@songsid/agend 2.1.11-beta.3 → 2.1.11-beta.5

package/dist/daemon.js

@@ -300,11 +300,14 @@ export class PaneStateMachine {
     busyPattern;
     lastPaneHash = null;
     lastPaneChangeAt;
+    lastProgressTick = null;
+    progressTick;
     lastObservedAt;
     stateChangedAt;
     currentState = "idle";
-    constructor(readyPattern, stuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS, now = Date.now(), busyPattern) {
+    constructor(readyPattern, stuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS, now = Date.now(), busyPattern, progressTick) {
         this.stuckTimeoutMs = stuckTimeoutMs;
+        this.progressTick = progressTick ?? null;
         // Stateful g/y regexes mutate lastIndex and can alternate true/false across
         // polls. State detection must be deterministic for identical pane content.
         this.readyPattern = new RegExp(readyPattern.source, readyPattern.flags.replace(/[gy]/g, ""));
@@ -350,7 +353,18 @@ export class PaneStateMachine {
         const paneChanged = this.lastPaneHash !== paneHash;
         if (paneChanged) {
             this.lastPaneHash = paneHash;
-            this.lastPaneChangeAt = changeAt;
+            // Never backwards: a capture taken for an old output event (the stuck-deadline probe passes the time of the LAST
+            // output, minutes ago) must not erase the progress a later capture already proved (#1188).
+            this.lastPaneChangeAt = Math.max(this.lastPaneChangeAt, changeAt);
+        }
+        // The CLI's own turn clock (Codex: the elapsed seconds of its live status row). A counter that moved since the last
+        // look is proof of life whatever the rest of the screen did; one that stands still is not — a frozen pane stays
+        // detectable.
+        if (this.progressTick) {
+            const tick = this.progressTick(pane);
+            if (tick !== null && tick !== this.lastProgressTick)
+                this.lastPaneChangeAt = Math.max(this.lastPaneChangeAt, now);
+            this.lastProgressTick = tick;
         }
         this.lastObservedAt = now;
         // Some TUIs keep their ready footer visible while a foreground tool owns
@@ -376,7 +390,7 @@ export class PaneStateMachine {
     }
     /** Record pane motion from tmux control mode without capturing pane content. */
     recordOutput(now = Date.now()) {
-        this.lastPaneChangeAt = now;
+        this.lastPaneChangeAt = Math.max(this.lastPaneChangeAt, now);
         this.lastObservedAt = now;
         if (this.currentState !== "working") {
             this.currentState = "working";
@@ -536,6 +550,12 @@ const INPUT_TRANSIENT_WAIT_MS = 10 * 60_000;
 const INPUT_TRANSIENT_POLL_MS = 250;
 /** Max "stranded text → submit → wait for prompt → re-check" rounds per delivery; each may send one recovery Enter. */
 const STRANDED_INPUT_MAX_ROUNDS = 3;
+/** #829: most clearing rounds for a restored draft (one row each), and how long one round may take to show. */
+const INPUT_RESIDUE_MAX_ROUNDS = 60;
+const INPUT_RESIDUE_ROUND_WAIT_MS = 1_000;
+const INPUT_RESIDUE_POLL_MS = 100;
+/** #829: how many of the latest pastes can prove a draft is AgEnD's own. */
+const RECENT_PASTES_KEPT = 8;
 /** Build a status holder from channel metadata, keeping chat and thread apart. */
 function channelStatus(meta) {
     const chatId = meta.chat_id;
@@ -1042,6 +1062,22 @@ export class Daemon extends EventEmitter {
      * dialog on screen at every poll and ignores nothing.
      */
     dialogAnswers = null;
+    /**
+     * The last error occurrence handed to the lifecycle: what an action that needs the screen it was seen on (a
+     * `nudge_continue` arming) reads back, with the spawn / monitors it was seen under.
+     */
+    lastErrorEpisode = null;
+    /**
+     * An armed "tell the agent to keep going" (Codex model at capacity). One per episode; the monitor owns it: every poll
+     * cancels it when anything changed, and it fires at most once. The due time is on the monotonic clock.
+     */
+    /**
+     * How many occurrences of each `nudge_continue` pattern were already on screen when this spawn first showed a live
+     * composer (null until then): resumed scrollback, i.e. HISTORY. An occurrence is a new episode only beyond that — a
+     * resumed session whose scrollback holds an old capacity line must not be told to "keep going" for it (#949).
+     */
+    nudgeBaselines = null;
+    capacityNudge = null;
     /** Current stdin-owning runtime dialog, independent from execution state. */
     inputBlockedDialogKey = null;
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
@@ -1186,6 +1222,8 @@ export class Daemon extends EventEmitter {
      *  comes from. See PaneWriteLock for why interleaving is destructive. */
     paneWriteLock = new PaneWriteLock();
     deliveryWritesStopping = false;
+    /** #829: the latest pastes, by spawn generation (see ownedInputDraft). */
+    recentPastes = [];
     pendingInstructionsUpdate;
     pendingInstructionsNotice = false;
     // Whether the warmup steering-reload notice should be injected after spawn.
