instar 1.3.985 → 1.3.986

package/dist/core/claudeReadinessProbe.d.ts

@@ -0,0 +1,137 @@
+/**
+ * Readiness classification for a framework TUI pane tail.
+ *
+ * WHY THIS EXISTS AS ITS OWN MODULE
+ * ---------------------------------
+ * On 2026-07-26 a user's message was injected into a freshly-spawned Claude Code
+ * pane 15 seconds before that pane could accept input. The paste was swallowed by
+ * the TUI still painting itself, and the delivery was logged as a SUCCESS
+ * (`Injected initial message into "…" (915 chars, after stabilization delay)`).
+ * The message reached the agent only because an unrelated start-hook backstop
+ * re-read recent history.
+ *
+ * The cause was the readiness probe, not the injector. It accepted a bare
+ * slash-command mention anywhere in the captured tail:
+ *
+ *     if (/\/(effort|model|fast)/.test(tail)) return true;
+ *
+ * Claude Code's startup banner advertises slash commands IN PROSE — the pane that
+ * fooled it carried "…Run /model and select Fable to use it." So the probe matched
+ * a promotional line and declared a still-booting pane ready. A string matcher
+ * fooled by its own subject: the banner that proves the app is NOT yet accepting
+ * input was read as proof that it is.
+ *
+ * THOSE CLAUSES ARE DELETED, NOT TUNED. The first fix attempt kept them and
+ * required "status-bar shape" (line-start, or directly after an interpunct).
+ * Second-pass review falsified that:
+ *   - The banner uses the same shape. `⚠ CLAUDE.md is over the … limit · /memory
+ *     to free up context` and `+1 more · /status` are BANNER lines in interpunct
+ *     shape. The only thing separating them from a status bar was that `memory`
+ *     and `status` fall outside the three-word set — i.e. still vocabulary, and a
+ *     plausible `· /model to opt in` promo line matched outright.
+ *   - The line-start branch reinstated the Anthropic-copy dependency it claimed to
+ *     remove: at a fixed pane width an edit shifting the wrap by ~14 characters
+ *     puts `/model` at column 0 and the original defect returns.
+ * A signal that cannot separate an ADVERT for a command from a STATUS BAR showing
+ * one carries no information about readiness. Widening the genuinely structural
+ * markers below costs nothing and covers the same panes.
+ *
+ * WHY THE ANSWER IS NOT A BOOLEAN
+ * -------------------------------
+ * There are three consumers and they want OPPOSITE responses to the two ways a
+ * pane can fail to be ready:
+ *   - the spawn/inject path — must not type into a pane that is still painting,
+ *     and must not type into a MENU (see below);
+ *   - `waitForClaudeReadyWithRetry` — waits, then falls back;
+ *   - the Slack stuck-session path (`server.ts`) — calls this on an ALREADY-LIVE
+ *     session and KILLS it when the answer is not-ready.
+ * A bare `false` tells that third caller "kill this" for a pane that is merely
+ * mid-boot or politely waiting on a question. So the probe reports WHICH state it
+ * saw and each caller applies its own policy. `isReadyPromptTail` is retained as
+ * the boolean façade for callers that genuinely only want "can I type now".
+ *
+ * THE MENU CASE (found by the operator, 2026-07-26)
+ * -------------------------------------------------
+ * Claude Code paints the SAME `❯` glyph on a menu's focused option as it uses for
+ * the input box (`PermissionPromptAutoResolver.SELECTOR_GLYPH`). So a session
+ * sitting on a startup question read as READY. This is strictly worse than the
+ * banner case: text typed at a banner is lost, but text typed at a menu is not —
+ * Enter SELECTS AN OPTION, so an arriving message can answer a permission question
+ * on the operator's behalf. A menu is therefore classified as its own state, never
+ * as ready, no matter which glyphs it carries.
+ *
+ * Kept pure (text in, verdict out) so it is testable without tmux, and so the
+ * regression fixtures are the literal pane text that caused each finding.
+ *
+ * RULE 3.1 RATIONALE (state-detection; registry:
+ * `specs/provider-portability/06-state-detector-registry.md`)
+ * ------------------------------------------------------------------------------
+ * - **Criticality:** silent-corruption-if-wrong — the worst class, demonstrated
+ *   twice. A false `ready` on a painting pane loses a user message AND writes a
+ *   success line for it; a false `ready` on a menu is worse still, because Enter
+ *   SELECTS an option, so an arriving message can answer a permission question on
+ *   the operator's behalf.
+ * - **Frequency:** per-spawn and per-inject, plus per-stuck-check on the Slack
+ *   path.
+ * - **Stability:** UNSTABLE. Claude Code's TUI is a private surface. This is not a
+ *   theoretical rating — the 2026-07-26 incident WAS an upstream copy change (a
+ *   Fable-5 promo line) turning a passing detector into a failing one, and the
+ *   menu case is an upstream glyph reuse.
+ * - **Fallback:** partial and asymmetric. The spawn path has an extended wait and
+ *   a blind-inject-if-alive fallback; the loss on 2026-07-26 was caught only by
+ *   the start hook's unanswered-message backstop, which is an unrelated path and
+ *   cannot be relied on as this detector's safety net. The Slack path's not-ready
+ *   branch is DESTRUCTIVE (kill + respawn), so a wrong answer there costs a live
+ *   session, not a delay.
+ * - **→ Verdict: deterministic + canary REQUIRED.** This module ships the
+ *   deterministic half plus regression fixtures carrying the literal pane text of
+ *   both known failures. It does NOT ship a canary, so it detects the two shapes
+ *   that already bit us and not the next drift. Canary tracked as CMT-1044.
+ *   <!-- tracked: CMT-1044 -->
+ */
+/**
+ * What a captured pane tail shows.
+ *
+ * - `ready`        — an input surface is drawn and accepting input.
+ * - `menu`         — a numbered selection menu is focused. NOT ready, and NOT a
+ *                    stuck session: something is waiting on an answer. A caller
+ *                    that kills on not-ready must not kill on this.
+ * - `not-ready`    — no input surface found (typically still painting).
+ */
+export type PaneReadiness = 'ready' | 'menu' | 'not-ready';
+/**
+ * True when the tail shows a FOCUSED selection menu.
+ *
+ * Requires the selector glyph to sit ON a numbered option line, AND at least two
+ * numbered option lines overall. Both halves are load-bearing:
+ *
+ *   - "glyph on the option line" separates a menu from the input box. The box
+ *     renders `❯` alone on its own line; a menu renders `❯ 1. Yes`. Testing only
+ *     "the tail contains ❯ somewhere" would classify ordinary assistant output
+ *     that happens to list `1.` and `2.` above the prompt as a menu, stalling a
+ *     genuinely ready session — an over-block on the inject path.
+ *   - "at least two options" separates a menu from a single numbered line of
+ *     ordinary output.
+ *
+ * This mirrors `PermissionPromptAutoResolver`'s requirement (a line whose lead
+ * glyphs contain ❯ whose text is `N.` + a label) rather than inventing a second,
+ * divergent notion of what a menu looks like.
+ */
+export declare function tailShowsMenu(tail: string): boolean;
+/**
+ * Classify a captured pane tail.
+ *
+ * `tail` is the joined last-N non-blank lines of a `capture-pane` read. Never pass
+ * the whole scrollback: a banner that has scrolled far above the prompt is not
+ * evidence either way, and older content only adds false-positive surface.
+ */
+export declare function classifyPaneReadiness(tail: string): PaneReadiness;
+/**
+ * Boolean façade: can text be typed into this pane right now?
+ *
+ * A menu answers `false` — correct for every caller that is about to type. A
+ * caller whose not-ready branch is DESTRUCTIVE (kill/respawn) must use
+ * `classifyPaneReadiness` instead and leave a `menu` pane alone.
+ */
+export declare function isReadyPromptTail(tail: string): boolean;
+//# sourceMappingURL=claudeReadinessProbe.d.ts.map

package/dist/core/claudeReadinessProbe.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeReadinessProbe.d.ts","sourceRoot":"","sources":["../../src/core/claudeReadinessProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;AA6B3D;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAUnD;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAejE;AAED;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEvD"}

package/dist/core/claudeReadinessProbe.js

@@ -0,0 +1,181 @@
+/**
+ * Readiness classification for a framework TUI pane tail.
+ *
+ * WHY THIS EXISTS AS ITS OWN MODULE
+ * ---------------------------------
+ * On 2026-07-26 a user's message was injected into a freshly-spawned Claude Code
+ * pane 15 seconds before that pane could accept input. The paste was swallowed by
+ * the TUI still painting itself, and the delivery was logged as a SUCCESS
+ * (`Injected initial message into "…" (915 chars, after stabilization delay)`).
+ * The message reached the agent only because an unrelated start-hook backstop
+ * re-read recent history.
+ *
+ * The cause was the readiness probe, not the injector. It accepted a bare
+ * slash-command mention anywhere in the captured tail:
+ *
+ *     if (/\/(effort|model|fast)/.test(tail)) return true;
+ *
+ * Claude Code's startup banner advertises slash commands IN PROSE — the pane that
+ * fooled it carried "…Run /model and select Fable to use it." So the probe matched
+ * a promotional line and declared a still-booting pane ready. A string matcher
+ * fooled by its own subject: the banner that proves the app is NOT yet accepting
+ * input was read as proof that it is.
+ *
+ * THOSE CLAUSES ARE DELETED, NOT TUNED. The first fix attempt kept them and
+ * required "status-bar shape" (line-start, or directly after an interpunct).
+ * Second-pass review falsified that:
+ *   - The banner uses the same shape. `⚠ CLAUDE.md is over the … limit · /memory
+ *     to free up context` and `+1 more · /status` are BANNER lines in interpunct
+ *     shape. The only thing separating them from a status bar was that `memory`
+ *     and `status` fall outside the three-word set — i.e. still vocabulary, and a
+ *     plausible `· /model to opt in` promo line matched outright.
+ *   - The line-start branch reinstated the Anthropic-copy dependency it claimed to
+ *     remove: at a fixed pane width an edit shifting the wrap by ~14 characters
+ *     puts `/model` at column 0 and the original defect returns.
+ * A signal that cannot separate an ADVERT for a command from a STATUS BAR showing
+ * one carries no information about readiness. Widening the genuinely structural
+ * markers below costs nothing and covers the same panes.
+ *
+ * WHY THE ANSWER IS NOT A BOOLEAN
+ * -------------------------------
+ * There are three consumers and they want OPPOSITE responses to the two ways a
+ * pane can fail to be ready:
+ *   - the spawn/inject path — must not type into a pane that is still painting,
+ *     and must not type into a MENU (see below);
+ *   - `waitForClaudeReadyWithRetry` — waits, then falls back;
+ *   - the Slack stuck-session path (`server.ts`) — calls this on an ALREADY-LIVE
+ *     session and KILLS it when the answer is not-ready.
+ * A bare `false` tells that third caller "kill this" for a pane that is merely
+ * mid-boot or politely waiting on a question. So the probe reports WHICH state it
+ * saw and each caller applies its own policy. `isReadyPromptTail` is retained as
+ * the boolean façade for callers that genuinely only want "can I type now".
+ *
+ * THE MENU CASE (found by the operator, 2026-07-26)
+ * -------------------------------------------------
+ * Claude Code paints the SAME `❯` glyph on a menu's focused option as it uses for
+ * the input box (`PermissionPromptAutoResolver.SELECTOR_GLYPH`). So a session
+ * sitting on a startup question read as READY. This is strictly worse than the
+ * banner case: text typed at a banner is lost, but text typed at a menu is not —
+ * Enter SELECTS AN OPTION, so an arriving message can answer a permission question
+ * on the operator's behalf. A menu is therefore classified as its own state, never
+ * as ready, no matter which glyphs it carries.
+ *
+ * Kept pure (text in, verdict out) so it is testable without tmux, and so the
+ * regression fixtures are the literal pane text that caused each finding.
+ *
+ * RULE 3.1 RATIONALE (state-detection; registry:
+ * `specs/provider-portability/06-state-detector-registry.md`)
+ * ------------------------------------------------------------------------------
+ * - **Criticality:** silent-corruption-if-wrong — the worst class, demonstrated
+ *   twice. A false `ready` on a painting pane loses a user message AND writes a
+ *   success line for it; a false `ready` on a menu is worse still, because Enter
+ *   SELECTS an option, so an arriving message can answer a permission question on
+ *   the operator's behalf.
+ * - **Frequency:** per-spawn and per-inject, plus per-stuck-check on the Slack
+ *   path.
+ * - **Stability:** UNSTABLE. Claude Code's TUI is a private surface. This is not a
+ *   theoretical rating — the 2026-07-26 incident WAS an upstream copy change (a
+ *   Fable-5 promo line) turning a passing detector into a failing one, and the
+ *   menu case is an upstream glyph reuse.
+ * - **Fallback:** partial and asymmetric. The spawn path has an extended wait and
+ *   a blind-inject-if-alive fallback; the loss on 2026-07-26 was caught only by
+ *   the start hook's unanswered-message backstop, which is an unrelated path and
+ *   cannot be relied on as this detector's safety net. The Slack path's not-ready
+ *   branch is DESTRUCTIVE (kill + respawn), so a wrong answer there costs a live
+ *   session, not a delay.
+ * - **→ Verdict: deterministic + canary REQUIRED.** This module ships the
+ *   deterministic half plus regression fixtures carrying the literal pane text of
+ *   both known failures. It does NOT ship a canary, so it detects the two shapes
+ *   that already bit us and not the next drift. Canary tracked as CMT-1044.
+ *   <!-- tracked: CMT-1044 -->
+ */
+/**
+ * Status-bar / footer strings that only exist once the TUI has finished starting.
+ *
+ * Sourced from the probes already trusted for this elsewhere in the tree
+ * (`SessionReaper`, the interactive-pool adapter config) rather than invented
+ * here, so the readiness question gets one vocabulary instead of four. Verified
+ * absent from the boot banner. `bypass permissions` alone covered only ONE of
+ * Claude Code's permission-mode footers — a session in auto-accept mode shows
+ * none of it — which is why the `❯`-is-always-present assumption was load-bearing
+ * before and is not now.
+ */
+const AT_PROMPT_FOOTERS = [
+    'bypass permissions',
+    '? for shortcuts',
+    'shift+tab to cycle',
+    'auto-accept edits',
+];
+/**
+ * A menu option line: an optional glyph run, then `N.` or `N)` and a label.
+ * Matches the shape Claude Code uses for approval / consent / trust prompts.
+ */
+const MENU_OPTION_RE = /^[^\w\n]{0,4}\s*\d+[.)]\s+\S/;
+/** The selector cursor Claude Code paints on the focused option — and on nothing else. */
+const SELECTOR_GLYPH = '❯';
+/**
+ * True when the tail shows a FOCUSED selection menu.
+ *
+ * Requires the selector glyph to sit ON a numbered option line, AND at least two
+ * numbered option lines overall. Both halves are load-bearing:
+ *
+ *   - "glyph on the option line" separates a menu from the input box. The box
+ *     renders `❯` alone on its own line; a menu renders `❯ 1. Yes`. Testing only
+ *     "the tail contains ❯ somewhere" would classify ordinary assistant output
+ *     that happens to list `1.` and `2.` above the prompt as a menu, stalling a
+ *     genuinely ready session — an over-block on the inject path.
+ *   - "at least two options" separates a menu from a single numbered line of
+ *     ordinary output.
+ *
+ * This mirrors `PermissionPromptAutoResolver`'s requirement (a line whose lead
+ * glyphs contain ❯ whose text is `N.` + a label) rather than inventing a second,
+ * divergent notion of what a menu looks like.
+ */
+export function tailShowsMenu(tail) {
+    if (!tail || !tail.includes(SELECTOR_GLYPH))
+        return false;
+    let options = 0;
+    let glyphOnOption = false;
+    for (const line of tail.split('\n')) {
+        if (!MENU_OPTION_RE.test(line))
+            continue;
+        options++;
+        if (line.includes(SELECTOR_GLYPH))
+            glyphOnOption = true;
+    }
+    return glyphOnOption && options >= 2;
+}
+/**
+ * Classify a captured pane tail.
+ *
+ * `tail` is the joined last-N non-blank lines of a `capture-pane` read. Never pass
+ * the whole scrollback: a banner that has scrolled far above the prompt is not
+ * evidence either way, and older content only adds false-positive surface.
+ */
+export function classifyPaneReadiness(tail) {
+    if (!tail)
+        return 'not-ready';
+    // A menu is checked FIRST and wins over every positive marker below, because it
+    // carries the same `❯` the input box does. Typing here selects an option.
+    if (tailShowsMenu(tail))
+        return 'menu';
+    // The framework prompt character. Codex uses ›; keeping this probe Claude-only
+    // previously delayed continuation bootstraps to the full timeout.
+    if (tail.includes(SELECTOR_GLYPH) || tail.includes('›'))
+        return 'ready';
+    // Footer/status-bar strings that only render once the TUI is up.
+    if (AT_PROMPT_FOOTERS.some(marker => tail.includes(marker)))
+        return 'ready';
+    return 'not-ready';
+}
+/**
+ * Boolean façade: can text be typed into this pane right now?
+ *
+ * A menu answers `false` — correct for every caller that is about to type. A
+ * caller whose not-ready branch is DESTRUCTIVE (kill/respawn) must use
+ * `classifyPaneReadiness` instead and leave a `menu` pane alone.
+ */
+export function isReadyPromptTail(tail) {
+    return classifyPaneReadiness(tail) === 'ready';
+}
+//# sourceMappingURL=claudeReadinessProbe.js.map

package/dist/core/claudeReadinessProbe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claudeReadinessProbe.js","sourceRoot":"","sources":["../../src/core/claudeReadinessProbe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0FG;AAaH;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG;IACxB,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,mBAAmB;CACpB,CAAC;AAEF;;;GAGG;AACH,MAAM,cAAc,GAAG,8BAA8B,CAAC;AAEtD,0FAA0F;AAC1F,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,aAAa,GAAG,KAAK,CAAC;IAC1B,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACzC,OAAO,EAAE,CAAC;QACV,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC;YAAE,aAAa,GAAG,IAAI,CAAC;IAC1D,CAAC;IACD,OAAO,aAAa,IAAI,OAAO,IAAI,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,IAAI,CAAC,IAAI;QAAE,OAAO,WAAW,CAAC;IAE9B,gFAAgF;IAChF,0EAA0E;IAC1E,IAAI,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,MAAM,CAAC;IAEvC,+EAA+E;IAC/E,kEAAkE;IAClE,IAAI,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC;IAExE,iEAAiE;IACjE,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAAE,OAAO,OAAO,CAAC;IAE5E,OAAO,WAAW,CAAC;AACrB,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC;AACjD,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.985",
+  "version": "1.3.986",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-07-26T17:59:55.648Z",
-  "instarVersion": "1.3.985",
+  "generatedAt": "2026-07-26T18:49:10.482Z",
+  "instarVersion": "1.3.986",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {
@@ -1538,7 +1538,7 @@
       "type": "subsystem",
       "domain": "sessions",
       "sourcePath": "src/core/SessionManager.ts",
-      "contentHash": "4fb46f8df9bd47f899f51c13d25057a158d21b00bacec8bbecd75b3414c64b95",
+      "contentHash": "3f88cbed25892776b9eaa258ff68b7eb7b8b676713ea01280899ee8f5b282e96",
       "since": "2025-01-01"
     },
     "subsystem:auto-updater": {

package/upgrades/1.3.986.md

@@ -0,0 +1,153 @@
+# Upgrade Guide — vNEXT
+
+<!-- assembled-by: assemble-next-md -->
+<!-- bump: patch -->
+
+## What Changed
+
+**A session's startup banner — and a session's startup QUESTION — were read as an input prompt, so
+a message could be typed into a pane that could not receive it, and the delivery was logged as a
+success.**
+
+`SessionManager.detectClaudePrompt` decided a pane was accepting input if the last six
+non-blank lines contained `❯`, `›`, `bypass permissions`, or a mention of `/effort`,
+`/model` or `/fast`. That last clause matched a bare slash-command mention **anywhere, in
+any context, including prose**.
