commandmate 0.48.0 → 0.49.1

package/dist/server/src/lib/cli-tools/submit-verified-sender.js

@@ -79,6 +79,16 @@
  * codex, Enter now waits until the composer shows the typed body
  * ({@link confirmTypedBodyLanded}); a body that never appears THROWS before
  * Enter, as #2464 does for a paste.
+ *
+ * Issue #3945 is two sends to one instance at once. A send that withdrew its
+ * body, or cleared before typing, erased whatever was in the composer — another
+ * send's body included — and a codex placeholder carries only a count, so a
+ * late one could not be told from the next send's. A send now runs as the
+ * instance's only writer (`lib/session/instance-input-lock`), re-reads the pane
+ * once it owns it ({@link recheckComposerBeforeInput}),
+ * checks it still owns the composer before every key, watches an `unseen`
+ * paste a little longer before giving up, and leaves a mark for a body that
+ * may still arrive, which the next send waits out ({@link waitOutCarriedPaste}).
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -114,10 +124,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LITERAL_SEND_MAX_BYTES = void 0;
-exports.classifySubmit = classifySubmit;
-exports.isSubmitted = isSubmitted;
-exports.classifyPasteLanded = classifyPasteLanded;
+exports.LITERAL_SEND_MAX_BYTES = exports.isSubmitted = exports.classifySubmit = exports.classifyPasteLanded = exports.recheckComposerBeforeInput = void 0;
 exports.clearComposerBeforeSend = clearComposerBeforeSend;
 exports.sendMessageWithSubmitVerification = sendMessageWithSubmitVerification;
 const childProcess = __importStar(require("child_process"));
@@ -127,19 +134,19 @@ const composer_spec_1 = require("./composer-spec");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger_1 = require("../../lib/logger");
+const global_state_1 = require("../../lib/global-state");
 const composer_clear_1 = require("../../lib/session/composer-clear");
+Object.defineProperty(exports, "recheckComposerBeforeInput", { enumerable: true, get: function () { return composer_clear_1.recheckComposerBeforeInput; } });
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const composer_text_1 = require("../../lib/detection/composer-text");
+const submit_composer_read_1 = require("./submit-composer-read");
+// Issue #3963: the composer reads moved to `submit-composer-read`; re-exported
+// so every caller and test keeps importing them from here.
+var submit_composer_read_2 = require("./submit-composer-read");
+Object.defineProperty(exports, "classifyPasteLanded", { enumerable: true, get: function () { return submit_composer_read_2.classifyPasteLanded; } });
+Object.defineProperty(exports, "classifySubmit", { enumerable: true, get: function () { return submit_composer_read_2.classifySubmit; } });
+Object.defineProperty(exports, "isSubmitted", { enumerable: true, get: function () { return submit_composer_read_2.isSubmitted; } });
 const logger = (0, logger_1.createLogger)('cli-tools/submit-verified-sender');
-/**
- * Version-resilient pasted-text placeholder.
- *
- * Broader than PASTED_TEXT_PATTERN (`/\[Pasted text #\d+/`) so it still matches
- * when a CLI version drops the `#N` and renders `[Pasted text +46 lines]`
- * (Issue #1469 condition 2). Used ONLY as a positive "still in the input box"
- * signal — never as the sole submit gate — so applying it to every tool is safe:
- * a tool that never renders it simply never matches.
- */
-const PASTE_PLACEHOLDER_PATTERN = /\[Pasted text[\s#]/;
 /**
  * Largest body typed as keystrokes (`send-keys -l`); anything longer is pasted
  * (Issue #2464).
@@ -178,461 +185,24 @@ const TYPED_BODY_POLL_MS = 50;
 const DEFAULT_TYPED_BODY_ATTEMPTS = 100;
 /** Per-command timeout for `load-buffer` / `paste-buffer`, as for every other tmux call. */
 const PASTE_COMMAND_TIMEOUT_MS = 5000;
-/** Makes each send's tmux paste buffer name unique within this process. */
-let pasteBufferSeq = 0;
-/**
- * A slash-command sitting on the input line (Issue #1501).
- *
- * TUI completion popups replace a typed slash command with a highlighted menu
- * item (`/status` -> `/statusline`, `/review` -> `/teamwork-preview`); the
- * result is always another slash command. Scoping the "replaced" verdict to
- * `/…` text keeps idle-prompt placeholders that some TUIs paint on an empty
- * composer (gemini's "Type your message or @path", claude's hints, "? for
- * shortcuts") — none of which start with `/` — from being mistaken for a
- * substitution, so a genuinely-submitted message never fails spuriously.
- */
-const REPLACEMENT_COMMAND_PATTERN = /^\/[A-Za-z]/;
 /**
- * Prompt input-line markers across the marker-drawing TUIs.
- * claude/gemini/copilot: `>` or `❯`; codex: `›`; antigravity: `>`;
- * vibe-local: `ctx:N% ❯`. Leading whitespace is tolerated (tmux padding).
- *
- * Issue #1906 scopes this to the tools whose {@link ComposerSpec.reader} is
- * `input-line-marker`. opencode draws no marker at all, so applying it there was
- * wrong in both directions — see {@link readComposer}.
+ * Makes each send's tmux paste buffer name unique within this process — on
+ * `globalThis` (Issue #3945 review #11): tmux buffers are server-wide, and a
+ * module-local counter restarts at 0 in every bundle `next dev` loads this file
+ * into, so two sessions' sends could load into one buffer name (the second
+ * `load-buffer` overwriting the first before its `paste-buffer`).
  */
-const INPUT_LINE_MARKER = /^\s*(?:ctx:\d+%\s*)?[>❯›]/;
+const pasteBufferSeq = (0, global_state_1.getOrInitGlobal)('__submitPasteBufferSeq', () => ({ last: 0 }));
 /**
- * Lines of pane tail to inspect for the "is the tool generating?" signal.
- *
- * Distinct from `ComposerSpec.verifyCaptureLines`, which sizes the tmux
- * capture: the busy marker of every tool lives in a status bar pinned to the
- * bottom of the pane, so it is read from a short tail even when the capture
- * itself is opencode's whole 200-row frame. Widening it to that frame would
- * match `esc interrupt` printed inside a reply.
- *
- * "The bottom" is the last row that holds anything (Issue #2464). codex,
- * Command Code and agy draw inline from the TOP of the 1000-row pane, so the
- * last twelve rows of the capture are blank padding — measured at rows 306,
- * 297 and 286 of 1,002 — and reading them found no composer on any send to
- * those three tools. See {@link withoutTrailingBlankRows}.
+ * Rows read for the re-check under the input lock (Issue #3945). The same
+ * capture `clearComposer` takes for its first read, so on a tool that clears
+ * before sending that read is the re-check's frame and no extra read is made.
  */
-const VERIFY_WINDOW_LINES = 12;
-/**
- * Read the composer out of a captured frame.
- *
- * Two readers, because the two families of TUI say "this is the input line" in
- * incompatible ways:
- *
- * - **marker tools** (`reader: 'input-line-marker'`) draw a `>` / `❯` / `›` at
- *   the start of the row. Scanned bottom-up over the tail window so a status bar
- *   below the box does not hide it.
