commandmate 0.46.1 → 0.47.2

package/dist/server/src/lib/auto-yes-poller.js

@@ -45,14 +45,9 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTO_YES_ENTER_FALLBACK_ANSWER = void 0;
-exports.getActivePollerCount = getActivePollerCount;
+exports.capturePollerFrame = exports.captureAndCleanOutput = exports.AUTO_YES_ENTER_FALLBACK_ANSWER = exports.noHookReceiptHint = exports.isPollerActive = exports.getLastServerResponseTimestamp = exports.getActivePollerCount = void 0;
 exports.clearAllPollerStates = clearAllPollerStates;
-exports.getLastServerResponseTimestamp = getLastServerResponseTimestamp;
-exports.isPollerActive = isPollerActive;
 exports.validatePollingContext = validatePollingContext;
-exports.capturePollerFrame = capturePollerFrame;
-exports.captureAndCleanOutput = captureAndCleanOutput;
 exports.processStopConditionDelta = processStopConditionDelta;
 exports.detectAndRespondToPrompt = detectAndRespondToPrompt;
 exports.startAutoYesPolling = startAutoYesPolling;
@@ -63,11 +58,12 @@ exports.stopAutoYesPollingByWorktree = stopAutoYesPollingByWorktree;
 exports.isAnyPollerActiveForWorktree = isAnyPollerActiveForWorktree;
 const cli_session_1 = require("./session/cli-session");
 const response_checker_1 = require("./polling/response-checker");
-const antigravity_permission_receipts_1 = require("./polling/antigravity-permission-receipts");
+const antigravity_receipt_episodes_1 = require("./polling/antigravity-receipt-episodes");
 const auto_yes_resolver_1 = require("./polling/auto-yes-resolver");
 const auto_yes_policy_1 = require("./polling/auto-yes-policy");
 const detect_1 = require("./detection/tools/codex/detect");
 const frame_1 = require("./detection/tools/frame");
+const dialog_1 = require("./detection/tools/antigravity/dialog");
 const auto_yes_dialog_gate_1 = require("./polling/auto-yes-dialog-gate");
 const auto_yes_enter_fallback_1 = require("./polling/auto-yes-enter-fallback");
 const task_transition_service_1 = require("./tasks/task-transition-service");
@@ -77,108 +73,49 @@ const worktree_session_ownership_1 = require("./cli-tools/worktree-session-owner
 const prompt_answer_sender_1 = require("./prompt-answer-sender");
 const prompt_answer_semantic_1 = require("./prompt-answer-semantic");
 const tmux_1 = require("./tmux/tmux");
+const session_created_signal_1 = require("./tmux/session-created-signal");
 const manager_1 = require("./cli-tools/manager");
 const cli_patterns_1 = require("./detection/cli-patterns");
 const prompt_key_1 = require("./detection/prompt-key");
 const errors_1 = require("./errors");
 const tmux_capture_cache_1 = require("./tmux/tmux-capture-cache");
 const auto_yes_config_1 = require("../config/auto-yes-config");
+const auto_yes_poller_stop_reason_1 = require("./polling/auto-yes-poller-stop-reason");
 const logger_1 = require("../lib/logger");
 const logger = (0, logger_1.createLogger)('auto-yes-poller');
 const path_validator_1 = require("./security/path-validator");
 const auto_yes_state_1 = require("./auto-yes-state");
 const global_state_1 = require("./global-state");
-const auto_yes_suppression_reason_1 = require("./polling/auto-yes-suppression-reason");
 const auto_yes_poller_state_1 = require("./polling/auto-yes-poller-state");
 const auto_yes_prompt_suppression_1 = require("./polling/auto-yes-prompt-suppression");
-/** In-memory storage for poller states (globalThis for hot reload persistence) */
-const autoYesPollerStates = (0, global_state_1.getOrInitGlobal)('__autoYesPollerStates', () => new Map());
-/**
- * When `antigravity-autoyes-withheld-no-hook-receipt` was last logged, per
- * compositeKey (Issue #2857). The poller re-reads a static pane every 2s, so the
- * line is limited to one per {@link WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS} per
- * instance. globalThis for the same reason as the poller states above.
- */
-const withheldNoReceiptLoggedAt = (0, global_state_1.getOrInitGlobal)('__autoYesWithheldNoReceiptLoggedAt', () => new Map());
-/** Least gap between two `antigravity-autoyes-withheld-no-hook-receipt` lines for one instance. */
-const WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS = 60_000;
-// =============================================================================
-// Poller State Accessors (compositeKey-based)
-// =============================================================================
-/**
- * Get poller state by composite key.
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns Poller state or undefined
- */
-function getPollerState(compositeKey) {
-    return autoYesPollerStates.get(compositeKey);
-}
-/**
- * Get the number of active pollers.
- */
-function getActivePollerCount() {
-    return autoYesPollerStates.size;
-}
+const auto_yes_poller_generation_1 = require("./polling/auto-yes-poller-generation");
+const auto_yes_poller_receipt_log_1 = require("./polling/auto-yes-poller-receipt-log");
+const auto_yes_poller_enter_fallback_1 = require("./polling/auto-yes-poller-enter-fallback");
+const auto_yes_poller_capture_1 = require("./polling/auto-yes-poller-capture");
+const auto_yes_confirmation_ledger_1 = require("./polling/auto-yes-confirmation-ledger");
+const auto_yes_poller_steps_1 = require("./polling/auto-yes-poller-steps");
+// Issue #3783: split out; re-exported so existing importers are unchanged.
+var auto_yes_poller_generation_2 = require("./polling/auto-yes-poller-generation");
+Object.defineProperty(exports, "getActivePollerCount", { enumerable: true, get: function () { return auto_yes_poller_generation_2.getActivePollerCount; } });
+Object.defineProperty(exports, "getLastServerResponseTimestamp", { enumerable: true, get: function () { return auto_yes_poller_generation_2.getLastServerResponseTimestamp; } });
+Object.defineProperty(exports, "isPollerActive", { enumerable: true, get: function () { return auto_yes_poller_generation_2.isPollerActive; } });
+var auto_yes_poller_receipt_log_2 = require("./polling/auto-yes-poller-receipt-log");
+Object.defineProperty(exports, "noHookReceiptHint", { enumerable: true, get: function () { return auto_yes_poller_receipt_log_2.noHookReceiptHint; } });
+var auto_yes_poller_enter_fallback_2 = require("./polling/auto-yes-poller-enter-fallback");
+Object.defineProperty(exports, "AUTO_YES_ENTER_FALLBACK_ANSWER", { enumerable: true, get: function () { return auto_yes_poller_enter_fallback_2.AUTO_YES_ENTER_FALLBACK_ANSWER; } });
+var auto_yes_poller_capture_2 = require("./polling/auto-yes-poller-capture");
+Object.defineProperty(exports, "captureAndCleanOutput", { enumerable: true, get: function () { return auto_yes_poller_capture_2.captureAndCleanOutput; } });
+Object.defineProperty(exports, "capturePollerFrame", { enumerable: true, get: function () { return auto_yes_poller_capture_2.capturePollerFrame; } });
 /**
  * Clear all poller states.
  * Stops all active pollers before clearing state.
  * @internal Exported for testing purposes only.
