commandmate 0.46.0 → 0.46.1

package/dist/server/src/lib/auto-yes-poller.js

@@ -88,6 +88,7 @@ const logger = (0, logger_1.createLogger)('auto-yes-poller');
 const path_validator_1 = require("./security/path-validator");
 const auto_yes_state_1 = require("./auto-yes-state");
 const global_state_1 = require("./global-state");
+const auto_yes_suppression_reason_1 = require("./polling/auto-yes-suppression-reason");
 const auto_yes_poller_state_1 = require("./polling/auto-yes-poller-state");
 const auto_yes_prompt_suppression_1 = require("./polling/auto-yes-prompt-suppression");
 /** In-memory storage for poller states (globalThis for hot reload persistence) */
@@ -158,8 +159,8 @@ function isPollerActive(compositeKey) {
  * @param compositeKey - Composite key
  * @param timestamp - Timestamp value (Date.now())
  */
-function updateLastServerResponseTimestamp(compositeKey, timestamp) {
-    const pollerState = getPollerState(compositeKey);
+function updateLastServerResponseTimestamp(compositeKey, timestamp, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
     if (pollerState) {
         pollerState.lastServerResponseTimestamp = timestamp;
     }
@@ -170,9 +171,10 @@ function updateLastServerResponseTimestamp(compositeKey, timestamp) {
  * and after an answer is sent.
  *
  * @param compositeKey - Composite key
+ * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
  */
-function resetErrorCount(compositeKey) {
-    const pollerState = getPollerState(compositeKey);
+function resetErrorCount(compositeKey, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
     if (pollerState) {
         pollerState.consecutiveErrors = 0;
         pollerState.currentInterval = auto_yes_state_1.POLLING_INTERVAL_MS;
@@ -183,9 +185,10 @@ function resetErrorCount(compositeKey) {
  * [IA-MF-001] compositeKey-based: extracts worktreeId/cliToolId for disableAutoYes.
  *
  * @param compositeKey - Composite key
+ * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
  */
-function incrementErrorCount(compositeKey) {
-    const pollerState = getPollerState(compositeKey);
+function incrementErrorCount(compositeKey, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
     if (pollerState) {
         pollerState.consecutiveErrors++;
         pollerState.currentInterval = (0, auto_yes_state_1.calculateBackoffInterval)(pollerState.consecutiveErrors);
@@ -209,6 +212,62 @@ function incrementErrorCount(compositeKey) {
         }
     }
 }
+/**
+ * The poller state under `compositeKey`, but only when it is `owner` — the
+ * tick's own (Issue #3706). Without `owner` (callers outside a tick, and tests
+ * driving `detectAndRespondToPrompt` with a hand-built state) it is the plain
+ * by-key read this always was.
+ */
+function ownedPollerState(compositeKey, owner) {
+    const pollerState = getPollerState(compositeKey);
+    if (owner !== undefined && pollerState !== owner)
+        return undefined;
+    return pollerState;
+}
+/** Is the tick's poller still the one under its key (not stopped, not replaced)? */
+function isPollerCurrent(generation) {
+    return getPollerState(generation.compositeKey) === generation.pollerState;
+}
+/**
+ * May the tick still act: its poller, its grant (the same enable, not expired)
+ * and its session (no relaunch since) are all still the ones it started under.
+ * Checked after capture, after each wait before a key, and inside the send.
+ */
+function isTickCurrent(generation) {
+    if (!isPollerCurrent(generation))
+        return false;
+    // `getAutoYesState` returns the stored object until it expires, when it
+    // stores (and returns) a disabled one — so an expiry fails identity too.
+    const grant = (0, auto_yes_state_1.getAutoYesState)(generation.worktreeId, generation.cliToolId, generation.instanceId);
+    if (grant !== generation.grant || !grant.enabled)
+        return false;
+    return isSameSession(generation);
+}
+/**
+ * Is the session the tick answered still the one it started on (Issue #3706)?
