Summary

Owner-attested external agents cannot be @-mentioned. The mention
candidate gate (added in #2149) drops every agent-classified identity
that is not in the local managed store — before the directory
eligibility logic (relayAgentIsSharedWithUser / the directory branch of
shouldHideAgentFromMentions) can run, so that shipped logic is
unreachable for them. The sharp edge from #2987, which we reproduced
independently: an external agent is mentionable while unattested
(misclassified as a person), and registering it correctly — kind:0
with verified NIP-OA attestation plus a kind:10100 directory entry — is
what makes it unreachable.

This PR rewrites the gate as one predicate that decides "will this agent
receive the message, and does its policy admit responding to you?" from
the same relay facts other agent surfaces already trust, keeping the
local store as one proof among several rather than the gatekeeper:

mentionable(agent, channel, viewer) =
     locallyManaged(agent)                         // native path, unchanged — membership
                                                   // NOT required (covers the managed
                                                   // non-member auto-add flow)
  || ( member(agent, channel)                      // external agents: relay membership,
                                                   // then the agent's own kind:10100
                                                   // declaration:
       && (  respond_to == "anyone"
          || (respond_to == "allowlist" && viewer ∈ allowlist)
          || (respond_to == "owner-only"
              && verifiedOwner(agent) == viewer) ) )   // the NIP-OA-verified ownerPubkey
                                                       // the "managed by" header renders

Deliberate boundaries:

• Liveness is not required: buzz-acp reconnects with a since
  filter and replays missed mentions, and stopped managed agents are
  offered today. Offline is a queue, not a void.
• No declaration → hidden from everyone except the verified owner.
  A second commit (after community feedback on External (non-desktop-managed) agents: publishing kind:10100 makes them un-mentionable — shouldHideAgentFromMentions's invocability logic is unreachable #2987 and the
  cross-machine reports) offers declaration-less attested agents to
  their NIP-OA-verified owner only: the harness's inbound author gate
  admits the owner under every respond-to mode, so an owner's mention is
  never a void chip — and it covers the owner-on-another-device cases
  ([Bug] Remote managed agents are hidden and unmentionable on secondary devices #2349, Managed agents are only mentionable from the machine that runs them #3277) without requiring a directory entry that nothing
  publishes for native agents yet. Strangers still see nothing. fix(desktop): prefer live agent mentions #2149's
  stale-identity protection: stale same-name identities an owner might
  now see fold into the live one via the untouched same-label/same-owner
  coalescing, and NIP-IA-archived identities are peeled before
  candidates are built.
• Non-member external agents stay hidden even when their policy is
  anyone: offering them would need the add flow to honor the
  directory's channel_add_policy declaration — a follow-up, kept out
  of this diff.

owner-only external agents becoming mentionable by their verified
owner is new capability the pre-aggregated sets could not express — it
composes the ownership proof the client already verifies for the
"managed by" surface with the agent's own policy declaration.

What this deliberately does not fix (same family, follow-ups)

• A third party mentioning a desktop-managed agent whose owner's
  respond-to setting never left its home machine (the third-party half
  of Desktop hides allowlisted agents owned by another user from @mention autocomplete #3125 / [Bug] Remote Agent Missing from @ Mention Autocomplete Across Machines #2508 / Mention picker lists locally-managed agents instead of channel members, so an agent running on another machine can never be @-mentioned #3204): the owner's intent lives only in the local
  kind:30177 record, so no client can honor what was never published.
  The owner-side half of the cross-machine cluster ([Bug] Remote managed agents are hidden and unmentionable on secondary devices #2349, Managed agents are only mentionable from the machine that runs them #3277) IS
  fixed by the second commit. Completing the third-party half needs a
  directory writer at agent create/attach time.
• The add-member search gates on the managed list the same way
  (MembersSidebar); its proof-shaped fix is the channel_add_policy
  declaration (also noted in External (non-desktop-managed) agents: publishing kind:10100 makes them un-mentionable — shouldHideAgentFromMentions's invocability logic is unreachable #2987).
• set-add-policy replaces the full kind:10100 record, hiding the agent from mention autocomplete #3663: the CLI's set-add-policy still replaces the full
  replaceable kind:10100 record with a single field; under this
  predicate the damaged entry fails closed ("no declaration") instead of
  reading as an explicit exclusion, but the read-merge-write CLI fix is
  its own change.

Related issue

Addresses the @-mention core of #2987 (kept open deliberately: that
report also covers the add-member search — first follow-up below — and
its comment thread documents declaration-less subcases discussed there).
Supplies the mechanism for #3125 (and the cross-machine
flavors #2508 / #2349 / #3277 / #3204) — see the section above for what
remains. Closest existing PRs, oldest first: #3110 (gate-loosening in both
the mention and add-member surfaces), #3448 (same root plus the
add-member search and a fetch-merge-write set-add-policy; its CLI
piece is exactly right and complementary to this change), and #3609
(minimal same-root fix admitting the precomputed mentionable set at the
gate). Relative to both, this PR keeps agents without any directory
declaration hidden (preserving #2149's stale-identity suppression, which
removing or bypassing the pre-gate alone re-opens through the
member-not-in-directory branch), requires channel membership, and
handles owner-only-by-owner via the verified attestation. Happy to
coordinate however the maintainers prefer — these three PRs are
convergent, not competing.

Testing

• cd desktop && pnpm test — 3,784 passing
• pnpm exec tsc --noEmit — clean
• pnpm exec biome check src/features/agents src/features/messages — clean
• Unit tests cover the policy matrix: anyone / allowlist in + out /
  owner-only as owner, as non-owner, unverified / no declaration /
  non-member external / managed member + non-member / unknown viewer /
  pubkey normalization on every comparison.
• Live verification on a self-hosted relay with two headless
  buzz-acp agents (systemd on a Linux host, NIP-OA-attested, full
  kind:10100 entries — the External (non-desktop-managed) agents: publishing kind:10100 makes them un-mentionable — shouldHideAgentFromMentions's invocability logic is unreachable #2987 topology): before this change the
  agents render agent chips and verified "managed by" but never appear
  in @-autocomplete; with it, autocomplete offers them, the published
  event carries the agent p tag, and the harness responds. Stale
  registration facts were confirmed on-relay via the NIP-98 bridge while
  root-causing.