@songsid/agend 2.2.0-beta.5 → 2.2.0-beta.7

package/dist/cross-instance-envelope.js

@@ -8,6 +8,8 @@ export function renderCrossInstanceHandoffMetadata(meta) {
             rows.push(`${label}: ${value.trim()}`);
     };
     add("message_id", meta.message_id);
+    add("verification_id", meta.verification_id);
+    add("forwards", meta.forwards);
     add("correlation_id", meta.correlation_id);
     add("request_kind", meta.request_kind);
     add("task_summary", meta.task_summary);

package/dist/cross-instance-envelope.js.map

@@ -1 +1 @@
-{"version":3,"file":"cross-instance-envelope.js","sourceRoot":"","sources":["../src/cross-instance-envelope.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0CAA0C,GAAG,MAAM,CAAC;AAEjE,2DAA2D;AAC3D,MAAM,UAAU,kCAAkC,CAAC,IAA4B;IAC7E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAyB,EAAE,EAAE;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACjD,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,WAA+B;IACrF,MAAM,OAAO,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/F,CAAC;AAKD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B,EAAE,OAAkB,KAAK;IAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC;IAChD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,CAAC;QACtD,OAAO,QAAQ;YACb,CAAC,CAAC,8CAA8C,IAAI,QAAQ,QAAQ,CAAC,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,0BAA0B,IAAI,yBAAyB;YACpK,CAAC,CAAC,iDAAiD,IAAI,0EAA0E,CAAC;IACtI,CAAC;IACD,OAAO,QAAQ;QACb,CAAC,CAAC,kHAAkH;QACpH,CAAC,CAAC,wHAAwH,CAAC;AAC/H,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iCAAiC,CAAC,OAAe,EAAE,IAA4B,EAAE,OAAkB,KAAK;IACtH,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IAC9F,IAAI,SAAS,GAAG,SAAS,SAAS,KAAK,OAAO,EAAE,CAAC;IACjD,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;QACnE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE;QAC/B,CAAC,CAAC,IAAI,CAAC;IACT,SAAS,IAAI,kCAAkC,CAAC,UAAU,CAAC,CAAC;IAC5D,SAAS,IAAI,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"cross-instance-envelope.js","sourceRoot":"","sources":["../src/cross-instance-envelope.ts"],"names":[],"mappings":"AAAA,4FAA4F;AAC5F,MAAM,CAAC,MAAM,0CAA0C,GAAG,MAAM,CAAC;AAEjE,2DAA2D;AAC3D,MAAM,UAAU,kCAAkC,CAAC,IAA4B;IAC7E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAE,KAAyB,EAAE,EAAE;QACvD,IAAI,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,KAAK,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACpE,CAAC,CAAC;IACF,GAAG,CAAC,YAAY,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,GAAG,CAAC,iBAAiB,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IAC7C,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC/B,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IAC3C,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IACvC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC;IACjD,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3B,GAAG,CAAC,oBAAoB,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,WAA+B;IACrF,MAAM,OAAO,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,MAAM,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACpC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;AACrD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,KAAa;IACpC,OAAO,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/F,CAAC;AAKD;;;GAGG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAA4B,EAAE,OAAkB,KAAK;IAC5F,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,KAAK,MAAM,CAAC;IAChD,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,aAAa,IAAI,QAAQ,CAAC,CAAC;QACtD,OAAO,QAAQ;YACb,CAAC,CAAC,8CAA8C,IAAI,QAAQ,QAAQ,CAAC,IAAI,CAAC,cAAc,IAAI,gBAAgB,CAAC,0BAA0B,IAAI,yBAAyB;YACpK,CAAC,CAAC,iDAAiD,IAAI,0EAA0E,CAAC;IACtI,CAAC;IACD,OAAO,QAAQ;QACb,CAAC,CAAC,kHAAkH;QACpH,CAAC,CAAC,wHAAwH,CAAC;AAC/H,CAAC;AAED,iGAAiG;AACjG,MAAM,UAAU,iCAAiC,CAAC,OAAe,EAAE,IAA4B,EAAE,OAAkB,KAAK;IACtH,MAAM,YAAY,GAAG,IAAI,CAAC,aAAa,IAAI,SAAS,CAAC;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,YAAY,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC;IAC9F,IAAI,SAAS,GAAG,SAAS,SAAS,KAAK,OAAO,EAAE,CAAC;IACjD,wEAAwE;IACxE,kDAAkD;IAClD,MAAM,UAAU,GAAG,sBAAsB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,CAAC;QACnE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE;QAC/B,CAAC,CAAC,IAAI,CAAC;IACT,SAAS,IAAI,kCAAkC,CAAC,UAAU,CAAC,CAAC;IAC5D,SAAS,IAAI,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/daemon.d.ts

@@ -1484,6 +1484,12 @@ export declare class Daemon extends EventEmitter {
     /** #1650: how this instance talks to the fleet — MCP tools, or agend-agent commands (agent_mode: cli). */
     private agentMode;
     private formatInboundMessage;
+    /** Pure cached owner: no pane/process query on ingress. */
+    captureHumanReceiptOwner(): string | null;
+    /** The same formatter/sanitizer used by the actual write; snapshot only. */
+    humanReceiptWire(content: string, meta: Record<string, string>, kind: string): string;
+    private humanReceiptAttempt;
+    private finishHumanReceipt;
     /**
      * Whether ONE delivery reached a verdict, carried by that delivery.
