[SergioTCG]

Summary

A coordinator message whose prompt hook arrived after the 120-second in-memory injected-text record, or after a daemon restart, failed the delegated task with:

A local terminal prompt replaced the delegated worker turn.

The handler had already authenticated the prompt against the persisted journal. It still sent it down the local-input path. This PR settles an authenticated current-generation message as bridge input. It also adds behavioural regression tests that drive the actual UserPromptSubmit handler.

Incident

A live Codex worker:

• The coordinator message was delivered at T.
• Its exact <sab-team-message …> prompt hook arrived at T + 123.331 s. Codex queues input submitted during a running turn and fires UserPromptSubmit when it actually submits it.
• The task failed 79 ms later.
• The prompt's digest matched the persisted journal (teamProviderTurn.promptHash) for the exact task, session, channel and generation. It was not manual terminal input.

Root cause

Step	Code	Result
1	providerPromptTurnMarker()	recognizes <sab-team-message>
2	providerPromptAcknowledgesTask()	authenticates the exact generation, bound turn and journal digest, so acknowledgedTurn is set and the turn is activated
3	the lifecycle branch acknowledgedTurn && teamTaskId && …	teamTaskId comes from taskMarker(), which knows only <sab-team-task>, so it is null and the acknowledged branch is skipped
4	fallback unacknowledgedPromptTeamEffect()	inside the 120 s cache injected is true and nothing happens; after expiry or a restart it returns fail_task
5	mirroring	the same prompt was also posted to Slack as 💬 You (terminal)

A sibling defect: the journal digest was computed over the raw hook prompt. Claude Code wraps pasted input in <pasted_content id="…">, so Claude task and message prompts could never match the journal once the cache expired or the daemon restarted.

taskMarker() keeps its semantics. Its other caller, withoutDelegatedTaskPrompt(), must purge only queued task-start envelopes and not coordinator messages.

Commits

1. refactor: move the handler into daemon/prompt-submit.mjs, verbatim. daemon.mjs cannot be imported in tests, so createPromptSubmitHandler() now holds the exact former body and the daemon delegates to it with its own effects. Supporting moves, each byte-identical in effect:

   • createInjectedTextCache() (with an injectable clock);
   • the state-taking lifecycle helpers;
   • isSystemPrompt;
   • coordinatorTaskMessagePrompt().

   The handler contract tests now read the new module, and the full suite passes (566).

2. test: the regression suite on its own. 10 of its 14 tests fail here on purpose, reproducing the incident through the actual handler.

3. fix:

   • An acknowledged current-generation coordinator message is settled as bridge input and never reaches the local-input fallback.
   • Journal digests use the unwrapped prompt.
   • A prompt that is acknowledged, or whose exact digest is journaled (journaledTeamProviderPrompt(), provenance only), is not mirrored as typing.

Preserved guarantees

• Task, session, channel, native-turn and generation checks are unchanged. Acknowledgement still requires the exact current or pending generation, the bound turn, and the journal digest or injected record.
• A tag alone is never trusted: altered, misaddressed or tag-only text is still local input.
• Stale same-task generations are ignored, so they neither fail the task nor authorize anything.
• Terminal tasks are never resumed.
• Delayed callbacks cannot discard a newer staged generation.
• Genuine local terminal input still fails the delegated turn and revokes a coordinator's team turn.
• The cache timeout is unchanged. Recognition comes from persisted evidence.

Regression tests (test/prompt-submit.test.mjs)

These drive createPromptSubmitHandler(), the code the daemon runs. They use:

• real team state built with teams.mjs;
• the real injected-text cache on a fake clock;
• the delivery path's own journal functions and envelope builders;
• a JSON round-trip of state plus an empty cache to stand in for a restart.

Slack, pollers, audits and persistence are recorded instead of performed.

Requirement	Test	Before fix	After fix
1. Valid current message after >120 s	codex: / claude: … hooked after the 120 s cache …	✖ fails the task	✔
2. Valid message after restart, empty cache	codex: / claude: … recognized after a daemon restart	✖ fails the task	✔
3. Task-start acknowledgement still works (incl. after restart)	codex: / claude: the original task-start acknowledgement …	✖ mirrored (Codex) / fails (Claude)	✔
4. Stale same-task generation neither fails nor authorizes	a stale same-task generation …	✖ mirrored as typing	✔
5. Altered / untrusted / wrong task, session, channel, generation	altered or misaddressed …, … replayed on another session or a rebound channel	✔	✔
6. Genuine local input ends delegated authority	genuine local terminal input …	✔	✔
7. Delivery/ack/completion races cannot corrupt newer work	a hook that beats its transport callback …, a late older-generation hook cannot discard a newer in-flight …, a declared completion survives …, a late hook for a terminated task …	1 ✔, 3 ✖	✔

Mutations. Each was applied on its own against the suite, then the files were restored byte-identical:

Mutation	Result
Drop the acknowledged-message branch	7 fail
Authenticate the raw wrapped prompt	3 fail
Mirror journaled bridge input again	10 fail
Trust the tag without the digest	1 fails
Journal lookup ignores the digest	2 fail
Treat every acknowledgement as a message (breaks task start)	14 fail
Cache-timeout-only "fix" (unfixed handler, 1 h TTL)	8 fail, including every post-restart case

Validation

• Focused regression suite: 14 pass, 0 fail.
• Full npm test: 581 pass, 0 fail.
• npm run check, node --check (daemon/channel/scripts), Pi extension --list-models and shellcheck all pass. Every named import in daemon.mjs resolves (319 checked).
• ⚠️ npm run audit fails on a newly published advisory, GHSA-6qxp-vccf-f47h (@modelcontextprotocol/sdk ≤ 1.30.1, OAuth client). This PR changes no dependencies; a separate lockfile PR fixes it.

Deployment notes

• Daemon restart needed: yes. Only daemon modules change; hooks, the CLI and the MCP channel are unchanged. There is no state migration and no new persisted field.
• Running sessions survive the restart. The fix recognizes messages that were delivered before the restart.
• Coordinate the restart with the operator. Other teams may be active, and a dispatching claim is never retried across a restart.
• Merging deploys within 6 h through the self-updater.
• Failed tasks are not resumed, released or recreated automatically.

🤖 Generated with Claude Code

https://claude.ai/code/session_011Xs8AVBVrTGfpzUMiCQp2R