From af764b47798ca3aca2e70ba1f7d55b42bb1edae2 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Thu, 6 Aug 2026 16:05:33 +0200
Subject: [PATCH 01/19] feat(detect): report CLAUDE.md closing-block signals to
 herdr

Surface the closing block as three independent channels -- blocking gates,
running agents, idle -- instead of collapsing them into one screen-scraped
status.

Screen scraping sees Claude's prompt box the instant a turn ends and calls the
pane idle (manifests/claude.toml live_prompt_box, priority 950). That is right
about the harness and wrong about the work: agents may still be running, or a
Gate may be waiting on a human.

Adds the closing-block sources to full_lifecycle_hook_authority so the Stop
hook outranks the prompt box, with a regression test asserting the authority
does not outlive the agent process. Demo harness under demo/.
---
 demo/README.md              | 124 ++++++++++++++++++++++++++
 demo/closing_block.py       | 156 +++++++++++++++++++++++++++++++++
 demo/drive.py               | 153 ++++++++++++++++++++++++++++++++
 demo/herdr-closing-block.py | 168 ++++++++++++++++++++++++++++++++++++
 demo/persistence_check.py   |  79 +++++++++++++++++
 demo/run_demo.sh            |  32 +++++++
 demo/test_closing_block.py  |  93 ++++++++++++++++++++
 src/detect/mod.rs           |   8 ++
 src/terminal/state.rs       |  64 ++++++++++++++
 9 files changed, 877 insertions(+)
 create mode 100644 demo/README.md
 create mode 100644 demo/closing_block.py
 create mode 100755 demo/drive.py
 create mode 100755 demo/herdr-closing-block.py
 create mode 100644 demo/persistence_check.py
 create mode 100755 demo/run_demo.sh
 create mode 100644 demo/test_closing_block.py

diff --git a/demo/README.md b/demo/README.md
new file mode 100644
index 0000000000..86c2461587
--- /dev/null
+++ b/demo/README.md
@@ -0,0 +1,124 @@
+# Closing-block signals → herdr
+
+Feasibility demo: surface the CLAUDE.md closing block to herdr as **three
+independent channels** instead of one collapsed status.
+
+## The question
+
+When a response ends in `**Nothing to act on.**`, can an outside observer tell
+whether that means *"idle, genuinely done"* or *"nothing for you, but agents are
+still working"* — and separately, whether blockers exist?
+
+**Yes.** The closing-block spec already emits two orthogonal fields:
+
+| Signal | Marker | Machine-readable |
+|---|---|---|
+| Human action needed | `**Critical action points (N blocking)**` vs `**Nothing to act on.**` | `N` = gate count |
+| Still working | `N agents running: <name — topic>` vs `Done here.` | counted + named |
+
+`Nothing to act on.` only replaces the *item list*, never the liveness line, so
+`Nothing to act on.` + `3 agents running:` is legal and common. Nothing needs to
+be added to CLAUDE.md — the information is already there and unambiguous.
+
+## The gap
+
+herdr has a first-class `Blocked` state (`src/detect/mod.rs:11-20`) with top
+lifecycle priority, red dot, and a "needs attention" toast. But for Claude and
+Codex it is derived purely from **screen scraping**:
+
+- `src/detect/manifests/claude.toml:41-52` — an on-screen permission form
+- `src/detect/manifests/codex.toml:7-12` — `Action Required` in the OSC title
+
+That is *harness*-blocked: waiting on a keypress. It knows nothing about
+*semantic* blocked — a **Gate**. Worse, `claude.toml:64-79` (`live_prompt_box`,
+priority 950) sees the `❯` box the instant a turn ends and calls the pane idle,
+even when three agents are still running.
+
+Meanwhile `herdr:claude` is on the **reserved** source list
+(`src/agent_resume.rs:81-93`), whose reported state is discarded and downgraded
+to session identity only. That is why herdr's own managed Claude hook
+(`~/.claude/hooks/herdr-agent-state.sh`) never reports lifecycle.
+
+## What's here
+
+| File | Role |
+|---|---|
+| `closing_block.py` | Parses the closing block into `blocking` / `agents_running` / `done_here` |
+| `test_closing_block.py` | 6 unit tests over closing blocks lifted from real transcripts |
+| `herdr-closing-block.py` | Claude Code `Stop` hook → `pane.report_agent` + `pane.report_metadata` |
+| `drive.py` | Feeds fixtures through the real hook, reads herdr back over the socket |
+| `run_demo.sh` | Boots an **isolated** herdr server and runs the above |
+| `persistence_check.py` | Checks whether a reported state survives later detection ticks |
+
+Isolation: every `HERDR_*` var is unset and the config/state/socket roots are
+redirected before the server starts. The live daily-driver server is never
+touched. (Unsetting the vars alone is not enough — herdr also autodetects a
+running server.)
+
+## Results
+
+**Python parser** — 6/6 pass.
+
+**Live socket demo, stock shipping binary** (`~/.local/bin/herdr`) — 3/3 pass:
+
+| Closing block | herdr status | tokens |
+|---|---|---|
+| `Nothing to act on.` + 3 agents running | `working` | `blocking=0 agents=3 idle=0` |
+| `Critical action points (2 blocking)` + 2 agents | `blocked` | `blocking=2 agents=2 idle=0` |
+| `Nothing to act on.` + `Done here.` | `idle` | `blocking=0 agents=0 idle=1` |
+
+`state_labels` render as `gate ×2` and `3 agents` in the sidebar.
+
+**This works on stock herdr with no Rust change**, because the hook reports under
+`herdr:claude-closing-block` — not the reserved `herdr:claude`.
+
+**Fork change** (`src/detect/mod.rs`): add `herdr:claude-closing-block` /
+`herdr:codex-closing-block` to `full_lifecycle_hook_authority`. This is what stops
+the `❯` prompt box from taking the pane back to idle at turn end. Covered by
+`closing_block_authority_outranks_visible_idle_prompt_box` in
+`src/terminal/state.rs`, which also asserts the authority does **not** outlive the
+agent process.
+
+Full `cargo test`, single-threaded, mine vs baseline: **13 failures on both
+sides, zero new**. The 13 are pre-existing codex-manifest cache drift (manifests
+are remote-updatable and the local cache has diverged from test expectations).
+
+## Two constraints found the hard way
+
+1. **A full-lifecycle source is only honoured while the real agent process is
+   confirmed in the pane** (`hook_authority_is_effective`,
+   `src/terminal/state.rs:2008-2013`). A synthetic shell pane can never qualify —
+   the report is stored and then ignored at read time, silently. This is why the
+   first fork run regressed to `unknown`: the mechanism was right, the test pane
+   was wrong.
+2. **A source must announce its own session before its state reports count.**
+   Sequences are tracked per source, and herdr's managed hook announces under
+   `herdr:claude`, so it does not cover us. The hook sends
+   `pane.report_agent_session` at `seq-1` before `pane.report_agent` at `seq`.
+   Without it the report is buffered and dropped with no error.
+
+Also fixed during the demo: metadata tokens persist across reports, so a key
+omitted on a later turn keeps its old value — a finished pane kept advertising
+agents that had already exited. The hook now always writes every key.
+
+## Not done
+
+- **Codex.** The allowlist entry exists, but no Codex-side hook is written. The
+  seam is `notify = [...]` in `~/.codex/config.toml` (already wired to a
+  `turn-ended` handler), which is the equivalent of Claude's `Stop`.
+- **UI.** Blockers and running-agents ride the existing single status field plus
+  `state_labels`/tokens. Rendering them as genuinely separate columns in the
+  sidebar is not implemented.
+- Verified against a synthetic pane and Rust unit tests, not against a live
+  `claude` process in a herdr pane end-to-end.
+
+## Running it
+
+```sh
+# stock binary
+bash demo/run_demo.sh
+
+# forked binary
+PATH="$HOME/.local/zig-0.15.2:$PATH" cargo build   # herdr pins zig 0.15.2
+HERDR_DEMO_BIN=target/debug/herdr DEMO_ROOT=/tmp/herdr-cb-fork bash demo/run_demo.sh
+```
diff --git a/demo/closing_block.py b/demo/closing_block.py
new file mode 100644
index 0000000000..bf6535ac9e
--- /dev/null
+++ b/demo/closing_block.py
@@ -0,0 +1,156 @@
+"""Parse the CLAUDE.md closing block into orthogonal herdr signals.
+
+The closing-block spec (global CLAUDE.md, "## Closing block") guarantees two
+independent fields at the end of every interactive response:
+
+  1. an action-item header -- either
+         **Critical action points (N blocking)**
+     or  **Nothing to act on.**
+  2. a liveness line -- either
+         Done here.
+     or  N agents running: <name -- topic>; <name -- topic>
+     optionally followed by named waits.
+
+They are orthogonal: "Nothing to act on." only replaces the *item list*, never
+the liveness line. So "no human action needed, but 3 agents are still working"
+is a legal and common terminal state -- and today herdr cannot see it, because
+Claude/Codex lifecycle is inferred from screen scraping alone.
+
+This module turns the block into a ClosingBlock with three independent counts so
+herdr can render them as three channels instead of one collapsed status.
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+
+# **Critical action points (3 blocking)** / (0 blocking) / bare header.
+_HEADER_RE = re.compile(
+    r"^\s*\*\*Critical action points(?:\s*\((?P<n>\d+)\s+blocking\))?\*\*\s*$",
+    re.MULTILINE,
+)
+_NOTHING_RE = re.compile(r"^\s*\*\*Nothing to act on\.?\*\*\s*$", re.MULTILINE)
+
+# "3 agents running: reviewer A -- round 4; reviewer B -- extra profile"
+_AGENTS_RE = re.compile(
+    r"^\s*(?P<n>\d+)\s+agents?\s+running:\s*(?P<rest>.+?)\s*$",
+    re.MULTILINE | re.IGNORECASE,
+)
+_DONE_RE = re.compile(r"^\s*Done here\.\s*$", re.MULTILINE)
+
+# Numbered item carrying a bold label: "1. **Gate** -- ..." / "2. **Answer** ..."
+_ITEM_RE = re.compile(
+    r"^\s*(?P<idx>\d+)[.)]\s*\*\*(?P<label>Gate|Answer|Verify)\*\*\s*(?P<body>.*?)\s*$",
+    re.MULTILINE,
+)
+
+_LABEL_SEP = re.compile(r"\s+[-—–]\s+")
+
+
+@dataclass
+class Item:
+    index: int
+    label: str  # Gate | Answer | Verify
+    text: str
+
+    @property
+    def blocking(self) -> bool:
+        # Spec: "Gates block."
+        return self.label == "Gate"
+
+
+@dataclass
+class ClosingBlock:
+    present: bool = False
+    items: list[Item] = field(default_factory=list)
+    # Count declared in the header, when the header declares one.
+    declared_blocking: int | None = None
+    agents: list[str] = field(default_factory=list)
+    declared_agents: int | None = None
+    done_here: bool = False
+
+    @property
+    def blocking(self) -> int:
+        """Number of blocking items. Header wins; item labels are the fallback."""
+        if self.declared_blocking is not None:
+            return self.declared_blocking
+        return sum(1 for i in self.items if i.blocking)
+
+    @property
+    def agents_running(self) -> int:
+        if self.declared_agents is not None:
+            return self.declared_agents
+        return len(self.agents)
+
+    @property
+    def herdr_state(self) -> str:
+        """Collapse to herdr's AgentState for `pane.report_agent`.
+
+        Only blocking items are a genuine human gate. Agents still running is
+        *working*, not blocked -- that distinction is the whole point.
+        """
+        if self.blocking > 0:
+            return "blocked"
+        if self.agents_running > 0:
+            return "working"
+        return "idle"
+
+    def message(self) -> str | None:
+        """Short human string for the herdr status row."""
+        if self.blocking > 0:
+            gates = [i for i in self.items if i.blocking]
+            head = gates[0].text if gates else ""
+            head = _LABEL_SEP.split(head, 1)[0].strip(" -—:") if head else ""
+            extra = f" (+{self.blocking - 1})" if self.blocking > 1 else ""
+            return (head or f"{self.blocking} blocking")[:80] + extra
+        if self.agents_running > 0:
+            n = self.agents_running
+            return f"{n} agent{'s' if n != 1 else ''} running"
+        return None
+
+
+def parse(text: str) -> ClosingBlock:
+    """Parse the closing block out of a full assistant message."""
+    block = ClosingBlock()
+
+    header = None
+    for header in _HEADER_RE.finditer(text):
+        pass  # keep the last -- the closing block is at the end
+    nothing = None
+    for nothing in _NOTHING_RE.finditer(text):
+        pass
+
+    # Whichever marker appears last is the operative one.
+    start = None
+    if header and (not nothing or header.start() > nothing.start()):
+        block.present = True
+        n = header.group("n")
+        block.declared_blocking = int(n) if n is not None else None
+        start = header.end()
+    elif nothing:
+        block.present = True
+        block.declared_blocking = 0
+        start = nothing.end()
+
+    if start is not None and block.declared_blocking != 0:
+        for m in _ITEM_RE.finditer(text, start):
+            block.items.append(
+                Item(int(m.group("idx")), m.group("label"), m.group("body").strip())
+            )
+
+    agents = None
+    for agents in _AGENTS_RE.finditer(text):
+        pass
+    if agents:
+        block.declared_agents = int(agents.group("n"))
+        block.agents = [
+            part.strip() for part in agents.group("rest").split(";") if part.strip()
+        ]
+        block.present = True
+    elif _DONE_RE.search(text):
+        block.done_here = True
+        block.declared_agents = 0
+        block.present = True
+
+    return block
diff --git a/demo/drive.py b/demo/drive.py
new file mode 100755
index 0000000000..1fe1a46206
--- /dev/null
+++ b/demo/drive.py
@@ -0,0 +1,153 @@
+#!/usr/bin/env python3
+"""Drive the demo: feed fixtures through the real Stop hook, read herdr back.
+
+Proves the full chain on a running herdr server:
+
+    assistant closing block
+      -> Stop hook (herdr-closing-block.py)
+      -> pane.report_agent / pane.report_metadata over $HERDR_SOCKET_PATH
+      -> herdr pane state
+
+Nothing here fakes the middle: the hook binary under test is the same file that
+would be wired into ~/.claude/settings.json.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import subprocess
+import sys
+import tempfile
+import time
+
+HERE = os.path.dirname(os.path.abspath(__file__))
+sys.path.insert(0, HERE)
+import test_closing_block as fx  # noqa: E402
+
+SOCK = os.environ["HERDR_SOCKET_PATH"]
+
+
+def rpc(method: str, params: dict | None = None) -> dict:
+    req = {"id": f"drive:{time.time_ns()}", "method": method, "params": params or {}}
+    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    client.settimeout(3.0)
+    client.connect(SOCK)
+    try:
+        client.sendall((json.dumps(req) + "\n").encode())
+        buf = b""
+        while not buf.endswith(b"\n"):
+            chunk = client.recv(65536)
+            if not chunk:
+                break
+            buf += chunk
+    finally:
+        client.close()
+    return json.loads(buf.decode() or "{}")
+
+
+def first_pane_id() -> str:
+    """Return a pane id, bootstrapping a workspace/tab if the server is empty."""
+    for attempt in range(2):
+        resp = rpc("pane.list")
+        panes = (resp.get("result") or resp).get("panes") or []
+        if panes:
+            return panes[0].get("id") or panes[0].get("pane_id")
+        if attempt:
+            break
+        ws = rpc("workspace.create", {})
+        print("workspace.create ->", json.dumps(ws)[:300])
+        tab = rpc("tab.create", {})
+        print("tab.create ->", json.dumps(tab)[:300])
+        time.sleep(0.5)
+    raise SystemExit("no panes in the isolated server")
+
+
+def run_hook(pane_id: str, transcript_text: str) -> str:
+    """Write a one-row transcript, then invoke the hook exactly as Claude would."""
+    with tempfile.NamedTemporaryFile("w", suffix=".jsonl", delete=False) as tf:
+        tf.write(
+            json.dumps(
+                {
+                    "type": "assistant",
+                    "isSidechain": False,
+                    "message": {"content": [{"type": "text", "text": transcript_text}]},
+                }
+            )
+            + "\n"
+        )
+        path = tf.name
+
+    payload = {
+        "hook_event_name": "Stop",
+        "session_id": "demo-session",
+        "transcript_path": path,
+    }
+    env = dict(os.environ, HERDR_ENV="1", HERDR_PANE_ID=pane_id,
+               HERDR_CLOSING_BLOCK_DEBUG="1")
+    proc = subprocess.run(
+        [sys.executable, os.path.join(HERE, "herdr-closing-block.py")],
+        input=json.dumps(payload), capture_output=True, text=True, env=env, timeout=10,
+    )
+    os.unlink(path)
+    if proc.returncode != 0:
+        raise SystemExit(f"hook failed rc={proc.returncode}: {proc.stderr}")
+    return proc.stderr.strip()
+
+
+def read_state(pane_id: str) -> dict:
+    resp = rpc("pane.get", {"pane_id": pane_id})
+    result = resp.get("result") or resp
+    pane = result.get("pane") if isinstance(result.get("pane"), dict) else result
+    if os.environ.get("DRIVE_DUMP"):
+        print("  raw pane.get ->", json.dumps(pane)[:1200])
+    agent = pane.get("agent") if isinstance(pane.get("agent"), dict) else {}
+    return {
+        "agent_state": pane.get("agent_state") or agent.get("state"),
+        "agent_status": pane.get("agent_status") or agent.get("status"),
+        "message": pane.get("agent_message") or agent.get("message"),
+        "tokens": pane.get("tokens") or agent.get("tokens"),
+    }
+
+
+# (name, fixture, expected herdr status, expected tokens subset)
+CASES = [
+    ("nothing to act on + 3 agents running", fx.NOTHING_BUT_AGENTS, "working",
+     {"closing_blocking": "0", "closing_agents": "3", "closing_idle": "0"}),
+    ("2 gates blocking (+2 agents)", fx.BLOCKING_GATE, "blocked",
+     {"closing_blocking": "2", "closing_agents": "2", "closing_idle": "0"}),
+    # Regression: agent names must not survive from the previous turn.
+    ("nothing to act on + done here", fx.FULLY_IDLE, "idle",
+     {"closing_blocking": "0", "closing_agents": "0", "closing_idle": "1",
+      "closing_agent_names": ""}),
+]
+
+
+def main() -> int:
+    pane_id = sys.argv[2] if len(sys.argv) > 2 else first_pane_id()
+    print(f"pane: {pane_id}\n")
+    failures = 0
+    for name, text, want, want_tokens in CASES:
+        dbg = run_hook(pane_id, text)
+        time.sleep(0.4)
+        got = read_state(pane_id)
+        state_ok = want in (got["agent_state"], got["agent_status"])
+        tokens = got["tokens"] or {}
+        bad = {k: (tokens.get(k), v) for k, v in want_tokens.items()
+               if tokens.get(k, "") != v}
+        ok = state_ok and not bad
+        failures += 0 if ok else 1
+        print(f"{'PASS' if ok else 'FAIL'}  {name}")
+        print(f"      hook emitted : {dbg or '(nothing)'}")
+        print(f"      herdr status : {got['agent_status']}  (expected {want})")
+        print(f"      herdr tokens : {tokens}")
+        if bad:
+            print(f"      TOKEN MISMATCH (got, want): {bad}")
+        print()
+    print("ALL PASS" if not failures else f"{failures} FAILED")
+    return 1 if failures else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/demo/herdr-closing-block.py b/demo/herdr-closing-block.py
new file mode 100755
index 0000000000..a0f25bd045
--- /dev/null
+++ b/demo/herdr-closing-block.py
@@ -0,0 +1,168 @@
+#!/usr/bin/env python3
+"""Claude Code `Stop` hook: report the closing block to herdr as real state.
+
+Installed *beside* herdr's managed `herdr-agent-state.sh` (which herdr overwrites
+on integration update, and which today reports session identity only -- never a
+lifecycle state).
+
+Wire into ~/.claude/settings.json:
+
+    "Stop": [{"hooks": [{"type": "command",
+      "command": "python3 /path/to/herdr-closing-block.py"}]}]
+
+Reads the Stop payload on stdin, pulls the last main-chain assistant message out
+of the transcript, parses its closing block, and emits two herdr RPCs:
+
+  pane.report_agent     -- blocked (gates) / working (agents running) / idle
+  pane.report_metadata  -- tokens so the three channels can render separately
+
+Fails silent and non-blocking in every error path: a hook must never wedge a turn.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import random
+import socket
+import sys
+import time
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from closing_block import parse  # noqa: E402
+
+SOURCE = "herdr:claude-closing-block"
+
+
+def rpc(sock_path: str, method: str, params: dict) -> None:
+    req = {
+        "id": f"{SOURCE}:{int(time.time() * 1000)}:{random.randrange(10**6):06d}",
+        "method": method,
+        "params": params,
+    }
+    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    client.settimeout(0.5)
+    try:
+        client.connect(sock_path)
+        client.sendall((json.dumps(req) + "\n").encode())
+        try:
+            client.recv(4096)
+        except OSError:
+            pass
+    finally:
+        client.close()
+
+
+def last_assistant_text(transcript_path: str) -> str | None:
+    try:
+        with open(transcript_path, encoding="utf-8") as fh:
+            rows = [json.loads(line) for line in fh if line.strip()]
+    except (OSError, ValueError):
+        return None
+    for row in reversed(rows):
+        if row.get("type") != "assistant" or row.get("isSidechain"):
+            continue
+        chunks = [
+            c.get("text", "")
+            for c in row.get("message", {}).get("content", [])
+            if c.get("type") == "text"
+        ]
+        text = "\n".join(c for c in chunks if c)
+        if text.strip():
+            return text
+    return None
+
+
+def main() -> int:
+    pane_id = os.environ.get("HERDR_PANE_ID")
+    sock_path = os.environ.get("HERDR_SOCKET_PATH")
+    if os.environ.get("HERDR_ENV") != "1" or not pane_id or not sock_path:
+        return 0
+
+    try:
+        payload = json.load(sys.stdin)
+    except (ValueError, OSError):
+        return 0
+    if payload.get("agent_id"):  # subagent stop -- never speaks for the pane
+        return 0
+
+    text = last_assistant_text(payload.get("transcript_path") or "")
+    if text is None:
+        return 0
+
+    block = parse(text)
+    if not block.present:
+        return 0
+
+    seq = time.time_ns()
+    # A full-lifecycle source must announce its own session before its state
+    # reports are honoured -- reports arriving without one are buffered and
+    # silently dropped. Sequences are tracked per source, and herdr's managed
+    # hook announces under `herdr:claude`, a different source, so that does not
+    # cover us. Announce under ours, one tick earlier.
+    session_ref = payload.get("session_id")
+    session_params = {
+        "pane_id": pane_id,
+        "source": SOURCE,
+        "agent": "claude",
+        "seq": seq - 1,
+    }
+    if session_ref:
+        session_params["agent_session_id"] = session_ref
+    if payload.get("transcript_path"):
+        session_params["agent_session_path"] = payload["transcript_path"]
+
+    agent_params = {
+        "pane_id": pane_id,
+        "source": SOURCE,
+        "agent": "claude",
+        "state": block.herdr_state,
+        "seq": seq,
+    }
+    message = block.message()
+    if message:
+        agent_params["message"] = message
+
+    # The three channels, kept separate so the UI never has to collapse them.
+    tokens = {
+        "closing_blocking": str(block.blocking),
+        "closing_agents": str(block.agents_running),
+        "closing_idle": "1" if (block.done_here and not block.agents) else "0",
+    }
+    # Always write every key. Tokens persist across reports, so omitting one
+    # leaves the previous turn's value on screen -- a finished pane would keep
+    # advertising agents that already exited.
+    tokens["closing_agent_names"] = "; ".join(block.agents)[:200]
+
+    try:
+        rpc(sock_path, "pane.report_agent_session", session_params)
+        rpc(sock_path, "pane.report_agent", agent_params)
+        rpc(
+            sock_path,
+            "pane.report_metadata",
+            {
+                "pane_id": pane_id,
+                "source": SOURCE,
+                "applies_to_source": SOURCE,
+                "tokens": tokens,
+                "state_labels": {
+                    "blocked": f"gate ×{block.blocking}" if block.blocking else "blocked",
+                    "working": (
+                        f"{block.agents_running} agents"
+                        if block.agents_running
+                        else "working"
+                    ),
+                },
+                "seq": seq,
+            },
+        )
+    except OSError:
+        return 0
+
+    if os.environ.get("HERDR_CLOSING_BLOCK_DEBUG"):
+        print(json.dumps({"state": block.herdr_state, "tokens": tokens}), file=sys.stderr)
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/demo/persistence_check.py b/demo/persistence_check.py
new file mode 100644
index 0000000000..f0505c26be
--- /dev/null
+++ b/demo/persistence_check.py
@@ -0,0 +1,79 @@
+#!/usr/bin/env python3
+"""Does a hook-reported state survive later screen-detection ticks?
+
+This is the question that decides whether the fork needs to touch
+`full_lifecycle_hook_authority` at all. Report `blocked`, then re-read the pane
+over ~8s (several detection intervals) and see whether screen scraping --
+which sees a shell prompt and concludes "idle" -- takes the pane back.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import socket
+import sys
+import time
+
+SOCK = os.environ["HERDR_SOCKET_PATH"]
+SOURCE = "herdr:claude-closing-block"
+
+
+def rpc(method: str, params: dict) -> dict:
+    req = {"id": f"pc:{time.time_ns()}", "method": method, "params": params}
+    c = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    c.settimeout(3.0)
+    c.connect(SOCK)
+    try:
+        c.sendall((json.dumps(req) + "\n").encode())
+        buf = b""
+        while not buf.endswith(b"\n"):
+            chunk = c.recv(65536)
+            if not chunk:
+                break
+            buf += chunk
+    finally:
+        c.close()
+    return json.loads(buf.decode() or "{}")
+
+
+def status(pane_id: str, dump: bool = False) -> str:
+    resp = rpc("pane.get", {"pane_id": pane_id})
+    result = resp.get("result") or resp
+    pane = result.get("pane") if isinstance(result.get("pane"), dict) else result
+    if dump:
+        print("  raw:", json.dumps(pane)[:600])
+    return pane.get("agent_status")
+
+
+def main() -> int:
+    panes = rpc("pane.list", {}).get("result", {}).get("panes") or []
+    if not panes:
+        rpc("workspace.create", {})
+        time.sleep(0.5)
+        panes = rpc("pane.list", {}).get("result", {}).get("panes") or []
+    pane_id = panes[0]["pane_id"]
+    print(f"pane: {pane_id}")
+
+    resp = rpc("pane.report_agent", {
+        "pane_id": pane_id, "source": SOURCE, "agent": "claude",
+        "state": "blocked", "message": "Gate 1: merge #30", "seq": time.time_ns(),
+    })
+    print("  report_agent ->", json.dumps(resp)[:400])
+
+    seen = []
+    for i in range(17):
+        s = status(pane_id, dump=(i == 0))
+        seen.append(s)
+        print(f"  t+{i * 0.5:4.1f}s  {s}")
+        time.sleep(0.5)
+
+    held = all(s == "blocked" for s in seen)
+    print(f"\n{'HELD' if held else 'OVERRIDDEN'}: blocked survived = {held}")
+    if not held:
+        print(f"  first non-blocked at index {next(i for i, s in enumerate(seen) if s != 'blocked')}")
+    return 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/demo/run_demo.sh b/demo/run_demo.sh
new file mode 100755
index 0000000000..04788a478a
--- /dev/null
+++ b/demo/run_demo.sh
@@ -0,0 +1,32 @@
+#!/usr/bin/env bash
+# End-to-end demo against an ISOLATED herdr server.
+#
+# Never touches the live daily-driver server: every HERDR_* var is unset first
+# and the socket/config/state roots are redirected, matching the guard used by
+# ~/.herdr-test/launch.sh (herdr also autodetects a running server, so unsetting
+# the inherited vars alone is not enough).
+set -euo pipefail
+
+DEMO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="${DEMO_ROOT:-/tmp/herdr-closing-block-demo}"
+BIN="${HERDR_DEMO_BIN:-$HOME/.local/bin/herdr}"
+
+for var in $(env | grep -o '^HERDR_[A-Z_]*' || true); do unset "$var"; done
+
+export XDG_CONFIG_HOME="$ROOT/config"
+export XDG_STATE_HOME="$ROOT/state"
+export HERDR_SOCKET_PATH="$ROOT/config/herdr/herdr.sock"
+export HERDR_CLIENT_SOCKET_PATH="$ROOT/config/herdr/herdr-client.sock"
+mkdir -p "$ROOT/config/herdr" "$XDG_STATE_HOME"
+
+echo "binary : $BIN"
+echo "socket : $HERDR_SOCKET_PATH"
+
+cleanup() { "$BIN" server stop >/dev/null 2>&1 || true; }
+trap cleanup EXIT
+
+"$BIN" server >"$ROOT/server.log" 2>&1 &
+for _ in $(seq 1 50); do [ -S "$HERDR_SOCKET_PATH" ] && break; sleep 0.2; done
+[ -S "$HERDR_SOCKET_PATH" ] || { echo "server never came up"; cat "$ROOT/server.log"; exit 1; }
+
+python3 "$DEMO_DIR/drive.py"
diff --git a/demo/test_closing_block.py b/demo/test_closing_block.py
new file mode 100644
index 0000000000..410d8fc0a5
--- /dev/null
+++ b/demo/test_closing_block.py
@@ -0,0 +1,93 @@
+"""Fixtures are real closing blocks lifted from live transcripts."""
+
+from closing_block import parse
+
+# Verbatim from the 2026-08-06 session checkpoint: the exact case herdr is
+# currently blind to -- nothing for the human, but three agents still working.
+NOTHING_BUT_AGENTS = """\
+Reviewer B failed on the `scalablehq` profile — codex usage limit, resets Aug 8.
+
+**Nothing to act on.**
+
+3 agents running: reviewer A — codex `gpt-5.6-sol` round 4; reviewer B — codex \
+`gpt-5.6-sol` round 4 on `extra` profile; independent reviewer — Claude \
+`opus·xhigh` round 4.
+"""
+
+FULLY_IDLE = """\
+CI is green on `030f8b00`.
+
+**Nothing to act on.**
+
+Done here.
+"""
+
+BLOCKING_GATE = """\
+Round 4 found two P1s. I verified both and dispatched the repair.
+
+**Critical action points (2 blocking)**
+
+1. **Gate** — Merge #30 into `fork/pr-base` once reviewer B reports.
+2. **Gate** — Approve rotating the `extra` profile credential.
+3. **Answer** — Should the PRIO panel fold sibling panes, or stay first-pane?
+
+2 agents running: repair worker — P1 watermark fix; reviewer A — round 4.
+"""
+
+NO_HEADER_COUNT = """\
+**Critical action points**
+
+1. **Answer** — Prefer teal or green for the done dot?
+
+Done here.
+"""
+
+
+def test_nothing_to_act_but_agents_running():
+    b = parse(NOTHING_BUT_AGENTS)
+    assert b.present
+    assert b.blocking == 0
+    assert b.agents_running == 3
+    assert not b.done_here
+    assert b.herdr_state == "working"
+    assert b.message() == "3 agents running"
+    assert "reviewer A" in b.agents[0]
+
+
+def test_fully_idle():
+    b = parse(FULLY_IDLE)
+    assert b.blocking == 0
+    assert b.agents_running == 0
+    assert b.done_here
+    assert b.herdr_state == "idle"
+    assert b.message() is None
+
+
+def test_blocking_gates_win_over_running_agents():
+    b = parse(BLOCKING_GATE)
+    assert b.blocking == 2
+    assert b.agents_running == 2
+    assert b.herdr_state == "blocked"
+    assert len(b.items) == 3
+    assert [i.blocking for i in b.items] == [True, True, False]
+    assert b.message() == "Merge #30 into `fork/pr-base` once reviewer B reports. (+1)"
+
+
+def test_header_without_declared_count_falls_back_to_labels():
+    b = parse(NO_HEADER_COUNT)
+    assert b.declared_blocking is None
+    assert b.blocking == 0  # one Answer, no Gate
+    assert b.herdr_state == "idle"
+
+
+def test_absent_block_is_inert():
+    b = parse("Just some prose with no closing block at all.")
+    assert not b.present
+    assert b.herdr_state == "idle"
+
+
+def test_last_marker_wins_when_body_quotes_an_earlier_one():
+    text = "Earlier I wrote:\n\n**Nothing to act on.**\n\n" + BLOCKING_GATE
+    b = parse(text)
+    assert b.blocking == 2
+    assert b.herdr_state == "blocked"
diff --git a/src/detect/mod.rs b/src/detect/mod.rs
index 787bae5a44..55d94fd5e2 100644
--- a/src/detect/mod.rs
+++ b/src/detect/mod.rs
@@ -386,6 +386,14 @@ pub(crate) fn full_lifecycle_hook_authority(source: &str, agent_label: &str) ->
             | ("herdr:opencode", "opencode")
             | ("herdr:kilo", "kilo")
             | ("herdr:kimi", "kimi")
+            // Closing-block reporter (Claude Code `Stop` hook). Screen scraping
+            // sees Claude's `❯` prompt box the instant a turn ends and calls the
+            // pane idle (manifests/claude.toml `live_prompt_box`, priority 950),
+            // which is right about the harness and wrong about the work: agents
+            // may still be running, or a Gate may be waiting on a human. The
+            // hook knows both, so it owns lifecycle for this source.
+            | ("herdr:claude-closing-block", "claude")
+            | ("herdr:codex-closing-block", "codex")
     )
 }
 
