fix(acp): state the reply destination in mid-turn steer prompts - #6633

Summary

buzz-acp has two mid-turn steer transports, and only one told the agent where to reply.

The cancel+merge fallback builds its prompt through queue::format_prompt, which states the thread scope and a --reply-to anchor. The native path hand-assembled its body from framing plus one event block and called neither format_context_hints nor resolve_reply_anchor. With no destination in the prompt, the previous subject's thread stayed the only live one in the agent's context, so a message steered in from thread B got answered in thread A. Regressed in e567491a1 (#1160), which introduced try_native_steer.

This is the default path: --multiple-event-handling defaults to steer, native is tried first, and cancel+merge is the fallback for an unadvertised transport, transport failure, a missing run ID, a rejected cross-adapter outcome, or method-not-found. It is not goose-specific either — _goose/unstable/session/steer and the cross-adapter _session/steering carry the same body, so any adapter advertising _meta.steering.supported is affected, claude-agent-acp included.

The fix

queue::format_native_steer_prompt owns the whole body, and native_steer_framing and format_event_block are now private to queue, so the hand-assembly cannot recur. Neither was ever visible outside buzz-acp — both were pub(crate) — so the narrowing cannot affect sprig, the only other crate that depends on buzz-acp. The crate exposes two items, pub use usage::TurnUsage and pub fn run, and this diff touches neither. Every module is private, so the pub declarations inside them are module-local. resolve_reply_anchor absorbed the DM branch format_prompt had inline, so one function holds the rule instead of two copies — the duplication is how the defect happened. Only per-event routing context is added: a steer is a delta into a live turn, so standing context, channel metadata and history stay out.

Two accepted tradeoffs:

Every non-DM native steer is anchored, agent turns included. The path is synchronous on the main event loop and a profile lookup needs an uncached relay query, so turn_is_human_facing sees an unknown sender and treats it as human. The fallback deliberately leaves agent-to-agent steers free to nest; native no longer does. Losing a human's reply destination is the worse failure, and the alternative is a network call on the hot path.

On unresolved channel metadata, native declines instead of guessing. Either guess is wrong somewhere: the non-DM rule forces an anchor onto a top-level DM that should have none, and the DM rule mis-targets in a channel. So DmClassification is a closed Dm | NonDm | Unresolved — gates_as_dm answers for every state, while native_steer_scope yields a NativeSteerScope only for the resolved ones. A decline hands the event to cancel+merge, which resolves the channel again at flush time. If that retry also fails, the fallback keeps its pre-existing non-DM default; that limit predates this PR.

Test enrollment

buzz-acp was compiled by CI and executed by no job — just test-unit names its packages explicitly and nothing runs cargo test --workspace — so the new routing tests would have guarded nothing. This PR adds the package to that recipe and to its scripts/run-tests.sh mirror, enrolling 821 tests, 810 of which predate this PR and have never run in CI.

Both commands clear the BUZZ_* family in a subshell first. config.rs asserts clap defaults through CliArgs::parse_from, which reads #[arg(env)] unconditionally, and a buzz-acp-hosted agent sets exactly those variables.

Related issue

None found — no open issue tracks this defect. The three nearest are all in this module and all describe different bugs: #5839 (mid-turn steering is channel-scoped, so an unrelated thread's message is injected into the in-flight turn — about whether to steer, not where the reply goes), #5219 (a multi-thread batch collapses all replies to the newest event's thread, which is the format_prompt cancel+merge path this PR leaves alone), and #4072 (feature request: agents should reply to the exact triggering message).

The closest prior art is a closed pull request, #1549 — fix(buzz-acp): anchor replies for natively-steered events — same root cause, in two of the source files this fix touches. It was opened 2026-07-06, approved by wesbillman eight minutes later, and closed unmerged by its own author on 2026-07-18, twelve days after the approval, with no comment saying why. The fix never reached main: native_steer_reply_instruction has no hits tree-wide at a8e1c66c4. #1549 kept the hand-assembly in lib.rs, splicing a native_steer_reply_instruction string in after the event block, and derived the anchor from thread tags alone — a top-level DM would be told the steered event "becomes the root of a new thread". Body ownership and the DmClassification branch, above, are what this PR does instead.

Testing

No UI surface — the diff is Justfile, crates/buzz-acp/src/{lib,pool,queue}.rs and scripts/run-tests.sh.

just ci exits 0 at 974ebe6ab on the repository's pinned Hermit toolchain, with the buzz-acp step this PR adds running all 821 green. The mobile path filter matches nothing in this diff, so those lanes skip upstream; dart format, flutter analyze and flutter test were run locally and pass. The run-tests.sh arm the gate never reaches was run directly against the blob this PR ships. Stripping its BUZZ_* postcondition is a live mutation: a readonly variable survives unset and reaches cargo test, and the step still reports passed — run_test_step calls the function from an if, so errexit never aborts it. A leaked variable no test reads is silent without that check.

Restoring the pre-fix body shape — framing plus event block, no [Context] — fails nine rows of the enrolled suite. Both classification-seam mutants — mapping Unresolved onto a resolved scope, and picking the wrong scope for a resolved one — fail the seam test, which reads the request try_native_steer actually sent. Pre-fix behaviour was observed rather than only inferred: steers delivered mid-turn to a live claude-agent-acp session carried the header, the event block and the closing note, with no [Context], no Thread root and no --reply-to.

Not verified: an end-to-end live steer on a patched build, confirming the posted reply's e tag resolves to the steering thread. That needs a harness running this branch, and the harness is the thing under test.