commandmate 0.47.0 → 0.48.0

package/dist/server/src/lib/auto-yes-poller.js

@@ -8,8 +8,14 @@
  * Issue #525: Composite key migration (worktreeId:cliToolId) for per-agent auto-yes.
  *
  * Dependencies: auto-yes-state.ts (composite keys / state), polling/* (prompt
- * detection, resolver, policy, dialog gate, enter fallback, poller state),
- * cli-tools/*, session/cli-session.ts, tmux/*, detection/*, db/*, tasks/*.
+ * detection, resolver, policy, dialog gate, session epoch, poller state,
+ * decision record), cli-tools/*, session/cli-session.ts, tmux/*, detection/*,
+ * db/*, tasks/*.
+ *
+ * Issue #3821: this poller (with the hook / API adjudication) is what answers
+ * automatically. The browser no longer answers, and the Enter sent to a choice
+ * screen CommandMate could not read (#3397) is gone: such a screen is left to a
+ * human, recorded as `unclassified-frame`.
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -45,46 +51,38 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AUTO_YES_ENTER_FALLBACK_ANSWER = void 0;
-exports.getActivePollerCount = getActivePollerCount;
+exports.capturePollerFrame = exports.captureAndCleanOutput = exports.AUTO_YES_ENTER_FALLBACK_ANSWER = exports.isAnyPollerActiveForWorktree = exports.getAutoYesPollerCompositeKeys = exports.noHookReceiptHint = exports.isPollerActive = exports.getLastServerResponseTimestamp = exports.getActivePollerCount = void 0;
 exports.clearAllPollerStates = clearAllPollerStates;
-exports.getLastServerResponseTimestamp = getLastServerResponseTimestamp;
-exports.isPollerActive = isPollerActive;
 exports.validatePollingContext = validatePollingContext;
-exports.capturePollerFrame = capturePollerFrame;
-exports.captureAndCleanOutput = captureAndCleanOutput;
 exports.processStopConditionDelta = processStopConditionDelta;
-exports.noHookReceiptHint = noHookReceiptHint;
 exports.detectAndRespondToPrompt = detectAndRespondToPrompt;
 exports.startAutoYesPolling = startAutoYesPolling;
 exports.stopAutoYesPolling = stopAutoYesPolling;
 exports.stopAllAutoYesPolling = stopAllAutoYesPolling;
-exports.getAutoYesPollerCompositeKeys = getAutoYesPollerCompositeKeys;
 exports.stopAutoYesPollingByWorktree = stopAutoYesPollingByWorktree;
-exports.isAnyPollerActiveForWorktree = isAnyPollerActiveForWorktree;
-const cli_session_1 = require("./session/cli-session");
 const response_checker_1 = require("./polling/response-checker");
-const antigravity_receipt_episodes_1 = require("./polling/antigravity-receipt-episodes");
-const antigravity_permission_receipts_1 = require("./polling/antigravity-permission-receipts");
-const auto_yes_resolver_1 = require("./polling/auto-yes-resolver");
 const auto_yes_policy_1 = require("./polling/auto-yes-policy");
-const detect_1 = require("./detection/tools/codex/detect");
-const frame_1 = require("./detection/tools/frame");
-const auto_yes_dialog_gate_1 = require("./polling/auto-yes-dialog-gate");
 const auto_yes_enter_fallback_1 = require("./polling/auto-yes-enter-fallback");
+const auto_yes_decision_state_1 = require("./polling/auto-yes-decision-state");
+const auto_yes_manual_answer_1 = require("./polling/auto-yes-manual-answer");
+const auto_yes_decision_1 = require("../types/auto-yes-decision");
 const task_transition_service_1 = require("./tasks/task-transition-service");
 const db_instance_1 = require("./db/db-instance");
 const chat_db_1 = require("./db/chat-db");
 const worktree_session_ownership_1 = require("./cli-tools/worktree-session-ownership");
 const prompt_answer_sender_1 = require("./prompt-answer-sender");
-const prompt_answer_semantic_1 = require("./prompt-answer-semantic");
-const tmux_1 = require("./tmux/tmux");
 const session_created_signal_1 = require("./tmux/session-created-signal");
 const manager_1 = require("./cli-tools/manager");
 const cli_patterns_1 = require("./detection/cli-patterns");
 const prompt_key_1 = require("./detection/prompt-key");
 const errors_1 = require("./errors");
 const tmux_capture_cache_1 = require("./tmux/tmux-capture-cache");
+const waiting_screen_reading_1 = require("./detection/waiting-screen-reading");
+const status_detector_1 = require("./detection/status-detector");
+const prompt_waiting_composition_1 = require("./session/prompt-waiting-composition");
+const registry_1 = require("./hooks/sources/registry");
+const waiting_episode_binding_1 = require("./session/waiting-episode-binding");
+const waiting_episode_state_1 = require("./session/waiting-episode-state");
 const auto_yes_config_1 = require("../config/auto-yes-config");
 const auto_yes_poller_stop_reason_1 = require("./polling/auto-yes-poller-stop-reason");
 const logger_1 = require("../lib/logger");
@@ -92,42 +90,34 @@ const logger = (0, logger_1.createLogger)('auto-yes-poller');
 const path_validator_1 = require("./security/path-validator");
 const auto_yes_state_1 = require("./auto-yes-state");
 const global_state_1 = require("./global-state");
-const auto_yes_suppression_reason_1 = require("./polling/auto-yes-suppression-reason");
-const auto_yes_suppression_state_1 = require("./polling/auto-yes-suppression-state");
 const auto_yes_poller_state_1 = require("./polling/auto-yes-poller-state");
 const auto_yes_prompt_suppression_1 = require("./polling/auto-yes-prompt-suppression");
-/** In-memory storage for poller states (globalThis for hot reload persistence) */
-const autoYesPollerStates = (0, global_state_1.getOrInitGlobal)('__autoYesPollerStates', () => new Map());
-/**
- * When `antigravity-autoyes-withheld-no-hook-receipt` was last logged, per
- * compositeKey (Issue #2857). The poller re-reads a static pane every 2s, so the
- * line is limited to one per {@link WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS} per
- * instance. globalThis for the same reason as the poller states above.
- */
-const withheldNoReceiptLoggedAt = (0, global_state_1.getOrInitGlobal)('__autoYesWithheldNoReceiptLoggedAt', () => new Map());
-/**
- * Least gap between two `antigravity-autoyes-withheld-no-hook-receipt` lines for
- * one instance. `antigravity-autoyes-withheld-by-policy` (Issue #3724) shares it.
- */
-const WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS = 60_000;
-// =============================================================================
-// Poller State Accessors (compositeKey-based)
-// =============================================================================
-/**
- * Get poller state by composite key.
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns Poller state or undefined
- */
-function getPollerState(compositeKey) {
-    return autoYesPollerStates.get(compositeKey);
-}
-/**
- * Get the number of active pollers.
- */
-function getActivePollerCount() {
-    return autoYesPollerStates.size;
-}
+const auto_yes_poller_generation_1 = require("./polling/auto-yes-poller-generation");
+const auto_yes_poller_receipt_log_1 = require("./polling/auto-yes-poller-receipt-log");
+const auto_yes_poller_enter_fallback_1 = require("./polling/auto-yes-poller-enter-fallback");
+const auto_yes_poller_capture_1 = require("./polling/auto-yes-poller-capture");
+const prompt_screen_reading_1 = require("./polling/prompt-screen-reading");
+const auto_yes_confirmation_ledger_1 = require("./polling/auto-yes-confirmation-ledger");
+const auto_yes_poller_tick_1 = require("./auto-yes-poller-tick");
+const auto_yes_poller_answer_target_1 = require("./auto-yes-poller-answer-target");
+const auto_yes_poller_session_presence_1 = require("./auto-yes-poller-session-presence");
+const auto_yes_poller_steps_1 = require("./polling/auto-yes-poller-steps");
+// Issue #3783: split out; re-exported so existing importers are unchanged.
+var auto_yes_poller_generation_2 = require("./polling/auto-yes-poller-generation");
+Object.defineProperty(exports, "getActivePollerCount", { enumerable: true, get: function () { return auto_yes_poller_generation_2.getActivePollerCount; } });
+Object.defineProperty(exports, "getLastServerResponseTimestamp", { enumerable: true, get: function () { return auto_yes_poller_generation_2.getLastServerResponseTimestamp; } });
+Object.defineProperty(exports, "isPollerActive", { enumerable: true, get: function () { return auto_yes_poller_generation_2.isPollerActive; } });
+var auto_yes_poller_receipt_log_2 = require("./polling/auto-yes-poller-receipt-log");
+Object.defineProperty(exports, "noHookReceiptHint", { enumerable: true, get: function () { return auto_yes_poller_receipt_log_2.noHookReceiptHint; } });
+// Issue #3893: split out; re-exported so existing importers are unchanged.
+var auto_yes_poller_keys_1 = require("./auto-yes-poller-keys");
+Object.defineProperty(exports, "getAutoYesPollerCompositeKeys", { enumerable: true, get: function () { return auto_yes_poller_keys_1.getAutoYesPollerCompositeKeys; } });
+Object.defineProperty(exports, "isAnyPollerActiveForWorktree", { enumerable: true, get: function () { return auto_yes_poller_keys_1.isAnyPollerActiveForWorktree; } });
+var auto_yes_poller_enter_fallback_2 = require("./polling/auto-yes-poller-enter-fallback");
+Object.defineProperty(exports, "AUTO_YES_ENTER_FALLBACK_ANSWER", { enumerable: true, get: function () { return auto_yes_poller_enter_fallback_2.AUTO_YES_ENTER_FALLBACK_ANSWER; } });
+var auto_yes_poller_capture_2 = require("./polling/auto-yes-poller-capture");
+Object.defineProperty(exports, "captureAndCleanOutput", { enumerable: true, get: function () { return auto_yes_poller_capture_2.captureAndCleanOutput; } });
+Object.defineProperty(exports, "capturePollerFrame", { enumerable: true, get: function () { return auto_yes_poller_capture_2.capturePollerFrame; } });
 /**
  * Clear all poller states.
  * Stops all active pollers before clearing state.
@@ -136,58 +126,8 @@ function getActivePollerCount() {
 function clearAllPollerStates() {
     // Issue #3730: a test seam, not a shutdown — logged as such.
     (0, auto_yes_poller_stop_reason_1.withPollerStopReason)('reset', () => stopAllAutoYesPolling());
-    autoYesPollerStates.clear();
-    withheldNoReceiptLoggedAt.clear();
-}
-/**
- * Get the last server response timestamp for a composite key.
- *
- * Issue #525: Changed from (worktreeId) to (compositeKey).
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns Timestamp (Date.now()) of the last server response, or null if none
- */
-function getLastServerResponseTimestamp(compositeKey) {
-    const pollerState = getPollerState(compositeKey);
-    return pollerState?.lastServerResponseTimestamp ?? null;
-}
-/**
- * Check if a server-side auto-yes poller is active for a composite key.
- *
- * Issue #525: Changed from (worktreeId) to (compositeKey).
- *
- * @param compositeKey - Composite key (worktreeId:cliToolId)
- * @returns true if a poller is actively running
- */
-function isPollerActive(compositeKey) {
-    return autoYesPollerStates.has(compositeKey);
-}
-/**
- * Update the last server response timestamp.