diff --git a/src/terminal/state.rs b/src/terminal/state.rs
index 774628dca3..5a5e47b93c 100644
--- a/src/terminal/state.rs
+++ b/src/terminal/state.rs
@@ -3618,6 +3618,70 @@ mod tests {
         assert_eq!(terminal.state, AgentState::Working);
     }
 
+    /// The closing-block reporter must outrank the screen scraper.
+    ///
+    /// When a Claude turn ends, `manifests/claude.toml` `live_prompt_box` sees the
+    /// `❯` box and calls the pane idle. That is right about the harness and wrong
+    /// about the work: agents may still be running, or a Gate may be waiting on a
+    /// human. The `Stop` hook knows both, so its report has to win.
+    #[test]
+    fn closing_block_authority_outranks_visible_idle_prompt_box() {
+        let mut terminal = test_terminal();
+        let session_path = test_session_path("closing-block.jsonl");
+        let now = Instant::now();
+
+        // A real claude process is in the pane -- the precondition every
+        // full-lifecycle source must satisfy.
+        terminal.set_detected_state(Some(Agent::Claude), AgentState::Idle);
+
+        // The Stop hook's session must be announced before its reports count.
+        terminal.set_agent_session_ref_for_session_start(
+            "herdr:claude-closing-block".into(),
+            "claude".into(),
+            crate::agent_resume::AgentSessionRef::path(session_path.clone()),
+            Some(999),
+            Some("startup".into()),
+        );
+        terminal.set_hook_authority_at(
+            "herdr:claude-closing-block".into(),
+            "claude".into(),
+            AgentState::Blocked,
+            Some("Gate 1: merge #30".into()),
+            crate::agent_resume::AgentSessionRef::path(session_path),
+            Some(1000),
+            now,
+        );
+
+        // Screen scraping now reports the idle prompt box. It must not win.
+        terminal.set_detected_state_with_screen_signals_at(
+            Some(Agent::Claude),
+            AgentState::Idle,
+            false,
+            true,
+            false,
+            false,
+            now + Duration::from_millis(1),
+        );
+        assert!(terminal.full_lifecycle_hook_authority_active());
+        assert_eq!(
+            terminal.state,
+            AgentState::Blocked,
+            "visible idle prompt box must not clear a reported Gate"
+        );
+
+        // And once the process is gone, the stale authority must not outlive it.
+        terminal.set_detected_state_with_screen_signals_at(
+            None,
+            AgentState::Unknown,
+            false,
+            false,
+            false,
+            true,
+            now + Duration::from_millis(2),
+        );
+        assert_ne!(terminal.state, AgentState::Blocked);
+    }
+
     #[test]
     fn rapid_restart_replays_reports_that_arrive_before_process_evidence() {
         let mut terminal = test_terminal();

From fa2369d72db3e76bd86cdf8811e73fa289a7ad12 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Thu, 6 Aug 2026 16:14:31 +0200
Subject: [PATCH 02/19] feat(detect): agent-agnostic turn-end status contract

Replace prose-shaped reporting with a structured payload any coding agent can
emit from its own turn-end hook:

    {"v":1,"agent":"claude","blocking":2,"agents":3,"gates":[...]}

blocking (items only a human can clear) and agents (still working) are
independent, so "nothing for you, but 3 agents are still running" becomes
visible for the first time.

The hook is the trigger, not the model: a turn-end hook fires deterministically,
a tool call the model must remember does not. Transport is the existing herdr
socket, with an atomic JSON mirror under XDG_STATE_HOME as durable fallback.

is_closing_block_source admits any herdr:<agent>-closing-block whose suffix
names the agent it speaks for, so adopting the contract needs no herdr release.
hook_authority_is_effective still requires that agent's process to be present.

Adapters for Claude (Stop) and Codex (notify), plus a dependency-free CLI.
---
 demo/README.md              | 142 +++++++++++++++++-----------
 demo/closing_block.py       |   7 +-
 demo/drive.py               |  68 ++++++++++++++
 demo/herdr-closing-block.py | 131 +++++---------------------
 demo/herdr-codex-notify.py  |  85 +++++++++++++++++
 demo/herdr-status           |  64 +++++++++++++
 demo/herdr_status.py        | 182 ++++++++++++++++++++++++++++++++++++
 src/detect/mod.rs           |  68 ++++++++++++--
 8 files changed, 572 insertions(+), 175 deletions(-)
 create mode 100755 demo/herdr-codex-notify.py
 create mode 100755 demo/herdr-status
 create mode 100644 demo/herdr_status.py

diff --git a/demo/README.md b/demo/README.md
index 86c2461587..ff4b093f4c 100644
--- a/demo/README.md
+++ b/demo/README.md
@@ -1,7 +1,7 @@
-# Closing-block signals → herdr
+# Turn-end agent status → herdr
 
-Feasibility demo: surface the CLAUDE.md closing block to herdr as **three
-independent channels** instead of one collapsed status.
+Surface what an agent is *actually* doing at the end of a turn as **three
+independent channels** instead of one screen-scraped status.
 
 ## The question
 
@@ -9,7 +9,7 @@ When a response ends in `**Nothing to act on.**`, can an outside observer tell
 whether that means *"idle, genuinely done"* or *"nothing for you, but agents are
 still working"* — and separately, whether blockers exist?
 
-**Yes.** The closing-block spec already emits two orthogonal fields:
+**Yes.** The CLAUDE.md closing block already emits two orthogonal fields:
 
 | Signal | Marker | Machine-readable |
 |---|---|---|
@@ -17,14 +17,13 @@ still working"* — and separately, whether blockers exist?
 | Still working | `N agents running: <name — topic>` vs `Done here.` | counted + named |
 
 `Nothing to act on.` only replaces the *item list*, never the liveness line, so
-`Nothing to act on.` + `3 agents running:` is legal and common. Nothing needs to
-be added to CLAUDE.md — the information is already there and unambiguous.
+`Nothing to act on.` + `3 agents running:` is legal and common.
 
 ## The gap
 
-herdr has a first-class `Blocked` state (`src/detect/mod.rs:11-20`) with top
-lifecycle priority, red dot, and a "needs attention" toast. But for Claude and
-Codex it is derived purely from **screen scraping**:
+herdr has a first-class `Blocked` state (`src/detect/mod.rs`) with top lifecycle
+priority, red dot, and a "needs attention" toast. But for Claude and Codex it is
+derived purely from **screen scraping**:
 
 - `src/detect/manifests/claude.toml:41-52` — an on-screen permission form
 - `src/detect/manifests/codex.toml:7-12` — `Action Required` in the OSC title
@@ -36,89 +35,126 @@ even when three agents are still running.
 
 Meanwhile `herdr:claude` is on the **reserved** source list
 (`src/agent_resume.rs:81-93`), whose reported state is discarded and downgraded
-to session identity only. That is why herdr's own managed Claude hook
-(`~/.claude/hooks/herdr-agent-state.sh`) never reports lifecycle.
+to session identity only. That is why herdr's own managed Claude hook never
+reports lifecycle.
+
+## The contract
+
+One payload, one transport, any coding agent:
+
+```json
+{"v": 1, "agent": "claude", "blocking": 2, "agents": 3,
+ "gates": ["Merge #30"], "agent_names": ["reviewer A — round 4"]}
+```
+
+`blocking` counts items only a human can clear. `agents` counts those still
+working. They are independent — `blocking=0, agents=3` is the state herdr could
+not previously see.
+
+**Hook is the trigger, JSON is the payload.** A turn-end hook fires
+deterministically; a tool call the model has to remember every turn does not.
+So the agent never has to maintain anything — its harness's existing turn-end
+hook does.
+
+**Transport is the herdr socket**, already injected into every pane as
+`$HERDR_SOCKET_PATH` and already proven. A directory watcher would be new Rust
+surface for no gain. A JSON mirror is written atomically to
+`$XDG_STATE_HOME/herdr/agent-status/<pane_id>.json` so the last known status
+survives restarts and is inspectable without the socket.
+
+Any agent reports in one line from whatever turn-end hook it has:
+
+```sh
+herdr-status --agent codex --blocking 1 --agents 2
+echo '{"blocking":0,"agents":3}' | herdr-status --agent opencode
+```
 
 ## What's here
 
 | File | Role |
 |---|---|
-| `closing_block.py` | Parses the closing block into `blocking` / `agents_running` / `done_here` |
+| `herdr_status.py` | The contract: payload, state mapping, socket push, atomic mirror |
+| `herdr-status` | Agent-agnostic CLI, no dependencies |
+| `closing_block.py` | Parses a CLAUDE.md closing block into the contract's counts |
 | `test_closing_block.py` | 6 unit tests over closing blocks lifted from real transcripts |
-| `herdr-closing-block.py` | Claude Code `Stop` hook → `pane.report_agent` + `pane.report_metadata` |
-| `drive.py` | Feeds fixtures through the real hook, reads herdr back over the socket |
+| `herdr-closing-block.py` | Claude Code `Stop` hook adapter |
+| `herdr-codex-notify.py` | Codex `notify` handler adapter |
+| `drive.py` | Feeds fixtures through the real hooks, reads herdr back over the socket |
 | `run_demo.sh` | Boots an **isolated** herdr server and runs the above |
-| `persistence_check.py` | Checks whether a reported state survives later detection ticks |
+| `persistence_check.py` | Checks a reported state survives later detection ticks |
 
 Isolation: every `HERDR_*` var is unset and the config/state/socket roots are
-redirected before the server starts. The live daily-driver server is never
-touched. (Unsetting the vars alone is not enough — herdr also autodetects a
-running server.)
+redirected before the server starts, so the live daily-driver server is never
+touched. Unsetting the vars alone is not enough — herdr also autodetects a
+running server.
 
 ## Results
 
-**Python parser** — 6/6 pass.
+**Parser** — 6/6.
 
-**Live socket demo, stock shipping binary** (`~/.local/bin/herdr`) — 3/3 pass:
+**Live socket demo against the stock shipping binary** — 5/5:
 
-| Closing block | herdr status | tokens |
-|---|---|---|
-| `Nothing to act on.` + 3 agents running | `working` | `blocking=0 agents=3 idle=0` |
-| `Critical action points (2 blocking)` + 2 agents | `blocked` | `blocking=2 agents=2 idle=0` |
-| `Nothing to act on.` + `Done here.` | `idle` | `blocking=0 agents=0 idle=1` |
+| Entry point | Input | herdr status | tokens |
+|---|---|---|---|
+| Claude `Stop` hook | `Nothing to act on.` + 3 agents | `working` | `blocking=0 agents=3 idle=0` |
+| Claude `Stop` hook | `Critical action points (2 blocking)` | `blocked` | `blocking=2 agents=2 idle=0` |
+| Claude `Stop` hook | `Nothing to act on.` + `Done here.` | `idle` | `blocking=0 agents=0 idle=1` |
+| Codex `notify` | same 2-gate block | `blocked` | mirror matches |
+| Bare CLI as `opencode` | `--blocking 0 --agents 4` | `working` | mirror matches |
 
 `state_labels` render as `gate ×2` and `3 agents` in the sidebar.
 
-**This works on stock herdr with no Rust change**, because the hook reports under
-`herdr:claude-closing-block` — not the reserved `herdr:claude`.
+**This works on stock herdr with no Rust change**, because reports go under
+`herdr:<agent>-closing-block` rather than the reserved `herdr:<agent>`.
+
+**Fork change** (`src/detect/mod.rs`): `is_closing_block_source` admits any
+`herdr:<agent>-closing-block` whose suffix names the agent it claims to speak
+for, so a new agent adopting the contract needs no herdr release. This is what
+stops the `❯` prompt box from taking the pane back to idle at turn end.
+`hook_authority_is_effective` still independently requires that agent's process
+to be present, so the shape match is not a trust hole.
 
-**Fork change** (`src/detect/mod.rs`): add `herdr:claude-closing-block` /
-`herdr:codex-closing-block` to `full_lifecycle_hook_authority`. This is what stops
-the `❯` prompt box from taking the pane back to idle at turn end. Covered by
-`closing_block_authority_outranks_visible_idle_prompt_box` in
-`src/terminal/state.rs`, which also asserts the authority does **not** outlive the
-agent process.
+Tests: `closing_block_source_matches_only_its_own_agent` (`src/detect/mod.rs`)
+and `closing_block_authority_outranks_visible_idle_prompt_box`
+(`src/terminal/state.rs`), the latter also asserting the authority does **not**
+outlive the agent process.
 
-Full `cargo test`, single-threaded, mine vs baseline: **13 failures on both
-sides, zero new**. The 13 are pre-existing codex-manifest cache drift (manifests
-are remote-updatable and the local cache has diverged from test expectations).
+`cargo fmt` clean, `cargo clippy --all-targets` clean. Full `cargo test`
+single-threaded, mine vs baseline: **13 failures on both sides, zero new**. The
+13 are pre-existing codex-manifest cache drift (manifests are remote-updatable
+and the local cache has diverged from test expectations).
 
 ## Two constraints found the hard way
 
 1. **A full-lifecycle source is only honoured while the real agent process is
    confirmed in the pane** (`hook_authority_is_effective`,
-   `src/terminal/state.rs:2008-2013`). A synthetic shell pane can never qualify —
-   the report is stored and then ignored at read time, silently. This is why the
-   first fork run regressed to `unknown`: the mechanism was right, the test pane
-   was wrong.
+   `src/terminal/state.rs`). A synthetic shell pane can never qualify — the
+   report is stored and then ignored at read time, silently.
 2. **A source must announce its own session before its state reports count.**
    Sequences are tracked per source, and herdr's managed hook announces under
-   `herdr:claude`, so it does not cover us. The hook sends
+   `herdr:<agent>`, so it does not cover us. `herdr_status.report` sends
    `pane.report_agent_session` at `seq-1` before `pane.report_agent` at `seq`.
    Without it the report is buffered and dropped with no error.
 
-Also fixed during the demo: metadata tokens persist across reports, so a key
-omitted on a later turn keeps its old value — a finished pane kept advertising
-agents that had already exited. The hook now always writes every key.
+Also fixed: metadata tokens persist across reports, so a key omitted on a later
+turn kept its old value — a finished pane kept advertising agents that had
+already exited. Every key is now written every time.
 
 ## Not done
 
-- **Codex.** The allowlist entry exists, but no Codex-side hook is written. The
-  seam is `notify = [...]` in `~/.codex/config.toml` (already wired to a
-  `turn-ended` handler), which is the equivalent of Claude's `Stop`.
-- **UI.** Blockers and running-agents ride the existing single status field plus
-  `state_labels`/tokens. Rendering them as genuinely separate columns in the
-  sidebar is not implemented.
+- **UI.** Blockers and running agents ride the existing single status field plus
+  `state_labels`/tokens. Rendering them as separate sidebar columns is not built.
 - Verified against a synthetic pane and Rust unit tests, not against a live
   `claude` process in a herdr pane end-to-end.
+- The Codex adapter is verified against a synthesised `agent-turn-complete`
+  payload, not a live `codex` turn. Codex already has a `notify` entry on this
+  machine, so wiring it means chaining, not replacing.
 
 ## Running it
 
 ```sh
-# stock binary
-bash demo/run_demo.sh
+bash demo/run_demo.sh                              # stock binary
 
-# forked binary
 PATH="$HOME/.local/zig-0.15.2:$PATH" cargo build   # herdr pins zig 0.15.2
 HERDR_DEMO_BIN=target/debug/herdr DEMO_ROOT=/tmp/herdr-cb-fork bash demo/run_demo.sh
 ```
diff --git a/demo/closing_block.py b/demo/closing_block.py
index bf6535ac9e..63a53cf053 100644
--- a/demo/closing_block.py
+++ b/demo/closing_block.py
@@ -135,9 +135,10 @@ def parse(text: str) -> ClosingBlock:
 
     if start is not None and block.declared_blocking != 0:
         for m in _ITEM_RE.finditer(text, start):
-            block.items.append(
-                Item(int(m.group("idx")), m.group("label"), m.group("body").strip())
-            )
+            # Items read "1. **Gate** — <text>"; drop the leading separator so
+            # the gate text stands alone as a status line.
+            body = m.group("body").strip().lstrip("-—–:").strip()
+            block.items.append(Item(int(m.group("idx")), m.group("label"), body))
 
     agents = None
     for agents in _AGENTS_RE.finditer(text):
diff --git a/demo/drive.py b/demo/drive.py
index 1fe1a46206..5a81a098e4 100755
--- a/demo/drive.py
+++ b/demo/drive.py
@@ -124,6 +124,73 @@ def read_state(pane_id: str) -> dict:
 ]
 
 
+def run_codex_notify(pane_id: str, text: str) -> str:
+    """Invoke the Codex notify handler exactly as codex would: one JSON argv."""
+    arg = json.dumps({"type": "agent-turn-complete", "turn-id": "t1",
+                      "last-assistant-message": text})
+    env = dict(os.environ, HERDR_ENV="1", HERDR_PANE_ID=pane_id,
+               HERDR_CLOSING_BLOCK_DEBUG="1")
+    proc = subprocess.run(
+        [sys.executable, os.path.join(HERE, "herdr-codex-notify.py"), arg],
+        capture_output=True, text=True, env=env, timeout=10,
+    )
+    return proc.stderr.strip()
+
+
+def run_cli(pane_id: str, agent: str, blocking: int, agents: int) -> str:
+    """The one-liner any other coding agent would call from its turn-end hook."""
+    env = dict(os.environ, HERDR_ENV="1", HERDR_PANE_ID=pane_id)
+    proc = subprocess.run(
+        [sys.executable, os.path.join(HERE, "herdr-status"), "--agent", agent,
+         "--blocking", str(blocking), "--agents", str(agents), "--json"],
+        capture_output=True, text=True, env=env, timeout=10, stdin=subprocess.DEVNULL,
+    )
+    return proc.stdout.strip()
+
+
+def check_mirror(pane_id: str, want_blocking: int, want_agents: int) -> bool:
+    """The durable JSON mirror must match what was pushed."""
+    sys.path.insert(0, HERE)
+    from herdr_status import mirror_path  # noqa: PLC0415
+
+    path = mirror_path(pane_id)
+    try:
+        with open(path, encoding="utf-8") as fh:
+            body = json.load(fh)
+    except (OSError, ValueError) as exc:
+        print(f"      mirror UNREADABLE at {path}: {exc}")
+        return False
+    ok = body.get("blocking") == want_blocking and body.get("agents") == want_agents
+    print(f"      mirror       : {path}")
+    print(f"                     {json.dumps(body)[:160]}")
+    return ok
+
+
+def cross_agent_phase(pane_id: str) -> int:
+    """Same contract, three different entry points."""
+    print("=== cross-agent entry points ===\n")
+    failures = 0
+
+    dbg = run_codex_notify(pane_id, fx.BLOCKING_GATE)
+    time.sleep(0.4)
+    got = read_state(pane_id)
+    ok = got["agent_status"] == "blocked" and check_mirror(pane_id, 2, 2)
+    failures += 0 if ok else 1
+    print(f"{'PASS' if ok else 'FAIL'}  codex notify -> blocked")
+    print(f"      handler      : {dbg or '(nothing)'}")
+    print(f"      herdr status : {got['agent_status']} (expected blocked)\n")
+
+    out = run_cli(pane_id, "opencode", blocking=0, agents=4)
+    time.sleep(0.4)
+    got = read_state(pane_id)
+    ok = got["agent_status"] == "working" and check_mirror(pane_id, 0, 4)
+    failures += 0 if ok else 1
+    print(f"{'PASS' if ok else 'FAIL'}  bare CLI (opencode) -> working")
+    print(f"      cli          : {out[:160] or '(nothing)'}")
+    print(f"      herdr status : {got['agent_status']} (expected working)\n")
+    return failures
+
+
 def main() -> int:
     pane_id = sys.argv[2] if len(sys.argv) > 2 else first_pane_id()
     print(f"pane: {pane_id}\n")
@@ -145,6 +212,7 @@ def main() -> int:
         if bad:
             print(f"      TOKEN MISMATCH (got, want): {bad}")
         print()
+    failures += cross_agent_phase(pane_id)
     print("ALL PASS" if not failures else f"{failures} FAILED")
     return 1 if failures else 0
 
diff --git a/demo/herdr-closing-block.py b/demo/herdr-closing-block.py
index a0f25bd045..d83b0f92e6 100755
--- a/demo/herdr-closing-block.py
+++ b/demo/herdr-closing-block.py
@@ -1,56 +1,28 @@
 #!/usr/bin/env python3
-"""Claude Code `Stop` hook: report the closing block to herdr as real state.
+"""Claude Code `Stop` hook -> herdr turn-end status.
 
-Installed *beside* herdr's managed `herdr-agent-state.sh` (which herdr overwrites
-on integration update, and which today reports session identity only -- never a
-lifecycle state).
-
-Wire into ~/.claude/settings.json:
+Installed *beside* herdr's managed `herdr-agent-state.sh`, which herdr overwrites
+on integration update and which today reports session identity only.
 
     "Stop": [{"hooks": [{"type": "command",
       "command": "python3 /path/to/herdr-closing-block.py"}]}]
 
-Reads the Stop payload on stdin, pulls the last main-chain assistant message out
-of the transcript, parses its closing block, and emits two herdr RPCs:
-
-  pane.report_agent     -- blocked (gates) / working (agents running) / idle
-  pane.report_metadata  -- tokens so the three channels can render separately
+The hook is the trigger -- it fires deterministically at turn end, unlike a tool
+call the model has to remember. It extracts the closing block from the last
+main-chain assistant message and hands the structured counts to herdr_status.
 
-Fails silent and non-blocking in every error path: a hook must never wedge a turn.
+Fails silent and non-blocking in every path.
 """
 
 from __future__ import annotations
 
 import json
 import os
-import random
-import socket
 import sys
-import time
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from closing_block import parse  # noqa: E402
-
-SOURCE = "herdr:claude-closing-block"
-
-
-def rpc(sock_path: str, method: str, params: dict) -> None:
-    req = {
-        "id": f"{SOURCE}:{int(time.time() * 1000)}:{random.randrange(10**6):06d}",
-        "method": method,
-        "params": params,
-    }
-    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
-    client.settimeout(0.5)
-    try:
-        client.connect(sock_path)
-        client.sendall((json.dumps(req) + "\n").encode())
-        try:
-            client.recv(4096)
-        except OSError:
-            pass
-    finally:
-        client.close()
+from herdr_status import report  # noqa: E402
 
 
 def last_assistant_text(transcript_path: str) -> str | None:
@@ -62,23 +34,19 @@ def last_assistant_text(transcript_path: str) -> str | None:
     for row in reversed(rows):
         if row.get("type") != "assistant" or row.get("isSidechain"):
             continue
-        chunks = [
+        text = "\n".join(
             c.get("text", "")
             for c in row.get("message", {}).get("content", [])
             if c.get("type") == "text"
-        ]
-        text = "\n".join(c for c in chunks if c)
+        )
         if text.strip():
             return text
     return None
 
 
 def main() -> int:
-    pane_id = os.environ.get("HERDR_PANE_ID")
-    sock_path = os.environ.get("HERDR_SOCKET_PATH")
-    if os.environ.get("HERDR_ENV") != "1" or not pane_id or not sock_path:
+    if os.environ.get("HERDR_ENV") != "1" or not os.environ.get("HERDR_PANE_ID"):
         return 0
-
     try:
         payload = json.load(sys.stdin)
     except (ValueError, OSError):
@@ -89,78 +57,21 @@ def main() -> int:
     text = last_assistant_text(payload.get("transcript_path") or "")
     if text is None:
         return 0
-
     block = parse(text)
     if not block.present:
         return 0
 
-    seq = time.time_ns()
-    # A full-lifecycle source must announce its own session before its state
-    # reports are honoured -- reports arriving without one are buffered and
-    # silently dropped. Sequences are tracked per source, and herdr's managed
-    # hook announces under `herdr:claude`, a different source, so that does not
-    # cover us. Announce under ours, one tick earlier.
-    session_ref = payload.get("session_id")
-    session_params = {
-        "pane_id": pane_id,
-        "source": SOURCE,
-        "agent": "claude",
-        "seq": seq - 1,
-    }
-    if session_ref:
-        session_params["agent_session_id"] = session_ref
-    if payload.get("transcript_path"):
-        session_params["agent_session_path"] = payload["transcript_path"]
-
-    agent_params = {
-        "pane_id": pane_id,
-        "source": SOURCE,
-        "agent": "claude",
-        "state": block.herdr_state,
-        "seq": seq,
-    }
-    message = block.message()
-    if message:
-        agent_params["message"] = message
-
-    # The three channels, kept separate so the UI never has to collapse them.
-    tokens = {
-        "closing_blocking": str(block.blocking),
-        "closing_agents": str(block.agents_running),
-        "closing_idle": "1" if (block.done_here and not block.agents) else "0",
-    }
-    # Always write every key. Tokens persist across reports, so omitting one
-    # leaves the previous turn's value on screen -- a finished pane would keep
-    # advertising agents that already exited.
-    tokens["closing_agent_names"] = "; ".join(block.agents)[:200]
-
-    try:
-        rpc(sock_path, "pane.report_agent_session", session_params)
-        rpc(sock_path, "pane.report_agent", agent_params)
-        rpc(
-            sock_path,
-            "pane.report_metadata",
-            {
-                "pane_id": pane_id,
-                "source": SOURCE,
-                "applies_to_source": SOURCE,
-                "tokens": tokens,
-                "state_labels": {
-                    "blocked": f"gate ×{block.blocking}" if block.blocking else "blocked",
-                    "working": (
-                        f"{block.agents_running} agents"
-                        if block.agents_running
-                        else "working"
-                    ),
-                },
-                "seq": seq,
-            },
-        )
-    except OSError:
-        return 0
-
+    outcome = report(
+        agent="claude",
+        blocking=block.blocking,
+        agents=block.agents_running,
+        gates=[i.text for i in block.items if i.blocking],
+        agent_names=block.agents,
+        session_id=payload.get("session_id"),
+        session_path=payload.get("transcript_path"),
+    )
     if os.environ.get("HERDR_CLOSING_BLOCK_DEBUG"):
-        print(json.dumps({"state": block.herdr_state, "tokens": tokens}), file=sys.stderr)
+        print(json.dumps(outcome["payload"]), file=sys.stderr)
     return 0
 
 
diff --git a/demo/herdr-codex-notify.py b/demo/herdr-codex-notify.py
new file mode 100755
index 0000000000..b3c3744257
--- /dev/null
+++ b/demo/herdr-codex-notify.py
@@ -0,0 +1,85 @@
+#!/usr/bin/env python3
+"""Codex `notify` handler -> herdr turn-end status.
+
+Codex invokes the notify program with a single JSON argument. For a finished
+turn it carries the assistant's final message, which is all we need:
+
+    notify = ["python3", "/path/to/herdr-codex-notify.py"]
+
+Codex already has a notify entry on this machine. Chain rather than replace:
+
+    notify = ["/path/to/chain.sh"]     # calls the existing handler, then this
+
+Fails silent and non-blocking in every path.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from closing_block import parse  # noqa: E402
+from herdr_status import report  # noqa: E402
+
+# Codex has used both spellings across versions.
+TURN_DONE = {"agent-turn-complete", "agent_turn_complete", "turn-ended", "turn_ended"}
+MESSAGE_KEYS = ("last-assistant-message", "last_assistant_message", "message")
+
+
+def load_payload(argv: list[str]) -> dict:
+    for arg in argv:
+        try:
+            body = json.loads(arg)
+        except ValueError:
+            continue
+        if isinstance(body, dict):
+            return body
+    if not sys.stdin.isatty():
+        try:
+            body = json.load(sys.stdin)
+            if isinstance(body, dict):
+                return body
+        except (ValueError, OSError):
+            pass
+    return {}
+
+
+def main() -> int:
+    if os.environ.get("HERDR_ENV") != "1" or not os.environ.get("HERDR_PANE_ID"):
+        return 0
+    payload = load_payload(sys.argv[1:])
+    kind = str(payload.get("type") or payload.get("event") or "")
+    if kind and kind not in TURN_DONE:
+        return 0
+
+    text = next(
+        (payload[k] for k in MESSAGE_KEYS if isinstance(payload.get(k), str)), None
+    )
+    if not text:
+        return 0
+    block = parse(text)
+    if not block.present:
+        return 0
+
+    outcome = report(
+        agent="codex",
+        blocking=block.blocking,
+        agents=block.agents_running,
+        gates=[i.text for i in block.items if i.blocking],
+        agent_names=block.agents,
+        session_id=payload.get("turn-id") or payload.get("turn_id"),
+    )
+    if os.environ.get("HERDR_CLOSING_BLOCK_DEBUG"):
+        print(json.dumps(outcome["payload"]), file=sys.stderr)
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except SystemExit:
+        raise
+    except Exception:  # noqa: BLE001 -- never wedge a turn
+        raise SystemExit(0)
diff --git a/demo/herdr-status b/demo/herdr-status
new file mode 100755
index 0000000000..93917071ca
--- /dev/null
+++ b/demo/herdr-status
@@ -0,0 +1,64 @@
+#!/usr/bin/env python3
+"""Report turn-end status to herdr. Agent-agnostic, no dependencies.
+
+    herdr-status --agent codex --blocking 1 --agents 2
+    echo '{"blocking":0,"agents":3}' | herdr-status --agent opencode
+
+Exits 0 unconditionally: a turn-end hook must never wedge a turn.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import os
+import sys
+
+sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
+from herdr_status import report  # noqa: E402
+
+
+def main() -> int:
+    p = argparse.ArgumentParser(prog="herdr-status", description=__doc__)
+    p.add_argument("--agent", default="claude", help="agent label, e.g. claude, codex")
+    p.add_argument("--blocking", type=int, help="count of items only a human can clear")
+    p.add_argument("--agents", type=int, help="count of agents still working")
+    p.add_argument("--gate", action="append", default=[], help="repeatable gate text")
+    p.add_argument("--agent-name", action="append", default=[], help="repeatable")
+    p.add_argument("--session-id")
+    p.add_argument("--session-path")
+    p.add_argument("--json", action="store_true", help="print what was reported")
+    args = p.parse_args()
+
+    body: dict = {}
+    if args.blocking is None or args.agents is None:
+        if not sys.stdin.isatty():
+            try:
+                body = json.loads(sys.stdin.read() or "{}")
+            except ValueError:
+                body = {}
+
+    blocking = args.blocking if args.blocking is not None else int(body.get("blocking", 0))
+    agents = args.agents if args.agents is not None else int(body.get("agents", 0))
+
+    outcome = report(
+        agent=args.agent or body.get("agent") or "claude",
+        blocking=max(0, blocking),
+        agents=max(0, agents),
+        gates=args.gate or body.get("gates") or [],
+        agent_names=args.agent_name or body.get("agent_names") or [],
+        session_id=args.session_id or body.get("session_id"),
+        session_path=args.session_path or body.get("session_path"),
+    )
+    if args.json:
+        print(json.dumps(outcome))
+    return 0
+
+
+if __name__ == "__main__":
+    try:
+        raise SystemExit(main())
+    except SystemExit:
+        raise
+    except Exception:  # noqa: BLE001 -- never wedge a turn
+        raise SystemExit(0)
diff --git a/demo/herdr_status.py b/demo/herdr_status.py
new file mode 100644
index 0000000000..515d07a260
--- /dev/null
+++ b/demo/herdr_status.py
@@ -0,0 +1,182 @@
+"""Agent-agnostic turn-end status contract for herdr.
+
+One payload, one transport, any coding agent.
+
+    {"v": 1, "agent": "claude", "blocking": 2, "agents": 3,
+     "gates": ["Merge #30"], "agent_names": ["reviewer A — round 4"]}
+
+`blocking` is the count of items only a human can clear (CLAUDE.md **Gate**
+items). `agents` is the count still working. They are independent: "nothing for
+you, but 3 agents are still running" is `blocking=0, agents=3`, which is exactly
+the state herdr could not previously see.
+
+Transport is the herdr socket at $HERDR_SOCKET_PATH -- already injected into
+every pane, already proven. A JSON mirror is written atomically to
+$XDG_STATE_HOME/herdr/agent-status/<pane_id>.json so the last known status
+survives herdr restarts and is inspectable without the socket.
+
+Any agent can report in one line from its own turn-end hook:
+
+    herdr-status --agent codex --blocking 1 --agents 2
+    echo '{"blocking":0,"agents":3}' | herdr-status --agent opencode
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import random
+import socket
+import tempfile
+import time
+
+VERSION = 1
+
+
+def state_for(blocking: int, agents: int) -> str:
+    """Collapse the channels to herdr's AgentState.
+
+    Only a human gate is genuinely *blocked*. Agents still working is *working*
+    -- keeping those apart is the whole point.
+    """
+    if blocking > 0:
+        return "blocked"
+    if agents > 0:
+        return "working"
+    return "idle"
+
+
+def message_for(blocking: int, agents: int, gates: list[str]) -> str | None:
+    if blocking > 0:
+        head = (gates[0] if gates else "").strip()
+        extra = f" (+{blocking - 1})" if blocking > 1 else ""
+        return ((head or f"{blocking} blocking")[:80]) + extra
+    if agents > 0:
+        return f"{agents} agent{'s' if agents != 1 else ''} running"
+    return None
+
+
+def mirror_path(pane_id: str) -> str:
+    root = os.environ.get("XDG_STATE_HOME") or os.path.expanduser("~/.local/state")
+    d = os.path.join(root, "herdr", "agent-status")
+    os.makedirs(d, exist_ok=True)
+    return os.path.join(d, f"{pane_id.replace(':', '_')}.json")
+
+
+def write_mirror(pane_id: str, payload: dict) -> str | None:
+    """Atomic write -- a torn status file is worse than a stale one."""
+    path = mirror_path(pane_id)
+    try:
+        fd, tmp = tempfile.mkstemp(dir=os.path.dirname(path), suffix=".tmp")
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            json.dump(payload, fh)
+        os.replace(tmp, path)
+        return path
+    except OSError:
+        return None
+
+
+def _rpc(sock_path: str, source: str, method: str, params: dict) -> None:
+    req = {
+        "id": f"{source}:{int(time.time() * 1000)}:{random.randrange(10**6):06d}",
+        "method": method,
+        "params": params,
+    }
+    client = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+    client.settimeout(0.5)
+    try:
+        client.connect(sock_path)
+        client.sendall((json.dumps(req) + "\n").encode())
+        try:
+            client.recv(4096)
+        except OSError:
+            pass
+    finally:
+        client.close()
+
+
+def report(
+    *,
+    agent: str,
+    blocking: int,
+    agents: int,
+    gates: list[str] | None = None,
+    agent_names: list[str] | None = None,
+    session_id: str | None = None,
+    session_path: str | None = None,
+    pane_id: str | None = None,
+    sock_path: str | None = None,
+) -> dict:
+    """Push one turn-end status. Never raises; returns what it did."""
+    gates = gates or []
+    agent_names = agent_names or []
+    pane_id = pane_id or os.environ.get("HERDR_PANE_ID") or ""
+    sock_path = sock_path or os.environ.get("HERDR_SOCKET_PATH") or ""
+
+    seq = time.time_ns()
+    state = state_for(blocking, agents)
+    payload = {
+        "v": VERSION,
+        "agent": agent,
+        "seq": seq,
+        "state": state,
+        "blocking": blocking,
+        "agents": agents,
+        "gates": gates,
+        "agent_names": agent_names,
+    }
+
+    outcome = {"payload": payload, "mirror": None, "socket": False}
+    if pane_id:
+        outcome["mirror"] = write_mirror(pane_id, payload)
+    if not (pane_id and sock_path):
+        return outcome
+
+    source = f"herdr:{agent}-closing-block"
+    # A full-lifecycle source must announce its own session before its state
+    # reports are honoured; sequences are tracked per source, so herdr's managed
+    # hook (which announces under `herdr:<agent>`) does not cover us. Without
+    # this the report is buffered and dropped with no error.
+    session_params = {"pane_id": pane_id, "source": source, "agent": agent,
+                      "seq": seq - 1}
+    if session_id:
+        session_params["agent_session_id"] = session_id
+    if session_path:
+        session_params["agent_session_path"] = session_path
+
+    agent_params = {"pane_id": pane_id, "source": source, "agent": agent,
+                    "state": state, "seq": seq}
+    message = message_for(blocking, agents, gates)
+    if message:
+        agent_params["message"] = message
+
+    # Always write every token. Tokens persist across reports, so omitting one
+    # leaves the previous turn's value on screen -- a finished pane would keep
+    # advertising agents that already exited.
+    tokens = {
+        "closing_blocking": str(blocking),
+        "closing_agents": str(agents),
+        "closing_idle": "1" if state == "idle" else "0",
+        "closing_agent_names": "; ".join(agent_names)[:200],
+        "closing_gates": "; ".join(gates)[:200],
+    }
+    meta_params = {
+        "pane_id": pane_id,
+        "source": source,
+        "applies_to_source": source,
+        "tokens": tokens,
+        "state_labels": {
+            "blocked": f"gate ×{blocking}" if blocking else "blocked",
+            "working": f"{agents} agents" if agents else "working",
+        },
+        "seq": seq,
+    }
+
+    try:
+        _rpc(sock_path, source, "pane.report_agent_session", session_params)
+        _rpc(sock_path, source, "pane.report_agent", agent_params)
+        _rpc(sock_path, source, "pane.report_metadata", meta_params)
+        outcome["socket"] = True
+    except OSError:
+        pass  # mirror already written; a hook must never wedge a turn
+    return outcome
diff --git a/src/detect/mod.rs b/src/detect/mod.rs
index 55d94fd5e2..83eca68e85 100644
--- a/src/detect/mod.rs
+++ b/src/detect/mod.rs
@@ -386,15 +386,29 @@ pub(crate) fn full_lifecycle_hook_authority(source: &str, agent_label: &str) ->
             | ("herdr:opencode", "opencode")
             | ("herdr:kilo", "kilo")
             | ("herdr:kimi", "kimi")
-            // Closing-block reporter (Claude Code `Stop` hook). Screen scraping
-            // sees Claude's `❯` prompt box the instant a turn ends and calls the
-            // pane idle (manifests/claude.toml `live_prompt_box`, priority 950),
-            // which is right about the harness and wrong about the work: agents
-            // may still be running, or a Gate may be waiting on a human. The
-            // hook knows both, so it owns lifecycle for this source.
-            | ("herdr:claude-closing-block", "claude")
-            | ("herdr:codex-closing-block", "codex")
-    )
+    ) || is_closing_block_source(source, agent_label)
+}
+
+/// Turn-end status reported by an agent's own hook, under `herdr:<agent>-closing-block`.
+///
+/// Screen scraping sees Claude's `❯` prompt box the instant a turn ends and
+/// calls the pane idle (`manifests/claude.toml` `live_prompt_box`, priority
+/// 950). That is right about the harness and wrong about the work: agents may
+/// still be running, or a gate may be waiting on a human. The hook knows both,
+/// so it owns lifecycle for its own source.
+///
+/// Matched by shape rather than an allowlist so any agent adopting the contract
+/// works without a herdr release. The source must still name the agent it
+/// claims to speak for, and `hook_authority_is_effective` independently
+/// requires that agent's process to be present in the pane.
+pub(crate) fn is_closing_block_source(source: &str, agent_label: &str) -> bool {
+    if agent_label.is_empty() {
+        return false;
+    }
+    source
+        .strip_prefix("herdr:")
+        .and_then(|rest| rest.strip_suffix("-closing-block"))
+        .is_some_and(|claimed| claimed == agent_label)
 }
 
 pub(crate) fn session_identity_only_integration(source: &str, agent_label: &str) -> bool {
@@ -735,6 +749,42 @@ fn is_python_runtime(name: &str) -> bool {
 
 #[cfg(test)]
 mod tests {
+
+    #[test]
+    fn closing_block_source_matches_only_its_own_agent() {
+        use super::{full_lifecycle_hook_authority, is_closing_block_source};
+        assert!(is_closing_block_source(
+            "herdr:claude-closing-block",
+            "claude"
+        ));
+        assert!(is_closing_block_source(
+            "herdr:codex-closing-block",
+            "codex"
+        ));
+        assert!(is_closing_block_source(
+            "herdr:opencode-closing-block",
+            "opencode"
+        ));
+        assert!(full_lifecycle_hook_authority(
+            "herdr:claude-closing-block",
+            "claude"
+        ));
+
+        // A source may not speak for an agent it does not name.
+        assert!(!is_closing_block_source(
+            "herdr:claude-closing-block",
+            "codex"
+        ));
+        assert!(!is_closing_block_source(
+            "herdr:evil-closing-block",
+            "claude"
+        ));
+        assert!(!is_closing_block_source("claude-closing-block", "claude"));
+        assert!(!is_closing_block_source("herdr:claude", "claude"));
+        assert!(!is_closing_block_source("herdr:-closing-block", ""));
+        // Reserved native sources keep their existing meaning.
+        assert!(!full_lifecycle_hook_authority("herdr:claude", "claude"));
+    }
     use super::*;
 
     fn foreground_process(

From 37cf11cf576c07b29d706df722717e11ee9cbe0c Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Thu, 6 Aug 2026 16:33:00 +0200
Subject: [PATCH 03/19] fix(terminal): admit closing-block reports that carry
 no session ref

The turn-end status contract was accepted at the RPC edge and then dropped
inside TerminalState, while the caller still saw {"type":"ok"} because
handle_pane_report_agent discards the mutation.

Two gates rejected it, both keyed on session identity:

- route_full_lifecycle_hook_report requires an AgentSessionRef, but
  agent_resume::session_ref_from_report mints one only for sources on the
  is_official_agent_source allowlist. A closing-block source reports what the
  agent just said, not where to resume it, so its ref is always None and every
  admitting path was unreachable.
- set_hook_authority_at rejected the report as an owner conflict on any pane
  where the real agent had already announced itself under herdr:<agent> -- that
  is, every pane that matters.

Accept on process presence instead, which is the only guarantee this source
claims; accept_hook_report still enforces per-source sequence monotonicity.

The existing test passed a session ref the RPC can never produce, so it stayed
green while the live path dropped every report. It now reports with None
against a pane whose session is owned by herdr:claude, and fails without the
fix.