@@ -1587,6 +1625,14 @@ export class Daemon extends EventEmitter {
             this.finishDurableDelivery(delivery, "uncertain", `${verdict.phase ?? "submission"}:unverified`);
             return;
         }
+        // A steer into a busy pane of a CLI whose input row cannot be read: the paste and the one Enter went through and the
+        // delivery's own unique marker is on the pane. That is "accepted into the live turn's input" — not "the model has read
+        // it", and delivery_status carries delivery_mode=steer — and it is all this class of backend can ever show for a steer
+        // (#1197). Labelled, so it is never mistaken for a proof that the input row was cleared.
+        if (verdict.proof === "steer-marker-on-pane") {
+            this.finishDurableDelivery(delivery, "delivered", "steer-accepted-marker-on-pane; input-row-unreadable");
+            return;
+        }
         this.finishDurableDelivery(delivery, "delivered", "positive submission proof");
     }
     deferDurableDelivery(meta, reason) {
@@ -1649,19 +1695,29 @@ export class Daemon extends EventEmitter {
         ensureInstanceDir(this.instanceDir);
         writeFileSync(join(this.instanceDir, "daemon.pid"), String(process.pid));
         this.logger.info(`Starting ${this.name}`);
-        // P1: Read crash state from previous run — skip resume if last run was a crash loop
+        // Recovery intent is one-shot, but only the reader may consume it. Keep
+        // an unreadable marker for a later start; clear successfully read bytes
+        // even when the JSON is corrupt so it cannot remain forever.
         const crashStatePath = join(this.instanceDir, "crash-state.json");
         try {
             if (existsSync(crashStatePath)) {
-                const state = JSON.parse(readFileSync(crashStatePath, "utf-8"));
-                if (state.resumeDisabled) {
-                    this.skipResume = true;
-                    this.logger.warn("Previous crash loop detected — starting without resume");
+                const content = readFileSync(crashStatePath, "utf-8");
+                try {
+                    const state = JSON.parse(content);
+                    if (state?.resumeDisabled === true) {
+                        this.skipResume = true;
+                        this.logger.warn("Previous crash loop detected — starting without resume");
+                    }
+                }
+                finally {
+                    try {
+                        unlinkSync(crashStatePath);
+                    }
+                    catch { /* best effort */ }
                 }
-                unlinkSync(crashStatePath);
             }
         }
-        catch { /* corrupt file — ignore */ }
+        catch { /* unreadable or corrupt file — ignore */ }
         // Restore last reply target so a fleet-topic instance can reply correctly
         // BEFORE its first post-restart inbound arrives (otherwise lastChatId is empty
         // → reply tool sends to "" → Discord 404).
@@ -2763,6 +2819,8 @@ export class Daemon extends EventEmitter {
                 const pane = await this.tmux.capturePane();
                 if (stale())
                     return;
+                this.takeNudgeBaselines(pane, patterns);
+                this.tickCapacityNudge(pane);
                 const inputBlockedDialog = this.updateInputBlockedState(pane, dialogs);
                 // A sign-in screen that appears AFTER the startup scan ended (first run:
                 // theme → login can take longer than its budget) is the same auth
@@ -3142,6 +3200,7 @@ export class Daemon extends EventEmitter {
         if (ep.type === "auth_error")
             this.authFailureUnresolved = true;
         this.logger.warn({ errorType: ep.type, action: ep.action }, `PTY error detected: ${message}`);
+        this.lastErrorEpisode = { key, pattern: ep.pattern, pane, spawn: this.spawnGeneration, fence: this.launchFenceEpoch };
         this.emit("pty_error", { name: this.name, ...ep, message });
     }
     /**
@@ -3189,6 +3248,9 @@ export class Daemon extends EventEmitter {
      * transaction; the interrupt key still cancels the CLI generation.
      */
     clearPendingDeliveries(fleetEpoch) {
+        // FleetManager calls this synchronously before sendEscape. Cancel only the
+        // current human turn; leave already-forwarded tool requests to settle.
+        this.turnReplyGuard.cancelByUser();
         this.deliveryEpoch = fleetEpoch === undefined
             ? this.deliveryEpoch + 1
             : Math.max(this.deliveryEpoch, fleetEpoch);
@@ -3971,7 +4033,11 @@ export class Daemon extends EventEmitter {
      * message can arrive mid-turn and sit queued, and marking at arrival would let
      * the PREVIOUS turn's idle edge consume (and reset) the new turn's state.
      */
-    markTurnStarted(meta, deliveredText) {
+    markTurnStarted(meta, deliveredText, deliveryEpoch = this.deliveryEpoch) {
+        // Cancel may have interrupted an in-flight paste before its promise settled.
+        // Its late success must not re-arm the turn that the user just cancelled.
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
         // Channel turns only. A cross-instance inbound (from_instance, empty
         // chat_id) does not update lastChatId, so its proxy reply would land in
         // whatever USER topic spoke to this instance last — the wrong audience for
@@ -4012,6 +4078,12 @@ export class Daemon extends EventEmitter {
             this.turnReplyGuard.complete(turn.generation);
             return;
         }
+        // An intentional stop is not a dropped reply. Successful in-flight replies
+        // still settle above, but cancellation cannot start another model turn.
