tokenmaxxing 1.0.2 → 1.1.0

package/DESIGN.md

@@ -99,11 +99,12 @@ A local Socket Mode daemon (no public URL) that turns Slack threads into Claude
 - **Id mapping**: Chat SDK ids are adapter-prefixed (`thread.channelId` = `slack:C0123`, `thread.id` = `slack:C0123:<threadTs>`) while links store bare Slack ids - lookups strip the prefix via `bareChannelId`. Subscriptions live in the daemon's memory state, so every mention re-subscribes its thread; queue-skipped messages (`context.skipped`) fold into the next prompt, with the queue-entry TTL raised to 1h (expiry is silent - no app callback in chat 4.34.0 - so it must outlast a depleted-pool park plus a long turn); per-thread turn serialization is owned by the daemon itself (a promise chain per thread id), because the SDK's queue dispatch lock has a 30s TTL extended only between dispatches and every claude turn outlives it; unlinked-channel traffic logs `serve.unlinked_channel` and stays silent in Slack.
 - **Restart resilience** (0.19.0, from the 2026-07-18 dead-thread incident: a deploy restart cut a turn mid-answer and left the thread deaf to follow-ups): startup re-subscribes every `slack-threads/` record straight on the state adapter (`state.subscribe(threadId)`; message routing checks `stateAdapter.isSubscribed`, verified in chat 4.34.0), so open threads survive restarts without needing a fresh mention. SIGTERM/SIGINT drains instead of dying: new turns are dropped loudly (`serve.drain_dropped` plus a tracked in-thread notice - a log-only drop reads as the bot thinking), tracked in-flight turns get up to 300s to finish (a re-snapshotting wait, so late-added notices still flush), then `Chat.shutdown()`; a second signal forces exit; the drain also aborts any depleted-pool park so a countdown never delays a restart. The claude child spawns detached in its own process group (`detachedClaudeSpawn` via the SDK's `spawnClaudeCodeProcess` hook), because a terminal Ctrl-C signals the whole foreground group and a non-detached child died with the daemon before the drain could save the turn; the signal handlers register before `bot.initialize()` so no turn can start while the process still has default signal disposition, and a rejecting `Chat.shutdown()` is caught so the drain always reaches its exit. When a `thread.post` rejects mid-turn (e.g. Slack finalizes an idle stream: `message_not_in_streaming_state`), relayThread drops the dead segment so the rest of the turn opens fresh messages instead of vanishing.
 - **Interrupted-turn recovery** (from the second 2026-07-18 restart incident: a redeploy killed a ship turn 8 minutes in with zero notice - drain cannot save a long turn, and a group-wide kill can take the claude child even detached): the thread record persists the claude session id the moment the init message assigns it, and every turn is wrapped in a durable `activeTurn` marker (original prompt, start time, resume count) written before the spawn and cleared when the turn returns - except that a turn failing DURING a drain keeps its marker, since that failure is presumed to be the shutdown signal killing the child. On startup, a surviving marker means a restart killed that turn: the daemon posts a notice into the thread (the chat-sdk's documented proactive handle, rebuilt with the thread's newest human message as streaming recipient context so the resumed turn keeps its native task cards, that message's author becoming the turn's requester) and auto-resumes the work - resuming the recorded session with a continuation prompt, or replaying the original prompt fresh when the kill landed before the session opened; resumed turns settle like inbound ones (outcome log + finish_thread GC). Retries cap at 3 (each spends real quota) with a loud give-up notice posted before its marker clears; a per-thread turn lock keeps a startup resume from ever racing an inbound message turn in the same cwd, every recovery branch recomputes its decision from a fresh record reload under that lock (so a resume superseded by a faster inbound turn no-ops instead of double-running), and a blocking singleton flock makes a new daemon generation wait for the previous one - drain included - to fully exit before touching any thread record. Uncatchable deaths cannot leak a working child either: SIGHUP drains like SIGTERM (its default disposition skips the exit hook that kills the detached group), and the marker records the child's group pid plus its C-locale ps start-time token at spawn, so recovery kills only an exactly-identified SIGKILL-orphaned claude (never a recycled pid) before resuming its turn.
-- **Depleted-pool recovery** (harvested from Slaude, reshaped around the pool): relayThread consumes the spawn-boundary switch decision instead of discarding it - a depleted pool with a known recovery inside the message's one 14min parking deadline (shared across chained parks, so the thread's queue slot is never held longer in total) posts a park notice and retries at the reset; unknown or past-deadline recovery posts an honest drop notice (dropping beats a false will-resume promise). A mid-turn limit - detected ONLY on errored results, since `is_error` can ride subtype `"success"` (`Claude AI usage limit reached|<epoch>`) and a successful answer discussing limits must never be re-run - is persisted into usage.json first (`recordObservedLimit`: the serve process has no statusLine tee, and the snapshot TTL would otherwise feed the retry the stale pre-limit state), then retried silently after a short beat, so a pool swap makes the hiccup invisible. Bounded recoveries; every drop the relay performs is announced in-thread.
-- **Slack-native output hygiene**: relayed turns run a small standalone `systemPrompt` telling the model replies render as Slack markdown, never HTML (a live turn once answered with a literal `<br>`; the SDK's default system prompt is minimal since 0.1.0, so the string replaces nothing), and whitespace-only text deltas do not count as reply text for segment breaking (no stranded near-blank messages).
+- **Depleted-pool recovery** (harvested from Slaude, reshaped around the pool): relayThread consumes the spawn-boundary switch decision instead of discarding it - a depleted pool with a known recovery inside the message's one 14min parking deadline (shared across chained parks, so the thread's queue slot is never held longer in total) posts a park notice and retries at the reset. A mid-turn limit - detected ONLY on errored results, since `is_error` can ride subtype `"success"` (`Claude AI usage limit reached|<epoch>`) and a successful answer discussing limits must never be re-run - is persisted into usage.json first (`recordObservedLimit`: the serve process has no statusLine tee, and the snapshot TTL would otherwise feed the retry the stale pre-limit state), then retried silently after a short beat, so a pool swap makes the hiccup invisible. Bounded recoveries; every drop the relay performs is announced in-thread.
+- **Usage-limit auto-resume** (2026-07-21, superseding the drop-beats-false-promise rule for the known-wake case): a turn that ends at a usage limit with a KNOWN recovery time defers instead of dropping. relayThread reports `deferUntil`, the thread's durable activeTurn marker keeps a `resumeAt`, and a per-thread daemon timer (cancelled on drain, re-armed from the record at startup: future wakes schedule, past wakes recover immediately) fires the same interrupted-turn recovery path - serialized chain, fresh-reload supersede check, pool-recovery notice, `resumeDecision` capping total resumes. The defer triggers: known recovery past the parking deadline or recovery budget, retries exhausted while a post-burn pool probe reports a wake, and an unclassifiable child failure (no limit phrase in the error) converted by a pool probe reporting exhaustion - the pool state is the evidence the error text did not carry. Only an unknown recovery time still posts the honest re-send drop.
+- **Slack-native output hygiene**: relayed turns run a small standalone `systemPrompt` telling the model replies render as Slack markdown, never HTML (a live turn once answered with a literal `<br>`; the SDK's default system prompt is minimal since 0.1.0, so the string replaces nothing).
 - **Slash commands** (2026-07-18): a mention-stripped thread message that starts with `/` runs as a claude slash command - the SDK delivers a string prompt as one stream-json user message and the CLI routes a leading-slash prompt through its command table, on fresh and resumed sessions alike (live-verified with free `/usage` and `/context` reads). Local command output (`num_turns` 0) arrives as a non-streamed assistant message plus `result.result`, which relayThread's no-text fallback posts; `slackstream` also maps the documented `system/local_command_output` wire subtype in case a claude update flips the emitter. `/goal` (built-in since 2.1.139) works headless and its active goal is restored on resume, so it survives the per-message resume pattern. Slack gotcha: the composer eats ANY message whose first character is `/` client-side (channels and thread replies; registered app commands cannot even dispatch from threads), so the supported forms are `@bot /usage` (mention-first) and ` /usage` (leading space, Slack's own documented workaround) - both normalize to a position-0 command via `stripLeadingMention`.
-- **Agent representation** (`src/lib/slackstream.ts`): turns stream natively (`chat.startStream`, which works in channel threads regardless of the assistant:write scope): thinking and tool calls as task cards ("Thinking"/tool name/"Turn", input summary + truncated output), reply text as native markdown with rendered code fences, and a segment break whenever a tool starts after streamed text, so one turn posts as separate ordered Slack messages around its tool runs.
-- **Todo checklist card**: TodoWrite is bookkeeping, not a real tool run, so it never opens a generic card and never breaks a segment. Instead each stream gets one stable-id "Todos" card (id `todos`, subagents `todos-<parent_tool_use_id>`) that updates in place on every TodoWrite: `✅ content` for completed, `🔄 activeForm` for the in-progress item (live narration), `⬜ content` for pending (the Chat SDK Plan object's own iconography); card status goes complete only when every item is completed. The "Todos have been modified successfully" tool_result is suppressed, but a FAILED TodoWrite flips the card to error (the optimistic checklist must not claim a state that never took effect). Card ids do not carry across segments, so a post-break TodoWrite starts a fresh card in the new message: accepted, the latest state is always in the newest message. claude >= 2.1.142 defaults to the structured Task tools and never emits TodoWrite, so relayThread sets `CLAUDE_CODE_ENABLE_TASKS: "0"` in the spawn env (the documented opt-out; without it the checklist card is inert).
+- **Agent representation** (`src/lib/slackstream.ts`): turns stream natively (`chat.startStream`, which works in channel threads regardless of the assistant:write scope): thinking and tool calls as task cards ("Thinking"/tool name/"Turn", input summary + truncated output) that Slack groups into ONE collapsible plan block per turn (the serve edge wraps every posted segment in a `StreamingPlan` with `groupTasks: "plan"`, Slack's `task_display_mode: "plan"`; user ask 2026-07-20 "squash them into one dropdown", superseding the 2026-07-18 separate-messages shape), and reply text as native markdown with rendered code fences - so one turn streams as a single Slack message: the reply plus one dropdown of its activity. A later main text block (typically post-tool prose) opens on a `\n\n` paragraph break (`textStreamed`), restoring the separation the per-tool message split used to provide; whitespace-only deltas do not arm it. Notices still post as their own messages, and a rejected append (Slack's message cap, a finalized idle stream) opens a follow-on message via the dead-segment recovery.
+- **Todo checklist card**: TodoWrite is bookkeeping, not a real tool run, so it never opens a generic card. Instead each stream gets one stable-id "Todos" card (id `todos`, subagents `todos-<parent_tool_use_id>`) that updates in place on every TodoWrite: `✅ content` for completed, `🔄 activeForm` for the in-progress item (live narration), `⬜ content` for pending (the Chat SDK Plan object's own iconography); card status goes complete only when every item is completed. The "Todos have been modified successfully" tool_result is suppressed, but a FAILED TodoWrite flips the card to error (the optimistic checklist must not claim a state that never took effect). Card ids do not carry across messages, so a TodoWrite after a dead-segment recovery starts a fresh card in the follow-on message: accepted, the latest state is always in the newest message. claude >= 2.1.142 defaults to the structured Task tools and never emits TodoWrite, so relayThread sets `CLAUDE_CODE_ENABLE_TASKS: "0"` in the spawn env (the documented opt-out; without it the checklist card is inert).
 - **Terminal echo** (2026-07-18): the daemon registers a `log()` echo (`setLogEcho` in log.ts, off by default so hooks and the statusline keep their stdout protocols clean), so every event while it runs - serve.* plus the in-process swap/decision events from `ensureBestAccount()`/`stopHookCheck` - also prints one colored line in the foreground terminal (`formatLogLine`: dim HH:MM:SS, event painted red/yellow/cyan by structural endsWith severity, redacted fields). `serve.turn_done`/`serve.turn_failed` (with seconds) close every relayed turn, so a foreground `xx serve` is observable without tailing `tokenmaxxing.log`.
 - **Live-verified end-to-end** (2026-07-18, #tokenmaxxing-dogfooding): mention opens a session (worktree-per-thread at the time), replies stream, thread follow-ups resume with context, cards + fenced code render, segmentation and queue folding behave. Plus the hermetic suite: schemas/links, stream mapping, fail-fast paths.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.0.2",
+  "version": "1.1.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",

