tokenmaxxing 1.4.0 → 1.6.0

package/DESIGN.md

@@ -94,11 +94,13 @@ A local Socket Mode daemon (no public URL) that turns Slack threads into Claude
 - **Config**: `slack.json` (0600 - it holds the xoxb-/xapp- tokens) with per-channel links `{channel, repo, permissionMode, model?}`. `serve setup` prints the app manifest (bot scopes: app_mentions:read, assistant:write, channels:history, groups:history, chat:write, files:write, im:history, users:read; agent_view enabled; events incl. app_mention, message.channels/groups/im, app_home_opened, app_context_changed; socket mode) and prompts for the tokens; `serve link <channel-id> <repo>` manages links (channel IDs only - names drift, ids don't).
 - **Thread = session**: a bot mention in a linked channel subscribes the thread and opens the session in the linked repo checkout (normal mode, user decision 2026-07-18 superseding the same-day worktree-per-thread default; a later same-day decision: the agent cuts its own worktree FIRST for any mutating task - read-only turns stay parallel in the shared checkout - taught by the serve-session skill, since the recorded cwd can never move), and records `{threadId, cwd, sessionId}` under `slack-threads/`. Resume is cwd-keyed in claude, so the cwd stays byte-stable for the thread's life; records from the worktree era pin their old `slack-worktrees/<threadKey>` cwd and keep working (those worktrees are never auto-deleted - they hold the thread's work).
 - **Thread close-out (finish_thread)**: when the user says the work is finished, the model calls the in-process MCP tool `finish_thread` (a per-turn `createSdkMcpServer` in relayThread, `alwaysLoad: true`, granted via `allowedTools` since nobody can answer a permission prompt over Slack). The handler runs in the daemon but only flags the turn outcome; after the turn ends (claude subprocess gone, segments posted) serve.ts runs `cleanupThread`: delete the `slack-threads/` record, `thread.unsubscribe()`, and post one confirmation line. Threads run in the shared repo checkout, so there is nothing on disk to collect and the checkout is never touched; a fresh mention after close-out starts a new session.
-- **Turn = spawn**: each thread message runs ONE `query()` with `resume: sessionId` (never a persistent streaming query - the SDK subprocess reads credentials at spawn, so per-turn spawns are what let `ensureBestAccount()` land each turn on the freshest account, and the daemon can restart without losing threads). `stopHookCheck` rides along as the SDK Stop hook. Streamed `text_delta`s feed `thread.post(AsyncIterable)` (the adapter debounces edits); tool-only turns post the final result text.
+- **Turn = spawn**: each thread message runs ONE `query()` with `resume: sessionId` (the SDK subprocess reads credentials at spawn, so per-turn spawns are what let `ensureBestAccount()` land each turn on the freshest account, and the daemon can restart without losing threads). `stopHookCheck` rides along as the SDK Stop hook. Streamed `text_delta`s feed `thread.post(AsyncIterable)` (the adapter debounces edits); tool-only turns post the final result text.
+- **Steering (2026-07-27, owner decision: steering is the default for a mid-turn reply)**: the per-turn query takes STREAMING input (`prompt` as an AsyncIterable of stream-json user messages) instead of a one-shot string, so a relayable reply landing while the turn runs is written onto the live child's stdin. The CLI folds it into the running turn at the next tool boundary (the same queued-message injection interactive Claude Code uses; a message that misses the last fold window runs as its own turn in the same child before exit, so nothing drops - both verified against claude 2.1.220). serve-side: `relayThread` exposes a per-attempt `steer()` via `onSteer`, refused once the attempt's result arrives (stdin ends then, and the SDK silently drops writes to an ended stdin); `buildServeRuntime` keeps one acceptor per live thread and tries it per arriving message - refusals (idle thread, parked pool, a non-empty inbox or waiting turn for ordering, an out-of-order late arrival, drain) fall back to the inbox path. Steered text appends to the durable `activeTurn.prompt` (kill-replays and limit-resumes carry it) and folds into retry prompts; steered message ids ride the marker (`steeredMessageIds`) wearing the same hourglass-to-terminal reaction lifecycle; an inbound takeover of a deferred turn adopts the held turn's unsettled ids so no hourglass is orphaned, and a steer answers a resumed turn's pending ask (attention cleared) like a queued turn would. SUCCESS IS STICKY per attempt: a post-fold-window steer's own drained turn can emit a second, errored result after the primary answer already succeeded, and marking the turn failed then would re-run completed work through the retry machinery - the steer is announced lost in-thread instead, `outcome.steerLost` settles the steered messages' reactions as failed (a lost instruction must never read green; attribution is per-turn, a documented tradeoff on TurnOutcomeSchema), a limit classification stays sticky across a child's errored results (a drained turn's generic death must not declassify the primary turn's recoverable limit), and each turn's result-only answer is flushed AT its result so a trailing turn's notice or result can neither suppress nor clobber a tool-only answer (all adversarial-review catches). Two CLI gotchas are load-bearing: steered messages carry NO uuid (the CLI dedupes by uuid and silently swallows a reuse) and NO priority (default "next" folds politely; "now" is a hard interrupt).
+- **Arrival dispatch (2026-07-27, replacing the chat queue strategy)**: Chat runs `concurrency: {strategy: "concurrent"}` - every message reaches `onMessage` the moment Slack delivers it. The queue strategy's 30s dispatch-lock lease made mid-turn messages invisible until the turn ended and could REORDER them (a reply enqueued behind a live lease was released only when a later message took the expired lock, newest dispatched first - adversarial-review catch on the steering redesign, present at any TTL). The daemon owns everything the queue provided: per-thread turn ordering via the serialized chain (`serializedTurn` counts only TURN-producing work, so reaction notes and nudges can never gate steering - a second review catch); mid-turn folding via steering; and batching via a per-thread INBOX - un-steered messages accumulate and drain as ONE folded turn, sorted by Slack ts (ids are timestamps), so an upstream arrival race cannot reorder the prompt and a burst behind a long turn costs one metered spawn, not N. Per-thread arrival decisions are themselves chained (steer-or-inbox for one message completes before the next begins), and chat's message-id dedupe runs before its concurrency branch, so the app_mention + message.channels double-delivery stays deduped.
 - **Safety posture**: per-link `permissionMode`, default `acceptEdits`; `--yolo` (alias `--dangerous`) opts a link into `bypassPermissions`, and relayThread pairs it with the SDK's mandatory `allowDangerouslySkipPermissions: true` opt-in. `AskUserQuestion` is disallowed (unanswerable over Slack; the model asks in prose instead). Turn failures post a trimmed message-only diagnostic (never a raw error body). Outsiders must not drive sessions (harvested from Slaude at its 2026-07-18 shutdown): `isOutsideAuthor` fail-closed rejects any message whose team-origin fields disagree with the home workspace's `workspaceTeamId` (captured via auth.test at setup and re-captured at every daemon start, so the reference can never go stale against a rotated token), so Slack Connect externals and cross-workspace guests are silently ignored and can never open a session.
 - **Serve skills** (`src/serve-plugin/`, ships in the package via `files: ["src"]`): a Claude Code plugin loaded per turn (`plugins: [{type: "local", path}]`; discovered skills are enabled by default, so no `skills` option). `tokenmaxxing:ask-the-user` teaches the decision protocol - when input is needed, tag the requester with the raw Slack mention token `<@U...>`, ask compactly, END the turn (the thread reply is the next turn); `tokenmaxxing:serve-session` documents how the session runs (shared repo checkout, resume across turns, worktree-by-default for mutating tasks, handoff). The one dynamic fact skills cannot carry - who asked - rides in per turn via a `UserPromptSubmit` hook whose `additionalContext` ("Slack relay context: ...", built by `serveTurnContext`) names the triggering message author's mention token. The mention survives the pipeline because streamed `markdown_text` deltas pass verbatim and the post-and-edit fallback's `finalize` only linkifies bare `@U...`, never escaping an already-formed `<@U...>`. Skills are independent of the system prompt choice (probe-verified 2026-07-18 under the custom-string `SLACK_SYSTEM_PROMPT`: the init message lists the plugin + both skills + the Skill tool; the skill listing arrives as a conversation system-reminder, and CLAUDE.md loads via settingSources).
 - **Socket lifecycle**: `bot.initialize()` starts the persistent auto-reconnecting SocketModeClient; the daemon then just stays alive. The leased `startSocketModeListener` API must never be looped: it returns instantly without `waitUntil` and the loop starves the event loop (live incident 2026-07-18 - connected but silent).
-- **Id mapping**: Chat SDK ids are adapter-prefixed (`thread.channelId` = `slack:C0123`, `thread.id` = `slack:C0123:<threadTs>`) while links store bare Slack ids - lookups strip the prefix via `bareChannelId`. Subscriptions live in the daemon's memory state, so every mention re-subscribes its thread; queue-skipped messages (`context.skipped`) fold into the next prompt, with the queue-entry TTL raised to 1h (expiry is silent - no app callback in chat 4.34.0 - so it must outlast a depleted-pool park plus a long turn); per-thread turn serialization is owned by the daemon itself (a promise chain per thread id), because the SDK's queue dispatch lock has a 30s TTL extended only between dispatches and every claude turn outlives it; unlinked-channel traffic logs `serve.unlinked_channel` and stays silent in Slack.
+- **Id mapping**: Chat SDK ids are adapter-prefixed (`thread.channelId` = `slack:C0123`, `thread.id` = `slack:C0123:<threadTs>`) while links store bare Slack ids - lookups strip the prefix via `bareChannelId`. Subscriptions live in the daemon's memory state, so every mention re-subscribes its thread; per-thread turn serialization is owned by the daemon itself (a promise chain per thread id), and message batching by the daemon's inbox (see the arrival-dispatch bullet; the chat queue strategy and its skipped/TTL machinery were retired with the 2026-07-27 steering redesign, though `context.skipped` is still merged defensively when present); unlinked-channel traffic logs `serve.unlinked_channel` and stays silent in Slack.
 - **Restart resilience** (0.19.0, from the 2026-07-18 dead-thread incident: a deploy restart cut a turn mid-answer and left the thread deaf to follow-ups): startup re-subscribes every `slack-threads/` record straight on the state adapter (`state.subscribe(threadId)`; message routing checks `stateAdapter.isSubscribed`, verified in chat 4.34.0), so open threads survive restarts without needing a fresh mention. SIGTERM/SIGINT drains instead of dying: new turns are dropped loudly (`serve.drain_dropped` plus a tracked in-thread notice - a log-only drop reads as the bot thinking), tracked in-flight turns get up to 300s to finish (a re-snapshotting wait, so late-added notices still flush), then `Chat.shutdown()`; a second signal forces exit; the drain also aborts any depleted-pool park so a countdown never delays a restart. The claude child spawns detached in its own process group (`detachedClaudeSpawn` via the SDK's `spawnClaudeCodeProcess` hook), because a terminal Ctrl-C signals the whole foreground group and a non-detached child died with the daemon before the drain could save the turn; the signal handlers register before `bot.initialize()` so no turn can start while the process still has default signal disposition, and a rejecting `Chat.shutdown()` is caught so the drain always reaches its exit. When a `thread.post` rejects mid-turn (e.g. Slack finalizes an idle stream after an undocumented window: `message_not_in_streaming_state`), relayThread salvages the dead segment in TEXT space: proven-delivered text is a mirror StreamingMarkdownRenderer's committable prefix over the confirmed chunks (each pull proves the previous append landed; the adapter's renderer holds back the trailing unterminated line until its post-iteration forced flush, so chunk-granular salvage would miss a final reply with no trailing newline - the live 2026-07-21 incident), and the remainder re-posts as a fresh message split at line boundaries, plus unconfirmed cards, bounded by a futility budget that refills on delivery progress; the textLost diagnostic remains only for exhausted salvage, and ambiguous failures duplicate a tail line rather than lose it.
 - **Interrupted-turn recovery** (from the second 2026-07-18 restart incident: a redeploy killed a ship turn 8 minutes in with zero notice - drain cannot save a long turn, and a group-wide kill can take the claude child even detached): the thread record persists the claude session id the moment the init message assigns it, and every turn is wrapped in a durable `activeTurn` marker (original prompt, start time, resume count) written before the spawn and cleared when the turn returns - except that a turn failing DURING a drain keeps its marker, since that failure is presumed to be the shutdown signal killing the child. On startup, a surviving marker means a restart killed that turn: the daemon posts a notice into the thread (the chat-sdk's documented proactive handle, rebuilt with the thread's newest human message as streaming recipient context so the resumed turn keeps its native task cards, that message's author becoming the turn's requester) and auto-resumes the work - resuming the recorded session with a continuation prompt, or replaying the original prompt fresh when the kill landed before the session opened; resumed turns settle like inbound ones (outcome log + finish_thread GC). Retries cap at 3 (each spends real quota) with a loud give-up notice posted before its marker clears; a per-thread turn lock keeps a startup resume from ever racing an inbound message turn in the same cwd, every recovery branch recomputes its decision from a fresh record reload under that lock (so a resume superseded by a faster inbound turn no-ops instead of double-running), and a blocking singleton flock makes a new daemon generation wait for the previous one - drain included - to fully exit before touching any thread record. Uncatchable deaths cannot leak a working child either: SIGHUP drains like SIGTERM (its default disposition skips the exit hook that kills the detached group), and the marker records the child's group pid plus its C-locale ps start-time token at spawn, so recovery kills only an exactly-identified SIGKILL-orphaned claude (never a recycled pid) before resuming its turn.
 - **Depleted-pool recovery** (harvested from Slaude, reshaped around the pool): relayThread consumes the spawn-boundary switch decision instead of discarding it - a depleted pool with a known recovery inside the message's one 14min parking deadline (shared across chained parks, so the thread's queue slot is never held longer in total) posts a park notice and retries at the reset. A mid-turn limit - detected ONLY on errored results, since `is_error` can ride subtype `"success"` (`Claude AI usage limit reached|<epoch>`) and a successful answer discussing limits must never be re-run - is persisted into usage.json first (`recordObservedLimit`: the serve process has no statusLine tee, and the snapshot TTL would otherwise feed the retry the stale pre-limit state), then retried silently after a short beat, so a pool swap makes the hiccup invisible. Bounded recoveries; every drop the relay performs is announced in-thread.

