agent-coord-mcp 0.26.24 → 0.26.25

package/hooks/submit.mjs

@@ -281,6 +281,168 @@ export function readPaneState(paneText) {
   return { busy, draft, ghost, styledInputLine };
 }
 
+// ⟨q-15d763dc⟩ NO KEY REACHES A PANE UNLESS ITS READY INPUT BOX IS POSITIVELY IDENTIFIED.
+//
+// Measured 2026-09-16 on a real Claude Code pane: with the /model picker open, a push typed its
+// text and pressed Enter. The picker took the Enter, wrote ~/.claude/settings.json, closed, and
+// left an empty `❯` prompt behind, so the push reported verified:true for a message Claude never
+// received. The same Enter on a permission prompt approves a tool call, and a message's text can
+// press a dialog's numeric option keys before any Enter. Any bus writer controls that text.
+// So readiness is decided BEFORE the first keystroke, from the SHAPE of the screen, and every
+// pusher (herdr.ts, tmux-pusher.mjs, coord-pusher.mjs) asks this one function. Do not re-implement it.
+//
+// PROFILES, decided once, from THIS PROCESS's environment at start and nowhere else:
+//   claude-code (default) — the only box shape known: a ─ rule, `❯` at column 0, a ─ rule,
+//                           then at most a few footer lines at the bottom of the screen.
+//                           Measured on Claude Code v2.1.273. Any other screen is HELD.
+//   none                  — the guard is off. For a harness with no profile yet (Aider, codex,
+//                           gemini-cli, opencode). Logged at start and surfaced in capabilities.
+// An unrecognised value is NOT "none": a typo must never unguard a seat.
+export const READY_PROFILES = Object.freeze(["claude-code", "none"]);
+export function resolveReadyProfile(raw) {
+  if (raw === undefined || raw === "") return { profile: "claude-code", raw: null };
+  if (READY_PROFILES.includes(raw)) return { profile: raw, raw };
+  return { profile: "claude-code", raw, warning: `AGENT_COORD_READY_PROFILE=${JSON.stringify(raw)} is not one of ${READY_PROFILES.join(", ")} — the guard stays ON (claude-code); a typo never unguards a seat` };
+}
+// Read ONCE, at module load, from process.env. Not re-read per call, so nothing that runs later in
+// the process (a message, a bus file, a tool call setting an env var) can switch the guard off.
+const READY_PROFILE_AT_START = Object.freeze(resolveReadyProfile(process.env.AGENT_COORD_READY_PROFILE));
+export function readyProfile() {
+  return READY_PROFILE_AT_START;
+}
+
+// The start-up line a pusher or server prints about its guard. Silent when guarded and unambiguous;
+// LOUD when the guard is off or the env value was not understood, so an unguarded seat is visible.
+export function readyProfileStartupLine(who) {
+  const p = READY_PROFILE_AT_START;
+  if (p.profile === "none") return `[${who}] ⛔ READY-BOX GUARD OFF (AGENT_COORD_READY_PROFILE=none, from this process's env): pushes are typed into panes WITHOUT checking for an input box — any open dialog or permission prompt can receive message text and Enter (q-15d763dc)\n`;
+  if (p.warning) return `[${who}] ⚠ ${p.warning}\n`;
+  return null;
+}
+
+// How many lines may sit below the input box's lower rule. Claude Code draws a footer there
+// (mode line, hints); a dialog, picker or autocomplete menu draws many more.
+export const READY_BOX_MAX_BELOW = 4;
+const RULE_RE = /^─{8,}$/;
+const BOX_LINE_RE = /^❯(?:\s|$)/;
+const MAX_DRAFT_LINES = 20;
+
+// Read the screen for Claude Code's input box. Returns:
+//   { ready: true,  draft, ghost, below, above, busy } — the box is on screen; draft "" means empty
+//   { ready: false, reason, unreadable? }              — no key may be sent
+//   { ready: true,  unguarded: true }                  — profile none: the caller's legacy path
+// `screen` may be plain or styled (herdr --format ansi, tmux capture-pane -e).
+export function readReadyBox(screen, profile = READY_PROFILE_AT_START.profile) {
+  if (profile === "none") return { ready: true, unguarded: true };
+  if (profile !== "claude-code") return { ready: false, reason: `unknown ready profile ${JSON.stringify(profile)} — held` };
+  if (screen === null || screen === undefined) return { ready: false, unreadable: true, reason: "the pane could not be read — no key was sent" };
+  const styled = String(screen).replace(/\r/g, "").split("\n");
+  const plain = styled.map((l) => stripAnsi(l).replace(/ /g, " ").replace(/\s+$/, ""));
+  let end = plain.length;
+  while (end > 0 && plain[end - 1].trim() === "") end--;
+  let p = -1;
+  for (let i = end - 1; i >= 0; i--) if (plain[i].includes("❯")) { p = i; break; }
+  if (p < 0) return { ready: false, reason: "no ❯ on screen — not Claude Code's input box (another harness, a shell, or a dialog without one)" };
+  if (!BOX_LINE_RE.test(plain[p])) return { ready: false, reason: `the last ❯ on screen is not at column 0 (${JSON.stringify(plain[p].trim().slice(0, 40))}) — a dialog, picker or menu row, not the input box` };
+  if (p === 0 || !RULE_RE.test(plain[p - 1].trim())) return { ready: false, reason: "the ❯ line has no ─ rule directly above it — not the input box" };