package/src/cli/serve.ts

@@ -18,7 +18,7 @@
 import { existsSync, realpathSync } from "node:fs";
 import { delay, omit, uniq } from "es-toolkit";
 import { z } from "zod";
-import { Chat, ThreadImpl, type StreamChunk } from "chat";
+import { Chat, StreamingPlan, ThreadImpl, type StreamChunk } from "chat";
 import { createSlackAdapter } from "@chat-adapter/slack";
 import { createMemoryState } from "@chat-adapter/state-memory";
 import {
@@ -42,6 +42,7 @@ import {
   type SlackThread,
 } from "../lib/slackstate.ts";
 import { cleanupThread, fetchWorkspaceTeamId, killGroup, relayThread, type CleanupOutcome, type TurnOutcome } from "../lib/slackbridge.ts";
+import { ensureBestAccount, type SwapDecision } from "../sdk.ts";
 import { pidStartTime } from "../lib/proc.ts";
 import { acquireLock } from "../lib/lock.ts";
 import { paths } from "../lib/paths.ts";
@@ -240,7 +241,7 @@ export function formatLogLine(input: { event: string; parts: string }): string {
 const ServeThreadSchema = z.custom<{
   id: string;
   channelId: string;
-  post: (m: string | AsyncIterable<string | StreamChunk>) => Promise<unknown>;
+  post: (m: string | AsyncIterable<string | StreamChunk> | StreamingPlan) => Promise<unknown>;
   subscribe: () => Promise<void>;
   unsubscribe: () => Promise<void>;
   startTyping: () => Promise<void>;
@@ -306,8 +307,19 @@ export function buildServeRuntime(seam: {
     drainSignal?: AbortSignal;
   }) => Promise<TurnOutcome>;
   cleanup: (input: { threadId: string }) => CleanupOutcome;
+  /** builds a streamable proactive thread handle for marker recovery (startup
+   *  resumes and deferred-turn wakes both need one). runDaemon passes a lazy
+   *  closure over its bot-backed streamableThread; tests pass a fake. */
+  streamable: (threadId: string) => Promise<{ thread: ServeThread; requesterIds: string[] }>;
+  /** the pool decision a deferred wake pre-probes with before posting the
+   *  recovery notice (production: ensureBestAccount; tests: a stub). */
+  decide: () => Promise<SwapDecision>;
 }) {
   const { cfg, workspaceTeamId } = seam;
+  /** short re-arm after a deferred wake fails transiently (Slack hiccup at
+   *  the resume): the durable marker keeps deferring, so the retry loop ends
+   *  the moment any marker-clearing path runs. */
+  const RESUME_RETRY_MS = 300_000;
   // in-flight turns, tracked so a shutdown signal can drain them instead of
   // killing a half-streamed answer (live incident 2026-07-18: a deploy
   // restart cut a turn mid-sentence and the answer never reached Slack).
@@ -323,7 +335,7 @@ export function buildServeRuntime(seam: {
    *  The session id persists the moment init assigns it - a first-turn kill
    *  must stay resumable. */
   const runTurn = async (input: {
-    thread: { id: string; post: (m: AsyncIterable<string | StreamChunk>) => Promise<unknown> };
+    thread: { id: string; post: (m: StreamingPlan) => Promise<unknown> };
     record: SlackThread;
     prompt: string;
     requesterIds: string[];
@@ -341,7 +353,12 @@ export function buildServeRuntime(seam: {
         prompt: input.prompt,
         requesterIds: input.requesterIds,
         link: input.link,
-        post: (m) => input.thread.post(m),
+        // every posted segment groups its task cards into one collapsible
+        // Slack plan block (task_display_mode "plan"; user ask 2026-07-20:
+        // "squash them into one dropdown") instead of a card-per-task
+        // timeline. Text-only segments (notices, plain replies) carry no
+        // tasks, so the wrap is a no-op for them.
+        post: (m) => input.thread.post(new StreamingPlan(m, { groupTasks: "plan" })),
         onSpawn: (pid) => {
           // the lstart token makes the pid a verifiable identity for the
           // orphan reaper; a child dead before ps sees it persists without
@@ -373,13 +390,23 @@ export function buildServeRuntime(seam: {
       // work; adversarial-review catch). null outcome = relay threw =
       // still presumed killed.
       const presumedKilled = draining && (outcome === null || (outcome.failed && !outcome.announcedDrop && !outcome.resultReceived));
+      // A usage-limit DEFERRAL keeps the marker with resumeAt: the turn
+      // returned on purpose so the queue slot frees up, and the scheduler
+      // resumes it from this durable record once the pool recovers.
+      const deferUntil = outcome?.deferUntil ?? null;
       // An unannounced drop OUTSIDE a drain still clears the marker on
       // purpose (retention would re-execute the turn at the next restart; see
       // notifyDelivered's doc) - but the loss must be operator-visible.
-      if (!draining && outcome !== null && outcome.failed && outcome.rateLimited && !outcome.announcedDrop) {
+      if (!draining && outcome !== null && outcome.failed && outcome.rateLimited && !outcome.announcedDrop && deferUntil === null) {
         log("serve.drop_unannounced", { thread: input.thread.id });
       }
-      saveSlackThread(presumedKilled ? record : omit(record, ["activeTurn"]));
+      if (deferUntil !== null && record.activeTurn) {
+        record = { ...record, activeTurn: { ...record.activeTurn, resumeAt: deferUntil } };
+        saveSlackThread(record);
+        scheduleDeferred(record.threadId, deferUntil);
+      } else {
+        saveSlackThread(presumedKilled ? record : omit(record, ["activeTurn"]));
+      }
     }
   };
 
