From b51a83205093bb17645fec90dabdeb41f5e40f9a Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Sun, 1 Nov 2026 11:24:14 +1100
Subject: [PATCH 1/9] feat(staged): send chat messages to a running session
 now, beside queueing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The session and note chat composers could only queue a follow-up while a
session ran. Project notes recently gained live delivery through the
`continue_repo_session` MCP tool; this gives the composer the same path.

Capability flag. A new `get_session_live_delivery` command (Tauri + web)
reports `{ supported, reason }` for a session, computed by the backend from
the same gate `route_continue_session` applies before delivering to a
running row: the row is `running`, this process owns it (not another Staged
instance sharing the database), and its ACP connection has handed out a
live turn-control handle. Read without the startup wait, so a row still
connecting is "queue only" with a reason. The chat pane asks on each
500 ms poll tick until the answer is yes and drops the flag whenever the
status leaves `running`; nothing is duplicated client-side.

Send-now command. `send_session_message_now` wraps the shared
`continue_session_for_store` body — steer into the turn in flight, else
interrupt and re-prompt, resume a stopped session, refuse a queued one —
and returns the same `delivery` / `reason` spelling as the MCP tool. The
web arm runs detached like `resume_session`, since a resume may be in
flight when the client disconnects.

UI. `composerSendControl` derives the submit control: a plain "Send"
(start/resume) when the session is idle, a plain "Queue" when it runs but
cannot take a message now, and a split button once the backend says it
can — the primary segment performs the remembered mode (Queue / Send) and
a dropdown (existing dropdown-menu component, accent button styling)
switches it. Live "Send" success lets the poll pick up the persisted user
row; `blocked` / `rejected_queued` / `not_resumable` surface the reason and
restore the draft rather than silently re-queueing, because a steer the
agent never acknowledged may already have landed.

Not-running sessions. While a session is queued, completed, failed, or
cancelled the composer renders exactly what it did before (single
button); "Send" on a stopped session resumes it, which is what
`continue_repo_session` does for those states. "Send" is never offered
for a queued session, matching the tool's refusal.

Persistence. The mode is a global preference, `composer-send-mode` in the
existing Tauri-store-backed preferences, defaulting to `queue`; malformed
values fall back to the default.

Tests: live-delivery flag for connected / connecting / other-instance /
not-running rows and the delivery reply shape (Rust); mode persistence,
default, and malformed-value fallback across native and web store clients;
the single-vs-split render decision in `composerSendControl`.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 apps/staged/src-tauri/src/lib.rs              |   2 +
 apps/staged/src-tauri/src/session_commands.rs | 240 ++++++++++++++++++
 apps/staged/src-tauri/src/web_server.rs       |  36 +++
 apps/staged/src/lib/commands.ts               |  27 ++
 .../lib/features/sessions/ChatComposer.svelte | 114 +++++++--
 .../features/sessions/SessionChatPane.svelte  | 115 ++++++++-
 .../sessions/composerSendControl.test.ts      |  57 +++++
 .../features/sessions/composerSendControl.ts  |  94 +++++++
 .../features/settings/preferences.svelte.ts   |  35 +++
 .../lib/features/settings/preferences.test.ts |  27 ++
 apps/staged/src/lib/types.ts                  |  27 ++
 11 files changed, 754 insertions(+), 20 deletions(-)
 create mode 100644 apps/staged/src/lib/features/sessions/composerSendControl.test.ts
 create mode 100644 apps/staged/src/lib/features/sessions/composerSendControl.ts

diff --git a/apps/staged/src-tauri/src/lib.rs b/apps/staged/src-tauri/src/lib.rs
index 5a14b7788..dc0598179 100644
--- a/apps/staged/src-tauri/src/lib.rs
+++ b/apps/staged/src-tauri/src/lib.rs
@@ -2341,6 +2341,8 @@ pub fn run() {
             session_commands::list_queued_session_messages,
             session_commands::delete_queued_session_message,
             session_commands::send_queued_session_message,
+            session_commands::send_session_message_now,
+            session_commands::get_session_live_delivery,
             session_commands::build_note_followup_message,
             session_commands::cancel_session,
             session_commands::stop_session_async_task,
diff --git a/apps/staged/src-tauri/src/session_commands.rs b/apps/staged/src-tauri/src/session_commands.rs
index 215e7c6c2..349007473 100644
--- a/apps/staged/src-tauri/src/session_commands.rs
+++ b/apps/staged/src-tauri/src/session_commands.rs
@@ -2333,6 +2333,123 @@ pub fn delete_queued_session_message(
         .map_err(|e| e.to_string())
 }
 
+/// Whether a message typed for `session_id` can reach its agent *now* (the
+/// chat composer's "Send" mode) — exactly the gate `route_continue_session`
+/// applies to a `running` row before delivering, read without waiting:
+/// the row is `running`, this process owns it, and its ACP connection has
+/// handed out a live turn-control handle. Anything else is "queue only",
+/// with `reason` saying why, so the composer can hide the mode switch
+/// rather than offer a send that would come back blocked.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionLiveDelivery {
+    pub supported: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+}
+
+impl SessionLiveDelivery {
+    fn unsupported(reason: impl Into<String>) -> Self {
+        Self {
+            supported: false,
+            reason: Some(reason.into()),
+        }
+    }
+}
+
+pub(crate) fn live_delivery_for_session(
+    store: &Store,
+    registry: &session_runner::SessionRegistry,
+    session_id: &str,
+) -> Result<SessionLiveDelivery, String> {
+    let session = store
+        .get_session(session_id)
+        .map_err(|e| e.to_string())?
+        .ok_or_else(|| format!("Session not found: {session_id}"))?;
+    if session.status != store::SessionStatus::Running {
+        return Ok(SessionLiveDelivery::unsupported(format!(
+            "the session is {}",
+            session.status.as_str()
+        )));
+    }
+    if let Some(owner_pid) = session.owner_pid.filter(|pid| *pid != std::process::id()) {
+        return Ok(SessionLiveDelivery::unsupported(format!(
+            "the session is owned by another Staged instance (pid {owner_pid})"
+        )));
+    }
+    match registry.turn_control_handle(session_id) {
+        Some(handle) if handle.is_connection_alive() => Ok(SessionLiveDelivery {
+            supported: true,
+            reason: None,
+        }),
+        _ => Ok(SessionLiveDelivery::unsupported(
+            "the session's agent has not connected yet",
+        )),
+    }
+}
+
+#[tauri::command]
+pub fn get_session_live_delivery(
+    store: tauri::State<'_, Mutex<Option<Arc<Store>>>>,
+    registry: tauri::State<'_, Arc<session_runner::SessionRegistry>>,
+    session_id: String,
+) -> Result<SessionLiveDelivery, String> {
+    let store = get_store(&store)?;
+    live_delivery_for_session(&store, &registry, &session_id)
+}
+
+/// The `send_session_message_now` reply: how the message reached (or failed
+/// to reach) the agent, in the wire spelling the project MCP server's
+/// `continue_repo_session` tool uses, with the reason when it did not.
+#[derive(Debug, Clone, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct SessionMessageDelivery {
+    pub delivery: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reason: Option<String>,
+}
+
+impl From<&ContinueOutcome> for SessionMessageDelivery {
+    fn from(outcome: &ContinueOutcome) -> Self {
+        Self {
+            delivery: outcome.delivery().to_string(),
+            reason: outcome.reason().map(str::to_string),
+        }
+    }
+}
+
+/// Deliver a chat message to a session now instead of queueing it: the
+/// composer's "Send" mode. Shares `continue_session_for_store` with the
+/// project MCP server's `continue_repo_session` tool, so a running session
+/// is steered (or interrupted and re-prompted), a stopped one is resumed,
+/// and a queued one is refused — the reply says which.
+#[tauri::command]
+#[allow(clippy::too_many_arguments)]
+pub async fn send_session_message_now(
+    store: tauri::State<'_, Mutex<Option<Arc<Store>>>>,
+    registry: tauri::State<'_, Arc<session_runner::SessionRegistry>>,
+    action_executor: tauri::State<'_, Arc<ActionExecutor>>,
+    action_registry: tauri::State<'_, Arc<ActionRegistry>>,
+    app_handle: tauri::AppHandle,
+    session_id: String,
+    content: String,
+    image_ids: Option<Vec<String>>,
+) -> Result<SessionMessageDelivery, String> {
+    let store = get_store(&store)?;
+    let outcome = continue_session_for_store(
+        store,
+        Arc::clone(&registry),
+        Arc::clone(&action_executor),
+        Arc::clone(&action_registry),
+        app_handle,
+        session_id,
+        content,
+        image_ids.unwrap_or_default(),
+    )
+    .await?;
+    Ok(SessionMessageDelivery::from(&outcome))
+}
+
 #[tauri::command]
 pub async fn send_queued_session_message(
     store: tauri::State<'_, Mutex<Option<Arc<Store>>>>,
@@ -8244,6 +8361,129 @@ mod tests {
         );
     }
 
+    /// The composer's live-delivery flag is the running-row gate of
+    /// `route_continue_session` read without the wait: a `running` row this
+    /// process owns, with a live turn-control handle, can take a message now.
+    #[tokio::test(flavor = "current_thread")]
+    async fn live_delivery_is_supported_for_a_running_session_with_a_live_connection() {
+        let store = Arc::new(Store::in_memory().unwrap());
+        let session = create_session_with_status(&store, "prompt", store::SessionStatus::Running);
+        let registry = test_registry();
+        let _registration = registry.register_external(&session.id);
+        let (handle, _) =
+            acp_client::TurnControlHandle::scripted(Ok(acp_client::SteerOutcome::Injected), Ok(()));
+        registry.set_turn_control_handle(&session.id, handle);
+
+        let capability = live_delivery_for_session(&store, &registry, &session.id).unwrap();
+
+        assert_eq!(
+            capability,
+            SessionLiveDelivery {
+                supported: true,
+                reason: None
+            }
+        );
+    }
+
+    /// A `running` row still in its startup window (no connection yet) and
+    /// one whose connection has gone are both "queue only" — the flag never
+    /// waits for a handle the way the delivery itself does.
+    #[test]
+    fn live_delivery_is_unsupported_until_the_agent_connects() {
+        let store = Arc::new(Store::in_memory().unwrap());
+        let session = create_session_with_status(&store, "prompt", store::SessionStatus::Running);
+        let registry = test_registry();
+        let _registration = registry.register_external(&session.id);
+
+        let starting = live_delivery_for_session(&store, &registry, &session.id).unwrap();
+        assert!(!starting.supported);
+        assert!(
+            starting
+                .reason
+                .as_deref()
+                .unwrap()
+                .contains("not connected"),
+            "{starting:?}"
+        );
+
+        registry.set_turn_control_handle(&session.id, acp_client::TurnControlHandle::detached());
+        let dead = live_delivery_for_session(&store, &registry, &session.id).unwrap();
+        assert!(!dead.supported);
+    }
+
+    /// Stopped and queued rows are not live: the composer keeps its plain
+    /// button for them (a stopped session's "Send" resumes it, as
+    /// `continue_session_for_store` would; a queued one cannot take a
+    /// message out of FIFO order).
+    #[test]
+    fn live_delivery_is_unsupported_for_rows_that_are_not_running() {
+        let store = Arc::new(Store::in_memory().unwrap());
+        let registry = test_registry();
+
+        let queued = create_session_with_status(&store, "prompt", store::SessionStatus::Queued);
+        let capability = live_delivery_for_session(&store, &registry, &queued.id).unwrap();
+        assert!(!capability.supported);
+        assert_eq!(capability.reason.as_deref(), Some("the session is queued"));
+
+        let completed = create_session_with_status(&store, "prompt", store::SessionStatus::Running);
+        store
+            .update_session_status(
+                &completed.id,
+                store::SessionStatus::Completed,
+                None,
+                Some(&store::CompletionReason::TurnComplete),
+            )
+            .unwrap();
+        let capability = live_delivery_for_session(&store, &registry, &completed.id).unwrap();
+        assert!(!capability.supported);
+        assert_eq!(
+            capability.reason.as_deref(),
+            Some("the session is completed")
+        );
+
+        assert!(live_delivery_for_session(&store, &registry, "missing").is_err());
+    }
+
+    /// A `running` row another Staged instance owns has its connection in
+    /// that process; a handle here would never appear, so it is queue only.
+    #[tokio::test(flavor = "current_thread")]
+    async fn live_delivery_is_unsupported_for_a_session_owned_by_another_instance() {
+        let store = Arc::new(Store::in_memory().unwrap());
+        let mut session = store::Session::new_running("prompt", Path::new("/tmp"));
+        let other_pid = std::process::id() + 1;
+        session.owner_pid = Some(other_pid);
+        store.create_session(&session).unwrap();
+        let registry = test_registry();
+        let _registration = registry.register_external(&session.id);
+        let (handle, _) =
+            acp_client::TurnControlHandle::scripted(Ok(acp_client::SteerOutcome::Injected), Ok(()));
+        registry.set_turn_control_handle(&session.id, handle);
+
+        let capability = live_delivery_for_session(&store, &registry, &session.id).unwrap();
+
+        assert!(!capability.supported);
+        let reason = capability.reason.unwrap();
+        assert!(reason.contains("another Staged instance"), "{reason}");
+        assert!(reason.contains(&other_pid.to_string()), "{reason}");
+    }
+
+    /// The wire reply of `send_session_message_now` spells the outcome the
+    /// way `continue_repo_session` does, reason included.
+    #[test]
+    fn session_message_delivery_mirrors_the_continue_outcome() {
+        let injected = SessionMessageDelivery::from(&ContinueOutcome::Injected);
+        assert_eq!(injected.delivery, "injected");
+        assert_eq!(injected.reason, None);
+
+        let blocked = SessionMessageDelivery::from(&ContinueOutcome::blocked("still starting"));
+        assert_eq!(blocked.delivery, "blocked");
+        assert_eq!(blocked.reason.as_deref(), Some("still starting"));
+
+        let rejected = SessionMessageDelivery::from(&ContinueOutcome::RejectedQueued);
+        assert_eq!(rejected.delivery, "rejected_queued");
+        assert_eq!(rejected.reason, None);
+    }
+
     /// A running session with a connection is steered first; the agent took
     /// the message into its turn, so nothing else is sent.
     #[tokio::test(flavor = "current_thread")]
diff --git a/apps/staged/src-tauri/src/web_server.rs b/apps/staged/src-tauri/src/web_server.rs
index cc0e419a5..0f3cc07c5 100644
--- a/apps/staged/src-tauri/src/web_server.rs
+++ b/apps/staged/src-tauri/src/web_server.rs
@@ -3679,6 +3679,42 @@ async fn dispatch(command: &str, args: Value, state: &WebAppState) -> Result<Val
             .await?;
             Ok(Value::Null)
         }
+        "send_session_message_now" => {
+            let store = get_store(store_mutex)?;
+            let session_id: String = arg(&args, "sessionId")?;
+            let content: String = arg(&args, "content")?;
+            let image_ids: Option<Vec<String>> = opt_arg(&args, "imageIds")?;
+            let app_handle = app_handle.clone();
+            let session_registry = Arc::clone(session_registry);
+            let action_executor = Arc::clone(action_executor);
+            let action_registry = Arc::clone(action_registry);
+            // Detached like `resume_session`: a stopped session is resumed
+            // through the same launch, and a client that disconnects while
+            // that resume is mid-flight must not abandon it half-started.
+            let delivery = detached(async move {
+                let outcome = session_commands::continue_session_for_store(
+                    store,
+                    session_registry,
+                    action_executor,
+                    action_registry,
+                    app_handle,
+                    session_id,
+                    content,
+                    image_ids.unwrap_or_default(),
+                )
+                .await?;
+                Ok(session_commands::SessionMessageDelivery::from(&outcome))
+            })
+            .await?;
+            Ok(serde_json::to_value(delivery).unwrap())
+        }
+        "get_session_live_delivery" => {
+            let store = get_store(store_mutex)?;
+            let session_id: String = arg(&args, "sessionId")?;
+            let capability =
+                session_commands::live_delivery_for_session(&store, session_registry, &session_id)?;
+            Ok(serde_json::to_value(capability).unwrap())
+        }
         "build_note_followup_message" => {
             let store = get_store(store_mutex)?;
             let session_id: String = arg(&args, "sessionId")?;
diff --git a/apps/staged/src/lib/commands.ts b/apps/staged/src/lib/commands.ts
index ca699d9b9..eded306b2 100644
--- a/apps/staged/src/lib/commands.ts
+++ b/apps/staged/src/lib/commands.ts
@@ -35,6 +35,8 @@ import type {
   SessionPollRequest,
   ToolCallBody,
   SessionBackgroundHoldSnapshot,
+  SessionLiveDelivery,
+  SessionMessageDelivery,
   QueuedSessionMessage,
   DiffFilesResponse,
   FileDiff,
@@ -1153,6 +1155,31 @@ export function getSessionBackgroundHold(
   return invokeCommand('get_session_background_hold', { sessionId });
 }
 
+/**
+ * Whether the session can take a message right now (composer "Send" mode).
+ * Cheap: a registry lookup, no agent round trip.
+ */
+export function getSessionLiveDelivery(sessionId: string): Promise<SessionLiveDelivery> {
+  return invokeCommand('get_session_live_delivery', { sessionId });
+}
+
+/**
+ * Deliver a message to the session now instead of queueing it: steered into
+ * the running turn (or interrupting it) over the live connection, or resuming
+ * a stopped session — the same path as the `continue_repo_session` MCP tool.
+ */
+export function sendSessionMessageNow(
+  sessionId: string,
+  content: string,
+  imageIds?: string[]
+): Promise<SessionMessageDelivery> {
+  return invokeCommand('send_session_message_now', {
+    sessionId,
+    content,
+    imageIds: imageIds ?? null,
+  });
+}
+
 export function deleteSession(sessionId: string): Promise<void> {
   return invokeCommand('delete_session', { sessionId });
 }
diff --git a/apps/staged/src/lib/features/sessions/ChatComposer.svelte b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
index 92a476020..d8afd452d 100644
--- a/apps/staged/src/lib/features/sessions/ChatComposer.svelte
+++ b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
@@ -6,6 +6,12 @@
   SessionChatPane, which backs both the session dialog and the note dialog's
   chat pane, so the composer looks and behaves identically everywhere: the
   text input gets its own full-width row with the controls beneath it.
+
+  The submit control follows `composerSendControl`: a plain "Send" on an idle
+  session, a plain "Queue" on a running one — and, when the backend reports
+  the running session can take a message now (`canSendLive`), a split button
+  whose primary segment performs the remembered mode (Queue / Send) and whose
+  dropdown switches it.
 -->
 <script lang="ts" module>
   // min-h instead of h so the vertical model/effort label can grow the button.
@@ -25,8 +31,16 @@
   import type { Snippet } from 'svelte';
   import X from '@lucide/svelte/icons/x';
   import Paperclip from '@lucide/svelte/icons/paperclip';
+  import ChevronDown from '@lucide/svelte/icons/chevron-down';
   import Spinner from '../../shared/Spinner.svelte';
-  import { Button } from '$lib/components/ui/button';
+  import { Button, buttonVariants } from '$lib/components/ui/button';
+  import * as DropdownMenu from '$lib/components/ui/dropdown-menu';
+  import { cn } from '$lib/components/utils';
+  import {
+    COMPOSER_SEND_MODE_OPTIONS,
+    composerSendControl,
+    type ComposerSendMode,
+  } from './composerSendControl';
   import { ATTACHMENT_ACCEPT } from './attachErrors';
   import AttachmentThumb from './AttachmentThumb.svelte';
   import type { AttachmentPreview } from './attachmentPreview';
@@ -54,6 +68,15 @@
     attachError?: string | null;
     /** Session is running — attach/remove disabled, send queues instead. */
     isLive?: boolean;
+    /**
+     * The running session can take a message now (backend-reported), so the
+     * submit control offers "Send" beside "Queue". Ignored unless `isLive`.
+     */
+    canSendLive?: boolean;
+    /** The remembered submit mode for live-capable sessions. */
+    sendMode?: ComposerSendMode;
+    /** The user picked a mode from the split button's menu. */
+    onSendModeChange?: (mode: ComposerSendMode) => void;
     sending?: boolean;
     onSend?: () => void;
     /** Agent config picker rendered at the start of the control row. */
@@ -74,6 +97,9 @@
     onRemoveImage,
     attachError = null,
     isLive = false,
+    canSendLive = false,
+    sendMode = 'queue',
+    onSendModeChange,
     sending = false,
     onSend,
     configPicker,
@@ -81,6 +107,13 @@
 
   let fileInputEl = $state<HTMLInputElement>();
 