+  let q = -1;
+  for (let i = p + 1; i < end && i <= p + MAX_DRAFT_LINES; i++) {
+    if (RULE_RE.test(plain[i].trim())) { q = i; break; }
+    if (plain[i].includes("❯")) break;
+  }
+  if (q < 0) return { ready: false, reason: "the ❯ line has no ─ rule below it — not the input box" };
+  const belowLines = plain.slice(q + 1, end).filter((l) => l.trim() !== "");
+  if (belowLines.some((l) => RULE_RE.test(l.trim()))) return { ready: false, reason: "a second ruled box below the input — a dialog or menu is open" };
+  let real = "";
+  let ghost = "";
+  for (let i = p; i < q; i++) {
+    const part = partitionStyledLine(styled[i]);
+    real += " " + stripAnsi(part.real).replace(/ /g, " ");
+    ghost += " " + part.ghost;
+  }
+  const content = squash(real.replace(/^\s*❯/, ""));
+  const placeholder = PLACEHOLDER_PATTERN();
+  const draft = placeholder && new RegExp(placeholder).test(content) ? "" : content;
+  const busyRe = BUSY_PATTERN();
+  return {
+    ready: true,
+    draft,
+    ghost: squash(ghost) || null,
+    below: belowLines.length,
+    above: plain.slice(0, p - 1),
+    busy: busyRe ? new RegExp(busyRe).test(belowLines.join("\n")) : null,
+  };
+}
+
+// May a keystroke be sent at all? Ready box, EMPTY input (typing onto someone's draft concatenates
+// with it), and nothing drawn below the footer. `null` = yes; otherwise the reason nothing was sent.
+export function refusalBeforeKeys(box) {
+  if (!box.ready) return box.reason;
+  if (box.unguarded) return null;
+  if (box.draft) return `the input box already holds unsent text (${JSON.stringify(box.draft.slice(0, 40))}) — typing would join it`;
+  if (box.below > READY_BOX_MAX_BELOW) return `${box.below} lines drawn below the input box (the footer is at most ${READY_BOX_MAX_BELOW}) — a menu or dialog is open`;
+  return null;
+}
+
+// The pushers' form of refusalBeforeKeys: a pasteAndSubmit-shaped refusal, or null to proceed.
+function heldBeforeKeys(screen, target) {
+  const box = readReadyBox(screen);
+  const refusal = refusalBeforeKeys(box);
+  if (!refusal) return null;
+  return {
+    submitted: false,
+    verified: !box.unreadable, // true: we DID read the screen, and it is not a ready input box
+    pasted: false,
+    held: true,
+    attempts: 0,
+    reason: `held, nothing pasted into pane '${target}': ${refusal}`,
+  };
+}
+
+// Did the typed payload land IN the box (and not in whatever else might have taken the keys)?
+export function boxHoldsPayload(box, payload) {
+  if (!box.ready || box.unguarded || !box.draft) return false;
+  if (isPasteChip(box.draft)) return true;
+  const needle = squash(payload);
+  if (!needle) return false;
+  const head = needle.slice(0, 32);
+  return box.draft.includes(head) || (needle.startsWith(box.draft) && box.draft.length >= 8);
+}
+
+// After Enter: the box is back and EMPTY, and the transcript's LAST user-message echo is this
+// payload and is NEW. An empty box alone proves nothing: a dialog that ate the Enter and closed
+// leaves exactly that.
+//
+// THE ECHO SHAPE, measured on a live Claude Code v2.1.273 pane that the tmux pusher had delivered
+// into: a submitted message is drawn as `❯ <first line>` at column 0, its further lines indented
+// beneath, then a blank line; a message queued behind a running turn is drawn `  ❯ <first line>`
+// just above the box. Bus renders often share a first line ("[agent-coord] +1 routine …"), so
+// "a line carrying the head appeared" cannot be a set lookup: an older identical echo would
+// satisfy it. The whole echo block (the echo and its lines up to the first blank) must differ from
+// the one the screen showed before any key was sent. Spinner and status lines never enter it.
+const ECHO_RE = /^\s{0,2}❯ /;
+function lastEchoBlock(above) {
+  const lines = above ?? [];
+  let i = lines.length - 1;
+  while (i >= 0 && !ECHO_RE.test(lines[i])) i--;
+  if (i < 0) return null;
+  const block = [lines[i]];
+  for (let j = i + 1; j < lines.length && lines[j].trim() !== "" && /^\s/.test(lines[j]); j++) block.push(lines[j]);
+  return block.map((l) => squash(l)).join("\n");
+}
+export function transcriptGained(before, after, payload) {
+  if (!after.ready || after.unguarded || after.draft) return false;
+  const now = lastEchoBlock(after.above);
+  if (now === null) return false;
+  const first = now.split("\n")[0];
+  const line = squash(String(payload ?? "").split("\n").find((l) => l.trim()) ?? "");
+  const head = line.slice(0, 24);
+  // A short payload (a control command such as /clear) must match the echo exactly, not as a substring.
+  const matches = head.length >= 8 ? first.includes(head) : line !== "" && squash(first.replace(/^❯/, "")) === line;
+  if (!PASTE_CHIP_RE.test(first) && !matches) return false;
+  return now !== lastEchoBlock(before.above);
+}
+
 // Submit a CONTROL command (/clear, /compact, /reload-skills) — the path that must actually
 // run, not merely arrive.
 //
@@ -309,11 +471,18 @@ export async function submitControl(deps, payload) {
 
