commandmate 0.46.0 → 0.47.0

package/dist/server/src/lib/auto-yes-poller.js

@@ -54,6 +54,7 @@ exports.validatePollingContext = validatePollingContext;
 exports.capturePollerFrame = capturePollerFrame;
 exports.captureAndCleanOutput = captureAndCleanOutput;
 exports.processStopConditionDelta = processStopConditionDelta;
+exports.noHookReceiptHint = noHookReceiptHint;
 exports.detectAndRespondToPrompt = detectAndRespondToPrompt;
 exports.startAutoYesPolling = startAutoYesPolling;
 exports.stopAutoYesPolling = stopAutoYesPolling;
@@ -63,6 +64,7 @@ exports.stopAutoYesPollingByWorktree = stopAutoYesPollingByWorktree;
 exports.isAnyPollerActiveForWorktree = isAnyPollerActiveForWorktree;
 const cli_session_1 = require("./session/cli-session");
 const response_checker_1 = require("./polling/response-checker");
+const antigravity_receipt_episodes_1 = require("./polling/antigravity-receipt-episodes");
 const antigravity_permission_receipts_1 = require("./polling/antigravity-permission-receipts");
 const auto_yes_resolver_1 = require("./polling/auto-yes-resolver");
 const auto_yes_policy_1 = require("./polling/auto-yes-policy");
@@ -77,17 +79,21 @@ const worktree_session_ownership_1 = require("./cli-tools/worktree-session-owner
 const prompt_answer_sender_1 = require("./prompt-answer-sender");
 const prompt_answer_semantic_1 = require("./prompt-answer-semantic");
 const tmux_1 = require("./tmux/tmux");
+const session_created_signal_1 = require("./tmux/session-created-signal");
 const manager_1 = require("./cli-tools/manager");
 const cli_patterns_1 = require("./detection/cli-patterns");
 const prompt_key_1 = require("./detection/prompt-key");
 const errors_1 = require("./errors");
 const tmux_capture_cache_1 = require("./tmux/tmux-capture-cache");
 const auto_yes_config_1 = require("../config/auto-yes-config");
+const auto_yes_poller_stop_reason_1 = require("./polling/auto-yes-poller-stop-reason");
 const logger_1 = require("../lib/logger");
 const logger = (0, logger_1.createLogger)('auto-yes-poller');
 const path_validator_1 = require("./security/path-validator");
 const auto_yes_state_1 = require("./auto-yes-state");
 const global_state_1 = require("./global-state");
+const auto_yes_suppression_reason_1 = require("./polling/auto-yes-suppression-reason");
+const auto_yes_suppression_state_1 = require("./polling/auto-yes-suppression-state");
 const auto_yes_poller_state_1 = require("./polling/auto-yes-poller-state");
 const auto_yes_prompt_suppression_1 = require("./polling/auto-yes-prompt-suppression");
 /** In-memory storage for poller states (globalThis for hot reload persistence) */
@@ -99,7 +105,10 @@ const autoYesPollerStates = (0, global_state_1.getOrInitGlobal)('__autoYesPoller
  * instance. globalThis for the same reason as the poller states above.
  */
 const withheldNoReceiptLoggedAt = (0, global_state_1.getOrInitGlobal)('__autoYesWithheldNoReceiptLoggedAt', () => new Map());
-/** Least gap between two `antigravity-autoyes-withheld-no-hook-receipt` lines for one instance. */
+/**
+ * Least gap between two `antigravity-autoyes-withheld-no-hook-receipt` lines for
+ * one instance. `antigravity-autoyes-withheld-by-policy` (Issue #3724) shares it.
+ */
 const WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS = 60_000;
 // =============================================================================
 // Poller State Accessors (compositeKey-based)
@@ -125,7 +134,8 @@ function getActivePollerCount() {
  * @internal Exported for testing purposes only.
  */
 function clearAllPollerStates() {
-    stopAllAutoYesPolling();
+    // Issue #3730: a test seam, not a shutdown — logged as such.
+    (0, auto_yes_poller_stop_reason_1.withPollerStopReason)('reset', () => stopAllAutoYesPolling());
     autoYesPollerStates.clear();
     withheldNoReceiptLoggedAt.clear();
 }
@@ -158,8 +168,8 @@ function isPollerActive(compositeKey) {
  * @param compositeKey - Composite key
  * @param timestamp - Timestamp value (Date.now())
  */
-function updateLastServerResponseTimestamp(compositeKey, timestamp) {
-    const pollerState = getPollerState(compositeKey);
+function updateLastServerResponseTimestamp(compositeKey, timestamp, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
     if (pollerState) {
         pollerState.lastServerResponseTimestamp = timestamp;
     }
@@ -170,9 +180,10 @@ function updateLastServerResponseTimestamp(compositeKey, timestamp) {
  * and after an answer is sent.
  *
  * @param compositeKey - Composite key
+ * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
  */
-function resetErrorCount(compositeKey) {
-    const pollerState = getPollerState(compositeKey);
+function resetErrorCount(compositeKey, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
     if (pollerState) {
         pollerState.consecutiveErrors = 0;
         pollerState.currentInterval = auto_yes_state_1.POLLING_INTERVAL_MS;
@@ -183,9 +194,10 @@ function resetErrorCount(compositeKey) {
  * [IA-MF-001] compositeKey-based: extracts worktreeId/cliToolId for disableAutoYes.
  *
  * @param compositeKey - Composite key
+ * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
  */
-function incrementErrorCount(compositeKey) {
-    const pollerState = getPollerState(compositeKey);
+function incrementErrorCount(compositeKey, owner) {
+    const pollerState = ownedPollerState(compositeKey, owner);
     if (pollerState) {
         pollerState.consecutiveErrors++;
         pollerState.currentInterval = (0, auto_yes_state_1.calculateBackoffInterval)(pollerState.consecutiveErrors);
@@ -205,10 +217,66 @@ function incrementErrorCount(compositeKey) {
                 // Issue #896: target the specific instance state (3-part keys carry instanceId).
                 (0, auto_yes_state_1.disableAutoYes)(worktreeId, cliToolId, 'consecutive_errors', (0, auto_yes_state_1.extractInstanceId)(compositeKey) ?? undefined);
             }
-            stopAutoYesPolling(compositeKey);
+            stopAutoYesPolling(compositeKey, 'consecutive-errors');
         }
     }
 }
+/**
+ * The poller state under `compositeKey`, but only when it is `owner` — the
+ * tick's own (Issue #3706). Without `owner` (callers outside a tick, and tests
+ * driving `detectAndRespondToPrompt` with a hand-built state) it is the plain
+ * by-key read this always was.
+ */
+function ownedPollerState(compositeKey, owner) {
+    const pollerState = getPollerState(compositeKey);
+    if (owner !== undefined && pollerState !== owner)
+        return undefined;
+    return pollerState;
+}
+/** Is the tick's poller still the one under its key (not stopped, not replaced)? */
+function isPollerCurrent(generation) {
+    return getPollerState(generation.compositeKey) === generation.pollerState;
+}
+/**
+ * May the tick still act: its poller, its grant (the same enable, not expired)
+ * and its session (no relaunch since) are all still the ones it started under.
