@openrig/cli 0.6.11 → 0.6.13

package/daemon/dist/domain/session-transport.js

@@ -1,15 +1,22 @@
+import { currentClaudeMcpMenu } from "./claude-mcp-menu.js";
+import stringWidth from "string-width";
 import { CODEX_TURN_STATUS_PATTERN } from "./codex-pane-patterns.js";
 import { randomUUID } from "node:crypto";
-import { inspectStartupStagedText, startupSubmissionEvidence } from "./startup-submission-evidence.js";
+import { COLLAPSED_PASTE, composerRegion, isComposerFooter, inspectStartupStagedText, QUEUED_PLACEHOLDER, startupSubmissionEvidence } from "./startup-submission-evidence.js";
+import { composerContainsOwnedText, composerNumberedChoicePattern, composerPromptClassForRuntime, composerPromptIsAmbiguous, composerSelectionPrefixPattern, COMPOSER_DRAFT_PATTERN, COMPOSER_EMPTY_CODEX_PLACEHOLDER_PATTERN as CODEX_EMPTY_COMPOSER_PATTERN, COMPOSER_EMPTY_PATTERN, COMPOSER_PROMPT_CLASS, COMPOSER_SELECTION_PATTERN, COMPOSER_SELECTION_SCAN_PATTERN, findComposerInputLineIndex, stripComposerPromptGlyph, readComposerPromptLine, COMPOSER_COLLAPSED_PASTE_PATTERN, } from "./composer-prompts.js";
 export { inspectStartupStagedText } from "./startup-submission-evidence.js";
 import { OutboxHandler } from "./outbox-handler.js";
+import { DraftAwareDelivery } from "./draft-aware-delivery.js";
 import { claudeResumeRotation } from "./session-registry.js";
-import { latestHookWaitsOnPerson } from "./agent-activity-store.js";
+import { latestHookPermissionPending, latestHookWaitsOnPerson } from "./agent-activity-store.js";
+import { DeliveryGuardError } from "./seat-delivery-guard.js";
 import { wrapPaneEnvelope, appendDeliveredSegment } from "../lib/pane-envelope.js";
 import { SeatIdentityStore } from "./seat-identity-store.js";
 import { isShellForeground } from "./shell-classifier.js";
 import { observeClaudeDelivery, verifyCodexPaneProcess } from "./native-process-lineage.js";
 import { hashSentText } from "./capture-observer.js";
+import { isAttentionRequiredReadinessCode } from "./runtime-adapter.js";
+import { getLatestStartupFailedEvent, hasClaudeResumeIdentityWork, isRecoverableStartupFailure } from "./startup-orchestrator.js";
 // OPR.0.4.1.10 — send-readiness freshness. The runtime-hook store keeps a 5min freshness for activity
 // DISPLAY, but "safe to send NOW" needs a tight window: a stale "idle" read must not authorize a send
 // into what may since have become a prompt. Beyond this window the hook is ignored for send-readiness
@@ -20,13 +27,18 @@ import { hashSentText } from "./capture-observer.js";
 // window comfortably spans one inter-tool gap (so a mid-turn reading stays trusted) while refusing to
 // authorize a send from a reading tens of seconds old. (EXA: agtx#14, daintree#3938.)
 const SEND_READINESS_FRESHNESS_MS = 15_000;
+// transport.verify_input_box: each extra input-box read gives up after this long and reads `unavailable`. A deadline
+// budget, not a guarantee: the pre-Enter read comes after the existing 200 ms wait and can add about this much before
+// Enter, and the post-Enter process read about this much before the reply. A read that misses it leaves the send
+// unconfirmed, and Enter is still sent once.
+const INPUT_BOX_READ_DEADLINE_MS = 500;
 // Mid-work detection patterns (cheap heuristics)
 const MID_WORK_PATTERNS = [
     /[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏]/, // spinner chars
     /Working/,
     /^[✶✢✳✻✽·]\s+\S.*(?:…|\.{3})\s+\([^)]*\bthinking\)$/m,
     /esc to interrupt/,
-    /^[❯›]\s*\d+\.\s/m, // trust/consent prompt choices (e.g. '› 1. Yes, continue')
+    COMPOSER_SELECTION_SCAN_PATTERN, // trust/consent prompt choices (e.g. '› 1. Yes, continue')
 ];
 // Idle-prompt patterns: empty prompt line (no typed text after the char).
 // Lines like '❯ Working on a task.' have text after the prompt char and
@@ -37,13 +49,12 @@ const MID_WORK_PATTERNS = [
 // normally sits above it, but Codex hides that row while it streams assistant output. So the
 // placeholder counts as idle only through MID_WORK_PATTERNS here, and classifySendReadiness
 // never lets a placeholder-only verdict override a display-fresh running/needs_input hook.
-const CODEX_EMPTY_COMPOSER_PATTERN = /^›\s+Ask Codex to do anything\s*$/;
 const IDLE_PROMPT_PATTERNS = [
-    /^[❯›]\s*$/, // prompt char + optional whitespace + end-of-line only
+    COMPOSER_EMPTY_PATTERN, // prompt char + optional whitespace + end-of-line only
     CODEX_EMPTY_COMPOSER_PATTERN,
 ];
 const PROMPT_DRAFT_PATTERNS = [
-    /^[❯›]\s+\S/,
+    COMPOSER_DRAFT_PATTERN,
 ];
 // Claude's permission-mode footers: default, accept edits, bypass, auto and plan, optionally after a
 // vim-mode marker such as "-- INSERT --" (#808). A suffix such as "· 1 shell" can follow the mode.
@@ -133,15 +144,20 @@ const CLAUDE_LIVE_STATUS_PATTERN = /^[✶✢✳✻✽·*]\s+\S[^(]*(?:…|\.{3})
 // ("✻ Crunched for 2s") have no trailing ellipsis. Only callers that must not send into a busy
 // pane opt in (ClassifyPaneOptions.timerlessStatusIsLive); ordinary send readiness is unchanged.
 const CLAUDE_TIMERLESS_STATUS_PATTERN = /^[✶✢✳✻✽·*]\s+\S.*(?:…|\.{3})$/;
+/** The current Claude footer follows the input frame; earlier examples are history or draft text. */
+function findClaudeFooterIndex(lines) {
+    let bar = lines.length - 1;
+    while (bar >= 0 && (!lines[bar].trim() || CLAUDE_STATUS_WARNINGS.some(pattern => pattern.test(lines[bar].trim()))))
+        bar--;
+    return bar;
+}
 function findClaudeComposer(paneContent, options = {}) {
     // Preserve columns: a multiline draft may contain indented border/prompt text.
     // This classifier scans at most 20 physical lines; captures can be taller.
     // Exhausting the scan without reaching the status head is unknown, not idle.
     const lines = paneContent.split("\n").slice(-20)
         .map((line) => line.trimEnd()).filter((line) => line.trim().length > 0);
-    let bar = lines.length - 1;
-    while (bar >= 0 && CLAUDE_STATUS_WARNINGS.some((pattern) => pattern.test(lines[bar].trim())))
-        bar--;
+    const bar = findClaudeFooterIndex(lines);
     const supportedWarningFooter = lines[bar]?.trim() === "⏵⏵ accept edits on (shift+tab to cycle) · ← for agents";
     const modeFooter = CLAUDE_MODE_FOOTER.test(lines[bar]?.trim() ?? "");
     let indent = /^([ \t]*)─{3,}$/.exec(lines[bar - 1] ?? "")?.[1];
@@ -154,7 +170,8 @@ function findClaudeComposer(paneContent, options = {}) {
         if (bar < 2 || !CLAUDE_ANCHORED_MODE_FOOTER.test(lines[bar].trim()))
             return null;
         prompt = lines[bar - 1] ?? "";
-        indent = /^([ \t]*)❯\s*$/.exec(prompt)?.[1];
+        const input = readComposerPromptLine(prompt, composerPromptClassForRuntime("claude-code"));
+        indent = input && !input.text.trim() ? input.indent : undefined;
         if (indent === undefined)
             return null;
         statusStart = bar - 2;
@@ -162,7 +179,7 @@ function findClaudeComposer(paneContent, options = {}) {
     else {
         const upper = lines[bar - 3] ?? "";
         if (!upper.startsWith(indent) || !/^─{3,}(?: .+ ─+)?$/.test(upper.slice(indent.length)) ||
-            !prompt.startsWith(`${indent}❯`) || !/^❯(?:\s|$)/.test(prompt.slice(indent.length)))
+            !prompt.startsWith(`${indent}❯`) || !readComposerPromptLine(prompt, composerPromptClassForRuntime("claude-code")))
             return null;
     }
     let liveStatus = null;
@@ -188,6 +205,163 @@ function findClaudeComposer(paneContent, options = {}) {
     }
     return { text: prompt.slice(indent.length), bar: lines[bar].trim(), framed, hasWarnings: bar < lines.length - 1, supportedWarningFooter, modeFooter, headSeen, liveStatus };
 }
+const unknown = () => ({ state: "unknown", rows: [], columns: 0, cursorAtEnd: false, collapsedPaste: null });
+const rule = (line) => /^[─━═-]{6,}(?: .+ [─━═-]+)?$/.test(line.trim());
+const codexFooter = (line) => isComposerFooter(line)
+    || /(?:\b\d+% context left\b|\bContext \[)/.test(line);
+/** Preserve faint styling so autocomplete ghosts can be separated from authored
+ * text. Color channel values must never be interpreted as style codes. */
+function styledTextLines(screen) {
+    let faint = false;
+    return screen.replace(/\r\n/g, "\n").split("\n").map(raw => {
+        let text = "", offset = 0;
+        const faintCells = [];
+        const append = (value) => { text += value; faintCells.push(...Array(value.length).fill(faint)); };
+        for (const match of raw.matchAll(/\x1b\[([0-9;:]*)m/g)) {
+            append(raw.slice(offset, match.index));
+            const codes = match[1].split(";");
+            for (let i = 0; i < codes.length; i++) {
+                const code = codes[i];
+                if (/^(?:38|48|58):/.test(code))
+                    continue; // Colon-form color is one parameter.
+                if (code === "38" || code === "48" || code === "58") {
+                    const skip = codes[i + 1] === "5" ? 2 : codes[i + 1] === "2" ? (codes[i + 2] === "" ? 5 : 4) : 0;
+                    // Color channels are not style codes. Ambiguous compound sequences
+                    // provide no faint-style proof, rather than interpreting an RGB 2 as dim.
+                    if (!skip || i + skip !== codes.length - 1) {
+                        faint = false;
+                        break;
+                    }
+                    i += skip;
+                }
+                else if (code === "" || code === "0" || code === "22")
+                    faint = false;
+                else if (code === "2")
+                    faint = true;
+            }
+            offset = match.index + match[0].length;
+        }
+        append(raw.slice(offset));
+        return { text, faintCells };
+    });
+}
+/** Inspect only the visible input containing the current cursor. Activity, hook
+ * freshness and text elsewhere in the pane are not evidence that input is empty.
+ */
+export function inspectComposerInput(snapshot, runtime = null, owned) {
+    const promptClass = composerPromptClassForRuntime(runtime);
+    if (!snapshot || snapshot.inMode)
+        return unknown();
+    const { x, y, width, height } = snapshot.cursor;
+    if (![x, y, width, height].every(Number.isInteger) || x < 0 || y < 0 || x >= width || y >= height || width < 3 || height < 1)
+        return unknown();
+    const styled = styledTextLines(snapshot.screen);
+    const lines = styled.map(line => line.text);
+    if (lines.at(-1) === "")
+        lines.pop();
+    if (lines.length > height || !lines[y])
+        return unknown();
+    const footerAt = findClaudeFooterIndex(lines);
+    const footer = lines[footerAt]?.trim() ?? "";
+    let claudeEnd = footerAt - 1;
+    while (claudeEnd >= 0 && !lines[claudeEnd].trim())
+        claudeEnd--;
+    const candidates = [];
+    for (let start = 0; start <= y; start++) {
+        const prompt = readComposerPromptLine(lines[start] ?? "", promptClass);
+        if (!prompt || !/^ *$/.test(prompt.indent))
+            continue;
+        const numbered = composerSelectionPrefixPattern(promptClass).test(lines[start].trimStart()) || /^\d+[.)]\s/.test(prompt.text);
+        const prefix = prompt.prefix;
+        let end = -1;
+        if (prompt.glyph === "❯") {
+            // Share the main reader's terminal footer anchor. A quoted frame within a
+            // multiline draft cannot supply either the closing rule or its indentation.
+            const alignedRule = (line) => rule(line) && line.length - line.trimStart().length === prompt.indent.length;
+            if ((!isComposerFooter(footer) && !CLAUDE_MODE_FOOTER.test(footer))
+                || !alignedRule(lines[start - 1] ?? "") || !alignedRule(lines[claudeEnd] ?? ""))
+                continue;
+            end = claudeEnd;
+        }
+        else {
+            for (let i = start + 1; i < lines.length; i++) {
+                if (lines[i].trim())
+                    continue;
+                const tail = lines.slice(i + 1).filter(line => line.trim());
+                if (lines[i + 1]?.trim() && tail.length === 1 && codexFooter(tail[0].trim())) {
+                    end = i;
+                    break;
+                }
+            }
+        }
+        if (end <= y || x < prefix)
+            continue;
+        const rows = [prompt.text];
+        let valid = true;
+        for (let i = start + 1; i < end; i++) {
+            const line = lines[i];
+            if (line.trim() && !line.startsWith(" ".repeat(prefix))) {
+                valid = false;
+                break;
+            }
+            rows.push(line.slice(prefix));
+        }
+        if (!valid)
+            continue;
+        // A suggestion is a wholly dim suffix beginning at the current cursor.
+        // A literal placeholder or text before a moved cursor remains authored input.
+        const cursorRow = y - start;
+        let ghost;
+        const currentRow = rows[cursorRow];
+        let cursorOffset = x === prefix ? 0 : -1;
+        let offset = 0;
+        for (const character of currentRow) {
+            offset += character.length;
+            if (stringWidth(currentRow.slice(0, offset)) === x - prefix)
+                cursorOffset = offset;
+        }
+        if (cursorOffset >= 0) {
+            const suffix = rows.slice(cursorRow).map((row, i) => ({
+                text: row.slice(i === 0 ? cursorOffset : 0),
+                faint: styled[y + i].faintCells.slice(prefix + (i === 0 ? cursorOffset : 0), prefix + row.length),
+            }));
+            if (suffix.some(row => row.text.length > 0) && suffix.every(row => row.faint.every(Boolean))) {
+                ghost = { line: y, offset: prefix + cursorOffset, continuationRows: rows.length - cursorRow - 1 };
+                rows.splice(cursorRow + 1);
+                rows[cursorRow] = currentRow.slice(0, cursorOffset);
+            }
+        }
+        const visible = rows.map(line => line.trimEnd());
+        // The cursor bounds authored whitespace on the last input row. Captures may
+        // omit trailing blank cells or include screen padding; neither changes the bytes to submit.
+        if (cursorRow === rows.length - 1) {
+            const cellWidth = stringWidth(rows[cursorRow]);
+            if (x - prefix >= cellWidth)
+                visible[cursorRow] = rows[cursorRow] + " ".repeat(x - prefix - cellWidth);
+            else if (cursorOffset >= 0 && !rows[cursorRow].slice(cursorOffset).trim())
+                visible[cursorRow] = rows[cursorRow].slice(0, cursorOffset);
+        }
+        const atStart = y === start && x === prefix;
+        const empty = atStart && rows.length === 1 && rows[0] === "";
+        const last = visible.length - 1;
+        const cursorAtEnd = y === start + last && x === prefix + stringWidth(visible[last] ?? "");
+        const label = visible.length === 1 && COMPOSER_COLLAPSED_PASTE_PATTERN.test(visible[0]) ? visible[0] : null;
+        const frame = JSON.stringify([prompt.glyph, prefix, width, footer]);
+        const input = { state: empty ? "empty" : "text", rows: visible, columns: width - prefix, cursorAtEnd, collapsedPaste: label, frame,
+            ...(ghost ? { ghost } : {}) };
+        // A numbered body is allowed only as this operation's exact text in its
+        // previously empty composer. A newly observed menu gains no such authority.