  */
 function clearAllPollerStates() {
-    stopAllAutoYesPolling();
-    autoYesPollerStates.clear();
-    withheldNoReceiptLoggedAt.clear();
-}
-/**
- * Get the last server response timestamp for a composite key.
- *
- * Issue #525: Changed from (worktreeId) to (compositeKey).
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns Timestamp (Date.now()) of the last server response, or null if none
- */
-function getLastServerResponseTimestamp(compositeKey) {
-    const pollerState = getPollerState(compositeKey);
-    return pollerState?.lastServerResponseTimestamp ?? null;
-}
-/**
- * Check if a server-side auto-yes poller is active for a composite key.
- *
- * Issue #525: Changed from (worktreeId) to (compositeKey).
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns true if a poller is actively running
- */
-function isPollerActive(compositeKey) {
-    return autoYesPollerStates.has(compositeKey);
-}
-/**
- * Update the last server response timestamp.
- *
- * @param compositeKey - Composite key
- * @param timestamp - Timestamp value (Date.now())
- */
-function updateLastServerResponseTimestamp(compositeKey, timestamp, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
-    if (pollerState) {
-        pollerState.lastServerResponseTimestamp = timestamp;
-    }
-}
-/**
- * Reset error count for a poller and restore the default polling interval.
- * Called after every poll that ran to the end without an error (Issue #3329)
- * and after an answer is sent.
- *
- * @param compositeKey - Composite key
- * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
- */
-function resetErrorCount(compositeKey, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
-    if (pollerState) {
-        pollerState.consecutiveErrors = 0;
-        pollerState.currentInterval = auto_yes_state_1.POLLING_INTERVAL_MS;
-    }
+    // Issue #3730: a test seam, not a shutdown — logged as such.
+    (0, auto_yes_poller_stop_reason_1.withPollerStopReason)('reset', () => stopAllAutoYesPolling());
+    auto_yes_poller_generation_1.autoYesPollerStates.clear();
+    auto_yes_poller_receipt_log_1.withheldNoReceiptLoggedAt.clear();
 }
 /**
  * Increment error count and apply backoff if the threshold is exceeded.
@@ -188,7 +125,7 @@ function resetErrorCount(compositeKey, owner) {
  * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
  */
 function incrementErrorCount(compositeKey, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
+    const pollerState = (0, auto_yes_poller_generation_1.ownedPollerState)(compositeKey, owner);
     if (pollerState) {
         pollerState.consecutiveErrors++;
         pollerState.currentInterval = (0, auto_yes_state_1.calculateBackoffInterval)(pollerState.consecutiveErrors);
@@ -208,50 +145,10 @@ function incrementErrorCount(compositeKey, owner) {
                 // Issue #896: target the specific instance state (3-part keys carry instanceId).
                 (0, auto_yes_state_1.disableAutoYes)(worktreeId, cliToolId, 'consecutive_errors', (0, auto_yes_state_1.extractInstanceId)(compositeKey) ?? undefined);
             }
-            stopAutoYesPolling(compositeKey);
+            stopAutoYesPolling(compositeKey, 'consecutive-errors');
         }
     }
 }
-/**
- * The poller state under `compositeKey`, but only when it is `owner` — the
- * tick's own (Issue #3706). Without `owner` (callers outside a tick, and tests
- * driving `detectAndRespondToPrompt` with a hand-built state) it is the plain
- * by-key read this always was.
- */
-function ownedPollerState(compositeKey, owner) {
-    const pollerState = getPollerState(compositeKey);
-    if (owner !== undefined && pollerState !== owner)
-        return undefined;
-    return pollerState;
-}
-/** Is the tick's poller still the one under its key (not stopped, not replaced)? */
-function isPollerCurrent(generation) {
-    return getPollerState(generation.compositeKey) === generation.pollerState;
-}
-/**
- * May the tick still act: its poller, its grant (the same enable, not expired)
- * and its session (no relaunch since) are all still the ones it started under.
- * Checked after capture, after each wait before a key, and inside the send.
- */
-function isTickCurrent(generation) {
-    if (!isPollerCurrent(generation))
-        return false;
-    // `getAutoYesState` returns the stored object until it expires, when it
-    // stores (and returns) a disabled one — so an expiry fails identity too.
-    const grant = (0, auto_yes_state_1.getAutoYesState)(generation.worktreeId, generation.cliToolId, generation.instanceId);
-    if (grant !== generation.grant || !grant.enabled)
-        return false;
-    return isSameSession(generation);
-}
-/**
- * Is the session the tick answered still the one it started on (Issue #3706)?
- * What the follow-ups of an answer already sent — the response poller restart,
- * the terminal push — are judged by: a disable after the keys landed does not
- * un-send them, a relaunch does make them about another process.
- */
-function isSameSession(generation) {
-    return (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(generation.compositeKey) === generation.sessionEpoch;
-}
 /**
  * End a tick that found its generation gone (Issue #3706). It changes nothing;
  * it re-arms its timer only when its own poller is still the current one — a
@@ -263,25 +160,11 @@ function endStaleTick(generation) {
         worktreeId: generation.worktreeId,
         cliToolId: generation.cliToolId,
         instanceId: generation.instanceId,
-        pollerCurrent: isPollerCurrent(generation),
+        pollerCurrent: (0, auto_yes_poller_generation_1.isPollerCurrent)(generation),
     });
-    if (isPollerCurrent(generation))
+    if ((0, auto_yes_poller_generation_1.isPollerCurrent)(generation))
         scheduleNextPoll(generation);
 }
-/**
- * Check if the given prompt has already been answered recently.
- *
- * @param pollerState - Current poller state
- * @param promptKey - Composite key of the current prompt
- * @returns true if the prompt key matches and is within the retry expiry window
- */
-function isDuplicatePrompt(pollerState, promptKey) {
-    if (pollerState.lastAnsweredPromptKey !== promptKey)
-        return false;
-    if (pollerState.lastAnsweredAt === null)
-        return false;
-    return (Date.now() - pollerState.lastAnsweredAt) < auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS;
-}
 // =============================================================================
 // Extracted Functions for pollAutoYes (Issue #323: SRP decomposition)
 // =============================================================================
@@ -302,50 +185,22 @@ function validatePollingContext(compositeKey, pollerState) {
     const worktreeId = (0, auto_yes_state_1.extractWorktreeId)(compositeKey);
     const cliToolId = (0, auto_yes_state_1.extractCliToolId)(compositeKey);
     if (!cliToolId) {
-        stopAutoYesPolling(compositeKey);
+        stopAutoYesPolling(compositeKey, 'invalid-key');
         return 'expired';
     }
     // Issue #896: resolve instanceId so per-instance enabled state is checked.
     const instanceId = (0, auto_yes_state_1.extractInstanceId)(compositeKey) ?? undefined;
     const autoYesState = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, instanceId);
     if (!autoYesState?.enabled) {
-        stopAutoYesPolling(compositeKey);
+        // Issue #3730: the return value says 'expired' for every one of these (its
+        // callers only need "stop"), but the log says which it was — the getter
+        // has just turned a past deadline into `stopReason: 'expired'`, and
+        // anything else is a grant some other path disabled or removed.
+        stopAutoYesPolling(compositeKey, autoYesState?.stopReason === 'expired' ? 'expired' : 'not-enabled');
         return 'expired';
     }
     return 'valid';
 }
-/**
- * Capture tmux session output once, keeping both spellings (Issue #2522).