+  let sendControl = $derived(composerSendControl({ isLive, canSendLive, mode: sendMode }));
+  let sendDisabled = $derived(sending || !value.trim());
+
+  function handleSendModeChange(value: string) {
+    if (value === 'queue' || value === 'send') onSendModeChange?.(value);
+  }
+
   function openImagePicker() {
     fileInputEl?.click();
   }
@@ -152,26 +185,66 @@
         </Button>
       </span>
     {/if}
-    <span class="inline-flex composer-send" title={isLive ? 'Queue message' : 'Send message'}>
-      <Button
-        variant="accent"
-        class="h-auto min-h-9 gap-1.5 px-4 py-1 text-sm max-[640px]:min-h-11"
-        onclick={onSend}
-        disabled={sending || !value.trim()}
-      >
-        {#if sending}
-          <Spinner size={14} />
-          Sending…
-        {:else if isLive}
-          Queue
-        {:else}
-          Send
-        {/if}
-      </Button>
-    </span>
+    {#if sendControl.split}
+      <span class="inline-flex composer-send composer-send-split" title={sendControl.title}>
+        <Button
+          variant="accent"
+          class="composer-send-primary h-auto min-h-9 gap-1.5 rounded-r-none px-4 py-1 text-sm max-[640px]:min-h-11"
+          onclick={onSend}
+          disabled={sendDisabled}
+        >
+          {@render sendLabel()}
+        </Button>
+        <DropdownMenu.Root>
+          <DropdownMenu.Trigger
+            class={cn(
+              buttonVariants({ variant: 'accent' }),
+              'composer-send-menu-trigger h-auto min-h-9 w-8 rounded-l-none px-0 max-[640px]:min-h-11'
+            )}
+            title="Change how messages are delivered"
+            aria-label="Change how messages are delivered"
+            disabled={sending}
+          >
+            <ChevronDown size={14} />
+          </DropdownMenu.Trigger>
+          <DropdownMenu.Content align="end" side="top" sideOffset={4} class="min-w-[220px]">
+            <DropdownMenu.RadioGroup value={sendMode} onValueChange={handleSendModeChange}>
+              {#each COMPOSER_SEND_MODE_OPTIONS as option (option.mode)}
+                <DropdownMenu.RadioItem value={option.mode}>
+                  <span class="flex min-w-0 flex-col">
+                    <span>{option.label}</span>
+                    <span class="truncate text-xs text-muted-foreground">{option.description}</span>
+                  </span>
+                </DropdownMenu.RadioItem>
+              {/each}
+            </DropdownMenu.RadioGroup>
+          </DropdownMenu.Content>
+        </DropdownMenu.Root>
+      </span>
+    {:else}
+      <span class="inline-flex composer-send" title={sendControl.title}>
+        <Button
+          variant="accent"
+          class="h-auto min-h-9 gap-1.5 px-4 py-1 text-sm max-[640px]:min-h-11"
+          onclick={onSend}
+          disabled={sendDisabled}
+        >
+          {@render sendLabel()}
+        </Button>
+      </span>
+    {/if}
   </div>
 </div>
 
+{#snippet sendLabel()}
+  {#if sending}
+    <Spinner size={14} />
+    Sending…
+  {:else}
+    {sendControl.label}
+  {/if}
+{/snippet}
+
 <style>
   .chat-composer {
     display: flex;
@@ -259,4 +332,9 @@
   .composer-controls .composer-send {
     margin-left: auto;
   }
+
+  /* A hairline between the split button's two accent segments. */
+  .composer-send-split :global(.composer-send-menu-trigger) {
+    border-left-color: color-mix(in srgb, var(--bg-primary) 35%, transparent);
+  }
 </style>
diff --git a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
index acae36cc2..3050d0ba0 100644
--- a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
+++ b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
@@ -13,6 +13,10 @@
     a labeled Stop button; once messages exist, Stop lives on the Thinking row
     and the composer queues follow-ups as usual
   - Message queue: sending while running persists a follow-up for backend drain
+  - Live send: when the backend reports the running session can take a message
+    now (`get_session_live_delivery`), the composer offers "Send" beside
+    "Queue"; "Send" goes through `send_session_message_now`, the path the
+    `continue_repo_session` MCP tool uses (steer, else interrupt-and-reprompt)
   - Copy button on every message
   - Tool calls show name + args preview; expand to see output
   - Fixed-size modal with proper scrolling
@@ -49,6 +53,7 @@
     Session,
     SessionBackgroundHoldPayload,
     SessionMessage,
+    SessionStatus,
     QueuedSessionMessage,
     HashtagItem,
     ProjectRepo,
@@ -65,6 +70,7 @@
     getSession,
     getSessionAcpMetadataMessages,
     getSessionBackgroundHold,
+    getSessionLiveDelivery,
     getLatestSessionMessages,
     getOlderSessionMessages,
     handleExternalLinkClick,
@@ -74,6 +80,7 @@
     queueSessionMessage,
     resumeSession,
     sendQueuedSessionMessage,
+    sendSessionMessageNow,
     stopSessionAsyncTask,
     type AcpConfigDiscovery,
     type AcpConfigSelector,
@@ -90,8 +97,13 @@
     defaultSelectorValue,
     selectorHasValue,
   } from '../agents/acpConfigSelection';
-  import { setAcpConfigPref } from '../settings/preferences.svelte';
+  import {
+    preferences,
+    setAcpConfigPref,
+    setComposerSendMode,
+  } from '../settings/preferences.svelte';
   import ChatComposer, { composerControlClass } from './ChatComposer.svelte';
+  import { composerSendControl } from './composerSendControl';
   import {
     backgroundHoldTaskRows,
     isTaskHeld,
@@ -270,6 +282,14 @@
   let closed = false;
   /** Latest background hold reported for this session; null when not holding. */
   let backgroundHold = $state<SessionBackgroundHold | null>(null);
+  /**
+   * The backend confirmed this running session can take a message now: it is
+   * owned by this process and its agent connection is up. Asked on each poll
+   * tick until it says yes (the connection comes up a few seconds into a run),
+   * and dropped whenever the status leaves `running`.
+   */
+  let liveDelivery = $state(false);
+  let liveDeliveryInFlight = false;
   /**
    * Counts hold reports received by event, so the mount-time snapshot can tell
    * whether a newer report landed while it was in flight.
@@ -327,6 +347,10 @@
   let followupDiscoveryRun = 0;
 
   let isLive = $derived(session?.status === 'running');
+  let canSendLive = $derived(isLive && liveDelivery);
+  let sendControl = $derived(
+    composerSendControl({ isLive, canSendLive, mode: preferences.composerSendMode })
+  );
   // Holding is a sub-state of running, so the session stays live and only the
   // activity row changes: the wait plus its live task count, and a Stop that
   // says what it stops.
@@ -783,6 +807,7 @@
       } else {
         // A terminal status ends any wait: the agent has been torn down.
         clearBackgroundHold();
+        liveDelivery = false;
         finishPolling();
       }
     });
@@ -802,6 +827,7 @@
     if (!isActive || !id) return;
 
     backgroundHold = null;
+    liveDelivery = false;
     stoppingTaskIds = new Set();
     taskStopNotices = new Map();
     const unlisten = listenToEvent<SessionBackgroundHoldPayload>(
@@ -1093,6 +1119,7 @@
       if (JSON.stringify(result.queuedMessages) !== JSON.stringify(queuedMessages)) {
         queuedMessages = result.queuedMessages;
       }
+      refreshLiveDelivery(s?.status ?? session?.status);
 
       applyAcpMetadataUpdates(result.acpMetadataMessages);
       const merged = mergeSinceMessages(messages, result.messages, request.sinceId);
@@ -1146,6 +1173,32 @@
     acpMetadataMessages = [...byId.values()].sort((a, b) => a.id - b.id);
   }
 
+  /**
+   * Learn whether the running session can take a message now. One cheap
+   * registry lookup per poll tick while the answer is still no; nothing once
+   * it is yes. A status other than `running` withdraws the flag at once.
+   */
+  function refreshLiveDelivery(status: SessionStatus | undefined) {
+    if (status !== 'running') {
+      liveDelivery = false;
+      return;
+    }
+    if (liveDelivery || liveDeliveryInFlight || !sessionId) return;
+    const id = sessionId;
+    liveDeliveryInFlight = true;
+    getSessionLiveDelivery(id)
+      .then((capability) => {
+        if (closed || sessionId !== id || session?.status !== 'running') return;
+        liveDelivery = capability.supported;
+      })
+      .catch(() => {
+        // Best-effort: the next tick asks again.
+      })
+      .finally(() => {
+        liveDeliveryInFlight = false;
+      });
+  }
+
   async function refreshQueuedMessages() {
     if (!sessionId || closed) return;
     try {
@@ -1217,6 +1270,11 @@
     // Reset textarea height after clearing (oninput won't fire for programmatic changes)
     tick().then(() => autoResize());
 
+    if (sendControl.action === 'send-now') {
+      await sendMessageNow(text, imageIdsToSend);
+      return;
+    }
+
     if (isLive) {
       try {
         await queueSessionMessage(sessionId, text, imageIdsToSend, branchId ?? null);
@@ -1233,6 +1291,56 @@
     await sendMessage(text, imageIdsToSend);
   }
 
+  /**
+   * Deliver a message to the running session now — the composer's "Send"
+   * mode. The backend steers it into the turn in flight, or interrupts the
+   * turn and re-prompts when the agent cannot steer; a session that stopped
+   * between the click and the request is resumed, as `continue_repo_session`
+   * would. Anything not delivered (`blocked`, `rejected_queued`,
+   * `not_resumable`) is reported and the draft restored — never re-queued
+   * behind the user's back, since a blocked steer may already have landed.
+   */
+  async function sendMessageNow(text: string, imageIds?: string[]) {
+    if (!session || sending) return;
+    const id = session.id;
+    sending = true;
+    error = null;
+    try {
+      const result = await sendSessionMessageNow(id, text, imageIds);
+      if (session?.id !== id) return;
+      switch (result.delivery) {
+        case 'injected':
+        case 'interrupted_and_reprompted':
+        case 'started_new_turn':
+        case 'resumed':
+          // The user row is persisted by the delivery itself; the poll picks
+          // it up. A resume flipped the row back to running.
+          if (result.delivery === 'resumed') {
+            session = { ...session, status: 'running' };
+            clearBackgroundHold();
+          }
+          startPolling();
+          scrollToBottom();
+          return;
+        case 'rejected_queued':
+          error = 'The session has not started yet; queue the message instead.';
+          break;
+        case 'blocked':
+        case 'not_resumable':
+          error = `Not delivered: ${result.reason ?? result.delivery}`;
+          break;
+      }
+      inputText = text;
+      replyImageIds = imageIds ?? [];
+    } catch (e) {
+      error = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
+      inputText = text;
+      replyImageIds = imageIds ?? [];
+    } finally {
+      sending = false;
+    }
+  }
+
   /** Actually send a message to the backend and start the agent. */
   async function sendMessage(
     text: string,
@@ -2844,7 +2952,7 @@
       <ChatComposer
         bind:textareaEl={inputEl}
         bind:value={inputText}
-        placeholder={isLive ? 'Type to queue a follow-up…' : 'Send a message…'}
+        placeholder={sendControl.placeholder}
         {hashtagItems}
         onkeydown={handleInputKeydown}
         oninput={autoResize}
@@ -2855,6 +2963,9 @@
         onRemoveImage={removeReplyImage}
         {attachError}
         {isLive}
+        {canSendLive}
+        sendMode={preferences.composerSendMode}
+        onSendModeChange={setComposerSendMode}
         {sending}
         onSend={handleSend}
       >
diff --git a/apps/staged/src/lib/features/sessions/composerSendControl.test.ts b/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
new file mode 100644
index 000000000..c83ef27ff
--- /dev/null
+++ b/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
@@ -0,0 +1,57 @@
+import { describe, expect, it } from 'vitest';
+import {
+  COMPOSER_SEND_MODE_OPTIONS,
+  composerSendControl,
+  normalizeComposerSendMode,
+} from './composerSendControl';
+
+describe('composerSendControl', () => {
+  it('shows a single Send button that starts a turn when the session is not running', () => {
+    for (const mode of ['queue', 'send'] as const) {
+      const control = composerSendControl({ isLive: false, canSendLive: true, mode });
+      expect(control).toMatchObject({ split: false, action: 'start', label: 'Send' });
+    }
+    expect(composerSendControl({ isLive: false, canSendLive: false, mode: 'queue' })).toMatchObject(
+      { split: false, action: 'start', label: 'Send' }
+    );
+  });
+
+  it('shows a single Queue button when the running session cannot take a message now', () => {
+    for (const mode of ['queue', 'send'] as const) {
+      const control = composerSendControl({ isLive: true, canSendLive: false, mode });
+      expect(control).toMatchObject({ split: false, action: 'queue', label: 'Queue' });
+    }
+  });
+
+  it('splits the button when live delivery is supported, with the primary following the mode', () => {
+    expect(composerSendControl({ isLive: true, canSendLive: true, mode: 'queue' })).toMatchObject({
+      split: true,
+      action: 'queue',
+      label: 'Queue',
+    });
+    expect(composerSendControl({ isLive: true, canSendLive: true, mode: 'send' })).toMatchObject({
+      split: true,
+      action: 'send-now',
+      label: 'Send',
+    });
+  });
+
+  it('gives each state a distinct placeholder', () => {
+    const start = composerSendControl({ isLive: false, canSendLive: false, mode: 'queue' });
+    const queue = composerSendControl({ isLive: true, canSendLive: true, mode: 'queue' });
+    const sendNow = composerSendControl({ isLive: true, canSendLive: true, mode: 'send' });
+    expect(new Set([start.placeholder, queue.placeholder, sendNow.placeholder]).size).toBe(3);
+  });
+
+  it('normalizes stored modes, defaulting to queue', () => {
+    expect(normalizeComposerSendMode('send')).toBe('send');
+    expect(normalizeComposerSendMode('queue')).toBe('queue');
+    expect(normalizeComposerSendMode(undefined)).toBe('queue');
+    expect(normalizeComposerSendMode('later')).toBe('queue');
+    expect(normalizeComposerSendMode({ mode: 'send' })).toBe('queue');
+  });
+
+  it('offers exactly the two modes in the dropdown', () => {
+    expect(COMPOSER_SEND_MODE_OPTIONS.map((o) => o.mode)).toEqual(['queue', 'send']);
+  });
+});
diff --git a/apps/staged/src/lib/features/sessions/composerSendControl.ts b/apps/staged/src/lib/features/sessions/composerSendControl.ts
new file mode 100644
index 000000000..2d7ebf2f4
--- /dev/null
+++ b/apps/staged/src/lib/features/sessions/composerSendControl.ts
@@ -0,0 +1,94 @@
+/**
+ * composerSendControl.ts — What the chat composer's submit control shows and
+ * does, derived from the session's state and the user's chosen mode.
+ *
+ * A session that is not running has one button: "Send", which starts (or
+ * resumes) a turn. A running session queues follow-ups for after the turn —
+ * unless the backend reports the session can take a message now (see
+ * `SessionLiveDelivery`), in which case the button splits: the primary
+ * segment performs the remembered mode (queue or live send) and a dropdown
+ * switches between the two. The mode is a global preference
+ * (`preferences.composerSendMode`), remembered across sessions and repos.
+ */
+
+/** How the composer submits a message while the session is running. */
+export type ComposerSendMode = 'queue' | 'send';
+
+export const DEFAULT_COMPOSER_SEND_MODE: ComposerSendMode = 'queue';
+
+/** A stored mode, or the default when the value is missing or malformed. */
+export function normalizeComposerSendMode(value: unknown): ComposerSendMode {
+  return value === 'queue' || value === 'send' ? value : DEFAULT_COMPOSER_SEND_MODE;
+}
+
+/** What pressing the primary segment does. */
+export type ComposerSendAction =
+  /** Start or resume a turn on a session that is not running. */
+  | 'start'
+  /** Persist a follow-up for after the running turn ends. */
+  | 'queue'
+  /** Deliver to the running session now (steer / interrupt-and-reprompt). */
+  | 'send-now';
+
+export interface ComposerSendControl {
+  /** Whether the mode dropdown is rendered beside the primary segment. */
+  split: boolean;
+  action: ComposerSendAction;
+  /** Primary segment label. */
+  label: string;
+  /** Hover title for the primary segment. */
+  title: string;
+  /** Placeholder for the empty input. */
+  placeholder: string;
+}
+
+export interface ComposerSendControlInput {
+  /** The session is running. */
+  isLive: boolean;
+  /** The backend reports the running session can take a message now. */
+  canSendLive: boolean;
+  /** The remembered mode (only consulted when both of the above hold). */
+  mode: ComposerSendMode;
+}
+
+export function composerSendControl({
+  isLive,
+  canSendLive,
+  mode,
+}: ComposerSendControlInput): ComposerSendControl {
+  if (!isLive) {
+    return {
+      split: false,
+      action: 'start',
+      label: 'Send',
+      title: 'Send message',
+      placeholder: 'Send a message…',
+    };
+  }
+  if (!canSendLive || mode === 'queue') {
+    return {
+      split: canSendLive,
+      action: 'queue',
+      label: 'Queue',
+      title: 'Queue message for after this turn',
+      placeholder: 'Type to queue a follow-up…',
+    };
+  }
+  return {
+    split: true,
+    action: 'send-now',
+    label: 'Send',
+    title: 'Send to the running agent now',
+    placeholder: 'Send a message to the running agent…',
+  };
+}
+
+/** Menu entries for the mode dropdown, in display order. */
+export const COMPOSER_SEND_MODE_OPTIONS: readonly {
+  mode: ComposerSendMode;
+  label: string;
+  description: string;
+}[] = [
+  { mode: 'queue', label: 'Queue', description: 'Deliver after the current turn finishes' },
+  { mode: 'send', label: 'Send', description: 'Deliver to the running agent now' },
+];
diff --git a/apps/staged/src/lib/features/settings/preferences.svelte.ts b/apps/staged/src/lib/features/settings/preferences.svelte.ts
index be5392ce1..4c6652dc1 100644
--- a/apps/staged/src/lib/features/settings/preferences.svelte.ts
+++ b/apps/staged/src/lib/features/settings/preferences.svelte.ts
@@ -34,9 +34,15 @@ import {
   normalizeProjectStatusOptions,
   type ProjectStatusOption,
 } from '../projects/projectStatusDisplay';
+import {
+  DEFAULT_COMPOSER_SEND_MODE,
+  normalizeComposerSendMode,
+  type ComposerSendMode,
+} from '../sessions/composerSendControl';
 
