@dmsdc-ai/aigentry-telepty 0.6.3 → 0.6.5

package/CHANGELOG.md

@@ -2,6 +2,48 @@
 
 All notable changes to `@dmsdc-ai/aigentry-telepty` are documented here.
 
+## [0.6.5] - 2026-06-13
+
+### Fixed — orchestrator REPORT loss: hold-and-redeliver queued injects until idle (#617)
+
+- **A REPORT injected into a busy orchestrator TUI is no longer lost.** When `inject --submit`
+  is classified `queued` (consumed=false, recipient busy), the daemon now watches the
+  recipient's auto-state and **re-fires the CR when it transitions to idle** — bounded
+  (`MAX_REDELIVER=3` + total-time deadline; never an unbounded loop), and never-double-deliver
+  (re-fires only while the body is still parked, gated by the #615 consumption check before
+  AND after idle). Detached fire-and-forget; kill-switch `TELEPTY_REDELIVER=off`. Closes the
+  "`Submitted via pty_cr` succeeds but the busy recipient never starts a new turn" gap that
+  forced manual pull-fallback in every orchestration wave.
+
+### Fixed — TASK_IDLE_UNCONFIRMED cry-wolf on long-running Claude turns (#619, telepty#54)
+
+- **A genuinely-completed long Claude TUI turn no longer reports `TASK_IDLE_UNCONFIRMED`.**
+  Consumption is an EARLY event (the turn fires ~T+2s after inject) but the #52/#545 idle-gate
+  evaluated it LATE (at idle, often 13–23 min later) by re-deriving from the output-ring /
+  OSC133 marks — by then a long turn's injected body has scrolled off and no fresh REPL-done
+  mark remains, so the gate fell back to UNCONFIRMED on every long completion (cry-wolf, which
+  trains the orchestrator to ignore the signal and defeats #52's own safety purpose). The
+  daemon now **persists the consumption fact at consumption-time** (`maybeRecordInjectConsumption()`
+  records `injectConsumedAt` on the first genuine non-busy→working/thinking turn after the CR,
+  reusing the #615 consumed signal) and the idle-gate reads that **decay-proof stored fact**
+  instead of re-deriving from a stale screen. **#52 guarantee preserved — never a false
+  COMPLETE**: the fact is only recorded for a real turn AFTER the CR (startup / sub-state flips
+  and busy-park excluded), so a never-consumed inject still yields UNCONFIRMED.
+
+## [0.6.4] - 2026-06-13
+
+### Added — inject consumption-evidence: consumed | queued | unknown (#53)
+
+- **`telepty inject` now distinguishes "delivered" from "consumed".** After the CR
+  (`pty_cr`), the daemon captures an output-ring watermark and `classifyInjectConsumption()`
+  / `verifyBodyConsumed()` (reusing the #52 echo-watermark technique) classify the result:
+  **consumed** (composer cleared + new turn rendered), **queued** (injected text persists
+  in a busy TUI composer), or **unknown** (conservative). The `/submit` response and CLI
+  output now carry this status; a `queued` result on a busy orchestrator TUI prints a
+  pull-fallback hint. Closes the "`Submitted` reads as success but the busy recipient never
+  consumed it" gap (observed 3+ times in a single orchestration wave). Backward-compatible
+  (accepted/retryable semantics and exit codes unchanged; response is a superset).
+
 ## [0.6.3] - 2026-06-13
 
 ### ⚠️ BREAKING — daemon binds 127.0.0.1 by default (#50)

package/cli.js

@@ -2423,7 +2423,21 @@ async function main() {
             : '';
           const attemptsNote = submitData.attempts > 1 ? ` (${submitData.attempts} attempts)` : '';
           const forcedNote = submitData.forced ? ' [forced]' : '';
-          console.log(`✅ Submitted via ${submitData.strategy}${attemptsNote}${gateNote}${lateNote}${forcedNote}.`);
+          const tail = `${attemptsNote}${gateNote}${lateNote}${forcedNote}`;
+          // #53: distinguish CONSUMED-as-a-turn from QUEUED-in-a-busy-composer. A bare
+          // "Submitted via pty_cr" only proves bytes reached the PTY; a busy recipient TUI
+          // parks the text without firing a turn, so report that instead of a false success.
+          const consumption = submitData.consumption
+            || (submitData.verify && submitData.verify.consumption) || null;
+          if (consumption === 'queued') {
+            console.log(`⚠️  Submitted via ${submitData.strategy}${tail}, but recipient is BUSY — text QUEUED, NOT consumed as a new turn. It will be processed after the current turn ends; if a reply is expected, fall back to pulling the recipient's state.`);
+          } else if (consumption === 'consumed') {
+            console.log(`✅ Submitted via ${submitData.strategy}${tail} — consumed as a new turn.`);
+          } else if (consumption === 'unknown') {
+            console.log(`✅ Submitted via ${submitData.strategy}${tail} (consumption=unknown — delivered to PTY; turn-consumption not observable).`);
+          } else {
+            console.log(`✅ Submitted via ${submitData.strategy}${tail}.`);
+          }
         } else if (submitRes && submitRes.status === 504) {
           // Soft failure: REPL never readied. Orchestrator scripts depend on
           // exit 0 here — surface a clear remediation hint but do not exit

package/daemon.js

@@ -43,6 +43,16 @@ const BOOTSTRAP_READY_TIMEOUT_MS = Math.max(500, Number(process.env.TELEPTY_BOOT
 // 2026-05-30 surface-ownership verdict — telepty no longer foregrounds surfaces.
 const WRAPPED_SUBMIT_DELAY_MS = 500;
 