- *
- * @internal Exported for testing purposes only.
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param captureLines - Optional number of lines to capture
- * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
- * @returns The tick's raw capture and its cleaned form
- */
-async function capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId) {
-    const lines = captureLines ?? auto_yes_config_1.FULL_CAPTURE_LINES;
-    const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, lines, instanceId);
-    return { raw: output, clean: (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)) };
-}
-/**
- * Capture tmux session output and strip ANSI escape codes.
- *
- * Kept as the cleaned half of {@link capturePollerFrame} so the many callers and
- * tests that only ever wanted that string are untouched; `pollAutoYes` takes the
- * pair. `stripBoxDrawing` still runs exactly once per capture either way.
- *
- * @internal Exported for testing purposes only.
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param captureLines - Optional number of lines to capture
- * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
- * @returns Cleaned output string (ANSI stripped)
- */
-async function captureAndCleanOutput(worktreeId, cliToolId, captureLines, instanceId) {
-    return (await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId)).clean;
-}
 /**
  * Process stop condition check using delta-based approach.
  *
@@ -366,62 +221,13 @@ function processStopConditionDelta(compositeKey, pollerState, cleanOutput) {
     if (cleanOutput.length > baseline) {
         const newContent = cleanOutput.substring(baseline);
         pollerState.stopCheckBaselineLength = cleanOutput.length;
-        return (0, auto_yes_state_1.checkStopCondition)(compositeKey, newContent, stopAutoYesPolling);
+        return (0, auto_yes_state_1.checkStopCondition)(compositeKey, newContent, (key) => stopAutoYesPolling(key, 'stop-pattern'));
     }
     else if (cleanOutput.length < baseline) {
         pollerState.stopCheckBaselineLength = cleanOutput.length;
     }
     return false;
 }
-/**
- * Say, once a minute, that Auto-Yes left an agy dialog alone for want of a hook
- * receipt (Issue #2857).
- *
- * `detectPromptOnCleanFrame` hands a frame the receipt gate (#2849) withholds
- * back as an ordinary `isPrompt: false`, so the poller cannot tell "no dialog on
- * the pane" from "a dialog agy never asked us about" by looking at the result.
- * The gate is the ONLY thing `receiptScope` changes, so the same frame read
- * without it answering a prompt is exactly the withheld case. That second
- * reading is taken only after the cheap tests: no receipt for this instance in
- * the window (with one, the gate let the frame through and a no-prompt result is
- * a real one) and no line for it in the last minute.
- *
- * Why it is worth a line: a machine whose `~/.gemini/config/hooks.json` points at
- * another server (#2622) never sends us the question, and every real dialog then
- * waits for a human with no sign of why. The line names the file to look at.
- * The response-checker's own `antigravity-dialog-no-recent-receipt` stays at
- * debug — it prints on every tick the same pane is read again.
- *
- * @param compositeKey - The instance's key, for the once-a-minute limit
- * @param readWithoutGate - The same frame read without `receiptScope`
- */
-function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, readWithoutGate) {
-    if ((0, antigravity_permission_receipts_1.hasRecentAntigravityPermissionReceipt)(worktreeId, 'antigravity', instanceId))
-        return;
-    const now = Date.now();
-    const lastLoggedAt = withheldNoReceiptLoggedAt.get(compositeKey);
-    if (lastLoggedAt !== undefined && now - lastLoggedAt < WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS)
-        return;
-    const ungated = readWithoutGate();
-    if (!ungated.isPrompt || !ungated.promptData)
-        return;
-    for (const [key, loggedAt] of withheldNoReceiptLoggedAt) {
-        if (now - loggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS)
-            withheldNoReceiptLoggedAt.delete(key);
-    }
-    withheldNoReceiptLoggedAt.set(compositeKey, now);
-    logger.info('antigravity-autoyes-withheld-no-hook-receipt', {
-        worktreeId,
-        instanceId: instanceId ?? 'antigravity',
-        windowMs: antigravity_permission_receipts_1.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS,
-        hint: 'hook の受信記録が直近に無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認',
-    });
-}
-/**
- * The audit row's `answer` for the Enter (Issue #3397): not a digit, so the
- * History reads as "Auto-Yes pressed Enter" rather than as a chosen option.
- */
-exports.AUTO_YES_ENTER_FALLBACK_ANSWER = '[Enter]';
 /**
  * Issue #3397: is the fresh capture still the screen the Enter was decided for?
  * Re-reads it the way one tick does — prompt reading, the same `promptFrameKey`,
@@ -497,19 +303,20 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
         });
         return false;
     }
-    // 3. The contract policy, as step 4 reads it.
+    // 3. The contract policy, as step 4 reads it (Issue #3822: a failed lookup withholds).
     const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
     const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy);
     if (resolution.suppressedBy) {
         pollerState.enterFallbackCandidateKey = null;
+        const mode = (0, auto_yes_resolver_1.policyLookupMode)(policy);
         (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(prompt, {
             reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
+            mode,
             promptType: promptData.type,
             pattern: resolution.pattern,
-        }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${policy?.mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
+        }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
             reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
+            mode,
             pattern: resolution.pattern,
             promptType: promptData.type,
             enterFallback: true,
@@ -544,9 +351,11 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
     // 5. Never another server's session (Issue #2865).
     const sessionName = manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId);
     const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
-    if (generation !== undefined && !isTickCurrent(generation))
+    if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation))
         return false;
     if (ownership === null || ownership.verdict === 'foreign') {
+        // Issue #3820: the ledger's own reason, as `skippedForUnownedSession` records it.
+        (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(prompt, 'foreign-session');
         (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
             worktreeId,
             cliToolId,
@@ -565,7 +374,7 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
     // has the box back. Everything that decided the Enter is judged again on the
     // fresh frame; any difference sends nothing, and the next tick starts over.
     const fresh = await (0, cli_session_1.captureSessionOutputFresh)(worktreeId, cliToolId, (rawOutput ?? '').split('\n').length, instanceId);
-    if (generation !== undefined && !isTickCurrent(generation))
+    if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation))
         return false;
     if (!isStillEnterFallbackScreen(prompt, fresh)) {
         pollerState.enterFallbackCandidateKey = null;
@@ -577,17 +386,29 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
         });
         return false;
     }
+    const receiptEpisode = (0, auto_yes_poller_receipt_log_1.receiptEpisodeOfSend)(cliToolId, worktreeId, instanceId);
+    // Issue #3820: taken before the await, so the result goes to this confirmation.
+    const ledgerAttempt = (0, auto_yes_confirmation_ledger_1.beginLedgerAttempt)(prompt, 'enter-fallback');
     try {
         await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
     }
+    catch (error) {
+        // Issue #3796: the Enter may or may not have reached the pane.
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(ledgerAttempt, 'failed');
+        throw error;
+    }
     finally {
         (0, tmux_capture_cache_1.invalidateCache)(sessionName);
     }
+    // Issue #3796 review E: the Enter is out — for the episode it began for only.
+    (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, false, receiptEpisode);
+    (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(ledgerAttempt, 'ok');
     // Issue #3706: the Enter is out, but the per-screen record is the CURRENT
     // session's: when the poller was stopped (the record was forgotten with it)
     // or a new session began while `send-keys` was awaited, the return of this
     // send must not put the record back. The audit row below is kept either way.