@@ -437,7 +464,7 @@ export function buildServeRuntime(seam: {
     const stripped = input.relayed
       .map((m) => ({ text: stripLeadingMention({ text: m.text, botUserId: seam.botUserId() }), authorId: m.authorId }))
       .filter((m) => m.text !== "");
-    const prompt = stripped.map((m) => m.text).join("\n\n");
+    let prompt = stripped.map((m) => m.text).join("\n\n");
     const requesterIds = uniq(stripped.map((m) => m.authorId));
     if (!prompt) return;
     // this whole handler runs inside the per-thread `serialized` chain (call
@@ -451,15 +478,33 @@ export function buildServeRuntime(seam: {
       saveSlackThread(record);
       log("serve.thread_opened", { thread: thread.id, cwd: link.repo });
     }
-    // Inside the serialized chain a marker can only be a PREVIOUS
-    // generation's killed turn (this generation's turns clear theirs before
-    // releasing the chain, and the serve-lock keeps generations exclusive):
-    // an inbound message can win the chain ahead of startup recovery (e.g.
-    // Slack redelivering the killed turn's unacked mention), and runTurn's
-    // fresh marker would silently discard the orphan's pid identity - reap it
-    // here so two claude processes never share the thread's cwd and session
-    // (closing-review catch, the recovery-path reap alone loses this race).
+    // Inside the serialized chain a surviving marker is either a PREVIOUS
+    // generation's killed turn (an inbound message can win the chain ahead of
+    // startup recovery, e.g. Slack redelivering the killed turn's unacked
+    // mention) or a LIMIT-DEFERRED turn holding its resumeAt promise. Reap a
+    // possible orphan either way, so two claude processes never share the
+    // thread's cwd and session (closing-review catch: the recovery-path reap
+    // alone loses this race).
     if (record.activeTurn) await reapOrphan(record.activeTurn);
+    // An inbound message takes over a deferred thread (its wake timer dies
+    // with the takeover; runTurn's fresh marker replaces the deferred one),
+    // and the held prompt ALWAYS folds in front of the new text: silently
+    // discarding it was the adversarial-review MAJOR catch on PR #44 (it
+    // would re-lose exactly the 2026-07-20 two-message shape the deferral
+    // exists to save), and no spawn-progress signal on the marker can prove
+    // the held prompt ever reached the session (a child can spawn and die
+    // before init - vercel review catch). A completed turn never defers, so
+    // folding can never re-run finished work; at worst a mid-turn deferral's
+    // prompt re-appears alongside the session transcript that already holds
+    // its partial work, and the newer message steers.
+    const deferred = record.activeTurn?.resumeAt !== undefined ? record.activeTurn : null;
+    if (deferred) {
+      const timer = deferredTimers.get(thread.id);
+      if (timer !== undefined) clearTimeout(timer);
+      deferredTimers.delete(thread.id);
+      prompt = `${deferred.prompt}\n\n${prompt}`;
+      log("serve.deferred_folded", { thread: thread.id });
+    }
     // subscriptions live in the memory state, so a daemon restart forgets
     // them; every mention re-subscribes to keep follow-up replies flowing.
     if (isMention) await thread.subscribe();
@@ -488,14 +533,24 @@ export function buildServeRuntime(seam: {
     startedAt: number;
   }) => {
     const { thread, outcome, startedAt } = input;
-    log(outcome.failed ? "serve.turn_failed" : "serve.turn_done", {
+    log(outcome.deferUntil !== null ? "serve.turn_deferred" : outcome.failed ? "serve.turn_failed" : "serve.turn_done", {
       thread: thread.id,
       seconds: Math.round((Date.now() - startedAt) / 1000),
+      ...(outcome.deferUntil === null ? {} : { resumeAt: outcome.deferUntil }),
     });
     // the user declared the work finished: close the thread now that the
     // turn (and its claude subprocess) is over. Never throw into the caller -
     // the daemon must keep serving other threads.
     if (!outcome.finish) return;
+    if (outcome.deferUntil !== null) {
+      // finish is sticky across retries, so it can ride a deferred outcome -
+      // and cleanup would delete the very record the deferral just promised
+      // to resume (adversarial-review catch on PR #44). The deferral wins:
+      // the resumed turn finishes the remaining work, and the user closes
+      // the thread again once it actually lands.
+      log("serve.finish_deferred", { thread: thread.id });
+      return;
+    }
     let result: CleanupOutcome;
     try {
       result = seam.cleanup({ threadId: thread.id });
@@ -584,25 +639,48 @@ export function buildServeRuntime(seam: {
     await tracked(serialized(input.thread.id, () => handleTurn({ thread: input.thread, relayed, isMention: input.isMention })));
   };
 
