fix: back off deferred DING probes

Author: myobie

INVARIANTS.md

@@ -12,6 +12,7 @@ materialization, messaging, DING, or presence must preserve them.
 | **Exactly-once-safe native bus** | Messages use stable `<unix-ms>-<rand6>.md` files. An archive filename is a durable receipt that shadows and cleans restored inbox replicas and makes repeated archive cleanup idempotent. | `src/message.rs::filename_grammar`; `src/message.rs::archive_receipt_suppresses_and_idempotently_cleans_a_restored_inbox_copy`; `tests/message.rs` |
 | **Fail-closed observed native DING** | Each unread message becomes one normalized `[DING]` frame. A maintained Codex or Claude composer must be positively empty before a bracketed paste, then show the exact notice in two immediately adjacent inspections before a separate bare Return. Human, modal, active, changed, timed-out, and unknown states never receive Return. Once paste starts, inspect-only staged ownership prevents duplicate paste across command failures, archive races, and restart adoption. Startup backlog otherwise becomes one generic recovery DING; new arrivals remain FIFO; `busy` delivers immediately; only fresh `dnd` defers. | `src/ding.rs::poke_text_normalizes_and_bounds_untrusted_fields`; `src/ding.rs::malicious_controls_cannot_escape_the_single_paste_frame`; `src/ding.rs::pty_stage_and_submit_are_separate_exact_sequences`; `src/ding.rs::maintained_composer_classifiers_require_exact_idle_state`; `src/ding.rs::paste_then_two_exact_observations_precede_return`; `src/ding.rs::changed_modal_ambiguous_and_bounded_timeout_never_return`; `src/ding.rs::final_observation_change_and_staged_retry_are_fail_closed`; `src/ding.rs::staged_ownership_survives_archive_and_never_repastes`; `src/ding.rs::pty_commands_have_a_real_outer_timeout`; `src/ding.rs::session_watch_has_startup_grace_debounce_and_live_reset`; `src/ding.rs::new_arrivals_is_fifo_and_archive_receipts_prevent_reding`; `src/ding.rs::pending_delivery_ignores_busy_but_respects_fresh_dnd_archive_and_retry`; `src/ding.rs::startup_recovery_notice_retries_in_memory`; `src/ding.rs::startup_backlog_gets_one_generic_recovery_then_new_arrivals_poke` |
 | **Mutation-only filesystem wakeups** | Supervisor and DING filesystem watchers ignore read/open access events and wake early only for create, modify, rename, or remove events. Their own catalog and inbox reads therefore cannot bypass the bounded timer cadence or form a Linux inotify CPU loop. | `src/watch.rs::only_mutations_wake_watch_loops`; `src/watch.rs::linux_reads_are_silent_but_real_mutations_wake`; `src/ding.rs::idle_ding_does_not_spin_on_its_own_inbox_reads`; `src/run.rs::idle_supervisor_does_not_spin_on_its_own_catalog_reads` |
+| **Bounded DING PTY probe churn** | An unsafe or active composer retains its FIFO notice but deferred delivery retries use a bounded backoff, so each inbox poll cannot spawn another short-lived PTY probe. | `src/ding.rs::deferred_delivery_backoff_bounds_short_lived_pty_attempts` |
 | **Agent-declared presence discipline** | The shipped bus contract requires agents to declare `busy` before executing work, use `available` only while yielding or ready, and reserve `dnd` for an explicit hold. Both native harnesses materialize that contract. Busy remains observable but does not suppress DING; fresh `dnd` is the only delivery gate. | `tests/compile_agent.rs::compile_agent_generates_claude_then_materializes_verbatim_persona`; `tests/compile_agent.rs::compile_agent_generates_codex_then_materializes_composed_agents_md`; `src/ding.rs::pending_delivery_ignores_busy_but_respects_fresh_dnd_archive_and_retry` |
 | **Stable roster JSON** | `st2 agents --json [--enrich]` preserves field names, order, null handling, presence, explicit retirement state, activity, and inbox counts. Human output marks retired declarations without changing active rows. | `src/agents.rs::agents_json_has_stable_wire_shape`; `tests/status_agents.rs::roster_json_and_human_output_distinguish_retirement_from_presence` |
 | **Agent-declared presence** | Refresh preserves non-DND declared status and only advances liveness; a missing status starts as `available`, while `dnd` is never refreshed and an unrefreshed declaration ages to `unknown`. | `src/status.rs::refresh_preserves_value_and_bumps_mtime`; `src/status.rs::refresh_leaves_dnd_to_age_out`; `src/status.rs::refresh_missing_writes_available_default`; `src/status.rs::stale_mtime_reads_as_unknown_regardless_of_contents` |

