@scotthuang/agent-knock-knock 0.15.0 → 0.16.1

package/docs/bidirectional-agent-protocol.md

@@ -38,7 +38,7 @@ compatibility; it can be `unknown` while the screen is visibly idle because
 native identity or durable activity is ambiguous. These axes are diagnostic
 and never replace a current `available_actions` entry as mutation authority.
 
-Human-friendly selectors such as `only`, `codex`, `claude`, and `@short-ref` remain slash-command discovery inputs. The v31 structured model contract carries semantic IDs only and does not expose selectors or opaque authority values. Its core shapes are `send({session_id|terminal_id,request})` with mutually exclusive targets, `watch({terminal_id})`, `model_options({terminal_id})`, the separately advertised Codex-only `repair_model_control({terminal_id})`, followed by `set_model({terminal_id,model,reasoning_effort})`, `native_inspect({terminal_id,inspection})`, `identify_foreground({terminal_id})`, `identify_and_send({terminal_id,request})`, `new_thread({terminal_id})`, `resume_thread({terminal_id,native_thread_id})`, `respond_interaction({turn_id|watch_id,interaction_id,answers,delivery_mode?})` with exactly one subject target and `delivery_mode` present only for an `async_question`, managed `approve({turn_id,decision})` or approve-once-only terminal-scoped `approve({terminal_id})`, and `reconcile_binding({terminal_id,conflicting_session_id})`. Model selection, model-control residue repair, approval, native interaction response, handoff takeover, and reconciliation require explicit user intent and fresh source state. The trusted plugin/CLI privately derives and revalidates terminal, catalog, binding, candidate, prompt, interaction, composer, handoff, revision, and compare-and-swap fences; the model never transports them. Store format remains 1 and writer protocol is 8; Terminal Watch schema is 3.
+Human-friendly selectors such as `only`, `codex`, `claude`, and `@short-ref` remain slash-command discovery inputs. The v31 structured model contract carries semantic IDs only and does not expose selectors or opaque authority values. Its core shapes are `send({session_id|terminal_id,request})` with mutually exclusive targets, `watch({terminal_id})`, `model_options({terminal_id})`, the separately advertised Codex-only `repair_model_control({terminal_id})`, followed by `set_model({terminal_id,model,reasoning_effort})`, `native_inspect({terminal_id,inspection})`, `identify_foreground({terminal_id})`, `identify_and_send({terminal_id,request})`, `new_thread({terminal_id})`, `resume_thread({terminal_id,native_thread_id})`, `respond_interaction({turn_id|watch_id,interaction_id,answers,delivery_mode?})` with exactly one subject target and `delivery_mode` present only for an `async_question`, managed `approve({turn_id,decision})` or approve-once-only terminal-scoped `approve({terminal_id})`, and `reconcile_binding({terminal_id,conflicting_session_id})`. The separately advertised `transfer_store_authority` action uses that same tool with `{operation:"transfer_store_authority",terminal_id,maintenance_acknowledgement?:true}`; legacy maintenance acknowledgement requires the user to stop all source-Store Hosts and old writers first. See [terminal recovery](operator-guide.md#terminal-recovery-and-diagnostics). Model selection, model-control residue repair, approval, native interaction response, handoff takeover, and reconciliation require explicit user intent and fresh source state. The trusted plugin/CLI privately derives and revalidates terminal, catalog, binding, candidate, prompt, interaction, composer, handoff, revision, and compare-and-swap fences; the model never transports them. Store format remains 1 and writer protocol is 11; Terminal Watch schema is 3. Protocol 11 fences retired source Session authority after Store transfer against predecessor writers.
 
 ## Managed Turn Flow
 
@@ -55,7 +55,7 @@ and session-only/new/resume and first-modal limits are described in the
 5. AKK sends a structured callback containing both `session_id` and `turn_id` to the originating Host session when it has reliable approval, completion, cancellation, stall, or failure evidence.
 6. After completion, refresh the terminal list. Another ordinary send through that row's current exact action creates a new Turn without clearing the native coding-agent context.
 
-Steps 2–6 describe managed delivery, which may require an exact empty Composer before input. For an advertised `terminal_user_explicit` Send, the selected live terminal/process and direct input-safety checks authorize the one physical Send; rollout, Session, Store, and callback state are sidecar management evidence rather than vetoes. Parsed working activity, an existing draft, and ordinary main-Composer visibility do not veto this user-priority path, but a blocked native approval or a proven input-owning questionnaire, editor, menu, or read-only viewer remains a zero-input boundary. Profiled Codex 0.154.0/0.155.1 exact collapsed async-question summaries remain sendable because the main Composer owns input; their expanded, clipped, or ambiguous async editors do not. Codex clears the current Composer once with `C-u`; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each then injects the request, waits through the paste window, and dispatches Enter exactly once. Codex also freezes the complete pre-send open-rollout inventory and scans those candidates together with newly opened roots after submission. One rollout that uniquely accepts the exact request hash is promoted to the managed Session/Turn; zero matches remain pending/unproven, while multiple matches or changed file/process authority become uncertain without replay. After either agent's text injection, no Composer observation may veto Enter.
+Steps 2–6 describe managed delivery, which may require an exact empty Composer before input. For an advertised `terminal_user_explicit` Send, the selected live terminal/process and direct input-safety checks authorize the one physical Send; rollout, Session, Store, and callback state are sidecar management evidence rather than vetoes. For Codex, parsed working activity, an existing draft, and ordinary main-Composer visibility do not veto this user-priority path, but a blocked native approval or a proven input-owning questionnaire, editor, menu, or read-only viewer remains a zero-input boundary. Profiled Codex 0.154.0/0.155.1 exact collapsed async-question summaries remain sendable because the main Composer owns input; their expanded, clipped, or ambiguous async editors do not. Claude instead requires an empty recognized main Composer, no existing stashed draft, a known footer and no running or unproven foreground turn. Cross-Store authority conflicts remain fenced. Codex clears the current Composer once with `C-u`; Claude Code refuses an existing stashed draft before input. On a freshly empty main Composer it uses one `C-s` to check for a hidden stash; restored content stops task submission and remains for the user. It writes no sentinel and deletes no draft. Each then injects the request, waits through the paste window, and dispatches Enter exactly once. Codex also freezes the complete pre-send open-rollout inventory and scans those candidates together with newly opened roots after submission. One rollout that uniquely accepts the exact request hash is promoted to the managed Session/Turn; zero matches remain pending/unproven, while multiple matches or changed file/process authority become uncertain without replay. After either agent's text injection, no Composer observation may veto Enter.
 