+        if (turn.cancelledByUser) {
+            this.turnReplyGuard.complete(turn.generation);
+            return;
+        }
         // A second idle edge ends the one permitted recovery turn. Never create a
         // third turn or guess at terminal text; make the failure visible instead.
         if (turn.phase === "recovering") {
@@ -4091,6 +4163,11 @@ export class Daemon extends EventEmitter {
             && this.backend?.replyCompletionGuard === true;
     }
     startReplyRecovery(turn, reason) {
+        const current = this.turnReplyGuard.snapshot();
+        if (current?.generation === turn.generation && current.cancelledByUser) {
+            this.turnReplyGuard.complete(turn.generation);
+            return;
+        }
         if (!this.turnReplyGuard.beginRecovery(turn.generation))
             return;
         this.emit("reply_drop_detected", {
@@ -4118,8 +4195,8 @@ export class Daemon extends EventEmitter {
         this.pasteQueueDepth++;
         this.pasteLock = this.pasteLock.then(async () => {
             try {
-                const current = this.turnReplyGuard.snapshot();
-                if (!current || current.generation !== turn.generation || current.phase !== "recovering")
+                const current = this.currentReplyRecovery(turn.generation, deliveryEpoch);
+                if (!current)
                     return;
                 if (current.completionDelivered) {
                     this.turnReplyGuard.complete(turn.generation);
@@ -4133,6 +4210,8 @@ export class Daemon extends EventEmitter {
                 const delivered = await this.deliverMessage(REPLY_RECOVERY_PROMPT, undefined, {
                     deliveryEpoch,
                 });
+                if (!this.currentReplyRecovery(turn.generation, deliveryEpoch))
+                    return;
                 if (!delivered) {
                     this.turnReplyGuard.complete(turn.generation);
                     this.reportUnrecoveredReplyDrop(turn, "recovery_prompt_delivery_failed");
@@ -4143,14 +4222,28 @@ export class Daemon extends EventEmitter {
             }
         }).catch(err => {
             this.logger.error({ err: err.message }, "Reply-drop recovery prompt failed");
+            if (!this.currentReplyRecovery(turn.generation, deliveryEpoch))
+                return;
             this.turnReplyGuard.complete(turn.generation);
             this.reportUnrecoveredReplyDrop(turn, "recovery_prompt_delivery_failed");
         });
     }
+    /** Recheck after queue waits and IO; cancellation must not become a failure notice. */
+    currentReplyRecovery(generation, deliveryEpoch) {
+        const current = this.turnReplyGuard.snapshot();
+        if (!current || current.generation !== generation || current.phase !== "recovering")
+            return null;
+        if (current.cancelledByUser || !this.isDeliveryEpochCurrent(deliveryEpoch)) {
+            this.turnReplyGuard.complete(generation);
+            return null;
+        }
+        return current;
+    }
     queueMalformedReplyRecovery(turn, text) {
         // Serialize the delivery decision ahead of any new pane input. If direct
         // delivery is positively acknowledged, there is no recovery turn. If its
         // outcome is unknown, do not ask the model to duplicate it.
+        const deliveryEpoch = this.deliveryEpoch;
         const delivery = this.deliverDaemonReply(text, "malformedreply", "Malformed tool-call recovery", turn.target);
         this.pasteQueueDepth++;
         this.pasteLock = this.pasteLock.then(async () => {
@@ -4161,17 +4254,24 @@ export class Daemon extends EventEmitter {
                     correlationId: turn.target.correlationId,
                     recovered: delivered,
                 });
+                const current = this.turnReplyGuard.snapshot();
                 this.turnReplyGuard.complete(turn.generation);
-                if (!delivered)
+                if (!delivered && current?.generation === turn.generation && !current.cancelledByUser
+                    && this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+                }
             }
             finally {
                 this.pasteQueueDepth--;
             }
         }).catch(err => {
             this.logger.error({ err: err.message }, "Malformed tool-call recovery attempt failed");
+            const current = this.turnReplyGuard.snapshot();
             this.turnReplyGuard.complete(turn.generation);
-            this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+            if (current?.generation === turn.generation && !current.cancelledByUser
+                && this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+            }
         });
     }
     reportUnrecoveredReplyDrop(turn, reason = "recovery_turn_missing_reply") {
@@ -4602,7 +4702,10 @@ export class Daemon extends EventEmitter {
                 // the new progress timestamp and re-arms both deadlines.
                 if (!expectedOutputAt)
                     this.instanceStateLastOutputAt = captureStartedAt;
-                this.scheduleInstanceStateStuckDeadline(this.instanceStateLastOutputAt || captureStartedAt);
+                // The deadline follows the state machine's latest sign of life (output events, content changes and the CLI's own
+                // turn clock all feed it). Keyed on the output clock alone it would be "now" again the moment a long quiet turn
+                // proved alive, and re-fire in a loop.