+ * What the follow-ups of an answer already sent — the response poller restart,
+ * the terminal push — are judged by: a disable after the keys landed does not
+ * un-send them, a relaunch does make them about another process.
+ */
+function isSameSession(generation) {
+    return (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(generation.compositeKey) === generation.sessionEpoch;
+}
+/**
+ * End a tick that found its generation gone (Issue #3706). It changes nothing;
+ * it re-arms its timer only when its own poller is still the current one — a
+ * renewed grant or a relaunched session under the same poller — so the chain
+ * goes on and the next tick starts from the new state.
+ */
+function endStaleTick(generation) {
+    logger.debug('poller:auto-yes-tick-superseded', {
+        worktreeId: generation.worktreeId,
+        cliToolId: generation.cliToolId,
+        instanceId: generation.instanceId,
+        pollerCurrent: isPollerCurrent(generation),
+    });
+    if (isPollerCurrent(generation))
+        scheduleNextPoll(generation);
+}
 /**
  * Check if the given prompt has already been answered recently.
  *
@@ -409,9 +468,13 @@ function isStillEnterFallbackScreen(prompt, fresh) {
  *  6. a capture taken now, past the capture cache, must still be that screen
  *     ({@link isStillEnterFallbackScreen}).
  *
+ * Issue #3706: with a `generation` (a tick of `pollAutoYes`), the waits of
+ * steps 5 and 6 are each followed by {@link isTickCurrent}; a tick that lost
+ * its generation sends nothing and changes nothing.
+ *
  * @returns true when the Enter was sent; the caller returns `responded`
  */
-async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput) {
+async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput, generation) {
     const { worktreeId, cliToolId, instanceId, pollerState, promptData, frameKey } = prompt;
     const judgement = dialogGate.dialog === null ? (0, auto_yes_enter_fallback_1.judgeEnterFallback)(cliToolId, rawOutput) : null;
     if (judgement === null || !judgement.eligible) {
@@ -481,6 +544,8 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
     // 5. Never another server's session (Issue #2865).
     const sessionName = manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId);
     const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
+    if (generation !== undefined && !isTickCurrent(generation))
+        return false;
     if (ownership === null || ownership.verdict === 'foreign') {
         (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
             worktreeId,
@@ -500,6 +565,8 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
     // has the box back. Everything that decided the Enter is judged again on the
     // fresh frame; any difference sends nothing, and the next tick starts over.
     const fresh = await (0, cli_session_1.captureSessionOutputFresh)(worktreeId, cliToolId, (rawOutput ?? '').split('\n').length, instanceId);
+    if (generation !== undefined && !isTickCurrent(generation))
+        return false;
     if (!isStillEnterFallbackScreen(prompt, fresh)) {
         pollerState.enterFallbackCandidateKey = null;
         logger.debug('poller:auto-yes-enter-fallback-fresh-frame-differs', {
@@ -516,13 +583,20 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
     finally {
         (0, tmux_capture_cache_1.invalidateCache)(sessionName);
     }
-    pollerState.enterFallbackSentKey = frameKey;
-    pollerState.enterFallbackCandidateKey = null;
-    (0, auto_yes_enter_fallback_1.recordEnterFallbackSent)(worktreeId, cliToolId, instanceId, {
-        promptType: promptData.type,
-        refusalReason: judgement.refusalReason,
-        screenKey,
-    });
+    // Issue #3706: the Enter is out, but the per-screen record is the CURRENT
+    // session's: when the poller was stopped (the record was forgotten with it)
+    // or a new session began while `send-keys` was awaited, the return of this
+    // send must not put the record back. The audit row below is kept either way.