Verified end-to-end against a live claude process: blocked survives the visible
prompt box, repeated detection ticks, and focusing the tab.
---
 demo/preview.sh       | 52 +++++++++++++++++++++++++++++++++++++++++++
 src/terminal/state.rs | 40 ++++++++++++++++++++++++++++-----
 2 files changed, 87 insertions(+), 5 deletions(-)
 create mode 100755 demo/preview.sh

diff --git a/demo/preview.sh b/demo/preview.sh
new file mode 100755
index 0000000000..efec126f80
--- /dev/null
+++ b/demo/preview.sh
@@ -0,0 +1,52 @@
+#!/usr/bin/env bash
+# Isolated preview of PR #31, with a live pane you can watch change state.
+#
+# Runs against its own config/state/socket so it can never attach to the live
+# herdr server. Both guards are required: unsetting inherited HERDR_* vars alone
+# is not enough, because herdr also autodetects a running server.
+set -euo pipefail
+
+DEMO_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+ROOT="$HOME/.herdr-cb-preview"
+BIN="$DEMO_DIR/../target/release/herdr"
+
+for var in $(env | grep -o '^HERDR_[A-Z_]*' || true); do unset "$var"; done
+
+export XDG_CONFIG_HOME="$ROOT/config"
+export XDG_STATE_HOME="$ROOT/state"
+export HERDR_SOCKET_PATH="$ROOT/config/herdr/herdr.sock"
+export HERDR_CLIENT_SOCKET_PATH="$ROOT/config/herdr/herdr-client.sock"
+mkdir -p "$ROOT/config/herdr" "$XDG_STATE_HOME"
+
+# Mirror the real config so keybindings (prefix = ctrl+a) match the live session.
+[ -f "$HOME/.config/herdr/config.toml" ] &&
+  cp -L "$HOME/.config/herdr/config.toml" "$ROOT/config/herdr/config.toml"
+
+cat <<BANNER
+herdr preview — PR #31, turn-end status contract
+
+  binary : $BIN
+  socket : $HERDR_SOCKET_PATH
+
+Watch the pane's status dot and label in the sidebar, then from any other
+terminal drive it through the three channels:
+
+  export HERDR_SOCKET_PATH=$HERDR_SOCKET_PATH
+  export HERDR_ENV=1 HERDR_PANE_ID=w1:p1
+
+  # nothing for you, but 3 agents still running  -> working / "3 agents"
+  $DEMO_DIR/herdr-status --agent claude --blocking 0 --agents 3
+
+  # two human gates                              -> blocked / "gate x2"
+  $DEMO_DIR/herdr-status --agent claude --blocking 2 --agents 2 \\
+      --gate "Merge #30 into fork/pr-base"
+
+  # genuinely done                               -> idle
+  $DEMO_DIR/herdr-status --agent claude --blocking 0 --agents 0
+
+  # durable JSON mirror
+  cat $ROOT/state/herdr/agent-status/w1_p1.json
+
+BANNER
+
+exec "$BIN" "$@"
diff --git a/src/terminal/state.rs b/src/terminal/state.rs
index 5a5e47b93c..2cfb6fbd54 100644
--- a/src/terminal/state.rs
+++ b/src/terminal/state.rs
@@ -920,7 +920,13 @@ impl TerminalState {
         if self.known_agent_label_conflicts_with_detected_agent(&agent_label) {
             return None;
         }
-        let owner_conflicts = self.current_session_owner_conflicts(&source, &agent_label);
+        // A closing-block source claims no resume session, so it cannot contend
+        // for the pane's session identity — that stays owned by the agent's own
+        // integration (`herdr:claude`). Without this exemption the status report
+        // is rejected here on every pane where the real agent has already
+        // announced itself, which is every pane that matters.
+        let owner_conflicts = !crate::detect::is_closing_block_source(&source, &agent_label)
+            && self.current_session_owner_conflicts(&source, &agent_label);
         let foreground_takeover_allowed = owner_conflicts
             && self.foreground_agent_confirms_hook_authority_takeover(
                 &source,
@@ -1158,6 +1164,23 @@ impl TerminalState {
                     .as_ref()
                     .is_none_or(|incoming| incoming == anchored)
             });
+        // A closing-block source reports what the agent just said, not where to
+        // resume it, so it never carries an `AgentSessionRef`
+        // (`agent_resume::session_ref_from_report` mints one only for official
+        // sources). Every path below admits a report by anchoring it to a
+        // session, so without this arm the report is unreachable: it falls to
+        // the `session_ref` bail-out and is stored as a pending replacement that
+        // nothing ever drains while the agent stays continuously detected.
+        //
+        // Presence of the agent's own process in the pane is the entire guard
+        // this source claims (see `detect::is_closing_block_source`), and
+        // `accept_hook_report` still enforces per-source sequence monotonicity
+        // downstream, so accepting on presence alone loses no protection.
+        if process_present && crate::detect::is_closing_block_source(source, agent_label) {
+            return FullLifecycleHookReportRoute::Accept {
+                reanchor_sequence: false,
+            };
+        }
         if let Some(suppressed) = self.suppressed_full_lifecycle_hook_reports.get(source) {
             if suppressed.agent_label != agent_label {
                 return FullLifecycleHookReportRoute::Ignore;
@@ -3634,20 +3657,27 @@ mod tests {
         // full-lifecycle source must satisfy.
         terminal.set_detected_state(Some(Agent::Claude), AgentState::Idle);
 
-        // The Stop hook's session must be announced before its reports count.
+        // The pane's session identity is already owned by claude's own
+        // integration, as it is on any pane running a real agent. The
+        // closing-block source must report *alongside* that owner, not fight it.
         terminal.set_agent_session_ref_for_session_start(
-            "herdr:claude-closing-block".into(),
+            "herdr:claude".into(),
             "claude".into(),
-            crate::agent_resume::AgentSessionRef::path(session_path.clone()),
+            crate::agent_resume::AgentSessionRef::path(session_path),
             Some(999),
             Some("startup".into()),
         );
+
+        // Exactly what the RPC produces: no session ref. `session_ref_from_report`
+        // mints one only for official sources, so a closing-block report always
+        // arrives with `None`. An earlier version of this test passed `Some(..)`
+        // here and stayed green while the live path silently dropped every report.
         terminal.set_hook_authority_at(
             "herdr:claude-closing-block".into(),
             "claude".into(),
             AgentState::Blocked,
             Some("Gate 1: merge #30".into()),
-            crate::agent_resume::AgentSessionRef::path(session_path),
+            None,
             Some(1000),
             now,
         );

From e0fc8739b053e836b257ad393afe62f89766eece Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Thu, 6 Aug 2026 16:33:33 +0200
Subject: [PATCH 04/19] docs: correct the override claim with live end-to-end
 evidence

---
 demo/README.md | 54 ++++++++++++++++++++++++++++++++++++++++++++------
 1 file changed, 48 insertions(+), 6 deletions(-)

diff --git a/demo/README.md b/demo/README.md
index ff4b093f4c..c61ee9d312 100644
--- a/demo/README.md
+++ b/demo/README.md
@@ -107,18 +107,58 @@ running server.
 **This works on stock herdr with no Rust change**, because reports go under
 `herdr:<agent>-closing-block` rather than the reserved `herdr:<agent>`.
 
-**Fork change** (`src/detect/mod.rs`): `is_closing_block_source` admits any
-`herdr:<agent>-closing-block` whose suffix names the agent it claims to speak
-for, so a new agent adopting the contract needs no herdr release. This is what
-stops the `❯` prompt box from taking the pane back to idle at turn end.
+**Live end-to-end against a real `claude` process** — the check that matters,
+and the one that initially failed:
+
+| Reported | herdr status | label |
+|---|---|---|
+| `blocking=0 agents=3` | `working` | `3 agents` |
+| `blocking=2 agents=2` + gate | `blocked` | `gate ×2` |
+| same, 3 detection ticks later | `blocked` | `gate ×2` |
+| same, after focusing the tab | `blocked` | `gate ×3` |
+| `blocking=0 agents=0` | `idle` | — |
+
+**Blocked persists across visiting the tab** for free: `src/ui/status.rs:380`
+and `src/ui/sidebar.rs:380` match `(AgentState::Blocked, _)`, ignoring `seen`.
+`seen` only separates idle from done. A gate therefore stays red until a later
+turn reports `blocking=0` — cleared by answering it, not by glancing at it.
+This is the same behaviour a real permission dialog has.
+
+**Fork change, part 1** (`src/detect/mod.rs`): `is_closing_block_source` admits
+any `herdr:<agent>-closing-block` whose suffix names the agent it claims to
+speak for, so a new agent adopting the contract needs no herdr release.
 `hook_authority_is_effective` still independently requires that agent's process
 to be present, so the shape match is not a trust hole.
 
+**Fork change, part 2** (`src/terminal/state.rs`) — necessary, and missed on the
+first pass. Part 1 alone armed a suppression that was never reachable: the
+report was accepted at the RPC edge and dropped inside `TerminalState`, while
+the caller still saw `{"type":"ok"}` because `handle_pane_report_agent`
+discards the mutation. Two gates rejected it, both keyed on session identity:
+
+1. `route_full_lifecycle_hook_report` requires an `AgentSessionRef`, but
+   `agent_resume::session_ref_from_report` mints one only for sources on the
+   `is_official_agent_source` allowlist. A closing-block source reports what the
+   agent *said*, not where to *resume* it, so its ref is always `None` — the
+   report fell through to a pending-replacement slot that nothing drains while
+   the agent stays continuously detected.
+2. `set_hook_authority_at` rejected it as an owner conflict on any pane where
+   the real agent had already announced itself under `herdr:<agent>`.
+
+Both now accept on process presence, the only guarantee this source claims.
+`accept_hook_report` still enforces per-source sequence monotonicity.
+
 Tests: `closing_block_source_matches_only_its_own_agent` (`src/detect/mod.rs`)
 and `closing_block_authority_outranks_visible_idle_prompt_box`
 (`src/terminal/state.rs`), the latter also asserting the authority does **not**
 outlive the agent process.
 
+The state.rs test originally passed a session ref the RPC can never produce and
+a session announcement under its own source, so it stayed green while the live
+path dropped every report. It now reports with `session_ref: None` against a
+pane already owned by `herdr:claude`, and was confirmed to **fail without the
+fix** before being accepted as a guard.
+
 `cargo fmt` clean, `cargo clippy --all-targets` clean. Full `cargo test`
 single-threaded, mine vs baseline: **13 failures on both sides, zero new**. The
 13 are pre-existing codex-manifest cache drift (manifests are remote-updatable
@@ -144,8 +184,10 @@ already exited. Every key is now written every time.
 
 - **UI.** Blockers and running agents ride the existing single status field plus
   `state_labels`/tokens. Rendering them as separate sidebar columns is not built.
-- Verified against a synthetic pane and Rust unit tests, not against a live
-  `claude` process in a herdr pane end-to-end.
+- The `Stop` hook is not yet wired into `~/.claude/settings.json`, so the live
+  end-to-end run drove the contract by hand rather than from a real turn end.
+  Wiring it means adding a sibling hook — herdr overwrites its own managed
+  `herdr-agent-state.sh` on integration update.
 - The Codex adapter is verified against a synthesised `agent-turn-complete`
   payload, not a live `codex` turn. Codex already has a `notify` entry on this
   machine, so wiring it means chaining, not replacing.

From 6ba7ab3d95050487433c5bc3b4a7cd74923d3674 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Thu, 6 Aug 2026 17:28:52 +0200
Subject: [PATCH 05/19] feat(demo): drop counts from status labels, document
 live wiring

Sidebar labels are now "gate" and plain "working". One gate or three, the
action is the same; running agents just mean "not done", which the working dot
already says. The counts still ride along in the closing_* tokens.

Adds INSTALL.md with the wiring verified live for both agents, including the
two traps: --settings never loads hooks, and project-scoped hooks are silently
skipped until the folder is trusted.
---
 demo/INSTALL.md                         | 47 +++++++++++++++++++++++++
 demo/claude-settings.local.example.json |  1 +
 demo/herdr_status.py                    |  8 +++--
 3 files changed, 54 insertions(+), 2 deletions(-)
 create mode 100644 demo/INSTALL.md
 create mode 100644 demo/claude-settings.local.example.json

diff --git a/demo/INSTALL.md b/demo/INSTALL.md
new file mode 100644
index 0000000000..25a5b35a9e
--- /dev/null
+++ b/demo/INSTALL.md
@@ -0,0 +1,47 @@
+# Wiring the contract into a session
+
+Verified live end-to-end on 2026-08-06 against real `claude` and `codex` turns.
+
+## Claude Code
+
+Hooks load from **user** settings (`~/.claude/settings.json`), **project**
+settings (`.claude/settings.json`), or **project-local** settings
+(`.claude/settings.local.json`, gitignored). They do **not** load from
+`--settings <file>` — that flag ignores `hooks` entirely, which costs an hour if
+you assume otherwise.
+
+Project and project-local hooks additionally require the folder to be trusted.
+Until `~/.claude.json` has `projects["<abs cwd>"].hasTrustDialogAccepted: true`,
+they are silently skipped — no warning, no debug line.
+
+```json
+{"hooks":{"Stop":[{"hooks":[
+  {"type":"command","command":"python3 /abs/path/demo/herdr-closing-block.py"}
+]}]}}
+```
+
+Install it *beside* herdr's managed `herdr-agent-state.sh`, never inside it —
+herdr overwrites that file on integration update.
+
+`Stop` does **not** fire in `claude -p` headless mode, so verify interactively.
+
+## Codex
+
+`~/.codex/config.toml` already carries a `notify` entry on this machine, so
+covering codex means **chaining**, not replacing. For a throwaway session, use
+the CLI override instead of editing the file at all:
+
+```sh
+codex -c 'notify=["/abs/path/to/wrapper.sh"]'
+```
+
+where the wrapper forwards `$1` to `demo/herdr-codex-notify.py`. Real payload:
+
+```json
+{"type":"agent-turn-complete","thread-id":"...","turn-id":"...",
+ "cwd":"...","client":"codex-tui","input-messages":["..."],
+ "last-assistant-message":"ok\n\n**Critical action points (2 blocking)**\n..."}
+```
+
+`last-assistant-message` carries the closing block directly, so codex needs no
+transcript parsing — one reason the codex path is simpler than claude's.
diff --git a/demo/claude-settings.local.example.json b/demo/claude-settings.local.example.json
new file mode 100644
index 0000000000..80223994f0
--- /dev/null
+++ b/demo/claude-settings.local.example.json
@@ -0,0 +1 @@
+{"hooks":{"Stop":[{"hooks":[{"type":"command","command":"python3 /Users/matthiasschedel/Repos/herdr-worktrees/closing-block-demo/demo/herdr-closing-block.py"}]}]}}
diff --git a/demo/herdr_status.py b/demo/herdr_status.py
index 515d07a260..6d809432ce 100644
--- a/demo/herdr_status.py
+++ b/demo/herdr_status.py
@@ -165,9 +165,13 @@ def report(
         "source": source,
         "applies_to_source": source,
         "tokens": tokens,
+        # Counts are noise in the sidebar. One gate or three, the action is the
+        # same -- go answer it; and running agents just mean "not done", which
+        # the plain working dot already says. The numbers still ride along in
+        # the `closing_*` tokens for anything that wants them.
         "state_labels": {
-            "blocked": f"gate ×{blocking}" if blocking else "blocked",
-            "working": f"{agents} agents" if agents else "working",
+            "blocked": "gate" if blocking else "blocked",
+            "working": "working",
         },
         "seq": seq,
     }

From ca34932b66d49af57047f8e4b995062594765457 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Thu, 6 Aug 2026 18:04:22 +0200
Subject: [PATCH 06/19] feat(demo): supply a session title for agents that
 publish none

Codex sets its terminal title to the cwd and its rollout files carry no
title, so a codex pane has nothing to name it by. The notify handler now
derives one from the first turn's user message -- the same thing codex's
own resume picker previews -- and pins it in the mirror so later turns do
not rename the pane. Rides along as a `session_title` metadata token.
---
 demo/herdr-codex-notify.py | 34 +++++++++++++++++++++++++++++++++-
 demo/herdr_status.py       |  8 ++++++++
 2 files changed, 41 insertions(+), 1 deletion(-)

diff --git a/demo/herdr-codex-notify.py b/demo/herdr-codex-notify.py
index b3c3744257..f984c940d2 100755
--- a/demo/herdr-codex-notify.py
+++ b/demo/herdr-codex-notify.py
@@ -21,7 +21,7 @@
 
 sys.path.insert(0, os.path.dirname(os.path.abspath(__file__)))
 from closing_block import parse  # noqa: E402
-from herdr_status import report  # noqa: E402
+from herdr_status import mirror_path, report  # noqa: E402
 
 # Codex has used both spellings across versions.
 TURN_DONE = {"agent-turn-complete", "agent_turn_complete", "turn-ended", "turn_ended"}
@@ -46,6 +46,37 @@ def load_payload(argv: list[str]) -> dict:
     return {}
 
 
+def title_from(payload: dict, pane_id: str) -> str | None:
+    """A stable session name for the pane, since codex ships none.
+
+    Codex's own resume picker previews the first user message, so use the same
+    thing -- but only the *first* one. `input-messages` is per turn, so
+    re-deriving every turn would rename the pane on every prompt. The first
+    title wins and is kept in the mirror for the rest of the session.
+    """
+    try:
+        with open(mirror_path(pane_id), encoding="utf-8") as fh:
+            existing = json.load(fh).get("title")
+        if isinstance(existing, str) and existing:
+            return existing
+    except (OSError, ValueError, AttributeError):
+        pass
+
+    messages = payload.get("input-messages") or payload.get("input_messages") or []
+    if not isinstance(messages, list):
+        return None
+    # Last message, not first: the injected AGENTS.md / permissions preamble is
+    # prepended, so the human's actual prompt is at the end.
+    for msg in reversed(messages):
+        text = msg if isinstance(msg, str) else ""
+        for line in text.splitlines():
+            line = line.strip().lstrip("#").strip()
+            if not line or line.startswith("<") or line.lower().startswith("agents.md"):
+                continue
+            return line[:80]
+    return None
+
+
 def main() -> int:
     if os.environ.get("HERDR_ENV") != "1" or not os.environ.get("HERDR_PANE_ID"):
         return 0
@@ -70,6 +101,7 @@ def main() -> int:
         gates=[i.text for i in block.items if i.blocking],
         agent_names=block.agents,
         session_id=payload.get("turn-id") or payload.get("turn_id"),
+        title=title_from(payload, os.environ["HERDR_PANE_ID"]),
     )
     if os.environ.get("HERDR_CLOSING_BLOCK_DEBUG"):
         print(json.dumps(outcome["payload"]), file=sys.stderr)
diff --git a/demo/herdr_status.py b/demo/herdr_status.py
index 6d809432ce..e40c72ad35 100644
--- a/demo/herdr_status.py
+++ b/demo/herdr_status.py
@@ -104,6 +104,7 @@ def report(
     agent_names: list[str] | None = None,
     session_id: str | None = None,
     session_path: str | None = None,
+    title: str | None = None,
     pane_id: str | None = None,
     sock_path: str | None = None,
 ) -> dict:
@@ -125,6 +126,8 @@ def report(
         "gates": gates,
         "agent_names": agent_names,
     }
+    if title:
+        payload["title"] = title
 
     outcome = {"payload": payload, "mirror": None, "socket": False}
     if pane_id:
@@ -159,6 +162,11 @@ def report(
         "closing_idle": "1" if state == "idle" else "0",
         "closing_agent_names": "; ".join(agent_names)[:200],
         "closing_gates": "; ".join(gates)[:200],
+        # Codex publishes no session name -- its OSC title is just the cwd, and
+        # its rollout files carry no title either (the resume picker previews
+        # the first user message). So the agent that has one supplies it here.
+        # Render with a `$session_title` token in `rows_by_agent`.
+        "session_title": (title or "")[:120],
     }
     meta_params = {
         "pane_id": pane_id,

From 75cd7bb0bbbf32e1fa39eda65e89a1c89774c57f Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 10:51:44 +0200
Subject: [PATCH 07/19] fix(hooks): report a turn that ends without a closing
 block

A full-lifecycle source that stays silent leaves its last report standing
forever, so a pane that reported a gate kept showing it with nothing able
to clear it.
---
 demo/herdr-closing-block.py |  7 +++++--
 demo/herdr-codex-notify.py  |  7 +++++--
 demo/test_closing_block.py  | 10 ++++++++++
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/demo/herdr-closing-block.py b/demo/herdr-closing-block.py
index d83b0f92e6..6a60663274 100755
--- a/demo/herdr-closing-block.py
+++ b/demo/herdr-closing-block.py
@@ -57,9 +57,12 @@ def main() -> int:
     text = last_assistant_text(payload.get("transcript_path") or "")
     if text is None:
         return 0
+    # A turn that ended without a closing block still ended, and a full-lifecycle
+    # source that stays silent leaves its last report standing forever -- a pane
+    # that reported a gate last turn would keep showing it with nothing able to
+    # clear it. Absent counts are zero counts: nobody is waiting on a human.
+    # An absent block parses to zero counts, which is the honest reading.
     block = parse(text)
-    if not block.present:
-        return 0
 
     outcome = report(
         agent="claude",
diff --git a/demo/herdr-codex-notify.py b/demo/herdr-codex-notify.py
index f984c940d2..27cfb89600 100755
--- a/demo/herdr-codex-notify.py
+++ b/demo/herdr-codex-notify.py
@@ -90,9 +90,12 @@ def main() -> int:
     )
     if not text:
         return 0
+    # A turn that ended without a closing block still ended, and a full-lifecycle
+    # source that stays silent leaves its last report standing forever -- a pane
+    # that reported a gate last turn would keep showing it with nothing able to
+    # clear it. An absent block parses to zero counts, which is the honest
+    # reading: nobody is waiting on a human.
     block = parse(text)
-    if not block.present:
-        return 0
 
     outcome = report(
         agent="codex",
diff --git a/demo/test_closing_block.py b/demo/test_closing_block.py
index 410d8fc0a5..30cc63e276 100644
--- a/demo/test_closing_block.py
+++ b/demo/test_closing_block.py
@@ -86,6 +86,16 @@ def test_absent_block_is_inert():
     assert b.herdr_state == "idle"
 
 
+def test_absent_block_reports_zero_counts_so_the_hook_can_send_it():
+    """Both turn-end hooks now report a blockless turn instead of staying
+    silent, which is only safe because an absent block reads as zero."""
+    b = parse("Just some prose with no closing block at all.")
+    assert b.blocking == 0
+    assert b.agents_running == 0
+    assert b.items == []
+    assert b.agents == []
+
+
 def test_last_marker_wins_when_body_quotes_an_earlier_one():
     text = "Earlier I wrote:\n\n**Nothing to act on.**\n\n" + BLOCKING_GATE
     b = parse(text)

From 6c2d95d93b8acaf75b6b7acd110b616349ac983f Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 11:27:47 +0200
Subject: [PATCH 08/19] fix: retire stale blocked hook authority

---
 src/app/actions.rs          |   9 ++
 src/app/api.rs              |  31 ++++++-
 src/app/api/panes.rs        |  97 ++++++++++++++++++--
 src/app/input/terminal.rs   |  79 +++++++++++++++++
 src/events.rs               |   5 ++
 src/pane.rs                 | 104 ++++++++++++++++++++--
 src/pane/agent_detection.rs |  89 +++++++++++++++++++
 src/terminal/runtime.rs     |   4 +-
 src/terminal/state.rs       | 171 +++++++++++++++++++++++++++++++++++-
 9 files changed, 568 insertions(+), 21 deletions(-)

diff --git a/src/app/actions.rs b/src/app/actions.rs
index a232fa723f..18c4785a42 100644
--- a/src/app/actions.rs
+++ b/src/app/actions.rs
@@ -3039,6 +3039,15 @@ impl AppState {
                 })
                 .into_iter()
                 .collect(),
+            AppEvent::HookAuthorityRetired {
+                pane_id,
+                observed_at,
+            } => self
+                .update_terminal_state(pane_id, |terminal| {
+                    terminal.retire_blocked_full_lifecycle_hook_authority_at(observed_at)
+                })
+                .into_iter()
+                .collect(),
             AppEvent::HookAgentReleased {
                 pane_id,
                 source,
diff --git a/src/app/api.rs b/src/app/api.rs
index a019875eca..c87759c1a7 100644
--- a/src/app/api.rs
+++ b/src/app/api.rs
@@ -504,14 +504,43 @@ impl App {
                     else {
                         continue;
                     };
-                    runtime.set_full_lifecycle_authority_active(
+                    runtime.set_full_lifecycle_authority_state(
                         terminal.full_lifecycle_hook_authority_active(),
+                        terminal.state == crate::detect::AgentState::Blocked,
                     );
                 }
             }
         }
     }
 
+    pub(crate) fn retire_blocked_hook_authority_for_terminal(
+        &mut self,
+        terminal_id: &crate::terminal::TerminalId,
+        observed_at: Instant,
+    ) {
+        let Some(pane_id) = self.state.workspaces.iter().find_map(|workspace| {
+            workspace.tabs.iter().find_map(|tab| {
+                tab.panes.iter().find_map(|(pane_id, pane)| {
+                    (pane.attached_terminal_id == *terminal_id).then_some(*pane_id)
+                })
+            })
+        }) else {
+            return;
+        };
+        self.retire_blocked_hook_authority_for_pane(pane_id, observed_at);
+    }
+
+    pub(crate) fn retire_blocked_hook_authority_for_pane(
+        &mut self,
+        pane_id: crate::layout::PaneId,
+        observed_at: Instant,
+    ) {
+        self.handle_internal_event(AppEvent::HookAuthorityRetired {
+            pane_id,
+            observed_at,
+        });
+    }
+
     pub(crate) fn show_clipboard_feedback(&mut self) {
         if !self.state.toast_config.clipboard.enabled {
             self.state.copy_feedback = None;
diff --git a/src/app/api/panes.rs b/src/app/api/panes.rs
index f629cc0cdd..d6b0690632 100644
--- a/src/app/api/panes.rs
+++ b/src/app/api/panes.rs
@@ -1646,9 +1646,13 @@ impl App {
         let Some(runtime) = self.lookup_runtime_sender(ws_idx, pane_id) else {
             return pane_not_found(id, &params.pane_id);
         };
+        let has_bytes = !params.text.is_empty();
         if let Err(err) = runtime.try_send_bytes(Bytes::from(params.text)) {
             return encode_error(id, "pane_send_failed", err.to_string());
         }
+        if has_bytes {
+            self.retire_blocked_hook_authority_for_pane(pane_id, std::time::Instant::now());
+        }
 
         encode_success(id, ResponseResult::Ok {})
     }
@@ -1672,9 +1676,13 @@ impl App {
             Ok(bytes) => bytes,
             Err(key) => return encode_error(id, "invalid_key", format!("unsupported key {key}")),
         };
+        let has_bytes = !bytes.is_empty();
         if let Err(err) = runtime.try_send_bytes(Bytes::from(bytes)) {
             return encode_error(id, "pane_send_failed", err.to_string());
         }
+        if has_bytes {
+            self.retire_blocked_hook_authority_for_pane(pane_id, std::time::Instant::now());
+        }
 
         encode_success(id, ResponseResult::Ok {})
     }
@@ -1759,17 +1767,31 @@ impl App {
         let Some((ws_idx, pane_id)) = self.parse_pane_id(&params.pane_id) else {
             return pane_not_found(id, &params.pane_id);
         };
-        let Some(runtime) = self.lookup_runtime_sender(ws_idx, pane_id) else {
-            return pane_not_found(id, &params.pane_id);
-        };
-        let encoded_keys = match encode_api_keys(runtime, &params.keys) {
-            Ok(encoded_keys) => encoded_keys,
-            Err(key) => return encode_error(id, "invalid_key", format!("unsupported key {key}")),
+        let encoded_keys = {
+            let Some(runtime) = self.lookup_runtime_sender(ws_idx, pane_id) else {
+                return pane_not_found(id, &params.pane_id);
+            };
+            match encode_api_keys(runtime, &params.keys) {
+                Ok(encoded_keys) => encoded_keys,
+                Err(key) => {
+                    return encode_error(id, "invalid_key", format!("unsupported key {key}"));
+                }
+            }
         };
         for bytes in encoded_keys {
-            if let Err(err) = runtime.try_send_bytes(Bytes::from(bytes)) {
+            let has_bytes = !bytes.is_empty();
+            let send_result = {
+                let Some(runtime) = self.lookup_runtime_sender(ws_idx, pane_id) else {
+                    return pane_not_found(id, &params.pane_id);
+                };
+                runtime.try_send_bytes(Bytes::from(bytes))
+            };
+            if let Err(err) = send_result {
                 return encode_error(id, "pane_send_failed", err.to_string());
             }
+            if has_bytes {
+                self.retire_blocked_hook_authority_for_pane(pane_id, std::time::Instant::now());
+            }
         }
 
         encode_success(id, ResponseResult::Ok {})
@@ -2463,6 +2485,67 @@ mod tests {
         assert!(rx.try_recv().is_err());
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn pane_write_apis_retire_a_blocked_hook_after_forwarding_bytes() {
+        let requests = [
+            crate::api::schema::Method::PaneSendText(PaneSendTextParams {
+                pane_id: String::new(),
+                text: "x".into(),
+            }),
+            crate::api::schema::Method::PaneSendKeys(PaneSendKeysParams {
+                pane_id: String::new(),
+                keys: vec!["Enter".into()],
+            }),
+            crate::api::schema::Method::PaneSendInput(PaneSendInputParams {
+                pane_id: String::new(),
+                text: "x".into(),
+                keys: Vec::new(),
+            }),
+        ];
+
+        for (index, mut method) in requests.into_iter().enumerate() {
+            let (mut app, pane_id, mut rx) = app_with_send_key_runtime(1);
+            let internal_pane_id = app.state.workspaces[0].tabs[0].root_pane;
+            let terminal_id = app.state.workspaces[0]
+                .terminal_id(internal_pane_id)
+                .unwrap()
+                .clone();
+            let terminal = app.state.terminals.get_mut(&terminal_id).unwrap();
+            terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+            terminal.set_hook_authority(
+                "herdr:codex-closing-block".into(),
+                "codex".into(),
+                AgentState::Blocked,
+                None,
+                Some(1),
+            );
+            assert_eq!(app.state.terminals[&terminal_id].state, AgentState::Blocked);
+
+            match &mut method {
+                crate::api::schema::Method::PaneSendText(params) => {
+                    params.pane_id = pane_id.clone()
+                }
+                crate::api::schema::Method::PaneSendKeys(params) => {
+                    params.pane_id = pane_id.clone()
+                }
+                crate::api::schema::Method::PaneSendInput(params) => {
+                    params.pane_id = pane_id.clone()
+                }
+                _ => unreachable!(),
+            }
+            let response = app.handle_api_request(crate::api::schema::Request {
+                id: format!("req-{index}"),
+                method,
+            });
+            let success: SuccessResponse = serde_json::from_str(&response).unwrap();
+
+            assert_eq!(success.result, ResponseResult::Ok {});
+            assert!(rx.try_recv().is_ok());
+            assert_eq!(app.state.terminals[&terminal_id].state, AgentState::Idle);
+            assert!(!app.state.terminals[&terminal_id].full_lifecycle_hook_authority_active());
+        }
+    }
+
     #[tokio::test]
     async fn api_pane_send_keys_rejects_invalid_keys_before_writing() {
         let (mut app, pane_id, mut rx) = app_with_send_key_runtime(2);
diff --git a/src/app/input/terminal.rs b/src/app/input/terminal.rs
index 13e4aba9a1..1435a82a2e 100644
--- a/src/app/input/terminal.rs
+++ b/src/app/input/terminal.rs
@@ -54,9 +54,16 @@ impl App {
         }
 
         let input = self.prepare_terminal_key_forward(source_id, key)?;
+        let has_bytes = !input.bytes.is_empty();
         let sent = self
             .lookup_runtime_sender(input.ws_idx, input.pane_id)
             .is_some_and(|runtime| runtime.try_send_bytes(input.bytes).is_ok());
+        if sent && has_bytes {
+            self.retire_blocked_hook_authority_for_terminal(
+                &input.target.terminal_id,
+                std::time::Instant::now(),
+            );
+        }
         sent.then_some(input.target)
     }
 
@@ -395,11 +402,18 @@ impl App {
         }
 
         let input = self.prepare_terminal_key_forward(crate::app::LOCAL_INPUT_SOURCE, key)?;
+        let has_bytes = !input.bytes.is_empty();
         let sent = if let Some(runtime) = self.lookup_runtime_sender(input.ws_idx, input.pane_id) {
             runtime.send_bytes(input.bytes).await.is_ok()
         } else {
             false
         };
+        if sent && has_bytes {
+            self.retire_blocked_hook_authority_for_terminal(
+                &input.target.terminal_id,
+                std::time::Instant::now(),
+            );
+        }
         sent.then_some(input.target)
     }
 }
@@ -1643,6 +1657,71 @@ mod tests {
         assert!(rx.try_recv().is_err());
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn forwarded_input_retires_a_blocked_hook_and_allows_screen_state() {
+        let mut app = app_for_mouse_test();
+        let mut ws = Workspace::test_new("test");
+        let pane_id = ws.tabs[0].root_pane;
+        let pane_infos = ws.tabs[0].layout.panes(Rect::new(26, 2, 80, 18));
+        let (runtime, mut rx) = crate::terminal::TerminalRuntime::test_with_channel(
+            pane_infos[0].inner_rect.width,
+            pane_infos[0].inner_rect.height,
+        );
+        ws.insert_test_runtime(pane_id, runtime);
+        app.state.workspaces = vec![ws];
+        app.state.ensure_test_terminals();
+        app.state.active = Some(0);
+        app.state.selected = 0;
+        app.state.mode = Mode::Terminal;
+        app.state.view.pane_infos = pane_infos;
+
+        let terminal_id = app.state.workspaces[0]
+            .terminal_id(pane_id)
+            .unwrap()
+            .clone();
+        let terminal = app.state.terminals.get_mut(&terminal_id).unwrap();
+        terminal.set_detected_state(
+            Some(crate::detect::Agent::Codex),
+            crate::detect::AgentState::Idle,
+        );
+        terminal.set_hook_authority(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            crate::detect::AgentState::Blocked,
+            None,
+            Some(1),
+        );
+        assert_eq!(
+            app.state.terminals[&terminal_id].state,
+            crate::detect::AgentState::Blocked
+        );
+
+        app.handle_terminal_key_headless(TerminalKey::new(
+            KeyCode::Char('x'),
+            KeyModifiers::empty(),
+        ));
+
+        assert_eq!(rx.try_recv().unwrap().as_ref(), b"x");
+        assert_eq!(
+            app.state.terminals[&terminal_id].state,
+            crate::detect::AgentState::Idle
+        );
+        assert!(!app.state.terminals[&terminal_id].full_lifecycle_hook_authority_active());
+
+        app.state
+            .terminals
+            .get_mut(&terminal_id)
+            .unwrap()
+            .set_detected_state(
+                Some(crate::detect::Agent::Codex),
+                crate::detect::AgentState::Working,
+            );
+        assert_eq!(
+            app.state.terminals[&terminal_id].state,
+            crate::detect::AgentState::Working
+        );
+    }
+
     fn app_with_plain_scrollback(
         line_count: usize,
     ) -> (App, crate::layout::PaneId, crate::layout::PaneInfo) {
diff --git a/src/events.rs b/src/events.rs
index bb770da693..0143b78189 100644
--- a/src/events.rs
+++ b/src/events.rs
@@ -112,6 +112,11 @@ pub enum AppEvent {
         source: Option<String>,
         seq: Option<u64>,
     },
+    /// Activity after a blocked full-lifecycle report made that report stale.
+    HookAuthorityRetired {
+        pane_id: PaneId,
+        observed_at: Instant,
+    },
     /// The current detected agent gracefully released this pane back to the shell.
     HookAgentReleased {
         pane_id: PaneId,
diff --git a/src/pane.rs b/src/pane.rs
index 1e1fe09abe..e74c958537 100644
--- a/src/pane.rs
+++ b/src/pane.rs
@@ -42,8 +42,8 @@ use self::agent_detection::{
     decide_detection_screen_read, decide_screen_detection_publish,
     detection_update_for_publish_with_osc, mark_detection_content_changed,
     observe_detection_content_change, DetectionPublishDecision, DetectionScreenReadDecision,
-    DetectionScreenReadInput, PendingIdleConfirmation, ScreenDetectionPublishInput,
-    AGENT_PENDING_IDLE_RECHECK, AGENT_STARTUP_GRACE_WINDOW,
+    DetectionScreenReadInput, FullLifecycleHookOutputRetirement, PendingIdleConfirmation,
+    ScreenDetectionPublishInput, AGENT_PENDING_IDLE_RECHECK, AGENT_STARTUP_GRACE_WINDOW,
 };
 use self::terminal::{GhosttyPaneTerminal, PaneTerminal};
 pub(crate) use self::terminal::{
@@ -668,7 +668,9 @@ fn spawn_basic_detection_task(
     child_pid: Arc<AtomicU32>,
     terminal: Arc<PaneTerminal>,
     detection_content_seq: Arc<AtomicU64>,
+    full_lifecycle_hook_baseline_content_seq: Arc<AtomicU64>,
     full_lifecycle_authority_active: Arc<AtomicBool>,
+    full_lifecycle_hook_blocked: Arc<AtomicBool>,
     state_events: mpsc::Sender<AppEvent>,
 ) -> (
     tokio::task::AbortHandle,
@@ -697,6 +699,7 @@ fn spawn_basic_detection_task(
         let mut release_was_active = false;
         let mut last_detection_text = String::new();
         let mut last_screen_scan_detection_content_seq = None;
+        let mut hook_output_retirement = FullLifecycleHookOutputRetirement::default();
         let mut agent_startup_grace_until = None;
         let mut pending_idle = PendingIdleConfirmation::default();
         let mut last_background_job_count = None;
@@ -728,6 +731,7 @@ fn spawn_basic_detection_task(
                     release_was_active = false;
                     last_detection_text.clear();
                     last_screen_scan_detection_content_seq = None;
+                    hook_output_retirement.clear();
                     agent_startup_grace_until = None;
                     pending_idle.clear();
                     last_background_job_count = None;
@@ -747,7 +751,7 @@ fn spawn_basic_detection_task(
             let pid = child_pid.load(Ordering::Acquire);
             let mut agent_changed = false;
             let mut agent = agent_presence.current_agent();
-            let lifecycle_authority_active =
+            let mut lifecycle_authority_active =
                 full_lifecycle_authority_active.load(Ordering::Acquire);
             let foreground_pgid = (pid > 0)
                 .then(|| crate::detect::foreground_process_group_id(pid))
@@ -855,6 +859,30 @@ fn spawn_basic_detection_task(
                 && agent.is_some()
                 && !foreground_shell_exit_reported;
 
+            if lifecycle_authority_active
+                && full_lifecycle_hook_blocked.load(Ordering::Acquire)
+                && !process_exited
+            {
+                if let Some(observed_at) = hook_output_retirement.observe(
+                    detection_content_seq.load(Ordering::Relaxed),
+                    full_lifecycle_hook_baseline_content_seq.load(Ordering::Acquire),
+                    now,
+                ) {
+                    full_lifecycle_authority_active.store(false, Ordering::Release);
+                    lifecycle_authority_active = false;
+                    let _ = state_events
+                        .send(AppEvent::HookAuthorityRetired {
+                            pane_id,
+                            observed_at,
+                        })
+                        .await;
+                }
+            } else if !lifecycle_authority_active
+                || !full_lifecycle_hook_blocked.load(Ordering::Acquire)
+            {
+                hook_output_retirement.clear();
+            }
+
             let background_scan_seq = detection_content_seq.load(Ordering::Relaxed);
             if background_scan_needed(
                 agent_changed,
@@ -1064,7 +1092,9 @@ pub struct PaneRuntime {
     child_wait_completed: Option<Arc<AtomicBool>>,
     kitty_keyboard_flags: Arc<AtomicU16>,
     detection_content_seq: Arc<AtomicU64>,
+    full_lifecycle_hook_baseline_content_seq: Arc<AtomicU64>,
     full_lifecycle_authority_active: Arc<AtomicBool>,
+    full_lifecycle_hook_blocked: Arc<AtomicBool>,
     detect_reset_notify: Arc<Notify>,
     pending_release: Arc<Mutex<Option<PendingAgentRelease>>>,
     preserve_processes_on_drop: bool,
@@ -1989,12 +2019,16 @@ impl PaneRuntime {
         };
 
         let full_lifecycle_authority_active = Arc::new(AtomicBool::new(false));
+        let full_lifecycle_hook_baseline_content_seq = Arc::new(AtomicU64::new(0));
+        let full_lifecycle_hook_blocked = Arc::new(AtomicBool::new(false));
         let (detect_handle, detect_reset_notify, pending_release) = spawn_basic_detection_task(
             pane_id,
             child_pid.clone(),
             terminal.clone(),
             detection_content_seq.clone(),
+            full_lifecycle_hook_baseline_content_seq.clone(),
             full_lifecycle_authority_active.clone(),
+            full_lifecycle_hook_blocked.clone(),
             events,
         );
 
@@ -2008,7 +2042,9 @@ impl PaneRuntime {
             child_wait_completed: None,
             kitty_keyboard_flags,
             detection_content_seq,
+            full_lifecycle_hook_baseline_content_seq,
             full_lifecycle_authority_active,
+            full_lifecycle_hook_blocked,
             detect_reset_notify,
             pending_release,
             preserve_processes_on_drop: true,
@@ -2063,7 +2099,9 @@ impl PaneRuntime {
         let reported_cwd = Arc::new(Mutex::new(None));
         let child_wait_completed = Arc::new(AtomicBool::new(false));
         let detection_content_seq = Arc::new(AtomicU64::new(0));
+        let full_lifecycle_hook_baseline_content_seq = Arc::new(AtomicU64::new(0));
         let full_lifecycle_authority_active = Arc::new(AtomicBool::new(false));
+        let full_lifecycle_hook_blocked = Arc::new(AtomicBool::new(false));
         {
             let child_pid = child_pid.clone();
             let child_wait_completed = child_wait_completed.clone();
@@ -2163,7 +2201,10 @@ impl PaneRuntime {
             let terminal = terminal.clone();
             let state_events = events.clone();
             let detection_content_seq = detection_content_seq.clone();
+            let full_lifecycle_hook_baseline_content_seq_for_task =
+                full_lifecycle_hook_baseline_content_seq.clone();
             let full_lifecycle_authority_active_for_task = full_lifecycle_authority_active.clone();
+            let full_lifecycle_hook_blocked_for_task = full_lifecycle_hook_blocked.clone();
             let render_notify = render_notify.clone();
             let render_dirty = render_dirty.clone();
             let detect_reset_notify = Arc::new(Notify::new());
@@ -2190,6 +2231,7 @@ impl PaneRuntime {
                 let mut last_visible_signal_refresh = None;
                 let mut last_detection_text = String::new();
                 let mut last_screen_scan_detection_content_seq = None;
+                let mut hook_output_retirement = FullLifecycleHookOutputRetirement::default();
                 let mut agent_startup_grace_until = None;
                 let mut pending_idle = PendingIdleConfirmation::default();
                 let mut last_background_job_count = None;
@@ -2231,6 +2273,7 @@ impl PaneRuntime {
                             last_visible_signal_refresh = None;
                             last_detection_text.clear();
                             last_screen_scan_detection_content_seq = None;
+                            hook_output_retirement.clear();
                             agent_startup_grace_until = None;
                             pending_idle.clear();
                             last_background_job_count = None;
@@ -2249,7 +2292,7 @@ impl PaneRuntime {
                     release_was_active = suppressed_agent.is_some();
                     let pid = child_pid.load(Ordering::Acquire);
                     let mut agent = agent_presence.current_agent();
-                    let lifecycle_authority_active =
+                    let mut lifecycle_authority_active =
                         full_lifecycle_authority_active_for_task.load(Ordering::Acquire);
                     let foreground_pgid = (pid > 0)
                         .then(|| detect::foreground_process_group_id(pid))
@@ -2397,6 +2440,32 @@ impl PaneRuntime {
                         && agent.is_some()
                         && !foreground_shell_exit_reported;
 
+                    if lifecycle_authority_active
+                        && full_lifecycle_hook_blocked_for_task.load(Ordering::Acquire)
+                        && !process_exited
+                    {
+                        if let Some(observed_at) = hook_output_retirement.observe(
+                            detection_content_seq.load(Ordering::Relaxed),
+                            full_lifecycle_hook_baseline_content_seq_for_task
+                                .load(Ordering::Acquire),
+                            now,
+                        ) {
+                            full_lifecycle_authority_active_for_task
+                                .store(false, Ordering::Release);
+                            lifecycle_authority_active = false;
+                            let _ = state_events
+                                .send(AppEvent::HookAuthorityRetired {
+                                    pane_id,
+                                    observed_at,
+                                })
+                                .await;
+                        }
+                    } else if !lifecycle_authority_active
+                        || !full_lifecycle_hook_blocked_for_task.load(Ordering::Acquire)
+                    {
+                        hook_output_retirement.clear();
+                    }
+
                     let background_scan_seq = detection_content_seq.load(Ordering::Relaxed);
                     if background_scan_needed(
                         agent_changed,
@@ -2556,7 +2625,9 @@ impl PaneRuntime {
             child_wait_completed: Some(child_wait_completed),
             kitty_keyboard_flags,
             detection_content_seq,
+            full_lifecycle_hook_baseline_content_seq,
             full_lifecycle_authority_active,
+            full_lifecycle_hook_blocked,
             detect_reset_notify,
             pending_release,
             preserve_processes_on_drop: false,
@@ -2588,10 +2659,19 @@ impl PaneRuntime {
         self.detect_handle.is_some()
     }
 
-    pub fn set_full_lifecycle_authority_active(&self, active: bool) {
+    pub fn set_full_lifecycle_authority_state(&self, active: bool, blocked: bool) {
         let previous = self
             .full_lifecycle_authority_active
             .swap(active, Ordering::AcqRel);
+        let was_blocked = self
+            .full_lifecycle_hook_blocked
+            .swap(active && blocked, Ordering::AcqRel);
+        if active && blocked && (!previous || !was_blocked) {
+            self.full_lifecycle_hook_baseline_content_seq.store(
+                self.detection_content_seq.load(Ordering::Acquire),
+                Ordering::Release,
+            );
+        }
         if active && !previous {
             self.detect_reset_notify.notify_one();
         }
@@ -3061,7 +3141,9 @@ impl PaneRuntime {
                 child_wait_completed: None,
                 kitty_keyboard_flags: Arc::new(AtomicU16::new(0)),
                 detection_content_seq: Arc::new(AtomicU64::new(0)),
+                full_lifecycle_hook_baseline_content_seq: Arc::new(AtomicU64::new(0)),
                 full_lifecycle_authority_active: Arc::new(AtomicBool::new(false)),
+                full_lifecycle_hook_blocked: Arc::new(AtomicBool::new(false)),
                 detect_reset_notify: Arc::new(Notify::new()),
                 pending_release: Arc::new(Mutex::new(None)),
                 preserve_processes_on_drop: true,
@@ -3630,7 +3712,9 @@ mod tests {
             child_wait_completed: None,
             kitty_keyboard_flags: Arc::new(AtomicU16::new(0)),
             detection_content_seq: Arc::new(AtomicU64::new(0)),
+            full_lifecycle_hook_baseline_content_seq: Arc::new(AtomicU64::new(0)),
             full_lifecycle_authority_active: Arc::new(AtomicBool::new(false)),
+            full_lifecycle_hook_blocked: Arc::new(AtomicBool::new(false)),
             detect_reset_notify: Arc::new(Notify::new()),
             pending_release: Arc::new(Mutex::new(None)),
             preserve_processes_on_drop: true,
@@ -3661,7 +3745,9 @@ mod tests {
             child_wait_completed: None,
             kitty_keyboard_flags: Arc::new(AtomicU16::new(0)),
             detection_content_seq: Arc::new(AtomicU64::new(0)),
+            full_lifecycle_hook_baseline_content_seq: Arc::new(AtomicU64::new(0)),
             full_lifecycle_authority_active: Arc::new(AtomicBool::new(false)),
+            full_lifecycle_hook_blocked: Arc::new(AtomicBool::new(false)),
             detect_reset_notify: Arc::new(Notify::new()),
             pending_release: Arc::new(Mutex::new(None)),
             preserve_processes_on_drop: true,
@@ -4308,7 +4394,7 @@ mod tests {
         let runtime = PaneRuntime::test_with_screen_bytes(80, 24, b"");
         let reset_notify = runtime.agent_detection_reset_notify_for_test();
 
-        runtime.set_full_lifecycle_authority_active(true);
+        runtime.set_full_lifecycle_authority_state(true, false);
         tokio::time::timeout(
             std::time::Duration::from_millis(50),
             reset_notify.notified(),
@@ -4316,7 +4402,7 @@ mod tests {
         .await
         .expect("false-to-true transition should notify detection reset");
 
-        runtime.set_full_lifecycle_authority_active(true);
+        runtime.set_full_lifecycle_authority_state(true, false);
         assert!(
             tokio::time::timeout(
                 std::time::Duration::from_millis(20),
@@ -4327,7 +4413,7 @@ mod tests {
             "repeated true-to-true sync should not notify detection reset"
         );
 
-        runtime.set_full_lifecycle_authority_active(false);
+        runtime.set_full_lifecycle_authority_state(false, false);
         assert!(
             tokio::time::timeout(
                 std::time::Duration::from_millis(20),
@@ -4338,7 +4424,7 @@ mod tests {
             "true-to-false transition should not notify detection reset"
         );
 
-        runtime.set_full_lifecycle_authority_active(true);
+        runtime.set_full_lifecycle_authority_state(true, false);
         tokio::time::timeout(
             std::time::Duration::from_millis(50),
             reset_notify.notified(),
diff --git a/src/pane/agent_detection.rs b/src/pane/agent_detection.rs
index 9ef10dfedf..29330bf2ca 100644
--- a/src/pane/agent_detection.rs
+++ b/src/pane/agent_detection.rs
@@ -11,6 +11,45 @@ pub(super) const STABLE_VISIBLE_SIGNAL_REFRESH: std::time::Duration =
     std::time::Duration::from_millis(800);
 pub(super) const AGENT_STARTUP_GRACE_WINDOW: std::time::Duration =
     std::time::Duration::from_secs(3);
+pub(super) const FULL_LIFECYCLE_HOOK_OUTPUT_RETIREMENT_GRACE: std::time::Duration =
+    std::time::Duration::from_secs(5);
+
+#[derive(Debug, Default)]
+pub(super) struct FullLifecycleHookOutputRetirement {
+    authority_baseline_content_seq: Option<u64>,
+    last_content_seq: Option<u64>,
+    output_started_at: Option<std::time::Instant>,
+}
+
+impl FullLifecycleHookOutputRetirement {
+    pub(super) fn clear(&mut self) {
+        self.authority_baseline_content_seq = None;
+        self.last_content_seq = None;
+        self.output_started_at = None;
+    }
+
+    pub(super) fn observe(
+        &mut self,
+        content_seq: u64,
+        authority_baseline_content_seq: u64,
+        now: std::time::Instant,
+    ) -> Option<std::time::Instant> {
+        if self.authority_baseline_content_seq != Some(authority_baseline_content_seq) {
+            self.authority_baseline_content_seq = Some(authority_baseline_content_seq);
+            self.last_content_seq = Some(authority_baseline_content_seq);
+            self.output_started_at = None;
+        }
+
+        if self.last_content_seq != Some(content_seq) {
+            self.last_content_seq = Some(content_seq);
+            self.output_started_at.get_or_insert(now);
+        }
+
+        self.output_started_at.filter(|started_at| {
+            now.duration_since(*started_at) >= FULL_LIFECYCLE_HOOK_OUTPUT_RETIREMENT_GRACE
+        })
+    }
+}
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(super) struct DetectionPublishState {
@@ -553,4 +592,54 @@ mod tests {
 
         assert_eq!(seq.load(Ordering::Relaxed), 1);
     }
+
+    #[test]
+    fn output_retires_a_hook_gate_after_the_grace_period() {
+        let started = std::time::Instant::now();
+        let mut retirement = FullLifecycleHookOutputRetirement::default();
+
+        assert_eq!(retirement.observe(4, 4, started), None);
+        assert_eq!(
+            retirement.observe(5, 4, started + std::time::Duration::from_secs(1)),
+            None
+        );
+        assert_eq!(
+            retirement.observe(
+                5,
+                4,
+                started
+                    + std::time::Duration::from_secs(1)
+                    + FULL_LIFECYCLE_HOOK_OUTPUT_RETIREMENT_GRACE
+            ),
+            Some(started + std::time::Duration::from_secs(1))
+        );
+    }
+
+    #[test]
+    fn a_silent_hook_gate_does_not_expire() {
+        let started = std::time::Instant::now();
+        let mut retirement = FullLifecycleHookOutputRetirement::default();
+
+        assert_eq!(retirement.observe(4, 4, started), None);
+        assert_eq!(
+            retirement.observe(
+                4,
+                4,
+                started + FULL_LIFECYCLE_HOOK_OUTPUT_RETIREMENT_GRACE * 3,
+            ),
+            None
+        );
+    }
+
+    #[test]
+    fn output_before_the_first_detection_tick_starts_the_grace_period() {
+        let started = std::time::Instant::now();
+        let mut retirement = FullLifecycleHookOutputRetirement::default();
+
+        assert_eq!(retirement.observe(5, 4, started), None);
+        assert_eq!(
+            retirement.observe(5, 4, started + FULL_LIFECYCLE_HOOK_OUTPUT_RETIREMENT_GRACE),
+            Some(started)
+        );
+    }
 }
diff --git a/src/terminal/runtime.rs b/src/terminal/runtime.rs
index ba33398ace..63854c3239 100644
--- a/src/terminal/runtime.rs
+++ b/src/terminal/runtime.rs
@@ -250,8 +250,8 @@ impl TerminalRuntime {
         self.0.agent_detection_enabled_for_test()
     }
 
-    pub fn set_full_lifecycle_authority_active(&self, active: bool) {
-        self.0.set_full_lifecycle_authority_active(active);
+    pub fn set_full_lifecycle_authority_state(&self, active: bool, blocked: bool) {
+        self.0.set_full_lifecycle_authority_state(active, blocked);
     }
 
     pub fn resize(&self, rows: u16, cols: u16, cell_width_px: u32, cell_height_px: u32) {
diff --git a/src/terminal/state.rs b/src/terminal/state.rs
index 2cfb6fbd54..08986578d4 100644
--- a/src/terminal/state.rs
+++ b/src/terminal/state.rs
@@ -24,6 +24,7 @@ pub struct HookAuthority {
     pub message: Option<String>,
     pub reported_at: Instant,
     pub session_ref: Option<crate::agent_resume::AgentSessionRef>,
+    pub retired_at: Option<Instant>,
 }
 
 #[derive(Debug, Clone, PartialEq, Eq)]
@@ -992,6 +993,7 @@ impl TerminalState {
             message,
             reported_at: now,
             session_ref,
+            retired_at: None,
         });
         let current_session = self.current_session_identity_for_persistence();
         let session_ref_changed = previous_session != current_session;
@@ -1259,6 +1261,7 @@ impl TerminalState {
                     message: message.map(str::to_string),
                     reported_at,
                     session_ref: Some(session_ref),
+                    retired_at: None,
                 },
                 seq,
             });
@@ -1999,6 +2002,48 @@ impl TerminalState {
         })
     }
 
+    pub fn retire_blocked_full_lifecycle_hook_authority_at(
+        &mut self,
+        observed_at: Instant,
+    ) -> Option<TerminalStateMutation> {
+        let should_retire = self.hook_authority.as_ref().is_some_and(|authority| {
+            authority.state == AgentState::Blocked
+                && authority.retired_at.is_none()
+                && authority.reported_at <= observed_at
+                && self.hook_authority_is_effective(authority)
+                && crate::detect::full_lifecycle_hook_authority(
+                    &authority.source,
+                    &authority.agent_label,
+                )
+        });
+        if !should_retire {
+            return None;
+        }
+
+        let now = Instant::now();
+        let previous_agent_label = self.effective_agent_label().map(str::to_string);
+        let previous_known_agent = self.effective_known_agent();
+        let previous_state = self.state;
+        let previous_presentation = self.effective_presentation_for_state_at(previous_state, now);
+        let Some(authority) = self.hook_authority.as_mut() else {
+            return None;
+        };
+        authority.retired_at = Some(observed_at);
+
+        Some(TerminalStateMutation {
+            effective_state_change: self.recompute_effective_state(
+                previous_agent_label,
+                previous_known_agent,
+                previous_state,
+                previous_presentation,
+                now,
+            ),
+            session_ref_changed: false,
+            hook_work_context_changed: false,
+            agent_released: false,
+        })
+    }
+
     pub fn release_agent_with_mutation(
         &mut self,
         source: &str,
@@ -2185,7 +2230,8 @@ impl TerminalState {
 
     fn live_full_lifecycle_hook_authority(&self) -> bool {
         self.hook_authority.as_ref().is_some_and(|authority| {
-            self.hook_authority_is_effective(authority)
+            authority.retired_at.is_none()
+                && self.hook_authority_is_effective(authority)
                 && crate::detect::full_lifecycle_hook_authority(
                     &authority.source,
                     &authority.agent_label,
@@ -2456,7 +2502,9 @@ impl TerminalState {
         } else {
             self.hook_authority
                 .as_ref()
-                .filter(|authority| self.hook_authority_is_effective(authority))
+                .filter(|authority| {
+                    authority.retired_at.is_none() && self.hook_authority_is_effective(authority)
+                })
                 .map(|authority| authority.state)
                 .unwrap_or(self.fallback_state)
         };
@@ -4304,6 +4352,125 @@ mod tests {
         assert!(terminal.hook_authority.is_some());
     }
 
+    #[test]
+    fn activity_retires_a_blocked_hook_and_returns_to_screen_state() {
+        let observed = Instant::now();
+        let mut terminal = test_terminal();
+        terminal.set_detected_state_with_screen_signals_at(
+            Some(Agent::Codex),
+            AgentState::Idle,
+            false,
+            true,
+            false,
+            false,
+            observed,
+        );
+        terminal.set_hook_authority_at(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Blocked,
+            None,
+            None,
+            Some(7),
+            observed,
+        );
+        assert_eq!(terminal.state, AgentState::Blocked);
+
+        let mutation = terminal
+            .retire_blocked_full_lifecycle_hook_authority_at(
+                observed + std::time::Duration::from_secs(1),
+            )
+            .expect("activity should retire the blocked report");
+
+        assert_eq!(terminal.state, AgentState::Idle);
+        assert!(!terminal.full_lifecycle_hook_authority_active());
+        assert!(terminal.hook_authority.is_some());
+        assert_eq!(
+            mutation
+                .effective_state_change
+                .expect("retirement changes the effective state")
+                .state,
+            AgentState::Idle
+        );
+
+        terminal.set_detected_state_with_screen_signals_at(
+            Some(Agent::Codex),
+            AgentState::Working,
+            false,
+            false,
+            true,
+            false,
+            observed + std::time::Duration::from_secs(2),
+        );
+        assert_eq!(terminal.state, AgentState::Working);
+    }
+
+    #[test]
+    fn a_silent_blocked_hook_remains_authoritative_without_activity() {
+        let observed = Instant::now();
+        let mut terminal = test_terminal();
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority_at(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Blocked,
+            None,
+            None,
+            Some(7),
+            observed,
+        );
+
+        terminal.set_detected_state_with_screen_signals_at(
+            Some(Agent::Codex),
+            AgentState::Working,
+            false,
+            false,
+            true,
+            false,
+            observed + std::time::Duration::from_secs(30),
+        );
+
+        assert_eq!(terminal.state, AgentState::Blocked);
+        assert!(terminal.full_lifecycle_hook_authority_active());
+        assert_eq!(terminal.hook_authority.as_ref().unwrap().retired_at, None);
+    }
+
+    #[test]
+    fn a_fresh_hook_report_after_activity_retirement_is_honoured() {
+        let observed = Instant::now();
+        let mut terminal = test_terminal();
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority_at(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Blocked,
+            None,
+            None,
+            Some(7),
+            observed,
+        );
+        terminal
+            .retire_blocked_full_lifecycle_hook_authority_at(
+                observed + std::time::Duration::from_secs(1),
+            )
+            .expect("first report should retire");
+
+        let fresh = terminal.set_hook_authority_at(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Blocked,
+            None,
+            None,
+            Some(8),
+            observed + std::time::Duration::from_secs(2),
+        );
+
+        assert!(fresh.is_some());
+        assert_eq!(terminal.state, AgentState::Blocked);
+        assert!(terminal.full_lifecycle_hook_authority_active());
+        assert_eq!(terminal.hook_authority.as_ref().unwrap().retired_at, None);
+    }
+
     #[test]
     fn visible_blocker_does_not_override_different_agent_hook() {
         let mut terminal = test_terminal();

From e1035d01a184492af7c3ce8b24b90455976ee877 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 11:34:54 +0200
Subject: [PATCH 09/19] chore(detect): preserve blocked-authority merge
 provenance

source commit: 9572c4d1b78314181c12e0b55bba11ea7a8b70dd

From 5c3b70b241d09cc4b7a6554b8b2c78d730e83e25 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 11:12:05 +0200
Subject: [PATCH 10/19] fix: keep codex panes working while streaming

Use recent PTY output as a bounded fallback when Codex has no positive idle or blocker evidence. Codex's non-empty OSC cwd title still resolves Idle but no longer sets visible_idle, so pending-idle confirmation and blocker arbitration can observe the difference. Claude's live prompt box and blocker rules remain unchanged.
---
 src/detect/manifest/tests.rs       |  38 ++++++-
 src/detect/manifests/codex.toml    |  12 +--
 src/pane.rs                        |  48 ++++++++-
 src/pane/agent_detection.rs        | 153 ++++++++++++++++++++++++++++-
 website/agent-detection/codex.toml |  12 +--
 5 files changed, 239 insertions(+), 24 deletions(-)

diff --git a/src/detect/manifest/tests.rs b/src/detect/manifest/tests.rs
index 31639e71de..fca67bdee1 100644
--- a/src/detect/manifest/tests.rs
+++ b/src/detect/manifest/tests.rs
@@ -697,6 +697,19 @@ fn claude_empty_osc_empty_screen_is_idle_fallback() {
     assert!(!result.visible_idle);
 }
 
+#[test]
+fn claude_live_prompt_box_remains_a_positive_idle_observation() {
+    let screen = "──────────\n❯\n──────────\n";
+    let result = osc_explain(Agent::Claude, screen, "", "");
+
+    assert_eq!(result.state, AgentState::Idle);
+    assert_eq!(
+        result.matched_rule.as_ref().map(|rule| rule.id.as_str()),
+        Some("live_prompt_box")
+    );
+    assert!(result.visible_idle);
+}
+
 // --- Codex OSC rules ---
 
 #[test]
@@ -730,7 +743,7 @@ fn codex_osc_title_plain_is_idle() {
         result.matched_rule.as_ref().map(|r| r.id.as_str()),
         Some("osc_title_idle")
     );
-    assert!(result.visible_idle);
+    assert!(!result.visible_idle);
 }
 
 #[test]
@@ -744,7 +757,7 @@ fn codex_background_terminal_screen_does_not_override_osc_idle() {
         result.matched_rule.as_ref().map(|r| r.id.as_str()),
         Some("osc_title_idle")
     );
-    assert!(result.visible_idle);
+    assert!(!result.visible_idle);
 }
 
 #[test]
@@ -756,7 +769,8 @@ fn codex_screen_working_fallback_handles_static_osc_title_and_progress_decoratio
         let screen = format!(
             "• I’ll run it and wait for completion.\n\n{progress_line}\n\n\
              › Use /skills to list available skills\n\n\
-             gpt-5.6-sol default · /work\n"
+             gpt-5.6-sol default · /work\n\
+             footer detail\n"
         );
         let result = osc_explain(Agent::Codex, &screen, "project", "");
 
@@ -766,6 +780,14 @@ fn codex_screen_working_fallback_handles_static_osc_title_and_progress_decoratio
             Some("screen_working_fallback"),
             "{progress_line}"
         );
+        assert_eq!(
+            result
+                .matched_rule
+                .as_ref()
+                .map(|rule| rule.region.as_str()),
+            Some("after_current_prompt_block_marker"),
+            "{progress_line}"
+        );
         assert!(result.visible_working, "{progress_line}");
     }
 }
@@ -844,6 +866,12 @@ fn codex_screen_working_fallback_ignores_stale_and_prompt_text() {
         "  ◦ Working (1m 16s • esc to interrupt)\n\
          › Use /skills to list available skills\n\
          gpt-5.6-sol default · /work\n",
+        "• Earlier turn\n\
+         ◦ Working (1m 16s • esc to interrupt)\n\
+         › Previous prompt\n\
+         • Current turn\n\
+         › Use /skills to list available skills\n\
+         gpt-5.6-sol default · /work\n",
     ];
 
     for screen in screens {
@@ -853,7 +881,7 @@ fn codex_screen_working_fallback_ignores_stale_and_prompt_text() {
             result.matched_rule.as_ref().map(|r| r.id.as_str()),
             Some("osc_title_idle")
         );
-        assert!(result.visible_idle);
+        assert!(!result.visible_idle);
         assert!(!result.visible_working);
     }
 }
@@ -870,7 +898,7 @@ fn codex_screen_working_fallback_ignores_interrupted_short_terminal() {
         result.matched_rule.as_ref().map(|r| r.id.as_str()),
         Some("osc_title_idle")
     );
-    assert!(result.visible_idle);
+    assert!(!result.visible_idle);
     assert!(!result.visible_working);
 }
 
diff --git a/src/detect/manifests/codex.toml b/src/detect/manifests/codex.toml
index 304e579bfb..28384529cf 100644
--- a/src/detect/manifests/codex.toml
+++ b/src/detect/manifests/codex.toml
@@ -1,7 +1,7 @@
 id = "codex"
-version = "2026.08.02.1"
+version = "2026.08.07.1"
 min_engine_version = 2
-updated_at = "2026-08-02T00:00:00Z"
+updated_at = "2026-08-07T00:00:00Z"
 
 [[rules]]
 id = "osc_title_blocked"
@@ -60,11 +60,10 @@ any = [
 id = "screen_working_fallback"
 state = "working"
 priority = 500
-region = "bottom_non_empty_lines(3)"
+region = "after_current_prompt_block_marker"
 visible_working = true
-# Codex v0.146 keeps OSC title static while working and renders this progress
-# line without a bullet. Accept either current line decoration in the terminal
-# bottom buffer; blockers and interrupted-state checks above still outrank it.
+# Start at the latest Codex block marker so footer height cannot hide the live
+# status while an earlier turn in scrollback cannot satisfy the rule.
 line_regex = ['^(?:[•◦]\s+)?Working \([^)]*esc to interrupt\)(?: · .*)?$']
 not = [{ contains = ["■ Conversation interrupted"] }]
 
@@ -73,7 +72,6 @@ id = "osc_title_idle"
 state = "idle"
 priority = 100
 region = "osc_title"
-visible_idle = true
 regex = ['\S']
 not = [
   { regex = ['(?:^| )[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏](?: |$)'] },
diff --git a/src/pane.rs b/src/pane.rs
index e74c958537..af3fea2590 100644
--- a/src/pane.rs
+++ b/src/pane.rs
@@ -40,10 +40,11 @@ mod xtgettcap;
 
 use self::agent_detection::{
     decide_detection_screen_read, decide_screen_detection_publish,
-    detection_update_for_publish_with_osc, mark_detection_content_changed,
-    observe_detection_content_change, DetectionPublishDecision, DetectionScreenReadDecision,
-    DetectionScreenReadInput, FullLifecycleHookOutputRetirement, PendingIdleConfirmation,
-    ScreenDetectionPublishInput, AGENT_PENDING_IDLE_RECHECK, AGENT_STARTUP_GRACE_WINDOW,
+    detection_update_for_publish_with_osc, mark_detection_content_changed, observe_agent_output,
+    observe_detection_content_change, recent_agent_output, DetectionPublishDecision,
+    DetectionScreenReadDecision, DetectionScreenReadInput, FullLifecycleHookOutputRetirement,
+    PendingIdleConfirmation, ScreenDetectionPublishInput, AGENT_PENDING_IDLE_RECHECK,
+    AGENT_STARTUP_GRACE_WINDOW,
 };
 use self::terminal::{GhosttyPaneTerminal, PaneTerminal};
 pub(crate) use self::terminal::{
@@ -669,6 +670,7 @@ fn spawn_basic_detection_task(
     terminal: Arc<PaneTerminal>,
     detection_content_seq: Arc<AtomicU64>,
     full_lifecycle_hook_baseline_content_seq: Arc<AtomicU64>,
+    agent_output_seq: Arc<AtomicU64>,
     full_lifecycle_authority_active: Arc<AtomicBool>,
     full_lifecycle_hook_blocked: Arc<AtomicBool>,
     state_events: mpsc::Sender<AppEvent>,
@@ -700,6 +702,8 @@ fn spawn_basic_detection_task(
         let mut last_detection_text = String::new();
         let mut last_screen_scan_detection_content_seq = None;
         let mut hook_output_retirement = FullLifecycleHookOutputRetirement::default();
+        let mut last_output_seq = Some(agent_output_seq.load(Ordering::Relaxed));
+        let mut last_output_at = None;
         let mut agent_startup_grace_until = None;
         let mut pending_idle = PendingIdleConfirmation::default();
         let mut last_background_job_count = None;
@@ -732,6 +736,7 @@ fn spawn_basic_detection_task(
                     last_detection_text.clear();
                     last_screen_scan_detection_content_seq = None;
                     hook_output_retirement.clear();
+                    last_output_at = None;
                     agent_startup_grace_until = None;
                     pending_idle.clear();
                     last_background_job_count = None;
@@ -883,6 +888,17 @@ fn spawn_basic_detection_task(
                 hook_output_retirement.clear();
             }
 
+            if agent_changed || suppressed_agent.is_some() {
+                last_output_at = None;
+            }
+            let recent_output = recent_agent_output(
+                agent,
+                agent_output_seq.load(Ordering::Relaxed),
+                &mut last_output_seq,
+                &mut last_output_at,
+                now,
+            );
+
             let background_scan_seq = detection_content_seq.load(Ordering::Relaxed);
             if background_scan_needed(
                 agent_changed,
@@ -980,6 +996,7 @@ fn spawn_basic_detection_task(
             match decide_screen_detection_publish(
                 ScreenDetectionPublishInput {
                     screen_detection,
+                    recent_output,
                     current_state: state,
                     last_visible_idle,
                     last_visible_blocker,
@@ -1958,6 +1975,7 @@ impl PaneRuntime {
         let reported_cwd = Arc::new(Mutex::new(None));
         let kitty_keyboard_flags = Arc::new(AtomicU16::new(keyboard_protocol_flags));
         let detection_content_seq = Arc::new(AtomicU64::new(0));
+        let agent_output_seq = Arc::new(AtomicU64::new(0));
 
         let io = {
             let terminal = terminal.clone();
@@ -1965,6 +1983,7 @@ impl PaneRuntime {
             let render_notify = render_notify.clone();
             let render_dirty = render_dirty.clone();
             let detection_content_seq = detection_content_seq.clone();
+            let agent_output_seq = agent_output_seq.clone();
             let child_pid = child_pid.clone();
             let read_events = events.clone();
             let reported_cwd = reported_cwd.clone();
@@ -1975,6 +1994,7 @@ impl PaneRuntime {
                 let result =
                     terminal.process_pty_bytes(pane_id, shell_pid, bytes, &response_writer);
                 observe_detection_content_change(bytes, &detection_content_seq);
+                observe_agent_output(bytes, &agent_output_seq);
                 if result.request_render && render_dirty.request_pty(pane_id) {
                     render_notify.notify_one();
                 }
@@ -2027,6 +2047,7 @@ impl PaneRuntime {
             terminal.clone(),
             detection_content_seq.clone(),
             full_lifecycle_hook_baseline_content_seq.clone(),
+            agent_output_seq.clone(),
             full_lifecycle_authority_active.clone(),
             full_lifecycle_hook_blocked.clone(),
             events,
@@ -2100,6 +2121,7 @@ impl PaneRuntime {
         let child_wait_completed = Arc::new(AtomicBool::new(false));
         let detection_content_seq = Arc::new(AtomicU64::new(0));
         let full_lifecycle_hook_baseline_content_seq = Arc::new(AtomicU64::new(0));
+        let agent_output_seq = Arc::new(AtomicU64::new(0));
         let full_lifecycle_authority_active = Arc::new(AtomicBool::new(false));
         let full_lifecycle_hook_blocked = Arc::new(AtomicBool::new(false));
         {
@@ -2134,6 +2156,7 @@ impl PaneRuntime {
             let render_notify = render_notify.clone();
             let render_dirty = render_dirty.clone();
             let detection_content_seq = detection_content_seq.clone();
+            let agent_output_seq = agent_output_seq.clone();
             let child_pid = child_pid.clone();
             let events = events.clone();
             let reported_cwd = reported_cwd.clone();
@@ -2144,6 +2167,7 @@ impl PaneRuntime {
                     terminal.process_pty_bytes(pane_id, shell_pid, bytes, &response_writer);
                 if agent_detection == AgentDetection::Enabled {
                     observe_detection_content_change(bytes, &detection_content_seq);
+                    observe_agent_output(bytes, &agent_output_seq);
                 }
                 if result.request_render && render_dirty.request_pty(pane_id) {
                     render_notify.notify_one();
@@ -2203,6 +2227,7 @@ impl PaneRuntime {
             let detection_content_seq = detection_content_seq.clone();
             let full_lifecycle_hook_baseline_content_seq_for_task =
                 full_lifecycle_hook_baseline_content_seq.clone();
+            let agent_output_seq = agent_output_seq.clone();
             let full_lifecycle_authority_active_for_task = full_lifecycle_authority_active.clone();
             let full_lifecycle_hook_blocked_for_task = full_lifecycle_hook_blocked.clone();
             let render_notify = render_notify.clone();
@@ -2232,6 +2257,8 @@ impl PaneRuntime {
                 let mut last_detection_text = String::new();
                 let mut last_screen_scan_detection_content_seq = None;
                 let mut hook_output_retirement = FullLifecycleHookOutputRetirement::default();
+                let mut last_output_seq = Some(agent_output_seq.load(Ordering::Relaxed));
+                let mut last_output_at = None;
                 let mut agent_startup_grace_until = None;
                 let mut pending_idle = PendingIdleConfirmation::default();
                 let mut last_background_job_count = None;
@@ -2274,6 +2301,7 @@ impl PaneRuntime {
                             last_detection_text.clear();
                             last_screen_scan_detection_content_seq = None;
                             hook_output_retirement.clear();
+                            last_output_at = None;
                             agent_startup_grace_until = None;
                             pending_idle.clear();
                             last_background_job_count = None;
@@ -2466,6 +2494,17 @@ impl PaneRuntime {
                         hook_output_retirement.clear();
                     }
 
+                    if agent_changed || suppressed_agent.is_some() {
+                        last_output_at = None;
+                    }
+                    let recent_output = recent_agent_output(
+                        agent,
+                        agent_output_seq.load(Ordering::Relaxed),
+                        &mut last_output_seq,
+                        &mut last_output_at,
+                        now,
+                    );
+
                     let background_scan_seq = detection_content_seq.load(Ordering::Relaxed);
                     if background_scan_needed(
                         agent_changed,
@@ -2563,6 +2602,7 @@ impl PaneRuntime {
                     match decide_screen_detection_publish(
                         ScreenDetectionPublishInput {
                             screen_detection,
+                            recent_output,
                             current_state: state,
                             last_visible_idle,
                             last_visible_blocker,
diff --git a/src/pane/agent_detection.rs b/src/pane/agent_detection.rs
index 29330bf2ca..a7b17aca7b 100644
--- a/src/pane/agent_detection.rs
+++ b/src/pane/agent_detection.rs
@@ -7,6 +7,11 @@ pub(super) const AGENT_PENDING_IDLE_RECHECK: std::time::Duration =
 const AGENT_PENDING_IDLE_CONFIRMATIONS: u8 = 3;
 pub(super) const AGENT_PENDING_IDLE_CAP: std::time::Duration =
     std::time::Duration::from_millis(700);
+/// One second spans three 300ms identified-agent ticks and outlasts the
+/// 700ms pending-idle hold, covering a slow token gap while letting a quiet
+/// pane return to idle on the next detection pass.
+pub(super) const AGENT_RECENT_OUTPUT_WINDOW: std::time::Duration =
+    std::time::Duration::from_secs(1);
 pub(super) const STABLE_VISIBLE_SIGNAL_REFRESH: std::time::Duration =
     std::time::Duration::from_millis(800);
 pub(super) const AGENT_STARTUP_GRACE_WINDOW: std::time::Duration =
@@ -206,6 +211,29 @@ pub(super) fn stable_visible_signal_refresh_due(
         })
 }
 
+pub(super) fn recent_agent_output(
+    agent: Option<Agent>,
+    output_seq: u64,
+    last_output_seq: &mut Option<u64>,
+    last_output_at: &mut Option<std::time::Instant>,
+    now: std::time::Instant,
+) -> bool {
+    if *last_output_seq != Some(output_seq) {
+        *last_output_seq = Some(output_seq);
+        if agent.is_some() {
+            *last_output_at = Some(now);
+        }
+    }
+
+    if agent.is_none() {
+        *last_output_at = None;
+        return false;
+    }
+
+    last_output_at
+        .is_some_and(|last_output| now.duration_since(last_output) <= AGENT_RECENT_OUTPUT_WINDOW)
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub(super) enum DetectionTransitionDecision {
     NoPublish,
@@ -269,6 +297,7 @@ pub(super) struct ScreenDetectionPublishInput {
     pub(super) last_visible_working: bool,
     pub(super) last_visible_signal_refresh: Option<std::time::Instant>,
     pub(super) screen_detection: AgentDetection,
+    pub(super) recent_output: bool,
     pub(super) process_exited: bool,
     pub(super) agent_changed: bool,
     pub(super) now: std::time::Instant,
@@ -279,7 +308,16 @@ pub(super) fn decide_screen_detection_publish(
     pending_idle: &mut PendingIdleConfirmation,
 ) -> DetectionPublishDecision {
     let detection = input.screen_detection;
-    let new_state = crate::terminal::state::stabilize_agent_detection(detection);
+    let detected_state = crate::terminal::state::stabilize_agent_detection(detection);
+    let new_state = if input.recent_output
+        && detected_state == AgentState::Idle
+        && !detection.visible_idle
+        && !detection.visible_blocker
+    {
+        AgentState::Working
+    } else {
+        detected_state
+    };
     let visible_idle = detection.visible_idle && new_state == AgentState::Idle;
     let visible_blocker = detection.visible_blocker && new_state == AgentState::Blocked;
     let visible_working = detection.visible_working && new_state == AgentState::Working;
@@ -361,6 +399,12 @@ pub(super) fn observe_detection_content_change(bytes: &[u8], detection_content_s
     }
 }
 
+pub(super) fn observe_agent_output(bytes: &[u8], output_seq: &AtomicU64) {
+    if !bytes.is_empty() {
+        output_seq.fetch_add(1, Ordering::Relaxed);
+    }
+}
+
 pub(super) fn mark_detection_content_changed(detection_content_seq: &AtomicU64) {
     detection_content_seq.fetch_add(1, Ordering::Relaxed);
 }
@@ -400,6 +444,7 @@ mod tests {
             last_visible_working: false,
             last_visible_signal_refresh: None,
             screen_detection,
+            recent_output: false,
             process_exited: false,
             agent_changed: false,
             now,
@@ -570,6 +615,112 @@ mod tests {
         );
     }
 