- * - **opencode** draws a box with a gutter and no marker anywhere. Its buffer
- *   rows are located structurally by {@link findOpenCodeComposerRows} (#1911's
- *   chrome walk), and `Ask anything...` inside that box is opencode's own way of
- *   saying the buffer is empty (#1883) rather than a row of text.
- *
- * Before this split, opencode went through the marker reader, which is wrong
- * both ways round. It never matched opencode's composer, so EVERY opencode send
- * was classified `submitted` without evidence — #1471's "the Enter was
- * swallowed" recovery has never once run on opencode. And when a `>` did land in
- * the window from somewhere else (a Markdown quote in a reply), the reader
- * treated that row as the input line and answered from it.
- *
- * Issue #1933 turned "which reader" from a `cliToolId === 'opencode'` test plus
- * a set membership test into {@link ComposerSpec.reader}, so the answer is one
- * declaration the tool owns rather than two tables a new tool has to be added
- * to. `unreadable` is the third arm, and it is the one #1906 found opencode
- * silently occupying: it means every send is classified `submitted` without
- * evidence, so it is a state to declare knowingly, never to fall into.
- */
-function readComposer(reader, lines, windowLines) {
-    if (reader === 'opencode-box') {
-        const rows = (0, cli_patterns_1.findOpenCodeComposerRows)(lines);
-        if (rows === null)
-            return { kind: 'absent' };
-        // The placeholder is painted only while the buffer is empty, and only
-        // inside the box — hence matched on the raw, still-guttered row (#1883).
-        if (rows.some((row) => cli_patterns_1.OPENCODE_IDLE_COMPOSER_PATTERN.test(row)))
-            return { kind: 'empty' };
-        const first = rows.map(cli_patterns_1.stripOpenCodeGutter).find((row) => row.length > 0);
-        if (first === undefined)
-            return { kind: 'empty' };
-        return { kind: 'text', text: first, rows };
-    }
-    if (reader !== 'input-line-marker')
-        return { kind: 'absent' };
-    const inputLine = findInputLine(windowLines);
-    if (inputLine === null)
-        return { kind: 'absent' };
-    const stripped = stripInputMarker(inputLine);
-    if (stripped.length === 0)
-        return { kind: 'empty' };
-    return { kind: 'text', text: stripped, rows: [inputLine] };
-}
-/**
- * The captured rows without the blank rows under the last drawn one
- * (Issue #2464).
- *
- * `capture-pane` returns every row of the pane, and a TUI that renders inline
- * from the top (codex, Command Code, agy) fills only the first few hundred of
- * the 1000 rows the session is created with. The composer is the last thing
- * such a TUI draws, so "the tail of the pane" has to mean "the tail of what is
- * drawn" — otherwise the tail window is all padding, no composer is ever found,
- * and every send to those tools classifies as `submitted` whatever the
- * composer actually holds. A bottom-anchored TUI (claude) has no trailing blank
- * rows, so for it this is the identity.
- */
-function withoutTrailingBlankRows(lines) {
-    let end = lines.length;
-    while (end > 0 && lines[end - 1].trim() === '')
-        end--;
-    return lines.slice(0, end);
-}
+const RECHECK_CAPTURE_LINES = 200;
+/** How often a send waiting out a carried paste mark reads the composer (Issue #3945). */
+const CARRIED_MARK_POLL_MS = 200;
 /** Default bounded recovery Enters (each read back) before giving up (throwing). */
 const DEFAULT_VERIFY_ATTEMPTS = 4;
-/**
- * First non-blank line of the message, trimmed. This is what a TUI shows on the
- * prompt line before the body folds into a paste placeholder. NOT truncated:
- * the replacement check (inputMatchesBody) needs the full first line so that a
- * completion suffix (`/status` -> `/statusline`) is not mistaken for the body.
- */
-function firstNonBlankLine(message) {
-    const line = message
-        .split('\n')
-        .map((l) => l.trim())
-        .find((l) => l.length > 0);
-    return line ?? '';
-}
-/**
- * Locate the active input line within the pane tail: the last line that begins
- * with a prompt marker. Scanned bottom-up so a status-bar/footer line rendered
- * BELOW the input box (antigravity's "? for shortcuts", vibe-local's status bar)
- * does not hide the real input line above it.
- */
-function findInputLine(windowLines) {
-    for (let i = windowLines.length - 1; i >= 0; i--) {
-        if (INPUT_LINE_MARKER.test(windowLines[i])) {
-            return windowLines[i];
-        }
-    }
-    return null;
-}
-/** Input line text with the prompt marker stripped and surrounding space trimmed. */
-function stripInputMarker(inputLine) {
-    return inputLine.replace(INPUT_LINE_MARKER, '').trim();
-}
-/**
- * Whether the (marker-stripped, non-empty) input-line text is still our
- * unsent body rather than a TUI-substituted command.
- *
- * The still-unsent body appears verbatim on the input line. Line wrapping can
- * visually truncate it to a PREFIX of the first line, but a completion popup
- * always produces a DIFFERENT string — the body plus a completion suffix
- * (`/status` -> `/statusline`) or an unrelated command (`/review` ->
- * `/teamwork-preview`) — which is never a prefix of the body. So the body is
- * "still there" iff the input text is a prefix of (or equals) the body's first
- * line. This deliberately rejects `/statusline` for a `/status` body: the safe
- * rule is "input text that is not the body (or a prefix of it) is NOT resent".
- */
-function inputMatchesBody(strippedInput, message) {
-    const bodyFirstLine = firstNonBlankLine(message);
-    if (bodyFirstLine.length === 0)
-        return false;
-    return bodyFirstLine.startsWith(strippedInput);
-}
-/**
- * Collapsed-paste placeholders, as measured at the production 200x1000
- * geometry (Issue #2464, `tests/fixtures/long-body-2464/`):
- *
- *   claude 2.1.268  `[Pasted text #86 +59 lines]` for 60 lines, `[Pasted text #87]` for one
- *   agy 1.2.0       `[Pasted text #5 +60 lines]` for 60 lines, `[Pasted text #6 12288 chars]` for one
- *   codex 0.154.0   `[Pasted Content 12288 chars]`
- *   Command Code 1.53.0  `[PROBE P12k… +60L]` — the first ten characters, then the line count
- *
- * The `#N` stays optional for #1469's version drift (`[Pasted text +46 lines]`).
- */
-const PASTE_TOKEN_PATTERNS = [
-    {
-        pattern: /\[Pasted text(?: #\d+)?(?: \+(\d+) lines?| (\d+) chars?)?\]/g,
-        read: (m) => m[1] !== undefined ? { lines: Number(m[1]) } : m[2] !== undefined ? { chars: Number(m[2]) } : {},
-    },
-    { pattern: /\[Pasted Content (\d+) chars?\]/g, read: (m) => ({ chars: Number(m[1]) }) },
-    { pattern: /\[([^\]\n]*?)… \+(\d+)L\]/g, read: (m) => ({ head: m[1], lineTotal: Number(m[2]) }) },
-];
-/** Every paste placeholder on a composer row, and the text left around them. */
-function findPasteTokens(text) {
-    const tokens = [];
-    let rest = text;
-    for (const { pattern, read } of PASTE_TOKEN_PATTERNS) {
-        for (const match of text.matchAll(pattern)) {
-            tokens.push(read(match));
-            rest = rest.replace(match[0], '');
-        }
-    }
-    return { tokens, rest: rest.trim() };
-}
-/**
- * Does one placeholder account for the whole body?
