fix(boundary): Enter sau gõ tắt bị nuốt (WhatsApp beep, phải Enter 2 lần) — macOS 26 drop bản copy của phím HID thật

postBoundaryCopy re-post event.copy() của Return thật để nó rơi xuống SAU
edit gõ tắt — nhưng macOS 26 âm thầm drop bản copy đó trước khi tới app:
log bắt tại trận posted → qua tap của mình → không bao giờ tới IMKit.
Hệ quả: 'ko'⏎ nở thành 'không' nhưng tin nhắn không gửi, WhatsApp beep,
phải Enter lần 2.

Fix: dựng cặp down/up MỚI từ source .hidSystemState (giữ keycode + flags
gốc nên Shift+Enter vẫn là xuống dòng). Không magic — bản Enter mới quay
lại handle() như phím thật, engine lúc đó đã rỗng nên pass thẳng, không
loop. Post thêm keyUp để app không thấy phím bị giữ. Không dùng private
source vì Electron (Discord/Slate) hạ cấp Return private-source thành
'insert newline' thay vì Enter-to-send.

Tách makeBoundaryRepost thuần + BoundaryRepostTests pin 3 tính chất:
keycode/flags giữ nguyên, không magic, cặp down/up cân bằng.

Kèm 2 diagnostic: boundary-key code/rewrote (gated debugLogging) và
boundary-copy posted/skipped để field report lần sau tự kể chuyện.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: ptrinh

App/Sources/TelexInputController.swift

@@ -436,6 +436,7 @@ final class TelexInputController: IMKInputController {
             boundaryCommitInFlight = true
             let rewrote = boundary(client)
             boundaryCommitInFlight = false
+            logDecision("boundary-key code=\(event.keyCode) rewrote=\(rewrote)")
             // When the commit REWROTE the word (gõ tắt "ko"→"không", auto-restore
             // "thooiiii"), web-view editors (WhatsApp) apply that insertText
             // asynchronously — an immediately-delivered Return fires "send" on the

App/Sources/TerminalTap.swift

@@ -1309,22 +1309,51 @@ enum SyntheticKeyboard {
         postVirtual(key)
     }
 
-    /// Re-post a COPY of the user's own boundary keyDown (Return/Tab/Esc) so it
-    /// lands AFTER a synthesized rewrite. Unlike postKey/postVirtual this keeps
-    /// the ORIGINAL event's HID source state: Electron editors (Discord/Slate)
-    /// treat a private-source synthetic Return as "insert newline" instead of
-    /// firing their Enter-to-send handler, but an event that is byte-identical
-    /// to the hardware one triggers the real action. The copy carries no magic
-    /// and no in-flight count on purpose — when it re-enters our tap it must be
-    /// handled as a REAL key (by then the engine is empty and the edit burst has
-    /// drained, so it passes straight through; ordering is by timestamp).
-    /// Only the keyDown is copied: the user's physical keyUp was never
-    /// intercepted and reaches the app on its own.
+    /// Re-post the user's boundary key (Return/Tab/Esc) as a FRESH event so it
+    /// lands AFTER a synthesized rewrite. History of this function:
+    /// - postVirtual (private source) was rejected: Electron editors (Discord/
+    ///   Slate) treat a private-source Return as "insert newline" instead of
+    ///   firing Enter-to-send.
+    /// - `event.copy()` of the real HID event was the replacement — but macOS 26
+    ///   silently DROPS a re-posted copy of a hardware key before app delivery
+    ///   (repro 2026-08-06: copy posted → passes our tap → never reaches IMKit;
+    ///   WhatsApp beeped once, message not sent, shortcut "ko"→"không" needed a
+    ///   second Enter).
+    /// So: build a NEW event from the .hidSystemState source (hardware-like for
+    /// Electron, deliverable on macOS 26), same keycode + flags as the original.
+    /// No magic on purpose — when it re-enters IMKit it is handled as a REAL key;
+    /// by then the engine is empty (boundary() just ran) so it passes straight
+    /// through (`rewrote=false`), no loop. The keyUp is posted too so the app
+    /// never sees a keyDown left logically held (the user's physical keyUp
+    /// precedes our down and cannot pair with it).
     static func postBoundaryCopy(of event: CGEvent) {
-        guard Accessibility.isTrusted else { return }
-        guard let down = event.copy() else { return }
-        stamp(down)
-        down.post(tap: .cgSessionEventTap)
+        guard Accessibility.isTrusted else {
+            DebugLog.log("boundary-copy: SKIPPED (untrusted)")
+            return
+        }
+        let key = CGKeyCode(event.getIntegerValueField(.keyboardEventKeycode))
+        guard let (down, up) = makeBoundaryRepost(key: key, flags: event.flags) else {
+            DebugLog.log("boundary-copy: SKIPPED (create failed)")
+            return
+        }
+        notePostedKeyDown()
+        stamp(down); down.post(tap: .cgSessionEventTap)
+        stamp(up); up.post(tap: .cgSessionEventTap)
+        DebugLog.log("boundary-copy: posted fresh key=\(key)")
+    }
+
+    /// Builds the down/up pair postBoundaryCopy sends. Split out so tests can pin
+    /// the load-bearing properties without posting: .hidSystemState source (NOT the
+    /// private magic source — Electron demotes private-source Return to "newline",
+    /// and magic would make IMKit skip it) and NOT a copy of the hardware event
+    /// (macOS 26 drops re-posted copies before app delivery).
+    static func makeBoundaryRepost(key: CGKeyCode, flags: CGEventFlags) -> (down: CGEvent, up: CGEvent)? {
+        let src = CGEventSource(stateID: .hidSystemState)
+        guard let down = CGEvent(keyboardEventSource: src, virtualKey: key, keyDown: true),
+              let up = CGEvent(keyboardEventSource: src, virtualKey: key, keyDown: false) else { return nil }
+        down.flags = flags
+        up.flags = flags
+        return (down, up)
     }
 
