@team-agent/installer 0.3.25 → 0.3.27

package/crates/team-agent/src/messaging/delivery.rs

@@ -348,6 +348,7 @@ pub fn deliver_pending_message(
                         attempt,
                         "send_inject_exhausted",
                         &reason,
+                        None,
                     )?;
                     return Ok(DeliveryOutcome {
                         ok: false,
@@ -387,6 +388,13 @@ pub fn deliver_pending_message(
                 submit_verification_wire(inject_report.submit_verification)
             )
         };
+        // E50 PR-1 (0.3.24 P0): render forensic submit_diagnostics into the
+        // event so operators see per-attempt pane state without grepping. The
+        // legacy keys (`message_id` / `recipient` / `reason` / `attempts`)
+        // are preserved byte-for-byte for grep compatibility; new keys are
+        // ADDITIONAL.
+        let submit_attempts_detail =
+            render_submit_diagnostics(&inject_report);
         event_log.write(
             "send.unverified",
             serde_json::json!({
@@ -394,6 +402,7 @@ pub fn deliver_pending_message(
                 "recipient": message.recipient,
                 "reason": reason,
                 "attempts": inject_report.attempts,
+                "submit_attempts_detail": submit_attempts_detail,
             }),
         )?;
         if inject_report.attempts >= u32::from(SEND_RETRY_MAX_ATTEMPTS) {
@@ -407,6 +416,7 @@ pub fn deliver_pending_message(
                 inject_report.attempts,
                 "send_unverified_exhausted",
                 &reason,
+                Some(&inject_report),
             )?;
             return Ok(DeliveryOutcome {
                 ok: false,
@@ -463,7 +473,8 @@ pub fn deliver_pending_message(
     Ok(outcome)
 }
 
-fn inject_submit_verified(report: &InjectReport) -> bool {
+/// 0.3.27: promoted to pub(crate) for leader_receiver.rs verification gate.
+pub(crate) fn inject_submit_verified(report: &InjectReport) -> bool {
     match report.submit_verification {
         SubmitVerification::SendKeysFailed => false,
         SubmitVerification::PastedContentPromptStillPresentAfterSubmit => false,
@@ -492,7 +503,8 @@ fn inject_submit_verified(report: &InjectReport) -> bool {
 /// `CaptureMissingToken` → readback failed → not delivered (degraded/unverified). All
 /// other inject_verification variants (incl. token-less payloads, empty sends, new
 /// pasted-content prompt) are not readback-negative and pass this gate.
-fn pane_readback_verified(report: &InjectReport) -> bool {
+/// 0.3.27: promoted to pub(crate) for leader_receiver.rs verification gate.
+pub(crate) fn pane_readback_verified(report: &InjectReport) -> bool {
     !matches!(
         report.inject_verification,
         InjectVerification::CaptureMissingToken
@@ -504,7 +516,8 @@ fn pane_readback_verified(report: &InjectReport) -> bool {
 /// [team-agent-token:{message_id}]`. The worker (fake or real provider) only builds a result_envelope
 /// when it sees this block + extracts the token — the bare content gives WORKING but never a report
 /// (rt-host-a loop #4). token == message_id (exactly-once correlation).
-fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id: &str) -> String {
+/// F1 (0.3.26): promoted to `pub` for direct pane send in cli/send.rs.
+pub fn render_message(sender: &str, task_id: Option<&str>, content: &str, message_id: &str) -> String {
     let mut header = format!("Team Agent message from {sender}");
     if let Some(task_id) = task_id.filter(|t| !t.is_empty()) {
         header.push_str(&format!(" for {task_id}"));
@@ -557,7 +570,23 @@ fn resolve_inject_target(
         .and_then(serde_json::Value::as_str)
         .filter(|s| !s.is_empty())
         .map(PaneId::new);
+    // E51 (0.3.26 P0, delivery loop guard): if the worker's cached pane_id is
+    // the SAME as leader_receiver.pane_id (the leader's handle), injecting into
+    // it would deliver the worker's message back to the leader pane — a routing
+    // loop that the macmini "hand-handle mapping 灾難" truth source exposed. Fail
+    // loud with a SessionWindow target that will surface as a structured error
+    // (the SessionWindow "leader" target trips the existing leader_not_attached
+    // guard on any subsequent delivery attempt for this message). The root fix
+    // is in lease.rs (E51 guard #1) which prevents the conflation; this is the
+    // defence-in-depth in the delivery layer.
     if let Some(pane) = cached_pane.as_ref() {
+        let leader_pane = leader_receiver_pane_id(state);
+        if leader_pane.is_some_and(|lp| lp == pane.as_str()) {
+            return Target::SessionWindow {
+                session: SessionName::new(session),
+                window: WindowName::new(format!("{recipient}_pane_conflicts_with_leader")),
+            };
+        }
         if live_targets
             .iter()
             .any(|target| target.pane_id.as_str() == pane.as_str())
@@ -755,6 +784,34 @@ fn leader_receiver_field_in_state<'a>(
         .filter(|value| !value.is_empty())
 }
 
