polygram 0.12.0-rc.37 → 0.12.0-rc.39

package/lib/claude-bin.js

@@ -7,14 +7,20 @@ const fs = require('fs');
 // 0.12 Phase 4: moved from lib/process/tmux-process.js into the helper module
 // that consumes it, so the constant survives TmuxProcess deletion. CliProcess
 // + spike scripts + polygram boot all import from here now.
-// 0.12.0-rc.18: bumped 2.1.142 → 2.1.158 (latest installed). The dev-channels
-// inbound-message delivery has an intermittent channel-bind race (the bridge
-// pushes user_msg before claude's channel subscription is active → message
-// silently dropped → stuck turn; see docs/0.12.0-known-issues.md). Trying a
-// newer claude to see if the research-preview channels reliability improved,
-// before building polygram-side recovery. Re-validate the channel flow on each
-// bump via tests/e2e-channels-real-claude.test.js.
-const CLAUDE_CLI_PINNED_VERSION = '2.1.158';
+// 0.12.0-rc.18: bumped 2.1.142 → 2.1.158 (latest installed) chasing the
+// dev-channels reliability issues (see docs/0.12.0-known-issues.md).
+// 0.12.0-rc.38: bumped 2.1.158 → 2.1.173. Two reasons: (1) the ~32s startup
+// deaths root-caused 2026-06-11 to a stale MCP connect-timeout racing the
+// --resume session-id swap — a newer claude may fix the timer (2.1.173 also
+// adds "Channel notifications re-registered after reconnect"); (2) keep the
+// research-preview channels current. Per-bump re-validation done 2026-06-11:
+// resume-dialog env vars survive (CLAUDE_CODE_RESUME_THRESHOLD_MINUTES /
+// _TOKEN_THRESHOLD), trust + dev-channels dialogs unchanged, "esc to
+// interrupt" hint unchanged (template-rendered), but the channels READY
+// banner text CHANGED → readySignal in cli-process.js matches both forms.
+// Re-validate the channel flow on each bump via
+// tests/e2e-channels-real-claude.test.js (run with E2E_REAL_CLAUDE=1).
+const CLAUDE_CLI_PINNED_VERSION = '2.1.173';
 
 /**
  * Resolve + verify the pinned claude CLI binary.

package/lib/error/classify.js

@@ -207,12 +207,14 @@ const CODES = {
     isTransient: false,
     autoRecover: null,
   },
-  // TURN_TIMEOUT: 10-min wall-clock cap on a single channels turn. Mirror
-  // of the tmux wall-clock ceiling — typically a runaway, not a wedge.
-  // Not transient (auto-retry would just runaway again).
+  // TURN_TIMEOUT: per-turn time cap (idle default 10 min, configurable per
+  // chat/topic — UMI runs 60 min). Mirror of the tmux wall-clock ceiling —
+  // typically a runaway, not a wedge. Not transient (auto-retry would just
+  // runaway again). Copy must not name a number: the 2026-06-11 UMI false-⏱
+  // rendered "10-minute" under a 60-minute cap.
   TURN_TIMEOUT: {
     kind: 'turnTimeout',
-    userMessage: '⏱ The turn ran past the 10-minute cap. Resend if the answer still matters.',
+    userMessage: '⏱ This one ran past its time cap with no reply. Resend if the answer still matters.',
     isTransient: false,
     autoRecover: null,
   },

package/lib/handlers/abort.js

@@ -8,14 +8,16 @@
  *   1. Mark the session aborted BEFORE the SDK interrupt fires —
  *      pm-sdk's close handler races; if we marked after, the
  *      generic error-reply could slip through.
- *   2. pm.interrupt() — non-destructive cancel of the in-flight
- *      turn (preserves Query for the next user message).
+ *   2. Tiered cancel (cheap by default, 2026-06-12): in-place
+ *      interrupt keeps the proc warm (no --resume); kill only for
+ *      ghosts / detached background shells / unverifiable state.
  *   3. pm.drainQueue() — rejects queued pendings with
  *      err.code='INTERRUPTED' so the abort-grace classifier
  *      suppresses error replies on the way out.
  *   4. Clear ✍ reactions on already-autosteered messages from
  *      this turn (now dead context).
- *   5. Acknowledge in the language the user aborted in (en/ru).
+ *   5. Acknowledge with a 👍 reaction on the stop message when
+ *      something was stopped; silence otherwise. Never text.
  *
  * Returns true when the message was handled as an abort, false
  * otherwise. Caller short-circuits on true.
@@ -33,6 +35,9 @@ function createHandleAbort({
   clearAutosteeredReactions,
   getSessionKey,
   botName,
+  // Cancel-cheap (spec Finding 5): delay before the second background-shell
+  // probe — catches a shell whose TUI mode-line hadn't rendered at probe #1.
+  dualProbeDelayMs = 1000,
   logger = console,
 } = {}) {
 
