@with-logic/elwood 0.1.3 → 0.2.1

package/docs/cli-behavior.md

@@ -20,8 +20,34 @@ When a fact drives an implementation decision, the code and the matching PRD
 conformance criterion are cited. If you change behavior here, update `prd/`
 first (see `CLAUDE.md` / `AGENTS.md`), then this file.
 
+## Approval policy compatibility
+
+Codex 0.155.1 rejects `--ask-for-approval untrusted`; its accepted values are
+`on-request` and `never`. Real approval-flow tests on this version use `on-request`
+with a read-only sandbox and a tool that needs to write, then approve the native
+escalation dialog. An `untrusted` fixture exits before readiness and cannot test
+working-dialog clearance. Verified from the installed CLI's argument error on
+2026-09-19 while exercising C-ATTN-02.
+
 ## Readiness
 
+**Codex 0.159.2 adds a warning counter to its shortcuts footer.** A bounded
+invalid-model cold-start probe on 2026-10-01 captured `? for shortcuts` followed
+on the same row by `⚠ 3 warnings · f2 to view`, below the model footer and empty
+`› Ask Codex to do anything` composer. Its animated welcome said “Follow the
+white cursor.” The existing footer grammar rejects this captured row. The trace separately
+showed a retained trust episode and a held 10-second readiness deadline; it did
+not capture each observed frame, so it cannot attribute the original gate or
+prove that this final snapshot was the frame at that deadline. No submission Enter or UserPromptSubmit occurred,
+so the probe establishes startup layout/readiness evidence, not hook/transcript
+ordering. Clearance accepts the bounded native warning-count suffix while still
+requiring current settled frame, visible input cursor, native model chrome, and
+absence of active dialogs or work. A follow-up probe with this grammar recorded
+folder trust followed by the warning-bearing composer: the trust hold cleared,
+and both cold and resumed sessions reached ready and delivered exactly one
+invalid-model submission with one `UserPromptSubmit` each. No valid model was
+used. C-API-28, C-TRUST-01.
+
 **Codex fires its `SessionStart` hook lazily — on the first turn, not at boot.**
 Any experiment that waits for a boot-time Codex hook *without running a turn* is
 invalid and will conclude the hook "never fires". (This once produced a false
@@ -106,6 +132,17 @@ misattributed to a CLI regression.)
 
 ## Turn boundaries (rendered TUI)
 
+- **Claude 2.1.281 can use `◐ Claude Code` as its OSC working title.** A native
+  173×35 capture on 2026-09-23 showed `✻ Wandering… (0s)` above a fenced empty
+  composer, with a visible cursor at column 2, row 15 (zero-based), and no
+  `esc to interrupt` footer. The preceding frame showed a running
+  `UserPromptSubmit` hook with the same title. The session later reached a usage
+  limit; this capture proves working-title geometry, not a successful answer.
+  `tests/fixtures/claude-2.1.281/working.txt` retains the nonempty captured rows
+  with the temporary directory normalized. The title matcher accepts the
+  observed `◐ ` prefix alongside the existing braille range; both screen facts
+  and live trust clearance share it. No other new spinner glyph is inferred.
+  C-TURN-05, C-TRUST-01.
 - Both CLIs render the literal `esc to interrupt` only while a turn is running
   (Claude footer, Codex "Working" spinner). Elwood's `TurnStateWatcher` keys off
   this, and **arms only after initial readiness** because the Codex MCP boot
@@ -132,11 +169,95 @@ array of `{ type: "output_text", text }` entries. Only the assistant record with
 progress narration, and user/developer message records are inputs. Current
 sessions emit no legacy `agent_message` duplicate, so treating `content` as a
 plain string silently drops the reply text. The transcript adapter therefore
-extracts `output_text` only from assistant `final_answer` records while retaining
-legacy string/`agent_message` support. C-CODEX-16.
+extracts assistant `final_answer` records as `assistant_message` and
+`commentary` records as `assistant_progress`, while retaining legacy
+string/final `agent_message` support. Explicit non-final legacy mirrors keep
+only their raw observation. C-CODEX-16, C-CODEX-22.
 
 ## Model selection persistence
 
+- **A configured legacy Codex model may be absent from `/model`.** On Codex
+  0.154.0, `gpt-5.1-codex` still appeared in the session header but not in the
+  visible catalog; every returned row correctly had `isCurrent: false`.
+  Real picker tests should let the installed CLI choose its launch default,
+  rather than pinning a model that can disappear from the catalog.
+- **A model dialog replaces the composer; nothing renders below it.** Full-viewport
+  captures from Claude 2.1.274 and Codex 0.154.0 (2026-09-17,
+  `tests/helpers/model-dialog-viewports.ts`) show the picker, Codex's reasoning
+  level, and Claude's cache warning each ending the viewport, while the closed
+  state puts the composer back (`❯` between rules; `› Ask Codex to do anything`).
+  Rows ABOVE the dialog are ordinary transcript: Claude keeps `❯ /model` and reply
+  rows (`⏺` on 2.1.274, `●` earlier) there, so provenance is "no conversation or
+  composer row BELOW the header", never "none above". Picker text quoted in a reply
+  always has the working row and composer beneath it, so it is not a live dialog
+  and must never receive an Escape, which would interrupt the running turn. Claude
+  2.1.274's picker also carries an effort row (`◉ xHigh effort ←/→ to adjust`)
+  between its rows and footer. A closed Claude picker leaves only `❯ /model` /
+  `⎿ Kept model as …` behind, no header. Two more things are never a dialog: the
+  phrase on a reply or composer row itself (`❯ Select model` is staged input), and
+  a quoted picker above another dialog. Below its header a native dialog holds
+  exactly one contiguous block of picker rows (description column, numbered from 1,
+  at most one cursor); any other caret or numbered row (`❯ 1. Yes`, `  1. Yes`, a
+  staged `❯ 1. fix this  then that`) restarts the numbering, follows the blank or
+  rule that separates the composer, or lacks the column, and marks the region as
+  someone else's. The block must also be COMPLETE before Elwood treats it as live:
+  every captured picker and reasoning screen carries at least two numbered rows and
+  a closing hint row (`Esc to cancel`, `esc to go back`). A header with neither —
+  a transcript quoting `Select model` above a trust or hook prompt, or above a
+  reply's own numbered list — is a fragment, and Escaping it would dismiss the live
+  prompt underneath. The CURSOR is deliberately not required: a complete picker
+  still painting its cursor is live and must keep holding input, and `setPickerModel`
+  rejects the missing cursor on its own.
+- **A live switch dialog is never hung directly off an agent reply row.** The warning
+  screen carries no closing hint row, so completeness cannot be judged the way the
+  picker's is. Indentation cannot judge it either — the title itself may sit at column
+  zero, so a column test passes a staged draft straight through. Nor can option ORDER:
+  `Yes` normally precedes `No`, but a real reordered layout exists where the cursor starts
+  on `No` above `Yes` (`claudeModelCacheConfirmationYesBelow`), so an affirmative-first
+  rule rejects a live dialog. What does hold is the separator: Claude replaces the composer
+  with the dialog, so a live one is preceded by its rule (or the blank line before it),
+  never by an agent reply bullet. `parseClaudeSwitchConfirmation` therefore rejects a title
+  sitting DIRECTLY under a reply row, and reads options only from the dialog's own
+  contiguous run of action rows, so a staged `❯ Yes, switch to Fable` below a quoted
+  warning cannot pair with a quoted `No, go back`. C-API-24, C-ATTN-04.
+- **A picker's closing hint row TERMINATES its region.** Only blank lines and rules may
+  follow it. Otherwise a transcript quoting a complete picker — footer and all — above a
+  live trust or hook prompt still reads as a live picker, and Escaping it would dismiss
+  the human's prompt instead. For the same reason the header must be prose: a numbered
+  composer draft (`❯ 1. Select model  draft` / `2. next  text` / `Esc to cancel`)
+  otherwise satisfies the row and footer grammar entirely on its own. C-API-24.
+- **A picker mid-repaint is briefly unrecognizable, so one clear frame proves nothing.**
+  This is the same shape as the resume-replay settling above, and the picker hold reuses
+  that measured value (5 frames) rather than inventing a smaller one: the replay's quiet
+  gaps were measured at one frame and 5 clears them with margin, while the picker's gap
+  length is NOT measured. The failure directions are asymmetric — too high delays
+  releasing the input hold, too low releases queued input into a repainting dialog where
+  Enter applies the highlighted model — so the conservative measured precedent wins until
+  someone captures real picker repaint frames. Cleanup uses a shorter streak on purpose
+  because it is bounded at one second and must send its Escapes inside that budget; it
+  hands off to the survivor hold, which applies the full streak, so nothing is released
+  early. `src/runtime/session/picker-cleanup.ts`, C-API-55.
+- **Escape on a follow-up stage returns to the picker, not the composer.** On both
+  Claude 2.1.274 (cache warning) and Codex 0.154.0 (reasoning level) one Escape
+  reopens `Select model` / `Select Model and Effort`; a second closes it. Failure
+  cleanup therefore sends one Escape per stage and never repeats one: a second
+  Escape during a slow repaint would land on the composer. C-API-55.
+- **Claude paints its cache warning over the picker, with one partial frame.** A
+  5 ms frame capture on Claude 2.1.274 (2026-09-17) shows no idle composer between
+  the `s` key and the warning: 28 ms after the key one frame has `Switch model?`
+  and the cache copy above STALE picker rows (`❯ 1. Fable …`), with neither
+  `Select model` nor the Yes/No options; 7 ms later the dialog is complete
+  (numbered, cursor on `1. Yes, switch to …`). In that frame the title-only shell
+  cannot be told from a `PreModelSwitch` hook confirmation, so Elwood holds input on
+  it and never writes to it, and `setModel` does not treat a caret-only row
+  elsewhere in the viewport (a reply quoting the prompt) as the returned composer
+  while the shell is up. Before this, `setModel` resolved on that frame without
+  ever confirming the switch. C-API-24, C-API-55.
+- **Picker text visible before `/model` is submitted is not Elwood's.** A closed
+  picker leaves no header behind, so `Select model` / `Select Model and Effort` /
+  `Select Reasoning Level` text that precedes the command is a human's dialog or a
+  transcript quote (which the unanchored open check would otherwise parse and
+  drive). The operation rejects without writing. C-API-55.
 - **Codex persists `/model` picker selections into the user `config.toml`.**
   `setModel` restores the prior default via compare-and-swap after switching
   (C-CODEX-14), skipping with a `codex_default_model_persisted` warning on a
@@ -191,6 +312,236 @@ select a destructive-rider affirmative, and never answer a specific-affirmative
 prompt (e.g. hook trust) with a generic "Yes". `src/core/trust/responder.ts`,
 `src/core/trust/prompts.ts`, verified by `tests/e2e/trust-prompt-claude.e2e.ts`.
 