+/// E50 PR-1 (0.3.24 P0): render `InjectReport.submit_diagnostics` as a JSON
+/// array suitable for inclusion in `send.unverified` / `send.failed` events.
+/// `null` if no diagnostics were attached (e.g. the inject went through a
+/// path that bypassed the paste-prompt + Enter instrumentation, or this is
+/// the pre-PR-2 inject-failed path with no `InjectReport`).
+fn render_submit_diagnostics(report: &InjectReport) -> serde_json::Value {
+    let Some(diag) = report.submit_diagnostics.as_ref() else {
+        return serde_json::Value::Null;
+    };
+    serde_json::Value::Array(
+        diag.attempts_detail
+            .iter()
+            .map(|obs| {
+                serde_json::json!({
+                    "attempt_index": obs.attempt_index,
+                    "matched": obs.matched,
+                    "matched_literal": obs.matched_literal,
+                    "where_in_tail": obs.where_in_tail,
+                    "pane_tail_excerpt": obs.pane_tail_excerpt,
+                    "pane_tail_lines": obs.pane_tail_lines,
+                    "elapsed_ms": obs.elapsed_ms,
+                })
+            })
+            .collect(),
+    )
+}
+
+#[allow(clippy::too_many_arguments)]
 fn emit_send_failed_exhausted(
     workspace: &Path,
     state: &serde_json::Value,
@@ -764,7 +821,26 @@ fn emit_send_failed_exhausted(
     attempts: u32,
     failure_reason: &str,
     verification: &str,
+    inject_report: Option<&InjectReport>,
 ) -> Result<(), MessagingError> {
+    // E50 PR-1 (0.3.24 P0): forensic fields on send.failed. Legacy keys
+    // (`message_id` / `recipient` / `attempts` / `max_attempts` / `reason` /
+    // `verification`) preserved byte-for-byte for grep compatibility.
+    let submit_attempts_detail = inject_report
+        .map(render_submit_diagnostics)
+        .unwrap_or_else(|| serde_json::Value::Array(Vec::new()));
+    let total_elapsed_ms = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .map(|d| d.total_elapsed_ms)
+        .unwrap_or(0);
+    let last_matched_literal = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .and_then(|d| d.attempts_detail.last())
+        .and_then(|a| a.matched_literal.clone());
+    let last_pane_tail_excerpt = inject_report
+        .and_then(|r| r.submit_diagnostics.as_ref())
+        .and_then(|d| d.attempts_detail.last())
+        .map(|a| a.pane_tail_excerpt.clone());
     event_log.write(
         "send.failed",
         serde_json::json!({
@@ -774,6 +850,10 @@ fn emit_send_failed_exhausted(
             "max_attempts": SEND_RETRY_MAX_ATTEMPTS,
             "reason": failure_reason,
             "verification": verification,
+            "submit_attempts_detail": submit_attempts_detail,
+            "total_elapsed_ms": total_elapsed_ms,
+            "last_matched_literal": last_matched_literal,
+            "last_pane_tail_excerpt": last_pane_tail_excerpt,
         }),
     )?;
     let content = format!(

package/crates/team-agent/src/messaging/leader_receiver.rs

@@ -11,7 +11,7 @@ use crate::model::ids::{OwnerEpoch, TaskId};
 use crate::transport::{InjectPayload, Key, PaneId, Target, Transport};
 
 use super::helpers::MessageStatusShadow;
-use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStatus, MessagingError};
+use super::{DeliveryOutcome, DeliveryRefusal, DeliveryStage, DeliveryStatus, MessagingError};
 
