commandmate 0.47.0 → 0.47.2

package/dist/server/src/lib/auto-yes-poller.js

@@ -45,16 +45,10 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTO_YES_ENTER_FALLBACK_ANSWER = void 0;
-exports.getActivePollerCount = getActivePollerCount;
+exports.capturePollerFrame = exports.captureAndCleanOutput = exports.AUTO_YES_ENTER_FALLBACK_ANSWER = exports.noHookReceiptHint = exports.isPollerActive = exports.getLastServerResponseTimestamp = exports.getActivePollerCount = void 0;
 exports.clearAllPollerStates = clearAllPollerStates;
-exports.getLastServerResponseTimestamp = getLastServerResponseTimestamp;
-exports.isPollerActive = isPollerActive;
 exports.validatePollingContext = validatePollingContext;
-exports.capturePollerFrame = capturePollerFrame;
-exports.captureAndCleanOutput = captureAndCleanOutput;
 exports.processStopConditionDelta = processStopConditionDelta;
-exports.noHookReceiptHint = noHookReceiptHint;
 exports.detectAndRespondToPrompt = detectAndRespondToPrompt;
 exports.startAutoYesPolling = startAutoYesPolling;
 exports.stopAutoYesPolling = stopAutoYesPolling;
@@ -65,11 +59,11 @@ exports.isAnyPollerActiveForWorktree = isAnyPollerActiveForWorktree;
 const cli_session_1 = require("./session/cli-session");
 const response_checker_1 = require("./polling/response-checker");
 const antigravity_receipt_episodes_1 = require("./polling/antigravity-receipt-episodes");
-const antigravity_permission_receipts_1 = require("./polling/antigravity-permission-receipts");
 const auto_yes_resolver_1 = require("./polling/auto-yes-resolver");
 const auto_yes_policy_1 = require("./polling/auto-yes-policy");
 const detect_1 = require("./detection/tools/codex/detect");
 const frame_1 = require("./detection/tools/frame");
+const dialog_1 = require("./detection/tools/antigravity/dialog");
 const auto_yes_dialog_gate_1 = require("./polling/auto-yes-dialog-gate");
 const auto_yes_enter_fallback_1 = require("./polling/auto-yes-enter-fallback");
 const task_transition_service_1 = require("./tasks/task-transition-service");
@@ -92,42 +86,26 @@ const logger = (0, logger_1.createLogger)('auto-yes-poller');
 const path_validator_1 = require("./security/path-validator");
 const auto_yes_state_1 = require("./auto-yes-state");
 const global_state_1 = require("./global-state");
-const auto_yes_suppression_reason_1 = require("./polling/auto-yes-suppression-reason");
-const auto_yes_suppression_state_1 = require("./polling/auto-yes-suppression-state");
 const auto_yes_poller_state_1 = require("./polling/auto-yes-poller-state");
 const auto_yes_prompt_suppression_1 = require("./polling/auto-yes-prompt-suppression");
-/** In-memory storage for poller states (globalThis for hot reload persistence) */
-const autoYesPollerStates = (0, global_state_1.getOrInitGlobal)('__autoYesPollerStates', () => new Map());
-/**
- * When `antigravity-autoyes-withheld-no-hook-receipt` was last logged, per
- * compositeKey (Issue #2857). The poller re-reads a static pane every 2s, so the
- * line is limited to one per {@link WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS} per
- * instance. globalThis for the same reason as the poller states above.
- */
-const withheldNoReceiptLoggedAt = (0, global_state_1.getOrInitGlobal)('__autoYesWithheldNoReceiptLoggedAt', () => new Map());
-/**
- * Least gap between two `antigravity-autoyes-withheld-no-hook-receipt` lines for
- * one instance. `antigravity-autoyes-withheld-by-policy` (Issue #3724) shares it.
- */
-const WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS = 60_000;
-// =============================================================================
-// Poller State Accessors (compositeKey-based)
-// =============================================================================
-/**
- * Get poller state by composite key.
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns Poller state or undefined
- */
-function getPollerState(compositeKey) {
-    return autoYesPollerStates.get(compositeKey);
-}
-/**
- * Get the number of active pollers.
- */
-function getActivePollerCount() {
-    return autoYesPollerStates.size;
-}
+const auto_yes_poller_generation_1 = require("./polling/auto-yes-poller-generation");
+const auto_yes_poller_receipt_log_1 = require("./polling/auto-yes-poller-receipt-log");
+const auto_yes_poller_enter_fallback_1 = require("./polling/auto-yes-poller-enter-fallback");
+const auto_yes_poller_capture_1 = require("./polling/auto-yes-poller-capture");
+const auto_yes_confirmation_ledger_1 = require("./polling/auto-yes-confirmation-ledger");
+const auto_yes_poller_steps_1 = require("./polling/auto-yes-poller-steps");
+// Issue #3783: split out; re-exported so existing importers are unchanged.
+var auto_yes_poller_generation_2 = require("./polling/auto-yes-poller-generation");
+Object.defineProperty(exports, "getActivePollerCount", { enumerable: true, get: function () { return auto_yes_poller_generation_2.getActivePollerCount; } });
+Object.defineProperty(exports, "getLastServerResponseTimestamp", { enumerable: true, get: function () { return auto_yes_poller_generation_2.getLastServerResponseTimestamp; } });
+Object.defineProperty(exports, "isPollerActive", { enumerable: true, get: function () { return auto_yes_poller_generation_2.isPollerActive; } });
+var auto_yes_poller_receipt_log_2 = require("./polling/auto-yes-poller-receipt-log");
+Object.defineProperty(exports, "noHookReceiptHint", { enumerable: true, get: function () { return auto_yes_poller_receipt_log_2.noHookReceiptHint; } });
+var auto_yes_poller_enter_fallback_2 = require("./polling/auto-yes-poller-enter-fallback");
+Object.defineProperty(exports, "AUTO_YES_ENTER_FALLBACK_ANSWER", { enumerable: true, get: function () { return auto_yes_poller_enter_fallback_2.AUTO_YES_ENTER_FALLBACK_ANSWER; } });
+var auto_yes_poller_capture_2 = require("./polling/auto-yes-poller-capture");
+Object.defineProperty(exports, "captureAndCleanOutput", { enumerable: true, get: function () { return auto_yes_poller_capture_2.captureAndCleanOutput; } });
+Object.defineProperty(exports, "capturePollerFrame", { enumerable: true, get: function () { return auto_yes_poller_capture_2.capturePollerFrame; } });
 /**
  * Clear all poller states.
  * Stops all active pollers before clearing state.
@@ -136,58 +114,8 @@ function getActivePollerCount() {
 function clearAllPollerStates() {
     // Issue #3730: a test seam, not a shutdown — logged as such.
     (0, auto_yes_poller_stop_reason_1.withPollerStopReason)('reset', () => stopAllAutoYesPolling());
-    autoYesPollerStates.clear();
-    withheldNoReceiptLoggedAt.clear();
-}
-/**
- * Get the last server response timestamp for a composite key.
- *
- * Issue #525: Changed from (worktreeId) to (compositeKey).
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns Timestamp (Date.now()) of the last server response, or null if none
- */
-function getLastServerResponseTimestamp(compositeKey) {
-    const pollerState = getPollerState(compositeKey);
-    return pollerState?.lastServerResponseTimestamp ?? null;
-}
-/**
- * Check if a server-side auto-yes poller is active for a composite key.
