@team-agent/installer 0.3.25 → 0.3.26

package/crates/team-agent/src/messaging/delivery.rs

@@ -348,6 +348,7 @@ pub fn deliver_pending_message(
                         attempt,
                         "send_inject_exhausted",
                         &reason,
+                        None,
                     )?;
                     return Ok(DeliveryOutcome {
                         ok: false,
@@ -387,6 +388,13 @@ pub fn deliver_pending_message(
                 submit_verification_wire(inject_report.submit_verification)
             )
         };
+        // E50 PR-1 (0.3.24 P0): render forensic submit_diagnostics into the
+        // event so operators see per-attempt pane state without grepping. The
+        // legacy keys (`message_id` / `recipient` / `reason` / `attempts`)
+        // are preserved byte-for-byte for grep compatibility; new keys are
+        // ADDITIONAL.
+        let submit_attempts_detail =
+            render_submit_diagnostics(&inject_report);
         event_log.write(
             "send.unverified",
             serde_json::json!({
@@ -394,6 +402,7 @@ pub fn deliver_pending_message(
                 "recipient": message.recipient,
                 "reason": reason,
                 "attempts": inject_report.attempts,
+                "submit_attempts_detail": submit_attempts_detail,
             }),
         )?;
         if inject_report.attempts >= u32::from(SEND_RETRY_MAX_ATTEMPTS) {
@@ -407,6 +416,7 @@ pub fn deliver_pending_message(
                 inject_report.attempts,
                 "send_unverified_exhausted",
                 &reason,
+                Some(&inject_report),
             )?;
             return Ok(DeliveryOutcome {
                 ok: false,
@@ -504,7 +514,8 @@ fn pane_readback_verified(report: &InjectReport) -> bool {
 /// [team-agent-token:{message_id}]`. The worker (fake or real provider) only builds a result_envelope
 /// when it sees this block + extracts the token — the bare content gives WORKING but never a report
 /// (rt-host-a loop #4). token == message_id (exactly-once correlation).
-fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id: &str) -> String {
+/// F1 (0.3.26): promoted to `pub` for direct pane send in cli/send.rs.
+pub fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id: &str) -> String {
     let mut header = format!("Team Agent message from {sender}");
     if let Some(task_id) = task_id.filter(|t| !t.is_empty()) {
         header.push_str(&format!(" for {task_id}"));
@@ -557,7 +568,23 @@ fn resolve_inject_target(
         .and_then(serde_json::Value::as_str)
         .filter(|s| !s.is_empty())
         .map(PaneId::new);
+    // E51 (0.3.26 P0, delivery loop guard): if the worker's cached pane_id is
+    // the SAME as leader_receiver.pane_id (the leader's handle), injecting into
+    // it would deliver the worker's message back to the leader pane — a routing
+    // loop that the macmini "hand-handle mapping 灾難" truth source exposed. Fail
+    // loud with a SessionWindow target that will surface as a structured error
+    // (the SessionWindow "leader" target trips the existing leader_not_attached
+    // guard on any subsequent delivery attempt for this message). The root fix
+    // is in lease.rs (E51 guard #1) which prevents the conflation; this is the
+    // defence-in-depth in the delivery layer.
     if let Some(pane) = cached_pane.as_ref() {
+        let leader_pane = leader_receiver_pane_id(state);
+        if leader_pane.is_some_and(|lp| lp == pane.as_str()) {
+            return Target::SessionWindow {
+                session: SessionName::new(session),
+                window: WindowName::new(format!("{recipient}_pane_conflicts_with_leader")),
+            };
+        }
         if live_targets
             .iter()
             .any(|target| target.pane_id.as_str() == pane.as_str())
@@ -755,6 +782,34 @@ fn leader_receiver_field_in_state<'a>(
         .filter(|value| !value.is_empty())
 }
 