+    if (generation === undefined || (isPollerCurrent(generation) && isSameSession(generation))) {
+        pollerState.enterFallbackSentKey = frameKey;
+        pollerState.enterFallbackCandidateKey = null;
+        (0, auto_yes_enter_fallback_1.recordEnterFallbackSent)(worktreeId, cliToolId, instanceId, {
+            promptType: promptData.type,
+            refusalReason: judgement.refusalReason,
+            screenKey,
+            ...(generation !== undefined ? { epoch: generation.sessionEpoch } : {}),
+        });
+    }
     logger.info('poller:auto-yes-enter-fallback-sent', {
         worktreeId,
         cliToolId,
@@ -531,7 +605,7 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
         refusalReason: judgement.refusalReason,
         composerState: judgement.composerState,
     });
-    await finishAnsweredPrompt(prompt, promptDetection, exports.AUTO_YES_ENTER_FALLBACK_ANSWER);
+    await finishAnsweredPrompt(prompt, promptDetection, exports.AUTO_YES_ENTER_FALLBACK_ANSWER, generation);
     return true;
 }
 /**
@@ -543,24 +617,42 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
  * @param promptDetection - The detection `prompt.promptData` was read from; its
  *   content becomes the audit row's
  * @param answer - The answer that was sent
+ * @param generation - The tick's generation (Issue #3706). The keys are out, so
+ *   the task event and the audit row are always written: they record what the
+ *   agent actually received. What belongs to the poller is written to the
+ *   tick's own poller state only, never to a successor under the same key, and
+ *   the response poller restart and the terminal push are skipped when the
+ *   session was relaunched meanwhile.
  */
-async function finishAnsweredPrompt(prompt, promptDetection, answer) {
+async function finishAnsweredPrompt(prompt, promptDetection, answer, generation) {
     const { worktreeId, cliToolId, instanceId, compositeKey, pollerState, promptData, promptKey } = prompt;
-    // 6. Update timestamp and reset error count
-    updateLastServerResponseTimestamp(compositeKey, Date.now());
-    resetErrorCount(compositeKey);
-    // 7. Record answered prompt key and timestamp
-    pollerState.lastAnsweredPromptKey = promptKey;
-    pollerState.lastAnsweredAt = Date.now();
-    pollerState.lastSkipWarnKey = null;
-    logger.info('poller:response-sent', { worktreeId, cliToolId, instanceId });
+    // Issue #3706: the keys went to the session the tick started on. When a new
+    // one was begun while they were being sent, the new process never received
+    // this answer, so nothing that stands for "this instance's prompt was just
+    // answered" is written: not the dedup key (it would keep Auto-Yes off the new
+    // process's identical question), not the poller's response time, not the
+    // task event (the task looked up now may be the new session's). Only the
+    // audit row is, and it may not adopt a pending row saved after the tick began.
+    const sameSession = generation === undefined || isSameSession(generation);
+    if (sameSession) {
+        // 6. Update timestamp and reset error count
+        updateLastServerResponseTimestamp(compositeKey, Date.now(), generation?.pollerState);
+        resetErrorCount(compositeKey, generation?.pollerState);
+        // 7. Record answered prompt key and timestamp
+        pollerState.lastAnsweredPromptKey = promptKey;
+        pollerState.lastAnsweredAt = Date.now();
+        pollerState.lastSkipWarnKey = null;
+    }
+    logger.info('poller:response-sent', { worktreeId, cliToolId, instanceId, sameSession });
     // Issue #1548: the prompt was answered without a human. Raised only after
     // the keys actually reached tmux, so a send that threw is not logged as an
     // answer. No-ops when this instance is not running a contract.
-    (0, task_transition_service_1.applyEventToActiveTask)((0, db_instance_1.getDbInstance)(), worktreeId, cliToolId, 
-    // Undefined means the primary instance, which the task lookup identifies
-    // by the tool id itself (see getActiveTaskForInstance).
-    instanceId ?? cliToolId, 'prompt_answered_auto', { promptType: promptData.type });
+    if (sameSession) {
+        (0, task_transition_service_1.applyEventToActiveTask)((0, db_instance_1.getDbInstance)(), worktreeId, cliToolId, 
+        // Undefined means the primary instance, which the task lookup identifies
+        // by the tool id itself (see getActiveTaskForInstance).