+        if (numbered && !(owned?.frame === frame && composerContainsOwnedText(input, owned.text)))
+            continue;
+        if (owned?.frame === frame && cursorAtEnd && visible.join("\n").includes("[Pasted text #")
+            && hasExpectedStagedText(`${prompt.glyph} ${visible.join("\n")}`, owned.text, runtime)) {
+            input.collapsedPaste = visible.join("\n");
+            input.pasteMatchesExpected = true;
+        }
+        candidates.push(input);
+    }
+    return candidates.length === 1 ? candidates[0] : unknown();
+}
 function findPromptDraftBeforeFooter(paneContent) {
     const rawLines = paneContent.split("\n").map((line) => line.trimEnd());
     let lastLineIndex = rawLines.length - 1;
@@ -204,8 +378,9 @@ function findPromptDraftBeforeFooter(paneContent) {
     if (priorLine.trim().length === 0)
         return null;
     const priorTrimmed = priorLine.trim();
-    const looksLikeDraft = PROMPT_DRAFT_PATTERNS.some((pattern) => pattern.test(priorTrimmed));
-    const looksLikeSelection = /^[❯›]\s*\d+\.\s/.test(priorTrimmed);
+    const prompt = readComposerPromptLine(priorLine);
+    const looksLikeDraft = prompt !== null && prompt.text.trim().length > 0;
+    const looksLikeSelection = COMPOSER_SELECTION_PATTERN.test(priorTrimmed);
     if (!looksLikeDraft || looksLikeSelection)
         return null;
     return truncateEvidence(priorTrimmed);
@@ -282,7 +457,25 @@ function draftComposerLine(lines, verdict) {
         return null;
     return lines[last].trim();
 }
+/** A community harness's screen never proves it's idle: a quiet prompt can be an approval or a pause, so its idle
+ *  reading becomes unknown. Positive work and attention are kept. `communityHarness` is the seat's recorded selection
+ *  (`communityHarnessOf`); without it the classification is returned as it is. */
+export function communityHarnessPaneActivity(classification, communityHarness) {
+    return communityHarness && classification.state === "agent_idle"
+        ? { state: "unknown", reason: "community_harness_no_idle_signal", evidence: classification.evidence }
+        : classification;
+}
 export function classifyPaneActivity(paneContent, options = {}) {
+    if (options.composerSnapshot) {
+        const snapshot = options.composerSnapshot;
+        const { ghost } = inspectComposerInput(snapshot, options.runtime);
+        const lines = styledTextLines(snapshot.screen).map(line => line.text);
+        if (ghost) {
+            lines[ghost.line] = lines[ghost.line].slice(0, ghost.offset);
+            lines.splice(ghost.line + 1, ghost.continuationRows);
+        }
+        paneContent = lines.join("\n");
+    }
     const lastNonBlank = trimPaneLines(paneContent);
     if (lastNonBlank.length === 0) {
         return { state: "unknown", reason: "empty_capture", evidence: null };
@@ -299,15 +492,18 @@ export function classifyPaneActivity(paneContent, options = {}) {
         : null;
     const claudeComposer = findClaudeComposer(paneContent, options);
     const oldQuestionEnd = promptScanLines.lastIndexOf(CLAUDE_QUESTION_FOOTER);
+    const permissionPromptEvidence = findPatternEvidence(promptScanLines, PERMISSION_PROMPT_PATTERNS);
     // A complete later empty composer with a recognized Claude bar makes the preceding question history.
     // Keep draft handling and selectors without this dialog boundary unchanged.
     const selectionLines = claudeComposer?.framed &&
         CLAUDE_ANCHORED_MODE_FOOTER.test(claudeComposer.bar) &&
         IDLE_PROMPT_PATTERNS.some(pattern => pattern.test(claudeComposer.text)) &&
         oldQuestionEnd >= 0 && oldQuestionEnd < promptScanLines.length - 1
-        ? promptScanLines.slice(oldQuestionEnd + 1) : promptScanLines;
-    const selectionPromptEvidence = findCurrentClaudeQuestion(paneContent) ??
-        findPatternEvidence(selectionLines, [/^[❯›]\s*\d+\.\s/m]);
+        ? promptScanLines.slice(oldQuestionEnd + 1)
+        : options.runtime === "codex" && !permissionPromptEvidence
+            ? codexCurrentSelectionLines(paneContent) ?? promptScanLines : promptScanLines;
+    const selectionPromptEvidence = currentClaudeMcpMenu(paneContent) ?? findCurrentClaudeQuestion(paneContent) ??
+        findPatternEvidence(selectionLines, [COMPOSER_SELECTION_SCAN_PATTERN]);
     if (selectionPromptEvidence) {
         return {
             state: "attention",
@@ -318,7 +514,6 @@ export function classifyPaneActivity(paneContent, options = {}) {
     // OPR.0.4.1.10 (FR-1c): a permission/confirmation question is attention even when its selector is
     // not in view — checked before the idle short-circuits so a permission block above an idle-looking
     // footer never reads as idle (which would let a default send land on it).
-    const permissionPromptEvidence = findPatternEvidence(promptScanLines, PERMISSION_PROMPT_PATTERNS);
     if (permissionPromptEvidence) {
         return {
             state: "attention",
@@ -514,10 +709,12 @@ export async function probeSessionActivity(input) {
     };
     const captureSeq = observed ? nextCaptureSeq++ : 0;
     try {
-        const paneContent = await tmuxAdapter.capturePaneContent(sessionName, 20);
+        const snapshot = input.composerSnapshot ? await input.composerSnapshot().catch(() => null) : null;
+        const paneContent = snapshot?.screen ?? await tmuxAdapter.capturePaneContent(sessionName, 20);
         const capturedAt = new Date().toISOString();
         const classifyOptions = { timerlessStatusIsLive: input.timerlessStatusIsLive === true };
-        let classification = classifyPaneActivity(paneContent ?? "", classifyOptions);
+        let classification = communityHarnessPaneActivity(classifyPaneActivity(paneContent ?? "", { ...classifyOptions,
+            composerSnapshot: snapshot ?? undefined, runtime }), input.communityHarness);
         // Claude renders its prompt suggestion faint, which the plain capture loses. When a Claude pane reads
         // as a draft, one capture with styling is classified on its own. Newer attention or work there is
         // kept. A faint suggestion counts only when it's the same composer text this capture read as a draft;
@@ -625,7 +822,9 @@ function verificationSnippet(text) {
 /** Count whole visible envelope blocks, not prefixes of longer messages.
  * A new envelope, prompt or same-column output ends an indented user block.
  * Whitespace is compared only after retaining boundaries and quote indentation. */
-function countEnvelopeOccurrences(transcript, expected) {
+function countEnvelopeOccurrences(transcript, expected, promptClass) {
+    const promptPrefix = new RegExp(`^[${promptClass}]\\s+`);
+    const promptBoundary = new RegExp(`^[${promptClass}](?:\\s|$)`);
     const lines = transcript.split("\n");
     let count = 0;
     let block = null;
@@ -640,8 +839,8 @@ function countEnvelopeOccurrences(transcript, expected) {
     for (let i = 0; i < lines.length; i++) {
         const line = lines[i];
         const indent = /^[ \t]*/.exec(line)[0].length;
-        const prompted = /^[❯›]\s+/.test(line.slice(indent));
-        const header = line.slice(indent).replace(/^[❯›]\s+/, "");
+        const prompted = promptPrefix.test(line.slice(indent));
+        const header = line.slice(indent).replace(promptPrefix, "");
         const atBoundary = (!block && !inAgentOutput) || indent <= blockIndent;
         const candidate = normalizeVerificationText([header, ...lines.slice(i + 1, i + 5)].join("\n"));
         const envelopeHeader = /^From: [^\n]+\nTo: [^\n]+\n(?:Sent: [^\n]+\n)?---\n/.test(candidate);
@@ -660,7 +859,7 @@ function countEnvelopeOccurrences(transcript, expected) {
             finish();
             inAgentOutput = true;
         }
-        else if (atBoundary && /^[❯›](?:\s|$)/.test(line.slice(indent))) {
+        else if (atBoundary && promptBoundary.test(line.slice(indent))) {
             finish();
         }
         else if (block) {
@@ -673,15 +872,16 @@ function countEnvelopeOccurrences(transcript, expected) {
 /** The last prompt marker owns the current input region. Never count it or its
  * continuation lines as submitted transcript, in either capture. If a capture
  * ends at a historical prompt with no later input marker, leave it unconfirmed. */
-function verificationTranscript(content) {
+function verificationTranscript(content, promptClass) {
+    const indentedPrompt = new RegExp(`^([ \\t]*)[${promptClass}]`);
     const lines = (content ?? "").replace(/\r\n/g, "\n").split("\n");
-    let inputAt = lastPromptLine(lines);
+    let inputAt = findComposerInputLineIndex(lines, promptClass);
     if (inputAt >= 0) {
         let indent = /^[ \t]*/.exec(lines[inputAt])[0].length;
         // Claude indents draft continuation lines. A quoted prompt on one of them
         // belongs to the enclosing input, not a new transcript/composer boundary.
         for (let i = inputAt - 1; i >= 0; i--) {
-            const prompt = /^([ \t]*)[❯›]/.exec(lines[i]);
+            const prompt = indentedPrompt.exec(lines[i]);
             if (prompt && prompt[1].length < indent) {
                 inputAt = i;
                 indent = prompt[1].length;
@@ -715,33 +915,36 @@ export function scopeForTarget(target, recipients) {
 }
 /** The existing submit-only identity check, also used to inspect startup's own paste.
  * A false result is no matching staged evidence, not proof of model consumption. */
-export function hasExpectedStagedText(pane, expected) {
+export function hasExpectedStagedText(pane, expected, runtime = null) {
     const norm = (s) => s.replace(/\s+/g, "");
+    // The composer glyph set is scoped to the runtime when known: a Claude draft's
+    // continuation line can start with a Codex glyph, and taking that line as the
+    // input marker would misread the staged text. Unknown runtimes keep the union.
+    const promptClass = composerPromptClassForRuntime(runtime);
     // Round-2 (r2 HIGH-1): the evidence must be the CURRENT ACTIVE INPUT and must identify
     // THIS piece — stale scrollback can carry an old placeholder while a LATER interactive
     // prompt owns the input, and an Enter there approves the prompt. So:
     //   1. Only the pane's LAST input-marker line counts (the current input; everything above
     //      is history).
-    //   2. A numbered-option line (`❯ 1. …`) is a PROMPT SELECTION, never staged input: refuse.
+    //   2. A numbered-option line (`❯ 1. …`, `› 1.Yes`) is a PROMPT SELECTION, never staged
+    //      input: refuse.
     //   3. A pasted-text placeholder is identity-qualified: "[Pasted text #N +X lines]" counts
     //      only when X matches the expected piece's own line count (±1 for a trailing newline).
     //      More than one placeholder is COALESCED staging (several pieces, one Enter): refuse.
     //   4. Otherwise the line must carry the content's own head (24 normalized chars — a short
     //      paste renders inline, possibly truncated).
     const paneLines = (pane ?? "").split("\n");
-    let currentInputAt = -1;
-    for (let i = paneLines.length - 1; i >= 0; i--) {
-        if (paneLines[i].trimStart().startsWith("❯")) {
-            currentInputAt = i;
-            break;
-        }
-    }
+    const currentInputAt = findComposerInputLineIndex(paneLines, promptClass);
     let stagedEvidence = false;
     if (currentInputAt >= 0) {
+        // Unknown runtime: a composer block that mixes glyph kinds has no runtime to
+        // say which line is live, so fail closed exactly as the pre-union check did.
+        if (composerPromptIsAmbiguous(paneLines, currentInputAt, promptClass))
+            return false;
         const inputLine = paneLines[currentInputAt].trimStart();
-        // The region is the last ❯-line through the input box's closing separator (a box-drawing
-        // line) or pane end — wrapped input continues below the marker; everything ABOVE the
-        // marker is history and everything below the separator is hint-bar chrome.
+        // The region is the last composer-marker line through the input box's closing separator
+        // (a box-drawing line) or pane end — wrapped input continues below the marker; everything
+        // ABOVE the marker is history and everything below the separator is hint-bar chrome.
         let regionEnd = paneLines.length;
         for (let i = currentInputAt + 1; i < paneLines.length; i++) {
             const t = paneLines[i].trim();
@@ -751,7 +954,7 @@ export function hasExpectedStagedText(pane, expected) {
             }
         }
         const region = paneLines.slice(currentInputAt, regionEnd).join("\n");
-        if (!/^❯\s*\d+\./.test(inputLine)) {
+        if (!composerSelectionPrefixPattern(promptClass).test(inputLine)) {
             // Round-3 (r2 R2 HIGH-1, specimen-pinned): Claude renders ONE staged piece as MANY
             // placeholders whose displayed counts are SEGMENT sizes (sum ≤ source lines), followed
             // by the piece's own literal tail wrapped across pane lines — and the placeholder
@@ -777,7 +980,7 @@ export function hasExpectedStagedText(pane, expected) {
                 // or one that is not the piece's own suffix, FAIL CLOSED — the TUI did not expose
                 // enough content to identify the staged state, and a bare Enter is never guessed.
                 const chrome = /paste again to expand|ctrl\+g to edit( in Vim)?/gi;
-                const residual = norm(regionFlat.replace(placeholderRe, "").replace(chrome, "")).replace(/^❯/, "");
+                const residual = stripComposerPromptGlyph(norm(regionFlat.replace(placeholderRe, "").replace(chrome, "")), promptClass);
                 const pieceNorm = norm(expected);
                 const sum = counts.reduce((a, b) => a + b, 0);
                 // Round-5 (r2 R4 HIGH-1): the suffix anchor is JOINED to the opaque prefix. The
@@ -814,23 +1017,490 @@ export function hasExpectedStagedText(pane, expected) {
 function promptAnswerStaged(pane, answer, runtime) {
     if (!pane || !answer.trim() || /[\r\n\x1b]/.test(answer))
         return false;
+    // Fail closed for an unknown runtime: with no scoped glyph set there is no way to
+    // say which prompt line is the live input (the pre-shared-matcher check did the same).
+    if (runtime !== "codex" && runtime !== "claude-code")
+        return false;
+    const promptClass = composerPromptClassForRuntime(runtime);
     const lines = pane.split("\n");
-    for (let i = lines.length - 1; i >= 0; i--) {
-        const input = lines[i].trimStart();
-        if (!/^[❯›]/.test(input))
-            continue;
-        if (/^[❯›]\s*\d+[.)]/.test(input))
-            return false;
-        if (runtime === "codex" ? !input.startsWith("›") : runtime !== "claude-code" || !input.startsWith("❯"))
-            return false;
-        const end = lines.findIndex((line, index) => index > i && (runtime === "codex"
-            ? line.trim() === "" : /^[─═-]{10,}$/.test(line.trim())));
-        return end > i && lines.slice(i, end).join("\n").trimStart().slice(1).trim() === answer.trim();
+    // Only the LAST prompt line of this runtime's glyph set can be the current input;
+    // everything above it is transcript history, and another harness's glyph is not ours.
+    const inputIndex = findComposerInputLineIndex(lines, promptClass);
+    if (inputIndex < 0)
+        return false;
+    const input = lines[inputIndex].trimStart();
+    // A numbered choice (`.` or `)`), e.g. `» 1)` or `❯ 1.`, is a menu selection, never the answer.
+    if (composerNumberedChoicePattern(promptClass).test(input))
+        return false;
+    // Where the input ends: Codex closes the composer on a blank line, Claude Code on a rule line.
+    const end = lines.findIndex((line, index) => index > inputIndex && (runtime === "codex"
+        ? line.trim() === "" : /^[─═-]{10,}$/.test(line.trim())));
+    return end > inputIndex && lines.slice(inputIndex, end).join("\n").trimStart().slice(1).trim() === answer.trim();
+}
+// Codex 0.160 input box: the last prompt line plus indented continuation rows, one blank row, then a footer
+// of at most two rows: the `<model> · <~ or /path>` status line, optionally followed by one known hint row.
+const CODEX_STATUS_LINE = /^ {2}[^\s·][^·]* · [~/]/;
+const CODEX_HINT_ROW = /(?:^|\s)\? for shortcuts(?:\s|$)|⚠ \d+ warnings? · f2 to view\s*$/;
+// Codex shows a long paste as this label until it is submitted. Matched on the normalized body.