   const idleBudget = CONTROL_IDLE_WAIT_MS();
   const deadline = Date.now() + idleBudget;
-  let state = readPaneState(capture());
+  let screen = capture();
+  let state = readPaneState(screen);
   while (state.busy === true && idleBudget > 0 && Date.now() < deadline) {
     await sleep(VERIFY_POLL_MS() * 5);
-    state = readPaneState(capture());
+    screen = capture();
+    state = readPaneState(screen);
   }
+  // ⟨q-15d763dc⟩ No key before the ready input box is identified, read from the SAME screen the busy
+  // and draft guards below answer from. A dialog or picker row also matches PROMPT_PATTERN, so
+  // without this it would read as a draft at best, and as an empty input at worst.
+  const box = readReadyBox(screen);
+  if (!box.ready) return heldBeforeKeys(screen, target);
   if (state.busy === true) {
     return {
       submitted: false,
@@ -347,7 +516,9 @@ export async function submitControl(deps, payload) {
         `Styled input line: ${JSON.stringify(String(state.styledInputLine ?? "").slice(0, 160))}`,
     };
   }
-  return pasteAndSubmit(deps, payload, { bracketed: false, verify: true });
+  const below = refusalBeforeKeys(box);
+  if (below) return heldBeforeKeys(screen, target);
+  return pasteAndSubmit(deps, payload, { bracketed: false, verify: true, screen });
 }
 
 // Paste a payload into the target pane and submit it.
@@ -365,10 +536,16 @@ export async function submitControl(deps, payload) {
 // dropped or refused — no retry, no receipt of failure. Control commands
 // already verified; peer traffic gets the same loop now. Pass
 // `verify:false` explicitly to opt out (unknown-TUI / test escape hatch).
-export async function pasteAndSubmit(deps, payload, { bracketed = false, verify } = {}) {
+export async function pasteAndSubmit(deps, payload, { bracketed = false, verify, screen } = {}) {
   const { run, runStdin, target, buffer } = deps;
   const doVerify = verify === undefined ? bracketed : verify;
 