- *
- * @param compositeKey - Composite key
- * @param timestamp - Timestamp value (Date.now())
- */
-function updateLastServerResponseTimestamp(compositeKey, timestamp, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
-    if (pollerState) {
-        pollerState.lastServerResponseTimestamp = timestamp;
-    }
-}
-/**
- * Reset error count for a poller and restore the default polling interval.
- * Called after every poll that ran to the end without an error (Issue #3329)
- * and after an answer is sent.
- *
- * @param compositeKey - Composite key
- * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
- */
-function resetErrorCount(compositeKey, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
-    if (pollerState) {
-        pollerState.consecutiveErrors = 0;
-        pollerState.currentInterval = auto_yes_state_1.POLLING_INTERVAL_MS;
-    }
+    auto_yes_poller_generation_1.autoYesPollerStates.clear();
+    auto_yes_poller_receipt_log_1.withheldNoReceiptLoggedAt.clear();
 }
 /**
  * Increment error count and apply backoff if the threshold is exceeded.
@@ -197,10 +137,12 @@ function resetErrorCount(compositeKey, owner) {
  * @param owner - The tick's own poller state (Issue #3706); see {@link ownedPollerState}
  */
 function incrementErrorCount(compositeKey, owner) {
-    const pollerState = ownedPollerState(compositeKey, owner);
+    const pollerState = (0, auto_yes_poller_generation_1.ownedPollerState)(compositeKey, owner);
     if (pollerState) {
         pollerState.consecutiveErrors++;
         pollerState.currentInterval = (0, auto_yes_state_1.calculateBackoffInterval)(pollerState.consecutiveErrors);
+        // Issue #3791 (review N1): a failed tick held nothing back with the duplicate guard.
+        (0, auto_yes_poller_generation_1.releaseDuplicateRetry)(pollerState);
         // Issue #499 Item 5: Auto-stop after consecutive error threshold.
         //
         // Issue #3184: this is the `consecutive-errors` row of AUTO_YES_LIFECYCLE
@@ -221,46 +163,6 @@ function incrementErrorCount(compositeKey, owner) {
         }
     }
 }
-/**
- * The poller state under `compositeKey`, but only when it is `owner` — the
- * tick's own (Issue #3706). Without `owner` (callers outside a tick, and tests
- * driving `detectAndRespondToPrompt` with a hand-built state) it is the plain
- * by-key read this always was.
- */
-function ownedPollerState(compositeKey, owner) {
-    const pollerState = getPollerState(compositeKey);
-    if (owner !== undefined && pollerState !== owner)
-        return undefined;
-    return pollerState;
-}
-/** Is the tick's poller still the one under its key (not stopped, not replaced)? */
-function isPollerCurrent(generation) {
-    return getPollerState(generation.compositeKey) === generation.pollerState;
-}
-/**
- * May the tick still act: its poller, its grant (the same enable, not expired)
- * and its session (no relaunch since) are all still the ones it started under.
- * Checked after capture, after each wait before a key, and inside the send.
- */
-function isTickCurrent(generation) {
-    if (!isPollerCurrent(generation))
-        return false;
-    // `getAutoYesState` returns the stored object until it expires, when it
-    // stores (and returns) a disabled one — so an expiry fails identity too.
-    const grant = (0, auto_yes_state_1.getAutoYesState)(generation.worktreeId, generation.cliToolId, generation.instanceId);
-    if (grant !== generation.grant || !grant.enabled)
-        return false;
-    return isSameSession(generation);
-}
-/**
- * Is the session the tick answered still the one it started on (Issue #3706)?
- * What the follow-ups of an answer already sent — the response poller restart,
- * the terminal push — are judged by: a disable after the keys landed does not
- * un-send them, a relaunch does make them about another process.
- */
-function isSameSession(generation) {
-    return (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(generation.compositeKey) === generation.sessionEpoch;
-}
 /**
  * End a tick that found its generation gone (Issue #3706). It changes nothing;
  * it re-arms its timer only when its own poller is still the current one — a
@@ -272,25 +174,11 @@ function endStaleTick(generation) {
         worktreeId: generation.worktreeId,
         cliToolId: generation.cliToolId,
         instanceId: generation.instanceId,
-        pollerCurrent: isPollerCurrent(generation),
+        pollerCurrent: (0, auto_yes_poller_generation_1.isPollerCurrent)(generation),
     });
-    if (isPollerCurrent(generation))
+    if ((0, auto_yes_poller_generation_1.isPollerCurrent)(generation))
         scheduleNextPoll(generation);
 }
-/**
- * Check if the given prompt has already been answered recently.
- *
- * @param pollerState - Current poller state
- * @param promptKey - Composite key of the current prompt
- * @returns true if the prompt key matches and is within the retry expiry window
- */
-function isDuplicatePrompt(pollerState, promptKey) {
-    if (pollerState.lastAnsweredPromptKey !== promptKey)
-        return false;
-    if (pollerState.lastAnsweredAt === null)
-        return false;
-    return (Date.now() - pollerState.lastAnsweredAt) < auto_yes_state_1.DUPLICATE_RETRY_EXPIRY_MS;
-}
 // =============================================================================
 // Extracted Functions for pollAutoYes (Issue #323: SRP decomposition)
 // =============================================================================
@@ -327,38 +215,6 @@ function validatePollingContext(compositeKey, pollerState) {
     }
     return 'valid';
 }
-/**
- * Capture tmux session output once, keeping both spellings (Issue #2522).
- *
- * @internal Exported for testing purposes only.
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param captureLines - Optional number of lines to capture
- * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
- * @returns The tick's raw capture and its cleaned form
- */
-async function capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId) {
-    const lines = captureLines ?? auto_yes_config_1.FULL_CAPTURE_LINES;
-    const output = await (0, cli_session_1.captureSessionOutput)(worktreeId, cliToolId, lines, instanceId);
-    return { raw: output, clean: (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(output)) };
-}
-/**
- * Capture tmux session output and strip ANSI escape codes.
- *
- * Kept as the cleaned half of {@link capturePollerFrame} so the many callers and
- * tests that only ever wanted that string are untouched; `pollAutoYes` takes the
- * pair. `stripBoxDrawing` still runs exactly once per capture either way.
- *
- * @internal Exported for testing purposes only.
- * @param worktreeId - Worktree identifier
- * @param cliToolId - CLI tool type being polled
- * @param captureLines - Optional number of lines to capture
- * @param instanceId - Optional agent instance ID (Issue #896; defaults to primary session)
- * @returns Cleaned output string (ANSI stripped)
- */
-async function captureAndCleanOutput(worktreeId, cliToolId, captureLines, instanceId) {
-    return (await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId)).clean;
-}
 /**
  * Process stop condition check using delta-based approach.
  *
@@ -386,422 +242,6 @@ function processStopConditionDelta(compositeKey, pollerState, cleanOutput) {
     }
     return false;
 }
-/**
- * Say, once a minute, that Auto-Yes left an agy dialog alone for want of a hook
- * receipt (Issue #2857).
- *
- * `detectPromptOnCleanFrame` hands a frame the receipt gate (#2849) withholds
- * back as an ordinary `isPrompt: false`, so the poller cannot tell "no dialog on
- * the pane" from "a dialog agy never asked us about" by looking at the result.
- * The gate is the ONLY thing `receiptScope` changes, so the same frame read
- * without it answering a prompt is exactly the withheld case. That second
- * reading is taken only after the cheap tests: no receipt for this instance in
- * the window (with one, the gate let the frame through and a no-prompt result is
- * a real one) and no line for it in the last minute.
- *
- * Why it is worth a line: a machine whose `~/.gemini/config/hooks.json` points at
- * another server (#2622) never sends us the question, and every real dialog then
- * waits for a human with no sign of why. The line names the file to look at.
- *
- * A stale receipt does not always mean that, though (Issue #3724): a dialog the
- * contract's autoYes withheld got its receipt, the server answered `ask`, and
- * the dialog outlived the window. When `resolveAutoAnswerWithPolicy` on the
- * ungated reading suppresses the answer by contract (the base rules would have
- * answered it), the line is `antigravity-autoyes-withheld-by-policy` instead,
- * naming the reason, the mode and the task. Both share the limit.
- * The response-checker's own `antigravity-dialog-no-recent-receipt` stays at
- * debug — it prints on every tick the same pane is read again.
- *
- * @param compositeKey - The instance's key, for the once-a-minute limit
- * @param readWithoutGate - The same frame read without `receiptScope`
- */
-function logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, readWithoutGate) {
-    // Issue #3767: the gate's own verdict for this tick's candidate. Null means it
-    // never saw one (no dialog), `ok` that it let the frame through.
-    let verdict = (0, antigravity_receipt_episodes_1.getAntigravityReceiptVerdict)(worktreeId, instanceId);
-    if (verdict?.ok)
-        return;
-    const now = Date.now();
-    const ungated = readWithoutGate();
-    if (!ungated.isPrompt || !ungated.promptData)
-        return;
-    // The gate was not consulted (the gated reading declined the frame on screen
-    // grounds alone) yet the frame reads as a prompt: judge it here.
-    verdict ??= (0, antigravity_receipt_episodes_1.judgeAntigravityPermissionReceipt)(worktreeId, instanceId, now);
-    if (verdict.ok)
-        return;
-    // Issue #3724: a contract that withholds the answer makes the server reply
-    // `ask`, so the dialog stays up past the receipt window. The cause is then the
-    // contract, not a hooks.json that points elsewhere. Judged exactly as the tick
-    // judges a prompt it can read — the base rules first, then the contract — so
-    // a prompt the base rules never answer (a checkbox, a typed option) is not
-    // blamed on the contract. Policy and task id come from one lookup.
-    const { policy, taskId } = (0, auto_yes_policy_1.getSessionAutoYesPolicyEntry)(worktreeId, 'antigravity', instanceId);
-    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(ungated.promptData, policy);
-    // Issue #3767: `answered` is the dialog the gate already let through on this
-    // receipt, still up past the window. Unless the contract withheld it, that is
-    // not a missing receipt: neither recorded nor logged, nor counted for the limit.
-    // Issue #3789: `answered` is also a dialog accepted but never sent to (the
-    // tick recorded its own reason, if any, and that record is kept). One the
-    // poller DID send keys to and still up past the grace is `outlived`, which is
-    // recorded and logged like the others, so the stop is not a silent one.
-    // Issue #3796: the reason the poller recorded for this dialog (partial-answer,
-    // the contract, …) while it could still read it inside the window was not
-    // re-stamped once the window closed — the gated reading stopped seeing the
-    // prompt — so `cmate wait` dropped it as stale a minute later with the dialog
-    // still up. Re-stamped here on every tick the dialog stays — only while it
-    // still holds under this tick's evaluation — and kept over a `no-hook-receipt`
-    // for it: it is the more exact reason.
-    const keptPartialAnswer = refreshEpisodeSuppression(worktreeId, instanceId, verdict, resolution);
-    // Issue #3796 review D: a contract that withholds the prompt now is published
-    // whatever was recorded before — none at all (the window closed before the
-    // tick could read it, or an ended contract's record was dropped and a new one
-    // withholds it again) or another reason. Without it `cmate wait` read no
-    // reason and held the prompt as one Auto-Yes was answering. Only a partial
-    // answer still on screen comes first, as it does on the tick (step 2.5).