package/README.md

@@ -23,6 +23,33 @@ bun add -g tokenmaxxing
 tokenmaxxing init
 ```
 
+Or with Nix (same source-run-by-Bun package; `init` still owns credentials, the `claude` shim, and settings merges). Install onto PATH first, then init — `nix run ... -- init` alone leaves supervisor shims without a stable `tokenmaxxing` on PATH after the ephemeral run exits:
+
+```sh
+nix profile install github:anaclumos/tokenmaxxing
+tokenmaxxing init
+```
+
+nix-darwin:
+
+```nix
+# flake inputs: tokenmaxxing.url = "github:anaclumos/tokenmaxxing";
+modules = [
+  inputs.tokenmaxxing.darwinModules.withOverlay
+  { programs.tokenmaxxing.enable = true; }
+];
+# then: tokenmaxxing init
+```
+
+Home Manager:
+
+```nix
+imports = [ inputs.tokenmaxxing.homeManagerModules.default ];
+programs.tokenmaxxing.enable = true;
+programs.tokenmaxxing.package = inputs.tokenmaxxing.packages.${pkgs.system}.default;
+# then: tokenmaxxing init
+```
+
 `init` imports the account you're already on, installs the `claude` supervisor + four `settings.json` entries (the tokenmaxxing statusLine, a subagentStatusLine, a Stop hook, a SessionStart hook), and adds the supervisor's bin dir to PATH in your shell rc (idempotent; it must sit ahead of the real `claude` to intercept it). Restart your shell, then add more accounts and go:
 
 ```sh

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "tokenmaxxing",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "description": "Automatic Claude Code account switching: pool multiple accounts and hot-swap when quota fills, resuming your session on the fresh account.",
   "type": "module",
   "license": "MIT",
@@ -33,10 +33,11 @@
     "dev": "bun run src/main.ts",
     "test": "bun test",
     "typecheck": "tsc --noEmit",
-    "prepublishOnly": "bun run typecheck && bun run test"
+    "prepublishOnly": "bun run typecheck && bun run test",
+    "nix:bun": "bunx bun2nix@2.1.2 -o bun.nix"
   },
   "devDependencies": {
-    "@types/bun": "latest",
+    "@types/bun": "1.3.14",
     "typescript": "^5.6.0"
   },
   "dependencies": {