+  // ⟨q-15d763dc⟩ NOTHING IS PASTED until the screen is the ready, empty input box. The paste is held
+  // as firmly as the Enter: a digit pasted into an open dialog selects one of its options.
+  // `screen` is submitControl's own guard read, so a control command costs no second capture.
+  const held = heldBeforeKeys(screen ?? captureStyled(run, target), target);
+  if (held) return held;
+
   await runStdin(["load-buffer", "-b", buffer, "-"], payload);
   const paste = run(["paste-buffer", ...(bracketed ? ["-p"] : []), "-b", buffer, "-t", target, "-d"]);
   if (paste.status !== 0) {
@@ -383,11 +560,24 @@ export async function pasteAndSubmit(deps, payload, { bracketed = false, verify
   //   false — input line readable the whole time and the payload never
   //           appeared; refuse the Enter and say so (honest timeout, not a
   //           blind CR into someone's session).
-  //   null  — no readable input line (unknown TUI / capture failed); fall back
-  //           to the legacy fixed-delay path — unknown never blocks delivery.
+  //   null  — no readable input line (capture failed, or the box went away
+  //           after the paste). ⟨q-15d763dc⟩ This used to fall back to a blind
+  //           Enter ("unknown never blocks delivery"). Unreadable now means HELD:
+  //           an Enter nobody looked before is the Enter that lands in a dialog.
   const floor = sleep(ENTER_DELAY_MS());
   const landed = await pollUntilLanded(deps, payload);
   await floor;
+  if (landed === null) {
+    return {
+      submitted: false,
+      verified: false,
+      pasted: true,
+      attempts: 0,
+      reason:
+        `pasted into pane '${target}', but its input line could not be read afterwards (capture failed, or no line matched AGENT_COORD_PROMPT_PATTERN) — Enter NOT sent ` +
+        `(an unreadable screen is held, never answered with a blind Enter; check the pane for a stranded draft)`,
+    };
+  }
   if (landed === false) {
     return {
       submitted: false,
@@ -399,17 +589,34 @@ export async function pasteAndSubmit(deps, payload, { bracketed = false, verify
         `and check the pane for a stranded draft before resending)`,
     };
   }
+  // ⟨q-15d763dc⟩ ONE Enter, sent right after the landing read saw this payload in the input. The
+  // unconditional second Enter that used to follow it (150 ms later, no screen read) is gone: it
+  // landed in whatever opened after the first (qa's FAIL on #364). A menu that swallows the first
+  // Enter is answered by the retry below, which looks at the screen before every key.
   const e1 = run(["send-keys", "-t", target, "Enter"]);
   if (e1.status !== 0) throw new Error(`tmux send-keys: ${String(e1.stderr ?? "").trim()}`);
-  await sleep(ENTER_GAP_MS());
-  run(["send-keys", "-t", target, "Enter"]);
 
   if (!doVerify) return { submitted: true, verified: false, attempts: 1 };
 
   const retries = ENTER_RETRIES();
   for (let attempt = 1; ; attempt++) {
     const outcome = await pollUntilGone(deps, payload);
-    if (outcome === false) return { submitted: true, verified: true, attempts: attempt };
+    if (outcome === false) {
+      // "The payload left the input" is only a submit if the screen is still the ready box. A
+      // picker's `❯ 2. …` row also matches PROMPT_PATTERN and reads as an emptied input.
+      const after = readReadyBox(captureStyled(run, target));
+      if (!after.ready || (!after.unguarded && after.draft)) {
+        return {
+          submitted: false,
+          verified: false,
+          attempts: attempt,
+          reason:
+            `Enter sent to pane '${target}', but the screen after it is not the ready input box ` +
+            `(${after.ready ? "the box holds other text" : after.reason}) — a dialog may have taken the Enter; not verified`,
+        };
+      }
+      return { submitted: true, verified: true, attempts: attempt };
+    }
     if (outcome === null) {
       return {
         submitted: false,
@@ -440,6 +647,17 @@ export async function pasteAndSubmit(deps, payload, { bracketed = false, verify
     // since. Under the old tail-window check this fired on EVERY successful
     // submit — three Enters into a pane that had already run the command.
     await sleep(ENTER_GAP_MS());
+    // The loop head read the input; the retry Enter also needs the screen to still BE the ready box
+    // holding this payload, or it is the key that lands in a dialog.
+    const box = readReadyBox(captureStyled(run, target));
+    if (!box.unguarded && !boxHoldsPayload(box, payload)) {
+      return {
+        submitted: false,
+        verified: false,
+        attempts: attempt,
+        reason: `retry Enter NOT sent to pane '${target}': the screen is no longer the ready box holding the command (${box.ready ? "the box changed" : box.reason})`,
+      };
+    }
     run(["send-keys", "-t", target, "Enter"]);
   }
 }

package/hooks/tier.mjs

@@ -11,6 +11,7 @@
 
 import { isGateRunner } from "./roles.mjs";
 import { replayMarker } from "./replay.mjs";
+import { neutralizeControls } from "./control-bytes.mjs";
 
 // Typed protocol record → tier (Phase 8). The prefix table below is the same
 // vocabulary parsed out of text; reading the field instead removes the parse
@@ -222,7 +223,12 @@ export function injectLine(m) {
   // is still `[tag HH:MM from] ` and the marker is part of the TEXT, which is
   // correct — it is something the reader must see, not metadata about routing.
   text = `${replayMarker(m.replay)}${text}`;
-  return `  [${tag} ${hhmm} ${m.from}] ${text}`;
+  // ⟨q-e5cb3538⟩ — LAST, over the WHOLE line, so every field that reaches a pane is covered
+  // (tag, from, text, the record type in the handle) on every push path that renders here:
+  // herdr delivery, the tmux pusher and the remote pusher. A control byte in content is a
+  // keystroke in the recipient's session; it becomes a visible escape instead. Content line
+  // feeds are kept — see hooks/control-bytes.mjs for why, and for the byte class.
+  return neutralizeControls(`  [${tag} ${hhmm} ${m.from}] ${text}`);
 }
 