 /// `_send_to_leader_receiver` (`leader.py:69`) — **N31/N32 funnel primitive**:所有 leader-bound
 /// caller(send_message(to=leader) / report_result / request_human / idle reminder /
@@ -393,29 +393,66 @@ pub fn deliver_to_leader_fallback_pane(
 
     match inject_result {
         Ok(report) => {
-            store.mark(message_id, "delivered", None)?;
-            event_log.write(
-                "leader_receiver.fallback_pane_submitted",
-                serde_json::json!({
-                    "message_id": message_id,
-                    "result_id": result_id,
-                    "owner_team_id": owner_team_id,
-                    "pane_id": pane_id,
-                    "primary_error": primary_error,
-                    "delivered_via": "fallback_pane",
-                    "verification": format!("{:?}", report.submit_verification),
-                }),
-            )?;
-            Ok(DeliveryOutcome {
-                ok: true,
-                status: DeliveryStatus::Delivered,
-                message_status: MessageStatusShadow("delivered".to_string()),
-                message_id: Some(message_id.to_string()),
-                verification: Some("delivered_via=fallback_pane".to_string()),
-                stage: None,
-                reason: None,
-                channel: Some("fallback_pane".to_string()),
-            })
+            // 0.3.27 P0: leader_receiver verification gate. The pre-fix path
+            // marked every inject Ok as delivered regardless of whether the
+            // submit was actually verified. Apply the same two-gate check that
+            // deliver_pending_message uses (delivery.rs:376-381):
+            //   (a) inject_submit_verified — Enter was accepted by the TUI
+            //   (b) pane_readback_verified — token was visible in the pane
+            // Both must pass to mark delivered; otherwise degrade to
+            // submitted_unverified (loud, not silent).
+            let submit_ok = super::delivery::inject_submit_verified(&report);
+            let readback_ok = super::delivery::pane_readback_verified(&report);
+            if submit_ok && readback_ok {
+                store.mark(message_id, "delivered", None)?;
+                event_log.write(
+                    "leader_receiver.fallback_pane_submitted",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "result_id": result_id,
+                        "owner_team_id": owner_team_id,
+                        "pane_id": pane_id,
+                        "primary_error": primary_error,
+                        "delivered_via": "fallback_pane",
+                        "verification": format!("{:?}", report.submit_verification),
+                    }),
+                )?;
+                Ok(DeliveryOutcome {
+                    ok: true,
+                    status: DeliveryStatus::Delivered,
+                    message_status: MessageStatusShadow("delivered".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some("delivered_via=fallback_pane".to_string()),
+                    stage: None,
+                    reason: None,
+                    channel: Some("fallback_pane".to_string()),
+                })
+            } else {
+                let reason = format!(
+                    "fallback_pane_unverified:submit={submit_ok},readback={readback_ok},sv={:?}",
+                    report.submit_verification
+                );
+                store.mark(message_id, "submitted_unverified", Some(&reason))?;
+                event_log.write(
+                    "leader_receiver.fallback_pane_unverified",
+                    serde_json::json!({
+                        "message_id": message_id,
+                        "pane_id": pane_id,
+                        "reason": reason,
+                        "primary_error": primary_error,
+                    }),
+                )?;
+                Ok(DeliveryOutcome {
+                    ok: false,
+                    status: DeliveryStatus::Failed,
+                    message_status: MessageStatusShadow("submitted_unverified".to_string()),
+                    message_id: Some(message_id.to_string()),
+                    verification: Some(reason),
+                    stage: Some(DeliveryStage::Submit),
+                    reason: None,
+                    channel: Some("fallback_pane".to_string()),
+                })
+            }
         }
         Err(error) => {
             event_log.write(

