@songsid/agend 2.1.6-beta.12 → 2.1.6-beta.14

package/dist/daemon.js

@@ -399,6 +399,8 @@ export class PendingWorkTracker {
 const NORMAL_ENTER_SETTLE_MS = 500;
 /** How long to keep looking for proof after a retry Enter before failing it. */
 const POST_ENTER_PROOF_WINDOW_MS = 3_000;
+/** A final bounded observation before an ambiguous Codex submit can be classified. */
+const CODEX_LATE_PROOF_MS = 5_000;
 const POST_ENTER_PROOF_POLL_MS = 250;
 /** Attempts to read the pre-paste pane before a delivery gives up on a baseline. */
 const BASELINE_CAPTURE_ATTEMPTS = 3;
@@ -423,6 +425,16 @@ const STARTUP_DIALOG_BUDGET_MS = 30_000;
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
 /** How many "dialog painted just before the write → wait → retry" rounds a delivery tolerates. */
 const LATE_DIALOG_WRITE_ROUNDS = 3;
+/** How many times a delivery redoes itself when a spawn starts between its settle wait and its pane write. */
+const DELIVERY_SPAWN_RACE_MAX_ROUNDS = 3;
+/**
+ * After relay exhaustion, how long to wait for an authoritatively idle pane
+ * before giving up the immediate resume-direct (the fallback flag and the
+ * notification already cover the next natural restart). Muse turns can run
+ * for many minutes; polling keeps each check a fresh capture.
+ */
+const MUSE_DIRECT_RESUME_IDLE_BUDGET_MS = 10 * 60_000;
+const MUSE_DIRECT_RESUME_IDLE_POLL_MS = 5_000;
 /**
  * Startup failed because the CLI's backend is unreachable (see backend-outage.ts).
  * The session-id is deliberately KEPT; the fleet schedules a delayed retry.
@@ -568,7 +580,7 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
     }
 }
 /** Redact likely credentials and control sequences before pane text reaches logs. */
-export function sanitizePaneTail(pane, lineCount = 5) {
+export function sanitizePaneTail(pane, lineCount = 5, excludeLine) {
     const secretAssignment = /\b(token|secret|password|passwd|api[_-]?key|authorization)\b\s*[:=]\s*\S+/gi;
     const bearer = /\bBearer\s+\S+/gi;
     const knownToken = /\b(?:sk-[A-Za-z0-9_-]+|ghp_[A-Za-z0-9]+|github_pat_[A-Za-z0-9_]+|AKIA[A-Z0-9]{16})\b/g;
@@ -581,6 +593,10 @@ export function sanitizePaneTail(pane, lineCount = 5) {
         lines.pop();
     return lines
         .slice(-lineCount)
+        // The proxy-reply chrome predicate sees only control-normalized lines,
+        // but must run BEFORE redaction. Redaction can replace a status-footer
+        // session UUID with [REDACTED], destroying its structural signature.
+        .filter(line => !excludeLine?.(line))
         .map(line => line
         .replace(bearer, "Bearer [REDACTED]")
         .replace(secretAssignment, "$1=[REDACTED]")
@@ -597,12 +613,14 @@ export function sanitizePaneTail(pane, lineCount = 5) {
  * final answer exists only on screen. Everything up to and including the last
  * line of the inbound message we pasted is cut (the reply starts after it),
  * lines with no letters or digits are dropped (borders, separators, spinners,
- * bare prompts), and the ready-prompt line is dropped by pattern. Returns null
- * when what remains is trivial — a proxy message must carry an answer, not
- * chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
+ * bare prompts), and UI chrome is dropped by a backend-specific per-line
+ * filter when available (or a legacy single-line ready pattern). Whole-pane
+ * readiness regexes cannot identify individual prompt/footer lines. Returns
+ * null when what remains is trivial — a proxy message must carry an answer,
+ * not chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
  */
 export function extractProxyReplyText(pane, opts = {}) {
-    const lines = sanitizePaneTail(pane, opts.maxLines ?? 40);
+    const lines = sanitizePaneTail(pane, opts.maxLines ?? 40, opts.isChromeLine);
     const marker = opts.inboundMarker?.trim();
     // Require a distinctive marker: a short one ("ok") would match agent text.
     if (marker && marker.length >= 8) {
@@ -3214,7 +3232,11 @@ export class Daemon extends EventEmitter {
                 pane = await this.tmux?.capturePane();
             if (!pane)
                 return;
-            const text = extractProxyReplyText(pane, { inboundMarker: target.inboundMarker, readyPattern: this.instanceStateReadyPattern });
+            const text = extractProxyReplyText(pane, {
+                inboundMarker: target.inboundMarker,
+                readyPattern: this.instanceStateReadyPattern,
+                isChromeLine: line => this.backend?.isProxyReplyChromeLine?.(line) ?? false,
+            });
             if (!text) {
                 this.logger.debug("Dead-MCP proxy reply skipped — pane tail is trivial");
                 return;
@@ -3952,14 +3974,16 @@ export class Daemon extends EventEmitter {
      * steer's verdict decide whether a queued message's sender is told its
      * delivery failed — a false ❌ carrying the wrong correlation id.