+                this.scheduleInstanceStateStuckDeadline(snapshot.observedAt - snapshot.unchangedForMs || captureStartedAt);
             }
         }
         catch (err) {
@@ -4665,7 +4768,7 @@ export class Daemon extends EventEmitter {
             : DEFAULT_STATE_IDLE_DEBOUNCE_MS;
         this.instanceStateReadyPattern = this.backend.getReadyPattern();
         this.instanceStateBusyPattern = this.backend.getBusyPattern?.() ?? null;
-        this.instanceStateMachine = new PaneStateMachine(this.instanceStateReadyPattern, this.instanceStateStuckTimeoutMs, Date.now(), this.instanceStateBusyPattern);
+        this.instanceStateMachine = new PaneStateMachine(this.instanceStateReadyPattern, this.instanceStateStuckTimeoutMs, Date.now(), this.instanceStateBusyPattern, this.backend.getLiveProgressTick ? (pane) => this.backend.getLiveProgressTick(pane) : null);
         this.instanceStateLastOutputAt = 0;
         this.instanceStatePeriodicIdleConfirmations = 0;
         this.instanceStateMonitorActive = true;
@@ -4975,6 +5078,16 @@ export class Daemon extends EventEmitter {
             return ""; // skip channel tools
         return name;
     }
+    /**
+     * A steered message reads like a queued one plus a banner. The delivery marker (`[agend-delivery-id:…]`, when the message
+     * is a durable delivery) must LEAD the persisted user message — restart reconciliation recognises a delivery only by a
+     * marker at the start of the body (#1197) — so the banner goes right after it, not in front of it.
+     */
+    static steerEnvelope(inbound) {
+        const banner = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n";
+        const marker = inbound.match(/^\[agend-delivery-id:[^\]\r\n]+\]\r?\n/);
+        return marker ? marker[0] + banner + inbound.slice(marker[0].length) : banner + inbound;
+    }
     /**
      * The one place an inbound message grows its metadata wrapper ([user:]/
      * [from:] prefix, pending reactions, handoff metadata, reply instructions).
@@ -5084,8 +5197,7 @@ export class Daemon extends EventEmitter {
         this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
         this.pendingWork.recordInbound();
         this.recordRecentUserMessage(content, meta);
-        const formatted = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n"
-            + this.formatInboundMessage(content, meta);
+        const formatted = Daemon.steerEnvelope(this.formatInboundMessage(content, meta));
         const status = channelStatus(meta);
         const durableAttempt = this.durableDeliveryAttempt(meta, content);
         if (durableAttempt === false) {
@@ -5112,7 +5224,7 @@ export class Daemon extends EventEmitter {
                     durableAttempt: durableAttempt || undefined,
                 })) {
                     this.finishDurableSubmission(durableAttempt, verdict);
-                    this.markTurnStarted(meta, formatted);
+                    this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
                 else if (durableAttempt && verdict.paneWriteStarted) {
                     this.finishDurableDelivery(durableAttempt, "uncertain", `${verdict.phase ?? "post-submit"}:${verdict.proof ?? "unproven"}`);
@@ -5167,7 +5279,7 @@ export class Daemon extends EventEmitter {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                 return;
             if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id })) {
-                this.markTurnStarted(meta, formatted);
+                this.markTurnStarted(meta, formatted, deliveryEpoch);
             }
         }).catch(err => {
             this.logger.warn({ err: err.message }, "btw delivery error");
@@ -5280,7 +5392,7 @@ export class Daemon extends EventEmitter {
                     durableAttempt: durableAttempt || undefined,
                 })) {
                     this.finishDurableSubmission(durable, verdict);
-                    this.markTurnStarted(meta, formatted);
+                    this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
                 else if (durableAttempt && verdict.paneWriteStarted) {
                     this.finishDurableDelivery(durable, "uncertain", `${verdict.phase ?? "post-submit"}:${verdict.proof ?? "unproven"}`);
@@ -5384,6 +5496,7 @@ export class Daemon extends EventEmitter {
         // this spawn generation. A spawn that starts afterwards is detected inside
         // the critical section, where this delivery backs out and redoes itself.
         const settleGeneration = this.spawnGeneration;
+        const settleFence = this.launchFenceEpoch;
         if (cancelled())
             return false;
         if (this.refuseFatalStartupDelivery(verdict, status))
@@ -5508,7 +5621,28 @@ export class Daemon extends EventEmitter {
                 }
                 if (!(await this.hasPositiveDeliveryInput()))
                     return "dialog";
-                return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true);
+                // #829: a CLI that restores a cancelled prompt into its input box would
+                // have this message pasted onto it and both submitted as one. Clear it
+                // first, or do not write at all. From here every await is fenced: a
+                // cancel, stop, freeze or spawn ends this attempt unwritten.
+                // The CLI process is its spawn generation; a recovered window id is the
+                // same process, a pause/stop/respawn is not (launchFenceEpoch moves even
+                // when a failed pause resumes the monitors).
+                const writeCurrent = () => !cancelled()
+                    && !this.deliveryWritesStopping
+                    && !this.runtimeMonitorsFrozen
+                    && !this.spawning
+                    && settleGeneration === this.spawnGeneration
+                    && settleFence === this.launchFenceEpoch;
+                const stale = () => (this.spawning || settleGeneration !== this.spawnGeneration ? "spawn-started" : false);
+                const residue = await this.clearRestoredInputDraft(handingOffToNativeQueue, writeCurrent);
+                if (residue === "stale")
+                    return stale();
+                if (residue !== "clear")
+                    return this.failDelivery(verdict, status, "input-residue", residue);
+                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent);
+                // Fenced before its first write: not attempted — redo after a spawn, else drop without a ❌.