+/// E50 PR-1 (0.3.24 P0): render `InjectReport.submit_diagnostics` as a JSON
+/// array suitable for inclusion in `send.unverified` / `send.failed` events.
+/// `null` if no diagnostics were attached (e.g. the inject went through a
+/// path that bypassed the paste-prompt + Enter instrumentation, or this is
+/// the pre-PR-2 inject-failed path with no `InjectReport`).
+fn render_submit_diagnostics(report: &InjectReport) -> serde_json::Value {
+    let Some(diag) = report.submit_diagnostics.as_ref() else {
+        return serde_json::Value::Null;
+    };
+    serde_json::Value::Array(
+        diag.attempts_detail
+            .iter()
+            .map(|obs| {
+                serde_json::json!({
+                    "attempt_index": obs.attempt_index,
+                    "matched": obs.matched,
+                    "matched_literal": obs.matched_literal,
+                    "where_in_tail": obs.where_in_tail,
+                    "pane_tail_excerpt": obs.pane_tail_excerpt,
+                    "pane_tail_lines": obs.pane_tail_lines,
+                    "elapsed_ms": obs.elapsed_ms,
+                })
+            })
+            .collect(),
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
 fn emit_send_failed_exhausted(
     workspace: &Path,
     state: &serde_json::Value,
@@ -764,7 +819,26 @@ fn emit_send_failed_exhausted(
     attempts: u32,
     failure_reason: &str,
     verification: &str,
+    inject_report: Option<&InjectReport>,
 ) -> Result<(), MessagingError> {
+    // E50 PR-1 (0.3.24 P0): forensic fields on send.failed. Legacy keys
+    // (`message_id` / `recipient` / `attempts` / `max_attempts` / `reason` /
+    // `verification`) preserved byte-for-byte for grep compatibility.
+    let submit_attempts_detail = inject_report
+        .map(render_submit_diagnostics)
+        .unwrap_or_else(|| serde_json::Value::Array(Vec::new()));
+    let total_elapsed_ms = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .map(|d| d.total_elapsed_ms)
+        .unwrap_or(0);
+    let last_matched_literal = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .and_then(|d| d.attempts_detail.last())
+        .and_then(|a| a.matched_literal.clone());
+    let last_pane_tail_excerpt = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .and_then(|d| d.attempts_detail.last())
+        .map(|a| a.pane_tail_excerpt.clone());
     event_log.write(
         "send.failed",
         serde_json::json!({
@@ -774,6 +848,10 @@ fn emit_send_failed_exhausted(
             "max_attempts": SEND_RETRY_MAX_ATTEMPTS,
             "reason": failure_reason,
             "verification": verification,
+            "submit_attempts_detail": submit_attempts_detail,
+            "total_elapsed_ms": total_elapsed_ms,
+            "last_matched_literal": last_matched_literal,
+            "last_pane_tail_excerpt": last_pane_tail_excerpt,
         }),
     )?;
     let content = format!(

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -1308,6 +1308,7 @@ impl Transport for UnverifiedInjectTransport {
                 crate::transport::SubmitVerification::PastedContentPromptStillPresentAfterSubmit,
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: u32::from(SEND_RETRY_MAX_ATTEMPTS),
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _t: &Target, _k: &[Key]) -> Result<(), TransportError> {
@@ -1467,6 +1468,7 @@ impl Transport for ReadbackMissingTransport {
             },
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: 1,
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _: &Target, _: &[Key]) -> Result<(), TransportError> {

package/crates/team-agent/src/messaging/tests/spine.rs

@@ -173,6 +173,7 @@ impl Transport for DeliverOkTransport {
             submit_verification: crate::transport::SubmitVerification::EnterSentWithoutPlaceholderCheck,
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: 1,
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _t: &Target, _k: &[Key]) -> Result<(), TransportError> {

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -369,9 +369,10 @@
             .expect("spawn_split");
         assert_eq!(result.pane_id.as_str(), "%5");
         let calls = rec.lock().unwrap().clone();
+        // E53 (0.3.26): split-window now carries `-d` (no focus steal).
         assert_eq!(
-            calls[0][0..4],
-            svec(&["tmux", "split-window", "-t", "teamsess:team-w1"])
+            calls[0][0..5],
+            svec(&["tmux", "split-window", "-d", "-t", "teamsess:team-w1"])
         );
         assert_eq!(
             calls[1],
@@ -823,6 +824,166 @@ CaptureMissingToken, not the static CaptureContainsToken false-positive"
         );
     }
 