-    if (generation === undefined || (isPollerCurrent(generation) && isSameSession(generation))) {
+    if (generation === undefined || ((0, auto_yes_poller_generation_1.isPollerCurrent)(generation) && (0, auto_yes_poller_generation_1.isSameSession)(generation))) {
         pollerState.enterFallbackSentKey = frameKey;
         pollerState.enterFallbackCandidateKey = null;
         (0, auto_yes_enter_fallback_1.recordEnterFallbackSent)(worktreeId, cliToolId, instanceId, {
@@ -605,7 +426,7 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
         refusalReason: judgement.refusalReason,
         composerState: judgement.composerState,
     });
-    await finishAnsweredPrompt(prompt, promptDetection, exports.AUTO_YES_ENTER_FALLBACK_ANSWER, generation);
+    await finishAnsweredPrompt(prompt, promptDetection, auto_yes_poller_enter_fallback_1.AUTO_YES_ENTER_FALLBACK_ANSWER, generation);
     return true;
 }
 /**
@@ -633,17 +454,29 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
     // process's identical question), not the poller's response time, not the
     // task event (the task looked up now may be the new session's). Only the
     // audit row is, and it may not adopt a pending row saved after the tick began.
-    const sameSession = generation === undefined || isSameSession(generation);
+    const sameSession = generation === undefined || (0, auto_yes_poller_generation_1.isSameSession)(generation);
     if (sameSession) {
         // 6. Update timestamp and reset error count
-        updateLastServerResponseTimestamp(compositeKey, Date.now(), generation?.pollerState);
-        resetErrorCount(compositeKey, generation?.pollerState);
+        (0, auto_yes_poller_generation_1.updateLastServerResponseTimestamp)(compositeKey, Date.now(), generation?.pollerState);
+        (0, auto_yes_poller_generation_1.resetErrorCount)(compositeKey, generation?.pollerState);
         // 7. Record answered prompt key and timestamp
         pollerState.lastAnsweredPromptKey = promptKey;
         pollerState.lastAnsweredAt = Date.now();
         pollerState.lastSkipWarnKey = null;
     }
-    logger.info('poller:response-sent', { worktreeId, cliToolId, instanceId, sameSession });
+    // Issue #3748: what was answered and with what — the question (cut to
+    // MAX_LOGGED_QUESTION_LENGTH, never the full text) and the answer sent (the
+    // option number, `y`, or `[Enter]`) — so an answer that should not have been
+    // given can be told from the log alone.
+    logger.info('poller:response-sent', {
+        worktreeId,
+        cliToolId,
+        instanceId,
+        sameSession,
+        promptType: promptData.type,
+        question: (0, auto_yes_prompt_suppression_1.truncateForLog)(promptData.question),
+        answer,
+    });
     // Issue #1548: the prompt was answered without a human. Raised only after
     // the keys actually reached tmux, so a send that threw is not logged as an
     // answer. No-ops when this instance is not running a contract.
@@ -700,11 +533,152 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
     ]);
     // Re-read after the await, not the `sameSession` taken before the audit: a
     // relaunch while the modules loaded makes the restart about the new process.
-    if (!sameSession || (generation !== undefined && !isSameSession(generation)))
+    if (!sameSession || (generation !== undefined && !(0, auto_yes_poller_generation_1.isSameSession)(generation)))
         return;
     startResponsePolling(worktreeId, cliToolId, instanceId);
     void broadcastTerminalSnapshotAfterInteraction(worktreeId, cliToolId, instanceId);
 }
+/**
+ * Step 1 of `detectAndRespondToPrompt`: normalise the tick's frame once and
+ * read the prompt on it.
+ */
+function readPromptFrame(worktreeId, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput) {
+    const receiptScope = { worktreeId, instanceId };
+    // Issue #3183: the ONE frame every judgement below reads — normalised once,
+    // from the capture as captured (the input-box markers are rule rows the
+    // cleaned spelling has blanked), and handed as the same object to the
+    // prompt reading, the codex launch guards and the dialog gate. That is what
+    // makes "the status chain and Auto-Yes read the same live region" a fact
+    // rather than a hope: there is no second normalisation to disagree with.
+    const frame = (0, frame_1.normalizeFrame)(rawOutput ?? cleanOutput, cliToolId);
+    // Issue #3767: bracket the read so the receipt gate can tell when an agy
+    // dialog first appeared, not only what time this tick is.
+    if (cliToolId === 'antigravity')
+        (0, antigravity_receipt_episodes_1.beginAntigravityFrameRead)(worktreeId, instanceId);
+    const promptDetection = (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput, receiptScope, frame);
+    if (cliToolId === 'antigravity')
+        (0, antigravity_receipt_episodes_1.endAntigravityFrameRead)(worktreeId, instanceId);
+    return { frame, promptDetection };
+}
+/**
+ * What `detectAndRespondToPrompt` does to the poller state on a frame with no
+ * prompt to answer, before it returns `no_prompt`.
+ */
+function noteNoPromptOnScreen(tick) {
+    const { worktreeId, cliToolId, instanceId, compositeKey, pollerState, frame, promptDetection, cleanOutput, precomputedLines, rawOutput, } = tick;
+    (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey);
+    pollerState.lastAnsweredPromptKey = null;
+    pollerState.lastAnsweredAt = null;
+    pollerState.enterFallbackCandidateKey = null;
+    // Issue #3757: agy's trust screen reads as no prompt (unnumbered: neither
+    // reader takes it), but it is one nobody here answers — record why, still
+    // as `no_prompt`. Before the warn key is cleared, so the WARN stays once
+    // per screen.
+    // Issue #3820: the trust screen records itself in the ledger when it records
+    // its reason (`suppressAntigravityTrustScreen`).
+    if (cliToolId === 'antigravity' &&
+        (0, auto_yes_prompt_suppression_1.suppressAntigravityTrustScreen)(worktreeId, instanceId, pollerState, frame, manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId))) {
+        return;
+    }
+    pollerState.lastSkipWarnKey = null;
+    if (cliToolId === 'antigravity' && !promptDetection.isPrompt) {
+        const seen = (0, auto_yes_poller_receipt_log_1.logIfWithheldForWantOfReceipt)(worktreeId, instanceId, compositeKey, () => (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput));
+        // Issue #3820: past the receipt window the gated reading says "no prompt"
+        // while the dialog is still up. The ungated reading says it is, so the
+        // ledger keeps the same confirmation (and the same withheld interval)
+        // rather than closing it on every tick outside the window.
+        if (seen !== null) {
+            const scope = { compositeKey, worktreeId, cliToolId, instanceId };
+            (0, auto_yes_confirmation_ledger_1.observeLedgerScreen)(scope, (0, auto_yes_poller_state_1.ledgerScreenKey)(seen.promptData), seen.promptData.type, ledgerCallOf(cliToolId, worktreeId, instanceId));
+            if (seen.reason !== null)
+                (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(scope, seen.reason);
+        }
+    }
+}
+/**
+ * Issue #3820 (design §2.4, PR 3): the agy call the receipt episode on screen
+ * was accepted for, for the ledger to tie the confirmation to. Asked after the
+ * frame was judged; read only to record, and never throws.
+ */
+function ledgerCallOf(cliToolId, worktreeId, instanceId) {
+    if (cliToolId !== 'antigravity')
+        return {};
+    try {
+        const callId = (0, antigravity_receipt_episodes_1.getAntigravityAcceptedReceiptCallId)(worktreeId, instanceId);
+        return callId === null ? {} : { callId };
+    }
+    catch {
+        // Recording only: a failure here ties nothing and changes nothing else.