+// #617 hold-and-redeliver — when an inject(--submit) is classified `queued` (busy
+// recipient parked the CR'd body in its composer, no turn fired), the daemon holds the
+// parked body and re-fires the CR on the recipient's next busy→idle transition so the
+// dropped REPORT turn finally starts. Bounded + never-double-deliver. Kill-switch
+// TELEPTY_REDELIVER=off restores the pre-0.6.5 detect-only behavior (back-compat).
+const REDELIVER_ENABLED = String(process.env.TELEPTY_REDELIVER || '').toLowerCase() !== 'off';
+const REDELIVER_MAX_ATTEMPTS = Math.max(1, Number(process.env.TELEPTY_REDELIVER_MAX_ATTEMPTS || 3));
+const REDELIVER_TOTAL_TIMEOUT_MS = Math.max(1000, Number(process.env.TELEPTY_REDELIVER_TOTAL_TIMEOUT_MS || 600000));
+const REDELIVER_IDLE_WAIT_MS = Math.max(1000, Number(process.env.TELEPTY_REDELIVER_IDLE_WAIT_MS || 120000));
+
 // Session state machine manager — auto-detects session state from PTY output
 const sessionStateManager = new SessionStateManager({
   idle_timeout_ms:      Number(process.env.TELEPTY_STATE_IDLE_TIMEOUT_MS || 5000),
@@ -82,6 +92,11 @@ sessionStateManager.onTransition((sessionId, from, to, detail) => {
       pendingReport.sawWorkingAfterInject = true;
       pendingReport.workingAfterInjectAt = new Date().toISOString();
     }
+    // #619: capture the durable early-consumption fact the instant a genuine fresh turn
+    // fires, so the idle-gate (evaluated minutes later on a scrolled-off ring) reads the
+    // stored fact instead of failing to re-derive it. since_ms is set at this transition.
+    const consumedSinceMs = sessionStateManager.getState(sessionId)?.since_ms;
+    maybeRecordInjectConsumption(pendingReport, from, to, consumedSinceMs);
   }
 
   // Fire TASK_IDLE_NO_REPORT on idle transition (for sessions with pendingReports).
@@ -329,6 +344,35 @@ function pendingReportHasSubmitEvidence(pendingReport) {
   ));
 }
 