 If managed preparation still fails before input, physical-terminal authority performs the same single Send and best-effort persists an exact request-bound Terminal Watch. That Watch supplies completion callbacks. Before exact native acceptance it remains notify-only; after acceptance it can emit an idempotent `interaction_required` wake-up and, through same-controller Status, expose one supported native-interaction response offer. Activity/best-effort or manual-only observations emit `interaction_manual_required` and require direct TUI input. Watch attachment failure is reported without changing or retrying the successful Send. Send output treats transport, native acceptance, management, and observation as separate facts through `terminal_input_dispatched`, `agent_acceptance`, `management_mode`, `observation_mode`, and `capabilities`; legacy delivery fields remain compatibility aliases. Once clear or request input may have occurred, an uncertain result must never be retried automatically.
 

package/docs/callback-compatibility.md

@@ -42,7 +42,8 @@ they are not converted into a permissive activity fallback.
 Ordinary List/Status remains observation-only and does not create either Watch.
 Existing managed tasks and user terminals are not restarted by this policy.
 
-The store writer protocol is 10. Outer Terminal Watch schema remains 3; new
+The store writer protocol is 11. It additionally protects retired Session
+authority after Store transfer from predecessor writers. Outer Terminal Watch schema remains 3; new
 paginated anchors and request-correlated activity anchors use version 2. Earlier
 anchors remain readable. The store upgrade changes the writer fence without
 rewriting existing private Watch records, and older writers cannot mutate the

package/docs/claude-2.1.285-compatibility.md

@@ -116,18 +116,80 @@ approval/callback lifecycle, and real external notification delivery are not
 covered by this observation. Existing fast regressions remain distinct from native evidence. Unrecognized interaction shapes
 retain manual handling rather than gaining authority through version matching.
 
-A pre-existing explicit-Send issue was also observed: Claude automatically
-restores its `C-s` stash on request submission, including AKK's draft-replacement
-sentinel. This can leave ` [AKK replacing current draft]` in the Composer after
-successful Send and callback. It can block subsequent operations that require an
-empty Composer until the user clears the draft. The same native behavior exists
-in 2.1.266 and 2.1.282. This change does not redesign that clearing transaction or
-attempt asynchronous cleanup, which could erase newly entered user text. The
-lifecycle observations above start with an empty Composer after explicitly
-clearing only the owned probe's sentinel; they do not prove automatic recovery
-from this residue.
+A pre-existing explicit-Send issue was also observed in this compatibility run:
+Claude automatically restored its `C-s` stash on request submission, including
+AKK's draft-replacement sentinel. This left ` [AKK replacing current draft]` in
+the Composer after successful Send and callback and could block subsequent
+operations that require an empty Composer. The same native behavior exists in
+2.1.266 and 2.1.282. The original compatibility change did not redesign that
+clearing transaction. The lifecycle observations above start with an empty
+Composer after explicitly clearing only the owned probe's sentinel; they do not
+prove automatic recovery from this residue.
+
+AKK 0.16.1 replaces the former marker/stash/erase transaction with existing-stash
+refusal and one non-destructive restore probe, described below. The abandoned
+local preview that attempted to consume and delete its own sentinel is not the
+released implementation. Ordinary managed Sends, Codex and independent Watch
+monitoring retain their existing behavior.
 
 Full, integration, and release suites were excluded from the initial local
 task under `AGENTS.md`. After the user successfully tested the installed
 combined candidate and authorized publication, the standard release gate was
 run separately; see the Codex 0.159.2 report.
+
+### Claude 2.1.295 physical footer compatibility
+
+The native footer can show shell counts, `esc to interrupt`, `↓ to manage`,
+and a right-aligned `Debug` label after `← for agents`. Physical Send accepts
+only recognized native components, including wrapped rows and a separate
+right-aligned stash indicator; unknown footer text still blocks before input.
+A stash indicator is recognized as native footer syntax but blocks physical Send before input. `Draft restored` is a separate transient notification; an accompanying `› stashed` still reports a populated slot. The label is not proof of what the stash contains.
+
+A shell count does not establish that Claude's foreground turn is idle.
+Physical Send checks the foreground evidence independently and rejects a
+running or unproven foreground turn. It also preserves an existing user draft:
+the user must send, save, or clear it before a new physical Send. A completed
+foreground turn with background shells and an empty recognized Composer can
+remain eligible. These checks apply before task text; there is no Composer
+observation, cleanup, or delivery veto after Enter.
+
+
+### Existing-stash refusal in AKK 0.16.1
+
+Claude physical-input preparation finishes before task text or Enter. A visible `› stashed` indicator refuses the attempt before any terminal input. When no stash is shown, AKK rechecks the empty main Composer and uses `C-s` once to restore any hidden stash. If content appears, it stops and leaves that content in the input box for the user; it does not re-stash or delete it. If the probe or final empty check is uncertain, it stops without task text or Enter and does not retry the key. This replaces the former sentinel transaction: no new marker is written and no editing keys delete a draft. There is no Composer observation or cleanup after task text or Enter. Ordinary managed Sends, Codex clearing and independent Watch monitoring are unchanged. This is refusal with manual recovery, not a guarantee of protecting drafts against simultaneous human input; avoid typing in the pane during an attempt. Screen capture and key delivery are not an atomic keyboard lock. A transport acknowledgement cannot prove that Claude processed `Ctrl+S`; ignored keys or cropped native indicators can leave stash occupancy unproven. AKK does not overwrite that unknown slot with a marker.
+
+If List or Send reports a stashed draft, open that exact window and wait for the foreground turn to finish. Preserve any visible draft first. With the main input box empty, press `Ctrl+S` once to restore the stash, then save, send, or clear it yourself before refreshing List. AKK cannot identify hidden content just from the stash label. If restoration reveals `[AKK replacing current draft ...]`, it may be residue from an older failed AKK cleanup: remove only that marker after checking the text, preserve any other content, and do not press Enter on the marker. `Draft restored` is a transient restore notification; an accompanying `› stashed` still reports an occupied slot and remains a refusal condition. Do not repeatedly toggle `Ctrl+S` or retry an uncertain AKK attempt automatically.
+
+
+### Shared notification-row correction in AKK 0.16.1
+
+The earlier local preview validation covered separate stash-badge rows, but a later native
+2.1.295 observation showed the badge appended to another notification immediately
+above the Composer:
+
+```text
+new task? /clear to save 337.6k tokens · › stashed
+────────────────────────────────────────────────
+❯
+────────────────────────────────────────────────
+  ⏵⏵ bypass permissions on (shift+tab to cycle) · ← for agents
+```
+
+The earlier whole-line badge matcher missed that occupied stash. Its passing fast
+suite and prior live checks were insufficient for this real layout. AKK
+0.16.1 matches the badge at the end of the nearest notification row above
+the current Composer, or at the end of a trailing row, rather than requiring
+that the badge occupy the whole row. `Draft restored · new task? /clear to save
+337.6k tokens · › stashed` also refuses before input. The `/clear` hint without a
+badge does not itself block Send; foreground, input-ownership and closed-footer
+checks remain independent. Earlier history rows are not treated as current
+stash evidence when a newer reply intervenes.
+
+Action contract 35 and projection v4 remain unchanged: this is an implementation
+fix for the already documented no-stash precondition. It does not remove the
+concurrent-input or native-key acknowledgement limits described above. The native stash-and-restore sequence was verified on the office Claude 2.1.295 /
+Herdr test setup and independently repeated by the user; transformed-screen
+and zero-input Bridge cases are regression evidence, not additional live
+sessions. See [PR #464](https://github.com/scotthuang/agent-knock-knock/pull/464).
+The publishing machine runs the separate release gate; it does not repeat
+those live actions in existing user sessions.