+ * Checked after capture, after each wait before a key, and inside the send.
+ */
+function isTickCurrent(generation) {
+    if (!isPollerCurrent(generation))
+        return false;
+    // `getAutoYesState` returns the stored object until it expires, when it
+    // stores (and returns) a disabled one — so an expiry fails identity too.
+    const grant = (0, auto_yes_state_1.getAutoYesState)(generation.worktreeId, generation.cliToolId, generation.instanceId);
+    if (grant !== generation.grant || !grant.enabled)
+        return false;
+    return isSameSession(generation);
+}
+/**
+ * Is the session the tick answered still the one it started on (Issue #3706)?
+ * What the follow-ups of an answer already sent — the response poller restart,
+ * the terminal push — are judged by: a disable after the keys landed does not
+ * un-send them, a relaunch does make them about another process.
+ */
+function isSameSession(generation) {
+    return (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(generation.compositeKey) === generation.sessionEpoch;
+}
+/**
+ * End a tick that found its generation gone (Issue #3706). It changes nothing;
+ * it re-arms its timer only when its own poller is still the current one — a
+ * renewed grant or a relaunched session under the same poller — so the chain
+ * goes on and the next tick starts from the new state.
+ */
+function endStaleTick(generation) {
+    logger.debug('poller:auto-yes-tick-superseded', {
+        worktreeId: generation.worktreeId,
+        cliToolId: generation.cliToolId,
+        instanceId: generation.instanceId,
+        pollerCurrent: isPollerCurrent(generation),
+    });
+    if (isPollerCurrent(generation))
+        scheduleNextPoll(generation);
+}
 /**
  * Check if the given prompt has already been answered recently.
  *
@@ -243,14 +311,18 @@ function validatePollingContext(compositeKey, pollerState) {
     const worktreeId = (0, auto_yes_state_1.extractWorktreeId)(compositeKey);
     const cliToolId = (0, auto_yes_state_1.extractCliToolId)(compositeKey);
     if (!cliToolId) {
-        stopAutoYesPolling(compositeKey);
+        stopAutoYesPolling(compositeKey, 'invalid-key');
         return 'expired';
     }
     // Issue #896: resolve instanceId so per-instance enabled state is checked.
     const instanceId = (0, auto_yes_state_1.extractInstanceId)(compositeKey) ?? undefined;
     const autoYesState = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
     if (!autoYesState?.enabled) {
-        stopAutoYesPolling(compositeKey);
+        // Issue #3730: the return value says 'expired' for every one of these (its
+        // callers only need "stop"), but the log says which it was — the getter
+        // has just turned a past deadline into `stopReason: 'expired'`, and
+        // anything else is a grant some other path disabled or removed.
+        stopAutoYesPolling(compositeKey, autoYesState?.stopReason === 'expired' ? 'expired' : 'not-enabled');
         return 'expired';
     }
     return 'valid';
@@ -307,7 +379,7 @@ function processStopConditionDelta(compositeKey, pollerState, cleanOutput) {
     if (cleanOutput.length > baseline) {
         const newContent = cleanOutput.substring(baseline);
         pollerState.stopCheckBaselineLength = cleanOutput.length;
-        return (0, auto_yes_state_1.checkStopCondition)(compositeKey, newContent, stopAutoYesPolling);
+        return (0, auto_yes_state_1.checkStopCondition)(compositeKey, newContent, (key) => stopAutoYesPolling(key, 'stop-pattern'));
     }
     else if (cleanOutput.length < baseline) {
         pollerState.stopCheckBaselineLength = cleanOutput.length;
@@ -330,6 +402,13 @@ function processStopConditionDelta(compositeKey, pollerState, cleanOutput) {
  * Why it is worth a line: a machine whose `~/.gemini/config/hooks.json` points at
  * another server (#2622) never sends us the question, and every real dialog then
  * waits for a human with no sign of why. The line names the file to look at.
+ *
+ * A stale receipt does not always mean that, though (Issue #3724): a dialog the
+ * contract's autoYes withheld got its receipt, the server answered `ask`, and
+ * the dialog outlived the window. When `resolveAutoAnswerWithPolicy` on the
+ * ungated reading suppresses the answer by contract (the base rules would have
+ * answered it), the line is `antigravity-autoyes-withheld-by-policy` instead,
+ * naming the reason, the mode and the task. Both share the limit.
  * The response-checker's own `antigravity-dialog-no-recent-receipt` stays at
  * debug — it prints on every tick the same pane is read again.
  *
@@ -337,27 +416,193 @@ function processStopConditionDelta(compositeKey, pollerState, cleanOutput) {
  * @param readWithoutGate - The same frame read without `receiptScope`
  */
 function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, readWithoutGate) {
-    if ((0, antigravity_permission_receipts_1.hasRecentAntigravityPermissionReceipt)(worktreeId, 'antigravity', instanceId))
+    // Issue #3767: the gate's own verdict for this tick's candidate. Null means it
+    // never saw one (no dialog), `ok` that it let the frame through.
+    let verdict = (0, antigravity_receipt_episodes_1.getAntigravityReceiptVerdict)(worktreeId, instanceId);
+    if (verdict?.ok)
         return;
     const now = Date.now();
-    const lastLoggedAt = withheldNoReceiptLoggedAt.get(compositeKey);
-    if (lastLoggedAt !== undefined && now - lastLoggedAt < WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS)
-        return;
     const ungated = readWithoutGate();
     if (!ungated.isPrompt || !ungated.promptData)
         return;
-    for (const [key, loggedAt] of withheldNoReceiptLoggedAt) {
-        if (now - loggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS)
-            withheldNoReceiptLoggedAt.delete(key);
+    // The gate was not consulted (the gated reading declined the frame on screen
+    // grounds alone) yet the frame reads as a prompt: judge it here.
+    verdict ??= (0, antigravity_receipt_episodes_1.judgeAntigravityPermissionReceipt)(worktreeId, instanceId, now);
+    if (verdict.ok)
+        return;
+    // Issue #3724: a contract that withholds the answer makes the server reply
+    // `ask`, so the dialog stays up past the receipt window. The cause is then the
+    // contract, not a hooks.json that points elsewhere. Judged exactly as the tick
+    // judges a prompt it can read — the base rules first, then the contract — so
+    // a prompt the base rules never answer (a checkbox, a typed option) is not
+    // blamed on the contract. Policy and task id come from one lookup.
+    const { policy, taskId } = (0, auto_yes_policy_1.getSessionAutoYesPolicyEntry)(worktreeId, 'antigravity', instanceId);
+    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(ungated.promptData, policy);
+    // Issue #3767: `answered` is the dialog the gate already let through on this
+    // receipt, still up past the window. Unless the contract withheld it, that is
+    // not a missing receipt: neither recorded nor logged, nor counted for the limit.