- *
- * Issue #525: Changed from (worktreeId) to (compositeKey).
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns true if a poller is actively running
- */
-function isPollerActive(compositeKey) {
-    return autoYesPollerStates.has(compositeKey);
-}
-/**
- * Update the last server response timestamp.
- *
- * @param compositeKey - Composite key
- * @param timestamp - Timestamp value (Date.now())
- */
-function updateLastServerResponseTimestamp(compositeKey, timestamp, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
-    if (pollerState) {
-        pollerState.lastServerResponseTimestamp = timestamp;
-    }
-}
-/**
- * Reset error count for a poller and restore the default polling interval.
- * Called after every poll that ran to the end without an error (Issue #3329)
- * and after an answer is sent.
- *
- * @param compositeKey - Composite key
- * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
- */
-function resetErrorCount(compositeKey, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
-    if (pollerState) {
-        pollerState.consecutiveErrors = 0;
-        pollerState.currentInterval = auto_yes_state_1.POLLING_INTERVAL_MS;
-    }
+    auto_yes_poller_generation_1.autoYesPollerStates.clear();
+    auto_yes_poller_receipt_log_1.withheldNoReceiptLoggedAt.clear();
 }
 /**
  * Increment error count and apply backoff if the threshold is exceeded.
@@ -197,7 +125,7 @@ function resetErrorCount(compositeKey, owner) {
  * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
  */
 function incrementErrorCount(compositeKey, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
+    const pollerState = (0, auto_yes_poller_generation_1.ownedPollerState)(compositeKey, owner);
     if (pollerState) {
         pollerState.consecutiveErrors++;
         pollerState.currentInterval = (0, auto_yes_state_1.calculateBackoffInterval)(pollerState.consecutiveErrors);
@@ -221,46 +149,6 @@ function incrementErrorCount(compositeKey, owner) {
         }
     }
 }
-/**
- * The poller state under `compositeKey`, but only when it is `owner` — the
- * tick's own (Issue #3706). Without `owner` (callers outside a tick, and tests
- * driving `detectAndRespondToPrompt` with a hand-built state) it is the plain
- * by-key read this always was.
- */
-function ownedPollerState(compositeKey, owner) {
-    const pollerState = getPollerState(compositeKey);
-    if (owner !== undefined && pollerState !== owner)
-        return undefined;
-    return pollerState;
-}
-/** Is the tick's poller still the one under its key (not stopped, not replaced)? */
-function isPollerCurrent(generation) {
-    return getPollerState(generation.compositeKey) === generation.pollerState;
-}
-/**
- * May the tick still act: its poller, its grant (the same enable, not expired)
- * and its session (no relaunch since) are all still the ones it started under.
- * Checked after capture, after each wait before a key, and inside the send.
- */
-function isTickCurrent(generation) {
-    if (!isPollerCurrent(generation))
-        return false;
-    // `getAutoYesState` returns the stored object until it expires, when it
-    // stores (and returns) a disabled one — so an expiry fails identity too.
-    const grant = (0, auto_yes_state_1.getAutoYesState)(generation.worktreeId, generation.cliToolId, generation.instanceId);
-    if (grant !== generation.grant || !grant.enabled)
-        return false;
-    return isSameSession(generation);
-}
-/**
- * Is the session the tick answered still the one it started on (Issue #3706)?
- * What the follow-ups of an answer already sent — the response poller restart,
- * the terminal push — are judged by: a disable after the keys landed does not
- * un-send them, a relaunch does make them about another process.
- */
-function isSameSession(generation) {
-    return (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(generation.compositeKey) === generation.sessionEpoch;
-}
 /**
  * End a tick that found its generation gone (Issue #3706). It changes nothing;
  * it re-arms its timer only when its own poller is still the current one — a
@@ -272,25 +160,11 @@ function endStaleTick(generation) {
         worktreeId: generation.worktreeId,
         cliToolId: generation.cliToolId,
         instanceId: generation.instanceId,
-        pollerCurrent: isPollerCurrent(generation),
+        pollerCurrent: (0, auto_yes_poller_generation_1.isPollerCurrent)(generation),
     });
-    if (isPollerCurrent(generation))
+    if ((0, auto_yes_poller_generation_1.isPollerCurrent)(generation))
         scheduleNextPoll(generation);
 }
-/**
- * Check if the given prompt has already been answered recently.
- *
- * @param pollerState - Current poller state
- * @param promptKey - Composite key of the current prompt
- * @returns true if the prompt key matches and is within the retry expiry window
- */
-function isDuplicatePrompt(pollerState, promptKey) {
-    if (pollerState.lastAnsweredPromptKey !== promptKey)
-        return false;
-    if (pollerState.lastAnsweredAt === null)
-        return false;
-    return (Date.now() - pollerState.lastAnsweredAt) < auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS;
-}
 // =============================================================================
 // Extracted Functions for pollAutoYes (Issue #323: SRP decomposition)
 // =============================================================================
@@ -327,38 +201,6 @@ function validatePollingContext(compositeKey, pollerState) {
     }
     return 'valid';
 }
-/**
- * Capture tmux session output once, keeping both spellings (Issue #2522).
- *
- * @internal Exported for testing purposes only.
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param captureLines - Optional number of lines to capture
- * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
- * @returns The tick's raw capture and its cleaned form
- */
-async function capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId) {
-    const lines = captureLines ?? auto_yes_config_1.FULL_CAPTURE_LINES;
-    const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, lines, instanceId);
-    return { raw: output, clean: (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)) };
-}
-/**
- * Capture tmux session output and strip ANSI escape codes.
- *
- * Kept as the cleaned half of {@link capturePollerFrame} so the many callers and
- * tests that only ever wanted that string are untouched; `pollAutoYes` takes the
- * pair. `stripBoxDrawing` still runs exactly once per capture either way.
- *
- * @internal Exported for testing purposes only.
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param captureLines - Optional number of lines to capture
- * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
- * @returns Cleaned output string (ANSI stripped)
- */
-async function captureAndCleanOutput(worktreeId, cliToolId, captureLines, instanceId) {
-    return (await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId)).clean;
-}
 /**
  * Process stop condition check using delta-based approach.
  *
@@ -386,228 +228,6 @@ function processStopConditionDelta(compositeKey, pollerState, cleanOutput) {
     }
     return false;
 }
-/**
- * Say, once a minute, that Auto-Yes left an agy dialog alone for want of a hook
- * receipt (Issue #2857).
- *
- * `detectPromptOnCleanFrame` hands a frame the receipt gate (#2849) withholds
- * back as an ordinary `isPrompt: false`, so the poller cannot tell "no dialog on
- * the pane" from "a dialog agy never asked us about" by looking at the result.
- * The gate is the ONLY thing `receiptScope` changes, so the same frame read
- * without it answering a prompt is exactly the withheld case. That second
- * reading is taken only after the cheap tests: no receipt for this instance in
- * the window (with one, the gate let the frame through and a no-prompt result is
- * a real one) and no line for it in the last minute.
- *
- * Why it is worth a line: a machine whose `~/.gemini/config/hooks.json` points at
- * another server (#2622) never sends us the question, and every real dialog then
- * waits for a human with no sign of why. The line names the file to look at.