-  /** Recover one thread whose activeTurn marker survived the previous daemon:
-   *  a restart killed that turn mid-run. Notify the thread, then resume the
-   *  session (or replay the original prompt when the kill landed before init
-   *  assigned a session id); past the retry cap, give up loudly. EVERY branch
-   *  runs inside the shared per-thread `serialized` chain and recomputes the
-   *  decision from a fresh reload there: an inbound turn (or Slack
-   *  redelivering the killed turn's unacked mention) can win the chain first,
-   *  handle the thread, and clear the marker - acting on the startup snapshot
-   *  would then re-run superseded work and write stale record fields over the
-   *  session id that turn persisted (adversarial-review catch). Lives in the
-   *  seam with `streamable` INJECTED (the daemon passes its bot-backed handle
-   *  builder, tests a fake) so that superseded-recovery race is pinnable
+  /** Deferred-turn wakes: one process-local timer per thread, re-armed by a
+   *  later deferral. The durable marker (activeTurn.resumeAt) is the source
+   *  of truth - timers die with the process and startup re-arms or recovers
+   *  from the record. Node clamps setTimeout delays above 2^31-1ms to 1ms,
+   *  so the delay is capped instead: an early fire re-defers off the
+   *  still-depleted pool, bounded by resumeCount. */
+  const deferredTimers = new Map<string, ReturnType<typeof setTimeout>>();
+  const scheduleDeferred = (threadId: string, resumeAt: number) => {
+    const prev = deferredTimers.get(threadId);
+    if (prev !== undefined) clearTimeout(prev);
+    log("serve.resume_scheduled", { thread: threadId, resumeAt });
+    const timer = setTimeout(() => {
+      deferredTimers.delete(threadId);
+      if (draining) return;
+      try {
+        const record = loadSlackThread(threadId);
+        if (!record?.activeTurn) return; // superseded: a turn already cleared it
+        void tracked(recoverInterrupted(record));
+      } catch (e) {
+        log("serve.resume_error", { thread: threadId, err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
+      }
+    }, Math.min(Math.max(0, resumeAt - Date.now()), 2_147_483_647));
+    deferredTimers.set(threadId, timer);
+  };
+
+  /** Recover one thread whose activeTurn marker survived: a restart killed
+   *  that turn mid-run, or a usage-limit deferral parked it (resumeAt) and
+   *  the wake arrived. Notify the thread, then resume the session (or replay
+   *  the original prompt when the turn never reached init); past the retry
+   *  cap, give up loudly. EVERY branch runs inside the shared per-thread
+   *  `serialized` chain and recomputes the decision from a fresh reload
+   *  there: an inbound turn (or Slack redelivering the killed turn's unacked
+   *  mention) can win the chain first, handle the thread, and clear the
+   *  marker - acting on the startup snapshot would then re-run superseded
+   *  work and write stale record fields over the session id that turn
+   *  persisted (adversarial-review catch). Lives in the seam with
+   *  `streamable` INJECTED (the daemon passes its bot-backed handle builder,
+   *  tests a fake) so that superseded-recovery race is pinnable
    *  (closing-review catch: the invariant had no test while inline). */
-  const recoverInterrupted = async (
-    record: SlackThread,
-    streamable: (threadId: string) => Promise<{ thread: ServeThread; requesterIds: string[] }>,
-  ) => {
+  const recoverInterrupted = async (record: SlackThread) => {
     try {
-      const { thread, requesterIds } = await streamable(record.threadId);
+      const { thread, requesterIds } = await seam.streamable(record.threadId);
       const link = linkForChannel(cfg, bareChannelId(thread.channelId));
       await serialized(record.threadId, async () => {
         // a drain signal can land between the scan and this turn; leave the
@@ -612,6 +690,15 @@ export function buildServeRuntime(seam: {
         const turn = fresh?.activeTurn;
         const decision = fresh ? resumeDecision(fresh) : null;
         if (!fresh || !turn || !decision) return; // superseded: an earlier turn already cleared the marker
+        if (turn.resumeAt !== undefined && turn.resumeAt > Date.now()) {
+          // a wake that queued behind an in-flight turn can find a RE-DEFERRED
+          // marker whose new wake is hours out; resuming it now would post a
+          // false "pool has recovered" notice and burn a resume attempt
+          // (adversarial-review catch on PR #44). Re-arm and step aside, the
+          // same guard the startup scan applies.
+          scheduleDeferred(record.threadId, turn.resumeAt);
+          return;
+        }
         await reapOrphan(turn);
         if (!link) {
           // unlinked since the turn started: nothing can run here; drop the
@@ -631,6 +718,43 @@ export function buildServeRuntime(seam: {
           saveSlackThread(omit(fresh, ["activeTurn"]));
           return;
         }
+        if (turn.resumeAt !== undefined) {
+          // the wake arrived, but the reset clock was extrapolated: confirm
+          // the pool ACTUALLY recovered before posting the recovery notice
+          // and spending one of the capped resume attempts - a still-depleted
+          // pool with a KNOWN wake re-defers silently (no quota was spent, so
+          // no attempt burns; cursor review catch on PR #44). This runs AFTER
+          // the give-up branch on purpose: a turn at the resume cap gives up
+          // honestly at its due wake instead of re-deferring forever (cubic
+          // review catch). A still-depleted pool with an UNKNOWN wake drops
+          // honestly (vercel + cubic review catch: falling through would post
+          // a false "pool has recovered" notice and burn an attempt on a
+          // spawn-boundary drop) - the drop-beats-false-promise principle
+          // stands for the unknown-wake case, and a short silent re-arm loop
+          // against a never-recovering pool would keep a zombie promise
+          // alive instead. A probe failure falls through to the normal
+          // resume, whose own decision path announces honestly.
+          try {
+            const verdict = await seam.decide();
+            const depleted = verdict.reason === "all-depleted" || verdict.reason === "depleted-wait";
+            if (depleted) {
+              const wake = verdict.waitUntil ?? null;
+              if (wake != null) {
+                const resumeAt = wake + 5_000;
+                saveSlackThread({ ...fresh, activeTurn: { ...turn, resumeAt } });
+                scheduleDeferred(record.threadId, resumeAt);
+                log("serve.resume_still_depleted", { thread: record.threadId, resumeAt });
+                return;
+              }
+              log("serve.resume_dropped_unknown", { thread: record.threadId });
+              await thread.post("the pool is still at its usage limit and its recovery time is now unknown - this held message is dropped; re-send it once the pool recovers.");
+              saveSlackThread(omit(fresh, ["activeTurn"]));
+              return;
+            }
+          } catch (e) {
+            log("serve.resume_probe_error", { thread: record.threadId, err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
+          }
+        }
         log("serve.resume_interrupted", { thread: record.threadId, attempt: decision.marker.resumeCount });
         // the notice posts BEFORE runTurn persists the incremented marker,
         // on purpose: the cap bounds quota-SPENDING attempts (the spawn),
@@ -647,6 +771,19 @@ export function buildServeRuntime(seam: {
     } catch (e) {
       const detail = (e instanceof Error ? e.message : String(e)).slice(0, 300);
       log("serve.resume_error", { thread: record.threadId, err: detail });
+      // a DEFERRED turn's wake must survive a transient failure here (a
+      // Slack hiccup at an unattended 4am wake would otherwise strand the
+      // held turn until the next restart - adversarial-review catch on
+      // PR #44): re-arm a short retry while the marker still defers. The
+      // marker-clearing paths (resume, supersession, unlink, give-up) all
+      // end the loop; killed-turn (no resumeAt) startup semantics keep
+      // their once-per-restart retry.
+      try {
+        const marker = loadSlackThread(record.threadId)?.activeTurn;
+        if (marker?.resumeAt !== undefined && !draining) scheduleDeferred(record.threadId, Date.now() + RESUME_RETRY_MS);
+      } catch {
+        // the record itself is unreadable; the startup scan is the backstop.
+      }
     }
   };
 
@@ -654,10 +791,14 @@ export function buildServeRuntime(seam: {
     /** in-flight turn promises; shutdown drains them. */
     activeTurns,
     isDraining: () => draining,
-    /** stop taking new turns and wake parked/retrying ones. */
+    /** stop taking new turns and wake parked/retrying ones. Pending deferred
+     *  wakes are cancelled: the markers are durable and the next generation
+     *  re-arms them at startup. */
     beginDrain: () => {
       draining = true;
       drainAbort.abort();
+      for (const timer of deferredTimers.values()) clearTimeout(timer);
+      deferredTimers.clear();
     },
     relayable,
     onMessage,
@@ -669,6 +810,7 @@ export function buildServeRuntime(seam: {
     runTurn,
     settleTurn,
     recoverInterrupted,
+    scheduleDeferred,
   };
 }
 