-    if (resolution.suppressedBy && !keptPartialAnswer) {
-        (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, {
-            reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
-            promptType: ungated.promptData.type,
-            ...(resolution.pattern !== undefined ? { pattern: resolution.pattern } : {}),
-        });
-    }
-    if (!resolution.suppressedBy && (verdict.cause === 'answered' || keptPartialAnswer))
-        return;
-    const lastLoggedAt = withheldNoReceiptLoggedAt.get(compositeKey);
-    const logDue = lastLoggedAt === undefined || now - lastLoggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS;
-    if (logDue) {
-        for (const [key, loggedAt] of withheldNoReceiptLoggedAt) {
-            if (now - loggedAt >= WITHHELD_NO_RECEIPT_LOG_INTERVAL_MS)
-                withheldNoReceiptLoggedAt.delete(key);
-        }
-        withheldNoReceiptLoggedAt.set(compositeKey, now);
-    }
-    if (resolution.suppressedBy) {
-        if (!logDue)
-            return;
-        logger.info('antigravity-autoyes-withheld-by-policy', {
-            worktreeId,
-            instanceId: instanceId ?? 'antigravity',
-            reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
-            taskId,
-            hint: '契約の autoYes が答えを止めている。契約の autoYes を確認',
-        });
-        return;
-    }
-    // Issue #3767: recorded on every tick (the record's `at` follows the prompt
-    // while it stays up), logged once a minute.
-    (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, {
-        reason: auto_yes_suppression_reason_1.NO_HOOK_RECEIPT_SUPPRESSION_REASON,
-        mode: null,
-        promptType: ungated.promptData.type,
-    });
-    if (!logDue)
-        return;
-    logger.info('antigravity-autoyes-withheld-no-hook-receipt', {
-        worktreeId,
-        instanceId: instanceId ?? 'antigravity',
-        windowMs: antigravity_permission_receipts_1.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS,
-        hint: noHookReceiptHint(verdict, now),
-    });
-}
-/**
- * Issue #3796: keep the suppression the poller recorded during this dialog's
- * episode current while the dialog it accepted (`answered` / `outlived`) is
- * still up. Only a record made since the dialog was first read, and never the
- * receipt gate's own `no-hook-receipt` (the caller records that itself). A
- * record is kept only while its reason still holds NOW:
- *
- * - `partial-answer` remembers an event: it holds for as long as the dialog
- *   the keys went to stays up (this episode), and is re-stamped here;
- * - a contract reason is the contract's verdict on the prompt, re-evaluated on
- *   every tick (`resolution`): no verdict (the contract ended, or now answers
- *   it) drops the record — the dialog is then `answered` / `outlived` like any
- *   other. A verdict is recorded by the caller (review D), whatever was here;
- * - any other reason is left as it was recorded.
- *
- * @returns true when a `partial-answer` that still holds was re-stamped
- */
-function refreshEpisodeSuppression(worktreeId, instanceId, verdict, resolution) {
-    if (verdict.cause !== 'answered' && verdict.cause !== 'outlived')
-        return false;
-    const own = (0, auto_yes_suppression_state_1.getLastPolicySuppression)(worktreeId, 'antigravity', instanceId);
-    if (own === null || own.reason === auto_yes_suppression_reason_1.NO_HOOK_RECEIPT_SUPPRESSION_REASON || !(own.at >= verdict.firstSeenAt)) {
-        return false;
-    }
-    if (own.reason === auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON) {
-        // The memory is the episode's: the dialog the keys went to is still the one
-        // up (same episode, accepted on the same receipt). Not `getPartialAnswer`:
-        // the tick forgets it as soon as the gated reading stops seeing the prompt,
-        // which past the window is every tick.
-        const { at: _recordedAt, ...suppression } = own;
-        (0, auto_yes_suppression_state_1.recordPolicySuppression)(worktreeId, 'antigravity', instanceId, suppression);
-        return true;
-    }
-    if (auto_yes_suppression_reason_1.CONTRACT_SUPPRESSION_REASONS.has(own.reason) && !resolution.suppressedBy) {
-        (0, auto_yes_suppression_state_1.forgetPolicySuppression)(worktreeId, 'antigravity', instanceId);
-    }
-    return false;
-}
-/**
- * Issue #3789: keys for an agy dialog the receipt gate accepted reached tmux.
- * Only here does the gate start the grace after which a dialog still up is
- * reported as `outlived`; the tick's `no_answer` exits (another server's session,
- * a partial answer, the base rules or the contract not answering) never get
- * here, so their own records are not overwritten by `no-hook-receipt`.
- *
- * Issue #3796: `interrupted` — the send began and was cut short (stopped
- * part-way, or failed). Its keys may be on the pane and the receipt is spent,
- * so the grace starts here too; without it the dialog stayed `answered`, and
- * silent, for as long as it stayed up.
- */
-function noteAnswerSent(cliToolId, worktreeId, instanceId, interrupted = false, forReceiptAt) {
-    if (cliToolId !== 'antigravity')
-        return;
-    (0, antigravity_receipt_episodes_1.markAntigravityAnswerSent)(worktreeId, instanceId, Date.now(), {
-        interrupted,
-        ...(forReceiptAt !== undefined ? { forReceiptAt } : {}),
-    });
-}
-/**
- * Issue #3796 review: the agy episode a send is about to go to, read before
- * its first await; null for other tools. Given back to {@link noteAnswerSent}
- * however the send came back — whole, failed or cut short (review E) — so that
- * only that episode is marked — the same
- * idea as the Enter record's generation check in `tryEnterFallback`.
- */
-function receiptEpisodeOfSend(cliToolId, worktreeId, instanceId) {
-    return cliToolId === 'antigravity' ? (0, antigravity_receipt_episodes_1.getAntigravityAcceptedReceiptAt)(worktreeId, instanceId) : null;
-}
-/**
- * The hint for `antigravity-autoyes-withheld-no-hook-receipt` (Issue #3767):
- * which of the withheld cases it was decides where to look.
- */
-function noHookReceiptHint(verdict, now = Date.now()) {
-    const seconds = verdict.ageMs === null ? null : Math.round(verdict.ageMs / 1000);
-    // `lapsed` says how long ago, so from now: the line repeats once a minute.
-    const secondsAgo = verdict.lastReceiptAt === null ? null : Math.round((now - verdict.lastReceiptAt) / 1000);
-    switch (verdict.cause) {
-        case 'never':
-            return 'hook の受信が一度も無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認';
-        case 'late':
-            return `最後の受信から ${seconds} 秒後に確認が出た（窓 ${antigravity_permission_receipts_1.ANTIGRAVITY_PERMISSION_RECEIPT_WINDOW_MS / 1000} 秒の外）ため答えなかった。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）。続くなら ~/.gemini/config/hooks.json の向き先（#2622）も確認`;
-        case 'lapsed':
-            return `最後の受信は ${secondsAgo} 秒前で途絶えている（hook が届かなくなった）。hooks.json の向き先（#2622）と agy の再起動を確認`;
-        case 'predates':
-            return '確認は最後の受信より前から画面に出ていた（引用か別の確認）ため答えなかった。人が答える';
-        case 'used':
-            return '最後の受信は直前の確認に使い済み。この確認に対する受信は無いため答えなかった。人が答える';
-        case 'outlived':
-            if (verdict.answerInterrupted === true) {
-                return `Auto-Yes が最後の受信の確認へ答えを送る途中で送信が止まり（キーの一部が入力に残っている可能性がある）、${antigravity_receipt_episodes_1.ANTIGRAVITY_ANSWERED_DIALOG_GRACE_MS / 1000} 秒を過ぎても確認が画面に残っている。未使用の受信が無いため、もう一度は答えない。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）`;
-            }
-            return `Auto-Yes が最後の受信の確認へキーを送ってから ${antigravity_receipt_episodes_1.ANTIGRAVITY_ANSWERED_DIALOG_GRACE_MS / 1000} 秒を過ぎても、確認が画面に残っている。キーで確認が閉じなかったか、新しい受信の無い別の確認と入れ替わった（画面からは区別できない）。未使用の受信が無いため、もう一度は答えない。人が答える（auto-yes --disable → prompt --json → respond --expect-screen）`;
-        default:
-            return 'hook の受信記録が直近に無いため Auto-Yes は答えなかった。~/.gemini/config/hooks.json の向き先（#2622）を確認';
-    }
-}
-/**
- * The audit row's `answer` for the Enter (Issue #3397): not a digit, so the
- * History reads as "Auto-Yes pressed Enter" rather than as a chosen option.
- */
-exports.AUTO_YES_ENTER_FALLBACK_ANSWER = '[Enter]';
-/**
- * Issue #3397: is the fresh capture still the screen the Enter was decided for?
- * Re-reads it the way one tick does — prompt reading, the same `promptFrameKey`,
- * codex's launch dialogs and `/model` picker, the dialog gate refusing with no
- * dialog vouched for, and `judgeEnterFallback` (input box off screen, tool
- * alive, not thinking). The policy and the checkbox rule read `promptData`,
- * which the equal `promptFrameKey` already pins (type, question, options).
- */
-function isStillEnterFallbackScreen(prompt, fresh) {
-    const { worktreeId, cliToolId, instanceId, frameKey } = prompt;
-    const clean = (0, cli_patterns_1.stripBoxDrawing)((0, cli_patterns_1.stripAnsi)(fresh));
-    const frame = (0, frame_1.normalizeFrame)(fresh, cliToolId);
-    const detection = (0, response_checker_1.detectPromptOnCleanFrame)(clean, cliToolId, clean.split('\n'), fresh, { worktreeId, instanceId }, frame);
-    if (!detection.isPrompt || !detection.promptData)
-        return false;
-    if ((0, auto_yes_poller_state_1.promptFrameKey)(detection.promptData) !== frameKey)
-        return false;
-    if (cliToolId === 'codex' && ((0, cli_patterns_1.getCodexLifecycleDialog)(frame) || (0, detect_1.isCodexModelPickerFrame)(frame))) {
-        return false;
-    }
-    const gate = (0, auto_yes_dialog_gate_1.evaluateAutoYesDialogGate)(cliToolId, detection.promptData.type, frame);
-    if (gate.allowed || gate.dialog !== null)
-        return false;
-    return (0, auto_yes_enter_fallback_1.judgeEnterFallback)(cliToolId, fresh).eligible;
-}
-/**
- * Issue #3397: a frame the dialog gate refused may still be a choice screen
- * CommandMate cannot read — the one the prompt window offers direct input for.
- * Send ONE Enter there (confirm whatever is selected), under every condition
- * `judgeEnterFallback` and this function check; otherwise record the refusal as
- * step 3.5 always did.
- *
- * Order, each one able to stop the Enter:
- *  1. `judgeEnterFallback` (rollout table, refusal, composer off screen, tool
- *     alive, not thinking) — and the gate must not have vouched for a dialog it
- *     refused to type into (opencode's `keys` strip, #1893);
- *  2. the screen already had its Enter: record `no-effect`, send nothing;
- *  3. the contract policy, exactly as step 4 applies it (mode, allow-listed
- *     types, deny patterns over the question, options and `approvalTarget`);
- *     a prompt the base rules would not answer (multi-select, typed text) gets
- *     nothing either;
- *  4. the screen must have been eligible on the previous tick as well;
- *  5. the session must be this server's (#2865);
- *  6. a capture taken now, past the capture cache, must still be that screen
- *     ({@link isStillEnterFallbackScreen}).
