@songsid/agend 2.1.12-beta.7 → 2.1.12-beta.9

package/dist/daemon.js

@@ -30,13 +30,14 @@ import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
 import { buildFleetInstructions } from "./instructions.js";
 import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata, } from "./cross-instance-envelope.js";
-import { bottomRowIsReady, inputAreaText, inputShowsPastedText, pastedTextSignature, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
+import { agendMessageInInput, bottomRowIsReady, inputAreaText, inputShowsPastedText, pastedTextSignature, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
 import { TurnReplyGuard } from "./turn-reply-guard.js";
 import { t } from "./locale.js";
 import { MuseUsageRelay, clearMuseUsageSnapshot } from "./muse-usage-relay.js";
 import { deliveryContentDigest } from "./delivery-outbox.js";
 import { queueResumePolicyForAttempt } from "./delivery-queue-evidence.js";
 import { scanTranscriptForDeliveryMarker } from "./delivery-reconciliation.js";
+import { TranscriptDeltaReader } from "./transcript-delta-reader.js";
 import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
 import { codexLiveRowMatches } from "./backend/codex.js";
 import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
@@ -68,6 +69,10 @@ const REPLY_DROP_WARNING_COOLDOWN_MS = 5 * 60_000;
 const REPLY_GUARD_IDLE_CONFIRM_MS = 60_000;
 const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. React with an emoji or use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, a brief react is sufficient. If you already replied to this message, do nothing. Do not reply to this system instruction except through the react or reply tool.";
 /** Point a resumed CLI at its one backend-native instruction source. */
+/** The outbox evidence for a delivery the CLI's transcript shows taken (#758). */
+function transcriptMarkerEvidence(kind) {
+    return kind === "user" ? "transcript-marker" : "transcript-marker-queued";
+}
 export function buildInstructionReloadNotice(binaryName, instanceName, instanceDir) {
     const source = binaryName === "codex" || binaryName === "grok" || binaryName === "muse"
         ? "AGENTS.md"
@@ -1765,7 +1770,8 @@ export class Daemon extends EventEmitter {
             this.finishDurableDelivery(delivery, "delivered", OUTPUT_EDGE_ONLY_EVIDENCE);
             return;
         }
-        this.finishDurableDelivery(delivery, "delivered", "positive submission proof");
+        this.finishDurableDelivery(delivery, "delivered", verdict.transcriptProof
+            ? `positive submission proof; ${transcriptMarkerEvidence(verdict.transcriptProof)}` : "positive submission proof");
     }
     /**
      * Finish a delivery that only the output edge vouched for, by the delivery's own marker in the CLI's transcript (#758).
@@ -1794,7 +1800,7 @@ export class Daemon extends EventEmitter {
                 const found = await scanTranscriptForDeliveryMarker(checkpoint.path, checkpoint.offset, checkpoint.backend, delivery.deliveryId);
                 if (found === "user" || found === "queued") {
                     outcome = "delivered";
-                    evidence = found === "user" ? "transcript-marker" : "transcript-marker-queued";
+                    evidence = transcriptMarkerEvidence(found);
                     break;
                 }
                 last = found;
@@ -2073,6 +2079,15 @@ export class Daemon extends EventEmitter {
             // conversation store via a pluggable source. Backends with no known
             // source stay inert exactly as before.
             this.transcriptMonitor = new TranscriptMonitor(this.instanceDir, this.logger, createTranscriptSource(this.config.backend ?? "claude-code", this.config.working_directory, this.credentialProfileStore()));
+            const transcriptMonitor = this.transcriptMonitor;
+            const transcriptFence = this.launchFenceEpoch;
+            // Baseline in the isolate before this daemon accepts new work. A
+            // stopped/replaced launch may never re-arm polling after this await.
+            await transcriptMonitor.initialize();
+            if (this.startupAborted || this.launchFenceEpoch !== transcriptFence || this.transcriptMonitor !== transcriptMonitor) {
+                transcriptMonitor.stop();
+                return;
+            }
             // 5. Wire transcript events
             const ackIfPending = () => {
                 if (!this.pendingAckMessage || !this.adapter)
@@ -2843,7 +2858,13 @@ export class Daemon extends EventEmitter {
                         // was just stopped or paused (#1160 review).
