agent-coord-mcp 0.26.24 → 0.26.25

package/src/tools/records.ts

@@ -45,7 +45,7 @@ import { verdictsFor, gatedBy, prVerdictsIn } from "../gated-head.js";
 import { boardRefFor, classifyBoardRef } from "./board-ref.js";
 import { haltState } from "./stall.js";
 import { readSubs, evaluate, commitEvaluation, eventIsDerived, type RecordEvent } from "./events.js";
-import { prRefsIn } from "./record-events.js";
+import { prRefsIn, leadingItemIdOf } from "./record-events.js";
 
 const QUEUE_DOC = "docs/QUEUE.md";
 const DONE_DOC = "docs/DONE.md";
@@ -1199,7 +1199,23 @@ export async function landTool(
     }
   }
 
-  const already = doneEntriesOf(d.doc).some((e) => new RegExp(`#${n}\\b`).test(String(e.ref ?? "")));
+  /*
+   * ⛔ ⟨q-552b9912⟩ "ALREADY LOGGED" IS A QUESTION ABOUT THE ITEM, NOT THE PR.
+   *
+   * It asked whether ANY DONE entry cited this PR, so the second item a PR closed found the first item's entry,
+   * reported `alreadyLogged: true`, and wrote nothing: the row left the queue and never reached the delivery record,
+   * so `scan_record_events` emitted no item event for it. Measured twice on 2026-09-16 — ⟨q-3b8e05af⟩ on #360 and
+   * ⟨q-144c97a8⟩ on #366, both hand-repaired (07338a1, 00c8315).
+   *
+   * Keyed per item BY POSITION ONLY: an entry is this item's when it LEADS with `⟨id⟩` (the form this verb writes). A
+   * by-mention fallback was tried and REMOVED (qa's FAIL on #370 @ fce3ae1): an id-less entry for this PR that merely
+   * MENTIONS the id — B never landed — read as logged and wrote nothing, the same defect narrowed. A mention is not a
+   * record. A land with no item keeps the PR key, since there is no item to key on.
+   */
+  const citesThisPr = (e: { ref?: string }) => new RegExp(`#${n}\\b`).test(String(e.ref ?? ""));
+  const already = target
+    ? doneEntriesOf(d.doc).some((e) => leadingItemIdOf(e.text) === target.id)
+    : doneEntriesOf(d.doc).some(citesThisPr);
 
   // A DONE LINE A HUMAN WOULD NOT HAVE WRITTEN IS NOT A DONE LINE.
   //

package/src/tools/registry.ts

@@ -6,7 +6,7 @@ import { existsSync, openSync, statSync, watch } from "node:fs";
 import { promises as fsp } from "node:fs";
 import { spawn, spawnSync } from "node:child_process";
 import { fileURLToPath } from "node:url";
-import { detectSpread, installedBuild } from "../server-spread.js";
+import { detectSpread, installedBuild, pidRunning } from "../server-spread.js";
 import { z } from "zod";
 import path from "node:path";
 import {
@@ -161,6 +161,9 @@ export async function registerTool(args: {
       registeredAt: existing?.registeredAt ?? now,
       lastHeartbeat: now,
       capabilities: existing?.capabilities,
+      // ⟨q-18a719c5⟩ The entry is rebuilt here, so the stamp is rebuilt with it — from the
+      // server answering THIS register, which is the one serving the seat now.
+      ...answeringServerIdentity(),
       // Omitted → carried forward untouched. Only an explicit `false` revokes.
       ...(args.proseOnly === undefined
         ? existing?.proseOnly
@@ -285,6 +288,39 @@ export async function quitTool(args: { agentId: string }): Promise<never> {
 
 export const heartbeatSchema = { agentId: z.string().min(1) };
 