package/src/cli/serve.ts

@@ -21,7 +21,7 @@ import { delay, omit, uniq } from "es-toolkit";
 import { z } from "zod";
 import { Chat, ConsoleLogger, StreamingPlan, ThreadImpl, type StreamChunk } from "chat";
 import { createSlackAdapter } from "@chat-adapter/slack";
-import { createMemoryState } from "@chat-adapter/state-memory";
+import { MemoryStateAdapter } from "@chat-adapter/state-memory";
 import {
   bareChannelId,
   isChannelId,
@@ -334,6 +334,10 @@ export function buildServeRuntime(seam: {
      *  relayThread). */
     onSpawn?: (pid: number) => void;
     drainSignal?: AbortSignal;
+    /** steering seam (see relayThread): a live attempt's steer function, or
+     *  null when the attempt ends. steer runs its onAccept callback
+     *  synchronously inside acceptance, before the child sees the text. */
+    onSteer?: (steer: ((text: string, onAccept?: () => void) => boolean) | null) => void;
   }) => Promise<TurnOutcome>;
   cleanup: (input: { threadId: string }) => CleanupOutcome;
   /** add/remove a status reaction on a message (production: the Slack
@@ -373,6 +377,33 @@ export function buildServeRuntime(seam: {
   const unlinkedLogged = new Set<string>();
   // corrupt thread records already logged as skipped this run (see nudgeSweep).
   const sweepSkipLogged = new Set<string>();
+  // Steering registry: one acceptor per thread with a LIVE query attempt
+  // (registered by runTurn via the relay's onSteer hook, removed when the
+  // attempt ends). onMessage tries the acceptor before the inbox - steering
+  // is the default for a mid-turn reply (owner decision 2026-07-27); a
+  // refusal (attempt ending, mention-only text, out-of-order arrival) falls
+  // back to the inbox path. A thread only ever appears here after handleTurn
+  // ran under this daemon's cfg, so the channel is known linked.
+  const liveSteers = new Map<string, (m: { relayed: { text: string; authorId: string; id: string }[] }) => Promise<boolean>>();
+  // TURN-PRODUCING serialized work per thread (running plus waiting). Only
+  // turn producers count (adversarial-review catch: reaction notes and nudge
+  // bookkeeping ride the same serialized chain, and counting them silently
+  // disabled steering for the rest of any turn a user reacted to). A steer
+  // is only ordered when nothing waits behind the live turn.
+  const turnDepth = new Map<string, number>();
+  // Un-steered messages waiting for the next turn, folded and drained as ONE
+  // turn (sorted by Slack ts, which restores order for any upstream arrival
+  // race). This is the daemon-owned replacement for the chat queue's
+  // skipped-message folding. Each entry carries its delivery's mention flag,
+  // so the drained turn derives mention-ness from the RETAINED messages - a
+  // mention dropped by the overflow cap must not leave a phantom flag behind
+  // (cubic review catch on PR #50).
+  const pendingInbox = new Map<string, { text: string; authorId: string; id: string; isMention: boolean }[]>();
+  // Per-thread arrival ordering: the steer attempt and the inbox push for
+  // one message run to completion before the next message's do, so two
+  // near-simultaneous replies can never interleave at the acceptor's await
+  // points and land on the child's stdin out of order.
+  const arrivalChains = new Map<string, Promise<void>>();
 
   /** Best-effort status reaction: reaction state is decoration, so every
    *  failure (missing reactions:write until the app is reinstalled,
@@ -391,7 +422,9 @@ export function buildServeRuntime(seam: {
    *  before the spawn, cleared when the turn returns, so a marker surviving
    *  into the next daemon start identifies a turn a restart killed mid-run.
    *  The session id persists the moment init assigns it - a first-turn kill
-   *  must stay resumable. */
+   *  must stay resumable. Returns the steered message ids alongside the
+   *  outcome: they joined the turn mid-run, so the caller's settle must
+   *  close their reaction lifecycle too. */
   const runTurn = async (input: {
     thread: { id: string; post: (m: StreamingPlan) => Promise<unknown> };
     record: SlackThread;
@@ -400,14 +433,17 @@ export function buildServeRuntime(seam: {
     sessionId: string | null;
     marker: ActiveTurn;
     link: SlackLink;
-  }): Promise<TurnOutcome> => {
+  }): Promise<{ outcome: TurnOutcome; steeredMessageIds: string[] }> => {
     let record: SlackThread = { ...input.record, activeTurn: input.marker };
     saveSlackThread(record);
-    // the whole turn (parks and retries included) reads as "being processed".
-    if (input.marker.messageId) {
-      await setStatus({ threadId: input.thread.id, messageId: input.marker.messageId, emoji: STATUS_EMOJI.processing, op: "add" });
+    // the whole turn (parks and retries included) reads as "being processed";
+    // a resumed marker's steered messages re-arm their hourglass too
+    // (setStatus swallows already_reacted).
+    for (const id of [input.marker.messageId, ...(input.marker.steeredMessageIds ?? [])]) {
+      if (id) await setStatus({ threadId: input.thread.id, messageId: id, emoji: STATUS_EMOJI.processing, op: "add" });
     }
     let outcome: TurnOutcome | null = null;
+    let steeredMessageIds = input.marker.steeredMessageIds ?? [];
     try {
       outcome = await seam.relay({
         cwd: record.cwd,
@@ -424,9 +460,14 @@ export function buildServeRuntime(seam: {
         onSpawn: (pid) => {
           // the lstart token makes the pid a verifiable identity for the
           // orphan reaper; a child dead before ps sees it persists without
-          // one, and an identity-less pid is never signaled.
+          // one, and an identity-less pid is never signaled. Built on the
+          // CURRENT marker (a steer may have grown it), with the previous
+          // spawn's identity dropped: a retry child must never inherit the
+          // dead child's lstart, or the reaper would skip (or mis-verify)
+          // the live group.
           const startedAt = pidStartTime(pid);
-          record = { ...record, activeTurn: { ...input.marker, pid, ...(startedAt === null ? {} : { pidStartedAt: startedAt }) } };
+          const marker = omit(record.activeTurn ?? input.marker, ["pid", "pidStartedAt"]);
+          record = { ...record, activeTurn: { ...marker, pid, ...(startedAt === null ? {} : { pidStartedAt: startedAt }) } };
           saveSlackThread(record);
         },
         onSessionId: (sessionId) => {
@@ -434,9 +475,115 @@ export function buildServeRuntime(seam: {
           saveSlackThread(record);
         },
         drainSignal: drainAbort.signal,
+        // While an attempt is steerable, a relayable mid-turn message folds
+        // into the RUNNING turn (owner decision 2026-07-27: steering is the
+        // default; the queued next turn is only the fallback). The acceptor
+        // runs its marker mutation synchronously after a successful steer:
+        // the steered text becomes part of the durable prompt (replays and
+        // retries must include it) before any await can interleave with the
+        // turn's own marker writes.
+        onSteer: (steerText) => {
+          if (steerText === null) {
+            liveSteers.delete(input.thread.id);
+            return;
+          }
+          liveSteers.set(input.thread.id, async (m) => {
+            const stripped = m.relayed
+              .map((r) => ({ text: stripLeadingMention({ text: r.text, botUserId: seam.botUserId() }), authorId: r.authorId, id: r.id }))
+              .filter((r) => r.text !== "");
+            if (stripped.length === 0) return false;
+            // out-of-order insurance: Slack ids are timestamps, so a message
+            // OLDER than anything this turn already carries arrived late
+            // through an upstream race - refuse it into the inbox, whose
+            // drain sorts by ts, instead of folding it after its successor.
+            const seen = record.activeTurn ?? input.marker;
+            const newestSeen = Math.max(Number(seen.messageId ?? 0) || 0, ...(seen.steeredMessageIds ?? []).map((id) => Number(id) || 0));
+            if (stripped.some((r) => (Number(r.id) || 0) < newestSeen)) return false;
+            // per-turn steer budget (cursor security review, round 2 on
+            // PR #50): accepted steers grow the durable prompt and the
+            // child's queue outside the inbox's 100-entry cap, so a flood
+            // could balloon one turn without bound. Far past any human
+            // steering cadence, a reply takes the capped inbox path instead.
+            if ((seen.steeredMessageIds?.length ?? 0) + stripped.length > 25) return false;
+            // hourglass BEFORE the steer so a settle racing this acceptor
+            // can never leave an unremovable reaction; a refusal takes it
+            // back off.
+            for (const r of stripped) {
+              await setStatus({ threadId: input.thread.id, messageId: r.id, emoji: STATUS_EMOJI.processing, op: "add" });
+            }
+            // authors the turn does not know yet get named inline: the
+            // UserPromptSubmit context does not re-fire for folded mid-turn
+            // messages, so attribution rides the message itself.
+            const text = stripped
+              .map((r) => (input.requesterIds.includes(r.authorId) ? r.text : `Message from <@${r.authorId}>:\n${r.text}`))
+              .join("\n\n");
+            // The durable commit runs INSIDE steer's acceptance, in the same
+            // JS tick as its liveness check (adversarial-review catch, round
+            // 3: this acceptor runs on the arrival chain and can resume from
+            // its hourglass awaits AFTER the turn ended - a write-ahead save
+            // here resurrected the finished turn's marker on disk, and its
+            // refusal rollback clobbered post-turn state with a stale
+            // snapshot). Acceptance proves the turn is live, so the closure
+            // record is disk-faithful; the marker still grows durably BEFORE
+            // the text reaches the child's stdin (a crash in between replays
+            // a steer the child may never have seen - duplication over
+            // loss); and a refusal commits nothing, so a stale invocation is
+            // a harmless fall-through to the inbox.
+            let asked: SlackThread["attention"];
+            const commit = () => {
+              const mergedRequesters = uniq([...input.requesterIds, ...stripped.map((r) => r.authorId)]);
+              const marker = record.activeTurn ?? input.marker;
+              const grownIds = [...(marker.steeredMessageIds ?? []), ...stripped.map((r) => r.id)];
+              let next = { ...record, activeTurn: { ...marker, prompt: `${marker.prompt}\n\n${text}`, requesterIds: mergedRequesters, steeredMessageIds: grownIds } };
+              // the user responded: a pending ask is answered by the steer
+              // just like by a queued turn (adversarial-review catch:
+              // leaving it would strand the question mark and fire a
+              // spurious nudge about an ask this very message answered).
+              const pendingAsk = next.attention;
+              if (pendingAsk) next = omit(next, ["attention"]);
+              // all-or-nothing (cubic review catch, round 4): the durable
+              // save runs before ANY outer mutation, so a failed write
+              // leaves the turn's view untouched and the refusal fallback
+              // below starts from clean state - without this ordering the
+              // settle would stamp the never-delivered message with the
+              // turn's outcome emoji.
+              saveSlackThread(next);
+              steeredMessageIds = grownIds;
+              record = next;
+              asked = pendingAsk;
+              for (const r of stripped) {
+                if (!input.requesterIds.includes(r.authorId)) input.requesterIds.push(r.authorId);
+              }
+            };
+            // a throwing commit (the durable save failing) escapes steer()
+            // BEFORE the text reaches the child or the relay records it
+            // (cubic review catch, round 4): treat it as a refusal, so the
+            // message keeps its inbox fallback instead of vanishing into
+            // the generic task_crashed log with its hourglass stranded. If
+            // the disk stays broken, the inbox turn's own marker write
+            // surfaces it loudly through the crash-notice path.
+            let accepted = false;
+            try {
+              accepted = steerText(text, commit);
+            } catch (e) {
+              log("serve.steer_commit_failed", { thread: input.thread.id, err: (e instanceof Error ? e.message : String(e)).slice(0, 300) });
+            }
+            if (!accepted) {
+              for (const r of stripped) {
+                await setStatus({ threadId: input.thread.id, messageId: r.id, emoji: STATUS_EMOJI.processing, op: "remove" });
+              }
+              return false;
+            }
+            log("serve.steered", { thread: input.thread.id, texts: stripped.length });
+            if (asked?.messageId) {
+              await setStatus({ threadId: input.thread.id, messageId: asked.messageId, emoji: STATUS_EMOJI.attention, op: "remove" });
+            }
+            return true;
+          });
+        },
       });
       record = { ...record, sessionId: outcome.sessionId };
-      return outcome;
+      return { outcome, steeredMessageIds };
     } finally {
       // a failure DURING a drain is presumed to be the shutdown signal killing
       // the claude child (terminal Ctrl-C and group signals hit the whole
@@ -462,6 +609,9 @@ export function buildServeRuntime(seam: {
       if (!draining && outcome !== null && outcome.failed && outcome.rateLimited && !outcome.announcedDrop && deferUntil === null) {
         log("serve.drop_unannounced", { thread: input.thread.id });
       }
+      // belt-and-braces: the relay clears its steer hook per attempt, but the
+      // registry entry must never outlive the turn that owns it.
+      liveSteers.delete(input.thread.id);
       if (deferUntil !== null && record.activeTurn) {
         record = { ...record, activeTurn: { ...record.activeTurn, resumeAt: deferUntil } };
         saveSlackThread(record);
@@ -474,7 +624,7 @@ export function buildServeRuntime(seam: {
 