package/docs/claude-cli-direct.md

@@ -4,6 +4,8 @@ AKK controls an already-open Claude Code CLI through its native connection or an
 
 Starting with AKK **0.15.0**, new Claude Code sends automatically prefer a **managed terminal Turn** when AKK verifies a unique controllable tmux/Herdr counterpart for the exact native session and process. The result supplies a `turn_id` for monitoring and supported approvals or question responses; the caller does not select a transport or enable background management. Without that exact terminal, AKK uses the native inbox and returns a `claude-cli-watch:...` receipt. Codex CLI continues to prefer its shared backend. Existing Turns, Watches and send receipts retain their original provider and are never migrated or resent to adopt this policy.
 
+An explicitly selected physical terminal is a separate existing operation. When List offers that terminal's `terminal_user_explicit` Send, call Send with its exact displayed `terminal_id` and request. AKK may enter text and submit Enter even when native conversation identity is unresolved, subject to the current terminal input-safety checks: an empty recognized main Composer, a known native footer, and no running or unproven foreground turn. Background shells alone do not block this physical Send. This does not prove native acceptance or completion and does not add background-worker protocol support. Ordinary managed sends never silently downgrade to physical input after failure, and callers do not pass a new scope or private token.
+
 Live observations include **Claude Code `2.1.295` and `2.1.296` on macOS**, using native peer protocol `1`. These are tested versions, not minimum versions or a promise that every UI variant works. An unlisted, complete `x.y.z` version can use the compatible runtime contracts; absence from the regression matrix alone does not disable an otherwise eligible operation. Discovery checks the running CLI's registry, native session UUID, PID/start time, and socket identity. Unknown identity, protocol or UI structure is not guessed.
 
 AKK uses a small **Python 3 helper on the controller side** to verify macOS Unix-socket peer credentials. Python 3 must be available to AKK. This is not installed into Claude Code and does not change its login, proxy, permissions, or settings. Other operating systems do not yet have this direct adapter; existing supported terminal routes remain available.
@@ -37,10 +39,64 @@ Keep the authenticated Claude Code CLI open and ask your controller to refresh `
 
 > Use AKK to ask Claude Code in my-project to inspect the failing tests. Tell me when it finishes.
 
-Save the task identity returned by Send: `turn_id` for managed terminal delivery, or `watch_id` for native inbox delivery. Monitoring starts automatically; do not add another Watch for that task. Use Status with that exact task identity for follow-up, including managed approvals. Conversation Status reads the latest input and must not replace the original task identity. For a task started manually in the CLI, explicitly ask the controller to Watch it.
+For managed or native inbox delivery, save the task identity returned by Send: `turn_id` for managed terminal delivery, or `watch_id` for native inbox delivery. Monitoring starts automatically; do not add another Watch for that task. Use Status with that exact task identity for follow-up, including managed approvals. An explicitly selected physical Send reports its actual dispatch and observation evidence; without native identity, it cannot promise acceptance or completion monitoring. Conversation Status reads the latest input and must not replace the original task identity. For a task started manually in the CLI, explicitly ask the controller to Watch it.
 
 The usual `CLAUDE_CONFIG_DIR` is respected. For native inbox delivery, AKK does not modify Claude's inbound-message policy: if the session holds or refuses peer messages, the result remains held/refused rather than being bypassed with terminal input. Native busy Send is rejected because Claude can absorb an inbound message into the task already running.
 
+### When List offers different operations
+
+List's per-conversation guidance explains the current usable operations and
+recovery steps. An idle native conversation can accept Send without offering
+Watch because there is no active task to observe. Send creates monitoring for
+its own task. A working or waiting native conversation can offer Watch, whose
+creation still requires an exact active input. Terminal activity observation is
+a different, best-effort operation and may remain available on an unidentified
+terminal.
+
+If a Claude pane lacks verified identity, List requests one additional fresh
+snapshot from the configured reader, shared across unresolved Claude panes in
+that scan. It applies the same interactive-session and exact process, registry
+and configuration-home checks. It never types into the terminal, promotes a
+background agent, or substitutes a same-directory conversation. If the retry
+cannot establish native identity, the row explains the missing proof and the
+operations still offered, even when a more specific diagnostic is unavailable.
+An independently offered physical Send may still accept terminal input. Follow the
+actual action and its stated proof limits rather than interpreting missing
+native identity as a blanket input prohibition.
+
+The live investigation initially looked like a reader omission. The installed
+Claude Code 2.1.295 runtime instead deliberately excludes a foreground registry
+record carrying `parkedJobId` from `agents --json`; `--all` only adds completed
+background jobs and does not remove that exclusion. A foreground window in the
+Agents/background-session interface can display a conversation executed by a
+separate `bg-spare` process. Its own registered session is therefore not proof
+of the identity of the displayed conversation. This finding describes the
+inspected installation, not a universal contract for every Claude release.
+
+For an unresolved Claude terminal, AKK can explain this state using a bounded,
+read-only check of the foreground process's owned registry, exact PID and live
+process start identity. Positive evidence produces background-view guidance.
+When that physical terminal offers Send, explicitly selecting it can enter text
+and submit Enter; the result must still be checked in the window because native
+acceptance and exact task completion are unproven. When Send is not offered,
+continue manually in the current window, or start an ordinary foreground
+conversation without attaching a background conversation, then refresh List.
+Restarting and reopening the same background conversation does not change its
+execution model. This is a display diagnosis only: AKK does not resolve the
+background job or worker, access daemon or claim sockets, add a background
+protocol delivery route, or promise exact background-task completion. The
+background-view marker neither grants physical Send authority nor blocks an
+otherwise valid physical input action.
+
+Missing, unsafe, malformed, stale or unreadable evidence does not become a
+background diagnosis. List retains the generic explanation that the current
+conversation identity could not be confirmed, with the physical input option
+when actually offered, or steps to inspect the pane, continue directly, and
+retry ordinary startup/List refresh where appropriate.
+Restarting remains an attempt, not a guaranteed repair. Background jobs remain
+excluded from AKK's interactive conversation list, so scan counts are not a
+count of every Claude process on the machine.
+
 ### Sender permission class
 
 For native inbox delivery, set `AKK_NATIVE_CLAUDE_SENDER_PERMISSION_CLASS` in the **AKK/controller Host's launch environment**, with `bypass` or `prompting`. AKK declares that value in the native `<cross-session-message from-mode="…">` envelope and escapes the supplied task text. Callers pass the plain task request; they do not construct the envelope. Managed terminal sends do not use this envelope. The declaration does not change the target's permissions or bypass its hold/refuse policy.
@@ -68,6 +124,18 @@ Native Send and explicit native Watch share the **720-minute default hard deadli
 
 For a native Watch, use an explicit renewal only when the same native input is still active. A completed, failed, interrupted, or exited native task cannot renew. `recover` reconciles saved state; it neither resends the prompt nor extends the deadline. `close` ends AKK's management of a native Send, while `unwatch` stops observation. Neither cancels Claude. Managed terminal tasks retain their existing Turn-specific approval, renewal, cancellation and close actions. Callback retry is restricted to a known retryable delivery failure; accepted or uncertain notifications are not blindly replayed. See [Backend Recovery](backend-task-recovery.md) for the native concepts.
 