+/**
+ * ⟨q-18a719c5⟩ THE ANSWERING SERVER'S IDENTITY — what `serverSpread` places a seat by. It exists
+ * only inside the process that serves the seat, so every path on which a session binds an
+ * identity stamps it: `register` (which `join` calls), the first-claim binding in server.ts
+ * (a server that restarts and re-binds through any gated tool, `attach_agent` included),
+ * `rename_agent` (the renaming session serves the new id), and `heartbeat`. Before this,
+ * only `heartbeat` stamped, no code path called it, and `register` rebuilt the entry and
+ * dropped whatever it had written.
+ */
+export function answeringServerIdentity(): { serverPid: number; serverStartedAt: number; serverModule?: string } {
+  return {
+    serverPid: process.pid,
+    // Derived from uptime rather than read from a file: an mtime tracks writes (a reinstall of
+    // identical bytes moves it) while uptime is a fact about THIS process.
+    serverStartedAt: Date.now() - Math.round(process.uptime() * 1000),
+    // WHAT this process is executing, not what it is labelled. Resolved from this module's own
+    // URL, so a server running a dev `dist/` says so instead of inheriting the installed path.
+    serverModule: installedBuild(import.meta.url, statSync)?.module,
+  };
+}
+
+/** Stamp an EXISTING registry entry with the answering server's identity. False when absent. */
+export async function stampServerIdentity(agentId: string): Promise<boolean> {
+  let stamped = false;
+  await updateJson<AgentRegistry>(AGENTS_FILE, {}, (current) => {
+    if (!current[agentId]) return current;
+    Object.assign(current[agentId], answeringServerIdentity());
+    stamped = true;
+    return current;
+  });
+  return stamped;
+}
+
 export async function heartbeatTool(args: { agentId: string }) {
   let missing = false;
   await updateJson<AgentRegistry>(AGENTS_FILE, {}, (current) => {
@@ -293,23 +329,8 @@ export async function heartbeatTool(args: { agentId: string }) {
       return current;
     }
     current[args.agentId].lastHeartbeat = Date.now();
-    /*
-     * ⛔ STAMP THE ANSWERING PROCESS — `⟨q-cec42e20⟩`. This runs INSIDE the server that
-     * is answering, which is the only place these two facts exist: `capabilities`
-     * reports them solely to its own caller, and no seat can query another seat's
-     * server at all. Publishing them here is what makes a cross-seat comparison
-     * possible without every seat having to volunteer it in prose.
-     *
-     * `startedAt` is derived from uptime rather than read from a file: an mtime tracks
-     * writes (a reinstall of identical bytes moves it) while uptime is a fact about
-     * THIS process.
-     */
-    current[args.agentId].serverPid = process.pid;
-    current[args.agentId].serverStartedAt = Date.now() - Math.round(process.uptime() * 1000);
-    // ⛔ WHAT this process is executing, not what it is labelled. Resolved from this
-    // module's own URL, so a server running a dev `dist/` says so instead of inheriting
-    // the installed path — the case that made a 3-build fleet read AGREED.
-    current[args.agentId].serverModule = installedBuild(import.meta.url, statSync)?.module;
+    // ⛔ STAMP THE ANSWERING PROCESS — `⟨q-cec42e20⟩`; see `answeringServerIdentity`.
+    Object.assign(current[args.agentId], answeringServerIdentity());
     return current;
   });
   if (missing) return { ok: false, error: `agent '${args.agentId}' not registered` };
@@ -464,6 +485,8 @@ export async function listAgentsTool() {
         serverModule: a.serverModule,
       })),
     installedBuild(import.meta.url, statSync),
+    // ⟨q-18a719c5⟩ a stamp whose server is gone reads unknown: ask the kernel, here, in production.
+    { isRunning: pidRunning },
   );
 
   // ⟨q-178878aa⟩ — the humans the bus knows: visible here, read at send time, never evicted.
@@ -541,6 +564,18 @@ export function isMarkerLive(marker: TransportMarker, reg: AgentRegistry, now: n
   return isPidAlive(marker.pid);
 }
 