      */
-    failDelivery(verdict, status) {
+    failDelivery(verdict, status, phase = "unknown", proof = "undelivered") {
         verdict.reached = true;
+        verdict.phase = phase;
+        verdict.proof = proof;
         if (status)
             this.emit("message_failed", status); // ❌
         return false;
     }
     /** Tell the fleet when an already-accepted cross-instance pane write failed. */
-    reportCrossInstanceDeliveryFailure(meta, error) {
+    reportCrossInstanceDeliveryFailure(meta, verdict, error) {
         if (!meta.from_instance)
             return;
         this.ipcServer?.broadcast({
@@ -3967,7 +3991,10 @@ export class Daemon extends EventEmitter {
             senderSession: meta.from_instance,
             targetInstance: this.name,
             correlationId: meta.correlation_id ?? "unknown",
-            error: error ?? this.tmux?.getLastPasteError?.() ?? "target pane rejected the delivery",
+            // Never use getLastPasteError as a generic fallback: it may describe an
+            // earlier paste, and #910 was a post-submit proof failure, not a paste
+            // rejection. Keep the sender diagnostic phase-specific and non-secret.
+            error: `delivery failed: phase=${verdict?.phase ?? (error ? "exception" : "unknown")}; proof=${verdict?.proof ?? (error ? "threw" : "none")}`,
         });
     }
     /**
@@ -4021,12 +4048,12 @@ export class Daemon extends EventEmitter {
                 // Same rule as the queued path: a steer that never got to try is not a
                 // delivery failure. This holder is the steer's own, which is the point
                 // — it runs on steerLock while a queued delivery runs on pasteLock.
-                this.reportCrossInstanceDeliveryFailure(meta);
+                this.reportCrossInstanceDeliveryFailure(meta, verdict);
             }
         }).catch(err => {
             this.logger.warn({ err: err.message }, "steer delivery error");
             if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
-                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+                this.reportCrossInstanceDeliveryFailure(meta, undefined, err.message);
             }
         });
     }
@@ -4160,7 +4187,7 @@ export class Daemon extends EventEmitter {
                     // not ready yet, a cancel, a storm hold or a shutdown all return
                     // false without one, and telling the sender its message was lost
                     // there would be the false ❌ of #826 in its other form.
-                    this.reportCrossInstanceDeliveryFailure(meta);
+                    this.reportCrossInstanceDeliveryFailure(meta, verdict);
                 }
             }
             finally {
@@ -4169,7 +4196,7 @@ export class Daemon extends EventEmitter {
         }).catch(err => {
             this.logger.warn({ err: err.message }, "pasteLock delivery error — chain continues");
             if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
-                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+                this.reportCrossInstanceDeliveryFailure(meta, undefined, err.message);
             }
         });
         this.logger.debug({ user: meta.user, text: content.slice(0, 100) }, "Queued channel message for delivery");
@@ -4214,7 +4241,14 @@ export class Daemon extends EventEmitter {
                 return false;
         }
         // Before anything reads the window id: a spawn in progress is about to change it.
-        await this.waitForSpawnToSettle();
+        // A false return means the cap expired with a spawn STILL running — the
+        // generation captured below is in-progress evidence, not settled evidence,
+        // so the critical section must still back out (see settledClean).
+        const settledClean = await this.waitForSpawnToSettle();
+        // Everything captured below (window id, readiness verdicts) belongs to
+        // this spawn generation. A spawn that starts afterwards is detected inside
+        // the critical section, where this delivery backs out and redoes itself.
+        const settleGeneration = this.spawnGeneration;
         if (cancelled())
             return false;
         if (this.refuseFatalStartupDelivery(verdict, status))
@@ -4239,7 +4273,8 @@ export class Daemon extends EventEmitter {
             // fall through to the wait.
             const canHandOff = (supportsQueuedInput || opts?.steer)
                 && readiness === "busy"
-                && (await this.probeBlockingDialog()).state === "clear";
+                && (await this.probeBlockingDialog()).state === "clear"
+                && await this.hasPositiveDeliveryInput();
             if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
@@ -4259,7 +4294,7 @@ export class Daemon extends EventEmitter {
                     // wedged CLI (where the text would sit unsubmitted and the next message
                     // would land on top of it) — and instead of holding the queue silently.
                     this.logger.error("Pane still busy after the idle wait — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "readiness", "timeout-before-write");
                 }
             }
         }
@@ -4280,7 +4315,7 @@ export class Daemon extends EventEmitter {
                 // recovery Enter, so exactly STRANDED_INPUT_MAX_ROUNDS of them go out.
                 if (round >= STRANDED_INPUT_MAX_ROUNDS) {
                     this.logger.error({ round }, "Input row still not clear after the stranded-text recovery budget — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "retry-budget-exhausted");
                 }
                 const stranded = await this.submitStrandedInputIfAny(windowId);
                 if (cancelled())
@@ -4289,14 +4324,14 @@ export class Daemon extends EventEmitter {
                     break;
                 if (stranded === "failed") {
                     this.logger.error({ round }, "Could not submit the stranded text — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "enter-failed");
                 }
                 const readyAgain = await this.waitForPaneReadyForDelivery(windowId);
                 if (cancelled())
                     return false;
                 if (!readyAgain) {
                     this.logger.error("Pane never returned to its prompt after submitting stranded input — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "prompt-timeout");
                 }
             }
         }
@@ -4308,13 +4343,22 @@ export class Daemon extends EventEmitter {
             const outcome = await this.paneWriteLock.run(async () => {
                 if (cancelled())
                     return false;
+                // A spawn that started after the settle wait above invalidates the
+                // window id and every readiness verdict since: the pane about to be
+                // written may already belong to a replacement process. The same holds
+                // when the settle wait itself timed out (!settledClean) or a spawn is
+                // running right now — none of those is settled evidence. Never wait
+                // here (startup dismissal needs this lock) — back out and redo the
+                // delivery from the top, where the settle wait runs again outside it.