- *
- * Issue #3706: with a `generation` (a tick of `pollAutoYes`), the waits of
- * steps 5 and 6 are each followed by {@link isTickCurrent}; a tick that lost
- * its generation sends nothing and changes nothing.
- *
- * @returns true when the Enter was sent; the caller returns `responded`
- */
-async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput, generation) {
-    const { worktreeId, cliToolId, instanceId, pollerState, promptData, frameKey } = prompt;
-    const judgement = dialogGate.dialog === null ? (0, auto_yes_enter_fallback_1.judgeEnterFallback)(cliToolId, rawOutput) : null;
-    if (judgement === null || !judgement.eligible) {
-        pollerState.enterFallbackCandidateKey = null;
-        (0, auto_yes_prompt_suppression_1.suppressUnclassifiedFrame)(prompt, dialogGate);
-        return false;
-    }
-    const screenKey = (0, auto_yes_enter_fallback_1.enterFallbackScreenKey)(promptData);
-    // 2. The Enter did not move the screen on. Another one would be a guess.
-    if (pollerState.enterFallbackSentKey === frameKey) {
-        pollerState.enterFallbackCandidateKey = null;
-        (0, auto_yes_enter_fallback_1.recordEnterFallbackNoEffect)(worktreeId, cliToolId, instanceId, screenKey);
-        (0, auto_yes_prompt_suppression_1.suppressUnclassifiedFrame)(prompt, dialogGate);
-        (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000enter-fallback-no-effect`, 'poller:auto-yes-enter-fallback-no-effect', {
-            worktreeId,
-            cliToolId,
-            instanceId,
-            promptType: promptData.type,
-            refusalReason: judgement.refusalReason,
-        });
-        return false;
-    }
-    // 3. The contract policy, as step 4 reads it.
-    const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
-    const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptData, policy);
-    if (resolution.suppressedBy) {
-        pollerState.enterFallbackCandidateKey = null;
-        (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(prompt, {
-            reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
-            promptType: promptData.type,
-            pattern: resolution.pattern,
-        }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${policy?.mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
-            reason: resolution.suppressedBy,
-            mode: policy?.mode ?? null,
-            pattern: resolution.pattern,
-            promptType: promptData.type,
-            enterFallback: true,
-        });
-        return false;
-    }
-    // A checkbox list is out of scope whatever the parser's flag says: the
-    // labels' boxes (`[ ]` / `[x]` / `[X]` / `[✔]`, the one reading in
-    // `prompt-answer-semantic` the sender shares) count too, so an Enter never
-    // submits a half-ticked list (Issue #3397; the base rules' #2755 reading
-    // covers `multiSelect` only).
-    if (resolution.answer === null ||
-        (promptData.type === 'multiple_choice' && (0, prompt_answer_semantic_1.isMultiSelectPrompt)(promptData))) {
-        pollerState.enterFallbackCandidateKey = null;
-        (0, auto_yes_prompt_suppression_1.suppressUnclassifiedFrame)(prompt, dialogGate);
-        return false;
-    }
-    // 4. Seen once: wait for the next tick to see the same screen again.
-    // Nothing is recorded as withheld here: Auto-Yes is about to answer, and a
-    // fresh `lastSuppression` would make `cmate wait` report the prompt to a
-    // human at once instead of holding for Auto-Yes (#2463).
-    if (pollerState.enterFallbackCandidateKey !== frameKey) {
-        pollerState.enterFallbackCandidateKey = frameKey;
-        logger.debug('poller:auto-yes-enter-fallback-candidate', {
-            worktreeId,
-            cliToolId,
-            instanceId,
-            promptType: promptData.type,
-        });
-        return false;
-    }
-    // 5. Never another server's session (Issue #2865).
-    const sessionName = manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId);
-    const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
-    if (generation !== undefined && !isTickCurrent(generation))
-        return false;
-    if (ownership === null || ownership.verdict === 'foreign') {
-        (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
-            worktreeId,
-            cliToolId,
-            instanceId,
-            sessionName,
-            sessionPath: ownership?.sessionPath ?? null,
-            reason: ownership ? 'foreign' : 'worktree_not_found',
-            enterFallback: true,
-        });
-        return false;
-    }
-    // 6. The last look before the key, at a capture taken NOW. The two ticks of
-    // step 4 read through the capture cache, whose TTL is longer than the poll
-    // interval, so "seen twice" can be one stale frame read twice: a redraw caught
-    // with its input box missing (#2457's repaint) while the real pane already
-    // has the box back. Everything that decided the Enter is judged again on the
-    // fresh frame; any difference sends nothing, and the next tick starts over.
-    const fresh = await (0, cli_session_1.captureSessionOutputFresh)(worktreeId, cliToolId, (rawOutput ?? '').split('\n').length, instanceId);
-    if (generation !== undefined && !isTickCurrent(generation))
-        return false;
-    if (!isStillEnterFallbackScreen(prompt, fresh)) {
-        pollerState.enterFallbackCandidateKey = null;
-        logger.debug('poller:auto-yes-enter-fallback-fresh-frame-differs', {
-            worktreeId,
-            cliToolId,
-            instanceId,
-            promptType: promptData.type,
-        });
-        return false;
-    }
-    const receiptEpisode = receiptEpisodeOfSend(cliToolId, worktreeId, instanceId);
-    try {
-        await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
-    }
-    catch (error) {
-        // Issue #3796: the Enter may or may not have reached the pane.
-        noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
-        throw error;
-    }
-    finally {
-        (0, tmux_capture_cache_1.invalidateCache)(sessionName);
-    }
-    // Issue #3796 review E: the Enter is out — for the episode it began for only.
-    noteAnswerSent(cliToolId, worktreeId, instanceId, false, receiptEpisode);
-    // Issue #3706: the Enter is out, but the per-screen record is the CURRENT
-    // session's: when the poller was stopped (the record was forgotten with it)
-    // or a new session began while `send-keys` was awaited, the return of this
-    // send must not put the record back. The audit row below is kept either way.
-    if (generation === undefined || (isPollerCurrent(generation) && isSameSession(generation))) {
-        pollerState.enterFallbackSentKey = frameKey;
-        pollerState.enterFallbackCandidateKey = null;
-        (0, auto_yes_enter_fallback_1.recordEnterFallbackSent)(worktreeId, cliToolId, instanceId, {
-            promptType: promptData.type,
-            refusalReason: judgement.refusalReason,
-            screenKey,
-            ...(generation !== undefined ? { epoch: generation.sessionEpoch } : {}),
-        });
-    }
-    logger.info('poller:auto-yes-enter-fallback-sent', {
-        worktreeId,
-        cliToolId,
-        instanceId,
-        promptType: promptData.type,
-        refusalReason: judgement.refusalReason,
-        composerState: judgement.composerState,
-    });
-    await finishAnsweredPrompt(prompt, promptDetection, exports.AUTO_YES_ENTER_FALLBACK_ANSWER, generation);
-    return true;
-}
 /**
  * Issue #3214: steps 6 and 7 of `detectAndRespondToPrompt` and everything after
  * them -- what is done once the answer has reached tmux, in the order it always
@@ -817,8 +257,11 @@ async function tryEnterFallback(prompt, promptDetection, dialogGate, rawOutput,
  *   tick's own poller state only, never to a successor under the same key, and
  *   the response poller restart and the terminal push are skipped when the
  *   session was relaunched meanwhile.
+ * @param capture - Issue #3881 (review P2-2): the tick's frame and its capture
+ *   window, so an audit row this answer creates carries the same reading the
+ *   response poller's save gives a row (`promptDataForStorage`)
  */
-async function finishAnsweredPrompt(prompt, promptDetection, answer, generation) {
+async function finishAnsweredPrompt(prompt, promptDetection, answer, generation, capture) {
     const { worktreeId, cliToolId, instanceId, compositeKey, pollerState, promptData, promptKey } = prompt;
     // Issue #3706: the keys went to the session the tick started on. When a new
     // one was begun while they were being sent, the new process never received
@@ -827,11 +270,11 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
     // process's identical question), not the poller's response time, not the
     // task event (the task looked up now may be the new session's). Only the
     // audit row is, and it may not adopt a pending row saved after the tick began.
-    const sameSession = generation === undefined || isSameSession(generation);
+    const sameSession = generation === undefined || (0, auto_yes_poller_generation_1.isSameSession)(generation);
     if (sameSession) {
         // 6. Update timestamp and reset error count
-        updateLastServerResponseTimestamp(compositeKey, Date.now(), generation?.pollerState);
-        resetErrorCount(compositeKey, generation?.pollerState);
+        (0, auto_yes_poller_generation_1.updateLastServerResponseTimestamp)(compositeKey, Date.now(), generation?.pollerState);
+        (0, auto_yes_poller_generation_1.resetErrorCount)(compositeKey, generation?.pollerState);
         // 7. Record answered prompt key and timestamp
         pollerState.lastAnsweredPromptKey = promptKey;
         pollerState.lastAnsweredAt = Date.now();
@@ -839,7 +282,7 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
     }
     // Issue #3748: what was answered and with what — the question (cut to
     // MAX_LOGGED_QUESTION_LENGTH, never the full text) and the answer sent (the
-    // option number, `y`, or `[Enter]`) — so an answer that should not have been
+    // option number or `y`) — so an answer that should not have been
     // given can be told from the log alone.
     logger.info('poller:response-sent', {
         worktreeId,
@@ -869,7 +312,10 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
             worktreeId,
             cliToolId,
             instanceId: instanceId ?? cliToolId,
-            promptData,
+            // Issue #3881 (review P2-2): with the reading of the frame it answered,
+            // so a row this creates is classified as the response poller's row for
+            // the same screen would be — not by whichever of the two wrote first.
+            promptData: auditPromptData(cliToolId, promptDetection, promptData, capture),
             answer,
             answeredBy: 'auto',
             content: promptDetection.rawContent || promptDetection.cleanContent,
@@ -906,11 +352,67 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
     ]);
     // Re-read after the await, not the `sameSession` taken before the audit: a
     // relaunch while the modules loaded makes the restart about the new process.
-    if (!sameSession || (generation !== undefined && !isSameSession(generation)))
+    if (!sameSession || (generation !== undefined && !(0, auto_yes_poller_generation_1.isSameSession)(generation)))
         return;
     startResponsePolling(worktreeId, cliToolId, instanceId);
     void broadcastTerminalSnapshotAfterInteraction(worktreeId, cliToolId, instanceId);
 }
+/**
+ * The `promptData` an Auto-Yes audit row is recorded with (Issue #3881 review
+ * P2-2): the answered prompt with `promptDataForStorage`'s reading of the
+ * tick's frame. A pending row the response poller saved keeps its own reading
+ * (`recordAnsweredPrompt` spreads it); this is what a row created here, or one
+ * saved without a reading, gets.