+/**
+ * ⟨q-abd88dd4⟩ Does this marker hold a LIVE LOCAL PROCESS — a pusher someone could signal, or
+ * wait on? A herdr marker never does: it has no pusher, and its `pid` is addressed to pre-herdr
+ * readers (pid 1, see `herdrMarkerPid`), so reading it as a process would make pid 1 look like a
+ * running pusher. Every pid-as-process decision about a marker goes through here; liveness of a
+ * herdr seat is `isMarkerLive`, which asks herdr for the pane.
+ */
+export function markerHoldsLiveProcess(marker: TransportMarker | null | undefined): boolean {
+  if (!marker || marker.transport === HERDR) return false;
+  return isPidAlive(marker.pid);
+}
+
 export function isPidAlive(pid: number): boolean {
   if (!pid || pid <= 0) return false;
   try {
@@ -682,7 +717,7 @@ export async function renameAgentTool(args: { agentId: string; newAgentId: strin
   // must re-attach under the new id (join/attach_agent) to restore push.
   const liveTransport = await readJson<TransportMarker | null>(transportFile(oldId), null);
   let detachedTransport = false;
-  if (liveTransport && isPidAlive(liveTransport.pid)) {
+  if (markerHoldsLiveProcess(liveTransport)) {
     await detachAgentTool({ agentId: oldId });
     detachedTransport = true;
   }
@@ -690,7 +725,8 @@ export async function renameAgentTool(args: { agentId: string; newAgentId: strin
   // Registry: move the entry under the new key.
   await updateJson<AgentRegistry>(AGENTS_FILE, {}, (current) => {
     if (current[oldId]) {
-      current[newId] = { ...current[oldId], agentId: newId };
+      // ⟨q-18a719c5⟩ The renaming session serves the new id, so the stamp is re-taken from it.
+      current[newId] = { ...current[oldId], agentId: newId, ...answeringServerIdentity() };
       delete current[oldId];
     }
     return current;

package/src/tools/transport.ts

@@ -1,4 +1,4 @@
-import { loadLiveTransports, isMarkerLive, isPidAlive } from "./registry.js";
+import { loadLiveTransports, isMarkerLive, isPidAlive, markerHoldsLiveProcess } from "./registry.js";
 import {
   TMUX_PUSH,
   registerTmuxHost,
@@ -685,7 +685,8 @@ export async function attachAgentTool(args: {
       agentId: args.agentId,
       transport: HERDR,
       target: marker.target,
-      pid: 0,
+      pid: marker.pid,
+      pidWhy: marker.pidWhy,
       rooms: marker.rooms,
       note: "herdr socket transport: no pusher process — delivery is made in-process by this server through herdr's socket API; liveness is herdr's own pane status",
     };
@@ -711,10 +712,10 @@ export async function attachAgentTool(args: {
 
   // If something's already attached, refuse rather than spawn a second pusher.
   const existing = await readJson<TransportMarker | null>(transportFile(args.agentId), null);
-  if (existing && isPidAlive(existing.pid)) {
+  if (markerHoldsLiveProcess(existing)) {
     return {
       ok: false,
-      error: `agent '${args.agentId}' already has a live ${existing.transport} attached (pid ${existing.pid}). Call detach_agent first.`,
+      error: `agent '${args.agentId}' already has a live ${existing!.transport} attached (pid ${existing!.pid}). Call detach_agent first.`,
       existing,
     };
   }

package/src/transports/herdr.ts

@@ -36,6 +36,16 @@
 import { spawnSync } from "node:child_process";
 import type { ControlCommand, Liveness, Transport, TransportKind, TransportMarker, TickReading, TickState } from "./types.js";
 import { HERDR, TICK_READS_AS, TICK_STORED_AS, targetOf } from "./types.js";
+// ⟨q-dc83023a⟩ The chip grammar and the pane-unsafe byte class are single-sourced in hooks/, shared
+// with both pushers. `hooks/` ships beside `dist/`, so these resolve the same when installed.
+// @ts-expect-error — untyped .mjs sibling, deliberately not duplicated in TS
+import { PASTE_CHIP_RE, readReadyBox, readyProfile, refusalBeforeKeys, boxHoldsPayload, transcriptGained } from "../../hooks/submit.mjs";
+// @ts-expect-error — untyped .mjs sibling, deliberately not duplicated in TS
+import { neutralizeControls } from "../../hooks/control-bytes.mjs";
+
+/** Bracketed-paste markers (xterm mode 2004), which Claude Code and tmux `paste-buffer -p` both speak. */
+export const PASTE_START = "\x1b[200~";
+export const PASTE_END = "\x1b[201~";
 
 export type HerdrError = { code: string; message: string };
 export type HerdrResult = {
@@ -118,6 +128,20 @@ function processInfoOf(r: HerdrResult): ProcessInfo | undefined {
 }
 const LIVE_STATUSES = new Set(["idle", "working", "blocked", "done"]);
 