 // Which room is THIS agent's project room, derived from the bus naming

package/hooks/tmux-pusher.mjs

@@ -103,7 +103,7 @@ import { isCi } from "./roles.mjs";
 import { mergeTransportMarker } from "./marker.mjs";
 import { readPushCursor, writePushCursor } from "./push-cursor.mjs";
 import { priorDeliveries, replayInfo } from "./replay.mjs";
-import { pasteAndSubmit as sharedPasteAndSubmit, submitControl as sharedSubmitControl } from "./submit.mjs";
+import { pasteAndSubmit as sharedPasteAndSubmit, submitControl as sharedSubmitControl, readyProfileStartupLine } from "./submit.mjs";
 
 const AGENT_ID = process.env.AGENT_COORD_ID;
 const TMUX_TARGET = process.env.AGENT_COORD_TMUX_TARGET;
@@ -768,6 +768,10 @@ function submitControlCommand(payload) {
 
 // Publish transport marker so list_agents can show this agent is push-capable.
 writeTransportMarker();
+{
+  const guardLine = readyProfileStartupLine("tmux-pusher");
+  if (guardLine) process.stderr.write(guardLine);
+}
 let markerCleaned = false;
 const cleanupMarker = () => {
   if (markerCleaned) return;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-coord-mcp",
-  "version": "0.26.24",
+  "version": "0.26.25",
   "description": "File-backed MCP server for coordinating multiple AI coding agents (Claude Code, Cursor, Cline, etc.). Local stdio or networked over Streamable HTTP.",
   "type": "module",
   "bin": {

package/scripts/coord-pusher.mjs

@@ -37,7 +37,7 @@
 
 import { hostname } from "node:os";
 import { spawn, spawnSync } from "node:child_process";
-import { pasteAndSubmit as sharedPasteAndSubmit, submitControl as sharedSubmitControl } from "../hooks/submit.mjs";
+import { pasteAndSubmit as sharedPasteAndSubmit, submitControl as sharedSubmitControl, readyProfileStartupLine } from "../hooks/submit.mjs";
 // The pane's parse-contract line, single-sourced — see the note above formatBatch.
 import { injectLine } from "../hooks/tier.mjs";
 import { Client } from "@modelcontextprotocol/sdk/client/index.js";
@@ -58,6 +58,10 @@ const REFRESH_MS = parseInt(argv["refresh-ms"] ?? "30000", 10);
 if (!SERVER) die("--server (or AGENT_COORD_SERVER) is required");
 if (!TOKEN) die("--token (or AGENT_COORD_TOKEN) is required");
 if (!AGENT_ID) die("--agent (or AGENT_COORD_ID) is required");
+{
+  const guardLine = readyProfileStartupLine("coord-pusher");
+  if (guardLine) process.stderr.write(guardLine);
+}
 if (!TMUX_TARGET) die("--tmux (or AGENT_COORD_TMUX_TARGET) is required");
 
 const SAFE_ID = AGENT_ID.replace(/[^a-zA-Z0-9._-]/g, "_");

package/src/capabilities.ts

@@ -33,25 +33,39 @@
  * Probes call behaviour. The version travels beside the answer as CONTEXT and
  * is labelled as such.
  */
+import { mkdtempSync, writeFileSync, rmSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
 import { prRefsIn } from "./tools/record-events.js";
 import { EVENT_KIND_IDS } from "./tools/event-kinds.js";
 import { suggestRecordType, typedRecordMode } from "./typed-records.js";
 import { LEAD_REFUSED, PARKED_CATEGORIES } from "./tools/away.js";
 import { recordAuthorityFor } from "./roles.js";
+// ⟨q-e5cb3538⟩ The renderer and the byte class live in hooks/, shared with both pushers.
+// @ts-expect-error — untyped .mjs sibling, deliberately not duplicated in TS
+import { injectLine } from "../hooks/tier.mjs";
+// @ts-expect-error — untyped .mjs sibling, deliberately not duplicated in TS
+import { findControlByte } from "../hooks/control-bytes.mjs";
+// ⟨q-15d763dc⟩ The ready-box guard's profile, as this process read it from its own env at start.
+// @ts-expect-error — untyped .mjs sibling, deliberately not duplicated in TS
+import { readyProfile } from "../hooks/submit.mjs";
 import { subscriptionHealth } from "./tools/events.js";
 import {
   configuredTransport,
   runningTransport,
   isTmuxKind,
   targetOf,
+  herdrMarkerPid,
   type TransportKind,
 } from "./transports/index.js";
-import { readAllTransportMarkers } from "./tools/registry.js";
+import { readAllTransportMarkers, markerHoldsLiveProcess } from "./tools/registry.js";
 import { queueWriteSchema } from "./tools/queue-write.js";
 import { treeProvenance } from "./tools/tree-provenance.js";
 import { detectSpread } from "./server-spread.js";
+import { answeringServerIdentity } from "./tools/registry.js";
 import { HerdrTransport, herdrKeyName } from "./transports/herdr.js";
 import { tickVerdict } from "./tools/tick.js";
+import { ensureHerdrTail, herdrTailState, newMessagesIn, stopHerdrTail } from "./tools/herdr-tail.js";
 import { HERDR, TICK_READS_AS, TICK_STORED_AS, type TickState } from "./transports/types.js";
 
