@songsid/agend 2.1.6-beta.6 → 2.1.6-beta.8

package/dist/daemon.js

@@ -437,7 +437,23 @@ export class BackendUnreachableStartupError extends Error {
 /** Bounded wait (under the pane lock) for the prompt to return before retrying a dropped Enter. */
 const STRANDED_RETRY_READY_WAIT_MS = 30_000;
 /** A passive startup phase must clear within this bound before an Enter is sent. */
-const INPUT_TRANSIENT_WAIT_MS = 30_000;
+/**
+ * How long a passive startup/resume transient may sit WITHOUT REPAINTING before
+ * delivery gives up. It is a stall budget, not a total: a CLI that is still
+ * painting its resume is making progress, and #826 is what happens when the two
+ * are confused — codex's resume is the only declared transient in the fleet
+ * (backend/codex.ts), a woken paused codex routinely takes longer than this to
+ * come back, and the flat 30s cap turned that into ❌ plus a discarded message
+ * on a pane that was seconds from ready.
+ */
+const INPUT_TRANSIENT_STALL_MS = 30_000;
+/**
+ * The absolute ceiling for the same wait, so a transient that repaints forever
+ * (a spinner on a wedged resume) still ends in an honest failure. Bounded, as
+ * every other delivery wait is — just bounded by "no progress", not by a guess
+ * at how long a resume takes.
+ */
+const INPUT_TRANSIENT_WAIT_MS = 10 * 60_000;
 const INPUT_TRANSIENT_POLL_MS = 250;
 /** Max "stranded text → submit → wait for prompt → re-check" rounds per delivery; each may send one recovery Enter. */
 const STRANDED_INPUT_MAX_ROUNDS = 3;
@@ -880,6 +896,11 @@ export class Daemon extends EventEmitter {
     /** Identity of that dialog: its pattern, not its description (two tables may describe one screen differently). */
     dialogParkedKey = null;
     dialogParkedReported = false;
+    /** Current stdin-owning runtime dialog, independent from execution state. */
+    inputBlockedDialogKey = null;
+    /** Generation/signature fence for safety dialogs while their screen is still visible. */
+    autoResolvedDialogKey = null;
+    autoResolvedDialogGeneration = 0;
     backgroundSessionRecoveryAttempted = false;
     /** Whether the last spawn started a fresh session (not resumed). */
     isNewSession = false;
@@ -2170,6 +2191,7 @@ export class Daemon extends EventEmitter {
                 if (!alive)
                     return;
                 const pane = await this.tmux.capturePane();
+                const inputBlockedDialog = this.updateInputBlockedState(pane, dialogs);
                 const interactivePrompt = this.interactivePromptDetector.observe(pane, Date.now(), this.instanceStateLastOutputAt);
                 if (interactivePrompt) {
                     this.logger.warn(interactivePrompt, "Interactive terminal prompt is waiting for human input");
@@ -2186,7 +2208,7 @@ export class Daemon extends EventEmitter {
                 const hasPendingWork = this.pendingWork.hasPendingWork();
                 if (!hasPendingWork)
                     this.blockingProcessDetector.reset();
-                const blockingProcess = hasPendingWork
+                const blockingProcess = hasPendingWork && !inputBlockedDialog
                     ? this.blockingProcessDetector.observe(pane, paneActivity, Date.now())
                     : null;
                 if (blockingProcess) {
@@ -2208,27 +2230,80 @@ export class Daemon extends EventEmitter {
                         blockingSeen = dialog;
                     if (dialog.holdOnly)
                         break; // recognised, deliberately not answered; trackDialogParked reports it
+                    const autoKey = dialog.autoResolutionKey;
+                    if (dialog.verifyAfterKeys && autoKey
+                        && this.autoResolvedDialogGeneration === this.spawnGeneration
+                        && this.autoResolvedDialogKey === autoKey) {
+                        // A previous poll sent the safety choice but the CLI has not
+                        // repainted yet. Never send another Enter into the same screen.
+                        continue;
+                    }
                     // These keys go straight into the pane. Sent while a message delivery is
                     // mid-transaction, an `Escape` wipes the pasted text and an `Enter`
                     // submits it half-composed — the user sees a message that vanished. Skip
                     // (not queue) when the pane is busy: this poller runs every 5s, and the
                     // dialog will still be on screen next tick.