+                return written === false && verdict.fenced ? stale() : written;
             });
             if (outcome === "spawn-started") {
                 // The pane changed under this delivery: its queued paste must not land
@@ -5809,6 +5943,104 @@ export class Daemon extends EventEmitter {
         this.trackDialogParked(null);
         return { state: "clear" };
     }
+    /**
+     * Arm the "keep going" nudge for the error occurrence just reported (`pattern` must be the one the lifecycle was
+     * handed). The nudge is sent once, `delayMs` from now on the MONOTONIC clock (a wall-clock step changes nothing),
+     * and only if nothing has changed by then — see {@link tickCapacityNudge}. Returns false when there is nothing to arm.
+     */
+    armCapacityNudge(pattern, delayMs) {
+        const episode = this.lastErrorEpisode;
+        if (!episode || episode.pattern !== pattern)
+            return false;
+        if (episode.spawn !== this.spawnGeneration || episode.fence !== this.launchFenceEpoch)
+            return false;
+        if (this.isPaused || this.getProcessStatus() === "stopped")
+            return false;
+        // Only an occurrence that appeared during this spawn's live session: before the baseline exists, or not beyond it,
+        // it is scrollback from a resumed session.
+        const baseline = this.nudgeBaselines?.get(episode.key);
+        if (baseline === undefined || Daemon.countOccurrences(pattern, episode.pane) <= baseline)
+            return false;
+        this.capacityNudge = {
+            pane: episode.pane, spawn: episode.spawn, fence: episode.fence,
+            epoch: this.deliveryEpoch, dueAt: performance.now() + delayMs,
+        };
+        this.logger.info({ delayMs }, "Model-capacity nudge armed");
+        return true;
+    }
+    /** Drop an armed nudge (the user stopped / paused the instance, or the lifecycle gave up on it). */
+    cancelCapacityNudge(reason) {
+        if (!this.capacityNudge)
+            return;
+        this.capacityNudge = null;
+        this.logger.info({ reason }, "Model-capacity nudge cancelled");
+    }
+    /** The first live composer of a spawn fixes what is history (see {@link nudgeBaselines}). */
+    takeNudgeBaselines(pane, patterns) {
+        if (!this.isCodexLivePaneSnapshot(pane))
+            return;
+        const baselines = this.nudgeBaselines ?? new Map();
+        for (const ep of patterns) {
+            if (ep.action !== "nudge_continue")
+                continue;
+            const key = Daemon.errorPatternKey(ep);
+            const count = Daemon.countOccurrences(ep.pattern, pane);
+            // History that has scrolled away must not hide the next real occurrence.
+            baselines.set(key, Math.min(baselines.get(key) ?? count, count));
+        }
+        this.nudgeBaselines = baselines;
+    }
+    static countOccurrences(pattern, pane) {
+        const flags = pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g";
+        return (pane.match(new RegExp(pattern.source, flags)) || []).length;
+    }
+    /**
+     * One monitor poll's look at an armed nudge. It is CANCELLED — never postponed — when anything about the instance
+     * moved: a stop / pause / respawn (spawn generation or monitor epoch), a user cancel (delivery epoch), the pane no
+     * longer being exactly the one the error was seen on (it moved on by itself, a person typed, another dialog), the
+     * agent working, or a message waiting for delivery. Only when it is due and still untouched is it fired — once — and
+     * the injection re-verifies everything under the pane-write lock.
+     */
+    tickCapacityNudge(pane) {
+        const nudge = this.capacityNudge;
+        if (!nudge)
+            return;
+        const gone = nudge.spawn !== this.spawnGeneration || nudge.fence !== this.launchFenceEpoch ? "the instance was stopped, paused or respawned"
+            : !this.isDeliveryEpochCurrent(nudge.epoch) ? "the user cancelled"
+                : this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped" ? "the instance is not running"
+                    : pane !== nudge.pane ? "the screen changed"
+                        : this.instanceState === "working" || this.pasteQueueDepth > 0 ? "the instance has work of its own"
+                            : null;
+        if (gone) {
+            this.cancelCapacityNudge(gone);
+            return;
+        }
+        if (performance.now() < nudge.dueAt)
+            return;
+        this.capacityNudge = null; // fired: once per episode
+        void this.sendCapacityNudge(nudge).catch(err => this.logger.warn({ err: err.message }, "Model-capacity nudge failed"));
+    }
+    async sendCapacityNudge(nudge) {
+        // Everything the nudge was armed under, asked again after EVERY await that precedes a write — inside the paste
+        // primitive too (its capture, its paste, its pause, its Enter, its retry): once any of it is false nothing more is
+        // written. A message queued behind the lock, or the agent starting a turn, is "work of its own" like at the poll.
+        const current = () => nudge.spawn === this.spawnGeneration && nudge.fence === this.launchFenceEpoch
+            && this.isDeliveryEpochCurrent(nudge.epoch) && !this.isPaused && !this.healthCheckPaused
+            && !this.startupAborted && this.getProcessStatus() !== "stopped"
+            && this.pasteQueueDepth === 0 && this.instanceState !== "working";
+        // Exclusive with every delivery: nothing can paste a turn between the verdict below and the nudge.
