@songsid/agend 2.1.11-beta.4 → 2.1.11-beta.5

package/dist/daemon.js

@@ -300,11 +300,14 @@ export class PaneStateMachine {
     busyPattern;
     lastPaneHash = null;
     lastPaneChangeAt;
+    lastProgressTick = null;
+    progressTick;
     lastObservedAt;
     stateChangedAt;
     currentState = "idle";
-    constructor(readyPattern, stuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS, now = Date.now(), busyPattern) {
+    constructor(readyPattern, stuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS, now = Date.now(), busyPattern, progressTick) {
         this.stuckTimeoutMs = stuckTimeoutMs;
+        this.progressTick = progressTick ?? null;
         // Stateful g/y regexes mutate lastIndex and can alternate true/false across
         // polls. State detection must be deterministic for identical pane content.
         this.readyPattern = new RegExp(readyPattern.source, readyPattern.flags.replace(/[gy]/g, ""));
@@ -350,7 +353,18 @@ export class PaneStateMachine {
         const paneChanged = this.lastPaneHash !== paneHash;
         if (paneChanged) {
             this.lastPaneHash = paneHash;
-            this.lastPaneChangeAt = changeAt;
+            // Never backwards: a capture taken for an old output event (the stuck-deadline probe passes the time of the LAST
+            // output, minutes ago) must not erase the progress a later capture already proved (#1188).
+            this.lastPaneChangeAt = Math.max(this.lastPaneChangeAt, changeAt);
+        }
+        // The CLI's own turn clock (Codex: the elapsed seconds of its live status row). A counter that moved since the last
+        // look is proof of life whatever the rest of the screen did; one that stands still is not — a frozen pane stays
+        // detectable.
+        if (this.progressTick) {
+            const tick = this.progressTick(pane);
+            if (tick !== null && tick !== this.lastProgressTick)
+                this.lastPaneChangeAt = Math.max(this.lastPaneChangeAt, now);
+            this.lastProgressTick = tick;
         }
         this.lastObservedAt = now;
         // Some TUIs keep their ready footer visible while a foreground tool owns
@@ -376,7 +390,7 @@ export class PaneStateMachine {
     }
     /** Record pane motion from tmux control mode without capturing pane content. */
     recordOutput(now = Date.now()) {
-        this.lastPaneChangeAt = now;
+        this.lastPaneChangeAt = Math.max(this.lastPaneChangeAt, now);
         this.lastObservedAt = now;
         if (this.currentState !== "working") {
             this.currentState = "working";
@@ -536,6 +550,12 @@ const INPUT_TRANSIENT_WAIT_MS = 10 * 60_000;
 const INPUT_TRANSIENT_POLL_MS = 250;
 /** Max "stranded text → submit → wait for prompt → re-check" rounds per delivery; each may send one recovery Enter. */
 const STRANDED_INPUT_MAX_ROUNDS = 3;
+/** #829: most clearing rounds for a restored draft (one row each), and how long one round may take to show. */
+const INPUT_RESIDUE_MAX_ROUNDS = 60;
+const INPUT_RESIDUE_ROUND_WAIT_MS = 1_000;
+const INPUT_RESIDUE_POLL_MS = 100;
+/** #829: how many of the latest pastes can prove a draft is AgEnD's own. */
+const RECENT_PASTES_KEPT = 8;
 /** Build a status holder from channel metadata, keeping chat and thread apart. */
 function channelStatus(meta) {
     const chatId = meta.chat_id;
@@ -1202,6 +1222,8 @@ export class Daemon extends EventEmitter {
      *  comes from. See PaneWriteLock for why interleaving is destructive. */
     paneWriteLock = new PaneWriteLock();
     deliveryWritesStopping = false;
+    /** #829: the latest pastes, by spawn generation (see ownedInputDraft). */
+    recentPastes = [];
     pendingInstructionsUpdate;
     pendingInstructionsNotice = false;
     // Whether the warmup steering-reload notice should be injected after spawn.
@@ -1603,6 +1625,14 @@ export class Daemon extends EventEmitter {
             this.finishDurableDelivery(delivery, "uncertain", `${verdict.phase ?? "submission"}:unverified`);
             return;
         }
+        // A steer into a busy pane of a CLI whose input row cannot be read: the paste and the one Enter went through and the
+        // delivery's own unique marker is on the pane. That is "accepted into the live turn's input" — not "the model has read
+        // it", and delivery_status carries delivery_mode=steer — and it is all this class of backend can ever show for a steer
+        // (#1197). Labelled, so it is never mistaken for a proof that the input row was cleared.
