@agentconnect.md/daemon 1.0.0-rc.308 → 1.0.0-rc.309

package/dist/{run-foreground-DrYgPjW_.js → run-foreground-DoM1PkHn.js}

@@ -6366,6 +6366,12 @@ var LocalStore = class {
         effortOverride TEXT, permissionModeOverride TEXT, fastModeOverride INTEGER,
         outputModeOverride TEXT
       );
+      -- A !stop can arrive while a cold session is still materializing, before the
+      -- sessions row exists. Keep the mute independently keyed so that stop survives a
+      -- daemon restart and is applied when the session row is eventually created.
+      CREATE TABLE IF NOT EXISTS session_mutes (
+        key TEXT PRIMARY KEY
+      );
       -- Platform id → human display name (Slack channel/user names, daemon-resolved
       -- and cached here so session read-back can label ids without a Slack call).
       CREATE TABLE IF NOT EXISTS display_names (
@@ -6411,9 +6417,22 @@ var LocalStore = class {
         integrationId TEXT,
         callMeta TEXT,
         isQueueCmd INTEGER,
+        loopGuardCounted INTEGER NOT NULL DEFAULT 0,
         enqueuedAt TEXT NOT NULL
       );
       CREATE INDEX IF NOT EXISTS inbox_fifo ON inbox (sessionKey, enqueuedAt);
+      -- Conversation-wide spam/feedback-loop circuit. Unlike the in-memory dedup
+      -- caches, this latch survives a daemon restart, so durable inbox replay cannot
+      -- re-ignite a conversation that was already stopped by loop protection.
+      CREATE TABLE IF NOT EXISTS loop_guard (
+        scopeKey TEXT PRIMARY KEY,
+        windowStartedAt INTEGER NOT NULL,
+        totalCount INTEGER NOT NULL,
+        automaticWindowStartedAt INTEGER NOT NULL,
+        automaticCount INTEGER NOT NULL,
+        trippedAt INTEGER,
+        reason TEXT
+      );
       -- §3.4/§6.8 main-agent orchestration: a main agent fans out N subtasks to
       -- worker agents, then waits asynchronously and summarizes. The record is
       -- persisted BEFORE any delivery (record-first — a fast worker's reply must
@@ -6458,8 +6477,26 @@ var LocalStore = class {
         ON orchestration_subtask (orchestrationId, idx);
     `);
 		this.migrateSessionUsage();
+		this.migrateSessionMutes();
+		this.migrateInboxLoopGuardCounted();
 		this.migrateTranscriptToolBody();
 	}
+	/** Backfill the durable mute tombstones from the legacy sessions.muted column.
+	*  Both writes in setSessionMuted stay transactional, so this idempotent sync cannot
+	*  resurrect a mute that was explicitly cleared. */
+	migrateSessionMutes() {
+		this.db.exec(`
+      CREATE TABLE IF NOT EXISTS session_mutes (key TEXT PRIMARY KEY);
+      INSERT OR IGNORE INTO session_mutes (key) SELECT key FROM sessions WHERE muted = 1;
+      UPDATE sessions SET muted = 1 WHERE key IN (SELECT key FROM session_mutes);
+    `);
+	}
+	/** Rows written before loop protection had no per-delivery accounting marker. They
+	*  start at 0 so the first owner that can replay them charges them exactly once. */
+	migrateInboxLoopGuardCounted() {
+		if (!this.db.prepare("PRAGMA table_info(inbox)").all().some((c) => c.name === "loopGuardCounted")) this.db.exec("ALTER TABLE inbox ADD COLUMN loopGuardCounted INTEGER NOT NULL DEFAULT 0");
+		else this.db.exec("UPDATE inbox SET loopGuardCounted = 0 WHERE loopGuardCounted IS NULL");
+	}
 	/** Add the `transcript.tool_call_id` + `transcript.body` columns (and the partial
 	*  unique index) to a pre-existing DB. CREATE TABLE IF NOT EXISTS above adds them for
 	*  fresh DBs but never alters an existing table, so upgrade in place. No-op once the
@@ -6551,11 +6588,19 @@ var LocalStore = class {
 		};
 	}
 	upsertSession(rec) {
-		this.db.prepare(`INSERT INTO sessions (key, agentId, platform, channel, thread, acpSessionId, state, lastDeliveredTs, updatedAt, triggeredBy)
-         VALUES (@key, @agentId, @platform, @channel, @thread, @acpSessionId, @state, @lastDeliveredTs, @updatedAt, @triggeredBy)
+		this.db.prepare(`INSERT INTO sessions
+           (key, agentId, platform, channel, thread, acpSessionId, state, lastDeliveredTs, updatedAt, muted, triggeredBy)
+         VALUES
+           (@key, @agentId, @platform, @channel, @thread, @acpSessionId, @state, @lastDeliveredTs, @updatedAt,
+            CASE WHEN EXISTS (SELECT 1 FROM session_mutes WHERE key = @key) THEN 1 ELSE NULL END,
+            @triggeredBy)
          ON CONFLICT(key) DO UPDATE SET
            acpSessionId=excluded.acpSessionId, state=excluded.state,
            lastDeliveredTs=excluded.lastDeliveredTs, updatedAt=excluded.updatedAt,
+           muted=CASE
+             WHEN EXISTS (SELECT 1 FROM session_mutes WHERE key = excluded.key) THEN 1
+             ELSE sessions.muted
+           END,
            triggeredBy=COALESCE(sessions.triggeredBy, excluded.triggeredBy)`).run({
 			key: rec.key,
 			agentId: rec.agentId,
@@ -6575,11 +6620,20 @@ var LocalStore = class {
 	setSessionState(key, state, updatedAt) {
 		this.db.prepare("UPDATE sessions SET state = ?, updatedAt = ? WHERE key = ?").run(state, updatedAt, key);
 	}
-	/** `!stop` thread mute: while set, the router must not auto-dispatch this session's
-	*  thread to the agent (thread affinity / keyword / auto); an explicit @mention
-	*  clears it. No-op on an unknown key. */
+	/** `!stop` thread mute: the tombstone is written even before a session row exists,
+	*  then mirrored into sessions.muted for existing readers. An explicit @mention
+	*  clears both atomically. */
 	setSessionMuted(key, muted) {
-		this.db.prepare("UPDATE sessions SET muted = ? WHERE key = ?").run(muted ? 1 : 0, key);
+		this.db.exec("BEGIN");
+		try {
+			if (muted) this.db.prepare("INSERT OR IGNORE INTO session_mutes (key) VALUES (?)").run(key);
+			else this.db.prepare("DELETE FROM session_mutes WHERE key = ?").run(key);
+			this.db.prepare("UPDATE sessions SET muted = ? WHERE key = ?").run(muted ? 1 : 0, key);
+			this.db.exec("COMMIT");
+		} catch (err) {
+			this.db.exec("ROLLBACK");
+			throw err;
+		}
 	}
 	/** Human-facing session title from the runtime's `session_info_update` (latest
 	*  wins; null clears per ACP semantics). No-op on an unknown key. */
@@ -6587,7 +6641,11 @@ var LocalStore = class {
 		this.db.prepare("UPDATE sessions SET title = ? WHERE key = ?").run(title, key);
 	}
 	isSessionMuted(key) {
-		return this.db.prepare("SELECT muted FROM sessions WHERE key = ?").get(key)?.muted === 1;
+		return this.db.prepare(`SELECT CASE
+           WHEN EXISTS (SELECT 1 FROM session_mutes WHERE key = ?)
+             OR EXISTS (SELECT 1 FROM sessions WHERE key = ? AND muted = 1)
+           THEN 1 ELSE 0
+         END AS muted`).get(key, key).muted === 1;
 	}
 	/** The session-scoped model override (set via the console's in-session model switch),
 	*  or undefined if the session runs on the agent's default. Sticky across turns and
@@ -6811,11 +6869,15 @@ var LocalStore = class {
 		return this.db.prepare("SELECT lastRunAt FROM cron_runs WHERE key = ?").get(key)?.lastRunAt;
 	}
 	/** §6.9 #353 durable inbox: persist an admitted message BEFORE its admission ACK. Keyed
-	*  by the stable id (deliveryId/msgId) with INSERT OR IGNORE, so a re-append of the same
-	*  delivery (P2 retry / replay) is a no-op — idempotent against the admission maps. */
+	*  by the stable id (deliveryId/msgId); a re-append preserves the original payload/FIFO
+	*  position and may only advance the durable loop-accounting marker from 0 to 1. */
 	appendInbox(row) {
-		this.db.prepare(`INSERT OR IGNORE INTO inbox (id, sessionKey, agentId, msg, integrationId, callMeta, isQueueCmd, enqueuedAt)
-         VALUES (@id, @sessionKey, @agentId, @msg, @integrationId, @callMeta, @isQueueCmd, @enqueuedAt)`).run({
+		this.db.prepare(`INSERT INTO inbox
+           (id, sessionKey, agentId, msg, integrationId, callMeta, isQueueCmd, loopGuardCounted, enqueuedAt)
+         VALUES
+           (@id, @sessionKey, @agentId, @msg, @integrationId, @callMeta, @isQueueCmd, @loopGuardCounted, @enqueuedAt)
+         ON CONFLICT(id) DO UPDATE SET
+           loopGuardCounted=MAX(inbox.loopGuardCounted, excluded.loopGuardCounted)`).run({
 			id: row.id,
 			sessionKey: row.sessionKey,
 			agentId: row.agentId,
@@ -6823,6 +6885,7 @@ var LocalStore = class {
 			integrationId: row.integrationId ?? null,
 			callMeta: row.callMeta ?? null,
 			isQueueCmd: row.isQueueCmd ?? null,
+			loopGuardCounted: row.loopGuardCounted ?? 0,
 			enqueuedAt: row.enqueuedAt
 		});
 	}
@@ -6836,6 +6899,129 @@ var LocalStore = class {
 	listInboxBySessionKeyFifo() {
 		return this.db.prepare("SELECT * FROM inbox ORDER BY sessionKey ASC, enqueuedAt ASC").all();
 	}
+	hasInbox(id) {
+		return this.db.prepare("SELECT 1 FROM inbox WHERE id = ?").get(id) !== void 0;
+	}
+	/** Remove every durable turn owned by an agent. Agent pause is an operator stop,
+	*  not a drain/retry signal: work purged here must never resurrect after unpause +
+	*  restart. Returns the removed ids so the daemon can clear its live-id cache. */
+	removeInboxByAgentId(agentId) {
+		const rows = this.db.prepare("SELECT id FROM inbox WHERE agentId = ?").all(agentId);
+		this.db.prepare("DELETE FROM inbox WHERE agentId = ?").run(agentId);
+		return rows.map((row) => row.id);
+	}
+	/** Record one turn admission against a conversation-wide fixed window. A trusted
+	*  human boundary resets only the consecutive automatic counter; the total-rate
+	*  backstop deliberately keeps counting so a platform bug that misclassifies its
+	*  own events as human still eventually opens the circuit. */
+	recordLoopGuardTurn(scopeKey, now, automatic, limits) {
+		this.db.prepare(`DELETE FROM loop_guard
+         WHERE trippedAt IS NULL AND windowStartedAt <= @cutoff AND automaticWindowStartedAt <= @cutoff`).run({ cutoff: now - limits.windowMs });
+		const current = this.getLoopGuard(scopeKey);
+		if (current?.trippedAt !== null && current?.trippedAt !== void 0) return {
+			allowed: false,
+			trippedNow: false,
+			totalCount: current.totalCount,
+			automaticCount: current.automaticCount,
+			...current.reason ? { reason: current.reason } : {}
+		};
+		const totalWindowExpired = !current || now - current.windowStartedAt >= limits.windowMs;
+		const automaticWindowExpired = !current || now - current.automaticWindowStartedAt >= limits.windowMs;
+		const windowStartedAt = totalWindowExpired ? now : current.windowStartedAt;
+		const totalCount = totalWindowExpired ? 1 : current.totalCount + 1;
+		const automaticWindowStartedAt = automaticWindowExpired || !automatic ? now : current.automaticWindowStartedAt;
+		const automaticCount = automatic ? automaticWindowExpired ? 1 : current.automaticCount + 1 : 0;
+		const reason = automaticCount > limits.maxAutomatic ? "automatic_turn_burst" : totalCount > limits.maxTotal ? "turn_rate_burst" : void 0;
+		const trippedAt = reason ? now : null;
+		this.db.prepare(`INSERT INTO loop_guard
+           (scopeKey, windowStartedAt, totalCount, automaticWindowStartedAt, automaticCount, trippedAt, reason)
+         VALUES (@scopeKey, @windowStartedAt, @totalCount, @automaticWindowStartedAt, @automaticCount, @trippedAt, @reason)
+         ON CONFLICT(scopeKey) DO UPDATE SET
+           windowStartedAt=excluded.windowStartedAt,
+           totalCount=excluded.totalCount,
+           automaticWindowStartedAt=excluded.automaticWindowStartedAt,
+           automaticCount=excluded.automaticCount,
+           trippedAt=excluded.trippedAt,
+           reason=excluded.reason`).run({
+			scopeKey,
+			windowStartedAt,
+			totalCount,
+			automaticWindowStartedAt,
+			automaticCount,
+			trippedAt,
+			reason: reason ?? null
+		});
+		return {
+			allowed: reason === void 0,
+			trippedNow: reason !== void 0,
+			totalCount,
+			automaticCount,
+			...reason ? { reason } : {}
+		};
+	}
+	/** Charge a migrated inbox delivery and advance its marker in one SQLite transaction.