+                if (!settledClean || settleGeneration !== this.spawnGeneration || this.spawning)
+                    return "spawn-started";
                 if (this.refuseFatalStartupDelivery(verdict, status))
                     return false;
                 // A passive startup phase may paint after the outer readiness probe.
                 // It clears without input, so waiting under the pane lock cannot starve
                 // a dialog dismisser and closes the final clear→paste TOCTOU window.
                 if (!(await this.waitForInputTransientToClear("pre-write"))) {
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "pre-write", "input-transient-timeout");
                 }
                 // TOCTOU: the probes above ran outside this lock, and the CLI repaints
                 // whenever it likes — a resume prompt can be painted between "clear" and
@@ -4325,8 +4369,22 @@ export class Daemon extends EventEmitter {
                     if (probe.state !== "clear")
                         return "dialog";
                 }
+                if (!(await this.hasPositiveDeliveryInput()))
+                    return "dialog";
                 return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict);
             });
+            if (outcome === "spawn-started") {
+                // The pane changed under this delivery: its queued paste must not land
+                // in the replacement process's first screen. Redo the whole delivery
+                // (fresh window id, fresh probes) — bounded, so spawn churn ends in an
+                // honest failure rather than a message that never lands.
+                const retries = (opts?.spawnRetry ?? 0) + 1;
+                if (retries > DELIVERY_SPAWN_RACE_MAX_ROUNDS) {
+                    this.logger.error({ rounds: retries }, "A spawn kept starting before the pane write — reporting delivery failure");
+                    return this.failDelivery(verdict, status);
+                }
+                return this.deliverMessage(formatted, status, { ...opts, spawnRetry: retries });
+            }
             if (outcome !== "dialog")
                 return outcome;
             // Wait OUTSIDE the lock (holding it would starve the runtime dismisser),
@@ -4334,14 +4392,14 @@ export class Daemon extends EventEmitter {
             // an honest failure rather than a message that never lands.
             if (round + 1 >= LATE_DIALOG_WRITE_ROUNDS) {
                 this.logger.error({ rounds: round + 1 }, "A dialog kept appearing before the pane write — reporting delivery failure");
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "pre-write", "dialog-or-input-not-ready");
             }
-            this.logger.info("Dialog appeared before the pane write — waiting for it to clear");
+            this.logger.info("Dialog or input transition appeared before the pane write — waiting for readiness");
             const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId) : false;
             if (cancelled())
                 return false;
             if (!clear) {
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "pre-write", "readiness-timeout");
             }
         }
     }
@@ -4602,6 +4660,27 @@ export class Daemon extends EventEmitter {
     async isPaneReadyForDelivery(windowId) {
         return (await this.paneReadinessForDelivery(windowId)) === "ready";
     }
+    needsStartupInputProof() {
+        return !!this.backend?.isDeliveryInputReadyPane
+            && this.inputTransientGuardGeneration === this.spawnGeneration;
+    }
+    /** Codex can paint a prompt before the TTY enters raw mode. Both are required. */
+    async hasPositiveDeliveryInput() {
+        if (!this.needsStartupInputProof())
+            return true;
+        const check = this.backend?.isDeliveryInputReadyPane;
+        if (!check || !this.tmux)
+            return !check;
+        try {
+            const mode = await this.tmux.getPaneInputMode?.();
+            if (mode !== "raw")
+                return false;
+            return check.call(this.backend, await this.tmux.capturePane());
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Why a pane is not deliverable matters. "busy" may be handed to a native
      * input queue or steered (after its own dialog probe); "dialog", "transient"
@@ -4620,6 +4699,9 @@ export class Daemon extends EventEmitter {
             return "transient";
         if (transient.state === "unknown")
             return "unknown";
+        if (this.needsStartupInputProof()) {
+            return await this.hasPositiveDeliveryInput() ? "ready" : "transient";
+        }
         if (this.backend?.dropsEnterWhileBusy?.() !== true)
             return "ready";
         const prompt = this.backend.getBottomReadyPattern?.();
@@ -4664,7 +4746,8 @@ export class Daemon extends EventEmitter {
         // screen", and a dialog disappears without any output edge the silence
         // gate could see.
         const deadline = Date.now() + timeoutMs;
-        const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true;
+        const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true
+            || this.needsStartupInputProof();
         let unknownStreak = 0;
         let transientBudget = null;
         for (;;) {
@@ -4787,11 +4870,12 @@ export class Daemon extends EventEmitter {
             return "busy";
         if (this.backend?.getBusyPattern?.()?.test(pane))
             return "busy";
+        if (this.backend?.isDeliveryInputReadyPane && !this.backend.isDeliveryInputReadyPane(pane))
+            return "busy";
         if (strandedAgendMessageInInput(pane, prompt))
             return "stranded";
-        // Kiro needs a bottom-anchored prompt as positive readiness evidence. Codex
-        // does not: this preflight runs only after its ordinary silence gate and is
-        // enabled solely to recover a positively identified old AgEnD strand.