+        if (verdict.proof === "steer-marker-on-pane") {
+            this.finishDurableDelivery(delivery, "delivered", "steer-accepted-marker-on-pane; input-row-unreadable");
+            return;
+        }
         this.finishDurableDelivery(delivery, "delivered", "positive submission proof");
     }
     deferDurableDelivery(meta, reason) {
@@ -1665,19 +1695,29 @@ export class Daemon extends EventEmitter {
         ensureInstanceDir(this.instanceDir);
         writeFileSync(join(this.instanceDir, "daemon.pid"), String(process.pid));
         this.logger.info(`Starting ${this.name}`);
-        // P1: Read crash state from previous run — skip resume if last run was a crash loop
+        // Recovery intent is one-shot, but only the reader may consume it. Keep
+        // an unreadable marker for a later start; clear successfully read bytes
+        // even when the JSON is corrupt so it cannot remain forever.
         const crashStatePath = join(this.instanceDir, "crash-state.json");
         try {
             if (existsSync(crashStatePath)) {
-                const state = JSON.parse(readFileSync(crashStatePath, "utf-8"));
-                if (state.resumeDisabled) {
-                    this.skipResume = true;
-                    this.logger.warn("Previous crash loop detected — starting without resume");
+                const content = readFileSync(crashStatePath, "utf-8");
+                try {
+                    const state = JSON.parse(content);
+                    if (state?.resumeDisabled === true) {
+                        this.skipResume = true;
+                        this.logger.warn("Previous crash loop detected — starting without resume");
+                    }
+                }
+                finally {
+                    try {
+                        unlinkSync(crashStatePath);
+                    }
+                    catch { /* best effort */ }
                 }
-                unlinkSync(crashStatePath);
             }
         }
-        catch { /* corrupt file — ignore */ }
+        catch { /* unreadable or corrupt file — ignore */ }
         // Restore last reply target so a fleet-topic instance can reply correctly
         // BEFORE its first post-restart inbound arrives (otherwise lastChatId is empty
         // → reply tool sends to "" → Discord 404).
@@ -3208,6 +3248,9 @@ export class Daemon extends EventEmitter {
      * transaction; the interrupt key still cancels the CLI generation.
      */
     clearPendingDeliveries(fleetEpoch) {
+        // FleetManager calls this synchronously before sendEscape. Cancel only the
+        // current human turn; leave already-forwarded tool requests to settle.
+        this.turnReplyGuard.cancelByUser();
         this.deliveryEpoch = fleetEpoch === undefined
             ? this.deliveryEpoch + 1
             : Math.max(this.deliveryEpoch, fleetEpoch);
@@ -3990,7 +4033,11 @@ export class Daemon extends EventEmitter {
      * message can arrive mid-turn and sit queued, and marking at arrival would let
      * the PREVIOUS turn's idle edge consume (and reset) the new turn's state.
      */
-    markTurnStarted(meta, deliveredText) {
+    markTurnStarted(meta, deliveredText, deliveryEpoch = this.deliveryEpoch) {
+        // Cancel may have interrupted an in-flight paste before its promise settled.
+        // Its late success must not re-arm the turn that the user just cancelled.
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
         // Channel turns only. A cross-instance inbound (from_instance, empty
         // chat_id) does not update lastChatId, so its proxy reply would land in
         // whatever USER topic spoke to this instance last — the wrong audience for
@@ -4031,6 +4078,12 @@ export class Daemon extends EventEmitter {
             this.turnReplyGuard.complete(turn.generation);
             return;
         }
+        // An intentional stop is not a dropped reply. Successful in-flight replies
+        // still settle above, but cancellation cannot start another model turn.
