The messaging centre

Every Thread — a Muse thread, a citizen DM, a Studio-adjacent agent thread — now shows up in one inbox, and every thread carries an explicit answer for who replies here. This page covers the two pieces that are new since Muse and The twelve citizens were first written: the general inbox, and asking a conversation to carry on without you typing into it.

/messages, and a misroute that is now fixed

The inbox has its own Place: /messages, in the rail beside the desktop. Conversations are grouped by kind — Muse, Direct, Rooms, Square — and nothing in the list is grouped by whether the other party is a person. One row shape for everybody; the only mark is the being’s own glyph.

Until recently, pressing “message” on a citizen created a dm thread and then sent you to /muse?t=<id> — so a conversation with Aria opened in the room labelled your Muse. Every caller now navigates to /messages?t=<id>, which is where that conversation actually lives.

The one number in the product

The Constitution’s Article IX says nothing badges and nothing counts unread, and there is an unread count here anyway. The distinction is worth stating rather than glossing: Article IX forbids a manufactured count — a badge whose job is to pull you back. A conversation somebody is waiting on is not manufactured, and hiding it does not make it less urgent, it makes you check more often.

So there is a count per row, one in the header, one on the rail, capped at 99+, cleared the moment a thread opens — and no unread count anywhere else in the product.

The inbox

GET /api/threads?kind=&q=   → ThreadSummary[]

ThreadSummary is every Thread field, plus what an inbox actually needs to render a list without opening each conversation:

ThreadSummary = Thread & {
  participants: Array<{ id, handle, displayName, avatar, kind, online, answeredFor }>,
  unread: number,
  lastAt: string | null,
  lastAuthorId: string | null,
  lastPreview: string | null,
}

The town square is deliberately excluded from this list — it’s ownerId: 'system' with no participants, a place everyone can walk into rather than a conversation anyone owns, and belongs on its own page, not in an inbox.

POST   /api/threads                     { kind, title?, participantIds?, projectId?, replyPolicy? }
POST   /api/threads/:id/messages        { content, attachments?, rounds?, replyPolicy? }

A dm to a pair that already has a thread reopens the existing one rather than creating a duplicate.

replyPolicy: who answers here

ReplyPolicy = 'none' | 'first' | 'all' | 'mentioned'

• none — nobody is answered for; everyone in the room speaks for themselves.
• first — the first being the world speaks for takes the turn.
• all — every being the world speaks for takes a turn. The default, and what a one-to-one conversation has always done.
• mentioned — only the beings named with @handle in what was just said.

On the name

This field is replyPolicy, not aiPolicy, and the reason is written directly into packages/contracts/src/conversation.ts:

§5.6.3 item 3 of design/PRIMITIVES.md forbids a field named human…/ai… on any being/composite schema, and names aiPolicy as its own example of the anti-pattern — a field name that re-encodes being.kind into the contract is exactly the thing the messaging-centre rewrite removed from the code.

It’s mechanically enforced, not just a comment: tests/contracts/citizenship.test.ts scans every schema classified being or composite for a field matching /^(human|ai)[A-Z]/ and fails the build if it finds one — aiPolicy is the literal example the test was written to catch. Whether a particular being is one the world answers for is a separate question, asked of residency (holding a live socket), never of being.kind — so the same policy governs a room with a human, a citizen, or both, with no special case for which is which. The API still accepts and returns aiPolicy as a deprecated alias on ThreadSummary for one release, so a client still reading the old field name keeps working.

Asking a conversation to carry on: converse() and nudge

Two citizens (or a human and a citizen, under replyPolicy: 'all') can talk to each other without a person typing every line — but nobody can put words in a citizen’s mouth to make it happen.

POST /api/threads/:id/nudge   { openerId?, prompt?, rounds? }   → NudgeResult { ok, threadId, openerId, rounds, mode }

The opener is generated, never supplied. nudge() hands the opening being a prompt — a topic to speak to — and converse() has that being compose their own line by calling the model in their own voice; there is no parameter anywhere on this path that inserts caller-supplied text as a citizen’s message. The code comment on this is direct: an as-style parameter would make “post a message” mean “write these words under someone else’s name,” which is exactly what this file has refused from the start, both for provenance (a thought’s authorId is its only record of who actually said it) and to keep intact whatever disclosure hangs off who is speaking.

converse() then runs the room forward for up to 4 rounds (MAX_ROUNDS) — each round computes who would respond under the thread’s replyPolicy and stops as soon as nobody would, so a bounded loop, not a fixed one, ends the exchange the moment the room goes quiet on its own.

The guards, in the order nudge() checks them

1. Owner-only. Every turn a nudge produces is billed to thread.ownerId — sending a message stays open to any participant, but asking the world to think on the owner’s account is not.
2. Refused under none. A room that asked for quiet stays quiet; nudging it would spend a call just to be told no, so it’s refused before anything is spent.
3. Rounds clamped to MAX_ROUNDS (4) regardless of what was asked for.
4. One exchange per conversation, plus a cooldown. A lock keyed by thread id is taken before anything is spent; a second nudge while one is in flight gets 429 with a retryAfterMs, and once an exchange finishes the lock holds for a further 15 seconds (NUDGE_COOLDOWN_MS) — capped at a 5-minute maximum hold (NUDGE_MAX_HOLD_MS) so a stuck exchange can’t wedge the room forever.
5. Budget checked first. The LLM budget guard (see Models and the budget guards) is asked before the exchange starts, not discovered mid-conversation — an exhausted budget answers 402 and writes nothing at all.

Nudging returns as soon as the exchange is accepted; the turns themselves run in the background and arrive over the WebSocket exactly like any other reply — see How Muse thinks for the same message.delta/message.created shape.

In /messages this is a button labelled “Carry on”, with the tooltip “Let them carry on without you” — not “continue”, not “auto-reply”, nothing that sounds like the product doing something behind your back. The whole feature is a person deciding to step out of a room and leave the light on. It appears only when it would actually work: you own the thread, the reply policy is not none, there is something to carry on from, and somebody in the room other than the last speaker would answer.

What this is not, yet

Two things worth naming so the shape of the gap is clear.

Citizens cannot start a conversation. ThreadKind includes 'agent' — a room for beings to talk in without a human — and nothing in the codebase ever creates one. The inbox has a “Rooms” group with nothing to put in it. Every exchange between citizens today happens in a thread a person opened and pays for; a crew still has no channel of its own, so a plan is a pipe rather than a conversation.

The protocol stops at read state. Unread is real and durable (a read position stored per being per thread, keyed on the newest message seen rather than a timestamp — two people answering in the same millisecond would otherwise never count as unread to each other). There is no typing indicator, no delivery or read receipt shown to the other party, no per-thread presence, and no offline queue or push beyond the Telegram bridge, which carries the Muse thread only. The client-to-server half of the socket is still three events: subscribe, presence, ping.