+        // Kiro uses the bottom row; Codex's positive prompt/footer check above
+        // rules out a historical transcript echo or a transition/modal screen.
         return !requireBottomReady || bottomRowIsReady(pane, prompt) ? "clear" : "busy";
     }
     /**
@@ -4841,7 +4925,7 @@ export class Daemon extends EventEmitter {
         if (!this.fatalStartupBlocked)
             return false;
         this.logger.error("Delivery refused — CLI is parked on a fatal startup screen");
-        this.failDelivery(verdict, status);
+        this.failDelivery(verdict, status, "fatal-startup", "blocked-before-write");
         return true;
     }
     /**
@@ -4944,7 +5028,7 @@ export class Daemon extends EventEmitter {
                 if (!recoverable) {
                     // A tmux error the window cannot be recovered from: the text will
                     // never reach this pane, so it is a verdict like the others.
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "paste", "non-retryable-tmux-error");
                 }
                 windowId = (await this.recoverWindow()) ?? windowId;
                 if (attempt < maxAttempts)
@@ -4974,7 +5058,7 @@ export class Daemon extends EventEmitter {
             }
             let enterAt = Date.now();
             if (!(await this.sendDeliveryEnter("initial-submit"))) {
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "submit-enter", "tmux-send-keys-failed");
             }
             // Kiro's legacy TUI can swallow Enter while it is still processing a large
             // paste — not only during the post-ready redraw (#479): on slower hosts it
@@ -5023,8 +5107,16 @@ export class Daemon extends EventEmitter {
                     // Our text is on the pane but cannot be shown to have left the input
                     // row — either the backend exposes no input row (only /steer reaches
                     // this path on such a backend) or the pre-paste pane was unreadable.
-                    // Re-pasting on that would deliver the message twice, so accept as
-                    // this path always has, and record that it is unproven.
+                    // For Codex, this can also mean its current layout is not a trusted
+                    // input/queue frame. Do not turn that uncertainty into a false ✅.
+                    if (this.backend?.isDeliveryInputReadyPane) {
+                        this.logger.warn({ phase: "native-queue-proof", proof }, "Codex native-queue outcome uncertain — not re-pasting or confirming");
+                        verdict.phase = "native-queue-proof";
+                        verdict.proof = proof;
+                        return false;
+                    }
+                    // Re-pasting on a backend without structured Codex pane evidence
+                    // would risk duplication; retain its legacy best-effort behavior.
                     this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
                     if (status)
                         this.emit("message_confirmed", status); // ✅ (best-effort)
@@ -5057,9 +5149,14 @@ export class Daemon extends EventEmitter {
                     this.logger.warn("Message still in the input row after idle — submitting the existing text instead of pasting it again");
                     const strandedAt = Date.now();
                     if (!(await this.sendDeliveryEnter("native-queue-stranded-submit"))) {
-                        return this.failDelivery(verdict, status);
+                        return this.failDelivery(verdict, status, "native-queue-submit", "tmux-send-keys-failed");
                     }
-                    const afterEnter = await this.confirmSubmitted(signature, pasteBaseline);
+                    // The recovery Enter can be accepted before Codex paints its new
+                    // transcript. One immediate capture is not a failure verdict: give
+                    // that echo/queue a bounded chance to appear, without re-pasting.
+                    const afterEnter = this.backend?.isDeliveryInputReadyPane
+                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline, true)
+                        : await this.confirmSubmitted(signature, pasteBaseline);
                     if (afterEnter === "submitted") {
                         if (status)
                             this.emit("message_confirmed", status); // ✅
@@ -5071,8 +5168,23 @@ export class Daemon extends EventEmitter {
                     // another turn's output — and treating that as proof re-confirms a
                     // message nobody submitted. Output is corroboration; text sitting in
                     // the input row is disqualifying, and disqualifying evidence wins.
+                    if (this.backend?.isDeliveryInputReadyPane && afterEnter !== "stranded") {
+                        this.logger.warn({ phase: "native-queue-submit", proof: afterEnter, strandedAt }, "Codex recovery Enter outcome uncertain — no hard failure or duplicate paste");
+                        verdict.phase = "native-queue-submit";
+                        verdict.proof = afterEnter;
+                        return false;
+                    }
                     this.logger.error({ afterEnter, strandedAt }, "Stranded message could not be submitted by Enter");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-submit", afterEnter);
+                }
+                if (this.backend?.isDeliveryInputReadyPane) {
+                    // In Codex a missing viewport echo is inconclusive, not a proof of
+                    // loss. Another paste could run the same request twice. Leave the
+                    // already-pasted delivery at 👀 and let the next observation decide.