+                    let resolved = false;
                     const dismissed = await this.paneWriteLock.tryRun(async () => {
+                        // Re-read under the lock: the first capture may have gone stale
+                        // while a delivery was finishing. A stale danger menu must never
+                        // receive a blind key sequence.
+                        const currentPane = await this.tmux.capturePane();
+                        if (!Daemon.dialogMatches(dialog, currentPane)) {
+                            this.updateInputBlockedState(currentPane, dialogs);
+                            return;
+                        }
+                        if (dialog.verifyAfterKeys && autoKey
+                            && this.autoResolvedDialogGeneration === this.spawnGeneration
+                            && this.autoResolvedDialogKey === autoKey)
+                            return;
+                        if (dialog.verifyAfterKeys && autoKey) {
+                            this.autoResolvedDialogGeneration = this.spawnGeneration;
+                            this.autoResolvedDialogKey = autoKey;
+                        }
                         this.logger.info(`Auto-dismissing runtime dialog: ${dialog.description}`);
                         const SPECIAL_KEYS = new Set(["Up", "Down", "Enter", "Escape", "Right", "Left"]);
                         for (const key of dialog.keys) {
+                            let sent = false;
                             if (SPECIAL_KEYS.has(key)) {
-                                await this.tmux.sendSpecialKey(key);
+                                sent = await this.tmux.sendSpecialKey(key);
                             }
                             else {
-                                await this.tmux.pasteText(key, this.systemPasteOptions());
+                                sent = await this.tmux.pasteText(key, this.systemPasteOptions());
+                            }
+                            if (!sent) {
+                                if (dialog.verifyAfterKeys && autoKey) {
+                                    this.autoResolvedDialogGeneration = 0;
+                                    this.autoResolvedDialogKey = null;
+                                }
+                                return;
                             }
                             await new Promise(r => setTimeout(r, 200));
                         }
+                        if (dialog.verifyAfterKeys) {
+                            const afterKeysPane = await this.tmux.capturePane();
+                            const dialogStillActive = dialog.inputBlocked
+                                ? dialogs.some(candidate => candidate.inputBlocked && Daemon.dialogMatches(candidate, afterKeysPane))
+                                : Daemon.dialogMatches(dialog, afterKeysPane);
+                            if (dialogStillActive) {
+                                this.logger.warn({ dialog: dialog.description }, "Runtime dialog remained after its safety choice");
+                                return;
+                            }
+                            this.updateInputBlockedState(afterKeysPane, dialogs);
+                            if (dialog.postDismissNotice) {
+                                resolved = await this.submitSystemPaste(dialog.postDismissNotice.text, dialog.postDismissNotice.label);
+                            }
+                            else {
+                                resolved = true;
+                            }
+                        }
                     });
                     if (!dismissed) {
                         this.logger.info({ dialog: dialog.description }, "Dialog dismissal deferred — pane write in flight");
                     }
+                    else if (dialog.verifyAfterKeys && !resolved) {
+                        this.logger.warn({ dialog: dialog.description }, "Safety dialog choice was sent but follow-up verification or notice submission failed");
+                    }
                     this.trackDialogParked(blockingSeen);
                     return; // Dialog handled (or deliberately deferred): skip error checks this cycle
                 }
@@ -2826,6 +2901,15 @@ export class Daemon extends EventEmitter {
     }
     applyInstanceStateSnapshot(snapshot, pane) {
         const previous = this.instanceState;
+        // A live safety menu owns stdin.  It may still contain Claude's persistent
+        // `❯` ready marker, but that is not an idle turn and must not clear pending
+        // work, retire Cancel, arm auto-pause, or enter the generic stuck path.
+        // Keep the public execution state unchanged until the menu disappears; the
+        // dedicated input_blocked event carries the reason to observers.
+        if (this.inputBlockedDialogKey !== null) {
+            this.logger.debug({ dialog: this.inputBlockedDialogKey }, "Suppressing execution-state edge while CLI input is blocked by a dialog");
+            return;
+        }
         this.instanceState = snapshot.state;
         // OpenCode creates its session lazily on the first submitted message.