                         if (this.runtimeMonitorsFrozen || this.healthCheckPaused)
                             return;
-                        this.transcriptMonitor?.resetOffset();
+                        // Reset is synchronous for file sources, but Kiro's baseline is
+                        // read off-thread. Finish it before starting the replacement CLI,
+                        // otherwise its first work could become part of that baseline.
+                        if (!await this.resetTranscriptBeforeAdmission())
+                            return;
+                        if (this.runtimeMonitorsFrozen || this.healthCheckPaused)
+                            return;
                         // Kill orphan MCP server from the crashed CLI session.
                         // MCP server writes its PID to channel.mcp.pid on startup.
                         try {
@@ -4252,50 +4273,77 @@ export class Daemon extends EventEmitter {
         // concurrency coordination, first output + idle is `budgetMs`, the dialog
         // scan is STARTUP_DIALOG_BUDGET_MS — so the outcome is always trySpawn's
         // own verdict. A soft timer only makes a slow wake visible in the log.
-        const transition = this.autoPauseController.wakeOnDeliver(async () => {
-            const slow = setTimeout(() => {
-                this.logger.warn({ budgetMs }, "Wake is exceeding its budget — still waiting for the spawn (it cannot be cancelled)");
-            }, budgetMs + STARTUP_DIALOG_BUDGET_MS);
-            slow.unref?.();
+        const wakeFence = this.launchFenceEpoch;
+        const wakeGeneration = this.spawnGeneration;
+        const isCurrent = () => !this.startupAborted && this.launchFenceEpoch === wakeFence
+            && this.spawnGeneration === wakeGeneration && this.pauseWakeState === "waking";
+        // The shared transition covers baseline initialization as well as spawn.
+        // Every wake().then(deliver) caller must wait for the same admission edge.
+        const transition = (async () => {
             try {
-                const ready = await this.trySpawn(true, budgetMs);
-                if (!ready)
-                    throw new Error(`Wake failed: the CLI did not become ready (budget ${budgetMs}ms)`);
+                await this.autoPauseController.wakeOnDeliver(async () => {
+                    const slow = setTimeout(() => {
+                        this.logger.warn({ budgetMs }, "Wake is exceeding its budget — still waiting for the spawn (it cannot be cancelled)");
+                    }, budgetMs + STARTUP_DIALOG_BUDGET_MS);
+                    slow.unref?.();
+                    try {
+                        const ready = await this.trySpawn(true, budgetMs);
+                        if (!ready)
+                            throw new Error(`Wake failed: the CLI did not become ready (budget ${budgetMs}ms)`);
+                    }
+                    finally {
+                        clearTimeout(slow);
+                    }
+                });
+                if (!isCurrent())
+                    throw new Error("Wake cancelled: the launch was superseded");
+                if (!await this.resetTranscriptBeforeAdmission() || !isCurrent()) {
+                    throw new Error("Wake cancelled: transcript initialization was superseded");
+                }
+                this.pauseWakeState = "active";
+                this.healthCheckPaused = false;
+                this.pauseRequested = false;
+                // trySpawn resolved only after the new CLI reached its ready prompt.
+                // Discard any recovery gate retained while monitors were frozen.
+                this.clearErrorRecoveryGate();
+                clearPausedMarker(this.instanceDir);
+                this.resumeRuntimeMonitors();
+                this.logger.info("Instance auto-woke");
+                this.ipcServer?.broadcast({
+                    type: "instance_state", instanceName: this.name, state: this.instanceState, pausedAt: null,
+                });
+                this.emit("auto_woke", { name: this.name });
+            }
+            catch (err) {
+                if (isCurrent()) {
+                    this.pauseWakeState = "paused";
+                    this.healthCheckPaused = true;
+                }
+                this.logger.error({ err: err.message }, "Instance wake failed");
+                throw err;
             }
             finally {
-                clearTimeout(slow);
+                this.endSpawn();
             }
-        });
+        })();
         this.pauseWakeTransition = transition;
         try {
             await transition;
-            this.pauseWakeState = "active";
-            this.healthCheckPaused = false;
-            this.pauseRequested = false;
-            // trySpawn resolved only after the new CLI reached its ready prompt.
