fix: address review findings for session submit intents

- Guard cmdSessionSuspend and cmdSessionWait with cityUsesManagedReconciler
  to prevent silently succeeding on unmanaged ad-hoc cities
- Add SubmissionCapabilities to createAgentSession response to match
  createProviderSession
- Restore StopTurn (POST /stop) to always use SIGINT; soft Escape is
  reserved for the submit interrupt_now path via stopTurnLocked
- Fix emitSessionSubmitResult to distinguish queued follow-ups from
  immediately delivered ones on suspended sessions
- Skip redundant stopTurnLocked before hard restart in interruptAndSubmitLocked
  since Stop() is a superset
- Add justifying comment on PID file usage in nudge poller

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: julianknutsen

cmd/gc/cmd_session.go

@@ -730,7 +730,9 @@ func cmdSessionSuspend(args []string, stdout, stderr io.Writer) int {
 	}
 
 	// Try reconciler-first path: set held_until metadata, poke controller.
-	if cityErr == nil {
+	// Only use this path when the city is managed by a standalone controller
+	// or the machine-wide supervisor — not for unmanaged ad-hoc cities.
+	if cityErr == nil && cityUsesManagedReconciler(cityPath) {
 		if pokeErr := pokeController(cityPath); pokeErr == nil {
 			// Controller is running — metadata-only suspend.
 			// Set held_until far in the future so the reconciler drains/stops the session.
@@ -1173,8 +1175,10 @@ func cmdSessionSubmit(args []string, intent session.SubmitIntent, stdout, stderr
 
 func emitSessionSubmitResult(stdout io.Writer, target string, intent session.SubmitIntent, queued bool) {
 	switch {
-	case queued || intent == session.SubmitIntentFollowUp:
+	case queued:
 		fmt.Fprintf(stdout, "Queued follow-up for %s\n", target) //nolint:errcheck // best-effort stdout
+	case intent == session.SubmitIntentFollowUp:
+		fmt.Fprintf(stdout, "Submitted follow-up to %s\n", target) //nolint:errcheck // best-effort stdout
 	case intent == session.SubmitIntentInterruptNow:
 		fmt.Fprintf(stdout, "Interrupted and submitted to %s\n", target) //nolint:errcheck // best-effort stdout
 	default:

cmd/gc/cmd_session_submit_test.go

@@ -8,14 +8,26 @@ import (
 	"github.com/gastownhall/gascity/internal/session"
 )
 
-func TestEmitSessionSubmitResultFollowUp(t *testing.T) {
+func TestEmitSessionSubmitResultFollowUpQueued(t *testing.T) {
 	var stdout bytes.Buffer
 	emitSessionSubmitResult(&stdout, "mayor", session.SubmitIntentFollowUp, true)
 	if got := stdout.String(); !strings.Contains(got, "Queued follow-up for mayor") {
 		t.Fatalf("stdout = %q, want queued confirmation", got)
 	}
 }
 
+func TestEmitSessionSubmitResultFollowUpImmediate(t *testing.T) {
+	var stdout bytes.Buffer
+	emitSessionSubmitResult(&stdout, "mayor", session.SubmitIntentFollowUp, false)
+	got := stdout.String()
+	if strings.Contains(got, "Queued") {
+		t.Fatalf("stdout = %q, should not say Queued when message was delivered immediately", got)
+	}
+	if !strings.Contains(got, "Submitted follow-up to mayor") {
+		t.Fatalf("stdout = %q, want submitted follow-up confirmation", got)
+	}
+}
+
 func TestParseSessionSubmitIntentAcceptsLegacySpellings(t *testing.T) {
 	cases := []struct {
 		raw  string

cmd/gc/cmd_wait.go

@@ -159,8 +159,8 @@ func cmdSessionWait(args, depIDs []string, matchAny bool, note string, sleep boo
 	}
 	if sleep {
 		cityPath, err := resolveCity()
-		if err != nil || pokeController(cityPath) != nil {
-			fmt.Fprintln(stderr, "gc session wait: controller must be running when --sleep is used") //nolint:errcheck
+		if err != nil || !cityUsesManagedReconciler(cityPath) {
+			fmt.Fprintln(stderr, "gc session wait: a managed controller must be running when --sleep is used") //nolint:errcheck
 			return 1
 		}
 	}

internal/api/handler_session_chat.go

@@ -403,6 +403,9 @@ func (s *Server) handleSessionCreate(w http.ResponseWriter, r *http.Request) {
 
 	resp := sessionToResponse(info, s.state.Config())
 	resp.Kind = "agent"
+	if caps, capErr := s.sessionManager(store).SubmissionCapabilities(info.ID); capErr == nil {
+		resp.SubmissionCapabilities = caps
+	}
 	s.enrichSessionResponse(&resp, info, s.state.Config(), s.state.SessionProvider(), false)
 	statusCode := http.StatusAccepted // always async for agent sessions
 	s.idem.storeResponse(idemKey, bodyHash, statusCode, resp)

internal/api/handler_session_submit_test.go

@@ -148,7 +148,7 @@ func TestHandleSessionGetIncludesSubmissionCapabilities(t *testing.T) {
 	}
 }
 