         // Waiting until stop/pause to persist that id loses resume state when the
@@ -3299,6 +3383,7 @@ export class Daemon extends EventEmitter {
         const captureStartedAt = Date.now();
         try {
             const pane = await this.tmux.capturePane();
+            this.updateInputBlockedState(pane);
             // Output received while capture-pane was in flight makes this snapshot
             // stale. Its output handler has already armed a new debounce.
             const outputMovedDuringCapture = (expectedOutputAt > 0 && this.instanceStateLastOutputAt > expectedOutputAt)
@@ -3535,6 +3620,10 @@ export class Daemon extends EventEmitter {
         this.instanceStateSafetyListener = null;
     }
     handleStuckTransition(pane, snapshot, readyPattern) {
+        if (this.inputBlockedDialogKey !== null) {
+            this.logger.debug({ dialog: this.inputBlockedDialogKey }, "Suppressing stuck notification while CLI input is blocked by a dialog");
+            return;
+        }
         const deterministicReadyPattern = new RegExp(readyPattern.source, readyPattern.flags.replace(/[gy]/g, ""));
         const diagnostic = {
             backend: this.backend?.binaryName ?? this.config.backend ?? "unknown",
@@ -3834,6 +3923,28 @@ export class Daemon extends EventEmitter {
         }
         return formatted;
     }
+    /**
+     * Whether ONE delivery reached a verdict, carried by that delivery.
+     *
+     * `deliverMessage` returns false for two unrelated things: a delivery that
+     * cannot land (window gone, a pane that never came back, an unanswered
+     * dialog) and a delivery that was never attempted (user cancel, a tmux storm,
+     * shutdown). Only the first is a failure to tell the sender about; reporting
+     * the second told a sending agent its message was lost while the fleet was
+     * merely standing down (#826).
+     *
+     * It is per call and not a field on the daemon because deliveries do NOT all
+     * share one lock: an ordinary delivery is serialised on `pasteLock`, a steer
+     * on `steerLock`, and the two run concurrently by design. A field would let a
+     * steer's verdict decide whether a queued message's sender is told its
+     * delivery failed — a false ❌ carrying the wrong correlation id.
+     */
+    failDelivery(verdict, status) {
+        verdict.reached = true;
+        if (status)
+            this.emit("message_failed", status); // ❌
+        return false;
+    }
     /** Tell the fleet when an already-accepted cross-instance pane write failed. */
     reportCrossInstanceDeliveryFailure(meta, error) {
         if (!meta.from_instance)
@@ -3889,10 +4000,14 @@ export class Daemon extends EventEmitter {
             await this.wake();
             if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                 return;
-            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id })) {
+            const verdict = { reached: false };
+            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id, verdict })) {
                 this.markTurnStarted(meta, formatted);
             }
-            else if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
+            else if (verdict.reached && this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                // Same rule as the queued path: a steer that never got to try is not a
+                // delivery failure. This holder is the steer's own, which is the point
+                // — it runs on steerLock while a queued delivery runs on pasteLock.
                 this.reportCrossInstanceDeliveryFailure(meta);
             }
         }).catch(err => {
@@ -4022,10 +4137,16 @@ export class Daemon extends EventEmitter {
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
-                if (await this.deliverMessage(formatted, status, { deliveryEpoch, submissionId: meta.message_id })) {
+                const verdict = { reached: false };
+                if (await this.deliverMessage(formatted, status, { deliveryEpoch, submissionId: meta.message_id, verdict })) {
                     this.markTurnStarted(meta, formatted);
                 }
-                else if (meta.from_instance && this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                else if (meta.from_instance && verdict.reached
+                    && this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                    // Only a delivery that reached a verdict is reported. A pane that is
+                    // not ready yet, a cancel, a storm hold or a shutdown all return
+                    // false without one, and telling the sender its message was lost
+                    // there would be the false ❌ of #826 in its other form.
                     this.reportCrossInstanceDeliveryFailure(meta);
                 }
             }
@@ -4057,6 +4178,9 @@ export class Daemon extends EventEmitter {
      * serial in both cases so separate PTY writes can never overlap.
      */
     async deliverMessage(formatted, status, opts) {
+        // The caller passes its own holder when it needs the answer; a system paste
+        // that ignores the outcome gets a throwaway.