   const handleTurn = async (input: {
     thread: ServeThread;
-    /** every relayed message this turn (queue-skipped + triggering), text
+    /** every relayed message this turn (the inbox batch, ts-sorted), text
      *  paired with its author id: a decision may be owed to an earlier
      *  folded sender, and a sender whose whole message was the bot mention
      *  contributes no prompt text, so text and author filter together
@@ -529,11 +679,10 @@ export function buildServeRuntime(seam: {
       return;
     }
     log("serve.message", { thread: thread.id, isMention, texts: input.relayed.length });
-    // relayed carries queue-skipped messages plus the triggering one: the
-    // queue strategy hands a turn only the LATEST message and the rest via
-    // context.skipped, so they are folded into one prompt here. A message
-    // that is empty once its bot mention is stripped contributes neither
-    // prompt text nor a requester id (cursor review catch 2026-07-18).
+    // relayed carries every message the inbox batched for this turn, folded
+    // into one prompt here. A message that is empty once its bot mention is
+    // stripped contributes neither prompt text nor a requester id (cursor
+    // review catch 2026-07-18).
     const stripped = input.relayed
       .map((m) => ({ text: stripLeadingMention({ text: m.text, botUserId: seam.botUserId() }), authorId: m.authorId }))
       .filter((m) => m.text !== "");
@@ -575,6 +724,12 @@ export function buildServeRuntime(seam: {
     // prompt re-appears alongside the session transcript that already holds
     // its partial work, and the newer message steers.
     const deferred = record.activeTurn?.resumeAt !== undefined ? record.activeTurn : null;
+    // a taken-over deferral's messages still wear their processing hourglass
+    // (a deferral settles nothing); this turn serves their held prompt, so
+    // it adopts their ids and settles them with its own outcome - without
+    // the adoption the old trigger's hourglass would read "processing"
+    // forever once the fold replaced its marker.
+    const adoptedIds = deferred ? [...(deferred.messageId ? [deferred.messageId] : []), ...(deferred.steeredMessageIds ?? [])] : [];
     if (deferred) {
       const timer = deferredTimers.get(thread.id);
       if (timer !== undefined) clearTimeout(timer);
@@ -612,16 +767,16 @@ export function buildServeRuntime(seam: {
     // agent feature + assistant:write (the adapter warns instead of throwing).
     await thread.startTyping();
     const startedAt = Date.now();
-    const outcome = await runTurn({
+    const { outcome, steeredMessageIds } = await runTurn({
       thread,
       record,
       prompt,
       requesterIds,
       sessionId: record.sessionId,
-      marker: { prompt, startedAt: new Date().toISOString(), resumeCount: 0, ...(messageId ? { messageId } : {}), requesterIds },
+      marker: { prompt, startedAt: new Date().toISOString(), resumeCount: 0, ...(messageId ? { messageId } : {}), requesterIds, ...(adoptedIds.length > 0 ? { steeredMessageIds: adoptedIds } : {}) },
       link,
     });
-    await settleTurn({ thread, outcome, startedAt, messageId, requesterIds });
+    await settleTurn({ thread, outcome, startedAt, messageId, steeredMessageIds, requesterIds });
   };
 
   /** Post-turn bookkeeping shared by inbound and resumed turns: the outcome
@@ -634,6 +789,9 @@ export function buildServeRuntime(seam: {
     startedAt: number;
     /** the triggering message carrying the status reactions; absent = skip. */
     messageId?: string;
+    /** messages steered into the turn mid-run: they carry the same reaction
+     *  lifecycle as the trigger and settle with the same emoji. */
+    steeredMessageIds?: string[];
     /** the turn's asked users, persisted when the model flagged attention. */
     requesterIds?: string[];
   }) => {
@@ -657,10 +815,19 @@ export function buildServeRuntime(seam: {
     // below makes the question mark unremovable forever.
     const killedByDrain = draining && outcome.failed && !outcome.announcedDrop && !outcome.resultReceived;
     const deferredForResume = outcome.deferUntil !== null;
-    if (input.messageId && !killedByDrain && !deferredForResume) {
+    if (!killedByDrain && !deferredForResume) {
       const emoji = outcome.failed ? STATUS_EMOJI.failed : outcome.attention && !outcome.finish ? STATUS_EMOJI.attention : STATUS_EMOJI.done;
-      await setStatus({ threadId: thread.id, messageId: input.messageId, emoji, op: "add" });
-      await setStatus({ threadId: thread.id, messageId: input.messageId, emoji: STATUS_EMOJI.processing, op: "remove" });
+      // steerLost: a steered follow-up's own drained turn failed after the
+      // primary turn succeeded, so the steered messages settle as failed -
+      // matching the in-thread re-send notice; a lost instruction must never
+      // read green (see TurnOutcomeSchema.steerLost for the per-turn
+      // attribution tradeoff).
+      const steeredEmoji = outcome.steerLost ? STATUS_EMOJI.failed : emoji;
+      for (const id of [input.messageId, ...(input.steeredMessageIds ?? [])]) {
+        if (!id) continue;
+        await setStatus({ threadId: thread.id, messageId: id, emoji: id === input.messageId ? emoji : steeredEmoji, op: "add" });
+        await setStatus({ threadId: thread.id, messageId: id, emoji: STATUS_EMOJI.processing, op: "remove" });
+      }
     }
     // the model asked the user for a decision: mark the thread waiting so the
     // nudge sweep and the reaction-answer path can see it. Persisted even on
@@ -755,12 +922,12 @@ export function buildServeRuntime(seam: {
     }
   };
 