+// #619: persist inject-CONSUMPTION as a DURABLE FACT at consumption-time. The #52/#545 idle-
+// gate re-derives consumption from the outputRing/OSC133 marks AT IDLE-TIME; on a long Claude
+// turn (idle at T+13-23min) the injected body has scrolled off the ring, so the gate fails to
+// re-derive a genuine completion → false TASK_IDLE_UNCONFIRMED. Recording the fact the instant
+// the turn fires makes the idle-gate decay-proof (it reads the stored fact instead).
+//
+// never-false-complete (the #52 invariant) is preserved by recording ONLY the #615 `consumed`
+// signal — a genuine FRESH turn that started at/after the inject CR:
+//   - the transition must enter a turn (→ working/thinking) FROM a non-busy state (idle/waiting);
+//     a `starting`→working startup flip (#537 pollution) and a working↔thinking mid-turn sub-
+//     state flip (an already-running turn, NOT ours) are both excluded;
+//   - the turn's since_ms must be ≥ the inject's submit-start (a turn that predates our CR is the
+//     #617 busy-park case — never our consumption);
+//   - a submit must have been attempted (submitStartedAt) — a non-submit text-inject records nothing.
+// A never-consumed inject therefore never gets a fact and still signals UNCONFIRMED. Pure +
+// idempotent (first genuine turn wins); mutates the passed pendingReport, returns whether it recorded.
+function maybeRecordInjectConsumption(pendingReport, fromState, toState, transitionSinceMs) {
+  if (!pendingReport || pendingReport.injectConsumedAt) return false;
+  if (toState !== 'working' && toState !== 'thinking') return false;
+  if (fromState !== 'idle' && fromState !== 'waiting') return false;
+  if (!pendingReport.submitStartedAt) return false;
+  const submitStartedMs = new Date(pendingReport.submitStartedAt).getTime();
+  if (!Number.isFinite(submitStartedMs)) return false;
+  if (!Number.isFinite(transitionSinceMs) || transitionSinceMs < submitStartedMs) return false;
+  pendingReport.injectConsumedAt = new Date(transitionSinceMs).toISOString();
+  pendingReport.injectConsumedSinceMs = transitionSinceMs;
+  return true;
+}
+
 // #52: the TASK_IDLE_UNCONFIRMED semantic is "inject may NOT have been processed" — gate it
 // on CONSUMPTION evidence the daemon already owns instead of screen idleness. Evidence:
 //   - a screen-VERIFIED submit confirmation (body consumed from the composer, or a state
@@ -339,6 +383,12 @@ function pendingReportHasSubmitEvidence(pendingReport) {
 // no-land) is positive NON-consumption and can never be overridden by echo, so the
 // never-false-complete invariant of #48 holds: a genuinely unconsumed inject still signals.
 function observeConsumptionEvidence(pendingReport, session) {
+  // #619: a durable early-consumption fact (recorded at turn-start) is decay-proof — prefer it
+  // over re-deriving from the possibly scrolled-off outputRing at idle-time. This also covers the
+  // #48 settle re-entry path (where `confirmed` is force-false) as a suppression backstop.
+  if (pendingReport.injectConsumedAt) {
+    return { observed: true, reason: 'consumed_recorded' };
+  }
   const confirm = pendingReport.submitConfirm;
   if (confirm && confirm.accepted === false) {
     return { observed: false, reason: 'submit_failed' };
@@ -463,6 +513,11 @@ function fireAutoReport(targetId, targetSession, pendingReport, trigger, deps =
   // as proof of processing — require positive submit confirmation (screen-poll verify /
   // honest force / gate-off). Paths with no submit expected keep the legacy floor/work rule.
   const strongSubmitConfirmed = !!(
+    // #619: a durable early-consumption fact (a genuine fresh turn fired by the inject) is
+    // the strongest completion proof there is — stronger than a screen-derived submit confirm
+    // and decay-proof at idle-time. Recorded conservatively (maybeRecordInjectConsumption), so
+    // this never promotes a never-consumed inject.
+    pendingReport.injectConsumedAt ||
     pendingReport.submitConfirmedAt ||
     (pendingReport.submitConfirm && pendingReport.submitConfirm.accepted === true)
   );
@@ -473,9 +528,14 @@ function fireAutoReport(targetId, targetSession, pendingReport, trigger, deps =
   // symptom — a submit-confirmed worker still thinking), consistent with the BUG-B confirm gate;
   // plain non-submit injects keep their existing floor-based completion. Absent flag / other
   // triggers preserve prior behavior.
+  // #619: a recorded early-consumption fact overrides the decayed at-idle evidence. The
+  // `idleEvidenceReliable === false` downgrade exists because the screen-derived evidence is
+  // weak; a stored consumption fact IS the (decay-proof) evidence, so the downgrade no longer
+  // applies. Without a recorded fact, behavior is unchanged (#545/#52 conservative UNCONFIRMED).
   const idleEvidenceUnreliable = trigger === 'real-idle'
     && pendingReport.submitExpected
-    && deps.idleEvidenceReliable === false;
+    && deps.idleEvidenceReliable === false
+    && !pendingReport.injectConsumedAt;
   // #48: a settled recheck re-enters ONLY to emit the UNCONFIRMED label — pinned at arm time,
   // so elapsed growing past the floor during the settle window can never promote a stale idle
   // snapshot to TASK_COMPLETE (never a false complete).
@@ -984,6 +1044,97 @@ async function gatedTerminalSubmit(id, session, injectedBody, settleEnabled) {
   return terminalLevelSubmit(id, session);
 }
 