+        return {};
+    }
+}
+/**
+ * Issue #3820: the result of a send that threw, as the ledger counts it.
+ * `keysSent` is what the sender said (#3706); a throw that says nothing is a
+ * failure whose keys may or may not be on the pane.
+ */
+function attemptResultOfThrow(keysSent) {
+    if (keysSent === true)
+        return 'partial';
+    if (keysSent === false)
+        return 'no-keys-sent';
+    return 'failed';
+}
+/**
+ * Issue #3820: the evidence an answer on the screen path is given on (design
+ * §7 PR 1). A tool's own dialog detector vouched for the frame: `L3`. The
+ * gate did not judge it (a `legacy` tool, a non-multiple-choice prompt): the
+ * generic reading alone, `L4`.
+ *
+ * agy's gate is `legacy` (`gated: false`), yet its prompts are read by its own
+ * reader first (`detectPromptOnCleanFrame` returns that reader's result
+ * whenever it reads the frame). Which reader it was is not on the detection
+ * result, so it is asked of the same reader on the same text here — for the
+ * label only; the answer was decided before this is called. Read by agy's own
+ * reader, and through the receipt gate (the tick's reading carried the
+ * receipt scope): `L3`, with `receiptAccepted` on the attempt.
+ */
+function answerBasisOf(prompt, cleanOutput) {
+    if (prompt.cliToolId === 'antigravity') {
+        return (0, dialog_1.detectAntigravityNumberedDialogPrompt)(cleanOutput) !== null ? 'L3' : 'L4';
+    }
+    const gate = prompt.dialogGate;
+    return gate !== undefined && gate.gated && gate.allowed && gate.dialog !== null ? 'L3' : 'L4';
+}
+/**
+ * The `catch` of `detectAndRespondToPrompt`: settles the send in flight and
+ * tells an abandoned tick from a failed one.
+ */
+function settleFailedTick(error, tick) {
+    const { worktreeId, cliToolId, instanceId, compositeKey, generation, attempt, sendInFlight, receiptEpisode } = tick;
+    const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
+    // Issue #3820: the send that was cut short, in the ledger — before the send
+    // record below is settled, whose state says whether it had expired.
+    if (attempt !== null && sendInFlight) {
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(attempt.ledger, attemptResultOfThrow(keysSent), { expired: attempt.state === 'expired' });
+    }
+    // Issue #3706: a tick that lost its generation — the send stopped part-way
+    // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
+    // failure of the poller that now holds the key, and not an answer either.
+    if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
+        // A stop with keys already on the pane: the next tick must not type the
+        // answer again over them (step 2.5). Recorded under the attempt's key as
+        // it is now — the new one when a worktree ID move carried it (#3713).
+        if (attempt !== null)
+            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, keysSent === true);
+        if (sendInFlight)
+            (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent });
+        return 'no_answer';
+    }
+    if (attempt !== null)
+        (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
+    if (sendInFlight)
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+    incrementErrorCount(compositeKey, generation?.pollerState);
+    logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId });
+    return 'error';
+}
 /**
  * Detect prompt in terminal output, resolve auto-answer, and send response.
  *
@@ -730,6 +704,14 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
     // Issue #3706 / #3713: the send in flight, settled without an await once it
     // comes back — as a partial answer when it was stopped with keys on the pane.
     let attempt = null;
+    // Issue #3796: `sendPromptAnswer` began and has not returned — a throw now cut
+    // the send short, and the agy receipt gate is told so (`noteAnswerSent`).
+    let sendInFlight = false;
+    let receiptEpisode = null;
+    // Issue #3820: the ledger's tick. A tick that read the screen and saw no
+    // confirmation closes the open one as gone when it ends (`endLedgerTick`).
+    const ledgerScope = { compositeKey, worktreeId, cliToolId, instanceId };
+    const ledgerTick = (0, auto_yes_confirmation_ledger_1.beginLedgerTick)(ledgerScope);
     try {
         // 1. Detect prompt.
         //
@@ -770,38 +752,38 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // machine whose hook does not reach us. The price is that Auto-Yes leaves
         // such a machine's dialogs alone, which is why `logIfWithheldForWantOfReceipt`
         // says so.
-        // Issue #3397: a session begun since the last tick (a relaunch the poller
-        // outlived) starts with no screen that had its Enter.
-        const epoch = (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey);
-        if ((pollerState.enterFallbackEpoch ?? 0) !== epoch) {
-            pollerState.enterFallbackSentKey = null;
-            pollerState.enterFallbackCandidateKey = null;
-            pollerState.enterFallbackEpoch = epoch;
-        }
-        const receiptScope = { worktreeId, instanceId };
-        // Issue #3183: the ONE frame every judgement below reads — normalised once,
-        // from the capture as captured (the input-box markers are rule rows the
-        // cleaned spelling has blanked), and handed as the same object to the
-        // prompt reading, the codex launch guards and the dialog gate. That is what
-        // makes "the status chain and Auto-Yes read the same live region" a fact
-        // rather than a hope: there is no second normalisation to disagree with.
-        const frame = (0, frame_1.normalizeFrame)(rawOutput ?? cleanOutput, cliToolId);
-        const promptDetection = (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput, receiptScope, frame);
+        const epoch = (0, auto_yes_poller_enter_fallback_1.syncEnterFallbackEpoch)(compositeKey, pollerState);
+        const { frame, promptDetection } = readPromptFrame(worktreeId, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput);
         if (!promptDetection.isPrompt || !promptDetection.promptData) {
-            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey);
-            pollerState.lastAnsweredPromptKey = null;
-            pollerState.lastAnsweredAt = null;
-            pollerState.lastSkipWarnKey = null;
-            pollerState.enterFallbackCandidateKey = null;
-            if (cliToolId === 'antigravity' && !promptDetection.isPrompt) {
-                logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, () => (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput));
-            }
+            noteNoPromptOnScreen({
+                worktreeId,
+                cliToolId,
+                instanceId,
+                compositeKey,
+                pollerState,
+                frame,
+                promptDetection,
+                cleanOutput,
+                precomputedLines,
+                rawOutput,
+            });
             return 'no_prompt';
         }
+        // Issue #3820: computed here, before the duplicate check, so the ledger
+        // sees the confirmation on every tick it is on screen (step 2.5 below
+        // reads the same key).
+        // The ledger's own key keeps the body (`ledgerScreenKey`): two commands
+        // that differ by a `>` or an indent are two confirmations to count.
+        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
+        // agy (PR 3): tied to the call the receipt that let it through asked about.
+        (0, auto_yes_confirmation_ledger_1.observeLedgerScreen)(ledgerScope, (0, auto_yes_poller_state_1.ledgerScreenKey)(promptDetection.promptData), promptDetection.promptData.type, ledgerCallOf(cliToolId, worktreeId, instanceId));
         // 2. Check for duplicate prompt (Issue #306)
         const promptKey = (0, prompt_key_1.generatePromptKey)(promptDetection.promptData);
         const frameKey = (0, auto_yes_poller_state_1.promptFrameKey)(promptDetection.promptData);
-        if (isDuplicatePrompt(pollerState, promptKey)) {
+        if ((0, auto_yes_poller_generation_1.isDuplicatePrompt)(pollerState, promptKey)) {
+            // Issue #3820: not answered on this tick either — an interval of its own
+            // reason, so the count can tell the wait for an answer to land apart.