+const CODEX_COLLAPSED_PASTE = /^\[PastedContent\d+chars\]$/;
+/** The current Codex input box: its normalized text ("" when empty), its rows as drawn (the prompt glyph removed)
+ *  and where its prompt row is, or null when the layout is not the recognized one (another footer, a selector, no
+ *  blank separator, an older TUI). */
+function codexInputBox(pane) {
+    const lines = pane.split("\n");
+    let last = lines.length - 1;
+    while (last >= 0 && !lines[last].trim())
+        last--;
+    let footerStart = last;
+    while (footerStart > 0 && lines[footerStart - 1].trim())
+        footerStart--;
+    const footer = lines.slice(footerStart, last + 1);
+    if (last < 0 || footer.length > 2 || !CODEX_STATUS_LINE.test(footer[0])
+        || !footer.slice(1).every((row) => CODEX_HINT_ROW.test(row)))
+        return null;
+    // promptAnswerStaged also ends a Codex input at a blank row.
+    const separator = footerStart - 1;
+    if (separator < 1 || lines[separator].trim())
+        return null;
+    const promptClass = composerPromptClassForRuntime("codex");
+    const inputAt = findComposerInputLineIndex(lines.slice(0, separator), promptClass);
+    if (inputAt < 0 || composerNumberedChoicePattern(promptClass).test(lines[inputAt].trimStart()))
+        return null;
+    const rows = lines.slice(inputAt, separator);
+    // Only indented continuation rows belong to the input; anything else is not an input box.
+    if (rows.slice(1).some((row) => row.trim() && !/^\s/.test(row)))
+        return null;
+    if (CODEX_EMPTY_COMPOSER_PATTERN.test(rows[0].trimStart()) && rows.slice(1).every((row) => !row.trim())) {
+        return { text: "", rows: [], lines, inputAt };
     }
-    return false;
+    return { text: rows.join("\n").trimStart().slice(1).replace(/\s+/g, ""), rows: stripBoxGlyph(rows), lines, inputAt };
+}
+/** A box's rows with the prompt glyph taken off the first row (`❯`, `›`), as composerRegion does for its body. */
+function stripBoxGlyph(rows) {
+    return rows.map((row, i) => (i === 0 ? row.trimStart().slice(1) : row));
+}
+// Bounds of a string's terminal width. Upper: a non-ASCII character may take two cells. Lower: a printable ASCII
+// character takes exactly one cell, and any other character is counted as none (a combining mark, a variation
+// selector or a joiner takes none, and an emoji sequence of several code points takes two cells in all).
+const widthAtMost = (text) => [...text].reduce((cells, ch) => cells + (ch.charCodeAt(0) < 0x80 ? 1 : 2), 0);
+const widthAtLeast = (text) => [...text].filter((ch) => ch >= " " && ch <= "~").length;
+// Pairs of characters that no wrapper separates across rows inside a word that fits in a row, under the conditions
+// rowBreakIsSpace adds. Claude Code 2.1.296 wraps its input with wrap-ansi, which breaks only at spaces. Codex 0.160.0
+// wraps it with textwrap's FirstFit, its UAX #14 word separator and its hyphen splitter, then re-passes the rows
+// (tui/src/bottom_pane/textarea/wrapping.rs at rust-v0.160.0), which also break with no space drawn after a hyphen
+// or a slash, between ideographs and at other UAX #14 break opportunities. UAX #14 has none between two ASCII
+// letters or digits (LB23, LB25, LB28), nor between a printable ASCII character and a following hyphen, slash,
+// closing bracket or `.,:;!?` (LB13, LB15d, LB21).
+const ASCII_LETTER_OR_DIGIT = /^[A-Za-z0-9]$/;
+const ASCII_VISIBLE = /^[!-~]$/;
+const ASCII_NO_BREAK_BEFORE = /^[-/.,:;!?)\]}]$/;
+// A word of ASCII letters, digits, `'` and `.,:;`, which has no UAX #14 break opportunity inside it (LB13, LB19, LB23,
+// LB25, LB28, LB29): Codex's re-pass keeps such a word whole when it starts on a row that already holds text.
+const ASCII_UNBROKEN_WORD = /^[A-Za-z0-9'.,:;]+$/;
+/** Whether the break between two drawn rows of a box must be whitespace of the box's text, given a lower bound of
+ *  the box's width. Rows are measured as drawn, the box's own indentation included (an upper bound of their width);
+ *  words are split at ASCII spaces only, which neither TUI breaks inside a word. `ownIndent` is how many cells of
+ *  `row` the box draws itself (1 after the prompt glyph, 2 on a continuation row). Either:
+ *  - the next row's first word would have fit on this row after a space: both wrappers fill a row first
+ *    (wrap-ansi and FirstFit are greedy), so where the rows follow the wrapper's own lines the box breaks its rows
+ *    there only at a line break of its text. Residual (review-safety-3 F1, from a model of the rust-v0.160.0 source,
+ *    not a live capture): on Codex, once a row holding only indentation has absorbed and split a word (below), the
+ *    re-pass can push a later row early at a hyphen, since its keep-whole check measures a hyphenated compound as one
+ *    word, so a short row can be followed by a fragment that would have fit with no whitespace between them, and this
+ *    rule counts that break as a space. Every such box in that model also holds the earlier absorbed split, which
+ *    only this rule reads and which it rejects (the row is full), so the box reads `ambiguous`, never `exact`. That
+ *    relies on the row-start check below, which the tests pin; or
+ *  - no wrapper breaks between the two characters (ASCII_NO_BREAK_BEFORE above), the two words they end and begin,
+ *    joined, fit in a row, the row's last word has no break opportunity inside it (ASCII_UNBROKEN_WORD), and the
+ *    row's text starts at its first cell with a printable ASCII character. Codex 0.160.0 keeps a word that fits in a
+ *    row whole only where the word starts on a row that already holds text, after whitespace or at one of textwrap's
+ *    breaks: a row holding only indentation absorbs the next word and splits it where the row fills ("Partial
+ *    whitespace rows absorb the next word"), and a word after a hyphen or a slash in a row that took the next
+ *    textwrap line is split the same way. So on Codex a split between two letters is no space at all on a row that
+ *    starts with indentation, or after a break opportunity inside the row's last word; only the first rule above
+ *    reads such a break. */
+function rowBreakIsSpace(row, next, width, ownIndent) {
+    const firstWord = next.trim().split(" ")[0];
+    if (widthAtMost(row.trimEnd()) + 1 + widthAtMost(firstWord) <= width)
+        return true;
+    if (row.slice(0, ownIndent).trim() || !ASCII_VISIBLE.test(row.slice(ownIndent, ownIndent + 1)))
+        return false;
+    const lastWord = row.trim().split(" ").at(-1);
+    if (!ASCII_UNBROKEN_WORD.test(lastWord))
+        return false;
+    const before = lastWord.at(-1);
+    const after = next.trimStart()[0] ?? "";
+    const noBreak = (ASCII_LETTER_OR_DIGIT.test(before) && ASCII_LETTER_OR_DIGIT.test(after))
+        || (ASCII_VISIBLE.test(before) && ASCII_NO_BREAK_BEFORE.test(after));
+    return noBreak && widthAtMost(lastWord + firstWord) <= width;
 }
+/** Whether a Claude Code or Codex box, given as its rows, holds exactly `text` with its word boundaries kept.
+ *  Whitespace inside a row is compared as one space (runs and Unicode spaces count the same, so `now here` is not
+ *  `nowhere`), and letters are compared as they are (case included). A row break counts as the text's space only
+ *  where it must be whitespace of the box's text (rowBreakIsSpace), measured against the box's widest row in
+ *  printable ASCII cells (widthAtLeast), a lower bound of the box's width whatever else the rows hold. Any other
+ *  break may fall inside a word of the box's text, or be how the box draws different spacing, so the reading is
+ *  `ambiguous`, never `exact`, and so is a break that falls inside a word of the sent text. */
+function boxHoldsText(rows, text) {
+    // The box draws its first row one cell after the prompt glyph, and its continuation rows two cells in.
+    const drawn = rows.flatMap((row, index) => (row.trim() ? [{ row, ownIndent: index === 0 ? 1 : 2 }] : []));
+    const shown = drawn.map(({ row }) => row.trim().replace(/\s+/g, " "));
+    const sent = text.trim().replace(/\s+/g, " ");
+    // Measured on the rows as drawn: whitespace compares as a space, but U+FEFF, which `\s` matches, takes no cell.
+    const width = Math.max(0, ...drawn.map(({ row }) => widthAtLeast(row.trim())));
+    let at = 0;
+    let ambiguous = false;
+    for (let i = 0; i < shown.length; i++) {
+        const row = shown[i];
+        if (!sent.startsWith(row, at))
+            return "other";
+        at += row.length;
+        if (i === shown.length - 1)
+            break;
+        if (sent[at] === " ") {
+            at += 1;
+            if (!rowBreakIsSpace(drawn[i].row, drawn[i + 1].row, width, drawn[i].ownIndent))
+                ambiguous = true;
+        }
+        else {
+            ambiguous = true;
+        }
+    }
+    if (at !== sent.length)
+        return "other";
+    return ambiguous ? "ambiguous" : "exact";
+}
+/** The row of Codex's running-turn status (`• Working (… esc to interrupt)`) above its input box, or -1. */
+function codexTurnStatusAt(box) {
+    for (let i = box.inputAt - 1; i >= 0; i--)
+        if (CODEX_TURN_STATUS_PATTERN.test(box.lines[i]))
+            return i;
+    return -1;
+}
+/** Codex 0.160.0's parent bottom-pane renderer replaces the normal composer for a modal; inline choices and
+ *  previews follow the running status. Only scope generic selector history at this adjacent normal-frame slot.
+ *  A draft, queued input, different visible version, missing footer or intervening content keeps the full scan.
+ *  Source: openai/codex a956835d, tui/src/bottom_pane/mod.rs:2164-2310. Permission detectors keep their own scan. */
+function codexCurrentSelectionLines(pane) {
+    if (readInputBox(pane, "codex", "") !== "empty")
+        return null;
+    const box = codexInputBox(pane);
+    let status = box.inputAt - 1;
+    while (status >= 0 && !box.lines[status].trim())
+        status--;
+    if (status < 0 || !CODEX_TURN_STATUS_PATTERN.test(box.lines[status]))
+        return null;
+    return trimPaneLines(box.lines.slice(status).join("\n"));
+}
+/** Whether a Claude Code frame shows a running turn: `esc to interrupt` in the footer under its input box, or a
+ *  live status row above the box (timer-less rows included): in the two rows above the box's opening rule, where
+ *  Claude Code 2.1.296 draws its status row over a one-row margin whatever the box's height, or as
+ *  `findClaudeComposer` reads it above a one-row box. Claude Code queues a message submitted during a turn, and it
+ *  labels the queue only while a per-user hint counter is low, so an unlabelled queued message leaves the same
+ *  empty box as a submit. With a statusLine configured (OpenRig installs one on every seat) and while the box holds
+ *  text, the footer never draws `esc to interrupt`, so the status row is the running signal, but only while it is
+ *  drawn: Claude Code hides it while streamed text is shown (SEAT_IDLE_SHAPES.claude.statusSlot). So this reading
+ *  can only say a turn ran; a turn it misses is ruled out, if at all, by the seat reading before the paste. */
+function claudeTurnRunning(pane) {
+    const { markerLine, closingRuleLine } = composerRegion(pane, "claude-code");
+    if (closingRuleLine === null || markerLine === null)
+        return false;
+    const lines = pane.split("\n");
+    if (lines.slice(closingRuleLine).some((row) => /esc to interrupt/.test(row)))
+        return true;
+    // markerLine is 1-based: the box's first row is lines[markerLine - 1] and its opening rule the row above it.
+    const statusSlot = lines.slice(Math.max(0, markerLine - 4), Math.max(0, markerLine - 2)).map((row) => row.trim());
+    if (statusSlot.some((row) => CLAUDE_LIVE_STATUS_PATTERN.test(row) || CLAUDE_TIMERLESS_STATUS_PATTERN.test(row)))
+        return true;
+    return findClaudeComposer(pane, { timerlessStatusIsLive: true })?.liveStatus != null;
+}
+// Claude's faint `Try "…"` suggestion in an empty box. The capture is unstyled, so it is read as other text and
+// never as the sent text, even when the text is the suggestion itself.
+const CLAUDE_TRY_SUGGESTION = /^Try"[^"]*"$/;
+// Codex 0.160 lists messages waiting for a running turn above its input box under one of these headers, with
+// `↳ <text>` rows (tui/src/bottom_pane/pending_input_preview.rs). Like Claude's queued label, such a row is generic:
+// it says a message waits, not which one.
+const CODEX_PENDING_INPUT_HEADER = /^• (?:Messages to be submitted (?:after next tool call|at end of turn)|Queued follow-up inputs)\b/;
+const CODEX_PENDING_INPUT_ROW = new RegExp(`${CODEX_PENDING_INPUT_HEADER.source}|^↳ `);
+const BRAILLE_SPINNER = /[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏]/;
+// Rows that rule out an idle seat wherever they are in the capture (compared trimmed). A transcript row that
+// happens to match also reads not-idle, which only leaves the send unconfirmed.
+const SEAT_NOT_IDLE_ROWS = {
+    "claude-code": [CLAUDE_LIVE_STATUS_PATTERN, CLAUDE_TIMERLESS_STATUS_PATTERN, /esc to interrupt/, /paste again to expand/,
+        /Press up to edit queued messages/, BRAILLE_SPINNER],
+    codex: [CODEX_TURN_STATUS_PATTERN, /esc to interrupt/, CODEX_PENDING_INPUT_ROW, BRAILLE_SPINNER],
+};
+// Codex 0.160's completion row (tui/src/history_cell/separators.rs, FinalMessageSeparator::label at rust-v0.160.0):
+// `Worked for <elapsed>`, then ` • ` and the completion time (an optional date for another day, then the host's
+// 12- or 24-hour clock, tui/src/clock_format.rs), then optional runtime metrics, each after ` • `, in source order.
+// A live completion always has both the elapsed time and the time (chatwidget/completion.rs), so both are required.
+// `<1s`, `{s}s`, `{m}m {s}s` or `{h}h {m}m {s}s`, with minutes and seconds below 60 and no leading zeros.
+const CODEX_SIXTY = "(?:[0-9]|[1-5][0-9])";
+const CODEX_NONZERO_SIXTY = "(?:[1-9]|[1-5][0-9])";
+const CODEX_ELAPSED = `(?:<1s|${CODEX_NONZERO_SIXTY}s|${CODEX_NONZERO_SIXTY}m ${CODEX_SIXTY}s|[1-9][0-9]*h ${CODEX_SIXTY}m ${CODEX_SIXTY}s)`;
+// `%b %-d at ` (this year) or `%b %-d, %Y at ` (another year); nothing for today.
+const CODEX_DATE = "(?:(?:Jan|Feb|Mar|Apr|May|Jun|Jul|Aug|Sep|Oct|Nov|Dec) (?:[1-9]|[12][0-9]|3[01])(?:, [0-9]{4})? at )?";
+// `%-I:%M %p` (TwelveHour) or `%H:%M` (TwentyFourHour).
+const CODEX_CLOCK = "(?:(?:[1-9]|1[0-2]):[0-5][0-9] [AP]M|(?:[01][0-9]|2[0-3]):[0-5][0-9])";
+// runtime_metrics_label: format_duration_ms gives `<n>.<d>s` from one second, `<n>ms` below it.
+const CODEX_MS = "(?:[0-9]+\\.[0-9]s|[0-9]+ms)";
+const CODEX_TTFT_TBT = `(?:${CODEX_MS} \\(iapi\\)(?: ${CODEX_MS} \\(service\\))?|${CODEX_MS} \\(service\\))`;
+// A metric is shown only for a count above zero; pluralize() gives the singular for exactly one.
