[christso]

Change

Keep unconfirmed-send recovery in a compact raised card immediately above the composer so Dismiss stays reachable while reading or scrolling chat. The saved text is folded, avoiding a second visible message bubble. An exact scoped sent/discarded receipt removes the saved copy automatically; equal native text alone cannot confirm delivery or release a queue fence.

This replaces the fork’s inline recovery presentation. Copy, terminal review and keyboard dismissal preserve the draft. Design references: Claude Code’s controls for taking back queued input and Paseo’s canonical user echoes.

Related: devswha#2792

Validation

• bun run check fast: passed, 10,625 unit tests, 41 repository skips; typecheck/build and generated-file checks passed.
• Focused pending-message, machine-session and sent-waiting tests: 111 passed.
• bun run check run bun scripts/sent-waiting-browser-qa.ts: 18 cases passed across desktop/phone and PC namespaces; covers wrong/exact receipts, competing attempts, reload, focus and transcript virtualization.
• chat-virtual-browser-qa.ts and terminal-autoswitch-demo-regression.ts: passed. The production recovery case includes 390 × 470 disclosure geometry, denied clipboard fallbacks and Enter dismissal back to the owning composer, with draft preservation and no new input.
• Isolated native Codex proof: idle confirmed send and two Send now attempts each yielded one submit and one native turn, with no faded duplicate. Copy, terminal review, reload, dismissal and the next explicit message passed. The harness explicitly maps codex_interrupt_unconfirmed to generic submit_changed; it does not establish the original remote host’s exact failure. An additional attempted automatic-queue control remained unconfirmed and is not counted as green.
• Full independent review: seven lenses, no actionable findings; narrow review passed the added production browser assertions. No external model review ran.
• All 12 hosted checks passed, including Fast checks, Integration and browser, Native Windows install, macOS session identity and the Rust PTY host.
• The tested revision is deployed; the HTTPS-served client matches its installed build. Installed-source native proof and configuration/device/bundle preservation are recorded in the evidence branch.

Screenshots

Native MP4, screenshots, results and reproduction harness.

Desktop	Phone

Earlier inline screenshots and recordings are preserved in the evidence branch. These after images use isolated native test sessions; no live user chat was recorded.

---

[christso]

Independent code review completed for this change before publication: correctness, project standards, tests, maintainability, reliability, frontend races and adversarial review. No actionable findings remain. The suggested short-phone geometry and final-row keyboard-dismiss checks were added to the existing full production PaneTerminal browser suite; a narrow closure review found no findings, and that suite passed on desktop/phone in light/dark themes.

The full fast gate on committed revision 7d0f4291 passed: 10,625 tests, zero failures, 41 repository skips, with typecheck and build. The 18-case receipt/focus/virtualization browser matrix and isolated native proof also passed. Focus transfer to another saved row is not browser-covered.

No external model review ran. The unavailable route failed before code egress and was cleaned up; review used the available in-process reviewers. This comment records the completed review independently of any skipped CodeRabbit check. Hosted CI remains the merge gate.

[christso]

Deployed and verified revision 7d0f42915d1c39874706d33c048ccae7f73385b0 at https://herdrweb.z.tsoyang.com/ while hosted CI runs. The HTTPS client asset matches the installed build; private configuration, paired-device identities, remote bundle pin and the Herdr socket are preserved.

Installed-source native green MP4, screenshots, results and reproduction harness. Both actual queued Send now attempts produced one native user turn and one submit, zero faded duplicates, and one compact non-resendable recovery notice. Clipboard refusal, terminal peek/back, preserved draft/focus, keyboard dismissal, next-message unblock, reload and short-phone visibility passed with no page errors. The harness explicitly projects the interruption error to generic submit_changed; it does not establish the original remote host’s exact acknowledgement failure.

The first installed attempt was an ordinary confirmed send before the browser observed working status, so it was not counted as Send now proof. The final harness requires browser working status and an actual queued response. No app code changed during this deployment proof. Fork merge remains gated on the hosted checks.