+        if (turn.cancelledByUser) {
+            this.turnReplyGuard.complete(turn.generation);
+            return;
+        }
         // A second idle edge ends the one permitted recovery turn. Never create a
         // third turn or guess at terminal text; make the failure visible instead.
         if (turn.phase === "recovering") {
@@ -4110,6 +4163,11 @@ export class Daemon extends EventEmitter {
             && this.backend?.replyCompletionGuard === true;
     }
     startReplyRecovery(turn, reason) {
+        const current = this.turnReplyGuard.snapshot();
+        if (current?.generation === turn.generation && current.cancelledByUser) {
+            this.turnReplyGuard.complete(turn.generation);
+            return;
+        }
         if (!this.turnReplyGuard.beginRecovery(turn.generation))
             return;
         this.emit("reply_drop_detected", {
@@ -4137,8 +4195,8 @@ export class Daemon extends EventEmitter {
         this.pasteQueueDepth++;
         this.pasteLock = this.pasteLock.then(async () => {
             try {
-                const current = this.turnReplyGuard.snapshot();
-                if (!current || current.generation !== turn.generation || current.phase !== "recovering")
+                const current = this.currentReplyRecovery(turn.generation, deliveryEpoch);
+                if (!current)
                     return;
                 if (current.completionDelivered) {
                     this.turnReplyGuard.complete(turn.generation);
@@ -4152,6 +4210,8 @@ export class Daemon extends EventEmitter {
                 const delivered = await this.deliverMessage(REPLY_RECOVERY_PROMPT, undefined, {
                     deliveryEpoch,
                 });
+                if (!this.currentReplyRecovery(turn.generation, deliveryEpoch))
+                    return;
                 if (!delivered) {
                     this.turnReplyGuard.complete(turn.generation);
                     this.reportUnrecoveredReplyDrop(turn, "recovery_prompt_delivery_failed");
@@ -4162,14 +4222,28 @@ export class Daemon extends EventEmitter {
             }
         }).catch(err => {
             this.logger.error({ err: err.message }, "Reply-drop recovery prompt failed");
+            if (!this.currentReplyRecovery(turn.generation, deliveryEpoch))
+                return;
             this.turnReplyGuard.complete(turn.generation);
             this.reportUnrecoveredReplyDrop(turn, "recovery_prompt_delivery_failed");
         });
     }
+    /** Recheck after queue waits and IO; cancellation must not become a failure notice. */
+    currentReplyRecovery(generation, deliveryEpoch) {
+        const current = this.turnReplyGuard.snapshot();
+        if (!current || current.generation !== generation || current.phase !== "recovering")
+            return null;
+        if (current.cancelledByUser || !this.isDeliveryEpochCurrent(deliveryEpoch)) {
+            this.turnReplyGuard.complete(generation);
+            return null;
+        }
+        return current;
+    }
     queueMalformedReplyRecovery(turn, text) {
         // Serialize the delivery decision ahead of any new pane input. If direct
         // delivery is positively acknowledged, there is no recovery turn. If its
         // outcome is unknown, do not ask the model to duplicate it.
+        const deliveryEpoch = this.deliveryEpoch;
         const delivery = this.deliverDaemonReply(text, "malformedreply", "Malformed tool-call recovery", turn.target);
         this.pasteQueueDepth++;
         this.pasteLock = this.pasteLock.then(async () => {
@@ -4180,17 +4254,24 @@ export class Daemon extends EventEmitter {
                     correlationId: turn.target.correlationId,
                     recovered: delivered,
                 });
+                const current = this.turnReplyGuard.snapshot();
                 this.turnReplyGuard.complete(turn.generation);
-                if (!delivered)
+                if (!delivered && current?.generation === turn.generation && !current.cancelledByUser
+                    && this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+                }
             }
             finally {
                 this.pasteQueueDepth--;
             }
         }).catch(err => {
             this.logger.error({ err: err.message }, "Malformed tool-call recovery attempt failed");
+            const current = this.turnReplyGuard.snapshot();
             this.turnReplyGuard.complete(turn.generation);
-            this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+            if (current?.generation === turn.generation && !current.cancelledByUser
+                && this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+            }
         });
     }
     reportUnrecoveredReplyDrop(turn, reason = "recovery_turn_missing_reply") {
@@ -4621,7 +4702,10 @@ export class Daemon extends EventEmitter {
                 // the new progress timestamp and re-arms both deadlines.
                 if (!expectedOutputAt)
                     this.instanceStateLastOutputAt = captureStartedAt;
-                this.scheduleInstanceStateStuckDeadline(this.instanceStateLastOutputAt || captureStartedAt);
+                // The deadline follows the state machine's latest sign of life (output events, content changes and the CLI's own
+                // turn clock all feed it). Keyed on the output clock alone it would be "now" again the moment a long quiet turn
+                // proved alive, and re-fire in a loop.