+        instanceId ?? cliToolId, 'prompt_answered_auto', { promptType: promptData.type });
+    }
     // Issue #1685: persist question/options/answer to chat history so the audit
     // trail survives even when the answer landed inside the response poller's
     // interval and the prompt was never saved as a pending message. Must never
@@ -575,6 +667,7 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer) {
             answer,
             answeredBy: 'auto',
             content: promptDetection.rawContent || promptDetection.cleanContent,
+            ...(sameSession ? {} : { pendingSavedAtOrBefore: generation.startedAt }),
         });
     }
     catch (recordError) {
@@ -605,6 +698,10 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer) {
         Promise.resolve().then(() => __importStar(require('../lib/polling/response-poller'))),
         Promise.resolve().then(() => __importStar(require('../lib/realtime/terminal-broadcast'))),
     ]);
+    // Re-read after the await, not the `sameSession` taken before the audit: a
+    // relaunch while the modules loaded makes the restart about the new process.
+    if (!sameSession || (generation !== undefined && !isSameSession(generation)))
+        return;
     startResponsePolling(worktreeId, cliToolId, instanceId);
     void broadcastTerminalSnapshotAfterInteraction(worktreeId, cliToolId, instanceId);
 }
@@ -621,10 +718,18 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer) {
  * @param rawOutput - The SAME tick's capture with its box drawing intact
  *   (Issue #2522). Omitting it costs Command Code's `AskUserQuestion` and
  *   nothing else; see {@link capturePollerFrame}.
+ * @param generation - The calling tick's generation (Issue #3706). Given, every
+ *   wait before a key — the ownership check, the Enter fallback's fresh capture,
+ *   each wait inside the send — is followed by {@link isTickCurrent}, and a tick
+ *   that lost it types nothing more and returns `no_answer`. Omitted (direct
+ *   callers, tests), nothing is checked, as before.
  * @returns 'responded' | 'no_prompt' | 'duplicate' | 'no_answer' | 'error'
  */
-async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput) {
+async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput, generation) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    // Issue #3706 / #3713: the send in flight, settled without an await once it
+    // comes back — as a partial answer when it was stopped with keys on the pane.
+    let attempt = null;
     try {
         // 1. Detect prompt.
         //
@@ -683,6 +788,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         const frame = (0, frame_1.normalizeFrame)(rawOutput ?? cleanOutput, cliToolId);
         const promptDetection = (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput, receiptScope, frame);
         if (!promptDetection.isPrompt || !promptDetection.promptData) {
+            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey);
             pollerState.lastAnsweredPromptKey = null;
             pollerState.lastAnsweredAt = null;
             pollerState.lastSkipWarnKey = null;
@@ -708,6 +814,37 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
             promptKey,
             frameKey,
         };
+        // 2.5. Issue #3706: an earlier answer to this prompt was stopped after some
+        // of its keys reached the pane (a `y` whose Enter was withheld). Typing the
+        // answer again would append to what is already in the input (`yy`), and
+        // what the pane holds now cannot be told from the frame, so the prompt is
+        // left for a human until it leaves the screen, another prompt replaces it
+        // (`partialAnswerScreenKey`: options and approvalTarget count, the cursor
+        // does not), or the session is relaunched. Recorded as a suppression, so
+        // the prompt Push and `cmate wait` see "withheld", not "answering".
+        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
+        const partial = (0, auto_yes_poller_state_1.getPartialAnswer)(compositeKey, epoch);
+        if (partial !== null) {
+            if (partial.screenKey === screenKey) {
+                (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
+                    reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
+                    mode: null,
+                    promptType: promptDetection.promptData.type,
+                }, `${frameKey}\u0000partial-answer`, 'poller:auto-yes-skipped-partial-answer', { promptType: promptDetection.promptData.type, stoppedAt: partial.at });
+                return 'no_answer';
+            }
+            // Another prompt is on screen: only the sends at the forgotten one's
+            // screen go with it (#3713) — one in flight at this screen keeps its hold.
