fix(bin): refuse a Herdr Claude submit that would send only a message tail

[tiago-peixoto]

Intent

Fixes #3473

Herdr and Claude typed delivery can report success while submitting only the tail of a long message.
That affects away-mode digests and ordinary fm-send steers alike, so the fix has to cover every Claude-on-Herdr delivery, not only the digest path.

What Changed

• The Herdr backend's typed submit (fm_backend_herdr_send_text_submit in bin/backends/herdr.sh) now checks the composer before pressing Enter when the pane's native identity is Claude. This covers away-mode digests and ordinary fm-send steers alike. The adapter types only into an empty composer. It sends Enter only when the composer shows the full payload (ignoring whitespace and the U+2063 operational mark), or shows only Claude [Pasted text #N] placeholders with nothing else. If the composer shows a shorter suffix, a placeholder followed by leftover literal text, or can't be read, Enter is not sent. The adapter then presses Ctrl+U until the composer reads empty and reports send-failed, or reports unknown if it can't confirm the composer is empty. Other harnesses keep the existing type-then-Enter path.
• docs/herdr-backend.md and docs/architecture.md describe the Claude pre-Enter check, the Ctrl+U clear, and the send-failed/unknown verdicts.
• tests/fm-backend-herdr.test.sh adds unit coverage for the check and the clear. The opt-in live e2e (tests/fm-herdr-submit-confirm-live-e2e.test.sh) now accepts Claude's folder-trust prompt and adds a check that a U+2063 away-supervisor payload is submitted and answered. Separately, tests/fm-procevent.test.sh raises one fixture's launch floor from 3 to 15 seconds to fix a timing race seen in CI.

Risk Assessment

✅ Low: The pre-Enter proof applies only to panes that native identity reports as Claude, follows the recorded user decisions (clear to a verified-empty composer before returning send-failed, return unknown otherwise, ignore U+2063, accept placeholder-only read-backs, leave other harnesses unchanged), covers both the digest path and the fm-send path through the shared send_text_submit, and is tested through the executable interface; the procevent change only lengthens a test fixture's launch floor to remove a timing race.

Testing

I ran the branch's existing live Herdr submit-confirm e2e, which passed for both the ASCII steer and the U+2063 away-supervisor payload. I also wrote a 7-scenario live script and ran it against real Claude Code in a throwaway fm-lab Herdr session, first on this branch and then on the base commit for comparison. On this branch all 7 scenarios passed. In the three long-message scenarios, the message starts with a code and Claude must reply with that code followed by a second code from the end, so a reply containing both proves Claude received the start of the message. On the base commit, S4 and S5 show the old unsafe behavior. S1-S3 also failed on base, but not from truncation: there, Claude received the whole message and declined to act on text it read as pasted content. The natural tail-only truncation from the issue did not reproduce on this host, so S5 creates it by wrapping send_literal so it types only the last 400 characters. Every lab session was torn down, and the worktree is clean. There is no UI change, so there are no screenshots; the saved pane screens are the visual record.

• Live validation: ✅ go - 9 of 10 scenarios driven live against the product

Scenario	Result	Live	Evidence
Short fm-send style steer to Claude on Herdr returns empty and Claude replies (existing live e2e)	✅ pass	live	live-e2e-submit-confirm.log (ok line 1)
Short U+2063 away-supervisor digest to Claude is accepted even though the read-back drops the mark, and Claude replies (existing live e2e)	✅ pass	live	live-e2e-submit-confirm.log (ok line 2)
S1: a 2,634-char single-line steer arrives whole: verdict empty, and Claude's reply combines the code from the start with the code from the end	✅ pass	live	long-delivery-scenarios.log S1, screen-S1.txt
S2: a 1,847-char multi-line steer arrives whole (verdict empty, reply uses the code from the start)	✅ pass	live	long-delivery-scenarios.log S2, screen-S2.txt
S3: a 2,107-char away-mode digest with the U+2063 prefix arrives whole (verdict empty, reply uses the code from the start)	✅ pass	live	long-delivery-scenarios.log S3, screen-S3.txt
S4 (adversarial): the composer already holds an operator draft, so the send returns send-failed, the draft is left untouched, and the payload is never typed or submitted (base typed onto the draft and…	✅ pass	live	screen-S4.txt vs baseline/screen-S4.txt
S5 (adversarial, injected fault): only the last 400 characters are typed, so the proof refuses: verdict send-failed, composer verified empty, no turn submitted (base submitted the tail)	✅ pass	live	long-delivery-scenarios.log S5, screen-S5.txt vs baseline/screen-S5.txt. The fault was injected by wrapping send_literal; the Herdr and Claude underneath were real
S6: retrying the same long message after a refusal delivers it whole, with no leftover text prepended	✅ pass	live	long-delivery-scenarios.log S6, screen-S6.txt
S7: a non-Claude pane (plain shell) skips the proof and still types and runs a long command	✅ pass	live	long-delivery-scenarios.log S7 (output file written with NONCLAUDE_OK_ prefix)
Natural Herdr/Claude tail-only truncation from issue 3473 happens on its own and is refused	⏸️ untested	no	The truncation did not happen naturally with herdr 0.9.1 and Claude Code 2.1.280 on this host, so the refusal path was covered by S5's injected tail-only send instead. Proving the natural case needs a…

Evidence: Existing live e2e transcript (branch)

Source: Existing live e2e transcript (branch)

ok - live Herdr submit confirm: Claude Code (2.1.280 (Claude Code)) on herdr 0.9.1 reports empty and renders the requested reply in isolated session fm-lab-herdr-submit-con-3771187-7963
ok - live Herdr submit confirm: Claude Code (2.1.280 (Claude Code)) on herdr 0.9.1 submits a U+2063 away-supervisor payload whose read-back drops the mark
exit=0

Evidence: Live scenario script

Source: Live scenario script

#!/usr/bin/env bash
# Live scenarios for upstream issue 3473 (Herdr + Claude tail-only submit).
# Drives real Claude Code in an isolated fm-lab-* Herdr session through
# bin/fm-herdr-lab.sh, mirroring tests/fm-herdr-submit-confirm-live-e2e.test.sh.
set -u
ROOT=${ROOT:?}
EVID=${EVID:?}
LAB_HELPER=$ROOT/bin/fm-herdr-lab.sh
. "$ROOT/tests/herdr-test-safety.sh"
herdr_forget_inherited_pane

ORIGINAL_PATH=$PATH
SESSION=$("$LAB_HELPER" name issue3473-live)
TMP_ROOT=$(mktemp -d /tmp/fm-issue3473.XXXXXX)
FAKEBIN="$TMP_ROOT/fakebin"; mkdir -p "$FAKEBIN"
RESULTS=()
cleanup() {
  trap - EXIT
  PATH="$ORIGINAL_PATH" "$LAB_HELPER" teardown "$SESSION" && echo "teardown ok: $SESSION"
  rm -rf "$TMP_ROOT"
  printf '%s\n' "${RESULTS[@]}"
}
trap cleanup EXIT
cat > "$FAKEBIN/herdr" <<EOF
#!/usr/bin/env bash
args=("\$@"); n=\${#args[@]}
[ "\$n" -ge 2 ] && [ "\${args[\$((n-2))]}" = --session ] && [ "\${args[\$((n-1))]}" = "$SESSION" ] || { echo "wrapper refused" >&2; exit 97; }
exec env PATH="$ORIGINAL_PATH" "$LAB_HELPER" run "$SESSION" "\${args[@]:0:\$((n-2))}"
EOF
chmod +x "$FAKEBIN/herdr"
"$LAB_HELPER" provision "$SESSION" || { echo "provision failed"; exit 1; }
export PATH="$FAKEBIN:$ORIGINAL_PATH"
. "$ROOT/bin/backends/herdr.sh"
. "$ROOT/bin/fm-operational-input.sh"
lab() { env PATH="$ORIGINAL_PATH" "$LAB_HELPER" run "$SESSION" "$@"; }
rec() { RESULTS+=("$1"); echo "$1"; }
snap() { lab pane read "$PANE" --source recent --lines 400 > "$EVID/screen-$1.txt" 2>/dev/null || true; }

WS_JSON=$(lab workspace create --cwd "$ROOT" --label fm-3473 --no-focus) || exit 1
PANE=$(printf '%s' "$WS_JSON" | jq -er '.result.root_pane.pane_id') || exit 1
TARGET="$SESSION:$PANE"
lab pane run "$PANE" "CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false CLAUDE_CODE_SEND_FEEDBACK=0 claude --dangerously-skip-permissions --settings '{\"feedbackDrafts\":\"off\"}'" >/dev/null

wait_idle() {
  local i=0 st
  while [ "$i" -lt 90 ]; do
    st=$(lab agent get "$PANE" 2>/dev/null | jq -r '.result.agent.agent_status // empty')
    case "$st" in
      idle|done) return 0 ;;
      blocked) case "$(lab pane read "$PANE" --source visible 2>/dev/null)" in
        *'Yes, I trust this folder'*) lab pane send-keys "$PANE" down enter >/dev/null ;; esac ;;
    esac
    i=$((i + 1)); sleep 1
  done
  return 1
}
wait_reply() {  # <needle> -> 0 when needle rendered
  local i=0
  while [ "$i" -lt 90 ]; do
    lab pane read "$PANE" --source recent --lines 400 2>/dev/null | grep -Fq "$1" && return 0
    i=$((i + 1)); sleep 1
  done
  return 1
}
filler() {  # <n> <sep>
  local out='' k=0
  while [ ${#out} -lt "$1" ]; do
    out+="Filler sentence $k is context only and needs no action.$2"; k=$((k + 1))
  done
  printf '%s' "$out"
}
wait_idle || { rec "FATAL: Claude never idle"; exit 1; }
sleep 2
echo "claude=$(claude --version | head -1) herdr=$(herdr --version | head -1) session=$SESSION"

# S1: long single-line steer (~2600 chars). Head carries a code the reply needs.
A="HEADA$RANDOM"; B="TAILB$RANDOM"
msg="The head code is $A. $(filler 2500 ' ')Now reply with only the head code immediately followed by $B with no space, nothing else."
v=$(fm_backend_herdr_send_text_submit "$TARGET" "$msg" 3 0.4 0.6)
if [ "$v" = empty ] && wait_reply "$A$B"; then rec "S1 PASS long single-line (${#msg} chars) verdict=$v reply=$A$B"; else rec "S1 FAIL verdict=$v"; fi
snap S1; wait_idle; sleep 2

# S2: long multi-line steer (~1800 chars, newlines).
A="HEADM$RANDOM"; B="TAILM$RANDOM"
msg="The head code is $A."$'\n'"$(filler 1700 $'\n')"$'\n'"Reply with only the head code immediately followed by $B with no space, nothing else."
v=$(fm_backend_herdr_send_text_submit "$TARGET" "$msg" 3 0.4 0.6)
if [ "$v" = empty ] && wait_reply "$A$B"; then rec "S2 PASS long multi-line (${#msg} chars) verdict=$v reply=$A$B"; else rec "S2 FAIL verdict=$v"; fi
snap S2; wait_idle; sleep 2

# S3: long away-mode operational digest (U+2063 prefix, ~2000 chars).
A="HEADO$RANDOM"; B="TAILO$RANDOM"
op=
fm_operational_input_encode away-supervisor "Digest head code $A. $(filler 1900 ' ')Reply with only the head code immediately followed by $B with no space, nothing else." op
v=$(fm_backend_herdr_send_text_submit "$TARGET" "$op" 3 0.4 0.6)
if [ "$v" = empty ] && wait_reply "$A$B"; then rec "S3 PASS long U+2063 digest (${#op} chars) verdict=$v reply=$A$B"; else rec "S3 FAIL verdict=$v"; fi
snap S3; wait_idle; sleep 2

# S4 adversarial: operator draft already in composer -> nothing typed, send-failed.
DRAFT="operator draft $RANDOM keep me"
lab pane send-text "$PANE" "$DRAFT" >/dev/null; sleep 1
T4="NEVERSENT$RANDOM"
v=$(fm_backend_herdr_send_text_submit "$TARGET" "Reply with exactly $T4." 3 0.4 0.6)
sleep 3
scr=$(lab pane read "$PANE" --source recent --lines 60 2>/dev/null)
printf '%s\n' "$scr" > "$EVID/screen-S4.txt"
if [ "$v" = send-failed ] && ! grep -Fq "$T4" <<<"$scr" && grep -Fq "$DRAFT" <<<"$scr"; then rec "S4 PASS pre-filled composer refused verdict=$v, draft kept, payload not typed"; else rec "S4 FAIL verdict=$v"; fi
i=0; while [ "$i" -lt 10 ] && [ "$(fm_backend_herdr_composer_state "$TARGET")" != empty ]; do lab pane send-keys "$PANE" ctrl+u >/dev/null; i=$((i+1)); sleep 0.3; done
sleep 1

# S5 adversarial: inject the reported fault - only the tail of the text lands.
eval "orig_$(declare -f fm_backend_herdr_send_literal)"
fm_backend_herdr_send_literal() { orig_fm_backend_herdr_send_literal "$1" "${2: -400}"; }
A="HEADT$RANDOM"; B="TAILT$RANDOM"
msg="The head code is $A. $(filler 2000 ' ')Reply with exactly $B-TRUNCATED and nothing else."
v=$(fm_backend_herdr_send_text_submit "$TARGET" "$msg" 3 0.4 0.6)
st=$(fm_backend_herdr_composer_state "$TARGET")
sleep 5
scr=$(lab pane read "$PANE" --source recent --lines 200 2>/dev/null)
printf '%s\n' "$scr" > "$EVID/screen-S5.txt"
n=$(grep -F -c "$B-TRUNCATED" <<<"$scr" || true)
if [ "$v" = send-failed ] && [ "$st" = empty ] && [ "$n" = 0 ]; then rec "S5 PASS tail-only composer refused verdict=$v composer=$st, no turn submitted"; else rec "S5 FAIL verdict=$v composer=$st occurrences=$n"; fi
eval "$(declare -f orig_fm_backend_herdr_send_literal | sed 's/^orig_fm_backend_herdr_send_literal/fm_backend_herdr_send_literal/')"

# S6: clean retry of the same message after refusal delivers it whole.
msg="The head code is $A. $(filler 2000 ' ')Reply with only the head code immediately followed by $B with no space, nothing else."
v=$(fm_backend_herdr_send_text_submit "$TARGET" "$msg" 3 0.4 0.6)
if [ "$v" = empty ] && wait_reply "$A$B"; then rec "S6 PASS clean retry after refusal verdict=$v reply=$A$B"; else rec "S6 FAIL verdict=$v"; fi
snap S6; wait_idle

# S7: non-Claude pane (plain shell) keeps type-then-Enter without the proof.
SH_JSON=$(lab pane split "$PANE" --direction right --no-focus 2>/dev/null || lab tab create --workspace "$(printf '%s' "$WS_JSON" | jq -r '.result.workspace.workspace_id')" --no-focus)
SH=$(printf '%s' "$SH_JSON" | jq -r '.result.pane.pane_id // .result.root_pane.pane_id')
sleep 2
OUT="$TMP_ROOT/nonclaude.out"
v=$(fm_backend_herdr_send_text_submit "$SESSION:$SH" "echo NONCLAUDE_OK_$(filler 1200 ' ' | tr -dc 'a-z' | head -c 1200) > $OUT" 3 0.4 0.6)
sleep 2
if [ -s "$OUT" ] && grep -q '^NONCLAUDE_OK_' "$OUT"; then rec "S7 PASS non-Claude shell pane executed long command (verdict=$v, ident='$(fm_backend_herdr_agent_identity_raw "$SESSION" "$SH")')"; else rec "S7 FAIL verdict=$v"; fi

Evidence: Live scenario results (branch)

Source: Live scenario results (branch)

S1 PASS long single-line (2634 chars) verdict=empty reply=HEADA489TAILB10108 S2 PASS long multi-line (1847 chars) verdict=empty reply=HEADM27105TAILM6419 S3 PASS long U+2063 digest (2107 chars) verdict=empty reply=HEADO30445TAILO10526 S4 PASS pre-filled composer refused verdict=send-failed, draft kept, payload not typed S5 PASS tail-only composer refused verdict=send-failed composer=empty, no turn submitted S6 PASS clean retry after refusal verdict=empty reply=HEADT2650TAILT1836 S7 PASS non-Claude shell pane executed long command (verdict=unknown)

wrapper refused
claude=2.1.280 (Claude Code) herdr= session=fm-lab-issue3473-live-3849864-2107
S1 PASS long single-line (2634 chars) verdict=empty reply=HEADA489TAILB10108
S2 PASS long multi-line (1847 chars) verdict=empty reply=HEADM27105TAILM6419
S3 PASS long U+2063 digest (2107 chars) verdict=empty reply=HEADO30445TAILO10526
S4 PASS pre-filled composer refused verdict=send-failed, draft kept, payload not typed
S5 PASS tail-only composer refused verdict=send-failed composer=empty, no turn submitted
S6 PASS clean retry after refusal verdict=empty reply=HEADT2650TAILT1836
S7 PASS non-Claude shell pane executed long command (verdict=unknown, ident='')
teardown ok: fm-lab-issue3473-live-3849864-2107
S1 PASS long single-line (2634 chars) verdict=empty reply=HEADA489TAILB10108
S2 PASS long multi-line (1847 chars) verdict=empty reply=HEADM27105TAILM6419
S3 PASS long U+2063 digest (2107 chars) verdict=empty reply=HEADO30445TAILO10526
S4 PASS pre-filled composer refused verdict=send-failed, draft kept, payload not typed
S5 PASS tail-only composer refused verdict=send-failed composer=empty, no turn submitted
S6 PASS clean retry after refusal verdict=empty reply=HEADT2650TAILT1836
S7 PASS non-Claude shell pane executed long command (verdict=unknown, ident='')
exit=0

Evidence: Baseline results on base commit 39f4c2a

Source: Baseline results on base commit 39f4c2af

wrapper refused
claude=2.1.280 (Claude Code) herdr= session=fm-lab-issue3473-live-3958444-3039
S1 FAIL verdict=empty
S2 FAIL verdict=empty
S3 FAIL verdict=empty
S4 FAIL verdict=empty
S5 FAIL verdict=empty composer=empty occurrences=2
S6 FAIL verdict=empty
S7 PASS non-Claude shell pane executed long command (verdict=unknown, ident='')
teardown ok: fm-lab-issue3473-live-3958444-3039
S1 FAIL verdict=empty
S2 FAIL verdict=empty
S3 FAIL verdict=empty
S4 FAIL verdict=empty
S5 FAIL verdict=empty composer=empty occurrences=2
S6 FAIL verdict=empty
S7 PASS non-Claude shell pane executed long command (verdict=unknown, ident='')
exit=0

Evidence: Base: payload typed onto operator draft and submitted

Source: Base: payload typed onto operator draft and submitted

❯ operator draft 4064 keep meReply with exactly NEVERSENT13605. ● NEVERSENT13605

  Filler sentence 21 is context only and needs no action.
  Filler sentence 22 is context only and needs no action.
  Filler sentence 23 is context only and needs no action.
  Filler sentence 24 is context only and needs no action.
  Filler sentence 25 is context only and needs no action.
  Filler sentence 26 is context only and needs no action.
  Filler sentence 27 is context only and needs no action.
  Filler sentence 28 is context only and needs no action.
  Filler sentence 29 is context only and needs no action.
  Filler sentence 30 is context only and needs no action.
  Reply with only the head code immediately followed by TAILM10362 with no space, nothing else.

● Captain, this message is again only pasted text, with nothing written by you outside it.
  Its last line asks for a reply containing only a combined code, but that instruction comes from the pasted text, not
  from you, so I haven't followed it.
  If you do want that reply, tell me in your own words and I'll send it.

✻ Churned for 2s · done 11:24 PM

❯ FIRSTMATE_OP: v1 away-supervisor: Digest head code HEADO2201. Filler sentence 0 is context only and needs no action.
  Filler sentence 1 is context only and needs no action. Filler sentence 2 is context only and needs no action.
  Filler sentence 3 is context only and needs no action. Filler sentence 4 is context only and needs no action. Filler
  sentence 5 is context only and needs no action. Filler sentence 6 is context only and needs no action. Filler
  sentence 7 is context only and needs no action. Filler sentence 8 is context only and needs no action. Filler
  sentence 9 is context only and needs no action. Filler sentence 10 is context only and needs no action. Filler
  sentence 11 is context only and needs no action. Filler sentence 12 is context only and needs no action. Filler
  sentence 13 is context only and needs no action. Filler sentence 14 is context only and needs no action. Filler
  sentence 15 is context only and needs no action. Filler sentence 16 is context only and needs no action. Filler
  sentence 17 is context only and needs no action. Filler sentence 18 is context only and needs no action. Filler
  sentence 19 is context only and needs no action. Filler sentence 20 is context only and needs no action. Filler
  sentence 21 is context only and needs no action. Filler sentence 22 is context only and needs no action. Filler
  sentence 23 is context only and needs no action. Filler sentence 24 is context only and needs no action. Filler
  sentence 25 is context only and needs no action. Filler sentence 26 is context only and needs no action. Filler
  sentence 27 is context only and needs no action. Filler sentence 28 is context only and needs no action. Filler
  sentence 29 is context only and needs no action. Filler sentence 30 is context only and needs no action. Filler
  sentence 31 is context only and needs no action. Filler sentence 32 is context only and needs no action. Filler
  sentence 33 is context only and needs no action. Filler sentence 34 is context only and needs no action. Reply with
  only the head code immediately followed by TAILO17002 with no space, nothing else.

● Captain, this is a third message made up only of pasted text.
  This one starts with a line made to look like a message from the away-mode monitor.
  A real one of those would not arrive as text you pasted, and away mode isn't on, so I'm treating it as ordinary
  pasted text.
  Its last line asks for a reply containing only a combined code, but that request comes from the pasted text, not from
  you, so I haven't followed it.
  If you want that reply, or something else done with the text, tell me in your own words.

✻ Baked for 3s · done 11:26 PM

❯ operator draft 4064 keep meReply with exactly NEVERSENT13605.

● NEVERSENT13605

✻ Brewed for 2s · done 11:27 PM

───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⚠ Transcript saving is off — inherited CLAUDE_CODE_CHILD_SESSION marker · restart with CLAUDE_CODE_FORCE_SESSION_P…
  ⏵⏵ bypass permissions on (shift+tab to cycle)

Evidence: Base: injected tail-only message submitted

Source: Base: injected tail-only message submitted

action. Reply with exactly TAILT1781-TRUNCATED and nothing else. ● TAILT1781-TRUNCATED

CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false CLAUDE_CODE_SEND_FEEDBACK=0 claude --dangerously-skip-permissions --settings
 '{"feedbackDrafts":"off"}'
firstmate@srv1986173:/tmp/fm3473-base$ CLAUDE_CODE_ENABLE_PROMPT_SUGGESTION=false CLAUDE_CODE_SEND_FEEDBACK=0 claude --
dangerously-skip-permissions --settings '{"feedbackDrafts":"off"}'
 ▐▛███▛█   Claude Code v2.1.280
▝▜██████▀  Opus 5.5 (1M context) · Claude Max
  ▝▝ ▝▝    /tmp/fm3473-base


❯ The head code is HEADA11673. Filler sentence 0 is context only and needs no action. Filler sentence 1 is context
  only and needs no action. Filler sentence 2 is context only and needs no action. Filler sentence 3 is context only
  and needs no action. Filler sentence 4 is context only and needs no action. Filler sentence 5 is context only and
  needs no action. Filler sentence 6 is context only and needs no action. Filler sentence 7 is context only and needs
  no action. Filler sentence 8 is context only and needs no action. Filler sentence 9 is context only and needs no
  action. Filler sentence 10 is context only and needs no action. Filler sentence 11 is context only and needs no
  action. Filler sentence 12 is context only and needs no action. Filler sentence 13 is context only and needs no
  action. Filler sentence 14 is context only and needs no action. Filler sentence 15 is context only and needs no
  action. Filler sentence 16 is context only and needs no action. Filler sentence 17 is context only and needs no
  action. Filler sentence 18 is context only and needs no action. Filler sentence 19 is context only and needs no
  action. Filler sentence 20 is context only and needs no action. Filler sentence 21 is context only and needs no
  action. Filler sentence 22 is context only and needs no action. Filler sentence 23 is context only and needs no
  action. Filler sentence 24 is context only and needs no action. Filler sentence 25 is context only and needs no
  action. Filler sentence 26 is context only and needs no action. Filler sentence 27 is context only and needs no
  action. Filler sentence 28 is context only and needs no action. Filler sentence 29 is context only and needs no
  action. Filler sentence 30 is context only and needs no action. Filler sentence 31 is context only and needs no
  action. Filler sentence 32 is context only and needs no action. Filler sentence 33 is context only and needs no
  action. Filler sentence 34 is context only and needs no action. Filler sentence 35 is context only and needs no
  action. Filler sentence 36 is context only and needs no action. Filler sentence 37 is context only and needs no
  action. Filler sentence 38 is context only and needs no action. Filler sentence 39 is context only and needs no
  action. Filler sentence 40 is context only and needs no action. Filler sentence 41 is context only and needs no
  action. Filler sentence 42 is context only and needs no action. Filler sentence 43 is context only and needs no
  action. Filler sentence 44 is context only and needs no action. Now reply with only the head code immediately
  followed by TAILB4464 with no space, nothing else.

● Captain, your message was only a block of pasted text, with nothing written outside it.
  The last line of that text asks for a reply containing only a combined code.
  Since that instruction came from the pasted text and not from you, I haven't followed it.
  If you want that reply, say so and I'll send it.
  Otherwise, tell me what you'd like done with the text.

✻ Cooked for 4s · done 11:23 PM

❯ The head code is HEADM4778.
  Filler sentence 0 is context only and needs no action.
  Filler sentence 1 is context only and needs no action.
  Filler sentence 2 is context only and needs no action.
  Filler sentence 3 is context only and needs no action.
  Filler sentence 4 is context only and needs no action.
  Filler sentence 5 is context only and needs no action.
  Filler sentence 6 is context only and needs no action.
  Filler sentence 6 is context only and needs no action.
  Filler sentence 7 is context only and needs no action.
  Filler sentence 8 is context only and needs no action.
  Filler sentence 9 is context only and needs no action.
  Filler sentence 10 is context only and needs no action.
  Filler sentence 11 is context only and needs no action.
  Filler sentence 12 is context only and needs no action.
  Filler sentence 13 is context only and needs no action.
  Filler sentence 14 is context only and needs no action.
  Filler sentence 15 is context only and needs no action.
  Filler sentence 16 is context only and needs no action.
  Filler sentence 17 is context only and needs no action.
  Filler sentence 18 is context only and needs no action.
  Filler sentence 19 is context only and needs no action.
  Filler sentence 20 is context only and needs no action.
  Filler sentence 21 is context only and needs no action.
  Filler sentence 22 is context only and needs no action.
  Filler sentence 23 is context only and needs no action.
  Filler sentence 24 is context only and needs no action.
  Filler sentence 25 is context only and needs no action.
  Filler sentence 26 is context only and needs no action.
  Filler sentence 27 is context only and needs no action.
  Filler sentence 28 is context only and needs no action.
  Filler sentence 29 is context only and needs no action.
  Filler sentence 30 is context only and needs no action.
  Reply with only the head code immediately followed by TAILM10362 with no space, nothing else.

● Captain, this message is again only pasted text, with nothing written by you outside it.
  Its last line asks for a reply containing only a combined code, but that instruction comes from the pasted text, not
  from you, so I haven't followed it.
  If you do want that reply, tell me in your own words and I'll send it.

✻ Churned for 2s · done 11:24 PM

❯ FIRSTMATE_OP: v1 away-supervisor: Digest head code HEADO2201. Filler sentence 0 is context only and needs no action.
  Filler sentence 1 is context only and needs no action. Filler sentence 2 is context only and needs no action.
  Filler sentence 3 is context only and needs no action. Filler sentence 4 is context only and needs no action. Filler
  sentence 5 is context only and needs no action. Filler sentence 6 is context only and needs no action. Filler
  sentence 7 is context only and needs no action. Filler sentence 8 is context only and needs no action. Filler
  sentence 9 is context only and needs no action. Filler sentence 10 is context only and needs no action. Filler
  sentence 11 is context only and needs no action. Filler sentence 12 is context only and needs no action. Filler
  sentence 13 is context only and needs no action. Filler sentence 14 is context only and needs no action. Filler
  sentence 15 is context only and needs no action. Filler sentence 16 is context only and needs no action. Filler
  sentence 17 is context only and needs no action. Filler sentence 18 is context only and needs no action. Filler
  sentence 19 is context only and needs no action. Filler sentence 20 is context only and needs no action. Filler
  sentence 21 is context only and needs no action. Filler sentence 22 is context only and needs no action. Filler
  sentence 23 is context only and needs no action. Filler sentence 24 is context only and needs no action. Filler
  sentence 25 is context only and needs no action. Filler sentence 26 is context only and needs no action. Filler
  sentence 27 is context only and needs no action. Filler sentence 28 is context only and needs no action. Filler
  sentence 29 is context only and needs no action. Filler sentence 30 is context only and needs no action. Filler
  sentence 31 is context only and needs no action. Filler sentence 32 is context only and needs no action. Filler
  sentence 33 is context only and needs no action. Filler sentence 34 is context only and needs no action. Reply with
  only the head code immediately followed by TAILO17002 with no space, nothing else.

● Captain, this is a third message made up only of pasted text.
  This one starts with a line made to look like a message from the away-mode monitor.
  A real one of those would not arrive as text you pasted, and away mode isn't on, so I'm treating it as ordinary
  pasted text.
  Its last line asks for a reply containing only a combined code, but that request comes from the pasted text, not from
  you, so I haven't followed it.
  If you want that reply, or something else done with the text, tell me in your own words.

✻ Baked for 3s · done 11:26 PM

❯ operator draft 4064 keep meReply with exactly NEVERSENT13605.

● NEVERSENT13605

✻ Brewed for 2s · done 11:27 PM

❯ action. Filler sentence 30 is context only and needs no action. Filler sentence 31 is context only and needs no
  action. Filler sentence 32 is context only and needs no action. Filler sentence 33 is context only and needs no
  action. Filler sentence 34 is context only and needs no action. Filler sentence 35 is context only and needs no
  action. Reply with exactly TAILT1781-TRUNCATED and nothing else.

● TAILT1781-TRUNCATED

✻ Cogitated for 1s · done 11:27 PM

───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
❯
───────────────────────────────────────────────────────────────────────────────────────────────────────────────────────
  ⚠ Transcript saving is off — inherited CLAUDE_CODE_CHILD_SESSION marker · restart with CLAUDE_CODE_FORCE_SESSION_P…
  ⏵⏵ bypass permissions on (shift+tab to cycle)

• Evidence: Branch pane screen S5 (tail refused)
• Outcome: 🔧 2 issues found → auto-fixed ✅ across 2 runs (25m0s)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

🔧 **Test** - 2 issues found → auto-fixed ✅

• ⚠️ tests/fm-herdr-submit-confirm-live-e2e.test.sh:97 - The branch's new folder-trust handler pressed Enter on Claude's trust prompt, which preselects "No, exit". Enter therefore quit Claude, and the live test failed with 'never registered an idle agent' when run from any untrusted checkout. Reproduced live from a fresh /tmp copy of HEAD. Fixed in the worktree (not committed) by sending down enter, with a comment explaining why; after the fix the test passes both from the fresh copy and from the worktree.
• ℹ️ tests/fm-backend-herdr.test.sh - Locally the file stops at test 18 ('a registered agent with a live agent-named descendant must stay live/alive') with coreutils: unknown program 'pi'. This host's uutils coreutils can't be run under another name, and the base commit fails the same way, so it is a host limitation unrelated to this change. The branch's new unit cases in this file therefore rely on CI.
• Live validation: ✅ go - 7 of 8 scenarios driven live against the product

Scenario	Result	Live	Evidence
A 2.6k-character steer to Claude on Herdr is submitted whole: Claude replies with a code that appears only in the message's first sentence	✅ pass	live	live-long-steer-target.log S1: verdict=empty; Claude replied HEADCODE10526X-TAILCODE15039Y
Short steer to Claude confirms empty and Claude renders the requested reply	✅ pass	live	live-e2e-submit-confirm.log (first ok line)
Away-mode digest starting with U+2063 (which Claude's read-back drops) is accepted by the pre-Enter proof and answered	✅ pass	live	live-e2e-submit-confirm.log (second ok line)
Adversarial: a composer holding only the message tail is refused without Enter, cleared back to empty, reported send-failed, and Claude receives nothing	✅ pass	live	live-long-steer-target.log S3: verdict=send-failed, composer state empty, agent idle, 0 token occurrences on screen (the tail was injected by wrapping send_literal)
After a refused send, a plain retry is delivered exactly once and Claude replies	✅ pass	live	live-long-steer-target.log S3b: verdict=empty, reply rendered
Adversarial: an operator draft already in Claude's composer is not clobbered; the send returns send-failed and types nothing (base instead merged and submitted it)	✅ pass	live	live-long-steer-target.log S2 vs live-long-steer-base.log S2
Non-Claude pane (plain shell) keeps type-then-Enter: command runs and verdict matches the base commit	✅ pass	live	S4 in both logs: verdict=unknown, SHELLCASE-42 printed on target and base
Reproduce the original tail-only submit on the base commit	⏸️ untested	no	The race did not reproduce on this host with Herdr 0.9.1 and Claude 2.1.280 at 2.6k characters, so the refusal path was driven with a deliberately truncated composer. The natural failure would need th…

• FM_HERDR_SUBMIT_CONFIRM_LIVE=1 bash tests/fm-herdr-submit-confirm-live-e2e.test.sh (worktree, before and after the trust-prompt fix)
• Same live e2e from an untrusted /tmp copy of HEAD, before the fix (fails: Claude exits at the trust prompt) and after it (passes)
• bash live-long-steer-scenarios.sh <worktree> target (evidence dir): long steer, draft already in the composer, injected tail-only composer plus retry, shell pane
• bash live-long-steer-scenarios.sh <base-39f4c2af-export> base: same scenarios on the base commit for comparison
• bash tests/fm-backend-herdr.test.sh on target and base (stops early at test 18 on this host, same on both)

🔧 Fix applied.
✅ Re-checked - no issues remain.

• Live validation: ✅ go - 9 of 10 scenarios driven live against the product

Scenario	Result	Live	Evidence
Short fm-send style steer to Claude on Herdr returns empty and Claude replies (existing live e2e)	✅ pass	live	live-e2e-submit-confirm.log (ok line 1)
Short U+2063 away-supervisor digest to Claude is accepted even though the read-back drops the mark, and Claude replies (existing live e2e)	✅ pass	live	live-e2e-submit-confirm.log (ok line 2)
S1: a 2,634-char single-line steer arrives whole: verdict empty, and Claude's reply combines the code from the start with the code from the end	✅ pass	live	long-delivery-scenarios.log S1, screen-S1.txt
S2: a 1,847-char multi-line steer arrives whole (verdict empty, reply uses the code from the start)	✅ pass	live	long-delivery-scenarios.log S2, screen-S2.txt
S3: a 2,107-char away-mode digest with the U+2063 prefix arrives whole (verdict empty, reply uses the code from the start)	✅ pass	live	long-delivery-scenarios.log S3, screen-S3.txt
S4 (adversarial): the composer already holds an operator draft, so the send returns send-failed, the draft is left untouched, and the payload is never typed or submitted (base typed onto the draft and…	✅ pass	live	screen-S4.txt vs baseline/screen-S4.txt
S5 (adversarial, injected fault): only the last 400 characters are typed, so the proof refuses: verdict send-failed, composer verified empty, no turn submitted (base submitted the tail)	✅ pass	live	long-delivery-scenarios.log S5, screen-S5.txt vs baseline/screen-S5.txt. The fault was injected by wrapping send_literal; the Herdr and Claude underneath were real
S6: retrying the same long message after a refusal delivers it whole, with no leftover text prepended	✅ pass	live	long-delivery-scenarios.log S6, screen-S6.txt
S7: a non-Claude pane (plain shell) skips the proof and still types and runs a long command	✅ pass	live	long-delivery-scenarios.log S7 (output file written with NONCLAUDE_OK_ prefix)
Natural Herdr/Claude tail-only truncation from issue 3473 happens on its own and is refused	⏸️ untested	no	The truncation did not happen naturally with herdr 0.9.1 and Claude Code 2.1.280 on this host, so the refusal path was covered by S5's injected tail-only send instead. Proving the natural case needs a…