+                this.scheduleInstanceStateStuckDeadline(snapshot.observedAt - snapshot.unchangedForMs || captureStartedAt);
             }
         }
         catch (err) {
@@ -4684,7 +4768,7 @@ export class Daemon extends EventEmitter {
             : DEFAULT_STATE_IDLE_DEBOUNCE_MS;
         this.instanceStateReadyPattern = this.backend.getReadyPattern();
         this.instanceStateBusyPattern = this.backend.getBusyPattern?.() ?? null;
-        this.instanceStateMachine = new PaneStateMachine(this.instanceStateReadyPattern, this.instanceStateStuckTimeoutMs, Date.now(), this.instanceStateBusyPattern);
+        this.instanceStateMachine = new PaneStateMachine(this.instanceStateReadyPattern, this.instanceStateStuckTimeoutMs, Date.now(), this.instanceStateBusyPattern, this.backend.getLiveProgressTick ? (pane) => this.backend.getLiveProgressTick(pane) : null);
         this.instanceStateLastOutputAt = 0;
         this.instanceStatePeriodicIdleConfirmations = 0;
         this.instanceStateMonitorActive = true;
@@ -4994,6 +5078,16 @@ export class Daemon extends EventEmitter {
             return ""; // skip channel tools
         return name;
     }
+    /**
+     * A steered message reads like a queued one plus a banner. The delivery marker (`[agend-delivery-id:…]`, when the message
+     * is a durable delivery) must LEAD the persisted user message — restart reconciliation recognises a delivery only by a
+     * marker at the start of the body (#1197) — so the banner goes right after it, not in front of it.
+     */
+    static steerEnvelope(inbound) {
+        const banner = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n";
+        const marker = inbound.match(/^\[agend-delivery-id:[^\]\r\n]+\]\r?\n/);
+        return marker ? marker[0] + banner + inbound.slice(marker[0].length) : banner + inbound;
+    }
     /**
      * The one place an inbound message grows its metadata wrapper ([user:]/
      * [from:] prefix, pending reactions, handoff metadata, reply instructions).
@@ -5103,8 +5197,7 @@ export class Daemon extends EventEmitter {
         this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
         this.pendingWork.recordInbound();
         this.recordRecentUserMessage(content, meta);
-        const formatted = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n"
-            + this.formatInboundMessage(content, meta);
+        const formatted = Daemon.steerEnvelope(this.formatInboundMessage(content, meta));
         const status = channelStatus(meta);
         const durableAttempt = this.durableDeliveryAttempt(meta, content);
         if (durableAttempt === false) {
@@ -5131,7 +5224,7 @@ export class Daemon extends EventEmitter {
                     durableAttempt: durableAttempt || undefined,
                 })) {
                     this.finishDurableSubmission(durableAttempt, verdict);
-                    this.markTurnStarted(meta, formatted);
+                    this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
                 else if (durableAttempt && verdict.paneWriteStarted) {
                     this.finishDurableDelivery(durableAttempt, "uncertain", `${verdict.phase ?? "post-submit"}:${verdict.proof ?? "unproven"}`);
@@ -5186,7 +5279,7 @@ export class Daemon extends EventEmitter {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                 return;
             if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id })) {
-                this.markTurnStarted(meta, formatted);
+                this.markTurnStarted(meta, formatted, deliveryEpoch);
             }
         }).catch(err => {
             this.logger.warn({ err: err.message }, "btw delivery error");
@@ -5299,7 +5392,7 @@ export class Daemon extends EventEmitter {
                     durableAttempt: durableAttempt || undefined,
                 })) {
                     this.finishDurableSubmission(durable, verdict);
-                    this.markTurnStarted(meta, formatted);
+                    this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
                 else if (durableAttempt && verdict.paneWriteStarted) {
                     this.finishDurableDelivery(durable, "uncertain", `${verdict.phase ?? "post-submit"}:${verdict.proof ?? "unproven"}`);
@@ -5403,6 +5496,7 @@ export class Daemon extends EventEmitter {
         // this spawn generation. A spawn that starts afterwards is detected inside
         // the critical section, where this delivery backs out and redoes itself.
         const settleGeneration = this.spawnGeneration;
+        const settleFence = this.launchFenceEpoch;
         if (cancelled())
             return false;
         if (this.refuseFatalStartupDelivery(verdict, status))
@@ -5527,7 +5621,28 @@ export class Daemon extends EventEmitter {
                 }
                 if (!(await this.hasPositiveDeliveryInput()))
                     return "dialog";
-                return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true);
+                // #829: a CLI that restores a cancelled prompt into its input box would
+                // have this message pasted onto it and both submitted as one. Clear it
+                // first, or do not write at all. From here every await is fenced: a
+                // cancel, stop, freeze or spawn ends this attempt unwritten.