+	*  A crash can therefore neither lose the charge nor charge the same retained row again
+	*  after ownership moves. A tripping delivery is intentionally left at marker 0: the
+	*  newly-open durable circuit makes its whole scope terminal and replay purges it. */
+	recordLoopGuardTurnForInbox(inboxId, scopeKey, now, automatic, limits) {
+		this.db.exec("BEGIN");
+		try {
+			const verdict = this.recordLoopGuardTurn(scopeKey, now, automatic, limits);
+			if (verdict.allowed) {
+				if (this.db.prepare("UPDATE inbox SET loopGuardCounted = 1 WHERE id = ?").run(inboxId).changes !== 1) throw new Error(`inbox delivery disappeared while charging loop guard: ${inboxId}`);
+			}
+			this.db.exec("COMMIT");
+			return verdict;
+		} catch (err) {
+			this.db.exec("ROLLBACK");
+			throw err;
+		}
+	}
+	/** Open a loop circuit immediately for a structurally-invalid platform event. */
+	tripLoopGuard(scopeKey, now, reason) {
+		const current = this.getLoopGuard(scopeKey);
+		if (current?.trippedAt !== null && current?.trippedAt !== void 0) return {
+			allowed: false,
+			trippedNow: false,
+			totalCount: current.totalCount,
+			automaticCount: current.automaticCount,
+			...current.reason ? { reason: current.reason } : {}
+		};
+		const row = current ?? {
+			scopeKey,
+			windowStartedAt: now,
+			totalCount: 0,
+			automaticWindowStartedAt: now,
+			automaticCount: 0
+		};
+		this.db.prepare(`INSERT INTO loop_guard
+           (scopeKey, windowStartedAt, totalCount, automaticWindowStartedAt, automaticCount, trippedAt, reason)
+         VALUES (@scopeKey, @windowStartedAt, @totalCount, @automaticWindowStartedAt, @automaticCount, @trippedAt, @reason)
+         ON CONFLICT(scopeKey) DO UPDATE SET trippedAt=excluded.trippedAt, reason=excluded.reason`).run({
+			...row,
+			trippedAt: now,
+			reason
+		});
+		return {
+			allowed: false,
+			trippedNow: true,
+			totalCount: row.totalCount,
+			automaticCount: row.automaticCount,
+			reason
+		};
+	}
+	getLoopGuard(scopeKey) {
+		return this.db.prepare("SELECT * FROM loop_guard WHERE scopeKey = ?").get(scopeKey);
+	}
+	isLoopGuardOpen(scopeKey) {
+		const row = this.getLoopGuard(scopeKey);
+		return row?.trippedAt !== null && row?.trippedAt !== void 0;
+	}
+	/** Explicit operator/user reset. Purged inbox rows stay purged; reset only lets a
+	*  future fresh message start a new window. Returns whether a guard existed. */
+	resetLoopGuard(scopeKey) {
+		return this.db.prepare("DELETE FROM loop_guard WHERE scopeKey = ?").run(scopeKey).changes > 0;
+	}
 	/**
 	* RECORD-FIRST (§3.4): persist the orchestration header + all subtask rows (status
 	* 'pending') in ONE transaction, BEFORE any delivery. A fast worker's reply that
@@ -7004,6 +7190,30 @@ function attachmentMention(attachments) {
 }
 //#endregion
 //#region src/session/session-manager.ts
+function interrupted(signal) {
+	return signal.reason instanceof Error ? signal.reason : new Error(typeof signal.reason === "string" ? signal.reason : "session initialization interrupted");
+}
+/** Await one initialization seam with a turn-scoped abort fence. The underlying I/O may
+*  finish later, but its continuation cannot resume SessionManager.handle after abort. */
+function abortable(start, signal) {
+	if (!signal) return Promise.resolve().then(start);
+	if (signal.aborted) return Promise.reject(interrupted(signal));
+	return new Promise((resolve, reject) => {
+		const cleanup = () => signal.removeEventListener("abort", onAbort);
+		const onAbort = () => {
+			cleanup();
+			reject(interrupted(signal));
+		};
+		signal.addEventListener("abort", onAbort, { once: true });
+		Promise.resolve().then(start).then((result) => {
+			cleanup();
+			resolve(result);
+		}, (err) => {
+			cleanup();
+			reject(err);
+		});
+	});
+}
 var SessionManager = class {
 	deps;
 	constructor(deps) {
@@ -7015,7 +7225,7 @@ var SessionManager = class {
 		const dormant = this.deps.store.closedSessionAgents(channel, thread);
 		return dormant.length === 1 ? dormant[0] : null;
 	}
-	async handle(agentId, msg) {
+	async handle(agentId, msg, signal) {
 		const agent = this.deps.agentById(agentId);
 		if (!agent) throw new Error(`unknown agent ${agentId}`);
 		this.deps.memory.ensure({ agentId }, agent.name);
@@ -7032,9 +7242,9 @@ var SessionManager = class {
 			text: mention ? `${msg.text}\n${mention}`.trim() : msg.text
 		});
 		let rec = this.deps.store.getSession(key);
-		const host = await this.deps.hostFor(agentId);
+		const host = await abortable(() => this.deps.hostFor(agentId), signal);
 		const effortOverride = this.deps.store.getEffortOverride(key);
-		const memoryIndex = (await this.deps.memory.injectAtSessionStart({ agentId })).trim();
+		const memoryIndex = (await abortable(() => this.deps.memory.injectAtSessionStart({ agentId }), signal)).trim();
 		const memoryAppend = memoryIndex ? `# Your memory\nThis is your memory INDEX from earlier sessions. Read a linked topic file with the \`readMemory\` tool when relevant; revise memory with \`writeMemory\`.\n\n${memoryIndex}` : "";
 		const channelName = this.deps.store.getDisplayNames([msg.channel]).get(msg.channel);
 		const agentMeta = [
@@ -7051,14 +7261,14 @@ var SessionManager = class {
 		const metaContext = usesMeta ? sessionContext || void 0 : void 0;
 		let created = false;
 		if (!rec || !rec.acpSessionId) {
-			const cwd = await prepareWorkspace(agent);
+			const cwd = await abortable(() => prepareWorkspace(agent), signal);
 			const mcpServers = this.deps.mcpServersFor?.({
 				agent,
 				platform: msg.platform,
 				channel: msg.channel,
 				thread
 			}) ?? [];
-			const acpSessionId = await host.newSession(cwd, mcpServers, effortOverride, metaContext);
+			const acpSessionId = await abortable(() => host.newSession(cwd, mcpServers, effortOverride, metaContext), signal);
 			created = true;
 			rec = {
 				key,
@@ -7074,7 +7284,8 @@ var SessionManager = class {
 			};
 			this.deps.store.upsertSession(rec);
 		} else if (host.hasSession?.(rec.acpSessionId) === false) {
-			const cwd = await prepareWorkspace(agent);
+			const persistedSessionId = rec.acpSessionId;
+			const cwd = await abortable(() => prepareWorkspace(agent), signal);
 			const mcpServers = this.deps.mcpServersFor?.({
 				agent,
 				platform: msg.platform,
@@ -7085,12 +7296,14 @@ var SessionManager = class {
 			if (host.loadSupported?.()) {
 				this.deps.store.setSessionState(key, "resuming", Date.now());
 				try {
-					await host.loadSession(rec.acpSessionId, cwd, mcpServers, effortOverride, usesMeta ? agentMeta : void 0);
+					await abortable(() => host.loadSession(persistedSessionId, cwd, mcpServers, effortOverride, usesMeta ? agentMeta : void 0), signal);
 					resumed = true;
-				} catch {}
+				} catch {
+					if (signal?.aborted) throw interrupted(signal);
+				}
 			}
 			if (!resumed) {
-				const acpSessionId = await host.newSession(cwd, mcpServers, effortOverride, metaContext);
+				const acpSessionId = await abortable(() => host.newSession(cwd, mcpServers, effortOverride, metaContext), signal);
 				created = true;
 				rec = {
 					...rec,
@@ -7104,7 +7317,7 @@ var SessionManager = class {
 		}
 		if (rec.lastDeliveredTs === null && thread !== ts && msg.platform !== "webchat" && this.deps.fetchThreadHistory) {
 			if (!this.deps.store.transcriptSince(msg.channel, thread, null).some((e) => e.ts === thread)) {
-				const history = await this.deps.fetchThreadHistory(agentId, msg.channel, thread);
+				const history = await abortable(() => this.deps.fetchThreadHistory(agentId, msg.channel, thread), signal);
 				for (const h of history) this.deps.store.appendTranscript({
 					channel: msg.channel,
 					thread,
@@ -7133,11 +7346,11 @@ var SessionManager = class {
 			text: msg.text
 		});
 		if (msg.attachments?.length) {
-			const attBlocks = await buildAttachmentBlocks(msg.attachments, {
+			const attBlocks = await abortable(() => buildAttachmentBlocks(msg.attachments, {
 				download: (att) => this.deps.downloadAttachment?.(agentId, att) ?? Promise.resolve(null),
 				supports: (kind) => host.promptSupports?.(kind) ?? false,
 				...this.deps.attachmentMaxBytes !== void 0 ? { maxBytes: this.deps.attachmentMaxBytes } : {}
-			});
+			}), signal);
 			blocks.push(...attBlocks);
 		}
 		if (created && !usesMeta && sessionContext) blocks.unshift({
@@ -7293,6 +7506,7 @@ function guessMimeFromUrl(url) {
 * missing connection — the caller turns that into an MCP `isError` result.
 */
 async function executeTool(ctx, name, args, deps) {
+	if (deps.canRun && !deps.canRun(ctx)) throw new Error("this agent turn has been stopped");
 	if (name === "listMemory" || name === "readMemory" || name === "writeMemory") {
 		const scope = { agentId: ctx.agentId };
 		try {
@@ -11167,6 +11381,7 @@ function routeRules(msg, rules, threadOwner, explicitAgentId) {
 const COMMAND_PREFIXES = ["!", "/"];
 const STOP_WORDS = /* @__PURE__ */ new Set(["stop"]);
 const CANCEL_WORDS = /* @__PURE__ */ new Set(["cancel"]);
+const RESUME_WORDS = /* @__PURE__ */ new Set(["resume"]);
 const QUEUE_WORDS = /* @__PURE__ */ new Set(["queue"]);
 const STATUS_WORDS = /* @__PURE__ */ new Set(["status"]);
 const FAST_WORDS = /* @__PURE__ */ new Set(["fast"]);
@@ -11195,6 +11410,7 @@ function parseCommand(raw) {
 	const arg = (m[2] ?? "").trim();
 	if (STOP_WORDS.has(word)) return { kind: "stop" };
 	if (CANCEL_WORDS.has(word)) return { kind: "cancel" };
+	if (RESUME_WORDS.has(word)) return { kind: "resume" };
 	if (QUEUE_WORDS.has(word)) return {
 		kind: "queue",
 		text: arg
@@ -68467,6 +68683,19 @@ function consolidateShared(agents) {
 	}
 	return groups;
 }
+/** Only user-authored chat shapes enter routing. Slack emits edits, deletes,
+*  assistant-thread metadata/title updates, and system records through the same generic
+*  `message` listener. In particular, `message_changed` keeps the actual sender and
+*  text in a nested `message` object; normalizing that outer wrapper would turn it
+*  into an anonymous empty DM and could feed our own update back into the agent.
+*  `me_message` and thread broadcasts still carry genuine user text and must remain
+*  routable. Keep this allowlist aligned with the relay's shared Slack ingest. */
+function isRoutableMessageSubtype(subtype) {
+	return subtype === void 0 || subtype === "file_share" || subtype === "me_message" || subtype === "thread_broadcast" || subtype === "reply_broadcast";
+}
+function isRoutableMessageEvent(ev) {
+	return Boolean(ev.user) && !ev.bot_id && !ev.hidden && ev.message === void 0 && isRoutableMessageSubtype(ev.subtype);
+}
 /** Cap on members enriched per `listChannelMembers` call (bounds users.info fan-out). */
 const MEMBER_ENRICH_CAP = 50;
 /**
@@ -68558,8 +68787,8 @@ var SlackConnection = class {
 		};
 		this.app.message(async ({ message }) => {
 			const ev = message;
-			if (ev.type !== "message" || !ev.channel) {
-				log?.debug(`slack: inbound event ignored (type=${ev.type}, channel=${ev.channel ?? "none"})`);
+			if (ev.type !== "message" || !ev.channel || !isRoutableMessageEvent(ev)) {
+				log?.debug(`slack: inbound event ignored (type=${ev.type}, subtype=${ev.subtype ?? "none"}, channel=${ev.channel ?? "none"})`);
 				return;
 			}
 			deliver(ev, "message");
@@ -118741,7 +118970,7 @@ function normalizeTelegramMessage(msg, ctx) {
 * like Slack Socket Mode. One connection per bot token.
