ofw-mcp 2.9.1 → 2.10.0

package/dist/bundle.js

@@ -34929,7 +34929,8 @@ var KNOWN_CAPABILITIES = /* @__PURE__ */ new Set([
   "capture_redirect",
   "read_indexed_db",
   "read_dom",
-  "download"
+  "download",
+  "graphql"
 ]);
 
 // node_modules/@fetchproxy/protocol/dist/mcp-id.js
@@ -35232,6 +35233,7 @@ function assertIndexedDbScopesArray(value, label) {
 }
 var DOM_SELECTOR_RE = /^[^-]{1,512}$/;
 var DOM_ATTRIBUTE_RE = /^[A-Za-z_:][A-Za-z0-9_:.\-]{0,127}$/;
+var GRAPHQL_OP_NAME_RE = /^[_A-Za-z][_0-9A-Za-z]{0,127}$/;
 function assertDomSelectorsArray(value, label) {
   if (!Array.isArray(value)) {
     throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
@@ -35268,6 +35270,37 @@ function assertDomSelectorsArray(value, label) {
     }
   }
 }
+function assertGraphqlOpsArray(value, label) {
+  if (!Array.isArray(value)) {
+    throw new ProtocolError(`${label}: expected array, got ${typeof value}`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  for (let i = 0; i < value.length; i++) {
+    const entry = value[i];
+    assertObject(entry, `${label}[${i}]`);
+    if (entry.name === void 0) {
+      throw new ProtocolError(`${label}[${i}].name: missing`);
+    }
+    if (entry.operationName === void 0) {
+      throw new ProtocolError(`${label}[${i}].operationName: missing`);
+    }
+    if (typeof entry.name !== "string" || !SCOPE_KEY_RE.test(entry.name)) {
+      throw new ProtocolError(`${label}[${i}].name: invalid ${JSON.stringify(entry.name)}`);
+    }
+    if (typeof entry.operationName !== "string" || !GRAPHQL_OP_NAME_RE.test(entry.operationName)) {
+      throw new ProtocolError(`${label}[${i}].operationName: invalid ${JSON.stringify(entry.operationName)}`);
+    }
+    if (seen.has(entry.name)) {
+      throw new ProtocolError(`${label}: duplicate name ${JSON.stringify(entry.name)}`);
+    }
+    seen.add(entry.name);
+    for (const k of Object.keys(entry)) {
+      if (k !== "name" && k !== "operationName") {
+        throw new ProtocolError(`${label}[${i}]: unexpected field ${JSON.stringify(k)}`);
+      }
+    }
+  }
+}
 function validateFrame(raw) {
   assertObject(raw, "frame");
   const t = raw.type;
@@ -35346,6 +35379,9 @@ function validateHello(raw) {
     if (raw.domSelectors !== void 0) {
       assertDomSelectorsArray(raw.domSelectors, "hello.domSelectors");
     }
+    if (raw.graphqlOps !== void 0) {
+      assertGraphqlOpsArray(raw.graphqlOps, "hello.graphqlOps");
+    }
     assertBase64(raw.identityX25519Pub, "hello.identityX25519Pub");
     assertBase64(raw.identityEd25519Pub, "hello.identityEd25519Pub");
     assertBase64(raw.sessionNonce, "hello.sessionNonce");
@@ -35595,6 +35631,28 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
+  if (raw.op === "graphql_query") {
+    assertObject(raw.init, "inner.init");
+    if (raw.init.name === void 0)
+      throw new ProtocolError("inner.init.name: missing");
+    if (raw.init.variables === void 0) {
+      throw new ProtocolError("inner.init.variables: missing");
+    }
+    assertString(raw.init.name, "inner.init.name");
+    if (raw.init.name.length === 0) {
+      throw new ProtocolError("inner.init.name: must be non-empty");
+    }
+    assertObject(raw.init.variables, "inner.init.variables");
+    if (raw.init.tabUrl !== void 0) {
+      assertString(raw.init.tabUrl, "inner.init.tabUrl");
+    }
+    for (const k of Object.keys(raw.init)) {
+      if (k !== "name" && k !== "variables" && k !== "tabUrl") {
+        throw new ProtocolError(`inner.init: unexpected field ${JSON.stringify(k)} on graphql_query`);
+      }
+    }
+    return raw;
+  }
   if (raw.op === "download") {
     assertObject(raw.init, "inner.init");
     if (raw.init.url === void 0) {
@@ -35620,7 +35678,7 @@ function validateInnerRequest(raw) {
     }
     return raw;
   }
-  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download"; got ${JSON.stringify(raw.op)}`);
+  throw new ProtocolError(`inner.op: must be one of "fetch", "read_cookies", "read_local_storage", "read_session_storage", "capture_request_header", "capture_redirect", "read_indexed_db", "read_dom", "download", "graphql_query"; got ${JSON.stringify(raw.op)}`);
 }
 function assertNonEmptyKeyArray(value, label) {
   if (!Array.isArray(value)) {
@@ -35651,6 +35709,10 @@ function assertStringMap(value, label) {
     }
   }
 }
+var KNOWN_RESPONSE_OPS = /* @__PURE__ */ new Set([
+  ...KNOWN_CAPABILITIES,
+  "graphql_query"
+]);
 function validateInnerResponse(raw) {
   assertPositiveInt(raw.id, "inner.id");
   if (raw.ok === true) {
@@ -35712,6 +35774,13 @@ function validateInnerResponse(raw) {
       assertStringMap(raw.values, "inner.values");
       return raw;
     }
+    if (op === "graphql_query") {
+      if (raw.data === void 0) {
+        throw new ProtocolError("inner.data: missing on graphql_query response");
+      }
+      assertObject(raw.data, "inner.data");
+      return raw;
+    }
     if (op === "download") {
       assertObject(raw.value, "inner.value");
       assertString(raw.value.path, "inner.value.path");
@@ -35736,7 +35805,7 @@ function validateInnerResponse(raw) {
   if (raw.ok === false) {
     assertString(raw.error, "inner.error");
     if (raw.op !== void 0) {
-      if (typeof raw.op !== "string" || !KNOWN_CAPABILITIES.has(raw.op)) {
+      if (typeof raw.op !== "string" || !KNOWN_RESPONSE_OPS.has(raw.op)) {
         throw new ProtocolError(`inner.op: unknown response op ${JSON.stringify(raw.op)}`);
       }
     }
@@ -35928,11 +35997,33 @@ async function sealInnerFrame(sessionKey, mcpId, seq, inner) {
   };
 }
 async function openEncryptedFrame(sessionKey, frame) {
-  const iv = fromB64(frame.iv);
-  const ct = fromB64(frame.ciphertext);
-  const pt = await aesGcmOpen(sessionKey, iv, ct);
-  const parsed = JSON.parse(dec.decode(pt));
-  return validateInnerFrame(parsed);
+  const result = await openEncryptedFrameDetailed(sessionKey, frame);
+  if (result.stage === "ok")
+    return result.inner;
+  throw result.error instanceof Error ? result.error : new Error(String(result.error));
+}
+async function openEncryptedFrameDetailed(sessionKey, frame) {
+  let pt;
+  try {
+    const iv = fromB64(frame.iv);
+    const ct = fromB64(frame.ciphertext);
+    pt = await aesGcmOpen(sessionKey, iv, ct);