+If the native conversation's exact terminal is owned by another AKK Store, idle
+Claude does not authorize a managed Send or native fallback. Use only its fresh
+`transfer_store_authority` action when offered: the tool is
+`agent_knock_knock_reconcile_binding` with `operation:"transfer_store_authority"`
+and the action's physical `terminal_id`. This explicitly transfers settled Store
+authority without sending Claude input or creating a Turn. Legacy records may
+require the user to stop all source-Store Hosts and old writers and explicitly
+set `maintenance_acknowledgement:true`; the agent cannot infer that condition.
+Afterward refresh List and keep the original native `conversation_id` for Send.
+Ordinary binding reconciliation only detaches a local Session and cannot replace
+this transfer. See [terminal recovery](operator-guide.md#terminal-recovery-and-diagnostics).
+
 AKK persists the exact acceptance anchor, monitor deadline and callback outbox. It polls the native records instead of relying on Claude's session-level idle notification, whose subscriptions can replace one another and which does not identify an independently completed task.
 
 ## Protocol and verification boundary

package/docs/list-output.md

@@ -11,6 +11,100 @@ Use `agent_knock_knock_watches`, `/akk watches` or CLI `watches` to inspect
 monitoring. This is a read-only Store query: it does not create or renew a Watch,
 reconcile callbacks, reconnect a native session or send notifications.
 
+## Understanding a conversation row
+
+Each conversation includes `usage`, a bounded explanation derived from its
+current offered actions, activity, capabilities and blockers:
+
+| Field | Meaning |
+| --- | --- |
+| `summary` | Whether the conversation can receive work or currently needs attention |
+| `available` | What the user can do now |
+| `limitations` | Why a relevant operation is unavailable, including uncertainty |
+| `next_steps` | Concrete actions the user or controller can take next |
+
+Controllers should present this guidance in the user's language, beside the
+conversation title and project. A list of missing switches or internal reason
+codes is not a substitute for explaining what to do. Guidance is regenerated
+from each observation; it does not grant authority, add an action, or change
+existing action eligibility. The current `available_actions` and their input
+contracts remain authoritative. `usage` is an additive field within Host List
+projection v4. Action contract v35 adds a no-existing-stash prerequisite to Claude physical Send. This narrows eligibility for an empty input box with a stashed draft, so the action contract increases from v34; it is not only a wording change. The per-agent Composer policy names and public Send parameters remain unchanged. Readiness diagnostics are additive, and compact projection remains v4.
+The shared List projection adds this guidance to Codex CLI, Codex Desktop,
+Claude and terminal-only rows. Existing identities, capabilities and action
+offers retain their meanings; consumers may ignore the new display field.
+The additional identity recheck and background-view diagnosis described below
+apply only to Claude terminals, not to Codex discovery or dispatch.
+
+Different rows can legitimately offer different next steps. An idle native
+Claude conversation may accept Send without offering Watch: there is no active
+task to attach that Watch to. Send starts monitoring for its new task, so keep
+the returned Turn or Watch identity. A working native conversation can offer
+Watch, with the exact active input revalidated when observation starts. A
+terminal-only Watch can observe terminal activity; it does not establish an
+exact native task or prove that task succeeded.
+
+For an unresolved Claude terminal identity, List makes one additional fresh
+reader check, shared across the unresolved Claude terminals in that scan. It
+does not send terminal input or trust a registry file alone. If native identity
+remains unproven, List retains that uncertainty and explains the currently
+offered operations. A separately verified physical terminal Send can remain
+available; a failed native identity check does not establish native acceptance
+or completion, and does not by itself prove that terminal input is unsafe.
+
+A Claude window can display a background conversation while its own foreground
+conversation is parked. When a read-only check of that foreground process's
+owned registry and current process incarnation verifies this state, guidance
+explains that this window is in the background-session interface. This does not
+make the window read-only. When its real `terminal_user_explicit` Send action
+is offered, explicitly selecting that physical terminal lets AKK enter the
+requested text and submit Enter. The guidance distinguishes input dispatch
+from unproven native acceptance and completion, and asks the user to inspect
+the execution result in the window. Without that physical action, the user can
+continue manually or start an ordinary foreground conversation and refresh
+List. Reopening the same background conversation does not make it an ordinary
+foreground conversation.
+The raw observation adds
+`native_agent_identity_observation.window_role: "background_view"` only for
+that positive diagnosis; compact Host output carries its explanation in `usage`.
+This diagnosis does not identify or bind the background worker, inspect daemon
+or claim sockets, or grant physical Send authority or exact-task monitoring.
+Physical authority comes only from the current terminal action and its input
+safety checks, not from the background-view marker.
+
+If the registry check is missing, malformed, unsafe, stale or unavailable, List
+does not infer a background session. It retains the generic explanation that
+the native conversation identity could not be confirmed, together with the
+actual physical Send option when offered, or instructions to inspect the pane,
+use it manually, and retry ordinary startup and List refresh if appropriate.
+Failure to diagnose never removes the guidance.
+Relaunching is a recovery attempt, not a guaranteed repair.
+
+Claude physical rows additionally expose `physical_send_readiness` from the
+same current screen evidence used before input. An unsent user draft blocks
+Send and tells the user to send, save or clear it manually. A running foreground
+turn blocks Send until completion; an unproven running state asks the user to
+wait and refresh. Background shells alone do not block Send when the main
+Composer is empty and foreground completion can be verified. Unknown footer
+controls or an unrecognized input box stop automatic input and explain what
+AKK could not verify. These explanations take precedence over native-identity
+uncertainty. Codex readiness and managed Send rules are unchanged.
+
+To use an offered physical Send, select its displayed `terminal_id` and the
+existing Send tool's semantic inputs. No new public scope or token parameter
+is required. An ordinary managed Send does not silently switch to this route
+after an identity, ownership, Store or submission failure; uncertain input must
+never be replayed through a second route. A physical dispatch receipt proves
+only the stages it reports. Terminal activity observation is not native task
+acceptance or completion proof.
+
+`managed.session_count` counts distinct related Sessions found through current
+or historical managed records. It does not count valid current bindings. A
+positive count with null `session_id` and `session_short_ref`, and no
+`binding_status`, means no current authoritative Session was selected; it is not
+evidence that List lost a binding. These historical associations do not authorize
+Send or ownership recovery.
+
 ## Conversation selection
 
 Since 0.14.12 the default view prefers a verified backend as the project's CLI
@@ -63,7 +157,9 @@ Each Host page is capped at 24 KiB of UTF-8 JSON and 12,000 weighted characters
 (ASCII 1, other code points 16), including metadata. This is not a token budget.
 Oversized rows retain exact IDs and a Status entry point; omitted actions do not
 mean unsupported capabilities. Read exact Status for current questions, approvals
-and bounded public progress. List contains no progress body.
+and bounded public progress. Their guidance explains that details were omitted
+and directs the user to Status instead of claiming those operations are
+unsupported. List contains no progress body.
 