+    // Issue #3789: `answered` is also a dialog accepted but never sent to (the
+    // tick recorded its own reason, if any, and that record is kept). One the
+    // poller DID send keys to and still up past the grace is `outlived`, which is
+    // recorded and logged like the others, so the stop is not a silent one.
+    // Issue #3796: the reason the poller recorded for this dialog (partial-answer,
+    // the contract, …) while it could still read it inside the window was not
+    // re-stamped once the window closed — the gated reading stopped seeing the
+    // prompt — so `cmate wait` dropped it as stale a minute later with the dialog
+    // still up. Re-stamped here on every tick the dialog stays — only while it
+    // still holds under this tick's evaluation — and kept over a `no-hook-receipt`
+    // for it: it is the more exact reason.
+    const keptPartialAnswer = refreshEpisodeSuppression(worktreeId, instanceId, verdict, resolution);
+    // Issue #3796 review D: a contract that withholds the prompt now is published
+    // whatever was recorded before — none at all (the window closed before the
+    // tick could read it, or an ended contract's record was dropped and a new one
+    // withholds it again) or another reason. Without it `cmate wait` read no
+    // reason and held the prompt as one Auto-Yes was answering. Only a partial
+    // answer still on screen comes first, as it does on the tick (step 2.5).
+    if (resolution.suppressedBy && !keptPartialAnswer) {
+        (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, {
+            reason: resolution.suppressedBy,
+            mode: policy?.mode ?? null,
+            promptType: ungated.promptData.type,
+            ...(resolution.pattern !== undefined ? { pattern: resolution.pattern } : {}),
+        });
+    }
+    if (!resolution.suppressedBy && (verdict.cause === 'answered' || keptPartialAnswer))
+        return;
+    const lastLoggedAt = withheldNoReceiptLoggedAt.get(compositeKey);
+    const logDue = lastLoggedAt === undefined || now - lastLoggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS;
+    if (logDue) {
+        for (const [key, loggedAt] of withheldNoReceiptLoggedAt) {
+            if (now - loggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS)
+                withheldNoReceiptLoggedAt.delete(key);
+        }
+        withheldNoReceiptLoggedAt.set(compositeKey, now);
     }
-    withheldNoReceiptLoggedAt.set(compositeKey, now);
+    if (resolution.suppressedBy) {
+        if (!logDue)
+            return;
+        logger.info('antigravity-autoyes-withheld-by-policy', {
+            worktreeId,
+            instanceId: instanceId ?? 'antigravity',
+            reason: resolution.suppressedBy,
+            mode: policy?.mode ?? null,
+            taskId,
+            hint: '契約の autoYes が答えを止めている。契約の autoYes を確認',
+        });
+        return;
+    }
+    // Issue #3767: recorded on every tick (the record's `at` follows the prompt
+    // while it stays up), logged once a minute.
+    (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, {
+        reason: auto_yes_suppression_reason_1.NO_HOOK_RECEIPT_SUPPRESSION_REASON,
+        mode: null,
+        promptType: ungated.promptData.type,
+    });
+    if (!logDue)
+        return;
     logger.info('antigravity-autoyes-withheld-no-hook-receipt', {
         worktreeId,
         instanceId: instanceId ?? 'antigravity',
         windowMs: antigravity_permission_receipts_1.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS,
-        hint: 'hook の受信記録が直近に無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認',
+        hint: noHookReceiptHint(verdict, now),
+    });
+}
+/**
+ * Issue #3796: keep the suppression the poller recorded during this dialog's
+ * episode current while the dialog it accepted (`answered` / `outlived`) is
+ * still up. Only a record made since the dialog was first read, and never the
+ * receipt gate's own `no-hook-receipt` (the caller records that itself). A
+ * record is kept only while its reason still holds NOW:
+ *
+ * - `partial-answer` remembers an event: it holds for as long as the dialog
+ *   the keys went to stays up (this episode), and is re-stamped here;
+ * - a contract reason is the contract's verdict on the prompt, re-evaluated on
+ *   every tick (`resolution`): no verdict (the contract ended, or now answers
+ *   it) drops the record — the dialog is then `answered` / `outlived` like any
+ *   other. A verdict is recorded by the caller (review D), whatever was here;
+ * - any other reason is left as it was recorded.
+ *
+ * @returns true when a `partial-answer` that still holds was re-stamped
+ */
+function refreshEpisodeSuppression(worktreeId, instanceId, verdict, resolution) {
+    if (verdict.cause !== 'answered' && verdict.cause !== 'outlived')
+        return false;
+    const own = (0, auto_yes_suppression_state_1.getLastPolicySuppression)(worktreeId, 'antigravity', instanceId);
+    if (own === null || own.reason === auto_yes_suppression_reason_1.NO_HOOK_RECEIPT_SUPPRESSION_REASON || !(own.at >= verdict.firstSeenAt)) {
+        return false;
+    }
+    if (own.reason === auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON) {
+        // The memory is the episode's: the dialog the keys went to is still the one
+        // up (same episode, accepted on the same receipt). Not `getPartialAnswer`:
+        // the tick forgets it as soon as the gated reading stops seeing the prompt,
+        // which past the window is every tick.
+        const { at: _recordedAt, ...suppression } = own;
+        (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, suppression);
+        return true;
+    }
+    if (auto_yes_suppression_reason_1.CONTRACT_SUPPRESSION_REASONS.has(own.reason) && !resolution.suppressedBy) {
+        (0, auto_yes_suppression_state_1.forgetPolicySuppression)(worktreeId, 'antigravity', instanceId);
+    }
+    return false;
+}
+/**
+ * Issue #3789: keys for an agy dialog the receipt gate accepted reached tmux.
+ * Only here does the gate start the grace after which a dialog still up is
+ * reported as `outlived`; the tick's `no_answer` exits (another server's session,
+ * a partial answer, the base rules or the contract not answering) never get
+ * here, so their own records are not overwritten by `no-hook-receipt`.
+ *
+ * Issue #3796: `interrupted` — the send began and was cut short (stopped
+ * part-way, or failed). Its keys may be on the pane and the receipt is spent,
+ * so the grace starts here too; without it the dialog stayed `answered`, and
+ * silent, for as long as it stayed up.
+ */
+function noteAnswerSent(cliToolId, worktreeId, instanceId, interrupted = false, forReceiptAt) {
+    if (cliToolId !== 'antigravity')
+        return;
+    (0, antigravity_receipt_episodes_1.markAntigravityAnswerSent)(worktreeId, instanceId, Date.now(), {
+        interrupted,
+        ...(forReceiptAt !== undefined ? { forReceiptAt } : {}),
     });
 }
+/**
+ * Issue #3796 review: the agy episode a send is about to go to, read before
+ * its first await; null for other tools. Given back to {@link noteAnswerSent}
+ * however the send came back — whole, failed or cut short (review E) — so that
+ * only that episode is marked — the same
+ * idea as the Enter record's generation check in `tryEnterFallback`.
