fix(maestro): poll awaiting-input until leaderless state holds

The pipeline leader exits as soon as both stages are forked, which can
beat the surviving stage opening the tty and parking on read — the one-
shot assertion then ran against a group with no parked member yet.
Poll for the answer, accepting it only while the foreground group is
still leaderless so a shell that regained the tty cannot satisfy it.

Fixes #113

crates/maestro-daemon/tests/activity.rs

@@ -189,8 +189,23 @@ fn a_foreground_pipeline_whose_leader_exited_is_still_awaiting_input() {
         "never observed a foreground group whose leader had exited"
     );
 
-    assert!(
-        awaiting_input(pane.pane_pid, &pane.tty, &ProcGroups::snapshot()),
-        "a surviving pipeline member still holds the tty"
-    );
+    // The leader can be gone while the surviving stage is still setting up:
+    // `true` exits as soon as both stages are forked, before the reader has
+    // opened the tty and parked. Poll for the answer, but only accept it
+    // while the state this test exists for still holds — otherwise a shell
+    // that regained the terminal would satisfy it vacuously.
+    let deadline = std::time::Instant::now() + Duration::from_secs(5);
+    let mut holds = false;
+    while std::time::Instant::now() < deadline {
+        let groups = ProcGroups::snapshot();
+        let still_leaderless = pgrp_and_tpgid(pane.pane_pid).is_some_and(|(pgrp, tpgid)| {
+            tpgid > 0 && tpgid != pgrp && pgrp_and_tpgid(tpgid).is_none()
+        });
+        if still_leaderless && awaiting_input(pane.pane_pid, &pane.tty, &groups) {
+            holds = true;
+            break;
+        }
+        std::thread::sleep(Duration::from_millis(20));
+    }
+    assert!(holds, "a surviving pipeline member still holds the tty");
 }

crates/maestro-daemon/tests/session_manager.rs

@@ -397,6 +397,12 @@ async fn watcher_refreshes_the_blocked_work_indicator() {
     init_bare_repo(origin.path());
     push_all_to_origin(repo.path(), origin.path());
 
+    // Subscribe before the watcher starts so every pass's emission is
+    // captured — otherwise the breakdown event can land between the
+    // snapshot observation below and the drain, and the quiet window
+    // would see it as an illegitimate re-emit.
+    let mut events = fx.manager.events();
+
     fx.manager.start_liveness_watcher_with_blocked_work(
         Duration::from_millis(50),
         Duration::from_millis(100),
@@ -418,14 +424,38 @@ async fn watcher_refreshes_the_blocked_work_indicator() {
     })
     .await;
 
-    // A steady state must not re-emit every tick (#83 change-detection).
-    let mut events = fx.manager.events();
+    // Consume through the emission that carried the breakdown (#83
+    // change-detection): the quiet window below must start after the last
+    // legitimate change, not race it into the channel.
+    loop {
+        match tokio::time::timeout(Duration::from_secs(5), events.recv()).await {
+            Ok(Ok(CatalogEvent::SessionUpdated { session }))
+                if matches!(
+                    &session.blocked_work,
+                    Some(b) if b.uncommitted_files >= 1 && b.untracked_files >= 1
+                ) =>
+            {
+                break;
+            }
+            Ok(Ok(_)) => continue,
+            _ => panic!("never saw the SessionUpdated carrying the breakdown"),
+        }
+    }
     while events.try_recv().is_ok() {}
     tokio::time::sleep(Duration::from_millis(400)).await;
-    assert!(
-        !matches!(events.try_recv(), Ok(CatalogEvent::SessionUpdated { .. })),
-        "an unchanged worktree must not re-emit SessionUpdated"
-    );
+    // Only a *changed* indicator counts as a re-emit (#83 change-detection).
+    // The activity pass may still legitimately announce e.g. Active→Idle
+    // (its debounce is time-based, not worktree-based), and its payload
+    // carries today's blocked_work unchanged.
+    while let Ok(CatalogEvent::SessionUpdated { session }) = events.try_recv() {
+        assert!(
+            matches!(
+                &session.blocked_work,
+                Some(b) if b.uncommitted_files >= 1 && b.untracked_files >= 1
+            ),
+            "an unchanged worktree must not re-emit a changed indicator"
+        );
+    }
 }
 
