@songsid/agend 2.1.10-beta.1 → 2.1.10-beta.3

package/dist/coredump-filter.js

@@ -0,0 +1,64 @@
+/**
+ * Keep crash dumps small, from inside the fleet (#1113 hotfix).
+ *
+ * On WSL every crash is piped to /wsl-capture-crash, which ignores
+ * RLIMIT_CORE, so kiro-cli and the fleet left ~1 GB / ~450 MB dumps in
+ * %TEMP%\wsl-crashes. A zero /proc/<pid>/coredump_filter writes no memory
+ * mappings into a dump (a few KB). The unit's `CoredumpFilter=0` was meant to
+ * set it, but systemd 249 silently ignores that directive in a unit file
+ * (only a transient `systemd-run -p` honours it), so the fleet sets its own
+ * filter at startup instead. The value is inherited across fork/exec by a
+ * tmux server the fleet starts; panes of a server that already existed get
+ * it from coredumpFilterLaunchPrefix below.
+ *
+ * Linux only. No privilege needed: a process may always narrow its own filter.
+ */
+import { readFileSync, writeFileSync } from "node:fs";
+export function disableCoredumpMemory(path = "/proc/self/coredump_filter", platform = process.platform, env = process.env) {
+    if (platform !== "linux")
+        return "unsupported";
+    // An operator debugging a crash keeps full dumps (and any filter they set).
+    if (env.AGEND_KEEP_COREDUMP_FILTER === "1")
+        return "kept";
+    try {
+        if (/^0+$/.test(readFileSync(path, "utf-8").trim()))
+            return "already";
+    }
+    catch {
+        return "unsupported"; // no such file: a kernel without it
+    }
+    try {
+        writeFileSync(path, "0");
+        return /^0+$/.test(readFileSync(path, "utf-8").trim()) ? "set" : "failed";
+    }
+    catch {
+        return "failed";
+    }
+}
+/**
+ * The fleet process's start-up step: called once the fleet owns its lock,
+ * before anything is spawned, so a tmux server it starts inherits it.
+ */
+export function limitFleetCoreDumps(log, disable = disableCoredumpMemory) {
+    const outcome = disable();
+    if (outcome === "set" || outcome === "already")
+        log.info("Crash dumps limited to a few KB (coredump_filter=0 for the fleet and every CLI it launches).");
+    else if (outcome === "failed")
+        log.error("⚠ Could not set /proc/self/coredump_filter to 0; a crash may write a full-size core dump (#1113).");
+}
+/**
+ * Shell prefix for AgEnD's own CLI launch commands (#1125 review). The fleet's
+ * filter reaches a CLI only if the tmux server was started by this fleet; a
+ * server that already existed (the default socket may hold a user's own
+ * session, which AgEnD reuses and never kills) forks panes with ITS filter.
+ * So each launch sets the filter of the pane's own shell before the CLI
+ * starts: `echo` is a builtin in sh, bash, zsh and fish, the redirect order
+ * silences a failure, and the CLI and everything it spawns inherit the value.
+ * Empty where it does not apply or the operator opted out.
+ */
+export function coredumpFilterLaunchPrefix(platform = process.platform, env = process.env) {
+    if (platform !== "linux" || env.AGEND_KEEP_COREDUMP_FILTER === "1")
+        return "";
+    return "echo 0 2>/dev/null >/proc/self/coredump_filter; ";
+}
+//# sourceMappingURL=coredump-filter.js.map

package/dist/coredump-filter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"coredump-filter.js","sourceRoot":"","sources":["../src/coredump-filter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAItD,MAAM,UAAU,qBAAqB,CACnC,IAAI,GAAG,4BAA4B,EACnC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,aAAa,CAAC;IAC/C,4EAA4E;IAC5E,IAAI,GAAG,CAAC,0BAA0B,KAAK,GAAG;QAAE,OAAO,MAAM,CAAC;IAC1D,IAAI,CAAC;QACH,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,OAAO,SAAS,CAAC;IACxE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC,CAAC,oCAAoC;IAC5D,CAAC;IACD,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC5E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAA0D,EAC1D,UAAgD,qBAAqB;IAErE,MAAM,OAAO,GAAG,OAAO,EAAE,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,IAAI,OAAO,KAAK,SAAS;QAAE,GAAG,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;SACpJ,IAAI,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,KAAK,CAAC,mGAAmG,CAAC,CAAC;AAChJ,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,WAA4B,OAAO,CAAC,QAAQ,EAC5C,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,0BAA0B,KAAK,GAAG;QAAE,OAAO,EAAE,CAAC;IAC9E,OAAO,kDAAkD,CAAC;AAC5D,CAAC"}