+ */
+function auditPromptData(cliToolId, promptDetection, promptData, capture) {
+    return ((0, prompt_screen_reading_1.promptDataForStorage)(cliToolId, capture?.frame ?? null, { ...promptDetection, promptData }, capture?.captureTop)
+        ?? promptData);
+}
+/**
+ * The `catch` of `detectAndRespondToPrompt`: settles the send in flight and
+ * tells an abandoned tick from a failed one.
+ */
+function settleFailedTick(error, tick) {
+    const { worktreeId, cliToolId, instanceId, compositeKey, generation, attempt, sendInFlight, receiptEpisode } = tick;
+    const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
+    // Issue #3880: a tmux call that ended without an exit status may have left
+    // the answer on the pane though no key is known to be there (`keysSent` is
+    // not true, and the ledger counts it `failed`). Held as a partial answer is:
+    // the next tick does not send it again at the same confirmation (step 2.5).
+    // Read off the error like `keysSent` (`AnswerDelivery` in prompt-answer-sender).
+    const delivery = error instanceof Error && 'answerDelivery' in error ? error.answerDelivery : null;
+    const mayBeOnPane = keysSent === true || delivery === 'indeterminate';
+    // Issue #3820: the send that was cut short, in the ledger — before the send
+    // record below is settled, whose state says whether it had expired.
+    if (attempt !== null && sendInFlight) {
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(attempt.ledger, (0, auto_yes_poller_tick_1.attemptResultOfThrow)(keysSent), { expired: attempt.state === 'expired' });
+    }
+    // Issue #3706: a tick that lost its generation — the send stopped part-way
+    // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
+    // failure of the poller that now holds the key, and not an answer either.
+    if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
+        // A stop with keys already on the pane: the next tick must not type the
+        // answer again over them (step 2.5). Recorded under the attempt's key as
+        // it is now — the new one when a worktree ID move carried it (#3713).
+        if (attempt !== null)
+            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, mayBeOnPane);
+        if (sendInFlight)
+            (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+        logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent, delivery });
+        return 'no_answer';
+    }
+    // Issue #3839: a failure with keys already on the pane is held the same way —
+    // the next tick must not type the answer again over them (step 2.5); the
+    // screen leaving or changing forgets it (`forgetPartialAnswer`). Issue #3880:
+    // so is a send whose outcome is not known (`mayBeOnPane` above).
+    if (attempt !== null)
+        (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, mayBeOnPane);
+    if (sendInFlight)
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, true, receiptEpisode);
+    incrementErrorCount(compositeKey, generation?.pollerState);
+    logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId, delivery });
+    return 'error';
+}
 /**
  * Detect prompt in terminal output, resolve auto-answer, and send response.
  *
@@ -925,14 +427,33 @@ async function finishAnsweredPrompt(prompt, promptDetection, answer, generation)
  *   (Issue #2522). Omitting it costs Command Code's `AskUserQuestion` and
  *   nothing else; see {@link capturePollerFrame}.
  * @param generation - The calling tick's generation (Issue #3706). Given, every
- *   wait before a key — the ownership check, the Enter fallback's fresh capture,
- *   each wait inside the send — is followed by {@link isTickCurrent}, and a tick
+ *   wait before a key — the ownership check and each wait inside the send — is
+ *   followed by {@link isTickCurrent}, and a tick
  *   that lost it types nothing more and returns `no_answer`. Omitted (direct
  *   callers, tests), nothing is checked, as before.
+ * @param observation - Issue #3798: the tick's waiting-episode start, fixed
+ *   before its capture, and when that capture's frame was fetched. The answer
+ *   is observed against them ({@link observeAnsweredPrompt}). Omitted (direct
+ *   callers, tests), the start is fixed here and the frame dated 0.
+ * @param captureWindowLines - Issue #3881 (review P2-1): the window the
+ *   capture was taken with. Given, a capture that filled it is read as
+ *   possibly cut at its top: an approval target that reached that top is
+ *   `top-unknown`, and a deny miss on it is not a pass. Omitted (direct
+ *   callers, tests), nothing is known about the capture's extent, as before.
+ *   The same window says where the audit row's frame begins (`captureTop`).
+ * @param captureHeadCut - Issue #3881 (third review N4): whether that window
+ *   dropped rows from the top of what tmux returned, as the capture layer said
+ *   ({@link capturePollerFrame}'s `headCut`). At a window of the pane's height
+ *   the row count cannot tell. Omitted, judged from the row count as before.
  * @returns 'responded' | 'no_prompt' | 'duplicate' | 'no_answer' | 'error'
  */
-async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput, generation) {
+async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput, generation, observation, captureWindowLines, captureHeadCut) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
+    const captureExtent = captureWindowLines === undefined ? undefined : { windowLines: captureWindowLines, headCut: captureHeadCut };
+    const tickObservation = observation ?? {
+        start: (0, waiting_episode_binding_1.startWaitingObservation)(worktreeId, cliToolId, instanceId),
+        frameTime: { frameCapturedAt: 0, frameFetchedAfterStart: false },
+    };
     // Issue #3706 / #3713: the send in flight, settled without an await once it
     // comes back — as a partial answer when it was stopped with keys on the pane.
     let attempt = null;
@@ -940,6 +461,21 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
     // the send short, and the agy receipt gate is told so (`noteAnswerSent`).
     let sendInFlight = false;
     let receiptEpisode = null;
+    // Issue #3820: the ledger's tick. A tick that read the screen and saw no
+    // confirmation closes the open one as gone when it ends (`endLedgerTick`).
+    // Issue #3863: the answer mode this tick acts under, recorded on its ledger lines.
+    const answerMode = (0, auto_yes_poller_steps_1.answerModeOfTick)(worktreeId, cliToolId, instanceId, generation?.grant);
+    const ledgerScope = { compositeKey, worktreeId, cliToolId, instanceId, answerMode };
+    const ledgerTick = (0, auto_yes_confirmation_ledger_1.beginLedgerTick)(ledgerScope);
+    // Issue #3821: when this tick began, for the decision's reason (see `tickDecisionRecorder`).
+    const tickStartedAt = Date.now();
+    // Issue #3791 (review N1 / N3): the duplicate guard's reservation outlives
+    // this tick only when the guard holds the prompt back again. It stays up
+    // while the tick goes on to send the retry of the reserved prompt (an answer
+    // still on its way), and is released before any await for another screen,
+    // and in `finally` for everything else — withheld, failed, stopped, or
+    // answered (the new answer restarts the hold).
+    let keepDuplicateRetry = false;
     try {
         // 1. Detect prompt.
         //
@@ -980,54 +516,85 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // machine whose hook does not reach us. The price is that Auto-Yes leaves
         // such a machine's dialogs alone, which is why `logIfWithheldForWantOfReceipt`
         // says so.
-        // Issue #3397: a session begun since the last tick (a relaunch the poller
-        // outlived) starts with no screen that had its Enter.
-        const epoch = (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey);
-        if ((pollerState.enterFallbackEpoch ?? 0) !== epoch) {
-            pollerState.enterFallbackSentKey = null;
-            pollerState.enterFallbackCandidateKey = null;
-            pollerState.enterFallbackEpoch = epoch;
-        }
-        const receiptScope = { worktreeId, instanceId };
-        // Issue #3183: the ONE frame every judgement below reads — normalised once,
-        // from the capture as captured (the input-box markers are rule rows the
-        // cleaned spelling has blanked), and handed as the same object to the
-        // prompt reading, the codex launch guards and the dialog gate. That is what
-        // makes "the status chain and Auto-Yes read the same live region" a fact
-        // rather than a hope: there is no second normalisation to disagree with.
-        const frame = (0, frame_1.normalizeFrame)(rawOutput ?? cleanOutput, cliToolId);
-        // Issue #3767: bracket the read so the receipt gate can tell when an agy
-        // dialog first appeared, not only what time this tick is.
-        if (cliToolId === 'antigravity')
-            (0, antigravity_receipt_episodes_1.beginAntigravityFrameRead)(worktreeId, instanceId);
-        const promptDetection = (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput, receiptScope, frame);
-        if (cliToolId === 'antigravity')
-            (0, antigravity_receipt_episodes_1.endAntigravityFrameRead)(worktreeId, instanceId);
+        const epoch = (0, auto_yes_poller_enter_fallback_1.syncEnterFallbackEpoch)(compositeKey, pollerState);
+        const { frame, promptDetection } = (0, auto_yes_poller_tick_1.readPromptFrame)(worktreeId, cliToolId, cleanOutput, precomputedLines, instanceId, rawOutput, captureExtent, response_checker_1.detectPromptOnCleanFrame);
         if (!promptDetection.isPrompt || !promptDetection.promptData) {
-            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey);
-            pollerState.lastAnsweredPromptKey = null;
-            pollerState.lastAnsweredAt = null;
-            pollerState.enterFallbackCandidateKey = null;
-            // Issue #3757: agy's trust screen reads as no prompt (unnumbered: neither
-            // reader takes it), but it is one nobody here answers — record why, still
-            // as `no_prompt`. Before the warn key is cleared, so the WARN stays once
-            // per screen.
-            if (cliToolId === 'antigravity' &&
-                (0, auto_yes_prompt_suppression_1.suppressAntigravityTrustScreen)(worktreeId, instanceId, pollerState, frame, manager_1.CLIToolManager.getInstance().getTool(cliToolId).getSessionName(worktreeId, instanceId))) {
-                return 'no_prompt';
-            }
-            pollerState.lastSkipWarnKey = null;
-            if (cliToolId === 'antigravity' && !promptDetection.isPrompt) {
-                logIfWithheldForWantOfReceipt(worktreeId, instanceId, compositeKey, () => (0, response_checker_1.detectPromptOnCleanFrame)(cleanOutput, cliToolId, precomputedLines, rawOutput));
+            // Issue #3821: no prompt, no decision — except agy's dialog the receipt
+            // gate keeps from this reading while the status API still shows it.
+            (0, auto_yes_decision_state_1.forgetAutoYesDecision)(compositeKey);
+            const withheldPastGate = (0, auto_yes_poller_tick_1.noteNoPromptOnScreen)({
+                worktreeId,
+                cliToolId,
+                instanceId,
+                compositeKey,
+                epoch,
+                pollerState,
+                frame,
+                promptDetection,
+                cleanOutput,
+                precomputedLines,
+                rawOutput,
+                captureExtent,
+                detectPromptOnCleanFrame: response_checker_1.detectPromptOnCleanFrame,
+            });
+            if (withheldPastGate !== null && withheldPastGate.reason !== null) {
+                (0, auto_yes_poller_tick_1.tickDecisionRecorder)({
+                    worktreeId,
+                    cliToolId,
+                    instanceId,
+                    compositeKey,
+                    promptData: withheldPastGate.promptData,
+                    epoch,
+                    generation,
+                    startedAt: tickStartedAt,
+                }).withheld(withheldPastGate.reason);
             }
             return 'no_prompt';
         }
+        // Issue #3820: computed here, before the duplicate check, so the ledger
+        // sees the confirmation on every tick it is on screen (step 2.5 below
+        // reads the same key).
+        // The ledger's own key keeps the body (`ledgerScreenKey`): two commands
+        // that differ by a `>` or an indent are two confirmations to count.
+        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
+        // agy (PR 3): tied to the call the receipt that let it through asked about.