 // Re-export so picker code can import the type alongside the actions.
 export type { AcpConfigPref, AcpConfigPrefPatch };
+export type { ComposerSendMode };
 
 /**
  * The agent/model/effort the `generate_pikchr` diagram sub-session runs under,
@@ -84,6 +90,12 @@ const DIAGRAM_SUBSESSION_CONFIG_STORE_KEY = 'diagram-subsession-config';
 const BRANCH_PREFIX_STORE_KEY = 'branch-prefix';
 /** The statuses a project can be manually set to (frontend-only). */
 const PROJECT_STATUS_OPTIONS_STORE_KEY = 'project-status-options';
+/**
+ * How the chat composer submits to a running session that can take a message
+ * now: queue it for after the turn, or send it live. Global, not per session
+ * or repo (frontend-only).
+ */
+const COMPOSER_SEND_MODE_STORE_KEY = 'composer-send-mode';
 /** Maximum number of recent agents to remember. */
 const RECENT_AGENTS_MAX = 10;
 
@@ -191,6 +203,11 @@ export const preferences = $state({
   projectStatusOptions: DEFAULT_PROJECT_STATUS_OPTIONS.map((o) => ({
     ...o,
   })) as ProjectStatusOption[],
+  /**
+   * The chat composer's last-used submit mode for running sessions whose
+   * agent can take a message now. Remembered globally; defaults to queueing.
+   */
+  composerSendMode: DEFAULT_COMPOSER_SEND_MODE as ComposerSendMode,
   /** Whether all preferences have been loaded from storage */
   loaded: false,
 });
@@ -404,6 +421,11 @@ export async function initPreferences(): Promise<void> {
   if (typeof savedBranchPrefix === 'string') {
     preferences.branchPrefix = savedBranchPrefix;
   }
+
+  // Load the composer's last-used submit mode (malformed values fall back to queue)
+  preferences.composerSendMode = normalizeComposerSendMode(
+    await getStoreValue<unknown>(COMPOSER_SEND_MODE_STORE_KEY)
+  );
 }
 
 // =============================================================================
@@ -455,6 +477,19 @@ export function setBranchPrefix(prefix: string): void {
   setStoreValue(BRANCH_PREFIX_STORE_KEY, prefix.trim());
 }
 
+// =============================================================================
+// Composer Send Mode Actions
+// =============================================================================
+
+/**
+ * Remember how the chat composer submits to a running session: `queue` (after
+ * the turn) or `send` (deliver now). One global setting for every session.
+ */
+export function setComposerSendMode(mode: ComposerSendMode): void {
+  preferences.composerSendMode = mode;
+  setStoreValue(COMPOSER_SEND_MODE_STORE_KEY, mode);
+}
+
 // =============================================================================
 // Project Status Option Actions
 // =============================================================================
diff --git a/apps/staged/src/lib/features/settings/preferences.test.ts b/apps/staged/src/lib/features/settings/preferences.test.ts
index 8c09118bb..4f4e6b06c 100644
--- a/apps/staged/src/lib/features/settings/preferences.test.ts
+++ b/apps/staged/src/lib/features/settings/preferences.test.ts
@@ -199,3 +199,30 @@ describe.each([true, false])('project status synchronization (native=%s)', (nati
     expect(client.preferences.projectStatusOptions).toEqual([]);
   });
 });
+
+describe.each([true, false])('composer send mode (native=%s)', (native) => {
+  const modeKey = 'composer-send-mode';
+
+  it('defaults to queue and persists the chosen mode globally', async () => {
+    const client = await newClient(native);
+    await client.initPreferences();
+    expect(client.preferences.composerSendMode).toBe('queue');
+
+    client.setComposerSendMode('send');
+    expect(client.preferences.composerSendMode).toBe('send');
+    expect(values.get(modeKey)).toBe('send');
+
+    // A fresh client reads the remembered mode back.
+    const reopened = await newClient(native);
+    await reopened.initPreferences();
+    expect(reopened.preferences.composerSendMode).toBe('send');
+  });
+
+  it('falls back to queue for a malformed stored value', async () => {
+    values.set(modeKey, 'later');
+    const client = await newClient(native);
+    await client.initPreferences();
+    expect(client.preferences.composerSendMode).toBe('queue');
+    expect(set).not.toHaveBeenCalledWith(modeKey, expect.anything());
+  });
+});
diff --git a/apps/staged/src/lib/types.ts b/apps/staged/src/lib/types.ts
index ae252bc5c..e4d038da1 100644
--- a/apps/staged/src/lib/types.ts
+++ b/apps/staged/src/lib/types.ts
@@ -673,6 +673,33 @@ export interface SessionPoll {
   acpMetadataMessages: SessionMessage[];
 }
 
+/**
+ * Whether a message typed for a session can reach its agent now (the chat
+ * composer's "Send" mode) instead of waiting in the queue. Computed by the
+ * backend from the same gate `continue_repo_session` applies before delivering
+ * to a running session; `reason` says why not.
+ */
+export interface SessionLiveDelivery {
+  supported: boolean;
+  reason?: string;
+}
+
+/** How `send_session_message_now` delivered a message, or why it did not. */
+export type SessionMessageDeliveryKind =
+  | 'injected'
+  | 'interrupted_and_reprompted'
+  | 'started_new_turn'
+  | 'resumed'
+  | 'rejected_queued'
+  | 'blocked'
+  | 'not_resumable';
+
+export interface SessionMessageDelivery {
+  delivery: SessionMessageDeliveryKind;
+  /** Set when the message was not delivered (`blocked`, `not_resumable`). */
+  reason?: string;
+}
+
 // =============================================================================
 // Branch sessions
 // =============================================================================

From 7c8431da385381052a6ce8d2c19de0914caa80ed Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Sun, 1 Nov 2026 12:09:18 +1100
Subject: [PATCH 2/9] fix(staged): harden the composer's live-send path against
 the review's four findings
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-ups to b51a8320 (Queue / Send split button), addressing the code
review of that commit.

Double-submit kept the first draft and lost the second. `handleSend`
cleared the input before anything checked `sending`, and only the inner
send functions refused re-entry, so a second Cmd+Enter during an in-flight
live send (steer acknowledgement, interrupt-and-reprompt, or a resume can
take seconds) emptied the box and threw the new draft away. The `sending`
guard now runs first in `handleSend`, before the draft is taken out; the
inner guards stay as a second line.

"Send" on a session that stopped since the last poll no longer resumes it
on the backend. `send_session_message_now` resumed through the claimed
path, which applies no branch override and no follow-up config, so a race
in the note chat pane could land the resume on the session's own branch.
`route_continue_session` now takes a `StoppedSessionPolicy`: the MCP tool
keeps `Resume` (unchanged behaviour), while the command's new body,
`send_session_message_now_for_store`, routes with `Refuse` and answers a
stopped session — found stopped up front or after the row settles under
the wait — with a new `not_running` outcome, row untouched. The pane treats
`not_running` by falling through to `sendMessage`, the idle path that
passes the pane's `branchId` and follow-up selection. The command no
longer needs the action executor, registry, or app handle; the web arm
stays detached so a client disconnect between interrupt and re-prompt
cannot strand the turn.

The `delivery` switch is exhaustive. A `default:` arm reports
`Not delivered: <kind>` and restores the draft, with the codebase's
`const _: never` check so a kind added to `ContinueOutcome::delivery()`
without updating the TS union fails type-check rather than silently
restoring the draft. A `blocked` answer also forgets the live-delivery
flag, since the connection may have gone under the request.

Live-delivery polling stops on a permanent "no". `SessionLiveDelivery`
gains `retryable`: true while the row is running, ours, and its connection
has not handed out a handle yet (or lost it), false when another Staged
instance owns the row or it is not running, and always false alongside
`supported: true`. The pane keeps `LiveDeliveryKnowledge` (`supported`,
`settled`) instead of a boolean, asks only while unsettled, and forgets it
whenever the status leaves `running`, the pane changes session, or the
pane itself starts a new run. The pure helpers live in `liveDelivery.ts`.

Tests: the four Rust capability tests assert `retryable`; new tests cover
`not_running` for a stopped session (and that the tool still claims it)
and for a session that stops during the wait; `not_running` spelling and
reason on both the outcome and the wire reply; vitest covers the
ask/settle decisions of the pane helper.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 apps/staged/src-tauri/src/project_mcp.rs      |   1 +
 apps/staged/src-tauri/src/session_commands.rs | 277 +++++++++++++++---
 apps/staged/src-tauri/src/web_server.rs       |  24 +-
 apps/staged/src/lib/commands.ts               |   9 +-
 .../features/sessions/SessionChatPane.svelte  | 101 +++++--
 .../features/sessions/liveDelivery.test.ts    |  47 +++
 .../src/lib/features/sessions/liveDelivery.ts |  43 +++
 apps/staged/src/lib/types.ts                  |  23 +-
 8 files changed, 440 insertions(+), 85 deletions(-)
 create mode 100644 apps/staged/src/lib/features/sessions/liveDelivery.test.ts
 create mode 100644 apps/staged/src/lib/features/sessions/liveDelivery.ts

diff --git a/apps/staged/src-tauri/src/project_mcp.rs b/apps/staged/src-tauri/src/project_mcp.rs
index ad806db4d..08255ab01 100644
--- a/apps/staged/src-tauri/src/project_mcp.rs
+++ b/apps/staged/src-tauri/src/project_mcp.rs
@@ -1695,6 +1695,7 @@ mod tests {
                 crate::session_commands::ContinueWaits::uniform(std::time::Duration::from_millis(
                     200,
                 )),
+                crate::session_commands::StoppedSessionPolicy::Resume,
             )
             .await
             .unwrap();
diff --git a/apps/staged/src-tauri/src/session_commands.rs b/apps/staged/src-tauri/src/session_commands.rs
index 349007473..be140cee9 100644
--- a/apps/staged/src-tauri/src/session_commands.rs
+++ b/apps/staged/src-tauri/src/session_commands.rs
@@ -1821,6 +1821,10 @@ pub(crate) enum ContinueOutcome {
     /// A stopped session that cannot be resumed: no agent conversation to
     /// load, or its worktree is gone. The caller should start a new session.
     NotResumable { reason: String },
+    /// The session is stopped and the caller asked for live delivery only
+    /// (`StoppedSessionPolicy::Refuse`): nothing was sent and the row was
+    /// not touched. The caller resumes it through its own path.
+    NotRunning { reason: String },
 }
 
 impl ContinueOutcome {
@@ -1833,14 +1837,15 @@ impl ContinueOutcome {
             ContinueOutcome::RejectedQueued => "rejected_queued",
             ContinueOutcome::Blocked { .. } => "blocked",
             ContinueOutcome::NotResumable { .. } => "not_resumable",
+            ContinueOutcome::NotRunning { .. } => "not_running",
         }
     }
 
     pub(crate) fn reason(&self) -> Option<&str> {
         match self {
-            ContinueOutcome::Blocked { reason } | ContinueOutcome::NotResumable { reason } => {
-                Some(reason)
-            }
+            ContinueOutcome::Blocked { reason }
+            | ContinueOutcome::NotResumable { reason }
+            | ContinueOutcome::NotRunning { reason } => Some(reason),
             _ => None,
         }
     }
@@ -1856,6 +1861,28 @@ impl ContinueOutcome {
             reason: reason.into(),
         }
     }
+
+    fn not_running(reason: impl Into<String>) -> Self {
+        ContinueOutcome::NotRunning {
+            reason: reason.into(),
+        }
+    }
+}
+
+/// What `route_continue_session` does with a session that is stopped
+/// (`completed`, `cancelled`, or `error`) — including one that stops while
+/// the request waits on its connection.
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum StoppedSessionPolicy {
+    /// Claim it for a resume with the message as its next prompt, as the
+    /// `continue_repo_session` MCP tool does.
+    Resume,
+    /// Refuse with `ContinueOutcome::NotRunning` and leave the row alone.
+    /// The chat composer's "Send" uses this: its own resume path applies a
+    /// branch override and follow-up config that the claimed resume does
+    /// not, so a session that stopped between the composer's last poll and
+    /// the click must fall back to that path rather than be resumed here.
+    Refuse,
 }
 
 /// A stopped session `continue_resume_gate` claimed for a resume. Its row is
@@ -1892,8 +1919,9 @@ pub(crate) enum ContinueRoute {
 
 /// Deliver `message` to a session now, whatever state it is in.
 ///
-/// The Tauri/web `send_session_message_now` command and the project MCP
-/// server's `continue_repo_session` tool share this body. A `running`
+/// The body of the project MCP server's `continue_repo_session` tool (the
+/// Tauri/web `send_session_message_now` command shares the routing but not
+/// the resume; see `send_session_message_now_for_store`). A `running`
 /// session is reached over its live ACP connection — steering first,
 /// interrupt-and-reprompt when the agent refuses — so the row never leaves
 /// `running` and the runner never sees a turn boundary; a stopped session is
@@ -1922,6 +1950,7 @@ pub(crate) async fn continue_session_for_store(
         &message,
         &image_ids,
         ContinueWaits::DEFAULT,
+        StoppedSessionPolicy::Resume,
     )
     .await?;
     let claim = match route {
@@ -1943,6 +1972,40 @@ pub(crate) async fn continue_session_for_store(
     .map(|()| ContinueOutcome::Resumed)
 }
 
+/// Deliver `message` to a `running` session now, and only then: the body of
+/// the Tauri/web `send_session_message_now` command. The live paths are the
+/// ones `continue_session_for_store` takes (steer, else interrupt and
+/// re-prompt) and a `queued` session is refused the same way; a stopped
+/// session comes back `NotRunning` instead of being resumed, so the composer
+/// can resume it through `resume_session` with its branch override and
+/// follow-up config. Needs no app handle, since nothing here launches.
+pub(crate) async fn send_session_message_now_for_store(
+    store: &Arc<Store>,
+    registry: &Arc<session_runner::SessionRegistry>,
+    session_id: &str,
+    message: &str,
+    image_ids: &[String],
+) -> Result<ContinueOutcome, String> {
+    match route_continue_session(
+        store,
+        registry,
+        session_id,
+        message,
+        image_ids,
+        ContinueWaits::DEFAULT,
+        StoppedSessionPolicy::Refuse,
+    )
+    .await?
+    {
+        ContinueRoute::Delivered(outcome) => Ok(outcome),
+        ContinueRoute::Resume(claim) => Err(format!(
+            "send_session_message_now: session {} was claimed for a resume under the refuse \
+             policy",
+            claim.session.id
+        )),
+    }
+}
+
 /// Finish the resume of a session `continue_resume_gate` claimed: the same
 /// preparation and launch as `resume_session_for_store`, without the claim
 /// it already made. No `branch_id` override and no config selection: the
@@ -1997,7 +2060,9 @@ pub(crate) async fn resume_claimed_session_for_store(
 /// preparation and launch, which need the app handle. Loops because the
 /// status can move under the request: a `running` session whose connection
 /// ends while this waits for its handle is routed again on the status it
-/// ended with. Each wait takes its own budget from `waits`.
+/// ended with. Each wait takes its own budget from `waits`; `stopped` says
+/// whether a session found stopped (at the start or after such a re-route)
+/// is claimed for a resume or refused.
 pub(crate) async fn route_continue_session(
     store: &Arc<Store>,
     registry: &Arc<session_runner::SessionRegistry>,
@@ -2005,6 +2070,7 @@ pub(crate) async fn route_continue_session(
     message: &str,
     image_ids: &[String],
     waits: ContinueWaits,
+    stopped: StoppedSessionPolicy,
 ) -> Result<ContinueRoute, String> {
     // A handle whose connection went away under this request; the wait below
     // skips it so only a re-connect's handle (or a status change) ends it.
@@ -2086,6 +2152,11 @@ pub(crate) async fn route_continue_session(
             store::SessionStatus::Completed
             | store::SessionStatus::Cancelled
             | store::SessionStatus::Error => {
+                if stopped == StoppedSessionPolicy::Refuse {
+                    return Ok(ContinueRoute::Delivered(ContinueOutcome::not_running(
+                        format!("the session is {}", session.status.as_str()),
+                    )));
+                }
                 return Ok(match continue_resume_gate(store, registry, session)? {
                     Ok(claim) => ContinueRoute::Resume(Box::new(claim)),
                     Err(refused) => ContinueRoute::Delivered(refused),
@@ -2340,18 +2411,44 @@ pub fn delete_queued_session_message(
 /// handed out a live turn-control handle. Anything else is "queue only",
 /// with `reason` saying why, so the composer can hide the mode switch
 /// rather than offer a send that would come back blocked.
+///
+/// `retryable` tells the composer whether a "no" is worth asking about
+/// again while the row stays `running`: it is for a connection still coming
+/// up (or re-connecting), and is not for a row another Staged instance owns
+/// or one that is not running, where only a status change can alter the
+/// answer. It is always `false` when `supported` is true.
 #[derive(Debug, Clone, PartialEq, Eq, Serialize)]
 #[serde(rename_all = "camelCase")]
 pub struct SessionLiveDelivery {
     pub supported: bool,
+    pub retryable: bool,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub reason: Option<String>,
 }
 
 impl SessionLiveDelivery {
+    const SUPPORTED: Self = Self {
+        supported: true,
+        retryable: false,
+        reason: None,
+    };
+
+    /// Queue only for this run: asking again changes nothing until the
+    /// status moves.
     fn unsupported(reason: impl Into<String>) -> Self {
         Self {
             supported: false,
+            retryable: false,
+            reason: Some(reason.into()),
+        }
+    }
+
+    /// Queue only for now: the row is `running` and ours, so a later ask
+    /// may find the connection up.
+    fn not_yet(reason: impl Into<String>) -> Self {
+        Self {
+            supported: false,
+            retryable: true,
             reason: Some(reason.into()),
         }
     }
@@ -2378,11 +2475,8 @@ pub(crate) fn live_delivery_for_session(
         )));
     }
     match registry.turn_control_handle(session_id) {
-        Some(handle) if handle.is_connection_alive() => Ok(SessionLiveDelivery {
-            supported: true,
-            reason: None,
-        }),
-        _ => Ok(SessionLiveDelivery::unsupported(
+        Some(handle) if handle.is_connection_alive() => Ok(SessionLiveDelivery::SUPPORTED),
+        _ => Ok(SessionLiveDelivery::not_yet(
             "the session's agent has not connected yet",
         )),
     }
@@ -2418,33 +2512,28 @@ impl From<&ContinueOutcome> for SessionMessageDelivery {
     }
 }
 
