agent-coord-mcp 0.26.36 → 0.26.40

package/src/tools/herdr-tail.ts

@@ -38,9 +38,9 @@
  * `REFRESH_TICKS` ticks, and no herdr subprocess runs until there is something to type.
  */
 import { readFileSync, statSync } from "node:fs";
-import { inboxFile, roomFile, getRooms, transportFile } from "../store.js";
+import { inboxFile, roomFile, getRooms, transportFile, withDeliveryLock } from "../store.js";
 import { activeTransport, HERDR, targetOf, type Transport, type TransportMarker } from "../transports/index.js";
-import { renderForPane, advancePushCursor, readPushCursorFor, type Message } from "./herdr-delivery.js";
+import { renderForPane, advancePushCursor, readPushCursorFor, pushLogLine, sourceKey, type Message } from "./herdr-delivery.js";
 import { newMessagesIn, idEndingAt, endOfId } from "./jsonl-offsets.js";
 
 export const DEFAULT_POLL_MS = 1000;
@@ -84,7 +84,8 @@ export type TailContext = {
 };
 export const newContext = (seedEof = false): TailContext => ({ tick: 0, marker: null, rooms: [], hw: new Map(), hwId: new Map(), sizes: new Map(), seedEof, seeded: new Set(), pastEof: new Set() });
 
