feat(engine): withdraw_steer reports SteerWithdrawal outcome

Hosts that re-send a queued input through another path (interrupt-and-send)
must know whether the engine copy can still be committed, otherwise the
same message can be delivered twice: the withdrawal used to be
fire-and-forget, and "no SteerCommitted received yet" cannot be
distinguished from "already committed" on the async event path.

SteerControlState::withdraw now reports from the authoritative unsettled
ledger, and EngineHandle::withdraw_steer returns it:

- Retired: the id was pending and is now marked withdrawn — guaranteed
  never to be injected, settles with exactly one SteerDropped; the host
  may safely re-send.
- NotPending: the id already settled (committed or dropped) or was never
  seen — no-op with no event; the host must not re-send.

The withdrawal-set invariants are unchanged: unknown ids do not grow the
set (bounded), settled ids stay no-ops. Behavior test
steer_lifecycle_withdrawal_is_bounded_and_prevents_commit now asserts all
three outcomes.

No-Issue: driven by pinvou-agent#308 review (interrupt-and-send resend
race); upstream-neutral, same area as the conversation-insertion
primitives in #16.

Signed-off-by: luzeyang (INT) <lu.zeyang@h3c.com>

Author: luzeyang (INT)

crates/tui/src/core/engine.rs

@@ -579,6 +579,21 @@ pub enum CancelMode {
     StopDropInbox,
 }
 
+/// Outcome of withdrawing a queued steer by id. Hosts that re-send the same
+/// input through another path (e.g. interrupt-and-send) need to know whether
+/// the engine copy can still be committed, otherwise the same message may be
+/// delivered twice.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum SteerWithdrawal {
+    /// The steer was still pending and is now marked withdrawn: it will never
+    /// be injected and settles with exactly one `Event::SteerDropped`.
+    Retired,
+    /// The id was not pending — already committed, already settled, or never
+    /// seen. The withdrawal is a no-op and the engine copy may already be in
+    /// the transcript; hosts must not re-send in that case.
+    NotPending,
+}
+
 impl CancelReason {
     fn describe(self) -> &'static str {
         match self {
@@ -665,9 +680,15 @@ impl SteerControlState {
         self.withdrawn.remove(id);
     }
 
-    fn withdraw(&mut self, id: &str) {
+    fn withdraw(&mut self, id: &str) -> SteerWithdrawal {
         if self.unsettled.contains_key(id) {
             self.withdrawn.insert(id.to_string());
+            SteerWithdrawal::Retired
+        } else {
+            // Unknown ids must not grow the withdrawal set (bounded), and an
+            // id that already settled (committed or dropped) must stay a
+            // no-op so a late withdraw cannot rewrite history.
+            SteerWithdrawal::NotPending
         }
     }
 

crates/tui/src/core/engine/handle.rs

@@ -271,19 +271,22 @@ impl EngineHandle {
 
     /// Withdraw a queued steer before the engine injects it.
     ///
-    /// Fire-and-forget: the id is recorded in a set shared with the engine,
-    /// which checks it at every steer collection and injection point. A
-    /// withdrawn steer is never appended to the transcript; when the engine
-    /// next encounters it, the steer is skipped and reported once via
-    /// `Event::SteerDropped`. Withdrawing an id that was already committed —
-    /// or never existed — is a no-op with no event. The mark survives across
-    /// turns (a parked steer may only surface in a later turn) and is cleared
-    /// on session switch and shutdown.
-    pub fn withdraw_steer(&self, steer_id: &str) {
+    /// The id is recorded in a set shared with the engine, which checks it at
+    /// every steer collection and injection point. A withdrawn steer is never
+    /// appended to the transcript; when the engine next encounters it, the
+    /// steer is skipped and reported once via `Event::SteerDropped`.
+    ///
+    /// Returns [`SteerWithdrawal::Retired`] when the id was still pending and
+    /// is now guaranteed never to be injected, or
+    /// [`SteerWithdrawal::NotPending`] when the id already settled (committed
+    /// or dropped) or was never seen — a no-op with no event. Hosts that
+    /// re-send the same input through another path must check this outcome to
+    /// avoid delivering the message twice.
+    pub fn withdraw_steer(&self, steer_id: &str) -> crate::core::engine::SteerWithdrawal {
         self.steer_control
             .lock()
             .unwrap_or_else(std::sync::PoisonError::into_inner)
-            .withdraw(steer_id);
+            .withdraw(steer_id)
     }
 
     /// Steer an in-flight turn with additional user input.

crates/tui/src/core/engine/tests.rs

@@ -5385,7 +5385,11 @@ async fn steer_lifecycle_withdrawal_is_bounded_and_prevents_commit() {
         &Config::default(),
     );
     let turn = engine.begin_steer_turn();
-    handle.withdraw_steer("never-existed");
+    assert_eq!(
+        handle.withdraw_steer("never-existed"),
+        crate::core::engine::SteerWithdrawal::NotPending,
+        "unknown ids report NotPending"
+    );
     assert!(
         engine
             .steer_control
@@ -5397,10 +5401,18 @@ async fn steer_lifecycle_withdrawal_is_bounded_and_prevents_commit() {
     );
 
     let steer_id = handle.steer("withdraw this").await.expect("queue steer");
-    handle.withdraw_steer(&steer_id);
+    assert_eq!(
+        handle.withdraw_steer(&steer_id),
+        crate::core::engine::SteerWithdrawal::Retired,
+        "pending steer reports Retired"
+    );
     let steer = engine.rx_steer.recv().await.expect("queued steer");
     assert!(!engine.inject_steer(steer).await);
-    handle.withdraw_steer(&steer_id);
+    assert_eq!(
+        handle.withdraw_steer(&steer_id),
+        crate::core::engine::SteerWithdrawal::NotPending,
+        "settled id reports NotPending and stays a no-op"
+    );
     let state = engine
         .steer_control
         .lock()