-/// Deliver a chat message to a session now instead of queueing it: the
-/// composer's "Send" mode. Shares `continue_session_for_store` with the
-/// project MCP server's `continue_repo_session` tool, so a running session
-/// is steered (or interrupted and re-prompted), a stopped one is resumed,
-/// and a queued one is refused — the reply says which.
+/// Deliver a chat message to a running session now instead of queueing it:
+/// the composer's "Send" mode. Takes the live paths of the project MCP
+/// server's `continue_repo_session` tool — steer, else interrupt and
+/// re-prompt — and refuses a queued session the same way; unlike the tool it
+/// does not resume a stopped session (`not_running`), leaving that to the
+/// composer's `resume_session`, which honors the branch override and
+/// follow-up config. The reply says which.
 #[tauri::command]
-#[allow(clippy::too_many_arguments)]
 pub async fn send_session_message_now(
     store: tauri::State<'_, Mutex<Option<Arc<Store>>>>,
     registry: tauri::State<'_, Arc<session_runner::SessionRegistry>>,
-    action_executor: tauri::State<'_, Arc<ActionExecutor>>,
-    action_registry: tauri::State<'_, Arc<ActionRegistry>>,
-    app_handle: tauri::AppHandle,
     session_id: String,
     content: String,
     image_ids: Option<Vec<String>>,
 ) -> Result<SessionMessageDelivery, String> {
     let store = get_store(&store)?;
-    let outcome = continue_session_for_store(
-        store,
-        Arc::clone(&registry),
-        Arc::clone(&action_executor),
-        Arc::clone(&action_registry),
-        app_handle,
-        session_id,
-        content,
-        image_ids.unwrap_or_default(),
+    let outcome = send_session_message_now_for_store(
+        &store,
+        &registry,
+        &session_id,
+        &content,
+        &image_ids.unwrap_or_default(),
     )
     .await?;
     Ok(SessionMessageDelivery::from(&outcome))
@@ -8308,6 +8397,27 @@ mod tests {
             message,
             image_ids,
             ContinueWaits::uniform(Duration::from_millis(300)),
+            StoppedSessionPolicy::Resume,
+        )
+        .await
+        .unwrap()
+    }
+
+    /// `send_session_message_now`'s body, with the test wait budget.
+    async fn send_now_through_shared_body(
+        registry: &Arc<session_runner::SessionRegistry>,
+        store: &Arc<Store>,
+        session_id: &str,
+        message: &str,
+    ) -> ContinueRoute {
+        route_continue_session(
+            store,
+            registry,
+            session_id,
+            message,
+            &[],
+            ContinueWaits::uniform(Duration::from_millis(300)),
+            StoppedSessionPolicy::Refuse,
         )
         .await
         .unwrap()
@@ -8380,6 +8490,7 @@ mod tests {
             capability,
             SessionLiveDelivery {
                 supported: true,
+                retryable: false,
                 reason: None
             }
         );
@@ -8387,9 +8498,11 @@ mod tests {
 
     /// A `running` row still in its startup window (no connection yet) and
     /// one whose connection has gone are both "queue only" — the flag never
-    /// waits for a handle the way the delivery itself does.
+    /// waits for a handle the way the delivery itself does. Both answers are
+    /// retryable: the row is ours and running, so a (re-)connect can still
+    /// hand out a handle.
     #[test]
-    fn live_delivery_is_unsupported_until_the_agent_connects() {
+    fn live_delivery_is_unsupported_but_retryable_until_the_agent_connects() {
         let store = Arc::new(Store::in_memory().unwrap());
         let session = create_session_with_status(&store, "prompt", store::SessionStatus::Running);
         let registry = test_registry();
@@ -8397,6 +8510,7 @@ mod tests {
 
         let starting = live_delivery_for_session(&store, &registry, &session.id).unwrap();
         assert!(!starting.supported);
+        assert!(starting.retryable, "{starting:?}");
         assert!(
             starting
                 .reason
@@ -8409,20 +8523,22 @@ mod tests {
         registry.set_turn_control_handle(&session.id, acp_client::TurnControlHandle::detached());
         let dead = live_delivery_for_session(&store, &registry, &session.id).unwrap();
         assert!(!dead.supported);
+        assert!(dead.retryable, "{dead:?}");
     }
 
     /// Stopped and queued rows are not live: the composer keeps its plain
-    /// button for them (a stopped session's "Send" resumes it, as
-    /// `continue_session_for_store` would; a queued one cannot take a
-    /// message out of FIFO order).
+    /// button for them (a stopped session's "Send" resumes it through
+    /// `resume_session`; a queued one cannot take a message out of FIFO
+    /// order). Not retryable: only a status change can alter the answer.
     #[test]
-    fn live_delivery_is_unsupported_for_rows_that_are_not_running() {
+    fn live_delivery_is_unsupported_and_not_retryable_for_rows_that_are_not_running() {
         let store = Arc::new(Store::in_memory().unwrap());
         let registry = test_registry();
 
         let queued = create_session_with_status(&store, "prompt", store::SessionStatus::Queued);
         let capability = live_delivery_for_session(&store, &registry, &queued.id).unwrap();
         assert!(!capability.supported);
+        assert!(!capability.retryable, "{capability:?}");
         assert_eq!(capability.reason.as_deref(), Some("the session is queued"));
 
         let completed = create_session_with_status(&store, "prompt", store::SessionStatus::Running);
@@ -8436,6 +8552,7 @@ mod tests {
             .unwrap();
         let capability = live_delivery_for_session(&store, &registry, &completed.id).unwrap();
         assert!(!capability.supported);
+        assert!(!capability.retryable, "{capability:?}");
         assert_eq!(
             capability.reason.as_deref(),
             Some("the session is completed")
@@ -8445,9 +8562,11 @@ mod tests {
     }
 
     /// A `running` row another Staged instance owns has its connection in
-    /// that process; a handle here would never appear, so it is queue only.
+    /// that process; a handle here would never appear, so it is queue only
+    /// for the whole run — not retryable.
     #[tokio::test(flavor = "current_thread")]
-    async fn live_delivery_is_unsupported_for_a_session_owned_by_another_instance() {
+    async fn live_delivery_is_unsupported_and_not_retryable_for_a_session_owned_by_another_instance(
+    ) {
         let store = Arc::new(Store::in_memory().unwrap());
         let mut session = store::Session::new_running("prompt", Path::new("/tmp"));
         let other_pid = std::process::id() + 1;
@@ -8462,11 +8581,81 @@ mod tests {
         let capability = live_delivery_for_session(&store, &registry, &session.id).unwrap();
 
         assert!(!capability.supported);
+        assert!(!capability.retryable, "{capability:?}");
         let reason = capability.reason.unwrap();
         assert!(reason.contains("another Staged instance"), "{reason}");
         assert!(reason.contains(&other_pid.to_string()), "{reason}");
     }
 
+    /// `send_session_message_now` never resumes: a stopped session that the
+    /// MCP tool would claim comes back `not_running` with the row untouched,
+    /// so the composer can resume it through `resume_session` with its branch
+    /// override and follow-up config.
+    #[tokio::test(flavor = "current_thread")]
+    async fn send_now_refuses_a_stopped_session_instead_of_resuming_it() {
+        let (store, branch) = setup_branch_store_with_workdir();
+        let session = completed_commit_session_with_agent_id(&store, &branch.id);
+        let registry = test_registry();
+
+        let refused =
+            delivered(send_now_through_shared_body(&registry, &store, &session.id, "x").await);
+        assert_eq!(
+            refused,
+            ContinueOutcome::not_running("the session is completed")
+        );
+        assert_eq!(
+            store.get_session(&session.id).unwrap().unwrap().status,
+            store::SessionStatus::Completed
+        );
+
+        // The same session is still claimed under the tool's policy.
+        match continue_through_shared_body(&registry, &store, &session.id, "x").await {
+            ContinueRoute::Resume(claim) => assert_eq!(claim.session.id, session.id),
+            other => panic!("expected a resume, got {other:?}"),
+        }
+    }
+
+    /// The refusal also covers a session that stops while the request waits
+    /// for its connection: it is re-routed on the new status and refused
+    /// rather than claimed.
+    #[tokio::test(flavor = "current_thread")]
+    async fn send_now_refuses_a_session_that_stops_during_the_wait() {
+        let (store, branch) = setup_branch_store_with_workdir();
+        let session =
+            create_branch_commit_session(&store, &branch.id, store::SessionStatus::Running);
+        let registry = test_registry();
+        let _registration = registry.register_external(&session.id);
+        let settle = {
+            let store = Arc::clone(&store);
+            let session_id = session.id.clone();
+            tokio::spawn(async move {
+                tokio::time::sleep(Duration::from_millis(50)).await;
+                store
+                    .update_session_status(
+                        &session_id,
+                        store::SessionStatus::Cancelled,
+                        None,
+                        Some(&store::CompletionReason::Interrupted),
+                    )
+                    .unwrap();
+                store.set_agent_session_id(&session_id, "acp-1").unwrap();
+            })
+        };
+
+        let outcome =
+            delivered(send_now_through_shared_body(&registry, &store, &session.id, "x").await);
+
+        settle.await.unwrap();
+        assert_eq!(
+            outcome,
+            ContinueOutcome::not_running("the session is cancelled")
+        );
+        assert_eq!(
+            store.get_session(&session.id).unwrap().unwrap().status,
+            store::SessionStatus::Cancelled
+        );
+    }
+
     /// The wire reply of `send_session_message_now` spells the outcome the
     /// way `continue_repo_session` does, reason included.
     #[test]
@@ -8482,6 +8671,14 @@ mod tests {
         let rejected = SessionMessageDelivery::from(&ContinueOutcome::RejectedQueued);
         assert_eq!(rejected.delivery, "rejected_queued");
         assert_eq!(rejected.reason, None);
+
+        let not_running =
+            SessionMessageDelivery::from(&ContinueOutcome::not_running("the session is completed"));
+        assert_eq!(not_running.delivery, "not_running");
+        assert_eq!(
+            not_running.reason.as_deref(),
+            Some("the session is completed")
+        );
     }
 
     /// A running session with a connection is steered first; the agent took
@@ -8877,6 +9074,7 @@ mod tests {
                     "x",
                     &[],
                     ContinueWaits::uniform(Duration::from_millis(300)),
+                    StoppedSessionPolicy::Resume,
                 )
                 .await
                 .unwrap()
@@ -8932,6 +9130,7 @@ mod tests {
             "x",
             &[],
             ContinueWaits::uniform(Duration::from_secs(5)),
+            StoppedSessionPolicy::Resume,
         )
         .await
         .unwrap();
@@ -8969,6 +9168,7 @@ mod tests {
                 remote_startup: Duration::from_millis(500),
                 settle: Duration::from_millis(100),
             },
+            StoppedSessionPolicy::Resume,
         )
         .await
         .unwrap();
@@ -9103,6 +9303,9 @@ mod tests {
         let not_resumable = ContinueOutcome::not_resumable("gone");
         assert_eq!(not_resumable.delivery(), "not_resumable");
         assert_eq!(not_resumable.reason(), Some("gone"));
+        let not_running = ContinueOutcome::not_running("the session is completed");
+        assert_eq!(not_running.delivery(), "not_running");
+        assert_eq!(not_running.reason(), Some("the session is completed"));
         assert_eq!(ContinueOutcome::Injected.reason(), None);
     }
 
diff --git a/apps/staged/src-tauri/src/web_server.rs b/apps/staged/src-tauri/src/web_server.rs
index 0f3cc07c5..a9754506a 100644
--- a/apps/staged/src-tauri/src/web_server.rs
+++ b/apps/staged/src-tauri/src/web_server.rs
@@ -3684,23 +3684,17 @@ async fn dispatch(command: &str, args: Value, state: &WebAppState) -> Result<Val
             let session_id: String = arg(&args, "sessionId")?;
             let content: String = arg(&args, "content")?;
             let image_ids: Option<Vec<String>> = opt_arg(&args, "imageIds")?;
-            let app_handle = app_handle.clone();
             let session_registry = Arc::clone(session_registry);
-            let action_executor = Arc::clone(action_executor);
-            let action_registry = Arc::clone(action_registry);
-            // Detached like `resume_session`: a stopped session is resumed
-            // through the same launch, and a client that disconnects while
-            // that resume is mid-flight must not abandon it half-started.
+            // Detached: interrupt-and-reprompt is two agent round trips, and
+            // a client that disconnects between them must not leave the turn
+            // cancelled with the re-prompt never sent.
             let delivery = detached(async move {
-                let outcome = session_commands::continue_session_for_store(
-                    store,
-                    session_registry,
-                    action_executor,
-                    action_registry,
-                    app_handle,
-                    session_id,
-                    content,
-                    image_ids.unwrap_or_default(),
+                let outcome = session_commands::send_session_message_now_for_store(
+                    &store,
+                    &session_registry,
+                    &session_id,
+                    &content,
+                    &image_ids.unwrap_or_default(),
                 )
                 .await?;
                 Ok(session_commands::SessionMessageDelivery::from(&outcome))
diff --git a/apps/staged/src/lib/commands.ts b/apps/staged/src/lib/commands.ts
index eded306b2..a0c9a513b 100644
--- a/apps/staged/src/lib/commands.ts
+++ b/apps/staged/src/lib/commands.ts
@@ -1164,9 +1164,12 @@ export function getSessionLiveDelivery(sessionId: string): Promise<SessionLiveDe
 }
 
 /**
- * Deliver a message to the session now instead of queueing it: steered into
- * the running turn (or interrupting it) over the live connection, or resuming
- * a stopped session — the same path as the `continue_repo_session` MCP tool.
+ * Deliver a message to the running session now instead of queueing it:
+ * steered into the running turn (or interrupting it) over the live
+ * connection, as the `continue_repo_session` MCP tool does. Unlike the tool
+ * it does not resume a stopped session: that comes back `not_running`, and
+ * the caller resumes through `resumeSession` so the branch override and
+ * follow-up config apply.
  */
 export function sendSessionMessageNow(
   sessionId: string,
diff --git a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
index 3050d0ba0..0a0d37d59 100644
--- a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
+++ b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
@@ -15,8 +15,9 @@
   - Message queue: sending while running persists a follow-up for backend drain
   - Live send: when the backend reports the running session can take a message
     now (`get_session_live_delivery`), the composer offers "Send" beside
-    "Queue"; "Send" goes through `send_session_message_now`, the path the
-    `continue_repo_session` MCP tool uses (steer, else interrupt-and-reprompt)
+    "Queue"; "Send" goes through `send_session_message_now`, the live path the
+    `continue_repo_session` MCP tool uses (steer, else interrupt-and-reprompt);
+    a session that stopped meanwhile falls back to the idle resume path
   - Copy button on every message
   - Tool calls show name + args preview; expand to see output
   - Fixed-size modal with proper scrolling
@@ -104,6 +105,12 @@
   } from '../settings/preferences.svelte';
   import ChatComposer, { composerControlClass } from './ChatComposer.svelte';
   import { composerSendControl } from './composerSendControl';
+  import {
+    LIVE_DELIVERY_UNKNOWN,
+    liveDeliveryKnowledge,
+    shouldAskLiveDelivery,
+    type LiveDeliveryKnowledge,
+  } from './liveDelivery';
   import {
     backgroundHoldTaskRows,
     isTaskHeld,
@@ -283,12 +290,14 @@
   /** Latest background hold reported for this session; null when not holding. */
   let backgroundHold = $state<SessionBackgroundHold | null>(null);
   /**
-   * The backend confirmed this running session can take a message now: it is
-   * owned by this process and its agent connection is up. Asked on each poll
-   * tick until it says yes (the connection comes up a few seconds into a run),
-   * and dropped whenever the status leaves `running`.
+   * What the backend has said about this running session taking a message
+   * now (owned by this process, agent connection up). Asked on each poll tick
+   * until the answer is settled: a yes, or a no that cannot change during this
+   * run (another Staged instance owns the row). A retryable no — the
+   * connection comes up a few seconds into a run — is asked again. Forgotten
+   * whenever the status leaves `running` or the pane changes session.
    */
-  let liveDelivery = $state(false);
+  let liveDelivery = $state<LiveDeliveryKnowledge>(LIVE_DELIVERY_UNKNOWN);
   let liveDeliveryInFlight = false;
   /**
    * Counts hold reports received by event, so the mount-time snapshot can tell
@@ -347,7 +356,7 @@
   let followupDiscoveryRun = 0;
 
   let isLive = $derived(session?.status === 'running');
-  let canSendLive = $derived(isLive && liveDelivery);
+  let canSendLive = $derived(isLive && liveDelivery.supported);
   let sendControl = $derived(
     composerSendControl({ isLive, canSendLive, mode: preferences.composerSendMode })
   );
@@ -807,7 +816,7 @@
       } else {
         // A terminal status ends any wait: the agent has been torn down.
         clearBackgroundHold();
-        liveDelivery = false;
+        liveDelivery = LIVE_DELIVERY_UNKNOWN;
         finishPolling();
       }
     });
@@ -827,7 +836,7 @@
     if (!isActive || !id) return;
 
     backgroundHold = null;
-    liveDelivery = false;
+    liveDelivery = LIVE_DELIVERY_UNKNOWN;
     stoppingTaskIds = new Set();
     taskStopNotices = new Map();
     const unlisten = listenToEvent<SessionBackgroundHoldPayload>(
@@ -1175,21 +1184,24 @@
 