+// #617 — detached hold-and-redeliver for a `queued` inject. The /submit response has
+// already returned (the worker's `telepty inject` got consumption='queued' / a plain
+// force success and EXITS), so the daemon owns delivery from here: it re-classifies
+// when the status is unknown (the force path skips the synchronous classify), and if
+// `queued`, runs the bounded submitGate.holdAndRedeliver loop — watching the recipient's
+// auto-state for busy→idle (awaitReplReady) and re-firing the bare CR (the body is still
+// parked in the composer) until it is consumed as a fresh turn. Fire-and-forget: never
+// awaited by the handler, so it cannot affect the response or block the caller.
+function scheduleQueuedRedeliver(id, session, injectedBody, opts = {}) {
+  if (!REDELIVER_ENABLED) return;
+  if (!injectedBody || injectedBody.length === 0) return;
+  if (!session) return;
+  // One in-flight redeliver per session — never stack idle-watchers for the same composer.
+  if (session._redeliverInFlight) return;
+  session._redeliverInFlight = true;
+
+  const emitSubmitBus = typeof opts.emitSubmitBus === 'function' ? opts.emitSubmitBus : () => {};
+  const knownConsumption = opts.knownConsumption || null;
+
+  const isParked = () =>
+    submitGate.observeBodyVisibility(session, injectedBody, { stripAnsi: stripAnsiState }).visible === true;
+
+  // Re-fire a bare CR (body already parked) then re-classify against a FRESH watermark:
+  // the recipient is now idle, so a genuine idle→working/thinking turn is observable as
+  // `consumed` (#53). A still-`queued` result means the CR did not fire the composer — retry.
+  const fireCR = async () => {
+    const strategy = await gatedTerminalSubmit(id, session, injectedBody, true);
+    if (!strategy) return { redelivered: false, reason: 'strategy_failed' };
+    const submittedAtMs = Date.now();
+    const sinceBytes = session.outputRingTotalBytes || 0;
+    const c = await submitGate.classifyInjectConsumption(session, injectedBody, {
+      submittedAtMs,
+      sinceBytes,
+      getState: () => sessionStateManager.getState(id),
+      stripAnsi: stripAnsiState,
+    });
+    return { redelivered: c.status === 'consumed', reason: c.reason };
+  };
+
+  const waitForIdle = (remainingMs) =>
+    submitGate.awaitReplReady(id, sessionStateManager, {
+      timeoutMs: Math.min(remainingMs, REDELIVER_IDLE_WAIT_MS),
+    });
+
+  const run = async () => {
+    // Force path skips the synchronous classify — establish the `queued` precondition here
+    // before holding an idle-watcher. Only a busy-parked body needs rescue.
+    if (knownConsumption !== 'queued') {
+      if (Number.isFinite(opts.submittedAtMs)) {
+        const c = await submitGate.classifyInjectConsumption(session, injectedBody, {
+          submittedAtMs: opts.submittedAtMs,
+          sinceBytes: Number.isFinite(opts.ringBytesAtSubmit) ? opts.ringBytesAtSubmit : (session.outputRingTotalBytes || 0),
+          getState: () => sessionStateManager.getState(id),
+          stripAnsi: stripAnsiState,
+        });
+        if (c.status !== 'queued') return; // consumed / unknown — nothing to redeliver
+      } else {
+        return; // no watermark to classify against — cannot safely redeliver
+      }
+    }
+
+    console.log(`[REDELIVER] ${id} inject queued on busy recipient — holding for idle to re-fire`);
+    const result = await submitGate.holdAndRedeliver({
+      waitForIdle,
+      isStillParked: isParked,
+      fireCR,
+      maxAttempts: REDELIVER_MAX_ATTEMPTS,
+      totalTimeoutMs: REDELIVER_TOTAL_TIMEOUT_MS,
+      onAttempt: ({ attempt }) =>
+        console.log(`[REDELIVER] ${id} idle — re-firing queued inject (attempt ${attempt}/${REDELIVER_MAX_ATTEMPTS})`),
+      onExhausted: ({ reason, attempts }) => {
+        console.log(`[REDELIVER] ${id} redeliver-exhausted (${reason}, attempts=${attempts})`);
+        emitSubmitBus({ redeliver: 'exhausted', redeliver_reason: reason, redeliver_attempts: attempts });
+      },
+    });
+
+    if (result.status === 'redelivered') {
+      console.log(`[REDELIVER] ${id} queued inject redelivered after ${result.attempts} attempt(s)`);
+      markPendingReportSubmitConfirmed(id, { reason: 'redelivered', attempts: result.attempts });
+      emitSubmitBus({ redeliver: 'redelivered', redeliver_attempts: result.attempts });
+    } else if (result.status === 'already_consumed') {
+      console.log(`[REDELIVER] ${id} queued inject already consumed (${result.reason}) — no re-fire`);
+    }
+  };
+
+  Promise.resolve()
+    .then(run)
+    .catch((err) => console.log(`[REDELIVER] ${id} redeliver error: ${err && err.message}`))
+    .finally(() => { session._redeliverInFlight = false; });
+}
+
 async function executeBootstrapSubmit(sessionId, session, op) {
   const body = op.body || {};
   const injectedBody = typeof body.injected_body === 'string' ? body.injected_body : null;
@@ -2689,7 +2840,9 @@ app.post('/api/sessions/:id/submit', async (req, res) => {
     if (injectedBody) {
       markPendingReportSubmitStarted(id, injectedBody);
     }
+    const forceRingBytesAtSubmit = session.outputRingTotalBytes || 0;
     const strategy = terminalLevelSubmit(id, session);
+    const forceSubmittedAtMs = Date.now();
     if (strategy) {
       // #537 / Bug B: force-confirm must reflect ACTUAL delivery. A pty_cr fallback on a
       // cmux surface means cmux send-key failed and Enter never reached the CLI — record
@@ -2702,6 +2855,17 @@ app.post('/api/sessions/:id/submit', async (req, res) => {
           markPendingReportSubmitUnconfirmed(id, { reason: 'cmux_send_failed', attempts: 1, retryable: true });
         }
       }
+      // #617: the force path skips the synchronous consumption classify, so a busy-parked
+      // body would silently drop (this IS the worker's `--submit-force` REPORT path). Hand it
+      // to the detached redeliver — it classifies against the CR watermark and only re-fires
+      // if `queued`. No-op when the body was consumed/unknown or absent.
+      if (injectedBody && deliveredToSurface) {
+        scheduleQueuedRedeliver(id, session, injectedBody, {
+          submittedAtMs: forceSubmittedAtMs,
+          ringBytesAtSubmit: forceRingBytesAtSubmit,
+          emitSubmitBus,
+        });
+      }
       emitSubmitBus({ strategy, attempts: 1, gated: false, forced: true, submit_confirmed: deliveredToSurface });
       return res.json({ success: true, strategy, attempts: 1, gated: false, forced: true, submit_confirmed: deliveredToSurface });
     }
@@ -2815,6 +2979,9 @@ app.post('/api/sessions/:id/submit', async (req, res) => {
   const settleEnabled = req.body?.input_settle_gate !== false;
   let strategy = await gatedTerminalSubmit(id, session, injectedBody, settleEnabled);
   let submittedAtMs = Date.now();
+  // #53: outputRing watermark at the CR — scopes consumption-evidence matching to frames
+  // appended AFTER this submit (composer redraw / new-turn render), surviving ring trimming.
+  let ringBytesAtSubmit = session.outputRingTotalBytes || 0;
   let attempts = strategy ? 1 : 0;
   if (!strategy) {
     if (injectedBody) {
@@ -2836,12 +3003,15 @@ app.post('/api/sessions/:id/submit', async (req, res) => {
   // shot is enough. A retry is idempotent only when the body is still visible.
   let verify = null;
   let confirm = null;
+  let consumption = null;        // #53: 'consumed' | 'queued' | 'unknown'
+  let consumptionReason = null;
   if (injectedBody && injectedBody.length > 0) {
     confirm = await confirmSubmitAfterDispatch(id, session, injectedBody, submittedAtMs, verifyTimeoutMs);
     while (confirm && !confirm.accepted && confirm.retryable && attempts <= retries) {
       await new Promise(resolve => setTimeout(resolve, retryDelayMs));
       const retryStrategy = await gatedTerminalSubmit(id, session, injectedBody, settleEnabled);
       submittedAtMs = Date.now();
+      ringBytesAtSubmit = session.outputRingTotalBytes || 0;
       if (!retryStrategy) break;
       strategy = retryStrategy;
       attempts++;
@@ -2849,6 +3019,38 @@ app.post('/api/sessions/:id/submit', async (req, res) => {
     }
     verify = buildSubmitVerify(confirm);
 