- *
- * A stale receipt does not always mean that, though (Issue #3724): a dialog the
- * contract's autoYes withheld got its receipt, the server answered `ask`, and
- * the dialog outlived the window. When `resolveAutoAnswerWithPolicy` on the
- * ungated reading suppresses the answer by contract (the base rules would have
- * answered it), the line is `antigravity-autoyes-withheld-by-policy` instead,
- * naming the reason, the mode and the task. Both share the limit.
- * The response-checker's own `antigravity-dialog-no-recent-receipt` stays at
- * debug — it prints on every tick the same pane is read again.
- *
- * @param compositeKey - The instance's key, for the once-a-minute limit
- * @param readWithoutGate - The same frame read without `receiptScope`
- */
-function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, readWithoutGate) {
-    // Issue #3767: the gate's own verdict for this tick's candidate. Null means it
-    // never saw one (no dialog), `ok` that it let the frame through.
-    let verdict = (0, antigravity_receipt_episodes_1.getAntigravityReceiptVerdict)(worktreeId, instanceId);
-    if (verdict?.ok)
-        return;
-    const now = Date.now();
-    const ungated = readWithoutGate();
-    if (!ungated.isPrompt || !ungated.promptData)
-        return;
-    // The gate was not consulted (the gated reading declined the frame on screen
-    // grounds alone) yet the frame reads as a prompt: judge it here.
-    verdict ??= (0, antigravity_receipt_episodes_1.judgeAntigravityPermissionReceipt)(worktreeId, instanceId, now);
-    if (verdict.ok)
-        return;
-    // Issue #3724: a contract that withholds the answer makes the server reply
-    // `ask`, so the dialog stays up past the receipt window. The cause is then the
-    // contract, not a hooks.json that points elsewhere. Judged exactly as the tick
-    // judges a prompt it can read — the base rules first, then the contract — so
-    // a prompt the base rules never answer (a checkbox, a typed option) is not
-    // blamed on the contract. Policy and task id come from one lookup.
-    const { policy, taskId } = (0, auto_yes_policy_1.getSessionAutoYesPolicyEntry)(worktreeId, 'antigravity', instanceId);
-    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(ungated.promptData, policy);
-    // Issue #3767: `answered` is the dialog the gate already let through on this
-    // receipt, still up past the window. Unless the contract withheld it, that is
-    // not a missing receipt: neither recorded nor logged, nor counted for the limit.
-    // Issue #3789: `answered` is also a dialog accepted but never sent to (the
-    // tick recorded its own reason, if any, and that record is kept). One the
-    // poller DID send keys to and still up past the grace is `outlived`, which is
-    // recorded and logged like the others, so the stop is not a silent one.
-    // Issue #3796: the reason the poller recorded for this dialog (partial-answer,
-    // the contract, …) while it could still read it inside the window was not
-    // re-stamped once the window closed — the gated reading stopped seeing the
-    // prompt — so `cmate wait` dropped it as stale a minute later with the dialog
-    // still up. Re-stamped here on every tick the dialog stays — only while it
-    // still holds under this tick's evaluation — and kept over a `no-hook-receipt`
-    // for it: it is the more exact reason.
-    const keptPartialAnswer = refreshEpisodeSuppression(worktreeId, instanceId, verdict, resolution);
-    // Issue #3796 review D: a contract that withholds the prompt now is published
-    // whatever was recorded before — none at all (the window closed before the
-    // tick could read it, or an ended contract's record was dropped and a new one
-    // withholds it again) or another reason. Without it `cmate wait` read no
-    // reason and held the prompt as one Auto-Yes was answering. Only a partial
-    // answer still on screen comes first, as it does on the tick (step 2.5).
-    if (resolution.suppressedBy && !keptPartialAnswer) {
-        (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, {
-            reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
-            promptType: ungated.promptData.type,
-            ...(resolution.pattern !== undefined ? { pattern: resolution.pattern } : {}),
-        });
-    }
-    if (!resolution.suppressedBy && (verdict.cause === 'answered' || keptPartialAnswer))
-        return;
-    const lastLoggedAt = withheldNoReceiptLoggedAt.get(compositeKey);
-    const logDue = lastLoggedAt === undefined || now - lastLoggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS;
-    if (logDue) {
-        for (const [key, loggedAt] of withheldNoReceiptLoggedAt) {
-            if (now - loggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS)
-                withheldNoReceiptLoggedAt.delete(key);
-        }
-        withheldNoReceiptLoggedAt.set(compositeKey, now);
-    }
-    if (resolution.suppressedBy) {
-        if (!logDue)
-            return;
-        logger.info('antigravity-autoyes-withheld-by-policy', {
-            worktreeId,
-            instanceId: instanceId ?? 'antigravity',
-            reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
-            taskId,
-            hint: '契約の autoYes が答えを止めている。契約の autoYes を確認',
-        });
-        return;
-    }
-    // Issue #3767: recorded on every tick (the record's `at` follows the prompt
-    // while it stays up), logged once a minute.
-    (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, {
-        reason: auto_yes_suppression_reason_1.NO_HOOK_RECEIPT_SUPPRESSION_REASON,
-        mode: null,
-        promptType: ungated.promptData.type,
-    });
-    if (!logDue)
-        return;
-    logger.info('antigravity-autoyes-withheld-no-hook-receipt', {
-        worktreeId,
-        instanceId: instanceId ?? 'antigravity',
-        windowMs: antigravity_permission_receipts_1.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS,
-        hint: noHookReceiptHint(verdict, now),
-    });
-}
-/**
- * Issue #3796: keep the suppression the poller recorded during this dialog's
- * episode current while the dialog it accepted (`answered` / `outlived`) is
- * still up. Only a record made since the dialog was first read, and never the
- * receipt gate's own `no-hook-receipt` (the caller records that itself). A
- * record is kept only while its reason still holds NOW:
- *
- * - `partial-answer` remembers an event: it holds for as long as the dialog
- *   the keys went to stays up (this episode), and is re-stamped here;
- * - a contract reason is the contract's verdict on the prompt, re-evaluated on
- *   every tick (`resolution`): no verdict (the contract ended, or now answers
- *   it) drops the record — the dialog is then `answered` / `outlived` like any
- *   other. A verdict is recorded by the caller (review D), whatever was here;
- * - any other reason is left as it was recorded.
- *
- * @returns true when a `partial-answer` that still holds was re-stamped
- */
-function refreshEpisodeSuppression(worktreeId, instanceId, verdict, resolution) {
-    if (verdict.cause !== 'answered' && verdict.cause !== 'outlived')
-        return false;
-    const own = (0, auto_yes_suppression_state_1.getLastPolicySuppression)(worktreeId, 'antigravity', instanceId);
-    if (own === null || own.reason === auto_yes_suppression_reason_1.NO_HOOK_RECEIPT_SUPPRESSION_REASON || !(own.at >= verdict.firstSeenAt)) {
-        return false;
-    }
-    if (own.reason === auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON) {
-        // The memory is the episode's: the dialog the keys went to is still the one
-        // up (same episode, accepted on the same receipt). Not `getPartialAnswer`:
-        // the tick forgets it as soon as the gated reading stops seeing the prompt,
-        // which past the window is every tick.
-        const { at: _recordedAt, ...suppression } = own;
-        (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, suppression);
-        return true;
-    }
-    if (auto_yes_suppression_reason_1.CONTRACT_SUPPRESSION_REASONS.has(own.reason) && !resolution.suppressedBy) {
-        (0, auto_yes_suppression_state_1.forgetPolicySuppression)(worktreeId, 'antigravity', instanceId);
-    }
-    return false;
-}
-/**
- * Issue #3789: keys for an agy dialog the receipt gate accepted reached tmux.