+**Codex 0.156.1 uses a new folder-access dialog.** A native PTY capture on
+2026-09-23 showed `Folder access`, the working directory, `Trust this folder?`,
+the explanation beginning `Codex can read, edit, and run files here`, numbered
+`Trust and continue` / `Quit` choices, and `enter continue · esc quit`. The question
+and explanation share a row and wrap together. The previous grammar missed both
+the question and footer, let startup report ready, and sent an image paste into
+the unanswered dialog. Keep this layout as a separate exact-copy allowlist entry:
+`autotrust` may select only `Trust and continue`; partial or changed copy must hold
+input without approving it. The sanitized capture is
+`tests/fixtures/codex-0.156.1/folder-access.txt`; parser and session regressions
+cover both `autotrust` settings. A native rerun with this grammar answered the gate
+and attached the first image; its later cancelled-draft cleanup failed separately,
+so this is trust/attachment evidence, not a passing successor-cleanup run. C-TRUST-01.
+
+### Where the clearance grammar lives
+
+"This frame is the CLI's own idle composer, so the gate cleared" is a per-CLI layout
+fact, and both CLIs change their chrome independently. It therefore lives with each
+adapter's other verified screen facts — `claudeTrustClearance` in
+`src/claude/screen-table.ts`, `codexTrustClearance` in `src/codex/screen-table.ts` —
+and is injected into the shared coordinator (`TrustPromptResponder`/`trustView`).
+When a CLI's banner, status row, or composer placeholder changes, update that adapter's
+predicate. Codex's text grammar lives in `src/codex/screen/clearance.ts` and checks
+known placeholders plus a native model footer or complete welcome box. Text-only
+callers conservatively reject approval-like rows; the live session additionally
+uses the actual visible input cursor to identify the composer, so transcript
+caret/numbered rows above that input remain legitimate history. Dialogs hide the
+cursor or leave it outside the composer. A bare caret never proves clearance.
+Controlled post-settlement fixtures show that indented approval/trust headers or
+cursor-option blocks can coexist with a stale visible composer cursor. Clearance
+shares native trust-header classification without expanding C-ATTN-03 reporting.
+The captured 0.156.1 `Folder access` prelude holds before copy/choices finish;
+a selected numbered choice still holds after the prelude erases. Fresh composer
+replacement clears the gate. These fragments veto staged recovery and empty ACK.
+Assistant quotations require a native non-working assistant row and contiguous
+indentation; blank/column-zero rows end them. Wrapped user history requires a
+column-zero prompt, indented/blank continuation, then a non-working assistant
+reply as its next column-zero row. Unknown rows and native numbered-choice blocks
+cannot establish provenance. Bounded completed numbered user history remains
+valid regardless of its number or label. Selected numbered rows outside that
+completed history or an assistant quotation hold even without siblings. Generic
+quoted menus and caret prompts retain live-cursor history treatment; unquoted option
+blocks hold regardless of labels. Arbitrary identical dialog/transcript text is
+not claimed distinguishable from one frame.
+Native working rows and the live OSC working title retain the hold; prose that
+merely quotes `esc to interrupt` is not a native working row. The title, cursor,
+and text are read synchronously from the same completed render, including during
+trust-attempt polling. Raw PTY receipt invalidates the proof before batching.
+Both adapters now apply the same received/rendered boundary to human trust
+clearance and every retry read. A render failure permanently invalidates that
+terminal view; an unavailable view withholds automation within its existing
+deadline. This guards bytes already received, not future output the CLI has yet
+to send. A completed snapshot is reused until its render or viewport changes.
+That includes an oversized receipt's staged tail: completion of its first 64-KiB
+batch alone is not a complete render. The native working row includes elapsed
+time before the interrupt hint (seconds, minutes/seconds, or hours/minutes/seconds),
+as rendered by [Codex 0.142.5's status widget](https://github.com/openai/codex/blob/rust-v0.142.5/codex-rs/tui/src/status_indicator_widget.rs).
+Parenthesized transcript prose without that native status grammar is not work.
+An exact-shaped quotation such as `• Thinking (3s • esc to interrupt)` is ambiguous
+and retains the hold. A real Codex 0.155.1 rejected-model probe showed a visible
+column-two input cursor throughout native working frames; typing remains possible
+while a turn runs. The title spinner is configurable, and status location varies
+with preview rows, so neither missing title animation nor editable input disproves
+that exact native status. We do not promise to distinguish identical transcript
+and status rows from text/cursor evidence alone.
+Real 0.142.5 and 0.155.1 trust/model dialog captures start DEC2026 before painting,
+then hide the cursor with DEC25l before ending DEC2026. A 0.155.1 command approval
+under `read-only`/`on-request` uses the same ordering: its selected Yes row ends
+with the cursor hidden, not left visible on an old composer. Replaying all 1,078
+character prefixes of that actual approval paint retains the hold; Escape restores
+the visible composer afterward. The raw capture is preserved in
+`tests/fixtures/codex-command-approval-render.ts`. These observations apply to the
+captured versions and dialog types; a new CLI renderer needs new verification.
+Those native partial frames cannot combine settled rendering with a stale visible
+composer cursor. Captured protocol regressions replay the native bytes through trust clearance,
+staged recovery, and empty-input guards. They establish the synchronized/hidden
+cursor barriers, not an observed settled-visible partial dialog. Controlled
+actual-session fixtures separately exercise that post-settlement policy.
+The Claude predicate uses `src/core/trust/clearance.ts` for its separate grammar.
+A real Claude 2.1.278 classic-renderer capture hides the cursor during trust and
+restores it at column two on the composer only at the end of its idle paint.
+Unlike the captured Codex renderer, that Claude paint has no DEC2026 envelope.
+Splitting its bytes immediately before the final DEC25h leaves complete-looking
+composer chrome while native cursor restoration is still pending. Live Claude
+clearance therefore also verifies the visible native cursor on its composer row;
+receipt settlement alone cannot identify that native paint boundary.
+The same Claude 2.1.278 capture hides its cursor with DEC25l before repainting
+its model menu. After that complete control, all 1,241 remaining character prefixes
+retain the live hold, including prefixes where old composer chrome still passes the
+text-only grammar. `tests/fixtures/claude-model-dialog-render.ts` preserves that
+menu repaint without user paths or conversation content, and
+`tests/unit/claude-model-dialog-render.test.ts` replays every prefix. This evidence
+covers the captured model dialog; it does not establish behavior for arbitrary
+replacement prompts or future Claude renderers.
+
+Claude 2.1.278 can paint the complete folder-trust dialog before accepting keyboard
+navigation. In the real human-trust test, immediate Down/Enter writes left the
+selection on "No, exit". Waiting for the selected "Yes, I trust this folder" repaint
+before Enter cleared the dialog. The test records physical PTY writes and confirms
+that queued caller input follows native cursor clearance; it does not require a
+model response or available turn quota.
+
+`tests/e2e/codex-live-clearance.e2e.ts` also exercises production `startCodex`
