+export const MAIL_BODY_MIN_AX_HEIGHT = 50;
 
 /**
  * Body text for native Mail compose (clipboard paste, not AppleScript content).
@@ -169,51 +175,117 @@ export function composeNativeBody(body, { html = false } = {}) {
 }
 
 /**
- * AppleScript handlers: focus the compose body (not To) and paste.
+ * Distinctive first line used to prove the native editor received the body.
+ * Full multiline `contains` can miss when Mail stores an HTML alternative.
+ */
+export function composeBodyNeedle(body) {
+  const text = body === undefined || body === null ? "" : String(body);
+  const line = text.split(/\r?\n/).find((candidate) => candidate.trim()) || text;
+  const needle = line.trim();
+  return needle.length > 120 ? needle.slice(0, 120) : needle;
+}
+
+const BODY_MIN_H = asInteger(MAIL_BODY_MIN_AX_HEIGHT, { min: 1, max: 500, field: "bodyMinHeight" });
+
+/**
+ * AppleScript handlers: focus the compose body (not To/Subject) and paste.
  * System Events needs Accessibility; Mail make/send still needs Automation.
  *
  * macOS 26.x System Events has no `web area` class (compile -2741,
  * "Expected class name but found identifier"). Hosts compile
- * `text area` / `scroll area` and `UI element whose role is "AXWebArea"`.
+ * `text area` / `scroll area` / `text field` and `UI element whose role is
+ * "AXWebArea"`. Never focus the first AXTextArea blindly — on MacBook Mail
+ * that is a header field, and Cmd-V becomes BODY_PASTE_MISDIRECTED.
+ *
+ * Strategies, each fail-closed unless the caret left the header:
+ *   1. Click a tall AXWebArea (HTML compose body)
+ *   2. Focus a tall `text area` (plain compose body), never a short header
+ *   3. Click Subject then Tab into the body (stable Mini/MacBook order)
+ *   4. Click the lower two-thirds of the compose window
  */
 export function buildMailBodyPasteHandler() {
-  return `on atmFocusMailBody()
+  return `on atmSafeToPaste()
   tell application "System Events"
     tell process "Mail"
-      set frontmost to true
-      if (count of windows) < 1 then error "MAIL_COMPOSE_WINDOW_MISSING"
-      set w to first window
-      try
-        set focused of text area 1 of scroll area 1 of w to true
-        return
-      end try
       try
-        set focused of text area 1 of w to true
-        return
+        set fe to focused UI element
+        set r to (role of fe) as string
+        if r is "AXTextField" then return false
+        if r is "AXComboBox" then return false
+        if r is "AXButton" then return false
+        if r is "AXMenuButton" then return false
+        if r is "AXPopUpButton" then return false
+        set eh to 0
+        try
+          set {ew, eh} to size of fe
+        end try
+        if r is "AXTextArea" and eh < ${BODY_MIN_H} then return false
+        ignoring case
+          set bits to ""
+          try
+            set bits to bits & (description of fe as string) & " "
+          end try
+          try
+            set bits to bits & (name of fe as string) & " "
+          end try
+          if bits contains "To:" then return false
+          if bits contains "Cc:" then return false
+          if bits contains "Bcc:" then return false
+          if bits contains "Subject" then return false
+        end ignoring
+        if r is "AXWebArea" then return true
+        if r is "AXTextArea" then return true
+        if eh >= ${BODY_MIN_H} then return true
       end try
+      return false
+    end tell
+  end tell
+end atmSafeToPaste
+
+on atmFocusMailBody(expectedSubject)
+  tell application "System Events"
+    tell process "Mail"
+      set frontmost to true
+      if (count of windows) < 1 then error "MAIL_COMPOSE_WINDOW_MISSING"
+      set w to window 1
+      if expectedSubject is not "" then
+        repeat with i from 1 to (count of windows)
+          try
+            if (name of window i as string) is expectedSubject then
+              set w to window i
+              exit repeat
+            end if
+          end try
+        end repeat
+      end if
       try