+ */
+function receiptEpisodeOfSend(cliToolId, worktreeId, instanceId) {
+    return cliToolId === 'antigravity' ? (0, antigravity_receipt_episodes_1.getAntigravityAcceptedReceiptAt)(worktreeId, instanceId) : null;
+}
+/**
+ * The hint for `antigravity-autoyes-withheld-no-hook-receipt` (Issue #3767):
+ * which of the withheld cases it was decides where to look.
+ */
+function noHookReceiptHint(verdict, now = Date.now()) {
+    const seconds = verdict.ageMs === null ? null : Math.round(verdict.ageMs / 1000);
+    // `lapsed` says how long ago, so from now: the line repeats once a minute.
+    const secondsAgo = verdict.lastReceiptAt === null ? null : Math.round((now - verdict.lastReceiptAt) / 1000);
+    switch (verdict.cause) {
+        case 'never':
+            return 'hook の受信が一度も無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認';
+        case 'late':
+            return `最後の受信から ${seconds} 秒後に確認が出た（窓 ${antigravity_permission_receipts_1.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS / 1000} 秒の外）ため答えなかった。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）。続くなら ~/.gemini/config/hooks.json の向き先（#2622）も確認`;
+        case 'lapsed':
+            return `最後の受信は ${secondsAgo} 秒前で途絶えている（hook が届かなくなった）。hooks.json の向き先（#2622）と agy の再起動を確認`;
+        case 'predates':
+            return '確認は最後の受信より前から画面に出ていた（引用か別の確認）ため答えなかった。人が答える';
+        case 'used':
+            return '最後の受信は直前の確認に使い済み。この確認に対する受信は無いため答えなかった。人が答える';
+        case 'outlived':
+            if (verdict.answerInterrupted === true) {
+                return `Auto-Yes が最後の受信の確認へ答えを送る途中で送信が止まり（キーの一部が入力に残っている可能性がある）、${antigravity_receipt_episodes_1.ANTIGRAVITY_ANSWERED_DIALOG_GRACE_MS / 1000} 秒を過ぎても確認が画面に残っている。未使用の受信が無いため、もう一度は答えない。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）`;
+            }
+            return `Auto-Yes が最後の受信の確認へキーを送ってから ${antigravity_receipt_episodes_1.ANTIGRAVITY_ANSWERED_DIALOG_GRACE_MS / 1000} 秒を過ぎても、確認が画面に残っている。キーで確認が閉じなかったか、新しい受信の無い別の確認と入れ替わった（画面からは区別できない）。未使用の受信が無いため、もう一度は答えない。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）`;
+        default:
+            return 'hook の受信記録が直近に無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認';
+    }
+}
 /**
  * The audit row's `answer` for the Enter (Issue #3397): not a digit, so the
  * History reads as "Auto-Yes pressed Enter" rather than as a chosen option.
@@ -409,9 +654,13 @@ function isStillEnterFallbackScreen(prompt, fresh) {
  *  6. a capture taken now, past the capture cache, must still be that screen
  *     ({@link isStillEnterFallbackScreen}).
  *
+ * Issue #3706: with a `generation` (a tick of `pollAutoYes`), the waits of
+ * steps 5 and 6 are each followed by {@link isTickCurrent}; a tick that lost
+ * its generation sends nothing and changes nothing.
+ *
  * @returns true when the Enter was sent; the caller returns `responded`
  */
-async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput) {
+async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput, generation) {
     const { worktreeId, cliToolId, instanceId, pollerState, promptData, frameKey } = prompt;
     const judgement = dialogGate.dialog === null ? (0, auto_yes_enter_fallback_1.judgeEnterFallback)(cliToolId, rawOutput) : null;
     if (judgement === null || !judgement.eligible) {
@@ -481,6 +730,8 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
     // 5. Never another server's session (Issue #2865).
     const sessionName = manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId);
     const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
+    if (generation !== undefined && !isTickCurrent(generation))
+        return false;
     if (ownership === null || ownership.verdict === 'foreign') {
         (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
             worktreeId,
@@ -500,6 +751,8 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
     // has the box back. Everything that decided the Enter is judged again on the
     // fresh frame; any difference sends nothing, and the next tick starts over.
     const fresh = await (0, cli_session_1.captureSessionOutputFresh)(worktreeId, cliToolId, (rawOutput ?? '').split('\n').length, instanceId);
+    if (generation !== undefined && !isTickCurrent(generation))
+        return false;
     if (!isStillEnterFallbackScreen(prompt, fresh)) {
         pollerState.enterFallbackCandidateKey = null;
         logger.debug('poller:auto-yes-enter-fallback-fresh-frame-differs', {
@@ -510,19 +763,34 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
         });
         return false;
     }
+    const receiptEpisode = receiptEpisodeOfSend(cliToolId, worktreeId, instanceId);
     try {
         await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
     }
+    catch (error) {
+        // Issue #3796: the Enter may or may not have reached the pane.
+        noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        throw error;
+    }
     finally {
         (0, tmux_capture_cache_1.invalidateCache)(sessionName);
     }
-    pollerState.enterFallbackSentKey = frameKey;
-    pollerState.enterFallbackCandidateKey = null;
-    (0, auto_yes_enter_fallback_1.recordEnterFallbackSent)(worktreeId, cliToolId, instanceId, {
-        promptType: promptData.type,
-        refusalReason: judgement.refusalReason,
-        screenKey,
-    });
+    // Issue #3796 review E: the Enter is out — for the episode it began for only.
+    noteAnswerSent(cliToolId, worktreeId, instanceId, false, receiptEpisode);
+    // Issue #3706: the Enter is out, but the per-screen record is the CURRENT
+    // session's: when the poller was stopped (the record was forgotten with it)
+    // or a new session began while `send-keys` was awaited, the return of this
+    // send must not put the record back. The audit row below is kept either way.
+    if (generation === undefined || (isPollerCurrent(generation) && isSameSession(generation))) {
+        pollerState.enterFallbackSentKey = frameKey;
+        pollerState.enterFallbackCandidateKey = null;
+        (0, auto_yes_enter_fallback_1.recordEnterFallbackSent)(worktreeId, cliToolId, instanceId, {
+            promptType: promptData.type,
+            refusalReason: judgement.refusalReason,
+            screenKey,
+            ...(generation !== undefined ? { epoch: generation.sessionEpoch } : {}),
+        });
+    }
     logger.info('poller:auto-yes-enter-fallback-sent', {
         worktreeId,
         cliToolId,
@@ -531,7 +799,7 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
         refusalReason: judgement.refusalReason,
         composerState: judgement.composerState,
     });
-    await finishAnsweredPrompt(prompt, promptDetection, exports.AUTO_YES_ENTER_FALLBACK_ANSWER);
+    await finishAnsweredPrompt(prompt, promptDetection, exports.AUTO_YES_ENTER_FALLBACK_ANSWER, generation);
     return true;
 }
 /**
@@ -543,24 +811,54 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput)
  * @param promptDetection - The detection `prompt.promptData` was read from; its
  *   content becomes the audit row's
  * @param answer - The answer that was sent
+ * @param generation - The tick's generation (Issue #3706). The keys are out, so
+ *   the task event and the audit row are always written: they record what the
+ *   agent actually received. What belongs to the poller is written to the
+ *   tick's own poller state only, never to a successor under the same key, and
+ *   the response poller restart and the terminal push are skipped when the
+ *   session was relaunched meanwhile.