+with a fresh isolated configuration: queued input stays held at the human-owned
+directory gate, then one benign prompt reaches `UserPromptSubmit` after manual
+trust and visible native cursor clearance. Verified against installed Codex
+0.155.1; the test cleans up the real session rather than waiting for model output.
+
+A startup-only real PTY probe of Codex 0.142.5 on 2026-09-19 confirmed the
+model-only `gpt-5.5 high` footer with `tui.status_line = ["model-with-reasoning"]`.
+Its placeholder is randomized: observed `Use /skills to list available skills`,
+`Find and fix a bug in @filename`, and `Implement {feature}` across launches.
+The predicate recognizes the eight fixed placeholders in the version-tagged upstream
+`chatwidget.rs` as well as the captured 0.154.0 default. It still requires native
+footer or welcome-box evidence. The sanitized 100×30 capture and provenance are
+in `tests/fixtures/codex-0.142.5/`; no model prompt was submitted.
+
+### Native regions and live confirmation
+
+Claude 2.1.252 places `Accessing workspace:` and the workspace path **before**
+the trust question. The question may wrap; its explanatory copy is:
+
+```
+(Like your own code, a well-known open source project, or work from your team). If not,
+take a moment to review what's in this folder first.
+Claude Code'll be able to read, edit, and execute files here.
+Security guide
+```
+
+The 2.1.206 capture omits `, or work from your team`. Blank rows and wrapping
+remain part of one dialog. Unknown explanatory text, titles, or option rows do
+not authorize an answer. Conversation prefixes (`●`, `•`, user/composer markers)
+remain provenance even when they precede an exact quoted trust question; slicing
+at the question must not discard them.
+
+Native Codex 0.154.0 captures at 100 columns (2026-09-16) place
+`> You are in /absolute/project/path` before the directory question. The question
+and explanation begin on the same row and wrap:
+
+```
+Do you trust the contents of this directory? Working with untrusted contents comes with higher
+risk of prompt injection. Trusting the directory allows project-local config, hooks, and exec
+policies to load.
+› 1. Yes, continue
+  2. No, quit
+Press enter to continue
+```
+
+Its hook gate renders `Hooks need review`, `1 hook is new or changed.`, and
+`Hooks can run outside the sandbox after you trust them.`, followed by
+`Review hooks`, `Trust all and continue`, and
+`Continue without trusting (hooks won't run)` as numbered choices. Its footer is
+`Press enter to confirm or esc to go back` — accepting only `esc to cancel`
+incorrectly rejects this real dialog. These PTY captures supersede the earlier
+0.144.4 binary-string evidence for those layouts. No captured path follows the
+trust header; do not add generic path/prose acceptance based on that assumption.
+
+The native Codex 0.154.0 input loop can swallow the first numbered confirmation:
+the PTY write fulfills while the directory gate stays visible. In the 2026-09-16
+high-trust probe, a manual repeat at eight seconds cleared that same gate; the
+first write had already produced premature startup activity at roughly one second.
+Numbered automation therefore retries every 250 ms for at most five seconds,
+revalidates the same header and exact option identity before each write, and
+reports answered only after the gate clears. A native directory-to-hook transition
+confirms directory clearance without sending an old answer to the hook gate.
+An observed clear-and-reappear generation cancels the old attempt.
+
+Cursor navigation rereads between individual arrows and Enter. Both navigation
+styles now belong to one session-owned coordinator: each observed dialog
+generation owns its reservation, deadline, exact affirmative, and completion.
+An old cancelled attempt cannot release or settle a reappeared gate. The five-
+second bound starts at the first native-header candidate, including partial
+painting. Candidate recognition holds input; only the stricter native-dialog
+recognizer authorizes writes, and it requires the native explanatory copy above:
+a bare header with affirmative rows (a forged or half-painted frame) is held and
+never typed into. Every captured layout (Claude 2.1.206/2.1.252, the 2.1.274
+binary's component, Codex 0.154.0) renders that copy with its header. Unknown replacement text is not clearance. Native
+composer chrome or a verified successor gate confirms clearance; a bare caret
+alone cannot distinguish a composer from a one-option dialog.
+
+A stable unsupported or exhausted gate becomes recoverable `blocked` with the
+existing attention rule id after five seconds, even when the terminal emits no
+new data. This is the deliberate fallback approved for autotrust. A later valid
+layout or new generation re-arms safe automation; an unchanged redraw does not
+restart an expired loop. Once fallback is visible, the block remains until
+verified clearance. Raw human keys remain available, while queued persona,
+paste, and command input stays held. Stop, kill, teardown, startup cleanup and
+PTY exit cancel pending automation and timers before disposal. Only a rejected
+PTY write belonging to a still-live matching attempt emits
+`startup_prompt_write_failed`; cancellation and late settlement stay quiet.
+
+Both CLIs reword gates often, so an off-allowlist gate behind a recognized header
+prefix fails closed: a header-shaped region (`headerStart` in
+`src/core/trust/dialog.ts`) with real header text, selectable options, only
+option rows and a frame-ending native footer beneath it, and no conversation row
+above it holds input as `<agent>-unknown_gate-prompt` and is never written to. Both
+CLIs paint the composer below conversation content, so quoted or model-written
+question-plus-list prose fails that tail test. The footer is required because options
+paint before it. A gate whose first words fall outside `headerStart` (e.g.
+`Allow ...?`) is NOT held: a purely structural recognizer would also catch dialogs
+Elwood drives itself (the Codex model picker ends in `Press enter to confirm or esc
+to go back`).
+
+A fulfilled write alone does not prove the gate cleared. Real-CLI checks use a
+separate raw visibility oracle so production recognition failures cannot make
+the tests report the gate absent. Sanitized native Claude 2.1.274 and Codex
+0.154.0 post-trust composer captures anchor the positive-clearance tests.
+A no-model Codex resize probe at 100×12, 100×8 and 100×6 confirms that the welcome
+box can scroll away while its composer and model/reasoning/path footer remain.
+Those native rows also prove clearance; welcome presence is not required.
+
+### Native Codex startup warnings
+
+Codex 0.154.0 normally collapses MCP failures to
+`⚠ 1 MCP startup issue · ctrl + t for details`. Its Ctrl+T overlay retains the
+canonical detailed MCP and login warning rows beneath the boxed welcome header.
+The collapsed count cannot supply server names or recovery instructions; Elwood
+does not send Ctrl+T automatically. Captures and the local failing-server/401
+real-CLI test verify the detailed rows. The current welcome chrome and native
+warning prefixes distinguish these banners from conversational quotations.
+
+Native 0.154.0 startup renders no `•`/`●` row at any point: recorded frame by frame
+(2026-09-17) through the directory gate, hooks gate, welcome, and composer with
+both an MCP endpoint that fails at once and one that accepts the connection and
+never answers (the collapsed warning appears after ~10 s with no boot spinner).
+Warning recognition therefore ends at the first assistant-marker row or the
+first caller-side write, whichever comes first; after that a copied welcome box
+whose own marker has scrolled away is content. A CLI version that painted a `•`
+boot spinner before its warnings would lose those warnings rather than forge any.
+
 ### Bypass-permissions acceptance dialog (`--high-trust`)
 