+                    this.logger.warn({ phase: "native-queue-proof", proof: settled }, "Codex native-queue outcome uncertain — not re-pasting");
+                    verdict.phase = "native-queue-proof";
+                    verdict.proof = settled;
+                    return false;
                 }
                 // "unproven": nothing of ours is on screen — the paste itself was lost,
                 // so pasting it again cannot duplicate anything.
@@ -5081,12 +5193,12 @@ export class Daemon extends EventEmitter {
                     this.logger.error({
                         tmuxError: this.tmux.getLastPasteError?.() ?? "unknown tmux paste failure",
                     }, "Idle-gated redelivery paste failed after native-queue silent loss");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-redelivery", "tmux-paste-failed");
                 }
                 await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
                 const retryAt = Date.now();
                 if (!(await this.sendDeliveryEnter("native-queue-idle-redelivery"))) {
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-redelivery", "tmux-send-keys-failed");
                 }
                 if (windowId && this.controlClient) {
                     if (await this.confirmAfterEnter(windowId, retryAt, signature, pasteBaseline, "native-queue-idle-redelivery-retry")) {
@@ -5101,7 +5213,7 @@ export class Daemon extends EventEmitter {
                     return true;
                 }
                 this.logger.error("Idle-gated redelivery also failed after native-queue silent loss");
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "native-queue-redelivery", "not-submitted");
             }
             if (windowId && this.controlClient && this.backend?.dropsEnterWhileBusy?.() === true) {
                 // F2: output after Enter is necessary but not sufficient — the paste
@@ -5115,7 +5227,7 @@ export class Daemon extends EventEmitter {
                     const promptBack = await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS);
                     const retryAt = Date.now();
                     if (promptBack && !(await this.sendDeliveryEnter("stranded-text-retry"))) {
-                        return this.failDelivery(verdict, status);
+                        return this.failDelivery(verdict, status, "stranded-text-retry", "tmux-send-keys-failed");
                     }
                     submitted = promptBack && await this.confirmSubmittedAfterEnter(windowId, retryAt, formatted);
                 }
@@ -5125,7 +5237,7 @@ export class Daemon extends EventEmitter {
                 }
                 else {
                     this.logger.error("Message pasted but never submitted (text still in the input row after Enter retry)");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-text-retry", "stranded");
                 }
             }
             else if (windowId && this.controlClient) {
@@ -5145,12 +5257,26 @@ export class Daemon extends EventEmitter {
                         this.emit("message_confirmed", status); // ✅
                 }
                 else {
-                    // Both Enters were swallowed: the text is sitting UNSUBMITTED in the
-                    // CLI's input box. This used to return true, so the reaction stayed at 👀
-                    // forever and the next delivery pasted on top — submitting two messages
-                    // as one. Say so instead.
-                    this.logger.error("Message pasted but never submitted (no idle→busy after two Enters)");
-                    return this.failDelivery(verdict, status);
+                    const proof = this.backend?.isDeliveryInputReadyPane
+                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline)
+                        : await this.confirmSubmitted(signature, pasteBaseline);
+                    if (proof === "submitted") {
+                        if (status)
+                            this.emit("message_confirmed", status);
+                        return true;
+                    }
+                    if (this.backend?.isDeliveryInputReadyPane && proof !== "stranded") {
+                        // This is the observed #910 race: the CLI processed the message
+                        // although its echo had not appeared within the proof window. A
+                        // missing viewport signature cannot establish non-delivery; keep
+                        // 👀 and never emit the sender's hard ❌ or re-paste blindly.
+                        this.logger.warn({ phase: "post-submit-proof", proof }, "Codex delivery outcome uncertain — no hard failure or duplicate paste");
+                        verdict.phase = "post-submit-proof";
+                        verdict.proof = proof;
+                        return false;
+                    }
+                    this.logger.error({ phase: "post-submit-proof", proof }, "Message remains unsubmitted after Enter retry");
+                    return this.failDelivery(verdict, status, "post-submit-proof", proof);
                 }
             }
             else {
@@ -5163,7 +5289,7 @@ export class Daemon extends EventEmitter {
             return true;
         }
         this.logger.error("Message delivery failed after retries — window not ready");
-        return this.failDelivery(verdict, status);
+        return this.failDelivery(verdict, status, "paste", "retry-budget-exhausted");
     }
     /**
      * The single place a pasted message is judged submitted, shared by the
@@ -5221,6 +5347,42 @@ export class Daemon extends EventEmitter {
             }
             return busy;
         }
+        if (this.backend?.isDeliveryInputReadyPane) {
+            // Codex's first post-wake redraw may hide the echo for a few seconds.
+            // Absence from a viewport is NOT proof the paste was lost, so only a
+            // positively identified strand authorizes another Enter. Never re-paste
+            // here: the CLI may already be processing the unique message_id.