+const CODEX_MANY = "(?:[2-9]|[1-9][0-9]+)";
+const CODEX_COUNT = "[1-9][0-9]*";
+const CODEX_METRICS = [
+    `Local tools: (?:1 call|${CODEX_MANY} calls) \\(${CODEX_MS}\\)`,
+    `Inference: (?:1 call|${CODEX_MANY} calls) \\(${CODEX_MS}\\)`,
+    `WebSocket: ${CODEX_COUNT} events send \\(${CODEX_MS}\\)`,
+    `(?:Stream: 1 event|Streams: ${CODEX_MANY} events) \\(${CODEX_MS}\\)`,
+    `${CODEX_COUNT} events received \\(${CODEX_MS}\\)`,
+    `Responses API overhead: ${CODEX_MS}`,
+    `Responses API inference: ${CODEX_MS}`,
+    `TTFT: ${CODEX_TTFT_TBT}`,
+    `TBT: ${CODEX_TTFT_TBT}`,
+].map((metric) => `(?: • ${metric})?`).join("");
+const CODEX_COMPLETION_ROW = new RegExp(`^ {2}Worked for ${CODEX_ELAPSED} • ${CODEX_DATE}${CODEX_CLOCK}${CODEX_METRICS}$`);
+const escapeRegExp = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+// Claude Code 2.1.296's completion row, which ends a finished turn in the transcript (the bundle's turn-duration
+// row): the `✻` glyph in a two-cell column at column 0, then `<verb> for <duration> · done <time>`. The verb is one
+// of the bundle's past-tense list, picked from the turn's id. The duration is the bundle's duration format:
+// `<s>s` below a minute (`0.0s` below 1 ms), `<m>m <s>s`, `<h>h <m>m <s>s`, `<d>d <h>h <m>m`, without leading
+// zeros. The time is the clock of a turn that finished today in the en-US forms of the bundle's time-format
+// presets: `auto` (en-US) and `12-hour` (`5:24 PM`), `24-hour` (`17:24`, `09:05`), `24-hour-utc` (`17:24Z`); real
+// frames of OpenRig-launched seats show the 12-hour form. Anything after the time
+// (a still-running note, hidden-message or budget notes), a row without `· done`, another locale, a custom
+// pattern or the weekday and date of an earlier day is not on this list.
+const CLAUDE_COMPLETION_VERBS = ["Baked", "Brewed", "Churned", "Cogitated", "Cooked", "Crunched", "Saut\u00e9ed", "Worked"];
+const CLAUDE_SIXTY = "(?:[0-9]|[1-5][0-9])";
+const CLAUDE_NONZERO_SIXTY = "(?:[1-9]|[1-5][0-9])";
+const CLAUDE_HOURS = "(?:[0-9]|1[0-9]|2[0-3])";
+const CLAUDE_NONZERO_HOURS = "(?:[1-9]|1[0-9]|2[0-3])";
+const CLAUDE_DURATION = `(?:0\\.0s|${CLAUDE_SIXTY}s|${CLAUDE_NONZERO_SIXTY}m ${CLAUDE_SIXTY}s`
+    + `|${CLAUDE_NONZERO_HOURS}h ${CLAUDE_SIXTY}m ${CLAUDE_SIXTY}s|[1-9][0-9]*d ${CLAUDE_HOURS}h ${CLAUDE_SIXTY}m)`;
+const CLAUDE_CLOCK = "(?:(?:[1-9]|1[0-2]):[0-5][0-9] [AP]M|(?:[01][0-9]|2[0-3]):[0-5][0-9]Z?)";
+const CLAUDE_COMPLETION_ROW = new RegExp(`^✻ (?:${CLAUDE_COMPLETION_VERBS.join("|")}) for ${CLAUDE_DURATION} · done ${CLAUDE_CLOCK}$`);
+/** The idle allow-list. Each entry comes from real Claude Code 2.1.296 and Codex 0.160.0 frames
+ *  (test/fixtures/input-box, including idle seats OpenRig launched: openrig-seat-*), or, where no frame was captured,
+ *  from the Claude Code 2.1.296 bundle, the Codex 0.160.0 source or OpenRig's own launch code, as each entry says; a
+ *  frame that matches none of them is not proven idle. */
+const SEAT_IDLE_SHAPES = {
+    claude: {
+        // The box's opening rule. Plain (the captured frames: a seat started without a name), or carrying this seat's
+        // own session name: OpenRig launches every Claude seat with `--name <session>` (claude-code-adapter.ts), which
+        // Claude Code draws on the box's top border as `─…─ <name> ─`, as wide as the closing rule (2.1.296 bundle:
+        // the prompt-border banner draws the rule, the name padded by one space each side, then one `─`). Real frames
+        // of OpenRig seats from earlier Claude Code versions end it with `──` (session-transport.test.ts,
+        // fixtures/walk-staged-specimen), so one or two are accepted; real 2.1.296 OpenRig seats (openrig-seat-*) draw
+        // one. Any other name, or a truncated one, is unknown.
+        openingRules: {
+            plain: /^─{10,}$/,
+            named: (sessionName) => new RegExp(`^─+ ${escapeRegExp(sessionName)} ─{1,2}$`),
+        },
+        // The footer under an empty box when no turn runs, one per permission posture claudePostureFlag can launch
+        // (yolo-mode.ts: --dangerously-skip-permissions, or --permission-mode with any mode Claude Code 2.1.296 offers).
+        // Bypass and accept edits are real (openrig-seat-*; bypass also after-enter-15s.J, idle-fresh-suggestion). The
+        // others are drawn by the 2.1.296 bundle's footer (the mode's symbol and indicator plus ` on`,
+        // ` (shift+tab to cycle)` for every mode but default, then ` · ← for agents` while the box is empty); accept edits
+        // also matches a real 2.1.220 capture (claude-warning-footer-readiness.test.ts). OpenRig's statusLine makes the footer drop its hints
+        // (`? for shortcuts`, `esc to interrupt`), so these rows are the same whether or not a turn runs: the status
+        // slot above the box (`statusSlot` below) is what tells a running turn apart.
+        footers: {
+            bypassPermissions: "⏵⏵ bypass permissions on (shift+tab to cycle) · ← for agents",
+            acceptEdits: "⏵⏵ accept edits on (shift+tab to cycle) · ← for agents",
+            auto: "⏵⏵ auto mode on (shift+tab to cycle) · ← for agents",
+            dontAsk: "⏵⏵ don't ask on (shift+tab to cycle) · ← for agents",
+            plan: "⏸ plan mode on (shift+tab to cycle) · ← for agents",
+            default: "⏸ manual mode on · ← for agents",
+        },
+        // The rows OpenRig's statusLine collector (provisionContextCollector, assets/claude-statusline-context.cjs) draws
+        // between the closing rule and the footer: none. It prints nothing to stdout, and Claude Code 2.1.296 draws no
+        // row for an empty statusLine in the classic renderer OpenRig launches with (CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN=1).
+        // A statusLine that prints anything (a person's own command) is not on this list.
+        statusLineRows: [],
+        // The one row between the box's two rules: empty (after-enter-15s.J), or the Try suggestion (idle-fresh-suggestion).
+        boxes: [/^❯$/, /^❯\s+Try "[^"]*"$/],
+        // The row just above the opening rule: blank (after-enter-15s.J), the effort row (idle-fresh-suggestion), or a
+        // tmux notice (cleared-without-enter.J, staged-short).
+        notices: ["", "◐ medium · /effort",
+            "tmux detected · scroll with PgUp/PgDn · or add 'set -g mouse on' to ~/.tmux.conf for wheel scroll",
+            "tmux focus-events off · add 'set -g focus-events on' to ~/.tmux.conf and reattach for focus tracking"],
+        // The status slot, the row above that, read together with the rows above it when it is blank: the first
+        // non-blank row at or above the slot must be one of these. With OpenRig's statusLine the footer shows no running
+        // signal, so this slot is what tells a running turn apart, and the 2.1.296 bundle says what a running turn leaves
+        // there. Its REPL draws the live status row (the spinner) only while
+        // `isLoading && (!hasDisplayedStreamingText || tailBlank || …)`: once streamed text with a complete line is on
+        // screen it hides the spinner, and draws nothing in its place (the slot component renders only a retry banner,
+        // or null), so the last streamed row moves down into the slot. That row is never the completion row: Claude Code
+        // draws a message behind a two-cell `●` column (continuation rows two spaces in), the user's echo after `❯ `,
+        // tool output indented. But the bundle does not show that the last streamed row is never blank (the streamed
+        // markdown is laid out in a column with a one-row gap, and its unfinished last line is hidden), so a blank slot
+        // under transcript text is not proof of an idle seat and reads unknown. A blank slot counts only where nothing
+        // of a newer turn can be under the row it sits below:
+        // - finishedTurn: the completion row at column 0 (CLAUDE_COMPLETION_ROW). In the classic renderer OpenRig
+        //   launches Claude with, the box follows the transcript, so an idle seat that has finished a turn shows that
+        //   turn's completion row in the slot itself (openrig-seat-*: real OpenRig-launched seats); in the fullscreen
+        //   renderer the box is pinned to the bottom and blank rows sit between them (after-enter-15s.J). A newer turn
+        //   draws its echo, its status row or its `●` rows under the completion row.
+        // - freshSession: the last row of the welcome banner of Claude Code v2.1.296, before any turn (idle-fresh-
+        //   suggestion, cleared-without-enter.J).
+        // Any other row reads unknown.
+        statusSlot: {
+            finishedTurn: (lines, at) => CLAUDE_COMPLETION_ROW.test(lines[at] ?? ""),
+            freshSession: (lines, at) => at >= 2 && /^ ▝▝ {3}▝▝ {3}[~/]/.test(lines[at])
+                && /^▝▜██████▀ {2}\S/.test(lines[at - 1]) && /^ ▐▛███▛█ {3}Claude Code v2\.1\.296$/.test(lines[at - 2]),
+        },
+    },
+    codex: {
+        // The hint row under the status line of an empty box (product-path-idle.J, idle).
+        hints: [/^\? for shortcuts$/, /^\? for shortcuts\s+⚠ \d+ warnings? · f2 to view$/],
+        // The last non-blank row above the empty box: the completion row Codex adds when a turn completes
+        // (after-enter-15s.J; its grammar is CODEX_COMPLETION_ROW above), or the greeting under the session header
+        // before any turn (idle, product-path-idle.J, cleared-without-enter.J). A running or streaming turn draws rows
+        // below either.
+        above: {
+            finishedTurn: (lines, at) => CODEX_COMPLETION_ROW.test(lines[at] ?? ""),
+            freshSession: (lines, at) => {
+                if (!/^ {2}\S/.test(lines[at] ?? ""))
+                    return false;
+                let i = at - 1;
+                while (i >= 0 && !lines[i].trim())
+                    i--;
+                return i >= 2 && i < at - 1 && /^ {2}permissions: \S/.test(lines[i]) && /^ {5}[~/]/.test(lines[i - 1])
+                    && /^ {2}>_ OpenAI Codex \(v0\.160\.0\)$/.test(lines[i - 2]);
+            },
+        },
+    },
+};
+function claudeSeatIdle(lines, sessionName) {
+    const idle = SEAT_IDLE_SHAPES.claude;
+    let footer = lines.length - 1;
+    while (footer >= 0 && !lines[footer].trim())
+        footer--;
+    const closing = footer - 1 - idle.statusLineRows.length;
+    if (closing < 4)
+        return false;
+    const width = (row) => [...row].length;
+    const plainRule = (row) => idle.openingRules.plain.test(row);
+    const openingRule = (row) => plainRule(row)
+        || (!!sessionName && idle.openingRules.named(sessionName).test(row) && width(row) === width(lines[closing]));
+    return Object.values(idle.footers).includes(lines[footer].trim())
+        && idle.statusLineRows.every((row, i) => lines[closing + 1 + i].trim() === row) && plainRule(lines[closing])
+        && idle.boxes.some((box) => box.test(lines[closing - 1])) && openingRule(lines[closing - 2])
+        && idle.notices.includes(lines[closing - 3].trim()) && claudeStatusSlotIdle(lines, closing - 4);
+}
+/** The status slot (see SEAT_IDLE_SHAPES.claude.statusSlot): its own row, or, when it is blank, the first non-blank
+ *  row above it. */
+function claudeStatusSlotIdle(lines, slot) {
+    let at = slot;
+    while (at >= 0 && !lines[at].trim())
+        at--;
+    return at >= 0 && Object.values(SEAT_IDLE_SHAPES.claude.statusSlot).some((shape) => shape(lines, at));
+}
+function codexSeatIdle(pane) {
+    const box = codexInputBox(pane);
+    if (box === null || box.text)
+        return false;
+    const lines = box.lines.map((row) => row.trimEnd());
+    let hint = lines.length - 1;
+    while (hint >= 0 && !lines[hint].trim())
+        hint--;
+    if (!SEAT_IDLE_SHAPES.codex.hints.some((row) => row.test(lines[hint].trim())))
+        return false;
+    let above = box.inputAt - 1;
+    while (above >= 0 && !lines[above].trim())
+        above--;
+    return Object.values(SEAT_IDLE_SHAPES.codex.above).some((shape) => shape(lines, above));
+}
+// The client versions the idle layouts and box readers were recorded from, and the rows in which each client names
+// the version it runs: Claude Code's welcome banner (`Claude Code v2.1.296`), Codex's session header
+// (`>_ OpenAI Codex (v0.160.0)`) and its update notice, whose first version is the running one
+// (`Update available! 0.160.0 -> 0.162.1`). These are only what the frames show; nothing here discovers a version. A frame where one of them names another version is not read as these
+// layouts. Most frames name no version (the banner and header scroll away), and then a matching layout is evidence
+// about the layout only, not proof of the client version: another version that draws the same rows reads the same.
+const RECORDED_CLIENT_VERSION = { "claude-code": "2.1.296", codex: "0.160.0" };
+const VISIBLE_CLIENT_VERSION = {
+    "claude-code": [/Claude Code v(\d[\w.+-]*)/g],
+    codex: [/OpenAI Codex \(v(\d[\w.+-]*)\)/g, /Update available! (\d[\w.+-]*) -> /g],
+};
+/** Whether a frame visibly names a client version other than the recorded one (see RECORDED_CLIENT_VERSION). */
+function namesAnotherClientVersion(pane, runtime) {
+    return VISIBLE_CLIENT_VERSION[runtime].some((pattern) => [...pane.matchAll(pattern)].some((match) => match[1] !== RECORDED_CLIENT_VERSION[runtime]));
+}
+/** The seat before the paste (see SeatReading), read from the capture the transport already takes before it.
+ *  `sessionName` is the seat's own session name, which a Claude Code seat launched by OpenRig draws on its box.
+ *  A frame that names another client version is `unknown`. */
+export function readSeatBeforePaste(pane, runtime, sessionName) {
+    if (!pane?.trim())
+        return "unknown";
+    const lines = pane.split("\n").map((row) => row.trimEnd());
+    if (lines.some((row) => SEAT_NOT_IDLE_ROWS[runtime].some((pattern) => pattern.test(row.trim()))))
+        return "not-idle";
+    if (namesAnotherClientVersion(pane, runtime))
+        return "unknown";
+    return (runtime === "codex" ? codexSeatIdle(pane) : claudeSeatIdle(lines, sessionName)) ? "idle" : "unknown";
+}
+/** What a Claude Code or Codex input box shows, read from the input box only (never the transcript). Labels and
+ *  placeholders (Claude's queued label and Try suggestion, collapsed pastes, Codex's empty-box placeholder) are
+ *  checked before the sent text, so none of them can read as `exact`. The sent text is `exact` only with its word
+ *  boundaries kept, and `ambiguous` where the box's row breaks leave them uncertain (boxHoldsText). A frame that
+ *  names another client version reads `unrecognized` (RECORDED_CLIENT_VERSION).
+ *
+ *  An empty box also reads `queued` where the frames say the message may wait behind a turn: Codex's
+ *  pending-input rows above the box, rows between Codex's running-turn status row and the box, or
+ *  `beforeEnter` (the frame read just before Enter) showing a running turn (Codex's status row, or
+ *  `claudeTurnRunning`). These readings decide the verdict: verified needs `empty` after Enter. For a seat that
+ *  was not idle before the paste they only say why the send is unconfirmed (readSeatBeforePaste already rules it
+ *  out), but for a seat that was idle they are the only check that rejects a message queued behind a turn that
+ *  started after the pre-paste capture and shows in the frame read before Enter.