-  // Per-thread serialization owned HERE, not only by the SDK's queue lock:
-  // chat 4.34.0 acquires the dispatch lock with a 30s TTL and extends it only
-  // BETWEEN dispatches, so any handler outliving 30s (every claude turn, any
-  // depleted-pool park) lets a later message take the expired lock and start
-  // a second concurrent handler in the same thread and cwd (review catch,
-  // PR #18). Escaped messages run as sequential turns in arrival order.
+  // Per-thread serialization owned HERE: with concurrent dispatch (see
+  // runDaemon's Chat config) chat provides no per-thread locking at all, so
+  // this chain is the ONLY thing keeping two claude turns off one thread's
+  // cwd and session. It predates the concurrent switch for the same reason
+  // in weaker form: chat's old queue lock expired 30s into any claude turn
+  // and let a second handler start anyway (review catch, PR #18).
   const threadTurns = new Map<string, Promise<void>>();
   const serialized = (threadId: string, run: () => Promise<void>) => {
     const prev = threadTurns.get(threadId) ?? Promise.resolve();
@@ -782,18 +949,101 @@ export function buildServeRuntime(seam: {
     })();
     return next;
   };
+  /** serialized + the turnDepth count, for callers that produce a claude
+   *  TURN (inbox drains, reaction answers, recoveries). Bookkeeping riders
+   *  on the chain (reaction notes, nudges) use bare `serialized` so they
+   *  never gate steering. */
+  const serializedTurn = (threadId: string, run: () => Promise<void>) => {
+    turnDepth.set(threadId, (turnDepth.get(threadId) ?? 0) + 1);
+    const next = serialized(threadId, run);
+    void next.catch(() => {}).finally(() => {
+      const depth = (turnDepth.get(threadId) ?? 1) - 1;
+      if (depth <= 0) turnDepth.delete(threadId);
+      else turnDepth.set(threadId, depth);
+    });
+    return next;
+  };
 
   // both Chat SDK callbacks funnel here. Filter EVERY message, trigger
   // included: an outsider (or our own post) arriving last must not discard
-  // relayable home-workspace messages queued behind the turn - the queue hands
-  // the handler only the latest message and the rest ride context.skipped
-  // (review catch, PR #18).
+  // relayable home-workspace messages delivered alongside it (review catch,
+  // PR #18). context.skipped is empty under concurrent dispatch but stays
+  // merged defensively - a chat release reintroducing batching must not
+  // silently drop messages.
   const onMessage = async (input: { thread: ServeThread; message: ServeMessage; skipped: ServeMessage[]; isMention: boolean }) => {
     const relayed = [...input.skipped, input.message].filter(relayable).map((m) => ({ text: m.text, authorId: m.author.userId, id: m.id }));
     if (relayed.length === 0) return; // outsider mentions never open a session
-    await tracked(serialized(input.thread.id, async () => {
+    // arrivals for one thread DECIDE strictly one at a time, in delivery
+    // order: the steer-or-inbox decision for this message completes before
+    // the next message's begins, so two near-simultaneous replies can never
+    // interleave at the acceptor's await points. The chain holds only the
+    // DECISION - a scheduled turn's completion is awaited outside it, or a
+    // long turn would hold every later arrival hostage and steering could
+    // never engage.
+    const prev = arrivalChains.get(input.thread.id) ?? Promise.resolve();
+    const job = (async () => {
+      try {
+        await prev;
+      } catch { /* the previous arrival's failure was surfaced to its own caller */ }
+      return dispatchArrival({ thread: input.thread, relayed, isMention: input.isMention });
+    })();
+    const link = job.then(
+      () => {},
+      () => {},
+    );
+    arrivalChains.set(input.thread.id, link);
+    void link.then(() => {
+      if (arrivalChains.get(input.thread.id) === link) arrivalChains.delete(input.thread.id);
+    });
+    // tracked from the DECISION on (codex review catch on PR #50): the drain
+    // waits on activeTurns, and an arrival still deciding at shutdown lived
+    // nowhere else - the daemon could exit before the message reached the
+    // inbox, a marker, or the drop notice.
+    await tracked((async () => {
+      const scheduled = await job;
+      if (scheduled) await scheduled.turn;
+    })());
+  };
+
+  /** One message's steer-or-inbox decision. Steering first (owner decision
+   *  2026-07-27): a reply landing while the thread's turn is running folds
+   *  into that turn instead of waiting behind it. Guarded to an empty inbox
+   *  and no waiting turn, or the fold would reorder this message ahead of
+   *  one already waiting; a drain keeps its loud-drop contract. Every
+   *  refusal falls through to the inbox, whose drain runs ALL waiting
+   *  messages as one folded turn - the daemon-owned replacement for the
+   *  chat queue's skipped-message folding, sorted by Slack ts so an
+   *  upstream arrival race cannot reorder the prompt. Returns the tracked
+   *  drain-turn promise when this arrival scheduled one, so the caller can
+   *  await the turn without holding the arrival chain. */
+  const dispatchArrival = async (input: { thread: ServeThread; relayed: { text: string; authorId: string; id: string }[]; isMention: boolean }): Promise<{ turn: Promise<void> } | null> => {
+    const threadId = input.thread.id;
+    if (!draining && (pendingInbox.get(threadId)?.length ?? 0) === 0 && (turnDepth.get(threadId) ?? 0) <= 1) {
+      const accept = liveSteers.get(threadId);
+      if (accept && (await accept({ relayed: input.relayed }))) return null;
+    }
+    const inbox = pendingInbox.get(threadId) ?? [];
+    const hadPending = inbox.length > 0;
+    inbox.push(...input.relayed.map((r) => ({ ...r, isMention: input.isMention })));
+    // hard cap, replacing the retired chat queue's maxQueueSize bound
+    // (cursor security review on PR #50): without it a flood during one
+    // long turn grows memory and the folded prompt without limit. Newest
+    // dropped, LOUDLY - the old queue's silent drop-oldest ate the earliest
+    // instructions, the worse failure.
+    if (inbox.length > 100) {
+      log("serve.inbox_dropped", { thread: threadId, dropped: inbox.length - 100 });
+      inbox.length = 100;
+    }
+    pendingInbox.set(threadId, inbox);
+    // one drain per non-empty inbox: later arrivals fold into the batch the
+    // already-scheduled drain snapshots when it finally runs.
+    if (hadPending) return null;
+    const turn = tracked(serializedTurn(threadId, async () => {
+      const batch = (pendingInbox.get(threadId) ?? []).sort((a, b) => Number(a.id) - Number(b.id));
+      pendingInbox.delete(threadId);
+      if (batch.length === 0) return;
       try {
-        await handleTurn({ thread: input.thread, relayed, isMention: input.isMention });
+        await handleTurn({ thread: input.thread, relayed: batch, isMention: batch.some((m) => m.isMention) });
       } catch (e) {
         // an escaped handleTurn throw (a state-file parse, a Slack API
         // rejection outside relayThread's never-throws boundary) previously
@@ -825,13 +1075,14 @@ export function buildServeRuntime(seam: {
         }
         // a crash after runTurn added the hourglass would otherwise read as
         // "processing" forever (codex review catch); setStatus never throws.
-        const messageId = relayed.at(-1)?.id;
+        const messageId = batch.at(-1)?.id;
         if (messageId) {
           await setStatus({ threadId: input.thread.id, messageId, emoji: STATUS_EMOJI.failed, op: "add" });
           await setStatus({ threadId: input.thread.id, messageId, emoji: STATUS_EMOJI.processing, op: "remove" });
         }
       }
     }));
+    return { turn };
   };
 