 Desktop catalog pagination remains separate: finish Host pages for one catalog
 page, then pass `desktop_scan.next_cursor` as `desktopCursor` with the same filters

package/docs/operator-guide.md

@@ -36,6 +36,67 @@ fields in List does not mean Send had no monitoring. See
 [List and Watch inventory](list-output.md) for the 24-hour query window,
 48-hour eligible-history retention and separate Desktop catalog cursor.
 
+## What can I do with this conversation?
+
+Read the guidance beside each conversation. It explains what works now, what
+is preventing other operations, and the next step. The controller should give
+this explanation in your language instead of asking you to interpret internal
+error codes. It changes when the conversation's state changes.
+
+| What List shows | What to do |
+| --- | --- |
+| Can send and watch | Send a new task when offered, or ask AKK to watch the task already running. |
+| Can send, but no active task to watch | Send your task. Monitoring starts with that Send; keep its returned task reference. An idle conversation is usable. |
+| Can send to a window whose native conversation is unverified | Select that exact terminal's offered Send. AKK can enter text and submit Enter, but you must inspect the result in the window because native acceptance and completion are unproven. |
+| Window is in the background-session interface | Use its physical Send if offered and inspect the result there. If Send is unavailable, continue manually or open an ordinary foreground Claude conversation and refresh List. |
+| Can only inspect or watch the terminal and cannot identify the Claude conversation | AKK has retried identification without typing into the terminal. Use the original terminal to finish or safely stop any work, then follow the recovery steps below. |
+| Needs approval or management recovery | Open Status for that exact conversation or task and follow its currently offered response or recovery action. |
+| Details omitted from this List page | Open Status for that row. Missing details do not mean the conversation lacks those features. |
+
+For a sendable background window, the instruction means:
+
+> 可以向此窗口发送任务。AKK 会输入文字并提交，但目前无法可靠确认后台任务的接受和完成状态；请在窗口中查看执行结果。
+
+Choose the exact terminal entry and its offered Send action. This is ordinary
+terminal input, not a direct background-worker connection, and it does not
+promise a task-completion callback. An existing managed task that failed is not
+automatically retried through this route. If input might already have happened,
+inspect the original result before considering another send.
+
+If the window is showing a background conversation and physical Send is not
+offered, you can keep working in the current window manually. An ordinary
+foreground Claude conversation can instead provide native task identity and
+monitoring when those operations are offered. Reopening the same background
+conversation after restarting will not add that proof. Neither option converts
+the existing background conversation or transfers its work. In the inspected
+Claude Code 2.1.295 installation,
+`tclaude attach --help` documents `Ctrl+Z` as returning to the shell while the
+background session keeps running; check the installed command's help before
+applying that shortcut to another runtime or interface.
+
+If Claude remains unidentified and List cannot confirm that more specific
+background-view explanation:
+
+1. Open the named pane in Herdr or tmux and check what is running there. You can
+   continue using Claude directly. If its current physical Send action is
+   offered, you can also select that terminal for input while inspecting the
+   result manually.
+2. After finishing or safely stopping any current work, exit Claude with `/exit`
+   and relaunch it with your usual command in the same project directory. If
+   resuming history opens a background conversation, use the guidance above
+   instead of repeatedly restarting.
+3. Refresh AKK List and select the newly identified conversation. Do not resend a
+   task whose earlier delivery is uncertain; inspect its saved task reference.
+4. If the row still cannot receive work, keep using that terminal directly and
+   report the discovery limitation. A missing or failed diagnostic check does
+   not prove a background conversation or a reader bug. Relaunching can refresh
+   registration, but cannot guarantee a repair.
+
+You do not need to restart the controller Host for this recovery attempt. A
+terminal Watch can report terminal activity while identity is unresolved; it
+cannot promise exact task completion. A count of related managed Sessions is
+history, not proof that this newly discovered conversation is currently bound.
+
 ## Command reference
 
 Direct slash commands are available in every first-party Host integration:
@@ -168,21 +229,34 @@ The user-priority `terminal_user_explicit` path requires one exact live
 physical terminal/process, a scanned non-blocked approval state, and no proven
 input-owning questionnaire, editor, menu, or read-only viewer. Broken AKK Turn,
 Session, transfer, transition, ledger, or Store state cannot veto the user's
-explicit Send. Neither can parsed working activity, an existing draft, or
-ordinary Composer visibility, stability, or exactness. Codex physical fallback
-sends `C-u` once. Claude Code physical fallback uses a sentinel-backed native
-`C-s` stash-clear transaction that is independent of the cursor position and
-does not interrupt an active turn, then proves the main Composer empty. Each
+explicit Send within the same Store authority. A conflicting or unfinished
+cross-Store authority transfer still blocks input, including physical fallback.
+For Codex, neither can parsed working activity, an existing draft, or
+ordinary Composer visibility, stability, or exactness. Claude physical Send
+requires an empty recognized main Composer, no existing stashed draft, a known native footer, and no running
+or unproven foreground turn; background shells alone do not block it. Codex physical fallback
+sends `C-u` once. Claude Code refuses an existing stashed draft before input. On a freshly empty main Composer it uses one `C-s` to check for a hidden stash; restored content stops task submission and remains for the user. It writes no sentinel and deletes no draft. Each
 then injects the new request,
 waits through the paste window, and dispatches Enter exactly once. After text
 injection, Composer observation cannot veto Enter. Unreviewed Codex fullscreen
 frontends additionally require a recognizable styled Composer before clearing
 and a fresh empty Composer afterward, before any task text is sent.
 