-            // Discard any recovery gate retained while monitors were frozen.
-            this.clearErrorRecoveryGate();
-            clearPausedMarker(this.instanceDir);
-            this.transcriptMonitor?.resetOffset();
-            this.resumeRuntimeMonitors();
-            this.logger.info("Instance auto-woke");
-            this.ipcServer?.broadcast({
-                type: "instance_state", instanceName: this.name, state: this.instanceState, pausedAt: null,
-            });
-            this.emit("auto_woke", { name: this.name });
-        }
-        catch (err) {
-            this.pauseWakeState = "paused";
-            this.healthCheckPaused = true;
-            this.logger.error({ err: err.message }, "Instance wake failed");
-            throw err;
         }
         finally {
-            this.endSpawn();
             if (this.pauseWakeTransition === transition)
                 this.pauseWakeTransition = null;
         }
     }
+    /** A reset baseline must settle before a launch admits new work. */
+    async resetTranscriptBeforeAdmission() {
+        const monitor = this.transcriptMonitor;
+        const fence = this.launchFenceEpoch, generation = this.spawnGeneration;
+        monitor?.resetOffset();
+        await monitor?.initialize();
+        return !this.startupAborted && this.launchFenceEpoch === fence
+            && this.spawnGeneration === generation && this.transcriptMonitor === monitor;
+    }
     /**
      * One line per edge, until the instance is flapping. The edges themselves are
      * still published to every observer; only the log is limited, so the next
@@ -6143,7 +6191,7 @@ export class Daemon extends EventEmitter {
             const canHandOff = (supportsQueuedInput || opts?.steer)
                 && readiness === "busy"
                 && (await this.probeBlockingDialog()).state === "clear"
-                && await this.hasPositiveDeliveryInput();
+                && await this.hasPositiveDeliveryInput(true);
             if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
@@ -6240,7 +6288,7 @@ export class Daemon extends EventEmitter {
                     if (probe.state !== "clear")
                         return "dialog";
                 }
-                if (!(await this.hasPositiveDeliveryInput()))
+                if (!(await this.hasPositiveDeliveryInput(handingOffToNativeQueue)))
                     return "dialog";
                 // #829: a CLI that restores a cancelled prompt into its input box would
                 // have this message pasted onto it and both submitted as one. Clear it
@@ -6262,6 +6310,9 @@ export class Daemon extends EventEmitter {
                 if (residue !== "clear")
                     return this.failDelivery(verdict, status, "input-residue", residue);
                 const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent);
+                // The hand-off's last capture had no box: nothing was begun or written — wait for readiness, then try again.
+                if (written === "handoff-box-unread")
+                    return "dialog";
                 // Fenced before its first write: not attempted — redo after a spawn, else drop without a ❌.
                 return written === false && verdict.fenced ? stale() : written;
             });
@@ -6809,8 +6860,26 @@ export class Daemon extends EventEmitter {
         }
         return true;
     }
-    /** Codex can paint a prompt before the TTY enters raw mode. Both are required. */
-    async hasPositiveDeliveryInput() {
+    /**
+     * Codex can paint a prompt before the TTY enters raw mode. Both are required.
+     *
+     * A hand-off into a busy pane (native queue or steer) pastes and presses Enter at once, so a backend with a structural
+     * box reader must see its box on a fresh capture first: a pane whose box cannot be read — a modal the dialog table
+     * does not know, a frame the reader refuses, a failed capture — is not one to type into (#1169 review). Asked
+     * before the hand-off is chosen and again under the pane lock, right before the write; false waits for readiness.