+    #[test]
+    fn recent_agent_output_promotes_plain_idle_detection_to_working() {
+        let now = std::time::Instant::now();
+        let mut input = screen_publish_input(
+            AgentState::Idle,
+            AgentDetection {
+                state: AgentState::Idle,
+                skip_state_update: false,
+                visible_idle: false,
+                visible_blocker: false,
+                visible_working: false,
+            },
+            now,
+        );
+        input.recent_output = true;
+        let mut pending_idle = PendingIdleConfirmation::default();
+
+        assert_eq!(
+            decide_screen_detection_publish(input, &mut pending_idle),
+            DetectionPublishDecision::Publish {
+                state: AgentState::Working,
+                visible_idle: false,
+                visible_blocker: false,
+                visible_working: false,
+                process_exited: false,
+            }
+        );
+    }
+
+    #[test]
+    fn positive_idle_observation_wins_immediately_over_recent_agent_output() {
+        let now = std::time::Instant::now();
+        let mut input =
+            screen_publish_input(AgentState::Working, screen_detection(AgentState::Idle), now);
+        input.recent_output = true;
+        let mut pending_idle = PendingIdleConfirmation::default();
+
+        assert_eq!(
+            decide_screen_detection_publish(input, &mut pending_idle),
+            DetectionPublishDecision::Publish {
+                state: AgentState::Idle,
+                visible_idle: true,
+                visible_blocker: false,
+                visible_working: false,
+                process_exited: false,
+            }
+        );
+    }
+
+    #[test]
+    fn recent_agent_output_expires_before_a_plain_idle_transition_completes() {
+        let now = std::time::Instant::now();
+        let mut last_output_seq = None;
+        let mut last_output_at = None;
+        assert!(recent_agent_output(
+            Some(Agent::Codex),
+            1,
+            &mut last_output_seq,
+            &mut last_output_at,
+            now,
+        ));
+
+        let expired_at = now + AGENT_RECENT_OUTPUT_WINDOW + std::time::Duration::from_millis(1);
+        assert!(!recent_agent_output(
+            Some(Agent::Codex),
+            1,
+            &mut last_output_seq,
+            &mut last_output_at,
+            expired_at,
+        ));
+
+        let plain_idle = AgentDetection {
+            state: AgentState::Idle,
+            skip_state_update: false,
+            visible_idle: false,
+            visible_blocker: false,
+            visible_working: false,
+        };
+        let mut input = screen_publish_input(AgentState::Working, plain_idle, expired_at);
+        input.recent_output = false;
+        let mut pending_idle = PendingIdleConfirmation::default();
+        assert_eq!(
+            decide_screen_detection_publish(input, &mut pending_idle),
+            DetectionPublishDecision::NoPublish
+        );
+
+        for confirmation in 1..=3 {
+            input.now = expired_at + AGENT_PENDING_IDLE_RECHECK * confirmation;
+            let decision = decide_screen_detection_publish(input, &mut pending_idle);
+            if confirmation < 3 {
+                assert_eq!(decision, DetectionPublishDecision::NoPublish);
+            } else {
+                assert_eq!(
+                    decision,
+                    DetectionPublishDecision::Publish {
+                        state: AgentState::Idle,
+                        visible_idle: false,
+                        visible_blocker: false,
+                        visible_working: false,
+                        process_exited: false,
+                    }
+                );
+            }
+        }
+    }
+
     #[test]
     fn detection_content_change_tracks_raw_nonempty_reads_for_scan_scheduling() {
         let seq = AtomicU64::new(0);
diff --git a/website/agent-detection/codex.toml b/website/agent-detection/codex.toml
index 304e579bfb..28384529cf 100644
--- a/website/agent-detection/codex.toml
+++ b/website/agent-detection/codex.toml
@@ -1,7 +1,7 @@
 id = "codex"
-version = "2026.08.02.1"
+version = "2026.08.07.1"
 min_engine_version = 2
-updated_at = "2026-08-02T00:00:00Z"
+updated_at = "2026-08-07T00:00:00Z"
 
 [[rules]]
 id = "osc_title_blocked"
@@ -60,11 +60,10 @@ any = [
 id = "screen_working_fallback"
 state = "working"
 priority = 500
-region = "bottom_non_empty_lines(3)"
+region = "after_current_prompt_block_marker"
 visible_working = true
-# Codex v0.146 keeps OSC title static while working and renders this progress
-# line without a bullet. Accept either current line decoration in the terminal
-# bottom buffer; blockers and interrupted-state checks above still outrank it.
+# Start at the latest Codex block marker so footer height cannot hide the live
+# status while an earlier turn in scrollback cannot satisfy the rule.
 line_regex = ['^(?:[•◦]\s+)?Working \([^)]*esc to interrupt\)(?: · .*)?$']
 not = [{ contains = ["■ Conversation interrupted"] }]
 
@@ -73,7 +72,6 @@ id = "osc_title_idle"
 state = "idle"
 priority = 100
 region = "osc_title"
-visible_idle = true
 regex = ['\S']
 not = [
   { regex = ['(?:^| )[⠋⠙⠹⠸⠼⠴⠦⠧⠇⠏](?: |$)'] },

From 780bfa3d67385cb3f65bc05e6413fb8928bb5e50 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 11:32:08 +0200
Subject: [PATCH 11/19] fix(detect): keep the codex working rule anchored to
 observed screens

Verified against live `agent.read` captures of a codex 0.147 pane: a real
turn prints no block marker, so the block-marker region emptied the rule and
the only working evidence codex has stopped firing.
---
 src/detect/manifest/tests.rs       | 70 +++++++++++++++++++++++++++---
 src/detect/manifests/codex.toml    | 10 +++--
 src/pane/agent_detection.rs        | 11 +++--
 website/agent-detection/codex.toml | 10 +++--
 4 files changed, 84 insertions(+), 17 deletions(-)

diff --git a/src/detect/manifest/tests.rs b/src/detect/manifest/tests.rs
index fca67bdee1..c3225b29c9 100644
--- a/src/detect/manifest/tests.rs
+++ b/src/detect/manifest/tests.rs
@@ -785,13 +785,67 @@ fn codex_screen_working_fallback_handles_static_osc_title_and_progress_decoratio
                 .matched_rule
                 .as_ref()
                 .map(|rule| rule.region.as_str()),
-            Some("after_current_prompt_block_marker"),
+            Some("bottom_non_empty_lines(6)"),
             "{progress_line}"
         );
         assert!(result.visible_working, "{progress_line}");
     }
 }
 
+/// Verbatim from a codex-cli 0.147.0 pane read back through `agent.read` while
+/// it ran a shell command. Note what is *not* here: no bullet, no spinner, and
+/// an OSC title that never leaves the cwd. This screen is the reason the rule
+/// cannot anchor itself to a block marker.
+const CODEX_TOOL_CALL_SCREEN: &str = "\
+› Run exactly this shell command and nothing else, then report the exit code: sleep 45
+
+Working (19s • esc to interrupt) · 1 background terminal running · /ps to view
+
+› Write tests for @filename
+
+  gpt-5.6-luna medium · Context 97% left · 8.69K used · ~/workspaces/personal
+";
+
+/// The same pane a few seconds later, streaming its answer. Codex removes the
+/// progress line while it writes, so nothing on screen separates this from a
+/// finished turn -- only the bytes still arriving do.
+const CODEX_STREAMING_SCREEN: &str = "\
+› Explain in detail, step by step, how the Rust borrow checker works.
+
+• Rust's borrow checker enforces one central rule:
+
+  let value = String::from(\"hello\");
+  let reference = &value;
+
+› Use /skills to list available skills
+
+  gpt-5.6-luna medium · Context 100% left · ~/workspaces/personal
+";
+
+#[test]
+fn a_codex_pane_running_a_tool_is_working_even_though_it_printed_no_block_marker() {
+    let result = osc_explain(Agent::Codex, CODEX_TOOL_CALL_SCREEN, "personal", "");
+
+    assert_eq!(result.state, AgentState::Working);
+    assert_eq!(
+        result.matched_rule.as_ref().map(|r| r.id.as_str()),
+        Some("screen_working_fallback")
+    );
+    assert!(result.visible_working);
+}
+
+#[test]
+fn a_streaming_codex_pane_shows_no_working_evidence_on_screen_at_all() {
+    let result = osc_explain(Agent::Codex, CODEX_STREAMING_SCREEN, "personal", "");
+
+    // Idle by elimination, and the flag says so: nobody observed an idle pane,
+    // the manifest simply ran out of rules. Recent output is what rescues this
+    // screen, and it lives outside the manifest.
+    assert_eq!(result.state, AgentState::Idle);
+    assert!(!result.visible_working);
+    assert!(!result.visible_idle);
+}
+
 #[test]
 fn codex_osc_working_remains_preferred_over_screen_fallback() {
     let screen = "• Working (4s • esc to interrupt)\n\n\
@@ -866,12 +920,14 @@ fn codex_screen_working_fallback_ignores_stale_and_prompt_text() {
         "  ◦ Working (1m 16s • esc to interrupt)\n\
          › Use /skills to list available skills\n\
          gpt-5.6-sol default · /work\n",
-        "• Earlier turn\n\
-         ◦ Working (1m 16s • esc to interrupt)\n\
-         › Previous prompt\n\
-         • Current turn\n\
-         › Use /skills to list available skills\n\
-         gpt-5.6-sol default · /work\n",
+        // A stale progress line from an *earlier* turn is deliberately not
+        // tested here, because codex erases that line the moment the turn ends
+        // -- the same erase that leaves a streaming pane with no working
+        // evidence at all (see CODEX_STREAMING_SCREEN). A copy can only survive
+        // in scrollback the pane has already scrolled past, which puts it far
+        // above the bottom lines this rule reads. Narrowing the region to
+        // exclude a screen that cannot occur would cost the margin the observed
+        // tool-call screen needs.
     ];
 
     for screen in screens {
diff --git a/src/detect/manifests/codex.toml b/src/detect/manifests/codex.toml
index 28384529cf..bd288fe942 100644
--- a/src/detect/manifests/codex.toml
+++ b/src/detect/manifests/codex.toml
@@ -60,10 +60,14 @@ any = [
 id = "screen_working_fallback"
 state = "working"
 priority = 500
-region = "after_current_prompt_block_marker"
+region = "bottom_non_empty_lines(6)"
 visible_working = true
-# Start at the latest Codex block marker so footer height cannot hide the live
-# status while an earlier turn in scrollback cannot satisfy the rule.
+# Anchoring to a block marker looked tidier but empties the region on a real
+# turn: a codex 0.147 pane running a tool prints no bullet at all, so there is
+# nothing to anchor to and the only working rule the manifest has stops firing.
+# Six bottom lines clear the composer and status footer with room for a taller
+# one, and codex erases this line when it streams, so scrollback holds no stale
+# copy to match by accident.
 line_regex = ['^(?:[•◦]\s+)?Working \([^)]*esc to interrupt\)(?: · .*)?$']
 not = [{ contains = ["■ Conversation interrupted"] }]
 
diff --git a/src/pane/agent_detection.rs b/src/pane/agent_detection.rs
index a7b17aca7b..9b968e7e23 100644
--- a/src/pane/agent_detection.rs
+++ b/src/pane/agent_detection.rs
@@ -7,11 +7,14 @@ pub(super) const AGENT_PENDING_IDLE_RECHECK: std::time::Duration =
 const AGENT_PENDING_IDLE_CONFIRMATIONS: u8 = 3;
 pub(super) const AGENT_PENDING_IDLE_CAP: std::time::Duration =
     std::time::Duration::from_millis(700);
-/// One second spans three 300ms identified-agent ticks and outlasts the
-/// 700ms pending-idle hold, covering a slow token gap while letting a quiet
-/// pane return to idle on the next detection pass.
+/// Two seconds spans six 300ms identified-agent ticks and outlasts the 700ms
+/// pending-idle hold. It only has to cover a stall in a *stream*: a codex pane
+/// waiting on a tool keeps its progress line on screen for the whole wait --
+/// measured at 15s of an unchanged screen -- and is held Working by the rule
+/// that reads it, not by this window. Longer would keep a finished pane
+/// Working for no gain, since the turn-end hook reports idle either way.
 pub(super) const AGENT_RECENT_OUTPUT_WINDOW: std::time::Duration =
-    std::time::Duration::from_secs(1);
+    std::time::Duration::from_secs(2);
 pub(super) const STABLE_VISIBLE_SIGNAL_REFRESH: std::time::Duration =
     std::time::Duration::from_millis(800);
 pub(super) const AGENT_STARTUP_GRACE_WINDOW: std::time::Duration =
diff --git a/website/agent-detection/codex.toml b/website/agent-detection/codex.toml
index 28384529cf..bd288fe942 100644
--- a/website/agent-detection/codex.toml
+++ b/website/agent-detection/codex.toml
@@ -60,10 +60,14 @@ any = [
 id = "screen_working_fallback"
 state = "working"
 priority = 500
-region = "after_current_prompt_block_marker"
+region = "bottom_non_empty_lines(6)"
 visible_working = true
-# Start at the latest Codex block marker so footer height cannot hide the live
-# status while an earlier turn in scrollback cannot satisfy the rule.
+# Anchoring to a block marker looked tidier but empties the region on a real
+# turn: a codex 0.147 pane running a tool prints no bullet at all, so there is
+# nothing to anchor to and the only working rule the manifest has stops firing.
+# Six bottom lines clear the composer and status footer with room for a taller
+# one, and codex erases this line when it streams, so scrollback holds no stale
+# copy to match by accident.
 line_regex = ['^(?:[•◦]\s+)?Working \([^)]*esc to interrupt\)(?: · .*)?$']
 not = [{ contains = ["■ Conversation interrupted"] }]
 

From bbf57580f97458ef3cb796ae52eed8b27b764f22 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 11:41:56 +0200
Subject: [PATCH 12/19] chore(detect): preserve codex-working merge provenance

source commit: 8605133fe304870f8835fe04587d9ad138649c85

From 46da0d90032a2699de3b9472b366cd445b054e73 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 12:00:03 +0200
Subject: [PATCH 13/19] fix(detect): widen the recent-output window past the
 measured think gap

A live codex 0.147 turn goes silent for 3.6s between erasing its progress
line and the first streamed token; a two-second window showed that gap as
`done` mid-turn.
---
 src/pane/agent_detection.rs | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/src/pane/agent_detection.rs b/src/pane/agent_detection.rs
index 9b968e7e23..0a6ab5947a 100644
--- a/src/pane/agent_detection.rs
+++ b/src/pane/agent_detection.rs
@@ -7,14 +7,16 @@ pub(super) const AGENT_PENDING_IDLE_RECHECK: std::time::Duration =
 const AGENT_PENDING_IDLE_CONFIRMATIONS: u8 = 3;
 pub(super) const AGENT_PENDING_IDLE_CAP: std::time::Duration =
     std::time::Duration::from_millis(700);
-/// Two seconds spans six 300ms identified-agent ticks and outlasts the 700ms
-/// pending-idle hold. It only has to cover a stall in a *stream*: a codex pane
-/// waiting on a tool keeps its progress line on screen for the whole wait --
-/// measured at 15s of an unchanged screen -- and is held Working by the rule
-/// that reads it, not by this window. Longer would keep a finished pane
-/// Working for no gain, since the turn-end hook reports idle either way.
+/// This only has to cover a stall *inside* a turn: a codex pane waiting on a
+/// tool keeps its progress line on screen for the whole wait and is held
+/// Working by the rule that reads it, not by this window. The gap this covers
+/// is the silent one after codex erases that line and before the first token
+/// arrives -- measured at 3.6s on a live 0.147 pane, which a two-second window
+/// let show as `done` mid-turn. Eight seconds gives that measurement room to
+/// double and costs nothing at the real end of a turn, because the turn-end
+/// hook reports idle directly and outranks this.
 pub(super) const AGENT_RECENT_OUTPUT_WINDOW: std::time::Duration =
-    std::time::Duration::from_secs(2);
+    std::time::Duration::from_secs(8);
 pub(super) const STABLE_VISIBLE_SIGNAL_REFRESH: std::time::Duration =
     std::time::Duration::from_millis(800);
 pub(super) const AGENT_STARTUP_GRACE_WINDOW: std::time::Duration =

From 4df5661228eacd82863de35ea9e6a062a8bac6f8 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Fri, 7 Aug 2026 12:25:42 +0200
Subject: [PATCH 14/19] fix(detect): resume hook-idle panes from settled screen
 evidence

---
 src/pane.rs                 |  35 ++++++++-
 src/pane/agent_detection.rs |   2 +-
 src/terminal/state.rs       | 151 +++++++++++++++++++++++++++++++++++-
 3 files changed, 182 insertions(+), 6 deletions(-)

diff --git a/src/pane.rs b/src/pane.rs
index af3fea2590..97b6f66898 100644
--- a/src/pane.rs
+++ b/src/pane.rs
@@ -38,6 +38,7 @@ mod state;
 mod terminal;
 mod xtgettcap;
 
+pub(crate) use self::agent_detection::STABLE_VISIBLE_SIGNAL_REFRESH;
 use self::agent_detection::{
     decide_detection_screen_read, decide_screen_detection_publish,
     detection_update_for_publish_with_osc, mark_detection_content_changed, observe_agent_output,
@@ -453,6 +454,14 @@ fn should_skip_process_probe_for_lifecycle_authority(
         && !foreground_group_changed(input.foreground_pgid, input.last_foreground_pgid)
 }
 
+fn should_skip_screen_detection_for_lifecycle_authority(
+    full_lifecycle_authority_active: bool,
+    full_lifecycle_hook_blocked: bool,
+    process_exited: bool,
+) -> bool {
+    full_lifecycle_authority_active && full_lifecycle_hook_blocked && !process_exited
+}
+
 fn should_probe_foreground_job(input: ProcessProbeInput) -> bool {
     if input.pending_foreground_shell_clear || input.pending_restore_probe {
         return true;
@@ -924,7 +933,11 @@ fn spawn_basic_detection_task(
                 last_background_process_exited = Some(process_exited);
             }
 
-            if lifecycle_authority_active && !process_exited {
+            if should_skip_screen_detection_for_lifecycle_authority(
+                lifecycle_authority_active,
+                full_lifecycle_hook_blocked.load(Ordering::Acquire),
+                process_exited,
+            ) {
                 pending_idle.clear();
                 continue;
             }
@@ -2530,7 +2543,11 @@ impl PaneRuntime {
                         last_background_process_exited = Some(process_exited);
                     }
 
-                    if lifecycle_authority_active && !process_exited {
+                    if should_skip_screen_detection_for_lifecycle_authority(
+                        lifecycle_authority_active,
+                        full_lifecycle_hook_blocked_for_task.load(Ordering::Acquire),
+                        process_exited,
+                    ) {
                         pending_idle.clear();
                         continue;
                     }
@@ -4151,6 +4168,20 @@ mod tests {
         ));
     }
 
+    #[test]
+    fn active_unblocked_lifecycle_authority_reads_the_screen() {
+        assert!(!should_skip_screen_detection_for_lifecycle_authority(
+            true, false, false
+        ));
+    }
+
+    #[test]
+    fn active_blocked_lifecycle_authority_skips_the_screen() {
+        assert!(should_skip_screen_detection_for_lifecycle_authority(
+            true, true, false
+        ));
+    }
+
     #[test]
     fn pending_release_forces_initial_process_probe() {
         assert!(should_probe_foreground_job(ProcessProbeInput {
diff --git a/src/pane/agent_detection.rs b/src/pane/agent_detection.rs
index 0a6ab5947a..2208619d66 100644
--- a/src/pane/agent_detection.rs
+++ b/src/pane/agent_detection.rs
@@ -17,7 +17,7 @@ pub(super) const AGENT_PENDING_IDLE_CAP: std::time::Duration =
 /// hook reports idle directly and outranks this.
 pub(super) const AGENT_RECENT_OUTPUT_WINDOW: std::time::Duration =
     std::time::Duration::from_secs(8);
-pub(super) const STABLE_VISIBLE_SIGNAL_REFRESH: std::time::Duration =
+pub(crate) const STABLE_VISIBLE_SIGNAL_REFRESH: std::time::Duration =
     std::time::Duration::from_millis(800);
 pub(super) const AGENT_STARTUP_GRACE_WINDOW: std::time::Duration =
     std::time::Duration::from_secs(3);
diff --git a/src/terminal/state.rs b/src/terminal/state.rs
index 08986578d4..8f769d4b1a 100644
--- a/src/terminal/state.rs
+++ b/src/terminal/state.rs
@@ -5,8 +5,8 @@ use std::time::{Duration, Instant};
 use serde::{Deserialize, Serialize};
 
 // Effective state arbitration is intentionally centralized here. Full lifecycle
-// Herdr hook integrations are hook-authoritative while live; screen recovery
-// remains only for session-only/custom hook paths and fallback detection.
+// Herdr hook integrations are authoritative while live, except for settled
+// visible working evidence that can start a new turn after hook-reported idle.
 // Process-exit updates clear matching hook authority before recomputing state.
 
 use crate::detect::{Agent, AgentState};
@@ -261,6 +261,9 @@ pub struct TerminalState {
     pub detected_agent: Option<Agent>,
     pub fallback_state: AgentState,
     fallback_visible_blocker: bool,
+    fallback_visible_working: bool,
+    fallback_visible_working_observed_at: Option<Instant>,
+    fallback_working_observed_at: Option<Instant>,
     fallback_observed_at: Option<Instant>,
     pub hook_authority: Option<HookAuthority>,
     pub agent_metadata: HashMap<String, AgentMetadata>,
@@ -304,6 +307,9 @@ impl TerminalState {
             detected_agent: None,
             fallback_state: AgentState::Unknown,
             fallback_visible_blocker: false,
+            fallback_visible_working: false,
+            fallback_visible_working_observed_at: None,
+            fallback_working_observed_at: None,
             fallback_observed_at: None,
             hook_authority: None,
             agent_metadata: HashMap::new(),
@@ -556,7 +562,7 @@ impl TerminalState {
         fallback_state: AgentState,
         visible_blocker: bool,
         _visible_idle: bool,
-        _visible_working: bool,
+        visible_working: bool,
         process_exited: bool,
         now: Instant,
     ) -> TerminalStateMutation {
@@ -566,6 +572,10 @@ impl TerminalState {
         let previous_presentation = self.effective_presentation_for_state_at(previous_state, now);
         let previous_detected_agent = self.detected_agent;
         let previous_session = self.current_session_identity_for_persistence();
+        let visible_working_signal = visible_working && fallback_state == AgentState::Working;
+        self.fallback_visible_working = visible_working_signal;
+        self.fallback_visible_working_observed_at = visible_working_signal.then_some(now);
+        self.fallback_working_observed_at = (fallback_state == AgentState::Working).then_some(now);
         let newer_custom_authority = process_exited
             && self.hook_authority.as_ref().is_some_and(|authority| {
                 crate::detect::parse_agent_label(&authority.agent_label) == agent
@@ -2088,6 +2098,9 @@ impl TerminalState {
             self.detected_agent = None;
             self.fallback_state = AgentState::Unknown;
             self.fallback_visible_blocker = false;
+            self.fallback_visible_working = false;
+            self.fallback_visible_working_observed_at = None;
+            self.fallback_working_observed_at = None;
             self.fallback_observed_at = None;
             self.clear_agent_name();
         }
@@ -2228,6 +2241,47 @@ impl TerminalState {
             })
     }
 
+    fn visible_working_overrides_idle_hook(&self) -> bool {
+        let Some(authority) = self.hook_authority.as_ref() else {
+            return false;
+        };
+        authority.retired_at.is_none()
+            && self.hook_authority_is_effective(authority)
+            && authority.state == AgentState::Idle
+            && crate::detect::parse_agent_label(&authority.agent_label) == self.detected_agent
+            && self.fallback_visible_working
+            && self
+                .fallback_visible_working_observed_at
+                .is_some_and(|observed_at| {
+                    // Reuse the detector's stable-signal interval so one frame
+                    // left over from the hook report cannot start a new turn.
+                    authority
+                        .reported_at
+                        .checked_add(crate::pane::STABLE_VISIBLE_SIGNAL_REFRESH)
+                        .is_some_and(|settled_at| observed_at >= settled_at)
+                })
+    }
+
+    fn detected_working_overrides_idle_hook(&self) -> bool {
+        let Some(authority) = self.hook_authority.as_ref() else {
+            return false;
+        };
+        authority.retired_at.is_none()
+            && self.hook_authority_is_effective(authority)
+            && authority.state == AgentState::Idle
+            && crate::detect::parse_agent_label(&authority.agent_label) == self.detected_agent
+            && self
+                .fallback_working_observed_at
+                .is_some_and(|observed_at| {
+                    // The same settled interval covers output-promoted working
+                    // evidence, so a stale frame cannot start a new turn.
+                    authority
+                        .reported_at
+                        .checked_add(crate::pane::STABLE_VISIBLE_SIGNAL_REFRESH)
+                        .is_some_and(|settled_at| observed_at >= settled_at)
+                })
+    }
+
     fn live_full_lifecycle_hook_authority(&self) -> bool {
         self.hook_authority.as_ref().is_some_and(|authority| {
             authority.retired_at.is_none()
@@ -2414,6 +2468,9 @@ impl TerminalState {
         self.detected_agent = None;
         self.fallback_state = AgentState::Unknown;
         self.fallback_visible_blocker = false;
+        self.fallback_visible_working = false;
+        self.fallback_visible_working_observed_at = None;
+        self.fallback_working_observed_at = None;
         self.fallback_observed_at = None;
         self.hook_authority = None;
         self.persisted_agent_session = None;
@@ -2499,6 +2556,10 @@ impl TerminalState {
     ) -> Option<EffectiveStateChange> {
         let state = if self.visible_blocker_overrides_hook() {
             AgentState::Blocked
+        } else if self.visible_working_overrides_idle_hook()
+            || self.detected_working_overrides_idle_hook()
+        {
+            AgentState::Working
         } else {
             self.hook_authority
                 .as_ref()
@@ -4626,6 +4687,90 @@ mod tests {
         assert!(change.effective_state_change.is_none());
     }
 