-const keyOf = (s: { kind: string; chan?: string }) => (s.kind === "dm" ? "dm" : `room:${s.chan}`);
+/** ONE spelling with the send-time path: the delivery lock is taken on this key by both (⟨q-524305dd⟩). */
+const keyOf = (s: { kind: string; chan?: string }) => sourceKey(s.kind === "dm" ? { kind: "dm" } : { kind: "room", chan: s.chan! });
 /** Set the in-process mark just past `msg`, remembering which message it follows. */
 const mark = (ctx: TailContext, key: string, end: number, msg: Record<string, unknown>) => {
   ctx.hw.set(key, end);
@@ -193,71 +194,89 @@ export async function tailOnce(
     // now sits below it. So the mark is checked against the message it was set after: moved to where
     // that message now ends, or — if it was archived — dropped, and the PERSISTED cursor, which the
     // compactor rebased exactly (adjustCursors → rebaseBytes), is the position again.
-    const held = ctx.hw.get(key);
-    if (held !== undefined && idEndingAt(src.file, held) !== (ctx.hwId.get(key) ?? null)) {
-      const id = ctx.hwId.get(key);
-      const moved = id ? endOfId(src.file, id) : null;
-      log(`[herdr-tail] ${key} for ${agentId} was rewritten beneath the in-process mark (byte ${held}, after ${id ?? "no id"}) — ${moved !== null ? `moved to byte ${moved}, where that message now ends` : "that message is gone; resuming from the rebased push cursor"}`);
-      if (moved !== null) ctx.hw.set(key, moved);
-      else { ctx.hw.delete(key); ctx.hwId.delete(key); }
-    }
-    const from = await offsetOf(agentId, src, ctx);
-    // …and if the PERSISTED cursor is past EOF too, the compactor has not rebased it yet (it rewrites
-    // the file first, then the cursors) or a server without this fix compacted. `size <= from` below
-    // skips it either way; this only makes the state VISIBLE, once per entry — on 2026-09-24 the only
-    // measurements of this defect came from a seat reading the room file by hand.
-    if (from > size) {
-      if (!ctx.pastEof.has(key)) log(`[herdr-tail] ${key} push cursor for ${agentId} is past EOF (${from} > ${size} bytes) — nothing can be typed from there until it is rebased or the file regrows past it (q-f44f17a7)`);
-      ctx.pastEof.add(key);
-    } else ctx.pastEof.delete(key);
-    // ⭐ NEGATIVE CONTROL FOR THE CLASS THIS ROW IS ABOUT: nothing is logged here when
-    // `size === from` — a source with nothing owed must stay silent, or every idle room on
-    // every tick becomes a line and the log that is supposed to make a real stall visible
-    // drowns in ones that are not.
-    if (size <= from) continue;
-
-    for (const { msg, end } of newMessagesIn(src.file, from)) {
-      if (msg.from === agentId) { mark(ctx, key, end, msg); continue; }
-      const where = src.kind === "dm" ? ({ kind: "dm" } as const) : ({ kind: "room", chan: src.chan! } as const);
-      const rendered = await renderForPane(msg as unknown as Message, agentId, where);
-      let r: { delivered: boolean; error?: string; verified?: boolean; safeToRetry?: boolean; outcome?: string };
-      try { r = await t.push(marker, rendered); } catch (e) { r = { delivered: false, safeToRetry: false, error: (e as Error).message }; }
-      // ⟨q-1ce5bc97⟩ step 1(b) — EVERY push outcome, logged, before any branch decides what to do
-      // with it. Not just the ones that end up `held`: a `delivered` needs a line too, or the
-      // log can never distinguish "nothing was owed" from "something was pushed and it worked".
-      log(
-        `[herdr-tail] push id=${String(msg.id ?? "?")} target=${targetOf(marker) ?? "?"} outcome=${r.outcome ?? (r.delivered ? "delivered" : "unknown")}` +
-          (r.error ? ` reason=${JSON.stringify(r.error)}` : ""),
-      );
-      if (!r.delivered && r.safeToRetry === true) {
-        // HELD: the transport sent NO key (no ready input box, a draft, a dialog, an unreadable pane).
-        // Nothing moves and the message is retried next tick, which costs only a screen read. Stop
-        // this source so no later message is typed past one that did not land.
-        out.held.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? ""), why: r.error ?? "held — nothing was typed" });
-        ctx.sizes.delete(key); // force a re-read next tick
-        break;