+ *  Used only to report a send with transport.verify_input_box on. */
+export function readInputBox(pane, runtime, text, beforeEnter) {
+    if (!pane?.trim())
+        return "unavailable";
+    if (namesAnotherClientVersion(pane, runtime))
+        return "unrecognized";
+    if (runtime === "codex") {
+        const box = codexInputBox(pane);
+        if (box === null)
+            return "unrecognized";
+        if (!box.text) {
+            const before = beforeEnter ? codexInputBox(beforeEnter) : null;
+            const status = codexTurnStatusAt(box);
+            const rowsBehindTurn = status >= 0 && box.lines.slice(status + 1, box.inputAt).some((row) => row.trim());
+            const pendingInput = box.lines.slice(0, box.inputAt).some((row) => CODEX_PENDING_INPUT_ROW.test(row.trim()));
+            return pendingInput || rowsBehindTurn || (before !== null && codexTurnStatusAt(before) >= 0) ? "queued" : "empty";
+        }
+        if (CODEX_COLLAPSED_PASTE.test(box.text))
+            return "hidden";
+        return boxHoldsText(box.rows, text);
+    }
+    const { body, markerLine, closingRuleLine } = composerRegion(pane, runtime);
+    if (body === null)
+        return "unrecognized";
+    if (!body)
+        return beforeEnter && claudeTurnRunning(beforeEnter) ? "queued" : "empty";
+    if (body === QUEUED_PLACEHOLDER)
+        return "queued";
+    if (COLLAPSED_PASTE.test(body))
+        return "hidden";
+    if (CLAUDE_TRY_SUGGESTION.test(body))
+        return "other";
+    // composerRegion's body has every space removed (the startup guard's matcher, unchanged); identity reads the rows.
+    return boxHoldsText(stripBoxGlyph(pane.split("\n").slice(markerLine - 1, closingRuleLine - 1)), text);
+}
+const CALLER_CANCELLED = "caller_cancelled";
+/** The caller's cancellation signal, or none for sends no caller owns (queue wakes, committed outbox deliveries). */
+function callerSignal(opts) {
+    return opts?.queueWake || opts?.committedOutboxIds ? undefined : opts?.signal;
+}
+function callerCancelled(sessionName) {
+    return { ok: false, sessionName, sent: false, inputPhase: "not_reached", reason: CALLER_CANCELLED,
+        error: `The request was cancelled before any input started. Nothing was typed into '${sessionName}', and nothing will be.` };
+}
+/** The evidence of a verified send whose path does not read the input box (an audited prompt answer). */
+const INPUT_BOX_UNCHECKED = { seat: "unchecked", before: "unchecked", after: "unchecked", sameProcess: false };
 export class SessionTransport {
     db;
+    guardedDelivery;
     rigRepo;
     sessionRegistry;
     tmuxAdapter;
@@ -844,6 +1514,9 @@ export class SessionTransport {
     activityEndpointFile;
     captureObserver;
     listProcesses;
+    runtimeAdapters;
+    inFlightReconciliations = new Map();
+    verifyInputBox;
     constructor(deps) {
         this.db = deps.db;
         this.rigRepo = deps.rigRepo;
@@ -859,6 +1532,17 @@ export class SessionTransport {
         this.activityEndpointFile = deps.activityEndpointFile ?? (() => null);
         this.captureObserver = deps.captureObserver;
         this.listProcesses = deps.listProcesses;
+        this.runtimeAdapters = deps.runtimeAdapters ?? {};
+        this.verifyInputBox = deps.verifyInputBox;
+        const guard = this.tmuxAdapter.deliveryGuard;
+        if (guard && this.db.prepare("PRAGMA table_info(outbox_entries)").all().some(c => c.name === "guard_delivery"))
+            this.guardedDelivery = new DraftAwareDelivery(this.db, guard, (session, text, opts) => this.sendUnguarded(session, text, opts));
+    }
+    configureGuardedWakes(applicable) {
+        this.guardedDelivery?.configureWakes(applicable);
+    }
+    attachRuntimeAdapters(adapters) {
+        this.runtimeAdapters = { ...this.runtimeAdapters, ...adapters };
     }
     /** Freeze the registration and binding before asking tmux about this name. */
     absenceProbeTarget(sessionName) {
@@ -1132,17 +1816,33 @@ export class SessionTransport {
         const pref = guard.preference(target.nodeId);
         return pref.desired || pref.effective ? target : null;
     }
+    draftAwareTarget(sessionName) {
+        const guard = this.tmuxAdapter.deliveryGuard;
+        const target = guard?.maybeTarget(sessionName);
+        if (!guard || !target)
+            return null;
+        const policy = guard.configuration(target.nodeId);
+        return policy.desired.mode === "draft-aware" || policy.effective.mode === "draft-aware" ? target : null;
+    }
     /** Deliver text and Enter to the resolved recipient under the send guards.
      * With verification requested, compare rendered message counts, excluding
      * agent input; a confirmed render does not prove agent consumption. */
     async send(sessionName, text, opts) {
         const guard = this.tmuxAdapter.deliveryGuard;
-        if (!guard)
-            return this.sendUnguarded(sessionName, text, opts);
+        if (!guard) {
+            // No guard, so no recorded delivery to read back: a caller already gone ends the send here.
+            if (callerSignal(opts)?.aborted)
+                return callerCancelled(sessionName);
+            const result = await this.sendUnguarded(sessionName, text, opts);
+            if (result.ok && result.sent !== false) {
+                await this.reconcileStartupReadiness(sessionName).catch(() => { });
+            }
+            return result;
+        }
         const outbox = new OutboxHandler(this.db);
         const ids = opts?.committedOutboxIds ?? [opts?.deliveryId ?? `guard-send-${randomUUID()}`];
-        const retainedResult = () => ({ ok: true, sessionName, outcome: "retained", sent: false, verified: false,
-            outboxIds: ids, reason: "typing_guard_enabled", warning: `Retained, not delivered. Inspect with rig seat held-messages ${sessionName}; disabling does not replay held messages.` });
+        const retainedResult = (reason = "typing_guard_enabled") => ({ ok: true, sessionName, outcome: "retained", sent: false, verified: false,
+            outboxIds: ids, reason, warning: `Retained, not delivered. Inspect with rig seat held-messages ${sessionName}; changing protection does not replay held messages.` });
         try {
             if (opts?.committedOutboxIds) {
                 const target = guard.target(sessionName);
@@ -1155,6 +1855,9 @@ export class SessionTransport {
                     }
                 }
             }
+            const existing = this.guardedDelivery?.existing(sessionName, text, opts ?? {}, ids);
+            if (existing)
+                return existing;
             // Idempotent readback also after disabling: an old retained ID never becomes a new send.
             // (P2: this readback is NOT a new retention and is outside the retained_no_write seam.)
             if (!opts?.committedOutboxIds && opts?.deliveryId) {
@@ -1167,6 +1870,10 @@ export class SessionTransport {
                         return retainedResult();
                 }
             }
+            // A recorded delivery has answered with its own outcome above; with nothing recorded, a caller already gone
+            // ends the send here.
+            if (callerSignal(opts)?.aborted)
+                return callerCancelled(sessionName);
             // #1084 — the idle wait must not occupy the seat's serial lease: a long
             // --wait-for-idle inside guard.operation holds up other sends and queue
             // creates to this seat for the whole wait. The lease-free wait, main's
@@ -1204,9 +1911,28 @@ export class SessionTransport {
                     sendOpts = { ...opts, preWaitedIdle: pre.evidence, preWaitBound: pre.bound };
                 }
             }
-            return await guard.operation(sessionName, () => this.sendUnguarded(sessionName, text, sendOpts), async (target) => {
+            const result = await guard.operation(sessionName, async () => {
+                if (this.guardedDelivery && !sendOpts?.submitOnly && guard.needsInputCheck(sessionName)) {
+                    // Up to its durable record a draft-aware send is still the caller's: one that went away while this send
+                    // waited for the lease ends here, unless a record for this delivery already exists. DraftAwareDelivery.send
+                    // commits that record synchronously before its first await, so no cancellation lands between this check
+                    // and the commit; after the commit a caller going away doesn't cancel it.
+                    if (callerSignal(sendOpts)?.aborted && !this.guardedDelivery.existing(sessionName, text, sendOpts ?? {}, ids)) {
+                        return callerCancelled(sessionName);
+                    }
+                    return this.guardedDelivery.send(sessionName, text, { ...sendOpts, signal: undefined }, ids);
+                }
+                const prior = this.guardedDelivery?.existing(sessionName, text, sendOpts ?? {}, ids);
+                return prior ?? this.sendUnguarded(sessionName, text, sendOpts);
+            }, async (target) => {
+                const prior = this.guardedDelivery?.existing(sessionName, text, sendOpts ?? {}, ids);
+                if (prior)
+                    return prior;
                 if (opts?.submitOnly)
                     return { ok: false, sessionName, sent: false, reason: "typing_guard_enabled", error: "Typing guard prevents submit-only; no Enter was sent." };
+                // Nothing is retained yet: a caller that went away while this send waited for the lease ends it here.
+                if (callerSignal(opts)?.aborted)
+                    return callerCancelled(sessionName);
                 this.db.transaction(() => {
                     for (const id of ids) {
                         const prior = opts?.committedOutboxIds ? outbox.getById(id) : null;
@@ -1214,6 +1940,7 @@ export class SessionTransport {
                             throw new Error("Committed wake target/ID mismatch");
                         outbox.retain(prior ? { ...prior, outboxId: id, tags: prior.tags ?? undefined, auditPointer: prior.auditPointer ?? undefined } : {
                             outboxId: id, senderSession: opts?.actorSession ?? "unknown", destinationSession: sessionName, body: text, auditPointer: opts?.auditPointer,
+                            identityProvenance: opts?.identityProvenance,
                         }, target, !!opts?.committedOutboxIds);
                     }
                 })();
@@ -1234,8 +1961,24 @@ export class SessionTransport {
                 }
                 return retainedResult();
             });
+            if (result.ok && result.sent !== false) {
+                await this.reconcileStartupReadiness(sessionName).catch(() => { });
+            }
+            return result;
         }
         catch (error) {
+            // A refusal thrown after the text was written (for example a guard check before Enter) is not "nothing sent".
+            if (error.inputWritten === true) {
+                // Only a throw before the Enter key reached the adapter positively means Enter was never sent.
+                const enter = error.enterAttempted === true ? "the submission (Enter) outcome is unconfirmed" : "Enter was not sent";
+                return { ok: false, sessionName, sent: true, outcome: "failed", inputPhase: "written", reason: error.code ?? "submit_refused",
+                    error: `Text was written to '${sessionName}' but ${enter}: ${error.message}` };
+            }
+            // A throw after the text write was issued: whether it landed is unknown, so it is not "nothing sent" either.
+            if (error.inputAttempted === true) {
+                return { ok: false, sessionName, outcome: "failed", inputPhase: "attempted", reason: error.code ?? "delivery_indeterminate",
+                    error: `A text write to '${sessionName}' was issued, but its result was lost: ${error.message}` };
+            }
             return { ok: false, sessionName, sent: false, reason: error.code ?? "guard_unavailable", error: error.message };
         }
     }
@@ -1261,7 +2004,10 @@ export class SessionTransport {
             if (!preTarget)
                 return null;
             const prePref = guard.preference(preTarget.nodeId);
-            if (prePref.effective || prePref.desired)
+            // Hold mode retains in the lease, and draft-aware mode reads the input there first and returns its
+            // immediate result (held, or refused with its reason): neither takes the lease-free wait. A
+            // draft-aware send whose input is empty waits for idle inside the lease, as before this wait existed.
+            if (prePref.effective || prePref.desired || prePref.desiredMode === "draft-aware" || prePref.effectiveMode === "draft-aware")
                 return null;
             meta = this.getSessionMeta(sessionName);
             bound = guard.target(sessionName);
@@ -1349,6 +2095,7 @@ export class SessionTransport {
             timeoutMs,
             binding: { sessionName, nodeId: meta.nodeId, occupant: meta.occupant, pane: meta.pane },
             readinessFromPaneOnly: opts.readinessFromPaneOnly === true,
+            signal: callerSignal(opts), cancelledBy: "caller",
         });
         if (!preWait.ok) {
             return { ok: false, failure: {
@@ -1357,6 +2104,7 @@ export class SessionTransport {
                     reason: preWait.reason,
                     error: preWait.error,
                     sent: false,
+                    inputPhase: "not_reached",
                     activity: preWait.activity,
                     waitedMs: preWait.waitedMs,
                     attempts: preWait.attempts,
@@ -1388,6 +2136,31 @@ export class SessionTransport {
                 runtimeAdvisory = `runtime: ${observation.detail}; delivery proceeds without verified native identity.`;
             return null;
         };
+        // #331: with mouse on, scrolling a seat pane puts it in tmux copy mode. A paste still reaches
+        // the input there, but copy mode swallows the Enter, so the send would report ok while the
+        // text sits unsubmitted. Leave the mode once (send-keys -X cancel) and deliver; fail before
+        // typing anything only if the pane still reads as in a mode. An unknown answer keeps today's path.
+        const readPaneInMode = async () => {
+            try {
+                return typeof this.tmuxAdapter.isPaneInMode === "function" ? await this.tmuxAdapter.isPaneInMode(sessionName) : null;
+            }
+            catch {
+                return null;
+            }
+        };
+        const leavePaneMode = async (outcome) => {
+            if (await readPaneInMode() !== true)
+                return null;
+            try {
+                if (typeof this.tmuxAdapter.cancelPaneMode === "function")
+                    await this.tmuxAdapter.cancelPaneMode(sessionName);
+            }
+            catch { /* the re-read below decides */ }
+            if (await readPaneInMode() !== true)
+                return null;
+            return { ok: false, sessionName, sent: false, reason: "pane_in_mode",
+                error: `'${sessionName}' is in a tmux mode (such as copy mode) and could not leave it, so Enter would not reach the agent. ${outcome}` };
+        };
         // S01/S02 P2 observation context, frozen at attempt entry before any await.
         const observed = this.captureObserver ? {
             attemptId: randomUUID(),
@@ -1507,7 +2280,7 @@ export class SessionTransport {
                 if (!opts.requireFullStagedText || !opts.onStartupMismatch)
                     return;
                 try {
-                    const evidence = startupSubmissionEvidence(pane, expected, opts.submitOnlyCaptureLines ?? 50);
+                    const evidence = startupSubmissionEvidence(pane, expected, opts.submitOnlyCaptureLines ?? 50, runtime);
                     if (evidence)
                         opts.onStartupMismatch(evidence);
                 }
@@ -1522,8 +2295,8 @@ export class SessionTransport {
                 throw error; // Preserve the existing guarded/unguarded error handling.
             }
             const staged = opts.requireFullStagedText
-                ? inspectStartupStagedText(pane, expected) === "staged"
-                : hasExpectedStagedText(pane, expected);
+                ? inspectStartupStagedText(pane, expected, runtime) === "staged"
+                : hasExpectedStagedText(pane, expected, runtime);
             if (!staged) {
                 recordMismatch(pane);
                 return {
@@ -1533,13 +2306,41 @@ export class SessionTransport {
                     error: `submitOnly refused: the pane of '${sessionName}' does not show the expected staged text — pressing Enter here could drive something else entirely. Nothing was submitted.`,
                 };
             }
+            this.tmuxAdapter.deliveryGuard?.expectStagedInput(sessionName, expected);
+            // This Enter is the request's first input, so a caller that has gone ends it here, before any key, as for a paste.
+            const cancel = callerSignal(opts);
+            if (cancel?.aborted)
+                return callerCancelled(sessionName);
             const targetFailure = await checkClaudeTarget();
             if (targetFailure)
                 return targetFailure;
-            const submitResult = await this.runStage("session_transport.submit", () => this.tmuxAdapter.sendKeys(sessionName, ["Enter"]), (result) => result.ok ? "ok" : "failed");
+            const copyModeFailure = await leavePaneMode("Nothing was submitted.");
+            if (copyModeFailure)
+                return copyModeFailure;
+            if (cancel?.aborted)
+                return callerCancelled(sessionName);
+            // The last check runs in the adapter, immediately before the key (after its guard checks).
+            const beforeKey = cancel ? () => { if (cancel.aborted)
+                throw new DeliveryGuardError(CALLER_CANCELLED, "caller cancelled before the key"); } : undefined;
+            let submitResult;
+            try {
+                submitResult = await this.runStage("session_transport.submit", () => beforeKey ? this.tmuxAdapter.sendKeys(sessionName, ["Enter"], beforeKey) : this.tmuxAdapter.sendKeys(sessionName, ["Enter"]), (result) => result.ok ? "ok" : "failed");
+            }
+            catch (error) {
+                // Unguarded, the adapter's pre-key check throws instead of returning a result; no key was sent.