-        set focused of (first UI element of w whose role is "AXTextArea") to true
-        return
+        perform action "AXRaise" of w
       end try
       try
         click (first UI element of w whose role is "AXWebArea")
-        return
+        delay 0.08
+        if my atmSafeToPaste() then return
       end try
       try
         click (first UI element of scroll area 1 of w whose role is "AXWebArea")
-        return
+        delay 0.08
+        if my atmSafeToPaste() then return
       end try
       try
         click (first UI element of scroll area 1 of splitter group 1 of w whose role is "AXWebArea")
-        return
+        delay 0.08
+        if my atmSafeToPaste() then return
       end try
       try
         click (first UI element of scroll area 1 of group 1 of splitter group 1 of w whose role is "AXWebArea")
-        return
+        delay 0.08
+        if my atmSafeToPaste() then return
       end try
+      set atmTallText to missing value
+      set atmSubjectElem to missing value
       set atmQueue to UI elements of w
       set atmWalked to 0
-      repeat while (count of atmQueue) > 0 and atmWalked < 80
+      repeat while (count of atmQueue) > 0 and atmWalked < 120
         set atmWalked to atmWalked + 1
         set atmElem to item 1 of atmQueue
         if (count of atmQueue) is 1 then
@@ -223,14 +295,33 @@ export function buildMailBodyPasteHandler() {
         end if
         try
           if (role of atmElem as string) is "AXWebArea" then
-            click atmElem
-            return
+            set {ew, eh} to size of atmElem
+            if eh >= ${BODY_MIN_H} then
+              click atmElem
+              delay 0.08
+              if my atmSafeToPaste() then return
+            end if
           end if
         end try
         try
           if (role of atmElem as string) is "AXTextArea" then
-            set focused of atmElem to true
-            return
+            set {tw, th} to size of atmElem
+            if th >= ${BODY_MIN_H} and atmTallText is missing value then set atmTallText to atmElem
+          end if
+        end try
+        try
+          set r to (role of atmElem as string)
+          if r is "AXTextField" or r is "AXTextArea" then
+            set bits to ""
+            try
+              set bits to bits & (description of atmElem as string)
+            end try
+            try
+              set bits to bits & (name of atmElem as string)
+            end try
+            ignoring case
+              if bits contains "Subject" and atmSubjectElem is missing value then set atmSubjectElem to atmElem
+            end ignoring
           end if
         end try
         try
@@ -240,14 +331,52 @@ export function buildMailBodyPasteHandler() {
           end repeat
         end try
       end repeat
+      try
+        set ta to text area 1 of scroll area 1 of w
+        set {tw, th} to size of ta
+        if th >= ${BODY_MIN_H} then
+          set focused of ta to true
+          delay 0.08
+          if my atmSafeToPaste() then return
+        end if
+      end try
+      if atmTallText is not missing value then
+        try
+          set focused of atmTallText to true
+        end try
+        try
+          click atmTallText
+        end try
+        delay 0.08
+        if my atmSafeToPaste() then return
+      end if
+      try
+        click (first text field of w whose description contains "Subject")
+        delay 0.08
+        key code 48
+        delay 0.08
+        if my atmSafeToPaste() then return
+      end try
+      if atmSubjectElem is not missing value then
+        try
+          click atmSubjectElem
+          delay 0.08
+          key code 48
+          delay 0.08
+          if my atmSafeToPaste() then return
+        end try
+      end if
       set {wx, wy} to position of w
       set {ww, wh} to size of w
       click at {(wx + (ww div 2)) as integer, (wy + ((wh * 2) div 3)) as integer}
+      delay 0.08
+      if my atmSafeToPaste() then return
+      error "${BODY_FOCUS_FAILED_SENTINEL}"
     end tell
   end tell
 end atmFocusMailBody
 