+            let proof = "unproven";
+            const firstDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            for (;;) {
+                proof = await this.confirmSubmitted(signature, baseline);
+                if (proof === "submitted")
+                    return true;
+                if (proof === "stranded" || Date.now() >= firstDeadline)
+                    break;
+                await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+            }
+            if (proof !== "stranded")
+                return false;
+            if (!(await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS)))
+                return false;
+            proof = await this.confirmSubmitted(signature, baseline);
+            if (proof === "submitted")
+                return true;
+            if (proof !== "stranded")
+                return false;
+            if (!(await this.sendDeliveryEnter(retryPhase)))
+                return false;
+            const retryDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            for (;;) {
+                proof = await this.confirmSubmitted(signature, baseline);
+                if (proof === "submitted")
+                    return true;
+                if (Date.now() >= retryDeadline)
+                    return false;
+                await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+            }
+        }
         if (await this.confirmSubmitted(signature, baseline) === "submitted")
             return true;
         // Retry once the prompt is back — an Enter sent into a mid-redraw TUI is
@@ -5270,6 +5432,14 @@ export class Daemon extends EventEmitter {
                 : "unproven";
         }
         const after = this.paneEvidence(pane, signature);
+        // A Codex layout without its current input/footer pair may show a quoted
+        // or historical `›` row. Unless its active Working banner corroborates a
+        // real turn, text on that unknown screen cannot prove it left stdin.
+        if (this.backend?.isDeliveryInputReadyPane
+            && !this.backend.isDeliveryInputReadyPane(pane)
+            && !this.backend.getBusyPattern?.()?.test(pane)) {
+            return after.payload > 0 ? "unverifiable" : "unproven";
+        }
         // 1. Disqualifying evidence, checked FIRST and never overridden by the
         //    corroborating evidence below: our text is sitting in the input row, so
         //    it was not submitted — whatever else is on screen.
@@ -5308,6 +5478,35 @@ export class Daemon extends EventEmitter {
         this.logger.warn("Could not read the pane before pasting — this delivery cannot be verified either way");
         return "unverifiable";
     }
+    /** Only positive echo/queue evidence may turn an ambiguous Codex write into ✅. */
+    async lateCodexSubmissionProof(signature, baseline, waitThroughStranded = false) {
+        const deadline = Date.now() + CODEX_LATE_PROOF_MS;
+        let proof = "unproven";
+        for (;;) {
+            proof = await this.confirmSubmitted(signature, baseline);
+            // Ordinary idle-path proof may return a strand immediately. After a
+            // native-queue recovery Enter, though, it can be the previous frame
+            // still on screen; only a strand that survives the bounded repaint
+            // window proves that Enter was swallowed.
+            if (proof === "submitted" || (proof === "stranded" && !waitThroughStranded))
+                return proof;
+            if (signature.unique && this.tmux?.capturePaneWithHistory) {
+                try {
+                    const history = await this.tmux.capturePaneWithHistory(300);
+                    const seen = this.paneEvidence(history, signature);
+                    const known = !this.backend?.isDeliveryInputReadyPane
+                        || this.backend.isDeliveryInputReadyPane(history)
+                        || this.backend.getBusyPattern?.()?.test(history);
+                    if (known && seen.payload > 0 && !seen.strandedInput)
+                        return this.submittedProof();
+                }
+                catch { /* a failed history read proves neither delivery nor loss */ }
+            }
+            if (Date.now() >= deadline)
+                return proof;
+            await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+        }
+    }
     /**
      * What the pane currently shows of a given message. Taken once before the
      * paste and once after, so confirmSubmitted can require a NEW marker or a NEW
@@ -5323,7 +5522,8 @@ export class Daemon extends EventEmitter {
                 const pane = await this.tmux.capturePane();
                 const evidence = this.paneEvidence(pane, signature);
                 const prompt = this.backend?.getBottomReadyPattern?.();
-                if (prompt && strandedAgendMessageInInput(pane, prompt)) {
+                if (prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
+                    && strandedAgendMessageInInput(pane, prompt)) {
                     // Whatever we paste now lands after it, and one Enter submits both as
                     // a single message. Nothing here can undo that; saying so beats
                     // letting two messages silently merge.
@@ -5344,7 +5544,8 @@ export class Daemon extends EventEmitter {
     paneEvidence(pane, signature) {
         const marker = this.backend?.getQueuedInputMarker?.();
         const prompt = this.backend?.getBottomReadyPattern?.();
-        const input = prompt ? inputAreaText(pane, prompt) : null;
+        const input = prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
+            ? inputAreaText(pane, prompt) : null;
         return {
             queued: marker ? pane.split(/\r?\n/).filter(row => marker.test(row)).length : 0,
             payload: countOccurrences(pane.replace(/\s+/g, ""), signature.value),
@@ -5395,6 +5596,13 @@ export class Daemon extends EventEmitter {
             return false;
         let proof = await this.confirmSubmitted(signature, baseline);
         if (proof === "unverifiable") {
+            if (this.backend?.isDeliveryInputReadyPane) {
+                // A Codex screen without a structurally current input/footer pair is
+                // not a successful snapshot restore. The old best-effort rule below
+                // is only for backends that expose no readable input row at all.
+                this.logger.warn({ label }, "Codex system paste could not be verified");
+                return false;
+            }
             // No input row to read: this backend gets exactly what the old pasteText
             // path gave it, including the unconditional second Enter for queue-less
             // TUIs that swallow the first. Narrowing that to one Enter on the grounds
@@ -5996,26 +6204,33 @@ export class Daemon extends EventEmitter {
      * Bounded, and called BEFORE the pane lock is taken — waiting on the spawn while
      * holding the lock the spawn itself needs would deadlock.