+     */
+    async hasPositiveDeliveryInput(handOff = false) {
+        if (handOff && this.backend?.readInputRow) {
+            if (!this.tmux)
+                return false;
+            try {
+                if (this.backend.readInputRow(await this.tmux.capturePane()) === null)
+                    return false;
+            }
+            catch {
+                return false;
+            }
+        }
         if (!this.needsStartupInputProof())
             return true;
         const check = this.backend?.isDeliveryInputReadyPane;
@@ -7494,6 +7563,15 @@ export class Daemon extends EventEmitter {
                 verdict.fenced = !verdict.durableBeginCommitted;
                 return false;
             }
+            // A hand-off pastes and presses Enter into a busy pane: the box must still be readable on this, the last capture
+            // before the write (#1169 review) — a modal that appeared after the under-lock check would take that Enter. Before
+            // the durable begin the caller waits for readiness outside the lock and tries again; after it (a paste retry),
+            // nothing was written and the attempt ends like a paste that failed.
+            if (handingOffToNativeQueue && this.backend?.readInputRow && !pasteBaseline?.inputReadable) {
+                if (!verdict.durableBeginCommitted)
+                    return "handoff-box-unread";
+                return this.failDelivery(verdict, status, "paste", "handoff-input-unreadable");
+            }
             // Readiness, idle-gate, dialog, spawn and pane-lock waits have all ended.
             // Commit the submission fence at the last possible point before the
             // first side effect; a crash during those waits remains safely replayable.
@@ -7523,6 +7601,11 @@ export class Daemon extends EventEmitter {
                         path: attemptEvidence.transcriptPath,
                         offset: attemptEvidence.transcriptOffset,
                     };
+                    // From here every proof of this write may also ask the CLI's transcript (the pane can lose the echo to the
+                    // reply, or still be painting the paste) — this delivery's exact marker only.
+                    if (["claude-code", "codex"].includes(attemptEvidence.backend)) {
+                        signature.transcript = this.transcriptProofFor(verdict.transcriptCheckpoint, durableAttempt.deliveryId, spawnAtWrite, stillCurrent, kind => { verdict.transcriptProof = kind; });
+                    }
                 }
             }
             if (rawPaste)
@@ -7700,7 +7783,7 @@ export class Daemon extends EventEmitter {
                     // The recovery Enter can be accepted before Codex paints its new
                     // transcript. One immediate capture is not a failure verdict: give
                     // that echo/queue a bounded chance to appear, without re-pasting.
-                    const afterEnter = this.backend?.isDeliveryInputReadyPane
+                    const afterEnter = this.structuredInputEvidence()
                         ? await this.lateCodexSubmissionProof(signature, pasteBaseline, true)
                         : await this.confirmSubmitted(signature, pasteBaseline);
                     if (afterEnter === "submitted") {
@@ -7714,8 +7797,8 @@ export class Daemon extends EventEmitter {
                     // another turn's output — and treating that as proof re-confirms a
                     // message nobody submitted. Output is corroboration; text sitting in
                     // the input row is disqualifying, and disqualifying evidence wins.
-                    if (this.backend?.isDeliveryInputReadyPane && afterEnter !== "stranded") {
-                        this.logger.warn({ phase: "native-queue-submit", proof: afterEnter, strandedAt }, "Codex recovery Enter outcome uncertain — no hard failure or duplicate paste");
+                    if (this.structuredInputEvidence() && afterEnter !== "stranded") {
+                        this.logger.warn({ phase: "native-queue-submit", proof: afterEnter, strandedAt }, `${this.cliLabel()} recovery Enter outcome uncertain — no hard failure or duplicate paste`);
                         verdict.phase = "native-queue-submit";
                         verdict.proof = afterEnter;
                         return false;
@@ -7723,11 +7806,15 @@ export class Daemon extends EventEmitter {
                     this.logger.error({ afterEnter, strandedAt }, "Stranded message could not be submitted by Enter");
                     return this.failDelivery(verdict, status, "native-queue-submit", afterEnter);
                 }
-                if (this.backend?.isDeliveryInputReadyPane) {
+                // A structural box reader (claude-code, #1200) is in the same position as Codex once the turn has run: the
+                // message may have been taken and its echo scrolled out, the queue drained, the box empty — or the capture
+                // failed. None of that proves the paste was lost, so nothing short of positive evidence is a reason to paste
+                // again (#1353 review); "unverifiable" used to, and could submit the message twice.