 *
 * Control surface: unlike Slack (interactive status bar + modal), Telegram exposes
-* session state and controls via slash commands — `/status`, `/stop`, `/cancel`,
+* session state and controls via slash commands — `/status`, `/stop`, `/cancel`, `/resume`,
 * `/fast`, `/queue`, parsed by the daemon like any inbound text. start() registers
 * them with BotFather (setMyCommands) so they autocomplete in the Telegram UI.
 */
@@ -118761,6 +118990,10 @@ const BOT_COMMANDS = [
 		command: "cancel",
 		description: "Cancel the current turn (keep the session live)"
 	},
+	{
+		command: "resume",
+		description: "Reset loop protection and unmute this conversation"
+	},
 	{
 		command: "fast",
 		description: "Toggle fast mode — /fast on | off"
@@ -195408,6 +195641,10 @@ const DISCORD_APP_COMMANDS = [
 		name: "cancel",
 		description: "Cancel the in-flight turn (session stays live)"
 	},
+	{
+		name: "resume",
+		description: "Reset loop protection and unmute this conversation"
+	},
 	{
 		name: "queue",
 		description: "Queue a message to run once the agent is idle",
@@ -214877,6 +215114,9 @@ function formatErr(err) {
 	return e?.stack ?? String(err);
 }
 const MAX_QUEUED_PER_SESSION = 10;
+const LOOP_GUARD_WINDOW_MS = 6e4;
+const MAX_AUTOMATIC_TURNS_PER_WINDOW = 8;
+const MAX_TOTAL_TURNS_PER_WINDOW = 60;
 /** Thrown to a `dispatch()` caller when the per-session admission queue is at its depth
 *  cap (§4.4 backpressure): the message is fast-failed, not buffered. Carries a stable
 *  `reason` so an agent-call source (P1/P2) can surface a typed `queue_full`. */
@@ -214937,6 +215177,38 @@ const DEFAULT_WEB_APP_URL = "https://app.agentconnect.md";
 /** Cap on agent→agent hop depth (design §2.4/§4.5) — reject a `messageAgent` that
 *  would push the outgoing hopCount past this, so an A↔B wake loop can't run away. */
 const MAX_AGENT_CALL_HOPS = 8;
+/** One durable loop-guard scope shared by every agent in a conversation. DMs are
+*  keyed at channel level because malformed platform wrappers may lose thread
+*  coordinates; threaded channel conversations retain their canonical thread. */
+function loopGuardScopeFromCoords(platform, channel, thread, isDm) {
+	return `${platform}:${channel}:${isDm ? "dm" : thread}`;
+}
+function slackTopLevelLoopGuardScope(channel) {
+	return `slack:${channel}:top-level`;
+}
+function loopGuardScope(msg) {
+	if (msg.platform === "slack" && !msg.isDm) {
+		const prefix = `slack:${msg.channel}:`;
+		const eventTs = msg.msgId.startsWith(prefix) ? msg.msgId.slice(prefix.length) : void 0;
+		if (eventTs !== void 0 && msg.thread === eventTs) return slackTopLevelLoopGuardScope(msg.channel);
+	}
+	return loopGuardScopeFromCoords(msg.platform, msg.channel, msg.thread ?? msg.msgId, msg.isDm);
+}
+function isTrustedHumanTurn(msg) {
+	return msg.source === "user" && !msg.sender.isBot && msg.sender.id !== "unknown";
+}
+/** The coarse rate circuit protects platform chat ingress. Agent calls have an exact
+*  trusted hop cap; cron/hooks are operator automation; webchat has a separate sync ACK
+*  contract and no in-band !resume surface. */
+function usesLoopGuard(msg) {
+	return msg.source === "user" && msg.platform !== "webchat";
+}
+/** The exact poison shape produced when a Slack message_changed/assistant metadata
+*  wrapper was normalized as if it were a real message. No supported platform has a
+*  legitimate anonymous, empty, attachment-less user turn, so fail closed and latch. */
+function isMalformedPlatformTurn(msg) {
+	return msg.platform === "slack" && msg.source === "user" && !msg.sender.isBot && msg.sender.id === "unknown" && msg.text.trim() === "" && (msg.attachments?.length ?? 0) === 0;
+}
 /** Build the wire SessionKey (protocol §5) for a pending turn — what `drain/done`
 *  reports as released so the CP may reassign it. Uses the real `thread` (absent for
 *  a channel-root message), NOT `statusThread` (which falls back to msgId): the CP
@@ -214990,6 +215262,8 @@ var Daemon = class Daemon {
 	tgConnByIntegration = /* @__PURE__ */ new Map();
 	dcConnByIntegration = /* @__PURE__ */ new Map();
 	hostStarts = /* @__PURE__ */ new Map();
+	hostStartGeneration = /* @__PURE__ */ new Map();
+	hostStartAborts = /* @__PURE__ */ new Map();
 	watcher;
 	debounceTimer;
 	agentsDir = "";
@@ -215020,16 +215294,21 @@ var Daemon = class Daemon {
 	requestExit;
 	draining = false;
 	drainingAgents = /* @__PURE__ */ new Set();
+	safetyDrainingAgents = /* @__PURE__ */ new Set();
+	safetyDrainWaits = /* @__PURE__ */ new Map();
+	safetyDrainRuns = /* @__PURE__ */ new Map();
 	moveStagedAgents = /* @__PURE__ */ new Set();
 	moveStageMetadata = /* @__PURE__ */ new Map();
 	activatingAgents = /* @__PURE__ */ new Set();
 	agentMoveTails = /* @__PURE__ */ new Map();
 	agentMoveInFlight = /* @__PURE__ */ new Map();
 	activeDispatchesByAgent = /* @__PURE__ */ new Map();
+	activeDispatchDoneByKey = /* @__PURE__ */ new Map();
 	activeReplyConnectionUses = /* @__PURE__ */ new Map();
 	hostStopping = /* @__PURE__ */ new Map();
 	idleSweepTimer;
 	cancelTimers = /* @__PURE__ */ new Map();
+	coldCancelTimers = /* @__PURE__ */ new Map();
 	slackRetryTimers = /* @__PURE__ */ new Map();
 	slackRetryRuns = /* @__PURE__ */ new Map();
 	constructor(opts = {}) {
@@ -215144,6 +215423,11 @@ var Daemon = class Daemon {
 			socketPath: mcpSocketPath(root),
 			log: this.log,
 			now: () => Date.now(),
+			canRun: (ctx) => {
+				const key = sessionKey(ctx.platform, ctx.channel, ctx.thread, ctx.agentId);
+				const active = this.activeGateEntries.get(key);
+				return !this.paused(ctx.agentId) && active !== void 0 && !active.cancelledReason;
+			},
 			gatewayFor: (integrationId) => this.connByIntegration.get(integrationId) ?? this.tgConnByIntegration.get(integrationId) ?? this.dcConnByIntegration.get(integrationId),
 			channelAgents: (req) => {
 				const client = this.cpClient;
@@ -215333,33 +215617,34 @@ var Daemon = class Daemon {
 		}).join(", ")}]`);
 		else this.log.debug(`reconcile: no changes (${desired.length} desired agent(s))`);
 		for (const id of toStop) {
-			const host = this.hosts.get(id);
-			if (host) {
-				await host.stop();
-				this.hosts.delete(id);
-			}
-			this.hostStarts.delete(id);
+			const wasDraining = this.drainingAgents.has(id);
+			this.drainingAgents.add(id);
+			this.interruptAgentTurns(id, "stop");
 			this.agents.delete(id);
 			this.scheduler.unregister(id);
+			await this.stopHost(id);
+			if (!wasDraining && !this.moveStagedAgents.has(id)) this.drainingAgents.delete(id);
 		}
 		let connectionsDirty = toStart.length > 0 || toStop.length > 0;
 		for (const change of toChange) {
 			const a = change.agent;
+			const wasPaused = this.agents.get(a.id)?.pause === true;
 			this.agents.set(a.id, a);
+			if (!wasPaused && a.pause) this.interruptAgentTurns(a.id, "pause");
 			this.scheduler.sync(a.id, a.crons);
 			if (change.hostRespawn || change.workspace) {
-				const host = this.hosts.get(a.id);
-				if (host) {
-					await host.stop();
-					this.hosts.delete(a.id);
-				}
-				this.hostStarts.delete(a.id);
+				const wasDraining = this.drainingAgents.has(a.id);
+				this.drainingAgents.add(a.id);
+				this.interruptAgentTurns(a.id, "stop");
+				await this.stopHost(a.id);
+				if (!wasDraining) this.drainingAgents.delete(a.id);
 			}
 			if (change.workspace) this.prefetchClone(a);
 			if (change.integrations) connectionsDirty = true;
 		}
 		for (const a of toStart) {
 			this.agents.set(a.id, a);
+			if (a.pause) this.purgeAgentInbox(a.id);
 			this.prefetchClone(a);
 			this.scheduler.sync(a.id, a.crons);
 		}
@@ -215912,6 +216197,10 @@ var Daemon = class Daemon {
 		this.canonicalizeTelegramThread(msg);
 		const command = parseCommand(msg.text);
 		if (command) {
+			if (command.kind === "resume" && !isTrustedHumanTurn(msg)) {
+				this.log.warn(`loop guard: ignored unauthenticated resume for ${loopGuardScope(msg)}`);
+				return;
+			}
 			this.handleCommand(command, msg);
 			return;
 		}
@@ -215926,13 +216215,13 @@ var Daemon = class Daemon {
 			return;
 		}
 		const muteKey = sessionKey(msg.platform, msg.channel, msg.thread ?? msg.msgId, result.agentId);
-		if (this.store.isSessionMuted(muteKey)) {
+		if (this.isSessionMuted(muteKey)) {
 			if (result.via !== "mention") {
 				this.recordUnrouted(msg);
 				this.log.debug(`routing: dropping ${msg.msgId} for agent "${result.agentId}" (muted by !stop; awaiting @mention)`);
 				return;
 			}
-			this.store.setSessionMuted(muteKey, false);
+			this.setSessionMuted(muteKey, false);
 			this.log.info(`routing: agent "${result.agentId}" un-muted in ch=${msg.channel} (explicit @mention)`);
 		}
 		this.log.info(`routing: ch=${msg.channel} → agent "${result.agentId}" (integration ${result.integrationId})`);
@@ -215983,7 +216272,7 @@ var Daemon = class Daemon {
 				reason: "no_agent"
 			};
 		}
-		if (this.agents.get(result.agentId)?.pause) {
+		if (this.paused(result.agentId)) {
 			this.log.info(`webchat: agent "${result.agentId}" is paused — rejecting turn`);
 			return {
 				accepted: false,
@@ -215991,6 +216280,14 @@ var Daemon = class Daemon {
 				reason: "paused"
 			};
 		}
+		if (this.safetyDrainingAgents.has(result.agentId)) {
+			this.log.info(`webchat: agent "${result.agentId}" is stopping an interrupted turn — rejecting turn`);
+			return {
+				accepted: false,
+				turnId,
+				reason: "busy"
+			};
+		}
 		if (this.draining || this.drainingAgents.has(result.agentId)) {
 			this.log.info(`webchat: agent "${result.agentId}" is draining — rejecting turn`);
 			return {
@@ -216014,6 +216311,15 @@ var Daemon = class Daemon {
 			isDm: true,
 			trigger: "dm"
 		};
+		const key = this.webchatSessionKey(chatId, result.agentId);
+		if (this.inflight.has(key) && (this.serialQueue.get(key)?.length ?? 0) >= MAX_QUEUED_PER_SESSION) {
+			this.log.warn(`webchat: queue full for session ${key} — rejecting turn`);
+			return {
+				accepted: false,
+				turnId,
+				reason: "busy"
+			};
+		}
 		this.dispatch(result.agentId, msg, void 0, {
 			conversationId: chatId,
 			turnId,
@@ -216134,6 +216440,10 @@ var Daemon = class Daemon {
 			this.interruptTurn(p.agentId, p.sessionKey, "cancel", acpSessionId);
 			return;
 		}
+		for (const [key, entry] of this.activeGateEntries) if (entry.webchat?.conversationId === conversationId) {
+			this.interruptTurn(entry.agentId, key, "cancel");
+			return;
+		}
 		for (const [key, entries] of this.serialQueue) {
 			const hit = entries.find((e) => e.webchat?.conversationId === conversationId);
 			if (hit) {
@@ -216187,6 +216497,31 @@ var Daemon = class Daemon {
 			};
 		}
 		const normalized = msg.payload;
+		const command = parseCommand(normalized.text);
+		if (command) {
+			if (command.kind === "resume" && !isTrustedHumanTurn(normalized)) {
+				this.log.warn(`loop guard: ignored unauthenticated relay resume for ${loopGuardScope(normalized)}`);
+				return {
+					msgId: msg.msgId,
+					accepted: false,
+					reason: "unauthorized"
+				};
+			}
+			const target = this.resolveExplicitCommandTarget(msg.agentId, msg.integrationId, normalized);
+			if (!target) {
+				this.log.warn(`relay: unauthorized command from ${normalized.sender.id} for agent ${msg.agentId}`);
+				return {
+					msgId: msg.msgId,
+					accepted: false,
+					reason: "unauthorized"
+				};
+			}
+			this.handleCommand(command, normalized, target);
+			return {
+				msgId: msg.msgId,
+				accepted: true
+			};
+		}
 		this.dispatch(msg.agentId, normalized, msg.integrationId).catch((err) => this.log.error(`relay im dispatch failed for agent "${msg.agentId}": ${formatErr(err)}`));
 		return {
 			msgId: msg.msgId,
@@ -216294,6 +216629,16 @@ var Daemon = class Daemon {
 			this.agentCallDeliveries.set(deliveryId, result);
 			return result;
 		};
+		const callerKey = sessionKey(platform, req.callerChannel, req.callerThread, req.callerAgentId);
+		const inbound = this.activeTurnCallMeta.get(callerKey);
+		const sourceHopCount = inbound?.hopCount ?? 0;
+		if (inbound !== void 0 && sourceHopCount >= MAX_AGENT_CALL_HOPS) return record({
+			delivered: false,
+			targetSession,
+			reason: "hop_limit"
+		});
+		const isReply = inbound !== void 0 && req.toAgentId === inbound.callFrom;
+		const correlationId = req.correlationId !== void 0 ? req.correlationId : isReply ? inbound.correlationId : void 0;
 		const target = this.agents.get(req.toAgentId);
 		if (!target) {
 			const coordPlatform = platform === "hook" ? "slack" : platform;
@@ -216302,7 +216647,9 @@ var Daemon = class Daemon {
 				channel,
 				thread,
 				deliveryId,
-				targetSession
+				targetSession,
+				sourceHopCount,
+				correlationId
 			}));
 		}
 		if (target.callPolicy === "selected" && !target.allowedCallerAgentIds.includes(req.callerAgentId)) {
@@ -216313,16 +216660,7 @@ var Daemon = class Daemon {
 				reason: "not_allowed"
 			});
 		}
-		const callerKey = sessionKey(platform, req.callerChannel, req.callerThread, req.callerAgentId);
-		const inbound = this.activeTurnCallMeta.get(callerKey);
 		const hopCount = inbound ? inbound.hopCount + 1 : 0;
-		if (hopCount > MAX_AGENT_CALL_HOPS) return record({
-			delivered: false,
-			targetSession,
-			reason: "hop_limit"
-		});
-		const isReply = inbound !== void 0 && req.toAgentId === inbound.callFrom;
-		const correlationId = req.correlationId !== void 0 ? req.correlationId : isReply ? inbound.correlationId : void 0;
 		const callMeta = {
 			callFrom: req.callerAgentId,
 			...correlationId !== void 0 ? { correlationId } : {},
@@ -216359,9 +216697,8 @@ var Daemon = class Daemon {
 	* §2.3/§6.2/§6.4, P2) and map the relay's typed admission verdict to a
 	* {@link MessageAgentResult}. The `claimedFromAgentId` is our trusted caller — the
 	* relay re-validates it against our authenticated daemonId (a forged claim is
-	* rejected there). `hopCount` is the source turn's depth (0 in P1's minimal
-	* cross-turn model); the relay increments it (+1, cap 8). The body never touches
-	* the CP — only the relay.