   /** A user reaction in a tracked thread. While the thread waits on an asked
@@ -872,6 +1123,14 @@ export function buildServeRuntime(seam: {
       log("serve.reaction_dropped", { thread: input.threadId, reason: "unlinked-channel" });
       return;
     }
+    // bare `serialized` on purpose, so a reaction can never gate steering
+    // (adversarial-review catch: counting these bookkeeping riders in
+    // turnDepth silently disabled steering for the rest of any turn a user
+    // reacted to). Accepted tradeoff (documented, WONTFIX): in the rare
+    // shape where an ANSWER turn is queued here behind a live turn, a
+    // fresh reply may steer the live turn ahead of the queued answer - both
+    // still reach the model, and an answer coexisting with a live turn only
+    // occurs in multi-user threads.
     await tracked(serialized(input.threadId, async () => {
       const fresh = loadSlackThread(input.threadId);
       if (!fresh) return; // finished while queued
@@ -1052,7 +1311,9 @@ export function buildServeRuntime(seam: {
     try {
       const { thread, requesterIds } = await seam.streamable(record.threadId);
       const link = linkForChannel(cfg, bareChannelId(thread.channelId));
-      await serialized(record.threadId, async () => {
+      // serializedTurn: a recovery runs a real claude turn, so it must gate
+      // steering-order like any other queued turn.
+      await serializedTurn(record.threadId, async () => {
         // a drain signal can land between the scan and this turn; leave the
         // marker at its previous count so the next start retries.
         if (draining) return;
@@ -1086,10 +1347,11 @@ export function buildServeRuntime(seam: {
           // with the user never told the daemon gave up.
           await thread.post(decision.notice);
           saveSlackThread(omit(fresh, ["activeTurn"]));
-          // the abandoned turn's message must not keep reading as processing.
-          if (turn.messageId) {
-            await setStatus({ threadId: thread.id, messageId: turn.messageId, emoji: STATUS_EMOJI.failed, op: "add" });
-            await setStatus({ threadId: thread.id, messageId: turn.messageId, emoji: STATUS_EMOJI.processing, op: "remove" });
+          // the abandoned turn's messages must not keep reading as processing.
+          for (const id of [turn.messageId, ...(turn.steeredMessageIds ?? [])]) {
+            if (!id) continue;
+            await setStatus({ threadId: thread.id, messageId: id, emoji: STATUS_EMOJI.failed, op: "add" });
+            await setStatus({ threadId: thread.id, messageId: id, emoji: STATUS_EMOJI.processing, op: "remove" });
           }
           return;
         }
@@ -1127,9 +1389,10 @@ export function buildServeRuntime(seam: {
               // or its hourglass reads "processing" forever (cubic review
               // catch on PR #43). The unlinked abandon above stays reactionless
               // on purpose: unlinked channels are contractually untouchable.
-              if (turn.messageId) {
-                await setStatus({ threadId: thread.id, messageId: turn.messageId, emoji: STATUS_EMOJI.failed, op: "add" });
-                await setStatus({ threadId: thread.id, messageId: turn.messageId, emoji: STATUS_EMOJI.processing, op: "remove" });
+              for (const id of [turn.messageId, ...(turn.steeredMessageIds ?? [])]) {
+                if (!id) continue;
+                await setStatus({ threadId: thread.id, messageId: id, emoji: STATUS_EMOJI.failed, op: "add" });
+                await setStatus({ threadId: thread.id, messageId: id, emoji: STATUS_EMOJI.processing, op: "remove" });
               }
               saveSlackThread(omit(fresh, ["activeTurn"]));
               return;
@@ -1153,8 +1416,8 @@ export function buildServeRuntime(seam: {
         // nudge and answer-gate the users who were actually asked (vercel
         // review catch on PR #43); older markers without the field fall back.
         const resumedRequesterIds = decision.marker.requesterIds ?? requesterIds;
-        const outcome = await runTurn({ thread, record: fresh, prompt: decision.prompt, requesterIds: resumedRequesterIds, sessionId: decision.sessionId, marker: decision.marker, link });
-        await settleTurn({ thread, outcome, startedAt, messageId: decision.marker.messageId, requesterIds: resumedRequesterIds });
+        const { outcome, steeredMessageIds } = await runTurn({ thread, record: fresh, prompt: decision.prompt, requesterIds: resumedRequesterIds, sessionId: decision.sessionId, marker: decision.marker, link });
+        await settleTurn({ thread, outcome, startedAt, messageId: decision.marker.messageId, steeredMessageIds, requesterIds: resumedRequesterIds });
       });
     } catch (e) {
       const detail = (e instanceof Error ? e.message : String(e)).slice(0, 300);
@@ -1276,24 +1539,25 @@ async function runDaemon(): Promise<number> {
   // held directly (not only via Chat) so startup can re-subscribe recorded
   // threads: subscriptions live in this in-memory state and die with the
   // process, and only a fresh mention would otherwise revive a thread.
-  const state = createMemoryState();
+  const state = new MemoryStateAdapter();
   const bot = new Chat({
     userName: "tokenmaxxing",
     adapters: { slack },
     state,
-    // per-thread lock with queueing: a message landing mid-turn waits its turn
-    // instead of racing a second claude spawn on the same cwd. Queue-entry TTL
-    // expiry is SILENT (chat 4.34.0 has no app callback for it), so the TTL
-    // must outlast the longest legitimate hold: a depleted-pool park
-    // (PARK_MAX_MS 14min) plus a long claude turn. Expired-and-folded beats
-    // silently-vanished, hence a full hour. maxQueueSize matters for the same
-    // reason: the SDK default is 10 with a LOG-LESS drop-oldest trim
-    // (@chat-adapter/state-memory enqueue splices the front, and the SDK's
-    // message-dropped log only fires for drop-newest), so a >10-message burst
-    // behind one long turn silently ate the oldest instructions
-    // (adversarial-review catch). 100 outlasts any legitimate burst; the TTL
-    // stays the real bound.
-    concurrency: { strategy: "queue", queueEntryTtlMs: 3_600_000, maxQueueSize: 100 },
+    // CONCURRENT dispatch (steering redesign, superseding the queue strategy
+    // and its 1h-TTL/size-100 tuning): every message reaches onMessage the
+    // moment Slack delivers it, in arrival order. The queue strategy's
+    // 30s dispatch-lock lease made mid-turn messages invisible AND could
+    // reorder them - a reply enqueued behind a live lease was only released
+    // when a LATER message took the expired lock, dispatching newest-first
+    // (adversarial-review catch; chat 4.34.0 handleQueueOrDebounce). The
+    // daemon owns everything the queue used to provide: per-thread turn
+    // ordering (the serialized chain), mid-turn folding (the steering path),
+    // and batching of waiting messages (the per-thread inbox in
+    // buildServeRuntime, drained sorted as ONE folded turn). Chat's
+    // message-id dedupe runs before the concurrency branch, so the
+    // app_mention + message.channels double-delivery stays deduped.
+    concurrency: { strategy: "concurrent" },
     // without this a cards-only segment in post-and-edit fallback would
     // strand a bare "..." placeholder message.
     fallbackStreamingPlaceholderText: null,

package/src/lib/install.ts

@@ -33,14 +33,65 @@ export function isBinDirAhead(): boolean {
   }
 }
 
+// Optional "1"/"true"/"yes" flag; unset/empty → undefined (feature off).
+const EnvFlagSchema = z.enum(["1", "true", "yes"]).optional().catch(undefined);
+
+/** True when this process is the Nix-packaged CLI (flake startScript sets
+ *  TOKENMAXXING_NIX=1; store-path Bun.main is the fallback for wraps that
+ *  forget the env). Env overrides parse at the read site. */
+export function isNixPackaged(): boolean {
+  if (EnvFlagSchema.parse(process.env.TOKENMAXXING_NIX) != null) return true;
+  try {
+    return realpathSync(Bun.main).startsWith("/nix/store/");
+  } catch {
+    return false;
+  }
+}
+
+/** True when a Nix module owns the periodic check timer; init must not write
+ *  a second imperative unit. */
+export function skipImperativeTimer(): boolean {
+  return EnvFlagSchema.parse(process.env.TOKENMAXXING_SKIP_TIMER) != null;
+}
+
+/** Nix supervisor shim: prefer a PATH-stable `tokenmaxxing` (profile /
+ *  current-system, excluding this binDir) so upgrades/GC of an old store
+ *  generation stay reachable; fall back to bun+entry for the rare
+ *  `nix run ... -- init` case where nothing is on PATH yet (works until that
+ *  generation is GC'd — docs steer users to `nix profile install` first). */
+function nixSupervisorShim(bun: string, entry: string): string {
+  return `#!/bin/sh
+dir=$(CDPATH= cd -- "$(dirname "$0")" && pwd)
+old_ifs=$IFS
+IFS=:
+new_path=
+for p in $PATH; do
+  [ "$p" = "$dir" ] && continue
+  if [ -n "$new_path" ]; then new_path="$new_path:$p"; else new_path="$p"; fi
+done
+IFS=$old_ifs
+PATH=$new_path
+export PATH
+if command -v tokenmaxxing >/dev/null 2>&1; then
+  exec tokenmaxxing "$@"
+fi
+exec ${JSON.stringify(bun)} run ${JSON.stringify(entry)} "$@"
+`;
+}
+
 export function installSupervisor(): InstallOutcome {
   mkdirSync(paths.binDir, { recursive: true });
   const target = installedBin(); // binDir/tokenmaxxing
   // Resolve the entry through the global-bin symlink (bun add -g links
   // ~/.bun/bin/tokenmaxxing → the package's src/main.ts) so the shim points
-  // into the installed package tree, where its imports resolve.
+  // into the installed package tree, where its imports resolve. Nix shims
+  // prefer PATH first (see nixSupervisorShim).
   const entry = realpathSync(Bun.main);
-  writeFileAtomic(target, `#!/bin/sh\nexec ${JSON.stringify(process.execPath)} run ${JSON.stringify(entry)} "$@"\n`, 0o755);
+  if (isNixPackaged()) {
+    writeFileAtomic(target, nixSupervisorShim(process.execPath, entry), 0o755);
+  } else {
+    writeFileAtomic(target, `#!/bin/sh\nexec ${JSON.stringify(process.execPath)} run ${JSON.stringify(entry)} "$@"\n`, 0o755);
+  }
 
   // the on-PATH `claude` wrapper
   writeFileAtomic(paths.supervisorLink, `#!/bin/sh\nexec ${JSON.stringify(target)} __supervise "$@"\n`, 0o755);
@@ -174,6 +225,10 @@ function run(cmd: string[]): boolean {
  *  place but activation failed (e.g. systemd user session absent over ssh) -
  *  the caller prints the manual activation step. */
 function installCheckTimer(): boolean {
+  // Nix module owns the timer (TOKENMAXXING_SKIP_TIMER): do not write a second
+  // unit that would double-fire or clobber the declarative one.
+  if (skipImperativeTimer()) return true;
+
   if (process.platform === "darwin") {
     const plist = launchdPlist();
     writeFileAtomic(
@@ -243,6 +298,9 @@ export function timerActivationHint(): string {
 