   /**
    * Learn whether the running session can take a message now. One cheap
-   * registry lookup per poll tick while the answer is still no; nothing once
-   * it is yes. A status other than `running` withdraws the flag at once.
+   * registry lookup per poll tick while the answer is a retryable no; nothing
+   * once it is settled (see `liveDelivery`). A status other than `running`
+   * forgets the answer at once, so the next run asks afresh.
    */
   function refreshLiveDelivery(status: SessionStatus | undefined) {
     if (status !== 'running') {
-      liveDelivery = false;
+      liveDelivery = LIVE_DELIVERY_UNKNOWN;
+      return;
+    }
+    if (!shouldAskLiveDelivery(status, liveDelivery) || liveDeliveryInFlight || !sessionId) {
       return;
     }
-    if (liveDelivery || liveDeliveryInFlight || !sessionId) return;
     const id = sessionId;
     liveDeliveryInFlight = true;
     getSessionLiveDelivery(id)
       .then((capability) => {
         if (closed || sessionId !== id || session?.status !== 'running') return;
-        liveDelivery = capability.supported;
+        liveDelivery = liveDeliveryKnowledge(capability);
       })
       .catch(() => {
         // Best-effort: the next tick asks again.
@@ -1260,6 +1272,11 @@
   let noteFollowupSending = $state(false);
 
   async function handleSend() {
+    // A send still in flight (a live send can take a few seconds: steer
+    // acknowledgement, interrupt-and-reprompt, or a resume) owns the composer
+    // until it settles; a second Cmd+Enter meanwhile must not clear the draft
+    // typed since, so the guard comes before anything is taken out of the box.
+    if (sending) return;
     const text = inputText.trim();
     if (!text) return;
     inputText = '';
@@ -1294,11 +1311,15 @@
   /**
    * Deliver a message to the running session now — the composer's "Send"
    * mode. The backend steers it into the turn in flight, or interrupts the
-   * turn and re-prompts when the agent cannot steer; a session that stopped
-   * between the click and the request is resumed, as `continue_repo_session`
-   * would. Anything not delivered (`blocked`, `rejected_queued`,
-   * `not_resumable`) is reported and the draft restored — never re-queued
-   * behind the user's back, since a blocked steer may already have landed.
+   * turn and re-prompts when the agent cannot steer. It never resumes: a
+   * session that stopped between the last poll and the click comes back
+   * `not_running`, and the message goes through `sendMessage` instead — the
+   * idle path, which applies this pane's branch override and follow-up
+   * config (the note chat pane's branch would otherwise be lost). Anything
+   * not delivered (`blocked`, `rejected_queued`, `not_resumable`, or a kind
+   * this pane does not know) is reported and the draft restored — never
+   * re-queued behind the user's back, since a blocked steer may already have
+   * landed.
    */
   async function sendMessageNow(text: string, imageIds?: string[]) {
     if (!session || sending) return;
@@ -1312,23 +1333,47 @@
         case 'injected':
         case 'interrupted_and_reprompted':
         case 'started_new_turn':
-        case 'resumed':
           // The user row is persisted by the delivery itself; the poll picks
-          // it up. A resume flipped the row back to running.
-          if (result.delivery === 'resumed') {
-            session = { ...session, status: 'running' };
-            clearBackgroundHold();
-          }
+          // it up.
+          startPolling();
+          scrollToBottom();
+          return;
+        case 'resumed':
+          // The command does not resume (see `not_running`); the kind belongs
+          // to the shared MCP spelling. Should it ever arrive, the row is
+          // running again on a fresh connection.
+          session = { ...session, status: 'running' };
+          clearBackgroundHold();
+          liveDelivery = LIVE_DELIVERY_UNKNOWN;
           startPolling();
           scrollToBottom();
           return;
+        case 'not_running':
+          // Stopped since the last poll: resume it the way the idle composer
+          // does, with the branch override and follow-up config. `sending` is
+          // already held here, so the lock is passed through.
+          liveDelivery = LIVE_DELIVERY_UNKNOWN;
+          await sendMessage(text, imageIds, true);
+          return;
         case 'rejected_queued':
           error = 'The session has not started yet; queue the message instead.';
           break;
         case 'blocked':
+          // The connection may have gone under the request: ask again before
+          // offering "Send" next time.
+          liveDelivery = LIVE_DELIVERY_UNKNOWN;
+          error = `Not delivered: ${result.reason ?? result.delivery}`;
+          break;
         case 'not_resumable':
           error = `Not delivered: ${result.reason ?? result.delivery}`;
           break;
+        default: {
+          // A delivery kind the backend added that this hand-maintained union
+          // does not know: say so rather than restoring the draft in silence.
+          const unknownKind: never = result.delivery;
+          error = `Not delivered: ${String(unknownKind)}`;
+          break;
+        }
       }
       inputText = text;
       replyImageIds = imageIds ?? [];
@@ -1367,8 +1412,10 @@
       };
       // A new turn is starting: any hold reported belonged to the previous
       // one, so drop it rather than letting this local flip back to `running`
-      // re-render the old wait in place of "Thinking…".
+      // re-render the old wait in place of "Thinking…". Likewise whatever was
+      // known about live delivery was about the previous run.
       clearBackgroundHold();
+      liveDelivery = LIVE_DELIVERY_UNKNOWN;
       modelSpecificFollowupConfig = null;
       modelSpecificFollowupModelValue = null;
       modelSpecificFollowupSessionId = null;
diff --git a/apps/staged/src/lib/features/sessions/liveDelivery.test.ts b/apps/staged/src/lib/features/sessions/liveDelivery.test.ts
new file mode 100644
index 000000000..c1d48a033
--- /dev/null
+++ b/apps/staged/src/lib/features/sessions/liveDelivery.test.ts
@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest';
+import {
+  LIVE_DELIVERY_UNKNOWN,
+  liveDeliveryKnowledge,
+  shouldAskLiveDelivery,
+} from './liveDelivery';
+
+describe('liveDelivery', () => {
+  it('asks while the session is running and nothing is settled', () => {
+    expect(shouldAskLiveDelivery('running', LIVE_DELIVERY_UNKNOWN)).toBe(true);
+    expect(shouldAskLiveDelivery('running', { supported: false, settled: false })).toBe(true);
+  });
+
+  it('never asks about a session that is not running', () => {
+    for (const status of ['queued', 'completed', 'cancelled', 'error', undefined] as const) {
+      expect(shouldAskLiveDelivery(status, LIVE_DELIVERY_UNKNOWN)).toBe(false);
+    }
+  });
+
+  it('stops asking once the backend says yes', () => {
+    const knowledge = liveDeliveryKnowledge({ supported: true, retryable: false });
+    expect(knowledge).toEqual({ supported: true, settled: true });
+    expect(shouldAskLiveDelivery('running', knowledge)).toBe(false);
+  });
+
+  it('keeps asking after a retryable no (the agent has not connected yet)', () => {
+    const knowledge = liveDeliveryKnowledge({
+      supported: false,
+      retryable: true,
+      reason: "the session's agent has not connected yet",
+    });
+    expect(knowledge).toEqual({ supported: false, settled: false });
+    expect(shouldAskLiveDelivery('running', knowledge)).toBe(true);
+  });
+
+  it('stops asking after a non-retryable no (another instance owns the session)', () => {
+    const knowledge = liveDeliveryKnowledge({
+      supported: false,
+      retryable: false,
+      reason: 'the session is owned by another Staged instance (pid 42)',
+    });
+    expect(knowledge).toEqual({ supported: false, settled: true });
+    expect(shouldAskLiveDelivery('running', knowledge)).toBe(false);
+    // A status change resets to unknown, which asks again.
+    expect(shouldAskLiveDelivery('running', LIVE_DELIVERY_UNKNOWN)).toBe(true);
+  });
+});
diff --git a/apps/staged/src/lib/features/sessions/liveDelivery.ts b/apps/staged/src/lib/features/sessions/liveDelivery.ts
new file mode 100644
index 000000000..2d7fbe1bc
--- /dev/null
+++ b/apps/staged/src/lib/features/sessions/liveDelivery.ts
@@ -0,0 +1,43 @@
+/**
+ * liveDelivery.ts — What the chat pane remembers about whether a running
+ * session can take a message now, and when it asks the backend again.
+ *
+ * The backend answers `get_session_live_delivery` from a registry lookup, so
+ * asking is cheap, but asking at every poll tick for a whole run is pointless
+ * when the answer cannot change: a session another Staged instance owns never
+ * gets a connection in this process. The backend marks such a "no" as not
+ * `retryable`; a "no" while the connection is still coming up is. The pane
+ * asks until it has a yes or a non-retryable no, and forgets everything when
+ * the status moves or the pane shows a different session.
+ */
+import type { SessionLiveDelivery, SessionStatus } from '../../types';
+
+export interface LiveDeliveryKnowledge {
+  /** The backend said the running session can take a message now. */
+  supported: boolean;
+  /**
+   * Nothing to ask until the status moves: a yes, or a no that cannot change
+   * during this run. False means the next poll tick asks (again).
+   */
+  settled: boolean;
+}
+
+/** Nothing known yet: the next tick while running asks. */
+export const LIVE_DELIVERY_UNKNOWN: LiveDeliveryKnowledge = Object.freeze({
+  supported: false,
+  settled: false,
+});
+
+/** Whether this poll tick should ask the backend. */
+export function shouldAskLiveDelivery(
+  status: SessionStatus | undefined,
+  knowledge: LiveDeliveryKnowledge
+): boolean {
+  return status === 'running' && !knowledge.settled;
+}
+
+/** What to remember from the backend's answer. */
+export function liveDeliveryKnowledge(capability: SessionLiveDelivery): LiveDeliveryKnowledge {
+  if (capability.supported) return { supported: true, settled: true };
+  return { supported: false, settled: !capability.retryable };
+}
diff --git a/apps/staged/src/lib/types.ts b/apps/staged/src/lib/types.ts
index e4d038da1..59cca3065 100644
--- a/apps/staged/src/lib/types.ts
+++ b/apps/staged/src/lib/types.ts
@@ -681,10 +681,23 @@ export interface SessionPoll {
  */
 export interface SessionLiveDelivery {
   supported: boolean;
+  /**
+   * When `supported` is false, whether asking again while the session stays
+   * running could get a yes: true while the agent's connection is still coming
+   * up, false when another Staged instance owns the session or it is not
+   * running. Always false when `supported` is true.
+   */
+  retryable: boolean;
   reason?: string;
 }
 
-/** How `send_session_message_now` delivered a message, or why it did not. */
+/**
+ * How `send_session_message_now` delivered a message, or why it did not.
+ * Mirrors the Rust `ContinueOutcome::delivery()` spellings, which the
+ * `continue_repo_session` MCP tool shares; `resumed` and `not_resumable` are
+ * only reached through the tool, since the command never resumes a stopped
+ * session (it answers `not_running` instead).
+ */
 export type SessionMessageDeliveryKind =
   | 'injected'
   | 'interrupted_and_reprompted'
@@ -692,11 +705,15 @@ export type SessionMessageDeliveryKind =
   | 'resumed'
   | 'rejected_queued'
   | 'blocked'
-  | 'not_resumable';
+  | 'not_resumable'
+  | 'not_running';
 
 export interface SessionMessageDelivery {
   delivery: SessionMessageDeliveryKind;
-  /** Set when the message was not delivered (`blocked`, `not_resumable`). */
+  /**
+   * Set when the message was not delivered (`blocked`, `not_resumable`,
+   * `not_running`).
+   */
   reason?: string;
 }
 

From 5f3e1b11479d67a7419505eaef56b68d2e6c6b19 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Sun, 1 Nov 2026 12:15:40 +1100
Subject: [PATCH 3/9] fix(staged): restore the draft when the send-now fallback
 resume fails
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to 7c8431da. When `send_session_message_now` answers
`not_running`, the chat pane falls back to `sendMessage`, the idle resume
path. That arm returned straight after the call, so a resume that failed —
the worktree is gone, or the queue drain re-ran the session between the
`not_running` answer and `resumeSession` and the backend refused an
already-running row — reported the error but lost the draft, unlike every
other non-delivered arm, which puts `inputText` and `replyImageIds` back.

`sendMessage` now resolves a boolean: true once the backend accepted the
message (even if the pane moved to another session meanwhile), false when
the guard refused or the resume threw, having set `error`. The
`not_running` arm returns on true and otherwise breaks to the shared draft
restore, which does not touch `error`, so the reason stays visible. The
idle path in `handleSend` restores the draft on false the same way; the
"Continue where you left off" button and the note follow-up ignore the
result, having no draft to restore.

The `not_resumable` arm is unreachable from the command (the `Refuse`
policy returns before the resume gate) and is kept with a comment saying
it is defensive, since the shared TS union still spells the kind.

No pure helper changed, so no vitest was added; `pnpm check` and the full
vitest suite pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 .../features/sessions/SessionChatPane.svelte  | 38 ++++++++++++++-----
 1 file changed, 29 insertions(+), 9 deletions(-)

diff --git a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
index 0a0d37d59..7e208df12 100644
--- a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
+++ b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
@@ -1304,8 +1304,12 @@
       return;
     }
 
-    // Session is idle — send immediately
-    await sendMessage(text, imageIdsToSend);
+    // Session is idle — send immediately. `sendMessage` reports the failure
+    // itself; the draft goes back in the box so it can be retried.
+    if (!(await sendMessage(text, imageIdsToSend))) {
+      inputText = text;
+      replyImageIds = imageIdsToSend ?? [];
+    }
   }
 
   /**
@@ -1351,10 +1355,13 @@
         case 'not_running':
           // Stopped since the last poll: resume it the way the idle composer
           // does, with the branch override and follow-up config. `sending` is
-          // already held here, so the lock is passed through.
+          // already held here, so the lock is passed through. A resume that
+          // fails (worktree gone, or the queue drain re-ran the session first
+          // so the row is already running) has set `error`; fall through to
+          // the draft restore below without overwriting it.
           liveDelivery = LIVE_DELIVERY_UNKNOWN;
-          await sendMessage(text, imageIds, true);
-          return;
+          if (await sendMessage(text, imageIds, true)) return;
+          break;
         case 'rejected_queued':
           error = 'The session has not started yet; queue the message instead.';
           break;
@@ -1365,6 +1372,9 @@
           error = `Not delivered: ${result.reason ?? result.delivery}`;
           break;
         case 'not_resumable':
+          // Defensive: the command refuses a stopped session before the
+          // resume gate (`not_running`), so this kind only reaches the MCP
+          // tool. Kept because the shared union still spells it.
           error = `Not delivered: ${result.reason ?? result.delivery}`;
           break;
         default: {
@@ -1386,23 +1396,31 @@
     }
   }
 
-  /** Actually send a message to the backend and start the agent. */
+  /**
+   * Actually send a message to the backend and start the agent. Resolves
+   * `true` once the backend accepted the message (even if the pane has moved
+   * to another session since), `false` when nothing was sent: the guard
+   * refused, or the resume failed — in which case `error` says why and the
+   * caller decides whether to restore its draft.
+   */
   async function sendMessage(
     text: string,
     imageIds?: string[],
     sendingLocked = false,
     target: SendMessageTarget | null = null
-  ) {
+  ): Promise<boolean> {
     const targetSessionId = target?.sessionId ?? session?.id;
     const targetBranchId = target ? target.branchId : (branchId ?? null);
-    if (!targetSessionId || session?.id !== targetSessionId || (!sendingLocked && sending)) return;
+    if (!targetSessionId || session?.id !== targetSessionId || (!sendingLocked && sending)) {
+      return false;
+    }
     if (!sendingLocked) sending = true;
     error = null;
     const acpConfigSelection: AcpConfigSelection | undefined =
       followupAcpConfigSelection ?? undefined;
     try {
       await resumeSession(targetSessionId, text, imageIds, targetBranchId, acpConfigSelection);
-      if (session?.id !== targetSessionId) return;
+      if (session?.id !== targetSessionId) return true;
       // Backend sets status to running and emits an event.
       // Force an immediate poll to pick up the new user message + status.
       session = {
@@ -1421,8 +1439,10 @@
       modelSpecificFollowupSessionId = null;
       startPolling();
       scrollToBottom();
+      return true;
     } catch (e) {
       error = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
+      return false;
     } finally {
       if (!sendingLocked) sending = false;
     }

From d5bdcb437a7ffeccae05a8a3209563c167b0e812 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Sun, 1 Nov 2026 12:19:33 +1100
Subject: [PATCH 4/9] fix(staged): say why a send was refused while the session
 is still loading
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Follow-up to 5f3e1b11. `sendMessage`'s doc comment promised that `error`
says why whenever it resolves `false`, but the guard-refusal branch set
nothing. The no-session case is reachable: Cmd+Enter before the session
row has loaded went through `handleSend`, which restored the draft in
silence. That case now sets `error` ("No session to send to yet"). The
other refusal — another send already holds `sending` — stays silent, since
the spinner already explains the wait, and the doc comment now states
exactly that guarantee.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 .../lib/features/sessions/SessionChatPane.svelte    | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
index 7e208df12..083f23ee6 100644
--- a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
+++ b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
@@ -1399,9 +1399,10 @@
   /**
    * Actually send a message to the backend and start the agent. Resolves
    * `true` once the backend accepted the message (even if the pane has moved
-   * to another session since), `false` when nothing was sent: the guard
-   * refused, or the resume failed — in which case `error` says why and the
-   * caller decides whether to restore its draft.
+   * to another session since), `false` when nothing was sent, and the caller
+   * decides whether to restore its draft. `error` says why on `false` in
+   * every case but one: when another send already holds `sending`, nothing is
+   * written, since the spinner already explains the wait.
    */
   async function sendMessage(
     text: string,
@@ -1411,9 +1412,13 @@
   ): Promise<boolean> {
     const targetSessionId = target?.sessionId ?? session?.id;
     const targetBranchId = target ? target.branchId : (branchId ?? null);
-    if (!targetSessionId || session?.id !== targetSessionId || (!sendingLocked && sending)) {
+    if (!targetSessionId || session?.id !== targetSessionId) {
+      // Reachable from Cmd+Enter while the session is still loading, or when
+      // the pane moved on before a targeted send ran.
+      error = 'No session to send to yet; try again in a moment.';
       return false;
     }
+    if (!sendingLocked && sending) return false;
     if (!sendingLocked) sending = true;
     error = null;
     const acpConfigSelection: AcpConfigSelection | undefined =

From 0a6bbe50456b72a66e7679b3997bd3308b15e32b Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Sun, 1 Nov 2026 14:44:55 +1100
Subject: [PATCH 5/9] fix(staged): disable the composer while the session loads
 and show send failures beside it
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes scenario 8 of the manual QA of the Queue / Send composer. d5bdcb43
made `sendMessage` set `error` to "No session to send to yet" when Cmd+Enter
ran before the session row had loaded. That text lives in the transcript
slot behind `{#if loading}`, so it was invisible exactly while it applied,
and once `loadSession` finished the stale error replaced the whole
transcript with a red banner until the next send cleared it.

Submit is disabled while the row loads. `ChatComposer` takes `loading`; the
pane passes `loading || !session`. The submit control (and the split
button's mode menu) is disabled with the same styling it uses while
`sending`, titled "Loading session…", and `handleSend` returns before it
takes the draft out of the box, so Cmd+Enter is a no-op that keeps the
draft. Typing during load is unchanged. The decision is the pure
`composerSubmitBlock` helper in `composerSendControl.ts` (loading wins over
sending over an empty draft, since it is the only block the control's own
label does not explain), covered by vitest. `sendMessage`'s no-session guard
stays as a defensive branch returning `false`, but sets nothing: with
submit disabled its other trigger is a targeted send whose pane has moved
on, and a message there would be about a session the pane no longer shows.

Composer-level failures move out of the transcript slot. Every failure of
an action that starts at the composer — "Failed to send", "Not delivered",
the `rejected_queued` text, "Failed to queue", the queued-message send and
remove failures, and "Failed to cancel" — used to go into `error`, which
replaces the transcript with a centered card and, via `reopenMode`, turns
the next reopen into a full reload. They now go into a pane-local
`sendError`, rendered by `ChatComposer` as a `role="alert"` line above the
input, sharing the attachment error's style (renamed `.composer-error`).
It is cleared when the next composer action starts (so a successful send
dismisses it), when the draft is edited, and when the pane moves to another
session. Starting an action also clears a stale load `error`, as the send
paths did before, so a transcript retained across a failed reopen comes
back on the next send.

With that, `loadSession` is the only writer of `error` apart from the
shared clear, so a successful load can no longer leave a pre-load error on
screen: nothing can set one before the row has loaded.