package/crates/team-agent/src/messaging/tests/runtime.rs

@@ -1308,6 +1308,7 @@ impl Transport for UnverifiedInjectTransport {
                 crate::transport::SubmitVerification::PastedContentPromptStillPresentAfterSubmit,
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: u32::from(SEND_RETRY_MAX_ATTEMPTS),
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _t: &Target, _k: &[Key]) -> Result<(), TransportError> {
@@ -1467,6 +1468,7 @@ impl Transport for ReadbackMissingTransport {
             },
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: 1,
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _: &Target, _: &[Key]) -> Result<(), TransportError> {

package/crates/team-agent/src/messaging/tests/spine.rs

@@ -173,6 +173,7 @@ impl Transport for DeliverOkTransport {
             submit_verification: crate::transport::SubmitVerification::EnterSentWithoutPlaceholderCheck,
             turn_verification: crate::transport::TurnVerification::NotYetObserved,
             attempts: 1,
+            submit_diagnostics: None,
         })
     }
     fn send_keys(&self, _t: &Target, _k: &[Key]) -> Result<(), TransportError> {

package/crates/team-agent/src/tmux_backend/tests.rs

@@ -369,9 +369,10 @@
             .expect("spawn_split");
         assert_eq!(result.pane_id.as_str(), "%5");
         let calls = rec.lock().unwrap().clone();
+        // E53 (0.3.26): split-window now carries `-d` (no focus steal).
         assert_eq!(
-            calls[0][0..4],
-            svec(&["tmux", "split-window", "-t", "teamsess:team-w1"])
+            calls[0][0..5],
+            svec(&["tmux", "split-window", "-d", "-t", "teamsess:team-w1"])
         );
         assert_eq!(
             calls[1],
@@ -594,11 +595,15 @@ CaptureMissingToken, not the static CaptureContainsToken false-positive"
     /// report `SubmitConsumptionUnverified`, NOT
     /// `EnterSentWithoutPlaceholderCheck`. Otherwise delivery emits delivered
     /// + message.delivered (假阳) even though the worker never consumed it.
+    /// 0.3.27 amendment: when token IS visible in the pane (Phase 1 confirmed)
+    /// but NOT consumed from bottom 5 after all retries, the grace fallback
+    /// treats "paste landed but composer didn't clear" as
+    /// EnterSentWithoutPlaceholderCheck. This handles bare-shell panes (MCP sim)
+    /// and busy-agent TUIs (E55) that keep the token visible after submit.
+    /// SubmitConsumptionUnverified is reserved for the case where the token was
+    /// NEVER visible (paste truly failed / dropped).
     #[test]
-    fn e46_inject_text_with_token_unconsumed_in_tail_reports_submit_consumption_unverified() {
-        // Mock always returns the token in the captured tail — simulates the
-        // macmini fresh claude TUI where the paste lands but the input never
-        // clears (Enter swallowed by bracketed-paste).
+    fn e46_inject_text_with_token_visible_but_unconsumed_uses_grace_fallback() {
         let token_text = "Team Agent message from leader:\n\nhi\n\n[team-agent-token:msg_red1]";
         let (be, _rec) = backend_with(MockResp::Out(ok(token_text)), vec![]);
         let report = be
@@ -609,19 +614,50 @@ CaptureMissingToken, not the static CaptureContainsToken false-positive"
                 true,
             )
             .expect("inject runs");
+        // 0.3.27 grace fallback: token visible + not consumed from bottom →
+        // EnterSentWithoutPlaceholderCheck (paste landed, consumption unclear).
         assert_eq!(
             report.submit_verification,
-            SubmitVerification::SubmitConsumptionUnverified,
-            "E46 RED-1: when token remains in the pane input region after \
-             Enter + resend cap, transport must report SubmitConsumptionUnverified \
-             (not EnterSentWithoutPlaceholderCheck which delivery treats as \
-             delivered). Got {:?}",
+            SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            "0.3.27: when token is visible but not consumed from bottom 5 \
+             after all retries, grace fallback degrades to \
+             EnterSentWithoutPlaceholderCheck (paste landed, bare-shell/busy \
+             pane parity). Got {:?}",
             report.submit_verification
         );
-        // turn_verification stays NotYetObserved (Gap42: metadata only).
         assert_eq!(report.turn_verification, TurnVerification::NotYetObserved);
     }
 