+    // ⛔ ⟨q-524305dd⟩ THE SAME LOCK THE SENDER'S SEND-TIME PUSH TAKES. Without it, this tick read the push
+    // cursor while a sender's server was mid-verify on the same message and typed it a second time. A
+    // tick never waits for it: whoever holds it is delivering, and the next tick re-reads the cursor.
+    const locked = await withDeliveryLock(agentId, key, async () => {
+      const held = ctx.hw.get(key);
+      if (held !== undefined && idEndingAt(src.file, held) !== (ctx.hwId.get(key) ?? null)) {
+        const id = ctx.hwId.get(key);
+        const moved = id ? endOfId(src.file, id) : null;
+        log(`[herdr-tail] ${key} for ${agentId} was rewritten beneath the in-process mark (byte ${held}, after ${id ?? "no id"}) — ${moved !== null ? `moved to byte ${moved}, where that message now ends` : "that message is gone; resuming from the rebased push cursor"}`);
+        if (moved !== null) ctx.hw.set(key, moved);
+        else { ctx.hw.delete(key); ctx.hwId.delete(key); }
       }
-      // ⛔ ANYTHING SHORT OF A VERIFIED DELIVERY DOES NOT MOVE THE PERSISTENT CURSOR (⟨q-15d763dc⟩).
-      // Keys may have reached the pane (text typed, an Enter pressed) without the screen proving the
-      // message was submitted, so it stays owed on disk: read_messages still serves it and a restart
-      // re-offers it. The in-process high-water mark alone stops it being re-typed every tick, since
-      // re-typing a message that may already be sitting in the box is the paste loop in another coat.
-      // A throw lands here too: nothing says whether a key went out before it.
-      if (!r.delivered || r.verified !== true) {
+      const from = await offsetOf(agentId, src, ctx);
+      // …and if the PERSISTED cursor is past EOF too, the compactor has not rebased it yet (it rewrites
+      // the file first, then the cursors) or a server without this fix compacted. `size <= from` below
+      // skips it either way; this only makes the state VISIBLE, once per entry — on 2026-09-24 the only
+      // measurements of this defect came from a seat reading the room file by hand.
+      if (from > size) {
+        if (!ctx.pastEof.has(key)) log(`[herdr-tail] ${key} push cursor for ${agentId} is past EOF (${from} > ${size} bytes) — nothing can be typed from there until it is rebased or the file regrows past it (q-f44f17a7)`);
+        ctx.pastEof.add(key);
+      } else ctx.pastEof.delete(key);
+      // ⭐ NEGATIVE CONTROL FOR THE CLASS THIS ROW IS ABOUT: nothing is logged here when
+      // `size === from` — a source with nothing owed must stay silent, or every idle room on
+      // every tick becomes a line and the log that is supposed to make a real stall visible
+      // drowns in ones that are not.
+      if (size <= from) return;
+
+      for (const { msg, end } of newMessagesIn(src.file, from)) {
+        if (msg.from === agentId) { mark(ctx, key, end, msg); continue; }
+        const where = src.kind === "dm" ? ({ kind: "dm" } as const) : ({ kind: "room", chan: src.chan! } as const);
+        const rendered = await renderForPane(msg as unknown as Message, agentId, where);
+        let r: { delivered: boolean; error?: string; verified?: boolean; safeToRetry?: boolean; outcome?: string };
+        try { r = await t.push(marker, rendered); } catch (e) { r = { delivered: false, safeToRetry: false, error: (e as Error).message }; }
+        // ⟨q-1ce5bc97⟩ step 1(b) — EVERY push outcome, logged, before any branch decides what to do
+        // with it. Not just the ones that end up `held`: a `delivered` needs a line too, or the
+        // log can never distinguish "nothing was owed" from "something was pushed and it worked".
+        log(pushLogLine("tail", msg.id, targetOf(marker), r.outcome ?? (r.delivered ? "delivered" : "unknown"), r.error));
+        // ⛔⛆ A `pending` IS RE-PUSHED, AND THAT IS THE CURE — NOT AN EXCLUSION. `pending` means the payload
+        // was typed and Enter pressed and it did NOT submit, so the composer now holds that text.
+        // ⚠ THE FIRST FIX HERE WAS TO SKIP THE RE-PUSH, and it was wrong: it stops the retype loop but the
+        // dirty composer then HOLDS every later message to that pane while the seat reads QUIET instead of
+        // WEDGED. Curing the loop is not curing the symptom.
+        // ⭐ What re-pushing now does depends on which transport this server loaded, and BOTH are correct:
+        //   • NEW (this build): the transport recognises a payload IT left un-submitted and PRESSES ENTER
+        //     rather than retyping — the message goes out on the next tick with no human involved.
+        //   • OLD (0.26.36, what the fleet is still running): the push refuses on the draft, which is
+        //     today's behaviour exactly, so this is no regression while the servers wait on a restart.
+        // ⛔ Either way it lands in `out.held` BELOW, so the state is VISIBLE every tick with the pane named
+        // and the human action spelled out. A silent park is the one outcome ruled out.
+        // ⛔ AND THE ENTER CANNOT LIVE HERE: a consumer cannot press a key, only ask the transport to push.
+        // Restarting the servers that would load it is David's call, not this slice's ⟨q-1ce5bc97⟩.
+        if (!r.delivered && r.safeToRetry === true) {
+          // NO VERIFIED DELIVERY and the transport says a retry could work: either nothing was typed (no
+          // ready input box, a foreign draft, a dialog, an unreadable pane) or the payload is sitting
+          // un-submitted in the box. Stop this source either way, so no later message is typed past one
+          // that did not land, and re-read next tick.
+          out.held.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? ""), why: r.error ?? (r.outcome === "pending" ? "pending — typed but not submitted" : "held — nothing was typed") });
+          ctx.sizes.delete(key); // force a re-read next tick
+          break;
+        }
+        // ⛔ ANYTHING SHORT OF A VERIFIED DELIVERY DOES NOT MOVE THE PERSISTENT CURSOR (⟨q-15d763dc⟩).
+        // Keys may have reached the pane (text typed, an Enter pressed) without the screen proving the
+        // message was submitted, so it stays owed on disk: read_messages still serves it and a restart
+        // re-offers it. The in-process high-water mark alone stops it being re-typed every tick, since
+        // re-typing a message that may already be sitting in the box is the paste loop in another coat.
+        // A throw lands here too: nothing says whether a key went out before it.
+        if (!r.delivered || r.verified !== true) {
+          mark(ctx, key, end, msg);
+          out.held.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? ""), why: `${r.outcome ?? (r.delivered ? "unverified" : "not delivered")} — ${r.error ?? "not verified"}; the persistent cursor was not moved (q-15d763dc)` });
+          break;
+        }
+        // It landed and was verified. Record that in-process FIRST, so a cursor write that fails
+        // cannot turn one delivery into a paste loop, then persist exactly past this line.
         mark(ctx, key, end, msg);
-        out.held.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? ""), why: `${r.outcome ?? (r.delivered ? "unverified" : "not delivered")} — ${r.error ?? "not verified"}; the persistent cursor was not moved (q-15d763dc)` });
-        break;
+        const persisted = await advancePushCursor(agentId, where, end);
+        out.delivered.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? "") });
+        if (!persisted) {
+          out.held.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? ""), why: "delivered, but the push cursor could not be written — held in memory so it is not re-typed; a restart before the next successful write may type it once more" });
+          break;
+        }
       }
-      // It landed and was verified. Record that in-process FIRST, so a cursor write that fails
-      // cannot turn one delivery into a paste loop, then persist exactly past this line.
-      mark(ctx, key, end, msg);
-      const persisted = await advancePushCursor(agentId, where, end);
-      out.delivered.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? "") });
-      if (!persisted) {
-        out.held.push({ kind: src.kind, chan: src.chan, id: String(msg.id ?? ""), why: "delivered, but the push cursor could not be written — held in memory so it is not re-typed; a restart before the next successful write may type it once more" });
-        break;
-      }
-    }
+    }, { wait: false, log });
+    if (!locked.ran) ctx.sizes.delete(key); // another deliverer holds this source: re-read on the next tick
   }
   return out;
 }