Tests: `composerSubmitBlock` for loading / sending / empty / allowed.
`pnpm check` and the full vitest suite (1718 tests) pass; no Rust touched.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 .../lib/features/sessions/ChatComposer.svelte | 43 +++++++--
 .../features/sessions/SessionChatPane.svelte  | 89 ++++++++++++++-----
 .../sessions/composerSendControl.test.ts      | 20 +++++
 .../features/sessions/composerSendControl.ts  | 36 ++++++++
 4 files changed, 157 insertions(+), 31 deletions(-)

diff --git a/apps/staged/src/lib/features/sessions/ChatComposer.svelte b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
index d8afd452d..cf6e1e05b 100644
--- a/apps/staged/src/lib/features/sessions/ChatComposer.svelte
+++ b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
@@ -11,7 +11,13 @@
   session, a plain "Queue" on a running one — and, when the backend reports
   the running session can take a message now (`canSendLive`), a split button
   whose primary segment performs the remembered mode (Queue / Send) and whose
-  dropdown switches it.
+  dropdown switches it. While the session row is still loading the control
+  is disabled (titled "Loading session…") but the draft can be typed.
+
+  Failures of the composer's own actions (`sendError`: a refused send, a
+  queue change that failed) are shown on a line inside the composer, next to
+  the attachment error, rather than in the pane's transcript slot — the
+  transcript stays readable behind them.
 -->
 <script lang="ts" module>
   // min-h instead of h so the vertical model/effort label can grow the button.
@@ -37,8 +43,10 @@
   import * as DropdownMenu from '$lib/components/ui/dropdown-menu';
   import { cn } from '$lib/components/utils';
   import {
+    COMPOSER_LOADING_TITLE,
     COMPOSER_SEND_MODE_OPTIONS,
     composerSendControl,
+    composerSubmitBlock,
     type ComposerSendMode,
   } from './composerSendControl';
   import { ATTACHMENT_ACCEPT } from './attachErrors';
@@ -78,6 +86,17 @@
     /** The user picked a mode from the split button's menu. */
     onSendModeChange?: (mode: ComposerSendMode) => void;
     sending?: boolean;
+    /**
+     * The session row has not loaded yet: submit is disabled (and Cmd+Enter
+     * is the parent's no-op) while the draft can still be typed.
+     */
+    loading?: boolean;
+    /**
+     * Why the last composer action failed (send refused, queue change
+     * failed), shown inline until the parent clears it — on the next
+     * successful action or when the draft is edited.
+     */
+    sendError?: string | null;
     onSend?: () => void;
     /** Agent config picker rendered at the start of the control row. */
     configPicker?: Snippet;
@@ -101,6 +120,8 @@
     sendMode = 'queue',
     onSendModeChange,
     sending = false,
+    loading = false,
+    sendError = null,
     onSend,
     configPicker,
   }: Props = $props();
@@ -108,7 +129,11 @@
   let fileInputEl = $state<HTMLInputElement>();
 
   let sendControl = $derived(composerSendControl({ isLive, canSendLive, mode: sendMode }));
-  let sendDisabled = $derived(sending || !value.trim());
+  let submitBlock = $derived(
+    composerSubmitBlock({ loading, sending, hasText: value.trim().length > 0 })
+  );
+  let sendDisabled = $derived(submitBlock !== null);
+  let sendTitle = $derived(submitBlock === 'loading' ? COMPOSER_LOADING_TITLE : sendControl.title);
 
   function handleSendModeChange(value: string) {
     if (value === 'queue' || value === 'send') onSendModeChange?.(value);
@@ -149,7 +174,10 @@
     </div>
   {/if}
   {#if canAttachImages && attachError}
-    <p class="attach-error" role="alert">{attachError}</p>
+    <p class="composer-error" role="alert">{attachError}</p>
+  {/if}
+  {#if sendError}
+    <p class="composer-error" role="alert">{sendError}</p>
   {/if}
   <HashtagInput
     bind:textareaEl
@@ -186,7 +214,7 @@
       </span>
     {/if}
     {#if sendControl.split}
-      <span class="inline-flex composer-send composer-send-split" title={sendControl.title}>
+      <span class="inline-flex composer-send composer-send-split" title={sendTitle}>
         <Button
           variant="accent"
           class="composer-send-primary h-auto min-h-9 gap-1.5 rounded-r-none px-4 py-1 text-sm max-[640px]:min-h-11"
@@ -203,7 +231,7 @@
             )}
             title="Change how messages are delivered"
             aria-label="Change how messages are delivered"
-            disabled={sending}
+            disabled={sending || loading}
           >
             <ChevronDown size={14} />
           </DropdownMenu.Trigger>
@@ -222,7 +250,7 @@
         </DropdownMenu.Root>
       </span>
     {:else}
-      <span class="inline-flex composer-send" title={sendControl.title}>
+      <span class="inline-flex composer-send" title={sendTitle}>
         <Button
           variant="accent"
           class="h-auto min-h-9 gap-1.5 px-4 py-1 text-sm max-[640px]:min-h-11"
@@ -269,7 +297,8 @@
     flex-wrap: wrap;
   }
 
-  .attach-error {
+  /* Attachment and send failures share one line style. */
+  .composer-error {
     margin: 0;
     font-size: var(--size-sm);
     color: var(--ui-danger);
diff --git a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
index 083f23ee6..795c82d76 100644
--- a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
+++ b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
@@ -950,6 +950,8 @@
       hasOlderMessages = false;
       acpMetadataMessages = [];
       queuedMessages = [];
+      // A failure line is about the session that was shown when it happened.
+      sendError = null;
     }
     loading = true;
     error = null;
@@ -1270,8 +1272,36 @@
 
   let sending = $state(false);
   let noteFollowupSending = $state(false);
+  /**
+   * Why the last composer action failed (a refused or failed send, a queue
+   * change or cancel that failed). Shown on a line inside the composer, not in
+   * `error`: that state replaces the whole transcript with a centered card,
+   * which hides the very conversation the user is trying to continue, and
+   * (see `reopenMode`) would turn the next reopen into a full reload.
+   * Cleared when the next action starts, when the draft is edited, and when
+   * the pane moves to another session.
+   */
+  let sendError = $state<string | null>(null);
+
+  /**
+   * A composer action is starting: drop the previous action's failure line,
+   * and a stale load error with it — the action's outcome is what the pane
+   * should show now, and the poll a successful one starts refreshes the
+   * transcript anyway.
+   */
+  function beginComposerAction() {
+    sendError = null;
+    error = null;
+  }
+
+  /** The submit control is disabled until the session row has loaded. */
+  let composerLoading = $derived(loading || !session);
 
   async function handleSend() {
+    // Until the row has loaded there is nothing to send to; the control is
+    // disabled, and Cmd+Enter keeps the draft rather than taking it out of
+    // the box only to put it back.
+    if (composerLoading) return;
     // A send still in flight (a live send can take a few seconds: steer
     // acknowledgement, interrupt-and-reprompt, or a resume) owns the composer
     // until it settles; a second Cmd+Enter meanwhile must not clear the draft
@@ -1293,11 +1323,12 @@
     }
 
     if (isLive) {
+      beginComposerAction();
       try {
         await queueSessionMessage(sessionId, text, imageIdsToSend, branchId ?? null);
         await refreshQueuedMessages();
       } catch (e) {
-        error = `Failed to queue: ${e instanceof Error ? e.message : String(e)}`;
+        sendError = `Failed to queue: ${e instanceof Error ? e.message : String(e)}`;
         inputText = text;
         replyImageIds = imageIdsToSend ?? [];
       }
@@ -1329,7 +1360,7 @@
     if (!session || sending) return;
     const id = session.id;
     sending = true;
-    error = null;
+    beginComposerAction();
     try {
       const result = await sendSessionMessageNow(id, text, imageIds);
       if (session?.id !== id) return;
@@ -1357,38 +1388,38 @@
           // does, with the branch override and follow-up config. `sending` is
           // already held here, so the lock is passed through. A resume that
           // fails (worktree gone, or the queue drain re-ran the session first
-          // so the row is already running) has set `error`; fall through to
-          // the draft restore below without overwriting it.
+          // so the row is already running) has set `sendError`; fall through
+          // to the draft restore below without overwriting it.
           liveDelivery = LIVE_DELIVERY_UNKNOWN;
           if (await sendMessage(text, imageIds, true)) return;
           break;
         case 'rejected_queued':
-          error = 'The session has not started yet; queue the message instead.';
+          sendError = 'The session has not started yet; queue the message instead.';
           break;
         case 'blocked':
           // The connection may have gone under the request: ask again before
           // offering "Send" next time.
           liveDelivery = LIVE_DELIVERY_UNKNOWN;
-          error = `Not delivered: ${result.reason ?? result.delivery}`;
+          sendError = `Not delivered: ${result.reason ?? result.delivery}`;
           break;
         case 'not_resumable':
           // Defensive: the command refuses a stopped session before the
           // resume gate (`not_running`), so this kind only reaches the MCP
           // tool. Kept because the shared union still spells it.
-          error = `Not delivered: ${result.reason ?? result.delivery}`;
+          sendError = `Not delivered: ${result.reason ?? result.delivery}`;
           break;
         default: {
           // A delivery kind the backend added that this hand-maintained union
           // does not know: say so rather than restoring the draft in silence.
           const unknownKind: never = result.delivery;
-          error = `Not delivered: ${String(unknownKind)}`;
+          sendError = `Not delivered: ${String(unknownKind)}`;
           break;
         }
       }
       inputText = text;
       replyImageIds = imageIds ?? [];
     } catch (e) {
-      error = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
+      sendError = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
       inputText = text;
       replyImageIds = imageIds ?? [];
     } finally {
@@ -1400,9 +1431,11 @@
    * Actually send a message to the backend and start the agent. Resolves
    * `true` once the backend accepted the message (even if the pane has moved
    * to another session since), `false` when nothing was sent, and the caller
-   * decides whether to restore its draft. `error` says why on `false` in
-   * every case but one: when another send already holds `sending`, nothing is
-   * written, since the spinner already explains the wait.
+   * decides whether to restore its draft. `sendError` says why on `false` in
+   * every case but two: when nothing could be targeted (defensive — the
+   * composer is disabled until the row has loaded, and a targeted send checks
+   * its target before calling), and when another send already holds
+   * `sending`, since the spinner already explains the wait.
    */
   async function sendMessage(
     text: string,
@@ -1413,14 +1446,14 @@
     const targetSessionId = target?.sessionId ?? session?.id;
     const targetBranchId = target ? target.branchId : (branchId ?? null);
     if (!targetSessionId || session?.id !== targetSessionId) {
-      // Reachable from Cmd+Enter while the session is still loading, or when
-      // the pane moved on before a targeted send ran.
-      error = 'No session to send to yet; try again in a moment.';
+      // The row is not loaded, or the pane moved on before a targeted send
+      // ran. Nothing is said: a message here would be about a session this
+      // pane no longer shows.
       return false;
     }
     if (!sendingLocked && sending) return false;
     if (!sendingLocked) sending = true;
-    error = null;
+    beginComposerAction();
     const acpConfigSelection: AcpConfigSelection | undefined =
       followupAcpConfigSelection ?? undefined;
     try {
@@ -1446,7 +1479,7 @@
       scrollToBottom();
       return true;
     } catch (e) {
-      error = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
+      sendError = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
       return false;
     } finally {
       if (!sendingLocked) sending = false;
@@ -1459,7 +1492,7 @@
     const hasParsedNote = noteInfo.hasParsedNote;
     sending = true;
     noteFollowupSending = true;
-    error = null;
+    beginComposerAction();
     try {
       const prompt = await buildNoteFollowupMessage(
         target.sessionId,
@@ -1469,7 +1502,7 @@
       if (session?.id !== target.sessionId || (branchId ?? null) !== target.branchId) return;
       await sendMessage(prompt, undefined, true, target);
     } catch (e) {
-      error = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
+      sendError = `Failed to send: ${e instanceof Error ? e.message : String(e)}`;
     } finally {
       noteFollowupSending = false;
       sending = false;
@@ -1483,7 +1516,7 @@
       await deleteQueuedSessionMessage(id);
       await refreshQueuedMessages();
     } catch (e) {
-      error = `Failed to remove queued message: ${e instanceof Error ? e.message : String(e)}`;
+      sendError = `Failed to remove queued message: ${e instanceof Error ? e.message : String(e)}`;
     } finally {
       const next = new Set(queueActionIds);
       next.delete(id);
@@ -1494,7 +1527,7 @@
   async function handleSendQueuedMessage(id: string) {
     if (isLive || sending || queueActionIds.has(id)) return;
     queueActionIds = new Set(queueActionIds).add(id);
-    error = null;
+    beginComposerAction();
     try {
       await sendQueuedSessionMessage(id);
       await refreshQueuedMessages();
@@ -1504,7 +1537,7 @@
       startPolling();
       scrollToBottom();
     } catch (e) {
-      error = `Failed to send queued message: ${e instanceof Error ? e.message : String(e)}`;
+      sendError = `Failed to send queued message: ${e instanceof Error ? e.message : String(e)}`;
       await refreshQueuedMessages();
     } finally {
       const next = new Set(queueActionIds);
@@ -1519,7 +1552,7 @@
     try {
       await cancelSession(session.id);
     } catch (e) {
-      error = `Failed to cancel: ${e instanceof Error ? e.message : String(e)}`;
+      sendError = `Failed to cancel: ${e instanceof Error ? e.message : String(e)}`;
     } finally {
       cancelling = false;
     }
@@ -1602,6 +1635,12 @@
     }
   }
 
+  /** The draft changed: the last failure line has been read, so drop it. */
+  function handleInput() {
+    sendError = null;
+    autoResize();
+  }
+
   function autoResize() {
     if (!inputEl) return;
     inputEl.style.height = 'auto';
@@ -3027,7 +3066,7 @@
         placeholder={sendControl.placeholder}
         {hashtagItems}
         onkeydown={handleInputKeydown}
-        oninput={autoResize}
+        oninput={handleInput}
         {canAttachImages}
         attachedImageIds={replyImageIds}
         {imagePreviews}
@@ -3039,6 +3078,8 @@
         sendMode={preferences.composerSendMode}
         onSendModeChange={setComposerSendMode}
         {sending}
+        loading={composerLoading}
+        {sendError}
         onSend={handleSend}
       >
         {#snippet configPicker()}
diff --git a/apps/staged/src/lib/features/sessions/composerSendControl.test.ts b/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
index c83ef27ff..b73713846 100644
--- a/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
+++ b/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
@@ -2,6 +2,7 @@ import { describe, expect, it } from 'vitest';
 import {
   COMPOSER_SEND_MODE_OPTIONS,
   composerSendControl,
+  composerSubmitBlock,
   normalizeComposerSendMode,
 } from './composerSendControl';
 
@@ -55,3 +56,22 @@ describe('composerSendControl', () => {
     expect(COMPOSER_SEND_MODE_OPTIONS.map((o) => o.mode)).toEqual(['queue', 'send']);
   });
 });
+
+describe('composerSubmitBlock', () => {
+  it('disables submit while the session row is loading, whatever the draft holds', () => {
+    expect(composerSubmitBlock({ loading: true, sending: false, hasText: true })).toBe('loading');
+    expect(composerSubmitBlock({ loading: true, sending: false, hasText: false })).toBe('loading');
+    // Loading explains the block better than a spinner that is not spinning.
+    expect(composerSubmitBlock({ loading: true, sending: true, hasText: true })).toBe('loading');
+  });
+
+  it('disables submit while a send is in flight', () => {
+    expect(composerSubmitBlock({ loading: false, sending: true, hasText: true })).toBe('sending');
+    expect(composerSubmitBlock({ loading: false, sending: true, hasText: false })).toBe('sending');
+  });
+
+  it('disables submit on an empty draft and otherwise allows it', () => {
+    expect(composerSubmitBlock({ loading: false, sending: false, hasText: false })).toBe('empty');
+    expect(composerSubmitBlock({ loading: false, sending: false, hasText: true })).toBeNull();
+  });
+});
diff --git a/apps/staged/src/lib/features/sessions/composerSendControl.ts b/apps/staged/src/lib/features/sessions/composerSendControl.ts
index 2d7ebf2f4..a29610a7b 100644
--- a/apps/staged/src/lib/features/sessions/composerSendControl.ts
+++ b/apps/staged/src/lib/features/sessions/composerSendControl.ts
@@ -83,6 +83,42 @@ export function composerSendControl({
   };
 }
 
+/** Why the submit control is disabled, or `null` when it can be pressed. */
+export type ComposerSubmitBlock =
+  /** The session row has not loaded yet; the draft can be typed meanwhile. */
+  | 'loading'
+  /** A send is in flight and owns the composer until it settles. */
+  | 'sending'
+  /** Nothing to send. */
+  | 'empty';
+
+export interface ComposerSubmitBlockInput {
+  loading: boolean;
+  sending: boolean;
+  /** The draft has non-whitespace text. */
+  hasText: boolean;
+}
+
+/**
+ * Whether the composer's submit control is disabled, and why. `loading` wins
+ * because it is the only block the label does not already explain (the
+ * spinner covers `sending`, the empty box covers `empty`), so it gets a
+ * hover title of its own: `COMPOSER_LOADING_TITLE`.
+ */
+export function composerSubmitBlock({
+  loading,
+  sending,
+  hasText,
+}: ComposerSubmitBlockInput): ComposerSubmitBlock | null {
+  if (loading) return 'loading';
+  if (sending) return 'sending';
+  if (!hasText) return 'empty';
+  return null;
+}
+
+/** Hover title for the submit control while the session row is loading. */
+export const COMPOSER_LOADING_TITLE = 'Loading session…';
+
 /** Menu entries for the mode dropdown, in display order. */
 export const COMPOSER_SEND_MODE_OPTIONS: readonly {
   mode: ComposerSendMode;

From f0534a8f2aca0b98a952d394f6d66b83eabf07c1 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Sun, 1 Nov 2026 15:02:42 +1100
Subject: [PATCH 6/9] fix(staged): keep composer failures visible and name why
 submit is disabled
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Closes the three leftovers from the review of 0a6bbe50 and the targeted QA
re-run, all in the chat pane and its composer.

A failed Stop was invisible. While a workflow runs with no transcript yet
(`isPipelineRunning && grouped.length === 0`) the pipeline stop area stands
in for `ChatComposer`, so a `cancelSession` failure set `sendError` on a
component that was not mounted. The error line is now its own
`ComposerError` component (same markup, `role="alert"`, same danger style),
rendered by the composer for the attachment and send errors and by the stop
area above its button, which becomes a column so the line sits over the
right-aligned Stop.

Stale lines. `handleCancel` and `handleDeleteQueuedMessage` now call
`beginComposerAction()` after their guards, as `handleSendQueuedMessage`
does, so a successful cancel or remove drops the previous failure line and
a repeated identical failure remounts it (and is announced again).
Attaching, dropping, or removing an image is treated as a draft edit and
clears `sendError` alongside `attachError`.

Disabled title after a failed load. The composer's `loading` prop was the
pane's `loading || !session`, so once `getSession` threw or answered
"Session not found" the control stayed disabled titled "Loading session…"
while the transcript card said the load had failed. The prop is now
`sessionBlock: 'loading' | 'unavailable' | null`, computed by the pure
`composerSessionBlock` (loading wins while the fetch is in flight, since a
reopen keeps the row null until it settles; a settled fetch with no row is
"unavailable"). `composerSubmitBlock` takes it in place of the boolean and
`composerSubmitBlockTitle` gives "Loading session…" or "Session
unavailable", leaving the Send / Queue title alone for blocks the control
already explains. `handleSend` returns on any session block, as before.

Left alone, as requested: the one-poll-tick "Queue" flicker after a failed
`not_running` fallback, which is correct in the real race.