+    /// 0.3.27: empty pane captures → consumption poll sees "no token in
+    /// bottom 5" → consumed=true → EnterSentWithoutPlaceholderCheck. This is
+    /// the generous default for panes where the capture can't distinguish
+    /// "token consumed" from "token never landed" (empty mock, MCP sim).
+    /// SubmitConsumptionUnverified only fires when the grace fallback
+    /// explicitly rejects (token_visible_for_report=false AND consumed=false
+    /// at the same time — a state that requires the token to be in the pane
+    /// during consumption poll but absent during Phase 1, which is a
+    /// contradictory mock state that doesn't arise in production).
+    #[test]
+    fn e46_inject_text_with_empty_pane_defaults_to_consumed() {
+        let token_text = "Team Agent message from leader:\n\nhi\n\n[team-agent-token:msg_empty]";
+        let (be, _rec) = backend_with(MockResp::Out(ok("")), vec![]);
+        let report = be
+            .inject(
+                &Target::Pane(PaneId::new("%7")),
+                &InjectPayload::Text(token_text.to_string()),
+                Key::Enter,
+                true,
+            )
+            .expect("inject runs");
+        assert_eq!(
+            report.submit_verification,
+            SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            "0.3.27: empty pane → consumption poll sees no token in bottom → \
+             consumed=true → EnterSentWithoutPlaceholderCheck. Got {:?}",
+            report.submit_verification
+        );
+    }
+
     /// **E46 RED-2 (正向消费确认 → delivered)**: token-bearing Text + Enter +
     /// bracketed paste. Token VISIBLE on first capture (pre/post-submit token
     /// readback) BUT then GONE from the post-submit input-consumption probe
@@ -762,8 +798,13 @@ CaptureMissingToken, not the static CaptureContainsToken false-positive"
     /// mode on stuck composer). Non-Enter submits (e.g. Key::Down for codex
     /// menu) must NOT receive the Escape pre-step.
     #[test]
-    fn e46_inject_text_enter_emits_escape_before_enter_on_bracketed_paste() {
+    /// 0.3.27 amendment: Escape is now RETRY-ONLY (attempt > 0). The first
+    /// attempt sends Enter directly (Python parity — Python never sends Escape).
+    /// Escape fires only if the first Enter failed to consume the token and a
+    /// retry is needed. This test now asserts the first attempt has NO Escape.
+    fn e46_inject_text_first_attempt_no_escape_retry_only() {
         let token_text = "Team Agent message from leader:\n\nhi\n\n[team-agent-token:msg_esc]";
+        // Mock returns empty — token not in tail → consumed=true on first attempt.
         let (be, rec) = backend_with(MockResp::Out(ok("")), vec![]);
         let _report = be
             .inject(
@@ -774,21 +815,22 @@ CaptureMissingToken, not the static CaptureContainsToken false-positive"
             )
             .expect("inject runs");
         let calls = rec.lock().unwrap().clone();
-        let escape_idx = calls.iter().position(|argv| {
-            argv.get(1).map(String::as_str) == Some("send-keys")
-                && argv.contains(&"Escape".to_string())
-        });
-        let enter_idx = calls.iter().position(|argv| {
+        let enter_count = calls.iter().filter(|argv| {
             argv.get(1).map(String::as_str) == Some("send-keys")
                 && argv.contains(&"Enter".to_string())
-        });
-        let escape_idx = escape_idx.expect("E46: bracketed text + Enter must send Escape pre-step");
-        let enter_idx = enter_idx.expect("E46: must still send the final Enter");
+        }).count();
+        let escape_count = calls.iter().filter(|argv| {
+            argv.get(1).map(String::as_str) == Some("send-keys")
+                && argv.contains(&"Escape".to_string())
+        }).count();
         assert!(
-            escape_idx < enter_idx,
-            "E46: Escape must be sent BEFORE Enter (closes bracketed-paste \
-             so Enter is interpreted as submit). escape_idx={escape_idx} \
-             enter_idx={enter_idx} calls={calls:?}"
+            enter_count >= 1,
+            "0.3.27: first attempt must send Enter; calls={calls:?}"
+        );
+        assert_eq!(
+            escape_count, 0,
+            "0.3.27: first attempt (consumed=true) must NOT send Escape \
+             (Escape is retry-only); calls={calls:?}"
         );
     }
 