-AKK first takes the managed path where its stronger pre-input requirements
-hold. Otherwise it may deliver unmanaged work once and best-effort attaches a
-Terminal Watch that provides the completion callback. Exact preparation failure falls back to a request-correlated terminal-activity
-Watch when the physical identity and observation path remain valid. Its callback
+Claude physical-input preparation finishes before task text or Enter. A visible `› stashed` indicator refuses the attempt before any terminal input. When no stash is shown, AKK rechecks the empty main Composer and uses `C-s` once to restore any hidden stash. If content appears, it stops and leaves that content in the input box for the user; it does not re-stash or delete it. If the probe or final empty check is uncertain, it stops without task text or Enter and does not retry the key. This replaces the former sentinel transaction: no new marker is written and no editing keys delete a draft. There is no Composer observation or cleanup after task text or Enter. Ordinary managed Sends, Codex clearing and independent Watch monitoring are unchanged. This is refusal with manual recovery, not a guarantee of protecting drafts against simultaneous human input; avoid typing in the pane during an attempt. Screen capture and key delivery are not an atomic keyboard lock. A transport acknowledgement cannot prove that Claude processed `Ctrl+S`; ignored keys or cropped native indicators can leave stash occupancy unproven. AKK does not overwrite that unknown slot with a marker.
+
+If List or Send reports a stashed draft, open that exact window and wait for the foreground turn to finish. Preserve any visible draft first. With the main input box empty, press `Ctrl+S` once to restore the stash, then save, send, or clear it yourself before refreshing List. AKK cannot identify hidden content just from the stash label. If restoration reveals `[AKK replacing current draft ...]`, it may be residue from an older failed AKK cleanup: remove only that marker after checking the text, preserve any other content, and do not press Enter on the marker. `Draft restored` is a transient restore notification; an accompanying `› stashed` still reports an occupied slot and remains a refusal condition. Do not repeatedly toggle `Ctrl+S` or retry an uncertain AKK attempt automatically.
+
+Within an explicitly selected physical-input operation, AKK can use managed
+delivery where its stronger pre-input requirements hold. Otherwise that
+operation may deliver unmanaged input once and best-effort attach the strongest
+safe Terminal Watch available. A verified exact-task Watch can provide a
+completion callback; that proof is not supplied by a physical dispatch receipt.
+An ordinary Claude managed Send does not change to physical input after failure.
+Read the actual receipt: absent native identity
+means acceptance and completion remain unproven, including for a window showing
+a background conversation. Exact preparation failure may leave a
+request-correlated terminal-activity Watch when the physical identity and
+observation path remain valid. Its callback
 reports stable idle with best-effort confidence, never exact task success.
 Watch persistence failure never vetoes, revokes, or retries a successful
 Send. Uncertain native probe input or unsafe input surfaces stop before task
@@ -329,6 +403,11 @@ stale metadata.
 
 Send preserves the selected conversation's existing permission mode. Use an
 explicit advertised permission action to change it before sending a task.
+Claude Code's `default` mode (`⏸ manual mode on`), plan, accept-edits, and
+bypass modes do not prohibit submitting user task text. Managed Send injects
+the task and dispatches Enter without changing that mode; any subsequent tool
+approval remains a separate interaction. A real approval dialog or changed
+terminal identity still requires the corresponding interaction or recovery.
 The [CLI backend](codex-cli-native-compatibility.md) and
 [Desktop](codex-desktop-compatibility.md#settings-and-cancellation) adapters
 apply and verify the selected conversation's native settings. For a Codex
@@ -341,6 +420,13 @@ operation. Supported managed approvals decide one current request; they do not
 change the session's permission mode. The native sender's `bypass` or
 `prompting` declaration is message metadata, not a permission-setting API.
 
+Host Send uses the dispatch stages' own lock, transport, and acceptance
+timeouts instead of the relay's generic 90-second deadline. Slow discovery
+must not kill the dispatcher between text injection and Enter. Explicit Host
+cancellation and explicitly supplied relay deadlines still apply. If a sender
+is interrupted, inspect its durable submission receipt before deciding what
+to do; an unproven receipt never authorizes an automatic resend or Enter.
+
 ## Safe model control
 
 This section describes terminal model control. Desktop settings use the
@@ -559,6 +645,47 @@ state makes them meaningful. `reconcile_binding`, `identify_foreground`, and
 `repair_model_control` retain their physical-terminal requirements; backend
 Recover does not replace them.
 
+An idle coding-agent terminal can still belong to another AKK Store. A resolved
+dispatch means its task settled; it does not release that Store's native-thread
+authority. List reports this conflict and withholds managed Send. An exactly
+associated Claude native conversation can carry its terminal's recovery action;
+use that action's physical `terminal_id`, while retaining the native
+`conversation_id` for the later ordinary Send.
+
+The shared runtime stays at its existing configured location; recovery does not
+move the runtime or delete temporary Stores. Automatic recovery is limited to
+Stores explicitly created with `AKK_EPHEMERAL_STORE=1`, under a private, owned,
+non-symlink `akk-*` directory inside the system temporary directory. Every
+registered owner must be proven dead by its exact process incarnation, and the
+native session, physical terminal, idle state, and settled work must still be
+verified. A temporary pathname, elapsed time, or dead PID alone is insufficient.
+Persistent Stores require the advertised explicit transfer. A newer writer
+recording legacy authority preserves its incomplete owner coverage; later writes
+cannot make that legacy authority eligible for automatic recovery.
+
+There are two distinct binding-recovery operations:
+
+- `agent_knock_knock_reconcile_binding({terminal_id,conflicting_session_id})`
+  detaches one advertised stale binding in the current Store. It does not move
+  another Store's authority or adopt the live thread.
+- An advertised `transfer_store_authority` action uses
+  `agent_knock_knock_reconcile_binding({operation:"transfer_store_authority",terminal_id})`.
+  After explicit user confirmation, AKK rechecks the displayed authority and
+  transfers eligible settled native-thread authority to this Host's Store.
+  No coding-agent input is sent and no Turn is created. Refresh List before
+  continuing with the original native conversation's newly advertised Send.
+
+For legacy records whose previous Host/writer ownership cannot be proven, the
+action requires `maintenance_acknowledgement`. Stop every Host and old writer
+using the **source Store**, then explicitly confirm that condition and include
+`maintenance_acknowledgement:true`. The controller must never prefill this
+acknowledgement. An idle Claude/Codex prompt, completed task, resolved ledger, or
+elapsed timeout is insufficient evidence that those writers have stopped.
+Any observed live or unverifiable owner, unresolved work, or changed authority
+still prevents transfer. If no transfer action is advertised, use the reported
+owner/conflict diagnostics to resolve the source Host; do not delete a ledger,
+clear Store files, guess a Session ID, or supply a private authority token.
+
 | Command | Use |
 | --- | --- |
 | `/akk doctor` | Diagnose installation, Host, terminal, and coding-agent readiness. |

package/docs/quickstart-herdr.md

@@ -26,7 +26,7 @@ Wait for the empty idle composer. After the AKK OpenClaw plugin is installed and
 
 AKK enumerates every running local Herdr session, identifies a terminal by its session socket plus stable `terminal_id`, and treats the current `pane_id` only as a refreshable route. Moving a live pane does not silently rebind ownership. Every side effect revalidates the terminal resource, shell PID, agent PID, cwd, native-session evidence, and current composer first.
 