+            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey, partial.screenKey);
+        }
+        // Issue #3713: a worktree ID move carried an answer still being sent to
+        // this session's key. Its keys may already be on the pane, and how its send
+        // ends is not known yet — so this screen gets no keys until it comes back
+        // (recorded as a partial answer above, or gone).
+        if ((0, auto_yes_poller_state_1.hasMovedSendInFlight)(compositeKey, epoch, screenKey)) {
+            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000moved-send-in-flight`, 'poller:auto-yes-skipped-moved-send-in-flight', { worktreeId, cliToolId, instanceId, promptType: promptDetection.promptData.type });
+            return 'no_answer';
+        }
         // 3., 3.2., 3.5. Frames that are not Auto-Yes's to answer: see
         // `suppressIfNotOursToAnswer`.
         const notOurs = (0, auto_yes_prompt_suppression_1.suppressIfNotOursToAnswer)(judged, frame);
@@ -720,7 +857,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // 3.6. Issue #3397: a refused frame may be a choice screen CommandMate
         // cannot read; with Auto-Yes on it gets one Enter. See `tryEnterFallback`.
         if (notOurs.kind === 'dialog-gate-refused') {
-            return (await tryEnterFallback(judged, promptDetection, notOurs.dialogGate, rawOutput))
+            return (await tryEnterFallback(judged, promptDetection, notOurs.dialogGate, rawOutput, generation))
                 ? 'responded'
                 : 'no_answer';
         }
@@ -759,6 +896,8 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // Issue #2865: never auto-answer a same-named session another CommandMate
         // server created. The poller keeps running; it just does not type.
         const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
+        if (generation !== undefined && !isTickCurrent(generation))
+            return 'no_answer';
         if (ownership === null || ownership.verdict === 'foreign') {
             (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
                 worktreeId,
@@ -770,23 +909,42 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
             });
             return 'no_answer';
         }
+        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch);
         try {
             await (0, prompt_answer_sender_1.sendPromptAnswer)({
                 sessionName,
                 answer,
                 cliToolId,
                 promptData: promptDetection.promptData,
+                // Issue #3706: asked after each wait inside the send.
+                ...(generation !== undefined ? { stillCurrent: () => isTickCurrent(generation) } : {}),
             });
         }
         finally {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
         }
+        (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
         // 6., 7. The answer reached tmux: see `finishAnsweredPrompt`.
-        await finishAnsweredPrompt(judged, promptDetection, answer);
+        await finishAnsweredPrompt(judged, promptDetection, answer, generation);
         return 'responded';
     }
-    catch {
-        incrementErrorCount(compositeKey);
+    catch (error) {
+        // Issue #3706: a tick that lost its generation — the send stopped part-way
+        // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
+        // failure of the poller that now holds the key, and not an answer either.
+        if (generation !== undefined && !isTickCurrent(generation)) {
+            const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
+            // A stop with keys already on the pane: the next tick must not type the
+            // answer again over them (step 2.5). Recorded under the attempt's key as
+            // it is now — the new one when a worktree ID move carried it (#3713).
+            if (attempt !== null)
+                (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, keysSent === true);
+            logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent });
+            return 'no_answer';
+        }
+        if (attempt !== null)
+            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
+        incrementErrorCount(compositeKey, generation?.pollerState);
         logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId });
         return 'error';
     }
@@ -797,19 +955,36 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
  * @param worktreeId - Worktree identifier
  * @param cliToolId - CLI tool type being polled
  * @param instanceId - Agent instance ID being polled (Issue #896; equals cliToolId for primary)
+ * @param owner - The poller state whose timer fired (Issue #3706); a timer of a
+ *   poller that has since been replaced does nothing
  */
-async function pollAutoYes(worktreeId, cliToolId, instanceId) {
+async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
     // 1. Validate context
     const pollerState = getPollerState(compositeKey);
+    if (owner !== undefined && pollerState !== owner)
+        return;
     const contextResult = validatePollingContext(compositeKey, pollerState);
     if (contextResult !== 'valid') {
         return;
     }
+    const grant = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
+    if (!grant?.enabled)
+        return;
+    // Issue #3706: what this tick acts for, compared after every wait below.