Tests: `composerSessionBlock` for loading / unavailable / loaded,
`composerSubmitBlock` for the new input, and the block titles. `pnpm check`
and the full vitest suite (1724 tests) pass; no Rust touched.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 .../lib/features/sessions/ChatComposer.svelte | 46 ++++++-------
 .../features/sessions/ComposerError.svelte    | 33 ++++++++++
 .../features/sessions/SessionChatPane.svelte  | 47 +++++++++----
 .../sessions/composerSendControl.test.ts      | 64 ++++++++++++++++--
 .../features/sessions/composerSendControl.ts  | 66 ++++++++++++++++---
 5 files changed, 203 insertions(+), 53 deletions(-)
 create mode 100644 apps/staged/src/lib/features/sessions/ComposerError.svelte

diff --git a/apps/staged/src/lib/features/sessions/ChatComposer.svelte b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
index cf6e1e05b..70f34f4b3 100644
--- a/apps/staged/src/lib/features/sessions/ChatComposer.svelte
+++ b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
@@ -11,13 +11,14 @@
   session, a plain "Queue" on a running one — and, when the backend reports
   the running session can take a message now (`canSendLive`), a split button
   whose primary segment performs the remembered mode (Queue / Send) and whose
-  dropdown switches it. While the session row is still loading the control
-  is disabled (titled "Loading session…") but the draft can be typed.
+  dropdown switches it. While the pane has no session row to submit to
+  (`sessionBlock`: still loading, or the load settled without one) the
+  control is disabled with a title saying which, but the draft can be typed.
 
   Failures of the composer's own actions (`sendError`: a refused send, a
-  queue change that failed) are shown on a line inside the composer, next to
-  the attachment error, rather than in the pane's transcript slot — the
-  transcript stays readable behind them.
+  queue change that failed) are shown on a `ComposerError` line inside the
+  composer, next to the attachment error, rather than in the pane's
+  transcript slot — the transcript stays readable behind them.
 -->
 <script lang="ts" module>
   // min-h instead of h so the vertical model/effort label can grow the button.
@@ -43,14 +44,16 @@
   import * as DropdownMenu from '$lib/components/ui/dropdown-menu';
   import { cn } from '$lib/components/utils';
   import {
-    COMPOSER_LOADING_TITLE,
     COMPOSER_SEND_MODE_OPTIONS,
     composerSendControl,
     composerSubmitBlock,
+    composerSubmitBlockTitle,
     type ComposerSendMode,
+    type ComposerSessionBlock,
   } from './composerSendControl';
   import { ATTACHMENT_ACCEPT } from './attachErrors';
   import AttachmentThumb from './AttachmentThumb.svelte';
+  import ComposerError from './ComposerError.svelte';
   import type { AttachmentPreview } from './attachmentPreview';
   import HashtagInput from './HashtagInput.svelte';
   import type { HashtagItem } from '../../types';
@@ -87,10 +90,12 @@
     onSendModeChange?: (mode: ComposerSendMode) => void;
     sending?: boolean;
     /**
-     * The session row has not loaded yet: submit is disabled (and Cmd+Enter
-     * is the parent's no-op) while the draft can still be typed.
+     * Why there is no session row to submit to — still loading, or the load
+     * settled without one — or `null` once the row is in. While set, submit
+     * is disabled with a title saying which (and Cmd+Enter is the parent's
+     * no-op) while the draft can still be typed.
      */
-    loading?: boolean;
+    sessionBlock?: ComposerSessionBlock | null;
     /**
      * Why the last composer action failed (send refused, queue change
      * failed), shown inline until the parent clears it — on the next
@@ -120,7 +125,7 @@
     sendMode = 'queue',
     onSendModeChange,
     sending = false,
-    loading = false,
+    sessionBlock = null,
     sendError = null,
     onSend,
     configPicker,
@@ -130,10 +135,10 @@
 
   let sendControl = $derived(composerSendControl({ isLive, canSendLive, mode: sendMode }));
   let submitBlock = $derived(
-    composerSubmitBlock({ loading, sending, hasText: value.trim().length > 0 })
+    composerSubmitBlock({ sessionBlock, sending, hasText: value.trim().length > 0 })
   );
   let sendDisabled = $derived(submitBlock !== null);
-  let sendTitle = $derived(submitBlock === 'loading' ? COMPOSER_LOADING_TITLE : sendControl.title);
+  let sendTitle = $derived(composerSubmitBlockTitle(submitBlock) ?? sendControl.title);
 
   function handleSendModeChange(value: string) {
     if (value === 'queue' || value === 'send') onSendModeChange?.(value);
@@ -173,12 +178,10 @@
       {/each}
     </div>
   {/if}
-  {#if canAttachImages && attachError}
-    <p class="composer-error" role="alert">{attachError}</p>
-  {/if}
-  {#if sendError}
-    <p class="composer-error" role="alert">{sendError}</p>
+  {#if canAttachImages}
+    <ComposerError message={attachError} />
   {/if}
+  <ComposerError message={sendError} />
   <HashtagInput
     bind:textareaEl
     bind:value
@@ -231,7 +234,7 @@
             )}
             title="Change how messages are delivered"
             aria-label="Change how messages are delivered"
-            disabled={sending || loading}
+            disabled={sending || sessionBlock !== null}
           >
             <ChevronDown size={14} />
           </DropdownMenu.Trigger>
@@ -297,13 +300,6 @@
     flex-wrap: wrap;
   }
 
-  /* Attachment and send failures share one line style. */
-  .composer-error {
-    margin: 0;
-    font-size: var(--size-sm);
-    color: var(--ui-danger);
-  }
-
   .reply-image-thumb {
     position: relative;
     width: 48px;
diff --git a/apps/staged/src/lib/features/sessions/ComposerError.svelte b/apps/staged/src/lib/features/sessions/ComposerError.svelte
new file mode 100644
index 000000000..1c0ae038b
--- /dev/null
+++ b/apps/staged/src/lib/features/sessions/ComposerError.svelte
@@ -0,0 +1,33 @@
+<!--
+  ComposerError.svelte — One failure line for the chat composer area.
+
+  Shows why the last composer action failed (a refused send, a queue change,
+  an attachment the pane rejected) in the composer's own danger style, as a
+  live region so it is announced when it appears. Rendered by ChatComposer
+  for the attachment and send errors, and by SessionChatPane in the
+  pipeline-stop area that replaces the composer while a workflow runs with
+  no transcript yet, so a failed Stop is visible there too.
+
+  Renders nothing when `message` is null. The parent clears the message when
+  the next action starts, so a repeated identical failure remounts the line
+  and is announced again.
+-->
+<script lang="ts">
+  interface Props {
+    message: string | null;
+  }
+
+  let { message }: Props = $props();
+</script>
+
+{#if message}
+  <p class="composer-error" role="alert">{message}</p>
+{/if}
+
+<style>
+  .composer-error {
+    margin: 0;
+    font-size: var(--size-sm);
+    color: var(--ui-danger);
+  }
+</style>
diff --git a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
index 795c82d76..ae8cee664 100644
--- a/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
+++ b/apps/staged/src/lib/features/sessions/SessionChatPane.svelte
@@ -104,7 +104,8 @@
     setComposerSendMode,
   } from '../settings/preferences.svelte';
   import ChatComposer, { composerControlClass } from './ChatComposer.svelte';
-  import { composerSendControl } from './composerSendControl';
+  import ComposerError from './ComposerError.svelte';
+  import { composerSendControl, composerSessionBlock } from './composerSendControl';
   import {
     LIVE_DELIVERY_UNKNOWN,
     liveDeliveryKnowledge,
@@ -602,6 +603,8 @@
   async function handleAttachFiles(files: File[]) {
     if (!projectId) return;
     attachError = null;
+    // Attaching is a draft edit: the last failure line has been read.
+    sendError = null;
     const rejections: AttachRejection[] = [];
     for (const file of files) {
       const reason = await addImageFile(file);
@@ -659,6 +662,8 @@
     imagePreviews = new Map(imagePreviews);
     imagePreviews.delete(imageId);
     attachError = null;
+    // Removing an attachment is a draft edit too.
+    sendError = null;
     deleteImage(imageId).catch((err) => {
       console.error('Failed to delete image:', err);
     });
@@ -675,6 +680,7 @@
     // Surface rejection reasons (signature, size) as paste does, reporting
     // the whole batch once so a later success cannot hide an earlier one.
     attachError = null;
+    sendError = null;
     const rejections: AttachRejection[] = [];
     for (const path of imagePaths) {
       try {
@@ -1278,8 +1284,9 @@
    * `error`: that state replaces the whole transcript with a centered card,
    * which hides the very conversation the user is trying to continue, and
    * (see `reopenMode`) would turn the next reopen into a full reload.
-   * Cleared when the next action starts, when the draft is edited, and when
-   * the pane moves to another session.
+   * Cleared when the next action starts, when the draft is edited (text,
+   * attachments), and when the pane moves to another session. Rendered by
+   * `ChatComposer`, or by the pipeline stop area that stands in for it.
    */
   let sendError = $state<string | null>(null);
 
@@ -1294,14 +1301,18 @@
     error = null;
   }
 
-  /** The submit control is disabled until the session row has loaded. */
-  let composerLoading = $derived(loading || !session);
+  /**
+   * Why the composer has no session row to submit to (loading, or the load
+   * settled without one), or `null`. The submit control is disabled while
+   * set, with a title saying which.
+   */
+  let composerBlock = $derived(composerSessionBlock({ loading, hasSession: session !== null }));
 
   async function handleSend() {
-    // Until the row has loaded there is nothing to send to; the control is
-    // disabled, and Cmd+Enter keeps the draft rather than taking it out of
-    // the box only to put it back.
-    if (composerLoading) return;
+    // Without a row there is nothing to send to; the control is disabled, and
+    // Cmd+Enter keeps the draft rather than taking it out of the box only to
+    // put it back.
+    if (composerBlock) return;
     // A send still in flight (a live send can take a few seconds: steer
     // acknowledgement, interrupt-and-reprompt, or a resume) owns the composer
     // until it settles; a second Cmd+Enter meanwhile must not clear the draft
@@ -1512,6 +1523,7 @@
   async function handleDeleteQueuedMessage(id: string) {
     if (queueActionIds.has(id)) return;
     queueActionIds = new Set(queueActionIds).add(id);
+    beginComposerAction();
     try {
       await deleteQueuedSessionMessage(id);
       await refreshQueuedMessages();
@@ -1549,6 +1561,7 @@
   async function handleCancel() {
     if (!session || cancelling) return;
     cancelling = true;
+    beginComposerAction();
     try {
       await cancelSession(session.id);
     } catch (e) {
@@ -2974,8 +2987,11 @@
   <!-- Input area with queued messages and image previews -->
   <div class="input-wrapper">
     {#if isPipelineRunning && grouped.length === 0}
+      <!-- Stands in for the composer, so it shows the composer's failure
+           line too: a failed Stop has nowhere else to appear. -->
       <div class="pipeline-stop-area">
-        <span class="inline-flex" title="Stop workflow">
+        <ComposerError message={sendError} />
+        <span class="inline-flex pipeline-stop-button" title="Stop workflow">
           <Button
             variant="destructive"
             size="sm"
@@ -3078,7 +3094,7 @@
         sendMode={preferences.composerSendMode}
         onSendModeChange={setComposerSendMode}
         {sending}
-        loading={composerLoading}
+        sessionBlock={composerBlock}
         {sendError}
         onSend={handleSend}
       >
@@ -3684,15 +3700,22 @@
 
   /* ----- Pipeline stop area ---------------------------------------------- */
 
+  /* Same chrome as .chat-composer: the error line (if any) above, the
+     button right-aligned beneath it. */
   .pipeline-stop-area {
     display: flex;
-    justify-content: flex-end;
+    flex-direction: column;
+    gap: 8px;
     padding: 10px 14px;
     border-top: 1px solid var(--border-subtle);
     background: var(--bg-chrome);
     flex-shrink: 0;
   }
 
+  .pipeline-stop-button {
+    align-self: flex-end;
+  }
+
   /* ======================================================================= */
   /* Markdown content (assistant messages)                                   */
   /* ======================================================================= */
diff --git a/apps/staged/src/lib/features/sessions/composerSendControl.test.ts b/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
index b73713846..fe12e810c 100644
--- a/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
+++ b/apps/staged/src/lib/features/sessions/composerSendControl.test.ts
@@ -1,8 +1,12 @@
 import { describe, expect, it } from 'vitest';
 import {
+  COMPOSER_LOADING_TITLE,
   COMPOSER_SEND_MODE_OPTIONS,
+  COMPOSER_UNAVAILABLE_TITLE,
   composerSendControl,
+  composerSessionBlock,
   composerSubmitBlock,
+  composerSubmitBlockTitle,
   normalizeComposerSendMode,
 } from './composerSendControl';
 
@@ -57,21 +61,67 @@ describe('composerSendControl', () => {
   });
 });
 
+describe('composerSessionBlock', () => {
+  it('reports loading while the fetch is in flight, with or without a stale row', () => {
+    expect(composerSessionBlock({ loading: true, hasSession: false })).toBe('loading');
+    expect(composerSessionBlock({ loading: true, hasSession: true })).toBe('loading');
+  });
+
+  it('reports unavailable once the fetch settled without a row', () => {
+    expect(composerSessionBlock({ loading: false, hasSession: false })).toBe('unavailable');
+  });
+
+  it('reports no block once the row is in', () => {
+    expect(composerSessionBlock({ loading: false, hasSession: true })).toBeNull();
+  });
+});
+
 describe('composerSubmitBlock', () => {
   it('disables submit while the session row is loading, whatever the draft holds', () => {
-    expect(composerSubmitBlock({ loading: true, sending: false, hasText: true })).toBe('loading');
-    expect(composerSubmitBlock({ loading: true, sending: false, hasText: false })).toBe('loading');
+    const sessionBlock = 'loading';
+    expect(composerSubmitBlock({ sessionBlock, sending: false, hasText: true })).toBe('loading');
+    expect(composerSubmitBlock({ sessionBlock, sending: false, hasText: false })).toBe('loading');
     // Loading explains the block better than a spinner that is not spinning.
-    expect(composerSubmitBlock({ loading: true, sending: true, hasText: true })).toBe('loading');
+    expect(composerSubmitBlock({ sessionBlock, sending: true, hasText: true })).toBe('loading');
+  });
+
+  it('disables submit once the load settled without a row', () => {
+    const sessionBlock = 'unavailable';
+    expect(composerSubmitBlock({ sessionBlock, sending: false, hasText: true })).toBe(
+      'unavailable'
+    );
+    expect(composerSubmitBlock({ sessionBlock, sending: true, hasText: false })).toBe(
+      'unavailable'
+    );
   });
 
   it('disables submit while a send is in flight', () => {
-    expect(composerSubmitBlock({ loading: false, sending: true, hasText: true })).toBe('sending');
-    expect(composerSubmitBlock({ loading: false, sending: true, hasText: false })).toBe('sending');
+    expect(composerSubmitBlock({ sessionBlock: null, sending: true, hasText: true })).toBe(
+      'sending'
+    );
+    expect(composerSubmitBlock({ sessionBlock: null, sending: true, hasText: false })).toBe(
+      'sending'
+    );
   });
 
   it('disables submit on an empty draft and otherwise allows it', () => {
-    expect(composerSubmitBlock({ loading: false, sending: false, hasText: false })).toBe('empty');
-    expect(composerSubmitBlock({ loading: false, sending: false, hasText: true })).toBeNull();
+    expect(composerSubmitBlock({ sessionBlock: null, sending: false, hasText: false })).toBe(
+      'empty'
+    );
+    expect(composerSubmitBlock({ sessionBlock: null, sending: false, hasText: true })).toBeNull();
+  });
+});
+
+describe('composerSubmitBlockTitle', () => {
+  it('titles the session blocks differently so a settled failure reads as such', () => {
+    expect(composerSubmitBlockTitle('loading')).toBe(COMPOSER_LOADING_TITLE);
+    expect(composerSubmitBlockTitle('unavailable')).toBe(COMPOSER_UNAVAILABLE_TITLE);
+    expect(COMPOSER_LOADING_TITLE).not.toBe(COMPOSER_UNAVAILABLE_TITLE);
+  });
+
+  it('leaves the control title alone for blocks the control already explains', () => {
+    expect(composerSubmitBlockTitle('sending')).toBeNull();
+    expect(composerSubmitBlockTitle('empty')).toBeNull();
+    expect(composerSubmitBlockTitle(null)).toBeNull();
   });
 });
diff --git a/apps/staged/src/lib/features/sessions/composerSendControl.ts b/apps/staged/src/lib/features/sessions/composerSendControl.ts
index a29610a7b..6473a4a81 100644
--- a/apps/staged/src/lib/features/sessions/composerSendControl.ts
+++ b/apps/staged/src/lib/features/sessions/composerSendControl.ts
@@ -83,34 +83,64 @@ export function composerSendControl({
   };
 }
 
+/**
+ * Why the pane has no session row to submit to, or `null` once it has one.
+ * The draft can be typed in either state.
+ */
+export type ComposerSessionBlock =
+  /** The row is still being fetched. */
+  | 'loading'
+  /** The fetch settled without a row: it failed, or the session is gone. */
+  | 'unavailable';
+
+export interface ComposerSessionBlockInput {
+  /** The pane's load is in flight. */
+  loading: boolean;
+  /** The pane holds a session row. */
+  hasSession: boolean;
+}
+
+/**
+ * The pane's session state as the composer sees it. Loading wins over a
+ * missing row because a reopen keeps `hasSession` false until the fetch
+ * settles, and only a settled fetch with no row means the session is gone.
+ */
+export function composerSessionBlock({
+  loading,
+  hasSession,
+}: ComposerSessionBlockInput): ComposerSessionBlock | null {
+  if (loading) return 'loading';
+  if (!hasSession) return 'unavailable';
+  return null;
+}
+
 /** Why the submit control is disabled, or `null` when it can be pressed. */
 export type ComposerSubmitBlock =
-  /** The session row has not loaded yet; the draft can be typed meanwhile. */
-  | 'loading'
+  | ComposerSessionBlock
   /** A send is in flight and owns the composer until it settles. */
   | 'sending'
   /** Nothing to send. */
   | 'empty';
 
 export interface ComposerSubmitBlockInput {
-  loading: boolean;
+  sessionBlock: ComposerSessionBlock | null;
   sending: boolean;
   /** The draft has non-whitespace text. */
   hasText: boolean;
 }
 
 /**
- * Whether the composer's submit control is disabled, and why. `loading` wins
- * because it is the only block the label does not already explain (the
- * spinner covers `sending`, the empty box covers `empty`), so it gets a
- * hover title of its own: `COMPOSER_LOADING_TITLE`.
+ * Whether the composer's submit control is disabled, and why. A session
+ * block wins because it is the only kind the control does not already
+ * explain (the spinner covers `sending`, the empty box covers `empty`), so
+ * it gets a hover title of its own: see `composerSubmitBlockTitle`.
  */
 export function composerSubmitBlock({
-  loading,
+  sessionBlock,
   sending,
   hasText,
 }: ComposerSubmitBlockInput): ComposerSubmitBlock | null {
-  if (loading) return 'loading';
+  if (sessionBlock) return sessionBlock;
   if (sending) return 'sending';
   if (!hasText) return 'empty';
   return null;
@@ -119,6 +149,24 @@ export function composerSubmitBlock({
 /** Hover title for the submit control while the session row is loading. */
 export const COMPOSER_LOADING_TITLE = 'Loading session…';
 
+/** Hover title for the submit control once the load settled without a row. */
+export const COMPOSER_UNAVAILABLE_TITLE = 'Session unavailable';
+
+/**
+ * The hover title a submit block earns on its own, or `null` when the
+ * control's regular title (Send / Queue) should stand.
+ */
+export function composerSubmitBlockTitle(block: ComposerSubmitBlock | null): string | null {
+  switch (block) {
+    case 'loading':
+      return COMPOSER_LOADING_TITLE;
+    case 'unavailable':
+      return COMPOSER_UNAVAILABLE_TITLE;
+    default:
+      return null;
+  }
+}
+
 /** Menu entries for the mode dropdown, in display order. */
 export const COMPOSER_SEND_MODE_OPTIONS: readonly {
   mode: ComposerSendMode;

From 59308aeb474a3d22d019b91a6a0ed4bfff035354 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Mon, 2 Nov 2026 10:37:48 +1100
Subject: [PATCH 7/9] fix(staged): close the Queue / Send seam from 2 CSS px to
 1 and tint it accent

The accent split button's two segments were separated by a 2 CSS px seam
(4 device px at 2x) of composer background, against the 1 CSS px border the
Rebase and Create PR outline pairs show. `buttonVariants` paints every
button with a 1px transparent border and `bg-clip-padding`, so the
primary's transparent right border and the trigger's left border sat side
by side, both compositing over `--bg-chrome`. The "35% white hairline" was
therefore `#fafafa` beside `#f7f7f7` (light) and `#1e1a23` beside `#18151d`
(dark): a crack of page colour, not a tint.

