fix(acp): retry channel turns that leave a mention unanswered

[wpfleger96]

A mention can produce a turn that ends end_turn having streamed no assistant text and completed no tool call. Nothing is posted to the channel, but the harness sees a normal successful stop — so the mention is dequeued as handled, the retry machinery never engages, and the user waits on a reply that will never arrive. Two observed turns failed this way; one of them died on its first tool call being rejected, got the error back, and then ended the turn silently.

Diagnosing it after the fact was impossible because the turn lifecycle logging is invisible in every default deployment.

Log targets

Both launch paths default the log filter to buzz_acp=info — the binary's own EnvFilter fallback in crates/buzz-acp/src/lib.rs, and the RUST_LOG Desktop hands its managed child. EnvFilter matches a directive against a target by path segment, so bare targets like pool::prompt and acp::stream match nothing and are dropped. Turn start, turn stop, and every wire line never reach the log.

All 19 custom targets in the crate are now prefixed with buzz_acp::. Prefixing rather than widening the filter keeps the fix inside one crate — the alternative requires two filter strings, in two repos, to be kept in step forever. Neither filter string is touched. A test recurses the crate source and fails on any target the shipped filter would swallow.

What makes a turn dead

A turn is dead when it ends end_turn on a channel batch that contained at least one event the agent was expected to answer, and produced no output at all. Such a turn is reported as a failure and its batch flows through the existing backoff and dead-letter path (MAX_RETRIES) instead of vanishing.

Silence is only a failure when someone was owed an answer. PromptSource::Channel covers every matched batch, not just mentions — under --subscribe all or a require_mention: false rule the agent watches traffic nobody addressed to it, and base_prompt.md instructs it to stay quiet when it has nothing to add. MatchedRule therefore carries requires_response (the rule required a mention, or the event p-tags the agent) through QueuedEvent → BatchEvent → FlushBatch, and passive batches are never retried.

What counts as output is deliberately narrow:

Signal	Counts	Why
agent_message_chunk, non-blank	yes	an answer the user can see
agent_message_chunk, whitespace only	no	formatting, not an answer
tool_call / tool_call_update completed, no error flag	yes	real work; the ACP schema lets either event carry the terminal status
completed + rawOutput.isError	no	buzz-agent reports a rejected call this way — counting bare completed would mask the exact turn this detects
failed / in_progress	no	nothing was accomplished
agent_thought_chunk	no	reasoning the user never sees

Heartbeats are exempt — they are self-prompts with no waiting user and no batch to requeue. Every non-EndTurn stop is already classified by its own arm and is left alone. Both completion paths — the natural one and the synthesized EndTurn in the control-signal race — share one classifier, so they cannot drift.

Mid-turn steered events

An event injected into a running turn by a native steer is not part of the batch, and a Success ack used to drop it outright. If the turn then went silent, that mention disappeared with no retry — the same failure, one layer down.

AcpClient now tracks a monotonic output epoch instead of a boolean, because a flag cannot distinguish "spoke, then went silent on the new message" from "answered the steer". A Success ack parks the event in a delivered-steer ledger tagged with the epoch at acceptance; the turn's terminal classification settles it. Output after delivery retires the event; silence releases it to the queue front for an ordinary, fully-budgeted retry. Passive steered events are retired unanswered, same contract as passive batches. In-flight expiry and panic recovery settle the ledger as unanswered, so a delivered event can never outlive its turn.

Acks that lose the race with their own turn

The ack watcher and the prompt result travel on different channels, and the main loop's biased select! polls results first, so a genuinely-sent Success can be processed after the turn it belongs to has terminated. Settling only the delivered ledger would leave that event withheld with no turn left to judge it, and the late ack would then move it into a ledger nothing ever resolves.

EventQueue::settle_turn_steers therefore settles both steer tables at terminal classification: delivered entries against the turn's final output epoch, still-withheld entries released as delivery-unknown, all in arrival order at the queue front. record_delivered_steer and release_native_steer report whether the event was still pending, and apply_steer_ack hangs every effect off that answer — so a late ack of any shape queues no second copy, extends no unrelated turn's in-flight deadline, and fires no cancel+merge fallback at a turn that has ended.

An unacked withheld event is released even when it is passive, unlike a delivered passive event: the latter is known to have reached the agent, so silence answers it, while an unacked one may never have arrived at all.

Retry preserves the whole batch

A steer or interrupt cancel puts the events an agent was already working on into FlushBatch::cancelled_events, which the next flush merges into an annotated re-prompt. Both retry paths — requeue and requeue_preserve_timestamps — iterated only events, so when a merged re-prompt then failed, the interrupted bucket was discarded. For a response-required mention that is the same silent loss, reached through the retry machinery meant to prevent it.

Both now share one reinsertion helper that restores every event with its own prompt_tag, received_at and requires_response, cancelled first since they arrived earlier, under the same per-channel cap. Cancelled events are normalised into ordinary queued events rather than returned to the cancelled side table: that table is exempt from retry_after in the cancelled-only flush fallback, so restoring them there would let a throttled batch re-flush immediately and spin, and the merge annotation frames work an agent was interrupted part-way through — after a failed turn there is none.

Tradeoffs

A turn that emits only thought chunks and then stops is retried rather than accepted. That costs a bounded retry, which is the cheaper side of the trade against silently dropping a user's mention.

A steer acked startedNewTurn — delivered into a fresh, detached turn — reports the current turn's epoch. If that detached work produces nothing observable before the awaited response lands, the event is redelivered. The same applies to a Success whose ack the watcher delivers after its turn has already settled. A visible duplicate is the right side to err on against a silent loss.