- * Only here does the gate start the grace after which a dialog still up is
- * reported as `outlived`; the tick's `no_answer` exits (another server's session,
- * a partial answer, the base rules or the contract not answering) never get
- * here, so their own records are not overwritten by `no-hook-receipt`.
- *
- * Issue #3796: `interrupted` — the send began and was cut short (stopped
- * part-way, or failed). Its keys may be on the pane and the receipt is spent,
- * so the grace starts here too; without it the dialog stayed `answered`, and
- * silent, for as long as it stayed up.
- */
-function noteAnswerSent(cliToolId, worktreeId, instanceId, interrupted = false, forReceiptAt) {
-    if (cliToolId !== 'antigravity')
-        return;
-    (0, antigravity_receipt_episodes_1.markAntigravityAnswerSent)(worktreeId, instanceId, Date.now(), {
-        interrupted,
-        ...(forReceiptAt !== undefined ? { forReceiptAt } : {}),
-    });
-}
-/**
- * Issue #3796 review: the agy episode a send is about to go to, read before
- * its first await; null for other tools. Given back to {@link noteAnswerSent}
- * however the send came back — whole, failed or cut short (review E) — so that
- * only that episode is marked — the same
- * idea as the Enter record's generation check in `tryEnterFallback`.
- */
-function receiptEpisodeOfSend(cliToolId, worktreeId, instanceId) {
-    return cliToolId === 'antigravity' ? (0, antigravity_receipt_episodes_1.getAntigravityAcceptedReceiptAt)(worktreeId, instanceId) : null;
-}
-/**
- * The hint for `antigravity-autoyes-withheld-no-hook-receipt` (Issue #3767):
- * which of the withheld cases it was decides where to look.
- */
-function noHookReceiptHint(verdict, now = Date.now()) {
-    const seconds = verdict.ageMs === null ? null : Math.round(verdict.ageMs / 1000);
-    // `lapsed` says how long ago, so from now: the line repeats once a minute.
-    const secondsAgo = verdict.lastReceiptAt === null ? null : Math.round((now - verdict.lastReceiptAt) / 1000);
-    switch (verdict.cause) {
-        case 'never':
-            return 'hook の受信が一度も無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認';
-        case 'late':
-            return `最後の受信から ${seconds} 秒後に確認が出た（窓 ${antigravity_permission_receipts_1.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS / 1000} 秒の外）ため答えなかった。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）。続くなら ~/.gemini/config/hooks.json の向き先（#2622）も確認`;
-        case 'lapsed':
-            return `最後の受信は ${secondsAgo} 秒前で途絶えている（hook が届かなくなった）。hooks.json の向き先（#2622）と agy の再起動を確認`;
-        case 'predates':
-            return '確認は最後の受信より前から画面に出ていた（引用か別の確認）ため答えなかった。人が答える';
-        case 'used':
-            return '最後の受信は直前の確認に使い済み。この確認に対する受信は無いため答えなかった。人が答える';
-        case 'outlived':
-            if (verdict.answerInterrupted === true) {
-                return `Auto-Yes が最後の受信の確認へ答えを送る途中で送信が止まり（キーの一部が入力に残っている可能性がある）、${antigravity_receipt_episodes_1.ANTIGRAVITY_ANSWERED_DIALOG_GRACE_MS / 1000} 秒を過ぎても確認が画面に残っている。未使用の受信が無いため、もう一度は答えない。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）`;
-            }
-            return `Auto-Yes が最後の受信の確認へキーを送ってから ${antigravity_receipt_episodes_1.ANTIGRAVITY_ANSWERED_DIALOG_GRACE_MS / 1000} 秒を過ぎても、確認が画面に残っている。キーで確認が閉じなかったか、新しい受信の無い別の確認と入れ替わった（画面からは区別できない）。未使用の受信が無いため、もう一度は答えない。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）`;
-        default:
-            return 'hook の受信記録が直近に無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認';
-    }
-}
-/**
- * The audit row's `answer` for the Enter (Issue #3397): not a digit, so the
- * History reads as "Auto-Yes pressed Enter" rather than as a chosen option.
- */
-exports.AUTO_YES_ENTER_FALLBACK_ANSWER = '[Enter]';
 /**
  * Issue #3397: is the fresh capture still the screen the Enter was decided for?
  * Re-reads it the way one tick does — prompt reading, the same `promptFrameKey`,
@@ -683,19 +303,20 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
         });
         return false;
     }
-    // 3. The contract policy, as step 4 reads it.
+    // 3. The contract policy, as step 4 reads it (Issue #3822: a failed lookup withholds).
     const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
     const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy);
     if (resolution.suppressedBy) {
         pollerState.enterFallbackCandidateKey = null;
+        const mode = (0, auto_yes_resolver_1.policyLookupMode)(policy);
         (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(prompt, {
             reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
+            mode,
             promptType: promptData.type,
             pattern: resolution.pattern,
-        }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${policy?.mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
+        }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
             reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
+            mode,
             pattern: resolution.pattern,
             promptType: promptData.type,
             enterFallback: true,
@@ -730,9 +351,11 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
     // 5. Never another server's session (Issue #2865).
     const sessionName = manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId);
     const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
-    if (generation !== undefined && !isTickCurrent(generation))
+    if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation))
         return false;
     if (ownership === null || ownership.verdict === 'foreign') {
+        // Issue #3820: the ledger's own reason, as `skippedForUnownedSession` records it.
+        (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(prompt, 'foreign-session');
         (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
             worktreeId,
             cliToolId,
@@ -751,7 +374,7 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
     // has the box back. Everything that decided the Enter is judged again on the
     // fresh frame; any difference sends nothing, and the next tick starts over.
     const fresh = await (0, cli_session_1.captureSessionOutputFresh)(worktreeId, cliToolId, (rawOutput ?? '').split('\n').length, instanceId);
-    if (generation !== undefined && !isTickCurrent(generation))
+    if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation))
         return false;
     if (!isStillEnterFallbackScreen(prompt, fresh)) {
         pollerState.enterFallbackCandidateKey = null;
@@ -763,25 +386,29 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
         });
         return false;
     }
-    const receiptEpisode = receiptEpisodeOfSend(cliToolId, worktreeId, instanceId);
+    const receiptEpisode = (0, auto_yes_poller_receipt_log_1.receiptEpisodeOfSend)(cliToolId, worktreeId, instanceId);
+    // Issue #3820: taken before the await, so the result goes to this confirmation.
+    const ledgerAttempt = (0, auto_yes_confirmation_ledger_1.beginLedgerAttempt)(prompt, 'enter-fallback');
     try {
         await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
     }
     catch (error) {
         // Issue #3796: the Enter may or may not have reached the pane.
-        noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(ledgerAttempt, 'failed');
         throw error;
     }
     finally {
         (0, tmux_capture_cache_1.invalidateCache)(sessionName);
     }
     // Issue #3796 review E: the Enter is out — for the episode it began for only.