+    const generation = {
+        compositeKey,
+        worktreeId,
+        cliToolId,
+        instanceId,
+        pollerState: pollerState,
+        grant,
+        sessionEpoch: (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey),
+        startedAt: Date.now(),
+    };
     try {
         // 2. Capture and clean output
-        const autoYesState = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
-        const captureLines = autoYesState?.stopPattern
+        const captureLines = grant.stopPattern
             ? auto_yes_config_1.FULL_CAPTURE_LINES
             : auto_yes_config_1.REDUCED_CAPTURE_LINES;
         // Issue #2522: one capture, both spellings. The cleaned string drives every
@@ -817,6 +992,10 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId) {
         // so a dialog anchored on box drawing is not invisible to the one path that
         // can answer it without a human.
         const { raw: rawOutput, clean: cleanOutput } = await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId);
+        if (!isTickCurrent(generation)) {
+            endStaleTick(generation);
+            return;
+        }
         if (pollerState.waitingForSession) {
             pollerState.waitingForSession = false;
             logger.info('poller:session-appeared', { worktreeId, cliToolId, instanceId });
@@ -827,23 +1006,27 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId) {
             return;
         }
         // 4. Detect and respond to prompt
-        const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput);
+        const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput, generation);
+        if (!isTickCurrent(generation)) {
+            endStaleTick(generation);
+            return;
+        }
         // Issue #3329: a poll that ran to the end ends the run of errors, so only
         // failures in a row reach AUTO_STOP_ERROR_THRESHOLD — not ones scattered
         // over hours. Not on 'error': a capture that works followed by an answer
         // that fails every time must still back off and stop.
         if (result !== 'error') {
-            resetErrorCount(compositeKey);
+            resetErrorCount(compositeKey, generation.pollerState);
         }
         if (result === 'responded') {
-            scheduleNextPoll(worktreeId, cliToolId, instanceId, auto_yes_state_1.COOLDOWN_INTERVAL_MS);
+            scheduleNextPoll(generation, auto_yes_state_1.COOLDOWN_INTERVAL_MS);
             return;
         }
         // 5. Thinking check
         if (result === 'no_prompt') {
             const recentLines = lines.slice(-auto_yes_state_1.THINKING_CHECK_LINE_COUNT).join('\n');
             if ((0, cli_patterns_1.detectThinking)(cliToolId, recentLines)) {
-                scheduleNextPoll(worktreeId, cliToolId, instanceId, auto_yes_config_1.THINKING_POLLING_INTERVAL_MS);
+                scheduleNextPoll(generation, auto_yes_config_1.THINKING_POLLING_INTERVAL_MS);
                 return;
             }
         }
@@ -853,18 +1036,23 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId) {
         // the session it answers for (`auto-yes-lifecycle`), and `send --auto-yes`
         // enables it before the session starts — so wait until `expiresAt`, at the
         // backoff cap, instead of counting toward `consecutive_errors`.
-        if (await isSessionMissing(worktreeId, cliToolId, instanceId)) {
+        const sessionMissing = await isSessionMissing(worktreeId, cliToolId, instanceId);
+        if (!isTickCurrent(generation)) {
+            endStaleTick(generation);
+            return;
+        }
+        if (sessionMissing) {
             if (!pollerState.waitingForSession) {
                 pollerState.waitingForSession = true;
                 logger.info('poller:waiting-for-session', { worktreeId, cliToolId, instanceId });
             }
-            scheduleNextPoll(worktreeId, cliToolId, instanceId, auto_yes_state_1.MAX_BACKOFF_MS);
+            scheduleNextPoll(generation, auto_yes_state_1.MAX_BACKOFF_MS);
             return;
         }
-        incrementErrorCount(compositeKey);
+        incrementErrorCount(compositeKey, generation.pollerState);
         logger.warn('poller:poll-error', { worktreeId, cliToolId, instanceId, error: (0, errors_1.getErrorMessage)(error) });
     }
-    scheduleNextPoll(worktreeId, cliToolId, instanceId);
+    scheduleNextPoll(generation);
 }
 /**
  * Whether a failed capture failed because the session does not exist
@@ -883,19 +1071,20 @@ async function isSessionMissing(worktreeId, cliToolId, instanceId) {
 /**
  * Schedule the next polling iteration
  *
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param instanceId - Agent instance ID being polled (Issue #896)
+ * Issue #3706: on the tick's OWN poller state, and only while it is still the
+ * one under its key. Re-reading by key let a tick that outlived a disable →
+ * enable write its timer over the new poller's `timerId`, leaving two chains.
