fix(tmux): confirm delivery by draft transition, not by prompt glyph (#1257)

send-message.sh located the REPL input box with grep -E '❯|^>|│ >'. That set is
Claude Code's box. A pi seat renders a bare U+2500 rule with no glyph, so on every
idle pi seat the capture succeeded, the grep matched nothing, status stayed
"unconfirmed", and the tool exited 2 "may be UNDELIVERED" with the paste and the
Enter both landed. The stderr tells the operator to retry, and that retry is the
duplicate delivery reported against the same tool.

Confirmation is now runtime-agnostic: our message tail sits on the input line
(located by cursor row, no glyph) before Enter and has left it after. That
transition is positive proof of submission.

Absence still proves nothing, which is the guard the 2026-08 fix was reaching for
and got backwards. Two positive checks keep it:

  - a prompt box that IS locatable and still carries our tail => draft, exit 2.
    This covers the cursor-row blind spot: a cooked pane whose foreground process
    never reads stdin echoes the paste through the kernel line discipline and
    moves the cursor off it on Enter, which by cursor row alone is indistinguishable
    from a real submit.
  - no draft ever observed on the input line => unconfirmed, non-zero.

Tests, both red-first against the shipping blob d397907:

  test-send-message-glyph-agnostic.sh (new, 6 fixtures)  4/6 -> 6/6
  test-send-message-verdict.sh (fixture 2 reshaped, 2b added)  3/4 -> 4/4

Fixture 2 of the verdict suite asserted exit 2 for a glyphless pane that submits
and was labelled "false-positive FIXED". A pi seat is that fixture, so the suite
was locking the bug in. It is reshaped deliberately, and the guard it was credited
with moves to new fixture 2b (glyphless AND non-submitting, raw/no-echo) so the
"never infer delivered from absence" property is tested positively rather than as
a side effect.

Measured on tmux 3.7b (sb-it-1-dt), 3.5a (fomo-lin), and dragon-lin.

Co-authored-by: scooby <[email protected]>

packages/mosaic/framework/tools/tmux/send-message.sh

@@ -97,13 +97,34 @@ printf '%s' "$MSG" | "${tmux_cmd[@]}" load-buffer -b "$BUF" -
 #   would otherwise accumulate forever.
 sleep 0.5
 
-# 2) Submit, then POSITIVELY confirm submission; flush with another Enter if it is
-#    still a draft. Success requires positive evidence — the queued banner, OR the
-#    REPL input box located AND clear of our message tail. The historical bug was
-#    treating ABSENCE of a draft as delivery: if the prompt glyph was never matched
-#    (wrong pane / prompt-glyph drift), an unsubmitted message read as "delivered"
-#    and worker->lead relays stalled silently. We now default to UNCONFIRMED and only
-#    upgrade to delivered on positive evidence; anything we cannot confirm fails loud.
+# 2) Submit, then POSITIVELY confirm submission by DRAFT TRANSITION, not by prompt
+#    glyph. The historical bug was treating ABSENCE of a draft as delivery; the
+#    2026-08 fix over-corrected to glyph inference (grep '❯|^>|│ >'), which locates
+#    only Claude Code's box and false-NEGATIVES every glyphless REPL (pi renders a
+#    U+2500 rule, no glyph) — a delivered message reported "UNDELIVERED", driving a
+#    retry that duplicates it. Runtime-agnostic evidence: our message tail sits on
+#    the INPUT line (located by the cursor row, not a glyph) BEFORE Enter, and has
+#    LEFT it AFTER — that transition is positive proof of submission and needs no
+#    glyph. Absence alone still never means delivered: if we never saw our draft on
+#    the input line we stay UNCONFIRMED (wrong/dead pane), and a draft that never
+#    leaves the input line stays a DRAFT (exit 2), preserving both historical guards.
+_cursor_line() { # echo the pane's current input (cursor) line, glyph-free
+  local cy line
+  cy=$("${tmux_cmd[@]}" display-message -p -t "$EFFECTIVE_TARGET" -F '#{cursor_y}' 2>/dev/null) || return 1
+  [ -n "$cy" ] || return 1
+  "${tmux_cmd[@]}" capture-pane -t "$EFFECTIVE_TARGET" -p 2>/dev/null | sed -n "$((cy + 1))p"
+}
+_draft_on_input() { # true iff our message tail is sitting on the input line now
+  [ -n "$snippet" ] || return 1
+  printf '%s' "$(_cursor_line)" | grep -qF "$snippet"
+}
+
+# Baseline: after the paste, our draft must be on the input line. This is positive
+# proof we are on the right pane and the paste landed — the anchor the transition
+# check measures against.
+saw_draft=0
+_draft_on_input && saw_draft=1
+
 status="unconfirmed"
 for attempt in $(seq 1 $((RETRIES + 1))); do
   "${tmux_cmd[@]}" send-keys -t "$EFFECTIVE_TARGET" Enter
@@ -113,20 +134,26 @@ for attempt in $(seq 1 $((RETRIES + 1))); do
   if printf '%s' "$pane" | grep -qF "$QUEUED_RE"; then
     status="queued"; break
   fi
-  # Locate the REPL input box (prompt glyph). If we cannot see it, we have NO
-  # evidence of submission state — stay UNCONFIRMED and retry; never infer delivery.
+  # POSITIVE draft evidence from a located prompt box, when one exists. This is the
+  # cursor-row check's blind spot: a pane in COOKED mode (a plain shell whose
+  # foreground process never reads stdin) echoes our paste via the kernel line
+  # discipline and moves the cursor off it on Enter, which is indistinguishable from
+  # a real submit by cursor row alone. If a prompt box IS locatable and still carries
+  # our tail, that is affirmative proof the message was not consumed. Absence of a
+  # glyph is still never used for anything — that inference is the original E7 bug.
   promptline=$(printf '%s' "$pane" | grep -E '❯|^>|│ >' | tail -1)
-  if [ -z "$promptline" ]; then
-    status="unconfirmed"; continue
-  fi
-  # Input box located AND still carrying our tail => unsubmitted draft. Flush + retry.
-  # (Submitted messages scroll up into history; a draft stays on the ❯ line.)
-  if [ -n "$snippet" ] && printf '%s' "$promptline" | grep -qF "$snippet"; then
+  if [ -n "$promptline" ] && [ -n "$snippet" ] && printf '%s' "$promptline" | grep -qF "$snippet"; then
     status="draft"; continue
   fi
-  # Input box located AND clear of our tail => positively submitted. This is the
-  # only path to success besides the queued banner.
-  status="delivered"; break
+  if [ "$saw_draft" = 1 ]; then
+    if _draft_on_input; then
+      status="draft"; continue      # still on the input line => not submitted; flush + retry
+    fi
+    status="delivered"; break        # left the input line => positively submitted
+  fi
+  # No confirmed baseline yet: try to (re)acquire it; never infer delivery from absence.
+  if _draft_on_input; then saw_draft=1; status="draft"; continue; fi
+  status="unconfirmed"; continue
 done
 
 [ "$VERBOSE" = 1 ] && { echo "--- pane tail ($TARGET) ---"; printf '%s\n' "$pane" | tail -4; echo "---"; }