@@ -100,21 +105,59 @@ function createHandleAbort({
     // classifier suppresses their error replies AND each turn's finally clears
     // its reactor + typing), THEN stop the live work.
     pm.drainQueue(sessionKey, 'INTERRUPTED');
+    // Cancel-cheap tiered gate (docs/0.13-cancel-efficiency-and-delete-trigger-
+    // spec.md, locked 2026-06-12; supersedes the 2026-06-04 always-kill
+    // decision). kill→--resume is the resume-death-race path AND a full
+    // re-prefill on aged sessions, so the cli backend now interrupts IN PLACE
+    // (C-c; claude stays resident, next message reuses the warm proc — live-
+    // verified on 2.1.173: subagents die with the turn) and kills ONLY when
+    // an in-place interrupt genuinely can't reach the work:
+    //   - a GHOST busy-state (no pending turn but still streaming — interrupt
+    //     can't clear its feedback; the close-drain can),
+    //   - detached run_in_background shells (they survive C-c — live-verified;
+    //     the pane scrape false-negatives, so cross-check the bg-work watchdog
+    //     and dual-probe, and FAIL TOWARD KILL when unverifiable).
+    let cancelMode = 'none';
+    let killReason = null;
     if (hadActive && proc && proc.backend === 'cli') {
-      // Channels HARD stop (user decision 2026-06-04: "/stop should stop
-      // everything including background, like the SDK backend"). A soft C-c
-      // interrupt leaves detached background shells + subagents running and
-      // can't clear a ghost (no-pending-turn) busy state — the symptom was
-      // "Stopped." with the reaction + typing still going. Kill the session: the
-      // whole process tree (claude + every subagent + all background shells)
-      // dies at once, the close drains the in-flight turn (clearing its
-      // reactor/typing), and the next message respawns fresh (--resume restores
-      // the conversation). This is what makes channels /stop "stop everything".
-      await pm.kill(sessionKey, 'abort').catch((err) =>
-        logger.error?.(`[${botName}] abort kill failed: ${err.message}`));
+      let mustKill = false;
+      if (!proc.inFlight) {
+        // hadActive came from the busy probe with no pending turn = ghost.
+        mustKill = true; killReason = 'ghost';
+      } else if (typeof proc.probeBusyState !== 'function') {
+        mustKill = true; killReason = 'no-probe';
+      } else {
+        try {
+          const p1 = busyProbe || await proc.probeBusyState();
+          let bg = !!p1?.backgroundShell;
+          if (!bg && typeof proc.hasActiveBackgroundWork === 'function'
+              && await proc.hasActiveBackgroundWork()) {
+            bg = true;
+          }
+          if (!bg) {
+            await new Promise((r) => setTimeout(r, dualProbeDelayMs));
+            const p2 = await proc.probeBusyState();
+            bg = !!p2?.backgroundShell;
+          }
+          if (bg) { mustKill = true; killReason = 'background-shell'; }
+        } catch (err) {
+          logger.error?.(`[${botName}] cancel bg-probe failed: ${err.message}`);
+          mustKill = true; killReason = 'probe-failed';
+        }
+      }
+      if (mustKill) {
+        cancelMode = 'kill';
+        await pm.kill(sessionKey, 'abort').catch((err) =>
+          logger.error?.(`[${botName}] abort kill failed: ${err.message}`));
+      } else {
+        cancelMode = 'interrupt';
+        await pm.interrupt(sessionKey).catch((err) =>
+          logger.error?.(`[${botName}] interrupt failed: ${err.message}`));
+      }
     } else {
       // SDK (or nothing active): non-destructive interrupt cancels the in-flight
       // Query turn WITHOUT tearing down the Query (cheap to reuse next message).
+      if (hadActive) cancelMode = 'interrupt';
       await pm.interrupt(sessionKey).catch((err) =>
         logger.error?.(`[${botName}] interrupt failed: ${err.message}`));
     }
@@ -123,6 +166,10 @@ function createHandleAbort({
     logEvent('abort-requested', {
       chat_id: chatId, user_id: msg.from?.id || null,
       had_active: hadActive,
+      // Cancel-cheap soak signals: which tier fired, and why a kill was chosen
+      // (ghost / background-shell / no-probe / probe-failed / null).
+      cancel_mode: cancelMode,
+      kill_reason: killReason,
       killed_background_shell: killedBackgroundShell,
       // "Stop" incident forensics: the raw busy-probe signals at decision
       // time. Lets us query, across real aborts, where the esc-hint /
@@ -140,35 +187,22 @@ function createHandleAbort({
       trigger: cleanText.slice(0, 40),
     });
 