package/dist/daemon.d.ts

@@ -47,6 +47,13 @@ export declare const DEFAULT_STATE_SAFETY_SWEEP_MS = 60000;
 export declare const PERIODIC_REDRAW_PROBE_MS = 25;
 /** Do not turn a streaming Codex turn into one capture-pane per burst. */
 export declare const STRUCTURED_IDLE_PROBE_MS = 500;
+/**
+ * An instance publishing more than this many execution-state edges inside the
+ * window is flapping; its edges stop being logged one by one (#1116). One
+ * flapping muse wrote 89,532 of the fleet's 91,000 state-change lines.
+ */
+export declare const STATE_EDGE_LOG_BURST = 10;
+export declare const STATE_EDGE_LOG_WINDOW_MS = 60000;
 /** How long an unrecognised-but-empty composer must stay unchanged before it counts as idle (#978). */
 export declare const UNKNOWN_LAYOUT_STABLE_MS = 10000;
 /** A foreground server/port-forward should hand control back or be acknowledged. */
@@ -472,6 +479,15 @@ export declare class Daemon extends EventEmitter {
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
     private autoResolvedDialogKey;
     private autoResolvedDialogGeneration;
+    /**
+     * (#1103) Proof that THIS spawn's Codex went onto Luna Reserve: AgEnD saw (and
+     * answered) the usage-limit menu that codex shows when it switches itself to
+     * the reserve. `count` is how many usage-limit lines the pane held at that
+     * moment; only occurrences up to it are the text of the incident we already
+     * handled. A later, larger count is a NEW hit (the reserve ran out too).
+     * Keyed by spawn generation, so a respawn starts without any proof.
+     */
+    private codexReserveAck;
     private backgroundSessionRecoveryAttempted;
     /** Whether the last spawn started a fresh session (not resumed). */
     isNewSession: boolean;
@@ -488,6 +504,10 @@ export declare class Daemon extends EventEmitter {
     /** Consecutive structural idle captures for a noisy, periodically-redrawing
      * pane.  Two are required before a working -> idle transition. */
     private instanceStatePeriodicIdleConfirmations;
+    /** Recent execution-state edge times, for the flap log limiter (#1116). */
+    private stateEdgeTimes;
+    private stateEdgesNotLogged;
+    private stateEdgeSummaryAt;
     /** #978: last unrecognised-but-empty-composer capture and since when it has been unchanged. */
     private unknownLayoutPaneKey;
     private unknownLayoutStableSince;
@@ -693,6 +713,15 @@ export declare class Daemon extends EventEmitter {
      * notice is scrollback, not a reason to pause and send /quit.
      */
     private isCodexLivePaneSnapshot;
+    /** The Codex "usage limit reached" pause pattern (the only one the reserve proof applies to). */
+    private static isCodexUsageLimitPause;
+    private static countPatternMatches;
+    /**
+     * Record that the Luna Reserve menu is (or was just) on screen, for the
+     * usage-limit decision in evaluateErrorPatterns. Called wherever a dialog is
+     * matched, before any key is sent.
+     */
+    private noteCodexReserveDialog;
     /** Re-check the current pane after an async quota probe before pausing it. */
     isCodexLivePane(): Promise<boolean>;
     /** Whether this instance is in a crash loop (3+ consecutive crashes). */
@@ -893,6 +922,14 @@ export declare class Daemon extends EventEmitter {
      * the pane monitor to capture it would re-create a false idle state.
      */
     /**
+     * The CLI was replaced under a running instance by one that cannot run it as
+     * configured — kiro-cli auto-updating to a release without the instance's
+     * UI/engine (#1109). Every respawn would refuse the same way, so stop
+     * supervising and say why instead of failing every 30 seconds.
+     */
+    private stopOnUnsupportedCliRespawn;
+    /**
+     * Announce that this instance is no longer being supervised.  /**
      * Announce that this instance is no longer being supervised.
      *
      * Four health-check exits set `healthCheckPaused = true` and returned without
@@ -1040,6 +1077,14 @@ export declare class Daemon extends EventEmitter {
     pause(reason?: PauseReason): Promise<void>;
     /** Respawn the CLI in the preserved window and block until its prompt is ready. */
     wake(timeoutMs?: number): Promise<void>;
+    /**
+     * One line per edge, until the instance is flapping. The edges themselves are
+     * still published to every observer; only the log is limited, so the next
+     * flap cannot bury the fleet log the way #1116 did. The first suppressed edge
+     * warns once (that is the signal worth reading), and a summary follows every
+     * window while it lasts and at the first edge after it calms.
+     */
+    private logStateEdge;
     private applyInstanceStateSnapshot;
     /**
      * An inbound message is in the CLI — the turn it starts owns the proxy-reply