+    // #53: consumption-evidence on the DELIVERY path. `confirm.accepted` can read a BUSY
+    // recipient's mid-turn output as success (the isAcceptedSubmitState last_output_at leak),
+    // so additionally classify whether the body was CONSUMED as a fresh turn vs QUEUED in a
+    // busy composer vs UNKNOWN — and surface it to the caller. Advisory + additive: it does
+    // NOT change accepted/retryable (back-compat); it only tells the sender what telepty can
+    // actually observe past the PTY layer. Conservative (never-false-consumed).
+    const consumptionResult = await submitGate.classifyInjectConsumption(session, injectedBody, {
+      submittedAtMs,
+      sinceBytes: ringBytesAtSubmit,
+      getState: () => sessionStateManager.getState(id),
+      stripAnsi: stripAnsiState,
+    });
+    consumption = consumptionResult.status;
+    consumptionReason = consumptionResult.reason;
+    if (verify) {
+      verify.consumption = consumptionResult.status;
+      verify.consumption_reason = consumptionResult.reason;
+    }
+
+    // #617: a `queued` body was parked on a busy recipient and will never fire on its own.
+    // Hand it to the detached hold-and-redeliver loop (re-fires the CR on busy→idle). This
+    // runs independent of whether the handler returns 200 or 504 below — delivery is the
+    // daemon's responsibility now that the worker no longer needs to poll the status.
+    if (consumption === 'queued') {
+      scheduleQueuedRedeliver(id, session, injectedBody, {
+        knownConsumption: 'queued',
+        submittedAtMs,
+        ringBytesAtSubmit,
+        emitSubmitBus,
+      });
+    }
+
     if (confirm && !confirm.accepted) {
       const reason = gatedDispatchAfterTimeout ? 'gated_dispatch_unconsumed' : 'submit_unconfirmed';
       const failBody = {
@@ -2863,6 +3065,7 @@ app.post('/api/sessions/:id/submit', async (req, res) => {
         gate_wait_ms: gateResult.waited_ms,
         verify,
         confirm,
+        ...(consumption ? { consumption, consumption_reason: consumptionReason } : {}),
         gated_dispatch_after_timeout: true,
         ...(promptSymbol ? { prompt_symbol: promptSymbol } : {}),
       };
@@ -2885,6 +3088,7 @@ app.post('/api/sessions/:id/submit', async (req, res) => {
     gate_wait_ms: gateResult.waited_ms,
     verify,
     confirm,
+    ...(consumption ? { consumption, consumption_reason: consumptionReason } : {}),
     ...(gatedDispatchAfterTimeout ? { gated_dispatch_after_timeout: true } : {}),
     ...(promptSymbol ? { prompt_symbol: promptSymbol } : {}),
   };
@@ -4226,6 +4430,7 @@ if (require.main === module) {
 // production call sites is unchanged. NOT a public API — internal/test use only.
 module.exports = {
   fireAutoReport,                 // #32: provenance-tagged auto-report (deps DI: now/deliver/...)
+  maybeRecordInjectConsumption,   // #619: durable early-consumption fact capture (idle-gate decay-proofing)
   forceSubmitDeliveredToSurface,  // #544/#537/Bug B: PTY-native force-confirm (pty_cr = delivered)
   terminalLevelSubmit,            // #544: PTY-only submit path (pty_cr | null)
   submitViaPty,                   // #544: bare-0x0D submit into the innermost node-pty