  */
-async function finishAnsweredPrompt(prompt, promptDetection, answer) {
+async function finishAnsweredPrompt(prompt, promptDetection, answer, generation) {
     const { worktreeId, cliToolId, instanceId, compositeKey, pollerState, promptData, promptKey } = prompt;
-    // 6. Update timestamp and reset error count
-    updateLastServerResponseTimestamp(compositeKey, Date.now());
-    resetErrorCount(compositeKey);
-    // 7. Record answered prompt key and timestamp
-    pollerState.lastAnsweredPromptKey = promptKey;
-    pollerState.lastAnsweredAt = Date.now();
-    pollerState.lastSkipWarnKey = null;
-    logger.info('poller:response-sent', { worktreeId, cliToolId, instanceId });
+    // Issue #3706: the keys went to the session the tick started on. When a new
+    // one was begun while they were being sent, the new process never received
+    // this answer, so nothing that stands for "this instance's prompt was just
+    // answered" is written: not the dedup key (it would keep Auto-Yes off the new
+    // process's identical question), not the poller's response time, not the
+    // task event (the task looked up now may be the new session's). Only the
+    // audit row is, and it may not adopt a pending row saved after the tick began.
+    const sameSession = generation === undefined || isSameSession(generation);
+    if (sameSession) {
+        // 6. Update timestamp and reset error count
+        updateLastServerResponseTimestamp(compositeKey, Date.now(), generation?.pollerState);
+        resetErrorCount(compositeKey, generation?.pollerState);
+        // 7. Record answered prompt key and timestamp
+        pollerState.lastAnsweredPromptKey = promptKey;
+        pollerState.lastAnsweredAt = Date.now();
+        pollerState.lastSkipWarnKey = null;
+    }
+    // Issue #3748: what was answered and with what — the question (cut to
+    // MAX_LOGGED_QUESTION_LENGTH, never the full text) and the answer sent (the
+    // option number, `y`, or `[Enter]`) — so an answer that should not have been
+    // given can be told from the log alone.
+    logger.info('poller:response-sent', {
+        worktreeId,
+        cliToolId,
+        instanceId,
+        sameSession,
+        promptType: promptData.type,
+        question: (0, auto_yes_prompt_suppression_1.truncateForLog)(promptData.question),
+        answer,
+    });
     // Issue #1548: the prompt was answered without a human. Raised only after
     // the keys actually reached tmux, so a send that threw is not logged as an
     // answer. No-ops when this instance is not running a contract.
-    (0, task_transition_service_1.applyEventToActiveTask)((0, db_instance_1.getDbInstance)(), worktreeId, cliToolId, 
-    // Undefined means the primary instance, which the task lookup identifies
-    // by the tool id itself (see getActiveTaskForInstance).
-    instanceId ?? cliToolId, 'prompt_answered_auto', { promptType: promptData.type });
+    if (sameSession) {
+        (0, task_transition_service_1.applyEventToActiveTask)((0, db_instance_1.getDbInstance)(), worktreeId, cliToolId, 
+        // Undefined means the primary instance, which the task lookup identifies
+        // by the tool id itself (see getActiveTaskForInstance).
+        instanceId ?? cliToolId, 'prompt_answered_auto', { promptType: promptData.type });
+    }
     // Issue #1685: persist question/options/answer to chat history so the audit
     // trail survives even when the answer landed inside the response poller's
     // interval and the prompt was never saved as a pending message. Must never
@@ -575,6 +873,7 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer) {
             answer,
             answeredBy: 'auto',
             content: promptDetection.rawContent || promptDetection.cleanContent,
+            ...(sameSession ? {} : { pendingSavedAtOrBefore: generation.startedAt }),
         });
     }
     catch (recordError) {
@@ -605,6 +904,10 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer) {
         Promise.resolve().then(() => __importStar(require('../lib/polling/response-poller'))),
         Promise.resolve().then(() => __importStar(require('../lib/realtime/terminal-broadcast'))),
     ]);
+    // Re-read after the await, not the `sameSession` taken before the audit: a
+    // relaunch while the modules loaded makes the restart about the new process.
+    if (!sameSession || (generation !== undefined && !isSameSession(generation)))
+        return;
     startResponsePolling(worktreeId, cliToolId, instanceId);
     void broadcastTerminalSnapshotAfterInteraction(worktreeId, cliToolId, instanceId);
 }
@@ -621,10 +924,22 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer) {
  * @param rawOutput - The SAME tick's capture with its box drawing intact
  *   (Issue #2522). Omitting it costs Command Code's `AskUserQuestion` and
  *   nothing else; see {@link capturePollerFrame}.
+ * @param generation - The calling tick's generation (Issue #3706). Given, every
+ *   wait before a key — the ownership check, the Enter fallback's fresh capture,
+ *   each wait inside the send — is followed by {@link isTickCurrent}, and a tick
+ *   that lost it types nothing more and returns `no_answer`. Omitted (direct
+ *   callers, tests), nothing is checked, as before.
  * @returns 'responded' | 'no_prompt' | 'duplicate' | 'no_answer' | 'error'
  */
-async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput) {
+async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput, generation) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    // Issue #3706 / #3713: the send in flight, settled without an await once it
+    // comes back — as a partial answer when it was stopped with keys on the pane.
+    let attempt = null;
+    // Issue #3796: `sendPromptAnswer` began and has not returned — a throw now cut
+    // the send short, and the agy receipt gate is told so (`noteAnswerSent`).
+    let sendInFlight = false;
+    let receiptEpisode = null;
     try {
         // 1. Detect prompt.
         //
@@ -681,12 +996,27 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // makes "the status chain and Auto-Yes read the same live region" a fact
         // rather than a hope: there is no second normalisation to disagree with.
         const frame = (0, frame_1.normalizeFrame)(rawOutput ?? cleanOutput, cliToolId);
+        // Issue #3767: bracket the read so the receipt gate can tell when an agy
+        // dialog first appeared, not only what time this tick is.
+        if (cliToolId === 'antigravity')
+            (0, antigravity_receipt_episodes_1.beginAntigravityFrameRead)(worktreeId, instanceId);
         const promptDetection = (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput, receiptScope, frame);
+        if (cliToolId === 'antigravity')
+            (0, antigravity_receipt_episodes_1.endAntigravityFrameRead)(worktreeId, instanceId);
         if (!promptDetection.isPrompt || !promptDetection.promptData) {
+            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey);
             pollerState.lastAnsweredPromptKey = null;
             pollerState.lastAnsweredAt = null;
-            pollerState.lastSkipWarnKey = null;
             pollerState.enterFallbackCandidateKey = null;
+            // Issue #3757: agy's trust screen reads as no prompt (unnumbered: neither
+            // reader takes it), but it is one nobody here answers — record why, still
+            // as `no_prompt`. Before the warn key is cleared, so the WARN stays once
+            // per screen.