      */
-    async waitForSpawnToSettle() {
+    /**
+     * Wait for an in-flight spawn to finish, up to the cap. Returns true when no
+     * spawn is in flight afterwards; false when the cap expired with one still
+     * running. A false return is NOT settled evidence — the caller must not
+     * treat the current generation as a completed spawn.
+     */
+    async waitForSpawnToSettle(capMs = SPAWN_SETTLE_MAX_WAIT_MS) {
         const settled = this.spawnSettled;
         if (!settled)
-            return;
+            return true;
         this.logger.debug("Holding delivery until the CLI has finished starting up");
         let timer;
         const cap = new Promise(resolve => {
-            timer = setTimeout(resolve, SPAWN_SETTLE_MAX_WAIT_MS);
+            timer = setTimeout(() => resolve(false), capMs);
             timer.unref?.();
         });
         try {
-            await Promise.race([settled, cap]);
+            const finished = await Promise.race([settled.then(() => true), cap]);
+            if (!finished) {
+                this.logger.warn("CLI still starting after the delivery hold — the pane is not settled evidence");
+            }
+            return finished;
         }
         finally {
             if (timer)
                 clearTimeout(timer);
         }
-        if (this.spawning) {
-            this.logger.warn("CLI still starting after the delivery hold — delivering anyway");
-        }
     }
     /** Spawn a CLI window. Returns true if --resume was used successfully. */
     /**
@@ -6321,20 +6536,63 @@ export class Daemon extends EventEmitter {
             reason: reuseWindow ? "wake" : this.lastSpawnAt > 0 ? "recovery" : "startup",
         }, () => this.trySpawnInsideGate(reuseWindow, startupTimeoutMs));
     }
+    /**
+     * One fresh pane capture judged as ready && !busy && !dialog. Transcript
+     * silence is deliberately NOT the gate: its monitor is inert for muse, so a
+     * quiet-but-working pane would read as idle and the respawn below would kill
+     * a live turn. Fail closed: an unreadable pane is never idle.
+     */
+    async isPaneAuthoritativelyIdle() {
+        const backend = this.backend;
+        if (!this.tmux || !backend)
+            return false;
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return false;
+        }
+        if (backend.getBusyPattern?.()?.test(pane))
+            return false;
+        for (const dialog of this.deliveryBlockingDialogs()) {
+            if (Daemon.dialogMatches(dialog, pane))
+                return false;
+        }
+        if (!backend.getReadyPattern().test(pane))
+            return false;
+        return true;
+    }
+    /**
+     * Poll the authoritative pane check until it reports idle or the budget runs
+     * out. Each poll is a fresh capture, so a turn that ends mid-wait is seen.
+     */
+    async waitForAuthoritativePaneIdle(budgetMs = MUSE_DIRECT_RESUME_IDLE_BUDGET_MS, pollMs = MUSE_DIRECT_RESUME_IDLE_POLL_MS) {
+        const deadline = Date.now() + budgetMs;
+        for (;;) {
+            if (await this.isPaneAuthoritativelyIdle())
+                return true;
+            if (Date.now() >= deadline)
+                return false;
+            await new Promise(r => setTimeout(r, pollMs));
+        }
+    }
     /**
      * A relay crash must not make the daemon kill a live Muse process. The
      * supervisor normally reclaims the same port; when that bounded recovery
-     * fails, mark usage unavailable and leave Muse untouched. A later natural
-     * spawn sees museRelayFallback and starts direct, without interrupting the
-     * current conversation or destroying its session.
+     * fails, move Muse back to a direct connection once it is authoritatively
+     * idle (session preserved via the existing resume path) and mark usage
+     * unavailable. The fallback flag also covers every later natural spawn.
+     * Never throws: the floor is the old behavior (flag set, relay stopped,
+     * next restart direct).
      */
-    switchMuseToDirect() {
+    switchMuseToDirect(idleBudgetMs = MUSE_DIRECT_RESUME_IDLE_BUDGET_MS, idlePollMs = MUSE_DIRECT_RESUME_IDLE_POLL_MS) {
         if (this.museRelayFallbackInFlight || this.startupAborted || this.backend?.binaryName !== "muse") {
             return this.museRelayFallbackInFlight ?? Promise.resolve();
         }
         this.museRelayFallbackInFlight = (async () => {
             this.museRelayFallback = true;
-            this.logger.warn("Muse usage relay could not recover — usage is unavailable until the next natural Muse restart");
+            this.logger.warn("Muse usage relay could not recover — usage is unavailable until Muse restarts direct");
             try {
                 if (this.museUsageRelay) {
                     await this.museUsageRelay.stop().catch(() => { });
@@ -6344,6 +6602,60 @@ export class Daemon extends EventEmitter {
             catch (err) {
                 this.logger.warn({ reason: err instanceof Error ? err.message : "relay stop failed" }, "Muse usage relay cleanup failed");
             }
+            // Say so where the operator is looking: without this, muse keeps running
+            // with --base-url pointed at the dead relay port and every turn fails.
+            this.emit("muse_relay_exhausted", { name: this.name });
+            // An idle muse can be moved now; a busy, paused, or supervised-paused one
+            // is left alone — pausing/wake respawns direct anyway via the fallback
+            // flag, and interrupting a live turn (or fighting supervision) would be
+            // worse than waiting for the next natural restart.