+  } catch (error51) {
+    return { stage: "decrypt-failed", error: error51 };
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(dec.decode(pt));
+  } catch (error51) {
+    return { stage: "validation-failed", error: error51, recoveredId: void 0 };
+  }
+  try {
+    const inner = validateInnerFrame(parsed);
+    return { stage: "ok", inner };
+  } catch (error51) {
+    const recoveredId = parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) && typeof parsed.id === "number" && Number.isInteger(parsed.id) && parsed.id > 0 ? parsed.id : void 0;
+    return { stage: "validation-failed", error: error51, recoveredId };
+  }
 }
 
 // node_modules/@fetchproxy/server/dist/election.js
@@ -36058,6 +36149,12 @@ async function buildServerHello(opts) {
       ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
     }));
   }
+  if (opts.graphqlOps && opts.graphqlOps.length > 0) {
+    hello.graphqlOps = opts.graphqlOps.map((d) => ({
+      name: d.name,
+      operationName: d.operationName
+    }));
+  }
   return hello;
 }
 
@@ -36148,7 +36245,8 @@ async function startHost(opts) {
     indexedDbScopes: opts.ownIndexedDbScopes,
     localStoragePointers: opts.ownLocalStoragePointers,
     sessionStoragePointers: opts.ownSessionStoragePointers,
-    domSelectors: opts.ownDomSelectors
+    domSelectors: opts.ownDomSelectors,
+    graphqlOps: opts.ownGraphqlOps
   });
   const ownSessionNonce = fromB64(ownHello.sessionNonce);
   let extensionWs = null;
@@ -36385,7 +36483,8 @@ async function startPeer(opts) {
     indexedDbScopes: opts.indexedDbScopes,
     domSelectors: opts.domSelectors,
     localStoragePointers: opts.localStoragePointers,
-    sessionStoragePointers: opts.sessionStoragePointers
+    sessionStoragePointers: opts.sessionStoragePointers,
+    graphqlOps: opts.graphqlOps
   });
   const sessionNonce = fromB64(hello.sessionNonce);
   ws.send(JSON.stringify(hello));
@@ -36429,10 +36528,20 @@ async function startPeer(opts) {
           return;
         if (!session.acceptInboundSeq(frame.seq))
           return;
-        try {
-          const inner = await openEncryptedFrame(session.sessionKey, frame);
-          innerListeners.forEach((cb) => cb(inner));
-        } catch {
+        const result = await openEncryptedFrameDetailed(session.sessionKey, frame);
+        if (result.stage === "ok") {
+          innerListeners.forEach((cb) => cb(result.inner));
+        } else if (result.stage === "decrypt-failed") {
+        } else {
+          console.error("[fetchproxy] peer: received a frame that decrypted OK but failed validation:", result.error);
+          if (result.recoveredId !== void 0) {
+            innerListeners.forEach((cb) => cb({
+              type: "response",
+              id: result.recoveredId,
+              ok: false,
+              error: `malformed response failed protocol validation: ${String(result.error)}`
+            }));
+          }
         }
       }
     } catch (e) {
@@ -36709,6 +36818,10 @@ var FetchproxyServer = class {
   pendingIdb = /* @__PURE__ */ new Map();
   // download awaiters resolve the saved-file metadata (path + size + mime).
   pendingDownload = /* @__PURE__ */ new Map();
+  // 1.x+: graphql_query awaiters resolve the GraphQL `data` object. Its
+  // shape is operation-specific, so the awaiter resolves `unknown` and the
+  // caller narrows.
+  pendingGraphql = /* @__PURE__ */ new Map();
   mcpId = null;
   identity = null;
   // 0.5.3+: in-flight role-election / handle-start promise. Set the
@@ -36796,6 +36909,10 @@ var FetchproxyServer = class {
         selector: d.selector,
         ...d.attribute !== void 0 ? { attribute: d.attribute } : {}
       })),
+      graphqlOps: (opts.graphqlOps ?? []).map((d) => ({
+        name: d.name,
+        operationName: d.operationName
+      })),
       // 0.8.0+: timer + lazy-revive default to ON. Every realty MCP
       // adapter was about to set these to the same numbers anyway; the
       // back-door is `0` (explicit opt-out) if a caller genuinely wants
@@ -36917,6 +37034,7 @@ var FetchproxyServer = class {
         ownLocalStoragePointers: this.opts.localStoragePointers,
         ownSessionStoragePointers: this.opts.sessionStoragePointers,
         ownDomSelectors: this.opts.domSelectors,
+        ownGraphqlOps: this.opts.graphqlOps,
         onPairCode: this.opts.onPairCode
       });
       this.hostHandle.onOwnInner((inner) => this.onInner(inner));
@@ -36945,7 +37063,8 @@ var FetchproxyServer = class {
         indexedDbScopes: this.opts.indexedDbScopes,
         localStoragePointers: this.opts.localStoragePointers,
         sessionStoragePointers: this.opts.sessionStoragePointers,
-        domSelectors: this.opts.domSelectors
+        domSelectors: this.opts.domSelectors,
+        graphqlOps: this.opts.graphqlOps
       });
       this.peerHandle.onInner((inner) => this.onInner(inner));
       this.peerHandle.onRenegotiate(() => {
@@ -37151,6 +37270,7 @@ var FetchproxyServer = class {
         this.pendingRedirect.delete(id);
         this.pendingDownload.delete(id);
         this.pendingIdb.delete(id);
+        this.pendingGraphql.delete(id);
       }
       throw err;
     }
@@ -37960,6 +38080,52 @@ var FetchproxyServer = class {
     await this.sendInnerFrame(inner);
     return this._withVerbTimeout(pending, this.pendingStorage, id, origin);
   }
+  /**
+   * 1.x+: run a declared GraphQL operation through the page's own Apollo
+   * client (`window.__APOLLO_CLIENT__`) in the signed-in tab's MAIN world.
+   * Requires `'graphql'` in capabilities AND `name` to match a declared
+   * `graphqlOps` entry. The extension resolves `name` → `operationName` →
+   * the live DocumentNode the page already observed, then invokes
+   * `client.query({ query, variables })` — the site's own request path, so
+   * per-request bot telemetry (Akamai etc.) runs automatically.
+   *
+   * Returns the GraphQL `data` object on success (shape is
+   * operation-specific; the caller narrows). Throws a plain `Error` on
+   * developer mistakes (undeclared capability, undeclared name) and a
+   * descriptive `Error` on the `ok:false` bridge path — which includes the
+   * typed "operation not yet observed on this tab" case (open the site's
+   * page and retry).