+                if (this.backend?.isDeliveryInputReadyPane || this.backend?.readInputRow) {
                     // In Codex a missing viewport echo is inconclusive, not a proof of
                     // loss. Another paste could run the same request twice. Leave the
                     // already-pasted delivery at 👀 and let the next observation decide.
-                    this.logger.warn({ phase: "native-queue-proof", proof: settled }, "Codex native-queue outcome uncertain — not re-pasting");
+                    this.logger.warn({ phase: "native-queue-proof", proof: settled }, `${this.cliLabel()} native-queue outcome uncertain — not re-pasting`);
                     verdict.phase = "native-queue-proof";
                     verdict.proof = settled;
                     return false;
@@ -7824,7 +7911,7 @@ export class Daemon extends EventEmitter {
                         verdict.proof = "output-edge";
                 }
                 else {
-                    const proof = this.backend?.isDeliveryInputReadyPane
+                    const proof = this.structuredInputEvidence()
                         ? await this.lateCodexSubmissionProof(signature, pasteBaseline)
                         : await this.confirmSubmitted(signature, pasteBaseline);
                     if (proof === "submitted") {
@@ -7832,12 +7919,12 @@ export class Daemon extends EventEmitter {
                             this.emit("message_confirmed", status);
                         return true;
                     }
-                    if (this.backend?.isDeliveryInputReadyPane && proof !== "stranded") {
+                    if (this.structuredInputEvidence() && proof !== "stranded") {
                         // This is the observed #910 race: the CLI processed the message
                         // although its echo had not appeared within the proof window. A
                         // missing viewport signature cannot establish non-delivery; keep
                         // 👀 and never emit the sender's hard ❌ or re-paste blindly.
-                        this.logger.warn({ phase: "post-submit-proof", proof }, "Codex delivery outcome uncertain — no hard failure or duplicate paste");
+                        this.logger.warn({ phase: "post-submit-proof", proof }, `${this.cliLabel()} delivery outcome uncertain — no hard failure or duplicate paste`);
                         verdict.phase = "post-submit-proof";
                         verdict.proof = proof;
                         return false;
@@ -7910,7 +7997,7 @@ export class Daemon extends EventEmitter {
         return dialogClear && this.spawnGeneration === spawnGeneration && this.getWindowId() === windowId;
     }
     canProveSubmission() {
-        return !!this.backend?.getBottomReadyPattern?.();
+        return this.readsInput();
     }
     /** Positive submission retires the startup transient guard for this spawn. */
     submittedProof() {
@@ -7947,18 +8034,22 @@ export class Daemon extends EventEmitter {
             }
             return busy;
         }
-        if (this.backend?.isDeliveryInputReadyPane) {
+        if (this.structuredInputEvidence()) {
             // Codex's first post-wake redraw may hide the echo for a few seconds.
             // Absence from a viewport is NOT proof the paste was lost, so only a
             // positively identified strand authorizes another Enter. Never re-paste
             // here: the CLI may already be processing the unique message_id.
             let proof = "unproven";
             const firstDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            // A structural box reader (claude-code) sees its box still holding the paste for a moment after an Enter it did
+            // take — Claude paints the submit late (captured live on 2.1.293: ~40 captures in a row). So for it a strand
+            // proves a swallowed Enter only once it outlasts the window; an early one is polled through. Codex keeps its rule.