-    // Reply in the same language the user aborted in. Cyrillic-
-    // detection is crude but reliable for ru/en.
-    const lang = /[а-яё]/i.test(cleanText) ? 'ru' : 'en';
-    const strs = {
-      en: {
-        stopped: 'Stopped.',
-        bgStopped: 'Stopped the background task.',
-        nothing: 'Nothing to stop.',
-      },
-      ru: {
-        stopped: 'Остановлено.',
-        bgStopped: 'Фоновая задача остановлена.',
-        nothing: 'Нечего останавливать.',
-      },
-    }[lang];
-    // Truthful ack: a stopped in-flight turn → "Stopped"; a stopped
-    // background shell → "Stopped the background task"; neither →
-    // "Nothing to stop".
-    const reply = hadActive ? strs.stopped
-      : killedBackgroundShell ? strs.bgStopped
-      : strs.nothing;
-    try {
-      await tg(bot, 'sendMessage', {
-        chat_id: chatId, text: reply,
-        reply_parameters: { message_id: msg.message_id, allow_sending_without_reply: true },
-        ...(threadId && { message_thread_id: threadId }),
-      }, { source: 'abort-ack', botName });
-    } catch (err) {
-      logger.error?.(`[${botName}] abort-ack send failed: ${err.message}`);
+    // Ack (locked design 2026-06-12, Ivan): a 👍 reaction on the user's stop
+    // message when something was actually stopped — NEVER a text reply. The
+    // old "Stopped." text was eventually-true at best (the interrupt settles
+    // up to graceMs later) and chat noise at worst; the reaction is just
+    // "got it, stopping" and is language-neutral. Nothing-to-stop → complete
+    // silence (a 👍 there would lie).
+    if (hadActive || killedBackgroundShell) {
+      try {
+        await tg(bot, 'setMessageReaction', {
+          chat_id: chatId,
+          message_id: msg.message_id,
+          reaction: [{ type: 'emoji', emoji: '👍' }],
+        }, { source: 'abort-ack', botName });
+      } catch (err) {
+        logger.error?.(`[${botName}] abort-ack reaction failed: ${err.message}`);
+      }
     }
     return true;
   };

package/lib/process/cli-process.js

@@ -122,7 +122,10 @@ const DEFAULT_QUEUE_CAP = 50;                // Parity P2: match SDK/tmux pendin
 // catalog when new dialogs are observed in production.
 const SESSION_AGE_PROMPT_RE = /Resuming the full session[\s\S]*Resume from summary/i;
 const MID_TURN_PROMPTS = [
-  { name: 'session-age', regex: SESSION_AGE_PROMPT_RE, action: 'enter' },
+  // Review F2 (resume-dialog fix): bare Enter selects the pre-selected
+  // "Resume from summary" — which literally runs /compact. Navigate to
+  // "Resume full session as-is" instead, same as the startup-gate trigger.
+  { name: 'session-age', regex: SESSION_AGE_PROMPT_RE, action: 'keys', keys: ['Down', 'Enter'] },
 ];
 
 // 0.12 Phase 3.2 (Finding 0.1.A): rc.45 esc-to-interrupt liveness heartbeat.
@@ -864,6 +867,20 @@ class CliProcess extends Process {
       cwd: resolvedCwd || opts.cwd || process.cwd(),
       command: this.claudeBin,
       args: claudeArgs,
+      envExtras: {
+        // Resume-dialog suppression (docs/0.13-resume-dialog-fix-spec.md B1):
+        // claude's session-age "resume-return" dialog fires when sessionAge ≥
+        // this many minutes AND est. tokens ≥ CLAUDE_CODE_RESUME_TOKEN_THRESHOLD
+        // (defaults 70 / 1e5, binary-verified on 2.1.158). Its pre-selected
+        // option literally runs /compact — silently compacting every aged
+        // --resume (and breaking the /model "conversation kept" guarantee).
+        // A huge threshold (1 year) means the dialog never triggers and resume
+        // is always full-session-as-is. Per-process env — the operator's own
+        // interactive claude is untouched. Belt-and-braces: the session-age
+        // gate trigger below still navigates to "full" if a future binary bump
+        // renames this var.
+        CLAUDE_CODE_RESUME_THRESHOLD_MINUTES: '525600',
+      },
     });
 