+   */
+  async graphqlQuery(opts) {
+    if (!this.opts.capabilities.includes("graphql")) {
+      throw new Error('FetchproxyServer.graphqlQuery(): MCP did not declare "graphql" in capabilities');
+    }
+    if (typeof opts.name !== "string" || opts.name.length === 0) {
+      throw new Error("FetchproxyServer.graphqlQuery: opts.name must be a non-empty string");
+    }
+    const declaredNames = this.opts.graphqlOps.map((d) => d.name);
+    if (!declaredNames.includes(opts.name)) {
+      throw new Error(`FetchproxyServer.graphqlQuery: operation ${JSON.stringify(opts.name)} not in declared graphqlOps [${declaredNames.map((n) => JSON.stringify(n)).join(", ")}]`);
+    }
+    await this.ensureConnected();
+    this.throwIfPendingPair();
+    const id = this.nextRequestId++;
+    const inner = {
+      type: "request",
+      id,
+      op: "graphql_query",
+      init: {
+        name: opts.name,
+        variables: opts.variables,
+        ...opts.tabUrl !== void 0 ? { tabUrl: opts.tabUrl } : {}
+      }
+    };
+    const pending = new Promise((resolve2, reject) => {
+      this.pendingGraphql.set(id, { resolve: resolve2, reject });
+    });
+    await this.sendInnerFrame(inner);
+    return this._withVerbTimeout(pending, this.pendingGraphql, id, opts.name);
+  }
   assertScopeSubset(requested, declared, label) {
     const undeclared = undeclaredKeys(requested, declared);
     if (undeclared.length > 0) {
@@ -38097,6 +38263,20 @@ var FetchproxyServer = class {
       }
       return;
     }
+    const graphqlCb = this.pendingGraphql.get(inner.id);
+    if (graphqlCb) {
+      this.pendingGraphql.delete(inner.id);
+      if (inner.ok) {
+        if (inner.op === "graphql_query") {
+          graphqlCb.resolve(inner.data);
+        } else {
+          graphqlCb.reject(new FetchproxyProtocolError(`unexpected ${String(inner.op)} response on graphql_query awaiter`));
+        }
+      } else {
+        graphqlCb.reject(new FetchproxyProtocolError(inner.error));
+      }
+      return;
+    }
     const cookiesCb = this.pendingReadCookies.get(inner.id);
     if (cookiesCb) {
       this.pendingReadCookies.delete(inner.id);
@@ -38148,6 +38328,9 @@ var FetchproxyServer = class {
     for (const { reject } of this.pendingDownload.values())
       reject(err);
     this.pendingDownload.clear();
+    for (const { reject } of this.pendingGraphql.values())
+      reject(err);
+    this.pendingGraphql.clear();
   }
   /**
    * 0.5.2+: read the current pair-pending pair code from whichever handle
@@ -38407,7 +38590,7 @@ async function loginWithPassword(username, password) {
 // package.json
 var package_default = {
   name: "ofw-mcp",
-  version: "2.9.1",
+  version: "2.10.0",
   license: "MIT",
   mcpName: "io.github.chrischall/ofw-mcp",
   description: "OurFamilyWizard MCP server for Claude \u2014 developed and maintained by AI (Claude Code)",
@@ -38442,8 +38625,8 @@ var package_default = {
     "worker:test": "vitest run --config vitest.workers.config.ts"
   },
   dependencies: {
-    "@chrischall/mcp-utils": "^0.13.0",
-    "@fetchproxy/bootstrap": "^1.3.0",
+    "@chrischall/mcp-utils": "^0.14.0",
+    "@fetchproxy/bootstrap": "^1.7.0",
     "@modelcontextprotocol/sdk": "^1.29.0",
     dotenv: "^17.4.2",
     zod: "^4.4.3"
@@ -38916,6 +39099,16 @@ function mapRecipients(items) {
 function hasRealView(recipients) {
   return recipients.some((r) => r.viewedAt !== null && !r.viewedAt.startsWith("1970-01-01"));
 }
+function threadedReplyTo(detail) {
+  return detail.replyToId ?? detail.inReplyTo ?? null;
+}
+function reportsThreaded(detail) {
+  return threadedReplyTo(detail) !== null || detail.showContext === true;
+}
+function reportsUnthreaded(detail) {
+  if (reportsThreaded(detail)) return false;
+  return detail.inReplyTo !== void 0 || detail.showContext !== void 0;
+}
 function scrapeSaysRead(listData) {
   if (typeof listData !== "object" || listData === null) return false;
   const ld = listData;
@@ -39230,7 +39423,12 @@ var DraftListItemSchema = external_exports.looseObject({
   id: external_exports.number(),
   subject: external_exports.string(),
   date: external_exports.looseObject({ dateTime: external_exports.string() }),
+  // Both spellings of the threading echo — OFW reports the reply target as
+  // `inReplyTo` (with showContext) on list payloads where `replyToId` is null.
+  // The cached row must derive the SAME value ofw_save_draft derived from the
+  // detail, or the content revision drifts between a save and the next sync.
   replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
   recipients: external_exports.array(ApiRecipientSchema).optional()
 });
 var DraftListResponseSchema = external_exports.looseObject({ data: external_exports.array(DraftListItemSchema).optional() });
@@ -39293,7 +39491,7 @@ async function syncDrafts(client2, draftsFolderId, store, budget) {
       subject: detail.subject ?? item.subject ?? "(no subject)",
       body: detail.body ?? "",
       recipients: mapRecipients(item.recipients),
-      replyToId: item.replyToId ?? null,
+      replyToId: threadedReplyTo(item),
       modifiedAt: item.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
       listData: item
     });
@@ -39594,8 +39792,18 @@ function draftRevision(d) {
 var ServerDraftSchema = external_exports.looseObject({
   subject: external_exports.string().optional(),
   body: external_exports.string().optional(),
+  // BOTH spellings of the threading echo (see ThreadingEcho in _shared.ts):
+  // OFW reports the reply target as `replyToId` on some payloads and as
+  // `inReplyTo` on others. The snapshot derives one value from whichever is
+  // present, so the revision hashed here matches the one ofw_save_draft
+  // computed from the same server state — a one-sided read produced revisions
+  // that disagreed about the same draft.
   replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
   recipients: external_exports.array(ApiRecipientSchema).optional(),
+  // Attachment fileIds — read so send-by-draft carries the draft's
+  // attachments onto the sent message (see DraftContent.files).
+  files: external_exports.array(external_exports.number()).optional(),
   // Read for the LIFECYCLE answer (see tools/lifecycle.ts): which folder OFW
   // itself says this id lives in right now. `existsOnServer` alone cannot
   // distinguish "still a draft" from "was sent" — a sent draft still exists.