      *

package/dist/daemon.js

@@ -9,6 +9,7 @@ import { rotateLogIfNeededAsync } from "./logger.js";
 import { coredumpFilterLaunchPrefix } from "./coredump-filter.js";
 import { mcpServerState } from "./mcp-liveness.js";
 import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
+import { writeBackgroundWorkEndedMarker } from "./background-work-ended.js";
 import { TmuxManager, resolveTmuxLogicalSize } from "./tmux-manager.js";
 import { TranscriptMonitor } from "./transcript-monitor.js";
 import { createTranscriptSource } from "./transcript-sources.js";
@@ -32,6 +33,7 @@ import { HangDetector } from "./hang-detector.js";
 import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
 import { buildFleetInstructions } from "./instructions.js";
+import { formatHumanInboundMessage, prepareDeliveryWire, steerInboundEnvelope, BTW_INBOUND_PREFIX, humanBodyHash, humanOwnerObjectId } from "./human-delivery-receipts.js";
 import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata, } from "./cross-instance-envelope.js";
 import { agendMessageInInput, bottomRowIsReady, inputAreaText, inputShowsPastedText, pastedTextSignature, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
 import { TurnReplyGuard } from "./turn-reply-guard.js";
@@ -2002,6 +2004,7 @@ export class Daemon extends EventEmitter {
         }
     }
     deferDurableDelivery(meta, reason) {
+        this.finishHumanReceipt(meta, { reached: false });
         const delivery = this.durableDeliveryAttempt(meta);
         if (delivery === null || delivery === false)
             return;
@@ -4232,6 +4235,13 @@ export class Daemon extends EventEmitter {
         if (!backend.quitBlockedByDialog(pane))
             return false;
         this.logger.warn({ reason }, "The CLI asked to confirm its exit (background work is running) — cancelling that prompt and stopping the process, not answering it");
+        // #1716: the background work is about to be ended — record it where the
+        // stop/restart reply and the instance topic notice can report it, so the
+        // kill is never silent.
+        try {
+            writeBackgroundWorkEndedMarker(this.instanceDir, reason);
+        }
+        catch { /* reporting only */ }
         await this.tmux.sendSpecialKey("Escape").catch(() => false);
         return true;
     }
@@ -4564,6 +4574,39 @@ export class Daemon extends EventEmitter {
             this.pauseRequested = false;
             return;
         }
+        // #1717: an idle pause is AgEnD-initiated and silent — it must not kill
+        // the user's running background work the way an explicit stop may. Defer
+        // this cycle while the backend reports background work; the next idle
+        // tick retries once the task ends. A pane-capture failure proceeds (the
+        // quit-menu handler below stays the backstop), never wedges unpaused.
+        if (this.backend?.backgroundWorkRunning && this.tmux) {
+            const tmux = this.tmux;
+            const windowId = tmux.getWindowId?.();
+            const generation = this.spawnGeneration;
+            let pane = null;
+            try {
+                pane = await tmux.capturePane();
+            }
+            catch { /* capture failed — pause as before, after revalidation */ }
+            // #1730 P2-2: the await yields — the pane read is only valid for the
+            // world it was taken from. Revalidate owner, phase, state and queue
+            // before acting on it; anything that moved defers this cycle.