+/**
+ * ⟨q-15d763dc⟩ What a push did, so a caller can tell a message that is safe to try again from one
+ * that may already be sitting in the pane:
+ *   delivered         — verified: the ready box took it and the transcript shows it. The ONLY
+ *                       outcome a cursor may advance on.
+ *   held              — NO key was sent (no ready box, a draft, a menu, or the pane unreadable).
+ *                       Safe to retry.
+ *   typed-unconfirmed — the text was typed but did not show in the box; Enter was NOT sent.
+ *   pending           — the text is still in the box after every Enter.
+ *   unverified        — Enter was sent and the screen after it does not prove submission.
+ */
+export type PushOutcome = "delivered" | "held" | "typed-unconfirmed" | "pending" | "unverified";
+export type HerdrPushResult = { delivered: boolean; verified?: boolean; outcome?: PushOutcome; safeToRetry?: boolean; error?: string; enters?: number; unguarded?: boolean; busy?: boolean };
+
 export type HerdrTransportOptions = {
   run?: HerdrRunner;
   /** Milliseconds to wait before reading a pane back after typing. */
@@ -126,14 +150,75 @@ export type HerdrTransportOptions = {
   sleep?: (ms: number) => void;
   /** Lines of pane to read back when verifying a delivery. */
   readLines?: number;
+  /** Injectable marker-pid decision (tests); defaults to asking the kernel about pid 1. */
+  markerPid?: () => HerdrMarkerPid;
+  /**
+   * The environment `attach` reads its default pane from. Injectable because it is AMBIENT
+   * PROCESS STATE, and ambient state is the one input an injected runner does not cover.
+   *
+   * ⛔ MEASURED 2026-09-16, the day seats moved onto herdr: the attach test injected a scripted
+   * runner and still read the REAL `process.env.HERDR_PANE_ID`. Outside herdr the variable was
+   * absent and the test passed; inside a herdr pane it resolved to the gater's own pane
+   * (`wA6:p1`), the scripted runner had never heard of it, and the suite went red on every
+   * herdr-hosted tree for a reason unrelated to any diff. Stripping `HERDR_PANE_ID` alone — one
+   * variable at a time, six others left in place — was what turned it green.
+   */
+  env?: Record<string, string | undefined>;
 };
 