+                if (error instanceof DeliveryGuardError && error.code === CALLER_CANCELLED && cancel?.aborted)
+                    return callerCancelled(sessionName);
+                throw error;
+            }
+            if (!submitResult.ok && submitResult.code === CALLER_CANCELLED && cancel?.aborted)
+                return callerCancelled(sessionName);
             if (!submitResult.ok) {
                 return { ok: false, sessionName, reason: "submit_failed", outcome: "failed", error: `submitOnly: Enter did not land on '${sessionName}': ${submitResult.message}` };
             }
+            try {
+                opts.onInputEffect?.("submitted");
+            }
+            catch { /* Observation cannot change an input result. */ }
             return observe({ ok: true, sessionName, outcome: "rendered-unconfirmed", submitOnly: true });
         }
         // #1084: when send() already waited lease-free (preWaitedIdle), the wait
@@ -1553,6 +2354,7 @@ export class SessionTransport {
                 timeoutMs: waitForIdleMs,
                 binding: observed?.binding,
                 readinessFromPaneOnly: opts?.readinessFromPaneOnly === true,
+                signal: callerSignal(opts), cancelledBy: "caller",
             });
             waitEvidence = {
                 activity: waitResult.activity,
@@ -1566,6 +2368,7 @@ export class SessionTransport {
                     reason: waitResult.reason,
                     error: waitResult.error,
                     sent: false,
+                    inputPhase: "not_reached",
                     ...waitEvidence,
                 };
             }
@@ -1610,6 +2413,7 @@ export class SessionTransport {
                     timeoutLabelMs: waitForIdleMs,
                     binding: observed?.binding,
                     readinessFromPaneOnly: opts.readinessFromPaneOnly === true,
+                    signal: callerSignal(opts), cancelledBy: "caller",
                 });
                 waitEvidence = {
                     activity: rewait.activity,
@@ -1623,6 +2427,7 @@ export class SessionTransport {
                         reason: rewait.reason,
                         error: rewait.error,
                         sent: false,
+                        inputPhase: "not_reached",
                         ...waitEvidence,
                     };
                 }
@@ -1654,6 +2459,7 @@ export class SessionTransport {
                         ok: false,
                         sessionName,
                         sent: false,
+                        inputPhase: "not_reached",
                         reason: late.reason,
                         error: late.error,
                         activity: recheck,
@@ -1680,7 +2486,7 @@ export class SessionTransport {
         // the positive-picker guard (FR-4 — the footgun separation). The advisory is carried on the
         // success result via `warning` so the honest telemetry is surfaced.
         let sendAdvisory;
-        let promptOverride = false;
+        const promptOverride = waitForIdleMs === undefined && Boolean(opts?.dangerouslyInteract);
         if (waitForIdleMs === undefined) {
             const readiness = await this.classifySendReadiness({
                 sessionName,
@@ -1688,42 +2494,37 @@ export class SessionTransport {
                 attachmentType: sessionMeta.attachmentType,
                 binding: observed?.binding,
             });
-            // Single state dispatch (B1 code-review fix): flattened so `unknown` ALWAYS attaches the advisory
-            // regardless of whether --dangerously-interact was passed — the deliberate-override branch no
-            // longer bypasses unknown handling.
-            if (readiness.state === "needs_input") {
-                // The POSITIVE picker/approval footgun. --dangerously-interact is the deliberate audited
-                // override (reason required + an auditable record persisted BEFORE the send; fail closed if it
-                // cannot be audited so an unauditable override never sends). Otherwise refuse with the
-                // proceed-path. This is the ONLY state --dangerously-interact bypasses.
-                if (opts?.dangerouslyInteract) {
-                    if (!opts.reason || opts.reason.trim().length === 0) {
-                        return {
-                            ok: false,
-                            sessionName,
-                            reason: "dangerously_interact_requires_reason",
-                            error: "--dangerously-interact requires --reason explaining why the prompt is being driven. No text was sent.",
-                        };
-                    }
-                    const audit = this.recordPromptOverride({
+            // Explicit interaction selects key input even when readiness cannot recognize the prompt.
+            // Only bypassing a positive picker requires a successful audit; other states already sent.
+            if (opts?.dangerouslyInteract) {
+                if (readiness.state === "needs_input" && (!opts.reason || opts.reason.trim().length === 0)) {
+                    return {
+                        ok: false,
                         sessionName,
-                        readiness,
-                        actorSession: opts.actorSession ?? null,
-                        overrideReason: opts.reason,
-                    });
-                    if (!audit.ok) {
-                        return {
-                            ok: false,
-                            sessionName,
-                            reason: "prompt_override_audit_unavailable",
-                            activity: readiness,
-                            error: `Refused: --dangerously-interact requires an auditable override record, which could not be persisted (${audit.reason}). No text was sent.`,
-                        };
-                    }
-                    // Audited answers use unbracketed input; a choice may submit itself.
-                    promptOverride = true;
+                        reason: "dangerously_interact_requires_reason",
+                        error: "--dangerously-interact requires --reason explaining why the prompt is being driven. No text was sent.",
+                    };
                 }
-                else {
+                const audit = this.recordPromptOverride({
+                    sessionName,
+                    readiness,
+                    actorSession: opts.actorSession ?? null,
+                    overrideReason: opts.reason ?? null,
+                });
+                if (!audit.ok && readiness.state === "needs_input") {
+                    return {
+                        ok: false,
+                        sessionName,
+                        reason: "prompt_override_audit_unavailable",
+                        activity: readiness,
+                        error: `Refused: --dangerously-interact requires an auditable override record, which could not be persisted (${audit.reason}). No text was sent.`,
+                    };
+                }
+                if (!audit.ok)
+                    sendAdvisory = "prompt-override: audit unavailable (" + audit.reason + "); input sent anyway.";
+            }
+            if (readiness.state === "needs_input") {
+                if (!promptOverride) {
                     return {
                         ok: false,
                         sessionName,
@@ -1741,7 +2542,7 @@ export class SessionTransport {
                 // surfaced without ever blocking communication. Hooks are advisory telemetry, not authority
                 // over whether agents can talk.
                 const linkDiagnosis = await this.diagnoseProducerLink(sessionName);
-                sendAdvisory = `producer-link: ${linkDiagnosis} — activity could not be determined (${readiness.reason}); sent anyway (telemetry is advisory).`;
+                sendAdvisory = [sendAdvisory, `producer-link: ${linkDiagnosis} — activity could not be determined (${readiness.reason}); sent anyway (telemetry is advisory).`].filter(Boolean).join(" ");
                 // fall through to the send below.
             }
             else if (readiness.state === "running") {
@@ -1750,11 +2551,15 @@ export class SessionTransport {
                 // attach it on the success result + PROCEED (mirrors the unknown inversion). --force is now a
                 // no-op here (the option is kept for back-compat). needs_input (positive picker) remains the
                 // ONLY hard refuse; unknown/stale/missing already proceed-with-advisory above.
-                sendAdvisory = `target pane appears mid-task; sent anyway (busy is advisory, not a block).`;
+                sendAdvisory = [sendAdvisory, "target pane appears mid-task; sent anyway (busy is advisory, not a block)."].filter(Boolean).join(" ");
                 // fall through to the send below.
             }
             // idle (or running/unknown — now advisory-and-proceed) → proceed to send.
         }
+        // transport.verify_input_box: a verified Claude Code or Codex send reports on input-box evidence. The
+        // setting is read only for those sends; everything else keeps today's path.
+        const inputBoxRuntime = opts?.verify && (runtime === "claude-code" || runtime === "codex") && this.inputBoxSettingOn()
+            ? runtime : null;
         if (opts?.verify) {
             const captureSeq = observed ? nextCaptureSeq++ : 0;
             try {
@@ -1776,55 +2581,116 @@ export class SessionTransport {
         if (opts?.stampISO) {
             text = appendDeliveredSegment(text, this.now().getTime() - Date.parse(opts.stampISO));
         }
+        // A caller that went away while this send waited: nothing has been written, so nothing ever is.
+        if (callerSignal(opts)?.aborted)
+            return observe({ ...callerCancelled(sessionName), ...(waitMode ? waitEvidence : {}) });
         // Recheck the selected recipient after readiness/capture awaits, at the input boundary.
         const targetFailure = await checkClaudeTarget();
         if (targetFailure)
             return observe(targetFailure);
+        const copyModeFailure = await leavePaneMode("No text was sent.");
+        if (copyModeFailure)
+            return observe({ ...copyModeFailure, ...(waitMode ? waitEvidence : {}) });
         // 3. Deliver ordinary messages as paste, audited prompt answers as key input.
         if (observed)
             observed.sentHash = hashSentText(text);
+        // The caller's cancellation is checked once more at the adapter's last step before the paste (after its buffer
+        // setup). A refusal there is proven pre-input and returns caller_cancelled; Enter below never checks it.
+        const cancel = callerSignal(opts);
+        if (cancel?.aborted)
+            return observe({ ...callerCancelled(sessionName), ...(waitMode ? waitEvidence : {}) });
+        const beforePaste = cancel ? () => { opts?.beforeWrite?.(); if (cancel.aborted)
+            throw new DeliveryGuardError(CALLER_CANCELLED, "caller cancelled before the paste"); } : opts?.beforeWrite;
+        // Set once the text write has been handed to the adapter: from then on a throw is not "nothing sent".
+        let writeIssued = false;
+        const tagIssued = (error) => {
+            if (writeIssued && error && typeof error === "object")
+                error.inputAttempted = true;
+            throw error;
+        };
         const textResult = await this.runStage("session_transport.send_text", () => {
             opts?.beforeWrite?.();
+            writeIssued = true;
             if (promptOverride)
-                return this.tmuxAdapter.sendText(sessionName, text, opts?.beforeWrite, { bracketed: false });
-            return opts?.beforeWrite ? this.tmuxAdapter.sendText(sessionName, text, opts.beforeWrite) : this.tmuxAdapter.sendText(sessionName, text);
-        }, (result) => result.ok ? "ok" : "failed");
+                return this.tmuxAdapter.sendText(sessionName, text, beforePaste, { bracketed: false });
+            return beforePaste ? this.tmuxAdapter.sendText(sessionName, text, beforePaste) : this.tmuxAdapter.sendText(sessionName, text);
+        }, (result) => result.ok ? "ok" : "failed").catch(tagIssued);
+        if (!textResult.ok && textResult.code === CALLER_CANCELLED && cancel?.aborted) {
+            return observe({ ...callerCancelled(sessionName), ...(waitMode ? waitEvidence : {}) });
+        }
         if (!textResult.ok) {
+            // A draft refusal is the guard holding the write before any input; it is not an attempted write.
+            const policyRefusal = typeof textResult.code === "string" && textResult.code.startsWith("draft_");
             return observe({
                 ok: false,
                 sessionName,
-                reason: "send_failed",
+                reason: policyRefusal ? textResult.code : "send_failed",
                 outcome: "failed",
+                ...(policyRefusal ? {} : { inputPhase: "attempted" }),
                 error: `Failed to send text to '${sessionName}': ${textResult.message}`,
-                ...(waitMode ? { sent: false, ...waitEvidence } : {}),
+                ...(waitMode || policyRefusal ? { sent: false, ...waitEvidence } : {}),
             });
         }
-        // 4. Wait 200ms (spike-proven delay)
-        await this.sleep(200);
-        if (runtime === "claude-code" && bindingChanged())
-            return observe(changedRecipient(true));
-        if (promptOverride) {
-            const pane = await this.runStage("session_transport.prompt_override_pre_submit_capture", () => this.tmuxAdapter.capturePaneContent(sessionName, 50)).catch(() => null);
+        try {
+            opts?.onInputEffect?.("pasted");
+        }
+        catch { /* Observation cannot change a completed paste. */ }
+        // From the successful paste to Enter the text may sit in the seat's input. Any throw in this span is
+        // tagged inputWritten, so no caller reports it as unsent; a step added here later stays covered.
+        let boxBefore = null;
+        let submitResult;
+        let enterIssued = false; // set as the Enter key is handed to the adapter
+        try {
+            // 4. Wait 200ms (spike-proven delay)
+            await this.sleep(200);
+            // With transport.verify_input_box on, one bounded read of the input box and its pane process before
+            // Enter (a 500 ms budget after the 200 ms wait). It only reports: nothing here decides whether Enter is sent.
+            // The seat is read from the existing --verify capture taken before the paste (the whole screen); no new read.
+            if (inputBoxRuntime && !promptOverride) {
+                const read = await this.readWithinDeadline("session_transport.input_box_capture", () => Promise.all([
+                    this.tmuxAdapter.getPanePid(sessionName).catch(() => null),
+                    this.tmuxAdapter.capturePaneContent(sessionName, 30).catch(() => null),
+                ]));
+                boxBefore = { seat: readSeatBeforePaste(preVerifyContent, inputBoxRuntime, sessionName),
+                    reading: readInputBox(read?.[1] ?? null, inputBoxRuntime, text), pid: read?.[0] ?? null, pane: read?.[1] ?? null };
+            }
             if (runtime === "claude-code" && bindingChanged())
                 return observe(changedRecipient(true));
-            if (!promptAnswerStaged(pane, text, runtime)) {
-                return observe({ ok: true, sessionName, sent: true, verified: false, outcome: "rendered-unconfirmed", promptInteraction: "unverified",
-                    warning: "prompt-override: answer sent as unbracketed input; submission unverified. No trailing Enter: the complete answer is not visibly staged (it may have been consumed, the prompt changed, or observation is unavailable)." });
+            if (promptOverride) {
+                const pane = await this.runStage("session_transport.prompt_override_pre_submit_capture", () => this.tmuxAdapter.capturePaneContent(sessionName, 50)).catch(() => null);
+                if (runtime === "claude-code" && bindingChanged())
+                    return observe(changedRecipient(true));
+                if (!promptAnswerStaged(pane, text, runtime)) {
+                    return observe({ ok: true, sessionName, sent: true, verified: false, outcome: "rendered-unconfirmed", promptInteraction: "unverified",
+                        ...(inputBoxRuntime ? { inputBox: INPUT_BOX_UNCHECKED } : {}),
+                        warning: [sendAdvisory, "prompt-override: answer sent as unbracketed input; submission unverified. No trailing Enter: the complete answer is not visibly staged (it may have been consumed, the prompt changed, or observation is unavailable)."].filter(Boolean).join(" ") });
+                }
+                sendAdvisory = [sendAdvisory, "prompt-override: answer sent as unbracketed input; Enter submitted the complete still-staged answer."].filter(Boolean).join(" ");
+            }
+            // 5. Submit (Enter)
+            submitResult = await this.runStage("session_transport.submit", () => { opts?.beforeWrite?.(); enterIssued = true; return opts?.beforeWrite ? this.tmuxAdapter.sendKeys(sessionName, ["Enter"], opts.beforeWrite) : this.tmuxAdapter.sendKeys(sessionName, ["Enter"]); }, (result) => result.ok ? "ok" : "failed");
+            if (!submitResult.ok) {
+                const policyRefusal = typeof submitResult.code === "string" && submitResult.code.startsWith("draft_");
+                return observe({
+                    ok: false,
+                    sessionName,
+                    reason: policyRefusal ? submitResult.code : "submit_failed",
+                    outcome: "failed",
+                    inputPhase: "written",
+                    error: `Text is in '${sessionName}', but the Enter reported a failure, so the submission outcome is unconfirmed. The agent may need manual attention.`,
+                    ...(waitMode || policyRefusal ? { sent: true, ...waitEvidence } : {}),
+                });
             }
-            sendAdvisory = "prompt-override: answer sent as unbracketed input; Enter submitted the complete still-staged answer.";
         }
-        // 5. Submit (Enter)
-        const submitResult = await this.runStage("session_transport.submit", () => { opts?.beforeWrite?.(); return opts?.beforeWrite ? this.tmuxAdapter.sendKeys(sessionName, ["Enter"], opts.beforeWrite) : this.tmuxAdapter.sendKeys(sessionName, ["Enter"]); }, (result) => result.ok ? "ok" : "failed");
-        if (!submitResult.ok) {
-            return observe({
-                ok: false,
-                sessionName,
-                reason: "submit_failed",
-                outcome: "failed",
-                error: `Text is visible in '${sessionName}' but was not submitted (Enter failed). The agent may need manual attention.`,
-                ...(waitMode ? { sent: true, ...waitEvidence } : {}),
-            });
+        catch (error) {
+            if (error && typeof error === "object")
+                Object.assign(error, { inputWritten: true, enterAttempted: enterIssued });
+            throw error;
         }
+        try {
+            opts?.onInputEffect?.("submitted");
+        }
+        catch { /* Observation cannot change a completed submission. */ }
         const interaction = promptOverride ? { promptInteraction: "enter-sent" } : {};
         // 6. Verify if requested. At this point text + Enter BOTH succeeded, so the
         // message LANDED; the capture only re-confirms the render. Not re-confirming
@@ -1842,23 +2708,77 @@ export class SessionTransport {
                 // its original prefix-count verification even while a command is running.
                 const terminal = runtime === "terminal";
                 const { snippet, envelope } = terminal ? { snippet: text.slice(0, 40), envelope: false } : verificationSnippet(text);
+                // Only Codex gains »; all other runtimes keep the existing boundaries.