- *
- * Counts below the body's mean the paste is still arriving; counts above it mean
- * the composer holds more than the body. The two units that differ between
- * tools for the same `+M lines` wording (claude: 59 for a 60-line body, agy: 60)
- * are both accepted — a bracketed paste arrives as one unit, so the failure this
- * guards against is a count that is wildly short (the 24-byte tail of #2464),
- * not one that is off by one line.
- */
-function comparePasteToken(token, message) {
-    const newlines = (message.match(/\n/g) ?? []).length;
-    if (token.head !== undefined) {
-        const normalizedHead = token.head.replace(/\s+/g, ' ').trim();
-        if (!message.replace(/\s+/g, ' ').startsWith(normalizedHead))
-            return 'mismatch';
-    }
-    let observed;
-    let accepted;
-    if (token.chars !== undefined) {
-        observed = token.chars;
-        accepted = [[...message].length, message.length];
-    }
-    else if (token.lineTotal !== undefined) {
-        observed = token.lineTotal;
-        accepted = [newlines + 1];
-    }
-    else if (token.lines !== undefined) {
-        observed = token.lines;
-        accepted = [newlines, newlines + 1];
-    }
-    else {
-        // claude's bare `[Pasted text #N]` is what it draws for a single line.
-        return newlines === 0 ? 'landed' : 'pasting';
-    }
-    if (accepted.includes(observed))
-        return 'landed';
-    return observed < Math.min(...accepted) ? 'pasting' : 'mismatch';
-}
-/**
- * The composer as {@link classifySubmit} reads it (Issue #3205).
- *
- * {@link readComposer}'s marker reader takes the bottom-most `›` row of the
- * tail as the input line. A codex composer holding several lines draws its
- * continuation rows under the `›` row, and when one of them itself begins with
- * `›` — a body quoting a dialog's `› 1. Yes, proceed (y)` — that continuation
- * row was read as the input line: its text is not the body's first line, so a
- * body still sitting in the composer was classified `submitted` (F). Measured:
- * `tests/fixtures/codex-multiline-composer-3205/tc104-raw-pane.txt`.
- *
- * So for codex a composer of two or more rows is read with
- * `extractComposerText` — the #1890 reader `awaitTypedBody` already uses —
- * and its first line is the input line. Every other frame (a one-row
- * composer, an empty or ghost one, none at all, another tool) is read exactly
- * as before.
- *
- * Issue #3880 (H-2): this is also the reader before Enter
- * ({@link classifyPasteLanded}) and in the error text ({@link describeComposer}).
- * The paste check used to read the twelve-row tail with {@link readComposer}
- * alone, so a codex composer taller than that window (a 20-line paste, or 600
- * bytes wrapped in a narrow pane) put its `›` row above the window — `unseen`,
- * and the body that was in the composer was withdrawn and reported as not
- * landed — and a continuation row starting with `>` (a Markdown quote) was taken
- * for the input line — `mismatch`. The same frame read after Enter was
- * `pending`. One reader on both sides of Enter keeps the two verdicts about the
- * same composer.
- */
-/**
- * Everything a codex composer holds, for deciding that a pasted body arrived in
- * full (Issue #3880).
- *
- * `extractComposerText` answers for the UI: its text stops at 2,000 characters,
- * at 40 rows and at the composer's first blank row, so a composer that matches
- * it may still be missing the rest of the body — or hold something after it.
- * This reads the raw rows instead, from the `›` row down to the last block of
- * the frame (codex's model / cwd footer), so a body with blank lines, more than
- * 40 rows or more than 2,000 characters is compared whole, and anything typed
- * after the body is part of what is compared.
- */
-function codexComposerRegion(output) {
-    const raw = output.split('\n');
-    const box = (0, composer_text_1.findCodexInputBox)(raw);
-    if (box === null)
-        return null;
-    const isBlank = (row) => (0, cli_patterns_1.stripAnsi)(row).trim() === '';
-    let end = raw.length - 1;
-    while (end >= 0 && isBlank(raw[end]))
-        end--;
-    let lastBlockStart = end;
-    while (lastBlockStart > 0 && !isBlank(raw[lastBlockStart - 1]))
-        lastBlockStart--;
-    const stop = lastBlockStart > box.lastRow ? lastBlockStart - 1 : end;
-    const rows = raw.slice(box.firstRow, stop + 1).map((row) => (0, cli_patterns_1.stripAnsi)(row));
-    rows[0] = rows[0].replace(/^\s*\u203A ?/, '');
-    return rows.join('\n');
-}
-function readSubmitComposer(output, cliToolId, reader, lines, windowLines) {
-    if (cliToolId === 'codex' && reader === 'input-line-marker') {
-        const read = (0, composer_text_1.extractComposerText)(output, cliToolId);
-        if (read.state === 'content') {
-            const region = codexComposerRegion(output) ?? read.text;
-            if (read.text.includes('\n')) {
-                return { kind: 'text', text: firstNonBlankLine(read.text), rows: read.text.split('\n'), region };
-            }
-            // Issue #3880 (N1): a one-row excerpt is read as before for its verdict
-            // after Enter, but still carries the whole region — `head` with the rest of
-            // the body under a blank row is one excerpt row and must not pass for the
-            // whole body before Enter.
-            const single = readComposer(reader, lines, windowLines);
-            return single.kind === 'text' ? { ...single, region } : single;
-        }
-    }
-    return readComposer(reader, lines, windowLines);
-}
-/**
- * Classify a captured pane into submitted / pending / replaced (Issue #1501).
- *
- * Version-independent by design — does NOT require the paste placeholder:
- *   A. The tool is generating a response              -> submitted.
- *   B. No composer, or the composer is empty           -> submitted.
- *   C. A paste placeholder is folded in the composer   -> pending (Enter eaten).
- *   D. The body is still verbatim in the composer      -> pending (resend Enter).
- *   E. A DIFFERENT slash command is in the composer    -> replaced (TUI popup
- *      autocompleted the command; clear the line and throw, never resend Enter).
- *   F. Any other non-empty text (idle placeholder/hint) -> submitted (unchanged
- *      pre-#1501 permissive default, so normal sends never spuriously fail).
- *
- * C–F are scoped to the composer only, so the user-message echo that a TUI
- * prints into its history above the prompt never causes a false verdict.
- *
- * Issue #1906: "the composer" is read per tool by {@link readComposer} rather
- * than by looking for a `>` in the last twelve rows. For opencode — which draws
- * no marker — that read was unreachable, so every send reached F (in fact B) and
- * this function has never returned anything but `submitted` for it.
- *
- * Issue #2464: the tail window starts at the last drawn row, not at the last row
- * of the pane ({@link withoutTrailingBlankRows}), and C recognises every tool's
- * paste placeholder ({@link findPasteTokens}), not only claude's.
- *
- * @param output - Captured pane, ANSI intact. For opencode this must be the
- *   whole pane; {@link ComposerSpec.verifyCaptureLines} is what asks tmux for it.