+/**
+ * ⟨q-abd88dd4⟩ — THE PID A HERDR MARKER CARRIES, chosen for the readers that CANNOT be patched.
+ *
+ * A herdr seat has no pusher, so its marker used to carry pid 0. Every server build from before
+ * the herdr transport (0.19.1, kit 0.26.19, published 0.26.22 — reproduced in a throwaway bus
+ * against each) decides marker liveness as `isPidAlive(marker.pid)` for everything but
+ * `tmux-push-remote`, and `isPidAlive(0)` is false, so ONE ordinary read (`list_agents`,
+ * `status`, `stall_check`, `send_command`) DELETES the marker. A mixed-build fleet deafens its
+ * herdr seats as a side effect of looking at the roster.
+ *
+ * pid 1 is kept by all three: it always exists, so `isPidAlive(1)` is true. Their signal paths,
+ * enumerated by qa across all three on its gate: kit 0.26.19 and published 0.26.22 gate
+ * `detach_agent`'s SIGTERM on `isPusherProcess(marker.pid)`, which reads the process COMMAND, so they
+ * never signal launchd whatever uid they run as. Only 0.19.1's detach is unguarded (`isPidAlive`
+ * then `process.kill(marker.pid, "SIGTERM")`, reachable from `detach_agent`, `unregister` and
+ * `rename_agent`), and it enforces identity, so its caller must be bound as that herdr seat. As a
+ * non-root process that kill gets EPERM — measured `killed:false`, launchd untouched. The seat's own
+ * server pid would have been kept by all three as well, and 0.19.1's unguarded detach would have
+ * SIGTERMed that seat's MCP server; that shape is rejected.
+ *
+ * ⛔ SO pid 1 IS WRITTEN ONLY WHEN THIS PROCESS COULD NOT SIGNAL IT, asked of the kernel with
+ * signal 0 rather than inferred from a uid: as root, or in a container where pid 1 is our own
+ * user's process (often the server itself), `kill(1, 0)` succeeds and an old reader running
+ * alongside could SIGTERM init. There the marker falls back to pid 0 and says why — an old
+ * reader then deletes it, which is deafness, and deafness is recoverable where a signal to init
+ * is not. RESIDUAL, stated as narrowly as it is: a 0.19.1-era server, running as ROOT, bound as
+ * the herdr seat's OWN identity, calling detach, unregister or rename, reaches init. Nothing a
+ * marker says can remove a privilege its reader holds.
+ *
+ * The CURRENT build never reads this pid as liveness: a herdr marker is live exactly when herdr
+ * says its pane exists (`isMarkerLive`), and nothing signals it (`detach_agent` removes the
+ * marker, `markerHoldsLiveProcess` answers false).
+ */
+export type HerdrMarkerPid = { pid: 0 | 1; why: string };
+export function herdrMarkerPid(kill: (pid: number, signal: 0) => unknown = (p, s) => process.kill(p, s)): HerdrMarkerPid {
+  try {
+    kill(1, 0);
+    return { pid: 0, why: "this process may signal pid 1 (root, or a container whose pid 1 is ours), so pid 1 is not safe to advertise; pre-herdr readers will reap this marker" };
+  } catch (e) {
+    const code = (e as NodeJS.ErrnoException).code;
+    if (code === "EPERM") return { pid: 1, why: "pid 1 exists and this process may not signal it, so pre-herdr readers keep the marker and their detach cannot signal it" };
+    return { pid: 0, why: `kill(1, 0) answered ${code ?? "an unexpected error"}, not EPERM — pid 1 not advertised` };
+  }
+}
+
 export class HerdrTransport implements Transport {
   readonly kind: TransportKind = HERDR;
   #run: HerdrRunner;
   #settleMs: number;
   #sleep: (ms: number) => void;
   #readLines: number;
+  #markerPid: () => HerdrMarkerPid;
+  #env: Record<string, string | undefined>;
 
   constructor(opts: HerdrTransportOptions = {}) {
     this.#run = opts.run ?? defaultHerdrRunner;
@@ -143,7 +228,9 @@ export class HerdrTransport implements Transport {
     // the spike measured is Claude's input box; the retry exists for that, bounded to one.
     this.#settleMs = opts.settleMs ?? 400;
     this.#sleep = opts.sleep ?? ((ms) => { const end = Date.now() + ms; while (Date.now() < end) { /* spin: tiny and rare */ } });
-    this.#readLines = opts.readLines ?? 12;
+    this.#readLines = opts.readLines ?? 40;
+    this.#markerPid = opts.markerPid ?? (() => herdrMarkerPid());
+    this.#env = opts.env ?? process.env;
   }
 