+	* rejected there). `sourceHopCount` is the trusted source turn's depth; the relay
+	* increments it (+1, cap 8). The body never touches the CP — only the relay.
 	*/
 	async routeAgentMsgCrossDaemon(req, ctx) {
 		if (!this.relays) return {
@@ -216379,8 +216716,8 @@ var Daemon = class Daemon {
 					channel: ctx.channel,
 					...ctx.thread !== void 0 ? { thread: ctx.thread } : {}
 				},
-				...req.correlationId !== void 0 ? { correlationId: req.correlationId } : {},
-				hopCount: 0,
+				...ctx.correlationId !== void 0 ? { correlationId: ctx.correlationId } : {},
+				hopCount: ctx.sourceHopCount,
 				deliveryId: ctx.deliveryId
 			});
 			if (ack.delivered) return {
@@ -216651,7 +216988,7 @@ var Daemon = class Daemon {
 				reason: "no_agent"
 			};
 		}
-		if (this.agents.get(msg.agentId)?.pause) {
+		if (this.paused(msg.agentId)) {
 			this.log.info(`hook: agent "${msg.agentId}" is paused — rejecting fire ${msg.msgId}`);
 			return {
 				msgId: msg.msgId,
@@ -216659,6 +216996,14 @@ var Daemon = class Daemon {
 				reason: "paused"
 			};
 		}
+		if (this.safetyDrainingAgents.has(msg.agentId)) {
+			this.log.info(`hook: agent "${msg.agentId}" is stopping an interrupted turn — rejecting fire ${msg.msgId}`);
+			return {
+				msgId: msg.msgId,
+				accepted: false,
+				reason: "busy"
+			};
+		}
 		if (this.draining || this.drainingAgents.has(msg.agentId)) {
 			this.log.info(`hook: agent "${msg.agentId}" is draining — rejecting fire ${msg.msgId}`);
 			return {
@@ -216877,10 +217222,20 @@ var Daemon = class Daemon {
 	}
 	inflight = /* @__PURE__ */ new Set();
 	serialQueue = /* @__PURE__ */ new Map();
+	/** Current head for every owned serial gate, including the cold pre-Pending phase.
+	*  Lets pause/loop trip latch cancellation onto work that cannot yet be found through
+	*  `pending` and would otherwise revive after a quick reset. */
+	activeGateEntries = /* @__PURE__ */ new Map();
 	/** §6.9 #353: stable ids of messages currently backed by a durable inbox row (admitted,
 	*  not yet terminal). Guards startup replay from re-admitting a row whose entry is already
 	*  live in the gate (idempotency — a duplicate/in-flight id is not double-processed). */
 	liveInboxIds = /* @__PURE__ */ new Set();
+	isSessionMuted(key) {
+		return this.store.isSessionMuted(key);
+	}
+	setSessionMuted(key, muted) {
+		this.store.setSessionMuted(key, muted);
+	}
 	/**
 	* Resolve a command's target from the channel's latest session when the routing ladder
 	* couldn't (no mention entity / thread / dm rule matched — e.g. a group `/status@bot`).
@@ -216902,25 +217257,71 @@ var Daemon = class Daemon {
 			via: "thread"
 		};
 	}
+	/** Validate the relay-arbitrated command target against the local agent spec. Shared
+	*  bot IMs bypass routeRules' arbitration, but must retain its bot rejection and
+	*  per-integration allowedUserIds authorization before executing a control command. */
+	resolveExplicitCommandTarget(agentId, integrationId, msg) {
+		if (!this.commandSenderAllowed(agentId, integrationId, msg)) return null;
+		return {
+			agentId,
+			integrationId,
+			via: "thread"
+		};
+	}
+	/** Recovery path for a channel-wide Slack top-level loop latch. The triggering
+	*  message itself was rejected, so its warning thread may have no thread owner or
+	*  latest session to route a bare `!resume` through. Select only an integration
+	*  that independently authorizes this human, preferring an explicitly mentioned bot. */
+	resolveTopLevelResumeTarget(msg) {
+		if (msg.platform !== "slack" || msg.isDm || !this.store.isLoopGuardOpen(slackTopLevelLoopGuardScope(msg.channel))) return null;
+		const candidates = [];
+		for (const [agentId, agent] of this.agents) for (const integration of agent.integrations) {
+			if (integration.platform !== "slack" || !this.commandSenderAllowed(agentId, integration.id, msg)) continue;
+			const mentioned = integration.slack.botUserId !== void 0 && msg.mentionedBots.includes(integration.slack.botUserId);
+			candidates.push({
+				agentId,
+				integrationId: integration.id,
+				via: mentioned ? "mention" : "auto",
+				mentioned
+			});
+		}
+		candidates.sort((a, b) => Number(b.mentioned) - Number(a.mentioned) || a.agentId.localeCompare(b.agentId) || a.integrationId.localeCompare(b.integrationId));
+		return candidates[0] ?? null;
+	}
+	/** Final command authorization at the concrete integration. CP routing rules do not
+	*  carry allowedUserIds themselves, so routing success alone is not an auth verdict. */
+	commandSenderAllowed(agentId, integrationId, msg) {
+		if (msg.sender.isBot) return false;
+		const integration = this.agents.get(agentId)?.integrations.find((candidate) => candidate.id === integrationId && candidate.platform === msg.platform);
+		if (!integration) return false;
+		const allowed = integration.platform === "telegram" ? integration.telegram.allowedUserIds : integration.platform === "discord" ? integration.discord.allowedUserIds : integration.slack.allowedUserIds;
+		return allowed.length === 0 || allowed.includes(msg.sender.id);
+	}
 	/**
 	* Handle an in-conversation control command. Resolves the target agent via the
 	* same routing ladder as a normal message (so thread-affinity + per-integration
 	* `allowedUserIds` authz apply), then acts on that agent's session in this
 	* (channel, thread).
 	*/
-	handleCommand(command, msg) {
-		let target = routeRules(msg, this.mergedRules(), (c, t) => this.sessions.threadOwner(c, t));
+	handleCommand(command, msg, explicitTarget) {
+		let target = explicitTarget ?? routeRules(msg, this.mergedRules(), (c, t) => this.sessions.threadOwner(c, t));
 		if (!target) target = this.resolveCommandTargetFromLatest(msg);
+		if (!target && command.kind === "resume") target = this.resolveTopLevelResumeTarget(msg);
 		if (!target) {
 			this.log.debug(`command: '${command.kind}' in ch=${msg.channel} — no agent resolved, ignoring`);
 			return;
 		}
+		if (!this.commandSenderAllowed(target.agentId, target.integrationId, msg)) {
+			this.log.warn(`command: '${command.kind}' rejected for unauthorized sender ${msg.sender.id}`);
+			return;
+		}
 		const conn = this.replyConnFor(target.agentId, target.integrationId);
 		const replyThread = msg.thread ?? msg.msgId;
 		let thread = replyThread;
 		let key = sessionKey(msg.platform, msg.channel, thread, target.agentId);
 		let rec = this.store.getSession(key);
-		if (!rec) {
+		const directGateActive = this.inflight.has(key) || this.activeGateEntries.has(key) || (this.serialQueue.get(key)?.length ?? 0) > 0;
+		if (!rec && !directGateActive) {
 			const latest = this.store.latestSession(target.agentId, msg.channel);
 			if (latest) {
 				rec = latest;
@@ -216936,8 +217337,28 @@ var Daemon = class Daemon {
 			if (msg.platform === "telegram") conn.postMessage(msg.channel, text, replyThread, tgReplyTo);
 			else conn.postMessage(msg.channel, text, replyThread);
 		};
+		if (command.kind === "resume") {
+			const directScope = thread === replyThread ? loopGuardScope(msg) : loopGuardScopeFromCoords(msg.platform, msg.channel, thread, msg.isDm);
+			const topLevelScope = msg.platform === "slack" && !msg.isDm ? slackTopLevelLoopGuardScope(msg.channel) : void 0;
+			const scope = topLevelScope && this.store.isLoopGuardOpen(topLevelScope) ? topLevelScope : directScope;
+			if ([...this.activeGateEntries.values()].some((entry) => entry.cancelledReason === "loop protection" && loopGuardScope(entry.msg) === scope) || [...this.pending.values()].some((pending) => {
+				return pending.outputSuppressed === "loop protection" && pending.loopGuardScope === scope;
+			})) {
+				reply("Loop protection is still stopping the previous turn. Try `!resume` again in a moment.");
+				return;
+			}
+			const wasOpen = this.store.isLoopGuardOpen(scope);
+			this.store.resetLoopGuard(scope);
+			const wasMuted = this.isSessionMuted(key);
+			if (wasMuted) this.setSessionMuted(key, false);
+			if (wasOpen || wasMuted) {
+				this.log.info(`loop guard: explicitly reset ${scope} by ${msg.sender.id}`);
+				reply("▶️ Resumed. Loop protection is reset; send a new message to continue.");
+			} else reply("Loop protection is not active in this conversation.");
+			return;
+		}
 		if (command.kind === "stop") {
-			if (rec) this.store.setSessionMuted(key, true);
+			if (rec || inflight) this.setSessionMuted(key, true);
 			const muteNote = "Muted in this thread — @mention me to resume.";
 			if (!inflight) {
 				reply(rec ? `🔇 Nothing is running. ${muteNote}` : "Nothing is running to stop.");
@@ -217245,6 +217666,7 @@ var Daemon = class Daemon {
 				integrationId: entry.integrationId ?? null,
 				callMeta: entry.callMeta ? JSON.stringify(entry.callMeta) : null,
 				isQueueCmd: entry.isQueueCmd ? 1 : null,
+				loopGuardCounted: 1,
 				enqueuedAt: monotonicTs()
 			});
 			entry.inboxId = id;
@@ -217266,6 +217688,94 @@ var Daemon = class Daemon {
 			this.log.warn(`durable inbox: remove failed for ${entry.inboxId}: ${err.message}`);
 		}
 	}
+	/** Pause is an explicit operator stop, so admitted work for that agent becomes
+	*  terminal instead of surviving as restart replay. */
+	purgeAgentInbox(agentId) {
+		try {
+			const ids = this.store.removeInboxByAgentId(agentId);
+			for (const id of ids) this.liveInboxIds.delete(id);
+			if (ids.length > 0) this.log.warn(`durable inbox: purged ${ids.length} row(s) for paused agent "${agentId}"`);
+			return ids.length;
+		} catch (err) {
+			this.log.error(`durable inbox: failed to purge paused agent "${agentId}": ${err.message}`);
+			return 0;
+		}
+	}
+	/** Inbox rows intentionally keep the complete normalized message instead of a
+	*  duplicated conversation column. A loop trip is rare, so scanning this small,
+	*  already-bounded backlog keeps the persisted schema compatible while purging every
+	*  agent/session in the affected conversation. */
+	purgeLoopScopeInbox(scope) {
+		let removed = 0;
+		try {
+			for (const row of this.store.listInboxBySessionKeyFifo()) {
+				let msg;
+				try {
+					msg = JSON.parse(row.msg);
+				} catch {
+					continue;
+				}
+				if (loopGuardScope(msg) !== scope) continue;
+				this.store.removeInbox(row.id);
+				this.liveInboxIds.delete(row.id);
+				removed++;
+			}
+		} catch (err) {
+			this.log.error(`loop guard: failed to purge inbox for ${scope}: ${err.message}`);
+		}
+		return removed;
+	}
+	isLoopGuardOpen(msg) {
+		return usesLoopGuard(msg) && this.store.isLoopGuardOpen(loopGuardScope(msg));
+	}
+	/** First-open side effects for a durable conversation circuit: purge restart work,
+	*  drop every matching serial queue, cancel live ACP turns across ALL agents sharing
+	*  the conversation, and emit exactly one operator-facing warning. */
+	onLoopGuardTripped(scope, reason, trigger) {
+		const purged = this.purgeLoopScopeInbox(scope);
+		const targets = /* @__PURE__ */ new Map();
+		for (const [key, entry] of this.activeGateEntries) {
+			if (loopGuardScope(entry.msg) !== scope) continue;
+			entry.cancelledReason = "loop protection";
+			targets.set(key, { agentId: entry.agentId });