+ *
+ * @param generation - The tick's generation
  * @param overrideInterval - Optional override for the next poll delay
  */
-function scheduleNextPoll(worktreeId, cliToolId, instanceId, overrideInterval) {
-    const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
-    const pollerState = getPollerState(compositeKey);
-    if (!pollerState)
+function scheduleNextPoll(generation, overrideInterval) {
+    if (!isPollerCurrent(generation))
         return;
+    const { worktreeId, cliToolId, instanceId, pollerState } = generation;
     const interval = Math.max(overrideInterval ?? pollerState.currentInterval, auto_yes_state_1.POLLING_INTERVAL_MS);
     pollerState.timerId = setTimeout(() => {
-        pollAutoYes(worktreeId, cliToolId, instanceId);
+        void pollAutoYes(worktreeId, cliToolId, instanceId, pollerState);
     }, interval);
 }
 // =============================================================================
@@ -958,7 +1147,7 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
     // Start polling immediately
     pollerState.timerId = setTimeout(() => {
-        pollAutoYes(worktreeId, cliToolId, effectiveInstanceId);
+        void pollAutoYes(worktreeId, cliToolId, effectiveInstanceId, pollerState);
     }, auto_yes_state_1.POLLING_INTERVAL_MS);
     logger.info('poller:started', { worktreeId, cliToolId, instanceId: effectiveInstanceId });
     return { started: true };
@@ -998,6 +1187,7 @@ function stopAllAutoYesPolling() {
     }
     autoYesPollerStates.clear();
     (0, auto_yes_enter_fallback_1.clearEnterFallbacks)();
+    (0, auto_yes_poller_state_1.clearPartialAnswers)();
 }
 /**
  * Get all composite keys that have active auto-yes poller entries.
@@ -1017,12 +1207,20 @@ function getAutoYesPollerCompositeKeys() {
  * [SF-001] Uses shared filterCompositeKeysByWorktree (DRY).
  *
  * @param worktreeId - Worktree identifier
+ * @param options.keepPartialAnswers - Issue #3713 (re-instruction 1, P2-1): the
+ *   disable route's "every agent" passes it — a disable, like one agent's
+ *   `stopAutoYesPolling`, keeps the memory of an answer stopped part-way and
+ *   the sends still in flight, so a disable → enable does not type over a
+ *   partial input. Omitted (the worktree being deleted, `session-cleanup` via
+ *   `auto-yes-lifecycle`), both are dropped and a late send records nothing.
  */
-function stopAutoYesPollingByWorktree(worktreeId) {
+function stopAutoYesPollingByWorktree(worktreeId, options) {
     const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId);
     pollerKeys.forEach(key => stopAutoYesPolling(key));
     // Issue #3397: and the records of instances whose poller had already stopped.
     (0, auto_yes_enter_fallback_1.forgetEnterFallbacksByWorktree)(worktreeId);
+    if (!options?.keepPartialAnswers)
+        (0, auto_yes_poller_state_1.forgetPartialAnswersByWorktree)(worktreeId);
 }
 /**
  * Check if any auto-yes poller is active for a given worktreeId.