@@ -39638,8 +39846,9 @@ async function fetchMessageSnapshot(client2, id) {
     content: {
       subject: detail.subject ?? "",
       body: detail.body ?? "",
-      replyToId: detail.replyToId ?? null,
-      recipients: mapRecipients(detail.recipients)
+      replyToId: threadedReplyTo(detail),
+      recipients: mapRecipients(detail.recipients),
+      ...detail.files !== void 0 ? { files: detail.files } : {}
     },
     folderId: detail.folder?.id === void 0 ? null : String(detail.folder.id),
     folderName: detail.folder?.name ?? null,
@@ -39769,13 +39978,24 @@ async function ensureFolderIdMap(client2, store) {
     return { map: cached2, requests: 1 };
   }
 }
+var STATE_BY_FOLDER_NAME = /* @__PURE__ */ new Map([
+  ["drafts", "draft"],
+  ["sent", "sent"],
+  ["sent messages", "sent"],
+  ["inbox", "received"]
+]);
 function classifyState(snapshot, map2) {
   if (snapshot === null) return "deleted";
-  const { folderId } = snapshot;
-  if (folderId === null) return "unknown";
-  if (map2.drafts !== null && folderId === map2.drafts) return "draft";
-  if (map2.sent !== null && folderId === map2.sent) return "sent";
-  if (map2.inbox !== null && folderId === map2.inbox) return "received";
+  const { folderId, folderName } = snapshot;
+  if (folderId !== null) {
+    if (map2.drafts !== null && folderId === map2.drafts) return "draft";
+    if (map2.sent !== null && folderId === map2.sent) return "sent";
+    if (map2.inbox !== null && folderId === map2.inbox) return "received";
+  }
+  if (folderName !== null) {
+    const byName = STATE_BY_FOLDER_NAME.get(folderName.trim().toLowerCase());
+    if (byName !== void 0) return byName;
+  }
   return "unknown";
 }
 function probeWouldStamp(cachedDraft, cachedMessage) {
@@ -40917,13 +41137,25 @@ var SentDetailSchema = external_exports.looseObject({
   body: external_exports.string().optional(),
   date: DateSchema.optional(),
   from: external_exports.looseObject({ name: external_exports.string().optional() }).optional(),
-  recipients: external_exports.array(ApiRecipientSchema).optional()
+  recipients: external_exports.array(ApiRecipientSchema).optional(),
+  // The threading echo, in BOTH spellings plus showContext — OFW reports the
+  // reply target inconsistently across payloads (see ThreadingEcho in
+  // _shared.ts). Backs the `threaded` verdict on ofw_send_message.
+  replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
+  showContext: external_exports.boolean().optional()
 });
 var SavedDraftDetailSchema = external_exports.looseObject({
   subject: external_exports.string().optional(),
   body: external_exports.string().optional(),
   date: DateSchema.optional(),
+  // All three threading-echo fields. Reading ONLY `replyToId` here fired a
+  // false "OurFamilyWizard did not thread this draft" warning on nearly every
+  // threaded save, while the same payload's `inReplyTo`/`showContext` showed
+  // the draft WAS threaded — see threadedReplyTo in _shared.ts.
   replyToId: external_exports.number().nullable().optional(),
+  inReplyTo: external_exports.number().nullable().optional(),
+  showContext: external_exports.boolean().optional(),
   recipients: external_exports.array(ApiRecipientSchema).optional(),
   // Read to audit whether requested myFileIDs actually attached (Defect 3).
   files: external_exports.array(external_exports.number()).optional()
@@ -41122,6 +41354,11 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     if (draftRow !== null) {
       const { freshness: freshness2, serverConfirmed, cacheStatus } = await draftsFreshness(cache);
       return jsonResponse({
+        // Stable identity FIRST — the id below changes on every edit
+        // (create-then-delete), so callers should key off draftKey. Null when
+        // this draft was never written through this tool (e.g. authored in
+        // the web app).
+        draftKey: (await cache.getDraftLineageById(draftRow.id))?.draftKey ?? null,
         id: draftRow.id,
         folder: "drafts",
         subject: draftRow.subject,
@@ -41138,13 +41375,9 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
         listData: draftRow.listData,
         attachments: [],
         // Concurrency token — pass as expectedRevision to ofw_save_draft /
-        // ofw_delete_draft to assert you are editing THIS version.
+        // ofw_delete_draft / ofw_send_message to assert you are acting on
+        // THIS version.
         revision: draftRevision(draftRow),
-        // Stable logical identity. Survives the create-then-delete id churn of
-        // editing AND the transition to sent — pass it to ofw_status to ask
-        // "what happened to the thing I was working on?". Null when this draft
-        // was never written through this tool (e.g. authored in the web app).
-        draftKey: (await cache.getDraftLineageById(draftRow.id))?.draftKey ?? null,
         cacheStatus,
         // False = this draft's existence and unsent status are remembered from
         // a cache, not confirmed on OFW. Call ofw_check_freshness before
@@ -41227,16 +41460,19 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     return jsonResponse({ ...withReadState(row), attachments, freshness });
   });
   if (allowSend) server.registerTool("ofw_send_message", {
-    description: "Send a message via OurFamilyWizard. To send an existing draft, pass messageId \u2014 subject/body/recipientIds become optional overrides (missing fields default to the draft's cached values) and the draft is deleted after sending. To send a fresh message, supply subject/body/recipientIds directly. draftId is the legacy spelling of messageId and works the same way. If replyToId is provided, the cache may rewrite it to the latest reply in the same thread (a note is included in the response when this happens). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After sending, the tool re-fetches the message from OFW to populate the local cache and link attachments to the new message id.",
+    description: "Send a message via OurFamilyWizard \u2014 the ONE irreversible operation here, so it carries the strongest guard. TO SEND AN EXISTING DRAFT (the safe default): pass draftId (or messageId \u2014 same thing). The tool re-reads the draft from OFW and sends the SERVER'S version, so what goes out is what is on OurFamilyWizard, not what this session remembers \u2014 subject/body act only as explicit overrides. It is guarded exactly like ofw_save_draft: pass expectedRevision to assert which version you are sending; if the draft changed on OFW since you read it \u2014 or no longer exists (it may already have been SENT) \u2014 the send is REFUSED with the current server content echoed back, and nothing goes out. RECIPIENTS: OurFamilyWizard does not persist recipients on drafts, so recipientIds is usually still required at send time (ids from ofw_get_profile). After the send is CONFIRMED (OFW returned the new message id and the re-fetched sent record matches what was posted), the source draft is deleted automatically; pass deleteDraftOnSuccess:false to keep it. On ANY failure or ambiguity the draft is never deleted \u2014 the response carries draftRetained:true with the reason. TO COMPOSE FROM SCRATCH: supply subject/body/recipientIds with no draftId. If replyToId is provided (or inherited from the draft), the cache may rewrite it to the latest reply in the same thread (a note is included when this happens). ATTACHMENTS: when sending by draftId, the server draft's own attachments carry over automatically; myFileIDs (from ofw_upload_attachment) overrides or attaches files on a fresh compose. The response leads with sentMessageId and the stable draftKey, and reports threaded (whether OFW actually linked the reply) and draftDeleted.",
     annotations: { destructiveHint: true },
     inputSchema: {
-      subject: external_exports.string().describe("Message subject. Required unless messageId/draftId references a cached draft.").optional(),
-      body: external_exports.string().describe("Message body text. Required unless messageId/draftId references a cached draft.").optional(),
-      recipientIds: external_exports.array(external_exports.number()).describe("Array of recipient user IDs (get from ofw_get_profile). Required unless messageId/draftId references a cached draft.").optional(),
-      replyToId: external_exports.number().describe("ID of the message being replied to").optional(),
-      messageId: external_exports.number().describe("ID of an existing draft to send. When set, missing subject/body/recipientIds default to the draft's cached values, and the draft is deleted after sending.").optional(),
-      draftId: external_exports.number().describe("Legacy synonym for messageId. If both are passed they must be equal.").optional(),
-      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment) to attach to the message").optional()
+      subject: external_exports.string().describe("Message subject. Required unless draftId/messageId is given (then it overrides the server draft's subject).").optional(),