+		}
+		for (const [acpSessionId, pending] of this.pending) if (pending.loopGuardScope === scope) targets.set(pending.sessionKey, {
+			agentId: pending.agentId,
+			acpSessionId
+		});
+		for (const [key, queued] of this.serialQueue) {
+			const entry = queued.find((candidate) => loopGuardScope(candidate.msg) === scope);
+			if (entry && !targets.has(key)) targets.set(key, { agentId: entry.agentId });
+		}
+		for (const [key, target] of targets) this.interruptTurn(target.agentId, key, "loop protection", target.acpSessionId, { dropQueued: true });
+		this.log.warn(`loop guard: OPEN ${scope} reason=${reason}; interrupted=${targets.size}, purgedInbox=${purged}; explicit !resume required`);
+		if (trigger.msg.headless) return;
+		const conn = this.replyConnFor(trigger.agentId, trigger.integrationId);
+		if (!conn) return;
+		const warningThread = reason === "malformed_platform_event" && trigger.msg.isDm ? void 0 : trigger.msg.thread;
+		conn.postMessage(trigger.msg.channel, "⚠️ Loop protection stopped this conversation and discarded its queued backlog. Send `!resume` when it is safe to continue.", warningThread).catch((err) => this.log.warn(`loop guard: warning post failed for ${scope}: ${err.message}`));
+	}
+	/** Count a genuine admission and run first-open side effects if its fixed-window
+	*  budget is exhausted. Returns false when this incoming turn must not enter the
+	*  serial gate. */
+	admitLoopGuardTurn(agentId, msg, integrationId, inboxReplayId) {
+		if (!usesLoopGuard(msg)) return true;
+		const scope = loopGuardScope(msg);
+		const limits = {
+			windowMs: LOOP_GUARD_WINDOW_MS,
+			maxTotal: MAX_TOTAL_TURNS_PER_WINDOW,
+			maxAutomatic: MAX_AUTOMATIC_TURNS_PER_WINDOW
+		};
+		const verdict = inboxReplayId ? this.store.recordLoopGuardTurnForInbox(inboxReplayId, scope, this.clock.now(), !isTrustedHumanTurn(msg), limits) : this.store.recordLoopGuardTurn(scope, this.clock.now(), !isTrustedHumanTurn(msg), limits);
+		if (verdict.allowed) return true;
+		if (verdict.trippedNow) this.onLoopGuardTripped(scope, verdict.reason ?? "turn_burst", {
+			agentId,
+			msg,
+			integrationId
+		});
+		else this.purgeLoopScopeInbox(scope);
+		return false;
+	}
 	/**
 	* Terminate a QUEUED entry's webchat sink when it is gate-dropped/rejected without ever
 	* entering dispatchOne (drain/pause gate-drop, fail-stop of the queued rest, `!cancel`/`!stop`
@@ -217275,7 +217785,8 @@ var Daemon = class Daemon {
 	* entries. Pass an `error` for reject/cancel/shutdown; omit it for a clean gate-drop.
 	*/
 	terminateQueuedSink(entry, error) {
-		if (!entry.webchat) return;
+		if (!entry.webchat || entry.webchat.doneSent) return;
+		entry.webchat.doneSent = true;
 		entry.webchat.sink.done({
 			conversationId: entry.webchat.conversationId,
 			turnId: entry.webchat.turnId,
@@ -217289,15 +217800,54 @@ var Daemon = class Daemon {
 				resolve(null);
 				return;
 			}
-			if (this.agents.get(agentId).pause) {
+			if (this.paused(agentId)) {
 				this.log.info(`dispatch: skipped for agent "${agentId}" (paused)`);
 				resolve(null);
 				return;
 			}
+			if (this.safetyDrainingAgents.has(agentId)) {
+				if (opts?.fromInboxReplay) this.waitForSafetyDrain(agentId).then(() => {
+					if (this.draining || !this.agents.has(agentId)) {
+						resolve(null);
+						return;
+					}
+					if (opts.inboxReplayId !== void 0 && !this.store.hasInbox(opts.inboxReplayId)) {
+						resolve(null);
+						return;
+					}
+					this.dispatch(agentId, msg, integrationId, webchat, callMeta, opts, githubReply).then(resolve, reject);
+				}).catch(reject);
+				else {
+					this.log.info(`dispatch: skipped for agent "${agentId}" (stopping interrupted work)`);
+					resolve(null);
+				}
+				return;
+			}
 			const key = sessionKey(msg.platform, msg.channel, msg.thread ?? msg.msgId, agentId);
+			const loopScope = loopGuardScope(msg);
+			if (usesLoopGuard(msg) && this.store.isLoopGuardOpen(loopScope)) {
+				if (opts?.fromInboxReplay) this.purgeLoopScopeInbox(loopScope);
+				this.log.warn(`dispatch: skipped ${msg.msgId}; loop guard is open for ${loopScope}`);
+				resolve(null);
+				return;
+			}
+			if (isMalformedPlatformTurn(msg)) {
+				if (msg.isDm) {
+					const verdict = this.store.tripLoopGuard(loopScope, this.clock.now(), "malformed_platform_event");
+					if (verdict.trippedNow) this.onLoopGuardTripped(loopScope, verdict.reason ?? "malformed_platform_event", {
+						agentId,
+						msg,
+						integrationId
+					});
+					else this.purgeLoopScopeInbox(loopScope);
+				} else this.log.warn(`dispatch: dropped malformed Slack platform event ${msg.msgId}`);
+				resolve(null);
+				return;
+			}
 			const entry = {
 				agentId,
 				msg,
+				initAbort: new AbortController(),
 				...integrationId !== void 0 ? { integrationId } : {},
 				...webchat ? { webchat } : {},
 				...callMeta ? { callMeta } : {},
@@ -217313,12 +217863,20 @@ var Daemon = class Daemon {
 					reject(new QueueFullError(key));
 					return;
 				}
+				if (!opts?.replay && !this.admitLoopGuardTurn(agentId, msg, integrationId, opts?.inboxReplayId)) {
+					resolve(null);
+					return;
+				}
 				q.push(entry);
 				this.serialQueue.set(key, q);
 				this.persistInbox(entry, key);
 				this.log.debug(`dispatch: queued behind in-flight turn for session ${key} (depth ${q.length})`);
 				return;
 			}
+			if (!opts?.replay && !this.admitLoopGuardTurn(agentId, msg, integrationId, opts?.inboxReplayId)) {
+				resolve(null);
+				return;
+			}
 			this.persistInbox(entry, key);
 			this.inflight.add(key);
 			this.runLoop(key, entry);
@@ -217336,18 +217894,63 @@ var Daemon = class Daemon {
 	paused(agentId) {
 		return this.agents.get(agentId)?.pause === true;
 	}
-	beginActiveDispatch(agentId) {
+	/** Await a transient interrupt drain without broadening its target set. The wait set is
+	*  additive, so loop until the runner removes the admission latch; a second interrupt
+	*  that joins while we wait is therefore included automatically. */
+	async waitForSafetyDrain(agentId) {
+		while (this.safetyDrainingAgents.has(agentId)) await Promise.all([...this.safetyDrainWaits.get(agentId) ?? []]);
+	}
+	/** Gate new work until the selected active dispatches have fully unwound. Waits are
+	*  additive: overlapping interrupts on different keys of one agent join the same drain
+	*  instead of letting the first completion reopen admission too early. */
+	beginSafetyDrain(agentId, reason, keys) {
+		const selected = keys === void 0 ? [...this.activeDispatchesByAgent.get(agentId) ?? []] : [...keys].map((key) => this.activeDispatchDoneByKey.get(key)).filter((done) => done !== void 0);
+		if (selected.length === 0) return;
+		const waits = this.safetyDrainWaits.get(agentId) ?? /* @__PURE__ */ new Set();
+		for (const done of selected) waits.add(done);
+		this.safetyDrainWaits.set(agentId, waits);
+		this.safetyDrainingAgents.add(agentId);
+		if (this.safetyDrainRuns.has(agentId)) return;
+		const token = Symbol(agentId);
+		this.safetyDrainRuns.set(agentId, token);
+		(async () => {
+			try {
+				while (true) {
+					const pending = [...this.safetyDrainWaits.get(agentId) ?? []];
+					if (pending.length === 0) break;
+					await Promise.all(pending);
+					const current = this.safetyDrainWaits.get(agentId);
+					for (const done of pending) current?.delete(done);
+				}
+			} finally {
+				if (this.safetyDrainRuns.get(agentId) !== token) return;
+				this.safetyDrainWaits.delete(agentId);
+				this.safetyDrainRuns.delete(agentId);
+				this.safetyDrainingAgents.delete(agentId);
+				this.log.info(`${reason}: interrupted turns fully stopped for agent "${agentId}"`);
+			}
+		})();
+	}
+	dispatchGateReason(entry) {
+		if (entry.cancelledReason) return entry.cancelledReason;
+		if (this.paused(entry.agentId)) return "pause";
+		if (this.isLoopGuardOpen(entry.msg)) return "loop protection";
+	}
+	beginActiveDispatch(agentId, key) {
 		let resolveDone;
 		const done = new Promise((resolve) => resolveDone = resolve);
 		const active = this.activeDispatchesByAgent.get(agentId) ?? /* @__PURE__ */ new Set();
 		active.add(done);
 		this.activeDispatchesByAgent.set(agentId, active);
+		this.activeDispatchDoneByKey.set(key, done);
 		let released = false;
 		return () => {
 			if (released) return;
 			released = true;
 			active.delete(done);
 			if (active.size === 0) this.activeDispatchesByAgent.delete(agentId);
+			this.clearColdCancelBackstop(key, done);
+			if (this.activeDispatchDoneByKey.get(key) === done) this.activeDispatchDoneByKey.delete(key);
 			resolveDone();
 		};
 	}
@@ -217377,53 +217980,64 @@ var Daemon = class Daemon {
 	}
 	async runLoop(key, firstEntry) {
 		let entry = firstEntry;
-		while (entry) {
-			if (entry !== firstEntry && (this.draining || this.drainingAgents.has(entry.agentId) || this.paused(entry.agentId))) {
-				this.terminateQueuedSink(entry);
-				if (!this.draining) this.removeInbox(entry);
-				entry.resolve(null);
-				const rest = this.serialQueue.get(key) ?? [];
-				this.serialQueue.delete(key);
-				for (const e of rest) {
-					this.terminateQueuedSink(e);
-					if (!this.draining) this.removeInbox(e);
-					e.resolve(null);
-				}
-				this.inflight.delete(key);
-				return;
-			}
-			try {
-				const releaseDispatch = this.beginActiveDispatch(entry.agentId);
-				let sessionId;
+		try {
+			while (entry) {
+				this.activeGateEntries.set(key, entry);
+				if (entry !== firstEntry && (this.draining || this.drainingAgents.has(entry.agentId) || this.paused(entry.agentId))) {
+					this.terminateQueuedSink(entry);
+					if (!this.draining) this.removeInbox(entry);
+					entry.resolve(null);
+					const rest = this.serialQueue.get(key) ?? [];
+					this.serialQueue.delete(key);
+					for (const e of rest) {
+						this.terminateQueuedSink(e);
+						if (!this.draining) this.removeInbox(e);
+						e.resolve(null);
+					}
+					this.inflight.delete(key);
+					return;
+				}
 				try {
-					sessionId = await this.dispatchOne(entry, key);
-				} finally {
-					releaseDispatch();
+					const releaseDispatch = this.beginActiveDispatch(entry.agentId, key);
+					let sessionId;
+					try {
+						sessionId = await this.dispatchOne(entry, key);
+					} finally {
+						releaseDispatch();
+					}
+					if (!(this.draining && entry.cancelledReason === "shutdown")) this.removeInbox(entry);
+					entry.resolve(sessionId);
+				} catch (err) {
+					if (!this.draining) this.removeInbox(entry);
+					entry.reject(err);
+					const rest = this.serialQueue.get(key) ?? [];
+					this.serialQueue.delete(key);
+					for (const e of rest) {
+						const failStop = new FailStopError(key);
+						this.terminateQueuedSink(e, failStop.message);
+						if (!this.draining) this.removeInbox(e);
+						e.reject(failStop);
+					}
+					this.inflight.delete(key);
+					return;
 				}
-				this.removeInbox(entry);
-				entry.resolve(sessionId);
-			} catch (err) {
-				if (!this.draining) this.removeInbox(entry);
-				entry.reject(err);
-				const rest = this.serialQueue.get(key) ?? [];
-				this.serialQueue.delete(key);
-				for (const e of rest) {
-					const failStop = new FailStopError(key);
-					this.terminateQueuedSink(e, failStop.message);
-					if (!this.draining) this.removeInbox(e);
-					e.reject(failStop);
-				}
-				this.inflight.delete(key);
-				return;
+				const q = this.serialQueue.get(key);
+				entry = q?.shift();
+				if (q && q.length === 0) this.serialQueue.delete(key);
 			}
-			const q = this.serialQueue.get(key);
-			entry = q?.shift();
-			if (q && q.length === 0) this.serialQueue.delete(key);
+			this.inflight.delete(key);
+		} finally {
+			this.activeGateEntries.delete(key);
 		}
-		this.inflight.delete(key);
 	}
 	async dispatchOne(entry, key) {
 		const { agentId, msg, integrationId, webchat, callMeta, githubReply } = entry;
+		const initialGate = this.dispatchGateReason(entry);
+		if (initialGate) {
+			this.terminateQueuedSink(entry);
+			this.log.info(`dispatch: skipped admitted turn ${msg.msgId} (${initialGate})`);
+			return null;
+		}
 		if (callMeta?.correlationId !== void 0) this.recordWorkerReport(key, callMeta, msg.text);
 		const agent = this.agents.get(agentId);
 		const rec = new TranscriptRecorder();
@@ -217436,11 +218050,15 @@ var Daemon = class Daemon {
 		const releaseReplyConn = this.holdReplyConnection(replyConn);
 		let handled;
 		try {
-			handled = await this.sessions.handle(agentId, msg);
+			handled = await this.sessions.handle(agentId, msg, entry.initAbort.signal);
 		} catch (err) {
+			const interrupted = this.dispatchGateReason(entry);
 			try {
 				this.store.setSessionState(key, "idle", this.clock.now());
-				this.surfaceTurnFailure(err, {
+				if (interrupted) {
+					this.terminateQueuedSink(entry, interrupted);
+					this.showActivity(replyConn, msg.channel, statusThread, "");
+				} else this.surfaceTurnFailure(err, {
 					agentId,
 					webchat,
 					replyConn,
@@ -217451,9 +218069,27 @@ var Daemon = class Daemon {
 			} finally {
 				releaseReplyConn();
 			}
+			if (interrupted) return null;
 			throw err;
 		}
 		const { sessionId, blocks, created } = handled;
+		const initializedGate = this.dispatchGateReason(entry);
+		if (initializedGate) {
+			const interruptedSession = this.store.getSession(key);
+			if (created && interruptedSession?.acpSessionId === sessionId) this.store.upsertSession({
+				...interruptedSession,
+				acpSessionId: null,
+				state: "idle",
+				lastDeliveredTs: null,
+				updatedAt: this.clock.now()
+			});
+			else this.store.setSessionState(key, "idle", this.clock.now());
+			this.showActivity(replyConn, msg.channel, statusThread, "");
+			this.terminateQueuedSink(entry);
+			releaseReplyConn();
+			this.log.info(`dispatch: skipped initialized turn ${msg.msgId} (${initializedGate})`);
+			return null;
+		}
 		if (created) this.emitSessionMetadataSnapshot({
 			sessionId,
 			agentId,
@@ -217464,12 +218100,17 @@ var Daemon = class Daemon {
 		});
 		let resolveDone;
 		const done = new Promise((r) => resolveDone = r);
+		const pendingWebchat = webchat ? Object.assign(webchat, {
+			index: 0,
+			replyText: ""
+		}) : void 0;
 		const p = {
 			conv,
 			rec,
 			agentId,
 			platform: msg.platform,
 			isDm: msg.isDm,
+			loopGuardScope: loopGuardScope(msg),
 			sessionKey: key,
 			acpSessionId: sessionId,
 			channel: msg.channel,
@@ -217481,11 +218122,7 @@ var Daemon = class Daemon {
 			done,
 			resolveDone,
 			...callMeta ? { callMeta } : {},
-			...webchat ? { webchat: {
-				...webchat,
-				index: 0,
-				replyText: ""
-			} } : {},
+			...pendingWebchat ? { webchat: pendingWebchat } : {},
 			...githubReply ? { github: {
 				...this.makeGithubReply(agentId, githubReply, sessionId),
 				deferredFinalTranscript: false
@@ -217504,9 +218141,21 @@ var Daemon = class Daemon {
 			if (effortOverride) await host.setSessionEffort(sessionId, effortOverride).catch((err) => this.log.debug(`effort override "${effortOverride}" not applied: ${err.message}`));
 			const fastOverride = this.store.getFastModeOverride(key);
 			if (fastOverride !== void 0) await host.setSessionFastMode(sessionId, fastOverride).catch((err) => this.log.debug(`fast-mode override ${fastOverride} not applied: ${err.message}`));
+			const readyGate = this.dispatchGateReason(entry);
+			if (readyGate) {
+				this.showActivity(replyConn, msg.channel, statusThread, "");
+				this.terminateQueuedSink(entry);
+				if (readyGate === "loop protection") finalPhase = "problem";
+				this.log.info(`dispatch: skipped ready turn ${msg.msgId} (${readyGate})`);
+				return null;
+			}
 			if (!wasRunning) this.showActivity(replyConn, msg.channel, statusThread, "is thinking…");
 			this.emitStatusBar(p);
 			const { stopReason, usage } = await host.prompt(sessionId, blocks);
+			if (p.outputSuppressed) {
+				if (p.outputSuppressed === "loop protection") finalPhase = "problem";
+				return null;
+			}
 			if (usage) this.store.setTokenUsage(key, {
 				totalTokens: usage.totalTokens,
 				inputTokens: usage.inputTokens,
@@ -217539,12 +218188,15 @@ var Daemon = class Daemon {
 					kind: "text",
 					text: p.webchat.replyText
 				});
-				p.webchat.sink.done({
-					conversationId: p.webchat.conversationId,
-					turnId: p.webchat.turnId,
-					...stopReason ? { stopReason } : {},
-					...usage?.totalTokens !== void 0 ? { usage: { used: usage.totalTokens } } : {}
-				});
+				if (!p.webchat.doneSent) {
+					p.webchat.doneSent = true;
+					p.webchat.sink.done({
+						conversationId: p.webchat.conversationId,
+						turnId: p.webchat.turnId,
+						...stopReason ? { stopReason } : {},
+						...usage?.totalTokens !== void 0 ? { usage: { used: usage.totalTokens } } : {}
+					});
+				}
 			} else {
 				const link = this.sessionLink(sessionId);
 				const finals = conv instanceof TelegramConverger || conv instanceof DiscordConverger ? conv.onFinal(link) : conv.onFinal(link, this.webAppBase(), this.sharedFooterFor(agentId, integrationId));
@@ -217554,6 +218206,10 @@ var Daemon = class Daemon {
 			await p.applyChain;
 		} catch (err) {
 			this.clearIdle(p);
+			if (p.outputSuppressed) {
+				if (p.outputSuppressed === "loop protection") finalPhase = "problem";
+				return null;
+			}
 			finalPhase = "problem";
 			if (p.webchat) {
 				this.surfaceTurnFailure(err, {
@@ -217588,13 +218244,14 @@ var Daemon = class Daemon {
 			}
 			throw err;
 		} finally {
+			this.clearCancelBackstop(sessionId);
+			if (p.outputSuppressed) await p.applyChain.catch(() => {});
 			releaseReplyConn();
 			this.clearIdle(p);
 			this.releasePermissions(sessionId);
 			this.releaseElicits(sessionId);
 			if (callMeta) this.activeTurnCallMeta.delete(key);
-			this.clearCancelBackstop(sessionId);
-			const githubFinal = p.github && finalPhase === "end" ? p.github.collector.finalText(true) : void 0;
+			const githubFinal = p.github && !p.outputSuppressed && finalPhase === "end" ? p.github.collector.finalText(true) : void 0;
 			if (p.github?.deferredFinalTranscript && githubFinal?.trim()) this.store.appendTranscript({
 				channel: p.channel,
 				thread: p.statusThread,
@@ -217603,7 +218260,7 @@ var Daemon = class Daemon {
 				kind: "text",
 				text: githubFinal
 			});
-			if (p.github) await p.github.poster.publish(githubFinal).catch((err) => this.log.warn(`github poster: final publish failed (${formatErr(err)})`));
+			if (p.github && !p.outputSuppressed) await p.github.poster.publish(githubFinal).catch((err) => this.log.warn(`github poster: final publish failed (${formatErr(err)})`));
 			this.pending.delete(sessionId);
 			this.store.setSessionState(key, "idle", this.clock.now());
 			this.emitSessionMetadataSnapshot({
@@ -217618,44 +218275,91 @@ var Daemon = class Daemon {
 		}
 		return sessionId;
 	}
-	/** Interrupt a session by its LOGICAL sessionKey (shared by `!stop`, `!cancel`, and
-	*  webchat cancel): reject+drop anything queued behind it in the serial gate, then — if
+	/** Interrupt a session by its LOGICAL sessionKey (shared by pause, `!stop`, `!cancel`,
+	*  and webchat cancel): settle+drop anything queued behind it in the serial gate, then — if
 	*  a turn is actually in flight (ACP session live) — release any unanswered cards, mark
 	*  it `cancelling`, send ACP `session/cancel`, and arm the force backstop. Works for a
 	*  queued-but-not-yet-started or cold session too (§6.9 #390): draining the queue is
 	*  enough, no ACP id required. Muting is the CALLER's concern — `!stop` mutes,
 	*  `!cancel`/webchat-cancel do not. */
-	interruptTurn(agentId, key, reason, acpSessionId) {
+	interruptTurn(agentId, key, reason, acpSessionId, opts = {}) {
+		this.beginSafetyDrain(agentId, reason, [key]);
+		const activeEntry = this.activeGateEntries.get(key);
+		if (activeEntry) {
+			activeEntry.cancelledReason ??= reason;
+			this.removeInbox(activeEntry);
+		}
 		const queued = this.serialQueue.get(key);
 		if (queued && queued.length > 0) {
 			this.serialQueue.delete(key);
 			for (const e of queued) {
-				this.terminateQueuedSink(e, reason);
+				this.terminateQueuedSink(e, opts.dropQueued ? void 0 : reason);
 				this.removeInbox(e);
-				e.reject(new FailStopError(key));
+				if (opts.dropQueued) e.resolve(null);
+				else e.reject(new FailStopError(key));
+			}
+		}
+		const livePair = acpSessionId ? [acpSessionId, this.pending.get(acpSessionId)] : [...this.pending.entries()].find(([, pending]) => pending.sessionKey === key);
+		const liveSessionId = livePair?.[0];
+		const live = livePair?.[1];
+		if (live) {
+			live.outputSuppressed ??= reason;
+			this.clearIdle(live);
+			this.showActivity(live.conn, live.channel, live.statusThread, "");
+			if (live.webchat && !live.webchat.doneSent) {
+				live.webchat.doneSent = true;
+				live.webchat.sink.done({
+					conversationId: live.webchat.conversationId,
+					turnId: live.webchat.turnId,
+					error: reason
+				});
 			}
+		} else if (activeEntry) {
+			this.terminateQueuedSink(activeEntry, reason);
+			this.showActivity(this.replyConnFor(activeEntry.agentId, activeEntry.integrationId), activeEntry.msg.channel, activeEntry.msg.thread ?? activeEntry.msg.msgId, "");
 		}
-		this.log.info(`command: ${reason} → agent "${agentId}" session ${key}${acpSessionId ? ` (${acpSessionId})` : ""}`);
-		if (!acpSessionId || !this.pending.has(acpSessionId)) return;
-		this.releasePermissions(acpSessionId);
-		this.releaseElicits(acpSessionId);
+		this.log.info(`command: ${reason} → agent "${agentId}" session ${key}${liveSessionId ? ` (${liveSessionId})` : ""}`);
+		if (!liveSessionId || !live) {
+			const active = this.activeDispatchDoneByKey.get(key);
+			if (activeEntry && active) this.armColdCancelBackstop(agentId, key, reason, active);
+			return;
+		}
+		this.releasePermissions(liveSessionId);
+		this.releaseElicits(liveSessionId);
 		this.store.setSessionState(key, "cancelling", this.clock.now());
-		this.hosts.get(agentId)?.cancel(acpSessionId).catch((err) => this.log.error(`command ${reason}: cancel failed: ${err.message}`));
-		this.armCancelBackstop(agentId, acpSessionId, key);
-	}
-	/** After `!stop` sends session/cancel, give the agent `cancelBackstopMs` to yield.