+    // ═════════════════════════════════════════════════════════════════════════
+    // E50 PR-1 (0.3.24 P0, pasted-prompt 假阴诊断) — InjectReport.submit_diagnostics
+    // is populated for paste-prompt loops, and `pasted_prompt_match` / scrubbing
+    // helpers are pure functions safe to test deterministically.
+    //
+    // Architect verdict (Workflow forensic): the pre-fix
+    // `capture_has_pasted_content_prompt` matched ANY `pasted content` /
+    // `pasted text` token in the full Tail(80), including scrolled-off
+    // submitted blocks. PR-1 just adds the diagnostics; PR-2 will USE
+    // `where_in_tail` to fix the criterion. These tests pin the data shape.
+    // ═════════════════════════════════════════════════════════════════════════
+
+    /// **E50 RED-1 (判据误判, pure function)**: `pasted_prompt_match` must
+    /// distinguish bottom-region (composer) from scrollback (line 6+ from
+    /// bottom). Pre-fix `capture_has_pasted_content_prompt` returned `true`
+    /// for BOTH; the new tuple-returning helper surfaces the offset so PR-2
+    /// can fix the criterion.
+    #[test]
+    fn e50_pasted_prompt_match_reports_where_in_tail_for_scrollback_vs_composer() {
+        use super::pasted_prompt_match;
+
+        // Composer (bottom) match.
+        let composer_only = "some output\n\
+                             [Pasted content 1.2k]\n\
+                             ❯ ";
+        // The match is "pasted content" in the line at index 1 from bottom
+        // among non-empty lines (`[Pasted content...]`, `❯ ` is at idx 0).
+        let m = pasted_prompt_match(composer_only).expect("match");
+        assert_eq!(m.0, "pasted content");
+        assert_eq!(
+            m.1, 1,
+            "E50: where_in_tail must reflect bottom offset (idx 1 = above the \
+             `❯` composer line); got {m:?}"
+        );
+
+        // Scrollback (top) match — 8 lines from bottom.
+        let scrollback_only = "[Pasted content 5.0k]\n\
+                               assistant reply line 1\n\
+                               assistant reply line 2\n\
+                               assistant reply line 3\n\
+                               assistant reply line 4\n\
+                               assistant reply line 5\n\
+                               assistant reply line 6\n\
+                               assistant reply line 7\n\
+                               ❯ ";
+        let m2 = pasted_prompt_match(scrollback_only).expect("match");
+        assert_eq!(m2.0, "pasted content");
+        assert!(
+            m2.1 >= 6,
+            "E50: scrollback `Pasted content` must report where_in_tail >= 6 \
+             (clearly above the bottom composer region); got {m2:?}. PR-2 \
+             will use this offset to distinguish live composer vs scrollback \
+             residue."
+        );
+
+        // No match.
+        assert!(pasted_prompt_match("nothing here\n❯ ").is_none());
+    }
+
+    /// **E50 PR-2 Fix-B (amends PR-1 RED-2)**: with Fix-B, token-bearing
+    /// payloads SKIP the paste-prompt weak loop and fall through to the E46
+    /// token consumption gate. The `submit_diagnostics` still records the
+    /// appear-gate timing (was `saw_pasted_prompt` matched?), but
+    /// `attempts_detail` is populated by the E46 consumption gate path, not
+    /// the deleted weak loop. This test pins the NEW shape: `appear_gate_matched`
+    /// may be false (mock default returns the pasted-content text, but the
+    /// appear-gate polls 5 times with 25ms sleep and the mock answers the SAME
+    /// text every time → appear-gate DOES match). However, the `has_token` guard
+    /// skips the weak loop body → the token path's diagnostics fill in instead.
+    #[test]
+    fn e50_inject_paste_prompt_path_populates_submit_diagnostics_per_attempt() {
+        let token_text =
+            "Team Agent message from leader:\n\nhello\n\n[team-agent-token:msg_pr1]";
+        // Mock keeps returning the pasted-content placeholder. With Fix-B,