+            if (this.tmux !== tmux
+                || this.tmux?.getWindowId?.() !== windowId
+                || this.spawnGeneration !== generation
+                || this.getPauseWakeState() !== "active"
+                || !(this.instanceState === "idle" || (allowStuck && this.instanceState === "stuck"))
+                || this.pasteQueueDepth > 0) {
+                this.logger.info("Deferring auto-pause: pause preconditions changed during the pane read");
+                this.pauseRequested = false;
+                return;
+            }
+            if (pane !== null && this.backend?.backgroundWorkRunning?.(pane)) {
+                this.logger.info("Deferring auto-pause: background work is still running");
+                this.pauseRequested = false;
+                return;
+            }
+        }
         this.pauseWakeState = "pausing";
         this.healthCheckPaused = true;
         this.freezeRuntimeMonitors();
@@ -6281,11 +6324,7 @@ export class Daemon extends EventEmitter {
      * is a durable delivery) must LEAD the persisted user message — restart reconciliation recognises a delivery only by a
      * marker at the start of the body (#1197) — so the banner goes right after it, not in front of it.
      */
-    static steerEnvelope(inbound) {
-        const banner = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n";
-        const marker = inbound.match(/^\[agend-delivery-id:[^\]\r\n]+\]\r?\n/);
-        return marker ? marker[0] + banner + inbound.slice(marker[0].length) : banner + inbound;
-    }
+    static steerEnvelope(inbound) { return steerInboundEnvelope(inbound); }
     /**
      * The one place an inbound message grows its metadata wrapper ([user:]/
      * [from:] prefix, pending reactions, handoff metadata, reply instructions).
@@ -6296,35 +6335,65 @@ export class Daemon extends EventEmitter {
     /** #1650: how this instance talks to the fleet — MCP tools, or agend-agent commands (agent_mode: cli). */
     agentMode() { return this.config.agent_mode === "cli" ? "cli" : "mcp"; }
     formatInboundMessage(content, meta) {
-        const user = meta.user || "unknown";
-        const fromInstance = meta.from_instance;
-        let formatted;
-        if (fromInstance) {
-            formatted = formatCrossInstanceInboundMessage(content, meta, this.agentMode());
+        if (!meta.from_instance)
+            return formatHumanInboundMessage(content, meta, this.agentMode());
+        let formatted = formatCrossInstanceInboundMessage(content, meta, this.agentMode());
+        if (meta.reply_to_text)
+            formatted += '\n(reply_to: "' + meta.reply_to_text + '")';
+        if (meta.delivery_id)
+            formatted = "[agend-delivery-id:" + meta.delivery_id + "]\n" + formatted;
+        return formatted;
+    }
+    /** Pure cached owner: no pane/process query on ingress. */
+    captureHumanReceiptOwner() {
+        try {
+            if (this.deliveryWritesStopping || this.spawning || !this.tmux)
+                return null;
+            const o = this.interactionOwner();
+            const window = this.tmux.getWindowId();
+            if (!window || !o.bootId || ![o.spawnGeneration, o.launchAttempt, o.launchFenceEpoch, this.deliveryEpoch]
+                .every(n => Number.isSafeInteger(n) && n >= 0))
+                return null;
+            return JSON.stringify([o.bootId, o.spawnGeneration, o.launchAttempt, o.launchFenceEpoch,
+                this.deliveryEpoch, humanOwnerObjectId(this.tmux), window]);
         }
-        else {
-            const via = meta.source ? ` via ${meta.source}` : "";
-            const idTag = meta.user_id ? `, id:${meta.user_id}` : "";
-            formatted = `[user:${user}${via}${idTag}] ${content}`;
-            // Reactions queued since the last real message (#432). One leading line of
-            // context, present only when something is pending — a reaction no longer
-            // costs a turn of its own.
-            if (meta.pending_reactions) {
-                formatted = `[Recent reactions: ${meta.pending_reactions}]\n${formatted}`;
-            }
-            formatted += renderHandoffMetadata(meta);
-            // #1650: a CLI-mode agent has no reply tool — it answers with the agend-agent command.