+                // The CLI process is its spawn generation; a recovered window id is the
+                // same process, a pause/stop/respawn is not (launchFenceEpoch moves even
+                // when a failed pause resumes the monitors).
+                const writeCurrent = () => !cancelled()
+                    && !this.deliveryWritesStopping
+                    && !this.runtimeMonitorsFrozen
+                    && !this.spawning
+                    && settleGeneration === this.spawnGeneration
+                    && settleFence === this.launchFenceEpoch;
+                const stale = () => (this.spawning || settleGeneration !== this.spawnGeneration ? "spawn-started" : false);
+                const residue = await this.clearRestoredInputDraft(handingOffToNativeQueue, writeCurrent);
+                if (residue === "stale")
+                    return stale();
+                if (residue !== "clear")
+                    return this.failDelivery(verdict, status, "input-residue", residue);
+                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent);
+                // Fenced before its first write: not attempted — redo after a spawn, else drop without a ❌.
+                return written === false && verdict.fenced ? stale() : written;
             });
             if (outcome === "spawn-started") {
                 // The pane changed under this delivery: its queued paste must not land
@@ -6291,6 +6406,114 @@ export class Daemon extends EventEmitter {
      * else submitted it); "failed" = the Enter could not be sent (the delivery
      * must fail rather than paste on top of the stranded text).
      */
+    /** #829: remember what this pane generation was given, so a draft can be proven to be ours. */
+    /**
+     * #829: remember what was pasted, under the spawn generation it was written
+     * to — fixed by the caller BEFORE its paste await, so a write that lands
+     * while the CLI is replaced is never credited to the replacement.
+     */
+    rememberPaste(text, generation) {
+        this.recentPastes.push({ generation, text });
+        if (this.recentPastes.length > RECENT_PASTES_KEPT)
+            this.recentPastes.splice(0, this.recentPastes.length - RECENT_PASTES_KEPT);
+    }
+    /**
+     * #829: whether the input box shows one of this generation's own pastes —
+     * exactly as the backend draws it, wrapping included (inputDraftShows). A
+     * marker that looks like AgEnD's, a collapsed paste whose content cannot be
+     * seen, or text that differs only in spacing proves nothing.
+     */
+    ownsInputDraft(draft) {
+        const shows = this.backend?.inputDraftShows;
+        if (!shows)
+            return false;
+        return this.recentPastes.some(p => p.generation === this.spawnGeneration && shows.call(this.backend, draft, p.text));
+    }
+    /**
+     * #829: empty the CLI's input box of a draft the CLI put back there itself
+     * (muse restores a cancelled prompt) before a delivery is pasted. Only for a
+     * backend that can read its box and names the keys that clear it; every other
+     * backend is untouched.
+     *
+     * Only a draft that is provably one of this pane's own pastes is cleared, one
+     * line per round, and every round must leave the first or last rows of what
+     * was there — anything else in the box is somebody's typing and stops the
+     * clearing. `current` is the caller's fixed fence (cancel, stop, freeze,
+     * pause, spawn): it is asked after every await, and a stale answer means
+     * nothing more is sent. A capture that fails, a box that does not empty or a
+     * draft that is not ours stops the delivery; it is never pasted onto.
+     */
+    async clearRestoredInputDraft(handingOffToNativeQueue, current) {
+        const backend = this.backend;
+        const tmux = this.tmux;
+        const keys = backend?.getClearInputKeys?.();
+        if (!backend?.inputDraft || !keys?.length || handingOffToNativeQueue || !tmux)
+            return "clear";
+        // undefined: the capture itself failed. null: read, but not a layout the backend knows.