+        await this.paneWriteLock.run(async () => {
+            if (!this.tmux)
+                return;
+            // ONE capture decides: it must be exactly the screen the error was seen on AND an idle composer. (A second picture
+            // vouching for the first — "same screen" here, "idle" there — would let a half-typed draft through.)
+            const sent = await this.submitSystemPaste(t("inst.codex_capacity_nudge_text"), "capacity-continue", {
+                current,
+                accept: pane => pane === nudge.pane && this.paneAuthoritativelyIdle(pane),
+            });
+            this.logger.info({ sent }, "Model-capacity nudge attempted");
+        });
+    }
     /** What identifies the request on screen: the backend's own identity when it has one, else the whole screen verbatim. */
     static screenOf(dialog, pane) {
         return dialog.requestIdentity?.(pane) ?? pane;
@@ -6174,6 +6406,114 @@ export class Daemon extends EventEmitter {
      * else submitted it); "failed" = the Enter could not be sent (the delivery
      * must fail rather than paste on top of the stranded text).
      */
+    /** #829: remember what this pane generation was given, so a draft can be proven to be ours. */
+    /**
+     * #829: remember what was pasted, under the spawn generation it was written
+     * to — fixed by the caller BEFORE its paste await, so a write that lands
+     * while the CLI is replaced is never credited to the replacement.
+     */
+    rememberPaste(text, generation) {
+        this.recentPastes.push({ generation, text });
+        if (this.recentPastes.length > RECENT_PASTES_KEPT)
+            this.recentPastes.splice(0, this.recentPastes.length - RECENT_PASTES_KEPT);
+    }
+    /**
+     * #829: whether the input box shows one of this generation's own pastes —
+     * exactly as the backend draws it, wrapping included (inputDraftShows). A
+     * marker that looks like AgEnD's, a collapsed paste whose content cannot be
+     * seen, or text that differs only in spacing proves nothing.
+     */
+    ownsInputDraft(draft) {
+        const shows = this.backend?.inputDraftShows;
+        if (!shows)
+            return false;
+        return this.recentPastes.some(p => p.generation === this.spawnGeneration && shows.call(this.backend, draft, p.text));
+    }
+    /**
+     * #829: empty the CLI's input box of a draft the CLI put back there itself
+     * (muse restores a cancelled prompt) before a delivery is pasted. Only for a
+     * backend that can read its box and names the keys that clear it; every other
+     * backend is untouched.
+     *
+     * Only a draft that is provably one of this pane's own pastes is cleared, one
+     * line per round, and every round must leave the first or last rows of what
+     * was there — anything else in the box is somebody's typing and stops the
+     * clearing. `current` is the caller's fixed fence (cancel, stop, freeze,
+     * pause, spawn): it is asked after every await, and a stale answer means
+     * nothing more is sent. A capture that fails, a box that does not empty or a
+     * draft that is not ours stops the delivery; it is never pasted onto.
+     */
+    async clearRestoredInputDraft(handingOffToNativeQueue, current) {
+        const backend = this.backend;
+        const tmux = this.tmux;
+        const keys = backend?.getClearInputKeys?.();
+        if (!backend?.inputDraft || !keys?.length || handingOffToNativeQueue || !tmux)
+            return "clear";
+        // undefined: the capture itself failed. null: read, but not a layout the backend knows.
+        const read = async () => {
+            let pane;
+            try {
+                pane = await tmux.capturePane();
+            }
+            catch {
+                return undefined;
+            }
+            return backend.inputDraft(pane);
+        };
+        const first = await read();
+        if (!current())
+            return "stale";
+        if (first === undefined) {
+            this.logger.warn("Could not read the input box before this delivery — not writing it");
+            return "unreadable";
+        }
+        // A screen the backend does not recognise keeps today's behaviour; the
+        // readiness checks before this one decide whether it is writable at all.
+        if (first === null || first.rows.length === 0)
+            return "clear";
+        if (!this.ownsInputDraft(first)) {
+            this.logger.warn({ rows: first.rows.length }, "The input box holds text AgEnD did not put there — not clearing it, and not writing this delivery onto it");
+            return "foreign-draft";
+        }
+        const original = first.rows;
+        // A round removes whole lines from one end: what is left is the original's
+        // first or last rows, unchanged.
+        const remainderOk = (rows) => rows.length <= original.length
+            && (rows.every((r, k) => r === original[k]) || rows.every((r, k) => r === original[original.length - rows.length + k]));
+        const same = (a, b) => a.length === b.length && a.every((r, k) => r === b[k]);
+        const rounds = Math.min(INPUT_RESIDUE_MAX_ROUNDS, original.length + 3);
+        this.logger.info({ rows: original.length }, "Clearing a restored draft from the input box before this delivery");
+        // `current` is asked after every await; between one of those answers and
+        // the next key there is no await.