package/src/tools/registry.ts

@@ -660,9 +660,61 @@ export async function liveClaimEvidence(agentId: string, now: number): Promise<C
     // for the fleet that runs on herdr: every seat was refused by its own leftover marker (6 of 6 on
     // 2026-09-23). The pane comes from THIS process's environment, never from the caller's argument.
     const ownPane = ownPaneTarget(marker.transport);
-    if (targetOf(marker) && ownPane && targetOf(marker) === ownPane) {
-      samePane = true;
-      reasons.push(`the marker names THIS process's own pane (${ownPane})`);
+    const markerPane = targetOf(marker);
+    if (markerPane && ownPane) {
+      // ⟨q-f995c3c7⟩ NEXT LAYER — COMPARE PANE IDENTITIES, NOT SPELLINGS. `===` on the two strings was
+      // the whole remaining defect: one pane has more than one name, and this seat's env said
+      // `wA5:p1` while its own marker said `wA3:p4` for the SAME pane. Every herdr seat had to be
+      // hand-staged to its env spelling before a restart, and the standdown manifest grew an
+      // `attachWith` field to carry the workaround. herdr already answers the canonical id for
+      // either name, so the fix is to ask it.
+      const resolver = activeTransport();
+      const canAsk = marker.transport === HERDR && resolver?.kind === HERDR && resolver instanceof HerdrTransport;
+      const mine = canAsk ? resolver.resolvePaneId(ownPane) : null;
+      const theirs = canAsk ? resolver.resolvePaneId(markerPane) : null;
+
+      if (mine && theirs) {
+        // Both spellings resolved: identity is the answer, and a spelling mismatch is no longer one.
+        if (mine === theirs) {
+          samePane = true;
+          reasons.push(
+            markerPane === ownPane
+              ? `the marker names THIS process's own pane (${ownPane})`
+              : `the marker names THIS process's own pane — '${markerPane}' and '${ownPane}' both resolve to ${mine}`,
+          );
+        }
+      } else if (markerPane === ownPane) {
+        // ⛔ THE FALLBACK, AND IT IS DELIBERATELY THE NARROW ONE. When herdr cannot be asked — a tmux
+        // seat, no herdr binary, a pane that no longer answers — the only thing still knowable is
+        // whether the two spellings are literally equal, which is exactly the pre-fix behaviour. It
+        // is kept so this change cannot REMOVE a reclaim that used to work.
+        //
+        // ⛔⛆ AND IT NEVER WIDENS: "could not ask" must not silently become "matches". Unequal
+        // spellings that could not be resolved stay UNMATCHED — the seat is refused and has to be
+        // looked at, which is the outcome this row exists to make rare, not the outcome it exists to
+        // hide. A fallback that guessed `true` here would convert a diagnosable refusal into a seat
+        // silently claiming a pane that may belong to someone else.
+        samePane = true;
+        reasons.push(
+          canAsk
+            ? `the marker names THIS process's own pane (${ownPane}) — spellings are equal; herdr could not resolve either to a pane id, so identity was NOT confirmed`
+            : `the marker names THIS process's own pane (${ownPane})`,
+        );
+      } else {
+        // ⛔ STATED RATHER THAN SILENT, AND IT DISTINGUISHES THE TWO WAYS OF NOT KNOWING. A refusal
+        // whose reason is "I could not ask" is diagnosable in one read; one that prints nothing is the
+        // 26-hour kind. The first version of this branch was `else if (canAsk)`, which left the
+        // no-resolver case saying NOTHING — the same invisible-fallback shape the row is about, one
+        // level down, and the tests caught it.
+        const why = !canAsk
+          ? marker.transport === HERDR
+            ? "no herdr transport is wired in this process (initTransportFromConfig has not run), so no pane id could be asked for"
+            : `the ${marker.transport} transport has no pane-identity resolver, so only the spellings could be compared`
+          : `herdr could not resolve ${mine ? `'${markerPane}'` : theirs ? `'${ownPane}'` : "either spelling"} to a pane id`;
+        reasons.push(
+          `the marker names pane '${markerPane}' and this process is in '${ownPane}'; ${why}, so they are NOT treated as the same pane`,
+        );
+      }
     }
   }
 

package/src/transports/herdr.ts

@@ -246,6 +246,20 @@ export class HerdrTransport implements Transport {
   #markerPid: () => HerdrMarkerPid;
   #env: Record<string, string | undefined>;
   #submitMode: SubmitMode;
+  /**
+   * ⛔⛆ PROVENANCE FOR THE ENTER WE PRESS ON A DRAFT WE DID NOT JUST TYPE: target → the exact text this
+   * transport left sitting un-submitted in that pane. A `pending` result means the payload is IN the box
+   * and our enters did not submit it; the recovery is to press Enter again, NEVER to retype.
+   * ⚠ Why the box alone cannot decide this: a pasted payload renders as `[Pasted text #N +M lines]`, and
+   * `isPasteChip` is CONTENT-BLIND (MEASURED 2026-09-27, 4 cases over the 4 draft classes readReadyBox
+   * distinguishes — our verbatim payload, a foreign plain draft, a foreign chip, an empty box: the foreign
+   * chip read as OURS). Our own paste is a chip too, so chip-vs-chip is indistinguishable ON SCREEN and a
+   * content-only rule would refuse the very case this fixes. So ownership is recorded HERE, by the code
+   * that typed it, and the screen read stays exactly as strict as it was.
+   * ⭐ In-memory by design: after a restart we claim nothing and fall through to the refusal, which is the
+   * conservative side and is what today's build already does.
+   */
+  #leftUnsubmitted = new Map<string, string>();
 
   constructor(opts: HerdrTransportOptions = {}) {
     this.#run = opts.run ?? defaultHerdrRunner;
@@ -329,11 +343,61 @@ export class HerdrTransport implements Transport {
     return herdrPaneExists(target, this.#run);
   }
 