@@ -761,6 +903,10 @@ async function runDaemon(): Promise<number> {
     botUserId: () => slack.botUserId ?? null,
     relay: relayThread,
     cleanup: cleanupThread,
+    // lazy on purpose: streamableThread is declared just below and only ever
+    // invoked long after startup (recovery runs and deferred wakes).
+    streamable: (threadId) => streamableThread(threadId),
+    decide: ensureBestAccount,
   });
 
   /** A proactive thread handle that can still stream natively. bot.thread()
@@ -866,14 +1012,22 @@ async function runDaemon(): Promise<number> {
   for (const record of records) await state.subscribe(record.threadId);
   log("serve.resubscribed", { threads: records.length });
 
-  // threads whose activeTurn marker survived the previous daemon were killed
-  // mid-turn by a restart (live incident 2026-07-18: a redeploy silently
-  // killed a ship turn 8 minutes in and the thread just went dark). Each gets
-  // a notice and an auto-resumed turn, tracked so a drain waits for them too;
-  // the actionable decision is recomputed under the per-thread lock inside.
+  // threads whose activeTurn marker survived the previous daemon were either
+  // killed mid-turn by a restart (live incident 2026-07-18: a redeploy
+  // silently killed a ship turn 8 minutes in and the thread just went dark)
+  // or deferred at a usage limit (resumeAt; 2026-07-20 incident: dropped
+  // messages sat dead for hours after the pool recovered). A future resumeAt
+  // re-arms its timer; everything else recovers now, tracked so a drain
+  // waits for it; the actionable decision is recomputed under the per-thread
+  // lock inside.
   for (const record of records) {
-    if (!record.activeTurn) continue;
-    void runtime.tracked(runtime.recoverInterrupted(record, streamableThread));
+    const marker = record.activeTurn;
+    if (!marker) continue;
+    if (marker.resumeAt !== undefined && marker.resumeAt > Date.now()) {
+      runtime.scheduleDeferred(record.threadId, marker.resumeAt);
+      continue;
+    }
+    void runtime.tracked(runtime.recoverInterrupted(record));
   }
 
   console.log(`${c.green("●")} serving ${count({ n: cfg.links.length, noun: "linked channel" })} over Slack Socket Mode - mention the bot in a linked channel to open a session (Ctrl-C to stop)`);

package/src/lib/slackbridge.ts

@@ -18,7 +18,7 @@ import { http, safeErrorDetail } from "./http.ts";
 import { loadLastSwapAt } from "./state.ts";
 import { fmtResetShort, recordObservedLimit } from "./usage.ts";
 import { deleteSlackThread, type SlackLink } from "./slackstate.ts";
-import { agentEventChunks, newStreamMapState, SegmentBreakSchema } from "./slackstream.ts";
+import { agentEventChunks, newStreamMapState } from "./slackstream.ts";
 import { log } from "./log.ts";
 
 /** With systemPrompt omitted the SDK runs a MINIMAL system prompt (the
@@ -46,6 +46,11 @@ export const TurnOutcomeSchema = z.object({
    *  operator's benefit). A drain must not read that delivery failure as a
    *  killed child and re-run completed work (adversarial-review catch). */
   resultReceived: z.boolean(),
+  /** epoch ms when the pool is expected usable again: set when the turn ended
+   *  at a usage limit whose recovery time is known. The caller keeps the
+   *  thread's activeTurn marker with resumeAt and the daemon resumes the turn
+   *  itself, instead of the old "re-send it once the pool recovers" drop. */
+  deferUntil: z.number().nullable(),
 });
 export type TurnOutcome = z.infer<typeof TurnOutcomeSchema>;
 
@@ -69,24 +74,32 @@ export const MAX_RECOVERIES = 3;
 const ParkPlanSchema = z.union([
   z.object({ kind: z.literal("proceed") }),
   z.object({ kind: z.literal("park"), wakeAt: z.number() }),
-  z.object({ kind: z.literal("drop"), recoversAt: z.number().nullable() }),
+  z.object({ kind: z.literal("defer"), resumeAt: z.number() }),
+  z.object({ kind: z.literal("drop") }),
 ]);
 export type ParkPlan = z.infer<typeof ParkPlanSchema>;
 
-/** What to do with a spawn-boundary switch decision: proceed on a usable pool,
- *  park until the soonest recovery when it lands inside the message's one
- *  shared deadline, drop honestly otherwise (dropping beats a false
- *  will-resume promise - slaude's recorded rationale). The deadline is fixed
- *  when the message's relay starts, so chained parks can never hold the queue
- *  slot longer than PARK_MAX_MS in total. */
+/** What to do with a spawn-boundary switch decision: proceed on a usable pool;
+ *  park in-handler until the soonest recovery when it lands inside the
+ *  message's one shared deadline; DEFER when recovery is known but further
+ *  out (or the in-handler recovery budget is spent): the handler releases the
+ *  queue slot and the daemon resumes the turn from its durable marker once
+ *  the pool recovers (2026-07-20 incident: dropped messages sat dead for
+ *  hours after the pool recovered until the user re-sent them by hand -
+ *  superseding the older drop-instead-of-promise rule, whose premise was that
+ *  a will-resume promise could not be kept; the marker + scheduler + startup
+ *  scan make it durable). Only an UNKNOWN recovery time still drops honestly.
+ *  The deadline is fixed when the message's relay starts, so chained parks
+ *  can never hold the queue slot longer than PARK_MAX_MS in total. */
 export function parkPlan(input: { decision: SwapDecision; recoveries: number; deadline: number }): ParkPlan {
   const depleted = input.decision.reason === "all-depleted" || input.decision.reason === "depleted-wait";
   if (!depleted) return { kind: "proceed" };
   const wake = input.decision.waitUntil ?? null;
+  if (wake == null) return { kind: "drop" };
   // the grace counts against the deadline too: the promised total hold is
   // exact, not deadline-plus-grace (review catch, PR #18).
-  if (wake == null || wake + PARK_GRACE_MS > input.deadline || input.recoveries >= MAX_RECOVERIES) {
-    return { kind: "drop", recoversAt: wake };
+  if (wake + PARK_GRACE_MS > input.deadline || input.recoveries >= MAX_RECOVERIES) {
+    return { kind: "defer", resumeAt: wake + PARK_GRACE_MS };
   }
   return { kind: "park", wakeAt: wake + PARK_GRACE_MS };
 }
@@ -344,25 +357,34 @@ export function detachedClaudeSpawn(options: SpawnOptions) {
 }
 