-on atmPasteMailBody(bodyText)
+on atmPasteMailBody(bodyText, expectedSubject)
   set savedClip to ""
   set hadClip to false
   try
@@ -256,15 +385,16 @@ on atmPasteMailBody(bodyText)
   end try
   set the clipboard to bodyText
   tell application "Mail" to activate
-  delay 0.25
+  delay 0.4
   try
-    atmFocusMailBody()
+    atmFocusMailBody(expectedSubject)
+    if atmSafeToPaste() is false then error "${BODY_FOCUS_FAILED_SENTINEL}"
     tell application "System Events"
       tell process "Mail"
         keystroke "v" using command down
       end tell
     end tell
-    delay 0.15
+    delay 0.2
   on error errMsg number errNum
     if hadClip then set the clipboard to savedClip
     if errMsg contains "assistive access" or errNum is -25211 then error "${ACCESSIBILITY_DENIED_SENTINEL}"
@@ -274,8 +404,11 @@ on atmPasteMailBody(bodyText)
 end atmPasteMailBody`;
 }
 
-function recipientStillPresentChecks(to) {
+function composeMisdirectChecks({ to, cc = [], bcc = [], subject, body }) {
   const toCount = asInteger(to.length, { min: 1, max: 99, field: "toCount" });
+  const ccCount = asInteger(cc.length, { min: 0, max: 99, field: "ccCount" });
+  const bccCount = asInteger(bcc.length, { min: 0, max: 99, field: "bccCount" });
+  const needle = composeBodyNeedle(body);
   const stillThere = to
     .map((address, i) => {
       const n = asInteger(i, { min: 0, max: 99, field: "recipientIndex" });
@@ -287,8 +420,38 @@ function recipientStillPresentChecks(to) {
     if atmFound${n} is false then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"`;
     })
     .join("\n");
+  const bodyCheck = needle
+    ? `    set atmGotBody to ""
+    try
+      set atmGotBody to content of newMessage as string
+    end try
+    if atmGotBody is "" then
+      try
+        save newMessage
+      end try
+      delay 0.2
+      try
+        set atmGotBody to content of newMessage as string
+      end try
+    end if
+    if atmGotBody does not contain ${asString(needle)} then
+      try
+        tell application "System Events"
+          tell process "Mail"
+            set atmAxVal to value of focused UI element as string
+            if atmAxVal contains ${asString(needle)} then set atmGotBody to atmAxVal
+          end tell
+        end tell
+      end try
+    end if
+    if atmGotBody does not contain ${asString(needle)} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"`
+    : "";
   return `    if (count of to recipients of newMessage) is not ${toCount} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
-${stillThere}`;
+    if (count of cc recipients of newMessage) is not ${ccCount} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
+    if (count of bcc recipients of newMessage) is not ${bccCount} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
+${stillThere}
+    if (subject of newMessage as string) is not ${asString(subject)} then error "${BODY_PASTE_MISDIRECTED_SENTINEL}"
+${bodyCheck}`;
 }
 
 /**
@@ -300,9 +463,10 @@ ${stillThere}`;
  *
  * Do not set AppleScript `content` or `html content`: Ventura+ FB11734014
  * cite-wraps those setters (`>` prefixes + `<blockquote type="cite">`).
- * Recipients are AppleScript `make new … recipient`. The body is pasted
- * into the compose window (native editor) via System Events. If paste
- * lands in To, recipient count changes and we abort + delete (nothing sent).
+ * Recipients and subject are AppleScript properties (never paste). The body
+ * is pasted into the compose window (native editor) via System Events only
+ * after caret focus leaves the header. If paste lands in To/Subject, or the
+ * body never receives the intended text, abort + delete (nothing sent).
  */
 export function buildComposeScript({ to, cc, bcc, subject, body, send, html = false }) {
   const recipients = [
@@ -313,9 +477,9 @@ export function buildComposeScript({ to, cc, bcc, subject, body, send, html = fa
 
   const plainBody = composeNativeBody(body, { html });
   const pasteAndVerify = plainBody
-    ? `  atmPasteMailBody(${asString(plainBody)})
+    ? `  atmPasteMailBody(${asString(plainBody)}, ${asString(subject)})
   tell application "Mail"
-${recipientStillPresentChecks(to)}
+${composeMisdirectChecks({ to, cc, bcc, subject, body: plainBody })}
   end tell`
     : "";
 
@@ -336,9 +500,14 @@ on error errMsg number errNum
   end try
   error errMsg number errNum
 end try
+set atmOutgoingId to ""
 tell application "Mail"
+  try
+    set atmOutgoingId to message id of newMessage as string
+  end try
   ${send ? "send newMessage" : "save newMessage"}
 end tell
+if atmOutgoingId is not "" then return atmOutgoingId
 return "OK"`;
 }
 
@@ -350,8 +519,31 @@ function summarizeRecipients(to, cc, bcc) {
   return parts.join("; ");
 }
 
+export const SENT_VERIFY_SENT = "SENT";
+export const SENT_VERIFY_OUTBOX = "OUTBOX";
+export const SENT_VERIFY_NOT_FOUND = "NOT_FOUND";
+/** Older hang-recovery scripts returned FOUND to mean Sent. Still accepted. */
 export const SENT_VERIFY_FOUND = "FOUND";
 export const SENT_VERIFY_TIMEOUT_MS = 15000;
+export const SENT_VERIFY_ATTEMPTS = 3;
+export const SENT_VERIFY_RETRY_MS = 400;
+
+export const MAIL_VERIFY_MISS_GUIDANCE =
+  "Mail reported the send call succeeded, but the message was not found in Sent or Outbox. Do not assume it was delivered.";
+
+function defaultSentVerifySleep(ms) {
+  if (!ms || ms <= 0) return;
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+/** Test hook: skip the retry delay without changing attempt count. */
+export const sentVerifyClock = {
+  sleep: defaultSentVerifySleep
+};
+
+export function resetSentVerifyClock() {
+  sentVerifyClock.sleep = defaultSentVerifySleep;
+}
 
 /**
  * Hard Mail Automation deny: -1743 / -10004 / "not authorized…", or
@@ -376,10 +568,10 @@ function mailBoxesPreamble() {
   return `  set cutoff to (current date) - (10 * minutes)
   set boxes to {}
   try
-    set end of boxes to sent mailbox
+    set end of boxes to outgoing mailbox
   end try
   try
-    set end of boxes to outgoing mailbox
+    set end of boxes to sent mailbox
   end try
   repeat with acct in accounts
     try
@@ -392,6 +584,48 @@ function appleScriptToList(addresses = []) {
   return `{${addresses.map((address) => asString(address)).join(", ")}}`;
 }
 