+  /**
+   * ⟨q-f995c3c7⟩ next layer — THE CANONICAL ID BEHIND A PANE SPELLING. `null` = could not ask.
+   *
+   * ⛔ WHY THIS EXISTS: one pane has more than one name. This seat's env said `wA5:p1` while its
+   * marker said `wA3:p4`, both resolving to the same pane, and the first-claim guard compared the two
+   * STRINGS with `===`. So a seat restarting into its own pane was refused by its own marker — the
+   * defect ⟨q-f995c3c7⟩ fixed for the ENV-vs-TMUX_PANE case and left standing for spelling-vs-spelling.
+   * Measured 2026-09-26: six seats had to be hand-staged to the env spelling before a restart, and the
+   * fleet-wide standdown manifest now carries an `attachWith` field to work around it.
+   *
+   * ⭐ HERDR IS ALREADY THE RESOLVER — `pane get <spelling>` answers with the canonical `pane_id` for
+   * either name, and `attach()` above has read `paneOf(cur)?.pane_id` since before this row existed.
+   * Nothing new is being invented here; the guard simply stopped short of asking.
+   */
+  resolvePaneId(target: string): string | null {
+    const got = this.#run(["pane", "get", target]);
+    if (!got.ok) return null;
+    return paneOf(got)?.pane_id ?? null;
+  }
+
   /** Nothing to kill: there is no pusher. The tool deletes the marker. */
   async detach(_agentId: string): Promise<void> {
     return;
   }
 
+  /**
+   * Press Enter on a payload ALREADY sitting in the ready box, and verify by reading back. Returns a
+   * result when the outcome is settled, or `null` to fall through to the normal type-then-submit path.
+   *
+   * ⭐ Used only when `boxHoldsPayload` says the draft is OURS. No `send-text` happens here — the text is
+   * already there, and typing it again would join it to itself. This is the recovery for a `pending` left
+   * by an earlier attempt, and it is what turns that state from "a human must nudge it" into "the next
+   * tick submits it".
+   */
+  #pressEnterUntilSubmitted(target: string, text: string, before: ReturnType<typeof readReadyBox>, key: string): HerdrPushResult | null {
+    let enters = 0;
+    for (let attempt = 0; attempt < 2; attempt++) {
+      const pressed = this.#run(["pane", "send-keys", target, key]);
+      if (!pressed.ok) return { delivered: false, verified: false, outcome: "typed-unconfirmed", safeToRetry: false, enters, error: `send-keys enter to ${target} refused while submitting a payload already in the box: ${pressed.error?.message ?? pressed.stderr}` };
+      enters++;
+      this.#sleep(this.#settleMs);
+      const box = readReadyBox(this.#screen(target));
+      if (transcriptGained(before, box, text)) {
+        this.#leftUnsubmitted.delete(target);
+        return { delivered: true, verified: true, outcome: "delivered", safeToRetry: false, enters, busy: box.ready ? box.busy ?? undefined : undefined };
+      }
+      if (boxHoldsPayload(box, text)) continue;
+      // The box no longer holds our text and the transcript did not gain it: something else consumed it.
+      // Not ours to retype — report it rather than guess.
+      this.#leftUnsubmitted.delete(target);
+      return { delivered: false, verified: false, outcome: "unverified", safeToRetry: false, enters, error: `pressed enter on a payload already in ${target}'s box, but the screen after it does not show the message submitted (${box.ready ? (box.draft ? "the box now holds other text" : "the box is empty and the transcript gained no line carrying it") : box.reason})` };
+    }
+    return { delivered: false, verified: true, outcome: "pending", safeToRetry: true, enters, error: `payload was already sitting in ${target}'s input and ${enters} further enters did not submit it — the composer HOLDS this message: a human Enter in ${target} submits it, or clearing that box discards it` };
+  }
+
   /**
    * Type `text` into the pane and press enter; VERIFY by reading the pane back, and if
    * the line is still sitting unsubmitted (the spike's race), press enter once more.
@@ -363,6 +427,22 @@ export class HerdrTransport implements Transport {
     // ⟨q-15d763dc⟩ BEFORE ANY KEY: the screen must be Claude Code's ready, empty input box. The text
     // is held as firmly as the Enter — a digit typed into an open dialog selects an option.
     const before = readReadyBox(this.#screen(target));
+
+    // ⛔⛆ OUR OWN UN-SUBMITTED PAYLOAD IS SUBMITTED, NOT REFUSED AND NOT RETYPED. A previous attempt can
+    // leave this exact text in the composer: `pasteAndSubmit` types it, presses Enter up to twice, and
+    // returns `pending` when the box still holds it. `refusalBeforeKeys` then refuses ANY draft — so the
+    // retry refused on text THIS TRANSPORT typed, every tick, forever, and only a human Enter broke it.
+    // That is David's nudge on fleet HRx, shipped in 0.26.36 ⟨q-1ce5bc97⟩.
+    // ⭐ `boxHoldsPayload` is the discriminator worker-1 identified: OUR payload → press Enter and submit
+    // what is already there; a FOREIGN draft → refuse, which is what that refusal was always for. Typing
+    // again is never right — it would join the text to itself.
+    // ⚠ The refusal is NOT weakened for any other case: an unready screen, a dialog, or someone else's
+    // draft still stops before a single key, because `boxHoldsPayload` returns false for all of them.
+    if (this.#leftUnsubmitted.get(target) === text && boxHoldsPayload(before, text)) {
+      const resubmitted = this.#pressEnterUntilSubmitted(target, text, before, enterKey.key);
+      if (resubmitted) return resubmitted;
+    }
+
     const refusal = refusalBeforeKeys(before);
     if (refusal) return { delivered: false, verified: false, outcome: "held", safeToRetry: true, error: `held, nothing typed into ${target}: ${refusal}` };
 