 /**
- * One claude turn relayed into a Slack thread as a SEQUENCE of messages: reply
- * text streams natively, thinking and tool calls stream as task_update cards
- * (see slackstream.ts), and a segment_break (a tool starting after streamed
- * text) closes the current Slack message and opens the next one, so a turn
- * reads as separate messages around its tool runs (user ask 2026-07-18).
- * Segments post strictly in order: the next opens only after the previous
- * post resolves. Never throws: a failure posts a short diagnostic line and
- * sets outcome.failed (the daemon must keep serving other threads). Error
- * text is message-only - a raw error body could echo request material.
+ * One claude turn relayed into a Slack thread as ONE streamed message: reply
+ * text streams natively and thinking/tool calls stream as task_update cards
+ * (see slackstream.ts) that Slack groups into a single collapsible plan block
+ * (user ask 2026-07-20: "squash them into one dropdown"; the serve edge wraps
+ * each posted segment in a StreamingPlan with groupTasks "plan", superseding
+ * the 2026-07-18 separate-messages-around-tool-runs shape). Segments still
+ * exist as the posting machinery: recovery notices post as their own
+ * messages, a rejected post opens a fresh one (so an over-long turn that
+ * trips Slack's message cap degrades to a follow-on message instead of
+ * vanishing), and segments post strictly in order: the next opens only after
+ * the previous post resolves. Never throws: a failure posts a short
+ * diagnostic line and sets outcome.failed (the daemon must keep serving other
+ * threads). Error text is message-only - a raw error body could echo request
+ * material.
  *
  * Depleted-pool recovery (ported from slaude at its shutdown, reshaped around
  * the pool): the spawn-boundary switch decision is CONSUMED, not discarded -
  * a depleted pool parks BEFORE a doomed spawn burns a failed turn, with an
  * honest in-thread notice either way; a mid-turn limit the cached pool state
  * did not predict is persisted (recordObservedLimit) and retried silently into
- * the same session. Total parking is bounded by one shared PARK_MAX_MS
- * deadline plus MAX_RECOVERIES, and every drop the relay itself performs is
- * announced in-thread (a queue-entry TTL expiry upstream is the one drop it
- * cannot see).
+ * the same session. Total in-handler parking is bounded by one shared
+ * PARK_MAX_MS deadline plus MAX_RECOVERIES; a limit whose recovery lands
+ * beyond that budget DEFERS instead of dropping (outcome.deferUntil): the
+ * caller keeps the thread's durable marker with resumeAt and the daemon
+ * resumes the turn itself once the pool recovers (2026-07-20 incident).
+ * Only an unknown recovery time still drops, and every drop the relay itself
+ * performs is announced in-thread (a queue-entry TTL expiry upstream is the
+ * one drop it cannot see).
  */
 export async function relayThread(input: {
   cwd: string;
@@ -389,7 +411,7 @@ export async function relayThread(input: {
    *  out a depleted-pool countdown. */
   drainSignal?: AbortSignal;
 }): Promise<TurnOutcome> {
-  const outcome: TurnOutcome = { sessionId: input.sessionId, failed: false, rateLimited: false, finish: false, announcedDrop: false, resultReceived: false };
+  const outcome: TurnOutcome = { sessionId: input.sessionId, failed: false, rateLimited: false, finish: false, announcedDrop: false, resultReceived: false, deferUntil: null };
   let segment: ReturnType<typeof pushableStream> | null = null;
   let segmentMeta: { text: boolean } | null = null;
   let lastPost: Promise<unknown> = Promise.resolve();
@@ -479,8 +501,14 @@ export async function relayThread(input: {
   };
   const inWord = (epochMs: number | null) => (epochMs == null ? "an unknown time" : `~${fmtResetShort(epochMs, Date.now()) || "1m"}`);
 
+  // a non-limit failure line held back until the depleted-pool probe rules:
+  // posted verbatim on a plain failure, discarded when the turn defers (the
+  // deferral notice explains the pause; the raw line would invite a manual
+  // re-send of work the daemon resumes itself - cubic catch, PR #44).
+  let pendingFailureLine: string | null = null;
   const runQueryOnce = async () => {
     postedText = false;
+    pendingFailureLine = null;
     outcome.failed = false;
     outcome.rateLimited = false;
     outcome.resultReceived = false;
@@ -584,15 +612,15 @@ export async function relayThread(input: {
             outcome.resultReceived = true;
           }
         }
-        for (const part of agentEventChunks({ state: mapState, message })) {
-          if (SegmentBreakSchema.safeParse(part).success) breakSegment();
-          else await push(SegmentChunkSchema.parse(part));
-        }
+        for (const part of agentEventChunks({ state: mapState, message })) await push(part);
       }
       // a turn that produced no streamed text (tool-only turns) still reports.
       if (!postedText && result) await push(result);
       if (!postedText && !result && outcome.failed && !outcome.rateLimited) {
-        await push("the turn ended without a result - trying again may help");
+        // held back until the depleted-pool probe rules: a "trying again may
+        // help" line right before a deferral notice invites a manual re-send
+        // of work the daemon is about to resume itself (cubic catch, PR #44).
+        pendingFailureLine = "the turn ended without a result - trying again may help";
       }
     } catch (e) {
       outcome.failed = true;
@@ -600,7 +628,10 @@ export async function relayThread(input: {
       outcome.rateLimited = isRateLimitText({ text: detail });
       if (outcome.rateLimited) await recordObservedLimit({ text: detail, now: Date.now(), org: spawnOrg });
       log("serve.turn_error", { err: detail });
-      if (!outcome.rateLimited) await push(`tokenmaxxing: turn failed: ${detail}`);
+      // same hold-back: the detail already reached the log above, and a
+      // deferral's own notice explains the pause better than a raw child
+      // error that reads as "please re-send".
+      if (!outcome.rateLimited) pendingFailureLine = `tokenmaxxing: turn failed: ${detail}`;
     }
   };
 
@@ -620,10 +651,23 @@ export async function relayThread(input: {
     }
     const plan = parkPlan({ decision, recoveries, deadline: parkDeadline });
     if (plan.kind === "drop") {
+      // recovery time unknown: an auto-resume promise would be unkeepable,
+      // so the honest drop survives for exactly this case.
       outcome.failed = true;
       outcome.rateLimited = true;
-      log("serve.pool_depleted_drop", { recoversAt: plan.recoversAt });
-      outcome.announcedDrop = await notifyDelivered(`every pooled account is at its usage limit (recovers in ${inWord(plan.recoversAt)}) - this message was dropped; re-send it once the pool recovers.`);
+      log("serve.pool_depleted_drop", {});
+      outcome.announcedDrop = await notifyDelivered("every pooled account is at its usage limit (recovers at an unknown time) - this message was dropped; re-send it once the pool recovers.");
+      break;
+    }
+    if (plan.kind === "defer") {
+      // release the queue slot and let the daemon resume the turn from its
+      // durable marker once the pool recovers (2026-07-20 incident: dropped
+      // messages sat dead for hours after recovery until re-sent by hand).
+      outcome.failed = true;
+      outcome.rateLimited = true;
+      outcome.deferUntil = plan.resumeAt;
+      log("serve.pool_depleted_defer", { resumeAt: plan.resumeAt });
+      await notify(`every pooled account is at its usage limit - holding this message; it will resume automatically in ${inWord(plan.resumeAt)}.`);
       break;
     }
     if (plan.kind === "park") {
@@ -631,15 +675,61 @@ export async function relayThread(input: {
       log("serve.pool_depleted_park", { wakeAt: plan.wakeAt, recoveries });
       await notify(`every pooled account is at its usage limit - holding this message and retrying in ${inWord(plan.wakeAt)}.`);
       if (!(await sleep(plan.wakeAt - Date.now()))) {
+        // a drain aborted the park: the turn never spawned, so the marker
+        // survives (presumedKilled) and the next daemon start replays it.
         outcome.failed = true;
-        outcome.announcedDrop = await notifyDelivered("tokenmaxxing is restarting - this message was dropped; please re-send it.");
+        await notify("tokenmaxxing is restarting - this message resumes after the restart.");
         break;
       }
       continue;
     }
     await runQueryOnce();
-    if (!outcome.failed || !outcome.rateLimited) break;
+    if (!outcome.failed) break;
+    if (!outcome.rateLimited) {
+      // an unclassifiable child failure (e.g. "Claude Code process exited
+      // with code 1" - the 2026-07-20 Fable-cap death carried no limit
+      // phrase) against an exhausted pool IS the limit: the pool state is
+      // the evidence the error text did not carry. A completed result stays
+      // terminal, and a usable pool keeps the plain failure.
+      if (!outcome.resultReceived) {
+        try {
+          const verdict = await ensureBestAccount();
+          const depleted = verdict.reason === "all-depleted" || verdict.reason === "depleted-wait";
+          const wake = depleted ? verdict.waitUntil ?? null : null;
+          if (wake != null) {
+            outcome.rateLimited = true;
+            outcome.deferUntil = wake + PARK_GRACE_MS;
+            pendingFailureLine = null;
+            log("serve.turn_failed_depleted_defer", { resumeAt: outcome.deferUntil });
+            await notify(`the account pool is exhausted - pausing this turn; it will resume automatically in ${inWord(outcome.deferUntil)}.`);
+          }
+        } catch (e) {
+          // keep the original failure; the probe must never mask it.
+          log("serve.defer_probe_error", { err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
+        }
+      }
+      if (pendingFailureLine !== null) await push(pendingFailureLine);
+      break;
+    }
     if (recoveries >= MAX_RECOVERIES) {
+      // out of in-handler retry budget: defer to the pool's own recovery
+      // clock when it is known, drop honestly when it is not (a stale cache
+      // claiming a usable pool while every retry limits out lands here too,
+      // and deferring on no evidence would just spin the resume cap).
+      let wake: number | null = null;
+      try {
+        const verdict = await ensureBestAccount();
+        const depleted = verdict.reason === "all-depleted" || verdict.reason === "depleted-wait";
+        wake = depleted ? verdict.waitUntil ?? null : null;
+      } catch (e) {
+        log("serve.defer_probe_error", { err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
+      }
+      if (wake != null) {
+        outcome.deferUntil = wake + PARK_GRACE_MS;
+        log("serve.rate_limited_defer", { recoveries, resumeAt: outcome.deferUntil });
+        await notify(`still at a usage limit after retries - pausing this turn; it will resume automatically in ${inWord(outcome.deferUntil)}.`);
+        break;
+      }
       log("serve.rate_limited_drop", { recoveries });
       outcome.announcedDrop = await notifyDelivered("still at a usage limit after retries - this message was dropped; reply when you want to try again.");
       break;
@@ -670,8 +760,11 @@ export async function relayThread(input: {
       break;
     }
     if (!(await sleep(Math.max(RETRY_DELAY_MS, cooldownUntil - Date.now())))) {
+      // a drain aborted the retry sleep: same as a killed child, the marker
+      // survives (presumedKilled) and the next daemon start resumes the
+      // session where it stopped.
       outcome.failed = true;
-      outcome.announcedDrop = await notifyDelivered("tokenmaxxing is restarting - this message was dropped; please re-send it.");
+      await notify("tokenmaxxing is restarting - this turn resumes after the restart.");
       break;
     }
   }