-    noteAnswerSent(cliToolId, worktreeId, instanceId, false, receiptEpisode);
+    (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, false, receiptEpisode);
+    (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(ledgerAttempt, 'ok');
     // Issue #3706: the Enter is out, but the per-screen record is the CURRENT
     // session's: when the poller was stopped (the record was forgotten with it)
     // or a new session began while `send-keys` was awaited, the return of this
     // send must not put the record back. The audit row below is kept either way.
-    if (generation === undefined || (isPollerCurrent(generation) && isSameSession(generation))) {
+    if (generation === undefined || ((0, auto_yes_poller_generation_1.isPollerCurrent)(generation) && (0, auto_yes_poller_generation_1.isSameSession)(generation))) {
         pollerState.enterFallbackSentKey = frameKey;
         pollerState.enterFallbackCandidateKey = null;
         (0, auto_yes_enter_fallback_1.recordEnterFallbackSent)(worktreeId, cliToolId, instanceId, {
@@ -799,7 +426,7 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
         refusalReason: judgement.refusalReason,
         composerState: judgement.composerState,
     });
-    await finishAnsweredPrompt(prompt, promptDetection, exports.AUTO_YES_ENTER_FALLBACK_ANSWER, generation);
+    await finishAnsweredPrompt(prompt, promptDetection, auto_yes_poller_enter_fallback_1.AUTO_YES_ENTER_FALLBACK_ANSWER, generation);
     return true;
 }
 /**
@@ -827,11 +454,11 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
     // process's identical question), not the poller's response time, not the
     // task event (the task looked up now may be the new session's). Only the
     // audit row is, and it may not adopt a pending row saved after the tick began.
-    const sameSession = generation === undefined || isSameSession(generation);
+    const sameSession = generation === undefined || (0, auto_yes_poller_generation_1.isSameSession)(generation);
     if (sameSession) {
         // 6. Update timestamp and reset error count
-        updateLastServerResponseTimestamp(compositeKey, Date.now(), generation?.pollerState);
-        resetErrorCount(compositeKey, generation?.pollerState);
+        (0, auto_yes_poller_generation_1.updateLastServerResponseTimestamp)(compositeKey, Date.now(), generation?.pollerState);
+        (0, auto_yes_poller_generation_1.resetErrorCount)(compositeKey, generation?.pollerState);
         // 7. Record answered prompt key and timestamp
         pollerState.lastAnsweredPromptKey = promptKey;
         pollerState.lastAnsweredAt = Date.now();
@@ -906,11 +533,152 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
     ]);
     // Re-read after the await, not the `sameSession` taken before the audit: a
     // relaunch while the modules loaded makes the restart about the new process.
-    if (!sameSession || (generation !== undefined && !isSameSession(generation)))
+    if (!sameSession || (generation !== undefined && !(0, auto_yes_poller_generation_1.isSameSession)(generation)))
         return;
     startResponsePolling(worktreeId, cliToolId, instanceId);
     void broadcastTerminalSnapshotAfterInteraction(worktreeId, cliToolId, instanceId);
 }
+/**
+ * Step 1 of `detectAndRespondToPrompt`: normalise the tick's frame once and
+ * read the prompt on it.
+ */
+function readPromptFrame(worktreeId, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput) {
+    const receiptScope = { worktreeId, instanceId };
+    // Issue #3183: the ONE frame every judgement below reads — normalised once,
+    // from the capture as captured (the input-box markers are rule rows the
+    // cleaned spelling has blanked), and handed as the same object to the
+    // prompt reading, the codex launch guards and the dialog gate. That is what
+    // makes "the status chain and Auto-Yes read the same live region" a fact
+    // rather than a hope: there is no second normalisation to disagree with.
+    const frame = (0, frame_1.normalizeFrame)(rawOutput ?? cleanOutput, cliToolId);
+    // Issue #3767: bracket the read so the receipt gate can tell when an agy
+    // dialog first appeared, not only what time this tick is.
+    if (cliToolId === 'antigravity')
+        (0, antigravity_receipt_episodes_1.beginAntigravityFrameRead)(worktreeId, instanceId);
+    const promptDetection = (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput, receiptScope, frame);
+    if (cliToolId === 'antigravity')
+        (0, antigravity_receipt_episodes_1.endAntigravityFrameRead)(worktreeId, instanceId);
+    return { frame, promptDetection };
+}
+/**
+ * What `detectAndRespondToPrompt` does to the poller state on a frame with no
+ * prompt to answer, before it returns `no_prompt`.
+ */
+function noteNoPromptOnScreen(tick) {
+    const { worktreeId, cliToolId, instanceId, compositeKey, pollerState, frame, promptDetection, cleanOutput, precomputedLines, rawOutput, } = tick;
+    (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey);
+    pollerState.lastAnsweredPromptKey = null;
+    pollerState.lastAnsweredAt = null;
+    pollerState.enterFallbackCandidateKey = null;
+    // Issue #3757: agy's trust screen reads as no prompt (unnumbered: neither
+    // reader takes it), but it is one nobody here answers — record why, still
+    // as `no_prompt`. Before the warn key is cleared, so the WARN stays once
+    // per screen.
+    // Issue #3820: the trust screen records itself in the ledger when it records
+    // its reason (`suppressAntigravityTrustScreen`).
+    if (cliToolId === 'antigravity' &&
+        (0, auto_yes_prompt_suppression_1.suppressAntigravityTrustScreen)(worktreeId, instanceId, pollerState, frame, manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId))) {
+        return;
+    }
+    pollerState.lastSkipWarnKey = null;
+    if (cliToolId === 'antigravity' && !promptDetection.isPrompt) {
+        const seen = (0, auto_yes_poller_receipt_log_1.logIfWithheldForWantOfReceipt)(worktreeId, instanceId, compositeKey, () => (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput));
+        // Issue #3820: past the receipt window the gated reading says "no prompt"
+        // while the dialog is still up. The ungated reading says it is, so the
+        // ledger keeps the same confirmation (and the same withheld interval)
+        // rather than closing it on every tick outside the window.
+        if (seen !== null) {
+            const scope = { compositeKey, worktreeId, cliToolId, instanceId };
+            (0, auto_yes_confirmation_ledger_1.observeLedgerScreen)(scope, (0, auto_yes_poller_state_1.ledgerScreenKey)(seen.promptData), seen.promptData.type, ledgerCallOf(cliToolId, worktreeId, instanceId));
+            if (seen.reason !== null)
+                (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(scope, seen.reason);
+        }
+    }
+}
+/**
+ * Issue #3820 (design §2.4, PR 3): the agy call the receipt episode on screen
+ * was accepted for, for the ledger to tie the confirmation to. Asked after the
+ * frame was judged; read only to record, and never throws.
+ */
+function ledgerCallOf(cliToolId, worktreeId, instanceId) {
+    if (cliToolId !== 'antigravity')
+        return {};
+    try {
+        const callId = (0, antigravity_receipt_episodes_1.getAntigravityAcceptedReceiptCallId)(worktreeId, instanceId);
+        return callId === null ? {} : { callId };
+    }
+    catch {
+        // Recording only: a failure here ties nothing and changes nothing else.
+        return {};
+    }
+}
+/**
+ * Issue #3820: the result of a send that threw, as the ledger counts it.
+ * `keysSent` is what the sender said (#3706); a throw that says nothing is a
+ * failure whose keys may or may not be on the pane.