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dmsdc-ai/aigentry-telepty",
-  "version": "0.6.3",
+  "version": "0.6.5",
   "main": "daemon.js",
   "bin": {
     "aigentry-telepty": "install.js",
@@ -37,9 +37,9 @@
   "scripts": {
     "postinstall": "node scripts/postinstall.js",
     "preuninstall": "node scripts/preuninstall.js",
-    "test": "node --require ./test-support/setup-env.js --test test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/daemon-harness-port.test.js test/daemon-bind-default.test.js test/integration/daemon-launch.test.js test/cli.test.js test/subcommand-help.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/uninstall.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/daemon-restart-fallback-15.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/idle-unconfirmed-settle.test.js test/idle-unconfirmed-consumption.test.js test/provenance.test.js test/inject-audit-broker-seam.test.js test/inject-provenance-daemon.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js && git diff --exit-code tests/snippet-protocol/v1/",
-    "test:watch": "node --require ./test-support/setup-env.js --test --watch test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/daemon-harness-port.test.js test/daemon-bind-default.test.js test/integration/daemon-launch.test.js test/cli.test.js test/subcommand-help.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/uninstall.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/daemon-restart-fallback-15.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/idle-unconfirmed-settle.test.js test/idle-unconfirmed-consumption.test.js test/provenance.test.js test/inject-audit-broker-seam.test.js test/inject-provenance-daemon.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js",
-    "test:ci": "node --require ./test-support/setup-env.js --test --test-reporter=spec test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/daemon-harness-port.test.js test/daemon-bind-default.test.js test/integration/daemon-launch.test.js test/cli.test.js test/subcommand-help.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/uninstall.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/daemon-restart-fallback-15.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/idle-unconfirmed-settle.test.js test/idle-unconfirmed-consumption.test.js test/provenance.test.js test/inject-audit-broker-seam.test.js test/inject-provenance-daemon.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js && git diff --exit-code tests/snippet-protocol/v1/",
+    "test": "node --require ./test-support/setup-env.js --test test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/daemon-harness-port.test.js test/daemon-bind-default.test.js test/integration/daemon-launch.test.js test/cli.test.js test/subcommand-help.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/inject-consumption-evidence.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/uninstall.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/daemon-restart-fallback-15.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/idle-unconfirmed-settle.test.js test/idle-unconfirmed-consumption.test.js test/idle-unconfirmed-decayed-619.test.js test/inject-redeliver.test.js test/provenance.test.js test/inject-audit-broker-seam.test.js test/inject-provenance-daemon.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js && git diff --exit-code tests/snippet-protocol/v1/",
+    "test:watch": "node --require ./test-support/setup-env.js --test --watch test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/daemon-harness-port.test.js test/daemon-bind-default.test.js test/integration/daemon-launch.test.js test/cli.test.js test/subcommand-help.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/inject-consumption-evidence.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/uninstall.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/daemon-restart-fallback-15.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/idle-unconfirmed-settle.test.js test/idle-unconfirmed-consumption.test.js test/idle-unconfirmed-decayed-619.test.js test/inject-redeliver.test.js test/provenance.test.js test/inject-audit-broker-seam.test.js test/inject-provenance-daemon.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js",
+    "test:ci": "node --require ./test-support/setup-env.js --test --test-reporter=spec test/auth.test.js test/http-auth.test.js test/broker-protocol.test.js test/broker-auth.test.js test/broker-server.test.js test/broker-client.test.js test/daemon-broker-wiring.test.js test/broker-cli.test.js test/broker-integration.test.js test/daemon.test.js test/daemon-singleton.test.js test/daemon-harness-port.test.js test/daemon-bind-default.test.js test/integration/daemon-launch.test.js test/cli.test.js test/subcommand-help.test.js test/telepty-kill.test.js test/idle-ttl.test.js test/telepty-clean-older-than.test.js test/lifecycle-transport-agnostic.test.js test/skill-installer.test.js test/interactive-terminal.test.js test/runtime-info.test.js test/session-routing.test.js test/session-state.test.js test/session-store-persistence.test.js test/mailbox-lock.test.js test/report-enforcement.test.js test/enforce-report.test.js test/peer-inject-validator.test.js test/enforce-submit-gate.test.js test/submit-gate.test.js test/submit-via-pty.test.js test/submit-render-gate.test.js test/prompt-symbol-registry.test.js test/inject-submit-flags.test.js test/inject-submit-force-env.test.js test/inject-consumption-evidence.test.js test/host-spec.test.js test/cross-host-inject.test.js test/cross-machine-ssh-routing.test.js test/init.test.js test/install-service-generation.test.js test/install-broker-service.test.js test/uninstall.test.js test/win-resolve-executable.test.js test/version-handshake.test.js test/ensure-daemon-running.test.js test/daemon-restart-fallback-15.test.js test/win-kill-process.test.js test/daemon-control-port-owner.test.js test/banner-stderr-jq-safety.test.js test/bridge-supervisor-ipc.test.js test/bridge-j3-shim.test.js test/bridge-e2e.test.js test/release-0.4.5-bugfixes.test.js test/idle-unconfirmed-settle.test.js test/idle-unconfirmed-consumption.test.js test/idle-unconfirmed-decayed-619.test.js test/inject-redeliver.test.js test/provenance.test.js test/inject-audit-broker-seam.test.js test/inject-provenance-daemon.test.js test/inject-audit-log.test.js test/inject-audit-daemon.test.js test/inject-audit-cli.test.js && git diff --exit-code tests/snippet-protocol/v1/",
     "typecheck": "tsc --noEmit",
     "regen-fixtures": "node scripts/regen-snippet-fixtures.js"
   },
@@ -61,7 +61,7 @@
   ],
   "author": "dmsdc-ai",
   "license": "ISC",
-  "description": "Universal terminal session bridge \u2014 connect any terminal to any terminal, any machine",
+  "description": "Universal terminal session bridge — connect any terminal to any terminal, any machine",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/dmsdc-ai/aigentry-telepty.git"

package/src/submit-gate.js

@@ -438,6 +438,171 @@ function observeInjectEcho(session, bodyText, opts = {}) {
   return { observed: false, reason: 'no_echo', windows_matched: hits };
 }
 