+      body: external_exports.string().describe("Message body text. Required unless draftId/messageId is given (then it overrides the server draft's body \u2014 omit it to send exactly what is on OurFamilyWizard).").optional(),
+      recipientIds: external_exports.array(external_exports.number()).describe("Array of recipient user IDs (get from ofw_get_profile). Usually required even when sending a draft: OurFamilyWizard does not persist recipients on drafts.").optional(),
+      replyToId: external_exports.number().describe("ID of the message being replied to. Defaults to the draft's stored reply target when sending by draftId.").optional(),
+      draftId: external_exports.number().describe("ID of an existing draft to send. The draft is re-read from OurFamilyWizard and its SERVER content is sent; missing subject/body default from it. Guarded: a draft that changed since you read it, or that was already sent/deleted, refuses rather than sending blind.").optional(),
+      messageId: external_exports.number().describe("Synonym for draftId (if both are passed they must be equal).").optional(),
+      expectedRevision: external_exports.string().describe('With draftId: the `revision` from ofw_list_drafts / ofw_get_message / ofw_check_freshness for that draft. Asserts you are sending THAT version; if the draft changed on OFW since, the send is refused and the current server content returned. Omit and the tool compares the server against the local cache instead \u2014 omitting never means "send whatever is there now".').optional(),
+      deleteDraftOnSuccess: external_exports.boolean().describe("Default true. Delete the source draft after \u2014 and ONLY after \u2014 the send is confirmed (new message id returned and the re-fetched sent record checks out). Set false to keep the draft. On a failed or unverifiable send the draft is ALWAYS kept, regardless of this flag.").optional(),
+      force: external_exports.boolean().describe("Default false. Send even when the draft changed on OurFamilyWizard since you read it, or its current state could not be read. Only use after showing the user the conflict.").optional(),
+      myFileIDs: external_exports.array(external_exports.number()).describe("Attachment file ids (from ofw_upload_attachment) to attach to the message. When sending by draftId, omit it to carry the server draft's own attachments over; passing it overrides them.").optional()
     }
   }, async (args) => {
     if (args.messageId !== void 0 && args.draftId !== void 0 && args.messageId !== args.draftId) {
@@ -41244,37 +41480,51 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     }
     const draftRef = args.messageId ?? args.draftId;
     const cache = cacheProvider();
+    const deleteOnSuccess = args.deleteDraftOnSuccess ?? true;
     let subject = args.subject;
     let body = args.body;
     let recipientIds = args.recipientIds;
     let draftReplyToId = null;
-    let draftLookupAttempted = false;
-    let draftFound = false;
+    let guardNote = null;
+    let serverDraft;
     if (draftRef !== void 0) {
-      draftLookupAttempted = true;
-      const draft = await cache.getDraft(draftRef);
-      if (draft !== null) {
-        draftFound = true;
-        subject = subject ?? draft.subject;
-        body = body ?? draft.body;
-        recipientIds = recipientIds ?? draft.recipients.map((r) => r.userId);
-        draftReplyToId = draft.replyToId;
+      const cachedDraft = await cache.getDraft(draftRef);
+      const needsContent = subject === void 0 || body === void 0 || recipientIds === void 0;
+      if (needsContent || deleteOnSuccess) {
+        const guard = await guardDestructiveDraftOp({
+          cache,
+          draftId: draftRef,
+          expectedRevision: args.expectedRevision,
+          force: args.force ?? false,
+          action: "send"
+        });
+        if (!guard.ok) return guard.response;
+        guardNote = guard.note;
+        serverDraft = guard.server;
+      }
+      const base = serverDraft ?? cachedDraft;
+      if (base != null) {
+        subject = subject ?? base.subject;
+        body = body ?? base.body;
+        draftReplyToId = base.replyToId;
+      }
+      if (recipientIds === void 0) {
+        const source = [serverDraft ?? null, cachedDraft].find(
+          (s) => s !== null && s !== void 0 && s.recipients.some((r) => r.userId !== 0)
+        );
+        if (source != null) {
+          recipientIds = [...new Set(source.recipients.map((r) => r.userId).filter((id) => id !== 0))];
+        }
       }
     }
     if (subject === void 0 || body === void 0 || recipientIds === void 0) {
-      if (draftLookupAttempted && !draftFound) {
-        throw new Error(
-          `draft ${draftRef} not found in local cache. Call ofw_sync_messages first, or supply subject/body/recipientIds explicitly.`
-        );
-      }
       const missing = [
         subject === void 0 ? "subject" : null,
         body === void 0 ? "body" : null,
         recipientIds === void 0 ? "recipientIds" : null
       ].filter((n) => n !== null).join(", ");
-      throw new Error(
-        `ofw_send_message requires ${missing}. Pass it directly, or pass messageId to default missing fields from a cached draft.`
-      );
+      const hint = draftRef === void 0 ? "Pass them directly, or pass draftId to send an existing draft." : missing === "recipientIds" ? `Draft ${draftRef} carries no stored recipients \u2014 OurFamilyWizard does not persist recipients on drafts, so they must be supplied at send time. Get the co-parent's user id from ofw_get_profile and pass recipientIds.` : `Draft ${draftRef}'s content was not readable from OurFamilyWizard or the local cache, so it cannot supply the missing fields. Pass them explicitly.`;
+      throw new Error(`ofw_send_message requires ${missing}. ${hint}`);
     }
     const requestedReplyTo = args.replyToId ?? draftReplyToId ?? null;
     let resolvedReplyTo = requestedReplyTo;
@@ -41288,7 +41538,7 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
       const parent = await cache.getMessage(resolvedReplyTo);
       chainRootId = parent?.chainRootId ?? parent?.id ?? requestedReplyTo;
     }
-    const myFileIDs = args.myFileIDs ?? [];
+    const myFileIDs = args.myFileIDs ?? serverDraft?.files ?? [];
     const { id: newId, detail, raw } = await postMessageAndRefetch(client2, {
       subject,
       body,
@@ -41301,19 +41551,51 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
     let persisted = null;
     let verifyNote = null;
     let sentDraftKey = null;
+    let threaded = false;
+    let threadNote = null;
     if (newId !== null) {
       verifyNote = verifyWriteLanded("message", { subject, body }, detail);
+      const echoed = threadedReplyTo(detail);
+      if (resolvedReplyTo === null) {
+        threaded = reportsThreaded(detail);
+      } else if (reportsThreaded(detail)) {
+        threaded = true;
+        if (echoed !== null && echoed !== resolvedReplyTo) {
+          threadNote = `NOTE: the sent message threads to ${echoed}, not the requested ${resolvedReplyTo} \u2014 OurFamilyWizard re-targeted the reply within the thread.`;
+        }
+      } else if (reportsUnthreaded(detail)) {
+        threaded = false;
+        threadNote = `WARNING: the sent message came back UNTHREADED \u2014 replyToId ${resolvedReplyTo} was posted but OurFamilyWizard reports no reply linkage on the sent record, so it went out as a new top-level conversation. Verify on ourfamilywizard.com.`;
+      } else {
+        threaded = true;
+      }
+      const storedRecipients = mapRecipients(detail.recipients);
+      if (Array.isArray(detail.recipients) && detail.recipients.length > 0) {
+        const landed = new Set(storedRecipients.map((r) => r.userId));
+        const missingRecipients = recipientIds.filter((rid) => !landed.has(rid));
+        if (missingRecipients.length > 0) {
+          verifyNote = [
+            verifyNote,
+            `WARNING: the sent record does not list requested recipient id(s) ${missingRecipients.join(", ")}, so the send could not be fully confirmed. Verify on ourfamilywizard.com.`
+          ].filter((n) => n !== null).join("\n\n");
+        }
+      }
       persisted = {
         id: newId,
         folder: "sent",
         subject: detail.subject ?? subject,
         fromUser: detail.from?.name ?? "",
         sentAt: detail.date?.dateTime ?? (/* @__PURE__ */ new Date()).toISOString(),
-        recipients: mapRecipients(detail.recipients),
+        recipients: storedRecipients,
         body: detail.body ?? body,
         fetchedBodyAt: (/* @__PURE__ */ new Date()).toISOString(),
-        replyToId: resolvedReplyTo,
-        chainRootId,
+        // Prefer OFW's own echo of where the reply landed; keep what was
+        // posted when OFW echoed nothing (sent rows feed findLatestReplyTip,
+        // and a null would break the chain for a message that IS threaded).