-The v31 structured model contract carries semantic IDs only. Ordinary send is `send({session_id,request})` for strict continuation or `send({terminal_id,request})` for the current verified Herdr pane; the targets are mutually exclusive. An advertised `terminal_user_explicit` action keeps the user's Send independent of broken AKK management state and ordinary Composer visibility, stability, exactness, or existing draft contents. It requires the exact live terminal/process, a scanned non-blocked approval state, and no proven questionnaire, editor, menu, history search, or read-only viewer that owns input. The agent-neutral `terminal_user_explicit_composer_policy` advertises `replace_current_composer_and_submit`; the older Codex-named field remains a compatibility alias. Codex freezes the open-rollout candidate set and sends `C-u` once to replace the current Composer; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each then injects the request, waits through the paste window, and dispatches Enter exactly once without a post-text Composer veto. For Codex, a unique exact request acceptance promotes the provisional Session/Turn even when `/clear` delayed creation of the foreground rollout; zero or ambiguous matches never cause replay. If managed promotion cannot be prepared before input, AKK still sends once, best-effort attaches an exact Terminal Watch, and releases stale management. After exact request acceptance, that Watch can notify the owning controller of a questionnaire and broker one explicitly chosen response through Status plus `respond_interaction({watch_id,...})`; before acceptance, or when only best-effort activity evidence exists, it remains notification-only. Watch failure never changes delivery. Native inspection and lifecycle input remain exact-empty-only. Send results expose physical dispatch, agent acceptance, management, and observation separately. Watch and native/lifecycle actions likewise expose `terminal_id` (plus `inspection` or `native_thread_id` where applicable), never a pane route, selector, draft text, composer digest, token, fingerprint, revision, or binding generation. AKK resolves the current Herdr route and derives all opaque freshness fences privately, then revalidates them under lock before terminal input. Once clear or request input may have occurred, an uncertain result must not be retried automatically.
+The v31 structured model contract carries semantic IDs only. Ordinary send is `send({session_id,request})` for strict continuation or `send({terminal_id,request})` for the current verified Herdr pane; the targets are mutually exclusive. An advertised `terminal_user_explicit` action keeps the user's Send independent of broken AKK management state within the same Store authority; cross-Store conflicts remain fenced. Codex does not require an empty visible Composer. Claude requires a recognized empty main Composer, no existing stashed draft, a known footer, and no running or unproven foreground turn. It requires the exact live terminal/process, a scanned non-blocked approval state, and no proven questionnaire, editor, menu, history search, or read-only viewer that owns input. Action contract v35 advertises `terminal_user_explicit_composer_policy=per_agent`: Codex uses `replace_current_composer_and_submit`, while Claude uses `require_empty_composer_and_submit` with the additional no-existing-stash rule. The older Codex-named field remains a compatibility alias. Codex freezes the open-rollout candidate set and sends `C-u` once to replace the current Composer; Claude Code refuses an existing stashed draft before input. On a freshly empty main Composer it uses one `C-s` to check for a hidden stash; restored content stops task submission and remains for the user. It writes no sentinel and deletes no draft. Each then injects the request, waits through the paste window, and dispatches Enter exactly once without a post-text Composer veto. For Codex, a unique exact request acceptance promotes the provisional Session/Turn even when `/clear` delayed creation of the foreground rollout; zero or ambiguous matches never cause replay. If managed promotion cannot be prepared before input, AKK still sends once, best-effort attaches an exact Terminal Watch, and releases stale management. After exact request acceptance, that Watch can notify the owning controller of a questionnaire and broker one explicitly chosen response through Status plus `respond_interaction({watch_id,...})`; before acceptance, or when only best-effort activity evidence exists, it remains notification-only. Watch failure never changes delivery. Native inspection and lifecycle input remain exact-empty-only. Send results expose physical dispatch, agent acceptance, management, and observation separately. Watch and native/lifecycle actions likewise expose `terminal_id` (plus `inspection` or `native_thread_id` where applicable), never a pane route, selector, draft text, composer digest, token, fingerprint, revision, or binding generation. AKK resolves the current Herdr route and derives all opaque freshness fences privately, then revalidates them under lock before terminal input. Once clear or request input may have occurred, an uncertain result must not be retried automatically.
 
 For a physically exact, exact-empty idle Codex pane with ambiguous rollout identity, a fresh row may advertise `identify_foreground` and `identify_and_send`. The diagnostic action changes no AKK Store record but sends `/status` exactly once through the same visible Herdr pane; its 30-second proof grants no later authority. The atomic action retains the canonical Herdr terminal lock across the probe and one task, while exact request acceptance remains the only durable Session/Turn identity. List and Status never run the probe. Codex 0.158.0/0.159.0/0.159.2 exact Send and active-task Watch use a separate closed `/status` transaction to bind the foreground paginated thread. The three status axes remain independent: `screen_state` describes the live TUI, `native_identity_state` describes foreground identity resolution, and `durable_activity_state` describes exact artifact-backed work; legacy `activity_state` stays conservative for compatibility.
 

package/docs/quickstart-tmux.md

@@ -34,7 +34,7 @@ tmux new-session -s akk-work -c "$(pwd -P)" codex
 
 Use `claude` instead of `codex` to share a Claude Code terminal. Wait until the coding agent is authenticated and showing its idle prompt. Detach from tmux with `Ctrl-b`, followed by `d`.
 
-AKK discovers supported Codex and Claude Code panes across workspaces. Before acting, it revalidates the expected agent PID and tmux pane identity, then confirms that the process and pane working directories still match. Managed Send requires a verified idle prompt; an advertised user-explicit physical Send may steer a working Codex or Claude Code pane when its scanned, non-blocked approval boundary remains valid and no proven questionnaire, editor, menu, or read-only viewer owns input. An existing draft or ordinary Composer uncertainty does not veto that explicit Send.
+AKK discovers supported Codex and Claude Code panes across workspaces. Before acting, it revalidates the expected agent PID and tmux pane identity, then confirms that the process and pane working directories still match. Managed Send requires a verified idle prompt; an advertised user-explicit physical Send may steer a working Codex pane when its scanned, non-blocked approval boundary remains valid and no proven questionnaire, editor, menu, or read-only viewer owns input. An existing draft or ordinary Composer uncertainty does not veto Codex explicit Send. Claude physical Send instead requires an empty recognized main Composer, a known native footer, and no running or unproven foreground turn. Background shells alone do not block it.
 