+// #53: classify whether an injected+submitted body was CONSUMED as a new turn by the
+// recipient TUI, vs QUEUED in a busy composer, vs UNKNOWN. This is the DELIVERY-side dual
+// of #52 (which gates the IDLE signal on consumption evidence). A bare `Submitted via
+// pty_cr` only proves bytes reached the PTY master; a BUSY Claude Code TUI parks the CR'd
+// text in its composer ("Press up to edit queued messages") and never starts a turn, so the
+// sender must be able to tell `queued` from `consumed`.
+//
+// Hard boundary (#53): telepty cannot see inside the TUI's turn loop, so `consumed` is only
+// claimable from OBSERVABLE evidence, and never-false-consumed is conservative:
+//
+//   consumed — the recipient was NOT already busy at the CR and then began a FRESH turn:
+//              an idle→working/thinking transition whose since_ms ≥ submittedAtMs (a genuine
+//              new turn, NOT mere continued output from a turn already running — the leak
+//              that made `last_output_at ≥ submittedAtMs` read a busy queue as success).
+//   queued   — the injected body is still observably PARKED on screen after a short settle
+//              (windowed echo match — #52 technique — tolerates composer line-wrap/borders).
+//              A recipient already busy at the CR can only ever land here (fact 1: busy CR
+//              queues, never fires), never in `consumed`.
+//   unknown  — neither positive signal within the window (conservative default).
+//
+// Pure: DI getState + outputRing-only, DI now/sleep/stripAnsi — no I/O, no daemon coupling.
+async function classifyInjectConsumption(session, bodyText, opts = {}) {
+  const timeoutMs   = Number.isFinite(opts.timeoutMs)   ? opts.timeoutMs   : 1200;
+  const settleMs    = Number.isFinite(opts.settleMs)    ? opts.settleMs    : 250;
+  const intervalMs  = Number.isFinite(opts.intervalMs)  ? opts.intervalMs  : 80;
+  const minChars    = Number.isFinite(opts.minChars)    ? opts.minChars    : 24;
+  const stripAnsi   = typeof opts.stripAnsi === 'function' ? opts.stripAnsi : (s) => s;
+  const now         = typeof opts.now   === 'function' ? opts.now   : () => Date.now();
+  const sleep       = typeof opts.sleep === 'function' ? opts.sleep : (ms) => new Promise((r) => setTimeout(r, ms));
+  const getState    = typeof opts.getState === 'function' ? opts.getState : null;
+  const submittedAtMs = Number.isFinite(opts.submittedAtMs) ? opts.submittedAtMs : now();
+  const sinceBytes  = Number.isFinite(opts.sinceBytes) ? opts.sinceBytes : null;
+
+  const body = normalize(bodyText);
+  if (body.length === 0)        return { status: 'unknown', reason: 'empty_body', waited_ms: 0 };
+  if (body.length < minChars)   return { status: 'unknown', reason: 'body_too_short', waited_ms: 0 };
+  if (!session || !Array.isArray(session.outputRing)) {
+    return { status: 'unknown', reason: 'no_ring', waited_ms: 0 };
+  }
+
+  // Was the recipient ALREADY busy when the CR was written? A busy claude-code TUI parks the
+  // CR'd text and never starts a turn (#53 fact 1), so we may observe `queued` there but must
+  // NEVER claim `consumed` — that is the hard boundary that produced the false success.
+  const initial = getState ? getState() : null;
+  const startedBusy = !!(initial && ACCEPTED_AFTER_SUBMIT_STATES.has(initial.state)
+    && Number.isFinite(initial.since_ms) && initial.since_ms < submittedAtMs);
+
+  const observeParked = () => observeInjectEcho(session, bodyText, { stripAnsi, sinceBytes, minChars });
+
+  const start = now();
+  while (true) {
+    // consumed — only from a non-busy start that produced a fresh idle→working/thinking turn.
+    if (!startedBusy && getState) {
+      const st = getState();
+      if (st && ACCEPTED_AFTER_SUBMIT_STATES.has(st.state)
+          && Number.isFinite(st.since_ms) && st.since_ms >= submittedAtMs) {
+        return { status: 'consumed', reason: `turn_started_${st.state}`, waited_ms: now() - start };
+      }
+    }
+
+    const elapsed = now() - start;
+    // Busy recipient cannot consume — short-circuit to `queued` as soon as the parked body
+    // settles, instead of waiting out the full window for a turn that will never come.
+    if (startedBusy && elapsed >= settleMs) {
+      const echo = observeParked();
+      if (echo.observed) return { status: 'queued', reason: 'busy_parked', waited_ms: elapsed };
+    }
+
+    if (elapsed >= timeoutMs) {
+      const echo = observeParked();
+      if (echo.observed) {
+        return { status: 'queued', reason: startedBusy ? 'busy_parked' : 'body_parked', waited_ms: elapsed };
+      }
+      return { status: 'unknown', reason: startedBusy ? 'busy_no_evidence' : 'no_turn', waited_ms: elapsed };
+    }
+    await sleep(intervalMs);
+  }
+}
+
+// #617 hold-and-redeliver — close the gap between #53 DETECTION and ACTION.
+//
+// A recipient that is BUSY when the inject CR is written parks the body in its