+        (0, auto_yes_confirmation_ledger_1.observeLedgerScreen)(ledgerScope, (0, auto_yes_poller_state_1.ledgerScreenKey)(promptDetection.promptData), promptDetection.promptData.type, (0, auto_yes_poller_tick_1.ledgerCallOf)(cliToolId, worktreeId, instanceId));
+        // Issue #3821: what this tick decides about the prompt, for `current-output`.
+        const decision = (0, auto_yes_poller_tick_1.tickDecisionRecorder)({
+            worktreeId,
+            cliToolId,
+            instanceId,
+            compositeKey,
+            promptData: promptDetection.promptData,
+            epoch,
+            generation,
+            startedAt: tickStartedAt,
+        });
+        // 1.5. Issue #3821 (review 2): a person began answering on this instance
+        // moments ago. What is on screen may be the very confirmation they are
+        // answering, so it is theirs until the hold passes; Auto-Yes stays on.
+        if ((0, auto_yes_manual_answer_1.isManualAnswerHolding)(compositeKey)) {
+            decision.withheld(auto_yes_manual_answer_1.ANSWERED_BY_HUMAN_DECISION_REASON);
+            return 'no_answer';
+        }
         // 2. Check for duplicate prompt (Issue #306)
         const promptKey = (0, prompt_key_1.generatePromptKey)(promptDetection.promptData);
         const frameKey = (0, auto_yes_poller_state_1.promptFrameKey)(promptDetection.promptData);
-        if (isDuplicatePrompt(pollerState, promptKey)) {
+        if ((0, auto_yes_poller_generation_1.isDuplicatePrompt)(pollerState, promptKey)) {
+            // Issue #3791 (review N1): the push gate holds this wait until the retry.
+            (0, auto_yes_poller_generation_1.reserveDuplicateRetry)(pollerState, promptKey, tickStartedAt);
+            keepDuplicateRetry = true;
+            // Issue #3820: not answered on this tick either — an interval of its own
+            // reason, so the count can tell the wait for an answer to land apart.
+            (0, auto_yes_confirmation_ledger_1.withholdLedgerConfirmation)(ledgerScope, 'answered-recently');
+            // Issue #3821: still `answering` only if this is the confirmation the send was for.
+            decision.reaffirmAnswering();
             return 'duplicate';
         }
+        // Issue #3791 (review N3): another screen than the reserved one — released
+        // now, before the awaits below, so the gate never reads it for this screen.
+        if (!(0, auto_yes_poller_generation_1.isDuplicateRetryOf)(pollerState, promptKey))
+            (0, auto_yes_poller_generation_1.releaseDuplicateRetry)(pollerState);
         const judged = {
             worktreeId,
             cliToolId,
@@ -1037,6 +604,11 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
             promptData: promptDetection.promptData,
             promptKey,
             frameKey,
+            // Issue #3863: for the `recommended` answer mode's choice among a question's options.
+            ...(promptDetection.optionRecommendations !== undefined
+                ? { optionRecommendations: promptDetection.optionRecommendations }
+                : {}),
+            answerMode,
         };
         // 2.5. Issue #3706: an earlier answer to this prompt was stopped after some
         // of its keys reached the pane (a `y` whose Enter was withheld). Typing the
@@ -1046,72 +618,45 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // (`partialAnswerScreenKey`: options and approvalTarget count, the cursor
         // does not), or the session is relaunched. Recorded as a suppression, so
         // the prompt Push and `cmate wait` see "withheld", not "answering".
-        const screenKey = (0, auto_yes_poller_state_1.partialAnswerScreenKey)(promptDetection.promptData);
-        const partial = (0, auto_yes_poller_state_1.getPartialAnswer)(compositeKey, epoch);
-        if (partial !== null) {
-            if (partial.screenKey === screenKey) {
-                (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
-                    reason: auto_yes_suppression_reason_1.PARTIAL_ANSWER_SUPPRESSION_REASON,
-                    mode: null,
-                    promptType: promptDetection.promptData.type,
-                }, `${frameKey}\u0000partial-answer`, 'poller:auto-yes-skipped-partial-answer', { promptType: promptDetection.promptData.type, stoppedAt: partial.at });
-                return 'no_answer';
-            }
-            // Another prompt is on screen: only the sends at the forgotten one's
-            // screen go with it (#3713) — one in flight at this screen keeps its hold.
-            (0, auto_yes_poller_state_1.forgetPartialAnswer)(compositeKey, partial.screenKey);
-        }
-        // Issue #3713: a worktree ID move carried an answer still being sent to
-        // this session's key. Its keys may already be on the pane, and how its send
-        // ends is not known yet — so this screen gets no keys until it comes back
-        // (recorded as a partial answer above, or gone).
-        if ((0, auto_yes_poller_state_1.hasMovedSendInFlight)(compositeKey, epoch, screenKey)) {
-            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000moved-send-in-flight`, 'poller:auto-yes-skipped-moved-send-in-flight', { worktreeId, cliToolId, instanceId, promptType: promptDetection.promptData.type });
+        if ((0, auto_yes_poller_steps_1.withheldForEarlierSend)(judged, screenKey, epoch)) {
+            decision.withheld('moved-send-in-flight');
             return 'no_answer';
         }
         // 3., 3.2., 3.5. Frames that are not Auto-Yes's to answer: see
         // `suppressIfNotOursToAnswer`.
         const notOurs = (0, auto_yes_prompt_suppression_1.suppressIfNotOursToAnswer)(judged, frame);
-        if (notOurs.kind !== 'dialog-gate-refused') {
-            pollerState.enterFallbackCandidateKey = null;
-        }
         if (notOurs.kind === 'left-alone') {
+            decision.withheld('unclassified-frame');
             return 'no_answer';
         }
-        // 3.6. Issue #3397: a refused frame may be a choice screen CommandMate
-        // cannot read; with Auto-Yes on it gets one Enter. See `tryEnterFallback`.
+        // 3.6. A frame the dialog gate refused is left to a human, whatever it is.
+        // Issue #3821: including a choice screen CommandMate cannot read, which got
+        // one bare Enter (#3397) until this Issue retired it — an Enter confirms
+        // whatever happens to be selected, and nothing here can say what that is.
         if (notOurs.kind === 'dialog-gate-refused') {
-            if (!(await tryEnterFallback(judged, promptDetection, notOurs.dialogGate, rawOutput, generation))) {
-                return 'no_answer';
-            }
-            return 'responded';
+            (0, auto_yes_prompt_suppression_1.suppressUnclassifiedFrame)(judged, notOurs.dialogGate);
+            decision.withheld('unclassified-frame');
+            return 'no_answer';
+        }
+        // 3.7. Issue #3822: a question to the operator is the human's to answer —
+        // under the `careful` answer mode (Issue #3863); under `recommended` a
+        // question reader's picker goes on to step 4. See `withheldAsQuestion`.
+        if ((0, auto_yes_poller_steps_1.withheldAsQuestion)(judged)) {
+            decision.withheld('question-left-to-human');
+            return 'no_answer';
         }
         // 4. Resolve auto answer under the execution contract's policy (Issue #1547).
+        // Issue #3863: a question the `recommended` mode answers takes its
+        // recommended option, else its default; one whose recommendation cannot
+        // be told is withheld (`recommended-option-unidentified`).
         // Auto-Yes reads the frame itself instead of going through status-detector
         // (it shares the reader, not the verdict), so this is the only place the policy can gate an
         // auto-answer: a prompt the policy withholds is left for a human, and the
         // response poller's prompt path (WS broadcast + Web Push, see
         // polling/response-checker.ts) is what tells them it is waiting.
-        const policy = (0, auto_yes_policy_1.getSessionAutoYesPolicy)(worktreeId, cliToolId, instanceId);
-        const resolution = (0, auto_yes_resolver_1.resolveAutoAnswerWithPolicy)(promptDetection.promptData, policy);
-        if (resolution.suppressedBy) {
-            // Issue #1684: the log line alone leaves a CLI-driven pipeline blind to
-            // why its worker stalled. Record the suppression so buildCurrentOutput
-            // can publish it (`autoYes.lastSuppression` in capture --json).
-            (0, auto_yes_prompt_suppression_1.suppressAndWarnOnce)(judged, {
-                reason: resolution.suppressedBy,
-                mode: policy?.mode ?? null,
-                promptType: promptDetection.promptData.type,
-                pattern: resolution.pattern,
-            }, `${frameKey}\u0000${resolution.suppressedBy}\u0000${policy?.mode ?? ''}\u0000${resolution.pattern ?? ''}`, 'poller:auto-yes-suppressed-by-policy', {
-                reason: resolution.suppressedBy,
-                mode: policy?.mode ?? null,
-                pattern: resolution.pattern,
-                promptType: promptDetection.promptData.type,
-            });
-        }
-        const answer = resolution.answer;
+        const answer = (0, auto_yes_poller_steps_1.resolveAnswerUnderPolicy)(judged);
         if (answer === null) {
+            decision.withheld(auto_yes_decision_1.NO_AUTO_ANSWER_DECISION_REASON);
             return 'no_answer';
         }
         // 5. Send answer to tmux (Issue #896: resolve the instance-specific session)
@@ -1121,21 +666,29 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
         // Issue #2865: never auto-answer a same-named session another CommandMate
         // server created. The poller keeps running; it just does not type.
         const ownership = await (0, worktree_session_ownership_1.checkWorktreeSessionOwnership)(worktreeId, sessionName);
-        if (generation !== undefined && !isTickCurrent(generation))
+        if (generation !== undefined && !(0, auto_yes_poller_generation_1.isTickCurrent)(generation))
             return 'no_answer';
-        if (ownership === null || ownership.verdict === 'foreign') {
-            (0, auto_yes_poller_state_1.warnOncePerFrame)(pollerState, `${frameKey}\u0000${sessionName}\u0000${ownership ? 'foreign' : 'worktree_not_found'}`, 'poller:auto-yes-skipped-foreign-session', {
-                worktreeId,
-                cliToolId,
-                instanceId,
-                sessionName,
-                sessionPath: ownership?.sessionPath ?? null,
-                reason: ownership ? 'foreign' : 'worktree_not_found',
-            });
+        if ((0, auto_yes_poller_steps_1.skippedForUnownedSession)(judged, sessionName, ownership)) {
+            decision.withheld('foreign-session');
             return 'no_answer';
         }
-        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch);
-        receiptEpisode = receiptEpisodeOfSend(cliToolId, worktreeId, instanceId);
+        // 5.5. Issue #3822: the last look before the first key — Auto-Yes still on
+        // and inside its window, and the contract, read past its cache, still
+        // allowing this answer. No wait between here and the send.
+        if ((0, auto_yes_poller_steps_1.withheldAtSend)(judged, generation !== undefined)) {
+            decision.withheld(auto_yes_decision_1.NO_AUTO_ANSWER_DECISION_REASON);
+            return 'no_answer';
+        }
+        // Issue #3821: from here until the screen is redrawn, Auto-Yes is answering.
+        decision.answering();
+        attempt = (0, auto_yes_poller_state_1.beginSendAttempt)(compositeKey, screenKey, generation?.sessionEpoch ?? epoch, 
+        // Issue #3820: an agy prompt read past the gate is one a hook receipt let through.