README.md

@@ -247,7 +247,9 @@ Agents must declare `busy` before actively executing work and return to `availab
 yielding or ready for new work, but `busy` never suppresses DING. Fresh `dnd` is the only delivery
 hold. The sidecar does not refresh `dnd`, so an abandoned hold becomes stale after 15 minutes and
 delivery resumes. New arrivals remain FIFO, same-filename archive receipts shadow and clean restored
-inbox duplicates, and failed or uncertain PTY operations retain the notice for safe retry. On start
+inbox duplicates, and failed or uncertain PTY operations retain the notice for safe retry. Unsafe
+delivery retries use a bounded backoff, so an active composer cannot make the sidecar spawn a fresh
+PTY probe on every inbox poll. On start
 or restart, the sidecar first adopts an exact staged recovery/backlog notice when present, then sends
 one generic check-inbox recovery DING if unread work remains; it does not replay every backlog
 message.

docs/vrs/spec.md

@@ -71,8 +71,9 @@ atomic inbox file → DING attempt → agent reads → archive receipt
   `busy` does not. Failed delivery remains retryable. Sidecar restart emits a
   bounded recovery notice instead of replaying the inbox. Delivery may wake an
   agent while it is working, but an active or uncertain human composer must be
-  left untouched. Inbox reads do not wake the sidecar; only mutations bypass
-  its bounded poll cadence.
+  left untouched. Unsafe delivery retries use a bounded backoff so an active
+  composer cannot create a short-lived PTY probe on every inbox poll. Inbox
+  reads do not wake the sidecar; only mutations bypass its bounded poll cadence.
 
 ## State and scope
 

src/ding.rs

@@ -32,6 +32,10 @@ const RECOVERY_POKE: &str = "[DING] unread st2 messages remain; check your inbox
 const PTY_COMMAND_TIMEOUT: Duration = Duration::from_millis(600);
 const COMPOSER_OBSERVATION_WINDOW: Duration = Duration::from_millis(450);
 const COMPOSER_OBSERVATION_POLL: Duration = Duration::from_millis(10);
+/// A human or active turn can keep a staged notice unsafe for minutes. Retrying `pty peek` every
+/// inbox poll creates a short-lived child for each attempt, so keep the correctness fallback but
+/// bound that descendant churn independently of the filesystem poll cadence.
+const DELIVERY_RETRY_BACKOFF: Duration = Duration::from_secs(15);
 
 /// The `<rand6>` of a `<unix-ms>-<rand6>.md` filename — the stable id an agent dedups re-pokes on.
 /// Falls back to the `.md`-stripped stem for anything off-grammar.
@@ -1030,6 +1034,7 @@ pub fn run_ding(
     let mut watch = SessionWatch::default();
     let mut logged_waiting = false;
     let mut last_refresh: Option<Instant> = None;
+    let mut next_delivery_attempt: Option<Instant> = None;
 
     loop {
         if stop.load(Ordering::SeqCst) {
@@ -1050,36 +1055,41 @@ pub fn run_ding(
                 last_refresh = Some(Instant::now());
             }
 