   /** Is herdr on this host AND is its server running? Both, or the reason. */
@@ -168,7 +255,7 @@ export class HerdrTransport implements Transport {
   async attach(args: { agentId: string; target?: string; includeRoom?: boolean; allowlist?: string[]; debounceMs?: number }): Promise<TransportMarker> {
     const avail = this.availability();
     if (!avail.available) throw new Error(`herdr transport cannot attach '${args.agentId}': ${avail.reason}`);
-    let target = args.target ?? process.env.HERDR_PANE_ID;
+    let target = args.target ?? this.#env.HERDR_PANE_ID;
     if (!target) {
       const cur = this.#run(["pane", "current"]);
       target = paneOf(cur)?.pane_id;
@@ -178,10 +265,12 @@ export class HerdrTransport implements Transport {
     }
     const got = this.#run(["pane", "get", target]);
     if (!got.ok) throw new Error(`herdr pane '${target}' not found: ${got.error?.message ?? got.stderr}`);
+    const markerPid = this.#markerPid();
     return {
       agentId: args.agentId,
       transport: HERDR,
-      pid: 0,
+      pid: markerPid.pid,
+      pidWhy: markerPid.why,
       target,
       tmuxTarget: target,
       since: Date.now(),
@@ -203,40 +292,108 @@ export class HerdrTransport implements Transport {
    * Type `text` into the pane and press enter; VERIFY by reading the pane back, and if
    * the line is still sitting unsubmitted (the spike's race), press enter once more.
    * Reports the enters it took so the race is measured on every delivery.
+   *
+   * ⟨q-dc83023a⟩ A DELIVERY IS A BRACKETED PASTE BY DEFAULT. `send-text` types keystrokes and
+   * herdr writes them in 1022-byte chunks; Claude Code v2.1.273 folds each large chunk into a
+   * `[Pasted text #N]` chip and, on submit, KEPT ONLY THE LAST CHUNK — a 2668-byte message
+   * arrived as its final 624 bytes, the PR, sha and gate gone. Wrapped in paste markers, the
+   * same bytes arrived whole (measured at 2668 B, 5 KB multi-line and 20 KB). The body is
+   * neutralised first so it can never carry the closing marker itself (⟨q-e5cb3538⟩).
+   * `paste: false` is for control commands only: a slash command must arrive as typing.
    */
-  async push(marker: TransportMarker, text: string): Promise<{ delivered: boolean; error?: string; enters?: number; verified?: boolean }> {
+  async push(marker: TransportMarker, text: string, opts: { paste?: boolean } = {}): Promise<HerdrPushResult> {
     const avail = this.availability();
-    if (!avail.available) return { delivered: false, error: avail.reason };
+    if (!avail.available) return { delivered: false, outcome: "held", safeToRetry: true, error: avail.reason };
     const target = targetOf(marker);
-    if (!target) return { delivered: false, error: "no target recorded on the marker" };
-    const typed = this.#run(["pane", "send-text", target, text]);
-    if (!typed.ok) return { delivered: false, error: `send-text to ${target} refused: ${typed.error?.message ?? typed.stderr}` };
+    if (!target) return { delivered: false, outcome: "held", safeToRetry: true, error: "no target recorded on the marker" };
+    const payload = opts.paste === false ? text : `${PASTE_START}${neutralizeControls(text)}${PASTE_END}`;
     const enterKey = herdrKeyName("enter");
-    if (!enterKey.ok) return { delivered: false, error: enterKey.error };
+    if (!enterKey.ok) return { delivered: false, outcome: "held", safeToRetry: true, error: enterKey.error };
+    if (readyProfile().profile === "none") return this.#pushUnguarded(target, text, payload, enterKey.key);
+
+    // ⟨q-15d763dc⟩ BEFORE ANY KEY: the screen must be Claude Code's ready, empty input box. The text
+    // is held as firmly as the Enter — a digit typed into an open dialog selects an option.
+    const before = readReadyBox(this.#screen(target));
+    const refusal = refusalBeforeKeys(before);
+    if (refusal) return { delivered: false, verified: false, outcome: "held", safeToRetry: true, error: `held, nothing typed into ${target}: ${refusal}` };
+
+    const typed = this.#run(["pane", "send-text", target, payload]);
+    if (!typed.ok) return { delivered: false, verified: false, outcome: "held", safeToRetry: true, error: `send-text to ${target} refused: ${typed.error?.message ?? typed.stderr}` };
+    this.#sleep(this.#settleMs);
+    let box = readReadyBox(this.#screen(target));
+    if (!boxHoldsPayload(box, text)) {
+      return { delivered: false, verified: false, outcome: "typed-unconfirmed", safeToRetry: false, error: `typed into ${target}, but the text did not show in the input box (${box.ready ? "box holds something else" : box.reason}) — Enter NOT sent` };
+    }
     let enters = 0;
     for (let attempt = 0; attempt < 2; attempt++) {
+      // Every Enter follows a read that saw THIS payload in the ready box, never a stale one.
       const pressed = this.#run(["pane", "send-keys", target, enterKey.key]);
-      if (!pressed.ok) return { delivered: false, error: `send-keys enter to ${target} refused: ${pressed.error?.message ?? pressed.stderr}`, enters };
+      if (!pressed.ok) return { delivered: false, verified: false, outcome: "typed-unconfirmed", safeToRetry: false, error: `send-keys enter to ${target} refused: ${pressed.error?.message ?? pressed.stderr}`, enters };
+      enters++;
+      this.#sleep(this.#settleMs);
+      box = readReadyBox(this.#screen(target));
+      if (transcriptGained(before, box, text)) return { delivered: true, verified: true, outcome: "delivered", safeToRetry: false, enters, busy: box.ready ? box.busy ?? undefined : undefined };
+      if (boxHoldsPayload(box, text)) continue;
+      return { delivered: false, verified: false, outcome: "unverified", safeToRetry: false, enters, error: `enter sent to ${target}, but the screen after it does not show the message submitted (${box.ready ? (box.draft ? "the box holds other text" : "the box is empty and the transcript gained no line carrying it") : box.reason})` };
+    }
+    return { delivered: false, verified: true, outcome: "pending", safeToRetry: false, enters, error: `text still sitting unsubmitted in ${target}'s input after ${enters} enters` };
+  }
+
+  /** The screen, styled, so the ready-box reader can tell a ghost suggestion from a draft. null = unreadable. */
+  #screen(target: string): string | null {
+    const read = this.#run(["pane", "read", target, "--source", "visible", "--lines", String(this.#readLines), "--format", "ansi"]);
+    return read.ok ? read.stdout : null;
+  }
+
+  /**
+   * AGENT_COORD_READY_PROFILE=none, chosen by whoever started this process: #357's push, with no
+   * readiness check. Reported `unguarded`, and an unreadable screen still never counts as verified.
+   */
+  #pushUnguarded(target: string, text: string, payload: string, enter: string): HerdrPushResult {
+    const typed = this.#run(["pane", "send-text", target, payload]);
+    if (!typed.ok) return { delivered: false, unguarded: true, outcome: "held", safeToRetry: true, error: `send-text to ${target} refused: ${typed.error?.message ?? typed.stderr}` };
+    let enters = 0;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const pressed = this.#run(["pane", "send-keys", target, enter]);
+      if (!pressed.ok) return { delivered: false, unguarded: true, outcome: "typed-unconfirmed", safeToRetry: false, error: `send-keys enter to ${target} refused: ${pressed.error?.message ?? pressed.stderr}`, enters };
       enters++;
       this.#sleep(this.#settleMs);
       const pending = this.#stillPending(target, text);
-      if (pending === false) return { delivered: true, enters, verified: true };
-      if (pending === null) return { delivered: true, enters, verified: false };
+      if (pending === false) return { delivered: true, verified: true, unguarded: true, outcome: "delivered", safeToRetry: false, enters };
+      if (pending === null) return { delivered: false, verified: false, unguarded: true, outcome: "unverified", safeToRetry: false, enters, error: `enter sent to ${target}, but the pane could not be read back to verify it` };
     }
-    return { delivered: false, enters, verified: true, error: `text still sitting unsubmitted in ${target}'s input after ${enters} enters` };
+    return { delivered: false, verified: true, unguarded: true, outcome: "pending", safeToRetry: false, enters, error: `text still sitting unsubmitted in ${target}'s input after ${enters} enters` };
   }
 