- * @param cliToolId - CLI tool id, for the "generating" detector
- * @param message - The body that was typed
- * @param composer - The tool's composer description (Issue #1933). Defaults to
- *   the tool's own, so every existing three-argument caller is unchanged.
- */
-function classifySubmit(output, cliToolId, message, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
-    const clean = (0, cli_patterns_1.stripAnsi)(output);
-    const lines = withoutTrailingBlankRows(clean.split('\n'));
-    const windowLines = lines.slice(-VERIFY_WINDOW_LINES);
-    const windowStr = windowLines.join('\n');
-    // A. Actively generating a response => the message was accepted. Read from the
-    //    tail window for every tool: each one's busy marker lives in a status bar
-    //    pinned to the bottom of the pane, and widening it to opencode's whole
-    //    frame would match `esc interrupt` printed inside a reply.
-    if ((0, cli_patterns_1.detectThinking)(cliToolId, windowStr)) {
-        return 'submitted';
-    }
-    const composer = readSubmitComposer(output, cliToolId, composerSpec.reader, lines, windowLines);
-    // B. No composer visible (scrolled off / dialog / still starting), or the
-    //    composer is empty => the message left the box => submitted.
-    if (composer.kind !== 'text') {
-        return 'submitted';
-    }
-    // C. A paste placeholder is still folded into the composer => body is there.
-    if (composer.rows.some((row) => PASTE_PLACEHOLDER_PATTERN.test(row) || findPasteTokens(row).tokens.length > 0)) {
-        return 'pending';
-    }
-    // D. The typed body is still sitting in the composer => resend Enter.
-    if (inputMatchesBody(composer.text, message)) {
-        return 'pending';
-    }
-    // E. A different slash command is in the composer => a completion popup
-    //    replaced what we typed. (Scoped to `/…` so idle-prompt placeholders that
-    //    some TUIs paint on an empty composer are never mistaken for this.)
-    if (REPLACEMENT_COMMAND_PATTERN.test(composer.text)) {
-        return 'replaced';
-    }
-    // F. Non-empty, non-command steady-state text (idle placeholder / hint) =>
-    //    submitted, preserving the pre-#1501 permissive default.
-    return 'submitted';
-}
-/**
- * Backward-compatible boolean view of {@link classifySubmit}: submitted vs not.
- * A `replaced` verdict is NOT "submitted", so this returns false for it too.
- */
-function isSubmitted(output, cliToolId, message, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
-    return classifySubmit(output, cliToolId, message, composerSpec) === 'submitted';
-}
-/**
- * How much of a pasted body the composer shows, read BEFORE Enter (Issue #2464).
- *
- * The question #2464 needs answered is not "did Enter work" but "is what Enter
- * would submit the message we sent". Claude kept the last 24 bytes of a 12 KB
- * brief as ordinary composer text; every check that runs after Enter saw an
- * empty box and a generating model, i.e. a perfect send. So the composer is
- * judged here, while pressing Enter can still be withheld:
- *
- *   1. A collapsed placeholder is compared by the count the TUI prints — lines
- *      for claude, agy and Command Code, characters for codex and agy's
- *      single-line form ({@link comparePasteToken}).
- *   2. Plain text is the body only if it is the body's BEGINNING. Text that
- *      occurs in the body but not at its start is exactly the #2464 tail, and is
- *      a mismatch rather than "not drawn yet".
- *   3. Anything else — the idle placeholder, a ghost suggestion, no composer —
- *      shows nothing of the body. `unseen`, which the caller decides about.
- *
- * Reads the composer the way {@link classifySubmit} does
- * ({@link readSubmitComposer}), so a history echo of an earlier message above the
- * composer is never mistaken for this one, and a frame both functions see holds
- * the same composer for both (Issue #3880). A multi-row codex composer is
- * compared as a whole ({@link codexComposerRegion}), whitespace removed
- * (wrapping and continuation indent proof): only the WHOLE body is `landed`;
- * the body's beginning alone is `pasting` (never enough to press Enter on), the
- * body plus anything else or text from inside it is `mismatch`. The whole body
- * is checked before placeholders, so a body that itself quotes
- * `[Pasted Content 600 chars]` is its own text, not codex's placeholder; a real
- * placeholder is only ever the composer's first row.
- */
-function classifyPasteLanded(output, cliToolId, message, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
-    const lines = withoutTrailingBlankRows((0, cli_patterns_1.stripAnsi)(output).split('\n'));
-    const composer = readSubmitComposer(output, cliToolId, composerSpec.reader, lines, lines.slice(-VERIFY_WINDOW_LINES));
-    if (composer.kind !== 'text')
-        return 'unseen';
-    if (composer.region !== undefined) {
-        const shown = compactText(composer.region);
-        const body = compactText(message);
-        if (shown === body)
-            return 'landed';
-        const placeholder = findPasteTokens(composer.text);
-        if (placeholder.tokens.length > 0) {
-            // A placeholder plus anything else — on its row or under it — is not the body as sent.
-            const below = compactText(composer.region.split('\n').slice(1).join('\n'));
-            if (placeholder.tokens.length > 1 || placeholder.rest !== '' || below !== '')
-                return 'mismatch';
-            return comparePasteToken(placeholder.tokens[0], message);
-        }
-        if (body.startsWith(shown))
-            return 'pasting';
-        // The body's beginning followed by something else, the body plus more, or a
-        // piece from inside it: the composer holds something other than the body.
-        if (inputMatchesBody(composer.text, message) || shown.startsWith(body) || body.includes(shown)) {
-            return 'mismatch';
-        }
-        return 'unseen';
-    }
-    // The whole body on one row is the body, even when it quotes a placeholder.
-    if (compactText(composer.text) === compactText(message))
-        return 'landed';
-    const { tokens, rest } = findPasteTokens(composer.text);
-    if (tokens.length === 0) {
-        if (inputMatchesBody(composer.text, message))
-            return 'landed';
-        if (message.includes(composer.text))
-            return 'mismatch';
-        return 'unseen';
-    }
-    if (tokens.length > 1 || rest !== '')
-        return 'mismatch';
-    return comparePasteToken(tokens[0], message);
-}
 /** Run one tmux command, optionally feeding it `input` on stdin. */
 function runTmux(args, input) {
     return new Promise((resolve, reject) => {
@@ -659,12 +229,40 @@ function runTmux(args, input) {
  * per line for a TUI that did not ask for brackets. `-d` drops the buffer on
  * success; a failure drops it here, so no body is left behind in the server.
  *
- * @throws Error when either tmux command fails
+ * Issue #3945 (review-1 #2): ownership is asked again between the two commands,
+ * right before `paste-buffer` — the session may have been replaced while
+ * `load-buffer` ran. A lost ticket drops the buffer and throws before anything
+ * reaches the pane (`input lock lost, nothing was typed`).