     // Dialog handling (Phase 0 finding) — poll capture-pane and Enter through:
@@ -880,7 +897,7 @@ class CliProcess extends Process {
    * lives in the shared helper.
    */
   async _handleStartupDialogs(tmuxName) {
-    await runStartupGate({
+    const gateResult = await runStartupGate({
       runner: this.runner,
       tmuxName,
       triggers: [
@@ -893,15 +910,33 @@ class CliProcess extends Process {
         // pre-selected "trust" option). The older "trust the files in this folder"
         // wording is kept for back-compat; both anchor on "trust … this folder".
         { name: 'trust',        regex: /trust (?:the files in )?this folder/i,    key: 'Enter' },
-        // Review F#12: session-age "Resume from summary?" prompt — fires on
-        // aged sessions (claude treats older session JSONLs differently).
-        // Tmux backend dismisses with Enter at tmux-process.js:2637 onward;
-        // mirror that here so an aged channels session doesn't hang the
-        // handshake until CHANNELS_HANDSHAKE_TIMEOUT (15s) → dead chat
-        // requiring manual /reset.
-        { name: 'session-age',  regex: SESSION_AGE_PROMPT_RE, key: 'Enter' },
+        // Review F#12 + 2026-06-11 resume-dialog fix: session-age
+        // "resume-return" prompt on aged sessions. Bare Enter selects the
+        // pre-selected "Resume from summary" — which literally runs /compact
+        // on the resumed session (silent context degradation; the original
+        // F#12 dismissal compacted every aged resume). Navigate to option 2
+        // "Resume full session as-is" instead. This is the FALLBACK path:
+        // spawn env (CLAUDE_CODE_RESUME_THRESHOLD_MINUTES above) suppresses
+        // the dialog entirely; this trigger firing at all means suppression
+        // failed (upstream renamed the env var?) — surfaced via the
+        // session-age-dialog-fallback event below.
+        { name: 'session-age',  regex: SESSION_AGE_PROMPT_RE, keys: ['Down', 'Enter'] },
       ],
-      readySignal: /Listening for channel messages from: server:polygram-bridge/i,
+      // 2.1.173 reworked the channels UI banner (live-captured 2026-06-11):
+      // "Channels (experimental) messages from server:polygram-bridge inject
+      // directly in this session · …". Keep the 2.1.158 text too so a
+      // POLYGRAM_CLAUDE_BIN override to an older binary still gates correctly.
+      //
+      // 2026-06-12 (caught by the cancel-cheap E2E before prod): in 2.1.173
+      // the banner lives in a COLLAPSIBLE notice list — with ≥3 notices the
+      // pane shows "+N more · /status" and the banner is hidden, stalling a
+      // banner-only gate into a false CHANNELS_DIALOG_TIMEOUT. An interactive
+      // prompt footer ("(shift+tab to cycle)" / "? for shortcuts") with no
+      // pending dialog is equally READY: the gate's job is dialog navigation;
+      // channel liveness is separately guaranteed by mcp-ready (send() gate)
+      // + the delivery watchdog. Dialog panes render "Enter to confirm"
+      // instead of the footer, so the footer can't match mid-dialog.
+      readySignal: /(?:Listening for channel messages from:|Channels \(experimental\) messages from) server:polygram-bridge|shift\+tab to cycle|\? for shortcuts/i,
       timeoutCode: 'CHANNELS_DIALOG_TIMEOUT',
       // Progress-aware gate (shumorobot General incident 2026-05-30): a
       // cold spawn that's mid-download (runtime fetch, "24%" progress bar)
@@ -917,9 +952,25 @@ class CliProcess extends Process {
       // only bounds a TUI that rendered and then truly hung.
       stallMs: this.startupGateStallMs ?? 60_000,
       deadlineMs: this.startupGateDeadlineMs ?? 180_000,
+      // Review F4: fire-time, NOT gate-resolution — the 2026-06-10 incident
+      // matched session-age and THEN died (TMUX_SESSION_GONE), which a
+      // success-path check would miss. The dialog appearing AT ALL means the
+      // env suppression (CLAUDE_CODE_RESUME_THRESHOLD_MINUTES in
+      // _spawnTmuxClaude) stopped working — almost certainly an upstream
+      // rename on a binary bump. The gate handles it (full resume picked);
+      // this makes the regression visible.
+      onTrigger: (name) => {
+        if (name !== 'session-age') return;
+        this.logger.warn?.(
+          `[${this.label}] channels: session-age resume dialog appeared despite env suppression — ` +
+          'check CLAUDE_CODE_RESUME_THRESHOLD_MINUTES against the pinned claude binary',
+        );
+        this._logEvent('session-age-dialog-fallback', { tmux_name: tmuxName, phase: 'startup-gate' });
+      },
       logger: this.logger,
       label: `${this.label}:startup-gate`,
     });
+    return gateResult;
   }
 