+function loadMailboxMessagesSnippet() {
+  return `      set recentMsgs to {}
+      set scanAll to false
+      try
+        if boxRef is outgoing mailbox then set scanAll to true
+      end try
+      try
+        set nm to name of boxRef as string
+        if nm contains "Outbox" then set scanAll to true
+        if nm contains "Outgoing" then set scanAll to true
+      end try
+      if scanAll then
+        set recentMsgs to messages of boxRef
+      else
+        set recentMsgs to (messages of boxRef whose date sent > cutoff)
+      end if`;
+}
+
+function verifyHitReturn() {
+  return `              try
+                if boxRef is outgoing mailbox then return "${SENT_VERIFY_OUTBOX}"
+              end try
+              try
+                set nm to name of boxRef as string
+                if nm contains "Outbox" then return "${SENT_VERIFY_OUTBOX}"
+                if nm contains "Outgoing" then return "${SENT_VERIFY_OUTBOX}"
+              end try
+              return "${SENT_VERIFY_SENT}"`;
+}
+
+function recipientHitSnippet() {
+  return `            set hitTo to false
+            try
+              repeat with recip in (to recipients of msg)
+                set recipAddr to address of recip as string
+                repeat with wanted in wantedTos
+                  if recipAddr is (wanted as string) then set hitTo to true
+                end repeat
+              end repeat
+            end try`;
+}
+
 /**
  * Look in Sent / Outbox for a reply of `messageId`.
  * Proper Mail replies set In-Reply-To. The fallback `make new outgoing
@@ -414,7 +648,7 @@ tell application "Mail"
 ${mailBoxesPreamble()}
   repeat with boxRef in boxes
     try
-      set recentMsgs to (messages of boxRef whose date sent > cutoff)
+${loadMailboxMessagesSnippet()}
       repeat with msg in recentMsgs
         try
           set candId to message id of msg
@@ -423,12 +657,18 @@ ${mailBoxesPreamble()}
           else
             try
               set src to source of msg
-              if src contains ("In-Reply-To: " & ${needleAngle}) then return "${SENT_VERIFY_FOUND}"
-              if src contains ("In-Reply-To: " & ${needleBare}) then return "${SENT_VERIFY_FOUND}"
+              if src contains ("In-Reply-To: " & ${needleAngle}) then
+${verifyHitReturn()}
+              end if
+              if src contains ("In-Reply-To: " & ${needleBare}) then
+${verifyHitReturn()}
+              end if
             end try
             if origSubject is not "" then
               set subj to subject of msg
-              if subj is ("Re: " & origSubject) then return "${SENT_VERIFY_FOUND}"
+              if subj is ("Re: " & origSubject) then
+${verifyHitReturn()}
+              end if
             end if
           end if
         end try
@@ -436,7 +676,7 @@ ${mailBoxesPreamble()}
     end try
   end repeat
 end tell
-return "NOT_FOUND"`;
+return "${SENT_VERIFY_NOT_FOUND}"`;
 }
 
 /**
@@ -463,7 +703,7 @@ ${mailBoxesPreamble()}
   set wantedTos to ${toList}
   repeat with boxRef in boxes
     try
-      set recentMsgs to (messages of boxRef whose date sent > cutoff)
+${loadMailboxMessagesSnippet()}
       repeat with msg in recentMsgs
         try
           set candId to message id of msg
@@ -474,15 +714,7 @@ ${mailBoxesPreamble()}
             if src contains ("In-Reply-To: " & ${needleAngle}) or src contains ("In-Reply-To: " & ${needleBare}) then
               -- A reply to the original is not this forward.
             else
-              set hitTo to false
-              try
-                repeat with recip in (to recipients of msg)
-                  set recipAddr to address of recip as string
-                  repeat with wanted in wantedTos
-                    if recipAddr is (wanted as string) then set hitTo to true
-                  end repeat
-                end repeat
-              end try
+${recipientHitSnippet()}
               if hitTo then
                 set subj to subject of msg
                 set exactFwd to false
@@ -498,8 +730,12 @@ ${mailBoxesPreamble()}
                 set mentionsOrigId to false
                 if src contains ${needleAngle} then set mentionsOrigId to true
                 if src contains ${needleBare} then set mentionsOrigId to true
-                if exactFwd then return "${SENT_VERIFY_FOUND}"
-                if looksForward and mentionsOrigId then return "${SENT_VERIFY_FOUND}"
+                if exactFwd then
+${verifyHitReturn()}
+                end if
+                if looksForward and mentionsOrigId then
+${verifyHitReturn()}
+                end if
               end if
             end if
           end if
@@ -508,45 +744,125 @@ ${mailBoxesPreamble()}
     end try
   end repeat
 end tell
-return "NOT_FOUND"`;
+return "${SENT_VERIFY_NOT_FOUND}"`;
 }
 