+        // A positively UNTHREADED send stores null — the chain link OFW says
+        // does not exist must not be invented.
+        replyToId: threaded ? echoed ?? resolvedReplyTo : null,
+        chainRootId: threaded ? chainRootId : null,
         listData: detail
       };
       await cache.upsertMessage(persisted);
@@ -41341,16 +41623,43 @@ function registerMessageTools(server, client2, cacheProvider, attachmentIO) {
       }
     }
     let unconfirmedNote = null;
+    let draftDeleted = false;
+    let draftRetainedReason = null;
     if (newId === null) {
       const draftClause = draftRef !== void 0 ? `Draft ${draftRef} was NOT deleted \u2014 check` : "Check";
       unconfirmedNote = `WARNING: OFW's send response did not include a message id, so the send could not be confirmed. ${draftClause} ourfamilywizard.com to see whether the message went out before retrying.`;
+      if (draftRef !== void 0) {
+        draftRetainedReason = "the send could not be confirmed (OFW returned no message id), so the draft is your only reliable copy of the message";
+      }
     } else if (draftRef !== void 0) {
-      await deleteOFWMessages(client2, [draftRef]);
-      await cache.deleteDraft(draftRef);
+      if (verifyNote !== null) {
+        draftRetainedReason = "the sent record could not be fully verified against what was posted (see WARNING above) \u2014 the draft is kept until you confirm the send on ourfamilywizard.com";
+      } else if (!deleteOnSuccess) {
+        draftRetainedReason = "deleteDraftOnSuccess:false \u2014 kept by request";
+      } else {
+        try {
+          await deleteOFWMessages(client2, [draftRef]);
+          await cache.deleteDraft(draftRef);
+          draftDeleted = true;
+        } catch (e) {
+          draftRetainedReason = `the send succeeded but the draft delete failed (${e.message}) \u2014 remove it with ofw_delete_draft once you have verified the sent message`;
+        }
+      }
     }
-    const responseObj = persisted === null ? raw : { ...persisted, ...sentDraftKey !== null ? { draftKey: sentDraftKey, previousId: draftRef } : {} };
+    const retainNote = draftRef !== void 0 && newId !== null && !draftDeleted ? `NOTE: draft ${draftRef} was retained: ${draftRetainedReason}.` : null;
+    const responseObj = persisted === null ? draftRef !== void 0 ? { sendConfirmed: false, draftDeleted: false, draftRetained: true, draftRetainedReason, raw } : raw : {
+      sentMessageId: newId,
+      draftKey: sentDraftKey,
+      threaded,
+      ...draftRef !== void 0 ? {
+        draftDeleted,
+        ...draftDeleted ? {} : { draftRetained: true, draftRetainedReason },
+        previousId: draftRef
+      } : {},
+      ...persisted
+    };
     const text = responseObj ? JSON.stringify(responseObj, null, 2) : "Message sent successfully.";
-    const notes = [rewriteNote, verifyNote, unconfirmedNote].filter((n) => n !== null).join("\n\n");
+    const notes = [guardNote, rewriteNote, verifyNote, threadNote, unconfirmedNote, retainNote].filter((n) => n !== null).join("\n\n");
     return textResponse(notes ? `${notes}
 
 ${text}` : text);
@@ -41370,7 +41679,7 @@ ${text}` : text);
     } catch (e) {
       const reason = e.message;
       if (force) {
-        return { ok: true, note: `WARNING: force:true \u2014 proceeded with ${action} on draft ${draftId} even though its current state could not be read from OurFamilyWizard (${reason}). Any newer server-side version was destroyed and is NOT recoverable from this response.` };
+        return { ok: true, note: `WARNING: force:true \u2014 proceeded with ${action} on draft ${draftId} even though its current state could not be read from OurFamilyWizard (${reason}). Any newer server-side version was destroyed and is NOT recoverable from this response.`, server: void 0 };
       }
       return {
         ok: false,
@@ -41385,7 +41694,7 @@ ${text}` : text);
     const verdict = checkDraftFreshness({ server: server2, cached: cached2, expectedRevision });
     if (verdict.verdict === "FRESH") {
       const note = verdict.metadataOnly ? `NOTE: draft ${draftId} was treated as current for this ${action}. Since you read it, OurFamilyWizard normalized connector-authored metadata (${verdict.changedFields.join(", ")}); the subject, body and recipients are unchanged, so this is not a conflict.` : null;
-      return { ok: true, note };
+      return { ok: true, note, server: server2 };
     }
     if (force) {
       console.error(`[ofw-mcp] WARNING: force:true overrode a ${verdict.verdict} verdict on draft ${draftId} (${action}). ${verdict.reason}`);
@@ -41398,7 +41707,8 @@ ${JSON.stringify(
           { overwrittenServerDraft: server2 === null ? null : { ...server2, revision: draftRevision(server2) } },
           null,
           2
-        )}`
+        )}`,
+        server: server2
       };
     }
     return {
@@ -41413,17 +41723,31 @@ ${JSON.stringify(
     };
   }
   server.registerTool("ofw_list_drafts", {
-    description: 'List draft messages from the local OurFamilyWizard cache. Returns an explicit `complete` boolean describing the RESULT SET: true means "these are ALL the drafts on OurFamilyWizard as of freshness.asOf" \u2014 check it before saying "you have N drafts". Each draft carries its `draftKey` (stable across the create-then-delete churn of editing) when one is known. An empty result from a cache that is not verified-fresh is REFUSED (result:"UNVERIFIED_EMPTY"); pass autoRefresh:true to sync and answer instead. For a live, one-call answer prefer ofw_status(includeDraftInventory:true).',
+    description: 'List draft messages, verified against OurFamilyWizard in ONE call: when the local drafts cache is not verified-fresh, a cheap drafts sync runs first by default (verify:true), so the answer is server-confirmed without a second call. Pass verify:false to answer purely from the cache (no OFW requests). Returns an explicit `complete` boolean describing the RESULT SET: true means "these are ALL the drafts on OurFamilyWizard as of freshness.asOf" \u2014 check it before saying "you have N drafts". Each draft carries its `draftKey` (stable across the create-then-delete churn of editing) when one is known. An empty result from a cache that is not verified-fresh is REFUSED (result:"UNVERIFIED_EMPTY"); pass autoRefresh:true to sync and answer instead.',
     annotations: { readOnlyHint: false },
     inputSchema: {
       page: external_exports.number().int().min(1).describe("Page number (default 1)").optional(),
