fix(chat): free the injected-turn slot when an injected turn is interrupted

[juacker]

Problem

Since mid-run queued-message delivery (#8ab0b33 feat(chat): deliver mid-run user messages into live Claude runs), a run can turn into a zombie: the spinner never stops after the conversation has visibly ended, and subsequent user messages get delivered into the dead run instead of starting a new one, so the agent appears to go silent.

Observed 2026-06-11 (run 6b218444): two queued messages delivered mid-run, both with interrupted=true — the second one interrupting the first injected message's turn. After the final turn completed, the run kept stdin open forever, never reached EOF, and never finalized. A message sent 15 minutes later was routed into the zombie run (interrupted=false, Claude sitting idle).

Root cause

With --input-format stream-json, the run ends when we close stdin (Claude drains and exits → EOF → run finalizes). That decision was driven by a counter, pending_injected_turns: +1 per delivered message, -1 per result event — except when the result was the wind-down of a turn we interrupted, on the assumption that an interrupted wind-down doesn't complete a real turn.

That assumption only holds when the interrupted turn is the original prompt turn (which never held a slot). When the interrupted turn is itself a previously injected turn — a second queued message arriving while the first one's turn runs — the wind-down is that turn completing. Skipping the decrement leaks one slot permanently: the counter never reaches 0, stdin never closes, the run never ends.

The deeper issue: the accounting was keyed off suppress_interrupted, an error-classification flag whose actual job is to stop the interrupt's error_during_execution from failing the run. Error semantics and turn counting are different concerns.

Fix

Replace the conditional decrement with a protocol invariant that needs no classification:

Claude Code emits exactly one result per turn, and turns run strictly in order: the original prompt turn first, then one turn per injected user line.

So: the first result always ends the original turn (frees nothing); every later result ends an injected turn and frees exactly one slot — whether it finished naturally or was cut by our interrupt.

Encoded as InjectedTurnLedger, a pure ~20-line state machine (delivered(n) / turn_ended() / pending()), unit-tested directly. suppress_interrupted now does only error suppression; accounting no longer looks at it.

This also fixes a symmetric latent edge for free: a message delivered before the original turn streamed its first event (poll tick fires before the first stream event, no interrupt sent) used to have its slot consumed by the original turn's own result, closing stdin while its turn was still buffered.

Tests

• injected_turn_ledger_double_interrupt_frees_the_cut_turns_slot — replays the observed log sequence 1:1 (regression).
• injected_turn_ledger_single_interrupt — the already-working case stays correct.
• injected_turn_ledger_delivery_before_first_turn_event — the latent edge above.
• injected_turn_ledger_no_injections — baseline.

cargo check clean; all 19 assistant::local_agent tests pass.