   /**
-   * Read the pane back: is the typed text still the LAST non-empty line (unsubmitted)?
+   * Read the pane back: is the typed text still sitting in the INPUT (unsubmitted)?
    * true = pending · false = submitted · null = could not read (unverified, not failed).
+   *
+   * ⟨q-dc83023a⟩ THE INPUT IS THE PROMPT LINE, NOT THE LAST LINE. Claude Code draws a border,
+   * a footer and hints ("paste again to expand") BELOW its `❯` input, so the last non-empty
+   * line is never the input and the old last-line check answered "submitted" for a message
+   * still sitting there. The prompt line is pending when it shows a paste chip or the start
+   * of what was typed (a long first line wraps, so either may be a prefix of the other).
+   *
+   * NO PROMPT LINE → null (UNVERIFIED), never the last-line reading: that reading was measured
+   * to answer "submitted" for text still sitting in Claude's input, so falling back to it would
+   * let a changed Claude version, an open dialog or a read mid-render verify silently again
+   * (the coordinator's condition on ⟨q-dc83023a⟩, from worker-2). What a caller does with an
+   * unverified delivery is ⟨q-15d763dc⟩.
    */
   #stillPending(target: string, text: string): boolean | null {
     const read = this.#run(["pane", "read", target, "--source", "visible", "--lines", String(this.#readLines), "--format", "text"]);
     if (!read.ok) return null;
     const lines = read.stdout.split("\n").map((l) => l.replace(/\s+$/, "")).filter((l) => l.trim().length > 0);
-    const last = lines.at(-1) ?? "";
     const firstLine = text.split("\n")[0];
-    return last.endsWith(firstLine) && !/^[⏺✔✖]/.test(last);
+    const prompt = [...lines].reverse().find((l) => /^\s*❯/.test(l));
+    if (prompt !== undefined) {
+      const content = prompt.replace(/^\s*❯\s?/, "").trim();
+      if (!content) return false;
+      if (PASTE_CHIP_RE.test(content)) return true;
+      return firstLine.startsWith(content) || content.startsWith(firstLine);
+    }
+    return null;
   }
 