+ *
+ * @throws Error when either tmux command fails, or `ticket` lost the composer
  */
-async function pasteBody(sessionName, message) {
-    const bufferName = `cm-send-${process.pid}-${++pasteBufferSeq}`;
+async function pasteBody(sessionName, message, ticket, cliToolId) {
+    pasteBufferSeq.last += 1;
+    const bufferName = `cm-send-${process.pid}-${pasteBufferSeq.last}`;
     try {
         await runTmux(['load-buffer', '-b', bufferName, '-'], message);
+    }
+    catch (error) {
+        await runTmux(['delete-buffer', '-b', bufferName]).catch(() => undefined);
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        throw new Error(`Failed to paste message into tmux session: ${errorMessage}`);
+    }
+    if (!ticket.isCurrent()) {
+        await runTmux(['delete-buffer', '-b', bufferName]).catch(() => undefined);
+        assertInputOwner(ticket, cliToolId, 'paste-buffer', false);
+    }
+    // Issue #3953: the send's stamp, as the typed branch takes it — after
+    // `load-buffer` (up to its timeout), right before the body reaches the pane.
+    // Issue #3992: a refused input boundary (#3957) stops the send here, with the
+    // body loaded but not pasted — the buffer is dropped before the refusal goes up.
+    try {
+        (0, instance_input_lock_1.noteInputStart)();
+    }
+    catch (error) {
+        await runTmux(['delete-buffer', '-b', bufferName]).catch(() => undefined);
+        throw error;
+    }
+    try {
         await runTmux(['paste-buffer', '-p', '-r', '-d', '-b', bufferName, '-t', (0, tmux_1.exactTarget)(sessionName)]);
     }
     catch (error) {
@@ -674,9 +272,9 @@ async function pasteBody(sessionName, message) {
     }
 }
 /** The composer's first row, for an error message a person has to act on. */
-function describeComposer(output, cliToolId, composerSpec) {
-    const lines = withoutTrailingBlankRows((0, cli_patterns_1.stripAnsi)(output).split('\n'));
-    const composer = readSubmitComposer(output, cliToolId, composerSpec.reader, lines, lines.slice(-VERIFY_WINDOW_LINES));
+function describeComposer(output, cliToolId, composerSpec, message) {
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    const composer = (0, submit_composer_read_1.readSubmitComposer)(output, cliToolId, composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message);
     if (composer.kind === 'absent')
         return 'no composer on screen';
     if (composer.kind === 'empty')
@@ -690,15 +288,27 @@ function describeComposer(output, cliToolId, composerSpec) {
  * Leaving it would put the fragment in front of the next message. claude and
  * codex go through the verified #1879 loop (a paste can span rows); the rest
  * get the single `C-u` the #1501 path already sends to them.
+ *
+ * @returns Whether the composer was confirmed empty afterwards (Issue #3945):
+ *   false for a `C-u` nothing can read back, a failed clear, and a ticket that
+ *   no longer owns the composer (no key is sent then).
  */
-async function withdrawUnsentBody(sessionName, cliToolId, composerSpec) {
+async function withdrawUnsentBody(sessionName, cliToolId, composerSpec, ticket) {
+    // Issue #3945: only this send's own composer is taken back. A ticket that is
+    // no longer current means another writer owns the composer now, and what it
+    // holds is that writer's.
+    if (!ticket.isCurrent()) {
+        logger.error('paste-withdraw-skipped-not-owner', { sessionName, cliToolId, generation: ticket.generation });
+        return false;
+    }
     try {
         if (composerSpec.clearBeforeSend) {
-            await (0, composer_clear_1.clearComposer)(sessionName, cliToolId);
-        }
-        else {
-            await (0, tmux_1.clearInputLine)(sessionName);
+            const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId, { beforePass: () => ticket.isCurrent() });
+            return result.cleared;
         }
+        await (0, tmux_1.clearInputLine)(sessionName);
+        // One `C-u` into a composer nothing here can read: sent, never confirmed.
+        return false;
     }
     catch (clearError) {
         logger.error('paste-withdraw-failed', {
@@ -706,7 +316,85 @@ async function withdrawUnsentBody(sessionName, cliToolId, composerSpec) {
             cliToolId,
             error: clearError instanceof Error ? clearError.message : String(clearError),
         });
+        return false;
+    }
+}
+/**
+ * Throw unless `ticket` still owns the composer (Issue #3945 stage 3). Called
+ * right before every key a send sends — body, paste, each Enter — so work still
+ * in flight after its ownership ended cannot reach the next owner's composer.
+ *
+ * @param typed - Whether any of the body may already be in the composer, which
+ *   decides how the failure classifies (`not-sent` before the body only).
+ */
+function assertInputOwner(ticket, cliToolId, step, typed) {
+    if (ticket.isCurrent())
+        return;
+    logger.error('input-lock-lost', { sessionName: ticket.sessionName, cliToolId, step, generation: ticket.generation });
+    if (!typed) {
+        throw new Error(`Session ${ticket.sessionName} was handed to another writer before ${step}; input lock lost, nothing was typed (Issue #3945).`);
+    }
+    throw new Error(`Session ${ticket.sessionName} was handed to another writer before ${step}; part of the message may be in its composer (Issue #3945).`);
+}
+/**
+ * Hold off typing while a carried paste mark is fresh (Issue #3945 stage 4).
+ *
+ * A previous send gave up on a body that may still be drawn. Until the mark
+ * expires, nothing of this send is typed: a placeholder of the same count as
+ * this body would be taken for it ({@link classifyPasteLanded} cannot tell
+ * them apart). What appears meanwhile is taken out at once — it is the previous
+ * send's, and this owner is the one left to handle it. A tool whose composer is
+ * not readable (no `clearBeforeSend`) only waits.
+ *
+ * @returns Whether there was a mark to wait out
+ */
+async function waitOutCarriedPaste(sessionName, cliToolId, composer, ticket) {
+    const mark = (0, instance_input_lock_1.getCarriedPasteMark)(sessionName);
+    if (mark === null)
+        return false;
+    logger.warn('carried-paste-mark-wait', {
+        sessionName,
+        cliToolId,
+        originGeneration: mark.originGeneration,
+        generation: ticket.generation,
+        remainingMs: mark.expiresAt - Date.now(),
+    });
+    while (Date.now() < mark.expiresAt) {
+        await new Promise((resolve) => setTimeout(resolve, Math.min(CARRIED_MARK_POLL_MS, mark.expiresAt - Date.now())));
+        if (!composer.clearBeforeSend)
+            continue;
+        assertInputOwner(ticket, cliToolId, 'the carried paste wait', false);
+        let frame;
+        try {
+            frame = await (0, tmux_1.capturePane)(sessionName, RECHECK_CAPTURE_LINES);
+        }
+        catch {
+            // The re-check after the wait decides about a pane that cannot be read.
+            continue;
+        }
+        if ((0, composer_clear_1.readClearComposer)(frame, cliToolId).state !== 'content')
+            continue;
+        const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId, {
+            initialCapture: frame,
+            beforePass: () => ticket.isCurrent(),
+        });
+        (0, tmux_capture_cache_1.invalidateCache)(sessionName);
+        logger.warn('carried-paste-withdrawn', {
+            sessionName,
+            cliToolId,
+            originGeneration: mark.originGeneration,
+            cleared: result.cleared,
+            discardedText: result.discardedText,
+        });
     }
+    (0, instance_input_lock_1.clearExpiredCarriedPasteMark)(ticket);
+    return true;
+}
+/** Whether the composer in `output` holds any text at all, read as the sender reads it. */
+function composerHoldsText(output, cliToolId, composerSpec, message) {
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    return ((0, submit_composer_read_1.readSubmitComposer)(output, cliToolId, composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message)
+        .kind === 'text');
 }
 /**
  * Wait until the composer shows the whole pasted body; decide whether Enter
@@ -728,42 +416,99 @@ async function withdrawUnsentBody(sessionName, cliToolId, composerSpec) {
  * drawn in ways this module has not measured, and refusing on them would turn
  * "cannot see it" into "did not send it" for every long message they get.