+            const strandMustPersist = !!this.backend?.readInputRow;
             for (;;) {
                 proof = await this.confirmSubmitted(signature, baseline);
                 if (proof === "submitted")
                     return true;
-                if (proof === "stranded" || Date.now() >= firstDeadline)
+                if ((proof === "stranded" && !strandMustPersist) || Date.now() >= firstDeadline)
                     break;
                 await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
             }
@@ -8008,13 +8099,65 @@ export class Daemon extends EventEmitter {
     async confirmSubmitted(signature, baseline) {
         if (!this.tmux)
             return "unproven";
-        let pane;
+        let pane = null;
         try {
             pane = await this.tmux.capturePane();
         }
-        catch {
-            return "unproven";
-        }
+        catch { /* the transcript may still say */ }
+        const onPane = pane === null ? "unproven" : this.judgeSubmission(pane, signature, baseline);
+        if (onPane === "submitted")
+            return onPane;
+        const t = signature.transcript;
+        const found = await this.transcriptLook(signature);
+        // One synchronous stretch from here: the fence is asked after the last await, and only then is the hit kept and the
+        // spawn's guard retired — a stop or respawn that lands between the look and this line leaves both untouched.
+        if (!found || !t?.current())
+            return onPane;
+        if (!t.provenBy) {
+            t.provenBy = found;
+            t.onProof?.(found);
+        }
+        return this.submittedProof();
+    }
+    /**
+     * The CLI's transcript, from this attempt's checkpoint, holds this delivery's exact marker: a user entry (read) or
+     * one it queued (taken into its queue). Either is the CLI having taken the
+     * message, so it outranks the pane — including a box that still shows the paste a moment after Enter (Claude paints
+     * the submit late, captured live on 2.1.293), which on its own reads as a strand. Positive only; never a downgrade.
+     */
+    async transcriptLook(signature) {
+        const t = signature.transcript;
+        if (!t || !t.current())
+            return null;
+        if (t.provenBy)
+            return t.provenBy;
+        const found = await t.reader.look();
+        // No side effect here: the caller keeps the hit and retires the guard only after its own fence check.
+        return found === "user" || found === "queued" ? found : null;
+    }
+    /**
+     * A write's transcript proof: bounded looks from its checkpoint, fenced to the write — its spawn and launch, a stop,
+     * and the caller's own fence — so a look that lands after any of them is never used (#1380 review).
+     */
+    transcriptProofFor(checkpoint, deliveryId, spawnAtWrite, stillCurrent, onProof) {
+        const launchAtWrite = this.launchFenceEpoch;
+        return {
+            reader: new TranscriptDeltaReader(checkpoint.path, checkpoint.offset, checkpoint.backend, deliveryId),
+            current: () => !this.deliveryWritesStopping && this.spawnGeneration === spawnAtWrite
+                && this.launchFenceEpoch === launchAtWrite && (stillCurrent?.() ?? true),
+            onProof,
+        };
+    }
+    /** The CLI this daemon drives, for log lines shared by every backend ("claude-code", "codex", …). */
+    cliLabel() {
+        return this.config.backend ?? this.backend?.binaryName ?? "CLI";
+    }
+    /**
+     * The verdict one snapshot supports — the live viewport, or (for a unique signature) the scrollback a late proof
+     * reads. One judge for both, so a history read cannot vouch for what the live one refuses: an unreadable box, or our
+     * text still in it (#1353 review).
+     */
+    judgeSubmission(pane, signature, baseline) {
         // Without a way to tell the input row from the transcript, "the text is on
         // screen" cannot distinguish submitted from stranded — that ambiguity IS
         // the bug. Such a backend gets an explicit verdict rather than a guess:
@@ -8024,8 +8167,7 @@ export class Daemon extends EventEmitter {
         // for the first and recovers on the second, which is what it did before —
         // the fix here is for backends that CAN be read, not a new guess for those
         // that cannot.
-        const prompt = this.backend?.getBottomReadyPattern?.();
-        if (!prompt) {
+        if (!this.readsInput()) {
             const seen = this.paneEvidence(pane, signature);
             if (signature.unique && seen.payload > 0)
                 return "unverifiable";
@@ -8042,6 +8184,11 @@ export class Daemon extends EventEmitter {
             && !this.backend.getBusyPattern?.()?.test(pane)) {
             return after.payload > 0 ? "unverifiable" : "unproven";
         }
+        // A structural reader (claude-code) that finds no input box on this screen — a dialog in front of it, a layout it
+        // does not know — cannot place our text on either side of the box: the same verdicts as a readerless backend.