 export type ProbeResult = {
@@ -302,6 +316,39 @@ const PROBES: Probe[] = [
       return { present, evidence: `"⛔ Blocked — was 🚧 …" in flight: ${blocked} (0.26.21 said true) · "🔍 In Review": ${review} -> present=${present}` };
     },
   },
+  {
+    // ⛔ A HERDR SEAT'S OWN SERVER TAILS ITS INBOX. The first version of this probe checked
+    // `typeof startHerdrTail === "function"` — which read PRESENT on six seats while the tail ran
+    // on none, the exact lie this verb exists to refuse. It now STARTS a tail against a scripted
+    // herdr transport and asserts the process registry reports it running, is idempotent on a
+    // second bind, and reports it gone after a stop — plus the line reader's byte offsets, which
+    // are what stop a later held message being skipped. Runtime truth for THIS seat is reported
+    // separately, under `herdrTail`, because a probe answers "can this build" and not "is it".
+    id: "herdr-inbox-tail",
+    since: "0.26.25",
+    run: () => {
+      const probeId = `__probe-herdr-tail-${process.pid}`;
+      const scripted = { kind: HERDR } as unknown as Parameters<typeof ensureHerdrTail>[1] extends infer O ? O extends { transport?: infer T } ? T : never : never;
+      const dir = mkdtempSync(path.join(tmpdir(), "probe-tail-"));
+      try {
+        const first = ensureHerdrTail(probeId, { transport: scripted, pollMs: 3_600_000, tail: async () => ({ delivered: [], held: [] }) });
+        const again = ensureHerdrTail(probeId, { transport: scripted, pollMs: 3_600_000, tail: async () => ({ delivered: [], held: [] }) });
+        const seen = herdrTailState().some((s) => s.agentId === probeId && s.running);
+        const stopped = stopHerdrTail(probeId);
+        const gone = !herdrTailState().some((s) => s.agentId === probeId);
+        const f = path.join(dir, "inbox.jsonl");
+        const a = `${JSON.stringify({ id: "a" })}\n`;
+        writeFileSync(f, `${a}${JSON.stringify({ id: "b" })}\n{"id":"hal`);
+        const read = newMessagesIn(f, 0);
+        const offsets = read.map((m) => m.end).join(",") === `${Buffer.byteLength(a)},${Buffer.byteLength(a) + Buffer.byteLength(`${JSON.stringify({ id: "b" })}\n`)}`;
+        const present = first.started && !again.started && again.running && seen && stopped && gone && read.length === 2 && offsets;
+        return { present, evidence: `ensureHerdrTail started=${first.started} · second bind started=${again.started} running=${again.running} · registry running=${seen} · stop=${stopped} gone=${gone} · reader ${read.length} whole lines with exact end offsets=${offsets} -> present=${present}` };
+      } finally {
+        stopHerdrTail(probeId);
+        rmSync(dir, { recursive: true, force: true });
+      }
+    },
+  },
   {
     // ⟨q-1c95f7d4⟩ Phase 5.4 Task 5 — the external tick, probed by CALLING the code that
     // decides what a reading MEANS (every probe here is synchronous, so the async read is
@@ -342,6 +389,72 @@ const PROBES: Probe[] = [
       return { present, evidence: `HerdrTransport.kind=${scripted.kind} · scripted pane_not_found -> paneExists=${exists} · herdrKeyName("C-u").ok=${key.ok} -> present=${present}` };
     },
   },
+  {
+    // ⟨q-e5cb3538⟩ (0.26.25) — a control byte in message content never reaches a pane as a
+    // keystroke: the renderer every push path uses shows it as a visible escape, and a new send
+    // carrying one is refused at ingress. Measured on qa's payload (CR, ESC[201~, ETX) plus DEL
+    // and C1, rendered through THIS process's hooks — a seat whose server predates the fix answers
+    // false here, which is the question a release is delivered by.
+    id: "pane-render-neutralizes-controls",
+    since: "0.26.25",
+    run: () => {
+      const body = "X1\rX2\x1b[201~X3\x03X4\x7f\u0085";
+      const line = String(injectLine({ ts: 0, tag: "DM", from: "probe", text: body }));
+      const leaked = (line.match(/[\x00-\x09\x0b-\x1f\x7f\u0080-\u009f]/g) ?? []).length;
+      const visible = line.includes("X1\\rX2\\x1b[201~X3\\x03X4\\x7f\\u0085");