  *
+ * Issue #3945 (stage 4): an `unseen` on a measured tool is not given up at the
+ * end of the 2 s. The composer is watched for {@link LATE_PASTE_OBSERVE_MS}
+ * more, still under the input lock — so whatever appears in it is this send's
+ * (or a person's typing), never another send's — and a placeholder or body that
+ * appears is withdrawn before the throw. A read that throws is a failure like
+ * the others: withdrawn, `body-not-landed`. When the body may still arrive —
+ * nothing of it was ever seen, it was only partly there, a read failed, or the
+ * withdrawal could not be confirmed — a carried mark holds the next send off
+ * the composer ({@link leaveCarriedPasteMark}).
+ *
  * @throws Error when the body cannot be confirmed in the composer
  */
 async function confirmPasteLanded(params) {
-    const { sessionName, message, cliToolId, composer, attempts } = params;
+    const { sessionName, message, cliToolId, composer, attempts, ticket } = params;
     let state = 'unseen';
     let output = '';
-    for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
-        await new Promise((resolve) => setTimeout(resolve, PASTE_LANDED_POLL_MS));
-        output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
-        state = classifyPasteLanded(output, cliToolId, message, composer);
-        if (state === 'landed' || state === 'mismatch')
-            break;
+    let readError = null;
+    /** ms after the 2 s check that something of the body appeared, during the late watch. */
+    let lateAfterMs = null;
+    try {
+        for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
+            await new Promise((resolve) => setTimeout(resolve, PASTE_LANDED_POLL_MS));
+            output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+            state = (0, submit_composer_read_1.classifyPasteLanded)(output, cliToolId, message, composer);
+            if (state === 'landed' || state === 'mismatch')
+                break;
+        }
+        if (state === 'unseen' && composer.clearBeforeSend) {
+            const observeAttempts = Math.ceil(instance_input_lock_1.LATE_PASTE_OBSERVE_MS / PASTE_LANDED_POLL_MS);
+            for (let attempt = 1; attempt <= observeAttempts; attempt++) {
+                await new Promise((resolve) => setTimeout(resolve, PASTE_LANDED_POLL_MS));
+                output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+                state = (0, submit_composer_read_1.classifyPasteLanded)(output, cliToolId, message, composer);
+                if (state !== 'unseen') {
+                    lateAfterMs = attempt * PASTE_LANDED_POLL_MS;
+                    break;
+                }
+            }
+        }
     }
-    if (state === 'landed')
+    catch (error) {
+        readError = error instanceof Error ? error.message : String(error);
+    }
+    if (readError === null && lateAfterMs === null && state === 'landed')
         return;
-    if (state === 'unseen' && !composer.clearBeforeSend) {
+    if (readError === null && state === 'unseen' && !composer.clearBeforeSend) {
         logger.warn('paste-landed-unverified', { sessionName, cliToolId, bytes: Buffer.byteLength(message, 'utf8') });
         return;
     }
     const bytes = Buffer.byteLength(message, 'utf8');
     const lineCount = message.split('\n').length;
-    const shown = describeComposer(output, cliToolId, composer);
-    await withdrawUnsentBody(sessionName, cliToolId, composer);
+    const shown = readError === null ? describeComposer(output, cliToolId, composer, message) : 'an unreadable pane';
+    const withdrawn = await withdrawUnsentBody(sessionName, cliToolId, composer, ticket);
     (0, tmux_capture_cache_1.invalidateCache)(sessionName);
-    logger.error('paste-not-landed', { sessionName, cliToolId, state, bytes, lines: lineCount, shown });
-    const what = state === 'mismatch'
-        ? `the composer does not hold the message as sent (it shows ${shown})`
-        : state === 'pasting'
-            ? `the paste had not finished arriving after ${attempts * PASTE_LANDED_POLL_MS}ms (the composer shows ${shown})`
-            : `the message never appeared in the composer (${shown})`;
+    const mayStillArrive = readError !== null || state === 'unseen' || state === 'pasting' || !withdrawn;
+    if (mayStillArrive)
+        (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+    logger.error('paste-not-landed', {
+        sessionName,
+        cliToolId,
+        state,
+        bytes,
+        lines: lineCount,
+        shown,
+        lateAfterMs,
+        readError,
+        withdrawn,
+        carried: mayStillArrive,
+    });
+    const what = readError !== null
+        ? `the composer could not be read while the paste was checked (${readError})`
+        : lateAfterMs !== null
+            ? `the paste appeared ${lateAfterMs}ms after the ${attempts * PASTE_LANDED_POLL_MS}ms check and was taken back out (the composer showed ${shown})`
+            : state === 'mismatch'
+                ? `the composer does not hold the message as sent (it shows ${shown})`
+                : state === 'pasting'
+                    ? `the paste had not finished arriving after ${attempts * PASTE_LANDED_POLL_MS}ms (the composer shows ${shown})`
+                    : `the message never appeared in the composer (${shown})`;
     throw new Error(`Message body did not arrive intact for session ${sessionName}: ${what}; the message is ${bytes} bytes / ${lineCount} lines. ` +
         'Enter was not pressed, so nothing was submitted (Issue #2464).');
 }
-/** The text with every whitespace character removed — wrapping and indent proof. */
-function compactText(text) {
-    return text.replace(/\s+/g, '');
+/**
+ * Whether the composer shows a paste placeholder whose count is not this body's
+ * (Issue #3945): one counting fewer or more, or more than one placeholder.
+ */
+function composerShowsForeignPasteToken(output, cliToolId, message, composerSpec) {
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    const composer = (0, submit_composer_read_1.readSubmitComposer)(output, cliToolId, composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message);
+    if (composer.kind !== 'text')
+        return false;
+    if (!composer.rows.some((row) => (0, submit_composer_read_1.findPasteTokens)(row).tokens.length > 0))
+        return false;
+    return (0, submit_composer_read_1.classifyPasteLanded)(output, cliToolId, message, composerSpec) !== 'landed';
 }
 /**
  * The part of a typed body the composer reader can see (Issue #3366).
@@ -781,6 +526,12 @@ function visibleTypedBody(message) {
     const blank = lines.findIndex((line, index) => index > first && line.trim() === '');
     return lines.slice(0, blank < 0 ? lines.length : blank).join('\n');
 }
+/** Whether the whole codex composer, read past the bounded readers (Issue #3906), is exactly `message`. */
+function codexComposerShowsWholeBody(output, message, composerSpec) {
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    const composer = (0, submit_composer_read_1.readSubmitComposer)(output, 'codex', composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message);
+    return composer.kind === 'text' && composer.region !== undefined && (0, submit_composer_read_1.compactText)(composer.region) === (0, submit_composer_read_1.compactText)(message);
+}
 /**
  * Wait until the composer shows the typed body; only then may Enter be pressed
  * (Issue #3366).