 /**
- * Look in Sent / Outbox for a compose whose subject matches exactly and
- * was sent in the last 10 minutes.
+ * Look in Sent / Outbox for a compose matching To + subject.
+ * Never matches subject alone — short subjects like "test" are unsafe.
+ * When `messageId` is present, prefer that id together with To.
  */
-export function buildFindSentBySubjectScript(subject) {
-  const subj = asString(subject);
+export function buildFindSentByRecipientAndSubjectScript(subject, toAddresses = [], messageId = null) {
+  const toList = appleScriptToList(toAddresses);
+  const subj = asString(subject || "");
+  const idLit = messageId ? asString(messageId) : null;
+  const matchBody = idLit
+    ? `${recipientHitSnippet()}
+            set candId to message id of msg
+            set hitId to false
+            try
+              if candId is ${idLit} then set hitId to true
+            end try
+            if hitId and hitTo then
+${verifyHitReturn()}
+            end if
+            if hitTo then
+              set subj to subject of msg
+              if subj is ${subj} then
+${verifyHitReturn()}
+              end if
+            end if`
+    : `${recipientHitSnippet()}
+            if hitTo then
+              set subj to subject of msg
+              if subj is ${subj} then
+${verifyHitReturn()}
+              end if
+            end if`;
+
   return `tell application "Mail"
 ${mailBoxesPreamble()}
+  set wantedTos to ${toList}
   repeat with boxRef in boxes
     try
-      set hits to (messages of boxRef whose subject is ${subj} and date sent > cutoff)
-      if (count of hits) > 0 then return "${SENT_VERIFY_FOUND}"
+${loadMailboxMessagesSnippet()}
+      repeat with msg in recentMsgs
+        try
+${matchBody}
+        end try
+      end repeat
     end try
   end repeat
 end tell
-return "NOT_FOUND"`;
+return "${SENT_VERIFY_NOT_FOUND}"`;
 }
 
 /**
- * After a send hang, ask Mail whether the message is already in Sent.
- * Returns a hit object or null. Verify failure / timeout is not success.
+ * @deprecated Subject-only matching is unsafe. Requires To as the second
+ * argument; without recipients the scan cannot hit.
  */
-export function recoverIfInSent({ inReplyTo = null, subject = null, forwardTo = null } = {}) {
-  const script = forwardTo && inReplyTo
-    ? buildFindSentForwardScript(inReplyTo, forwardTo)
-    : inReplyTo
-      ? buildFindSentByInReplyToScript(inReplyTo)
-      : subject
-        ? buildFindSentBySubjectScript(subject)
-        : null;
+export function buildFindSentBySubjectScript(subject, toAddresses = []) {
+  return buildFindSentByRecipientAndSubjectScript(subject, toAddresses);
+}
+
+export function parseSentVerifyOutput(output) {
+  const out = String(output || "").trim();
+  if (out === SENT_VERIFY_SENT || out === SENT_VERIFY_FOUND) {
+    return { found: true, mailbox: "sent" };
+  }
+  if (out === SENT_VERIFY_OUTBOX) {
+    return { found: true, mailbox: "outbox" };
+  }
+  return null;
+}
+
+export function parseOutgoingMessageId(output) {
+  const raw = String(output || "").trim();
+  if (!raw || raw === "OK") return null;
+  return validateMessageId(raw);
+}
+
+function pickSentVerifyScript({
+  inReplyTo = null,
+  subject = null,
+  forwardTo = null,
+  to = null,
+  messageId = null
+} = {}) {
+  if (forwardTo && inReplyTo) return buildFindSentForwardScript(inReplyTo, forwardTo);
+  if (inReplyTo) return buildFindSentByInReplyToScript(inReplyTo);
+  const toList = Array.isArray(to) ? to : [];
+  if (toList.length > 0 && (subject || messageId)) {
+    return buildFindSentByRecipientAndSubjectScript(subject || "", toList, messageId);
+  }
+  return null;
+}
+
+/**
+ * After a send hang, ask Mail whether the message is already in Sent/Outbox.
+ * Compose matches require To + subject (Message-ID when available) — never
+ * subject alone. Returns a hit object or null. Verify failure is not success.
+ */
+export function recoverIfInSent(match = {}) {
+  const script = pickSentVerifyScript(match);
   if (!script) return null;
   const result = runAppleScript(script, { timeout: SENT_VERIFY_TIMEOUT_MS, appName: "Mail" });
   if (!result.ok) return null;
-  const out = String(result.output || "").trim();
-  if (out === SENT_VERIFY_FOUND) return { found: true };
-  return null;
+  return parseSentVerifyOutput(result.output);
+}
+
+/**
+ * Poll Sent/Outbox after a send that returned without throw.
+ */
+export function verifyQueuedMessage(match = {}, { attempts = SENT_VERIFY_ATTEMPTS, retryMs = SENT_VERIFY_RETRY_MS } = {}) {
+  let last = null;
+  const n = Math.max(1, attempts);
+  for (let i = 0; i < n; i++) {
+    last = recoverIfInSent(match);
+    if (last) return last;
+    if (i < n - 1) sentVerifyClock.sleep(retryMs);
+  }
+  return last;
 }
 