package/dist/server/src/lib/conversation-logger.js

@@ -8,18 +8,30 @@ exports.recordClaudeConversation = recordClaudeConversation;
 const db_1 = require("./db");
 const log_manager_1 = require("./log-manager");
 const logger_1 = require("./logger");
+const poller_owner_1 = require("./polling/poller-owner");
 const logger = (0, logger_1.createLogger)('conversation-logger');
 /**
  * Persist the latest Claude response alongside the most recent user prompt.
  * Errors are swallowed so the calling API route can continue responding.
  */
-async function recordClaudeConversation(db, worktreeId, claudeResponse, cliToolId = 'claude') {
+async function recordClaudeConversation(db, worktreeId, claudeResponse, cliToolId = 'claude', options = {}) {
+    const { pollerKey } = options;
+    const mayWrite = pollerKey === undefined ? undefined : () => (0, poller_owner_1.mayActForPollerKey)(pollerKey);
+    if (mayWrite && !mayWrite()) {
+        logger.info('conversation:log-refused', { worktreeId, cliToolId });
+        return;
+    }
     const lastUserMessage = (0, db_1.getLastUserMessage)(db, worktreeId);
     if (!lastUserMessage) {
         return;
     }
     try {
-        await (0, log_manager_1.createLog)(worktreeId, lastUserMessage.content, claudeResponse, cliToolId);
+        const logPath = await (0, log_manager_1.createLog)(worktreeId, lastUserMessage.content, claudeResponse, cliToolId, {
+            mayWrite,
+        });
+        if (logPath === null) {
+            logger.info('conversation:log-refused', { worktreeId, cliToolId });
+        }
     }
     catch (error) {
         logger.error('conversation:log-failed', { error: error instanceof Error ? error.message : String(error) });

package/dist/server/src/lib/db/chat-db.js

@@ -693,9 +693,10 @@ function recordAnsweredPrompt(db, params) {
       AND message_type = 'prompt'
       AND json_extract(prompt_data, '$.status') = 'pending'
       ${exports.ACTIVE_FILTER}
+      ${params.pendingSavedAtOrBefore !== undefined ? 'AND timestamp <= ?' : ''}
     ORDER BY timestamp DESC
   `)
-        .all(worktreeId, resolvedInstanceId);
+        .all(worktreeId, resolvedInstanceId, ...(params.pendingSavedAtOrBefore !== undefined ? [params.pendingSavedAtOrBefore] : []));
     let target = null;
     for (const row of rows) {
         try {

package/dist/server/src/lib/history/user-turn-recorder.js

@@ -101,6 +101,7 @@ exports.USER_TURN_ADOPTION_WINDOW_MS = void 0;
 exports.normalizeUserTurnContent = normalizeUserTurnContent;
 exports.recordUserTurn = recordUserTurn;
 const logger_1 = require("../../lib/logger");
+const poller_owner_1 = require("../../lib/polling/poller-owner");
 const logger = (0, logger_1.createLogger)('lib/history/user-turn-recorder');
 /**
  * How far from the agent's own clock a `/send` row may sit and still be the
@@ -182,6 +183,19 @@ async function recordUserTurn(target, key, content, timestampMs, options = {}) {
                 timestampMs: existing.timestamp.getTime(),
             };
         }
+        // Issue #3705: the last `await` is behind us, and from here the recorder
+        // writes — a key onto an existing `/send` row, or a new row — with none
+        // between. A retired tick does neither under the instance it lost: both are
+        // keyed by `request_id`, which stops the same row being written twice and
+        // says nothing about who may write it.
+        if (!(0, poller_owner_1.mayActForAgentInstance)(target)) {
+            logger.info('user-turn-record-refused', {
+                ...describe(target),
+                requestId: key,
+                generation: (0, poller_owner_1.currentPollerOwner)()?.generation,
+            });
+            return { outcome: 'refused', messageId: null, timestampMs: null };
+        }
         const at = timestampMs > 0 ? timestampMs : Date.now();
         const adopted = adoptExistingRow(chatDb, db, target, instanceId, key, normalized, at, options);
         if (adopted)