+        const verdict = opts?.verdict ?? { reached: false };
         const cancelled = () => opts?.deliveryEpoch !== undefined
             && !this.isDeliveryEpochCurrent(opts.deliveryEpoch);
         if (cancelled() || this.stormWindow?.isStopped())
@@ -4080,7 +4204,7 @@ export class Daemon extends EventEmitter {
         await this.waitForSpawnToSettle();
         if (cancelled())
             return false;
-        if (this.refuseFatalStartupDelivery(status))
+        if (this.refuseFatalStartupDelivery(verdict, status))
             return false;
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
@@ -4122,9 +4246,7 @@ export class Daemon extends EventEmitter {
                     // wedged CLI (where the text would sit unsubmitted and the next message
                     // would land on top of it) — and instead of holding the queue silently.
                     this.logger.error("Pane still busy after the idle wait — reporting delivery failure");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
             }
         }
@@ -4145,9 +4267,7 @@ export class Daemon extends EventEmitter {
                 // recovery Enter, so exactly STRANDED_INPUT_MAX_ROUNDS of them go out.
                 if (round >= STRANDED_INPUT_MAX_ROUNDS) {
                     this.logger.error({ round }, "Input row still not clear after the stranded-text recovery budget — reporting delivery failure");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
                 const stranded = await this.submitStrandedInputIfAny(windowId);
                 if (cancelled())
@@ -4156,18 +4276,14 @@ export class Daemon extends EventEmitter {
                     break;
                 if (stranded === "failed") {
                     this.logger.error({ round }, "Could not submit the stranded text — reporting delivery failure");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
                 const readyAgain = await this.waitForPaneReadyForDelivery(windowId);
                 if (cancelled())
                     return false;
                 if (!readyAgain) {
                     this.logger.error("Pane never returned to its prompt after submitting stranded input — reporting delivery failure");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
             }
         }
@@ -4179,15 +4295,13 @@ export class Daemon extends EventEmitter {
             const outcome = await this.paneWriteLock.run(async () => {
                 if (cancelled())
                     return false;
-                if (this.refuseFatalStartupDelivery(status))
+                if (this.refuseFatalStartupDelivery(verdict, status))
                     return false;
                 // A passive startup phase may paint after the outer readiness probe.
                 // It clears without input, so waiting under the pane lock cannot starve
                 // a dialog dismisser and closes the final clear→paste TOCTOU window.
                 if (!(await this.waitForInputTransientToClear("pre-write"))) {
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
                 // TOCTOU: the probes above ran outside this lock, and the CLI repaints
                 // whenever it likes — a resume prompt can be painted between "clear" and
@@ -4198,7 +4312,7 @@ export class Daemon extends EventEmitter {
                     if (probe.state !== "clear")
                         return "dialog";
                 }
-                return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId);
+                return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict);
             });
             if (outcome !== "dialog")
                 return outcome;
@@ -4207,18 +4321,14 @@ export class Daemon extends EventEmitter {
             // an honest failure rather than a message that never lands.
             if (round + 1 >= LATE_DIALOG_WRITE_ROUNDS) {
                 this.logger.error({ rounds: round + 1 }, "A dialog kept appearing before the pane write — reporting delivery failure");
-                if (status)
-                    this.emit("message_failed", status); // ❌
-                return false;
+                return this.failDelivery(verdict, status);
             }
             this.logger.info("Dialog appeared before the pane write — waiting for it to clear");
             const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId) : false;
             if (cancelled())
                 return false;
             if (!clear) {
-                if (status)
-                    this.emit("message_failed", status); // ❌
-                return false;
+                return this.failDelivery(verdict, status);
             }
         }
     }
@@ -4253,13 +4363,47 @@ export class Daemon extends EventEmitter {
         return null;
     }
     /** Capture failure is unknown, never evidence that input is available. */
+    /**
+     * The budget for waiting out a passive transient, measured in progress rather
+     * than in wall clock.
+     *
+     * `observe(pane)` answers "may I keep waiting?". The stall timer restarts
+     * every time the pane text changes, so a resume that is still painting never
+     * runs out; a screen that has not changed for INPUT_TRANSIENT_STALL_MS, or a
+     * transient that outlives the ceiling, does. Both ends stay bounded — the
+     * point of #826 was never that the wait should be unlimited, it was that a
+     * flat 30s could not tell "slow" from "stuck".