@@ -794,29 +545,56 @@ function visibleTypedBody(message) {
  * a prefix is not enough, because codex can draw the first keystrokes before it
  * decides the rest are a burst.
  *
+ * On codex the verdict is the whole composer against the whole body
+ * ({@link codexComposerShowsWholeBody}, Issue #3906): the extractor's text is
+ * the body's first paragraph at most, so on its own it would let Enter go on a
+ * body whose later paragraphs had not been drawn.
+ *
  * A body that never appears is taken back out and the send THROWS without
  * Enter — nothing was submitted, so the caller must not print `Message sent.`.
  *
  * @throws Error when the composer does not show the body within the attempts
  */
 async function confirmTypedBodyLanded(params) {
-    const { sessionName, message, cliToolId, composer, attempts } = params;
-    const expected = compactText(visibleTypedBody(message));
+    const { sessionName, message, cliToolId, composer, attempts, ticket } = params;
+    const expected = (0, submit_composer_read_1.compactText)(visibleTypedBody(message));
     if (expected === '')
         return;
     let output = '';
-    for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
-        await new Promise((resolve) => setTimeout(resolve, TYPED_BODY_POLL_MS));
-        output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
-        const read = (0, composer_text_1.extractComposerText)(output, cliToolId);
-        if (read.state === 'content' && compactText(read.text) === expected)
-            return;
+    let readError = null;
+    try {
+        for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
+            await new Promise((resolve) => setTimeout(resolve, TYPED_BODY_POLL_MS));
+            output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+            // Issue #3906: on codex the whole composer must show the whole body. The
+            // extractor's excerpt stops at the first blank row, so its match is only
+            // the first paragraph — a five-paragraph body with one paragraph drawn
+            // would pass on it — and it cannot reach a body of more than four blocks.
+            if (cliToolId === 'codex') {
+                if (codexComposerShowsWholeBody(output, message, composer))
+                    return;
+                continue;
+            }
+            const read = (0, composer_text_1.extractComposerText)(output, cliToolId);
+            if (read.state === 'content' && (0, submit_composer_read_1.compactText)(read.text) === expected)
+                return;
+        }
+    }
+    catch (error) {
+        readError = error instanceof Error ? error.message : String(error);
     }
     const bytes = Buffer.byteLength(message, 'utf8');
-    const shown = describeComposer(output, cliToolId, composer);
-    await withdrawUnsentBody(sessionName, cliToolId, composer);
+    const shown = readError === null ? describeComposer(output, cliToolId, composer, message) : 'an unreadable pane';
+    // Issue #3945: a body never seen (codex can draw a burst late), a read that
+    // threw, or a withdrawal that was not confirmed may still put text in the
+    // composer after this throw — the next send waits that out.
+    const seen = readError === null && composerHoldsText(output, cliToolId, composer, message);
+    const withdrawn = await withdrawUnsentBody(sessionName, cliToolId, composer, ticket);
     (0, tmux_capture_cache_1.invalidateCache)(sessionName);
-    logger.error('typed-body-not-landed', { sessionName, cliToolId, bytes, attempts, shown });
+    const mayStillArrive = !seen || !withdrawn;
+    if (mayStillArrive)
+        (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+    logger.error('typed-body-not-landed', { sessionName, cliToolId, bytes, attempts, shown, readError, carried: mayStillArrive });
     throw new Error(`Message body did not appear in the composer for session ${sessionName} within ` +
         `${attempts * TYPED_BODY_POLL_MS}ms (it shows ${shown}); the message is ${bytes} bytes. ` +
         'Enter was not pressed, so nothing was submitted (Issue #3366).');
@@ -868,10 +646,18 @@ async function confirmTypedBodyLanded(params) {
  *
  * @throws Error when the composer still holds text after the pass cap.
  */
-async function clearComposerBeforeSend(sessionName, cliToolId, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
+async function clearComposerBeforeSend(sessionName, cliToolId, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId), options = {}) {
     if (!composerSpec.clearBeforeSend)
         return;
-    const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId);
+    // Issue #3945: the first read is the re-check's frame, and every pass asks
+    // first whether this send still owns the composer.
+    const { ticket } = options;
+    const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId, {
+        ...(options.initialCapture !== undefined ? { initialCapture: options.initialCapture } : {}),
+        ...(ticket !== undefined ? { beforePass: () => ticket.isCurrent() } : {}),
+    });
+    if (ticket !== undefined)
+        assertInputOwner(ticket, cliToolId, 'the pre-send clear', false);
     if (result.state === 'content') {
         logger.error('pre-send-composer-clear-failed', {
             sessionName,
@@ -912,23 +698,57 @@ async function clearComposerBeforeSend(sessionName, cliToolId, composerSpec = (0
  * and Enter waits until the composer shows all of it (Issue #2464); a body that
  * does not arrive intact THROWS before Enter, with nothing submitted.
  *
+ * Issue #3945: the whole of it — clear, body, Enter, read-back, withdrawal —
+ * runs as the session's only writer ({@link withInstanceInputLock}); before
+ * anything is typed the pane is re-read under the lock, on every send
+ * ({@link recheckComposerBeforeInput}), and a carried paste mark is waited out
+ * ({@link waitOutCarriedPaste}, then the re-check again).
+ *
  * @throws Error when the body does not arrive intact, or submit cannot be
- *   confirmed within the bounded attempts.
+ *   confirmed within the bounded attempts; `InstanceInputLockTimeoutError`
+ *   when the composer was not free in time (nothing typed).
  */
 async function sendMessageWithSubmitVerification(params) {
+    await (0, instance_input_lock_1.withInstanceInputLock)(params.sessionName, (ticket) => sendUnderInputLock(params, ticket));
+}
+async function sendUnderInputLock(params, ticket) {
     const { sessionName, message, cliToolId, composer = (0, composer_spec_1.resolveComposerSpec)(cliToolId), textInputWaitMs = cli_tool_timing_config_1.TUI_TEXT_INPUT_WAIT_MS, interEnterWaitMs = cli_tool_timing_config_1.TUI_TEXT_INPUT_WAIT_MS, verifyAttempts = DEFAULT_VERIFY_ATTEMPTS, verifyDelayMs = cli_tool_timing_config_1.TUI_MESSAGE_PROCESSED_WAIT_MS, pasteLandedAttempts = DEFAULT_PASTE_LANDED_ATTEMPTS, awaitTypedBody = false, typedBodyAttempts = DEFAULT_TYPED_BODY_ATTEMPTS, } = params;
     const submitEnterCount = params.submitEnterCount ?? composer.submitEnterCount;
+    // -1. Issue #3945 (review-1 #4): every send re-reads the pane once it owns
+    //     the composer, whether or not it queued — the prompt guard and the
+    //     tool's readiness wait ran before the lock, and a dialog can open in the
+    //     waits between them and the first key (claude's settle wait, a queue
+    //     behind another writer). A dialog refuses the send at once, before any
+    //     carried paste is waited out (a refusal leaves the mark as it is); a
+    //     send that did wait one out reads again after the wait. The last read
+    //     is the pre-send clear's first: a claude/codex send with no mark reads
+    //     no more often than before; any other tool gains this one capture.