 Claude Code carries a one-time disclaimer for bypass mode. Its wording, taken
@@ -231,26 +582,26 @@ therefore version/account-gated, and Elwood must be correct in BOTH states:
   security reasons` is the CLI's own refusal; Elwood does not special-case it —
   it surfaces as the ordinary start failure with the CLI's message.
 
-**Do not equate `autotrust` with “not blocking” until the write clears the real
-screen.** Trust rules are omitted from human-blocking classification under
-`autotrust`, because automation owns the gate. If option parsing drifts and writes
-nothing, the 10 s initial-ready starvation deadline can otherwise report `ready`
-over a still-visible trust dialog. C-E2E-09 therefore requires both `ready` and a
-cleared trust screen; a complete but unanswerable real frame is a failure, not a
-skip.
-
-The responder emits one transient `attention` when a recognized header paints
-before its affirmative option. A headless owner must ignore that transient only
-when its trust policy already authorizes the exact allowlisted prompt; `--no-trust`
-and generic permission dialogs remain human blocks. The startup replay buffer can
+**Do not equate `autotrust` with readiness until the real gate clears.** The
+automation gate holds the 10 s initial-ready fallback and queued input from the
+first native trust candidate. Successful bounded automation does not report a
+human block; unsupported or exhausted attempts transfer to the recoverable block
+above. C-E2E-09 requires both `ready` and a cleared trust screen; an unanswerable
+real frame is a failure, not a skip.
+
+The responder emits one transient `attention` when a recognized header and its
+native body paint before the affirmative option. A header whose body has not
+validated is held silently: it emits no transient `attention`, only the
+five-second fallback if it never completes. A headless owner must ignore that
+transient only when its trust policy already authorizes the exact allowlisted
+prompt; `--no-trust` and generic permission dialogs remain human blocks. The startup replay buffer can
 deliver this attention after the responder has already continued, so treating
 every attention event as fatal produces a false `blocked_prompt`.
 
 ## Codex in-TUI update prompt (and the restart loop)
 
 Independent of the `autoupdate` preflight (`codex update` run before spawn), the
-Codex TUI can show its OWN "update available" prompt at launch. Elwood **always
-skips it** — it never selects "Update now" — because letting the live TUI update
+Codex TUI can show its OWN "update available" prompt at launch. Elwood **only selects a verified safe skip choice** — it never selects "Update now" — because letting the live TUI update
 itself restarts Codex out from under the PTY session. The real update is the
 preflight; the in-TUI prompt is a nuisance to dismiss.
 
@@ -258,19 +609,37 @@ preflight; the in-TUI prompt is a nuisance to dismiss.
 "accepts" (or that Elwood used to leave latched) restarts Codex, the update does
 **not** take (a partial download, a managed install, contention), and the SAME
 update screen returns — an infinite loop stuck on the update screen. The fix is an
-**edge-triggered** skip: skip once per appearance, and RE-ARM the moment the update
-screen leaves the frame, so a reappearance after the restart is skipped again
-rather than sitting latched forever. Edge-detection mirrors the login watcher.
-
-Two version-coupled wrinkles this cost us:
-
-- The skip-attempt is gated by a per-session prompt tracker, even though the
-  option is located in the accumulated buffer. Codex can split the distinctive
-  versioned banner and its options across consecutive screen replacements; once
-  the banner activates the tracker, a safe-option-only continuation remains the
-  same blocking prompt. A definite non-update frame clears it. Matching the
-  accumulated buffer alone lets benign later prose re-fire against a **stale
-  buffered option** — a real bug we hit while building this. C-CODEX-12.
+**edge-triggered** skip: skip once per appearance. Unknown or blank replacements
+keep automation revoked until authoritative native composer clearance or fresh
+first-party banner evidence permits a new appearance. A verified clear can re-arm
+a new bannered appearance after the restart; retained composer text beneath a
+replacement cannot. The old attempt stays revoked even when a new one is authorized.
+
+Version-coupled behavior learned here:
+
+- Every automated selection requires the current validated first-party banner and
+  its current safe numbered choice. All bannerless continuations are withheld,
+  including previously observed number/label bindings. The banner activates the
+  blocker before choices paint, and retained input remains held until positive
+  native composer clearance. Historical accumulated-buffer matching and later
+  safe-option-only continuation inference are no longer authorization rules.
+  The earlier 0.155.1 full-menu fixture captures preserve the banner at every
+  observed size; those fixtures do not establish a genuine bannerless repaint. C-CODEX-12.
+- Captured Codex menus list `Update now` before safe choices. Selection respects
+  that ordering, excludes the update action, and compares the current bounded
+  option snapshot before each write. Removal or renumbering of a safe choice
+  invalidates the prior retry; a fresh bannered safe block gets a new appearance.
+  Old and new numbers are never accumulated into one authorized set.
+- Update recognition and input blocking have different lifetimes. An unknown
+  replacement is no longer an update. Without a prior recognized update it does
+  not create a retained update hold, so queued paste and Enter remain eligible.
+  Once an update was recognized, the session retains its input hold until native
+  composer and visible cursor in one completed render prove clearance, with no
+  working-title signal. The title may be absent or an ordinary directory name. A
+  partial repaint or bare caret cannot release it. Specific trust rules keep their
+  own labels; otherwise an unowned retained hold reports `codex-unidentified-dialog`.
+  Pending automated trust owns its partial repaints and suppresses that generic
+  label until its input hold ends.
 - Option labels drift by version. Older codex (0.132/0.133) rendered a numbered
   dialog ("1. Update now / 2. Skip / 3. Skip until next version"). In the installed
   0.149.1 binary, the upgrade notice strings extracted from the native binary read
@@ -278,16 +647,18 @@ Two version-coupled wrinkles this cost us:
   `https://github.com/openai/codex for installation options.`) rather than a
   numbered dialog — so the interactive dialog is not guaranteed on every version.
   The skip is written ONLY when a numbered skip option is actually present
-  (`findNumberedOption` → null ⇒ no write), so a passive banner is a harmless no-op.
+  (`safeUpdateOption` → `undefined` ⇒ no write), so a passive banner is a harmless no-op.
+  If the only skip-shaped choice precedes the update action, the helper also returns
+  `undefined` and no key is written.
   Every retry revalidates that the frame still belongs to the captured first-party
-  update-prompt generation and uses the safe option's current number. This preserves
-  the known safe-option-only continuation layout without letting a cleared/reappeared
-  prompt or replacement dialog inherit a stale digit. A prompt that remains blocking
+  update-prompt generation and uses the safe option's current number. The current banner must remain visible; a bannerless repaint cannot inherit a
+  digit from a cleared/reappeared prompt. A prompt that remains blocking
   but cannot be safely answered becomes `blocked_prompt` after the bounded
   responder/grace window, including runs without a whole-invocation timeout.
-  The match set (`src/codex/update-prompt.ts`) is unit-tested against captured
-  layouts, NOT against a live update event (which requires an actually-stale binary
-  to trigger). If Codex changes the dialog wording, this is the first thing to
+  The match set is unit-tested against captured
+  layouts; the pinned 0.155.1 native experiment below used controlled update metadata. `codex-update-selection.e2e.ts` also replays the documented option
+  layout and an adversarial reordered variant through a real PTY and emulator;
+  its child acknowledges the physical skip digit it received. If Codex changes the dialog wording, this is the first thing to
   re-capture.
 