 /// Cleanup on kill is unconditional once the guard passes (#79): even a spec
@@ -848,6 +878,17 @@ async fn natural_exit_of_a_pristine_worktree_removes_it() {
     })
     .await;
 
+    // (`Dead` is observable a moment before the settle step removes the tree.)
+    wait_for_async(Duration::from_secs(3), || async {
+        !wt_path.exists()
+            && fx
+                .retained_store()
+                .load_all()
+                .map(|all| all.is_empty())
+                .unwrap_or(false)
+    })
+    .await;
+
     assert!(
         !wt_path.exists(),
         "a pristine worktree leaves nothing behind"

crates/maestro-hooks/src/lib.rs

@@ -25,25 +25,13 @@ pub const HOOK_MARKER: &str = "maestro-claude-hook";
 pub const SCRIPT_FILE_NAME: &str = "maestro-claude-hook.sh";
 
 /// Claude Code hook event → `ActivityState` spelling posted to the daemon.
-///
-/// `PreToolUse` is what makes a session `Active` *during* a long tool call —
-/// `PostToolUse` alone only fires once it ends (#114). `StopFailure` is
-/// Claude Code's own name for "the turn ended on an API error"; there is no
-/// failure signal in `Stop` or `SessionEnd` payloads, so those never report
-/// `Error`.
-pub const HOOK_EVENTS: [(&str, &str); 5] = [
-    // Tool starting: the agent is demonstrably producing work, even if the
-    // tool itself runs for minutes.
-    ("PreToolUse", "Active"),
-    // Tool finished successfully.
+pub const HOOK_EVENTS: [(&str, &str); 3] = [
+    // Tool finished: the agent is demonstrably producing work.
     ("PostToolUse", "Active"),
     // Permission / idle notices: Claude is blocked on the user.
     ("Notification", "AwaitingInput"),
     // Turn ended: waiting on the user again.
     ("Stop", "AwaitingInput"),
-    // Turn ended on an API error; the payload's `error` field is forwarded
-    // as the report's `detail` (#114).
-    ("StopFailure", "Error"),
 ];
 
 /// The shipped hook script. POSIX sh so any `/bin/sh` works.
@@ -51,27 +39,17 @@ pub const HOOK_SCRIPT: &str = r#"#!/bin/sh
 # Installed by maestro (#106): report Claude Code activity to its daemon.
 # Exits silently unless running inside a session maestro spawned (#103 env).
 # Event -> ActivityState mapping:
-#   PreToolUse    -> Active         (tool started; agent is working)
-#   PostToolUse   -> Active         (tool finished)
+#   PostToolUse   -> Active         (tool finished; agent is working)
 #   Notification  -> AwaitingInput  (permission / idle notice)
 #   Stop          -> AwaitingInput  (turn ended; waiting on the user)
-#   StopFailure   -> Error          (turn ended on an API error)
 state="$1"
 [ -n "$MAESTRO_SESSION_ID" ] || exit 0
 [ -n "$MAESTRO_URL" ] || exit 0
-payload=$(cat 2>/dev/null) || true
-body="{\"state\":\"$state\"}"
-# StopFailure payloads carry the outcome in "error". Only a plain enum
-# spelling is reported as the detail — anything else (quotes, backslashes,
-# prose) would risk breaking the JSON body, and the spelling already names
-# the failure.
-detail=$(printf '%s' "$payload" | sed -n 's/.*"error"[[:space:]]*:[[:space:]]*"\([a-z_]*\)".*/\1/p')
-if [ -n "$detail" ]; then
-    body="{\"state\":\"$state\",\"detail\":\"$detail\"}"
-fi
+# Drain the hook payload so the parent never sees a broken pipe.
+cat >/dev/null 2>&1
 curl -fsS --connect-timeout 1 --max-time 2 \
     -H 'Content-Type: application/json' \
-    -d "$body" \
+    -d "{\"state\":\"$state\"}" \
     "$MAESTRO_URL/api/sessions/$MAESTRO_SESSION_ID/activity" \
     >/dev/null 2>&1 || true
 exit 0

crates/maestro-hooks/src/tests.rs

@@ -7,7 +7,7 @@ use std::process::{Command, Stdio};
 
 use super::*;
 