+        const read = async () => {
+            let pane;
+            try {
+                pane = await tmux.capturePane();
+            }
+            catch {
+                return undefined;
+            }
+            return backend.inputDraft(pane);
+        };
+        const first = await read();
+        if (!current())
+            return "stale";
+        if (first === undefined) {
+            this.logger.warn("Could not read the input box before this delivery — not writing it");
+            return "unreadable";
+        }
+        // A screen the backend does not recognise keeps today's behaviour; the
+        // readiness checks before this one decide whether it is writable at all.
+        if (first === null || first.rows.length === 0)
+            return "clear";
+        if (!this.ownsInputDraft(first)) {
+            this.logger.warn({ rows: first.rows.length }, "The input box holds text AgEnD did not put there — not clearing it, and not writing this delivery onto it");
+            return "foreign-draft";
+        }
+        const original = first.rows;
+        // A round removes whole lines from one end: what is left is the original's
+        // first or last rows, unchanged.
+        const remainderOk = (rows) => rows.length <= original.length
+            && (rows.every((r, k) => r === original[k]) || rows.every((r, k) => r === original[original.length - rows.length + k]));
+        const same = (a, b) => a.length === b.length && a.every((r, k) => r === b[k]);
+        const rounds = Math.min(INPUT_RESIDUE_MAX_ROUNDS, original.length + 3);
+        this.logger.info({ rows: original.length }, "Clearing a restored draft from the input box before this delivery");
+        // `current` is asked after every await; between one of those answers and
+        // the next key there is no await.
+        let rows = original;
+        for (let round = 0; round < rounds; round++) {
+            const before = rows;
+            const sent = await tmux.sendKeySequence(keys);
+            if (!current())
+                return "stale";
+            if (!sent)
+                return "not-cleared";
+            const deadline = Date.now() + INPUT_RESIDUE_ROUND_WAIT_MS;
+            let next;
+            do {
+                await new Promise(r => setTimeout(r, INPUT_RESIDUE_POLL_MS));
+                next = await read();
+                if (!current())
+                    return "stale";
+            } while (next && next.rows.length > 0 && same(next.rows, before) && Date.now() < deadline);
+            if (!next)
+                return "not-cleared";
+            if (next.rows.length === 0)
+                return "clear";
+            if (!remainderOk(next.rows)) {
+                this.logger.warn({ rows: next.rows.length }, "The input box changed to text AgEnD did not put there — stopped clearing, not writing this delivery");
+                return "foreign-draft";
+            }
+            rows = next.rows;
+        }
+        this.logger.error({ rows: rows.length }, "The input box did not empty — not writing this delivery onto it");
+        return "not-cleared";
+    }
     async submitStrandedInputIfAny(windowId) {
         if (!this.tmux || !this.backend)
             return "idle";
@@ -6612,10 +6835,15 @@ export class Daemon extends EventEmitter {
     async writeMessageToPane(formatted, initialWindowId, handingOffToNativeQueue, status, submissionId, 
     // Last and defaulted so the positional callers that ignore the outcome stay
     // readable; deliverMessage, the only one that reports, always passes its own.
-    verdict = { reached: false }, durableAttempt, steer = false) {
+    verdict = { reached: false }, durableAttempt, steer = false, 
+    // #829: the caller's fence, asked once more after the last await before the
+    // first side effect. Stale means unwritten: false, with no failure verdict.
+    stillCurrent) {
         const signature = this.submissionSignature(formatted, submissionId);
         const rawPaste = durableAttempt?.submissionMode === "raw_paste";
         let windowId = initialWindowId;
+        // The spawn this write belongs to: acceptance evidence is only read while it is still the current one (#1197).
+        const spawnAtWrite = this.spawnGeneration;
         // Bug A: paste with backoff. Transient failures are usually a stale window id
         // after a crash/respawn — recover by name and retry (max 3 attempts, 2s apart).
         const maxAttempts = 3;
@@ -6625,6 +6853,12 @@ export class Daemon extends EventEmitter {
             // Read the pane BEFORE writing to it, so the submission check can require
             // evidence this paste ADDED rather than evidence that was already there.
             const pasteBaseline = await this.capturePaneEvidence(signature);
+            // Every attempt, retries included: a stop or respawn during a recovery wait ends it unwritten.
+            // After a durable begin, the caller's abort path owns the row; only an attempt with no begin may be redone.