+                const promptClass = runtime === "codex" ? COMPOSER_PROMPT_CLASS : "❯›";
                 const transcript = terminal ? (pane) => pane ?? ""
-                    : envelope ? verificationTranscript : (pane) => normalizeVerificationText(verificationTranscript(pane));
-                const count = envelope ? countEnvelopeOccurrences : countOccurrences;
+                    : (pane) => envelope ? verificationTranscript(pane, promptClass)
+                        : normalizeVerificationText(verificationTranscript(pane, promptClass));
+                const count = envelope ? (pane, expected) => countEnvelopeOccurrences(pane, expected, promptClass) : countOccurrences;
                 const preCount = count(transcript(preVerifyContent), snippet);
                 const postCount = count(transcript(content), snippet);
-                const verified = postCount > preCount;
-                return observe({ ok: true, sessionName, ...interaction, verified, outcome: verified ? "delivered" : "rendered-unconfirmed", ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
+                // An audited prompt answer reads no box (no extra read is added for it), so it says so: unchecked, and
+                // unconfirmed; it never falls back to the count below.
+                const inputBox = boxBefore && inputBoxRuntime
+                    ? await this.inputBoxEvidence(sessionName, sessionMeta, boxBefore, readInputBox(content, inputBoxRuntime, text, boxBefore.pane))
+                    : inputBoxRuntime && promptOverride ? INPUT_BOX_UNCHECKED : undefined;
+                // With the setting on, only a seat proven idle before the paste and input-box evidence verify: exact before
+                // Enter, empty after, same process. A not-idle or unknown seat always reads unconfirmed.
+                const verified = inputBoxRuntime
+                    ? inputBox?.seat === "idle" && inputBox.before === "exact" && inputBox.after === "empty" && inputBox.sameProcess
+                    : postCount > preCount;
+                return observe({ ok: true, sessionName, ...interaction, verified, outcome: verified ? "delivered" : "rendered-unconfirmed", ...(inputBox ? { inputBox } : {}), ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
             }
             catch {
                 if (observed && observed.post.state === "not_reached") {
                     observed.post = { state: "unavailable", cause: "capture_error", capturedAt: this.now().toISOString(), captureSeq };
                 }
-                return observe({ ok: true, sessionName, ...interaction, verified: false, outcome: "rendered-unconfirmed", ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
+                const inputBox = boxBefore
+                    ? { seat: boxBefore.seat, before: boxBefore.reading, after: "unavailable", sameProcess: false }
+                    : inputBoxRuntime && promptOverride ? INPUT_BOX_UNCHECKED : undefined;
+                return observe({ ok: true, sessionName, ...interaction, verified: false, outcome: "rendered-unconfirmed", ...(inputBox ? { inputBox } : {}), ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
             }
         }
         return observe({ ok: true, sessionName, ...interaction, ...(sendAdvisory ? { warning: sendAdvisory } : {}), ...(waitMode ? { sent: true, ...waitEvidence } : {}) });
     }
+    inputBoxSettingOn() {
+        try {
+            return this.verifyInputBox?.() === true;
+        }
+        catch {
+            return false;
+        }
+    }
+    /** One input-box read, timed by the slow-op recorder and raced against the deadline. Null on timeout or
+     *  error; an abandoned read is ignored. A read never decides whether Enter is sent. */
+    async readWithinDeadline(site, read) {
+        let timer;
+        try {
+            const pending = this.runStage(site, read);
+            pending.catch(() => undefined);
+            return await Promise.race([
+                pending,
+                new Promise((resolve) => { timer = setTimeout(() => resolve(null), INPUT_BOX_READ_DEADLINE_MS); }),
+            ]);
+        }
+        catch {
+            return null;
+        }
+        finally {
+            if (timer !== undefined)
+                clearTimeout(timer);
+        }
+    }
+    /** After the post-Enter capture: the same pane process (pid read before Enter and now) and the same binding. */
+    async inputBoxEvidence(sessionName, meta, before, after) {
+        const pid = await this.readWithinDeadline("session_transport.input_box_pane_pid", () => this.tmuxAdapter.getPanePid(sessionName));
+        let sameBinding = false;
+        try {
+            const now = this.getSessionMeta(sessionName);
+            sameBinding = now.nodeId === meta.nodeId && now.pane === meta.pane && now.occupant === meta.occupant;
+        }
+        catch { /* unknown binding is not the same binding */ }
+        return { seat: before.seat, before: before.reading, after, sameProcess: before.pid !== null && pid !== null && pid === before.pid && sameBinding };
+    }
     runStage(site, fn, classify) {
         return this.slowOpRecorder?.runStage
             ? this.slowOpRecorder.runStage(site, fn, classify)
@@ -1902,12 +2822,15 @@ export class SessionTransport {
                     activity, waitedMs: input.timeoutMs, attempts,
                 };
         };
+        const cancelReason = input.cancelledBy === "caller" ? CALLER_CANCELLED : "preparation_cancelled";
         const cancelled = () => ({
             ok: false,
-            reason: "preparation_cancelled",
-            error: "Managed preparation ended; no compact authorized.",
+            reason: cancelReason,
+            error: input.cancelledBy === "caller"
+                ? "The request was cancelled while it waited for the seat to be idle. No text was sent, and none will be."
+                : "Managed preparation ended; no compact authorized.",
             activity: last ?? {
-                state: "unknown", reason: "preparation_cancelled", evidenceSource: "pane_heuristic",
+                state: "unknown", reason: cancelReason, evidenceSource: "pane_heuristic",
                 sampledAt: this.now().toISOString(), evidence: null,
             },
             waitedMs: Math.max(0, Math.min(input.timeoutMs, input.timeoutMs - (deadline - Date.now()))),
@@ -1919,7 +2842,9 @@ export class SessionTransport {
             if (attempts > 0 && Date.now() > deadline)
                 return expire();
             attempts++;
-            const activity = await this.observeReadinessWithin(input, deadline - Date.now());
+            // A caller's cancellation also ends a pending observation (the abandoned read is ignored, never delivered on).
+            // Managed preparation's wait keeps its own behaviour: it doesn't race the read against its signal.
+            const activity = await this.observeReadinessWithin(input, deadline - Date.now(), input.cancelledBy === "caller" ? input.signal : undefined);
             if (input.signal?.aborted)
                 return cancelled();
             if (activity === null || Date.now() > deadline)
@@ -1945,21 +2870,28 @@ export class SessionTransport {
             await this.sleep(Math.min(this.waitForIdlePollMs, remainingMs));
         }
     }
-    /** One readiness observation, raced against the time left before the wait's deadline. Null
-     *  when the deadline wins; the abandoned observation is ignored, never delivered on. */
-    async observeReadinessWithin(input, remainingMs) {
+    /** One readiness observation, raced against the time left before the wait's deadline and, when given, the
+     *  caller's cancellation. Null when the deadline or the cancellation wins; the abandoned observation is ignored,
+     *  never delivered on. */
+    async observeReadinessWithin(input, remainingMs, cancel) {
+        if (cancel?.aborted)
+            return null;
         const observation = this.classifySendReadiness(input);
         observation.catch(() => undefined);
         let timer;
+        let onAbort;
         try {
             return await Promise.race([
                 observation,
                 new Promise((resolve) => { timer = setTimeout(() => resolve(null), Math.max(0, remainingMs)); }),
+                ...(cancel ? [new Promise((resolve) => { onAbort = () => resolve(null); cancel.addEventListener("abort", onAbort, { once: true }); })] : []),
             ]);
         }
         finally {
             if (timer !== undefined)
                 clearTimeout(timer);
+            if (cancel && onAbort)
+                cancel.removeEventListener("abort", onAbort);
         }
     }
     async claudeDeliveryObservation(sessionName, pane, resumeToken, rotation = null) {
@@ -2015,10 +2947,16 @@ export class SessionTransport {
     }
     async classifySendReadiness(input) {
         const now = this.now();
+        const composerSnapshot = this.tmuxAdapter.deliveryGuard?.needsInputCheck(input.sessionName)
+            ? () => this.tmuxAdapter.captureComposerSnapshot(input.binding?.pane ?? input.sessionName) : undefined;
         const hookActivity = this.agentActivityStore?.getLatestForNode({
             sessionName: input.sessionName,
             now,
         });
+        const permissionPending = latestHookPermissionPending(hookActivity, input.runtime);
+        if (hookActivity && permissionPending && this.hookFreshForSend(hookActivity, now)) {
+            return { ...hookActivity, state: "needs_input" };
+        }
         // Pane-only readiness never lets a hook authorise a send, but a fresh hook showing work or a
         // waiting person still refuses one, as it does for every other send.
         if (input.readinessFromPaneOnly &&
@@ -2035,7 +2973,9 @@ export class SessionTransport {
         if (!input.readinessFromPaneOnly &&
             hookActivity &&
             hookActivity.evidenceSource === "runtime_hook" &&
-            hookActivity.stale !== true) {
+            hookActivity.stale !== true &&
+            hookActivity.reason !== "permission_request_pending" &&
+            hookActivity.reason !== "permission_prompt_cleared") {
             // Fresh hook (within the 15s send window): authoritative for any state.
             if (this.hookFreshForSend(hookActivity, now)) {
                 return hookActivity;
@@ -2055,6 +2995,7 @@ export class SessionTransport {
                 // vetoes (→ refuse); an unknown pane (the flaky-Codex case this trust
                 // exists for) or a clean idle pane does NOT veto → trust the stale hook.
                 const paneVeto = await probeSessionActivity({
+                    composerSnapshot,
                     sessionName: input.sessionName,
                     runtime: input.runtime,
                     attachmentType: input.attachmentType,
@@ -2070,6 +3011,7 @@ export class SessionTransport {
             }
         }
         const probe = await probeSessionActivity({
+            composerSnapshot,
             sessionName: input.sessionName,
             runtime: input.runtime,
             attachmentType: input.attachmentType,
@@ -2093,6 +3035,9 @@ export class SessionTransport {
             (hookActivity.state === "running" || hookActivity.state === "needs_input")) {
             return hookActivity;
         }
+        if (probe.state === "unknown" && permissionPending) {
+            return { ...probe, state: "needs_input", reason: "permission_request_unverified" };
+        }
         // A latest hook saying the seat waits on a person (approval, picker or elicitation) stays positive
         // picker evidence past the send window, and past the store's freshness window: nothing newer was
         // recorded, so nothing answered it. The pane alone can miss a picker it has no signature for (a
@@ -2219,10 +3164,9 @@ export class SessionTransport {
         }
         return `a recent activity hook exists but the live pane probe could not confirm idle (possible identity mismatch between the seat env, the DB, and the stored payload)`;
     }
-    // OPR.0.4.1.10 — persist the audit record for a --dangerously-interact prompt override. Audit-all-
-    // or-nothing: if there is no eventBus, the target rig/node can't be resolved, or the event cannot be
-    // persisted, return !ok so the caller fails closed and does NOT send. Payload keeps the caller's
-    // overrideReason distinct from the classifier's detectedReason/evidenceSource (not overloaded).
+    // Record actor/reason with the actual readiness, never a fabricated prompt classification.
+    // Report an unavailable sink to the caller: a positive-picker override still fails closed,
+    // while other readiness states keep their existing accepted-send behavior with an advisory.
     recordPromptOverride(input) {
         if (!this.eventBus)
             return { ok: false, reason: "audit_unconfigured" };
@@ -2247,6 +3191,9 @@ export class SessionTransport {
             return { ok: false, reason: "audit_persist_failed" };
         }
     }
+    /** `inputBox`: also describe a Claude Code or Codex seat's live input box (three more tmux reads), for callers that
+     *  use it: the capture route asks when its request does (`rig capture`, the MCP tool). `inputBoxBudget` is the time
+     *  those reads may still take, shared across a fan-out; a single capture gets its own CAPTURE_INPUT_BOX_DEADLINE_MS. */
     async capture(sessionName, opts) {
         const sessionMeta = this.getSessionMeta(sessionName);
         if (sessionMeta.attachmentType === "external_cli") {
@@ -2299,7 +3246,48 @@ export class SessionTransport {
                 error: `Could not capture pane content for '${sessionName}'.`,
             };
         }
-        return { ok: true, sessionName, content, lines };
+        await this.reconcileStartupReadiness(sessionName).catch(() => { });
+        const runtime = sessionMeta.runtime;
+        const inputBox = opts?.inputBox && (runtime === "claude-code" || runtime === "codex")
+            ? await this.captureInputBox(sessionName, runtime, opts.inputBoxBudget ?? { remainingMs: CAPTURE_INPUT_BOX_DEADLINE_MS })
+            : undefined;
+        return { ok: true, sessionName, content, lines, ...(inputBox ? { inputBox } : {}) };
+    }
+    /** The input box, or unknown when its reads don't finish within the budget's remaining time (or none is left): the
+     *  pane text is already in hand, so a slow read never holds the capture. The time spent comes off the budget. A read
+     *  still pending then settles on its own, unused. */
+    async captureInputBox(sessionName, runtime, budget) {
+        if (budget.remainingMs <= 0)
+            return annotateInputBox(null, null, runtime, { budgetSpent: true });
+        const started = this.now().getTime();
+        let timer;
+        const late = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(annotateInputBox(null, null, runtime, { timedOut: true })), budget.remainingMs);
+        });
+        try {
+            return await Promise.race([this.readInputBoxAnnotation(sessionName, runtime), late]);
+        }
+        finally {
+            clearTimeout(timer);
+            budget.remainingMs -= this.now().getTime() - started;
+        }
+    }
+    /** One styled read of the visible screen with the cursor read before and after it: a cursor that moved, or a pane
+     *  that resized, in between is reported as moved; when only one read succeeds, its reading is passed on as seen once.
+     *  Never throws. */
+    async readInputBoxAnnotation(sessionName, runtime) {
+        try {
+            const before = await this.tmuxAdapter.getPaneCursorPosition(sessionName);
+            const screen = await this.tmuxAdapter.capturePaneContent(sessionName, 0, { escapeSequences: true });
+            const after = await this.tmuxAdapter.getPaneCursorPosition(sessionName);
+            const steady = before && after && before.x === after.x && before.y === after.y
+                && before.width === after.width && before.height === after.height ? after : null;
+            const cursorSeenOnce = (before === null) !== (after === null) ? before ?? after : null;
+            return annotateInputBox(screen, steady, runtime, { cursorMoved: before !== null && after !== null && steady === null, cursorSeenOnce });
+        }
+        catch {
+            return annotateInputBox(null, null, runtime);
+        }
     }
     async broadcast(target, text, opts) {
         const resolved = await this.resolveSessions(target);
@@ -2352,5 +3340,295 @@ export class SessionTransport {
             results,
         };
     }
+    getReconciliationSnapshot(sessionName) {
+        return this.db.prepare(`
+      SELECT n.id as node_id, r.id as rig_id, s.id as session_id, s.session_name, n.runtime, n.cwd,
+             s.startup_status, s.status as session_status, s.startup_completed_at,
+             s.resume_type, s.resume_token,
+             b.tmux_session as binding_session, b.tmux_window as binding_window, b.tmux_pane as binding_pane,
+             b.updated_at as binding_updated_at,
+             (SELECT generation_uuid FROM occupant_tenures WHERE node_id = n.id ORDER BY generation_ordinal DESC LIMIT 1) as occupant_generation,
+             (SELECT id FROM sessions WHERE node_id = n.id ORDER BY id DESC LIMIT 1) as latest_session_id,
+             (SELECT MAX(seq) FROM events e WHERE e.node_id = n.id AND e.type IN ('node.startup_pending', 'node.startup_ready', 'node.startup_failed')) as startup_event_seq
+      FROM sessions s
+      JOIN nodes n ON n.id = s.node_id
+      JOIN rigs r ON r.id = n.rig_id
+      LEFT JOIN bindings b ON b.node_id = n.id
+      WHERE s.session_name = ?