+            (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(ledgerScope, 'answered-recently');
             return 'duplicate';
         }
         const judged = {
@@ -822,27 +804,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // (`partialAnswerScreenKey`: options and approvalTarget count, the cursor
         // does not), or the session is relaunched. Recorded as a suppression, so
         // the prompt Push and `cmate wait` see "withheld", not "answering".
-        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
-        const partial = (0, auto_yes_poller_state_1.getPartialAnswer)(compositeKey, epoch);
-        if (partial !== null) {
-            if (partial.screenKey === screenKey) {
-                (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
-                    reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
-                    mode: null,
-                    promptType: promptDetection.promptData.type,
-                }, `${frameKey}\u0000partial-answer`, 'poller:auto-yes-skipped-partial-answer', { promptType: promptDetection.promptData.type, stoppedAt: partial.at });
-                return 'no_answer';
-            }
-            // Another prompt is on screen: only the sends at the forgotten one's
-            // screen go with it (#3713) — one in flight at this screen keeps its hold.
-            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey, partial.screenKey);
-        }
-        // Issue #3713: a worktree ID move carried an answer still being sent to
-        // this session's key. Its keys may already be on the pane, and how its send
-        // ends is not known yet — so this screen gets no keys until it comes back
-        // (recorded as a partial answer above, or gone).
-        if ((0, auto_yes_poller_state_1.hasMovedSendInFlight)(compositeKey, epoch, screenKey)) {
-            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000moved-send-in-flight`, 'poller:auto-yes-skipped-moved-send-in-flight', { worktreeId, cliToolId, instanceId, promptType: promptDetection.promptData.type });
+        if ((0, auto_yes_poller_steps_1.withheldForEarlierSend)(judged, screenKey, epoch)) {
             return 'no_answer';
         }
         // 3., 3.2., 3.5. Frames that are not Auto-Yes's to answer: see
@@ -857,9 +819,10 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // 3.6. Issue #3397: a refused frame may be a choice screen CommandMate
         // cannot read; with Auto-Yes on it gets one Enter. See `tryEnterFallback`.
         if (notOurs.kind === 'dialog-gate-refused') {
-            return (await tryEnterFallback(judged, promptDetection, notOurs.dialogGate, rawOutput, generation))
-                ? 'responded'
-                : 'no_answer';
+            if (!(await tryEnterFallback(judged, promptDetection, notOurs.dialogGate, rawOutput, generation))) {
+                return 'no_answer';
+            }
+            return 'responded';
         }
         // 4. Resolve auto answer under the execution contract's policy (Issue #1547).
         // Auto-Yes reads the frame itself instead of going through status-detector
@@ -867,25 +830,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // auto-answer: a prompt the policy withholds is left for a human, and the
         // response poller's prompt path (WS broadcast + Web Push, see
         // polling/response-checker.ts) is what tells them it is waiting.
-        const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
-        const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptDetection.promptData, policy);
-        if (resolution.suppressedBy) {
-            // Issue #1684: the log line alone leaves a CLI-driven pipeline blind to
-            // why its worker stalled. Record the suppression so buildCurrentOutput
-            // can publish it (`autoYes.lastSuppression` in capture --json).
-            (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
-                reason: resolution.suppressedBy,
-                mode: policy?.mode ?? null,
-                promptType: promptDetection.promptData.type,
-                pattern: resolution.pattern,
-            }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${policy?.mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
-                reason: resolution.suppressedBy,
-                mode: policy?.mode ?? null,
-                pattern: resolution.pattern,
-                promptType: promptDetection.promptData.type,
-            });
-        }
-        const answer = resolution.answer;
+        const answer = (0, auto_yes_poller_steps_1.resolveAnswerUnderPolicy)(judged);
         if (answer === null) {
             return 'no_answer';
         }
@@ -896,20 +841,18 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // Issue #2865: never auto-answer a same-named session another CommandMate
         // server created. The poller keeps running; it just does not type.
         const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
-        if (generation !== undefined && !isTickCurrent(generation))
+        if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation))
             return 'no_answer';
-        if (ownership === null || ownership.verdict === 'foreign') {
-            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
-                worktreeId,
-                cliToolId,
-                instanceId,
-                sessionName,
-                sessionPath: ownership?.sessionPath ?? null,
-                reason: ownership ? 'foreign' : 'worktree_not_found',
-            });
+        if ((0, auto_yes_poller_steps_1.skippedForUnownedSession)(judged, sessionName, ownership)) {
             return 'no_answer';
         }
-        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch);
+        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch, 
+        // Issue #3820: an agy prompt read past the gate is one a hook receipt let through.
+        (0, auto_yes_confirmation_ledger_1.beginLedgerAttempt)(ledgerScope, answerBasisOf(judged, cleanOutput), {
+            receiptAccepted: cliToolId === 'antigravity',
+        }));
+        receiptEpisode = (0, auto_yes_poller_receipt_log_1.receiptEpisodeOfSend)(cliToolId, worktreeId, instanceId);
+        sendInFlight = true;
         try {
             await (0, prompt_answer_sender_1.sendPromptAnswer)({
                 sessionName,
@@ -917,36 +860,35 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
                 cliToolId,
                 promptData: promptDetection.promptData,
                 // Issue #3706: asked after each wait inside the send.
-                ...(generation !== undefined ? { stillCurrent: () => isTickCurrent(generation) } : {}),
+                ...(generation !== undefined ? { stillCurrent: () => (0, auto_yes_poller_generation_1.isTickCurrent)(generation) } : {}),
             });
         }
         finally {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
         }
+        sendInFlight = false;
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(attempt.ledger, 'ok', { expired: attempt.state === 'expired' });
         (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
+        // Issue #3796 review E: the episode the send began for, as on the failure side.
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, false, receiptEpisode);
         // 6., 7. The answer reached tmux: see `finishAnsweredPrompt`.
         await finishAnsweredPrompt(judged, promptDetection, answer, generation);
         return 'responded';
     }
     catch (error) {
-        // Issue #3706: a tick that lost its generation — the send stopped part-way
-        // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
-        // failure of the poller that now holds the key, and not an answer either.
-        if (generation !== undefined && !isTickCurrent(generation)) {
-            const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
-            // A stop with keys already on the pane: the next tick must not type the
-            // answer again over them (step 2.5). Recorded under the attempt's key as
-            // it is now — the new one when a worktree ID move carried it (#3713).
-            if (attempt !== null)
-                (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, keysSent === true);
-            logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent });
-            return 'no_answer';
-        }
-        if (attempt !== null)
-            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
-        incrementErrorCount(compositeKey, generation?.pollerState);
-        logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId });
-        return 'error';
+        return settleFailedTick(error, {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            compositeKey,
+            generation,
+            attempt,
+            sendInFlight,
+            receiptEpisode,
+        });
+    }
+    finally {
+        (0, auto_yes_confirmation_ledger_1.endLedgerTick)(ledgerScope, ledgerTick);
     }
 }
 /**
@@ -961,7 +903,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
 async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
     // 1. Validate context
-    const pollerState = getPollerState(compositeKey);
+    const pollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
     if (owner !== undefined && pollerState !== owner)
         return;
     const contextResult = validatePollingContext(compositeKey, pollerState);
@@ -982,6 +924,10 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         sessionEpoch: (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey),
         startedAt: Date.now(),
     };
+    // Issue #3796: this is the session wait's tick (it was scheduled as one) —
+    // recorded before anything can fail, for the push gate.