-func TestHandleSessionStopUsesSoftEscapeForCodex(t *testing.T) {
+func TestHandleSessionStopUsesInterruptForCodex(t *testing.T) {
 	fs := newSessionFakeState(t)
 	srv := New(fs)
 
@@ -165,19 +165,15 @@ func TestHandleSessionStopUsesSoftEscapeForCodex(t *testing.T) {
 	if rec.Code != http.StatusOK {
 		t.Fatalf("stop status = %d, want %d; body: %s", rec.Code, http.StatusOK, rec.Body.String())
 	}
-	var sawEscape, sawInterrupt bool
+	// StopTurn (backing /stop) always uses SIGINT regardless of provider.
+	// Soft Escape is reserved for the submit interrupt_now path.
+	var sawInterrupt bool
 	for _, call := range fs.sp.Calls {
-		if call.Method == "SendKeys" && call.Name == info.SessionName && call.Message == "Escape" {
-			sawEscape = true
-		}
 		if call.Method == "Interrupt" && call.Name == info.SessionName {
 			sawInterrupt = true
 		}
 	}
-	if !sawEscape {
-		t.Fatalf("calls = %#v, want SendKeys(Escape)", fs.sp.Calls)
-	}
-	if sawInterrupt {
-		t.Fatalf("calls = %#v, did not want Interrupt for codex stop", fs.sp.Calls)
+	if !sawInterrupt {
+		t.Fatalf("calls = %#v, want Interrupt for StopTurn", fs.sp.Calls)
 	}
 }

internal/session/chat.go

@@ -371,7 +371,9 @@ func (m *Manager) SendImmediate(ctx context.Context, id, message, resumeCommand
 	return m.send(ctx, id, message, resumeCommand, hints, true)
 }
 
-// StopTurn issues a soft interrupt for the currently running turn.
+// StopTurn issues a hard interrupt (SIGINT) for the currently running turn.
+// This backs the POST /v0/session/{id}/stop API endpoint and always uses
+// SIGINT for reliable interruption across all provider states.
 // Pool-managed sessions are rejected: they have no human user, so
 // Claude Code's interactive "What should Claude do instead?" prompt
 // would hang them forever.
@@ -381,7 +383,16 @@ func (m *Manager) StopTurn(id string) error {
 		if err != nil {
 			return err
 		}
-		return m.stopTurnLocked(b, sessName)
+		if State(b.Metadata["state"]) == StateSuspended || !m.sp.IsRunning(sessName) {
+			return nil
+		}
+		if b.Metadata["pool_managed"] == "true" || strings.TrimSpace(b.Metadata["pool_slot"]) != "" {
+			return fmt.Errorf("%w: %s", ErrPoolManaged, sessName)
+		}
+		if err := m.sp.Interrupt(sessName); err != nil {
+			return fmt.Errorf("interrupting session: %w", err)
+		}
+		return nil
 	})
 }
 

internal/session/submit.go

@@ -122,13 +122,17 @@ func (m *Manager) interruptAndSubmitLocked(ctx context.Context, id string, b bea
 	if !running {
 		return m.sendLocked(ctx, id, b, sessName, message, resumeCommand, hints, true)
 	}
-	if err := m.stopTurnLocked(b, sessName); err != nil {
-		return err
-	}
 	if usesHardRestartSubmit(b) {
+		// Hard-restart providers (Claude over tmux) are killed and restarted.
+		// Stop() is a superset of stopTurnLocked(), so skip the intermediate
+		// interrupt to avoid wasted latency.
 		if err := m.sp.Stop(sessName); err != nil {
 			return fmt.Errorf("stopping session before submit: %w", err)
 		}
+	} else {
+		if err := m.stopTurnLocked(b, sessName); err != nil {
+			return err
+		}
 	}
 	return m.sendLocked(ctx, id, b, sessName, message, resumeCommand, hints, true)
 }
@@ -230,6 +234,11 @@ func deferredSubmitAgentKey(b beads.Bead) string {
 