   // 0.12 Phase 1.6: TWO-handshake gate. The original implementation only
@@ -1201,6 +1252,34 @@ class CliProcess extends Process {
       return;
     }
 
+    // Dropped-"4" fix A2 (docs/0.13-resume-dialog-fix-spec.md): resolve the
+    // reply's originating TG message so the dispatcher has a target for solo
+    // reactions (and reply-quoting). Resolution order strictly mirrors
+    // _recordReplyForPendingTurn so quote/reaction attribution can never
+    // disagree with reply attribution: echoed turn_id → InputLedger entry's
+    // msgId (registered at send/inject time); no echo → the single pending
+    // turn's ledger entry. Anything else stays null — an unattributable
+    // reply must never react to / quote an unrelated message.
+    //
+    // Review F1: quote only the FIRST delivered reply per turn. On SDK,
+    // deliverReplies fires once per turn → one quote; the channels dispatcher
+    // fires per reply tool call, and an N-reply turn must not produce N
+    // bubbles all quoting the same user message.
+    let sourceMsgId = null;
+    let sourceEntry = null;
+    if (args.turn_id && this.inputLedger.has(args.turn_id)) {
+      sourceEntry = this.inputLedger.get(args.turn_id);
+    } else if (this.pendingTurns.size === 1) {
+      const [[onlyTurnId]] = this.pendingTurns;
+      sourceEntry = this.inputLedger.get(onlyTurnId) || null;
+    }
+    if (sourceEntry && !sourceEntry._quoteUsed) {
+      // Review F6: ledger stores msgId stringified; every other delivery call
+      // site passes numeric message_id — coerce rather than lean on TG leniency.
+      const n = Number(sourceEntry.msgId);
+      sourceMsgId = Number.isFinite(n) && n > 0 ? n : null;
+    }
+
     let result;
     try {
       result = await this.toolDispatcher({
@@ -1211,6 +1290,7 @@ class CliProcess extends Process {
         text: args.text,
         files: args.files,
         messageId: args.message_id,         // 0.13: edit_message target bubble
+        sourceMsgId,                        // reaction/quote target (A2)
         sessionCwd: this.sessionCwd,        // P0 #2: dispatcher uses this to allowlist file roots
         maxOutboundFileBytes: this.maxOutboundFileBytes, // backend/chat-derived upload cap
       });
@@ -1219,6 +1299,12 @@ class CliProcess extends Process {
       return;
     }
 
+    // Review F1: the quote target is spent once a reply actually delivered
+    // with it. A FAILED delivery doesn't consume it — the retry still quotes.
+    if (msg.name === 'reply' && result?.ok && sourceMsgId != null && sourceEntry) {
+      sourceEntry._quoteUsed = true;
+    }
+
     // 0.13: carry the delivered message_id back so the bridge hands it to claude
     // (reply → edit_message progressive status).
     this._writeToBridge({ kind: 'tool_ack', tool_call_id: msg.tool_call_id, ok: !!result?.ok, error: result?.error, message_id: result?.message_id });
@@ -1449,6 +1535,21 @@ class CliProcess extends Process {
         this._ledgerTransition(id, 'resolved');
         this._logEvent('cli-input-acked', { turn_id: id, source: e.source });
       }
+      // UMI 2026-06-11 19:49 false ⏱ timeout: when claude answers a
+      // primary+fold in ONE reply but echoes the FOLD's turn_id, the reply
+      // routes via late-reply correlation and the PRIMARY pending absorbs
+      // nothing — yet this ack names the primary. Mark it consumed so the
+      // finalizer rungs treat it as replied (resolve already-delivered)
+      // instead of rejecting it at a ceiling AFTER the user got the answer.
+      const pending = this.pendingTurns.get(id);
+      if (pending) {
+        pending._consumedAcked = true;
+        // The ack itself flips rung-2 eligibility on — arm now. (The turn's
+        // last _noteActivity ran BEFORE this flag was set, so without this
+        // a quiet tail would never re-arm and the turn would sit until a
+        // ceiling.)
+        this._armActivityQuiet(id, pending);
+      }
     }
   }
 