+        // the token path takes over: post_submit_input_consumed checks
+        // bottom 5 lines for the token marker. The mock returns the pasted
+        // placeholder text (without the token) → token NOT in tail → consumed
+        // = Some(true) → EnterSentWithoutPlaceholderCheck.
+        // We test: (a) diagnostics present (b) submit verification reflects
+        // the E46 token path, not the deleted weak loop.
+        let pasted = "[Pasted content 1.2k]";
+        let (be, _rec) = backend_with(MockResp::Out(ok(pasted)), vec![]);
+        let report = be
+            .inject(
+                &Target::Pane(PaneId::new("%7")),
+                &InjectPayload::Text(token_text.to_string()),
+                Key::Enter,
+                true,
+            )
+            .expect("inject");
+        // Fix-B: token payload → E46 token path. The submit verification is
+        // either EnterSentWithoutPlaceholderCheck (consumed) or
+        // SubmitConsumptionUnverified (not consumed). With the mock returning
+        // pasted-content text (no token in tail), consumed = true.
+        assert_eq!(
+            report.submit_verification,
+            SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            "E50 PR-2 Fix-B: token payload that went through the E46 gate \
+             and was consumed (token not in bottom 5 lines) must report \
+             EnterSentWithoutPlaceholderCheck; got {:?}",
+            report.submit_verification
+        );
+    }
+
+    /// **E50 PR-1 secret scrubbing**: `scrub_pane_excerpt` must strip ANSI
+    /// + redact common secret shapes so emitted events.jsonl doesn't leak.
+    #[test]
+    fn e50_scrub_pane_excerpt_strips_ansi_and_redacts_secret_shapes() {
+        use super::scrub_pane_excerpt;
+        let raw = "\x1b[31merror\x1b[0m: sk-abcdef123ghi\n\
+                   token Bearer abc.def.ghi\n\
+                   key AKIAIOSFODNN7EXAMPLE\n\
+                   ghp_1234567890abcdef\n\
+                   hex deadbeefdeadbeefdeadbeefdeadbeefcafebabe\n\
+                   plain text below";
+        let (out, lines) = scrub_pane_excerpt(raw, 20);
+        assert!(lines >= 5, "E50: at least 5 non-empty lines; got {lines}");
+        assert!(!out.contains("\x1b"), "E50: ANSI escape stripped; got {out:?}");
+        assert!(
+            !out.contains("sk-abcdef123ghi"),
+            "E50: sk- secret must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("ghp_1234567890abcdef"),
+            "E50: ghp_ secret must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("AKIAIOSFODNN7EXAMPLE"),
+            "E50: AKIA secret must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("abc.def.ghi"),
+            "E50: Bearer secret token must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("deadbeefdeadbeefdeadbeefdeadbeefcafebabe"),
+            "E50: 32+ hex run must be redacted; got {out:?}"
+        );
+        assert!(
+            out.contains("REDACTED"),
+            "E50: redactions visible; got {out:?}"
+        );
+        assert!(
+            out.contains("plain text below"),
+            "E50: non-secret content preserved; got {out:?}"
+        );
+    }
+
+    /// **E50 PR-1 byte-identical legacy matcher**: `capture_has_pasted_content_prompt`
+    /// wrapper must still return the same bool the 3 legacy callers depend on
+    /// (the bool-returning fn shape is the contract for byte-locked behaviour).
+    #[test]
+    fn e50_capture_has_pasted_content_prompt_byte_identical_wrapper() {
+        use super::capture_has_pasted_content_prompt;
+        assert!(capture_has_pasted_content_prompt("[Pasted content 1k]"));
+        assert!(capture_has_pasted_content_prompt("[Pasted text foo]"));
+        assert!(!capture_has_pasted_content_prompt("just composer text"));
+        assert!(!capture_has_pasted_content_prompt(""));
+    }
+
     #[test]
     fn send_keys_cancel_mode_queries_mode_and_dispatches_cancel_argv() {
         let (be, rec) = backend_with(