 **Concurrent-start failure (verified against codex-cli 0.152.1, 2026-09):** the
@@ -299,11 +670,17 @@ therefore input-blocking facts, not only responder hints: readiness and paste
 submission remain suspended until the rendered update frame clears, even after
 the skip key is written. The prompt recognizer accepts the known first-party
 versioned banner before options paint, plus option-only frames when BOTH "Update
-now" and a safe skip/later choice are present. Once active, a safe-option-only
-continuation stays latched until a definite non-update frame. Generic agent prose
+now" and a safe skip/later choice are present. Those bannerless blocks remain recognition evidence only. No bannerless frame
+authorizes automation; the input hold lasts until positive native composer clearance. Generic agent prose
 containing "update available" and the actual 0.149.1 passive installation notice
 do not block.
 
+A fulfilled update digit write is not clearance evidence. Update settlement uses
+the same native composer, cursor, title, and completed-render predicate as the
+retained input hold. It also reads the frame observer's existing hold when old
+composer chrome survives beneath replacement text. Missing readers and replacement
+dialogs cancel quietly.
+
 The preflight adds a second boundary because global installers can also race
 across separate Elwood parent processes. A per-user/per-adapter atomic lease in
 the account cache (independent of `TMPDIR`) surrounds the required existence check
@@ -340,6 +717,18 @@ C-CLAUDE-17/18. Verified against the banner text the field reported; there is no
 live-CLI e2e (it would mutate real auth), so the matchers are unit-tested against
 captured strings.
 
+## Claude login picker handshake (2026-09-23)
+
+The `/login` command Enter and the method-picker selection Enter are distinct
+writes in the production login driver. A fixture must await the command Enter
+before painting the picker, then await the picker Enter before painting the auth
+URL/code screen. Advancing on the first Enter can replace the picker before the
+driver observes it. Reproduced through the real driver and fake PTY in
+`tests/claude/session-login.test.ts` with a temporary 250 ms delay before the picker
+stage: the old fixture missed the selection Enter; the corrected handshake passed.
+This was a fixture reproduction, not a fresh native CLI authentication test; no
+new CLI version or native capture was verified.
+
 ## Input / paste
 
 - Caller and LLM text sent via `sendPrompt`/`sendMessage`/`sendGuidance` is
@@ -347,13 +736,36 @@ captured strings.
   bracketed-paste markers (`ESC[200~`/`ESC[201~`) and C0/C1 controls except
   tab/nl/cr, so text can't escape bracketed paste and inject a dialog-confirming
   Enter. C-API-40.
-- A submission's Enter is **held while a blocking dialog is visible**
-  (`waitWhileBlocked`), so a dialog appearing in the paste→Enter window can't be
-  auto-confirmed by the pending Enter.
+- Codex 0.156.1 renders each pasted tab as one space, regardless of column;
+  consecutive tabs remain consecutive spaces. Pasted CR and LF start new rows.
+  Verified in an isolated native PTY without submitting a model turn (2026-09-23).
+  Recovery checks must use the sanitized payload and its rendered final line,
+  otherwise removed controls or preserved tabs make a still-staged draft look absent.
+- A submission's paste, Enter, and recovery Enters are **held while a blocking
+  dialog is visible** (`holdWhileUnsafe` / `writeUnsafe`, `src/core/input/abort.ts`),
+  so a dialog appearing in the paste→Enter window can't be auto-confirmed. "Visible"
+  means observed: each write first awaits `terminal.settled()`, because a dialog can
+  be received before it is rendered. xterm parses the first write after user input
+  synchronously and later ones on a timer, so that window is real and input-dependent.
 - **Writing a literal ESC byte in source is fragile** — it can be silently
   stripped by an editor/pipeline (this once neutered an interrupt e2e). Always
   write the escape sequence form (``), never a raw ESC character.
 
+## Hook bridge request FIN and delayed decisions
+
+The generated bridge child calls `client.end(request)` after connecting. That FIN
+ends the request stream while the child still awaits the parent's decision. A
+local real-socket reproduction with a handler held for 100 ms showed the default
+Node server closing its reply side first: the child received empty EOF and exited
+fail-open before the blocking decision existed. `allowHalfOpen: true` keeps the
+reply side available until the handler settles. The server still ends and destroys
+the socket after flushing its reply; shutdown still destroys pending sockets.
+
+The regression runs the actual generated child against `HookBridgeServer`, checking
+both the delayed blocking output/exit code and delayed handler-failure diagnostics.
+This is a local bridge/process proof, not a new Claude or Codex CLI capture. PRD
+§6.2/§6.3, C-HOOK-16.
+
 ## Hook bridge socket path length (macOS ~104-byte cap)
 
 macOS caps a Unix domain socket path near 104 bytes (`sockaddr_un.sun_path`); binding
@@ -435,8 +847,9 @@ Four real-PTY edges were invisible to the unit fixtures:
   Run probes in a detached process session so they keep interactive PATH resolution
   without participating in the caller terminal's job control.
 - Current agent TUIs push Kitty keyboard enhancements with `CSI > flags u`. Head mode
-  stops mirroring before agent teardown, so it cannot rely on the agent's matching
-  cleanup sequence reaching the physical terminal. The defensive reset must emit
+  mirrors through session cleanup (so the drained final frames are shown), but an
+  agent signalled or force-killed there is not guaranteed to emit its matching
+  cleanup sequence, so head mode cannot rely on one reaching the physical terminal. The defensive reset must emit
   `CSI < u` before leaving the alternate screen; otherwise every later shell keystroke
   can remain encoded as a `CSI u` key event, making even a typed `reset` unusable.
 