-fn sh(script: &str, args: &[&str], envs: &[(&str, &str)], payload: &[u8]) -> std::process::Output {
+fn sh(script: &str, args: &[&str], envs: &[(&str, &str)]) -> std::process::Output {
     let mut cmd = Command::new("/bin/sh");
     // `sh -c CMD NAME ARGS…`: NAME fills $0, so the real arguments start at $1.
     let mut argv = vec!["-c", script, HOOK_MARKER];
@@ -26,48 +26,21 @@ fn sh(script: &str, args: &[&str], envs: &[(&str, &str)], payload: &[u8]) -> std
         .spawn()
         .expect("spawn /bin/sh");
     // Feed a Claude-Code-style payload on stdin; the script must drain it.
-    child.stdin.take().unwrap().write_all(payload).ok();
+    child
+        .stdin
+        .take()
+        .unwrap()
+        .write_all(br#"{"session_id":"x"}"#)
+        .ok();
     child.wait_with_output().expect("wait")
 }
 
-const SESSION: &str = "01234567-89ab-cdef-0123-456789abcdef";
-
-/// Accept exactly one HTTP request on a throwaway listener, answer 204, and
-/// hand back the raw request text. Runs `run` with the base URL once the
-/// acceptor thread is in place.
-fn capture_request(run: impl FnOnce(String) -> std::process::Output) -> String {
-    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
-    let addr = listener.local_addr().unwrap();
-    let handle = std::thread::spawn(move || {
-        let (mut sock, _) = listener.accept().unwrap();
-        let mut buf = [0u8; 4096];
-        let n = sock.read(&mut buf).unwrap();
-        sock.write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
-            .unwrap();
-        String::from_utf8_lossy(&buf[..n]).to_string()
-    });
-    let out = run(format!("http://{addr}"));
-    assert!(out.status.success(), "{:?}", out.stderr);
-    handle.join().unwrap()
-}
-
-fn session_envs(url: &str) -> Vec<(&'static str, String)> {
-    vec![
-        ("MAESTRO_URL", url.to_string()),
-        ("MAESTRO_SESSION_ID", SESSION.to_string()),
-    ]
-}
-
-fn owned_envs<'a>(envs: &'a [(&'static str, String)]) -> Vec<(&'static str, &'a str)> {
-    envs.iter().map(|(k, v)| (*k, v.as_str())).collect()
-}
-
 /// The hook must be invisible outside maestro: no env vars (#103 unset) ⇒
 /// exit 0, no output, stdin drained.
 #[test]
 fn script_exits_silently_without_maestro_env() {
     for (event, _) in HOOK_EVENTS {
-        let out = sh(HOOK_SCRIPT, &[event], &[], br#"{"session_id":"x"}"#);
+        let out = sh(HOOK_SCRIPT, &[event], &[]);
         assert!(out.status.success(), "{event:?}: {:?}", out.stderr);
         assert!(out.stdout.is_empty(), "{event:?}: {:?}", out.stdout);
         assert!(out.stderr.is_empty(), "{event:?}: {:?}", out.stderr);
@@ -78,82 +51,46 @@ fn script_exits_silently_without_maestro_env() {
 /// activity endpoint and still exits 0.
 #[test]
 fn script_posts_mapped_state_to_the_activity_endpoint() {
+    let listener = std::net::TcpListener::bind("127.0.0.1:0").unwrap();
+    let addr = listener.local_addr().unwrap();
+    let server = move || {
+        let (mut sock, _) = listener.accept().unwrap();
+        let mut buf = [0u8; 4096];
+        let n = sock.read(&mut buf).unwrap();
+        let raw = String::from_utf8_lossy(&buf[..n]).to_string();
+        sock.write_all(b"HTTP/1.1 204 No Content\r\nContent-Length: 0\r\n\r\n")
+            .unwrap();
+        raw
+    };
+    let handle = std::thread::spawn(server);
+
+    let url = format!("http://{addr}");
+    let session = "01234567-89ab-cdef-0123-456789abcdef";
     // The installer bakes the mapped state into the command's argv; the
     // script relays whatever it is given.
-    let request = capture_request(|url| {
-        sh(
-            HOOK_SCRIPT,
-            &["Active"],
-            &owned_envs(&session_envs(&url)),
-            br#"{"session_id":"x"}"#,
-        )
-    });
+    let out = sh(
+        HOOK_SCRIPT,
+        &["Active"],
+        &[("MAESTRO_URL", &url), ("MAESTRO_SESSION_ID", session)],
+    );
+    assert!(out.status.success());
+
+    let request = handle.join().unwrap();
     assert!(request.starts_with("POST "), "{request}");
     assert!(
-        request.contains(&format!("/api/sessions/{SESSION}/activity")),
+        request.contains(&format!("/api/sessions/{session}/activity")),
         "{request}"
     );
     assert!(request.contains(r#""state":"Active""#), "{request}");
 }
 