+// composer ("Press up to edit queued messages") and never starts a turn (#53 fact 1).
+// classifyInjectConsumption already DETECTS this (`queued`), but 0.6.4 only reports
+// the status — the worker's `telepty inject` never reads it and exits, so the parked
+// REPORT turn is silently dropped. This loop is the ACTION: hold the parked body,
+// wait for the recipient's busy→idle transition, then re-fire the CR so the queued
+// turn finally fires. The body is ALREADY in the composer, so a bare CR (fireCR)
+// fires it — never re-inject the body (that would duplicate text).
+//
+// Invariants:
+//   - bounded: at most `maxAttempts` CR re-fires AND a `totalTimeoutMs` deadline —
+//     never an unbounded redeliver loop (Rule 27: redelivery is the fix, not a
+//     forever-retry workaround).
+//   - never-double-deliver: re-fire ONLY while the body is still parked
+//     (`isStillParked`, reusing #52/#53 echo observation at the daemon seam). The
+//     gate is checked before the idle wait AND again right after idle — a turn that
+//     auto-consumed the queue as it ended must not get a second CR.
+//   - back-compat: the daemon runs this DETACHED from the /submit response; a caller
+//     that ignores `consumption` is wholly unaffected.
+//
+// Pure: every effect (idle watch, parked check, CR fire) is injected; DI now. No
+// daemon coupling — the daemon wires real implementations, tests wire doubles.
+//
+// @param {{
+//   waitForIdle: (remainingMs: number) => Promise<{ ready: boolean, reason?: string }>,
+//   isStillParked: () => boolean,
+//   fireCR: () => Promise<{ redelivered: boolean, reason?: string }>,
+//   maxAttempts?: number, totalTimeoutMs?: number,
+//   onAttempt?: Function, onExhausted?: Function, now?: Function
+// }} opts
+// @returns {Promise<{ status: 'redelivered'|'already_consumed'|'exhausted', reason: string, attempts: number, waited_ms: number }>}
+async function holdAndRedeliver(opts = {}) {
+  const maxAttempts    = Number.isFinite(opts.maxAttempts)    ? opts.maxAttempts    : 3;
+  const totalTimeoutMs = Number.isFinite(opts.totalTimeoutMs) ? opts.totalTimeoutMs : 600000;
+  const now           = typeof opts.now === 'function' ? opts.now : () => Date.now();
+  const waitForIdle   = typeof opts.waitForIdle === 'function' ? opts.waitForIdle : null;
+  const isStillParked = typeof opts.isStillParked === 'function' ? opts.isStillParked : () => true;
+  const fireCR        = typeof opts.fireCR === 'function' ? opts.fireCR : null;
+  const onAttempt     = typeof opts.onAttempt === 'function' ? opts.onAttempt : () => {};
+  const onExhausted   = typeof opts.onExhausted === 'function' ? opts.onExhausted : () => {};
+
+  const start = now();
+  if (!waitForIdle || !fireCR) {
+    return { status: 'exhausted', reason: 'no_dependencies', attempts: 0, waited_ms: 0 };
+  }
+
+  let attempts = 0;
+  while (attempts < maxAttempts) {
+    if (now() - start >= totalTimeoutMs) {
+      onExhausted({ reason: 'deadline', attempts });
+      return { status: 'exhausted', reason: 'deadline', attempts, waited_ms: now() - start };
+    }
+
+    // never-double-deliver (pre-wait): if the body already left the composer, stop.
+    if (!isStillParked()) {
+      return { status: 'already_consumed', reason: 'not_parked', attempts, waited_ms: now() - start };
+    }
+
+    const remaining = totalTimeoutMs - (now() - start);
+    const idle = await waitForIdle(remaining);
+    if (!idle || !idle.ready) {
+      onExhausted({ reason: (idle && idle.reason) || 'idle_timeout', attempts });
+      return { status: 'exhausted', reason: 'idle_timeout', attempts, waited_ms: now() - start };
+    }
+
+    // never-double-deliver (post-idle): the turn that just ended may have auto-fired
+    // the queued body. Re-check before committing a CR.
+    if (!isStillParked()) {
+      return { status: 'already_consumed', reason: 'consumed_on_idle', attempts, waited_ms: now() - start };
+    }
+
+    attempts++;
+    onAttempt({ attempt: attempts });
+    const fired = await fireCR();
+    if (fired && fired.redelivered) {
+      return { status: 'redelivered', reason: fired.reason || 'consumed', attempts, waited_ms: now() - start };
+    }
+    // still queued/unknown — loop to await the next idle window (bounded by maxAttempts).
+  }
+
+  onExhausted({ reason: 'max_attempts', attempts });
+  return { status: 'exhausted', reason: 'max_attempts', attempts, waited_ms: now() - start };
+}
+
 function isAcceptedSubmitState(state, submittedAtMs) {
   if (!state || !ACCEPTED_AFTER_SUBMIT_STATES.has(state.state)) return false;
   if (!Number.isFinite(submittedAtMs)) {
@@ -613,6 +778,8 @@ module.exports = {
   confirmSubmitAccepted,
   observeBodyVisibility,
   observeInjectEcho,
+  classifyInjectConsumption,
+  holdAndRedeliver,
   awaitPromptSymbol,
   defaultReadScreen,
   isReady,