       size: external_exports.number().int().min(1).describe("Drafts per page (default 50)").optional(),
+      verify: external_exports.boolean().describe("Default true: when the drafts cache is not verified-fresh, run a drafts sync first (cheap \u2014 one list page plus one detail per draft) so the response is server-confirmed in one call. Set false to serve straight from the local cache with no OFW requests.").optional(),
       autoRefresh: external_exports.boolean().describe(AUTO_REFRESH_DESC).optional()
     }
   }, async (args) => {
     const page = args.page ?? 1;
     const size = args.size ?? 50;
     const cache = cacheProvider();
+    let autoVerified = false;
+    let verifyNote = null;
+    if (args.verify ?? true) {
+      const { cacheStatus } = await draftsFreshness(cache);
+      if (cacheStatus !== "fresh") {
+        try {
+          await syncAll(client2, { folders: ["drafts"], maxRequests: getSyncMaxRequests() }, cache);
+          autoVerified = await getDraftsCacheStatus(cache) === "fresh";
+        } catch (e) {
+          verifyNote = `The automatic drafts verification could not reach OurFamilyWizard (${e.message}). Answering from the local cache \u2014 the freshness block below labels its age, and an empty result will still be refused rather than reported as an absence.`;
+        }
+      }
+    }
     const { value, refreshed, unverifiedEmpty } = await guardedCacheRead({
       client: client2,
       cache,
@@ -41454,7 +41778,7 @@ ${JSON.stringify(
         freshness: value.freshness,
         refreshed,
         remedy: 'Call ofw_sync_messages(folders:["drafts"]) and retry, re-call with autoRefresh:true, or use ofw_status(includeDraftInventory:true) for a single live answer.',
-        extra: { page, size }
+        extra: { page, size, ...verifyNote !== null ? { verifyNote } : {} }
       });
     }
     const { drafts, total, freshness, serverConfirmed } = value;
@@ -41473,10 +41797,16 @@ ${JSON.stringify(
     if (refreshed) {
       payload.autoRefreshed = true;
     }
+    if (autoVerified) {
+      payload.autoVerified = true;
+    }
+    if (verifyNote !== null) {
+      payload.verifyNote = verifyNote;
+    }
     return jsonResponse(payload);
   });
   if (allowDrafts) server.registerTool("ofw_save_draft", {
-    description: "Save a message as a draft in OurFamilyWizard. Recipients are optional. Pass messageId to replace an existing draft \u2014 note that under the hood this creates a NEW draft and deletes the old one (OFW's update-in-place endpoint silently no-ops while echoing the posted body, so we don't use it); the response.id will be the NEW id, not the messageId you passed, and the change is documented in a transparency NOTE in the response that also lists which fields (subject/body/recipients/replyToId/attachments) were carried over. If replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included in response). Attach files by passing their fileIds (from ofw_upload_attachment) in myFileIDs. After saving, the tool re-fetches the draft from OFW to populate the local cache from authoritative server state, and the returned `revision` reflects that authoritative state (so it will match on your next edit). FIELD PRESERVATION: the response echoes the effective threading (replyToId/inReplyTo) and, whenever OFW did not carry over a requested replyToId, recipient or attachment, a `warnings[]` entry naming what was dropped \u2014 never a silent null. SAFETY: because replacing DESTROYS the old draft rather than merging, passing messageId first re-reads that draft from OFW and REFUSES the write if its subject/body/recipients changed since you read it (drafts edited in the OFW web app do not bump any timestamp, so the local cache can be silently behind). A pure replyToId normalization by OFW is NOT treated as a conflict. The refusal returns the current server body under serverBody \u2014 merge your edit into it and retry with expectedRevision.",
+    description: "Save a message as a draft in OurFamilyWizard. RECIPIENTS: OurFamilyWizard does NOT persist recipients on drafts \u2014 recipientIds are accepted but the saved draft comes back with none (documented OFW behavior, noted once in the response, not warned about; supply recipientIds at send time instead). IDENTITY: the response leads with `draftKey`, the stable identity that survives editing \u2014 key off it, because the `id` changes on EVERY edit (replacing a draft creates a NEW draft and deletes the old one; OFW's update-in-place endpoint silently no-ops, so we never use it). Pass messageId to replace an existing draft; the response.id will be the NEW id, and a transparency NOTE documents the swap and which fields were carried over. THREADING: if replyToId is provided, the cache may rewrite it to the latest reply in the thread (note included). The threading verdict is read from OFW's full echo (replyToId/inReplyTo/showContext) \u2014 a warning appears ONLY when the reply linkage was genuinely dropped or re-targeted, and the response's top-level replyToId/inReplyTo always agree with its listData. Attach files via myFileIDs (from ofw_upload_attachment). After saving, the tool re-fetches the draft from OFW, and the returned `revision` reflects that authoritative state (so it will match on your next edit). SAFETY: because replacing DESTROYS the old draft rather than merging, passing messageId first re-reads that draft from OFW and REFUSES the write if its subject/body/recipients changed since you read it (drafts edited in the OFW web app do not bump any timestamp, so the local cache can be silently behind). A pure replyToId normalization by OFW is NOT treated as a conflict. The refusal returns the current server body under serverBody \u2014 merge your edit into it and retry with expectedRevision.",
     annotations: { readOnlyHint: false },
     inputSchema: {
       subject: external_exports.string().describe("Message subject"),
@@ -41530,12 +41860,13 @@ ${JSON.stringify(
     let persisted = null;
     let replaceNote = null;
     let verifyNote = null;
+    let recipientsNote = null;
     let newRevision = null;
     let draftKey = null;
     const warnings = [];
     if (newId !== null) {
       verifyNote = verifyWriteLanded("draft", { subject: args.subject, body: args.body }, detail);
-      const effectiveReplyTo = detail.replyToId ?? null;
+      const effectiveReplyTo = threadedReplyTo(detail);
       const storedRecipients = mapRecipients(detail.recipients);
       persisted = {
