[nikolasd]

A vendor TUI's own redraw-driven escape queries were being journaled as if a human had typed them. crewd attach's viewer socket carries genuine keystrokes and a real terminal's replies to the vendor's own queries on the same duplex stream, and serve_viewer treated every byte read on it as out-of-band input regardless of content: a run left attached and idle in a real terminal (measured against a live tmux pane, which is confirmed -- via display/tmux.rs's own placement code -- to be the real terminal-emulator-in-the-loop for production attach panes) produced 99 outOfBandInput journal events and 99 needsReconciliation flag-sets in 20 seconds of pure idle, out of 211 total events for the run. The reported incident (a run left attached for eight minutes) journaled over 7,300 rows for a single run.

The byte source, confirmed before any fix was written

Reproduced headlessly: a fake vendor process emitting the CPR (ESC[6n) and primary-DA (ESC[c) queries a redrawing TUI issues, attached via crewd attach hosted in a real tmux pane. Every byte arriving on the viewer socket matched exactly the pattern ESC[<row>;<col>R (CPR reply) immediately followed by ESC[?1;2;4c (primary DA reply) -- tmux answering the vendor's queries on its behalf, the only path that could ever answer them, since crew's own attach relay never interprets terminal escape codes. Zero printable keystroke bytes anywhere in the capture.

The fix

display::terminal_reply recognizes the fixed shapes a real terminal emits automatically and a human keyboard never does: CPR replies, primary/secondary DA replies, the DSR "terminal OK" reply, focus in/out reports, and bracketed-paste start/end markers (the markers only -- text pasted between them is untouched and still counts as real input). serve_viewer strips these before deciding whether to call on_user_input at all; a read that is nothing but replies never reaches it, so it neither journals an event nor sets needsReconciliation. The vendor's own PTY still receives every byte unfiltered, exactly as before -- this is the only path that answers the vendor's own queries, so forwarding must not change.

A socket read can split a reply sequence across two reads. This was measured live, not theorized: the committed reproduction test (below) failed intermittently (roughly 30-50% of runs) after the coalescing work landed, with a spurious single-input row appearing. Root cause: a lone trailing c in one read, and a truncated ESC[?1;2;4 missing its closing c arriving in the next. ReplyFilter carries up to 32 unresolved trailing bytes across reads within one connection, so a split sequence is recognized once the next read completes it, rather than leaking either half. Regression tests split the captured reply at every possible byte offset, and chunk a 146-reply burst at a 7-byte boundary that doesn't divide the reply's 17-byte length.

Holding a byte back is driven by volume (more bytes arriving), not time. On its own this would hold a lone Escape keypress forever if nothing else ever arrived -- and Escape, alone, interrupts a claude TUI's current turn, about as consequential an out-of-band action as exists. serve_viewer's read loop also races an idle-window sleep (shared with the coalescer's own IDLE_WINDOW rather than a second timer, re-armed every iteration, enabled only while something is held) that releases whatever's pending as content once a full idle window passes with no further read -- through the same on_user_input path an ordinary keystroke takes, so a released byte coalesces like any other input rather than journaling a row of its own.

Coalescing: OutOfBandInput now carries input_count: u64 (#[serde(default = "one_input")], defaulting to 1 -- an outOfBandInput event means a human typed, so a pre-coalescing row cannot truthfully claim zero) and span_ms: u64 (#[serde(default)], defaulting to 0 -- a pre-coalescing row is a single input spanning no time), both #[ts(type = "number")], both plain u64 and never String so neither needs a redaction-guard allowlist entry -- content-free by type, not just by review. A background coalescer batches rapid on_user_input firings and flushes one row after a second of quiet, rather than one row per read. The variant's doc comment states it is journaled at the end of the window it describes, so the window's start is reconstructible from the envelope timestamp minus span_ms without a second, redundant timestamp field.

Also fixed: a transcript format that stamps every entry with its session id (Claude's does) was re-deriving and re-journaling an identical AdapterVendorSessionEvent for every tailed entry -- 41 identical rows for one session id, measured on a real transcript. The pump loop now tracks the last vendor session id it actually emitted and skips a redundant re-emit, but only when doing so has no effect on cursor durability: the common shape (SessionMeta paired with another event on the same transcript line) already gives SessionMeta no cursor, since the sibling event carries it, so skipping it is free; the rarer "hidden SessionMeta-only line" shape still emits even when redundant, since dropping that call would drop the only commit advancing runs.transcript_cursor past it.

Verification

• The committed reproduction test drives the real production path end to end: a fake vendor emitting the exact captured query pair every 50ms under a real tmux pane hosting crewd attach. A positive control (tmux capture-pane -S -, counting DA-reply occurrences with a floor of 20) runs and must pass before the real assertion, so a scaffold producing nothing cannot pass the zero-journaled-rows check for the wrong reason -- verified the floor itself fires by temporarily breaking it and confirming the test failed with the right message. Skips visibly when tmux isn't on PATH, rather than failing.
• cargo fmt --all --check -- clean.
• cargo clippy --all-targets --all-features -D warnings -- clean.
• CREW_DISABLE_VENDOR_CLI=1 cargo test --workspace -- all green, including 17/17 terminal_reply tests, 3/3 oob_coalescer tests, and the storm reproduction test run four times total across this review with zero flakes (post-fix).
• bun run check -- exit 0 end to end (schema-drift, format, typecheck, build, bun test, full Rust workspace).
• bun run generate re-run for the OutOfBandInput schema/bindings change.