+
+Claude Code's startup banner advertises slash commands in prose. The pane that caused the
+incident carried, verbatim:
+
+> `…Fable 5 draws down usage faster than Opus 4.8. Run /model and`
+> `select Fable to use it. Learn more: https://support.claude.com/…`
+
+so the probe matched a promotional line and declared a still-painting pane ready.
+
+**Observed (topic 29723, 2026-07-26).** Inbound message at `17:44:49Z`, session respawned,
+pointer prompt injected at `17:45:00Z` — but that session's own start hook did not complete
+until `17:45:15Z`. The paste landed fifteen seconds early, was swallowed by the TUI redraw,
+and the injector wrote `Injected initial message into "…" (915 chars, after stabilization
+delay)`. A success line for a delivery that did not happen. The message reached the agent
+only because the start hook's unanswered-message backstop re-reads recent history — an
+unrelated path that happens to cover this hole and cannot be relied on to.
+
+**The slash-command clauses are deleted, not tuned.** A first attempt kept them and required
+"status-bar shape" (line-start or directly after an interpunct). Second-pass review falsified that:
+the banner uses the same shape — `· /memory to free up context` and `+1 more · /status` are BANNER
+lines — so the discrimination was still vocabulary, and `· /model to opt in` matched outright. The
+line-start branch also reinstated the very dependency it claimed to remove: at a fixed pane width, a
+copy edit shifting the wrap by ~14 characters puts the command at column 0 and the defect returns. A
+signal that cannot separate an ADVERT for a command from a STATUS BAR showing one carries no
+readiness information. The structural markers were widened instead — `? for shortcuts`,
+`shift+tab to cycle` and `auto-accept edits` join `bypass permissions`, so a session in auto-accept
+mode no longer depends on the prompt glyph being visible.
+
+**Second defect, found by the operator: a startup question read as ready.** Claude Code paints the
+same `❯` on a menu's focused option that it uses for the input box. This is strictly worse than the
+banner — text typed at a banner is lost, but Enter at a menu SELECTS AN OPTION, so an arriving
+message can answer a permission question on the operator's behalf. A focused menu is now its own
+state, never ready.
+
+**The verdict is no longer a boolean.** Three consumers ask this question and one of them KILLS a
+live session when the answer is not-ready. "Still painting" and "waiting on an answer" want opposite
+responses from it, so the probe now names which state it saw and each caller applies its own policy;
+the destructive caller leaves a menu alone, waits a bounded moment for the always-on auto-resolver to
+clear it, and only then treats the session as stuck.
+
+Classification moved into a small pure module so the incident's literal pane text is a
+regression fixture rather than a paraphrase.
+
+## What to Tell Your User
+
+If you ever messaged me, watched a session start, and then saw it sit there doing nothing with
+your message apparently lost — this was one way that happened. I was deciding I was awake by
+looking for certain command names on screen, and my own startup banner mentions those command
+names while advertising a feature. So I read "still starting up" as "ready", typed your message
+into a screen that was still drawing itself, and recorded it as delivered.
+
+There is a second case, sharper than the first. Sessions sometimes start by asking a question,
+and the marker drawn beside the selected answer is the same one drawn for the input box. So a
+session waiting on a question also read as ready. At a banner, a message typed too early is
+simply lost. At a question it is not lost — pressing Enter picks an answer, so an arriving
+message could have answered a permission question on your behalf. That can no longer happen.
+
+I now wait for the actual input box, or for a footer that only exists once the app is running,
+and I treat a question on screen as somewhere not to type.
+
+One honest limit: this makes typing too early far less likely, but I still report a message as
+delivered on the basis of having typed it, not on the basis of it appearing. Confirming that
+typed text actually arrived is a separate change, recorded and not bundled here.