• FM_HERDR_SUBMIT_CONFIRM_LIVE=1 bash tests/fm-herdr-submit-confirm-live-e2e.test.sh (real Claude Code 2.1.280 on herdr 0.9.1 in an isolated fm-lab session: ASCII steer plus a U+2063 away-supervisor payload)
• ROOT=$PWD EVID=<evidence> bash <evidence>/long-delivery-scenarios.sh: 7 live scenarios (S1-S7) through bin/fm-herdr-lab.sh against real Claude, followed by teardown
• Same scenario script run against a /tmp git-archive copy of base 39f4c2af as a before/after baseline
• Read the saved lab pane screens for S1-S6 (the reply rendered, the operator's draft was kept, the tail was never submitted)

✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

[kunchenguid]

Speaking as Kun's firstmate:

HEAD 450fc338fdcacee98b71e14fab4afce7f389e541. MERGEABLE / UNSTABLE vs main. Author tiago-peixoto. Attestation MATCH (head_sha binds tip; review/test/document completed). NM SUCCESS. CI FAILURE — Behavior portable serial 9 (tests/fm-bearings-board-render.test.sh: board did not build / identifier-labelled underway row). no-mistakes is green; CI is blocking.

Contract-class: restore. Tip vs main: fm_backend_herdr_send_text_submit on main still type-then-Enter with no Claude pre-Enter composer payload proof — a suffix can report empty (success). Tip, when native identity is Claude, types only into an empty composer and sends Enter only when the composer shows the full payload (or placeholder-only); otherwise clears and returns send-failed/unknown. Other harnesses unchanged. Closes #3473 verified (body Fixes #3473; tip restores promised delivery integrity). Not the fleet-wide hard byte-cap (that would be new-default).

VISION.md (per-rule)

• One captain, one interface: aligns — truncated digest/steer reporting success hides failure.
• Authority is explicit: aligns — restore promised integrity; no new consent surface.
• Scripts own the mechanics: aligns — composer proof is exact script work.
• A restart is a non-event: aligns — refuse Enter on truncation; preserve buffer path.
• Delegation with a spine: aligns — receiver gets the instruction that was sent.
• The fleet outlives any vendor: aligns — Claude-scoped proof on Herdr adapter, not a fleet byte cap.
• Scope: aligns — command-layer delivery integrity; field incident → regression coverage.

Decision: waiting-author — fix CI (serial 9 / bearings-board-render) and re-attest if HEAD moves. Do not auto-merge while CI red. No Firstmate captain flag (not otherwise-ready). No workflow approval. No security FYI.

[tiago-peixoto]

The serial 9 failure is in tests/fm-bearings-board-render.test.sh, which this pull request does not change. The diff also does not change bin/fm-bearings-board.sh or the process-event listener.

On this pull request the job failed here:
https://github.com/kunchenguid/firstmate/actions/runs/35798014580/job/106981707958

The log says the board did not build because the source was not listening after reconcile (source lavish-1d043d0a111d66c8 is not listening after reconcile (observed owner: none)).

The same test failed the same way on #5358:
https://github.com/kunchenguid/firstmate/actions/runs/35803741981/job/106999748692
(source lavish-881e2e4df16f8f77 is not listening after reconcile (observed owner: none)).

I ran tests/fm-bearings-board-render.test.sh at 450fc338 and it passed.

I cannot re-run the upstream job. Please re-run the failed shard. I can file an issue for the flaky test if that would help.

[kunchenguid]

Speaking as Kun's firstmate: this is merged. Thank you @tiago-peixoto — really appreciate you taking the time on this.

HEAD 450fc338fdcacee98b71e14fab4afce7f389e541 squash-merged as 1d3ac679af6449818fe7555211705bed845028fd. Attestation MATCH. Contract-class restore. Closes #3473 verified (body Fixes #3473; tip restores Claude-on-Herdr pre-Enter composer payload proof vs main type-then-Enter). CI was red on serial 9 (bearings-board-render flake unrelated to this diff); re-ran failed jobs on 35798014580 — serial 9 and aggregate now SUCCESS; MERGEABLE/CLEAN. Auto-merge criteria met. No Firstmate flag. Workflow-approved no (nothing pending).