@@ -502,3 +915,477 @@ side-effect-free signal. C-CLI-21 through C-CLI-24.
 - Per the testing pyramid in `CLAUDE.md`: anything that interfaces with the real
   CLI SHOULD have a real-CLI e2e. Every fact in this file is one a unit test could
   not have caught.
+
+### Codex commentary and final-answer phases (2026-10-20)
+
+The reported completed `response_item` fixture retains assistant text in an
+array-form `output_text` block with `phase: "commentary"`. The previous summarizer
+discarded that phase. It now produces `assistant_progress`; final answers retain
+`assistant_message`. Explicit non-final legacy `agent_message` mirrors remain raw
+observations without normalized text, avoiding false final replies and duplicate
+progress. Tests exercise mirrors before and after canonical response items, as
+well as repeated genuine canonical updates.
+
+An isolated real Codex 0.159.2 / `gpt-6-luna` low-effort turn passed
+`tests/e2e/codex-commentary.e2e.ts`: one progress event preceded one final event,
+progress observed `running`, the turn ended `ready`, and ergonomic `send()`
+returned only final text. Exactly one paste and Enter were delivered, with zero
+tools. The test uses a private Codex home and empty project, removes that home,
+and checks the parent environment and Codex auth/config/hook file fingerprints.
+Run explicitly with `ELWOOD_NATIVE_COMMENTARY_PROOF=1`; it consumes one small
+valid-model turn. This pinned-version proof does not establish every future CLI
+layout or guarantee that arbitrary prompts will cause a model to send commentary.
+
+### Model-picker dispatch and post-cancel composer (2026-09-19)
+
+A serial native PTY probe on Codex 0.155.1 and Claude Code 2.1.278 typed
+`/model`, waited 300 ms, then sent Enter. Neither CLI displayed its model picker
+before Enter; both displayed it afterward. Model test drivers must therefore wait
+for the command's submitting Enter before painting the picker. No model prompt was
+submitted in this probe.
+
+Codex returned to its known `Ask Codex to do anything` composer and model/effort
+footer after Escape; automated `listModels` then returned five rows. Claude kept
+`❯ /model` and `Kept model as …` in the transcript above its final fenced composer.
+Its idle footer read `-- INSERT -- ⏵⏵ auto mode on (shift+tab to cycle) · ← for
+agents`. A whole-screen clearance predicate that rejects every earlier caret
+therefore rejects this genuine post-picker idle frame. Model clearance must use
+the last composer, its enclosing rules, and its native footer; a bare caret or a
+partial model dialog is insufficient. The sanitized Claude frame is retained in
+`tests/fixtures/claude-2.1.278/model-cancelled.txt`. With this recognition fix,
+Claude also completed automated `listModels` and returned five rows (C-API-55).
+
+
+### Cursor provenance for Codex trust clearance
+
+Startup-only probes on 2026-09-19 checked Codex 0.142.5 and 0.155.1 at 100×30,
+without submitting a model prompt. Both hide the cursor with DEC private mode 25
+on the directory-trust and `/model` dialogs, leaving its coordinates on a footer.
+Both show the cursor at column 2 on the native placeholder row after trust and
+after dismissing the picker. Codex 0.155.1 retains this evidence at 100×6.
+The 0.142.5 narrow resize leaves malformed chrome, so that frame is not used as a
+positive fixture. Inspect cursor mode and coordinates together with the same
+completed rendered text and title: an old composer or footer can remain during a
+dialog repaint, and a transcript can contain identical caret/option text.
+
+### Cancelled native composer drafts (2026-09-20)
+
+Claude Code 2.1.278 and codex-cli 0.155.1 both cleared a staged `[Image #1]` chip
+and text draft when production cancellation cleanup sent Ctrl+U followed by Ctrl+K
+through the real PTY. `tests/e2e/composer-cleanup.e2e.ts` waits for idle readiness,
+observes the image and text, then cancels before Enter; it rejects any submitting
+Enter and observes no `UserPromptSubmit` hook, so no model turn runs. Disabling
+only the production clear write made both tests retain the image and text and fail.
+This verifies an automation-owned idle composer, not cleanup across caller edits
+or blocking dialogs. Codex clipboard text is restored after attachment.
+
+
+Native startup protocol replies also emit xterm `onData`. The actual-session
+image-cancellation proof exposed this on both adapters: treating those replies as
+caller edits revoked cleanup before its first staged image. A real terminal's
+cursor-position query (`CSI 6 n`) reproduces the revocation without any caller
+input. Ownership now tracks `xterm.input` invocations; parser-generated replies
+preserve authority, while caller keys still revoke it. Startup trust writers also
+use that automation scope: both actual-session trust fixtures showed that writing
+outside it revoked cleanup before the first caller submission.
+
+The actual-session image queue also exposed a consumption race: writing the clear
+keys did not establish that Claude had removed the staged image before successor
+attachment. Cleanup therefore waits for a fresh completed empty native frame. A
+bounded Claude probe then found a cleared frame with a visible input cursor at
+column two, enclosing rules, and a version banner: existing whole-frame live
+clearance accepted it, while the post-model-picker suffix predicate rejected it.
+Cleanup accepts either existing positive Claude clearance path, preserving the
+same completed-render and cursor checks. The suffix path remains useful when
+earlier conversation carets prevent whole-frame clearance.
+
+
+### Capitalized Codex model footer (2026-09-23)
+
+Codex 0.156.1 renders `GPT-6-Astra default` in the native footer, followed by
+its working directory and a right-aligned warning count. A 189×48 capture after
+staged-draft cleanup showed the empty `Ask Codex to do anything` placeholder with
+the input cursor at column 2, row 11 (zero-based), but the lowercase-only `gpt-`
+footer pattern rejected the completed native frame. Cleanup consequently reported
+`Could not clear the staged composer draft` after the CLI had already cleared it.
+The model prefix now accepts the captured `GPT-` spelling alongside `gpt-`;
+placeholder, footer layout, live cursor and blocking-overlay checks remain required.
+The captured nonempty rows are retained in
+`tests/fixtures/codex-0.156.1/cleared-composer.txt`; the regression replays them
+at their original viewport size, with temporary paths replaced by a stable `CAPTURE`
+placeholder. C-API-56, C-TRUST-01, PRD §5.4.
+
+### Native Codex updater layout (2026-09-23)
+
+An authenticated Codex 0.155.1 binary, copied into an isolated `CODEX_HOME`
+standalone-release layout with fresh cached update metadata naming 0.156.1,
+rendered the actual updater without selecting any menu item. Native PTY resize
+captured the full menu at 100×30, banner plus the clipped first action at 100×6,
+banner only at 100×3, and the first safe choice at 100×8. The fixtures in
+`tests/fixtures/codex-0.155.1/update-*.txt` preserve the rendered text.
+
+The banner begins with `✨` and a thin space. A release-notes link precedes the
+options. The `Update now` install command wraps onto an indented continuation
+row; `Press enter to continue` follows the option block. The parser accepts those
+observed rows while rejecting numbered scrollback before the banner and unknown
+text after the choices. Wrapped command fragments must form a prefix of the
+captured `sh -c 'curl -fsSL https://chatgpt.com/codex/install.sh | CODEX_NON_INTERACTIVE=1 sh'`
+action. Arbitrary indented replacement text is not a command continuation or safe choice.
+
+These captures prove native renderer layout under controlled cached metadata,
+not an update execution or a genuine bannerless repaint. The banner remained
+visible in every captured resize. Adversarial replacement frames and shell-PTY
+proofs are separate constructed evidence; these fixtures alone do not prove
+queued-input suppression through a live Elwood session.
+
+A controlled real-session probe passed on 2026-09-23: one test, one pass, no skips. It verified the pinned binary's
+version and login status, then started Elwood with normal automatic skip handling
+and a queued caller message. At 100×6 and 100×3, Elwood stayed `blocked` and emitted
+`codex-update-prompt` attention. Neither automation nor the queued message attempted
+an application write; the queue rejected on shutdown. The PTY interceptor recorded
+attempts before rejecting them, so it could not hide an incorrect selection. Only
+exact native terminal protocol replies were forwarded. `autoupdate: false`
+disabled installation, not startup-menu skipping. The temporary binary, config,
+version metadata, and credential copy were removed after teardown. This proves
+these narrow native layouts under controlled version metadata; it does not prove
+a bannerless continuation, run an updater, or submit a model turn.
+
+### Native updater resize to a bannerless empty viewport (2026-10-01)
+
+A fresh isolated Codex 0.155.1 probe used the actual pinned standalone binary and
+private authenticated `CODEX_HOME`, with cached metadata naming 0.156.1. With
+normal startup-menu skipping enabled and one caller message queued, resizing
+100×6 → 100×2 → 100×1 → 100×3 → 100×6 produced a genuinely empty viewport at one
+row. The two-row frame still contained the banner. The empty repaint remained
+`blocked`, emitted `codex-unidentified-dialog` attention, held the caller, and
+attempted zero application writes. Returning to three and six rows restored the
+banner and retained the hold. Shutdown rejected the queued message.
+
+The run passed one test with no skips. Application writes were counted before
+being rejected by the interceptor; only exact terminal protocol replies reached
+the PTY. No updater action or model prompt was delivered, and the private binary,
+metadata and credential copy were removed afterward. This proves a genuine
+bannerless **empty** repaint, not a bannerless numbered-choice layout. The initial