-            formatted += this.agentMode() === "cli"
-                ? '\n(Reply with agend-agent reply "…" — do NOT respond with direct text)'
-                : "\n(Reply using the reply tool — do NOT respond with direct text)";
-        }
-        if (meta.reply_to_text) {
-            formatted += `\n(reply_to: "${meta.reply_to_text}")`;
-        }
-        if (meta.delivery_id) {
-            formatted = `[agend-delivery-id:${meta.delivery_id}]\n${formatted}`;
+        catch {
+            return null;
+        }
+    }
+    /** The same formatter/sanitizer used by the actual write; snapshot only. */
+    humanReceiptWire(content, meta, kind) {
+        let wire = kind === "raw_paste" ? content
+            : !meta.from_instance && content.startsWith("/raw ") && kind === "fleet_inbound"
+                ? content.slice(5) : this.formatInboundMessage(content, meta);
+        if (kind === "steer")
+            wire = Daemon.steerEnvelope(wire);
+        else if (kind === "btw")
+            wire = BTW_INBOUND_PREFIX + wire;
+        return prepareDeliveryWire(wire, kind === "raw_paste");
+    }
+    humanReceiptAttempt(meta, wire) {
+        const id = meta.human_receipt_id;
+        const daemonOwner = meta.human_daemon_owner;
+        if (!id || !/^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/.test(id) || meta.verification_id !== "hmsg-" + id
+            || !daemonOwner || !meta.human_owner_key || !/^[a-f0-9]{64}$/.test(meta.human_wire_sha256 ?? "")
+            || humanBodyHash(prepareDeliveryWire(wire)) !== meta.human_wire_sha256)
+            return undefined;
+        return { receiptId: id, verificationId: meta.verification_id, expectedWireHash: meta.human_wire_sha256,
+            ownerKey: meta.human_owner_key, current: () => this.captureHumanReceiptOwner() === daemonOwner };
+    }
+    finishHumanReceipt(meta, verdict) {
+        if (!meta.human_receipt_id || !meta.human_owner_key)
+            return;
+        const attempt = verdict.humanReceipt;
+        const proof = attempt?.current() && !["unverified", "output-edge", "unverifiable"].includes(verdict.proof ?? "")
+            ? attempt.proof ?? null : null;
+        try {
+            this.emit("human_receipt_result", { receipt_id: meta.human_receipt_id, owner_key: meta.human_owner_key, proof });
+        }
+        catch (err) {
+            this.logger.error({ err }, "Could not publish human delivery evidence");
         }
-        return formatted;
     }
     /**
      * Whether ONE delivery reached a verdict, carried by that delivery.
@@ -6417,12 +6486,13 @@ export class Daemon extends EventEmitter {
                 this.deferDurableDelivery(meta, "delivery epoch changed while waking for steer");
                 return;
             }
-            const verdict = { reached: false };
+            const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
             try {
                 if (await this.deliverMessage(formatted, status, {
                     steer: true,
                     deliveryEpoch,
                     submissionId: meta.message_id,
+                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
                     verdict,
                     durableAttempt: durableAttempt || undefined,
                 })) {
@@ -6453,6 +6523,9 @@ export class Daemon extends EventEmitter {
                     this.retryDurableDeliveryBeforeBegin(durableAttempt, err.message);
                 throw err;
             }
+            finally {
+                this.finishHumanReceipt(meta, verdict);
+            }
         }).catch(err => {
             this.deferDurableDelivery(meta, `target wake/steer failed before pane submission: ${err.message}`);
             this.logger.warn({ err: err.message }, "steer delivery error");
@@ -6468,24 +6541,37 @@ export class Daemon extends EventEmitter {
      * so channel delivery intentionally uses a normal wrapped inbound instead.