-/// Every event maps to the state the contract specifies.
+/// Every event maps to the state the issue specifies.
 #[test]
 fn event_state_mapping_matches_the_contract() {
     let map: std::collections::HashMap<&str, &str> = HOOK_EVENTS.into_iter().collect();
-    assert_eq!(map["PreToolUse"], "Active");
     assert_eq!(map["PostToolUse"], "Active");
-    assert_eq!(map["Notification"], "AwaitingInput");
     assert_eq!(map["Stop"], "AwaitingInput");
-    assert_eq!(map["StopFailure"], "Error");
-}
-
-/// A `StopFailure` payload names the API error that ended the turn; the
-/// script reports its `error` spelling as the report's `detail` so a card
-/// can show why (#114).
-#[test]
-fn script_reports_the_error_spelling_as_detail() {
-    let request = capture_request(|url| {
-        sh(
-            HOOK_SCRIPT,
-            &["Error"],
-            &owned_envs(&session_envs(&url)),
-            br#"{"session_id":"abc","hook_event_name":"StopFailure","error":"rate_limit","error_details":"429 Too Many Requests"}"#,
-        )
-    });
-    assert!(request.contains(r#""state":"Error""#), "{request}");
-    assert!(request.contains(r#""detail":"rate_limit""#), "{request}");
-}
-
-/// An `error` value that is not a plain enum spelling (or a payload without
-/// one at all) must never produce a broken body — no detail is posted.
-#[test]
-fn script_posts_no_detail_for_an_unexpected_error_value() {
-    let request = capture_request(|url| {
-        sh(
-            HOOK_SCRIPT,
-            &["Error"],
-            &owned_envs(&session_envs(&url)),
-            br#"{"hook_event_name":"StopFailure","error":"429 \"Too Many\" \\ requests"}"#,
-        )
-    });
-    assert!(request.contains(r#""state":"Error""#), "{request}");
-    assert!(!request.contains("detail"), "{request}");
-}
-
-/// Events whose payload carries no error fields post a bare body — never an
-/// empty or stale detail.
-#[test]
-fn script_posts_no_detail_for_events_without_an_error() {
-    let request = capture_request(|url| {
-        sh(
-            HOOK_SCRIPT,
-            &["AwaitingInput"],
-            &owned_envs(&session_envs(&url)),
-            br#"{"hook_event_name":"Stop","stop_hook_active":false}"#,
-        )
-    });
-    assert!(request.contains(r#""state":"AwaitingInput""#), "{request}");
-    assert!(!request.contains("detail"), "{request}");
+    assert_eq!(map["Notification"], "AwaitingInput");
 }
 