Two tokens change in `ChatComposer.svelte`, as recommended in the seam
note. The `DropdownMenu.Trigger` gains `-ml-px`, the same overlap
`BranchCardHeaderInfo.svelte` and `BranchCardPrButton.svelte` put on their
trigger wrapper, so the trigger's left border covers the primary's
transparent right border and one border column remains. The scoped
`border-left-color` mixes `--bg-primary` into `var(--ui-accent)` instead of
`transparent`, so that remaining column is an opaque tint of the fill
(`#6fb2ff` light, `#4777b6` dark) rather than a wash over the chrome
background. The comment on the rule now explains the two-column problem
and why the mix target is the accent colour. The control is 1 CSS px
narrower (91.3 px against 92.3 px); the fills are unchanged.

Measured with a Playwright + Chrome fixture using this branch's built
Tailwind CSS (the earlier `/tmp/split-seam` harness was gone), scanning
the row a quarter of the way down the control, clear of the label and
chevron. The before numbers reproduce the note's exactly.

  before: 2 CSS px at 1x, 4 device px at 2x; #f7f7f7 + #fafafa (light),
          #18151d + #1e1a23 (dark)
  after:  1 CSS px at 1x, 2 device px at 2x; #6fb2ff (light),
          #4777b6 (dark); primary.right - trigger.left = 1

`-ml-px` is present in the built CSS. `pnpm check` and the full vitest
suite (1724 tests) pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 .../src/lib/features/sessions/ChatComposer.svelte    | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/apps/staged/src/lib/features/sessions/ChatComposer.svelte b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
index 70f34f4b3..b98f9ae7c 100644
--- a/apps/staged/src/lib/features/sessions/ChatComposer.svelte
+++ b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
@@ -230,7 +230,7 @@
           <DropdownMenu.Trigger
             class={cn(
               buttonVariants({ variant: 'accent' }),
-              'composer-send-menu-trigger h-auto min-h-9 w-8 rounded-l-none px-0 max-[640px]:min-h-11'
+              'composer-send-menu-trigger -ml-px h-auto min-h-9 w-8 rounded-l-none px-0 max-[640px]:min-h-11'
             )}
             title="Change how messages are delivered"
             aria-label="Change how messages are delivered"
@@ -358,8 +358,14 @@
     margin-left: auto;
   }
 
-  /* A hairline between the split button's two accent segments. */
+  /* A hairline between the split button's two accent segments. Every button
+     paints a 1px transparent border with bg-clip-padding, so without the
+     trigger's -ml-px overlap the primary's right border and the trigger's left
+     border sit side by side as a 2px seam of composer background. With the
+     overlap only this border column remains; it is mixed into the accent fill
+     (not transparent) so it renders as an opaque tint of the fill rather than
+     a near-invisible wash over the chrome background behind the control. */
   .composer-send-split :global(.composer-send-menu-trigger) {
-    border-left-color: color-mix(in srgb, var(--bg-primary) 35%, transparent);
+    border-left-color: color-mix(in srgb, var(--bg-primary) 35%, var(--ui-accent));
   }
 </style>

From f8c2575a6948220f32c5a83522ef434c05354d9a Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Mon, 2 Nov 2026 11:38:33 +1100
Subject: [PATCH 8/9] fix(staged): draw the Queue / Send divider at fill height
 instead of border-box height

Follow-up to 59308aeb. The accent hairline between the split button's two
segments poked past the blue fills at the top and bottom. Every button
paints a 1px transparent border with bg-clip-padding, so each fill is inset
1px from its border box, while the trigger's tinted border-left spanned the
whole border box and mitred into the transparent top and bottom borders.

Measured on the saved real-app 2x captures (light and dark) and the fixture
harness, scanning the two seam columns against the fill columns 4 CSS px to
either side:

  before: outer seam column 1 device px past the fills at each end, plus a
          half-tone pixel beyond that (the mitre); inner column flush with
          a half-tone pixel beyond. 1x: flush, with a half-tone pixel at
          each end.
  after:  0 device px overshoot top and bottom at 1x and 2x, light and
          dark; the rows beyond the fills are plain background.

The trigger keeps -ml-px but drops its left border, so its fill paints over
the primary's transparent right-border column and the two fills meet with
no seam. The divider is a 1px absolutely positioned ::before with top and
bottom 0: its containing block is the trigger's padding box, which is
exactly the fill's extent (a 1px inset there would notch the line by 1 CSS
px at each end, which the harness confirmed). The colour is the same
opaque accent tint as before. The comment on the rule now describes this
mechanism.

Also evaluated and rejected: an inset box-shadow through Tailwind's
--tw-inset-shadow variable measures identically and composes with the
focus ring, but couples the divider to a private variable and to some
box-shadow utility being present at rest; a 1px background-image strip
also measures identically but reads less plainly and rounds the dark tint
by one unit.

Verified: seam 1 CSS px (2 device px at 2x), same x as before; primary and
trigger fill extents and the control width (83.06 px typed) unchanged;
keyboard focus ring on the trigger renders as before (screenshot). Also
captured once in the running app through the /tmp/staged-live scaffold
(light, 2x, prebuilt patched binary, new dist): seam columns rows 3..70
against fill rows 3..70, where the previous capture had 2..71. pnpm check
and the full vitest suite (1724 tests) pass.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 .../lib/features/sessions/ChatComposer.svelte | 33 ++++++++++++++-----
 1 file changed, 25 insertions(+), 8 deletions(-)

diff --git a/apps/staged/src/lib/features/sessions/ChatComposer.svelte b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
index b98f9ae7c..1d9d5dc2a 100644
--- a/apps/staged/src/lib/features/sessions/ChatComposer.svelte
+++ b/apps/staged/src/lib/features/sessions/ChatComposer.svelte
@@ -358,14 +358,31 @@
     margin-left: auto;
   }
 
-  /* A hairline between the split button's two accent segments. Every button
-     paints a 1px transparent border with bg-clip-padding, so without the
-     trigger's -ml-px overlap the primary's right border and the trigger's left
-     border sit side by side as a 2px seam of composer background. With the
-     overlap only this border column remains; it is mixed into the accent fill
-     (not transparent) so it renders as an opaque tint of the fill rather than
-     a near-invisible wash over the chrome background behind the control. */
+  /* A hairline between the split button's two accent segments, exactly the
+     height of the fills. Every button paints a 1px transparent border with
+     bg-clip-padding, so its fill is inset 1px from the border box on all
+     sides. The trigger's -ml-px overlaps the primary's transparent right
+     border column; with no left border of its own the trigger's fill paints
+     over that column and the two fills meet with no seam. The divider is then
+     drawn on top as a 1px ::before spanning the trigger's padding box (the
+     containing block of an absolutely positioned child), which is the fill's
+     extent, so it neither overshoots the fills nor notches them. A tinted
+     border-left would instead span the border box and mitre into the
+     transparent top and bottom borders, poking 1px past the fills at each
+     end. The colour mixes --bg-primary into the accent so the line is an
+     opaque tint of the fill rather than a wash over the chrome behind it. */
   .composer-send-split :global(.composer-send-menu-trigger) {
-    border-left-color: color-mix(in srgb, var(--bg-primary) 35%, var(--ui-accent));
+    position: relative;
+    border-left-width: 0;
+  }
+
+  .composer-send-split :global(.composer-send-menu-trigger::before) {
+    content: '';
+    position: absolute;
+    top: 0;
+    bottom: 0;
+    left: 0;
+    width: 1px;
+    background: color-mix(in srgb, var(--bg-primary) 35%, var(--ui-accent));
   }
 </style>

From 4b270c37beb3b564d71812b0a8af951b14a61a54 Mon Sep 17 00:00:00 2001
From: Matt Toohey <contact@matttoohey.com>
Date: Mon, 2 Nov 2026 13:27:43 +1100
Subject: [PATCH 9/9] fix(staged): keep the composer's Queue / Send mode in
 step across windows

Addresses the PR #1012 review comment on `setComposerSendMode`. The mode
is one global preference, but only the window that picked it updated:
`project-status-options` subscribes to `store://change`, the composer
mode did not. A second window kept its old mode, so a stale `send` could
deliver into (or interrupt) a running turn the user had switched to
queueing behind, and a stale `queue` could defer a message meant to land
now. The backend already forwards every store key's change to Tauri
windows and web tabs, so this is frontend-only.

The subscribe-and-refresh machinery the project statuses had is now the
`syncedPreference(key, apply)` helper in preferences.svelte.ts, used by
both keys: one `store://change` listener per key, a read on registration
and on every web reconnect (`onEstablished`), and a revision counter so a
notification or local edit wins over an older read still in flight.
`apply` normalizes, so a deleted or malformed mode falls back to `queue`
in every client, as it already did on load. Receiving an event never
writes back, so there is no echo loop.

The revision guard also closes a startup race the composer mode had on
its own: the mode is read at the end of `initPreferences`, after diff
theme loading, so a mode picked in that window was overwritten by the
late read. Project statuses behave as before.

Tests, native and web clients: a mode picked in one client reaches the
other with no echo write; deletion and malformed values fall back to
queue; a reconnect refresh recovers a missed change; a mode picked while
the initial read is in flight survives it. The listener-count assertion
is now one per synced key. The three sync tests fail against the old
code. `pnpm check` and the full vitest suite (1732 tests) pass.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Matt Toohey <contact@matttoohey.com>
---
 .../features/settings/preferences.svelte.ts   | 94 ++++++++++++-------
 .../lib/features/settings/preferences.test.ts | 55 ++++++++++-
 2 files changed, 114 insertions(+), 35 deletions(-)

diff --git a/apps/staged/src/lib/features/settings/preferences.svelte.ts b/apps/staged/src/lib/features/settings/preferences.svelte.ts
index 4c6652dc1..ed1f70fdb 100644
--- a/apps/staged/src/lib/features/settings/preferences.svelte.ts
+++ b/apps/staged/src/lib/features/settings/preferences.svelte.ts
@@ -283,30 +283,67 @@ function ensureSystemModeListener() {
 // Initialization
 // =============================================================================
 
-let unlistenStatusOptions: (() => void) | undefined;
-let statusOptionsRevision = 0;
+/**
+ * A preference every client (Tauri window or web tab) keeps in step: any
+ * client's write, this one's included, arrives as a store-change event and
+ * goes through `apply`, which must normalize missing or malformed values.
+ */
+function syncedPreference(key: string, apply: (value: unknown) => void) {
+  let unlisten: (() => void) | undefined;
+  let revision = 0;
 
-function applyProjectStatusOptions(value: unknown): void {
-  statusOptionsRevision += 1;
-  preferences.projectStatusOptions =
-    normalizeProjectStatusOptions(value) ?? DEFAULT_PROJECT_STATUS_OPTIONS.map((o) => ({ ...o }));
-}
+  function receive(value: unknown): void {
+    revision += 1;
+    apply(value);
+  }
 
-async function refreshProjectStatusOptions(): Promise<void> {
-  const revision = ++statusOptionsRevision;
-  try {
-    const value = await getStoreValue<unknown>(PROJECT_STATUS_OPTIONS_STORE_KEY);
-    // A notification, local edit, or newer refresh wins over an older snapshot.
-    if (revision === statusOptionsRevision) applyProjectStatusOptions(value);
-  } catch (error) {
-    console.error('[Preferences] Failed to refresh project status options:', error);
+  async function refresh(): Promise<void> {
+    const current = ++revision;
+    try {
+      const value = await getStoreValue<unknown>(key);
+      // A notification, local edit, or newer refresh wins over an older snapshot.
+      if (current === revision) apply(value);
+    } catch (error) {
+      console.error(`[Preferences] Failed to refresh ${key}:`, error);
+    }
   }
+
+  return {
+    /** Subscribe (once) and load the current value. */
+    start(): Promise<void> {
+      unlisten ??= listenToStoreKeyChange(key, receive, {
+        // Close the initial registration gap and recover missed web events on reconnect.
+        onEstablished: () => void refresh(),
+      });
+      return refresh();
+    },
+    /** Persist a value the caller has already applied locally. */
+    save(value: unknown): void {
+      revision += 1;
+      setStoreValue(key, value);
+    },
+    dispose(): void {
+      unlisten?.();
+      revision += 1;
+    },
+  };
 }
 
+const projectStatusOptionsSync = syncedPreference(PROJECT_STATUS_OPTIONS_STORE_KEY, (value) => {
+  preferences.projectStatusOptions =
+    normalizeProjectStatusOptions(value) ?? DEFAULT_PROJECT_STATUS_OPTIONS.map((o) => ({ ...o }));
+});
+
+// Global, so a mode picked in one window must reach the others: a stale `send`
+// would deliver into (or interrupt) a running turn the user meant to queue behind.
+const composerSendModeSync = syncedPreference(COMPOSER_SEND_MODE_STORE_KEY, (value) => {
+  preferences.composerSendMode = normalizeComposerSendMode(value);
+});
+
 if (import.meta.hot) {
   import.meta.hot.dispose(() => {
-    unlistenStatusOptions?.();
-    statusOptionsRevision += 1;
+    projectStatusOptionsSync.dispose();
+    composerSendModeSync.dispose();
   });
 }
 
@@ -317,17 +354,9 @@ if (import.meta.hot) {
 export async function initPreferences(): Promise<void> {
   await initPersistentStore();
 
-  unlistenStatusOptions ??= listenToStoreKeyChange(
-    PROJECT_STATUS_OPTIONS_STORE_KEY,
-    applyProjectStatusOptions,
-    {
-      // Close the initial registration gap and recover missed web events on reconnect.
-      onEstablished: () => void refreshProjectStatusOptions(),
-    }
-  );
-  // Also load without waiting for the web event socket to connect. Statuses
+  // Loads without waiting for the web event socket to connect. Statuses
   // belong to the first project paint, ahead of the slower diff-theme loading.
-  await refreshProjectStatusOptions();
+  await projectStatusOptionsSync.start();
 
   const [savedSize, savedMode] = await Promise.all([
     getStoreValue<number>(SIZE_STORE_KEY),
@@ -422,10 +451,8 @@ export async function initPreferences(): Promise<void> {
     preferences.branchPrefix = savedBranchPrefix;
   }
 
-  // Load the composer's last-used submit mode (malformed values fall back to queue)
-  preferences.composerSendMode = normalizeComposerSendMode(
-    await getStoreValue<unknown>(COMPOSER_SEND_MODE_STORE_KEY)
-  );
+  // Load and follow the composer's last-used submit mode (malformed values fall back to queue)
+  await composerSendModeSync.start();
 }
 
 // =============================================================================
@@ -487,7 +514,7 @@ export function setBranchPrefix(prefix: string): void {
  */
 export function setComposerSendMode(mode: ComposerSendMode): void {
   preferences.composerSendMode = mode;
-  setStoreValue(COMPOSER_SEND_MODE_STORE_KEY, mode);
+  composerSendModeSync.save(mode);
 }
 
 // =============================================================================
@@ -496,9 +523,8 @@ export function setComposerSendMode(mode: ComposerSendMode): void {
 
 /** Replace the list of statuses a project can be set to. */
 export function setProjectStatusOptions(options: ProjectStatusOption[]): void {
-  statusOptionsRevision += 1;
   preferences.projectStatusOptions = options;
-  setStoreValue(PROJECT_STATUS_OPTIONS_STORE_KEY, options);
+  projectStatusOptionsSync.save(options);
 }
 
 /** Restore the built-in project statuses. */
diff --git a/apps/staged/src/lib/features/settings/preferences.test.ts b/apps/staged/src/lib/features/settings/preferences.test.ts
index 4f4e6b06c..0b6bffe36 100644
--- a/apps/staged/src/lib/features/settings/preferences.test.ts
+++ b/apps/staged/src/lib/features/settings/preferences.test.ts
@@ -144,7 +144,8 @@ describe.each([true, false])('project status synchronization (native=%s)', (nati
     const client = await newClient(native);
     await client.initPreferences();
     await client.initPreferences();
-    expect(listeners).toHaveLength(1);
+    // One listener per synced key (project statuses first, then composer send mode).
+    expect(listeners).toHaveLength(2);
 
     values.set(key, [custom]);
     listeners[0].options?.onEstablished?.();
@@ -225,4 +226,56 @@ describe.each([true, false])('composer send mode (native=%s)', (native) => {
     expect(client.preferences.composerSendMode).toBe('queue');
     expect(set).not.toHaveBeenCalledWith(modeKey, expect.anything());
   });
+
+  it('follows a mode picked in another client without echoing it back', async () => {
+    const a = await newClient(native);
+    await a.initPreferences();
+    const b = await newClient(!native);
+    await b.initPreferences();
+
+    a.setComposerSendMode('send');
+    expect(b.preferences.composerSendMode).toBe('send');
+    b.setComposerSendMode('queue');
+    expect(a.preferences.composerSendMode).toBe('queue');
+    expect(set).toHaveBeenCalledTimes(2);
+  });
+
+  it('falls back to queue when another client deletes or corrupts the mode', async () => {
+    const client = await newClient(native);
+    await client.initPreferences();
+    emit('send', { key: modeKey });
+    emit(null, { key: modeKey, exists: false });
+    expect(client.preferences.composerSendMode).toBe('queue');
+    emit('send', { key: modeKey });
+    emit('later', { key: modeKey });
+    expect(client.preferences.composerSendMode).toBe('queue');
+    expect(set).not.toHaveBeenCalled();
+  });
+
+  it('refreshes on reconnection to recover a missed change', async () => {
+    const client = await newClient(native);
+    await client.initPreferences();
+    values.set(modeKey, 'send');
+    listeners[1].options?.onEstablished?.();
+    await vi.waitFor(() => expect(client.preferences.composerSendMode).toBe('send'));
+  });
+
+  it('keeps a mode picked while the initial read is in flight', async () => {
+    let resolve!: (value: unknown) => void;
+    get.mockImplementation(async (changedKey: string) =>
+      changedKey === modeKey
+        ? new Promise((done) => (resolve = done))
+        : structuredClone(values.get(changedKey))
+    );
+    const client = await newClient(native);
+    const initialized = client.initPreferences();
+    await vi.waitFor(() => expect(get).toHaveBeenCalledWith(modeKey));
+
+    // The local write's event has not arrived yet either.
+    set.mockResolvedValueOnce(undefined);
+    client.setComposerSendMode('send');
+    resolve('queue');
+    await initialized;
+    expect(client.preferences.composerSendMode).toBe('send');
+  });
 });