@@ -1607,7 +1708,10 @@ class CliProcess extends Process {
    */
   _armActivityQuiet(turnId, pending) {
     if (!this._sawHookStream) return;
-    if (!pending.replies || pending.replies.length === 0) return;
+    // ≥1 reply, OR seen + consumed-acked (the answer rode a sibling turn_id —
+    // fold-id echo; see _ledgerAckConsumed). Same eligibility as the fire site.
+    if ((!pending.replies || pending.replies.length === 0)
+        && !(pending.seen === true && pending._consumedAcked === true)) return;
     if (this._openQuestions.size > 0) return;
     if (pending._stopGracePending) return;
     if (pending._activityQuietTimer) clearTimeout(pending._activityQuietTimer);
@@ -1637,11 +1741,15 @@ class CliProcess extends Process {
     if (!pending) return;
     if (pending._stopGracePending) return;
     if (this._openQuestions.size > 0) return;          // re-check at fire time
-    if (!pending.replies || pending.replies.length === 0) return;
+    // Eligibility: ≥1 bound reply, OR seen + consumed-acked (the answer went
+    // out under a sibling turn_id — fold-id echo; see _ledgerAckConsumed).
+    const consumedAcked = pending.seen === true && pending._consumedAcked === true;
+    if ((!pending.replies || pending.replies.length === 0) && !consumedAcked) return;
     const lastHookAgeMs = this._lastHookEventAt ? Date.now() - this._lastHookEventAt : null;
     this._logEvent('cli-activity-quiet-finalize', {
       turn_id: turnId,
       reply_count: pending.replies.length,
+      consumed_acked: consumedAcked,
       last_hook_age_ms: lastHookAgeMs,
       had_stop: !!pending._stopHookData,
     });
@@ -1792,8 +1900,11 @@ class CliProcess extends Process {
       // BUT a turn finalized via the Stop fallback (no reply tool calls — the
       // stuck-turn case) has delivered NOTHING; marking it alreadyDelivered
       // would resolve the turn silently and the user still sees nothing. So
-      // only claim already-delivered when reply tool calls actually fired.
-      alreadyDelivered: hadReplyToolCalls,
+      // only claim already-delivered when reply tool calls actually fired —
+      // or when claude ACKED consuming this turn in a sibling reply
+      // (consumed_turn_ids; the fold-id-echo case): re-sending the Stop
+      // fallback there would duplicate the delivered answer.
+      alreadyDelivered: hadReplyToolCalls || pending._consumedAcked === true,
       sessionId: this.claudeSessionId,
       cost: null,             // Channels protocol doesn't expose per-turn cost
       duration,
@@ -1931,10 +2042,14 @@ class CliProcess extends Process {
         // would send a scary timeout error AFTER a successful reply (round-2
         // panel finding: the v2 soak gate contradicted the design's own
         // ask-timeout-then-ceiling path). TURN_TIMEOUT rejection is reserved
-        // for turns with ZERO delivered replies.
-        if ((pending.replies?.length || 0) > 0) {
+        // for turns with ZERO delivered replies. Consumed-acked counts as
+        // replied: the answer rode a sibling turn_id (fold-id echo — the UMI
+        // 2026-06-11 19:49 false ⏱; see _ledgerAckConsumed).
+        if ((pending.replies?.length || 0) > 0
+            || (pending.seen === true && pending._consumedAcked === true)) {
           this._logEvent('cli-turn-ceiling-resolved', {
-            reason, turnTimeoutMs, reply_count: pending.replies.length,
+            reason, turnTimeoutMs, reply_count: pending.replies?.length || 0,
+            consumed_acked: pending._consumedAcked === true,
           });
           this.emit('idle');
           resolve({
@@ -2042,6 +2157,13 @@ class CliProcess extends Process {
   async interrupt() {
     if (this.closed) return;
     if (!this.tmuxSession) return;
+    // Cancel-cheap C2 (spec Finding 7): a cancel is already in flight — a
+    // SECOND C-c would land at the now-idle prompt, which is claude's exit
+    // chord ("press ctrl+c again to exit") and would convert the cheap cancel
+    // into an accidental process exit. Also: resetting the grace timer would
+    // DELAY the synthetic resolution for a user double-tapping "stop".
+    // Idempotent no-op instead.
+    if (this._interruptGraceTimer) return;
     // tmux SIGINT — hard interrupt for the running turn.
     try {
       await this.runner.sendControl(this.tmuxSession, 'C-c');
@@ -2052,18 +2174,37 @@ class CliProcess extends Process {
     this.emit('interrupt-applied', { backend: this.backend });
     this._logEvent('interrupt-applied', {});
 