package/src/lib/slackstate.ts

@@ -14,6 +14,7 @@
 
 import { existsSync, readFileSync, readdirSync, unlinkSync } from "node:fs";
 import { join } from "node:path";
+import { omit } from "es-toolkit";
 import { z } from "zod";
 import { paths } from "./paths.ts";
 import { writeFileAtomic } from "./atomic.ts";
@@ -90,14 +91,23 @@ export function isChannelId(s: string): boolean {
  *  when it returns, so a marker that survives into the next daemon start means
  *  a restart killed the turn mid-run - startup then notifies the thread and
  *  auto-resumes it (2026-07-18 incident: a redeploy silently killed a ship
- *  turn 8 minutes in). resumeCount caps the retries: every resumed attempt
- *  spends real quota, so a turn that keeps dying must not retry forever. */
+ *  turn 8 minutes in). A marker can also survive a RETURNED turn on purpose:
+ *  a usage-limit deferral keeps it with resumeAt set, and the daemon resumes
+ *  the turn itself once the pool recovers (2026-07-20 incident: limit-hit
+ *  turns and depleted-pool drops sat dead until the user re-sent by hand).
+ *  resumeCount caps the retries: every resumed attempt spends real quota, so
+ *  a turn that keeps dying must not retry forever. */
 const ActiveTurnSchema = z.object({
   /** the original folded prompt, replayed verbatim when the killed turn never
    *  reached its init message (sessionId still null = nothing to resume). */
   prompt: z.string(),
   startedAt: z.string(),
   resumeCount: z.number().int().nonnegative(),
+  /** epoch ms when the pool is expected usable again: present only on a
+   *  usage-limit deferral. The daemon resumes the turn at this time (or at
+   *  startup once it has passed); a still-depleted pool at the wake simply
+   *  re-defers, bounded by resumeCount. */
+  resumeAt: z.number().int().positive().optional(),
   /** the DETACHED claude child's process-group id, persisted at spawn: an
    *  uncatchable daemon death (SIGKILL, crash) skips the exit hook that kills
    *  the group, so recovery must reap a surviving orphan before resuming -
@@ -188,23 +198,32 @@ const ResumeDecisionSchema = z.union([
 ]);
 export type ResumeDecision = z.infer<typeof ResumeDecisionSchema>;
 
-/** What startup should do with a thread whose activeTurn marker survived the
- *  previous daemon. Returns null for threads with no surviving marker. */
+/** What to do with a thread whose activeTurn marker survived: either the
+ *  previous daemon died mid-turn (no resumeAt - startup recovery) or a
+ *  usage-limit deferral parked the turn (resumeAt set - the scheduler fires
+ *  it once the pool recovers). Returns null for threads with no marker. The
+ *  resumed marker drops resumeAt: the wake is consumed, and a still-depleted
+ *  pool at the resume writes a fresh deferral with a fresh wake. */
 export function resumeDecision(record: SlackThread): ResumeDecision | null {
   const turn = record.activeTurn;
   if (!turn) return null;
+  const deferred = turn.resumeAt !== undefined;
   if (turn.resumeCount >= MAX_TURN_RESUMES) {
     return {
       kind: "give-up",
-      notice: `a daemon restart interrupted this turn, and ${MAX_TURN_RESUMES} resume attempts were interrupted too - giving up. Send a new message to continue.`,
+      notice: deferred
+        ? `this turn kept hitting the pool's usage limits and ${MAX_TURN_RESUMES} resume attempts were spent - giving up. Send a new message to continue.`
+        : `a daemon restart interrupted this turn, and ${MAX_TURN_RESUMES} resume attempts were interrupted too - giving up. Send a new message to continue.`,
     };
   }
-  const marker = { ...turn, resumeCount: turn.resumeCount + 1 };
+  const marker = omit({ ...turn, resumeCount: turn.resumeCount + 1 }, ["resumeAt"]);
   const attempt = marker.resumeCount > 1 ? ` (attempt ${marker.resumeCount}/${MAX_TURN_RESUMES})` : "";
   if (record.sessionId === null) {
     return {
       kind: "resume",
-      notice: `a daemon restart interrupted this turn before its session opened - starting it over${attempt}`,
+      notice: deferred
+        ? `the account pool has recovered - running your held message${attempt}`
+        : `a daemon restart interrupted this turn before its session opened - starting it over${attempt}`,
       prompt: turn.prompt,
       sessionId: null,
       marker,
@@ -212,8 +231,10 @@ export function resumeDecision(record: SlackThread): ResumeDecision | null {
   }
   return {
     kind: "resume",
-    notice: `a daemon restart interrupted this turn - resuming${attempt}`,
-    prompt: `A tokenmaxxing serve daemon restart killed your previous turn mid-run. Pick up exactly where you left off and finish the task. If the work was already complete, just summarize the final state. The original request was:\n\n${turn.prompt}`,
+    notice: deferred ? `the account pool has recovered - resuming this turn${attempt}` : `a daemon restart interrupted this turn - resuming${attempt}`,
+    prompt: deferred
+      ? `Your previous turn stopped early because every pooled account was at its usage limit; the pool has recovered. Pick up exactly where you left off and finish the task. If the work was already complete, just summarize the final state. The original request was:\n\n${turn.prompt}`
+      : `A tokenmaxxing serve daemon restart killed your previous turn mid-run. Pick up exactly where you left off and finish the task. If the work was already complete, just summarize the final state. The original request was:\n\n${turn.prompt}`,
     sessionId: record.sessionId,
     marker,
   };