+        let rows = original;
+        for (let round = 0; round < rounds; round++) {
+            const before = rows;
+            const sent = await tmux.sendKeySequence(keys);
+            if (!current())
+                return "stale";
+            if (!sent)
+                return "not-cleared";
+            const deadline = Date.now() + INPUT_RESIDUE_ROUND_WAIT_MS;
+            let next;
+            do {
+                await new Promise(r => setTimeout(r, INPUT_RESIDUE_POLL_MS));
+                next = await read();
+                if (!current())
+                    return "stale";
+            } while (next && next.rows.length > 0 && same(next.rows, before) && Date.now() < deadline);
+            if (!next)
+                return "not-cleared";
+            if (next.rows.length === 0)
+                return "clear";
+            if (!remainderOk(next.rows)) {
+                this.logger.warn({ rows: next.rows.length }, "The input box changed to text AgEnD did not put there — stopped clearing, not writing this delivery");
+                return "foreign-draft";
+            }
+            rows = next.rows;
+        }
+        this.logger.error({ rows: rows.length }, "The input box did not empty — not writing this delivery onto it");
+        return "not-cleared";
+    }
     async submitStrandedInputIfAny(windowId) {
         if (!this.tmux || !this.backend)
             return "idle";
@@ -6495,10 +6835,15 @@ export class Daemon extends EventEmitter {
     async writeMessageToPane(formatted, initialWindowId, handingOffToNativeQueue, status, submissionId, 
     // Last and defaulted so the positional callers that ignore the outcome stay
     // readable; deliverMessage, the only one that reports, always passes its own.
-    verdict = { reached: false }, durableAttempt, steer = false) {
+    verdict = { reached: false }, durableAttempt, steer = false, 
+    // #829: the caller's fence, asked once more after the last await before the
+    // first side effect. Stale means unwritten: false, with no failure verdict.
+    stillCurrent) {
         const signature = this.submissionSignature(formatted, submissionId);
         const rawPaste = durableAttempt?.submissionMode === "raw_paste";
         let windowId = initialWindowId;
+        // The spawn this write belongs to: acceptance evidence is only read while it is still the current one (#1197).
+        const spawnAtWrite = this.spawnGeneration;
         // Bug A: paste with backoff. Transient failures are usually a stale window id
         // after a crash/respawn — recover by name and retry (max 3 attempts, 2s apart).
         const maxAttempts = 3;
@@ -6508,6 +6853,12 @@ export class Daemon extends EventEmitter {
             // Read the pane BEFORE writing to it, so the submission check can require
             // evidence this paste ADDED rather than evidence that was already there.
             const pasteBaseline = await this.capturePaneEvidence(signature);
+            // Every attempt, retries included: a stop or respawn during a recovery wait ends it unwritten.
+            // After a durable begin, the caller's abort path owns the row; only an attempt with no begin may be redone.
+            if (stillCurrent && !stillCurrent()) {
+                verdict.fenced = !verdict.durableBeginCommitted;
+                return false;
+            }
             // Readiness, idle-gate, dialog, spawn and pane-lock waits have all ended.
             // Commit the submission fence at the last possible point before the
             // first side effect; a crash during those waits remains safely replayable.
@@ -6520,6 +6871,10 @@ export class Daemon extends EventEmitter {
                     pastedContentSha256: durableAttempt.contentSha256 ?? null,
                     pastedBytesSha256: deliveryContentDigest(formatted),
                 };
+                if (stillCurrent && !stillCurrent()) {
+                    verdict.fenced = true;
+                    return false;
+                }
                 if (!this.beginDurableDelivery(durableAttempt, attemptEvidence)) {
                     verdict.durableBeginRejected = true;
                     verdict.phase = "submission-begin";
@@ -6534,7 +6889,10 @@ export class Daemon extends EventEmitter {
             // failed/throwing write as uncertain rather than retrying bytes into the
             // same pane; the write-ahead Enter marker later separates safe pre-Enter
             // recovery from a possibly executed command.
+            const pasteGeneration = this.spawnGeneration;
             const pasted = await this.tmux.pasteBuffer(formatted);
+            if (pasted)
+                this.rememberPaste(formatted, pasteGeneration);
             if (!pasted) {
                 if (rawPaste) {
                     verdict.phase = "raw-paste-write";
@@ -6640,6 +6998,18 @@ export class Daemon extends EventEmitter {
                         verdict.proof = proof;
                         return false;
                     }
+                    // A steer into a busy pane of a CLI with no input-row reader (claude-code, grok, muse): it can never be shown to
+                    // have left the input row, and the idle→busy edge that proves an ordinary submission cannot exist in a pane that
+                    // is already busy. What it CAN show, and what is enough to call the steer accepted, is its own trusted unique
+                    // marker on the pane after the one Enter — with the dialog, spawn and window unchanged (#1197).
+                    if (steer && signature.unique && !this.backend?.getBottomReadyPattern?.()
+                        && await this.steerMarkerAccepted(signature, pasteBaseline, spawnAtWrite, windowId)) {
+                        verdict.phase = "steer-accepted";
+                        verdict.proof = "steer-marker-on-pane";
+                        if (status)
+                            this.emit("message_confirmed", status); // ✅ accepted into the live turn
+                        return true;
+                    }
                     // Re-pasting on a backend without structured Codex pane evidence
                     // would risk duplication; retain its legacy best-effort behavior.
                     this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
@@ -6868,6 +7238,29 @@ export class Daemon extends EventEmitter {
      * — fall back to "the pane printed something" whenever a paste left no trace,
      * which is the same false confirmation one layer down.