 ## 3. Run doctor
 
@@ -58,7 +58,9 @@ Doctor verifies the installed plugin and skill, Gateway health, tmux, and at lea
 /akk inspect this repository and summarize it
 ```
 
-The bare task works when exactly one send-ready coding-agent pane exists across all workspaces. Send-ready means an exact live terminal/process, a scanned non-blocked approval state, and no proven questionnaire, editor, menu, or read-only viewer that owns input. Parsed working activity, an existing draft, and ordinary main-Composer visibility, stability, or exactness do not veto this user-priority path. Profiled Codex 0.154.0/0.155.1 collapsed async-question summaries remain sendable, while their expanded, clipped, or ambiguous editors receive zero AKK input. Codex physical fallback sends `C-u` once to replace the current Composer; Claude Code uses a sentinel-backed native `C-s` stash-clear transaction that is independent of the cursor position and does not interrupt an active turn, then proves the main Composer empty. Each then injects the request, waits through the paste window, and dispatches Enter exactly once without a post-text Composer veto. Broken AKK management state does not veto this user-explicit Send. If more than one pane is eligible, AKK stops instead of guessing: run `/akk list`, then use `/akk <selector>: <message>`, for example:
+Claude physical-input preparation finishes before task text or Enter. A visible `› stashed` indicator refuses the attempt before any terminal input. When no stash is shown, AKK rechecks the empty main Composer and uses `C-s` once to restore any hidden stash. If content appears, it stops and leaves that content in the input box for the user; it does not re-stash or delete it. If the probe or final empty check is uncertain, it stops without task text or Enter and does not retry the key. This replaces the former sentinel transaction: no new marker is written and no editing keys delete a draft. There is no Composer observation or cleanup after task text or Enter. Ordinary managed Sends, Codex clearing and independent Watch monitoring are unchanged. This is refusal with manual recovery, not a guarantee of protecting drafts against simultaneous human input; avoid typing in the pane during an attempt.
+
+The bare task works when exactly one send-ready coding-agent pane exists across all workspaces. Send-ready means an exact live terminal/process, a scanned non-blocked approval state, and no proven questionnaire, editor, menu, or read-only viewer that owns input. For Codex, parsed working activity, an existing draft, and ordinary main-Composer visibility, stability, or exactness do not veto this user-priority path. Claude requires an empty recognized main Composer, no existing stashed draft, a known native footer, and no running or unproven foreground turn; background shells alone do not block it. Profiled Codex 0.154.0/0.155.1 collapsed async-question summaries remain sendable, while their expanded, clipped, or ambiguous editors receive zero AKK input. Codex physical fallback sends `C-u` once to replace the current Composer; Claude Code refuses an existing stashed draft before input. On a freshly empty main Composer it uses one `C-s` to check for a hidden stash; restored content stops task submission and remains for the user. It writes no sentinel and deletes no draft. Each then injects the request, waits through the paste window, and dispatches Enter exactly once without a post-text Composer veto. Broken AKK management state does not veto this user-explicit Send. If more than one pane is eligible, AKK stops instead of guessing: run `/akk list`, then use `/akk <selector>: <message>`, for example:
 
 ```text
 /akk @a1b2c3d4: inspect this repository and summarize it
@@ -68,7 +70,7 @@ Success returns a managed turn and, when the work finishes, its result. The same
 
 `/akk list` keeps that physical pane as the primary resource: it appears once in `terminals[]`. Read `screen_state` for the bounded live TUI, `native_identity_state` for foreground native-session resolution, and `durable_activity_state` for exact rollout/transcript task evidence. The legacy `activity_state` remains conservative for compatibility, so an idle screen can coexist with ambiguous native identity, unknown durable activity, and legacy `activity_state="unknown"`. These status axes are diagnostic; use only a current `available_actions` entry for mutations. Its managed context follows terminal → native coding-agent session → AKK `session_id` → Turns. AKK places the active Turn under `managed.current_turn`, or the newest retained Turn under `managed.recent_turn`; retained Turns do not occupy or hide the pane.
 
-For another request, refresh `/akk list` and use only that terminal row's listed v31 `send` action. A `session_exact` action carries `session_id`; `terminal_follow_current` and user-priority `terminal_user_explicit` actions carry `terminal_id`. Add only the new request text. The two target fields are mutually exclusive, and a structured model call never carries a selector, draft text, composer digest, or opaque token. AKK derives and revalidates its freshness fences internally. Managed delivery may require exact empty before input and creates a new `turn_id`; native inspection and lifecycle input remain exact-empty-only. Codex and Claude Code `terminal_user_explicit` advertise the agent-neutral `terminal_user_explicit_composer_policy=replace_current_composer_and_submit`; the older Codex-named field remains a compatibility alias. Codex freezes every open rollout as a candidate instead of trusting one stale root as the foreground thread, then binds the uniquely accepting rollout after Enter. For either agent, once the managed path injects user-explicit text or physical fallback runs, Composer observation cannot veto the one Enter after injection. If managed promotion is unavailable, the physical fallback creates no managed callback Turn; after Enter, AKK best-effort attaches an exact Terminal Watch callback and returns its `watch_id`. Once exact request acceptance is established, that Watch can notify and—after a same-controller Status refresh plus an explicit user answer—respond to a supported native interaction. Before acceptance and for best-effort activity Watches, interaction handling remains notification-only. Attachment failure is a warning and never changes delivery. Check `terminal_input_dispatched` separately from `agent_acceptance`, `management_mode`, and `observation_mode`; once clear or request input may have occurred, an uncertain result must not be retried automatically. A completed Turn is history, not the destination of the next send. Human-friendly selectors such as `codex`, `only`, or `@a1b2c3d4` remain slash-command discovery conveniences; they are not structured action authority.
+For another request, refresh `/akk list` and use only that terminal row's listed v31 `send` action. A `session_exact` action carries `session_id`; `terminal_follow_current` and user-priority `terminal_user_explicit` actions carry `terminal_id`. Add only the new request text. The two target fields are mutually exclusive, and a structured model call never carries a selector, draft text, composer digest, or opaque token. AKK derives and revalidates its freshness fences internally. Managed delivery may require exact empty before input and creates a new `turn_id`; native inspection and lifecycle input remain exact-empty-only. Codex and Claude Code `terminal_user_explicit` advertise different Composer policies in action contract v35: Codex keeps `replace_current_composer_and_submit`, while Claude uses `require_empty_composer_and_submit`. The static `terminal_user_explicit_composer_policy=per_agent` points to `terminal_user_explicit_composer_policies`; the older Codex-named field remains a compatibility alias. Codex freezes every open rollout as a candidate instead of trusting one stale root as the foreground thread, then binds the uniquely accepting rollout after Enter. For either agent, once the managed path injects user-explicit text or physical fallback runs, Composer observation cannot veto the one Enter after injection. If managed promotion is unavailable, the physical fallback creates no managed callback Turn; after Enter, AKK best-effort attaches an exact Terminal Watch callback and returns its `watch_id`. Once exact request acceptance is established, that Watch can notify and—after a same-controller Status refresh plus an explicit user answer—respond to a supported native interaction. Before acceptance and for best-effort activity Watches, interaction handling remains notification-only. Attachment failure is a warning and never changes delivery. Check `terminal_input_dispatched` separately from `agent_acceptance`, `management_mode`, and `observation_mode`; once clear or request input may have occurred, an uncertain result must not be retried automatically. A completed Turn is history, not the destination of the next send. Human-friendly selectors such as `codex`, `only`, or `@a1b2c3d4` remain slash-command discovery conveniences; they are not structured action authority.
 
 If the coding agent asks a question and the active Turn becomes `waiting_for_openclaw`, use the listed `respond` action with its prefilled `turn_id`, or the equivalent form: