commandmate 0.49.0 → 0.49.2

package/dist/server/src/lib/cli-tools/submit-verified-sender.js

@@ -79,6 +79,23 @@
  * codex, Enter now waits until the composer shows the typed body
  * ({@link confirmTypedBodyLanded}); a body that never appears THROWS before
  * Enter, as #2464 does for a paste.
+ *
+ * Issue #3945 is two sends to one instance at once. A send that withdrew its
+ * body, or cleared before typing, erased whatever was in the composer — another
+ * send's body included — and a codex placeholder carries only a count, so a
+ * late one could not be told from the next send's. A send now runs as the
+ * instance's only writer (`lib/session/instance-input-lock`), re-reads the pane
+ * once it owns it ({@link recheckComposerBeforeInput}),
+ * checks it still owns the composer before every key, watches an `unseen`
+ * paste a little longer before giving up, and leaves a mark for a body that
+ * may still arrive, which the next send waits out ({@link waitOutCarriedPaste}).
+ *
+ * Issue #4035 is a claude session's first prompt reported sent when it was
+ * not. Keys typed right after the prompt appeared were drawn ~1 s later and
+ * their Enter was lost, while the read-back still showed the dim placeholder
+ * (rule F). On that first prompt a B or F verdict now waits for claude's own
+ * `UserPromptSubmit` ({@link awaitPromptReport}), and a later send that clears
+ * a body this one called sent says so ({@link reportSubmittedBodyInComposer}).
  */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
@@ -114,10 +131,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.LITERAL_SEND_MAX_BYTES = void 0;
-exports.classifySubmit = classifySubmit;
-exports.isSubmitted = isSubmitted;
-exports.classifyPasteLanded = classifyPasteLanded;
+exports.PROMPT_REPORT_WAIT_MS = exports.LITERAL_SEND_MAX_BYTES = exports.isSubmitted = exports.classifySubmitWithRule = exports.classifySubmit = exports.classifyPasteLanded = exports.recheckComposerBeforeInput = void 0;
 exports.clearComposerBeforeSend = clearComposerBeforeSend;
 exports.sendMessageWithSubmitVerification = sendMessageWithSubmitVerification;
 const childProcess = __importStar(require("child_process"));
@@ -127,19 +141,23 @@ const composer_spec_1 = require("./composer-spec");
 const cli_patterns_1 = require("../detection/cli-patterns");
 const cli_tool_timing_config_1 = require("../../config/cli-tool-timing-config");
 const logger_1 = require("../../lib/logger");
+const global_state_1 = require("../../lib/global-state");
 const composer_clear_1 = require("../../lib/session/composer-clear");
+Object.defineProperty(exports, "recheckComposerBeforeInput", { enumerable: true, get: function () { return composer_clear_1.recheckComposerBeforeInput; } });
+const prompt_submit_receipt_1 = require("../../lib/session/prompt-submit-receipt");
+const send_attempt_state_1 = require("../../lib/session/send-attempt-state");
+const send_attempt_types_1 = require("../../lib/session/send-attempt-types");
+const instance_input_lock_1 = require("../../lib/session/instance-input-lock");
 const composer_text_1 = require("../../lib/detection/composer-text");
+const submit_composer_read_1 = require("./submit-composer-read");
+// Issue #3963: the composer reads moved to `submit-composer-read`; re-exported
+// so every caller and test keeps importing them from here.
+var submit_composer_read_2 = require("./submit-composer-read");
+Object.defineProperty(exports, "classifyPasteLanded", { enumerable: true, get: function () { return submit_composer_read_2.classifyPasteLanded; } });
+Object.defineProperty(exports, "classifySubmit", { enumerable: true, get: function () { return submit_composer_read_2.classifySubmit; } });
+Object.defineProperty(exports, "classifySubmitWithRule", { enumerable: true, get: function () { return submit_composer_read_2.classifySubmitWithRule; } });
+Object.defineProperty(exports, "isSubmitted", { enumerable: true, get: function () { return submit_composer_read_2.isSubmitted; } });
 const logger = (0, logger_1.createLogger)('cli-tools/submit-verified-sender');
-/**
- * Version-resilient pasted-text placeholder.
- *
- * Broader than PASTED_TEXT_PATTERN (`/\[Pasted text #\d+/`) so it still matches
- * when a CLI version drops the `#N` and renders `[Pasted text +46 lines]`
- * (Issue #1469 condition 2). Used ONLY as a positive "still in the input box"
- * signal — never as the sole submit gate — so applying it to every tool is safe:
- * a tool that never renders it simply never matches.
- */
-const PASTE_PLACEHOLDER_PATTERN = /\[Pasted text[\s#]/;
 /**
  * Largest body typed as keystrokes (`send-keys -l`); anything longer is pasted
  * (Issue #2464).
@@ -178,558 +196,33 @@ const TYPED_BODY_POLL_MS = 50;
 const DEFAULT_TYPED_BODY_ATTEMPTS = 100;
 /** Per-command timeout for `load-buffer` / `paste-buffer`, as for every other tmux call. */
 const PASTE_COMMAND_TIMEOUT_MS = 5000;
-/** Makes each send's tmux paste buffer name unique within this process. */
-let pasteBufferSeq = 0;
-/**
- * A slash-command sitting on the input line (Issue #1501).
- *
- * TUI completion popups replace a typed slash command with a highlighted menu
- * item (`/status` -> `/statusline`, `/review` -> `/teamwork-preview`); the
- * result is always another slash command. Scoping the "replaced" verdict to
- * `/…` text keeps idle-prompt placeholders that some TUIs paint on an empty
- * composer (gemini's "Type your message or @path", claude's hints, "? for
- * shortcuts") — none of which start with `/` — from being mistaken for a
- * substitution, so a genuinely-submitted message never fails spuriously.
- */
-const REPLACEMENT_COMMAND_PATTERN = /^\/[A-Za-z]/;
 /**
- * Prompt input-line markers across the marker-drawing TUIs.
- * claude/gemini/copilot: `>` or `❯`; codex: `›`; antigravity: `>`;
- * vibe-local: `ctx:N% ❯`. Leading whitespace is tolerated (tmux padding).
- *
- * Issue #1906 scopes this to the tools whose {@link ComposerSpec.reader} is
- * `input-line-marker`. opencode draws no marker at all, so applying it there was
- * wrong in both directions — see {@link readComposer}.
+ * Makes each send's tmux paste buffer name unique within this process — on
+ * `globalThis` (Issue #3945 review #11): tmux buffers are server-wide, and a
+ * module-local counter restarts at 0 in every bundle `next dev` loads this file
+ * into, so two sessions' sends could load into one buffer name (the second
+ * `load-buffer` overwriting the first before its `paste-buffer`).
  */
-const INPUT_LINE_MARKER = /^\s*(?:ctx:\d+%\s*)?[>❯›]/;
+const pasteBufferSeq = (0, global_state_1.getOrInitGlobal)('__submitPasteBufferSeq', () => ({ last: 0 }));
 /**
- * Lines of pane tail to inspect for the "is the tool generating?" signal.
- *
- * Distinct from `ComposerSpec.verifyCaptureLines`, which sizes the tmux
- * capture: the busy marker of every tool lives in a status bar pinned to the
- * bottom of the pane, so it is read from a short tail even when the capture
- * itself is opencode's whole 200-row frame. Widening it to that frame would
- * match `esc interrupt` printed inside a reply.
- *
- * "The bottom" is the last row that holds anything (Issue #2464). codex,
- * Command Code and agy draw inline from the TOP of the 1000-row pane, so the
- * last twelve rows of the capture are blank padding — measured at rows 306,
- * 297 and 286 of 1,002 — and reading them found no composer on any send to
- * those three tools. See {@link withoutTrailingBlankRows}.
+ * Rows read for the re-check under the input lock (Issue #3945). The same
+ * capture `clearComposer` takes for its first read, so on a tool that clears
+ * before sending that read is the re-check's frame and no extra read is made.
  */
-const VERIFY_WINDOW_LINES = 12;
-/**
- * Read the composer out of a captured frame.
- *
- * Two readers, because the two families of TUI say "this is the input line" in
- * incompatible ways:
- *
- * - **marker tools** (`reader: 'input-line-marker'`) draw a `>` / `❯` / `›` at
- *   the start of the row. Scanned bottom-up over the tail window so a status bar
- *   below the box does not hide it.
- * - **opencode** draws a box with a gutter and no marker anywhere. Its buffer
- *   rows are located structurally by {@link findOpenCodeComposerRows} (#1911's
- *   chrome walk), and `Ask anything...` inside that box is opencode's own way of
- *   saying the buffer is empty (#1883) rather than a row of text.
- *
- * Before this split, opencode went through the marker reader, which is wrong
- * both ways round. It never matched opencode's composer, so EVERY opencode send
- * was classified `submitted` without evidence — #1471's "the Enter was
- * swallowed" recovery has never once run on opencode. And when a `>` did land in
- * the window from somewhere else (a Markdown quote in a reply), the reader
- * treated that row as the input line and answered from it.
- *
- * Issue #1933 turned "which reader" from a `cliToolId === 'opencode'` test plus
- * a set membership test into {@link ComposerSpec.reader}, so the answer is one
- * declaration the tool owns rather than two tables a new tool has to be added
- * to. `unreadable` is the third arm, and it is the one #1906 found opencode
- * silently occupying: it means every send is classified `submitted` without
- * evidence, so it is a state to declare knowingly, never to fall into.
- */
-function readComposer(reader, lines, windowLines) {
-    if (reader === 'opencode-box') {
-        const rows = (0, cli_patterns_1.findOpenCodeComposerRows)(lines);
-        if (rows === null)
-            return { kind: 'absent' };
-        // The placeholder is painted only while the buffer is empty, and only
-        // inside the box — hence matched on the raw, still-guttered row (#1883).
-        if (rows.some((row) => cli_patterns_1.OPENCODE_IDLE_COMPOSER_PATTERN.test(row)))
-            return { kind: 'empty' };
-        const first = rows.map(cli_patterns_1.stripOpenCodeGutter).find((row) => row.length > 0);
-        if (first === undefined)
-            return { kind: 'empty' };
-        return { kind: 'text', text: first, rows };
-    }
-    if (reader !== 'input-line-marker')
-        return { kind: 'absent' };
-    const inputLine = findInputLine(windowLines);
-    if (inputLine === null)
-        return { kind: 'absent' };
-    const stripped = stripInputMarker(inputLine);
-    if (stripped.length === 0)
-        return { kind: 'empty' };
-    return { kind: 'text', text: stripped, rows: [inputLine] };
-}
-/**
- * The captured rows without the blank rows under the last drawn one
- * (Issue #2464).
- *
- * `capture-pane` returns every row of the pane, and a TUI that renders inline
- * from the top (codex, Command Code, agy) fills only the first few hundred of
- * the 1000 rows the session is created with. The composer is the last thing
- * such a TUI draws, so "the tail of the pane" has to mean "the tail of what is
- * drawn" — otherwise the tail window is all padding, no composer is ever found,
- * and every send to those tools classifies as `submitted` whatever the
- * composer actually holds. A bottom-anchored TUI (claude) has no trailing blank
- * rows, so for it this is the identity.
- */
-function withoutTrailingBlankRows(lines) {
-    let end = lines.length;
-    while (end > 0 && lines[end - 1].trim() === '')
-        end--;
-    return lines.slice(0, end);
-}
+const RECHECK_CAPTURE_LINES = 200;
+/** How often a send waiting out a carried paste mark reads the composer (Issue #3945). */
+const CARRIED_MARK_POLL_MS = 200;
 /** Default bounded recovery Enters (each read back) before giving up (throwing). */
 const DEFAULT_VERIFY_ATTEMPTS = 4;
 /**
- * First non-blank line of the message, trimmed. This is what a TUI shows on the
- * prompt line before the body folds into a paste placeholder. NOT truncated:
- * the replacement check (inputMatchesBody) needs the full first line so that a
- * completion suffix (`/status` -> `/statusline`) is not mistaken for the body.
- */
-function firstNonBlankLine(message) {
-    const line = message
-        .split('\n')
-        .map((l) => l.trim())
-        .find((l) => l.length > 0);
-    return line ?? '';
-}
-/**
- * Locate the active input line within the pane tail: the last line that begins
- * with a prompt marker. Scanned bottom-up so a status-bar/footer line rendered
- * BELOW the input box (antigravity's "? for shortcuts", vibe-local's status bar)
- * does not hide the real input line above it.
+ * How long a B/F verdict on a session's first prompt waits for the agent's own
+ * report of it (Issue #4035). Claude 2.1.314 reported the first prompt 0.66–0.74 s
+ * after the send began in all 29 submitted first sends measured; an unsent body
+ * was drawn into the composer 0.9–1.7 s after its Enter.
  */
-function findInputLine(windowLines) {
-    for (let i = windowLines.length - 1; i >= 0; i--) {
-        if (INPUT_LINE_MARKER.test(windowLines[i])) {
-            return windowLines[i];
-        }
-    }
-    return null;
-}
-/** Input line text with the prompt marker stripped and surrounding space trimmed. */
-function stripInputMarker(inputLine) {
-    return inputLine.replace(INPUT_LINE_MARKER, '').trim();
-}
-/**
- * Whether the (marker-stripped, non-empty) input-line text is still our
- * unsent body rather than a TUI-substituted command.
- *
- * The still-unsent body appears verbatim on the input line. Line wrapping can
- * visually truncate it to a PREFIX of the first line, but a completion popup
- * always produces a DIFFERENT string — the body plus a completion suffix
- * (`/status` -> `/statusline`) or an unrelated command (`/review` ->
- * `/teamwork-preview`) — which is never a prefix of the body. So the body is
- * "still there" iff the input text is a prefix of (or equals) the body's first
- * line. This deliberately rejects `/statusline` for a `/status` body: the safe
- * rule is "input text that is not the body (or a prefix of it) is NOT resent".
- */
-function inputMatchesBody(strippedInput, message) {
-    const bodyFirstLine = firstNonBlankLine(message);
-    if (bodyFirstLine.length === 0)
-        return false;
-    return bodyFirstLine.startsWith(strippedInput);
-}
-/**
- * Collapsed-paste placeholders, as measured at the production 200x1000
- * geometry (Issue #2464, `tests/fixtures/long-body-2464/`):
- *
- *   claude 2.1.268  `[Pasted text #86 +59 lines]` for 60 lines, `[Pasted text #87]` for one
- *   agy 1.2.0       `[Pasted text #5 +60 lines]` for 60 lines, `[Pasted text #6 12288 chars]` for one
- *   codex 0.154.0   `[Pasted Content 12288 chars]`
- *   Command Code 1.53.0  `[PROBE P12k… +60L]` — the first ten characters, then the line count
- *
- * The `#N` stays optional for #1469's version drift (`[Pasted text +46 lines]`).
- */
-const PASTE_TOKEN_PATTERNS = [
-    {
-        pattern: /\[Pasted text(?: #\d+)?(?: \+(\d+) lines?| (\d+) chars?)?\]/g,
-        read: (m) => m[1] !== undefined ? { lines: Number(m[1]) } : m[2] !== undefined ? { chars: Number(m[2]) } : {},
-    },
-    { pattern: /\[Pasted Content (\d+) chars?\]/g, read: (m) => ({ chars: Number(m[1]) }) },
-    { pattern: /\[([^\]\n]*?)… \+(\d+)L\]/g, read: (m) => ({ head: m[1], lineTotal: Number(m[2]) }) },
-];
-/** Every paste placeholder on a composer row, and the text left around them. */
-function findPasteTokens(text) {
-    const tokens = [];
-    let rest = text;
-    for (const { pattern, read } of PASTE_TOKEN_PATTERNS) {
-        for (const match of text.matchAll(pattern)) {
-            tokens.push(read(match));
-            rest = rest.replace(match[0], '');
-        }
-    }
-    return { tokens, rest: rest.trim() };
-}
-/**
- * Does one placeholder account for the whole body?
- *
- * Counts below the body's mean the paste is still arriving; counts above it mean
- * the composer holds more than the body. The two units that differ between
- * tools for the same `+M lines` wording (claude: 59 for a 60-line body, agy: 60)
- * are both accepted — a bracketed paste arrives as one unit, so the failure this
- * guards against is a count that is wildly short (the 24-byte tail of #2464),
- * not one that is off by one line.
- */
-function comparePasteToken(token, message) {
-    const newlines = (message.match(/\n/g) ?? []).length;
-    if (token.head !== undefined) {
-        const normalizedHead = token.head.replace(/\s+/g, ' ').trim();
-        if (!message.replace(/\s+/g, ' ').startsWith(normalizedHead))
-            return 'mismatch';
-    }
-    let observed;
-    let accepted;
-    if (token.chars !== undefined) {
-        observed = token.chars;
-        accepted = [[...message].length, message.length];
-    }
-    else if (token.lineTotal !== undefined) {
-        observed = token.lineTotal;
-        accepted = [newlines + 1];
-    }
-    else if (token.lines !== undefined) {
-        observed = token.lines;
-        accepted = [newlines, newlines + 1];
-    }
-    else {
-        // claude's bare `[Pasted text #N]` is what it draws for a single line.
-        return newlines === 0 ? 'landed' : 'pasting';
-    }
-    if (accepted.includes(observed))
-        return 'landed';
-    return observed < Math.min(...accepted) ? 'pasting' : 'mismatch';
-}
-/**
- * The composer as {@link classifySubmit} reads it (Issue #3205).
- *
- * {@link readComposer}'s marker reader takes the bottom-most `›` row of the
- * tail as the input line. A codex composer holding several lines draws its
- * continuation rows under the `›` row, and when one of them itself begins with
- * `›` — a body quoting a dialog's `› 1. Yes, proceed (y)` — that continuation
- * row was read as the input line: its text is not the body's first line, so a
- * body still sitting in the composer was classified `submitted` (F). Measured:
- * `tests/fixtures/codex-multiline-composer-3205/tc104-raw-pane.txt`.
- *
- * So for codex a composer of two or more rows is read with
- * `extractComposerText` — the #1890 reader `awaitTypedBody` already uses —
- * and its first line is the input line. Every other frame (a one-row
- * composer, an empty or ghost one, none at all, another tool) is read exactly
- * as before.
- *
- * Issue #3880 (H-2): this is also the reader before Enter
- * ({@link classifyPasteLanded}) and in the error text ({@link describeComposer}).
- * The paste check used to read the twelve-row tail with {@link readComposer}
- * alone, so a codex composer taller than that window (a 20-line paste, or 600
- * bytes wrapped in a narrow pane) put its `›` row above the window — `unseen`,
- * and the body that was in the composer was withdrawn and reported as not
- * landed — and a continuation row starting with `>` (a Markdown quote) was taken
- * for the input line — `mismatch`. The same frame read after Enter was
- * `pending`. One reader on both sides of Enter keeps the two verdicts about the
- * same composer.
- */
-/**
- * Everything a codex composer holds, for deciding that a pasted body arrived in
- * full (Issue #3880).
- *
- * `extractComposerText` answers for the UI: its text stops at 2,000 characters,
- * at 40 rows and at the composer's first blank row, so a composer that matches
- * it may still be missing the rest of the body — or hold something after it.
- * This reads the raw rows instead, from the `›` row down to the last block of
- * the frame (codex's model / cwd footer), so a body with blank lines, more than
- * 40 rows or more than 2,000 characters is compared whole, and anything typed
- * after the body is part of what is compared.
- */
-function codexComposerRegion(output) {
-    const raw = output.split('\n');
-    const box = (0, composer_text_1.findCodexInputBox)(raw);
-    if (box === null)
-        return null;
-    return codexRegionFrom(raw, box.firstRow, box.lastRow);
-}
-/**
- * {@link codexComposerRegion} from a known `›` row (Issue #3906): the rows from
- * `firstRow` down to the frame's last block (the footer), ANSI and glyph
- * stripped. `lastRow` is the end of the `›` row's own block, so a composer that
- * is itself the frame's last block is read to the end.
- */
-function codexRegionFrom(raw, firstRow, lastRow) {
-    const isBlank = (row) => (0, cli_patterns_1.stripAnsi)(row).trim() === '';
-    let end = raw.length - 1;
-    while (end >= 0 && isBlank(raw[end]))
-        end--;
-    let lastBlockStart = end;
-    while (lastBlockStart > 0 && !isBlank(raw[lastBlockStart - 1]))
-        lastBlockStart--;
-    const stop = lastBlockStart > lastRow ? lastBlockStart - 1 : end;
-    const rows = raw.slice(firstRow, stop + 1).map((row) => (0, cli_patterns_1.stripAnsi)(row));
-    rows[0] = rows[0].replace(/^\s*\u203A ?/, '');
-    return rows.join('\n');
-}
-/** End (inclusive) of the blank-row-delimited block that starts at `row`. */
-function blockEndFrom(raw, row) {
-    let end = row;
-    while (end + 1 < raw.length && (0, cli_patterns_1.stripAnsi)(raw[end + 1]).trim() !== '')
-        end++;
-    return end;
-}
-/** The bottom-most row of `windowLines` the marker reader takes as the input line, as a frame index. */
-function markerRowIndex(windowLines, windowStart) {
-    for (let i = windowLines.length - 1; i >= 0; i--) {
-        if (INPUT_LINE_MARKER.test(windowLines[i]))
-            return windowStart + i;
-    }
-    return -1;
-}
-function readSubmitComposer(output, cliToolId, reader, lines, windowLines, message) {
-    if (cliToolId === 'codex' && reader === 'input-line-marker') {
-        const raw = output.split('\n');
-        const windowStart = lines.length - windowLines.length;
-        const read = (0, composer_text_1.extractComposerText)(output, cliToolId);
-        if (read.state === 'content') {
-            const box = (0, composer_text_1.findCodexInputBox)(raw);
-            // Issue #3906: a dialog option drawn below the composer the extractor
-            // located means the dialog is what the pane shows now, on every branch
-            // below — that composer is one left from before, not this send's.
-            if (box !== null && (0, composer_text_1.codexDialogBelow)(raw, box.firstRow))
-                return { kind: 'absent' };
-            const outsideWindow = box !== null && box.firstRow < windowStart;
-            const region = codexComposerRegion(output) ?? read.text;
-            if (read.text.includes('\n')) {
-                // Issue #3906: a composer of many rows with no blank line (20 lines) has
-                // its `›` row above the window too, and is marked so like the others.
-                return {
-                    kind: 'text',
-                    text: firstNonBlankLine(read.text),
-                    rows: read.text.split('\n'),
-                    region,
-                    ...(outsideWindow ? { outsideWindow } : {}),
-                };
-            }
-            // Issue #3906 (1): the `›` row sits above the twelve-row window (a one-line
-            // paragraph, a blank line, then a tall one). The marker reader would see no
-            // input line there — `unseen` before Enter, `submitted` after it — so the
-            // composer `extractComposerText` located is read instead, whole.
-            if (outsideWindow && (0, composer_text_1.findCodexLiveComposerRow)(raw) === box.firstRow) {
-                return { kind: 'text', text: read.text.trim(), rows: [raw[box.firstRow]], region, outsideWindow: true };
-            }
-            // Issue #3880 (N1): a one-row excerpt is read as before for its verdict
-            // after Enter, but still carries the whole region — `head` with the rest of
-            // the body under a blank row is one excerpt row and must not pass for the
-            // whole body before Enter.
-            const single = readComposer(reader, lines, windowLines);
-            return single.kind === 'text' ? { ...single, region } : single;
-        }
-        if (read.state === 'no_composer') {
-            // Issue #3906 (2): more paragraphs than the four blocks the extractor
-            // searches. Whatever the marker reader takes must carry the whole region,
-            // so the composer's first line alone never passes for the body. The row is
-            // the live composer only when no dialog option is drawn below it
-            // ({@link findCodexLiveComposerRow}, the order `findCodexBottomGlyphRow`
-            // reads a frame in): a composer row left above an approval dialog is
-            // never this send's composer, however its text reads.
-            const composerRow = (0, composer_text_1.findCodexLiveComposerRow)(raw);
-            if (composerRow >= 0) {
-                const region = codexRegionFrom(raw, composerRow, blockEndFrom(raw, composerRow));
-                const text = stripInputMarker((0, cli_patterns_1.stripAnsi)(raw[composerRow]));
-                if (composerRow >= windowStart) {
-                    const single = readComposer(reader, lines, windowLines);
-                    if (single.kind === 'text' && markerRowIndex(windowLines, windowStart) === composerRow) {
-                        return { ...single, region };
-                    }
-                    return single;
-                }
-                // Above the window as well, with no dialog below it.
-                if (message !== undefined && text.length > 0 && inputMatchesBody(text, message)) {
-                    return { kind: 'text', text, rows: [raw[composerRow]], region, outsideWindow: true };
-                }
-                // Not the body's first line. A composer whose own block is empty or
-                // placeholder-only is empty; real text is read too — a `/…` command
-                // there is `replaced` as it is inside the window, and anything else is
-                // not proof that the message left ({@link classifySubmit}: `indeterminate`).
-                const held = (0, composer_text_1.readCodexComposerFrom)(raw.slice(0, blockEndFrom(raw, composerRow) + 1), composerRow);
-                if (held.state !== 'content')
-                    return { kind: 'empty' };
-                return {
-                    kind: 'text',
-                    text: firstNonBlankLine(held.text),
-                    rows: [raw[composerRow]],
-                    region,
-                    outsideWindow: true,
-                };
-            }
-        }
-    }
-    return readComposer(reader, lines, windowLines);
-}
-/**
- * Classify a captured pane into submitted / pending / replaced (Issue #1501).
- *
- * Version-independent by design — does NOT require the paste placeholder:
- *   A. The tool is generating a response              -> submitted.
- *   B. No composer, or the composer is empty           -> submitted.
- *   C. A paste placeholder is folded in the composer   -> pending (Enter eaten).
- *   D. The body is still verbatim in the composer      -> pending (resend Enter).
- *   E. A DIFFERENT slash command is in the composer    -> replaced (TUI popup
- *      autocompleted the command; clear the line and throw, never resend Enter).
- *   F. Any other non-empty text (idle placeholder/hint) -> submitted (unchanged
- *      pre-#1501 permissive default, so normal sends never spuriously fail) —
- *      except in a codex composer above the read window -> indeterminate
- *      (Issue #3906).
- *
- * C–F are scoped to the composer only, so the user-message echo that a TUI
- * prints into its history above the prompt never causes a false verdict.
- *
- * Issue #1906: "the composer" is read per tool by {@link readComposer} rather
- * than by looking for a `>` in the last twelve rows. For opencode — which draws
- * no marker — that read was unreachable, so every send reached F (in fact B) and
- * this function has never returned anything but `submitted` for it.
- *
- * Issue #2464: the tail window starts at the last drawn row, not at the last row
- * of the pane ({@link withoutTrailingBlankRows}), and C recognises every tool's
- * paste placeholder ({@link findPasteTokens}), not only claude's.
- *
- * @param output - Captured pane, ANSI intact. For opencode this must be the
- *   whole pane; {@link ComposerSpec.verifyCaptureLines} is what asks tmux for it.
- * @param cliToolId - CLI tool id, for the "generating" detector
- * @param message - The body that was typed
- * @param composer - The tool's composer description (Issue #1933). Defaults to
- *   the tool's own, so every existing three-argument caller is unchanged.
- */
-function classifySubmit(output, cliToolId, message, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
-    const clean = (0, cli_patterns_1.stripAnsi)(output);
-    const lines = withoutTrailingBlankRows(clean.split('\n'));
-    const windowLines = lines.slice(-VERIFY_WINDOW_LINES);
-    const windowStr = windowLines.join('\n');
-    // A. Actively generating a response => the message was accepted. Read from the
-    //    tail window for every tool: each one's busy marker lives in a status bar
-    //    pinned to the bottom of the pane, and widening it to opencode's whole
-    //    frame would match `esc interrupt` printed inside a reply.
-    if ((0, cli_patterns_1.detectThinking)(cliToolId, windowStr)) {
-        return 'submitted';
-    }
-    const composer = readSubmitComposer(output, cliToolId, composerSpec.reader, lines, windowLines, message);
-    // B. No composer visible (scrolled off / dialog / still starting), or the
-    //    composer is empty => the message left the box => submitted.
-    if (composer.kind !== 'text') {
-        return 'submitted';
-    }
-    // C. A paste placeholder is still folded into the composer => body is there.
-    if (composer.rows.some((row) => PASTE_PLACEHOLDER_PATTERN.test(row) || findPasteTokens(row).tokens.length > 0)) {
-        return 'pending';
-    }
-    // D. The typed body is still sitting in the composer => resend Enter.
-    if (inputMatchesBody(composer.text, message)) {
-        return 'pending';
-    }
-    // E. A different slash command is in the composer => a completion popup
-    //    replaced what we typed. (Scoped to `/…` so idle-prompt placeholders that
-    //    some TUIs paint on an empty composer are never mistaken for this.)
-    if (REPLACEMENT_COMMAND_PATTERN.test(composer.text)) {
-        return 'replaced';
-    }
-    // F. Non-empty, non-command steady-state text (idle placeholder / hint) =>
-    //    submitted, preserving the pre-#1501 permissive default. Not for a codex
-    //    composer above the window (Issue #3906): before #3906 that frame was
-    //    read as no composer at all; text there that is not the body says
-    //    neither that the message left nor that Enter would send it.
-    return composer.outsideWindow ? 'indeterminate' : 'submitted';
-}
-/**
- * Backward-compatible boolean view of {@link classifySubmit}: submitted vs not.
- * A `replaced` verdict is NOT "submitted", so this returns false for it too.
- */
-function isSubmitted(output, cliToolId, message, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
-    return classifySubmit(output, cliToolId, message, composerSpec) === 'submitted';
-}
-/**
- * How much of a pasted body the composer shows, read BEFORE Enter (Issue #2464).
- *
- * The question #2464 needs answered is not "did Enter work" but "is what Enter
- * would submit the message we sent". Claude kept the last 24 bytes of a 12 KB
- * brief as ordinary composer text; every check that runs after Enter saw an
- * empty box and a generating model, i.e. a perfect send. So the composer is
- * judged here, while pressing Enter can still be withheld:
- *
- *   1. A collapsed placeholder is compared by the count the TUI prints — lines
- *      for claude, agy and Command Code, characters for codex and agy's
- *      single-line form ({@link comparePasteToken}).
- *   2. Plain text is the body only if it is the body's BEGINNING. Text that
- *      occurs in the body but not at its start is exactly the #2464 tail, and is
- *      a mismatch rather than "not drawn yet".
- *   3. Anything else — the idle placeholder, a ghost suggestion, no composer —
- *      shows nothing of the body. `unseen`, which the caller decides about.
- *
- * Reads the composer the way {@link classifySubmit} does
- * ({@link readSubmitComposer}), so a history echo of an earlier message above the
- * composer is never mistaken for this one, and a frame both functions see holds
- * the same composer for both (Issue #3880). A multi-row codex composer is
- * compared as a whole ({@link codexComposerRegion}), whitespace removed
- * (wrapping and continuation indent proof): only the WHOLE body is `landed`;
- * the body's beginning alone is `pasting` (never enough to press Enter on), the
- * body plus anything else or text from inside it is `mismatch`. The whole body
- * is checked before placeholders, so a body that itself quotes
- * `[Pasted Content 600 chars]` is its own text, not codex's placeholder; a real
- * placeholder is only ever the composer's first row.
- *
- * Issue #3906: a codex composer outside the twelve-row window, or split into
- * more blocks than `extractComposerText` searches, is still read with its whole
- * region ({@link readSubmitComposer}), so neither `unseen` for a body that is
- * there nor `landed` on its first line alone.
- */
-function classifyPasteLanded(output, cliToolId, message, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
-    const lines = withoutTrailingBlankRows((0, cli_patterns_1.stripAnsi)(output).split('\n'));
-    const composer = readSubmitComposer(output, cliToolId, composerSpec.reader, lines, lines.slice(-VERIFY_WINDOW_LINES), message);
-    if (composer.kind !== 'text')
-        return 'unseen';
-    if (composer.region !== undefined) {
-        const shown = compactText(composer.region);
-        const body = compactText(message);
-        if (shown === body)
-            return 'landed';
-        const placeholder = findPasteTokens(composer.text);
-        if (placeholder.tokens.length > 0) {
-            // A placeholder plus anything else — on its row or under it — is not the body as sent.
-            const below = compactText(composer.region.split('\n').slice(1).join('\n'));
-            if (placeholder.tokens.length > 1 || placeholder.rest !== '' || below !== '')
-                return 'mismatch';
-            return comparePasteToken(placeholder.tokens[0], message);
-        }
-        if (body.startsWith(shown))
-            return 'pasting';
-        // The body's beginning followed by something else, the body plus more, or a
-        // piece from inside it: the composer holds something other than the body.
-        if (inputMatchesBody(composer.text, message) || shown.startsWith(body) || body.includes(shown)) {
-            return 'mismatch';
-        }
-        return 'unseen';
-    }
-    // The whole body on one row is the body, even when it quotes a placeholder.
-    if (compactText(composer.text) === compactText(message))
-        return 'landed';
-    const { tokens, rest } = findPasteTokens(composer.text);
-    if (tokens.length === 0) {
-        if (inputMatchesBody(composer.text, message))
-            return 'landed';
-        if (message.includes(composer.text))
-            return 'mismatch';
-        return 'unseen';
-    }
-    if (tokens.length > 1 || rest !== '')
-        return 'mismatch';
-    return comparePasteToken(tokens[0], message);
-}
+exports.PROMPT_REPORT_WAIT_MS = 5000;
+/** How often the report and the composer are looked at during that wait. */
+const PROMPT_REPORT_POLL_MS = 100;
 /** Run one tmux command, optionally feeding it `input` on stdin. */
 function runTmux(args, input) {
     return new Promise((resolve, reject) => {
@@ -756,12 +249,52 @@ function runTmux(args, input) {
  * per line for a TUI that did not ask for brackets. `-d` drops the buffer on
  * success; a failure drops it here, so no body is left behind in the server.
  *
- * @throws Error when either tmux command fails
+ * Issue #3945 (review-1 #2): ownership is asked again between the two commands,
+ * right before `paste-buffer` — the session may have been replaced while
+ * `load-buffer` ran. A lost ticket drops the buffer and throws before anything
+ * reaches the pane (`input lock lost, nothing was typed`).
+ *
+ * Issue #4011: a failed `load-buffer` throws with `delivery: 'not-started'`
+ * (the field `TmuxSendError` carries) — it runs before `paste-buffer`, so none
+ * of the body reached the pane, however it failed (an exit status or a timeout).
+ * Issue #4031: worded `Failed to load message into tmux buffer` and coded
+ * `PASTE_NOT_STARTED_CODE`, so `classifySendFailure` records it `not-sent`.
+ *
+ * @throws Error when either tmux command fails, or `ticket` lost the composer
  */
-async function pasteBody(sessionName, message) {
-    const bufferName = `cm-send-${process.pid}-${++pasteBufferSeq}`;
+async function pasteBody(sessionName, message, ticket, cliToolId) {
+    pasteBufferSeq.last += 1;
+    const bufferName = `cm-send-${process.pid}-${pasteBufferSeq.last}`;
     try {
         await runTmux(['load-buffer', '-b', bufferName, '-'], message);
+    }
+    catch (error) {
+        await runTmux(['delete-buffer', '-b', bufferName]).catch(() => undefined);
+        const errorMessage = error instanceof Error ? error.message : String(error);
+        // Issue #4031: its own wording and code, apart from `paste-buffer`'s
+        // failure below (whose body may be on the pane), so the send is recorded
+        // `not-sent` with or without a bound relay.
+        throw Object.assign(new Error(`Failed to load message into tmux buffer: ${errorMessage}`), {
+            delivery: 'not-started',
+            code: send_attempt_types_1.PASTE_NOT_STARTED_CODE,
+        });
+    }
+    if (!ticket.isCurrent()) {
+        await runTmux(['delete-buffer', '-b', bufferName]).catch(() => undefined);
+        assertInputOwner(ticket, cliToolId, 'paste-buffer', false);
+    }
+    // Issue #3953: the send's stamp, as the typed branch takes it — after
+    // `load-buffer` (up to its timeout), right before the body reaches the pane.
+    // Issue #3992: a refused input boundary (#3957) stops the send here, with the
+    // body loaded but not pasted — the buffer is dropped before the refusal goes up.
+    try {
+        (0, instance_input_lock_1.noteInputStart)();
+    }
+    catch (error) {
+        await runTmux(['delete-buffer', '-b', bufferName]).catch(() => undefined);
+        throw error;
+    }
+    try {
         await runTmux(['paste-buffer', '-p', '-r', '-d', '-b', bufferName, '-t', (0, tmux_1.exactTarget)(sessionName)]);
     }
     catch (error) {
@@ -772,8 +305,8 @@ async function pasteBody(sessionName, message) {
 }
 /** The composer's first row, for an error message a person has to act on. */
 function describeComposer(output, cliToolId, composerSpec, message) {
-    const lines = withoutTrailingBlankRows((0, cli_patterns_1.stripAnsi)(output).split('\n'));
-    const composer = readSubmitComposer(output, cliToolId, composerSpec.reader, lines, lines.slice(-VERIFY_WINDOW_LINES), message);
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    const composer = (0, submit_composer_read_1.readSubmitComposer)(output, cliToolId, composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message);
     if (composer.kind === 'absent')
         return 'no composer on screen';
     if (composer.kind === 'empty')
@@ -787,15 +320,27 @@ function describeComposer(output, cliToolId, composerSpec, message) {
  * Leaving it would put the fragment in front of the next message. claude and
  * codex go through the verified #1879 loop (a paste can span rows); the rest
  * get the single `C-u` the #1501 path already sends to them.
+ *
+ * @returns Whether the composer was confirmed empty afterwards (Issue #3945):
+ *   false for a `C-u` nothing can read back, a failed clear, and a ticket that
+ *   no longer owns the composer (no key is sent then).
  */
-async function withdrawUnsentBody(sessionName, cliToolId, composerSpec) {
+async function withdrawUnsentBody(sessionName, cliToolId, composerSpec, ticket) {
+    // Issue #3945: only this send's own composer is taken back. A ticket that is
+    // no longer current means another writer owns the composer now, and what it
+    // holds is that writer's.
+    if (!ticket.isCurrent()) {
+        logger.error('paste-withdraw-skipped-not-owner', { sessionName, cliToolId, generation: ticket.generation });
+        return false;
+    }
     try {
         if (composerSpec.clearBeforeSend) {
-            await (0, composer_clear_1.clearComposer)(sessionName, cliToolId);
-        }
-        else {
-            await (0, tmux_1.clearInputLine)(sessionName);
+            const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId, { beforePass: () => ticket.isCurrent() });
+            return result.cleared;
         }
+        await (0, tmux_1.clearInputLine)(sessionName);
+        // One `C-u` into a composer nothing here can read: sent, never confirmed.
+        return false;
     }
     catch (clearError) {
         logger.error('paste-withdraw-failed', {
@@ -803,8 +348,86 @@ async function withdrawUnsentBody(sessionName, cliToolId, composerSpec) {
             cliToolId,
             error: clearError instanceof Error ? clearError.message : String(clearError),
         });
+        return false;
     }
 }
+/**
+ * Throw unless `ticket` still owns the composer (Issue #3945 stage 3). Called
+ * right before every key a send sends — body, paste, each Enter — so work still
+ * in flight after its ownership ended cannot reach the next owner's composer.
+ *
+ * @param typed - Whether any of the body may already be in the composer, which
+ *   decides how the failure classifies (`not-sent` before the body only).
+ */
+function assertInputOwner(ticket, cliToolId, step, typed) {
+    if (ticket.isCurrent())
+        return;
+    logger.error('input-lock-lost', { sessionName: ticket.sessionName, cliToolId, step, generation: ticket.generation });
+    if (!typed) {
+        throw new Error(`Session ${ticket.sessionName} was handed to another writer before ${step}; input lock lost, nothing was typed (Issue #3945).`);
+    }
+    throw new Error(`Session ${ticket.sessionName} was handed to another writer before ${step}; part of the message may be in its composer (Issue #3945).`);
+}
+/**
+ * Hold off typing while a carried paste mark is fresh (Issue #3945 stage 4).
+ *
+ * A previous send gave up on a body that may still be drawn. Until the mark
+ * expires, nothing of this send is typed: a placeholder of the same count as
+ * this body would be taken for it ({@link classifyPasteLanded} cannot tell
+ * them apart). What appears meanwhile is taken out at once — it is the previous
+ * send's, and this owner is the one left to handle it. A tool whose composer is
+ * not readable (no `clearBeforeSend`) only waits.
+ *
+ * @returns Whether there was a mark to wait out
+ */
+async function waitOutCarriedPaste(sessionName, cliToolId, composer, ticket) {
+    const mark = (0, instance_input_lock_1.getCarriedPasteMark)(sessionName);
+    if (mark === null)
+        return false;
+    logger.warn('carried-paste-mark-wait', {
+        sessionName,
+        cliToolId,
+        originGeneration: mark.originGeneration,
+        generation: ticket.generation,
+        remainingMs: mark.expiresAt - Date.now(),
+    });
+    while (Date.now() < mark.expiresAt) {
+        await new Promise((resolve) => setTimeout(resolve, Math.min(CARRIED_MARK_POLL_MS, mark.expiresAt - Date.now())));
+        if (!composer.clearBeforeSend)
+            continue;
+        assertInputOwner(ticket, cliToolId, 'the carried paste wait', false);
+        let frame;
+        try {
+            frame = await (0, tmux_1.capturePane)(sessionName, RECHECK_CAPTURE_LINES);
+        }
+        catch {
+            // The re-check after the wait decides about a pane that cannot be read.
+            continue;
+        }
+        if ((0, composer_clear_1.readClearComposer)(frame, cliToolId).state !== 'content')
+            continue;
+        const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId, {
+            initialCapture: frame,
+            beforePass: () => ticket.isCurrent(),
+        });
+        (0, tmux_capture_cache_1.invalidateCache)(sessionName);
+        logger.warn('carried-paste-withdrawn', {
+            sessionName,
+            cliToolId,
+            originGeneration: mark.originGeneration,
+            cleared: result.cleared,
+            discardedText: result.discardedText,
+        });
+    }
+    (0, instance_input_lock_1.clearExpiredCarriedPasteMark)(ticket);
+    return true;
+}
+/** Whether the composer in `output` holds any text at all, read as the sender reads it. */
+function composerHoldsText(output, cliToolId, composerSpec, message) {
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    return ((0, submit_composer_read_1.readSubmitComposer)(output, cliToolId, composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message)
+        .kind === 'text');
+}
 /**
  * Wait until the composer shows the whole pasted body; decide whether Enter
  * may be pressed (Issue #2464).
@@ -825,42 +448,99 @@ async function withdrawUnsentBody(sessionName, cliToolId, composerSpec) {
  * drawn in ways this module has not measured, and refusing on them would turn
  * "cannot see it" into "did not send it" for every long message they get.
  *
+ * Issue #3945 (stage 4): an `unseen` on a measured tool is not given up at the
+ * end of the 2 s. The composer is watched for {@link LATE_PASTE_OBSERVE_MS}
+ * more, still under the input lock — so whatever appears in it is this send's
+ * (or a person's typing), never another send's — and a placeholder or body that
+ * appears is withdrawn before the throw. A read that throws is a failure like
+ * the others: withdrawn, `body-not-landed`. When the body may still arrive —
+ * nothing of it was ever seen, it was only partly there, a read failed, or the
+ * withdrawal could not be confirmed — a carried mark holds the next send off
+ * the composer ({@link leaveCarriedPasteMark}).
+ *
  * @throws Error when the body cannot be confirmed in the composer
  */
 async function confirmPasteLanded(params) {
-    const { sessionName, message, cliToolId, composer, attempts } = params;
+    const { sessionName, message, cliToolId, composer, attempts, ticket } = params;
     let state = 'unseen';
     let output = '';
-    for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
-        await new Promise((resolve) => setTimeout(resolve, PASTE_LANDED_POLL_MS));
-        output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
-        state = classifyPasteLanded(output, cliToolId, message, composer);
-        if (state === 'landed' || state === 'mismatch')
-            break;
+    let readError = null;
+    /** ms after the 2 s check that something of the body appeared, during the late watch. */
+    let lateAfterMs = null;
+    try {
+        for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
+            await new Promise((resolve) => setTimeout(resolve, PASTE_LANDED_POLL_MS));
+            output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+            state = (0, submit_composer_read_1.classifyPasteLanded)(output, cliToolId, message, composer);
+            if (state === 'landed' || state === 'mismatch')
+                break;
+        }
+        if (state === 'unseen' && composer.clearBeforeSend) {
+            const observeAttempts = Math.ceil(instance_input_lock_1.LATE_PASTE_OBSERVE_MS / PASTE_LANDED_POLL_MS);
+            for (let attempt = 1; attempt <= observeAttempts; attempt++) {
+                await new Promise((resolve) => setTimeout(resolve, PASTE_LANDED_POLL_MS));
+                output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+                state = (0, submit_composer_read_1.classifyPasteLanded)(output, cliToolId, message, composer);
+                if (state !== 'unseen') {
+                    lateAfterMs = attempt * PASTE_LANDED_POLL_MS;
+                    break;
+                }
+            }
+        }
+    }
+    catch (error) {
+        readError = error instanceof Error ? error.message : String(error);
     }
-    if (state === 'landed')
+    if (readError === null && lateAfterMs === null && state === 'landed')
         return;
-    if (state === 'unseen' && !composer.clearBeforeSend) {
+    if (readError === null && state === 'unseen' && !composer.clearBeforeSend) {
         logger.warn('paste-landed-unverified', { sessionName, cliToolId, bytes: Buffer.byteLength(message, 'utf8') });
         return;
     }
     const bytes = Buffer.byteLength(message, 'utf8');
     const lineCount = message.split('\n').length;
-    const shown = describeComposer(output, cliToolId, composer, message);
-    await withdrawUnsentBody(sessionName, cliToolId, composer);
+    const shown = readError === null ? describeComposer(output, cliToolId, composer, message) : 'an unreadable pane';
+    const withdrawn = await withdrawUnsentBody(sessionName, cliToolId, composer, ticket);
     (0, tmux_capture_cache_1.invalidateCache)(sessionName);
-    logger.error('paste-not-landed', { sessionName, cliToolId, state, bytes, lines: lineCount, shown });
-    const what = state === 'mismatch'
-        ? `the composer does not hold the message as sent (it shows ${shown})`
-        : state === 'pasting'
-            ? `the paste had not finished arriving after ${attempts * PASTE_LANDED_POLL_MS}ms (the composer shows ${shown})`
-            : `the message never appeared in the composer (${shown})`;
+    const mayStillArrive = readError !== null || state === 'unseen' || state === 'pasting' || !withdrawn;
+    if (mayStillArrive)
+        (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+    logger.error('paste-not-landed', {
+        sessionName,
+        cliToolId,
+        state,
+        bytes,
+        lines: lineCount,
+        shown,
+        lateAfterMs,
+        readError,
+        withdrawn,
+        carried: mayStillArrive,
+    });
+    const what = readError !== null
+        ? `the composer could not be read while the paste was checked (${readError})`
+        : lateAfterMs !== null
+            ? `the paste appeared ${lateAfterMs}ms after the ${attempts * PASTE_LANDED_POLL_MS}ms check and was taken back out (the composer showed ${shown})`
+            : state === 'mismatch'
+                ? `the composer does not hold the message as sent (it shows ${shown})`
+                : state === 'pasting'
+                    ? `the paste had not finished arriving after ${attempts * PASTE_LANDED_POLL_MS}ms (the composer shows ${shown})`
+                    : `the message never appeared in the composer (${shown})`;
     throw new Error(`Message body did not arrive intact for session ${sessionName}: ${what}; the message is ${bytes} bytes / ${lineCount} lines. ` +
         'Enter was not pressed, so nothing was submitted (Issue #2464).');
 }
-/** The text with every whitespace character removed — wrapping and indent proof. */
-function compactText(text) {
-    return text.replace(/\s+/g, '');
+/**
+ * Whether the composer shows a paste placeholder whose count is not this body's
+ * (Issue #3945): one counting fewer or more, or more than one placeholder.
+ */
+function composerShowsForeignPasteToken(output, cliToolId, message, composerSpec) {
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    const composer = (0, submit_composer_read_1.readSubmitComposer)(output, cliToolId, composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message);
+    if (composer.kind !== 'text')
+        return false;
+    if (!composer.rows.some((row) => (0, submit_composer_read_1.findPasteTokens)(row).tokens.length > 0))
+        return false;
+    return (0, submit_composer_read_1.classifyPasteLanded)(output, cliToolId, message, composerSpec) !== 'landed';
 }
 /**
  * The part of a typed body the composer reader can see (Issue #3366).
@@ -880,9 +560,9 @@ function visibleTypedBody(message) {
 }
 /** Whether the whole codex composer, read past the bounded readers (Issue #3906), is exactly `message`. */
 function codexComposerShowsWholeBody(output, message, composerSpec) {
-    const lines = withoutTrailingBlankRows((0, cli_patterns_1.stripAnsi)(output).split('\n'));
-    const composer = readSubmitComposer(output, 'codex', composerSpec.reader, lines, lines.slice(-VERIFY_WINDOW_LINES), message);
-    return composer.kind === 'text' && composer.region !== undefined && compactText(composer.region) === compactText(message);
+    const lines = (0, submit_composer_read_1.withoutTrailingBlankRows)((0, cli_patterns_1.stripAnsi)(output).split('\n'));
+    const composer = (0, submit_composer_read_1.readSubmitComposer)(output, 'codex', composerSpec.reader, lines, lines.slice(-submit_composer_read_1.VERIFY_WINDOW_LINES), message);
+    return composer.kind === 'text' && composer.region !== undefined && (0, submit_composer_read_1.compactText)(composer.region) === (0, submit_composer_read_1.compactText)(message);
 }
 /**
  * Wait until the composer shows the typed body; only then may Enter be pressed
@@ -908,36 +588,110 @@ function codexComposerShowsWholeBody(output, message, composerSpec) {
  * @throws Error when the composer does not show the body within the attempts
  */
 async function confirmTypedBodyLanded(params) {
-    const { sessionName, message, cliToolId, composer, attempts } = params;
-    const expected = compactText(visibleTypedBody(message));
+    const { sessionName, message, cliToolId, composer, attempts, ticket } = params;
+    const expected = (0, submit_composer_read_1.compactText)(visibleTypedBody(message));
     if (expected === '')
         return;
     let output = '';
-    for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
-        await new Promise((resolve) => setTimeout(resolve, TYPED_BODY_POLL_MS));
-        output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
-        // Issue #3906: on codex the whole composer must show the whole body. The
-        // extractor's excerpt stops at the first blank row, so its match is only
-        // the first paragraph — a five-paragraph body with one paragraph drawn
-        // would pass on it — and it cannot reach a body of more than four blocks.
-        if (cliToolId === 'codex') {
-            if (codexComposerShowsWholeBody(output, message, composer))
+    let readError = null;
+    try {
+        for (let attempt = 0; attempt < Math.max(1, attempts); attempt++) {
+            await new Promise((resolve) => setTimeout(resolve, TYPED_BODY_POLL_MS));
+            output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+            // Issue #3906: on codex the whole composer must show the whole body. The
+            // extractor's excerpt stops at the first blank row, so its match is only
+            // the first paragraph — a five-paragraph body with one paragraph drawn
+            // would pass on it — and it cannot reach a body of more than four blocks.
+            if (cliToolId === 'codex') {
+                if (codexComposerShowsWholeBody(output, message, composer))
+                    return;
+                continue;
+            }
+            const read = (0, composer_text_1.extractComposerText)(output, cliToolId);
+            if (read.state === 'content' && (0, submit_composer_read_1.compactText)(read.text) === expected)
                 return;
-            continue;
         }
-        const read = (0, composer_text_1.extractComposerText)(output, cliToolId);
-        if (read.state === 'content' && compactText(read.text) === expected)
-            return;
+    }
+    catch (error) {
+        readError = error instanceof Error ? error.message : String(error);
     }
     const bytes = Buffer.byteLength(message, 'utf8');
-    const shown = describeComposer(output, cliToolId, composer, message);
-    await withdrawUnsentBody(sessionName, cliToolId, composer);
+    const shown = readError === null ? describeComposer(output, cliToolId, composer, message) : 'an unreadable pane';
+    // Issue #3945: a body never seen (codex can draw a burst late), a read that
+    // threw, or a withdrawal that was not confirmed may still put text in the
+    // composer after this throw — the next send waits that out.
+    const seen = readError === null && composerHoldsText(output, cliToolId, composer, message);
+    const withdrawn = await withdrawUnsentBody(sessionName, cliToolId, composer, ticket);
     (0, tmux_capture_cache_1.invalidateCache)(sessionName);
-    logger.error('typed-body-not-landed', { sessionName, cliToolId, bytes, attempts, shown });
+    const mayStillArrive = !seen || !withdrawn;
+    if (mayStillArrive)
+        (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+    logger.error('typed-body-not-landed', { sessionName, cliToolId, bytes, attempts, shown, readError, carried: mayStillArrive });
     throw new Error(`Message body did not appear in the composer for session ${sessionName} within ` +
         `${attempts * TYPED_BODY_POLL_MS}ms (it shows ${shown}); the message is ${bytes} bytes. ` +
         'Enter was not pressed, so nothing was submitted (Issue #3366).');
 }
+/**
+ * Whether a verdict is one the agent's own report must back (Issue #4035):
+ * `submitted` from B or F — the screen saying only that the body is not in the
+ * composer. A (generating) stands on its own. A body starting with `/` or `!`
+ * is run by the TUI itself, which is not measured to report it as a prompt.
+ */
+function needsPromptReport(state, rule, message) {
+    if (state !== 'submitted' || rule === 'A')
+        return false;
+    return !/^\s*[/!]/.test(message);
+}
+/**
+ * Watch a session's first prompt until the agent reports it (Issue #4035).
+ *
+ * Reads the hook record and the composer every {@link PROMPT_REPORT_POLL_MS}
+ * until `deadline`, without pressing anything. The deadline is the send's, not
+ * the call's: a send that waits again after a resent Enter gets only what is
+ * left of its {@link PROMPT_REPORT_WAIT_MS} (it holds the input lock meanwhile).
+ *
+ *   - the agent reported the prompt — `received`;
+ *   - the screen changes its verdict — generating (A), or the body drawn into
+ *     the composer after all (C/D, `pending`: the caller resends Enter, as for
+ *     any typed-but-unsent body), or a completion (E) — `screen`, with the frame;
+ *   - neither, to the end — `unreported`: nothing says the message left.
+ */
+async function awaitPromptReport(params) {
+    const { sessionName, message, cliToolId, composer, enteredAt, deadline } = params;
+    let rule = params.rule;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, PROMPT_REPORT_POLL_MS));
+        if ((0, prompt_submit_receipt_1.readPromptSubmitReceipt)(sessionName, cliToolId, enteredAt) === 'received')
+            return { verdict: 'received' };
+        const output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+        const verdict = (0, submit_composer_read_1.classifySubmitWithRule)(output, cliToolId, message, composer);
+        if (verdict.state !== 'submitted' || verdict.rule === 'A')
+            return { verdict: 'screen', ...verdict, output };
+        rule = verdict.rule;
+    }
+    if ((0, prompt_submit_receipt_1.readPromptSubmitReceipt)(sessionName, cliToolId, enteredAt) === 'received')
+        return { verdict: 'received' };
+    return { verdict: 'unreported', rule };
+}
+/**
+ * Say so when the pre-send clear finds the body this session last reported
+ * submitted (Issue #4035): that body never reached the agent, and the send that
+ * said `sent` for it was wrong. The instance's `lastSend` is turned
+ * `indeterminate` (the send now running records its own outcome after it).
+ */
+function reportSubmittedBodyInComposer(sessionName, cliToolId, composerText, cleared) {
+    if (composerText === '' || !(0, prompt_submit_receipt_1.matchesSubmittedBody)(sessionName, composerText))
+        return;
+    const target = (0, prompt_submit_receipt_1.getPromptSubmitTarget)(sessionName);
+    if (target !== null)
+        (0, send_attempt_state_1.markLastSendDiscarded)({ ...target, instanceId: target.instanceId ?? target.cliToolId });
+    logger.warn('pre-send-found-submitted-body', {
+        sessionName,
+        cliToolId,
+        cleared,
+        length: composerText.length,
+    });
+}
 /**
  * Empty the composer before the body is typed into it (Issue #1880).
  *
@@ -985,10 +739,19 @@ async function confirmTypedBodyLanded(params) {
  *
  * @throws Error when the composer still holds text after the pass cap.
  */
-async function clearComposerBeforeSend(sessionName, cliToolId, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId)) {
+async function clearComposerBeforeSend(sessionName, cliToolId, composerSpec = (0, composer_spec_1.resolveComposerSpec)(cliToolId), options = {}) {
     if (!composerSpec.clearBeforeSend)
         return;
-    const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId);
+    // Issue #3945: the first read is the re-check's frame, and every pass asks
+    // first whether this send still owns the composer.
+    const { ticket } = options;
+    const result = await (0, composer_clear_1.clearComposer)(sessionName, cliToolId, {
+        ...(options.initialCapture !== undefined ? { initialCapture: options.initialCapture } : {}),
+        ...(ticket !== undefined ? { beforePass: () => ticket.isCurrent() } : {}),
+    });
+    if (ticket !== undefined)
+        assertInputOwner(ticket, cliToolId, 'the pre-send clear', false);
+    reportSubmittedBodyInComposer(sessionName, cliToolId, result.discardedText, result.state !== 'content');
     if (result.state === 'content') {
         logger.error('pre-send-composer-clear-failed', {
             sessionName,
@@ -1029,23 +792,59 @@ async function clearComposerBeforeSend(sessionName, cliToolId, composerSpec = (0
  * and Enter waits until the composer shows all of it (Issue #2464); a body that
  * does not arrive intact THROWS before Enter, with nothing submitted.
  *
+ * Issue #3945: the whole of it — clear, body, Enter, read-back, withdrawal —
+ * runs as the session's only writer ({@link withInstanceInputLock}); before
+ * anything is typed the pane is re-read under the lock, on every send
+ * ({@link recheckComposerBeforeInput}), and a carried paste mark is waited out
+ * ({@link waitOutCarriedPaste}, then the re-check again).
+ *
  * @throws Error when the body does not arrive intact, or submit cannot be
- *   confirmed within the bounded attempts.
+ *   confirmed within the bounded attempts; `InstanceInputLockTimeoutError`
+ *   when the composer was not free in time (nothing typed).
  */
 async function sendMessageWithSubmitVerification(params) {
+    await (0, instance_input_lock_1.withInstanceInputLock)(params.sessionName, (ticket) => sendUnderInputLock(params, ticket));
+}
+async function sendUnderInputLock(params, ticket) {
     const { sessionName, message, cliToolId, composer = (0, composer_spec_1.resolveComposerSpec)(cliToolId), textInputWaitMs = cli_tool_timing_config_1.TUI_TEXT_INPUT_WAIT_MS, interEnterWaitMs = cli_tool_timing_config_1.TUI_TEXT_INPUT_WAIT_MS, verifyAttempts = DEFAULT_VERIFY_ATTEMPTS, verifyDelayMs = cli_tool_timing_config_1.TUI_MESSAGE_PROCESSED_WAIT_MS, pasteLandedAttempts = DEFAULT_PASTE_LANDED_ATTEMPTS, awaitTypedBody = false, typedBodyAttempts = DEFAULT_TYPED_BODY_ATTEMPTS, } = params;
     const submitEnterCount = params.submitEnterCount ?? composer.submitEnterCount;
+    // -1. Issue #3945 (review-1 #4): every send re-reads the pane once it owns
+    //     the composer, whether or not it queued — the prompt guard and the
+    //     tool's readiness wait ran before the lock, and a dialog can open in the
+    //     waits between them and the first key (claude's settle wait, a queue
+    //     behind another writer). A dialog refuses the send at once, before any
+    //     carried paste is waited out (a refusal leaves the mark as it is); a
+    //     send that did wait one out reads again after the wait. The last read
+    //     is the pre-send clear's first: a claude/codex send with no mark reads
+    //     no more often than before; any other tool gains this one capture.
+    let frame = await (0, composer_clear_1.recheckComposerBeforeInput)(sessionName, cliToolId);
+    if (await waitOutCarriedPaste(sessionName, cliToolId, composer, ticket)) {
+        frame = await (0, composer_clear_1.recheckComposerBeforeInput)(sessionName, cliToolId);
+    }
     // 0. Empty the composer first (Issue #1880). The body below is typed at the
     //    TUI's current cursor position, so anything already in the box would be
     //    spliced into it. Throws for a claude composer that could not be emptied.
-    await clearComposerBeforeSend(sessionName, cliToolId, composer);
+    await clearComposerBeforeSend(sessionName, cliToolId, composer, { initialCapture: frame, ticket });
     if (Buffer.byteLength(message, 'utf8') > exports.LITERAL_SEND_MAX_BYTES) {
         // 1'. A body that would reach the TUI as more than one pty read is pasted
         //     as ONE bracketed paste, and Enter waits until the composer shows all
         //     of it (Issue #2464). Typed, Claude Code would keep only its last read.
         const pastedAt = Date.now();
-        await pasteBody(sessionName, message);
-        await confirmPasteLanded({ sessionName, message, cliToolId, composer, attempts: pasteLandedAttempts });
+        assertInputOwner(ticket, cliToolId, 'the paste', false);
+        try {
+            await pasteBody(sessionName, message, ticket, cliToolId);
+        }
+        catch (error) {
+            // Whether tmux put any of it into the pane is unknown — except after a
+            // refused input boundary (Issue #3992) or a failed `load-buffer` (Issue
+            // #4011, `not-started`), both before `paste-buffer`: a mark then would
+            // only hold the next send off for nothing.
+            const notStarted = error?.delivery === 'not-started';
+            if (!(0, instance_input_lock_1.isInputBoundaryRefusal)(error) && !notStarted)
+                (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+            throw error;
+        }
+        await confirmPasteLanded({ sessionName, message, cliToolId, composer, attempts: pasteLandedAttempts, ticket });
         // 2'. Keep the tool's own registration delay as a floor.
         const remaining = textInputWaitMs - (Date.now() - pastedAt);
         if (remaining > 0) {
@@ -1063,13 +862,29 @@ async function sendMessageWithSubmitVerification(params) {
         //    nowhere at all, with `rc 0`. All four measured on tmux 3.5a; the argv is
         //    built in `lib/tmux/key-sequence.ts`, which carries the table.
         const typedAt = Date.now();
-        await (0, tmux_1.sendKeys)(sessionName, message, false, { literal: true });
+        assertInputOwner(ticket, cliToolId, 'the body', false);
+        // Issue #3953: the send's stamp is taken here — after the lock, the carried
+        // mark, the re-check and the clear, right before the body's first key — so a
+        // previous turn that ended during any of them is older than this send.
+        (0, instance_input_lock_1.noteInputStart)();
+        try {
+            await (0, tmux_1.sendKeys)(sessionName, message, false, { literal: true });
+        }
+        catch (error) {
+            // Issue #3945 (review-1 #6): a keystroke send that failed may still have
+            // put part of the body into the pane (a timed-out `send-keys`, #3880's
+            // `indeterminate`), to be drawn after this send has let the composer go.
+            // Only a call tmux never started (`TmuxSendError.delivery`) typed nothing.
+            if (error?.delivery !== 'not-started')
+                (0, instance_input_lock_1.leaveCarriedPasteMark)(ticket);
+            throw error;
+        }
         // 2. Let the TUI register the input before pressing Enter. On codex that
         //    means waiting until the body is drawn (Issue #3366): an Enter pressed
         //    while codex still holds the keystrokes as a paste burst becomes a
         //    newline, and the body stays unsent. The fixed wait stays as a floor.
         if (awaitTypedBody && composer_text_1.SUPPORTED_COMPOSER_TOOLS.has(cliToolId)) {
-            await confirmTypedBodyLanded({ sessionName, message, cliToolId, composer, attempts: typedBodyAttempts });
+            await confirmTypedBodyLanded({ sessionName, message, cliToolId, composer, attempts: typedBodyAttempts, ticket });
         }
         const remaining = textInputWaitMs - (Date.now() - typedAt);
         if (remaining > 0) {
@@ -1077,7 +892,10 @@ async function sendMessageWithSubmitVerification(params) {
         }
     }
     // 3. Submit as a separate command (double Enter for vibe-local's IME mode).
+    //    Issue #4035: the agent's own report of the prompt counts from here.
+    const enteredAt = Date.now();
     for (let i = 0; i < Math.max(1, submitEnterCount); i++) {
+        assertInputOwner(ticket, cliToolId, 'Enter', true);
         await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
         if (i < submitEnterCount - 1) {
             await new Promise((resolve) => setTimeout(resolve, interEnterWaitMs));
@@ -1092,11 +910,62 @@ async function sendMessageWithSubmitVerification(params) {
     //    was reported "could not be confirmed" — a sent message as exit 99. The
     //    last read sends nothing: no Enter goes out that is not read back.
     const attempts = Math.max(1, verifyAttempts);
+    // Issue #4035: one wait for the agent's report per send, however many reads.
+    let promptReportDeadline = null;
     for (let attempt = 0; attempt <= attempts; attempt++) {
         await new Promise((resolve) => setTimeout(resolve, verifyDelayMs));
-        const output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
-        const state = classifySubmit(output, cliToolId, message, composer);
+        let output = await (0, tmux_1.capturePane)(sessionName, { startLine: -composer.verifyCaptureLines });
+        let { state, rule } = (0, submit_composer_read_1.classifySubmitWithRule)(output, cliToolId, message, composer);
+        const receipt = needsPromptReport(state, rule, message)
+            ? (0, prompt_submit_receipt_1.readPromptSubmitReceipt)(sessionName, cliToolId, enteredAt)
+            : 'not-required';
+        // Issue #4035: every verdict names the rule that gave it, so a send reported
+        // `sent` can be traced to what the screen showed.
+        logger.info('submit-classified', { sessionName, cliToolId, attempt, state, rule, receipt });
+        if (receipt === 'awaited') {
+            // Issue #4035: the screen says only that the body is not in the composer,
+            // on a session that has not reported a prompt yet. Watch, without Enter,
+            // until the agent reports it or the composer shows the body after all.
+            promptReportDeadline ??= Date.now() + exports.PROMPT_REPORT_WAIT_MS;
+            const watched = await awaitPromptReport({
+                sessionName,
+                message,
+                cliToolId,
+                composer,
+                enteredAt,
+                rule,
+                deadline: promptReportDeadline,
+            });
+            if (watched.verdict === 'unreported') {
+                (0, tmux_capture_cache_1.invalidateCache)(sessionName);
+                logger.error('submit-not-confirmed:prompt-unreported', {
+                    sessionName,
+                    cliToolId,
+                    attempt,
+                    rule: watched.rule,
+                    waitedMs: exports.PROMPT_REPORT_WAIT_MS,
+                });
+                throw new Error(`Message submit could not be confirmed for session ${sessionName}: the composer did not show the body ` +
+                    `(rule ${watched.rule}) but the agent did not report the prompt within ${exports.PROMPT_REPORT_WAIT_MS}ms ` +
+                    '(Issue #4035).');
+            }
+            if (watched.verdict === 'received') {
+                logger.info('submit-confirmed-by-prompt-hook', { sessionName, cliToolId, attempt, rule });
+                state = 'submitted';
+            }
+            else {
+                ({ state, rule, output } = watched);
+                logger.info('submit-classified', { sessionName, cliToolId, attempt, state, rule, receipt: 'awaited' });
+            }
+        }
         if (state === 'submitted') {
+            // Issue #4035: only a body the screen alone called submitted is remembered
+            // for the next send's clear. One the agent reported did leave, and the same
+            // text back in the composer is claude restoring it (Esc), the history (↑),
+            // or a person typing it — not a send that never arrived.
+            if ((0, prompt_submit_receipt_1.readPromptSubmitReceipt)(sessionName, cliToolId, enteredAt) !== 'received') {
+                (0, prompt_submit_receipt_1.noteSubmittedBody)(sessionName, message);
+            }
             (0, tmux_capture_cache_1.invalidateCache)(sessionName);
             return;
         }
@@ -1107,7 +976,12 @@ async function sendMessageWithSubmitVerification(params) {
             // (flavor B). Clear the input line (best-effort) and surface the failure
             // to the caller instead of ever resending Enter.
             try {
-                await (0, tmux_1.clearInputLine)(sessionName);
+                if (ticket.isCurrent()) {
+                    await (0, tmux_1.clearInputLine)(sessionName);
+                }
+                else {
+                    logger.error('submit-clear-input-skipped-not-owner', { sessionName, cliToolId, generation: ticket.generation });
+                }
             }
             catch (clearError) {
                 logger.error('submit-clear-input-failed', {
@@ -1129,12 +1003,30 @@ async function sendMessageWithSubmitVerification(params) {
             logger.warn('submit-not-confirmed:composer-unreadable', { sessionName, cliToolId, attempt });
             continue;
         }
+        // Issue #3945 (review #1): a paste placeholder that does not count this
+        // body is not this body. It can only be a paste that arrived after the
+        // initial Enter (a carried send's, past its mark), and another Enter would
+        // submit it. One that counts exactly this body cannot be told apart: that
+        // Enter is the accepted gap (LATE_TOKEN_AFTER_ENTER_SAME_COUNT in the tests).
+        if (composerShowsForeignPasteToken(output, cliToolId, message, composer)) {
+            logger.warn('submit-not-confirmed:foreign-paste-token', { sessionName, cliToolId, attempt });
+            continue;
+        }
+        // Issue #4035: the Enter thought lost may only have been late — the agent
+        // reporting the prompt now means it went, and another Enter would land on an
+        // empty composer, or on a dialog that the prompt just opened.
+        if ((0, prompt_submit_receipt_1.readPromptSubmitReceipt)(sessionName, cliToolId, enteredAt) === 'received') {
+            logger.info('submit-confirmed-by-prompt-hook', { sessionName, cliToolId, attempt, rule });
+            (0, tmux_capture_cache_1.invalidateCache)(sessionName);
+            return;
+        }
         // state === 'pending' — still typed-but-unsent, resend a single Enter and re-check.
         logger.warn('submit-not-confirmed:resending-enter', {
             sessionName,
             cliToolId,
             attempt,
         });
+        assertInputOwner(ticket, cliToolId, 'a resent Enter', true);
         await (0, tmux_1.sendSpecialKeys)(sessionName, ['Enter']);
     }
     (0, tmux_capture_cache_1.invalidateCache)(sessionName);