   /**
@@ -276,7 +433,8 @@ export class HerdrTransport implements Transport {
    * not measured) and are said so in the result.
    */
   async sendControl(marker: TransportMarker, cmd: ControlCommand): Promise<{ ok: boolean; error?: string; enters?: number; note?: string }> {
-    const r = await this.push(marker, `/${cmd}`);
+    const r = await this.push(marker, `/${cmd}`, { paste: false });
+    // push reports delivered only when verified (⟨q-15d763dc⟩), so `delivered` is the whole test here.
     if (!r.delivered) return { ok: false, error: r.error ?? "control not delivered", enters: r.enters };
     return {
       ok: true,

package/src/transports/index.ts

@@ -14,7 +14,7 @@ import { configuredTransport } from "./config.js";
 export * from "./types.js";
 export * from "./config.js";
 export { TmuxTransport, tmuxAvailable, paneExists, probePane, tmuxVersion, type TmuxHost } from "./tmux.js";
-export { HerdrTransport, defaultHerdrRunner, interpretHerdrReply, herdrKeyName, herdrPaneExists, HERDR_KEYS, HERDR_ABSENT_MESSAGE, type HerdrRunner, type HerdrResult } from "./herdr.js";
+export { HerdrTransport, defaultHerdrRunner, interpretHerdrReply, herdrKeyName, herdrPaneExists, herdrMarkerPid, HERDR_KEYS, HERDR_ABSENT_MESSAGE, type HerdrRunner, type HerdrResult, type HerdrMarkerPid } from "./herdr.js";
 
 let host: TmuxHost | undefined;
 

package/src/transports/types.ts

@@ -87,6 +87,11 @@ export type TransportMarker = {
   target?: string;
   /** The original field. Still written. See `target`. */
   tmuxTarget?: string;
+  /**
+   * ⟨q-abd88dd4⟩ herdr only: why `pid` holds what it holds (see `herdrMarkerPid`). A herdr
+   * marker's pid is addressed to PRE-HERDR readers and is never liveness for this build.
+   */
+  pidWhy?: string;
   since: number;
   /**
    * Remote pushers run on a different machine; the local pid is meaningless,