+            if (cliToolId === 'antigravity' &&
+                (0, auto_yes_prompt_suppression_1.suppressAntigravityTrustScreen)(worktreeId, instanceId, pollerState, frame, manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId))) {
+                return 'no_prompt';
+            }
+            pollerState.lastSkipWarnKey = null;
             if (cliToolId === 'antigravity' && !promptDetection.isPrompt) {
                 logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, () => (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput));
             }
@@ -708,6 +1038,37 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
             promptKey,
             frameKey,
         };
+        // 2.5. Issue #3706: an earlier answer to this prompt was stopped after some
+        // of its keys reached the pane (a `y` whose Enter was withheld). Typing the
+        // answer again would append to what is already in the input (`yy`), and
+        // what the pane holds now cannot be told from the frame, so the prompt is
+        // left for a human until it leaves the screen, another prompt replaces it
+        // (`partialAnswerScreenKey`: options and approvalTarget count, the cursor
+        // does not), or the session is relaunched. Recorded as a suppression, so
+        // the prompt Push and `cmate wait` see "withheld", not "answering".
+        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
+        const partial = (0, auto_yes_poller_state_1.getPartialAnswer)(compositeKey, epoch);
+        if (partial !== null) {
+            if (partial.screenKey === screenKey) {
+                (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
+                    reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
+                    mode: null,
+                    promptType: promptDetection.promptData.type,
+                }, `${frameKey}\u0000partial-answer`, 'poller:auto-yes-skipped-partial-answer', { promptType: promptDetection.promptData.type, stoppedAt: partial.at });
+                return 'no_answer';
+            }
+            // Another prompt is on screen: only the sends at the forgotten one's
+            // screen go with it (#3713) — one in flight at this screen keeps its hold.
+            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey, partial.screenKey);
+        }
+        // Issue #3713: a worktree ID move carried an answer still being sent to
+        // this session's key. Its keys may already be on the pane, and how its send
+        // ends is not known yet — so this screen gets no keys until it comes back
+        // (recorded as a partial answer above, or gone).
+        if ((0, auto_yes_poller_state_1.hasMovedSendInFlight)(compositeKey, epoch, screenKey)) {
+            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000moved-send-in-flight`, 'poller:auto-yes-skipped-moved-send-in-flight', { worktreeId, cliToolId, instanceId, promptType: promptDetection.promptData.type });
+            return 'no_answer';
+        }
         // 3., 3.2., 3.5. Frames that are not Auto-Yes's to answer: see
         // `suppressIfNotOursToAnswer`.
         const notOurs = (0, auto_yes_prompt_suppression_1.suppressIfNotOursToAnswer)(judged, frame);
@@ -720,9 +1081,10 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // 3.6. Issue #3397: a refused frame may be a choice screen CommandMate
         // cannot read; with Auto-Yes on it gets one Enter. See `tryEnterFallback`.
         if (notOurs.kind === 'dialog-gate-refused') {
-            return (await tryEnterFallback(judged, promptDetection, notOurs.dialogGate, rawOutput))
-                ? 'responded'
-                : 'no_answer';
+            if (!(await tryEnterFallback(judged, promptDetection, notOurs.dialogGate, rawOutput, generation))) {
+                return 'no_answer';
+            }
+            return 'responded';
         }
         // 4. Resolve auto answer under the execution contract's policy (Issue #1547).
         // Auto-Yes reads the frame itself instead of going through status-detector
@@ -759,6 +1121,8 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // Issue #2865: never auto-answer a same-named session another CommandMate
         // server created. The poller keeps running; it just does not type.
         const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
+        if (generation !== undefined && !isTickCurrent(generation))
+            return 'no_answer';
         if (ownership === null || ownership.verdict === 'foreign') {
             (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
                 worktreeId,
@@ -770,23 +1134,51 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
             });
             return 'no_answer';
         }
+        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch);
+        receiptEpisode = receiptEpisodeOfSend(cliToolId, worktreeId, instanceId);
+        sendInFlight = true;
         try {
             await (0, prompt_answer_sender_1.sendPromptAnswer)({
                 sessionName,
                 answer,
                 cliToolId,
                 promptData: promptDetection.promptData,
+                // Issue #3706: asked after each wait inside the send.
+                ...(generation !== undefined ? { stillCurrent: () => isTickCurrent(generation) } : {}),
             });
         }
         finally {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
         }
+        sendInFlight = false;
+        (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
+        // Issue #3796 review E: the episode the send began for, as on the failure side.
+        noteAnswerSent(cliToolId, worktreeId, instanceId, false, receiptEpisode);
         // 6., 7. The answer reached tmux: see `finishAnsweredPrompt`.
-        await finishAnsweredPrompt(judged, promptDetection, answer);
+        await finishAnsweredPrompt(judged, promptDetection, answer, generation);
         return 'responded';
     }
-    catch {
-        incrementErrorCount(compositeKey);
+    catch (error) {
+        // Issue #3706: a tick that lost its generation — the send stopped part-way
+        // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
+        // failure of the poller that now holds the key, and not an answer either.
+        if (generation !== undefined && !isTickCurrent(generation)) {
+            const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
+            // A stop with keys already on the pane: the next tick must not type the
+            // answer again over them (step 2.5). Recorded under the attempt's key as
+            // it is now — the new one when a worktree ID move carried it (#3713).
+            if (attempt !== null)
+                (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, keysSent === true);
+            if (sendInFlight)
+                noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+            logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent });
+            return 'no_answer';
+        }
+        if (attempt !== null)
+            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
+        if (sendInFlight)
+            noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        incrementErrorCount(compositeKey, generation?.pollerState);
         logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId });
         return 'error';
     }
@@ -797,19 +1189,40 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
  * @param worktreeId - Worktree identifier
  * @param cliToolId - CLI tool type being polled
  * @param instanceId - Agent instance ID being polled (Issue #896; equals cliToolId for primary)
+ * @param owner - The poller state whose timer fired (Issue #3706); a timer of a
+ *   poller that has since been replaced does nothing
  */
-async function pollAutoYes(worktreeId, cliToolId, instanceId) {
+async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
     // 1. Validate context
     const pollerState = getPollerState(compositeKey);
+    if (owner !== undefined && pollerState !== owner)
+        return;
     const contextResult = validatePollingContext(compositeKey, pollerState);
     if (contextResult !== 'valid') {
         return;
     }
+    const grant = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
+    if (!grant?.enabled)
+        return;
+    // Issue #3706: what this tick acts for, compared after every wait below.
+    const generation = {
+        compositeKey,
+        worktreeId,
+        cliToolId,
+        instanceId,
+        pollerState: pollerState,
+        grant,
+        sessionEpoch: (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey),
+        startedAt: Date.now(),
+    };
+    // Issue #3796: this is the session wait's tick (it was scheduled as one) —
+    // recorded before anything can fail, for the push gate.