+    let frame = await (0, composer_clear_1.recheckComposerBeforeInput)(sessionName, cliToolId);
+    if (await waitOutCarriedPaste(sessionName, cliToolId, composer, ticket)) {
+        frame = await (0, composer_clear_1.recheckComposerBeforeInput)(sessionName, cliToolId);
+    }
     // 0. Empty the composer first (Issue #1880). The body below is typed at the
     //    TUI's current cursor position, so anything already in the box would be
     //    spliced into it. Throws for a claude composer that could not be emptied.
-    await clearComposerBeforeSend(sessionName, cliToolId, composer);
+    await clearComposerBeforeSend(sessionName, cliToolId, composer, { initialCapture: frame, ticket });
     if (Buffer.byteLength(message, 'utf8') > exports.LITERAL_SEND_MAX_BYTES) {
         // 1'. A body that would reach the TUI as more than one pty read is pasted
         //     as ONE bracketed paste, and Enter waits until the composer shows all
         //     of it (Issue #2464). Typed, Claude Code would keep only its last read.
         const pastedAt = Date.now();
-        await pasteBody(sessionName, message);
-        await confirmPasteLanded({ sessionName, message, cliToolId, composer, attempts: pasteLandedAttempts });
+        assertInputOwner(ticket, cliToolId, 'the paste', false);
+        try {
+            await pasteBody(sessionName, message, ticket, cliToolId);
+        }
+        catch (error) {
+            // Whether tmux put any of it into the pane is unknown — except after a
+            // refused input boundary (Issue #3992), which stops before `paste-buffer`:
+            // a mark then would only hold the next send off for nothing.
+            if (!(0, instance_input_lock_1.isInputBoundaryRefusal)(error))
+                (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+            throw error;
+        }
+        await confirmPasteLanded({ sessionName, message, cliToolId, composer, attempts: pasteLandedAttempts, ticket });
         // 2'. Keep the tool's own registration delay as a floor.
         const remaining = textInputWaitMs - (Date.now() - pastedAt);
         if (remaining > 0) {
@@ -946,13 +766,29 @@ async function sendMessageWithSubmitVerification(params) {
         //    nowhere at all, with `rc 0`. All four measured on tmux 3.5a; the argv is
         //    built in `lib/tmux/key-sequence.ts`, which carries the table.
         const typedAt = Date.now();
-        await (0, tmux_1.sendKeys)(sessionName, message, false, { literal: true });
+        assertInputOwner(ticket, cliToolId, 'the body', false);
+        // Issue #3953: the send's stamp is taken here — after the lock, the carried
+        // mark, the re-check and the clear, right before the body's first key — so a
+        // previous turn that ended during any of them is older than this send.
+        (0, instance_input_lock_1.noteInputStart)();
+        try {
+            await (0, tmux_1.sendKeys)(sessionName, message, false, { literal: true });
+        }
+        catch (error) {
+            // Issue #3945 (review-1 #6): a keystroke send that failed may still have
+            // put part of the body into the pane (a timed-out `send-keys`, #3880's
+            // `indeterminate`), to be drawn after this send has let the composer go.
+            // Only a call tmux never started (`TmuxSendError.delivery`) typed nothing.
+            if (error?.delivery !== 'not-started')
+                (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+            throw error;
+        }
         // 2. Let the TUI register the input before pressing Enter. On codex that
         //    means waiting until the body is drawn (Issue #3366): an Enter pressed
         //    while codex still holds the keystrokes as a paste burst becomes a
         //    newline, and the body stays unsent. The fixed wait stays as a floor.
         if (awaitTypedBody && composer_text_1.SUPPORTED_COMPOSER_TOOLS.has(cliToolId)) {
-            await confirmTypedBodyLanded({ sessionName, message, cliToolId, composer, attempts: typedBodyAttempts });
+            await confirmTypedBodyLanded({ sessionName, message, cliToolId, composer, attempts: typedBodyAttempts, ticket });
         }
         const remaining = textInputWaitMs - (Date.now() - typedAt);
         if (remaining > 0) {
@@ -961,6 +797,7 @@ async function sendMessageWithSubmitVerification(params) {
     }
     // 3. Submit as a separate command (double Enter for vibe-local's IME mode).
     for (let i = 0; i < Math.max(1, submitEnterCount); i++) {
+        assertInputOwner(ticket, cliToolId, 'Enter', true);
         await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
         if (i < submitEnterCount - 1) {
             await new Promise((resolve) => setTimeout(resolve, interEnterWaitMs));
@@ -978,7 +815,7 @@ async function sendMessageWithSubmitVerification(params) {
     for (let attempt = 0; attempt <= attempts; attempt++) {
         await new Promise((resolve) => setTimeout(resolve, verifyDelayMs));
         const output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
-        const state = classifySubmit(output, cliToolId, message, composer);
+        const state = (0, submit_composer_read_1.classifySubmit)(output, cliToolId, message, composer);
         if (state === 'submitted') {
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
             return;
@@ -990,7 +827,12 @@ async function sendMessageWithSubmitVerification(params) {
             // (flavor B). Clear the input line (best-effort) and surface the failure
             // to the caller instead of ever resending Enter.
             try {
-                await (0, tmux_1.clearInputLine)(sessionName);
+                if (ticket.isCurrent()) {
+                    await (0, tmux_1.clearInputLine)(sessionName);
+                }
+                else {
+                    logger.error('submit-clear-input-skipped-not-owner', { sessionName, cliToolId, generation: ticket.generation });
+                }
             }
             catch (clearError) {
                 logger.error('submit-clear-input-failed', {
@@ -1003,15 +845,31 @@ async function sendMessageWithSubmitVerification(params) {
             logger.error('submit-replaced-by-tui-completion', { sessionName, cliToolId, attempt });
             throw new Error(`Message was replaced by a TUI autocompletion for session ${sessionName}; the input no longer matches the sent text. Cleared the input line without submitting to avoid executing a different command.`);
         }
-        // state === 'pending' after the final resend's read-back: give up below.
+        // state === 'pending' / 'indeterminate' after the final read-back: give up below.
         if (attempt === attempts)
             break;
+        // state === 'indeterminate' (Issue #3906) — no Enter: the composer does not
+        // show the body, so another Enter could submit whatever it does show.
+        if (state === 'indeterminate') {
+            logger.warn('submit-not-confirmed:composer-unreadable', { sessionName, cliToolId, attempt });
+            continue;
+        }
+        // Issue #3945 (review #1): a paste placeholder that does not count this
+        // body is not this body. It can only be a paste that arrived after the
+        // initial Enter (a carried send's, past its mark), and another Enter would
+        // submit it. One that counts exactly this body cannot be told apart: that
+        // Enter is the accepted gap (LATE_TOKEN_AFTER_ENTER_SAME_COUNT in the tests).
+        if (composerShowsForeignPasteToken(output, cliToolId, message, composer)) {
+            logger.warn('submit-not-confirmed:foreign-paste-token', { sessionName, cliToolId, attempt });
+            continue;
+        }
         // state === 'pending' — still typed-but-unsent, resend a single Enter and re-check.
         logger.warn('submit-not-confirmed:resending-enter', {
             sessionName,
             cliToolId,
             attempt,
         });
+        assertInputOwner(ticket, cliToolId, 'a resent Enter', true);
         await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
     }
     (0, tmux_capture_cache_1.invalidateCache)(sessionName);