+      ORDER BY s.id DESC LIMIT 1
+    `).get(sessionName);
+    }
+    /**
+     * Reconcile non-ready startup state after successful session interaction (Refs #7).
+     *
+     * If an active session is in a non-ready startup state (`failed` or `attention_required`),
+     * re-check readiness via the runtime adapter with currentness verification and atomic commit.
+     */
+    async reconcileStartupReadiness(sessionName) {
+        const existing = this.inFlightReconciliations.get(sessionName);
+        if (existing)
+            return existing;
+        const promise = this.doReconcileStartupReadiness(sessionName);
+        this.inFlightReconciliations.set(sessionName, promise);
+        try {
+            return await promise;
+        }
+        finally {
+            this.inFlightReconciliations.delete(sessionName);
+        }
+    }
+    async doReconcileStartupReadiness(sessionName) {
+        const snapshot = this.getReconciliationSnapshot(sessionName);
+        if (!snapshot)
+            return false;
+        if (snapshot.startup_status !== "failed" && snapshot.startup_status !== "attention_required")
+            return false;
+        if (snapshot.session_status !== "running")
+            return false;
+        if (snapshot.session_id !== snapshot.latest_session_id)
+            return false;
+        if (!isRecoverableStartupFailure(this.db, snapshot.node_id, snapshot.session_id))
+            return false;
+        const checker = this.runtimeAdapters[snapshot.runtime];
+        if (!checker?.checkReady)
+            return false;
+        const hasClaudeIdentityWork = (nodeId, sessionId, runtime) => {
+            if (runtime !== "claude-code")
+                return false;
+            const failedEvent = getLatestStartupFailedEvent(this.db, nodeId, sessionId);
+            if (!failedEvent || failedEvent.requestedResumeToken === undefined || failedEvent.requestedResumeType === undefined) {
+                return true;
+            }
+            return hasClaudeResumeIdentityWork(this.sessionRegistry, sessionId, runtime, failedEvent.requestedResumeToken, failedEvent.requestedResumeType);
+        };
+        const probeBinding = {
+            id: `session-transport:${snapshot.session_id}`,
+            nodeId: snapshot.node_id,
+            attachmentType: "tmux",
+            tmuxSession: sessionName,
+            tmuxWindow: null,
+            tmuxPane: null,
+            cmuxWorkspace: null,
+            cmuxSurface: null,
+            updatedAt: "",
+            cwd: snapshot.cwd ?? "",
+        };
+        let timeoutTimer;
+        const timeoutPromise = new Promise((_, reject) => {
+            timeoutTimer = setTimeout(() => reject(new Error("readiness probe timeout")), 5000);
+        });
+        let readiness;
+        try {
+            readiness = await Promise.race([checker.checkReady(probeBinding), timeoutPromise]);
+        }
+        catch {
+            return false;
+        }
+        finally {
+            if (timeoutTimer)
+                clearTimeout(timeoutTimer);
+        }
+        let emittedReady = false;
+        this.db.transaction(() => {
+            const current = this.getReconciliationSnapshot(sessionName);
+            if (!current || JSON.stringify(current) !== JSON.stringify(snapshot))
+                return;
+            if (!isRecoverableStartupFailure(this.db, snapshot.node_id, snapshot.session_id))
+                return;
+            const currentIdentityWork = hasClaudeIdentityWork(current.node_id, current.session_id, current.runtime);
+            if (readiness.ready) {
+                if (currentIdentityWork) {
+                    this.db.prepare(`
+            UPDATE sessions
+            SET startup_status = 'attention_required'
+            WHERE id = ? AND startup_status = 'failed'
+          `).run(snapshot.session_id);
+                    return;
+                }
+                const result = this.db.prepare(`
+          UPDATE sessions
+          SET startup_status = 'ready',
+              startup_completed_at = ?
+          WHERE id = ? AND startup_status IN ('failed', 'attention_required')
+        `).run(new Date().toISOString(), snapshot.session_id);
+                if (result.changes > 0) {
+                    emittedReady = true;
+                }
+                return;
+            }
+            if (isAttentionRequiredReadinessCode(readiness.code)) {
+                this.db.prepare(`
+          UPDATE sessions
+          SET startup_status = 'attention_required'
+          WHERE id = ? AND startup_status = 'failed'
+        `).run(snapshot.session_id);
+            }
+        }).immediate();
+        if (emittedReady && this.eventBus) {
+            this.eventBus.emit({
+                type: "node.startup_ready",
+                rigId: snapshot.rig_id,
+                nodeId: snapshot.node_id,
+                previousStatus: snapshot.startup_status,
+            });
+            return true;
+        }
+        return false;
+    }
+}
+const INPUT_CONTINUATION_COLUMN = 2; // Claude Code and Codex indent an input's later rows by two cells
+// How long a capture's input-box reads may take in all before the box reports unknown: one seat's three reads, or a
+// whole fan-out's (the send path's INPUT_BOX_READ_DEADLINE_MS bounds one read each).
+export const CAPTURE_INPUT_BOX_DEADLINE_MS = 1_000;
+// Claude Code's input frame rule, as findClaudeComposer and the composer-boundary reader match it (a label may sit in it).
+const CLAUDE_FRAME_RULE = /^─{3,}(?: .+ ─+)?$/;
+/** The input box's rows on the screen: Claude Code's prompt row inside its frame (the opening rule directly above it,
+ *  through the row before the closing rule), or Codex's box as codexInputBox reads it. A committed prompt row in the
+ *  transcript, or a prompt-looking line in output, has no opening rule above it. Null when no input box is recognized
+ *  (a selector, a menu instead of a box, busy output with no box, another layout). */
+function inputBoxRows(lines, runtime) {
+    if (runtime === "codex") {
+        const box = codexInputBox(lines.join("\n"));
+        if (!box)
+            return null;
+        return { first: box.inputAt, last: box.inputAt + Math.max(box.rows.length, 1) - 1, empty: box.text === "" };
+    }
+    const promptClass = composerPromptClassForRuntime("claude-code");
+    const first = findComposerInputLineIndex(lines, promptClass);
+    if (first < 1 || composerNumberedChoicePattern(promptClass).test(lines[first].trimStart()))
+        return null;
+    // A rule at the prompt's own indent: an input's later rows are indented, so a rule typed inside it never closes it.
+    const indent = /^[ \t]*/.exec(lines[first])[0];
+    const frame = (line) => line.startsWith(indent) && CLAUDE_FRAME_RULE.test(line.slice(indent.length).trimEnd());
+    if (!frame(lines[first - 1]))
+        return null;
+    let close = first + 1;
+    while (close < lines.length && !frame(lines[close]))
+        close++;
+    return close < lines.length ? { first, last: close - 1 } : null;
+}
+export function annotateInputBox(styledScreen, cursor, runtime, opts = {}) {
+    const harness = runtime === "codex" ? "Codex" : "Claude Code";
+    const result = (status, confidence, hint, input = null, suggestion = null, evidence = []) => ({ status, confidence, cursor, input, suggestion, evidence, hint });
+    const budget = `${CAPTURE_INPUT_BOX_DEADLINE_MS / 1000} s`;
+    if (opts.timedOut) {
+        return result("unknown", "unknown", `The input box's reads didn't finish within this capture's ${budget} budget, so it wasn't checked.`, null, null, ["input box reads timed out"]);
+    }
+    if (opts.budgetSpent) {
+        return result("unknown", "unknown", `The input box wasn't read: this capture's ${budget} budget for input-box reads was spent on earlier seats.`, null, null, ["input box budget spent"]);
+    }
+    if (!styledScreen?.trim())
+        return result("unknown", "unknown", "The screen couldn't be read, so the input box wasn't checked.");
+    const cells = styledLines(styledScreen);
+    const lines = cells.map((row) => row.map((cell) => cell.ch).join(""));
+    const box = inputBoxRows(lines, runtime);
+    if (!box)
+        return result("no-input-box", "unknown", `No ${harness} input box was recognized on the screen.`);
+    // Each box row's text cells with their screen columns. The first row's text starts after the prompt glyph and its
+    // space, a later row's after its two-cell indent.
+    const rows = [];
+    for (let row = box.first; row <= box.last; row++) {
+        let col = 0;
+        const placed = (cells[row] ?? []).map((cell) => { const at = col; col += stringWidth(cell.ch); return { ...cell, col: at }; });
+        const glyphAt = row === box.first ? placed.findIndex((cell) => cell.ch === "❯" || cell.ch === "›") : -1;
+        const startCol = row === box.first ? (glyphAt >= 0 ? placed[glyphAt].col + 2 : INPUT_CONTINUATION_COLUMN) : INPUT_CONTINUATION_COLUMN;
+        let text = placed.filter((cell) => cell.col >= startCol);
+        while (text.length && !text[text.length - 1].ch.trim())
+            text = text.slice(0, -1);
+        rows.push({ row, cells: text });
+    }
+    const startCol = rows[0].cells[0]?.col ?? (lines[box.first].search(/[❯›]/) + 2);
+    const spanOf = (from, to) => ({
+        startRow: from.row, startCol: from.col, endRow: to.row, endCol: to.col,
+        text: rows.filter((r) => r.row >= from.row && r.row <= to.row)
+            .map((r) => r.cells.filter((cell) => (r.row > from.row || cell.col >= from.col) && (r.row < to.row || cell.col < to.col)).map((cell) => cell.ch).join(""))
+            .join("\n"),
+    });
+    const textRows = rows.filter((r) => r.cells.length > 0);
+    const outsideBox = (at) => at.y < box.first || at.y > box.last;
+    // A cursor seen outside the box by the one read that worked still contradicts the box being the live one.
+    const seenOutside = cursor === null && !opts.cursorMoved && opts.cursorSeenOnce != null && outsideBox(opts.cursorSeenOnce);
+    const seenOutsideEvidence = "cursor outside the input box (the other cursor read failed)";
+    if (box.empty || textRows.length === 0) {
+        // Only a steady cursor in the box shows it's the live one: an empty frame drawn in output has the cursor below it, a
+        // moved cursor means the box may have changed, and a missing cursor shows nothing either way.
+        if (cursor !== null && !outsideBox(cursor))
+            return result("empty", "high", "The input box is empty.", null, null, ["no text in the input box"]);
+        if (cursor !== null || seenOutside) {
+            return result("unknown", "unknown", `An empty ${harness} input box was recognized, but the cursor is outside it, so it may not be the live box.`, null, null, ["no text in the input box", cursor !== null ? "cursor outside the input box" : seenOutsideEvidence]);
+        }
+        if (opts.cursorMoved) {
+            return result("unknown", "unknown", `The ${harness} input box read empty, but the cursor moved during the capture, so it may have changed.`, null, null, ["no text in the input box", "cursor moved during the capture"]);
+        }
+        return result("unknown", "unknown", `An empty ${harness} input box was recognized, but the cursor couldn't be read, so it may not be the live box.`, null, null, ["no text in the input box", "cursor unavailable"]);
+    }
+    const lastRow = textRows[textRows.length - 1];
+    const lastCell = lastRow.cells[lastRow.cells.length - 1];
+    const end = { row: lastRow.row, col: lastCell.col + stringWidth(lastCell.ch) };
+    const input = spanOf({ row: box.first, col: startCol }, end);
+    const quote = (text) => {
+        const flat = text.replace(/\s*\n\s*/g, " ").trim();
+        return `"${flat.length > 60 ? `${flat.slice(0, 57)}...` : flat}"`;
+    };
+    const styled = /\x1b\[/.test(styledScreen);
+    const textCells = rows.flatMap((r) => r.cells.filter((cell) => cell.ch.trim()).map((cell) => ({ ...cell, row: r.row })));
+    const allFaint = styled && textCells.every((cell) => cell.faint);
+    const noneFaint = styled && textCells.every((cell) => !cell.faint);
+    // Claude Code's `Try "…"` words are a person's possible words too, so they count only where there's no styling to go
+    // on, and at most as a possible (medium) suggestion. With styling, the faint text decides.
+    const tryShape = runtime === "claude-code" && CLAUDE_TRY_SUGGESTION.test(input.text.replace(/\s+/g, ""));
+    const trySuggestion = tryShape && !styled;
+    const evidence = [];
+    if (tryShape)
+        evidence.push("Claude Code's Try \"...\" words");
+    evidence.push(!styled ? "no styling in the capture" : allFaint ? "text drawn faint" : noneFaint ? "text not faint" : "part of the text drawn faint");
+    const inBox = cursor !== null && cursor.y >= box.first && cursor.y <= box.last;
+    const atStart = inBox && cursor.y === box.first && cursor.x === startCol;
+    const atEnd = inBox && cursor.y === end.row && cursor.x === end.col;
+    if (cursor === null)
+        evidence.unshift(opts.cursorMoved ? "cursor moved during the capture" : seenOutside ? seenOutsideEvidence : "cursor unavailable");
+    else
+        evidence.unshift(!inBox ? "cursor outside the input box" : atStart ? "cursor at the input's start" : atEnd ? "cursor after the text" : "cursor inside the text");
+    const why = evidence.join("; ");
+    const likelySuggestion = (confidence) => result("likely-suggestion", confidence, confidence === "high"
+        ? `The input box shows ${quote(input.text)}, likely a ${harness} suggestion (${why}), not something the person typed: it isn't their intent, a draft or a staged command.`
+        : `The input box shows ${quote(input.text)}, possibly a ${harness} suggestion (${why}; medium confidence): don't take it as the person's intent, and don't assume it isn't their draft.`, input, input, evidence);
+    const typed = (confidence) => result("typed", confidence, `The input box holds ${quote(input.text)}, likely typed by the person and not yet sent (${why}).`, input, null, evidence);
+    const unknown = () => result("unknown", "unknown", `The input box shows ${quote(input.text)}; whether the person typed it or it's a ${harness} suggestion is unknown (${why}).`, input, null, evidence);
+    // A moved cursor or one seen outside the box contradicts any reading; only an unavailable cursor leaves the styling or
+    // the Try words to go on, at medium confidence.
+    if (cursor === null || !inBox) {
+        if (cursor === null && !opts.cursorMoved && !seenOutside && (allFaint || trySuggestion))
+            return likelySuggestion("medium");
+        return unknown();
+    }
+    if (atStart) {
+        if (allFaint)
+            return likelySuggestion("high");
+        if (!styled)
+            return likelySuggestion("medium");
+        // Claude Code draws its suggestion faint (Codex draws its placeholder faint too); unfaint text with the cursor at its
+        // start may be a draft the person moved the cursor back through, in either harness.
+        return unknown();
+    }
+    if (atEnd) {
+        if (noneFaint)
+            return typed("high");
+        if (!styled)
+            return typed("medium");
+        return unknown();
+    }
+    // The cursor is inside the text: the person moved it, or typed a prefix and the harness suggests the rest after it.
+    const split = textCells.findIndex((cell) => cell.row > cursor.y || (cell.row === cursor.y && cell.col >= cursor.x));
+    const before = split < 0 ? textCells : textCells.slice(0, split);
+    const after = split < 0 ? [] : textCells.slice(split);
+    if (styled && before.length > 0 && after.length > 0 && before.every((cell) => !cell.faint) && after.every((cell) => cell.faint)) {
+        const suggestion = spanOf({ row: cursor.y, col: cursor.x }, end);
+        const typedPart = spanOf({ row: box.first, col: startCol }, { row: cursor.y, col: cursor.x });
+        return result("typed-with-suggestion", "high", `The input box holds ${quote(typedPart.text)}, likely typed by the person, then ${quote(suggestion.text)}, likely a ${harness} suggestion after the cursor (${why}; the text after the cursor is faint): the suggestion isn't their intent.`, input, suggestion, [...evidence, "the text after the cursor is faint"]);
+    }
+    if (noneFaint)
+        return typed("medium");
+    return unknown();
 }
 //# sourceMappingURL=session-transport.js.map