+        (0, auto_yes_confirmation_ledger_1.beginLedgerAttempt)(ledgerScope, (0, auto_yes_poller_tick_1.answerBasisOf)(judged, cleanOutput), {
+            receiptAccepted: cliToolId === 'antigravity',
+        }));
+        receiptEpisode = (0, auto_yes_poller_receipt_log_1.receiptEpisodeOfSend)(cliToolId, worktreeId, instanceId);
+        // Issue #3798: the wait this answer goes to, fixed as the send begins.
+        const answerTarget = (0, auto_yes_poller_answer_target_1.fixAnswerTarget)(worktreeId, cliToolId, instanceId);
         sendInFlight = true;
         try {
             await (0, prompt_answer_sender_1.sendPromptAnswer)({
@@ -1144,43 +697,53 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
                 cliToolId,
                 promptData: promptDetection.promptData,
                 // Issue #3706: asked after each wait inside the send.
-                ...(generation !== undefined ? { stillCurrent: () => isTickCurrent(generation) } : {}),
+                ...(generation !== undefined ? { stillCurrent: () => (0, auto_yes_poller_generation_1.isTickCurrent)(generation) } : {}),
             });
         }
         finally {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
         }
         sendInFlight = false;
+        (0, auto_yes_confirmation_ledger_1.settleLedgerAttempt)(attempt.ledger, 'ok', { expired: attempt.state === 'expired' });
         (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
         // Issue #3796 review E: the episode the send began for, as on the failure side.
-        noteAnswerSent(cliToolId, worktreeId, instanceId, false, receiptEpisode);
+        (0, auto_yes_poller_receipt_log_1.noteAnswerSent)(cliToolId, worktreeId, instanceId, false, receiptEpisode);
+        // Issue #3798: the wait this answer went to — opened if none is open — so
+        // the frame that shows the confirmation gone closes it. Once the keys are
+        // out, only by a tick that still acts for this instance (#3706: one that
+        // lost its grant or session writes nothing that says "answered"), and only
+        // for the wait fixed as the send began.
+        if (generation === undefined || (0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
+            observeAnsweredPrompt(judged, screenKey, tickObservation, answerTarget);
+        }
         // 6., 7. The answer reached tmux: see `finishAnsweredPrompt`.
-        await finishAnsweredPrompt(judged, promptDetection, answer, generation);
+        await finishAnsweredPrompt(judged, promptDetection, answer, generation, {
+            // The tick's one normalised frame (#3183), not the capture again.
+            frame,
+            captureTop: (0, auto_yes_poller_tick_1.captureTopOf)(rawOutput ?? cleanOutput, captureExtent, cliToolId),
+        });
         return 'responded';
     }
     catch (error) {
-        // Issue #3706: a tick that lost its generation — the send stopped part-way
-        // (`PromptAnswerAbortedError`), or failed after the grant went — is not a
-        // failure of the poller that now holds the key, and not an answer either.
-        if (generation !== undefined && !isTickCurrent(generation)) {
-            const keysSent = error instanceof Error && 'keysSent' in error ? Boolean(error.keysSent) : null;
-            // A stop with keys already on the pane: the next tick must not type the
-            // answer again over them (step 2.5). Recorded under the attempt's key as
-            // it is now — the new one when a worktree ID move carried it (#3713).
-            if (attempt !== null)
-                (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, keysSent === true);
-            if (sendInFlight)
-                noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
-            logger.info('poller:auto-yes-answer-abandoned', { worktreeId, cliToolId, instanceId, keysSent });
-            return 'no_answer';
-        }
-        if (attempt !== null)
-            (0, auto_yes_poller_state_1.settleSendAttempt)(attempt, false);
-        if (sendInFlight)
-            noteAnswerSent(cliToolId, worktreeId, instanceId, true, receiptEpisode);
-        incrementErrorCount(compositeKey, generation?.pollerState);
-        logger.warn('poller:detect-respond-error', { worktreeId, cliToolId, instanceId });
-        return 'error';
+        // Issue #3821: a tick that failed has decided nothing the next one will not
+        // decide again; until then the prompt is not "being answered".
+        if (generation === undefined || (0, auto_yes_poller_generation_1.isTickCurrent)(generation))
+            (0, auto_yes_decision_state_1.forgetAutoYesDecision)(compositeKey);
+        return settleFailedTick(error, {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            compositeKey,
+            generation,
+            attempt,
+            sendInFlight,
+            receiptEpisode,
+        });
+    }
+    finally {
+        (0, auto_yes_confirmation_ledger_1.endLedgerTick)(ledgerScope, ledgerTick);
+        if (!keepDuplicateRetry)
+            (0, auto_yes_poller_generation_1.releaseDuplicateRetry)(pollerState);
     }
 }
 /**
@@ -1195,7 +758,7 @@ async function detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, clea
 async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, instanceId);
     // 1. Validate context
-    const pollerState = getPollerState(compositeKey);
+    const pollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
     if (owner !== undefined && pollerState !== owner)
         return;
     const contextResult = validatePollingContext(compositeKey, pollerState);
@@ -1215,11 +778,15 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         grant,
         sessionEpoch: (0, auto_yes_enter_fallback_1.getEnterFallbackSessionEpoch)(compositeKey),
         startedAt: Date.now(),
+        // Issue #3821: a person's answer begun after this is read stops the tick.
+        manualAnswerSeq: (0, auto_yes_manual_answer_1.getManualAnswerSeq)(compositeKey),
     };
     // Issue #3796: this is the session wait's tick (it was scheduled as one) —
     // recorded before anything can fail, for the push gate.
     if (pollerState.sessionWaitTickAt !== undefined)
         pollerState.sessionWaitTickRanAt = generation.startedAt;
+    // Issue #3798: the waiting episode as this tick found it, before its first wait.
+    const observationStart = (0, waiting_episode_binding_1.startWaitingObservation)(worktreeId, cliToolId, instanceId);
     try {
         // 2. Capture and clean output
         const captureLines = grant.stopPattern
@@ -1229,8 +796,11 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // step below exactly as it did; the raw one is carried to the prompt reading
         // so a dialog anchored on box drawing is not invisible to the one path that
         // can answer it without a human.
-        const { raw: rawOutput, clean: cleanOutput } = await capturePollerFrame(worktreeId, cliToolId, captureLines, instanceId);
-        if (!isTickCurrent(generation)) {
+        //
+        // Issue #3798: dated by where that frame came from — the capture goes
+        // through the 5 s cache, so it may predate this tick.
+        const { frame: { raw: rawOutput, clean: cleanOutput, headCut }, frameTime, } = await (0, waiting_episode_binding_1.captureObservedFrame)(() => (0, auto_yes_poller_capture_1.capturePollerFrame)(worktreeId, cliToolId, captureLines, instanceId));
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
@@ -1246,8 +816,11 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
             return;
         }
         // 4. Detect and respond to prompt
-        const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput, generation);
-        if (!isTickCurrent(generation)) {
+        const result = await detectAndRespondToPrompt(worktreeId, pollerState, cliToolId, cleanOutput, lines, instanceId, rawOutput, generation, { start: observationStart, frameTime }, 
+        // Issue #3881 (review P2-1): the window this capture was taken with,
+        // and (third review N4) whether it cut the pane's top.
+        captureLines, headCut);
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
@@ -1256,7 +829,7 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // over hours. Not on 'error': a capture that works followed by an answer
         // that fails every time must still back off and stop.
         if (result !== 'error') {
-            resetErrorCount(compositeKey, generation.pollerState);
+            (0, auto_yes_poller_generation_1.resetErrorCount)(compositeKey, generation.pollerState);
         }
         if (result === 'responded') {
             scheduleNextPoll(generation, auto_yes_state_1.COOLDOWN_INTERVAL_MS);
@@ -1264,6 +837,15 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         }
         // 5. Thinking check
         if (result === 'no_prompt') {
+            observeWaitingFromTick({
+                worktreeId,
+                cliToolId,
+                instanceId,
+                start: observationStart,
+                frameTime,
+                pollerState: generation.pollerState,
+                rawOutput,
+            });
             const recentLines = lines.slice(-auto_yes_state_1.THINKING_CHECK_LINE_COUNT).join('\n');
             if ((0, cli_patterns_1.detectThinking)(cliToolId, recentLines)) {
                 scheduleNextPoll(generation, auto_yes_config_1.THINKING_POLLING_INTERVAL_MS);
@@ -1276,12 +858,24 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
         // the session it answers for (`auto-yes-lifecycle`), and `send --auto-yes`
         // enables it before the session starts — so wait until `expiresAt`, at the
         // backoff cap, instead of counting toward `consecutive_errors`.
-        const sessionMissing = await isSessionMissing(worktreeId, cliToolId, instanceId);
-        if (!isTickCurrent(generation)) {
+        const sessionMissing = await (0, auto_yes_poller_session_presence_1.isSessionMissing)(worktreeId, cliToolId, instanceId);
+        if (!(0, auto_yes_poller_generation_1.isTickCurrent)(generation)) {
             endStaleTick(generation);
             return;
         }
         if (sessionMissing) {
+            // Issue #3791 (review N1): no screen for the duplicate guard to hold back.
+            (0, auto_yes_poller_generation_1.releaseDuplicateRetry)(generation.pollerState);
+            // Issue #3798: a session that is gone is waiting for nobody.
+            observeWaitingFromTick({
+                worktreeId,
+                cliToolId,
+                instanceId,
+                start: observationStart,
+                frameTime: { frameCapturedAt: 0, frameFetchedAfterStart: false },
+                pollerState: generation.pollerState,
+                rawOutput: null,
+            });
             if (!pollerState.waitingForSession) {
                 pollerState.waitingForSession = true;
                 logger.info('poller:waiting-for-session', { worktreeId, cliToolId, instanceId });
@@ -1295,17 +889,108 @@ async function pollAutoYes(worktreeId, cliToolId, instanceId, owner) {
     scheduleNextPoll(generation);
 }
 /**
- * Whether a failed capture failed because the session does not exist
- * (Issue #3329). Asked of tmux (`has-session`'s exit code), not read off the
- * error text. `unknown` — tmux timed out or could not be run — is not "absent":
- * the failure is counted as before, so a broken tmux still stops Auto-Yes.
+ * The answer the poller just sent, as an observation of the waiting episodes
+ * (Issue #3798, design §2.5 "Auto-Yes poller", PR 3). Called in the
+ * synchronous step the send returns to, before anything else is awaited: the
+ * confirmation answered is a fresh prompt (planned against the episode as it
+ * is now, I5 (d)), so a wait opens if none is open, and a second confirmation
+ * of the same turn after an answer (another screen key) replaces the answered
+ * wait (R1-7) — a new hold, not the old wait's spent one. The episode the plan
+ * leaves open is recorded as `lastAnswer`; a plan refused (another generation,
+ * or a frame fetched before the close of this very confirmation — a stop that
+ * landed during the send) records none, so nothing is closed on the strength
+ * of it. Nor does a send whose wait moved under it (`target`, fixed as the
+ * send began): another wait opened during the send — a hook, another
+ * observer — is not the one these keys answered, and nothing is planned or
+ * recorded for it; `lastAnswer` stays as it was — and so for the same wait
+ * rebound during the send to a person's `screen`. Advisory, like
+ * {@link observeWaitingFromTick}.