-            if !delivery_suppressed(status_path)
-                && let Some(candidates) = startup_candidates.as_ref()
-            {
-                match poker.adopt_staged(candidates) {
-                    Ok(Some(text)) => {
-                        if text == RECOVERY_POKE {
-                            if let Some(recovery) = pending
-                                .iter_mut()
-                                .find(|notice| matches!(notice, PendingNotice::Recovery { .. }))
-                            {
-                                recovery.set_staged_text(Some(text));
-                            }
-                        } else {
-                            pending.push_front(PendingNotice::adopted(text));
-                        }
-                        startup_candidates = None;
-                    }
-                    Ok(None) => startup_candidates = None,
-                    Err(error) => {
-                        eprintln!("st2 ding: startup staged-notice adoption failed: {error}")
-                    }
-                }
-            }
             pending.extend(
                 new_arrivals(inbox_dir, &mut seen)
                     .into_iter()
                     .map(PendingNotice::message),
             );
             prune_archived_pending(inbox_dir, &mut pending);
-            flush_pending(status_path, &mut pending, poker);
+
+            let delivery_due =
+                next_delivery_attempt.is_none_or(|deadline| Instant::now() >= deadline);
+            if delivery_due && !delivery_suppressed(status_path) {
+                if let Some(candidates) = startup_candidates.as_ref() {
+                    match poker.adopt_staged(candidates) {
+                        Ok(Some(text)) => {
+                            if text == RECOVERY_POKE {
+                                if let Some(recovery) = pending
+                                    .iter_mut()
+                                    .find(|notice| matches!(notice, PendingNotice::Recovery { .. }))
+                                {
+                                    recovery.set_staged_text(Some(text));
+                                }
+                            } else {
+                                pending.push_front(PendingNotice::adopted(text));
+                            }
+                            startup_candidates = None;
+                        }
+                        Ok(None) => startup_candidates = None,
+                        Err(error) => {
+                            eprintln!("st2 ding: startup staged-notice adoption failed: {error}")
+                        }
+                    }
+                }
+                flush_pending(status_path, &mut pending, poker);
+                next_delivery_attempt = (startup_candidates.is_some() || !pending.is_empty())
+                    .then(|| Instant::now() + DELIVERY_RETRY_BACKOFF);
+            }
         } else if !watch.seen_alive && !logged_waiting {
             eprintln!(
                 "st2 ding: target pty session not yet registered; waiting before enabling exit-when-gone."
@@ -1241,6 +1251,7 @@ mod tests {
     #[derive(Default)]
     struct RecordingPoker {
         alive: AtomicBool,
+        defer: AtomicBool,
         probes: AtomicUsize,
         failures: Mutex<usize>,
         calls: Mutex<Vec<String>>,
@@ -1258,6 +1269,9 @@ mod tests {
     impl Poker for RecordingPoker {
         fn poke(&self, text: &str) -> anyhow::Result<PokeOutcome> {
             self.calls.lock().unwrap().push(text.to_string());
+            if self.defer.load(Ordering::SeqCst) {
+                return Ok(PokeOutcome::Deferred);
+            }
             let mut failures = self.failures.lock().unwrap();
             if *failures > 0 {
                 *failures -= 1;
@@ -1879,6 +1893,37 @@ mod tests {
         assert!(!calls.iter().any(|call| call.contains("seeded")));
     }
 
+    #[test]
+    fn deferred_delivery_backoff_bounds_short_lived_pty_attempts() {
+        let agent = tempfile::tempdir().unwrap();
+        let inbox = inbox_dir(agent.path());
+        let status_path = status::status_path(agent.path());
+        status::set_state(&status_path, status::State::Available).unwrap();
+        send_to_inbox(&inbox, "alice", Some("active"), None, &[], "active").unwrap();
+
+        let poker = RecordingPoker::live();
+        poker.defer.store(true, Ordering::SeqCst);
+        let stop = AtomicBool::new(false);
+        let config = DingConfig {
+            poll: Duration::from_millis(20),
+            status_refresh: Duration::from_secs(60),
+        };
+
+        std::thread::scope(|scope| {
+            scope.spawn(|| {
+                std::thread::sleep(Duration::from_millis(250));
+                stop.store(true, Ordering::SeqCst);
+            });
+            run_ding(&inbox, Some(&status_path), &poker, &config, &stop).unwrap();
+        });
+
+        assert_eq!(
+            poker.calls.lock().unwrap().len(),
+            1,
+            "an unsafe composer must not respawn pty peek/send children every inbox poll"
+        );
+    }
+
     #[cfg(target_os = "linux")]
     #[test]
     fn idle_ding_does_not_spin_on_its_own_inbox_reads() {