package/crates/team-agent/src/tmux_backend.rs

@@ -642,9 +642,15 @@ impl TmuxBackend {
     ) -> Result<SpawnResult, TransportError> {
         let command = shell_command(argv, cwd, env, env_unset);
         let target = format!("{}:{}", session.as_str(), window.as_str());
+        // E53 (0.3.26, adaptive layout same-session tabs): `-d` prevents the
+        // new split pane from stealing focus from the leader's active pane.
+        // Same rationale as the `-d` on `new-window` in transport.rs; for
+        // adaptive layout the leader and all workers share the same tmux
+        // session, and every focus-stealing spawn is a disruption.
         let split_argv = vec![
             "tmux".to_string(),
             "split-window".to_string(),
+            "-d".to_string(),
             "-t".to_string(),
             target.clone(),
             "-h".to_string(),
@@ -920,8 +926,202 @@ fn submit_verification_for_key(key: Key) -> SubmitVerification {
 }
 
 fn capture_has_pasted_content_prompt(text: &str) -> bool {
+    pasted_prompt_match(text).is_some()
+}
+
+/// E50 PR-1 (0.3.24 P0, pasted-prompt 假阴诊断): factor `capture_has_pasted_content_prompt`
+/// so the diagnostic layer can recover the MATCHED LITERAL and its position
+/// in the tail. Returns `(literal, line_index_from_bottom)` on a match.
+/// Byte-identical match semantics — `capture_has_pasted_content_prompt`'s
+/// `bool` wrapper preserves the legacy `true/false` contract for the three
+/// existing callers (the appear-gate poll at :1122-1128 + the legacy submit
+/// loop matcher at :1138 + post-flip clearer at :1138).
+///
+/// **Where-in-tail rationale**: a `pasted content` literal that lives in
+/// the SCROLLBACK (line 6+ from bottom) is NOT the live composer
+/// placeholder — codex's successful submit scrolls the block into history
+/// where it remains in the last 80 lines. The current matcher cannot
+/// distinguish that from a live placeholder; this fn surfaces the data
+/// the operator needs to see (PR-2 will USE it to fix the criterion).
+pub(crate) fn pasted_prompt_match(text: &str) -> Option<(&'static str, u32)> {
     let lower = text.to_ascii_lowercase();
-    lower.contains("pasted content") || lower.contains("pasted text")
+    let lit = if lower.contains("pasted content") {
+        "pasted content"
+    } else if lower.contains("pasted text") {
+        "pasted text"
+    } else {
+        return None;
+    };
+    // Distance from the bottom of the tail in non-empty lines.
+    let non_empty: Vec<&str> = text.lines().filter(|line| !line.trim().is_empty()).collect();
+    let mut from_bottom: u32 = 0;
+    for line in non_empty.iter().rev() {
+        if line.to_ascii_lowercase().contains(lit) {
+            return Some((lit, from_bottom));
+        }
+        from_bottom = from_bottom.saturating_add(1);
+    }
+    // Literal appeared only in trimmed-away whitespace lines — treat as
+    // bottom (defensive; rare).
+    Some((lit, 0))
+}
+
+/// E50 PR-1 (0.3.24 P0): scrub a pane capture for safe inclusion in
+/// `events.jsonl`. Steps:
+///   1. Strip CSI / OSC ANSI escapes.
+///   2. Take the bottom `tail_lines` of non-empty lines.
+///   3. Redact common secret shapes (sk-, ghp_, AKIA, Bearer ..., 32+ hex).
+///   4. Cap at ~1200 bytes (UTF-8 safe truncation).
+/// Returns `(excerpt, line_count)`. Designed to be CHEAP — no regex crate
+/// dependency, simple byte scanning.
+pub(crate) fn scrub_pane_excerpt(raw: &str, tail_lines: usize) -> (String, u32) {
+    let stripped = strip_ansi_escapes_inplace(raw);
+    let lines: Vec<&str> = stripped
+        .lines()
+        .filter(|line| !line.trim().is_empty())
+        .collect();
+    let tail = if lines.len() > tail_lines {
+        &lines[lines.len() - tail_lines..]
+    } else {
+        &lines[..]
+    };
+    let mut out = tail
+        .iter()
+        .map(|line| scrub_secrets(line))
+        .collect::<Vec<_>>()
+        .join("\n");
+    if out.len() > 1200 {
+        // Truncate at UTF-8 char boundary.
+        let mut cut = 1200;
+        while cut > 0 && !out.is_char_boundary(cut) {
+            cut -= 1;
+        }
+        out.truncate(cut);