@@ -823,6 +865,166 @@ CaptureMissingToken, not the static CaptureContainsToken false-positive"
         );
     }
 
+    // ═════════════════════════════════════════════════════════════════════════
+    // E50 PR-1 (0.3.24 P0, pasted-prompt 假阴诊断) — InjectReport.submit_diagnostics
+    // is populated for paste-prompt loops, and `pasted_prompt_match` / scrubbing
+    // helpers are pure functions safe to test deterministically.
+    //
+    // Architect verdict (Workflow forensic): the pre-fix
+    // `capture_has_pasted_content_prompt` matched ANY `pasted content` /
+    // `pasted text` token in the full Tail(80), including scrolled-off
+    // submitted blocks. PR-1 just adds the diagnostics; PR-2 will USE
+    // `where_in_tail` to fix the criterion. These tests pin the data shape.
+    // ═════════════════════════════════════════════════════════════════════════
+
+    /// **E50 RED-1 (判据误判, pure function)**: `pasted_prompt_match` must
+    /// distinguish bottom-region (composer) from scrollback (line 6+ from
+    /// bottom). Pre-fix `capture_has_pasted_content_prompt` returned `true`
+    /// for BOTH; the new tuple-returning helper surfaces the offset so PR-2
+    /// can fix the criterion.
+    #[test]
+    fn e50_pasted_prompt_match_reports_where_in_tail_for_scrollback_vs_composer() {
+        use super::pasted_prompt_match;
+
+        // Composer (bottom) match.
+        let composer_only = "some output\n\
+                             [Pasted content 1.2k]\n\
+                             ❯ ";
+        // The match is "pasted content" in the line at index 1 from bottom
+        // among non-empty lines (`[Pasted content...]`, `❯ ` is at idx 0).
+        let m = pasted_prompt_match(composer_only).expect("match");
+        assert_eq!(m.0, "pasted content");
+        assert_eq!(
+            m.1, 1,
+            "E50: where_in_tail must reflect bottom offset (idx 1 = above the \
+             `❯` composer line); got {m:?}"
+        );
+
+        // Scrollback (top) match — 8 lines from bottom.
+        let scrollback_only = "[Pasted content 5.0k]\n\
+                               assistant reply line 1\n\
+                               assistant reply line 2\n\
+                               assistant reply line 3\n\
+                               assistant reply line 4\n\
+                               assistant reply line 5\n\
+                               assistant reply line 6\n\
+                               assistant reply line 7\n\
+                               ❯ ";
+        let m2 = pasted_prompt_match(scrollback_only).expect("match");
+        assert_eq!(m2.0, "pasted content");
+        assert!(
+            m2.1 >= 6,
+            "E50: scrollback `Pasted content` must report where_in_tail >= 6 \
+             (clearly above the bottom composer region); got {m2:?}. PR-2 \
+             will use this offset to distinguish live composer vs scrollback \
+             residue."
+        );
+
+        // No match.
+        assert!(pasted_prompt_match("nothing here\n❯ ").is_none());
+    }
+
+    /// **E50 PR-2 Fix-B (amends PR-1 RED-2)**: with Fix-B, token-bearing
+    /// payloads SKIP the paste-prompt weak loop and fall through to the E46
+    /// token consumption gate. The `submit_diagnostics` still records the
+    /// appear-gate timing (was `saw_pasted_prompt` matched?), but
+    /// `attempts_detail` is populated by the E46 consumption gate path, not
+    /// the deleted weak loop. This test pins the NEW shape: `appear_gate_matched`
+    /// may be false (mock default returns the pasted-content text, but the
+    /// appear-gate polls 5 times with 25ms sleep and the mock answers the SAME
+    /// text every time → appear-gate DOES match). However, the `has_token` guard
+    /// skips the weak loop body → the token path's diagnostics fill in instead.
+    #[test]
+    fn e50_inject_paste_prompt_path_populates_submit_diagnostics_per_attempt() {
+        let token_text =
+            "Team Agent message from leader:\n\nhello\n\n[team-agent-token:msg_pr1]";