 var startSessionSubmitPoller = ensureSessionSubmitPoller
 
+// ensureSessionSubmitPoller starts a background nudge poller if one is not
+// already running. PID files are used here for orphan bounding rather than
+// state tracking: the poller validates PID liveness via kill(pid, 0) and the
+// 15-second grace period in shouldKeepNudgePollerAlive caps orphan lifetime
+// on parent crash.
 func ensureSessionSubmitPoller(cityPath, agentName, sessionName string) error {
 	pidPath := sessionSubmitPollerPIDPath(cityPath, sessionName)
 	return withSessionSubmitPollerPIDLock(pidPath, func() error {

internal/session/submit_test.go

@@ -245,11 +245,8 @@ func TestSubmitInterruptNowFallsBackToHardRestartForClaude(t *testing.T) {
 		t.Fatal("Submit(interrupt_now) unexpectedly queued")
 	}
 
-	var sawInterrupt, sawStop, sawRestart, sawNudge bool
+	var sawStop, sawRestart, sawNudge bool
 	for _, call := range sp.Calls {
-		if call.Method == "Interrupt" && call.Name == info.SessionName {
-			sawInterrupt = true
-		}
 		if call.Method == "Stop" && call.Name == info.SessionName {
 			sawStop = true
 		}
@@ -260,12 +257,12 @@ func TestSubmitInterruptNowFallsBackToHardRestartForClaude(t *testing.T) {
 			sawNudge = true
 		}
 	}
-	if !sawInterrupt || !sawStop || !sawRestart || !sawNudge {
-		t.Fatalf("calls = %#v, want interrupt + stop + restart + nudge", sp.Calls)
+	if !sawStop || !sawRestart || !sawNudge {
+		t.Fatalf("calls = %#v, want stop + restart + nudge (no intermediate interrupt)", sp.Calls)
 	}
 }
 
-func TestStopTurnUsesSoftEscapeForCodex(t *testing.T) {
+func TestStopTurnUsesInterruptForCodex(t *testing.T) {
 	store := beads.NewMemStore()
 	sp := runtime.NewFake()
 	mgr := NewManager(store, sp)
@@ -279,19 +276,43 @@ func TestStopTurnUsesSoftEscapeForCodex(t *testing.T) {
 		t.Fatalf("StopTurn: %v", err)
 	}
 
-	var sawEscape, sawInterrupt bool
+	// StopTurn always uses SIGINT (Interrupt) regardless of provider.
+	// Soft Escape is only used by the submit interrupt_now path via stopTurnLocked.
+	var sawInterrupt bool
 	for _, call := range sp.Calls {
-		if call.Method == "SendKeys" && call.Name == info.SessionName && call.Message == "Escape" {
-			sawEscape = true
-		}
 		if call.Method == "Interrupt" && call.Name == info.SessionName {
 			sawInterrupt = true
 		}
 	}
-	if !sawEscape {
-		t.Fatalf("calls = %#v, want SendKeys(Escape)", sp.Calls)
+	if !sawInterrupt {
+		t.Fatalf("calls = %#v, want Interrupt for StopTurn", sp.Calls)
 	}
-	if sawInterrupt {
-		t.Fatalf("calls = %#v, did not want Interrupt for codex stop", sp.Calls)
+}
+
+func TestSubmitInterruptNowUsesSoftEscapeForCodex(t *testing.T) {
+	store := beads.NewMemStore()
+	sp := runtime.NewFake()
+	mgr := NewManager(store, sp)
+
+	info, err := mgr.Create(context.Background(), "helper", "", "codex", t.TempDir(), "codex", nil, ProviderResume{}, runtime.Config{})
+	if err != nil {
+		t.Fatalf("Create: %v", err)
+	}
+
+	_, err = mgr.Submit(context.Background(), info.ID, "replace", BuildResumeCommand(info), runtime.Config{WorkDir: info.WorkDir}, SubmitIntentInterruptNow)
+	if err != nil {
+		t.Fatalf("Submit(interrupt_now): %v", err)
+	}
+
+	// The submit interrupt_now path uses stopTurnLocked which sends
+	// soft Escape for codex instead of SIGINT.
+	var sawEscape bool
+	for _, call := range sp.Calls {
+		if call.Method == "SendKeys" && call.Name == info.SessionName && call.Message == "Escape" {
+			sawEscape = true
+		}
+	}
+	if !sawEscape {
+		t.Fatalf("calls = %#v, want SendKeys(Escape) via submit interrupt_now", sp.Calls)
 	}
 }