+        out.push_str("…[truncated]");
+    }
+    (out, tail.len() as u32)
+}
+
+fn strip_ansi_escapes_inplace(input: &str) -> String {
+    let mut out = String::with_capacity(input.len());
+    let bytes = input.as_bytes();
+    let mut i = 0;
+    while i < bytes.len() {
+        if bytes[i] == 0x1b && i + 1 < bytes.len() {
+            // CSI: ESC [ ... <final byte 0x40-0x7e>
+            if bytes[i + 1] == b'[' {
+                let mut j = i + 2;
+                while j < bytes.len() && !(0x40..=0x7e).contains(&bytes[j]) {
+                    j += 1;
+                }
+                i = j.saturating_add(1).min(bytes.len());
+                continue;
+            }
+            // OSC: ESC ] ... BEL or ESC \
+            if bytes[i + 1] == b']' {
+                let mut j = i + 2;
+                while j < bytes.len() {
+                    if bytes[j] == 0x07 {
+                        j += 1;
+                        break;
+                    }
+                    if bytes[j] == 0x1b && j + 1 < bytes.len() && bytes[j + 1] == b'\\' {
+                        j += 2;
+                        break;
+                    }
+                    j += 1;
+                }
+                i = j.min(bytes.len());
+                continue;
+            }
+            // Other single-char ESC sequence — skip ESC + next byte.
+            i += 2;
+            continue;
+        }
+        let ch = bytes[i];
+        out.push(ch as char);
+        i += 1;
+    }
+    // Re-decode from bytes to recover UTF-8 (since we pushed bytes as chars,
+    // multi-byte UTF-8 is preserved correctly because we only skip on the
+    // single-byte ESC start). For pane text this is good enough; pathological
+    // UTF-8 inside CSI parameter bytes is invalid anyway.
+    out
+}
+
+fn scrub_secrets(line: &str) -> String {
+    // Five shapes: sk-XXXX, ghp_XXXX, AKIAXXXX (16-char uppercase id), Bearer XXXX,
+    // 32+ hex (token).
+    let mut out = String::with_capacity(line.len());
+    let bytes = line.as_bytes();
+    let mut i = 0;
+    while i < bytes.len() {
+        // sk- / ghp_ / AKIA prefixes: detect and redact through end-of-token.
+        if matches_prefix(bytes, i, b"sk-") || matches_prefix(bytes, i, b"ghp_") {
+            let prefix_len = if bytes[i] == b's' { 3 } else { 4 };
+            let token_end = scan_token_end(bytes, i + prefix_len);
+            out.push_str(&line[i..i + prefix_len]);
+            out.push_str("REDACTED");
+            i = token_end;
+            continue;
+        }
+        if matches_prefix(bytes, i, b"AKIA") {
+            let token_end = scan_token_end(bytes, i + 4);
+            out.push_str("AKIA");
+            out.push_str("REDACTED");
+            i = token_end;
+            continue;
+        }
+        if matches_prefix_case_insensitive(bytes, i, b"Bearer ") {
+            let token_end = scan_token_end(bytes, i + 7);
+            out.push_str(&line[i..i + 7]);
+            out.push_str("REDACTED");
+            i = token_end;
+            continue;
+        }
+        // 32+ hex run.
+        if is_hex_byte(bytes[i]) {
+            let mut j = i;
+            while j < bytes.len() && is_hex_byte(bytes[j]) {
+                j += 1;
+            }
+            if j - i >= 32 {
+                out.push_str("REDACTED_HEX");
+                i = j;
+                continue;
+            }
+        }
+        // Default: passthrough byte.
+        out.push(bytes[i] as char);
+        i += 1;
+    }
+    out
+}
+
+fn matches_prefix(bytes: &[u8], i: usize, prefix: &[u8]) -> bool {
+    bytes.get(i..i + prefix.len()).is_some_and(|s| s == prefix)
+}
+
+fn matches_prefix_case_insensitive(bytes: &[u8], i: usize, prefix: &[u8]) -> bool {
+    bytes
+        .get(i..i + prefix.len())
+        .is_some_and(|s| s.eq_ignore_ascii_case(prefix))
+}
+
+fn scan_token_end(bytes: &[u8], start: usize) -> usize {
+    let mut j = start;
+    while j < bytes.len() && is_token_byte(bytes[j]) {
+        j += 1;
+    }
+    j
+}
+
+fn is_token_byte(b: u8) -> bool {
+    b.is_ascii_alphanumeric() || b == b'-' || b == b'_'
+}
+
+fn is_hex_byte(b: u8) -> bool {
+    b.is_ascii_hexdigit()
 }
 