      */
     btwMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
-        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+            this.finishHumanReceipt(meta, { reached: false });
             return;
+        }
         this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
         this.pendingWork.recordInbound();
         this.recordRecentUserMessage(content, meta);
-        const formatted = "[BTW — side question from the user. Answer it separately without changing or interrupting the CURRENT work.]\n"
-            + this.formatInboundMessage(content, meta);
+        const formatted = BTW_INBOUND_PREFIX + this.formatInboundMessage(content, meta);
         const status = channelStatus(meta);
         this.steerLock = this.steerLock.then(async () => {
-            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.finishHumanReceipt(meta, { reached: false });
                 return;
+            }
             await this.wake();
-            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.finishHumanReceipt(meta, { reached: false });
                 return;
-            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id })) {
-                this.markTurnStarted(meta, formatted, deliveryEpoch);
+            }
+            const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+            try {
+                if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id,
+                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}), verdict })) {
+                    this.markTurnStarted(meta, formatted, deliveryEpoch);
+                }
+            }
+            finally {
+                this.finishHumanReceipt(meta, verdict);
             }
         }).catch(err => {
+            this.finishHumanReceipt(meta, { reached: false });
             this.logger.warn({ err: err.message }, "btw delivery error");
         });
     }
@@ -6599,7 +6685,7 @@ export class Daemon extends EventEmitter {
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
-                verdict = { reached: false };
+                verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
                 const durableAttempt = this.durableDeliveryAttempt(meta, content);
                 if (durableAttempt === false) {
                     this.deferDurableDelivery(meta, "invalid durable delivery attempt metadata");
@@ -6609,6 +6695,7 @@ export class Daemon extends EventEmitter {
                 if (await this.deliverMessage(formatted, status, {
                     deliveryEpoch,
                     submissionId: meta.message_id,
+                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
                     verdict,
                     durableAttempt: durableAttempt || undefined,
                 })) {
@@ -6656,6 +6743,7 @@ export class Daemon extends EventEmitter {
                 this.logger.warn({ err: err.message }, "Durable pane delivery deferred after exception");
             }
             finally {
+                this.finishHumanReceipt(meta, verdict);
                 this.pasteQueueDepth--;
             }
         }).catch(err => {
@@ -6692,12 +6780,7 @@ export class Daemon extends EventEmitter {
             && !this.isDeliveryEpochCurrent(opts.deliveryEpoch);
         if (cancelled() || this.stormWindow?.isStopped())
             return false;
-        // Sanitize unclosed code fences — they cause CLI to wait for closure on Enter
-        const fenceCount = (formatted.match(/```/g) || []).length;
-        if (!opts?.preserveExactBytes && fenceCount % 2 !== 0) {
-            // Odd number of fences = unclosed. Remove all code fences from the message.
-            formatted = formatted.replace(/```/g, "");
-        }
+        formatted = prepareDeliveryWire(formatted, opts?.preserveExactBytes);
         // Direct paths such as /steer, /btw, /raw and schedules do not pass the
         // FleetManager idle gate. Hold them at the final common pane-write path so
         // a tmux storm cannot force any text into a half-booted CLI.
@@ -6870,7 +6953,7 @@ export class Daemon extends EventEmitter {
                     return stale();
                 if (residue !== "clear")
                     return this.failDelivery(verdict, status, "input-residue", residue);
-                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent);
+                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent, opts?.humanVerificationId);
                 // #1690: still under the lock — whatever waits on it next must already see what this write started.
                 if (verdict.paneWriteStarted)
                     opts?.onPaneWritten?.();
@@ -7665,7 +7748,7 @@ export class Daemon extends EventEmitter {
             return false;
         const row = norm(shown);
         // The marker line holds nothing but the marker: the row is exactly it.
-        if (/^\[agend-delivery-id:[^\]\s]+\]$/.test(first))
+        if (/^\[agend-(?:delivery|human)-id:[^\]\s]+\]$/.test(first))
             return row === first;
         return row === first || row.startsWith(`${first} `);
     }
@@ -8207,6 +8290,8 @@ export class Daemon extends EventEmitter {
             if (!current())
                 return false;
             if (evidence === "submitted") {
+                if (pending.signature.unique)
+                    pending.signature.humanPositive?.("unique-id-pane");
                 if (status)
                     this.emit("message_confirmed", status);
                 return true;
@@ -8242,6 +8327,8 @@ export class Daemon extends EventEmitter {
                 if (retry === "cancelled")
                     return false;
                 if (retry === "submitted") {
+                    if (pending.signature.unique)
+                        pending.signature.humanPositive?.("unique-id-pane");
                     if (status)
                         this.emit("message_confirmed", status);
                     return true;
@@ -8382,9 +8469,24 @@ export class Daemon extends EventEmitter {
     verdict = { reached: false }, durableAttempt, steer = false, 
     // #829: the caller's fence, asked once more after the last await before the
     // first side effect. Stale means unwritten: false, with no failure verdict.