+        // Mock keeps returning the pasted-content placeholder. With Fix-B,
+        // the token path takes over: post_submit_input_consumed checks
+        // bottom 5 lines for the token marker. The mock returns the pasted
+        // placeholder text (without the token) → token NOT in tail → consumed
+        // = Some(true) → EnterSentWithoutPlaceholderCheck.
+        // We test: (a) diagnostics present (b) submit verification reflects
+        // the E46 token path, not the deleted weak loop.
+        let pasted = "[Pasted content 1.2k]";
+        let (be, _rec) = backend_with(MockResp::Out(ok(pasted)), vec![]);
+        let report = be
+            .inject(
+                &Target::Pane(PaneId::new("%7")),
+                &InjectPayload::Text(token_text.to_string()),
+                Key::Enter,
+                true,
+            )
+            .expect("inject");
+        // Fix-B: token payload → E46 token path. The submit verification is
+        // either EnterSentWithoutPlaceholderCheck (consumed) or
+        // SubmitConsumptionUnverified (not consumed). With the mock returning
+        // pasted-content text (no token in tail), consumed = true.
+        assert_eq!(
+            report.submit_verification,
+            SubmitVerification::EnterSentWithoutPlaceholderCheck,
+            "E50 PR-2 Fix-B: token payload that went through the E46 gate \
+             and was consumed (token not in bottom 5 lines) must report \
+             EnterSentWithoutPlaceholderCheck; got {:?}",
+            report.submit_verification
+        );
+    }
+
+    /// **E50 PR-1 secret scrubbing**: `scrub_pane_excerpt` must strip ANSI
+    /// + redact common secret shapes so emitted events.jsonl doesn't leak.
+    #[test]
+    fn e50_scrub_pane_excerpt_strips_ansi_and_redacts_secret_shapes() {
+        use super::scrub_pane_excerpt;
+        let raw = "\x1b[31merror\x1b[0m: sk-abcdef123ghi\n\
+                   token Bearer abc.def.ghi\n\
+                   key AKIAIOSFODNN7EXAMPLE\n\
+                   ghp_1234567890abcdef\n\
+                   hex deadbeefdeadbeefdeadbeefdeadbeefcafebabe\n\
+                   plain text below";
+        let (out, lines) = scrub_pane_excerpt(raw, 20);
+        assert!(lines >= 5, "E50: at least 5 non-empty lines; got {lines}");
+        assert!(!out.contains("\x1b"), "E50: ANSI escape stripped; got {out:?}");
+        assert!(
+            !out.contains("sk-abcdef123ghi"),
+            "E50: sk- secret must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("ghp_1234567890abcdef"),
+            "E50: ghp_ secret must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("AKIAIOSFODNN7EXAMPLE"),
+            "E50: AKIA secret must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("abc.def.ghi"),
+            "E50: Bearer secret token must be redacted; got {out:?}"
+        );
+        assert!(
+            !out.contains("deadbeefdeadbeefdeadbeefdeadbeefcafebabe"),
+            "E50: 32+ hex run must be redacted; got {out:?}"
+        );
+        assert!(
+            out.contains("REDACTED"),
+            "E50: redactions visible; got {out:?}"
+        );
+        assert!(
+            out.contains("plain text below"),
+            "E50: non-secret content preserved; got {out:?}"
+        );
+    }
+
+    /// **E50 PR-1 byte-identical legacy matcher**: `capture_has_pasted_content_prompt`
+    /// wrapper must still return the same bool the 3 legacy callers depend on
+    /// (the bool-returning fn shape is the contract for byte-locked behaviour).
+    #[test]
+    fn e50_capture_has_pasted_content_prompt_byte_identical_wrapper() {
+        use super::capture_has_pasted_content_prompt;
+        assert!(capture_has_pasted_content_prompt("[Pasted content 1k]"));
+        assert!(capture_has_pasted_content_prompt("[Pasted text foo]"));
+        assert!(!capture_has_pasted_content_prompt("just composer text"));
+        assert!(!capture_has_pasted_content_prompt(""));
+    }
+
     #[test]
     fn send_keys_cancel_mode_queries_mode_and_dispatches_cancel_argv() {
         let (be, rec) = backend_with(