+      const refused = findControlByte({ text: body }) !== null && findControlByte({ text: "ok\n\tok" }) === null;
+      const present = leaked === 0 && visible && refused;
+      return { present, evidence: `rendered qa's payload + DEL + C1 -> leaked ${leaked} control byte(s) · escapes visible=${visible} · ingress refuses it and passes LF/TAB=${refused} -> present=${present}` };
+    },
+  },
+  {
+    // ⟨q-abd88dd4⟩ — a herdr marker's pid is chosen for the pre-herdr readers that cannot be
+    // patched: 1 only where this process may not signal pid 1 (EPERM), 0 otherwise, and this
+    // build never reads it as a process. Both functions are new in 0.26.25.
+    id: "herdr-marker-survives-pre-herdr-readers",
+    since: "0.26.25",
+    run: () => {
+      const eperm = () => { const e = new Error("EPERM") as NodeJS.ErrnoException; e.code = "EPERM"; throw e; };
+      const notSignalable = herdrMarkerPid(eperm).pid;
+      const signalable = herdrMarkerPid(() => true).pid;
+      const holds = markerHoldsLiveProcess({ agentId: "probe", transport: HERDR, pid: 1, since: 0 });
+      const present = notSignalable === 1 && signalable === 0 && holds === false;
+      return { present, evidence: `kill(1,0) EPERM -> pid ${notSignalable} · kill(1,0) permitted (root/container) -> pid ${signalable} · herdr marker pid 1 holds a live process: ${holds} -> present=${present}` };
+    },
+  },
+  {
+    // ⟨q-3cd5a77d⟩ — the result word counts only in the CLAIM position. A seat on an older server
+    // reads the #359 routing header (PASS in the PR title) as the coordinator gating it PASS.
+    id: "gate-claim-needs-claim-position",
+    since: "0.26.25",
+    run: () => {
+      const sha = "0826519e043add993c5d757908c1903239542160";
+      const line = (text: string) => JSON.stringify({ ts: 1, from: "probe", text, record: { type: "go", payload: {}, cites: [{ kind: "pr", ref: "#359" }] } });
+      const routing = gateClaimsIn(line(`GATE, prioritised: #359 (test-all prints PASS after FAILED) @ ${sha}`), "359", sha).length;
+      const typed = gateClaimsIn(line(`QA GATE — **PASS** @ \`${sha}\``), "359", sha).length;
+      const present = routing === 0 && typed === 1;
+      return { present, evidence: `routing header with PASS in the title -> ${routing} claim(s) · typed QA GATE — **PASS** @ sha -> ${typed} -> present=${present}` };
+    },
+  },
+  {
+    // ⟨q-18a719c5⟩ The spread can place a seat at all: the identity THIS server stamps names its
+    // module (resolved by package name, through the real caller in dist/tools/registry.js), a
+    // stamp whose pid is gone reads unknown, and unknowns block AGREED but not DIVERGED. Before
+    // 0.26.25 the module resolved to undefined on every server.
+    id: "server-spread-places-seats",
+    since: "0.26.25",
+    run: () => {
+      const me = answeringServerIdentity();
+      const installed = typeof me.serverModule === "string" ? { mtime: 1_000, module: me.serverModule } : null;
+      const seat = (agentId: string, startedAt: number, pid = 101) => ({ agentId, serverPid: pid, serverStartedAt: startedAt, serverModule: me.serverModule });
+      const alive = (pid: number) => pid !== 999;
+      const stale = installed ? detectSpread([seat("gone", 2_000, 999), seat("b", 3_000)], installed, { isRunning: alive }) : null;
+      const split = installed ? detectSpread([seat("old", 500), seat("new", 3_000), { agentId: "mute" }], installed, { isRunning: alive }) : null;
+      const staleUnknown = !!stale?.uncomparable.some((u) => u.agentId === "gone" && /no longer running/.test(u.why));
+      const present = typeof me.serverModule === "string" && staleUnknown && split?.state === "DIVERGED";
+      return { present, evidence: `module ${me.serverModule ?? "UNRESOLVED"} · dead stamp -> unknown: ${staleUnknown} · split + unstamped seat -> ${split?.state ?? "n/a"} -> present=${present}` };
+    },
+  },
   {
     id: "record-authority",
     since: "0.24.0",
@@ -524,7 +637,7 @@ export function probeCapabilities(context: { module: string; versionLabel: strin
 