 /// A dead or unreachable daemon must never fail — or slow down — a session.
@@ -167,7 +104,6 @@ fn script_ignores_daemon_failure() {
             ("MAESTRO_URL", "http://127.0.0.1:1"),
             ("MAESTRO_SESSION_ID", "00000000-0000-0000-0000-000000000000"),
         ],
-        br#"{"session_id":"x"}"#,
     );
     assert!(out.status.success());
 }
@@ -202,10 +138,9 @@ fn fresh_install_registers_every_event() {
     install(&settings_path(home), &script_path(home)).unwrap();
 
     let cmds = installed_commands(&settings_path(home));
-    assert_eq!(cmds.len(), HOOK_EVENTS.len());
+    assert_eq!(cmds.len(), 3);
     let joined = cmds.join("\n");
-    assert_eq!(joined.matches("Active").count(), 2);
-    assert!(joined.contains("Error"));
+    assert!(joined.contains("Active"));
     assert_eq!(joined.matches("AwaitingInput").count(), 2);
     for cmd in &cmds {
         assert!(cmd.contains(SCRIPT_FILE_NAME));
@@ -223,10 +158,7 @@ fn install_is_idempotent() {
     install(&settings_path(home), &script_path(home)).unwrap();
     let twice = std::fs::read_to_string(settings_path(home)).unwrap();
     assert_eq!(once, twice);
-    assert_eq!(
-        installed_commands(&settings_path(home)).len(),
-        HOOK_EVENTS.len()
-    );
+    assert_eq!(installed_commands(&settings_path(home)).len(), 3);
 }
 
 /// An older maestro entry under the same events is updated in place, not
@@ -256,11 +188,7 @@ fn install_updates_an_older_maestro_hook_in_place() {
     install(&settings, &new_script).unwrap();
 
     let cmds = installed_commands(&settings);
-    assert_eq!(
-        cmds.len(),
-        HOOK_EVENTS.len(),
-        "old entry replaced, not kept: {cmds:?}"
-    );
+    assert_eq!(cmds.len(), 3, "old entry replaced, not kept: {cmds:?}");
     assert!(!cmds.iter().any(|c| c == old_script));
     let root: serde_json::Value =
         serde_json::from_str(&std::fs::read_to_string(&settings).unwrap()).unwrap();
@@ -303,11 +231,11 @@ fn install_preserves_foreign_hooks_and_removes_stale_maestro_ones() {
     assert_eq!(pre[0]["hooks"][0]["command"], "my-own-linter.sh");
     // Stale maestro event gone.
     assert!(root["hooks"].get("UserPromptSubmit").is_none());
-    // Our events present, nothing else maestro-related anywhere.
+    // Our three events present, nothing else maestro-related anywhere.
     let cmds = installed_commands(&settings);
     assert_eq!(
         cmds.iter().filter(|c| c.contains(HOOK_MARKER)).count(),
-        HOOK_EVENTS.len(),
+        3,
         "{cmds:?}"
     );
 }

docs/SIDEBAR.md

@@ -107,20 +107,6 @@ When the TTL expires, inference resumes and the session's reported detail —
 if any — clears with the report. Clients never blend the two: whichever source
 is in force supplies both the colour and the clock for `activity_since`.
 
-Two rulings specific to a reported `Error` (#114):
-
-- **The five-minute TTL applies to `Error` like to any other state.** A
-  session that failed is still failed after five minutes, but a card pinned
-  red forever lies once the session moves on; when the report lapses the card
-  returns to the daemon's own inference — usually `Idle` for a session that
-  has gone quiet.
-- **Only a new report clears an `Error` before its TTL.** The next
-  `ActivityState` of any kind replaces it (with #106's hook that is typically
-  `PreToolUse` → `Active` when the user prompts again). PTY output and
-  process changes do not clear it — only the agent itself may withdraw what
-  the agent itself reported. Re-reporting `Error` extends the TTL rather than
-  stacking reports.
-
 If a client receives an `ActivityState` variant it does not know, it must not
 fail rendering: treat it as `Idle` (neutral/dim, line-2 rules apply as usual)
 until the daemon sends a variant it does know. Rust clients deserialize