package/dist/daemon.js

@@ -1,9 +1,11 @@
 import { join, dirname, basename, resolve } from "node:path";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
 import { fileURLToPath } from "node:url";
+import { ensureInstanceDir } from "./private-dir.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { rotateLogIfNeeded } from "./logger.js";
+import { coredumpFilterLaunchPrefix } from "./coredump-filter.js";
 import { mcpServerState } from "./mcp-liveness.js";
 import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
 import { TmuxManager, resolveTmuxLogicalSize } from "./tmux-manager.js";
@@ -18,7 +20,7 @@ import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
 import { daemonBudgetMs } from "./channel/ipc-timeouts.js";
 import { MessageBus } from "./channel/message-bus.js";
-import { shellQuote } from "./backend/types.js";
+import { shellQuote, UnsupportedCliError } from "./backend/types.js";
 import { getTmuxSession } from "./config.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { HangDetector } from "./hang-detector.js";
@@ -97,6 +99,13 @@ export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
 export const PERIODIC_REDRAW_PROBE_MS = 25;
 /** Do not turn a streaming Codex turn into one capture-pane per burst. */
 export const STRUCTURED_IDLE_PROBE_MS = 500;
+/**
+ * An instance publishing more than this many execution-state edges inside the
+ * window is flapping; its edges stop being logged one by one (#1116). One
+ * flapping muse wrote 89,532 of the fleet's 91,000 state-change lines.
+ */
+export const STATE_EDGE_LOG_BURST = 10;
+export const STATE_EDGE_LOG_WINDOW_MS = 60_000;
 /** How long an unrecognised-but-empty composer must stay unchanged before it counts as idle (#978). */
 export const UNKNOWN_LAYOUT_STABLE_MS = 10_000;
 /** A foreground server/port-forward should hand control back or be acknowledged. */
@@ -161,7 +170,7 @@ export function readLastInboundAt(instanceDir, now = Date.now()) {
 }
 /** Atomically persist the last real channel inbound timestamp. */
 export function writeLastInboundAt(instanceDir, timestamp) {
-    mkdirSync(instanceDir, { recursive: true });
+    ensureInstanceDir(instanceDir);
     const target = join(instanceDir, LAST_INBOUND_FILE);
     const temp = `${target}.${process.pid}.tmp`;
     writeFileSync(temp, String(timestamp));
@@ -1020,6 +1029,15 @@ export class Daemon extends EventEmitter {
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
     autoResolvedDialogKey = null;
     autoResolvedDialogGeneration = 0;
+    /**
+     * (#1103) Proof that THIS spawn's Codex went onto Luna Reserve: AgEnD saw (and
+     * answered) the usage-limit menu that codex shows when it switches itself to
+     * the reserve. `count` is how many usage-limit lines the pane held at that
+     * moment; only occurrences up to it are the text of the incident we already
+     * handled. A later, larger count is a NEW hit (the reserve ran out too).
+     * Keyed by spawn generation, so a respawn starts without any proof.
+     */
+    codexReserveAck = null;
     backgroundSessionRecoveryAttempted = false;
     /** Whether the last spawn started a fresh session (not resumed). */
     isNewSession = false;
@@ -1037,6 +1055,10 @@ export class Daemon extends EventEmitter {
     /** Consecutive structural idle captures for a noisy, periodically-redrawing
      * pane.  Two are required before a working -> idle transition. */
     instanceStatePeriodicIdleConfirmations = 0;
+    /** Recent execution-state edge times, for the flap log limiter (#1116). */
+    stateEdgeTimes = [];
+    stateEdgesNotLogged = 0;
+    stateEdgeSummaryAt = 0;
     /** #978: last unrecognised-but-empty-composer capture and since when it has been unchanged. */
     unknownLayoutPaneKey = null;
     unknownLayoutStableSince = 0;
@@ -1275,6 +1297,27 @@ export class Daemon extends EventEmitter {
             return false;
         }
     }
+    /** The Codex "usage limit reached" pause pattern (the only one the reserve proof applies to). */
+    static isCodexUsageLimitPause(ep) {
+        return ep.type === "quota" && ep.action === "pause" && ep.message.startsWith("Codex usage limit reached");
+    }
+    static countPatternMatches(pattern, text) {
+        const flags = pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g";
+        return (text.match(new RegExp(pattern.source, flags)) || []).length;
+    }
+    /**
+     * Record that the Luna Reserve menu is (or was just) on screen, for the
+     * usage-limit decision in evaluateErrorPatterns. Called wherever a dialog is
+     * matched, before any key is sent.
+     */
+    noteCodexReserveDialog(dialog, pane) {
+        if (dialog.autoResolutionKey !== "codex-usage-limit-luna-reserve" || this.backend?.binaryName !== "codex")
+            return;
+        const ep = this.backend.getErrorPatterns?.().find(candidate => Daemon.isCodexUsageLimitPause(candidate));
+        const count = ep ? Daemon.countPatternMatches(ep.pattern, pane) : 0;
+        this.codexReserveAck = { generation: this.spawnGeneration, count };