+    if (pollerState.sessionWaitTickAt !== undefined)
+        pollerState.sessionWaitTickRanAt = generation.startedAt;
     try {
         // 2. Capture and clean output
-        const autoYesState = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
-        const captureLines = autoYesState?.stopPattern
+        const captureLines = grant.stopPattern
             ? auto_yes_config_1.FULL_CAPTURE_LINES
             : auto_yes_config_1.REDUCED_CAPTURE_LINES;
         // Issue #2522: one capture, both spellings. The cleaned string drives every
@@ -817,8 +1230,14 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId) {
         // so a dialog anchored on box drawing is not invisible to the one path that
         // can answer it without a human.
         const { raw: rawOutput, clean: cleanOutput } = await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId);
+        if (!isTickCurrent(generation)) {
+            endStaleTick(generation);
+            return;
+        }
         if (pollerState.waitingForSession) {
             pollerState.waitingForSession = false;
+            // Issue #3796: the session wait's tick ran here — read by the push gate.
+            pollerState.sessionAppearedAt = generation.startedAt;
             logger.info('poller:session-appeared', { worktreeId, cliToolId, instanceId });
         }
         const lines = cleanOutput.split('\n');
@@ -827,23 +1246,27 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId) {
             return;
         }
         // 4. Detect and respond to prompt
-        const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput);
+        const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput, generation);
+        if (!isTickCurrent(generation)) {
+            endStaleTick(generation);
+            return;
+        }
         // Issue #3329: a poll that ran to the end ends the run of errors, so only
         // failures in a row reach AUTO_STOP_ERROR_THRESHOLD — not ones scattered
         // over hours. Not on 'error': a capture that works followed by an answer
         // that fails every time must still back off and stop.
         if (result !== 'error') {
-            resetErrorCount(compositeKey);
+            resetErrorCount(compositeKey, generation.pollerState);
         }
         if (result === 'responded') {
-            scheduleNextPoll(worktreeId, cliToolId, instanceId, auto_yes_state_1.COOLDOWN_INTERVAL_MS);
+            scheduleNextPoll(generation, auto_yes_state_1.COOLDOWN_INTERVAL_MS);
             return;
         }
         // 5. Thinking check
         if (result === 'no_prompt') {
             const recentLines = lines.slice(-auto_yes_state_1.THINKING_CHECK_LINE_COUNT).join('\n');
             if ((0, cli_patterns_1.detectThinking)(cliToolId, recentLines)) {
-                scheduleNextPoll(worktreeId, cliToolId, instanceId, auto_yes_config_1.THINKING_POLLING_INTERVAL_MS);
+                scheduleNextPoll(generation, auto_yes_config_1.THINKING_POLLING_INTERVAL_MS);
                 return;
             }
         }
@@ -853,18 +1276,23 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId) {
         // the session it answers for (`auto-yes-lifecycle`), and `send --auto-yes`
         // enables it before the session starts — so wait until `expiresAt`, at the
         // backoff cap, instead of counting toward `consecutive_errors`.
-        if (await isSessionMissing(worktreeId, cliToolId, instanceId)) {
+        const sessionMissing = await isSessionMissing(worktreeId, cliToolId, instanceId);
+        if (!isTickCurrent(generation)) {
+            endStaleTick(generation);
+            return;
+        }
+        if (sessionMissing) {
             if (!pollerState.waitingForSession) {
                 pollerState.waitingForSession = true;
                 logger.info('poller:waiting-for-session', { worktreeId, cliToolId, instanceId });
             }
-            scheduleNextPoll(worktreeId, cliToolId, instanceId, auto_yes_state_1.MAX_BACKOFF_MS);
+            scheduleNextPoll(generation, auto_yes_state_1.MAX_BACKOFF_MS, { sessionWait: true });
             return;
         }
-        incrementErrorCount(compositeKey);
+        incrementErrorCount(compositeKey, generation.pollerState);
         logger.warn('poller:poll-error', { worktreeId, cliToolId, instanceId, error: (0, errors_1.getErrorMessage)(error) });
     }
-    scheduleNextPoll(worktreeId, cliToolId, instanceId);
+    scheduleNextPoll(generation);
 }
 /**
  * Whether a failed capture failed because the session does not exist
@@ -883,20 +1311,76 @@ async function isSessionMissing(worktreeId, cliToolId, instanceId) {
 /**
  * Schedule the next polling iteration
  *
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param instanceId - Agent instance ID being polled (Issue #896)
+ * Issue #3706: on the tick's OWN poller state, and only while it is still the
+ * one under its key. Re-reading by key let a tick that outlived a disable →
+ * enable write its timer over the new poller's `timerId`, leaving two chains.
+ *
+ * @param generation - The tick's generation
  * @param overrideInterval - Optional override for the next poll delay
+ * @param options.sessionWait - The tick waits for a session to appear (Issue #3791)
  */
-function scheduleNextPoll(worktreeId, cliToolId, instanceId, overrideInterval) {
-    const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
-    const pollerState = getPollerState(compositeKey);
-    if (!pollerState)
+function scheduleNextPoll(generation, overrideInterval, options = {}) {
+    if (!isPollerCurrent(generation))
         return;
+    const { worktreeId, cliToolId, instanceId, pollerState } = generation;
     const interval = Math.max(overrideInterval ?? pollerState.currentInterval, auto_yes_state_1.POLLING_INTERVAL_MS);
-    pollerState.timerId = setTimeout(() => {
-        pollAutoYes(worktreeId, cliToolId, instanceId);
+    // Issue #3791: only the session wait's tick is one the push gate waits for.
+    pollerState.sessionWaitTickAt = options.sessionWait === true ? Date.now() + interval : undefined;
+    // Issue #3796: any new timer supersedes the previous one's wake.
+    dropSessionWaitWake(generation.compositeKey);
+    const timerId = setTimeout(() => {
+        dropSessionWaitWake(generation.compositeKey, timerId);
+        void pollAutoYes(worktreeId, cliToolId, instanceId, pollerState);
     }, interval);
+    pollerState.timerId = timerId;
+    if (options.sessionWait === true)
+        armSessionWaitWake(generation, timerId);
+}
+/** compositeKey -> the pending session-wait tick's wake. At most one per poller key. */
+const sessionWaitWakes = (0, global_state_1.getOrInitGlobal)('__autoYesSessionWaitWakes', () => new Map());
+/**
+ * Stop listening for the session of `compositeKey` (Issue #3796).
+ *
+ * @param timerId - Only when the wake is this timer's: the timer firing drops
+ *   its own wake, never a successor's
+ */
+function dropSessionWaitWake(compositeKey, timerId) {
+    const wake = sessionWaitWakes.get(compositeKey);
+    if (wake === undefined || (timerId !== undefined && wake.timerId !== timerId))
+        return;
+    sessionWaitWakes.delete(compositeKey);
+    wake.unsubscribe();
+}
+/**
+ * Issue #3796: while the poller waits `MAX_BACKOFF_MS` for its session, the
+ * session's creation brings the tick forward to a poll interval — so the first
+ * prompt of a session started right after the poller looked (`send --auto-yes`
+ * enables Auto-Yes before the session exists) is answered, or its human
+ * notified, without waiting out the backoff. The push gate's hold follows the
+ * earlier tick (`autoYesHoldEndsAt`).