+		this.hosts.get(agentId)?.cancel(liveSessionId).catch((err) => this.log.error(`command ${reason}: cancel failed: ${err.message}`));
+		this.armCancelBackstop(agentId, liveSessionId, key, reason);
+	}
+	/** Interrupt every logical session owned by an agent for a lifecycle gate (pause,
+	*  removal, or host respawn). Active ACP turns are cancelled; queued turns are
+	*  cleanly gate-dropped. A cold head is latched so it cannot resume after teardown. */
+	interruptAgentTurns(agentId, reason) {
+		this.beginSafetyDrain(agentId, reason);
+		this.purgeAgentInbox(agentId);
+		const targets = /* @__PURE__ */ new Map();
+		for (const [key, entry] of this.activeGateEntries) {
+			if (entry.agentId !== agentId) continue;
+			entry.cancelledReason = reason;
+			targets.set(key, void 0);
+		}
+		for (const [acpSessionId, p] of this.pending) if (p.agentId === agentId) targets.set(p.sessionKey, acpSessionId);
+		for (const [key, queued] of this.serialQueue) if (queued.some((entry) => entry.agentId === agentId) && !targets.has(key)) targets.set(key, this.store.getSession(key)?.acpSessionId ?? void 0);
+		if (targets.size > 0) this.log.info(`${reason}: interrupting ${targets.size} active session(s) for agent "${agentId}"`);
+		for (const [key, acpSessionId] of targets) this.interruptTurn(agentId, key, reason, acpSessionId, { dropQueued: true });
+	}
+	/** After an interrupt sends session/cancel, give the agent `cancelBackstopMs` to yield.
 	*  If the turn is still in flight when the timer fires, the agent ignored the
 	*  cancel — force-stop its host (the only hard kill available) so the session
 	*  can't be stuck in `cancelling` forever. dispatch's finally clears this timer
 	*  the moment the turn yields on its own. */
-	armCancelBackstop(agentId, acpSessionId, key) {
+	armCancelBackstop(agentId, acpSessionId, key, reason) {
 		this.clearCancelBackstop(acpSessionId);
 		const ms = this.cfg.limits.cancelBackstopMs;
 		this.cancelTimers.set(acpSessionId, this.clock.setTimeout(() => {
 			this.cancelTimers.delete(acpSessionId);
 			if (!this.pending.has(acpSessionId)) return;
-			this.log.warn(`command stop: agent "${agentId}" ignored session/cancel for ${ms}ms — force-stopping host (session ${acpSessionId})`);
-			this.stopHost(agentId, 0);
+			this.log.warn(`${reason}: agent "${agentId}" ignored session/cancel for ${ms}ms — force-stopping host (session ${acpSessionId})`);
+			this.stopHost(agentId, 0).catch((err) => this.log.error(`${reason}: force-stop failed for agent "${agentId}": ${formatErr(err)}`));
 			this.store.setSessionState(key, "idle", this.clock.now());
 		}, ms));
 	}
@@ -217666,6 +218370,37 @@ var Daemon = class Daemon {
 			this.cancelTimers.delete(acpSessionId);
 		}
 	}
+	armColdCancelBackstop(agentId, key, reason, active) {
+		this.clearColdCancelBackstop(key);
+		const ms = this.cfg.limits.cancelBackstopMs;
+		const timer = this.clock.setTimeout(() => {
+			const current = this.coldCancelTimers.get(key);
+			if (!current || current.active !== active) return;
+			this.coldCancelTimers.delete(key);
+			if (this.activeDispatchDoneByKey.get(key) !== active) return;
+			const entry = this.activeGateEntries.get(key);
+			if (!entry?.cancelledReason) return;
+			this.log.warn(`${reason}: agent "${agentId}" did not finish cold initialization within ${ms}ms — force-stopping host (${key})`);
+			const stopped = this.stopHost(agentId, 0).catch((err) => {
+				this.log.error(`${reason}: cold force-stop failed for agent "${agentId}": ${formatErr(err)}`);
+				return new Promise(() => {});
+			});
+			const waits = this.safetyDrainWaits.get(agentId) ?? /* @__PURE__ */ new Set();
+			waits.add(stopped);
+			this.safetyDrainWaits.set(agentId, waits);
+			entry.initAbort.abort(new Error(reason));
+		}, ms);
+		this.coldCancelTimers.set(key, {
+			timer,
+			active
+		});
+	}
+	clearColdCancelBackstop(key, active) {
+		const current = this.coldCancelTimers.get(key);
+		if (!current || active !== void 0 && current.active !== active) return;
+		this.clock.clearTimeout(current.timer);
+		this.coldCancelTimers.delete(key);
+	}
 	/**
 	* Apply one converger action against the session's Slack connection:
 	*  - set-status → assistant.threads.setStatus (best-effort; '' clears)
@@ -218057,6 +218792,7 @@ var Daemon = class Daemon {
 	*  demand via `/status` (see handleCommand) — so it's skipped here. Headless no-ops in
 	*  applyAction (no connection), which is fine. */
 	emitStatusBar(p) {
+		if (p.outputSuppressed) return;
 		const info = this.buildStatusInfo(p);
 		const key = JSON.stringify(info);
 		if (key === p.lastStatusBar) return;
@@ -218093,7 +218829,11 @@ var Daemon = class Daemon {
 	*  remembered message ts (two concurrent `progress` actions both posting). Routes to
 	*  the platform's applier by the Pending's platform tag. */
 	enqueueApply(p, action) {
-		p.applyChain = p.applyChain.then(() => (p.platform === "telegram" ? this.applyTelegramAction(p, action) : p.platform === "discord" ? this.applyDiscordAction(p, action) : this.applySlackAction(p, action)).catch((err) => this.log.error(`apply failed: ${formatErr(err)}`)));
+		if (p.outputSuppressed) return;
+		p.applyChain = p.applyChain.then(() => {
+			if (p.outputSuppressed) return;
+			return (p.platform === "telegram" ? this.applyTelegramAction(p, action) : p.platform === "discord" ? this.applyDiscordAction(p, action) : this.applySlackAction(p, action)).catch((err) => this.log.error(`apply failed: ${formatErr(err)}`));
+		});
 	}
 	/** (Re)arm the ~2s idle-flush timer when body text is buffered (§9.1 text-buffer):
 	*  a long pure-text stream posts in steps instead of all at turn end. */
@@ -218134,22 +218874,34 @@ var Daemon = class Daemon {
 	async onAcpPermission(_agentId, sessionId, params) {
 		const p = this.pending.get(sessionId);
 		if (!p) return void 0;
+		if (p.outputSuppressed) return { outcome: { outcome: "cancelled" } };
 		const conn = p.conn;
 		if (p.platform !== "slack" || !(conn instanceof SlackConnection)) return void 0;
 		if (!params.options?.length) return void 0;
 		const requestId = `perm-${++this.permSeq}`;
 		const fallback = `Permission requested: ${params.toolCall?.title ?? "a tool call"}`;
-		const ts = await conn.postBlocks(p.channel, buildPermissionCard(requestId, params), fallback, p.statusThread).catch(() => void 0);
-		return await new Promise((resolve) => {
-			this.pendingPerms.set(requestId, {
-				sessionId,
-				params,
-				conn,
-				channel: p.channel,
-				ts,
-				resolve
-			});
+		let resolveResult;
+		const result = new Promise((resolve) => resolveResult = resolve);
+		this.pendingPerms.set(requestId, {
+			sessionId,
+			params,
+			conn,
+			channel: p.channel,
+			resolve: resolveResult
 		});
+		const ts = await conn.postBlocks(p.channel, buildPermissionCard(requestId, params), fallback, p.statusThread).catch(() => void 0);
+		const live = this.pendingPerms.get(requestId);
+		if (!live) {
+			if (ts) conn.updateBlocks(p.channel, ts, buildPermissionResolvedCard(params, "Cancelled", void 0), "Permission cancelled").catch(() => {});
+			return await result;
+		}
+		if (!ts) {
+			this.pendingPerms.delete(requestId);
+			live.resolve({ outcome: { outcome: "cancelled" } });
+			return await result;
+		}
+		live.ts = ts;
+		return await result;
 	}
 	/** A tapped permission-card button (SlackDeps.onPermissionChoice): resolve the pending
 	*  ACP request with the chosen option and edit the card in place to its resolved state
@@ -218189,6 +218941,7 @@ var Daemon = class Daemon {
 	async onAcpElicit(_agentId, sessionId, params) {
 		const p = this.pending.get(sessionId);
 		if (!p) return void 0;
+		if (p.outputSuppressed) return { action: "cancel" };
 		const conn = p.conn;
 		if (p.platform !== "slack" || !(conn instanceof SlackConnection)) return void 0;
 		const target = elicitTarget(params);
@@ -218197,19 +218950,30 @@ var Daemon = class Daemon {
 		const blocks = buildElicitationCard(requestId, params);
 		if (!blocks) return void 0;
 		const fallback = params.message ?? "The agent needs your input";
-		const ts = await conn.postBlocks(p.channel, blocks, fallback, p.statusThread).catch(() => void 0);
-		return await new Promise((resolve) => {
-			this.pendingElicits.set(requestId, {
-				sessionId,
-				params,
-				propName: target.propName,
-				kind: target.kind,
-				conn,
-				channel: p.channel,
-				ts,
-				resolve
-			});
+		let resolveResult;
+		const result = new Promise((resolve) => resolveResult = resolve);
+		this.pendingElicits.set(requestId, {
+			sessionId,
+			params,
+			propName: target.propName,
+			kind: target.kind,
+			conn,
+			channel: p.channel,
+			resolve: resolveResult
 		});
+		const ts = await conn.postBlocks(p.channel, blocks, fallback, p.statusThread).catch(() => void 0);
+		const live = this.pendingElicits.get(requestId);
+		if (!live) {
+			if (ts) conn.updateBlocks(p.channel, ts, buildElicitationResolvedCard(params, ":hourglass: Cancelled"), "Cancelled").catch(() => {});
+			return await result;
+		}
+		if (!ts) {
+			this.pendingElicits.delete(requestId);
+			live.resolve({ action: "cancel" });
+			return await result;
+		}
+		live.ts = ts;
+		return await result;
 	}
 	/** A tapped elicitation-card button (SlackDeps.onElicitChoice): resolve the pending ACP
 	*  request — `accept` with the chosen value (under the field name), or `decline` for the
@@ -218247,6 +219011,7 @@ var Daemon = class Daemon {
 	onAcpUpdate(_agentId, sessionId, update) {
 		const p = this.pending.get(sessionId);
 		if (!p) return;
+		if (p.outputSuppressed) return;
 		if (update?.sessionUpdate === "usage_update") {
 			this.store.setUsageSnapshot(p.sessionKey, {
 				contextUsed: update.used,
@@ -218374,15 +219139,37 @@ var Daemon = class Daemon {
 			text: ev.text
 		});
 	}
-	async ensureHostAsync(agentId) {
+	invalidateHostStart(agentId) {
+		this.hostStartGeneration.set(agentId, (this.hostStartGeneration.get(agentId) ?? 0) + 1);
+		this.hostStarts.delete(agentId);
+		this.hostStartAborts.get(agentId)?.abort(/* @__PURE__ */ new Error(`host start superseded for ${agentId}`));
+		this.hostStartAborts.delete(agentId);
+	}
+	async ensureHostAsync(agentId, opts = {}) {
+		const assertStartAllowed = () => {
+			if (this.draining) throw new Error(`host start blocked while daemon is draining (${agentId})`);
+			if (this.safetyDrainingAgents.has(agentId) && !this.hostStarts.has(agentId)) throw new Error(`host start blocked while interrupted turns are stopping (${agentId})`);
+			if (!opts.allowAgentDrain && this.drainingAgents.has(agentId)) throw new Error(`host start blocked while agent is draining (${agentId})`);
+		};
+		assertStartAllowed();
 		const stopping = this.hostStopping.get(agentId);
-		if (stopping) await stopping;
+		if (stopping) {
+			await stopping;
+			assertStartAllowed();
+		}
 		let p = this.hostStarts.get(agentId);
 		if (!p) {
-			p = this.startHostWithRetry(agentId);
+			const generation = (this.hostStartGeneration.get(agentId) ?? 0) + 1;
+			this.hostStartGeneration.set(agentId, generation);
+			const startAbort = new AbortController();
