diff --git a/.agents/skills/multi-agent-mux-create/SKILL.md b/.agents/skills/multi-agent-mux-create/SKILL.md
index e16d8f5..409f053 100644
--- a/.agents/skills/multi-agent-mux-create/SKILL.md
+++ b/.agents/skills/multi-agent-mux-create/SKILL.md
@@ -60,7 +60,8 @@ If any check fails → abort with a non-zero exit and report the reason (automat
   - examples: `landing-page-refer-landing-page-creator-claude`, `paper-pdf2md-creator-agy`
   - never re-derive this by hand — source lib.sh and call the function
 - **wrapper script** (claude only): `~/.local/bin/<workspace-slug>-creator-claude`
-  - contents: herdr new-session with `claude` inside, auto-handles trust/bypass dialogs
+  - contents: herdr new-session with `claude` inside; trust/bypass dialogs are
+    handled by the skill for every agent (see `--no-auto-trust` below)
   - see `<workdir>/agent_sessions.md` for the canonical wrapper template
 
 ## Herdr Session Isolation (격리 세션)
@@ -97,6 +98,32 @@ The bootstrapped server receives a **sanitized copy of the caller's environment*
    bash scripts/create_session.sh --workspace /path/to/project --agent claude --role developer --onboard
    ```
 
+   **Delivery is judged by the agent's own `started` event** (#23), within the
+   job's `ack_timeout_sec` (default 180 s) — not by what the pane looked like two
+   seconds after the keys were sent. The script no longer publishes `started` on
+   the agent's behalf, so a job that shows `started` really was picked up. A
+   send_keys rc 4 ("Enter not seen accepted", where a still-starting TUI lands) is
+   a warning; rc 1/2/3 still abort at once. No `started` within the ack timeout
+   fails the job and exits 1 — the prompt is never re-injected.
+
+   **Start-up dialogs** are answered for every agent, not only claude (#24). The
+   blocking-modal signatures and their accept keys live in each agent adapter
+   (`lib_py/agents/adapters/*.py`, published as `MAM_STARTUP_DIALOGS`), and they
+   are answered while waiting for the TUI rather than after it. `--no-auto-trust`
+   leaves directory-trust dialogs for a human to accept and still answers other
+   blocking notices (for example codex's update prompt, where Skip changes
+   nothing). Trust matters most for **codex**: trusting a directory makes it load
+   that project's local config, hooks and exec policy, so `--no-auto-trust` is the
+   switch to reach for when the workspace is not yours. Re-sending is rate-limited
+   by `MAM_DIALOG_RESEND_S` (default 5 s) because a `--source visible` snapshot
+   keeps showing a dialog for a while after it was accepted.
+
+   **Exit codes**: 42 = the TUI never became ready and the process is gone;
+   43 = the rollback could not kill the herdr session and it is still running.
+   On 43 the message names the session and the manual cleanup command; the YAML
+   row keeps `status: running` with `last_visible_status: rollback-failed` and no
+   `delegate_job_id`, and the onboarding job is closed as `cancelled`.
+
 Why use `--herdr-session`?
 
 - By default, all skills target `default` herdr session socket — fine for single-workspace use.
diff --git a/.agents/skills/multi-agent-mux-create/scripts/create_session.sh b/.agents/skills/multi-agent-mux-create/scripts/create_session.sh
index 9d8360e..e16a6af 100755
--- a/.agents/skills/multi-agent-mux-create/scripts/create_session.sh
+++ b/.agents/skills/multi-agent-mux-create/scripts/create_session.sh
@@ -17,6 +17,8 @@
 #   2  = invalid args
 #   3  = herdr session already exists (use multi-agent-mux-resume or delete first)
 #   4  = agent-sessions.yaml append failure
+#   42 = agent TUI never became ready and the process is gone
+#   43 = rollback could not kill the herdr session; it is still running (#23)
 set -euo pipefail
 
 _script_dir="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"