+
+## Summary of New Capabilities
+
+- A pane showing only a startup banner is no longer classified as ready for input, so a message
+  is not injected before the session can receive it.
+- A focused selection menu is recognised as its own state and is never ready, so an arriving
+  message cannot select an option in a question meant for the operator.
+- Slash-command mentions no longer count as a readiness signal in any form — the discrimination
+  moved to markers that only exist once the TUI is running.
+- All three permission-mode footers are recognised (`bypass permissions`, `? for shortcuts`,
+  `auto-accept edits`, `shift+tab to cycle`), where previously only one was — so a session in
+  auto-accept mode no longer depends on the prompt glyph being visible.
+- The readiness verdict names which state it saw rather than answering yes/no, so the caller that
+  kills a stuck session no longer kills one that is merely waiting on a question.
+- The readiness decision is a pure, separately-testable function, so the pane text from a real
+  incident is carried as a regression fixture instead of being described.
+
+## Evidence
+
+**Reproduction (before),** real pane text against the pre-fix clause:
+
+| input | pre-fix verdict | correct verdict |
+|---|---|---|
+| the 2026-07-26 boot banner (contains `Run /model and`) | `ready` | not ready |
+| `Do you want to proceed?` + `❯ 1. Yes` / `2. No` | `ready` | menu (never ready) |
+| `Do you trust the files in this folder?` + two options | `ready` | menu (never ready) |
+| `Run /fast to enable faster output on this plan.` | `ready` | not ready |
+
+**Also falsified — the intermediate "status-bar shape" attempt,** kept here because it is the
+reason the clause was deleted rather than narrowed:
+
+| input | "shape" verdict | correct verdict |
+|---|---|---|
+| `⚠ Fable 5 promotional access ends soon · /model to opt in` | `ready` | not ready |
+| `  · /model to switch between Opus and Fable` | `ready` | not ready |
+| soft-wrapped banner putting `/model` at column 0 | `ready` | not ready |
+| `opus 5 • medium • /effort` (bullet separator) | not ready | ready |
+
+**Observed after:**
+
+| input | before | after |
+|---|---|---|
+| the 2026-07-26 boot banner | ready | **not ready** |
+| any prose or interpunct mention of `/model`, `/fast`, `/effort` | ready | **not ready** |
+| a focused startup question (3 real shapes) | ready | **menu — never typed into** |
+| ordinary output listing `1.` / `2.` above the input box | ready | ready (not mistaken for a menu) |
+| a single numbered line beside the prompt | ready | ready |
+| drawn input box (`❯`) / codex prompt (`›`) | ready | ready |
+| `⏵⏵ bypass permissions on` | ready | ready |
+| `? for shortcuts` / `auto-accept edits` / `shift+tab to cycle` | **not ready** | **ready** (newly recognised) |
+| banner that has since grown an input box | ready | ready |
+| empty / whitespace pane | not ready | not ready |
+
+**Both guards refuse.** Restoring the old slash-command clause fails six assertions; removing the
+menu classification fails three. Both include the discrimination guard, whose only job is to prove
+the probe still tells its three verdicts apart:
+
+```
+# restoring the slash-command clause
+× REGRESSION: the 2026-07-26 startup banner does NOT read as ready
+× REGRESSION: a banner line in interpunct "status-bar shape" does NOT read as ready
+× REGRESSION: a soft-wrapped banner putting /model at line start does NOT read as ready
+× an agent echoing a slash command in its own output does NOT read as ready
+× the probe discriminates > produces all three verdicts and is not stuck on one
+Tests  6 failed | 12 passed (18)
+
+# removing the menu classification
+× REGRESSION: a startup question does NOT read as ready
+× a menu is not ready to be typed into
+× the probe discriminates > produces all three verdicts and is not stuck on one
+Tests  3 failed | 15 passed (18)
+```
+
+**Scope run:** `npx tsc --noEmit` clean; every tree-scanning test under `tests/unit` plus every
+test that mocks `capture-pane` (the fixtures that feed this probe) — counts in the PR body.