 import { resolveServerIdentity } from "./server-identity.js";
 import { seatBuildOf, installedFrom, psReader, type SeatBuild } from "./tools/seat-build.js";
-import { isInFlightStatus } from "./tools/stall.js";
+import { isInFlightStatus, gateClaimsIn } from "./tools/stall.js";
 import { parseWorkDoc, queueItemsOf, stampQueueIds } from "@davidbalzan/groundwork-seam";
 
 export const capabilitiesSchema = {} as const;
@@ -609,11 +722,24 @@ export async function seatBuilds(): Promise<{ installed: { module: string; hookP
   };
 }
 
+/**
+ * ⟨q-15d763dc⟩ Is THIS process's pane push guarded? `guarded:false` means AGENT_COORD_READY_PROFILE=none
+ * was set in this server's env at start: its pushes type into panes without checking for Claude
+ * Code's input box. Stated here so an unguarded seat is visible fleet-wide, not only in a log.
+ */
+function readyBoxState(): { profile: string; guarded: boolean; source: string; warning?: string } {
+  const p = readyProfile() as { profile: string; raw: string | null; warning?: string };
+  return { profile: p.profile, guarded: p.profile !== "none", source: "AGENT_COORD_READY_PROFILE in this process's env at start (never a message or the bus dir)", ...(p.warning ? { warning: p.warning } : {}) };
+}
+
 export async function capabilitiesTool() {
   const id = resolveServerIdentity();
   const report = probeCapabilities({ module: id.path, versionLabel: id.version });
   try {
-    return { ...report, transport: await probeTransport(), seats: await seatBuilds() };
+    // ⭐ `herdrTail` is RUNTIME truth for this process — the tails actually ticking here — kept apart
+    // from the build probe on purpose, because "this build can tail" and "this seat is tailing"
+    // are different facts and the first version of #353 reported the first as the second.
+    return { ...report, transport: await probeTransport(), herdrTail: herdrTailState(), readyBox: readyBoxState(), seats: await seatBuilds() };
   } catch (e) {
     // A THROWN TRANSPORT PROBE IS NOT A BROKEN VERB. An unknown configured value
     // refuses at startup by design, and this verb is exactly what an operator

package/src/gated-head.ts

@@ -233,8 +233,19 @@ export function gatedBy(verdicts: PassVerdict[], head: string, mergedAt: number
  * so the experiment CONFIRMS the false mechanism — whoever ran it would conclude they had
  * removed something load-bearing and got away with it. If you are removing it, the thing
  * to check is `DECLARES`, not this.
+ *
+ * ⛔ ⟨q-3cd5a77d⟩ THE RESULT WORD MUST STAND IN THE CLAIM POSITION — right after the opener, past
+ * only separators (`:` `—` `–` `-`, spaces) and an optional `**`. The first version accepted PASS or
+ * FAIL ANYWHERE before the `@`, so a ROUTING header read as a verdict:
+ *     `GATE, prioritised: #359 (⟨q-3605ede3⟩, test-all prints PASS after FAILED) @ 0826519e…`
+ * — the word was in the PR's TITLE. Bus history is permanent, so that one DM (11:19:43Z) turned
+ * `verdict-names-gater`'s live-population test red on every chain on the machine, and made
+ * `stall_check` report #359 as `reported-unscribed` with the COORDINATOR claiming PASS at its head.
+ * Measured before the change, old vs new over 126 real lines (the 61-line verdict corpus + every
+ * distinct line the old form matched on the live bus and in kit PR comments): they differ on
+ * exactly that routing line, and agree — result word and sha — on the other 125.
  */
-export const VERDICT_COMMENT = /^(?:QA GATE|\*\*GATE|GATE)\b[^\n]*?\b(PASS|FAIL)\b(?:\s*\([^)\n]*\))?[^\n]*?@\s*`?([0-9a-f]{7,40})`?/;
+export const VERDICT_COMMENT = /^(?:QA GATE|\*\*GATE|GATE)\b[\s:—–-]*(?:\*\*\s*)?(PASS|FAIL)\b[^\n]*?@\s*`?([0-9a-f]{7,40})`?/;
 
 /**
  * WHAT MAKES A VERDICT BINDING, expressed as a shape instead of a phrase: a