+            if (stillCurrent && !stillCurrent()) {
+                verdict.fenced = !verdict.durableBeginCommitted;
+                return false;
+            }
             // Readiness, idle-gate, dialog, spawn and pane-lock waits have all ended.
             // Commit the submission fence at the last possible point before the
             // first side effect; a crash during those waits remains safely replayable.
@@ -6637,6 +6871,10 @@ export class Daemon extends EventEmitter {
                     pastedContentSha256: durableAttempt.contentSha256 ?? null,
                     pastedBytesSha256: deliveryContentDigest(formatted),
                 };
+                if (stillCurrent && !stillCurrent()) {
+                    verdict.fenced = true;
+                    return false;
+                }
                 if (!this.beginDurableDelivery(durableAttempt, attemptEvidence)) {
                     verdict.durableBeginRejected = true;
                     verdict.phase = "submission-begin";
@@ -6651,7 +6889,10 @@ export class Daemon extends EventEmitter {
             // failed/throwing write as uncertain rather than retrying bytes into the
             // same pane; the write-ahead Enter marker later separates safe pre-Enter
             // recovery from a possibly executed command.
+            const pasteGeneration = this.spawnGeneration;
             const pasted = await this.tmux.pasteBuffer(formatted);
+            if (pasted)
+                this.rememberPaste(formatted, pasteGeneration);
             if (!pasted) {
                 if (rawPaste) {
                     verdict.phase = "raw-paste-write";
@@ -6757,6 +6998,18 @@ export class Daemon extends EventEmitter {
                         verdict.proof = proof;
                         return false;
                     }
+                    // A steer into a busy pane of a CLI with no input-row reader (claude-code, grok, muse): it can never be shown to
+                    // have left the input row, and the idle→busy edge that proves an ordinary submission cannot exist in a pane that
+                    // is already busy. What it CAN show, and what is enough to call the steer accepted, is its own trusted unique
+                    // marker on the pane after the one Enter — with the dialog, spawn and window unchanged (#1197).
+                    if (steer && signature.unique && !this.backend?.getBottomReadyPattern?.()
+                        && await this.steerMarkerAccepted(signature, pasteBaseline, spawnAtWrite, windowId)) {
+                        verdict.phase = "steer-accepted";
+                        verdict.proof = "steer-marker-on-pane";
+                        if (status)
+                            this.emit("message_confirmed", status); // ✅ accepted into the live turn
+                        return true;
+                    }
                     // Re-pasting on a backend without structured Codex pane evidence
                     // would risk duplication; retain its legacy best-effort behavior.
                     this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
@@ -6985,6 +7238,29 @@ export class Daemon extends EventEmitter {
      * — fall back to "the pane printed something" whenever a paste left no trace,
      * which is the same false confirmation one layer down.
      */
+    /**
+     * The acceptance evidence for a steer whose input row cannot be read: a FRESH capture shows this delivery's trusted unique
+     * marker more often than the pre-paste baseline did, no blocking dialog owns the pane, and it is still the spawn and the
+     * window the paste went into. (The marker is the `message_id:` value AgEnD put in the handoff metadata — never text
+     * scanned out of a body — so an older or quoted line cannot match it.)
+     */
+    async steerMarkerAccepted(signature, baseline, spawnGeneration, windowId) {
+        if (!this.tmux)
+            return false;
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return false;
+        }
+        // "More often than before the paste" needs a before: a baseline that could not be read is not a count of zero.
+        if (!baseline || this.paneEvidence(pane, signature).payload <= baseline.payload)
+            return false;
+        const dialogClear = (await this.probeBlockingDialog()).state === "clear";
+        // Asked last, after every await: the read evidence is only worth anything for the pane it was read from.
+        return dialogClear && this.spawnGeneration === spawnGeneration && this.getWindowId() === windowId;
+    }
     canProveSubmission() {
         return !!this.backend?.getBottomReadyPattern?.();
     }
@@ -7286,10 +7562,12 @@ export class Daemon extends EventEmitter {
         else {
             baseline = await this.capturePaneEvidence(signature);
         }
+        const pasteGeneration = this.spawnGeneration;
         if (!(await this.tmux.pasteBuffer(text))) {
             this.logger.warn({ label }, "System paste failed to reach the pane");
             return false;
         }
+        this.rememberPaste(text, pasteGeneration);
         await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
         if (!(await this.sendDeliveryEnter(label, guard?.current)))
             return false;