 /** True when the timer unit exists AND the service manager reports it loaded. */
 export function checkTimerHealthy(): boolean {
+  // Declarative Nix timer: init wrote nothing; doctor must not demand the
+  // imperative unit.
+  if (skipImperativeTimer()) return true;
   if (process.platform === "darwin") {
     const domain = launchdDomain();
     return existsSync(launchdPlist()) && domain != null && run(["launchctl", "print", `${domain}/${LAUNCHD_LABEL}`]);
@@ -305,6 +363,8 @@ function systemdTimerActive(): "active" | "not-active" | "unavailable" {
  *  loaded must deactivate successfully, and an unanswerable probe (service
  *  manager unusable) reports false rather than pretending it is gone. */
 function uninstallCheckTimer(): boolean {
+  // Nix owns the timer: do not bootout/disable the declarative unit.
+  if (skipImperativeTimer()) return true;
   if (process.platform === "darwin") {
     const domain = launchdDomain();
     const loaded = launchdJobLoaded();

package/src/lib/slackbridge.ts

@@ -9,7 +9,7 @@ import { spawn } from "node:child_process";
 import { join } from "node:path";
 import { z } from "zod";
 import { delay } from "es-toolkit";
-import { createSdkMcpServer, query, tool, type SpawnOptions } from "@anthropic-ai/claude-agent-sdk";
+import { createSdkMcpServer, query, tool, type SDKUserMessage, type SpawnOptions } from "@anthropic-ai/claude-agent-sdk";
 import { StreamingMarkdownRenderer, type StreamChunk } from "chat";
 import { ensureBestAccount, pooledOptions, stopHookCheck, type SwapDecision } from "../sdk.ts";
 import { POST_SWAP_COOLDOWN_MS } from "./decide.ts";
@@ -56,6 +56,14 @@ export const TurnOutcomeSchema = z.object({
    *  thread's activeTurn marker with resumeAt and the daemon resumes the turn
    *  itself, instead of the old "re-send it once the pool recovers" drop. */
   deferUntil: z.number().nullable(),
+  /** a steered follow-up's own drained turn FAILED after the primary turn
+   *  already succeeded (success stays sticky, the loss is announced
+   *  in-thread): the caller settles the steered messages' reactions as
+   *  failed, never as done - a lost instruction must not read green.
+   *  Attribution is per-turn, not per-message (steer() carries text only),
+   *  so when several messages were steered a successfully folded one can
+   *  read failed too - accepted: a false re-send ask beats a false green. */
+  steerLost: z.boolean(),
 });
 export type TurnOutcome = z.infer<typeof TurnOutcomeSchema>;
 
@@ -234,6 +242,60 @@ export function serveTurnContext(input: { requesterIds: string[] }): string {
 const SegmentChunkSchema = z.union([z.string(), z.custom<StreamChunk>()]);
 type SegmentChunk = z.infer<typeof SegmentChunkSchema>;
 