+     */
+    transientProgressBudget(overallDeadline) {
+        const ceiling = Math.min(overallDeadline, Date.now() + INPUT_TRANSIENT_WAIT_MS);
+        let lastPane = null;
+        let stallDeadline = 0;
+        const budget = {
+            stalled: false,
+            observe(pane) {
+                const now = Date.now();
+                if (pane !== lastPane) {
+                    lastPane = pane;
+                    stallDeadline = now + INPUT_TRANSIENT_STALL_MS;
+                }
+                if (now >= ceiling)
+                    return false;
+                budget.stalled = now >= stallDeadline;
+                return !budget.stalled;
+            },
+        };
+        return budget;
+    }
     async probeInputTransient() {
         if (this.guardedInputTransients().length === 0 || !this.tmux)
             return { state: "clear" };
         try {
             const pane = await this.tmux.capturePane();
             const transient = this.inputTransientInPane(pane);
-            return transient ? { state: "active", transient } : { state: "clear" };
+            // The pane text comes back with the verdict: a transient that is still
+            // repainting is still working, and that is the only thing separating a
+            // slow resume from a wedged one.
+            return transient ? { state: "active", transient, pane } : { state: "clear" };
         }
         catch (err) {
             this.logger.debug({ err }, "capture-pane failed during the input-transient probe — pane state unknown");
@@ -4275,7 +4419,12 @@ export class Daemon extends EventEmitter {
         const generation = this.inputTransientGuardGeneration;
         if (generation === null || generation !== this.spawnGeneration)
             return true;
-        const deadline = Date.now() + timeoutMs;
+        // Same progress rule as the outer readiness wait, for the same reason: this
+        // runs under the pane write lock, so a flat cap here turned a resume that
+        // repainted one second too late into a discarded message. Holding the lock
+        // while the pane is still painting costs nothing — every other writer is
+        // waiting on the same screen.
+        const budget = this.transientProgressBudget(Date.now() + timeoutMs);
         let observedDescription = null;
         for (;;) {
             if (this.inputTransientGuardGeneration !== generation || this.spawnGeneration !== generation) {
@@ -4293,12 +4442,18 @@ export class Daemon extends EventEmitter {
                 observedDescription = probe.transient.description;
                 this.logger.info({ phase, transient: probe.transient.description, generation }, "CLI is still completing startup — waiting before sending Enter");
             }
-            const remaining = deadline - Date.now();
-            if (remaining <= 0) {
-                this.logger.error({ phase, generation, timeoutMs, transient: observedDescription }, "CLI input stayed unavailable — refusing to send Enter");
+            // "unknown" (capture-pane failed) has to consume the budget too, or an
+            // unreadable pane would loop forever now that the flat deadline is gone.
+            // It never "changes", so it stalls out on the same rule.
+            if (!budget.observe(probe.state === "active" ? probe.pane : "\u0000unreadable")) {
+                this.logger.error({
+                    phase, generation, transient: observedDescription,
+                    stalledForMs: budget.stalled ? INPUT_TRANSIENT_STALL_MS : undefined,
+                    ceilingMs: timeoutMs,
+                }, "CLI input stayed unavailable — refusing to send Enter");
                 return false;
             }
-            await new Promise(r => setTimeout(r, Math.min(INPUT_TRANSIENT_POLL_MS, remaining)));
+            await new Promise(r => setTimeout(r, INPUT_TRANSIENT_POLL_MS));
         }
     }
     static dialogKey(dialog) {
@@ -4306,8 +4461,33 @@ export class Daemon extends EventEmitter {
     }
     /** A dialog counts only when it is the CURRENT interactive region, if the backend can tell; else by pattern. */
     static dialogMatches(dialog, pane) {
+        dialog.pattern.lastIndex = 0;
         return dialog.isActive ? dialog.isActive(pane) : dialog.pattern.test(pane);
     }
+    /** Refresh the separate stdin-blocked observation from one pane capture. */
+    updateInputBlockedState(pane, dialogs = this.backend?.getRuntimeDialogs?.() ?? []) {
+        const active = dialogs.find(dialog => dialog.inputBlocked && Daemon.dialogMatches(dialog, pane)) ?? null;
+        const nextKey = active ? Daemon.dialogKey(active) : null;
+        if (nextKey !== this.inputBlockedDialogKey) {
+            this.inputBlockedDialogKey = nextKey;
+            this.emit("input_blocked", {
+                name: this.name,
+                blocked: active !== null,
+                description: active?.description,
+            });
+        }
+        if (!active && this.autoResolvedDialogGeneration === this.spawnGeneration) {
+            // The old screen is gone.  A later dangerous command in the same spawn
+            // must get its own one-shot answer.