+    // Cancel-cheap C1 — the spec's O2 BLOCKER: the cancelled work's inputs
+    // must never re-deliver. The grace below synthesizes the resolution
+    // WITHOUT _finalizeTurn, so without this, an autosteer/fold entry stays
+    // 'written' and a LATER cycle-end sweep declares it dropped →
+    // drop-redeliver re-injects the user's CANCELLED message minutes later.
+    // 'cancelled' is terminal: the sweep only targets 'written', and
+    // _ledgerTransition clears the entry's drop/watchdog timers.
+    for (const [id, e] of this.inputLedger) {
+      if (e.state === 'written' || e.state === 'seen') {
+        this._ledgerTransition(id, 'cancelled');
+        this._logEvent('cli-input-cancelled', { turn_id: id, source: e.source });
+      }
+    }
+
     // Review P3 C8: after Ctrl-C, Claude may or may not call reply with an
     // "I was interrupted" message. If it doesn't (5s grace), resolve pending
     // turns with subtype 'interrupted' instead of letting them wait the full
-    // 10-min hardTimer. The grace window is reset if a new interrupt fires.
-    if (this._interruptGraceTimer) clearTimeout(this._interruptGraceTimer);
+    // 10-min hardTimer.
     this._interruptGraceTimer = setTimeout(() => {
       let resolvedAny = false;
       for (const [turnId, pending] of this.pendingTurns) {
         // Synthesize an interrupted resolution: empty text, 'interrupted' subtype.
+        // Cancel-cheap C3: clear ALL per-pending machinery (mirrors
+        // _finalizeTurn) — stray timers/listeners on the kept-warm proc are
+        // exactly what the cheap-cancel design must not leak.
         if (pending.quietTimer) clearTimeout(pending.quietTimer);
         if (pending.hardTimer) clearTimeout(pending.hardTimer);
-      if (pending.absoluteTimer) clearTimeout(pending.absoluteTimer);
+        if (pending.absoluteTimer) clearTimeout(pending.absoluteTimer);
+        if (pending._stopGraceTimer) clearTimeout(pending._stopGraceTimer);
+        if (pending._activityQuietTimer) clearTimeout(pending._activityQuietTimer);
+        if (pending._onStop) { this.off('stop-hook', pending._onStop); pending._onStop = null; }
         this.pendingTurns.delete(turnId);
         const qIdx = this.pendingQueue.findIndex(e => e.turnId === turnId);
         if (qIdx >= 0) this.pendingQueue.splice(qIdx, 1);
@@ -3389,16 +3530,28 @@ class CliProcess extends Process {
         pending_count: this.pendingTurns.size,
       });
 
-      if (prompt.action === 'enter') {
-        try {
-          await this.runner.sendControl(this.tmuxSession, 'Enter');
-        } catch (err) {
-          this.logger.warn?.(
-            `[${this.label}] cli: mid-turn dismiss-Enter failed for ${prompt.name}: ${err.message}`,
-          );
+      if (prompt.action === 'enter' || prompt.action === 'keys') {
+        // 'keys' sends a navigation sequence (e.g. Down,Enter to pick a
+        // non-default dialog option); 'enter' stays the single-key dismissal.
+        const keySeq = prompt.action === 'keys' ? prompt.keys : ['Enter'];
+        for (let ki = 0; ki < keySeq.length; ki++) {
+          if (ki > 0) await new Promise(r => setTimeout(r, 120));   // Ink can swallow same-batch keys
+          try {
+            await this.runner.sendControl(this.tmuxSession, keySeq[ki]);
+          } catch (err) {
+            this.logger.warn?.(
+              `[${this.label}] cli: mid-turn ${keySeq[ki]} failed for ${prompt.name}: ${err.message}`,
+            );
+          }
         }
       }
       // 'emit-only': telemetry-only; operator decides next step.
+      // Resume-dialog fix: the session-age dialog escaping to MID-TURN means
+      // env suppression failed AND the startup gate didn't see it — same
+      // soak-queryable event kind as the startup-gate fallback.
+      if (prompt.name === 'session-age') {
+        this._logEvent('session-age-dialog-fallback', { tmux_name: this.tmuxSession, phase: 'mid-turn' });
+      }
     }
 