+        if (this.backend?.readInputRow && !after.inputReadable) {
+            return after.payload > 0 ? "unverifiable" : "unproven";
+        }
         // 1. Disqualifying evidence, checked FIRST and never overridden by the
         //    corroborating evidence below: our text is sitting in the input row, so
         //    it was not submitted — whatever else is on screen.
@@ -8052,8 +8199,22 @@ export class Daemon extends EventEmitter {
         //    Otherwise an older stranded message with the same opening would be
         //    read as ours, we would press Enter to "recover" it, and the turn IT
         //    starts would confirm a message that never reached the pane.
-        if (after.strandedInput && (signature.unique || baseline?.strandedInput === false))
+        //
+        //    For a structural box reader (claude-code), "did not already show it" needs a baseline whose box was READ: an
+        //    unreadable one (a dialog, a redraw the reader refused) says nothing about what the box held, and counting it as
+        //    empty would claim an older message as ours and press Enter on it (#1353 review). The prompt-row backends (codex,
+        //    kiro) keep their existing attribution.
+        const attributable = baseline != null
+            && (!this.backend?.readInputRow || (baseline.inputReadable && after.inputReadable));
+        if (after.strandedInput && (signature.unique || (attributable && baseline.strandedInput === false)))
+            return "stranded";
+        //    A paste the CLI shows collapsed carries no signature at all. One the box did not hold before we pasted is
+        //    ours, and it is still in the box — whatever echo or output is on screen (#1200).
+        if (attributable && after.collapsedPastes > baseline.collapsedPastes)
             return "stranded";
+        //    Something sits in the box that cannot be attributed either way. Only a unique signature seen outside the box
+        //    (below) can still prove this delivery; nothing else on screen may.
+        const unattributedResidue = !attributable && (after.strandedInput || after.collapsedPastes > 0);
         // 2. Positive evidence. A unique signature needs no baseline: no earlier
         //    message can carry this delivery's message_id, so finding it outside
         //    the input row is proof in itself — which also means a momentary
@@ -8061,12 +8222,16 @@ export class Daemon extends EventEmitter {
         //    message into a re-paste.
         if (signature.unique && after.payload > 0)
             return this.submittedProof();
+        if (unattributedResidue)
+            return "unverifiable";
         // 3. Otherwise the evidence must be NEW relative to the pane as it was
         //    before we pasted: a queue marker left by an earlier message, or an
         //    older transcript entry that opens the same way, are on screen either
         //    way and would otherwise confirm a paste that never landed.
         if (baseline) {
-            if (after.queued > baseline.queued)
+            // A queue is new only against a box that was read before the paste (a reader backend): an unreadable baseline
+            // says nothing about whether the queue was already there.
+            if (after.queued > baseline.queued && (!this.backend?.readInputRow || baseline.inputReadable))
                 return this.submittedProof();
             if (after.payload > baseline.payload)
                 return this.submittedProof();
@@ -8094,12 +8259,10 @@ export class Daemon extends EventEmitter {
                 return proof;
             if (signature.unique && this.tmux?.capturePaneWithHistory) {
                 try {
+                    // Scrollback can hold the echo the viewport lost — but it is judged exactly like the viewport: a box that
+                    // cannot be read, or that still holds our text, is never upgraded by an echo further up.
                     const history = await this.tmux.capturePaneWithHistory(300);
-                    const seen = this.paneEvidence(history, signature);
-                    const known = !this.backend?.isDeliveryInputReadyPane
-                        || this.backend.isDeliveryInputReadyPane(history)
-                        || this.backend.getBusyPattern?.()?.test(history);
-                    if (known && seen.payload > 0 && !seen.strandedInput)
+                    if (this.judgeSubmission(history, signature, baseline) === "submitted")
                         return this.submittedProof();
                 }
                 catch { /* a failed history read proves neither delivery nor loss */ }
@@ -8123,9 +8286,8 @@ export class Daemon extends EventEmitter {
             try {
                 const pane = await this.tmux.capturePane();
                 const evidence = this.paneEvidence(pane, signature);
-                const prompt = this.backend?.getBottomReadyPattern?.();
-                if (prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
-                    && strandedAgendMessageInInput(pane, prompt)) {
+                const input = this.inputRegion(pane);
+                if (input && agendMessageInInput(input.text)) {
                     // Whatever we paste now lands after it, and one Enter submits both as
                     // a single message. Nothing here can undo that; saying so beats
                     // letting two messages silently merge.