+/** The exact user-message shape the SDK's own string-prompt path writes to the
+ *  child's stdin (verified in @anthropic-ai/claude-agent-sdk 0.3.214: the SDK
+ *  serializes yielded messages verbatim, adding nothing). No uuid on purpose:
+ *  the CLI dedupes stream-json user messages by uuid and silently swallows a
+ *  reused one, so a uuid derived from a Slack message ts would eat retries.
+ *  No priority either: the default "next" folds the message into the running
+ *  turn at the next tool boundary, while "now" is an undocumented hard
+ *  interrupt that would abort the turn mid-tool (both verified in the claude
+ *  2.1.220 binary). */
+function steerUserMessage(text: string): SDKUserMessage {
+  return { type: "user", session_id: "", message: { role: "user", content: [{ type: "text", text }] }, parent_tool_use_id: null };
+}
+
+/** A hand-pushed async iterable of SDK user messages: the streaming-input
+ *  prompt for one query attempt. The initial prompt is pushed before query()
+ *  and steered messages join mid-turn; end() closes the child's stdin (the
+ *  SDK ends the stream when the iterable finishes). */
+function pushableMessages(): {
+  iterable: AsyncIterable<SDKUserMessage>;
+  push: (m: SDKUserMessage) => void;
+  end: () => void;
+} {
+  const queued: SDKUserMessage[] = [];
+  let cursor = 0;
+  let done = false;
+  let notify: (() => void) | null = null;
+  return {
+    push(m) {
+      queued.push(m);
+      notify?.();
+    },
+    end() {
+      done = true;
+      notify?.();
+    },
+    iterable: {
+      async *[Symbol.asyncIterator]() {
+        while (true) {
+          while (cursor < queued.length) {
+            const next = queued[cursor]!;
+            cursor += 1;
+            yield next;
+          }
+          if (done) return;
+          await new Promise<void>((resolve) => {
+            notify = resolve;
+          });
+          notify = null;
+        }
+      },
+    },
+  };
+}
+
 /** A hand-pushed async iterable: relayThread feeds one of these per Slack
  *  message segment while thread.post concurrently drains it. */
 function pushableStream(): {
@@ -478,8 +540,22 @@ export async function relayThread(input: {
   /** daemon shutdown signal: aborts park/retry sleeps so a drain never sits
    *  out a depleted-pool countdown. */
   drainSignal?: AbortSignal;
+  /** Steering seam. Called with a steer function while a query attempt is
+   *  live and with null when it ends; steer(text) returns true when the text
+   *  was written into the RUNNING attempt's stdin (the CLI folds it into the
+   *  turn at the next tool boundary, or runs it as its own turn in the same
+   *  child when the fold window is gone - either way it reaches the session,
+   *  verified against claude 2.1.220), false once the attempt's result
+   *  arrived or the attempt died - the caller then queues the message as a
+   *  normal next turn instead. Accepted texts also fold into any RETRY
+   *  attempt's prompt, mirroring the existing resend-the-full-prompt retry
+   *  tradeoff (duplication in the resumed transcript beats loss).
+   *  input.requesterIds is shared by reference on purpose: the caller may
+   *  push a steer author's id so a retry attempt's UserPromptSubmit context
+   *  names them (the hook does not fire for folded mid-turn messages). */
+  onSteer?: (steer: ((text: string, onAccept?: () => void) => boolean) | null) => void;
 }): Promise<TurnOutcome> {
-  const outcome: TurnOutcome = { sessionId: input.sessionId, failed: false, rateLimited: false, finish: false, attention: false, announcedDrop: false, resultReceived: false, deferUntil: null };
+  const outcome: TurnOutcome = { sessionId: input.sessionId, failed: false, rateLimited: false, finish: false, attention: false, announcedDrop: false, resultReceived: false, deferUntil: null, steerLost: false };
   let segment: ReturnType<typeof pushableStream> | null = null;
   // acc mirrors the segment's pushed text (bounded by SEGMENT_TEXT_MAX plus a
   // small overshoot): fence parity must be computed over the ACCUMULATED text,
@@ -846,8 +922,15 @@ export async function relayThread(input: {
   // deferral notice explains the pause; the raw line would invite a manual
   // re-send of work the daemon resumes itself - cubic catch, PR #44).
   let pendingFailureLine: string | null = null;
-  // what the next spawn submits: the original message, until a transient
-  // retry swaps in the continuation wrapper (see the retry branch).
+  // texts steered into this message's turn, kept across retries: a retry
+  // resumes the session and re-sends the attempt prompt (the established
+  // duplication-beats-loss tradeoff), so steered text folds into every
+  // retry attempt's first message too - a steer written just before a
+  // mid-turn limit killed the child must not vanish from the turn it joined.
+  const steeredTexts: string[] = [];
+  // what the next spawn submits ahead of the steered texts: the original
+  // message, until a transient retry swaps in the continuation wrapper (see
+  // the retry branch).
   let prompt = input.prompt;
   const runQueryOnce = async () => {
     postedText = false;
@@ -863,11 +946,47 @@ export async function relayThread(input: {
     // inside the try: a malformed claude.json must fail the TURN, not the
     // relay's never-throws contract.
     let spawnOrg: string | null = null;
+    // Streaming input: the prompt rides an open stdin stream instead of a
+    // one-shot string, which is what lets a mid-turn Slack reply steer the
+    // running turn (the CLI folds a queued stream-json user message into the
+    // current turn at the next tool boundary; one that misses the last fold
+    // window runs as its own turn in the same child before exit, so nothing
+    // is ever dropped - both verified against claude 2.1.220 + SDK 0.3.214).
+    // steer() refuses the moment the attempt's result arrives: stdin ends
+    // then, and the SDK silently drops writes to an ended stdin.
+    const stream = pushableMessages();
+    let steerable = true;
+    const steer = (text: string, onAccept?: () => void): boolean => {
+      if (!steerable) return false;
+      // the caller's SYNCHRONOUS durable commit runs inside the acceptance,
+      // in the same JS tick as the liveness check and BEFORE the child sees
+      // the text (adversarial-review catch, round 3): steerable=true here
+      // proves the turn has not ended, so the commit's view of the turn
+      // state cannot be stale, a crash between commit and push replays a
+      // steer the child never saw (duplication over loss), and a refusal
+      // commits NOTHING - a stale acceptor invocation racing the turn's end
+      // can no longer resurrect a finished turn's marker or clobber
+      // post-turn state. A THROWING commit escapes to the caller before
+      // anything is pushed or recorded here: the stream, steeredTexts, and
+      // the sticky flags are untouched, so the caller can treat the throw
+      // as a refusal and a later steer still works.
+      onAccept?.();
+      steeredTexts.push(text);
+      stream.push(steerUserMessage(text));
+      // a steer answers a LIVE ask too (codex review catch on PR #50): when
+      // need_attention already fired in this attempt, the ask exists only as
+      // this sticky flag until settleTurn persists it - left set, the
+      // answered ask would still get a question mark and a nudge. A later
+      // need_attention call re-arms it for a genuinely new ask.
+      outcome.attention = false;
+      return true;
+    };
     try {
       spawnOrg = readOAuthAccount()?.organizationUuid ?? null;
       const pooled = pooledOptions();
+      stream.push(steerUserMessage([prompt, ...steeredTexts].join("\n\n")));
       const q = query({
-        prompt,
+        prompt: stream.iterable,
         options: {
           ...pooled,
           // claude >= 2.1.142 emits the structured Task tools by default and
@@ -934,8 +1053,18 @@ export async function relayThread(input: {
           ...(outcome.sessionId ? { resume: outcome.sessionId } : {}),
         },
       });
+      // registered only while this attempt is live (cleared in the finally):
+      // the caller's fallback for a refused steer is the normal queued turn.
+      input.onSteer?.(steer);
       const mapState = newStreamMapState();
       let result: string | null = null;
+      // reply text streamed since the last result boundary: each turn in the
+      // child (the primary one, plus any post-fold-window steer drained as
+      // its own turn) delivers its answer independently - a tool-only turn's
+      // answer lives ONLY in its result message, and flushing it at that
+      // result is what keeps a trailing turn's notice or result from
+      // suppressing or clobbering it (adversarial-review catch, round 2).
+      let streamedSinceResult = false;
       for await (const message of q) {
         if (message.type === "system" && message.subtype === "init") {
           // persist BEFORE the turn ends so a first-turn kill stays
@@ -946,41 +1075,82 @@ export async function relayThread(input: {
         }
         if (message.type === "result") {
           outcome.sessionId = message.session_id;
+          // any result ends steerability and closes the child's stdin: a
+          // steer arriving now queues as its own next turn instead. A steer
+          // accepted BEFORE this that missed its fold window still runs -
+          // the CLI drains queued commands as their own turns in this same
+          // child before exiting, emitting a further result each time, so
+          // this loop just keeps consuming until the child exits (end() is
+          // idempotent).
+          steerable = false;
+          stream.end();
           // is_error can ride a "success" subtype (a mid-turn usage limit
           // arrives exactly that way: result "Claude AI usage limit
           // reached|<epoch>"), so errored is a field check, not a subtype
           // check - and only an errored result is ever limit-classified.
           if (message.is_error || message.subtype !== "success") {
             const text = erroredResultText(message);
-            outcome.failed = true;
-            outcome.rateLimited = isRateLimitText({ text });
-            // persist the observation: the retry's decision otherwise re-reads
-            // the stale pre-limit snapshot (poll TTL) and respawns the same
-            // depleted account - a serve process has no statusLine tee.
-            if (outcome.rateLimited) await recordObservedLimit({ text, now: Date.now(), org: spawnOrg });
-            // hold the REAL errored text for the terminal diagnostic (codex
-            // review catches: a streamed-then-errored turn used to end with
-            // a truncated answer and only the x reaction, and a no-text
-            // errored turn used to discard the reason for a generic line).
-            // The depleted-pool probe still outranks the line.
-            else {
-              const reason = text.slice(0, 200) || "no error detail";
-              pendingFailureLine = postedText
-                ? `tokenmaxxing: the turn errored before finishing (${reason}) - the reply above may be incomplete.`
-                : `tokenmaxxing: the turn errored without a result (${reason}) - trying again may help.`;
+            const limited = isRateLimitText({ text });
+            // persist the observation either way: the next spawn decision
+            // must see the limit even when this turn does not retry.
+            if (limited) await recordObservedLimit({ text, now: Date.now(), org: spawnOrg });
+            if (outcome.resultReceived) {
+              // SUCCESS IS STICKY within an attempt (adversarial-review
+              // catch): this errored result belongs to a post-fold-window
+              // steer's own drained turn, arriving AFTER the primary turn
+              // already succeeded and delivered its answer. Marking the turn
+              // failed here would send the whole prompt back through the
+              // retry/defer machinery and re-run completed work - the exact
+              // duplicate-execution the outcome contract forbids. The steer
+              // is announced lost instead (drop-beats-false-promise), and
+              // steerLost settles the steered messages' reactions as failed.
+              outcome.steerLost = true;
+              log("serve.steered_turn_failed", { limited });
+              await notify(
+                limited
+                  ? "a steered follow-up message hit a usage limit before it could run - please re-send it."
+                  : "a steered follow-up message failed - please re-send it.",
+              );
+            } else {
+              outcome.failed = true;
+              // a limit classification is sticky across a child's errored
+              // results (adversarial-review catch, round 2): the drained
+              // steer turn's generic death must not declassify the primary
+              // turn's recoverable limit back to a plain failure.
+              outcome.rateLimited = outcome.rateLimited || limited;
+              // hold the REAL errored text for the terminal diagnostic (codex
+              // review catches: a streamed-then-errored turn used to end with
+              // a truncated answer and only the x reaction, and a no-text
+              // errored turn used to discard the reason for a generic line).
+              // The depleted-pool probe still outranks the line.
+              if (!limited) {
+                const reason = text.slice(0, 200) || "no error detail";
+                pendingFailureLine = postedText
+                  ? `tokenmaxxing: the turn errored before finishing (${reason}) - the reply above may be incomplete.`
+                  : `tokenmaxxing: the turn errored without a result (${reason}) - trying again may help.`;
+              }
             }
           } else {
             result = message.result;
             outcome.resultReceived = true;
+            // a turn that streamed no reply text (tool-only turns) still
+            // reports: its answer is flushed HERE, per result, not after the
+            // loop - a later turn in the same child must not suppress it. A
+            // paragraph break ahead of it when text already posted, or two
+            // result-only answers would concatenate mid-line (codex review
+            // catch on PR #50).
+            if (!streamedSinceResult && result) await pushText(`${postedText ? "\n\n" : ""}${result}`);
           }
+          streamedSinceResult = false;
         }
         for (const part of agentEventChunks({ state: mapState, message })) {
           if (part instanceof Object) await push(part);
-          else await pushText(part);
+          else {
+            if (part.trim() !== "") streamedSinceResult = true;
+            await pushText(part);
+          }
         }
       }
-      // a turn that produced no streamed text (tool-only turns) still reports.
-      if (!postedText && result) await pushText(result);
     } catch (e) {
       outcome.failed = true;
       const detail = (e instanceof Error ? e.message : String(e)).slice(0, 300);
@@ -991,6 +1161,13 @@ export async function relayThread(input: {
       // deferral's own notice explains the pause better than a raw child
       // error that reads as "please re-send".
       if (!outcome.rateLimited) pendingFailureLine = `tokenmaxxing: turn failed: ${detail}`;
+    } finally {
+      // a died attempt must stop accepting steers (they would be silent
+      // drops on an ended stdin) and must release the caller's steer hook
+      // before the retry loop decides anything.
+      steerable = false;
+      stream.end();
+      input.onSteer?.(null);
     }
   };
 

package/src/lib/slackstate.ts

@@ -133,6 +133,15 @@ const ActiveTurnSchema = z.object({
    *  Absent on older records: recovery falls back to the streamable
    *  handle's newest-author derivation. */
   requesterIds: z.array(z.string()).optional(),
+  /** Slack ids of messages STEERED into this turn mid-run: they carry the
+   *  same hourglass-to-terminal reaction lifecycle as the triggering
+   *  message, so a killed or deferred turn's recovery must settle them too.
+   *  Their text is already folded into `prompt` at steer time, which is what
+   *  makes replays and retries include what the user steered in. An inbound
+   *  takeover of a DEFERRED turn also adopts the held turn's unsettled ids
+   *  here: the takeover serves their held prompt, and without the adoption
+   *  the old trigger's hourglass would read "processing" forever. */
+  steeredMessageIds: z.array(z.string()).optional(),
 });
 export type ActiveTurn = z.infer<typeof ActiveTurnSchema>;