+ *
+ * The wake replaces the pending timer and nothing else: it does nothing once
+ * that timer fired (the tick drops the wake before it runs, so a tick in flight
+ * is never doubled), once another timer replaced it, or once the poller was
+ * stopped or replaced (`stopAutoYesPolling` drops it, and `scheduleNextPoll`
+ * checks the poller is still the generation's).
+ */
+function armSessionWaitWake(generation, timerId) {
+    const { compositeKey, worktreeId, cliToolId, instanceId, pollerState } = generation;
+    const sessionName = manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId);
+    const unsubscribe = (0, session_created_signal_1.onTmuxSessionCreated)(sessionName, () => {
+        const wake = sessionWaitWakes.get(compositeKey);
+        if (wake === undefined || wake.timerId !== timerId)
+            return;
+        sessionWaitWakes.delete(compositeKey);
+        if (!isPollerCurrent(generation) || pollerState.timerId !== timerId)
+            return;
+        clearTimeout(timerId);
+        logger.info('poller:session-created-wake', { worktreeId, cliToolId, instanceId });
+        // Still the session wait's tick — the one the push gate's hold is about.
+        scheduleNextPoll(generation, auto_yes_state_1.POLLING_INTERVAL_MS, { sessionWait: true });
+    });
+    sessionWaitWakes.set(compositeKey, { timerId, unsubscribe });
 }
 // =============================================================================
 // Public Poller API
@@ -920,6 +1404,11 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     }
     // Resolve the effective instance ID (primary === cliToolId).
     const effectiveInstanceId = instanceId ?? cliToolId;
+    // Issue #3730: nothing starts once a shutdown has recorded what it releases —
+    // a poller started after the record would be a grant the record never saw.
+    if ((0, auto_yes_state_1.isAutoYesShutdownStarted)()) {
+        return { started: false, reason: 'server shutting down' };
+    }
     // Check if auto-yes is enabled
     const autoYesState = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, effectiveInstanceId);
     if (!autoYesState?.enabled) {
@@ -938,7 +1427,7 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     }
     // Stop existing poller if cliToolId changed
     if (existingPollerState) {
-        stopAutoYesPolling(compositeKey);
+        stopAutoYesPolling(compositeKey, 'replaced');
     }
     // Create new poller state
     const pollerState = {
@@ -958,7 +1447,7 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
     // Start polling immediately
     pollerState.timerId = setTimeout(() => {
-        pollAutoYes(worktreeId, cliToolId, effectiveInstanceId);
+        void pollAutoYes(worktreeId, cliToolId, effectiveInstanceId, pollerState);
     }, auto_yes_state_1.POLLING_INTERVAL_MS);
     logger.info('poller:started', { worktreeId, cliToolId, instanceId: effectiveInstanceId });
     return { started: true };
@@ -968,9 +1457,16 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
  *
  * Issue #525: Changed from (worktreeId) to (compositeKey).
  *
+ * Issue #3730: `reason` is why the POLLER stops, logged on `poller:stopped`. It
+ * does not touch the grant: an ID move and a replacement stop the poller and
+ * keep the grant, so disabling stays each caller's own decision. Omitted, the
+ * reason of an enclosing {@link withPollerStopReason} applies (the lifecycle
+ * table's path), else `unspecified`.
+ *
  * @param compositeKey - Composite key (worktreeId:cliToolId)
+ * @param reason - Why the poller stops
  */
-function stopAutoYesPolling(compositeKey) {
+function stopAutoYesPolling(compositeKey, reason) {
     // Issue #3397: before the early return — the disable route and the session
     // cleanup call this for an instance whose poller may already be gone, and the
     // Enter record must not outlive the grant or the session either way.
@@ -981,23 +1477,32 @@ function stopAutoYesPolling(compositeKey) {
     if (pollerState.timerId) {
         clearTimeout(pollerState.timerId);
     }
+    dropSessionWaitWake(compositeKey);
     autoYesPollerStates.delete(compositeKey);
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
-    logger.info('poller:stopped', { compositeKey });
+    logger.info('poller:stopped', { compositeKey, reason: (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(reason, 'unspecified') });
 }
 /**
  * Stop all server-side auto-yes polling (graceful shutdown).
+ *
+ * Issue #3730: logs `shutdown` unless an enclosing
+ * {@link withPollerStopReason} says otherwise (the test reset). Writes nothing
+ * to disk: the record of the grants a shutdown released is the server's to
+ * make (`lib/auto-yes-shutdown-record`), never a side effect of this.
  */
 function stopAllAutoYesPolling() {
+    const reason = (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(undefined, 'shutdown');
     for (const [key, pollerState] of autoYesPollerStates.entries()) {
         if (pollerState.timerId) {
             clearTimeout(pollerState.timerId);
         }
+        dropSessionWaitWake(key);
         (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(key);
-        logger.info('poller:stopped', { compositeKey: key, reason: 'shutdown' });
+        logger.info('poller:stopped', { compositeKey: key, reason });
     }
     autoYesPollerStates.clear();
     (0, auto_yes_enter_fallback_1.clearEnterFallbacks)();
+    (0, auto_yes_poller_state_1.clearPartialAnswers)();
 }
 /**
  * Get all composite keys that have active auto-yes poller entries.
@@ -1017,12 +1522,22 @@ function getAutoYesPollerCompositeKeys() {
  * [SF-001] Uses shared filterCompositeKeysByWorktree (DRY).
  *
  * @param worktreeId - Worktree identifier
+ * @param options.reason - Issue #3730: why the pollers stop, for `poller:stopped`
+ * @param options.keepPartialAnswers - Issue #3713 (re-instruction 1, P2-1): the
+ *   disable route's "every agent" passes it — a disable, like one agent's
+ *   `stopAutoYesPolling`, keeps the memory of an answer stopped part-way and
+ *   the sends still in flight, so a disable → enable does not type over a
+ *   partial input. Omitted (the worktree being deleted, `session-cleanup` via
+ *   `auto-yes-lifecycle`), both are dropped and a late send records nothing.
  */
-function stopAutoYesPollingByWorktree(worktreeId) {
+function stopAutoYesPollingByWorktree(worktreeId, options) {
     const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId);
-    pollerKeys.forEach(key => stopAutoYesPolling(key));
+    // Issue #3730: `options.reason`, else the enclosing scope's (the lifecycle table).
+    pollerKeys.forEach(key => stopAutoYesPolling(key, options?.reason));
     // Issue #3397: and the records of instances whose poller had already stopped.
     (0, auto_yes_enter_fallback_1.forgetEnterFallbacksByWorktree)(worktreeId);
+    if (!options?.keepPartialAnswers)
+        (0, auto_yes_poller_state_1.forgetPartialAnswersByWorktree)(worktreeId);
 }
 /**
  * Check if any auto-yes poller is active for a given worktreeId.