+    if (pollerState.sessionWaitTickAt !== undefined)
+        pollerState.sessionWaitTickRanAt = generation.startedAt;
     try {
         // 2. Capture and clean output
         const captureLines = grant.stopPattern
@@ -991,13 +937,15 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // step below exactly as it did; the raw one is carried to the prompt reading
         // so a dialog anchored on box drawing is not invisible to the one path that
         // can answer it without a human.
-        const { raw: rawOutput, clean: cleanOutput } = await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId);
-        if (!isTickCurrent(generation)) {
+        const { raw: rawOutput, clean: cleanOutput } = await (0, auto_yes_poller_capture_1.capturePollerFrame)(worktreeId, cliToolId, captureLines, instanceId);
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
         if (pollerState.waitingForSession) {
             pollerState.waitingForSession = false;
+            // Issue #3796: the session wait's tick ran here — read by the push gate.
+            pollerState.sessionAppearedAt = generation.startedAt;
             logger.info('poller:session-appeared', { worktreeId, cliToolId, instanceId });
         }
         const lines = cleanOutput.split('\n');
@@ -1007,7 +955,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         }
         // 4. Detect and respond to prompt
         const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput, generation);
-        if (!isTickCurrent(generation)) {
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
@@ -1016,7 +964,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // over hours. Not on 'error': a capture that works followed by an answer
         // that fails every time must still back off and stop.
         if (result !== 'error') {
-            resetErrorCount(compositeKey, generation.pollerState);
+            (0, auto_yes_poller_generation_1.resetErrorCount)(compositeKey, generation.pollerState);
         }
         if (result === 'responded') {
             scheduleNextPoll(generation, auto_yes_state_1.COOLDOWN_INTERVAL_MS);
@@ -1037,7 +985,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // enables it before the session starts — so wait until `expiresAt`, at the
         // backoff cap, instead of counting toward `consecutive_errors`.
         const sessionMissing = await isSessionMissing(worktreeId, cliToolId, instanceId);
-        if (!isTickCurrent(generation)) {
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
@@ -1046,7 +994,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
                 pollerState.waitingForSession = true;
                 logger.info('poller:waiting-for-session', { worktreeId, cliToolId, instanceId });
             }
-            scheduleNextPoll(generation, auto_yes_state_1.MAX_BACKOFF_MS);
+            scheduleNextPoll(generation, auto_yes_state_1.MAX_BACKOFF_MS, { sessionWait: true });
             return;
         }
         incrementErrorCount(compositeKey, generation.pollerState);
@@ -1077,15 +1025,70 @@ async function isSessionMissing(worktreeId, cliToolId, instanceId) {
  *
  * @param generation - The tick's generation
  * @param overrideInterval - Optional override for the next poll delay
+ * @param options.sessionWait - The tick waits for a session to appear (Issue #3791)
  */
-function scheduleNextPoll(generation, overrideInterval) {
-    if (!isPollerCurrent(generation))
+function scheduleNextPoll(generation, overrideInterval, options = {}) {
+    if (!(0, auto_yes_poller_generation_1.isPollerCurrent)(generation))
         return;
     const { worktreeId, cliToolId, instanceId, pollerState } = generation;
     const interval = Math.max(overrideInterval ?? pollerState.currentInterval, auto_yes_state_1.POLLING_INTERVAL_MS);
-    pollerState.timerId = setTimeout(() => {
+    // Issue #3791: only the session wait's tick is one the push gate waits for.
+    pollerState.sessionWaitTickAt = options.sessionWait === true ? Date.now() + interval : undefined;
+    // Issue #3796: any new timer supersedes the previous one's wake.
+    dropSessionWaitWake(generation.compositeKey);
+    const timerId = setTimeout(() => {
+        dropSessionWaitWake(generation.compositeKey, timerId);
         void pollAutoYes(worktreeId, cliToolId, instanceId, pollerState);
     }, interval);
+    pollerState.timerId = timerId;
+    if (options.sessionWait === true)
+        armSessionWaitWake(generation, timerId);
+}
+/** compositeKey -> the pending session-wait tick's wake. At most one per poller key. */
+const sessionWaitWakes = (0, global_state_1.getOrInitGlobal)('__autoYesSessionWaitWakes', () => new Map());
+/**
+ * Stop listening for the session of `compositeKey` (Issue #3796).
+ *
+ * @param timerId - Only when the wake is this timer's: the timer firing drops
+ *   its own wake, never a successor's
+ */
+function dropSessionWaitWake(compositeKey, timerId) {
+    const wake = sessionWaitWakes.get(compositeKey);
+    if (wake === undefined || (timerId !== undefined && wake.timerId !== timerId))
+        return;
+    sessionWaitWakes.delete(compositeKey);
+    wake.unsubscribe();
+}
+/**
+ * Issue #3796: while the poller waits `MAX_BACKOFF_MS` for its session, the
+ * session's creation brings the tick forward to a poll interval — so the first
+ * prompt of a session started right after the poller looked (`send --auto-yes`
+ * enables Auto-Yes before the session exists) is answered, or its human
+ * notified, without waiting out the backoff. The push gate's hold follows the
+ * earlier tick (`autoYesHoldEndsAt`).
+ *
+ * The wake replaces the pending timer and nothing else: it does nothing once
+ * that timer fired (the tick drops the wake before it runs, so a tick in flight
+ * is never doubled), once another timer replaced it, or once the poller was
+ * stopped or replaced (`stopAutoYesPolling` drops it, and `scheduleNextPoll`
+ * checks the poller is still the generation's).
+ */
+function armSessionWaitWake(generation, timerId) {
+    const { compositeKey, worktreeId, cliToolId, instanceId, pollerState } = generation;
+    const sessionName = manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId);
+    const unsubscribe = (0, session_created_signal_1.onTmuxSessionCreated)(sessionName, () => {
+        const wake = sessionWaitWakes.get(compositeKey);
+        if (wake === undefined || wake.timerId !== timerId)
+            return;
+        sessionWaitWakes.delete(compositeKey);
+        if (!(0, auto_yes_poller_generation_1.isPollerCurrent)(generation) || pollerState.timerId !== timerId)
+            return;
+        clearTimeout(timerId);
+        logger.info('poller:session-created-wake', { worktreeId, cliToolId, instanceId });
+        // Still the session wait's tick — the one the push gate's hold is about.
+        scheduleNextPoll(generation, auto_yes_state_1.POLLING_INTERVAL_MS, { sessionWait: true });
+    });
+    sessionWaitWakes.set(compositeKey, { timerId, unsubscribe });
 }
 // =============================================================================
 // Public Poller API
@@ -1109,6 +1112,11 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     }
     // Resolve the effective instance ID (primary === cliToolId).
     const effectiveInstanceId = instanceId ?? cliToolId;
+    // Issue #3730: nothing starts once a shutdown has recorded what it releases —
+    // a poller started after the record would be a grant the record never saw.