+six-row layout had only the clipped update action, so that narrow phase alone
+establishes no live safe-choice selection.
+
+The final proof also launches a second isolated session without a queued caller,
+then resizes its real updater from 100×6 to 100×30. Before every application write,
+the interceptor checks the current rendered first-party banner and parsed `2. Skip`
+choice; only the exact digit `2` is permitted. The measured run attempted and
+delivered exactly one `2`, reached `ready`, then closed without a model prompt.
+The combined test passed 1/1 with no skips (8.28 seconds); the narrow phase still
+had zero application attempts. The negative session is killed before this phase,
+so its held caller cannot become a model submission when the menu clears.
+
+`tests/fixtures/codex-0.155.1/update-resize-100x1.json` preserves the actual frames.
+The opt-in `codex-native-update.e2e.ts` proof is repeatable with
+`ELWOOD_NATIVE_UPDATE_PROOF=1`; it verifies the pinned binary and login state before
+launch and never installs over the user's CLI. C-CODEX-12.
+
+### Empty input while a turn is active (2026-09-23)
+
+The retained Claude 2.1.281 `working.txt` and `working-empty-input.json` captures
+contain `⚠ Your login expires in 1 day · run /login to renew` in the welcome
+region and the same notice without `⚠` below the native composer. A user report
+on 2.1.305 (2026-10-20) shows the same welcome wording with `3 days`. These
+observations underpin the `login_expiring` warning (C-CLAUDE-23); they are advance
+renewal notices, not the lapsed-authentication screens used by `login_expired`.
+No `/login` was driven to collect this evidence.
+
+Native captures show that empty input and idle-turn clearance are different facts.
+Codex 0.156.1 kept its visible cursor at column 2 on `Ask Codex to do anything`
+while its working title and interrupt status were active. The bounded probe used
+an invalid model and reached rejection without model quota. Its model-only status
+line also carried a right-aligned `⚠ 3 warnings · f2 to view` badge.
+
+Claude Code 2.1.281 kept a visible column-2 cursor on its empty fenced input while
+`Wandering… (0s)` and the `◐ Claude Code` title were active. A single synthetic
+`Reply exactly OK. Do not use tools.` request in an isolated workspace supplied
+this capture; the request later reached a usage limit, so it proves active input
+geometry, not a successful answer. The native manual-mode footer included the
+token count and a login-expiry notice. No further valid-model requests were made.
+
+The sanitized `working-empty-input.json` fixtures retain these actual completed
+frames and cursor coordinates. Empty-input observers may use this geometry to
+confirm a consumed draft during work. They do not release trust, model-picker, or
+cleanup holds: those retain their stricter idle contract. Replay callers must
+also retain their existing dialog-blocking check and require a fresh frame after
+submission; an old empty frame does not prove acceptance.
+
+The Claude observer also preserves the existing version-banner/fenced-input
+alternative and the documented 2.1.268 non-Vim bypass-permissions footer.
+Those compatibility cases are constructed regressions, not new working captures.
+
+## Native submission hooks end recovery (2026-09-24)
+
+`tests/e2e/paste-recovery.e2e.ts` passed against Claude Code 2.1.281 and
+codex-cli 0.156.1: 2 tests, 2 passes, 0 failures, 0 skips, covering cold and
+resumed sessions for each adapter. Every phase physically delivered one Enter,
+emitted one `UserPromptSubmit`, and attempted no recovery Enter after native
+`user_message` activity during a further six-second observation.
+
+Codex resume did attempt a recovery Enter before its hook arrived: first Enter
+at 151 ms, retry at 1155 ms, native activity at 1317 ms. The test counted that
+retry and intercepted it before delivery. This proves the hook-only guarantee;
+it does not prove safety in the interval before the hook, or isolate native
+working evidence. The other three phases each attempted only the first Enter.
+
+Both CLIs rejected a nonexistent model before quota consumption. Since public
+resume options omit model, the test appended that same invalid native `--model`
+at the PTY launch seam. Native hooks, readiness, and input queues remained real.
+All processes and temporary credential copies were cleaned up. These observations
+do not establish successful model output or correlation of a hook to a prompt.
+
+## Live staged text and ambiguous working frames (2026-09-24)
+
+The 2026-09-24 no-submission captures of Claude Code 2.1.281 and
+Codex 0.156.1 show the actual cursor inside collapsed or wrapped drafts. Codex
+continuations use two-space indentation and may cross a nonzero buffer base.
+Claude collapsed text uses the exact “paste again to expand” footer, with the
+separate `◐ medium · /effort` row observed again in the fresh recovery probe; Ctrl+Y
+can remain visible from an earlier draft. Those captures did not establish that
+Ctrl-U/K removed all earlier text, and are not a model-turn acceptance proof.
+Committed fixtures preserve geometry while replacing account/quota details and
+temporary workspace names.
+
+Actual session/PTY tests distinguish the current cursor-owned composer from
+identical transcript text. Startup or resume replay and accepted native work can
+produce indistinguishable working frames before readiness. Recovery therefore
+withholds Enter during work without permanently inferring acceptance. A fresh
+positive empty input frame or native user-message activity ends that submission’s
+recovery; otherwise a later verified idle draft remains eligible within the
+four-observation/two-Enter bound. This is a conservative policy tested with
+controlled frames, not a newly observed native correlation guarantee.
+
+A fresh bounded recovery probe on these same CLI versions passed for both
+adapters: an 18-line prompt remained staged, and the actual PTY writer attempted
+exactly the first Enter plus two recovery Enters, near 150/1150/2150 ms. All three
+Enters were intercepted before delivery; neither CLI emitted UserPromptSubmit,
+and neither ran a model turn. This proves native staged geometry and retry
+bounds, not acceptance or post-acceptance behavior. The temporary Codex auth
+copy was removed after teardown.
+
+
+## Cached image recovery frames (2026-10-01)
+
+The existing captured image-chip and staged-text layouts establish live composer
+geometry, not whether an Enter was accepted after the capture. A completed idle
+frame can remain cached until a later native repaint; a second Enter must not be
+authorized from that pre-attempt frame. Recovery now captures the render revision
+before each physical Enter attempt and requires later completed output plus the
+adapter's live idle-composer check. Resizing or scrolling changes snapshot geometry
+without establishing this output ordering. Native user-message activity retains
+its independent, permanent revocation of recovery.
+
+The attachment-to-submission regressions use the real adapters and terminal parser,
+with controlled PTY output and a stubbed Codex platform clipboard. They retain the
+native Claude effort footer and distinguish fresh attached chips from history,
+hidden/working frames, and unchanged pre-Enter chips. This is deterministic ordering
+evidence, not a new native CLI acceptance measurement.
+
+## Codex whitespace-only staged input (2026-10-01)
+
+Private copied Codex 0.159.2, auth and config rendered a bracketed paste of two
+spaces, a tab and a space as an apparently empty `›`. The completed 140×35 frame
+was ready with visible cursor at zero-based (6,31): trimming text cannot prove
+consumption. Fixture: `tests/fixtures/codex-0.159.2/whitespace-only-input.json`.
+Updates were disabled and the model nonexistent. Exactly one paste and two
+protocol replies occurred, with no Enter, UPS, clipboard operation or model turn.
+Private home cleanup and unchanged parent environment passed. This proves geometry,
+not acceptance. Controlled replay combines it with an older captured empty frame;
+image tests exercise adapter options with stubbed clipboard. No native Claude
+whitespace capture is claimed.
+
+## Codex 0.159.2 native acceptance ordering
+
+A private-home Node 24.7.0 cold/resume probe used
+`gpt-elwood-nonexistent-acceptance-probe`, one Enter/UPS per phase and a one-second
+handler hold. The real generated bridge received its 38-byte response only after
+return (cold 1.353ms, resume 1.391ms), verifying half-close transport without a
+successful model/quota turn. Parent environment and global config were unchanged.
+Bounded pre-Enter discovery found no cold candidate, not proof no file existed.
+Resume used the persisted native ID with cold path memory cleared. Both UPS events
+had native task/turn-context metadata, but the new user record appeared only after
+ACK, absent at ingress and during the hold. Waiting for that record before ACK
+would deadlock the work ACK unblocks. This is ordering evidence, not a filesystem
+authority requirement for the authenticated per-launch hook channel.
+
+Official `rust-v0.159.2` commit `ff6aec96948b70d94983af2641a6b67c94faeff5` explains it:
+`core/src/hook_runtime.rs::inspect_pending_input` supplies active
+`turn_context.sub_id` and awaits UPS; `core/src/session/turn.rs::run_hooks_and_record_inputs`
+records afterward. SessionStart hooks run earlier. Steering shares the active
+context, so Enter need not create a new turn ID. `core/src/tasks/regular.rs` runs
+input hooks on cancelled startup too: cancellation cannot rule out delayed prior
+UPS. Successors must retain predecessor boundaries, not claim unfamiliar IDs from
+matching text alone.
+
+Opt-in `tests/e2e/codex-native-response.e2e.ts` passed on Codex 0.159.2 / Node 24.7.0,
+`gpt-6-luna`, low effort: two valid model turns in private home/empty workspace,
+cold `CodexSession.send` then `HeadlessCliSession.stream` using persisted Elwood
+record/native resume ID. Each returned its distinct exact synthetic token; resume
+excluded the old token. Each had one paste/Enter/UPS/Stop and zero tools. Private