+ */
+function attemptResultOfThrow(keysSent) {
+    if (keysSent === true)
+        return 'partial';
+    if (keysSent === false)
+        return 'no-keys-sent';
+    return 'failed';
+}
+/**
+ * Issue #3820: the evidence an answer on the screen path is given on (design
+ * §7 PR 1). A tool's own dialog detector vouched for the frame: `L3`. The
+ * gate did not judge it (a `legacy` tool, a non-multiple-choice prompt): the
+ * generic reading alone, `L4`.
+ *
+ * agy's gate is `legacy` (`gated: false`), yet its prompts are read by its own
+ * reader first (`detectPromptOnCleanFrame` returns that reader's result
+ * whenever it reads the frame). Which reader it was is not on the detection
+ * result, so it is asked of the same reader on the same text here — for the
+ * label only; the answer was decided before this is called. Read by agy's own
+ * reader, and through the receipt gate (the tick's reading carried the
+ * receipt scope): `L3`, with `receiptAccepted` on the attempt.
+ */
+function answerBasisOf(prompt, cleanOutput) {
+    if (prompt.cliToolId === 'antigravity') {
+        return (0, dialog_1.detectAntigravityNumberedDialogPrompt)(cleanOutput) !== null ? 'L3' : 'L4';
+    }
+    const gate = prompt.dialogGate;
+    return gate !== undefined && gate.gated && gate.allowed && gate.dialog !== null ? 'L3' : 'L4';
+}
+/**
+ * The `catch` of `detectAndRespondToPrompt`: settles the send in flight and
+ * tells an abandoned tick from a failed one.
+ */
+function settleFailedTick(error, tick) {
+    const { worktreeId, cliToolId, instanceId, compositeKey, generation, attempt, sendInFlight, receiptEpisode } = tick;
+    const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
+    // Issue #3820: the send that was cut short, in the ledger — before the send
+    // record below is settled, whose state says whether it had expired.
+    if (attempt !== null && sendInFlight) {
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(attempt.ledger, attemptResultOfThrow(keysSent), { expired: attempt.state === 'expired' });
+    }
+    // Issue #3706: a tick that lost its generation — the send stopped part-way
+    // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
+    // failure of the poller that now holds the key, and not an answer either.
+    if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
+        // A stop with keys already on the pane: the next tick must not type the
+        // answer again over them (step 2.5). Recorded under the attempt's key as
+        // it is now — the new one when a worktree ID move carried it (#3713).
+        if (attempt !== null)
+            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, keysSent === true);
+        if (sendInFlight)
+            (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent });
+        return 'no_answer';
+    }
+    if (attempt !== null)
+        (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
+    if (sendInFlight)
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+    incrementErrorCount(compositeKey, generation?.pollerState);
+    logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId });
+    return 'error';
+}
 /**
  * Detect prompt in terminal output, resolve auto-answer, and send response.
  *
@@ -940,6 +708,10 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
     // the send short, and the agy receipt gate is told so (`noteAnswerSent`).
     let sendInFlight = false;
     let receiptEpisode = null;
+    // Issue #3820: the ledger's tick. A tick that read the screen and saw no
+    // confirmation closes the open one as gone when it ends (`endLedgerTick`).
+    const ledgerScope = { compositeKey, worktreeId, cliToolId, instanceId };
+    const ledgerTick = (0, auto_yes_confirmation_ledger_1.beginLedgerTick)(ledgerScope);
     try {
         // 1. Detect prompt.
         //
@@ -980,52 +752,38 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // machine whose hook does not reach us. The price is that Auto-Yes leaves
         // such a machine's dialogs alone, which is why `logIfWithheldForWantOfReceipt`
         // says so.
-        // Issue #3397: a session begun since the last tick (a relaunch the poller
-        // outlived) starts with no screen that had its Enter.
-        const epoch = (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey);
-        if ((pollerState.enterFallbackEpoch ?? 0) !== epoch) {
-            pollerState.enterFallbackSentKey = null;
-            pollerState.enterFallbackCandidateKey = null;
-            pollerState.enterFallbackEpoch = epoch;
-        }
-        const receiptScope = { worktreeId, instanceId };
-        // Issue #3183: the ONE frame every judgement below reads — normalised once,
-        // from the capture as captured (the input-box markers are rule rows the
-        // cleaned spelling has blanked), and handed as the same object to the
-        // prompt reading, the codex launch guards and the dialog gate. That is what
-        // makes "the status chain and Auto-Yes read the same live region" a fact
-        // rather than a hope: there is no second normalisation to disagree with.
-        const frame = (0, frame_1.normalizeFrame)(rawOutput ?? cleanOutput, cliToolId);
-        // Issue #3767: bracket the read so the receipt gate can tell when an agy
-        // dialog first appeared, not only what time this tick is.
-        if (cliToolId === 'antigravity')
-            (0, antigravity_receipt_episodes_1.beginAntigravityFrameRead)(worktreeId, instanceId);
-        const promptDetection = (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput, receiptScope, frame);
-        if (cliToolId === 'antigravity')
-            (0, antigravity_receipt_episodes_1.endAntigravityFrameRead)(worktreeId, instanceId);
+        const epoch = (0, auto_yes_poller_enter_fallback_1.syncEnterFallbackEpoch)(compositeKey, pollerState);
+        const { frame, promptDetection } = readPromptFrame(worktreeId, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput);
         if (!promptDetection.isPrompt || !promptDetection.promptData) {
-            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey);
-            pollerState.lastAnsweredPromptKey = null;
-            pollerState.lastAnsweredAt = null;
-            pollerState.enterFallbackCandidateKey = null;
-            // Issue #3757: agy's trust screen reads as no prompt (unnumbered: neither
-            // reader takes it), but it is one nobody here answers — record why, still
-            // as `no_prompt`. Before the warn key is cleared, so the WARN stays once
-            // per screen.
-            if (cliToolId === 'antigravity' &&
-                (0, auto_yes_prompt_suppression_1.suppressAntigravityTrustScreen)(worktreeId, instanceId, pollerState, frame, manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId))) {
-                return 'no_prompt';
-            }
-            pollerState.lastSkipWarnKey = null;
-            if (cliToolId === 'antigravity' && !promptDetection.isPrompt) {
-                logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, () => (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput));
-            }
+            noteNoPromptOnScreen({
+                worktreeId,
+                cliToolId,
+                instanceId,
+                compositeKey,
+                pollerState,
+                frame,
+                promptDetection,
+                cleanOutput,
+                precomputedLines,
+                rawOutput,
+            });
             return 'no_prompt';
         }
+        // Issue #3820: computed here, before the duplicate check, so the ledger
+        // sees the confirmation on every tick it is on screen (step 2.5 below
+        // reads the same key).
+        // The ledger's own key keeps the body (`ledgerScreenKey`): two commands
+        // that differ by a `>` or an indent are two confirmations to count.
+        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
+        // agy (PR 3): tied to the call the receipt that let it through asked about.
+        (0, auto_yes_confirmation_ledger_1.observeLedgerScreen)(ledgerScope, (0, auto_yes_poller_state_1.ledgerScreenKey)(promptDetection.promptData), promptDetection.promptData.type, ledgerCallOf(cliToolId, worktreeId, instanceId));
         // 2. Check for duplicate prompt (Issue #306)
         const promptKey = (0, prompt_key_1.generatePromptKey)(promptDetection.promptData);
         const frameKey = (0, auto_yes_poller_state_1.promptFrameKey)(promptDetection.promptData);
-        if (isDuplicatePrompt(pollerState, promptKey)) {
+        if ((0, auto_yes_poller_generation_1.isDuplicatePrompt)(pollerState, promptKey)) {
+            // Issue #3820: not answered on this tick either — an interval of its own
+            // reason, so the count can tell the wait for an answer to land apart.