package/src/lib/slackstream.ts

@@ -1,11 +1,16 @@
 // Maps Claude Agent SDK messages onto Chat SDK stream chunks so a relayed
 // Slack turn shows the agent's process natively: task cards for thinking and
 // tool calls (pending -> in_progress -> complete/error), streamed text via
-// markdown_text, and a closing turn card with model/cost/duration. TodoWrite
-// is special-cased into one stable "Todos" checklist card per stream that
-// updates in place as items progress. Structured chunks render only when the
-// Slack app has the agent feature + assistant:write (the adapter drops them
-// gracefully otherwise); plain text streams either way.
+// markdown_text, and a closing turn card with model/cost/duration. All task
+// cards in a turn group into ONE collapsible Slack plan block (user ask
+// 2026-07-20: "squash them into one dropdown"; the serve edge posts each turn
+// as a StreamingPlan with groupTasks "plan", superseding the 2026-07-18
+// separate-messages-around-tool-runs shape), so this mapper emits no segment
+// breaks: a turn is one streamed message. TodoWrite is special-cased into one
+// stable "Todos" checklist card per stream that updates in place as items
+// progress. Structured chunks render only when the Slack app has the agent
+// feature + assistant:write (the adapter drops them gracefully otherwise);
+// plain text streams either way.
 
 import { truncate } from "es-toolkit/compat";
 import { z } from "zod";
@@ -58,21 +63,20 @@ const StreamMapStateSchema = z.object({
    *  effect). */
   todoCards: z.record(z.string(), z.string()),
   thinkingCount: z.number(),
-  /** reply text streamed since the last segment break. */
-  textSinceBreak: z.boolean(),
+  /** non-whitespace reply text already streamed this turn: a later main text
+   *  block gets a "\n\n" separator, restoring the visual break the removed
+   *  per-tool message split used to provide (without it, post-tool prose
+   *  glues onto pre-tool prose and a block opening with "## " or a ```
+   *  fence loses its line-start position). */
+  textStreamed: z.boolean(),
 });
 export type StreamMapState = z.infer<typeof StreamMapStateSchema>;
 
 export function newStreamMapState(): StreamMapState {
-  return { open: {}, toolTitles: {}, todoCards: {}, thinkingCount: 0, textSinceBreak: false };
+  return { open: {}, toolTitles: {}, todoCards: {}, thinkingCount: 0, textStreamed: false };
 }
 
-/** Emitted when a tool starts after streamed reply text: the bridge closes the
- *  current Slack message there and posts the rest as a new one, mirroring how
- *  an agent turn reads as separate messages around its tool runs. */
-export const SegmentBreakSchema = z.object({ type: z.literal("segment_break") });
-
-const StreamPartSchema = z.union([z.string(), z.custom<StreamChunk>(), SegmentBreakSchema]);
+const StreamPartSchema = z.union([z.string(), z.custom<StreamChunk>()]);
 export type StreamPart = z.infer<typeof StreamPartSchema>;
 
 /** One human line out of a tool-input JSON blob; null when nothing fits. */
@@ -159,13 +163,14 @@ function resultText(content: z.infer<typeof ToolResultBlockSchema>["content"]):
 
 /**
  * Consume one SDK message, mutating state, and return the stream chunks it
- * produces (strings are streamed reply text; objects are native task cards).
- * Subagent events (parent_tool_use_id set) contribute their TOOL cards to the
- * timeline (user ask 2026-07-18: subagent activity shows as accordions like
- * tool calls) but never reply text, thinking cards, or segment breaks: a
- * subagent runs inside a top-level Task tool, so its churn decorates the
- * current message rather than reshaping it. Open blocks are keyed per stream
- * (parent + index) because concurrent subagent streams reuse index space.
+ * produces (strings are streamed reply text; objects are native task cards,
+ * all of which Slack folds into the turn's single plan block). Subagent
+ * events (parent_tool_use_id set) contribute their TOOL cards to that plan
+ * (user ask 2026-07-18: subagent activity shows alongside tool calls) but
+ * never reply text or thinking cards: a subagent runs inside a top-level Task
+ * tool, so its churn decorates the turn rather than reshaping it. Open blocks
+ * are keyed per stream (parent + index) because concurrent subagent streams
+ * reuse index space.
  */
 export function agentEventChunks(input: { state: StreamMapState; message: SDKMessage }): StreamPart[] {
   const { state, message } = input;
@@ -174,6 +179,12 @@ export function agentEventChunks(input: { state: StreamMapState; message: SDKMes
     const event = message.event;
     if (event.type === "content_block_start") {
       const key = `${message.parent_tool_use_id ?? "main"}:${event.index}`;
+      if (event.content_block.type === "text" && isMain && state.textStreamed) {
+        // a new text block after streamed text opens on a fresh paragraph:
+        // the whole turn is one Slack message now, and without the break
+        // post-tool prose would glue onto pre-tool prose mid-line.
+        return ["\n\n"];
+      }
       if (event.content_block.type === "thinking" && isMain) {
         state.thinkingCount += 1;
         const id = `thinking-${state.thinkingCount}`;
@@ -184,9 +195,8 @@ export function agentEventChunks(input: { state: StreamMapState; message: SDKMes
         const { id, name } = event.content_block;
         if (name === "TodoWrite") {
           // bookkeeping, not a real tool run: no card until the list arrives,
-          // no segment break, and no toolTitles entry (its "Todos have been
-          // modified" success result is noise; failures still surface via
-          // todoCards below).
+          // and no toolTitles entry (its "Todos have been modified" success
+          // result is noise; failures still surface via todoCards below).
           const cardId = todoCardId(message.parent_tool_use_id);
           state.open[key] = { kind: "todo", id: cardId, title: "Todos", acc: "" };
           state.todoCards[id] = cardId;
@@ -195,12 +205,7 @@ export function agentEventChunks(input: { state: StreamMapState; message: SDKMes
         const title = toolCardTitle(name);
         state.open[key] = { kind: "tool", id, title, acc: "" };
         state.toolTitles[id] = title;
-        const card: StreamPart = { type: "task_update", id, title, status: "in_progress" };
-        if (isMain && state.textSinceBreak) {
-          state.textSinceBreak = false;
-          return [{ type: "segment_break" }, card];
-        }
-        return [card];
+        return [{ type: "task_update", id, title, status: "in_progress" }];
       }
       return [];
     }
@@ -208,10 +213,9 @@ export function agentEventChunks(input: { state: StreamMapState; message: SDKMes
       const open = state.open[`${message.parent_tool_use_id ?? "main"}:${event.index}`];
       if (event.delta.type === "text_delta") {
         if (!isMain) return [];
-        // whitespace-only deltas must not count as reply text: a "\n\n"
-        // before a tool call would otherwise break the segment and strand a
-        // near-blank Slack message.
-        if (event.delta.text.trim() !== "") state.textSinceBreak = true;
+        // whitespace-only deltas do not count: a text block carrying only
+        // "\n\n" must not earn the next block a doubled separator.
+        if (event.delta.text.trim() !== "") state.textStreamed = true;
         return [event.delta.text];
       }
       if (event.delta.type === "thinking_delta" && open) open.acc += event.delta.thinking;
@@ -274,8 +278,9 @@ export function agentEventChunks(input: { state: StreamMapState; message: SDKMes
     // emitting it, the output still posts, and having posted text suppresses
     // the result fallback so it never double-posts.
     if (message.content.trim() === "") return [];
-    state.textSinceBreak = true;
-    return [message.content];
+    const sep = state.textStreamed ? "\n\n" : "";
+    state.textStreamed = true;
+    return [sep + message.content];
   }
   if (message.type === "result") {
     const models = Object.keys(message.modelUsage).join(" ");