-    stillCurrent) {
-        const signature = this.submissionSignature(formatted, submissionId);
+    stillCurrent, humanVerificationId) {
+        const signature = this.submissionSignature(formatted, humanVerificationId ?? submissionId, humanVerificationId !== undefined);
         const rawPaste = durableAttempt?.submissionMode === "raw_paste";
+        const humanAttempt = verdict.humanReceipt;
+        const humanMode = rawPaste ? "raw_paste" : steer ? "steer"
+            : handingOffToNativeQueue ? "native_queue_handoff" : "idle_submit";
+        if (humanAttempt && signature.unique && signature.value === "agend-human-id:" + humanAttempt.verificationId
+            && humanBodyHash(formatted) === humanAttempt.expectedWireHash) {
+            signature.humanPositive = tag => {
+                if (!humanAttempt.current() || (stillCurrent && !stillCurrent()))
+                    return;
+                humanAttempt.proof = {
+                    receipt_id: humanAttempt.receiptId, verification_id: humanAttempt.verificationId,
+                    wire_sha256: humanBodyHash(formatted), owner_key: humanAttempt.ownerKey,
+                    mode: humanMode, tag,
+                };
+            };
+        }
         let windowId = initialWindowId;
         // The spawn this write belongs to: acceptance evidence is only read while it is still the current one (#1197).
         const spawnAtWrite = this.spawnGeneration;
@@ -8530,6 +8632,7 @@ export class Daemon extends EventEmitter {
             // positively hold typed text, and after it be the empty placeholder again. The empty placeholder here means the
             // paste never reached the box; an unreadable box (a failed or late capture, a dialog) proves nothing: no Enter.
             const steerComposerProof = handingOffToNativeQueue && steer && !!this.backend?.readSteerComposer && tmuxAtWrite !== null;
+            let humanComposerOwned = false;
             let steerEnterDeadline = Infinity;
             if (steerComposerProof) {
                 const deadline = performance.now() + STEER_PASTE_VISIBLE_MS;
@@ -8553,6 +8656,8 @@ export class Daemon extends EventEmitter {
                     return this.failDelivery(verdict, status, "steer-paste", before === null ? "box-unread" : `box-still-${before.mode}`);
                 if (!this.steerPasteIsOurs(before.pane, formatted))
                     return this.failDelivery(verdict, status, "steer-paste", "box-not-this-paste");
+                const shown = this.backend?.readSteerComposerText?.(before.pane)?.replace(/\s+/g, " ").trim();
+                humanComposerOwned = !!humanAttempt && shown === "[agend-human-id:" + humanAttempt.verificationId + "]";
                 // …and so is the Enter: the key is sent only while the reading is still within it.
                 steerEnterDeadline = deadline;
             }
@@ -8624,6 +8729,9 @@ export class Daemon extends EventEmitter {
                         if (after === "steer" || after === "queue" || after === "idle") {
                             const probe = await withinMs(this.probeBlockingDialog(), deadline - performance.now());
                             if (probe?.state === "clear" && performance.now() <= deadline && steerCurrent() && this.getWindowId() === windowId) {
+                                if (humanComposerOwned)
+                                    signature.humanPositive?.(after === "steer" ? "composer-empty-steer"
+                                        : after === "queue" ? "composer-empty-queue" : "composer-empty-idle");
                                 verdict.phase = "steer-accepted";
                                 verdict.proof = `steer-composer-${after}`;
                                 if (status)
@@ -9210,8 +9318,11 @@ export class Daemon extends EventEmitter {
         //    the input row is proof in itself — which also means a momentary
         //    failure to read the pane BEFORE pasting cannot turn a delivered
         //    message into a re-paste.
-        if (signature.unique && after.payload > 0)
+        if (signature.unique && after.payload > 0) {
+            if (after.inputReadable)
+                signature.humanPositive?.("unique-id-pane");
             return this.submittedProof();
+        }
         if (unattributedResidue)
             return "unverifiable";
         // 3. Otherwise the evidence must be NEW relative to the pane as it was
@@ -9348,7 +9459,7 @@ export class Daemon extends EventEmitter {
      * paste that never landed. System pastes carry no envelope and fall back to
      * the body signature, which the baseline comparison still ties to this paste.
      */
-    submissionSignature(formatted, trustedId) {
+    submissionSignature(formatted, trustedId, verification = false) {
         // The id must come from the message's own metadata, never from scanning the
         // rendered text: agents and users discuss message ids in the body all the
         // time ("check message_id: abc"), and a body-scanned value would match an
@@ -9357,7 +9468,7 @@ export class Daemon extends EventEmitter {
         // the handoff metadata identifies THIS delivery.
         const id = trustedId?.trim();
         if (id)
-            return { value: `message_id:${id}`, unique: true };
+            return { value: (verification ? "agend-human-id:" : "message_id:") + id, unique: true };
         return { value: pastedTextSignature(formatted), unique: false };
     }
     /**