+    if ((0, auto_yes_state_1.isAutoYesShutdownStarted)()) {
+        return { started: false, reason: 'server shutting down' };
+    }
     // Check if auto-yes is enabled
     const autoYesState = (0, auto_yes_state_1.getAutoYesState)(worktreeId, cliToolId, effectiveInstanceId);
     if (!autoYesState?.enabled) {
@@ -1116,8 +1124,8 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     }
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, effectiveInstanceId);
     // Check concurrent poller limit (DoS protection)
-    const existingPollerState = getPollerState(compositeKey);
-    if (!existingPollerState && autoYesPollerStates.size >= auto_yes_state_1.MAX_CONCURRENT_POLLERS) {
+    const existingPollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
+    if (!existingPollerState && auto_yes_poller_generation_1.autoYesPollerStates.size >= auto_yes_state_1.MAX_CONCURRENT_POLLERS) {
         return { started: false, reason: 'max concurrent pollers reached' };
     }
     // Issue #501: Idempotency check (key already encodes the instance, so a matching
@@ -1127,7 +1135,7 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     }
     // Stop existing poller if cliToolId changed
     if (existingPollerState) {
-        stopAutoYesPolling(compositeKey);
+        stopAutoYesPolling(compositeKey, 'replaced');
     }
     // Create new poller state
     const pollerState = {
@@ -1142,7 +1150,7 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
         stopCheckBaselineLength: -1,
         lastSkipWarnKey: null,
     };
-    autoYesPollerStates.set(compositeKey, pollerState);
+    auto_yes_poller_generation_1.autoYesPollerStates.set(compositeKey, pollerState);
     // A task may have been recorded moments ago; start from a fresh policy read.
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
     // Start polling immediately
@@ -1157,35 +1165,54 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
  *
  * Issue #525: Changed from (worktreeId) to (compositeKey).
  *
+ * Issue #3730: `reason` is why the POLLER stops, logged on `poller:stopped`. It
+ * does not touch the grant: an ID move and a replacement stop the poller and
+ * keep the grant, so disabling stays each caller's own decision. Omitted, the
+ * reason of an enclosing {@link withPollerStopReason} applies (the lifecycle
+ * table's path), else `unspecified`.
+ *
  * @param compositeKey - Composite key (worktreeId:cliToolId)
+ * @param reason - Why the poller stops
  */
-function stopAutoYesPolling(compositeKey) {
+function stopAutoYesPolling(compositeKey, reason) {
     // Issue #3397: before the early return — the disable route and the session
     // cleanup call this for an instance whose poller may already be gone, and the
     // Enter record must not outlive the grant or the session either way.
     (0, auto_yes_enter_fallback_1.forgetEnterFallback)(compositeKey);
-    const pollerState = getPollerState(compositeKey);
+    // Issue #3820: before the early return too — a session ended after its
+    // poller had already stopped still abandons the confirmation left on it.
+    (0, auto_yes_confirmation_ledger_1.noteLedgerPollerStopped)(compositeKey, (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(reason, 'unspecified'));
+    const pollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
     if (!pollerState)
         return;
     if (pollerState.timerId) {
         clearTimeout(pollerState.timerId);
     }
-    autoYesPollerStates.delete(compositeKey);
+    dropSessionWaitWake(compositeKey);
+    auto_yes_poller_generation_1.autoYesPollerStates.delete(compositeKey);
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
-    logger.info('poller:stopped', { compositeKey });
+    logger.info('poller:stopped', { compositeKey, reason: (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(reason, 'unspecified') });
 }
 /**
  * Stop all server-side auto-yes polling (graceful shutdown).
+ *
+ * Issue #3730: logs `shutdown` unless an enclosing
+ * {@link withPollerStopReason} says otherwise (the test reset). Writes nothing
+ * to disk: the record of the grants a shutdown released is the server's to
+ * make (`lib/auto-yes-shutdown-record`), never a side effect of this.
  */
 function stopAllAutoYesPolling() {
-    for (const [key, pollerState] of autoYesPollerStates.entries()) {
+    const reason = (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(undefined, 'shutdown');
+    for (const [key, pollerState] of auto_yes_poller_generation_1.autoYesPollerStates.entries()) {
         if (pollerState.timerId) {
             clearTimeout(pollerState.timerId);
         }
+        dropSessionWaitWake(key);
         (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(key);
-        logger.info('poller:stopped', { compositeKey: key, reason: 'shutdown' });
+        (0, auto_yes_confirmation_ledger_1.noteLedgerPollerStopped)(key, reason);
+        logger.info('poller:stopped', { compositeKey: key, reason });
     }
-    autoYesPollerStates.clear();
+    auto_yes_poller_generation_1.autoYesPollerStates.clear();
     (0, auto_yes_enter_fallback_1.clearEnterFallbacks)();
     (0, auto_yes_poller_state_1.clearPartialAnswers)();
 }
@@ -1197,7 +1224,7 @@ function stopAllAutoYesPolling() {
  * @returns Array of composite keys present in the autoYesPollerStates Map
  */
 function getAutoYesPollerCompositeKeys() {
-    return Array.from(autoYesPollerStates.keys());
+    return Array.from(auto_yes_poller_generation_1.autoYesPollerStates.keys());
 }
 // =============================================================================
 // byWorktree Helpers (Issue #525)
@@ -1207,6 +1234,7 @@ function getAutoYesPollerCompositeKeys() {
  * [SF-001] Uses shared filterCompositeKeysByWorktree (DRY).
  *
  * @param worktreeId - Worktree identifier
+ * @param options.reason - Issue #3730: why the pollers stop, for `poller:stopped`
  * @param options.keepPartialAnswers - Issue #3713 (re-instruction 1, P2-1): the
  *   disable route's "every agent" passes it — a disable, like one agent's
  *   `stopAutoYesPolling`, keeps the memory of an answer stopped part-way and
@@ -1215,10 +1243,14 @@ function getAutoYesPollerCompositeKeys() {
  *   `auto-yes-lifecycle`), both are dropped and a late send records nothing.
  */
 function stopAutoYesPollingByWorktree(worktreeId, options) {
-    const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId);
-    pollerKeys.forEach(key => stopAutoYesPolling(key));
+    const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(auto_yes_poller_generation_1.autoYesPollerStates.keys()), worktreeId);
+    // Issue #3730: `options.reason`, else the enclosing scope's (the lifecycle table).
+    pollerKeys.forEach(key => stopAutoYesPolling(key, options?.reason));
     // Issue #3397: and the records of instances whose poller had already stopped.
     (0, auto_yes_enter_fallback_1.forgetEnterFallbacksByWorktree)(worktreeId);
+    // Issue #3820: and the ledger's confirmations on them — an API approval is
+    // opened with Auto-Yes off too, so the running pollers do not name them all.
+    (0, auto_yes_confirmation_ledger_1.noteLedgerWorktreeStopped)(worktreeId, (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(options?.reason, 'unspecified'));
     if (!options?.keepPartialAnswers)
         (0, auto_yes_poller_state_1.forgetPartialAnswersByWorktree)(worktreeId);
 }
@@ -1230,5 +1262,5 @@ function stopAutoYesPollingByWorktree(worktreeId, options) {
  * @returns true if any poller is active for this worktree
  */
 function isAnyPollerActiveForWorktree(worktreeId) {
-    return (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId).length > 0;
+    return (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(auto_yes_poller_generation_1.autoYesPollerStates.keys()), worktreeId).length > 0;
 }