 export function isMailAccessibilityDenial(result) {
@@ -555,8 +871,22 @@ export function isMailAccessibilityDenial(result) {
   return text.includes("accessibility_denied") || text.includes("assistive access");
 }
 
+export function isMailBodyFocusFailed(result) {
+  if (!result) return false;
+  return String(result.error || "").toLowerCase().includes("body_focus_failed");
+}
+
+export function isMailBodyPasteMisdirected(result) {
+  if (!result) return false;
+  const text = String(result.error || "").toLowerCase();
+  return text.includes("body_paste_misdirected") || text.includes("body_focus_failed");
+}
+
 function failure(action, summary, result, secrets) {
   const err = String((result && result.error) || "").toLowerCase();
+  if (err.includes("body_focus_failed")) {
+    return `${action} failed — attempted to ${summary}. The compose caret could not be moved into the message body; nothing was sent.`;
+  }
   if (err.includes("body_paste_misdirected")) {
     return `${action} failed — attempted to ${summary}. The body was pasted into a header field instead of the message body; nothing was sent.`;
   }
@@ -586,9 +916,41 @@ function failure(action, summary, result, secrets) {
 }
 
 /**
- * Finish a compose/reply/forward. A send hang is not labeled TCC; if Mail
- * already delivered, return success. Hard -1743/-10004 stays a deny.
+ * Finish a compose/reply/forward. A real send is not success until Sent or
+ * Outbox verify hits. A send hang is not labeled TCC; if Mail already
+ * delivered, return success. Hard -1743/-10004 stays a deny.
  */
+function deliverySummary(successSummary, mailbox, recovered) {
+  if (mailbox === "outbox") {
+    return recovered
+      ? "queued in Outbox (still sending; verified after AppleScript hang)"
+      : "queued in Outbox (still sending)";
+  }
+  return recovered
+    ? `${successSummary} (verified in Sent after AppleScript hang)`
+    : `${successSummary} (verified in Sent)`;
+}
+
+function sendVerifiedSuccess({ action, successSummary, details, verified, recovered }) {
+  const mailbox = verified.mailbox;
+  const delivered = mailbox === "sent";
+  return {
+    ok: true,
+    delivered,
+    mailbox,
+    recovered: recovered || undefined,
+    message: writeSuccessMessage(action, deliverySummary(successSummary, mailbox, recovered), {
+      ...details,
+      mailbox,
+      delivery: delivered ? "sent" : "outbox"
+    })
+  };
+}
+
+function verifyMissMessage(action, summary) {
+  return `${action} failed — attempted to ${summary}. ${MAIL_VERIFY_MISS_GUIDANCE}`;
+}
+
 function finalizeMailWrite({
   action,
   summary,
@@ -598,30 +960,33 @@ function finalizeMailWrite({
   inReplyTo = null,
   subject = null,
   forwardTo = null,
+  to = null,
+  messageId = null,
   successSummary,
   details
 }) {
+  const match = { inReplyTo, subject, forwardTo, to, messageId };
+
   if (result.ok) {
-    return { ok: true, message: writeSuccessMessage(action, successSummary, details) };
+    if (!sendNow) {
+      return { ok: true, delivered: false, mailbox: null, message: writeSuccessMessage(action, successSummary, details) };
+    }
+    const verified = verifyQueuedMessage(match);
+    if (!verified) {
+      return { ok: false, delivered: false, mailbox: null, message: verifyMissMessage(action, summary) };
+    }
+    return sendVerifiedSuccess({ action, successSummary, details, verified, recovered: false });
   }
 
   if (sendNow && isMailSendTimeout(result)) {
-    const recovered = recoverIfInSent({ inReplyTo, subject, forwardTo });
+    const recovered = recoverIfInSent(match);
     if (recovered) {
-      return {
-        ok: true,
-        recovered: true,
-        message: writeSuccessMessage(
-          action,
-          `${successSummary} (verified in Sent after AppleScript hang)`,
-          details
-        )
-      };
+      return sendVerifiedSuccess({ action, successSummary, details, verified: recovered, recovered: true });
     }
-    return { ok: false, message: failure(action, summary, result, secrets) };
+    return { ok: false, delivered: false, mailbox: null, message: failure(action, summary, result, secrets) };
   }
 