+            this.autoResolvedDialogKey = null;
+            this.autoResolvedDialogGeneration = 0;
+        }
+        return active;
+    }
+    /** Whether a runtime prompt currently owns the pane's stdin. */
+    isInputBlocked() {
+        return this.inputBlockedDialogKey !== null;
+    }
     /**
      * Tri-state liveness. tmux's own isWindowAlive folds every query failure
      * into `false`, so a transient tmux hiccup would read as "the CLI died" —
@@ -4473,7 +4653,7 @@ export class Daemon extends EventEmitter {
         const deadline = Date.now() + timeoutMs;
         const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true;
         let unknownStreak = 0;
-        let transientDeadline = 0;
+        let transientBudget = null;
         for (;;) {
             const remaining = deadline - Date.now();
             if (remaining <= 0)
@@ -4486,15 +4666,19 @@ export class Daemon extends EventEmitter {
             const transient = await this.probeInputTransient();
             if (transient.state === "active") {
                 unknownStreak = 0;
-                transientDeadline ||= Math.min(deadline, Date.now() + INPUT_TRANSIENT_WAIT_MS);
-                if (Date.now() >= transientDeadline) {
-                    this.logger.error({ transient: transient.transient.description, timeoutMs: INPUT_TRANSIENT_WAIT_MS }, "CLI input stayed unavailable during the delivery-readiness wait");
+                transientBudget ||= this.transientProgressBudget(deadline);
+                if (!transientBudget.observe(transient.pane)) {
+                    this.logger.error({
+                        transient: transient.transient.description,
+                        stalledForMs: transientBudget.stalled ? INPUT_TRANSIENT_STALL_MS : undefined,
+                        ceilingMs: INPUT_TRANSIENT_WAIT_MS,
+                    }, "CLI input stayed unavailable during the delivery-readiness wait");
                     return false;
                 }
                 await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
                 continue;
             }
-            transientDeadline = 0;
+            transientBudget = null;
             if (transient.state === "unknown") {
                 if (++unknownStreak >= DIALOG_PROBE_UNKNOWN_MAX) {
                     this.logger.error({ probes: unknownStreak }, "Pane stayed unreadable during the input-transient probe — refusing to deliver blind");
@@ -4640,12 +4824,11 @@ export class Daemon extends EventEmitter {
      * what to fix, and holding would only build a queue that floods the pane the
      * moment the flag clears.
      */
-    refuseFatalStartupDelivery(status) {
+    refuseFatalStartupDelivery(verdict, status) {
         if (!this.fatalStartupBlocked)
             return false;
         this.logger.error("Delivery refused — CLI is parked on a fatal startup screen");
-        if (status)
-            this.emit("message_failed", status); // ❌
+        this.failDelivery(verdict, status);
         return true;
     }
     /**
@@ -4724,7 +4907,10 @@ export class Daemon extends EventEmitter {
         }
         return sent;
     }
-    async writeMessageToPane(formatted, initialWindowId, handingOffToNativeQueue, status, submissionId) {
+    async writeMessageToPane(formatted, initialWindowId, handingOffToNativeQueue, status, submissionId, 
+    // Last and defaulted so the positional callers that ignore the outcome stay
+    // readable; deliverMessage, the only one that reports, always passes its own.
+    verdict = { reached: false }) {
         const signature = this.submissionSignature(formatted, submissionId);
         let windowId = initialWindowId;
         // Bug A: paste with backoff. Transient failures are usually a stale window id
@@ -4743,9 +4929,9 @@ export class Daemon extends EventEmitter {
                     ? "pasteBuffer failed — recovering window and backing off"
                     : "pasteBuffer failed — non-retryable tmux error");
                 if (!recoverable) {
-                    if (status)
-                        this.emit("message_failed", status);
-                    return false;
+                    // A tmux error the window cannot be recovered from: the text will
+                    // never reach this pane, so it is a verdict like the others.