 const PASTED_CONTENT_APPEAR_POLLS: u32 = 5;
@@ -1118,6 +1318,10 @@ impl Transport for TmuxBackend {
                         self.run_inject_stage(&argv, stage)?;
                     }
                 }
+                // E50 PR-1 (0.3.24 P0): record appear-gate timing + per-attempt
+                // observations. Pure diagnostic — no behavioural change. The
+                // existing matcher / windows / actions are byte-identical.
+                let appear_gate_start = std::time::Instant::now();
                 let mut saw_pasted_prompt = false;
                 for _ in 0..PASTED_CONTENT_APPEAR_POLLS {
                     let captured = self.capture(target, CaptureRange::Tail(80))?;
@@ -1127,8 +1331,25 @@ impl Transport for TmuxBackend {
                     }
                     std::thread::sleep(Duration::from_millis(25));
                 }
+                let appear_gate_elapsed_ms = appear_gate_start.elapsed().as_millis() as u64;
                 let submit_argv = tmux_send_keys_argv(&pane, &[submit]);
-                if saw_pasted_prompt {
+                // E50 PR-2 Fix-B (0.3.26 P0): when the payload carries a token
+                // marker (ALL delivery messages do via render_message), SKIP the
+                // legacy pasted-prompt weak loop even if `saw_pasted_prompt` is
+                // true. Fall through to the E46 token-based consumption gate
+                // (Escape pre-Enter + post_submit_input_consumed + resend cap
+                // with C3 re-check), which has NONE of the two defects:
+                //   A. E46 gate uses 60ms sleep + 3 retries (not zero-sleep).
+                //   B. E46 gate anchors on the token marker in the bottom 5
+                //      lines (composer region), not a substring match on
+                //      Tail(80) that catches scrollback residue.
+                //
+                // Non-token payloads (rare: test harness / trust prompt Empty)
+                // still use the legacy loop for backward compatibility with
+                // provider_submit_verification_red.rs::PastePromptRunner tests.
+                let has_token = payload_token_marker(payload).is_some();
+                if saw_pasted_prompt && !has_token {
+                    // Legacy weak loop preserved for non-token payloads (test harness).
                     let mut attempts = 0;
                     let mut cleared = false;
                     for _ in 0..PASTED_CONTENT_SUBMIT_ATTEMPTS {
@@ -1151,6 +1372,7 @@ impl Transport for TmuxBackend {
                         },
                         turn_verification: TurnVerification::NotYetObserved,
                         attempts,
+                        submit_diagnostics: None,
                     });
                 }
                 // U1 #7 (efd189b redo, canonical-native): around the final submit, read
@@ -1237,6 +1459,11 @@ impl Transport for TmuxBackend {
                     // false-positive (silent paste drop).
                     None => submit_verification_for_key(submit),
                 };
+                // E50 PR-1: surface appear-gate timing on the E46 token path too.
+                // saw_pasted_prompt=false here; the placeholder never appeared
+                // within PASTED_CONTENT_APPEAR_POLLS, so the route is E46. The
+                // gate elapsed_ms still helps operators see how long we waited
+                // (e.g. codex slow-render).
                 return Ok(InjectReport {
                     stage_reached: InjectStage::Submit,
                     inject_verification: inject_verification_after_readback(
@@ -1249,6 +1476,12 @@ impl Transport for TmuxBackend {
                         InjectPayload::Text(_) => TurnVerification::NotYetObserved,
                     },
                     attempts: consumption_attempts,
+                    submit_diagnostics: Some(crate::transport::SubmitDiagnostics {
+                        appear_gate_elapsed_ms,
+                        appear_gate_matched: false,
+                        total_elapsed_ms: appear_gate_elapsed_ms,
+                        attempts_detail: Vec::new(),
+                    }),
                 });
             }
         }
@@ -1264,6 +1497,9 @@ impl Transport for TmuxBackend {
                 InjectPayload::Text(_) => TurnVerification::NotYetObserved,
             },
             attempts: 1,
+            // E50 PR-1: Empty payload / non-Text fallthrough path — no submit
+            // diagnostics applicable.
+            submit_diagnostics: None,
         })
     }
 

package/crates/team-agent/src/transport/test_support.rs

@@ -277,6 +277,7 @@ impl OfflineTransport {
             submit_verification: SubmitVerification::EnterSentWithoutPlaceholderCheck,
             turn_verification: TurnVerification::NotYetObserved,
             attempts: 1,
+            submit_diagnostics: None,
         }
     }
 }

package/crates/team-agent/src/transport/tests/mod.rs

@@ -74,6 +74,7 @@
                 submit_verification,
                 turn_verification,
                 attempts: 1,
+                submit_diagnostics: None,
             })
         }
         fn send_keys(&self, _target: &Target, _keys: &[Key]) -> Result<(), TransportError> {

package/crates/team-agent/src/transport/tests/wire.rs

@@ -271,7 +271,8 @@
                 "sh",
                 false,
             ),
-            vec!["tmux", "new-window", "-t", "team-sess", "-n", "worker-2", "sh", "-lc", "sh"]
+            // E53 (0.3.26): new-window now carries `-d` (detached, no focus steal).
+            vec!["tmux", "new-window", "-d", "-t", "team-sess", "-n", "worker-2", "sh", "-lc", "sh"]
         );
     }