@@ -381,11 +461,22 @@ export class HerdrTransport implements Transport {
       enters++;
       this.#sleep(this.#settleMs);
       box = readReadyBox(this.#screen(target));
-      if (transcriptGained(before, box, text)) return { delivered: true, verified: true, outcome: "delivered", safeToRetry: false, enters, busy: box.ready ? box.busy ?? undefined : undefined };
+      if (transcriptGained(before, box, text)) {
+        this.#leftUnsubmitted.delete(target);
+        return { delivered: true, verified: true, outcome: "delivered", safeToRetry: false, enters, busy: box.ready ? box.busy ?? undefined : undefined };
+      }
       if (boxHoldsPayload(box, text)) continue;
+      this.#leftUnsubmitted.delete(target);
       return { delivered: false, verified: false, outcome: "unverified", safeToRetry: false, enters, error: `enter sent to ${target}, but the screen after it does not show the message submitted (${box.ready ? (box.draft ? "the box holds other text" : "the box is empty and the transcript gained no line carrying it") : box.reason})` };
     }
-    return { delivered: false, verified: true, outcome: "pending", safeToRetry: true, enters, error: `text still sitting unsubmitted in ${target}'s input after ${enters} enters` };
+    // ⚠ `safeToRetry: true` STAYS, and it is not an oversight — ⟨q-1ce5bc97⟩ step 1 chose it because
+    // pending is the most recoverable non-delivery: the payload is KNOWN to be in the box, so a transient
+    // misread must not become a permanent drop. What was wrong lived in the CONSUMER, which read this flag
+    // as "no key was sent" and retried into the draft this attempt created (the 0.26.36 livelock).
+    // ⭐ The error now says what a sender actually faces, because `verified: true` here means the OUTCOME
+    // is known — we read the screen back and the payload is sitting there — and has never meant delivered.
+    this.#leftUnsubmitted.set(target, text);
+    return { delivered: false, verified: true, outcome: "pending", safeToRetry: true, enters, error: `text still sitting unsubmitted in ${target}'s input after ${enters} enters — the pane's composer HOLDS this message, so a retype would join it rather than send it: a human Enter in ${target} submits it, or clearing that box discards it` };
   }
 
   /**