     /// Shift+LeftArrow: extend the selection one char left (used by selectionReplace).

AppTests/BoundaryRepostTests.swift

@@ -0,0 +1,47 @@
+import XCTest
+import CoreGraphics
+@testable import VietTelex
+
+// Shortcut word + Enter (WhatsApp, 2026-08-06): "ko"⏎ expanded to "không" but the
+// message wasn't sent — one beep, second Enter needed. Root cause: postBoundaryCopy
+// re-posted `event.copy()` of the REAL hardware Return, and macOS 26 silently drops
+// a re-posted copy of a HID event before app delivery (it passed our own tap, then
+// vanished — never reached IMKit). The fix posts a FRESH down/up pair instead.
+// These tests pin the properties of that pair that each fix a distinct failure:
+final class BoundaryRepostTests: XCTestCase {
+
+    func testRepostCarriesKeycodeAndFlags() {
+        guard let (down, up) = SyntheticKeyboard.makeBoundaryRepost(key: 36, flags: .maskShift) else {
+            return XCTFail("pair must be constructible")
+        }
+        XCTAssertEqual(down.getIntegerValueField(.keyboardEventKeycode), 36)
+        XCTAssertEqual(up.getIntegerValueField(.keyboardEventKeycode), 36)
+        // Shift+Enter in chat apps means "newline, don't send" — the repost must
+        // preserve that distinction or a shortcut expansion turns it into a send.
+        XCTAssertTrue(down.flags.contains(.maskShift))
+        XCTAssertTrue(up.flags.contains(.maskShift))
+    }
+
+    /// NO magic: IMKit's handle() drops magic events without processing; this Enter
+    /// must re-enter handle() as a REAL key (engine is empty post-boundary, so it
+    /// passes through once — no loop) so the app's Enter action fires.
+    func testRepostCarriesNoMagicStamp() {
+        guard let (down, up) = SyntheticKeyboard.makeBoundaryRepost(key: 36, flags: []) else {
+            return XCTFail("pair must be constructible")
+        }
+        XCTAssertFalse(SyntheticKeyboard.isSyntheticMagic(down),
+                       "magic would make IMKit skip the repost — the Enter action would never fire")
+        XCTAssertFalse(SyntheticKeyboard.isSyntheticMagic(up))
+    }
+
+    /// A keyUp must exist: the user's physical keyUp precedes our posted keyDown,
+    /// so without our own up the key stays logically held (key-repeat / stuck-key
+    /// semantics in apps that track key state).
+    func testRepostIsABalancedPair() {
+        guard let (down, up) = SyntheticKeyboard.makeBoundaryRepost(key: 48, flags: []) else {
+            return XCTFail("pair must be constructible")
+        }
+        XCTAssertEqual(down.type, .keyDown)
+        XCTAssertEqual(up.type, .keyUp)
+    }
+}