         id: newId,
@@ -41571,17 +41902,23 @@ ${JSON.stringify(
         previousId: args.messageId ?? null,
         recordedAt: now
       });
-      if (resolvedReplyTo !== null && effectiveReplyTo !== resolvedReplyTo) {
+      if (resolvedReplyTo !== null && effectiveReplyTo !== resolvedReplyTo && reportsUnthreaded(detail)) {
+        const rewrittenFrom = requestedReplyTo !== resolvedReplyTo ? ` (rewritten from ${requestedReplyTo})` : "";
+        warnings.push(
+          `replyToId was requested as ${resolvedReplyTo}${rewrittenFrom} but the saved draft came back with replyToId null \u2014 OurFamilyWizard did not thread this draft (its inReplyTo/showContext are empty). The subject and body were saved; only the reply linkage was dropped. If threading matters, verify on ourfamilywizard.com.`
+        );
+      } else if (resolvedReplyTo !== null && effectiveReplyTo !== null && effectiveReplyTo !== resolvedReplyTo) {
         const rewrittenFrom = requestedReplyTo !== resolvedReplyTo ? ` (rewritten from ${requestedReplyTo})` : "";
-        const outcome = effectiveReplyTo === null ? "OurFamilyWizard did not thread this draft (its inReplyTo/showContext will be empty). The subject and body were saved; only the reply linkage was dropped." : `OurFamilyWizard re-targeted the reply to message ${effectiveReplyTo} instead. The draft IS threaded \u2014 to that message, not the one requested \u2014 and the inReplyTo in this response reflects where it actually landed.`;
         warnings.push(
-          `replyToId was requested as ${resolvedReplyTo}${rewrittenFrom} but the saved draft came back with replyToId ${effectiveReplyTo === null ? "null" : effectiveReplyTo} \u2014 ${outcome} If threading matters, verify on ourfamilywizard.com.`
+          `replyToId was requested as ${resolvedReplyTo}${rewrittenFrom} but the saved draft came back with replyToId ${effectiveReplyTo} \u2014 OurFamilyWizard re-targeted the reply to message ${effectiveReplyTo} instead. The draft IS threaded \u2014 to that message, not the one requested. If threading matters, verify on ourfamilywizard.com.`
         );
       }
-      if (args.recipientIds !== void 0 && Array.isArray(detail.recipients)) {
+      if (args.recipientIds !== void 0 && args.recipientIds.length > 0 && Array.isArray(detail.recipients)) {
         const requested = [...new Set(args.recipientIds)].sort((a, b) => a - b);
         const stored = [...new Set(storedRecipients.map((r) => r.userId))].sort((a, b) => a - b);
-        if (requested.join(",") !== stored.join(",")) {
+        if (stored.length === 0) {
+          recipientsNote = "NOTE: OurFamilyWizard does not persist recipients on drafts \u2014 the recipientIds you passed were accepted but are not stored on the draft (documented OFW behavior, not an error; it also means a draft cannot be sent by accident). Supply recipientIds when you send: ofw_send_message requires them when the draft carries none.";
+        } else if (requested.join(",") !== stored.join(",")) {
           warnings.push(
             `recipientIds were requested as [${requested.join(", ")}] but the saved draft has [${stored.join(", ")}]. Verify the recipients on ourfamilywizard.com.`
           );
@@ -41600,28 +41937,26 @@ ${JSON.stringify(
         try {
           await deleteOFWMessages(client2, [args.messageId]);
           await cache.deleteDraft(args.messageId);
-          replaceNote = `NOTE: ofw_save_draft replaced draft ${args.messageId} via create-then-delete. The new draft id is ${newId}; the old draft has been deleted. (OFW's update-in-place endpoint silently no-ops on subsequent updates, so we never use it. If you cached the old id anywhere, replace it with the new one.) Fields carried over to the new draft: subject, body, recipients (${persisted.recipients.length}), replyToId (${persisted.replyToId === null ? "none" : persisted.replyToId}), attachments (${myFileIDs.length}).${warnings.length > 0 ? " See warnings above for any field OurFamilyWizard did not carry over." : ""}`;
+          replaceNote = `NOTE: ofw_save_draft replaced draft ${args.messageId} via create-then-delete. The new draft id is ${newId}; the old draft has been deleted. The draftKey is UNCHANGED \u2014 key off it rather than the volatile id, which changes on every edit. (OFW's update-in-place endpoint silently no-ops on subsequent updates, so we never use it.) Fields carried over to the new draft: subject, body, recipients (${persisted.recipients.length}), replyToId (${persisted.replyToId === null ? "none" : persisted.replyToId}), attachments (${myFileIDs.length}).${warnings.length > 0 ? " See warnings above for any field OurFamilyWizard did not carry over." : ""}`;
         } catch (e) {
           replaceNote = `WARNING: New draft ${newId} was created successfully, but the old draft ${args.messageId} could NOT be deleted: ${e.message}. BOTH drafts now exist on OurFamilyWizard and nothing was lost. Verify ${newId} reads correctly, then remove ${args.messageId} with ofw_delete_draft.`;
         }
       }
     }
     const responseObj = persisted !== null ? {
+      draftKey,
+      revision: newRevision,
       ...persisted,
       inReplyTo: persisted.replyToId,
-      revision: newRevision,
-      // The id above is volatile — it changes on every edit. `draftKey` is
-      // not: pass it to ofw_status to resolve the chain's CURRENT id, or to
-      // find out that the draft was sent and when.
-      draftKey,
       previousId: args.messageId ?? null,
       cacheStatus: "fresh",
       serverConfirmed: true,
-      ...warnings.length > 0 ? { warnings } : {}
+      ...warnings.length > 0 ? { warnings } : {},
+      ...recipientsNote !== null ? { recipientsNote } : {}
     } : raw;
     const text = responseObj ? JSON.stringify(responseObj, null, 2) : "Draft saved.";
     const warnNote = warnings.length > 0 ? `WARNING: ${warnings.join("\n\n")}` : null;
-    const notes = [forceNote, rewriteNote, verifyNote, warnNote, replaceNote].filter((n) => n !== null).join("\n\n");
+    const notes = [forceNote, rewriteNote, verifyNote, warnNote, recipientsNote, replaceNote].filter((n) => n !== null).join("\n\n");
     return textResponse(notes ? `${notes}
 
 ${text}` : text);
@@ -42911,7 +43246,7 @@ var nodeCacheProvider = () => nodeCache ??= OFWCache.open(getCacheDbPath());
 var nodeAttachmentIO = new NodeAttachmentIO();
 await runMcp({
   name: "ofw",
-  version: "2.9.1",
+  version: "2.10.0",
   // x-release-please-version
   deps: client,
   tools: [