+    #[test]
+    fn settled_visible_working_overrides_full_lifecycle_hook_idle() {
+        let now = Instant::now();
+        let mut terminal = test_terminal();
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority_at(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Idle,
+            None,
+            None,
+            None,
+            now,
+        );
+
+        terminal.set_detected_state_with_screen_signals_at(
+            Some(Agent::Codex),
+            AgentState::Working,
+            false,
+            false,
+            true,
+            false,
+            now + crate::pane::STABLE_VISIBLE_SIGNAL_REFRESH,
+        );
+
+        assert_eq!(terminal.state, AgentState::Working);
+    }
+
+    #[test]
+    fn unsettled_visible_working_does_not_override_full_lifecycle_hook_idle() {
+        let now = Instant::now();
+        let mut terminal = test_terminal();
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority_at(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Idle,
+            None,
+            None,
+            None,
+            now,
+        );
+
+        terminal.set_detected_state_with_screen_signals_at(
+            Some(Agent::Codex),
+            AgentState::Working,
+            false,
+            false,
+            true,
+            false,
+            now + Duration::from_millis(1),
+        );
+
+        assert_eq!(terminal.state, AgentState::Idle);
+    }
+
+    #[test]
+    fn settled_detected_working_overrides_full_lifecycle_hook_idle() {
+        let now = Instant::now();
+        let mut terminal = test_terminal();
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority_at(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Idle,
+            None,
+            None,
+            None,
+            now,
+        );
+
+        terminal.set_detected_state_with_screen_signals_at(
+            Some(Agent::Codex),
+            AgentState::Working,
+            false,
+            false,
+            false,
+            false,
+            now + crate::pane::STABLE_VISIBLE_SIGNAL_REFRESH,
+        );
+
+        assert_eq!(terminal.state, AgentState::Working);
+    }
+
     #[test]
     fn detected_working_fallback_is_ignored_under_full_lifecycle_hook_authority() {
         let now = Instant::now();

From 0d6d00bc115575733cc6ddd7c9d14156a7f71c0a Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Sun, 9 Aug 2026 13:29:06 +0200
Subject: [PATCH 15/19] fix(terminal): preserve session mutation contract

---
 src/terminal/state.rs | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/src/terminal/state.rs b/src/terminal/state.rs
index 8f769d4b1a..e0a26135f5 100644
--- a/src/terminal/state.rs
+++ b/src/terminal/state.rs
@@ -2035,9 +2035,7 @@ impl TerminalState {
         let previous_known_agent = self.effective_known_agent();
         let previous_state = self.state;
         let previous_presentation = self.effective_presentation_for_state_at(previous_state, now);
-        let Some(authority) = self.hook_authority.as_mut() else {
-            return None;
-        };
+        let authority = self.hook_authority.as_mut()?;
         authority.retired_at = Some(observed_at);
 
         Some(TerminalStateMutation {
@@ -2049,6 +2047,7 @@ impl TerminalState {
                 now,
             ),
             session_ref_changed: false,
+            session_replaced: false,
             hook_work_context_changed: false,
             agent_released: false,
         })

From 0fdb27a4db9e33479d36aa8a9b5b18cfe901cf5b Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Sun, 9 Aug 2026 13:37:40 +0200
Subject: [PATCH 16/19] fix(detect): scope recent-output fallback to codex

---
 src/pane/agent_detection.rs | 23 +++++++++++++++++++++--
 1 file changed, 21 insertions(+), 2 deletions(-)

diff --git a/src/pane/agent_detection.rs b/src/pane/agent_detection.rs
index 2208619d66..19391a6e88 100644
--- a/src/pane/agent_detection.rs
+++ b/src/pane/agent_detection.rs
@@ -225,12 +225,14 @@ pub(super) fn recent_agent_output(
 ) -> bool {
     if *last_output_seq != Some(output_seq) {
         *last_output_seq = Some(output_seq);
-        if agent.is_some() {
+        if agent == Some(Agent::Codex) {
             *last_output_at = Some(now);
+        } else {
+            *last_output_at = None;
         }
     }
 
-    if agent.is_none() {
+    if agent != Some(Agent::Codex) {
         *last_output_at = None;
         return false;
     }
@@ -726,6 +728,23 @@ mod tests {
         }
     }
 
+    #[test]
+    fn recent_non_codex_output_does_not_delay_done_state() {
+        let now = std::time::Instant::now();
+        let mut last_output_seq = None;
+        let mut last_output_at = None;
+
+        assert!(!recent_agent_output(
+            Some(Agent::Pi),
+            1,
+            &mut last_output_seq,
+            &mut last_output_at,
+            now,
+        ));
+        assert_eq!(last_output_seq, Some(1));
+        assert_eq!(last_output_at, None);
+    }
+
     #[test]
     fn detection_content_change_tracks_raw_nonempty_reads_for_scan_scheduling() {
         let seq = AtomicU64::new(0);

From e65d2210a66c491bd92293d1c0f2c545d5239697 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Sun, 9 Aug 2026 14:35:31 +0200
Subject: [PATCH 17/19] fix(input): retire blocked hook authority after
 forwarding

---
 src/app/api/agents.rs |  82 +++++++++++++++++++++++++++++++
 src/app/input/mod.rs  | 109 +++++++++++++++++++++++++++++++++++++++---
 2 files changed, 184 insertions(+), 7 deletions(-)

diff --git a/src/app/api/agents.rs b/src/app/api/agents.rs
index 8bc29462d8..d2717f777d 100644
--- a/src/app/api/agents.rs
+++ b/src/app/api/agents.rs
@@ -104,6 +104,7 @@ impl App {
             return encode_error(id, "agent_prompt_failed", err.to_string());
         }
         runtime.send_bytes_after(Bytes::from(enter), AGENT_PROMPT_SUBMIT_DELAY);
+        self.retire_blocked_hook_authority_for_pane(resolved.pane_id, std::time::Instant::now());
         let Some(agent) = self.agent_info(resolved.ws_idx, resolved.pane_id) else {
             return agent_not_found(id, &params.target);
         };
@@ -260,9 +261,16 @@ impl App {
             }
         };
         let bytes: Vec<u8> = encoded.into_iter().flatten().collect();
+        let has_bytes = !bytes.is_empty();
         if let Err(err) = runtime.try_send_bytes(Bytes::from(bytes)) {
             return encode_error(id, "agent_send_keys_failed", err.to_string());
         }
+        if has_bytes {
+            self.retire_blocked_hook_authority_for_pane(
+                resolved.pane_id,
+                std::time::Instant::now(),
+            );
+        }
 
         encode_success(id, ResponseResult::Ok {})
     }
@@ -433,6 +441,80 @@ mod tests {
         assert!(rx.try_recv().is_err());
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn agent_prompt_retires_blocked_hook_authority_after_forwarding() {
+        let mut app = app_with_agent();
+        let pane_id = app.state.workspaces[0].tabs[0].root_pane;
+        let terminal_id = app.state.workspaces[0].tabs[0].panes[&pane_id]
+            .attached_terminal_id
+            .clone();
+        let terminal = app.state.terminals.get_mut(&terminal_id).unwrap();
+        terminal.set_agent_name("reviewer".into());
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Blocked,
+            None,
+            Some(1),
+        );
+        let (runtime, mut rx) = crate::terminal::TerminalRuntime::test_with_channel(80, 24);
+        app.state.insert_test_runtime(pane_id, runtime);
+
+        let response = app.handle_agent_prompt(
+            "req".into(),
+            AgentPromptParams {
+                target: "reviewer".into(),
+                text: "continue".into(),
+                wait: None,
+            },
+        );
+        let success: SuccessResponse = serde_json::from_str(&response).unwrap();
+
+        assert!(matches!(
+            success.result,
+            ResponseResult::AgentPrompted { .. }
+        ));
+        assert!(rx.try_recv().is_ok());
+        assert_eq!(app.state.terminals[&terminal_id].state, AgentState::Idle);
+        assert!(!app.state.terminals[&terminal_id].full_lifecycle_hook_authority_active());
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn agent_send_keys_retires_blocked_hook_authority_after_forwarding() {
+        let mut app = app_with_agent();
+        let pane_id = app.state.workspaces[0].tabs[0].root_pane;
+        let terminal_id = app.state.workspaces[0].tabs[0].panes[&pane_id]
+            .attached_terminal_id
+            .clone();
+        let terminal = app.state.terminals.get_mut(&terminal_id).unwrap();
+        terminal.set_agent_name("reviewer".into());
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Blocked,
+            None,
+            Some(1),
+        );
+        let (runtime, mut rx) = crate::terminal::TerminalRuntime::test_with_channel(80, 24);
+        app.state.insert_test_runtime(pane_id, runtime);
+
+        let response = app.handle_agent_send_keys(
+            "req".into(),
+            AgentSendKeysParams {
+                target: "reviewer".into(),
+                keys: vec!["enter".into()],
+            },
+        );
+        let success: SuccessResponse = serde_json::from_str(&response).unwrap();
+
+        assert!(matches!(success.result, ResponseResult::Ok {}));
+        assert!(rx.try_recv().is_ok());
+        assert_eq!(app.state.terminals[&terminal_id].state, AgentState::Idle);
+        assert!(!app.state.terminals[&terminal_id].full_lifecycle_hook_authority_active());
+    }
+
     #[tokio::test]
     async fn agent_prompt_rejects_managed_agent_while_startup_is_pending() {
         let mut app = app_with_agent();
diff --git a/src/app/input/mod.rs b/src/app/input/mod.rs
index e1648be16c..5f7cf018c4 100644
--- a/src/app/input/mod.rs
+++ b/src/app/input/mod.rs
@@ -145,11 +145,21 @@ impl App {
         self.selection_autoscroll_deadline = None;
         self.state.update_dismissed = true;
         if let Some(ws_idx) = self.state.active {
-            if let Some(runtime) = self
+            let pane_id = self
+                .state
+                .workspaces
+                .get(ws_idx)
+                .and_then(|workspace| workspace.focused_pane_id());
+            let sent = self
                 .state
                 .focused_runtime_in_workspace(&self.terminal_runtimes, ws_idx)
-            {
-                let _ = runtime.try_send_bytes(Bytes::copy_from_slice(text.as_bytes()));
+                .is_some_and(|runtime| {
+                    runtime
+                        .try_send_bytes(Bytes::copy_from_slice(text.as_bytes()))
+                        .is_ok()
+                });
+            if let (true, Some(pane_id)) = (sent, pane_id) {
+                self.retire_blocked_hook_authority_for_pane(pane_id, std::time::Instant::now());
             }
         }
     }
@@ -175,11 +185,21 @@ impl App {
         self.selection_autoscroll_deadline = None;
         self.state.update_dismissed = true;
         if let Some(ws_idx) = self.state.active {
-            if let Some(runtime) = self
+            let pane_id = self
+                .state
+                .workspaces
+                .get(ws_idx)
+                .and_then(|workspace| workspace.focused_pane_id());
+            let sent = if let Some(runtime) = self
                 .state
                 .focused_runtime_in_workspace(&self.terminal_runtimes, ws_idx)
             {
-                let _ = runtime.send_bytes(Bytes::from(text)).await;
+                runtime.send_bytes(Bytes::from(text)).await.is_ok()
+            } else {
+                false
+            };
+            if let (true, Some(pane_id)) = (sent, pane_id) {
+                self.retire_blocked_hook_authority_for_pane(pane_id, std::time::Instant::now());
             }
         }
     }
@@ -199,11 +219,22 @@ impl App {
         }
 
         if let Some(ws_idx) = self.state.active {
-            if let Some(rt) = self
+            let pane_id = self
+                .state
+                .workspaces
+                .get(ws_idx)
+                .and_then(|workspace| workspace.focused_pane_id());
+            let has_text = !text.is_empty();
+            let sent = if let Some(runtime) = self
                 .state
                 .focused_runtime_in_workspace(&self.terminal_runtimes, ws_idx)
             {
-                let _ = rt.send_paste(text).await;
+                runtime.send_paste(text).await.is_ok()
+            } else {
+                false
+            };
+            if let (true, Some(pane_id)) = (sent && has_text, pane_id) {
+                self.retire_blocked_hook_authority_for_pane(pane_id, std::time::Instant::now());
             }
         }
     }
@@ -979,6 +1010,47 @@ fn wait_for_file(path: &std::path::Path) -> String {
 mod tests {
     use super::*;
 
+    fn terminal_app_with_blocked_hook() -> (
+        App,
+        crate::terminal::TerminalId,
+        tokio::sync::mpsc::Receiver<Bytes>,
+    ) {
+        let mut app = test_app();
+        let mut workspace = crate::workspace::Workspace::test_new("test");
+        let pane_id = workspace.tabs[0].root_pane;
+        let terminal_id = workspace.tabs[0].panes[&pane_id]
+            .attached_terminal_id
+            .clone();
+        let (runtime, rx) = crate::terminal::TerminalRuntime::test_with_channel(80, 24);
+        workspace.insert_test_runtime(pane_id, runtime);
+        app.state.workspaces = vec![workspace];
+        app.state.ensure_test_terminals();
+        app.state.active = Some(0);
+        app.state.selected = 0;
+        app.state.mode = Mode::Terminal;
+        let terminal = app.state.terminals.get_mut(&terminal_id).unwrap();
+        terminal.set_detected_state(
+            Some(crate::detect::Agent::Codex),
+            crate::detect::AgentState::Idle,
+        );
+        terminal.set_hook_authority(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            crate::detect::AgentState::Blocked,
+            None,
+            Some(1),
+        );
+        (app, terminal_id, rx)
+    }
+
+    fn assert_blocked_hook_retired(app: &App, terminal_id: &crate::terminal::TerminalId) {
+        assert_eq!(
+            app.state.terminals[terminal_id].state,
+            crate::detect::AgentState::Idle
+        );
+        assert!(!app.state.terminals[terminal_id].full_lifecycle_hook_authority_active());
+    }
+
     fn test_app() -> App {
         App::new(
             &crate::config::Config::default(),
@@ -1005,6 +1077,29 @@ mod tests {
         assert!(!app.state.name_input_replace_on_type);
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn paste_retires_blocked_hook_authority_after_forwarding() {
+        let (mut app, terminal_id, mut rx) = terminal_app_with_blocked_hook();
+
+        app.handle_paste("continue".into()).await;
+
+        assert!(rx.try_recv().is_ok());
+        assert_blocked_hook_retired(&app, &terminal_id);
+    }
+
+    #[tokio::test(flavor = "current_thread")]
+    async fn text_commit_paths_retire_blocked_hook_authority_after_forwarding() {
+        let (mut app, terminal_id, mut rx) = terminal_app_with_blocked_hook();
+        app.handle_text_commit("continue".into()).await;
+        assert!(rx.try_recv().is_ok());
+        assert_blocked_hook_retired(&app, &terminal_id);
+
+        let (mut app, terminal_id, mut rx) = terminal_app_with_blocked_hook();
+        app.handle_text_commit_headless("continue");
+        assert!(rx.try_recv().is_ok());
+        assert_blocked_hook_retired(&app, &terminal_id);
+    }
+
     #[tokio::test]
     async fn paste_routes_to_keybind_help_query_only_when_searching() {
         let mut app = test_app();

From fb6d7f0994e37b9ca39b9ca9bb983988f3665414 Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Sun, 9 Aug 2026 15:04:49 +0200
Subject: [PATCH 18/19] fix(input): retire blocked authority on residual
 forwards

refs #125
---
 src/app/input/navigate.rs | 46 +++++++++++++++++++++++++++++++++++++++
 src/app/mod.rs            | 44 ++++++++++++++++++++++++++++++++++++-
 2 files changed, 89 insertions(+), 1 deletion(-)

diff --git a/src/app/input/navigate.rs b/src/app/input/navigate.rs
index 2994985a1a..a490a31b29 100644
--- a/src/app/input/navigate.rs
+++ b/src/app/input/navigate.rs
@@ -988,6 +988,14 @@ impl App {
         let Some(ws_idx) = self.state.active else {
             return false;
         };
+        let Some(pane_id) = self
+            .state
+            .workspaces
+            .get(ws_idx)
+            .and_then(|workspace| workspace.focused_pane_id())
+        else {
+            return false;
+        };
         let Some(rt) = self
             .state
             .focused_runtime_in_workspace(&self.terminal_runtimes, ws_idx)
@@ -1000,6 +1008,7 @@ impl App {
             return false;
         }
 
+        self.retire_blocked_hook_authority_for_pane(pane_id, std::time::Instant::now());
         self.state.mode = Mode::Terminal;
         true
     }
@@ -2275,6 +2284,43 @@ mod tests {
         app
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn prefix_pass_through_retires_blocked_hook_authority_after_forwarding() {
+        let mut app = app_with_test_workspaces(&["test"]);
+        let pane_id = app.state.workspaces[0].tabs[0].root_pane;
+        let terminal_id = app.state.workspaces[0].tabs[0].panes[&pane_id]
+            .attached_terminal_id
+            .clone();
+        let (runtime, mut rx) = crate::terminal::TerminalRuntime::test_with_channel(80, 24);
+        app.state.insert_test_runtime(pane_id, runtime);
+        let terminal = app.state.terminals.get_mut(&terminal_id).unwrap();
+        terminal.set_detected_state(
+            Some(crate::detect::Agent::Codex),
+            crate::detect::AgentState::Idle,
+        );
+        terminal.set_hook_authority(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            crate::detect::AgentState::Blocked,
+            None,
+            Some(1),
+        );
+        app.state.mode = Mode::Prefix;
+
+        app.handle_prefix_key(TerminalKey::new(
+            app.state.prefix_code,
+            app.state.prefix_mods,
+        ));
+
+        assert!(rx.try_recv().is_ok());
+        assert_eq!(app.state.mode, Mode::Terminal);
+        assert_eq!(
+            app.state.terminals[&terminal_id].state,
+            crate::detect::AgentState::Idle
+        );
+        assert!(!app.state.terminals[&terminal_id].full_lifecycle_hook_authority_active());
+    }
+
     #[test]
     fn toggle_tab_prio_flips_flag_and_marks_session_dirty() {
         let mut app = app_with_test_workspaces(&["one"]);
diff --git a/src/app/mod.rs b/src/app/mod.rs
index 60f9118a18..71b2e6351a 100644
--- a/src/app/mod.rs
+++ b/src/app/mod.rs
@@ -1906,7 +1906,14 @@ impl App {
                                         ws_idx,
                                         focused,
                                     ) {
-                                        let _ = runtime.try_send_paste(text);
+                                        let has_text = !text.is_empty();
+                                        let sent = runtime.try_send_paste(text).is_ok();
+                                        if sent && has_text {
+                                            self.retire_blocked_hook_authority_for_pane(
+                                                focused,
+                                                std::time::Instant::now(),
+                                            );
+                                        }
                                     }
                                 }
                             }
@@ -6751,6 +6758,41 @@ last_pane = "prefix+tab"
         assert!(!app.state.name_input_replace_on_type);
     }
 
+    #[tokio::test(flavor = "current_thread")]
+    async fn route_client_paste_retires_blocked_hook_authority_after_forwarding() {
+        let mut app = test_app();
+        let mut workspace = Workspace::test_new("test");
+        let pane_id = workspace.tabs[0].root_pane;
+        let terminal_id = workspace.tabs[0].panes[&pane_id]
+            .attached_terminal_id
+            .clone();
+        let (runtime, mut rx) = TerminalRuntime::test_with_channel(80, 24);
+        workspace.insert_test_runtime(pane_id, runtime);
+        app.state.workspaces = vec![workspace];
+        app.state.ensure_test_terminals();
+        app.state.active = Some(0);
+        app.state.selected = 0;
+        app.state.mode = Mode::Terminal;
+        let terminal = app.state.terminals.get_mut(&terminal_id).unwrap();
+        terminal.set_detected_state(Some(Agent::Codex), AgentState::Idle);
+        terminal.set_hook_authority(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            AgentState::Blocked,
+            None,
+            Some(1),
+        );
+
+        app.route_client_events(
+            vec![crate::raw_input::RawInputEvent::Paste("continue".into())],
+            true,
+        );
+
+        assert!(rx.try_recv().is_ok());
+        assert_eq!(app.state.terminals[&terminal_id].state, AgentState::Idle);
+        assert!(!app.state.terminals[&terminal_id].full_lifecycle_hook_authority_active());
+    }
+
     #[test]
     fn route_client_input_rename_enter_submits_through_api_path() {
         let mut app = test_app();

From 68c5cffcf38989626e04a0e751b9e42c9146acde Mon Sep 17 00:00:00 2001
From: matthias schedel <matthias@scalable.so>
Date: Sun, 9 Aug 2026 15:20:37 +0200
Subject: [PATCH 19/19] fix(input): retire blocked authority on terminal attach

refs #125
---
 src/server/headless.rs | 117 +++++++++++++++++++++++++++++++++++------
 1 file changed, 101 insertions(+), 16 deletions(-)

diff --git a/src/server/headless.rs b/src/server/headless.rs
index 37963a7303..b9f241d31f 100644
--- a/src/server/headless.rs
+++ b/src/server/headless.rs
@@ -1686,6 +1686,32 @@ impl HeadlessServer {
         self.app.terminal_runtimes.get(&terminal_id)
     }
 
+    fn forward_terminal_attach_bytes(
+        &mut self,
+        terminal_id: &str,
+        data: Vec<u8>,
+        reset_scroll: bool,
+    ) -> Option<Result<(), String>> {
+        let terminal_id = self.terminal_id_by_string(terminal_id)?;
+        let has_bytes = !data.is_empty();
+        let result = {
+            let runtime = self.app.terminal_runtimes.get(&terminal_id)?;
+            if reset_scroll {
+                runtime.scroll_reset();
+            }
+            runtime
+                .try_send_bytes(Bytes::from(data))
+                .map_err(|err| err.to_string())
+        };
+        if result.is_ok() && has_bytes {
+            self.app.retire_blocked_hook_authority_for_terminal(
+                &terminal_id,
+                std::time::Instant::now(),
+            );
+        }
+        Some(result)
+    }
+
     fn resolve_terminal_target_id_string(&self, target: &str) -> Option<String> {
         if self.terminal_id_by_string(target).is_some() {
             return Some(target.to_owned());
@@ -1711,14 +1737,19 @@ impl HeadlessServer {
     }
 
     fn paste_client_clipboard_image_path(&mut self, client_id: u64, path: String) -> bool {
-        if let Some(ClientConnection {
-            mode: ClientConnectionMode::TerminalAttach { terminal_id },
-            ..
-        }) = self.clients.get(&client_id)
-        {
-            if let Some(runtime) = self.runtime_for_terminal_id_string(terminal_id) {
+        let attached_terminal_id = self.clients.get(&client_id).and_then(|client| {
+            if let ClientConnectionMode::TerminalAttach { terminal_id } = &client.mode {
+                Some(terminal_id.clone())
+            } else {
+                None
+            }
+        });
+        if let Some(terminal_id) = attached_terminal_id {
+            if let Some(runtime) = self.runtime_for_terminal_id_string(&terminal_id) {
                 let payload = paste_payload_for_runtime(runtime, &path);
-                if let Err(err) = runtime.try_send_bytes(Bytes::from(payload)) {
+                if let Some(Err(err)) =
+                    self.forward_terminal_attach_bytes(&terminal_id, payload.into_bytes(), false)
+                {
                     warn!(client_id, terminal_id = %terminal_id, err = %err, "terminal attach clipboard image paste failed");
                 }
             }
@@ -2900,15 +2931,18 @@ impl HeadlessServer {
                     return false;
                 }
                 debug!(client_id, len = data.len(), "client input received");
-                if let Some(ClientConnection {
-                    mode: ClientConnectionMode::TerminalAttach { terminal_id },
-                    ..
-                }) = self.clients.get(&client_id)
-                {
-                    if let Some(runtime) = self.runtime_for_terminal_id_string(terminal_id) {
-                        if let Err(err) = apply_terminal_attach_input(runtime, data) {
-                            warn!(client_id, terminal_id = %terminal_id, err = %err);
-                        }
+                let attached_terminal_id = self.clients.get(&client_id).and_then(|client| {
+                    if let ClientConnectionMode::TerminalAttach { terminal_id } = &client.mode {
+                        Some(terminal_id.clone())
+                    } else {
+                        None
+                    }
+                });
+                if let Some(terminal_id) = attached_terminal_id {
+                    if let Some(Err(err)) =
+                        self.forward_terminal_attach_bytes(&terminal_id, data, true)
+                    {
+                        warn!(client_id, terminal_id = %terminal_id, err = %err);
                     }
                     return true;
                 }
@@ -6818,6 +6852,57 @@ next_tab = ""
         rt.shutdown_timeout(Duration::from_millis(100));
     }
 
+    #[tokio::test]
+    async fn terminal_attach_client_input_retires_blocked_hook_authority_after_forwarding() {
+        let mut server = test_headless_server();
+        let workspace = crate::workspace::Workspace::test_new("attached");
+        let pane_id = workspace.tabs[0].root_pane;
+        let terminal_id = workspace.tabs[0].panes[&pane_id]
+            .attached_terminal_id
+            .clone();
+        let terminal_id_string = terminal_id.to_string();
+        let (runtime, mut input_rx) = crate::terminal::TerminalRuntime::test_with_channel(80, 24);
+        server.app.state.workspaces = vec![workspace];
+        server.app.state.ensure_test_terminals();
+        server
+            .app
+            .terminal_runtimes
+            .insert(terminal_id.clone(), runtime);
+        let terminal = server.app.state.terminals.get_mut(&terminal_id).unwrap();
+        terminal.set_detected_state(
+            Some(crate::detect::Agent::Codex),
+            crate::detect::AgentState::Idle,
+        );
+        terminal.set_hook_authority(
+            "herdr:codex-closing-block".into(),
+            "codex".into(),
+            crate::detect::AgentState::Blocked,
+            None,
+            Some(1),
+        );
+
+        let mut client = test_app_client(Some(true), 1);
+        client.mode = ClientConnectionMode::TerminalAttach {
+            terminal_id: terminal_id_string,
+        };
+        server.clients.insert(1, client);
+
+        assert!(server.handle_server_event(ServerEvent::ClientInput {
+            client_id: 1,
+            data: b"continue".to_vec(),
+        }));
+
+        assert_eq!(
+            input_rx.try_recv().expect("forwarded attach input"),
+            Bytes::from_static(b"continue")
+        );
+        assert_eq!(
+            server.app.state.terminals[&terminal_id].state,
+            crate::detect::AgentState::Idle
+        );
+        assert!(!server.app.state.terminals[&terminal_id].full_lifecycle_hook_authority_active());
+    }
+
     fn with_terminal_attach_page_key_runtime(
         initial_bytes: &[u8],
         initial_scroll: usize,