+            if (this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped" || !this.tmux)
+                return;
+            const generation = this.spawnGeneration;
+            const idle = await this.waitForAuthoritativePaneIdle(idleBudgetMs, idlePollMs);
+            // Another spawn (wake/restart) completed while waiting — it owns the pane
+            // now, and respawning here would kill its fresh process mid-turn.
+            if (generation !== this.spawnGeneration)
+                return;
+            if (!idle)
+                return;
+            if (this.startupAborted || this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped")
+                return;
+            // Final re-verification under pane-write exclusion: no delivery can paste
+            // a new turn between this verdict and the respawn it authorizes. The
+            // spawn itself runs outside the lock (its dialog dismissal re-takes it).
+            let claimed = false;
+            await this.paneWriteLock.run(async () => {
+                const stillIdle = await this.isPaneAuthoritativelyIdle();
+                if (generation !== this.spawnGeneration)
+                    return;
+                if (!stillIdle)
+                    return;
+                // The final capture awaited above: re-check the full guards here, not
+                // just generation and idle — pause needs no generation bump to take
+                // effect, and respawning a freshly paused pane strands its state.
+                if (this.startupAborted || this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped")
+                    return;
+                this.beginSpawn();
+                claimed = true;
+            });
+            if (!claimed)
+                return;
+            try {
+                this.saveSessionId();
+                const ready = await this.trySpawn(true, this.wakeBudgetMs(30_000));
+                this.transcriptMonitor?.resetOffset();
+                if (ready)
+                    this.logger.info("Muse resumed direct after relay exhaustion (session preserved)");
+                else
+                    this.logger.warn("Muse direct resume after relay exhaustion did not become ready — next natural restart retries");
+            }
+            catch (err) {
+                this.logger.warn({ reason: err instanceof Error ? err.message : String(err) }, "Muse direct resume after relay exhaustion failed — next natural restart retries");
+            }
+            finally {
+                this.endSpawn();
+            }
         })().finally(() => { this.museRelayFallbackInFlight = null; });
         return this.museRelayFallbackInFlight;
     }
@@ -6619,6 +6931,10 @@ export class Daemon extends EventEmitter {
         let lastTransient = null;
         let captureFailures = 0;
         let attempts = 0;
+        // A safety-critical startup choice is one-shot. If the CLI has not
+        // repainted after Enter, let the following hold-only entry report it
+        // instead of sending a second Enter into a possibly changed screen.
+        const attemptedSafetyChoices = new Set();
         do {
             attempts++;
             let pane;
@@ -6655,6 +6971,11 @@ export class Daemon extends EventEmitter {
                 lastDialog = null;
                 for (const dialog of startupDialogs) {
                     if (Daemon.dialogMatches(dialog, pane)) {
+                        if (dialog.autoResolutionKey
+                            && (attemptedSafetyChoices.has(dialog.autoResolutionKey)
+                                || (this.autoResolvedDialogGeneration === this.spawnGeneration
+                                    && this.autoResolvedDialogKey === dialog.autoResolutionKey)))
+                            continue;
                         lastDialog = dialog;
                         cleanReadyPolls = 0;
                         // Start the parked clock for every delivery-blocking dialog, exact
@@ -6696,17 +7017,38 @@ export class Daemon extends EventEmitter {
                         // Restart is exactly when inbound messages pile up, and nothing gates
                         // delivery on `spawning`. Take the pane lock for the key sequence so a
                         // queued message cannot be pasted into a half-dismissed trust dialog.
-                        await this.paneWriteLock.run(async () => {
+                        const sent = await this.paneWriteLock.run(async () => {
+                            // The capture above may have gone stale while waiting for the
+                            // write lock. Trust/other safety prompts must still be the
+                            // CURRENT menu, with the same safe cursor, at the instant of
+                            // the key send. A changed pane falls through to the next scan.
+                            if (dialog.inputBlocked) {
+                                const currentPane = await this.tmux.capturePane();
+                                if (!Daemon.dialogMatches(dialog, currentPane))
+                                    return false;
+                            }
+                            if (dialog.autoResolutionKey) {
+                                attemptedSafetyChoices.add(dialog.autoResolutionKey);
+                                this.autoResolvedDialogGeneration = this.spawnGeneration;
+                                this.autoResolvedDialogKey = dialog.autoResolutionKey;
+                            }
                             for (const key of dialog.keys) {
                                 if (key === "Up" || key === "Down" || key === "Enter" || key === "Escape") {
-                                    await this.tmux.sendSpecialKey(key);
+                                    if (!await this.tmux.sendSpecialKey(key))
+                                        return false;
                                 }
                                 else {
-                                    await this.tmux.sendKeys(key);
+                                    if (!await this.tmux.sendKeys(key))
+                                        return false;
                                 }
                                 await new Promise(r => setTimeout(r, 200));
                             }
+                            return true;
                         });
+                        if (!sent) {
+                            matched = true;
+                            break;
+                        }
                         // Wait for next screen to render — bounded by what is left of the budget.
                         const renderWait = Math.max(0, Math.min(10_000, remaining()));
                         if (this.controlClient) {