@@ -8144,16 +8306,45 @@ export class Daemon extends EventEmitter {
         return null;
     }
     paneEvidence(pane, signature) {
-        const marker = this.backend?.getQueuedInputMarker?.();
-        const prompt = this.backend?.getBottomReadyPattern?.();
-        const input = prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
-            ? inputAreaText(pane, prompt) : null;
+        const input = this.inputRegion(pane);
+        // A structural box reader vouches for the queue itself (InputBox.queued): a marker's words elsewhere on the pane —
+        // a reply quoting it, an old block — are not a queue (#1169 review). Other backends count their marker rows.
+        const marker = this.backend?.readInputRow ? null : this.backend?.getQueuedInputMarker?.();
         return {
-            queued: marker ? pane.split(/\r?\n/).filter(row => marker.test(row)).length : 0,
+            queued: this.backend?.readInputRow
+                ? (input?.queued ? 1 : 0)
+                : marker ? pane.split(/\r?\n/).filter(row => marker.test(row)).length : 0,
             payload: countOccurrences(pane.replace(/\s+/g, ""), signature.value),
-            strandedInput: input != null && inputShowsPastedText(input, signature.value),
+            strandedInput: input != null && inputShowsPastedText(input.text, signature.value),
+            collapsedPastes: input?.collapsedPastes ?? 0,
+            inputReadable: input != null,
         };
     }
+    /**
+     * The input box as it stands on this screen: the backend's structural reader when it has one (claude-code, #1200),
+     * else the prompt-row heuristic (codex — only on a screen it vouches for — and kiro). null: no box to read here.
+     */
+    inputRegion(pane) {
+        if (this.backend?.readInputRow)
+            return this.backend.readInputRow(pane);
+        const prompt = this.backend?.getBottomReadyPattern?.();
+        if (!prompt || (this.backend?.isDeliveryInputReadyPane && !this.backend.isDeliveryInputReadyPane(pane)))
+            return null;
+        const text = inputAreaText(pane, prompt);
+        return text == null ? null : { text, collapsedPastes: 0 };
+    }
+    /** Whether this backend's input box can be read at all (a given screen may still have none). */
+    readsInput() {
+        return !!this.backend?.readInputRow || !!this.backend?.getBottomReadyPattern?.();
+    }
+    /**
+     * Backends whose pane evidence is structured (codex's input/footer pair, a structural box reader): there, our text
+     * missing from the viewport is inconclusive — an echo can arrive late or scroll away — and never a loss to re-paste
+     * over. Only text positively seen in the box (a strand) authorizes another Enter.
+     */
+    structuredInputEvidence() {
+        return !!this.backend?.isDeliveryInputReadyPane || !!this.backend?.readInputRow;
+    }
     /**
      * What identifies THIS message on screen. The routing envelope carries a
      * message_id that no earlier transcript entry can share, so prefer it: the
@@ -8220,6 +8411,17 @@ export class Daemon extends EventEmitter {
         if (!(await this.sendDeliveryEnter(label, guard?.current)))
             return false;
         let proof = await this.confirmSubmitted(signature, baseline);
+        // A structural box reader sees the paste in the box until the CLI digests the Enter (claude-code repaints a moment
+        // later): give that a bounded window before calling it stranded or lost, as the delivery ladder does.
+        if (this.backend?.readInputRow) {
+            const deadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            while (proof !== "submitted" && Date.now() < deadline) {
+                await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+                if (guard && !guard.current())
+                    return false;
+                proof = await this.confirmSubmitted(signature, baseline);
+            }
+        }
         if (proof === "unverifiable") {
             if (this.backend?.isDeliveryInputReadyPane) {
                 // A Codex screen without a structurally current input/footer pair is