A result, a receipt, and permission to share are different facts
The word done often hides a chain of independent claims. Work may have returned text, stored a body, delivered it to an owner, scheduled a turn, satisfied an assignment, received approval, or disclosed data. None of those facts automatically establishes the next.
Keep the claims separate
| Fact | Useful evidence | Limit |
|---|---|---|
| Returned output | The actual tool result, assistant text, transcript, or returned artifact. | A preview may be incomplete; the initial Tan job returns its last assistant text, which may be a later follow-up rather than the earlier report. |
| Delivery | A receipt or an identified owner-routed result. | Delivery is not compliance, a model reply, or a completed project check. |
| Observation | A query, inspection, or recovered result at a particular time. | Observation can change delivery bookkeeping; it is not always repeatable retrieval of the same body. |
| Completion | A settled operation plus evidence for the requested outcome. | A completed job can still have failed its assignment. |
| Approval | A scoped host decision or domain grant for the intended action. | Approval to edit or accept locally is not permission to disclose the transcript. |
| Disclosure | Data leaves its prior trusted boundary or an access-bearing copy is provided. | Encryption, redaction, a hidden panel, or UI cancellation does not alone make disclosure authorized or reversible. |
A delivered body and a scheduled wake are not the same result
The extension delivery coordinator makes this explicit. captureSessionTarget() records an owner anchor. deliverMessage() reports whether a body was deferred, committed, or already committed, and separately reports wake state.
A committed body with a pending wake is not missing content. Retain the same target, namespace, delivery ID, and body for a legitimate retry. Creating a new identity to recover a missing reply can duplicate delivery. A fork does not inherit the original owner’s delivery authority merely because it contains related conversation text, and moving away from the anchor or across a reset boundary can make delivery inadmissible.
Tan’s job delivery is a different interface, but it teaches the same distinction. Hub jobs or wait can recover a settled result and suppress duplicate automatic delivery. Later snapshots may omit the body because it was already delivered or recovered. Read the earlier result, the actual returned full-output artifact, or the transcript; do not infer that no output existed or construct an ordinary-task artifact URL for a tan.
Presentation is not content policy
Extension result content is the model-facing path; details is not automatically replayed to the model. Decision-critical fields need an appropriate model-visible representation. Conversely, display: false hides presentation without making custom-message content invisible to the model.
The same distinction appears in Memory: recalled material enters model context. Local storage does not prove no egress. It also appears in export: filters, collapsed sections, and a blank viewer do not remove embedded bytes.
Choose the copied representation before considering a recipient
A live dump uses current context and can include current system/tool information and a temporary sidecar. A file-based HTML export uses saved history without reconstructing a running agent’s current prompt inventory. Ordinary HTML can embed pre-clear and nested history. Default sharing builds a different snapshot and does not collect adjacent nested transcripts; a custom TUI share handler receives ordinary HTML instead.
Those differences are not privacy rankings. They are reasons to inspect the exact representation selected for the purpose. The current HTML viewer also depends on external CDN scripts: embedded data does not make it a self-contained offline viewer. Raw or decoded fictional data remains inspectable when scripts are blocked.
Redaction depends on the available obfuscator and its recognized fields and strings. Images, unknown values, and some identifying metadata can remain. Encryption protects access to the sealed representation, while the complete fragment-bearing link grants decryption access. Size trimming removes evidence, not necessarily sensitive content. Sharing cancellation has the separate late-completion boundary explained in Changing focus, stopping work, and cancelling disclosure.
Review Desk’s accepted status is a useful final check on vocabulary: it records a local decision and publishes nothing. Do not promote that fact into approval to share a packet.
Source trail: Observe jobs and read results, Owner-addressed delivery, Choosing a snapshot, and Sharing. Cited anchors include AsyncJobManager.consumeJobResults, ExtensionDeliveryCoordinator, buildSessionData, collectSubSessions, buildShareSnapshot, and shareSession in their source chapters.
Related chapters:
- 4. Steer and queue work
- 6. Observe jobs and read results
- 7. Continue a finished tan
- Tools, interception and native delegation
- Background work and owner-addressed delivery
- Review Desk: edit and decide locally
- Privacy and costs
- Review Packet choosing a snapshot
- Review Packet local HTML export
- Review Packet reading the whole packet
- Sharing is a separate disclosure decision
Connections and next steps · Unified editorial chapter; connects the recorded source material without rerunning it.