-  return { ok: false, message: failure(action, summary, result, secrets) };
+  return { ok: false, delivered: false, mailbox: null, message: failure(action, summary, result, secrets) };
 }
 
 /**
@@ -664,7 +1029,7 @@ export function mailCompose(args = {}, { draft = false } = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const script = buildComposeScript({
     to: to.addresses,
@@ -684,6 +1049,8 @@ export function mailCompose(args = {}, { draft = false } = {}) {
     secrets: [body.text, subject.text],
     sendNow: !draft,
     subject: draft ? null : subject.text,
+    to: draft ? null : to.addresses,
+    messageId: draft ? null : parseOutgoingMessageId(result.output),
     successSummary: draft ? "draft saved to Drafts" : "sent",
     details: {
       to: to.addresses.join(", "),
@@ -743,7 +1110,7 @@ export function mailReply(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildReplyScript({ messageId: resolved.messageId, body: body.text, replyAll, sendNow }),
@@ -806,7 +1173,7 @@ export function mailForward(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildForwardScript({ messageId: resolved.messageId, to: to.addresses, body: body.text, sendNow }),
@@ -854,7 +1221,7 @@ export function mailMark(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(buildMarkScript({ messageId: resolved.messageId, read: status === "read" }), { appName: "Mail" });
   if (!result.ok) return { ok: false, message: failure(action, summary, result, []) };
@@ -899,7 +1266,7 @@ export function mailArchive(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildMoveScript({
@@ -932,7 +1299,7 @@ export function mailTrash(args = {}) {
     dryRun: isFlagTrue(args.dry_run),
     confirm: isFlagTrue(args.confirm)
   });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildMoveScript({

package/lib/messagesWrite.js

@@ -17,6 +17,7 @@ import { escapeSQL } from "./validators.js";
 import { runAppleScript, asString, MESSAGES_TCC_GUIDANCE, MESSAGES_APP_NOT_RUNNING_GUIDANCE, ATTRIBUTION_GUIDANCE } from "./appleScript.js";
 import {
   planWrite,
+  plannedWriteResult,
   normalizeList,
   isMessagesHandle,
   validateChatGuid,
@@ -261,7 +262,7 @@ export function messagesSend(args = {}, deps = {}) {
       dryRun,
       confirm
     });
-    if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+    if (!plan.proceed) return plannedWriteResult(plan);
 
     const result = runAppleScript(
       buildSendToChatScript({ chatGuid: guid, text: body.text, attachmentPath: attachment.filePath }),
@@ -293,7 +294,7 @@ export function messagesSend(args = {}, deps = {}) {
 
   const summary = `send a message to ${handles.join(", ")} over ${serviceRaw}${attachment.filePath ? " with an attachment" : ""}`;
   const plan = planWrite({ action, summary, recipientCount: handles.length, dryRun, confirm });
-  if (!plan.proceed) return { ok: true, message: plan.message, planned: true };
+  if (!plan.proceed) return plannedWriteResult(plan);
 
   const result = runAppleScript(
     buildSendToHandlesScript({

package/lib/writeGuards.js

@@ -215,6 +215,24 @@ export function planWrite({
   return { decision: "execute", proceed: true, requiresConfirm, message: null };
 }
 
+/**
+ * Planned / dry_run / confirm-blocked results are not deliveries.
+ *
+ * MCP CallTool only surfaces `message` plus optional `isError`. Clients that
+ * treat a missing `isError` as success would read `ok: true` planned results
+ * as delivered. Planned writes therefore return `ok: false` with
+ * `planned: true` and `delivered: false`.
+ */
+export function plannedWriteResult(plan) {
+  return {
+    ok: false,
+    planned: true,
+    delivered: false,
+    mailbox: null,
+    message: plan && plan.message ? plan.message : "Nothing was changed."
+  };
+}
+
 export function truncate(text, max = 200) {
   if (typeof text !== "string") return "";
   const oneLine = text.replace(/\s+/g, " ").trim();