+home removal and unchanged parent environment passed. This pinned-version response
+isolation proof is separate from bogus-model ACK ordering.
+
+The pinned response fixture isolates both probe and PTY shell startup with a
+child-only `ZDOTDIR` pointing at its private home. An inherited interactive zsh
+profile timed out before `codex --version` at 15 seconds; the same pinned binary
+with an empty private profile directory returned its version in 52 ms. This
+preflight failure submitted no model turn. Parent environment values stay intact.
+
+## Claude question editor captures (2026-10-20)
+
+Claude Code 2.1.305 accepts a single question on Enter. Grouped questions advance
+through tabs and end on a separate Review your answers / Submit answers page.
+Multi-select uses checkbox rows, Space to toggle, and a per-question Submit row.
+
+The highlighted Type something row is already an editor: paste before Enter.
+An empty Enter there declines the request. A two-line bracketed paste preserved
+its newline. Choice rows start at column zero with a highlight or space, followed
+by one space. Other continuations are indented five spaces, so their numbered
+lists are text, not additional choices. The checkbox Submit row also uses five
+columns, but occurs only in the multi-select layout.
+
+A native checkbox Submit highlight can have a hidden terminal cursor parked at
+column zero on the viewport's bottom blank row. A multiline Other answer places
+the visible cursor on its indented continuation. Neither necessarily sits on
+the highlighted option glyph. The captures used private configuration and
+authentication copies with synthetic prompts; see
+`tests/fixtures/claude-2.1.305/questions/`.
+
+### Claude question dialogs and manual composer (2026-10-20)
+
+Claude Code 2.1.305 renders `AskUserQuestion` as a fenced questionnaire with
+checkbox headers, numbered choices, and a selected `❯` row. That caret belongs
+to the dialog, so the captured questionnaire is a blocking screen fact. The
+retained question and review frames are under
+`tests/fixtures/claude-2.1.305/questions/`.
+
+After native submission the captured `accepted-manual-composer.json` contains
+`⏸ manual mode on · ? for shortcuts` below the fenced empty composer. Earlier
+question prompts remain above it. The footer is valid native composer chrome;
+clearance still requires the current visible cursor at column two on the empty
+input row. A hook candidate may arrive while the previous composer is still
+visible, so that old frame cannot retire it before its matching questionnaire has
+appeared. Matching uses the live panel’s tabs and prompt, rather than earlier
+question text or cancellation notices retained in history.
+
+These captures establish the questionnaire and manual-footer additions on
+2.1.305. They do not reverify every screen-table pattern from earlier versions.
+
+The private adapter/controller tests retain native input ownership when a
+composer repaint precedes the matching completion hook. Successful submissions
+keep their request pending; a post-write abort retires the public ID while the
+native hold remains until matching completion, replacement or turn end. A
+predecessor review panel cannot publish a newly observed successor.
+
+Live sessions connect this adapter to the session-owned question controller,
+completed terminal renders, hook routing and the ordinary-input gate. Claude's
+hook-decision gate resolves the exact caller hook outcome before publishing a
+request; direct answers and denials withdraw automation while retaining native
+ownership until matching completion, replacement or turn end. The captured frames
+establish the native layouts; the capture-specific version and screen-pattern
+limitations above still apply.
+
+Structured answers use the session-owned transaction lane; request listing
+bypasses an active ergonomic turn. After uncertain dispatch, both physical write
+settlement and matching native closure are required before ordinary input resumes,
+regardless of their order. The live screen-fact rule also holds input while the
+questionnaire is visible.
+
+
+A final Enter rejected before physical dispatch, including by a current-frame or
+abort guard, does not count as submission. Once dispatch begins, a rejection or
+abort leaves delivery uncertain: the native identity and input hold survive an
+empty composer until matching native completion, replacement or turn end.
+A semantic replacement of a known questionnaire must show matching new choices
+before a retained composer can retire it.
+
+### Codex question panels, work pulses, and Plan footer (2026-10-20)
+
+Codex 0.163.0's native queued-question UI can coexist with a working status
+that pulses between `•` and `◦`. Both glyphs retain the elapsed-time and
+`esc to interrupt` grammar; the lighter pulse does not end the running turn.
+A blocking question panel ends with its own navigation/submission footer and
+must hold ordinary input even though its selected option also uses `›`.
+The captured queued choice panel hides the native cursor and can leave its
+coordinates at the end of the working row above the panel. That position is
+valid only with hidden cursor, exact working-row geometry, and blank intervening
+rows; a visible or unrelated cursor does not establish panel ownership.
+
+After a Plan mode question completes, the native model footer includes the exact
+right-aligned `Plan mode (⇧tab to cycle)` suffix. That suffix preserves empty
+composer evidence alongside the existing model/footer grammar, current visible
+cursor, and overlay checks.
+
+The native `async-editor-first.txt` queued editor and `blocking-modal-first.txt`
+modal captures retain their exact header and terminal footer. The collapsed
+`? 1 question` badge is not an open editor and does not itself block ordinary input.
+
+These captures establish the layouts in
+`tests/fixtures/codex-0.163.0/questions/`; they do not reverify all earlier
+Codex trust and update dialogs.
+
+### Native Codex editor provenance and clipped drafts (2026-10-21)
+
+Two isolated Codex 0.163.0 captures distinguish an empty placeholder from a
+literal answer with the same text. In queued input, `Type your answer` starts
+with a dimmed cursor cell at column 2; typing that literal leaves a nondimmed
+cursor after it at column 18. Modal notes render `  › Add notes` in both states,
+with the empty dimmed cursor at column 4 and the typed cursor at column 13.
+Private question frames retain the actual cursor-cell dimming and the cell-derived
+prefix from the same completed render. Public terminal snapshots keep their shape.
+
+The native editor manually wraps text without setting xterm `isWrapped`, clips
+long prefixes even at 140×45, and omits visible glyphs for interior trailing
+spaces that still survive submission. Both queued and modal answers trim outer
+whitespace on submission: a synthetic 764-character paste was accepted as its
+760-character `trim()` result. A continuation containing an indented `›` remains
+answer text; it cannot replace the native notes start after the option block.
+
+The snapshots, source hashes, expected inputs, and native acceptance evidence are
+in `tests/fixtures/codex-0.163.0/questions/editor/`. A viewport alone cannot establish
+complete logical equality of multirow or clipped drafts. Cursor-cell style and a
+physical row prefix are partial evidence, so they must not confirm unshown answer
+text. Full-answer verification must bind an owned paste to the native accepted
+payload rather than infer missing text from the screen.
+
+## Native interactive question records (2026-10-20)
+
+Claude Code 2.1.305 exposes structured `AskUserQuestion` input in PreToolUse and
+PermissionRequest hooks. PermissionRequest can omit the native tool-use ID
+(`tool_use_id`). Direct hook answers may bypass the terminal editor. PostToolUse
+carries the accepted answers for the entire tool request. See
+[Claude question editor captures](#claude-question-editor-captures-2026-10-20)
+for the captured editor, navigation and submission behavior.
+
+Codex 0.163.0 Plan-mode
+`request_user_input` groups questions in a modal and returns one function output
+with all answers. Every question needs nonempty options; a free-text-only tool
+call was rejected before any editor appeared. None of the above plus notes
+provides free text. `request_user_input_async` immediately returns accepted:true,
+then exposes independently answerable queued questions while work continues.
+Shift+Left opens the editor. Answering one leaves the others available, with a
+committed `send_user_message_question_reply` envelope identifying the exact
+question. The editor advances to a remaining question and stays expanded, so
+Elwood remains `blocked` even while the working row continues. This status does
+not complete the original `send()` turn. Ordinary composer input is not an
+equivalent answer route. Consecutive answer echoes can contain indented `›`
+inside multiline text before the final assistant response. Only that bounded
+response makes them transcript history for empty-composer recognition; an
+uncompleted user echo or numbered native option block still holds input.
+
+Async question AgentMessage records can say phase:final_answer while work is
+still running. They are question metadata, not a final assistant reply. The
+paginated item_completed mirror uses type AgentMessage. Deduplicate these mirrors
+against the stable tool call. The native question ID encodes the call ID and
+question index. Ctrl+] locally skips the focused async question without an answer
+record; Esc from its editor can merely collapse it. Do not treat every Esc as a
+turn interruption.
+
+Queued editors after the first use `⇧→ prev question`; only the first uses
+`⇧→ main prompt`. Keep this distinction in captured and scripted navigation
+frames. If a local skip and Esc collapse coalesce into one output render, the
+smaller badge does not identify the removed question. Preserve the prior focused
+editor count until a matching remaining editor confirms that removal.