+			this.hostStartAborts.set(agentId, startAbort);
+			p = this.startHostWithRetry(agentId, generation, startAbort.signal);
 			this.hostStarts.set(agentId, p);
-			p.catch(() => {
+			p.then(() => {
+				if (this.hostStartAborts.get(agentId) === startAbort) this.hostStartAborts.delete(agentId);
+			}, () => {
 				if (this.hostStarts.get(agentId) === p) this.hostStarts.delete(agentId);
+				if (this.hostStartAborts.get(agentId) === startAbort) this.hostStartAborts.delete(agentId);
 			});
 		}
 		return await p;
@@ -218392,7 +219179,7 @@ var Daemon = class Daemon {
 	*  builds a FRESH host; a failed start()'s half-spawned child is reaped before the
 	*  next try. On success the started host is left memoized in `this.hosts`; when every
 	*  attempt fails the last error is thrown (dispatch surfaces it to the session). */
-	async startHostWithRetry(agentId) {
+	async startHostWithRetry(agentId, generation, signal) {
 		const attempts = Math.max(1, this.cfg.limits.agentStartAttempts);
 		let ghToken;
 		const agentSpec = this.agents.get(agentId);
@@ -218401,30 +219188,46 @@ var Daemon = class Daemon {
 		} catch (err) {
 			this.log.warn(`gitcred: GH_TOKEN unavailable for agent "${agentId}" — spawning without it (${formatErr(err)})`);
 		}
+		if (this.hostStartGeneration.get(agentId) !== generation) throw new Error(`host start superseded for ${agentId}`);
 		let lastErr;
 		for (let i = 1; i <= attempts; i++) {
+			if (this.hostStartGeneration.get(agentId) !== generation) throw new Error(`host start superseded for ${agentId}`);
 			const host = this.ensureHost(agentId, this.cfg, ghToken);
 			try {
 				await host.start();
+				if (this.hostStartGeneration.get(agentId) !== generation) throw new Error(`host start superseded for ${agentId}`);
 				return host;
 			} catch (err) {
 				lastErr = err;
-				this.hosts.delete(agentId);
+				if (this.hosts.get(agentId) === host) this.hosts.delete(agentId);
 				await host.stop().catch(() => {});
+				if (this.hostStartGeneration.get(agentId) !== generation) throw err;
 				if (i < attempts) {
 					const backoff = this.cfg.limits.agentStartBackoffMs;
 					this.log.warn(`acp: agent "${agentId}" start attempt ${i}/${attempts} failed (${err.message}) — retrying in ${backoff}ms`);
-					await this.sleep(backoff);
+					await this.sleep(backoff, signal);
 				} else this.log.error(`acp: agent "${agentId}" failed to start after ${attempts} attempt(s): ${formatErr(err)}`);
 			}
 		}
 		throw lastErr;
 	}
 	/** Clock-driven delay (so a FakeClock stays deterministic in tests). */
-	sleep(ms) {
+	sleep(ms, signal) {
 		const delay = Math.min(Math.max(0, ms), 2147483647);
 		return new Promise((resolve) => {
-			this.clock.setTimeout(() => resolve(), delay);
+			if (signal?.aborted) {
+				resolve();
+				return;
+			}
+			const timer = this.clock.setTimeout(() => {
+				signal?.removeEventListener("abort", onAbort);
+				resolve();
+			}, delay);
+			const onAbort = () => {
+				this.clock.clearTimeout(timer);
+				resolve();
+			};
+			signal?.addEventListener("abort", onAbort, { once: true });
 		});
 	}
 	replyConnFor(agentId, integrationId) {
@@ -218444,12 +219247,17 @@ var Daemon = class Daemon {
 	*  is registered in `hostStopping` so a concurrent ensureHostAsync waits for it
 	*  instead of spawning a second live child. */
 	async stopHost(agentId, deadlineMs) {
+		this.invalidateHostStart(agentId);
+		const alreadyStopping = this.hostStopping.get(agentId);
+		if (alreadyStopping) {
+			await alreadyStopping;
+			this.invalidateHostStart(agentId);
+		}
 		const host = this.hosts.get(agentId);
 		this.hosts.delete(agentId);
-		this.hostStarts.delete(agentId);
 		this.hostStartedAt.delete(agentId);
 		if (!host) return;
-		const stop = host.stop(deadlineMs).finally(() => {
+		const stop = Promise.resolve(host.stop(deadlineMs)).finally(() => {
 			if (this.hostStopping.get(agentId) === stop) this.hostStopping.delete(agentId);
 		});
 		this.hostStopping.set(agentId, stop);
@@ -218632,13 +219440,44 @@ var Daemon = class Daemon {
 	*  to `shutdownDrainMs`, cancelling stragglers. Safe to call repeatedly. */
 	async drainForShutdown() {
 		this.draining = true;
-		const live = [...this.pending.values()];
-		if (live.length > 0) {
+		const active = [...new Set([...this.activeDispatchesByAgent.values()].flatMap((runs) => [...runs]))];
+		const pendingKeys = new Set([...this.pending.values()].map((p) => p.sessionKey));
+		const coldAgents = /* @__PURE__ */ new Set();
+		for (const [key, entry] of this.activeGateEntries) {
+			if (pendingKeys.has(key)) continue;
+			entry.cancelledReason ??= "shutdown";
+			entry.initAbort.abort(/* @__PURE__ */ new Error("daemon shutting down"));
+			coldAgents.add(entry.agentId);
+		}
+		const stopFailClosed = (agentId) => this.stopHost(agentId, 0).catch((err) => {
+			this.log.error(`shutdown: force-stop failed for agent "${agentId}": ${formatErr(err)}`);
+			return new Promise(() => {});
+		});
+		const coldStops = [...coldAgents].map(stopFailClosed);
+		const work = Promise.all([...active, ...coldStops]);
+		if (active.length > 0 || coldStops.length > 0) {
 			const deadlineMs = this.cfg.limits.shutdownDrainMs;
-			this.log.info(`shutdown: draining ${live.length} in-flight turn(s) (deadline ${Math.round(deadlineMs / 1e3)}s)`);
-			if (await this.raceDeadline(Promise.all(live.map((p) => p.done)), deadlineMs) === "timeout") {
-				this.log.warn(`shutdown: deadline hit with ${this.pending.size} turn(s) still in flight — cancelling`);
-				for (const [sid, p] of this.pending) await this.hosts.get(p.agentId)?.cancel(sid).catch(() => {});
+			this.log.info(`shutdown: draining ${active.length} active dispatch(es) (deadline ${Math.round(deadlineMs / 1e3)}s)`);
+			if (await this.raceDeadline(work, deadlineMs) === "timeout") {
+				this.log.warn(`shutdown: deadline hit with ${this.pending.size} ACP turn(s) still in flight — cancelling`);
+				const forceAgents = /* @__PURE__ */ new Set();
+				for (const [, entry] of this.activeGateEntries) {
+					entry.cancelledReason ??= "shutdown";
+					entry.initAbort.abort(/* @__PURE__ */ new Error("daemon shutdown deadline"));
+					forceAgents.add(entry.agentId);
+				}
+				for (const [sid, p] of this.pending) {
+					p.outputSuppressed ??= "shutdown";
+					this.releasePermissions(sid);
+					this.releaseElicits(sid);
+					this.hosts.get(p.agentId)?.cancel(sid).catch(() => {});
+				}
+				const forceStops = [...forceAgents].filter((id) => !coldAgents.has(id)).map(stopFailClosed);
+				await Promise.all([
+					...active,
+					...coldStops,
+					...forceStops
+				]);
 			}
 		}
 		this.settleQueuedForShutdown();
@@ -218675,12 +219514,21 @@ var Daemon = class Daemon {
 		}
 		if (rows.length === 0) return;
 		let replayed = 0;
+		const purgedPausedAgents = /* @__PURE__ */ new Set();
+		const purgedLoopScopes = /* @__PURE__ */ new Set();
 		for (const row of rows) {
 			if (this.liveInboxIds.has(row.id)) continue;
 			if (!this.agents.has(row.agentId)) {
 				this.log.warn(`durable inbox: skipping replay of ${row.id} — unknown agent "${row.agentId}"`);
 				continue;
 			}
+			if (this.paused(row.agentId)) {
+				if (!purgedPausedAgents.has(row.agentId)) {
+					purgedPausedAgents.add(row.agentId);
+					this.purgeAgentInbox(row.agentId);
+				}
+				continue;
+			}
 			let msg;
 			let callMeta;
 			try {
@@ -218690,7 +219538,24 @@ var Daemon = class Daemon {
 				this.log.warn(`durable inbox: skipping corrupt row ${row.id}: ${err.message}`);
 				continue;
 			}
-			this.dispatch(row.agentId, msg, row.integrationId ?? void 0, void 0, callMeta, row.isQueueCmd ? { isQueueCmd: true } : void 0).catch(() => {});
+			if (isMalformedPlatformTurn(msg) && !msg.isDm) {
+				this.store.removeInbox(row.id);
+				continue;
+			}
+			const loopScope = loopGuardScope(msg);
+			if (usesLoopGuard(msg) && this.store.isLoopGuardOpen(loopScope)) {
+				if (!purgedLoopScopes.has(loopScope)) {
+					purgedLoopScopes.add(loopScope);
+					this.purgeLoopScopeInbox(loopScope);
+				}
+				continue;
+			}
+			this.dispatch(row.agentId, msg, row.integrationId ?? void 0, void 0, callMeta, {
+				...row.isQueueCmd ? { isQueueCmd: true } : {},
+				fromInboxReplay: true,
+				inboxReplayId: row.id,
+				replay: row.loopGuardCounted === 1
+			}).catch(() => {});
 			replayed++;
 		}
 		if (replayed) this.log.info(`durable inbox: replayed ${replayed} admitted message(s) through the serial gate`);
@@ -218860,7 +219725,7 @@ var Daemon = class Daemon {
 							};
 						}
 						try {
-							await this.ensureHostAsync(agentId);
+							await this.ensureHostAsync(agentId, { allowAgentDrain: true });
 						} catch (err) {
 							this.moveStagedAgents.add(agentId);
 							await this.stopHost(agentId).catch(() => {});
@@ -218952,6 +219817,10 @@ var Daemon = class Daemon {
 	* in dispatch. Resolves with dispatch's sessionId (null = gate-dropped).
 	*/
 	async fireTrigger(agentId, msg, target, anchorText, label, githubReply) {
+		if (this.draining || this.drainingAgents.has(agentId) || this.paused(agentId) || this.safetyDrainingAgents.has(agentId)) {
+			this.log.info(`${label}: skipped for agent "${agentId}" (paused or draining)`);
+			return null;
+		}
 		if (target?.channel) {
 			const conn = this.replyConnFor(agentId, target.integrationId);
 			if (!conn) this.log.warn(`${label}: agent "${agentId}" has no live platform connection — running without output`);
@@ -219216,6 +220085,8 @@ var Daemon = class Daemon {
 		}
 		for (const t of this.cancelTimers.values()) this.clock.clearTimeout(t);
 		this.cancelTimers.clear();
+		for (const { timer } of this.coldCancelTimers.values()) this.clock.clearTimeout(timer);
+		this.coldCancelTimers.clear();
 		for (const t of this.slackRetryTimers.values()) this.clock.clearTimeout(t);
 		this.slackRetryTimers.clear();
 		for (const t of this.orchestrationDeadlines.values()) this.clock.clearTimeout(t);
@@ -219232,7 +220103,14 @@ var Daemon = class Daemon {
 		for (const c of this.sharedSlackConns.values()) await Promise.resolve(c.stop()).catch((e) => errors.push(e));
 		for (const c of this.telegramConns) await Promise.resolve(c.stop()).catch((e) => errors.push(e));
 		for (const c of this.discordConns) await Promise.resolve(c.stop()).catch((e) => errors.push(e));
-		for (const h of this.hosts.values()) await Promise.resolve(h.stop()).catch((e) => errors.push(e));
+		const hostStarts = [...this.hostStarts.values()];
+		const hostIds = /* @__PURE__ */ new Set([
+			...this.hosts.keys(),
+			...this.hostStarts.keys(),
+			...this.hostStopping.keys()
+		]);
+		for (const agentId of hostIds) await this.stopHost(agentId).catch((e) => errors.push(e));
+		await Promise.allSettled(hostStarts);
 		await Promise.resolve(this.mcp?.stop()).catch((e) => errors.push(e));
 		this.gitCredServer?.stop();
 		this.store?.close();
@@ -219272,4 +220150,4 @@ async function runForeground(opts, deps = {}) {
 //#endregion
 export { ClientTransport as i, CP_SUBPROTOCOL as n, CP_WS_PATH as r, runForeground as t };
 
-//# sourceMappingURL=run-foreground-DrYgPjW_.js.map
+//# sourceMappingURL=run-foreground-DoM1PkHn.js.map