+ */
+function observeAnsweredPrompt(prompt, screenKey, observation, target) {
+    const { worktreeId, cliToolId, instanceId, pollerState, promptData } = prompt;
+    try {
+        if (!(0, auto_yes_poller_answer_target_1.answerTargetHolds)(target, worktreeId, cliToolId, instanceId)) {
+            logger.debug('poller:answer-target-moved', { worktreeId, cliToolId, instanceId, target: target.episodeId });
+            return;
+        }
+        const plan = (0, waiting_episode_binding_1.observeWaiting)({
+            worktreeId,
+            cliToolId,
+            instanceId,
+            observer: 'auto-yes-poller',
+            start: observation.start,
+            reading: (0, waiting_screen_reading_1.promptWaitingReading)(promptData),
+            ...observation.frameTime,
+            freshPrompt: true,
+            lastAnswer: pollerState.lastAnswer ?? null,
+        });
+        const episode = plan.action === 'ignored' ? null : (0, waiting_episode_state_1.getWaitingEpisodeRecord)(worktreeId, cliToolId, instanceId);
+        pollerState.lastAnswer = episode === null ? null : { episodeId: episode.episodeId, screenKey, at: plan.at };
+    }
+    catch (error) {
+        pollerState.lastAnswer = null;
+        logger.debug('poller:waiting-observation-failed', {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            error: (0, errors_1.getErrorMessage)(error),
+        });
+    }
+}
+/**
+ * Tell the waiting episodes what this tick saw (Issue #3798, design §2.5,
+ * PR 1b): a frame with nothing for Auto-Yes to answer, read the way the status
+ * probe reads it — without the agy receipt window — or a session that is gone.
+ *
+ * What it can do is table O-1 for a waiting frame (a survey or a picker after
+ * an answer opens, or turns the wait into, a person's `screen`), and on the
+ * closing side a `screen` this tick saw cleared on a frame fetched after it
+ * became one, the wait the poller answered (`lastAnswer`, PR 3), or any wait
+ * of a session that is gone. A wait the poller did not answer — or answered
+ * before it was replaced — is not its to close. Advisory: a failure is logged
+ * and the tick goes on.
  */
-async function isSessionMissing(worktreeId, cliToolId, instanceId) {
+function observeWaitingFromTick(tick) {
+    const { worktreeId, cliToolId, instanceId } = tick;
     try {
-        return (await (0, cli_session_1.getSessionPresence)(worktreeId, cliToolId, instanceId)) === 'absent';
+        let reading = { kind: 'gone' };
+        if (tick.rawOutput !== null) {
+            const lastResponseAt = tick.pollerState.lastServerResponseTimestamp;
+            const lastOutputTimestamp = lastResponseAt ? new Date(lastResponseAt) : undefined;
+            // Without the receipt scope (design I9), and with the structured wait
+            // read the way the status probe reads it — the API-answerable one
+            // (#3184) a `prompt` here too, or the two observers would flip the
+            // episode's kind between `prompt` and `menu` on every tick.
+            const verdict = (0, status_detector_1.detectSessionStatus)(tick.rawOutput, cliToolId, lastOutputTimestamp);
+            const { structured } = (0, prompt_waiting_composition_1.peekPromptWaiting)({ worktreeId, cliToolId, instanceId, scraper: verdict });
+            reading = (0, waiting_screen_reading_1.readWaitingScreen)({
+                cliToolId,
+                output: tick.rawOutput,
+                lastOutputTimestamp,
+                structuredWaiting: structured !== null,
+                structuredSince: structured?.at ?? null,
+                apiAnswerable: (0, prompt_waiting_composition_1.isApiAnswerableStructuredWait)(structured, (0, registry_1.getAgentEventSource)(cliToolId).capabilities.eventIdentity),
+                verdict,
+            });
+        }
+        (0, waiting_episode_binding_1.observeWaiting)({
+            worktreeId,
+            cliToolId,
+            instanceId,
+            observer: 'auto-yes-poller',
+            start: tick.start,
+            reading,
+            ...tick.frameTime,
+            lastAnswer: tick.pollerState.lastAnswer ?? null,
+        });
     }
-    catch {
-        return false;
+    catch (error) {
+        logger.debug('poller:waiting-observation-failed', {
+            worktreeId,
+            cliToolId,
+            instanceId,
+            error: (0, errors_1.getErrorMessage)(error),
+        });
     }
 }
 /**
@@ -1320,7 +1005,7 @@ async function isSessionMissing(worktreeId, cliToolId, instanceId) {
  * @param options.sessionWait - The tick waits for a session to appear (Issue #3791)
  */
 function scheduleNextPoll(generation, overrideInterval, options = {}) {
-    if (!isPollerCurrent(generation))
+    if (!(0, auto_yes_poller_generation_1.isPollerCurrent)(generation))
         return;
     const { worktreeId, cliToolId, instanceId, pollerState } = generation;
     const interval = Math.max(overrideInterval ?? pollerState.currentInterval, auto_yes_state_1.POLLING_INTERVAL_MS);
@@ -1373,7 +1058,7 @@ function armSessionWaitWake(generation, timerId) {
         if (wake === undefined || wake.timerId !== timerId)
             return;
         sessionWaitWakes.delete(compositeKey);
-        if (!isPollerCurrent(generation) || pollerState.timerId !== timerId)
+        if (!(0, auto_yes_poller_generation_1.isPollerCurrent)(generation) || pollerState.timerId !== timerId)
             return;
         clearTimeout(timerId);
         logger.info('poller:session-created-wake', { worktreeId, cliToolId, instanceId });
@@ -1416,8 +1101,8 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
     }
     const compositeKey = (0, auto_yes_state_1.buildCompositeKey)(worktreeId, cliToolId, effectiveInstanceId);
     // Check concurrent poller limit (DoS protection)
-    const existingPollerState = getPollerState(compositeKey);
-    if (!existingPollerState && autoYesPollerStates.size >= auto_yes_state_1.MAX_CONCURRENT_POLLERS) {
+    const existingPollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
+    if (!existingPollerState && auto_yes_poller_generation_1.autoYesPollerStates.size >= auto_yes_state_1.MAX_CONCURRENT_POLLERS) {
         return { started: false, reason: 'max concurrent pollers reached' };
     }
     // Issue #501: Idempotency check (key already encodes the instance, so a matching
@@ -1442,7 +1127,7 @@ function startAutoYesPolling(worktreeId, cliToolId, instanceId) {
         stopCheckBaselineLength: -1,
         lastSkipWarnKey: null,
     };
-    autoYesPollerStates.set(compositeKey, pollerState);
+    auto_yes_poller_generation_1.autoYesPollerStates.set(compositeKey, pollerState);
     // A task may have been recorded moments ago; start from a fresh policy read.
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
     // Start polling immediately
@@ -1471,14 +1156,19 @@ function stopAutoYesPolling(compositeKey, reason) {
     // cleanup call this for an instance whose poller may already be gone, and the
     // Enter record must not outlive the grant or the session either way.
     (0, auto_yes_enter_fallback_1.forgetEnterFallback)(compositeKey);
-    const pollerState = getPollerState(compositeKey);
+    // Issue #3821: and the decision, for the same reason.
+    (0, auto_yes_decision_state_1.forgetAutoYesDecision)(compositeKey);
+    // Issue #3820: before the early return too — a session ended after its
+    // poller had already stopped still abandons the confirmation left on it.
+    (0, auto_yes_confirmation_ledger_1.noteLedgerPollerStopped)(compositeKey, (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(reason, 'unspecified'));
+    const pollerState = (0, auto_yes_poller_generation_1.getPollerState)(compositeKey);
     if (!pollerState)
         return;
     if (pollerState.timerId) {
         clearTimeout(pollerState.timerId);
     }
     dropSessionWaitWake(compositeKey);
-    autoYesPollerStates.delete(compositeKey);
+    auto_yes_poller_generation_1.autoYesPollerStates.delete(compositeKey);
     (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(compositeKey);
     logger.info('poller:stopped', { compositeKey, reason: (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(reason, 'unspecified') });
 }
@@ -1492,28 +1182,20 @@ function stopAutoYesPolling(compositeKey, reason) {
  */
 function stopAllAutoYesPolling() {
     const reason = (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(undefined, 'shutdown');
-    for (const [key, pollerState] of autoYesPollerStates.entries()) {
+    for (const [key, pollerState] of auto_yes_poller_generation_1.autoYesPollerStates.entries()) {
         if (pollerState.timerId) {
             clearTimeout(pollerState.timerId);
         }
         dropSessionWaitWake(key);
         (0, auto_yes_policy_1.invalidateSessionAutoYesPolicy)(key);
+        (0, auto_yes_confirmation_ledger_1.noteLedgerPollerStopped)(key, reason);
         logger.info('poller:stopped', { compositeKey: key, reason });
     }
-    autoYesPollerStates.clear();
+    auto_yes_poller_generation_1.autoYesPollerStates.clear();
     (0, auto_yes_enter_fallback_1.clearEnterFallbacks)();
+    (0, auto_yes_decision_state_1.clearAutoYesDecisions)();
     (0, auto_yes_poller_state_1.clearPartialAnswers)();
 }
-/**
- * Get all composite keys that have active auto-yes poller entries.
- *
- * Issue #525: Returns composite keys (worktreeId:cliToolId).
- *
- * @returns Array of composite keys present in the autoYesPollerStates Map
- */
-function getAutoYesPollerCompositeKeys() {
-    return Array.from(autoYesPollerStates.keys());
-}
 // =============================================================================
 // byWorktree Helpers (Issue #525)
 // =============================================================================
@@ -1531,21 +1213,15 @@ function getAutoYesPollerCompositeKeys() {
  *   `auto-yes-lifecycle`), both are dropped and a late send records nothing.
  */
 function stopAutoYesPollingByWorktree(worktreeId, options) {
-    const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId);
+    const pollerKeys = (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(auto_yes_poller_generation_1.autoYesPollerStates.keys()), worktreeId);
     // Issue #3730: `options.reason`, else the enclosing scope's (the lifecycle table).
     pollerKeys.forEach(key => stopAutoYesPolling(key, options?.reason));
     // Issue #3397: and the records of instances whose poller had already stopped.
     (0, auto_yes_enter_fallback_1.forgetEnterFallbacksByWorktree)(worktreeId);
+    (0, auto_yes_decision_state_1.forgetAutoYesDecisionsByWorktree)(worktreeId);
+    // Issue #3820: and the ledger's confirmations on them — an API approval is
+    // opened with Auto-Yes off too, so the running pollers do not name them all.
+    (0, auto_yes_confirmation_ledger_1.noteLedgerWorktreeStopped)(worktreeId, (0, auto_yes_poller_stop_reason_1.resolvePollerStopReason)(options?.reason, 'unspecified'));
     if (!options?.keepPartialAnswers)
         (0, auto_yes_poller_state_1.forgetPartialAnswersByWorktree)(worktreeId);
 }
-/**
- * Check if any auto-yes poller is active for a given worktreeId.
- * Uses shared filterCompositeKeysByWorktree (DRY).
- *
- * @param worktreeId - Worktree identifier
- * @returns true if any poller is active for this worktree
- */
-function isAnyPollerActiveForWorktree(worktreeId) {
-    return (0, auto_yes_state_1.filterCompositeKeysByWorktree)(Array.from(autoYesPollerStates.keys()), worktreeId).length > 0;
-}