+            (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(ledgerScope, 'answered-recently');
             return 'duplicate';
         }
         const judged = {
@@ -1046,27 +804,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // (`partialAnswerScreenKey`: options and approvalTarget count, the cursor
         // does not), or the session is relaunched. Recorded as a suppression, so
         // the prompt Push and `cmate wait` see "withheld", not "answering".
-        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
-        const partial = (0, auto_yes_poller_state_1.getPartialAnswer)(compositeKey, epoch);
-        if (partial !== null) {
-            if (partial.screenKey === screenKey) {
-                (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
-                    reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
-                    mode: null,
-                    promptType: promptDetection.promptData.type,
-                }, `${frameKey}\u0000partial-answer`, 'poller:auto-yes-skipped-partial-answer', { promptType: promptDetection.promptData.type, stoppedAt: partial.at });
-                return 'no_answer';
-            }
-            // Another prompt is on screen: only the sends at the forgotten one's
-            // screen go with it (#3713) — one in flight at this screen keeps its hold.
-            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey, partial.screenKey);
-        }
-        // Issue #3713: a worktree ID move carried an answer still being sent to
-        // this session's key. Its keys may already be on the pane, and how its send
-        // ends is not known yet — so this screen gets no keys until it comes back
-        // (recorded as a partial answer above, or gone).
-        if ((0, auto_yes_poller_state_1.hasMovedSendInFlight)(compositeKey, epoch, screenKey)) {
-            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000moved-send-in-flight`, 'poller:auto-yes-skipped-moved-send-in-flight', { worktreeId, cliToolId, instanceId, promptType: promptDetection.promptData.type });
+        if ((0, auto_yes_poller_steps_1.withheldForEarlierSend)(judged, screenKey, epoch)) {
             return 'no_answer';
         }
         // 3., 3.2., 3.5. Frames that are not Auto-Yes's to answer: see
@@ -1092,25 +830,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // auto-answer: a prompt the policy withholds is left for a human, and the
         // response poller's prompt path (WS broadcast + Web Push, see
         // polling/response-checker.ts) is what tells them it is waiting.
-        const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
-        const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptDetection.promptData, policy);
-        if (resolution.suppressedBy) {
-            // Issue #1684: the log line alone leaves a CLI-driven pipeline blind to
-            // why its worker stalled. Record the suppression so buildCurrentOutput
-            // can publish it (`autoYes.lastSuppression` in capture --json).
-            (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
-                reason: resolution.suppressedBy,
-                mode: policy?.mode ?? null,
-                promptType: promptDetection.promptData.type,
-                pattern: resolution.pattern,
-            }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${policy?.mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
-                reason: resolution.suppressedBy,
-                mode: policy?.mode ?? null,
-                pattern: resolution.pattern,
-                promptType: promptDetection.promptData.type,
-            });
-        }
-        const answer = resolution.answer;
+        const answer = (0, auto_yes_poller_steps_1.resolveAnswerUnderPolicy)(judged);
         if (answer === null) {
             return 'no_answer';
         }
@@ -1121,21 +841,17 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // Issue #2865: never auto-answer a same-named session another CommandMate
         // server created. The poller keeps running; it just does not type.
         const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
-        if (generation !== undefined && !isTickCurrent(generation))
+        if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation))
             return 'no_answer';
-        if (ownership === null || ownership.verdict === 'foreign') {
-            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
-                worktreeId,
-                cliToolId,
-                instanceId,
-                sessionName,
-                sessionPath: ownership?.sessionPath ?? null,
-                reason: ownership ? 'foreign' : 'worktree_not_found',
-            });
+        if ((0, auto_yes_poller_steps_1.skippedForUnownedSession)(judged, sessionName, ownership)) {
             return 'no_answer';
         }
-        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch);
-        receiptEpisode = receiptEpisodeOfSend(cliToolId, worktreeId, instanceId);
+        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch, 
+        // Issue #3820: an agy prompt read past the gate is one a hook receipt let through.
+        (0, auto_yes_confirmation_ledger_1.beginLedgerAttempt)(ledgerScope, answerBasisOf(judged, cleanOutput), {
+            receiptAccepted: cliToolId === 'antigravity',
+        }));
+        receiptEpisode = (0, auto_yes_poller_receipt_log_1.receiptEpisodeOfSend)(cliToolId, worktreeId, instanceId);
         sendInFlight = true;
         try {
             await (0, prompt_answer_sender_1.sendPromptAnswer)({
@@ -1144,43 +860,35 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
                 cliToolId,
                 promptData: promptDetection.promptData,
                 // Issue #3706: asked after each wait inside the send.
-                ...(generation !== undefined ? { stillCurrent: () => isTickCurrent(generation) } : {}),
+                ...(generation !== undefined ? { stillCurrent: () => (0, auto_yes_poller_generation_1.isTickCurrent)(generation) } : {}),
             });
         }
         finally {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
         }
         sendInFlight = false;
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(attempt.ledger, 'ok', { expired: attempt.state === 'expired' });
         (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
         // Issue #3796 review E: the episode the send began for, as on the failure side.
-        noteAnswerSent(cliToolId, worktreeId, instanceId, false, receiptEpisode);
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, false, receiptEpisode);
         // 6., 7. The answer reached tmux: see `finishAnsweredPrompt`.
         await finishAnsweredPrompt(judged, promptDetection, answer, generation);
         return 'responded';
     }
     catch (error) {
-        // Issue #3706: a tick that lost its generation — the send stopped part-way
-        // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
-        // failure of the poller that now holds the key, and not an answer either.
-        if (generation !== undefined && !isTickCurrent(generation)) {
-            const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
-            // A stop with keys already on the pane: the next tick must not type the
-            // answer again over them (step 2.5). Recorded under the attempt's key as
-            // it is now — the new one when a worktree ID move carried it (#3713).
-            if (attempt !== null)
-                (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, keysSent === true);
-            if (sendInFlight)
-                noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
-            logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent });
-            return 'no_answer';
-        }
-        if (attempt !== null)
-            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
-        if (sendInFlight)
-            noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
-        incrementErrorCount(compositeKey, generation?.pollerState);
-        logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId });
-        return 'error';
+        return settleFailedTick(error, {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            compositeKey,
+            generation,
+            attempt,
+            sendInFlight,
+            receiptEpisode,
+        });
+    }
+    finally {
+        (0, auto_yes_confirmation_ledger_1.endLedgerTick)(ledgerScope, ledgerTick);
     }
 }
 /**
@@ -1195,7 +903,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
 async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
     // 1. Validate context
-    const pollerState = getPollerState(compositeKey);
+    const pollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
     if (owner !== undefined && pollerState !== owner)
         return;
     const contextResult = validatePollingContext(compositeKey, pollerState);
@@ -1229,8 +937,8 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // step below exactly as it did; the raw one is carried to the prompt reading
         // so a dialog anchored on box drawing is not invisible to the one path that
         // can answer it without a human.