     // 0.12 Phase 3.3 (Q1 resolution): unknown-prompt heuristic. If the pane

package/lib/telegram/parse.js

@@ -94,8 +94,15 @@ function parseResponse(text, { stickerMap = {}, emojiToSticker = {} } = {}) {
   }
 
   // Solo-emoji shortcuts (single emoji → sticker if mapped, else reaction).
-  const emojiOnly = /^\p{Emoji_Presentation}$/u.test(trimmed)
-    || /^\p{Emoji}️?$/u.test(trimmed);
+  // Keycap-base guard (2026-06-10 "2+2 → 4" dropped reply): Unicode \p{Emoji}
+  // includes 0-9/#/* (keycap bases), so a bare single-digit answer parsed as
+  // a reaction with text:'' and the channels dispatcher dropped it. A solo
+  // digit/hash/asterisk is always TEXT; real keycap emoji (4️⃣) are
+  // multi-codepoint and never hit this branch anyway. The optional ️
+  // also catches a stray variation selector on a digit ("4️") — same class.
+  const emojiOnly = !/^[0-9#*]️?$/.test(trimmed)
+    && (/^\p{Emoji_Presentation}$/u.test(trimmed)
+      || /^\p{Emoji}️?$/u.test(trimmed));
 
   if (emojiOnly && trimmed) {
     if (emojiToSticker[trimmed]) {

package/lib/tmux/startup-gate.js

@@ -60,6 +60,10 @@ const DEFAULT_SETTLE_MS = 500;
  * @param {number} [opts.pollMs=300]
  * @param {number} [opts.settleMs=500]
  * @param {string} [opts.timeoutCode='TUI_STARTUP_TIMEOUT']
+ * @param {Function} [opts.onTrigger]          — (name) => void, called AT FIRE
+ *   TIME (not gate resolution). Telemetry hung off the success-path return
+ *   misses the matched-then-died sequence (2026-06-10 prod: gate matched
+ *   session-age, then TMUX_SESSION_GONE). Errors are swallowed.
  * @param {object} [opts.logger=console]
  * @param {string} [opts.label='startup-gate']
  * @returns {Promise<{matchedTriggers: string[], elapsedMs: number}>}
@@ -74,6 +78,7 @@ async function runStartupGate({
   pollMs = DEFAULT_POLL_MS,
   settleMs = DEFAULT_SETTLE_MS,
   timeoutCode = 'TUI_STARTUP_TIMEOUT',
+  onTrigger = null,
   logger = console,
   label = 'startup-gate',
 } = {}) {
@@ -174,13 +179,22 @@ async function runStartupGate({
     for (const trigger of triggers) {
       if (seen.has(trigger.name)) continue;
       if (!trigger.regex.test(pane)) continue;
-      try {
-        await runner.sendControl(tmuxName, trigger.key);
-      } catch (err) {
-        logger.warn?.(`[${label}] sendControl(${trigger.key}) failed for trigger=${trigger.name}: ${err.message}`);
+      // `keys: [...]` sends a sequence (dialog navigation — e.g. Down,Enter
+      // to pick a non-default option); `key:` remains the single-key form.
+      // Sequence keys go as separate send-keys calls with a short delay —
+      // Ink dialogs can swallow the second key of a same-batch sequence.
+      const keySeq = Array.isArray(trigger.keys) ? trigger.keys : [trigger.key];
+      for (let ki = 0; ki < keySeq.length; ki++) {
+        if (ki > 0) await new Promise(r => setTimeout(r, Math.min(settleMs, 120)));
+        try {
+          await runner.sendControl(tmuxName, keySeq[ki]);
+        } catch (err) {
+          logger.warn?.(`[${label}] sendControl(${keySeq[ki]}) failed for trigger=${trigger.name}: ${err.message}`);
+        }
       }
       seen.add(trigger.name);
       matchedTriggers.push(trigger.name);
+      try { onTrigger?.(trigger.name); } catch { /* telemetry must not break the gate */ }
       matched = true;
       // Sending a key is activity — navigating the TUI counts as progress
       // even if the pre-transition pane text was static (e.g. a dialog we

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "polygram",
-  "version": "0.12.0-rc.37",
+  "version": "0.12.0-rc.39",
   "description": "Telegram daemon for Claude Code that preserves the OpenClaw per-chat session model. Migration path for OpenClaw users moving to Claude Code.",
   "main": "lib/ipc/client.js",
   "bin": {