      */
+    /**
+     * The acceptance evidence for a steer whose input row cannot be read: a FRESH capture shows this delivery's trusted unique
+     * marker more often than the pre-paste baseline did, no blocking dialog owns the pane, and it is still the spawn and the
+     * window the paste went into. (The marker is the `message_id:` value AgEnD put in the handoff metadata — never text
+     * scanned out of a body — so an older or quoted line cannot match it.)
+     */
+    async steerMarkerAccepted(signature, baseline, spawnGeneration, windowId) {
+        if (!this.tmux)
+            return false;
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return false;
+        }
+        // "More often than before the paste" needs a before: a baseline that could not be read is not a count of zero.
+        if (!baseline || this.paneEvidence(pane, signature).payload <= baseline.payload)
+            return false;
+        const dialogClear = (await this.probeBlockingDialog()).state === "clear";
+        // Asked last, after every await: the read evidence is only worth anything for the pane it was read from.
+        return dialogClear && this.spawnGeneration === spawnGeneration && this.getWindowId() === windowId;
+    }
     canProveSubmission() {
         return !!this.backend?.getBottomReadyPattern?.();
     }
@@ -7143,17 +7536,40 @@ export class Daemon extends EventEmitter {
      * Best effort by design: these notices must never fail a delivery or throw.
      * The caller already holds paneWriteLock.
      */
-    async submitSystemPaste(text, label) {
+    /**
+     * `guard` is for a paste that must not outlive the reason it was made (the continue nudge): `accept` judges the ONE
+     * capture taken here — the same picture is the baseline, the expected-screen check and the idle check — and `current`
+     * is asked again after every await that precedes a write, so a cancelled paste adds no further paste and no key
+     * (the retries included). Without a guard it is exactly the old unconditional path.
+     */
+    async submitSystemPaste(text, label, guard) {
         if (!this.tmux)
             return false;
         const signature = this.submissionSignature(text);
-        const baseline = await this.capturePaneEvidence(signature);
+        let baseline;
+        if (guard) {
+            let pane;
+            try {
+                pane = await this.tmux.capturePane();
+            }
+            catch {
+                return false;
+            }
+            if (!guard.current() || !guard.accept(pane))
+                return false;
+            baseline = this.paneEvidence(pane, signature);
+        }
+        else {
+            baseline = await this.capturePaneEvidence(signature);
+        }
+        const pasteGeneration = this.spawnGeneration;
         if (!(await this.tmux.pasteBuffer(text))) {
             this.logger.warn({ label }, "System paste failed to reach the pane");
             return false;
         }
+        this.rememberPaste(text, pasteGeneration);
         await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
-        if (!(await this.sendDeliveryEnter(label)))
+        if (!(await this.sendDeliveryEnter(label, guard?.current)))
             return false;
         let proof = await this.confirmSubmitted(signature, baseline);
         if (proof === "unverifiable") {
@@ -7171,7 +7587,7 @@ export class Daemon extends EventEmitter {
             // exists to remove — visible text is also what a strand looks like.
             if (this.systemPasteOptions().retryEnter) {
                 await new Promise(r => setTimeout(r, 1_000));
-                await this.sendDeliveryEnter(`${label}-defensive-retry`);
+                await this.sendDeliveryEnter(`${label}-defensive-retry`, guard?.current);
             }
             return true; // best effort, exactly as before — nothing here is verified
         }
@@ -7180,7 +7596,7 @@ export class Daemon extends EventEmitter {
             // first one did land; when the text is still in the input row it is the
             // submit it never got. Re-pasting would append the text to itself.
             await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
-            if (!(await this.sendDeliveryEnter(`${label}-retry`)))
+            if (!(await this.sendDeliveryEnter(`${label}-retry`, guard?.current)))
                 return false;
             proof = await this.confirmSubmitted(signature, baseline);
         }
@@ -7748,6 +8164,9 @@ export class Daemon extends EventEmitter {
      */
     beginSpawn() {
         this.dialogAnswers = null;
+        this.capacityNudge = null;
+        this.lastErrorEpisode = null;
+        this.nudgeBaselines = null;
         // A relaunch settles any outstanding quit watch: the CLI came back.
         this.clearQuitRelaunchWatch();
         // A restarted CLI has no trustworthy turn edge for the process it replaced.
@@ -8133,8 +8552,7 @@ export class Daemon extends EventEmitter {
      * a live turn. Fail closed: an unreadable pane is never idle.
      */
     async isPaneAuthoritativelyIdle() {
-        const backend = this.backend;
-        if (!this.tmux || !backend)
+        if (!this.tmux || !this.backend)
             return false;
         let pane;
         try {
@@ -8143,6 +8561,13 @@ export class Daemon extends EventEmitter {
         catch {
             return false;
         }
+        return this.paneAuthoritativelyIdle(pane);
+    }
+    /** The verdict of {@link isPaneAuthoritativelyIdle} on a capture the caller already holds. */
+    paneAuthoritativelyIdle(pane) {
+        const backend = this.backend;
+        if (!backend)
+            return false;
         if (backend.getBusyPattern?.()?.test(pane))
             return false;
         for (const dialog of this.deliveryBlockingDialogs()) {