+                    return this.failDelivery(verdict, status);
                 }
                 windowId = (await this.recoverWindow()) ?? windowId;
                 if (attempt < maxAttempts)
@@ -4775,9 +4961,7 @@ export class Daemon extends EventEmitter {
             }
             let enterAt = Date.now();
             if (!(await this.sendDeliveryEnter("initial-submit"))) {
-                if (status)
-                    this.emit("message_failed", status); // ❌
-                return false;
+                return this.failDelivery(verdict, status);
             }
             // Kiro's legacy TUI can swallow Enter while it is still processing a large
             // paste — not only during the post-ready redraw (#479): on slower hosts it
@@ -4860,9 +5044,7 @@ export class Daemon extends EventEmitter {
                     this.logger.warn("Message still in the input row after idle — submitting the existing text instead of pasting it again");
                     const strandedAt = Date.now();
                     if (!(await this.sendDeliveryEnter("native-queue-stranded-submit"))) {
-                        if (status)
-                            this.emit("message_failed", status); // ❌
-                        return false;
+                        return this.failDelivery(verdict, status);
                     }
                     const afterEnter = await this.confirmSubmitted(signature, pasteBaseline);
                     if (afterEnter === "submitted") {
@@ -4877,9 +5059,7 @@ export class Daemon extends EventEmitter {
                     // message nobody submitted. Output is corroboration; text sitting in
                     // the input row is disqualifying, and disqualifying evidence wins.
                     this.logger.error({ afterEnter, strandedAt }, "Stranded message could not be submitted by Enter");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
                 // "unproven": nothing of ours is on screen — the paste itself was lost,
                 // so pasting it again cannot duplicate anything.
@@ -4888,16 +5068,12 @@ export class Daemon extends EventEmitter {
                     this.logger.error({
                         tmuxError: this.tmux.getLastPasteError?.() ?? "unknown tmux paste failure",
                     }, "Idle-gated redelivery paste failed after native-queue silent loss");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
                 await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
                 const retryAt = Date.now();
                 if (!(await this.sendDeliveryEnter("native-queue-idle-redelivery"))) {
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
                 if (windowId && this.controlClient) {
                     if (await this.confirmAfterEnter(windowId, retryAt, signature, pasteBaseline, "native-queue-idle-redelivery-retry")) {
@@ -4912,9 +5088,7 @@ export class Daemon extends EventEmitter {
                     return true;
                 }
                 this.logger.error("Idle-gated redelivery also failed after native-queue silent loss");
-                if (status)
-                    this.emit("message_failed", status); // ❌
-                return false;
+                return this.failDelivery(verdict, status);
             }
             if (windowId && this.controlClient && this.backend?.dropsEnterWhileBusy?.() === true) {
                 // F2: output after Enter is necessary but not sufficient — the paste
@@ -4928,9 +5102,7 @@ export class Daemon extends EventEmitter {
                     const promptBack = await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS);
                     const retryAt = Date.now();
                     if (promptBack && !(await this.sendDeliveryEnter("stranded-text-retry"))) {
-                        if (status)
-                            this.emit("message_failed", status); // ❌
-                        return false;
+                        return this.failDelivery(verdict, status);
                     }
                     submitted = promptBack && await this.confirmSubmittedAfterEnter(windowId, retryAt, formatted);
                 }
@@ -4940,9 +5112,7 @@ export class Daemon extends EventEmitter {
                 }
                 else {
                     this.logger.error("Message pasted but never submitted (text still in the input row after Enter retry)");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
             }
             else if (windowId && this.controlClient) {
@@ -4967,9 +5137,7 @@ export class Daemon extends EventEmitter {
                     // forever and the next delivery pasted on top — submitting two messages
                     // as one. Say so instead.
                     this.logger.error("Message pasted but never submitted (no idle→busy after two Enters)");
-                    if (status)
-                        this.emit("message_failed", status); // ❌
-                    return false;
+                    return this.failDelivery(verdict, status);
                 }
             }
             else {
@@ -4982,9 +5150,7 @@ export class Daemon extends EventEmitter {
             return true;
         }
         this.logger.error("Message delivery failed after retries — window not ready");
-        if (status)
-            this.emit("message_failed", status); // ❌
-        return false;
+        return this.failDelivery(verdict, status);
     }
     /**
      * The single place a pasted message is judged submitted, shared by the