-        const { raw: rawOutput, clean: cleanOutput } = await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId);
-        if (!isTickCurrent(generation)) {
+        const { raw: rawOutput, clean: cleanOutput } = await (0, auto_yes_poller_capture_1.capturePollerFrame)(worktreeId, cliToolId, captureLines, instanceId);
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
@@ -1247,7 +955,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         }
         // 4. Detect and respond to prompt
         const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput, generation);
-        if (!isTickCurrent(generation)) {
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
@@ -1256,7 +964,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // over hours. Not on 'error': a capture that works followed by an answer
         // that fails every time must still back off and stop.
         if (result !== 'error') {
-            resetErrorCount(compositeKey, generation.pollerState);
+            (0, auto_yes_poller_generation_1.resetErrorCount)(compositeKey, generation.pollerState);
         }
         if (result === 'responded') {
             scheduleNextPoll(generation, auto_yes_state_1.COOLDOWN_INTERVAL_MS);
@@ -1277,7 +985,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // enables it before the session starts — so wait until `expiresAt`, at the
         // backoff cap, instead of counting toward `consecutive_errors`.
         const sessionMissing = await isSessionMissing(worktreeId, cliToolId, instanceId);
-        if (!isTickCurrent(generation)) {
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
@@ -1320,7 +1028,7 @@ async function isSessionMissing(worktreeId, cliToolId, instanceId) {
  * @param options.sessionWait - The tick waits for a session to appear (Issue #3791)
  */
 function scheduleNextPoll(generation, overrideInterval, options = {}) {
-    if (!isPollerCurrent(generation))
+    if (!(0, auto_yes_poller_generation_1.isPollerCurrent)(generation))
         return;
     const { worktreeId, cliToolId, instanceId, pollerState } = generation;
     const interval = Math.max(overrideInterval ?? pollerState.currentInterval, auto_yes_state_1.POLLING_INTERVAL_MS);
@@ -1373,7 +1081,7 @@ function armSessionWaitWake(generation, timerId) {
         if (wake === undefined || wake.timerId !== timerId)
             return;
         sessionWaitWakes.delete(compositeKey);
-        if (!isPollerCurrent(generation) || pollerState.timerId !== timerId)
+        if (!(0, auto_yes_poller_generation_1.isPollerCurrent)(generation) || pollerState.timerId !== timerId)
             return;
         clearTimeout(timerId);
         logger.info('poller:session-created-wake', { worktreeId, cliToolId, instanceId });
@@ -1416,8 +1124,8 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     }
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, effectiveInstanceId);
     // Check concurrent poller limit (DoS protection)
-    const existingPollerState = getPollerState(compositeKey);
-    if (!existingPollerState && autoYesPollerStates.size >= auto_yes_state_1.MAX_CONCURRENT_POLLERS) {
+    const existingPollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
+    if (!existingPollerState && auto_yes_poller_generation_1.autoYesPollerStates.size >= auto_yes_state_1.MAX_CONCURRENT_POLLERS) {
         return { started: false, reason: 'max concurrent pollers reached' };
     }
     // Issue #501: Idempotency check (key already encodes the instance, so a matching
@@ -1442,7 +1150,7 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
         stopCheckBaselineLength: -1,
         lastSkipWarnKey: null,
     };
-    autoYesPollerStates.set(compositeKey, pollerState);
+    auto_yes_poller_generation_1.autoYesPollerStates.set(compositeKey, pollerState);
     // A task may have been recorded moments ago; start from a fresh policy read.
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
     // Start polling immediately
@@ -1471,14 +1179,17 @@ function stopAutoYesPolling(compositeKey, reason) {
     // cleanup call this for an instance whose poller may already be gone, and the
     // Enter record must not outlive the grant or the session either way.
     (0, auto_yes_enter_fallback_1.forgetEnterFallback)(compositeKey);
-    const pollerState = getPollerState(compositeKey);
+    // Issue #3820: before the early return too — a session ended after its
+    // poller had already stopped still abandons the confirmation left on it.
+    (0, auto_yes_confirmation_ledger_1.noteLedgerPollerStopped)(compositeKey, (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(reason, 'unspecified'));
+    const pollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
     if (!pollerState)
         return;
     if (pollerState.timerId) {
         clearTimeout(pollerState.timerId);
     }
     dropSessionWaitWake(compositeKey);
-    autoYesPollerStates.delete(compositeKey);
+    auto_yes_poller_generation_1.autoYesPollerStates.delete(compositeKey);
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
     logger.info('poller:stopped', { compositeKey, reason: (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(reason, 'unspecified') });
 }
@@ -1492,15 +1203,16 @@ function stopAutoYesPolling(compositeKey, reason) {
  */
 function stopAllAutoYesPolling() {
     const reason = (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(undefined, 'shutdown');
-    for (const [key, pollerState] of autoYesPollerStates.entries()) {
+    for (const [key, pollerState] of auto_yes_poller_generation_1.autoYesPollerStates.entries()) {
         if (pollerState.timerId) {
             clearTimeout(pollerState.timerId);
         }
         dropSessionWaitWake(key);
         (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(key);
+        (0, auto_yes_confirmation_ledger_1.noteLedgerPollerStopped)(key, reason);
         logger.info('poller:stopped', { compositeKey: key, reason });
     }
-    autoYesPollerStates.clear();
+    auto_yes_poller_generation_1.autoYesPollerStates.clear();
     (0, auto_yes_enter_fallback_1.clearEnterFallbacks)();
     (0, auto_yes_poller_state_1.clearPartialAnswers)();
 }
@@ -1512,7 +1224,7 @@ function stopAllAutoYesPolling() {
  * @returns Array of composite keys present in the autoYesPollerStates Map
  */
 function getAutoYesPollerCompositeKeys() {
-    return Array.from(autoYesPollerStates.keys());
+    return Array.from(auto_yes_poller_generation_1.autoYesPollerStates.keys());
 }
 // =============================================================================
 // byWorktree Helpers (Issue #525)
@@ -1531,11 +1243,14 @@ function getAutoYesPollerCompositeKeys() {
  *   `auto-yes-lifecycle`), both are dropped and a late send records nothing.
  */
 function stopAutoYesPollingByWorktree(worktreeId, options) {
-    const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId);
+    const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(auto_yes_poller_generation_1.autoYesPollerStates.keys()), worktreeId);
     // Issue #3730: `options.reason`, else the enclosing scope's (the lifecycle table).
     pollerKeys.forEach(key => stopAutoYesPolling(key, options?.reason));
     // Issue #3397: and the records of instances whose poller had already stopped.
     (0, auto_yes_enter_fallback_1.forgetEnterFallbacksByWorktree)(worktreeId);
+    // Issue #3820: and the ledger's confirmations on them — an API approval is
+    // opened with Auto-Yes off too, so the running pollers do not name them all.
+    (0, auto_yes_confirmation_ledger_1.noteLedgerWorktreeStopped)(worktreeId, (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(options?.reason, 'unspecified'));
     if (!options?.keepPartialAnswers)
         (0, auto_yes_poller_state_1.forgetPartialAnswersByWorktree)(worktreeId);
 }
@@ -1547,5 +1262,5 @@ function stopAutoYesPollingByWorktree(worktreeId, options) {
  * @returns true if any poller is active for this worktree
  */
 function isAnyPollerActiveForWorktree(worktreeId) {
-    return (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId).length > 0;
+    return (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(auto_yes_poller_generation_1.autoYesPollerStates.keys()), worktreeId).length > 0;
 }