package/lib/writeTools.js

@@ -48,7 +48,7 @@ export const WRITE_TOOL_DEFINITIONS = [
   // ============ MAIL WRITES ============
   {
     name: "mail_send",
-    description: "Send an email through Mail.app. Sending to more than one recipient in total (to + cc + bcc) requires confirm=true. Use dry_run=true to preview. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; the tool checks Sent before failing. Clients must Sent-check before retrying a timed-out send.",
+    description: "Send an email through Mail.app. Success means the message was verified in Sent or is still in Outbox (still sending) — AppleScript send returning is not enough. Sending to more than one recipient in total (to + cc + bcc) requires confirm=true. dry_run and unconfirmed multi-recipient calls are not deliveries (MCP isError). A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; hang recover matches To+subject (Message-ID when available), never subject alone. Clients must Sent-check before retrying a timed-out send.",
     inputSchema: {
       type: "object",
       properties: {
@@ -82,7 +82,7 @@ export const WRITE_TOOL_DEFINITIONS = [
   },
   {
     name: "mail_reply",
-    description: "Reply to an existing email. reply_all=true fans out to every original recipient and requires confirm=true. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; the tool checks Sent before failing. Clients must Sent-check before retrying a timed-out send.",
+    description: "Reply to an existing email. reply_all=true fans out to every original recipient and requires confirm=true. A real send is verified in Sent/Outbox before success. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; hang recover uses In-Reply-To. Clients must Sent-check before retrying a timed-out send.",
     inputSchema: {
       type: "object",
       properties: {
@@ -97,7 +97,7 @@ export const WRITE_TOOL_DEFINITIONS = [
   },
   {
     name: "mail_forward",
-    description: "Forward an existing email to new recipients. More than one recipient requires confirm=true. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; the tool checks Sent before failing. Clients must Sent-check before retrying a timed-out send.",
+    description: "Forward an existing email to new recipients. More than one recipient requires confirm=true. A real send is verified in Sent/Outbox before success. A send hang is a timeout, not TCC, unless Mail reports -1743/-10004; hang recover matches intended To plus Fwd: subject or original Message-ID. Clients must Sent-check before retrying a timed-out send.",
     inputSchema: {
       type: "object",
       properties: {
@@ -343,6 +343,23 @@ export function isWriteTool(name) {
   return Object.prototype.hasOwnProperty.call(WRITE_TOOL_HANDLERS, name);
 }
 
+/**
+ * MCP CallTool payload for a write. Planned / dry_run / confirm-blocked
+ * results set isError so clients that only check isError cannot treat them
+ * as delivered. Verified sends (ok: true) do not set isError.
+ *
+ * @param {{ ok?: boolean, planned?: boolean, message?: string }} writeResult
+ */
+export function mcpWriteResult(writeResult) {
+  const message = writeResult && writeResult.message ? writeResult.message : "write failed";
+  const planned = Boolean(writeResult && writeResult.planned);
+  const failed = !writeResult || writeResult.ok === false;
+  return {
+    content: [{ type: "text", text: message }],
+    ...((failed || planned) ? { isError: true } : {})
+  };
+}
+
 /**
  * Run a write in this process.
  * @returns {{ ok: boolean, message: string }}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apple-tools-mcp",
-  "version": "2.0.6",
+  "version": "2.0.8",
   "description": "MCP server for semantic search and write actions across Apple Mail, Messages, Calendar, and Contacts",
   "type": "module",
   "main": "index.js",

package/scripts/smoke-writes.js

@@ -233,8 +233,9 @@ function line(label, value) {
 }
 
 function step(name, result, severity = "error") {
-  const failed = result.ok === false;
-  const status = failed ? (severity === "warning" ? "WARN" : "FAIL") : result.planned ? "PLANNED" : "OK";
+  const planned = result && result.planned === true;
+  const failed = result && result.ok === false && !planned;
+  const status = planned ? "PLANNED" : failed ? (severity === "warning" ? "WARN" : "FAIL") : "OK";
   console.log(`\n[${status}] ${name}`);
   console.log(`  ${result.message}`);
   return result;
@@ -348,7 +349,7 @@ async function main() {
   }));
   results.push(created);
 
-  if (created.ok !== false) {
+  if (created.ok !== false || created.planned) {
     const contactId = apply ? extractContactId(created.message) : "ABCD1234-SMOKE:ABPerson";
     if (apply && !contactId) {
       console.log("  contacts_add reported success but returned no contact id; skipping edit/delete.");
@@ -405,7 +406,7 @@ async function main() {
   }));
   results.push(eventCreated);
 
-  if (eventCreated.ok !== false) {
+  if (eventCreated.ok !== false || eventCreated.planned) {
     const eventId = apply ? extractEventId(eventCreated.message) : "ATM-SMOKE-EVENT-UID";
     const extractedKitId = apply ? extractEventKitId(eventCreated.message) : "EK-SMOKE";
     const eventKitId = extractedKitId || (eventId && eventId.includes(":") ? eventId : null);
@@ -451,7 +452,7 @@ async function main() {
     }
   }
 
-  const failed = results.some((r) => r && r.ok === false);
+  const failed = results.some((r) => r && r.ok === false && !r.planned);
   console.log("\n" + "=".repeat(60));
   if (failed) {
     console.log("Result: FAILED - see the messages above.");