+        this.logger.info({ backend: "codex", evidence: "reserve-menu-seen", usageLimitLines: count }, "codex usage-limit: the Luna Reserve menu was seen — usage-limit text up to this count is stale");
+    }
     /** Re-check the current pane after an async quota probe before pausing it. */
     async isCodexLivePane() {
         if (this.backend?.binaryName !== "codex" || !this.tmux)
@@ -1575,7 +1618,7 @@ export class Daemon extends EventEmitter {
         }
     }
     async start() {
-        mkdirSync(this.instanceDir, { recursive: true });
+        ensureInstanceDir(this.instanceDir);
         writeFileSync(join(this.instanceDir, "daemon.pid"), String(process.pid));
         this.logger.info(`Starting ${this.name}`);
         // P1: Read crash state from previous run — skip resume if last run was a crash loop
@@ -2519,6 +2562,10 @@ export class Daemon extends EventEmitter {
                             this.stormWindow?.markRecovered(this.name);
                     }
                     catch (err) {
+                        if (this.stopOnUnsupportedCliRespawn(err)) {
+                            this.healthCheckTimer = null;
+                            return;
+                        }
                         if (!this.handOffBackendUnreachableRespawn(err)) {
                             this.logger.error({ err }, `Failed to respawn ${cliLabel} window`);
                         }
@@ -2552,6 +2599,21 @@ export class Daemon extends EventEmitter {
      * the pane monitor to capture it would re-create a false idle state.
      */
     /**
+     * The CLI was replaced under a running instance by one that cannot run it as
+     * configured — kiro-cli auto-updating to a release without the instance's
+     * UI/engine (#1109). Every respawn would refuse the same way, so stop
+     * supervising and say why instead of failing every 30 seconds.
+     */
+    stopOnUnsupportedCliRespawn(err) {
+        if (!(err instanceof UnsupportedCliError))
+            return false;
+        this.healthCheckPaused = true;
+        this.logger.error({ reason: err.message }, "Not respawning: the installed CLI cannot run this instance as configured");
+        this.emitSupervisionEnded(err.message, "Install a CLI version that supports this instance's configuration, then start it again.");
+        return true;
+    }
+    /**
+     * Announce that this instance is no longer being supervised.  /**
      * Announce that this instance is no longer being supervised.
      *
      * Four health-check exits set `healthCheckPaused = true` and returned without
@@ -2665,6 +2727,7 @@ export class Daemon extends EventEmitter {
                 for (const dialog of dialogs) {
                     if (!Daemon.dialogMatches(dialog, pane))
                         continue;
+                    this.noteCodexReserveDialog(dialog, pane);
                     if (dialog.blocksDelivery || dialog.holdOnly)
                         blockingSeen = dialog;
                     if (dialog.holdOnly)
@@ -2852,15 +2915,29 @@ export class Daemon extends EventEmitter {
             const count = countMatches(ep.pattern);
             const seen = this.lastErrorCount.get(key) ?? 0;
             // The generic Codex usage-limit line remains in scrollback after the
-            // user selects Luna Reserve. A live composer + Context footer is positive
-            // evidence that the pane recovered; baseline the stale occurrence so it
-            // cannot reach the destructive quota pause path.
-            if (codexLivePane && ep.type === "quota" && ep.action === "pause"
-                && ep.message.startsWith("Codex usage limit reached")) {
-                if (count > 0)
+            // user selects Luna Reserve. What proves that is NOT a live composer —
+            // codex paints one after a plain hit too, and the old live-composer guard
+            // therefore swallowed every real hit (#1103) — but AgEnD having seen the
+            // Luna Reserve menu in this spawn. Occurrences up to that point are the
+            // incident we already handled; anything beyond is a new hit and goes on to
+            // the lifecycle, whose usage probe decides (available / reserve / exhausted).
+            if (Daemon.isCodexUsageLimitPause(ep)) {
+                const ack = this.codexReserveAck;
+                if (ack && ack.generation === this.spawnGeneration && count <= ack.count) {
+                    // The handled incident's lines can scroll out of the capture buffer as
+                    // the reserve session talks on. Lower the proof (and the occurrence
+                    // baseline) with them: otherwise `count <= ack.count` would keep
+                    // swallowing a NEW hit — the reserve running out — until it exceeded
+                    // the menu-time count, and it would never reach the lifecycle probe.
+                    if (count < ack.count)
+                        ack.count = count;
                     this.lastErrorCount.set(key, count);
-                this.logger.debug("Codex usage-limit text is stale — live reserve pane is running");
-                continue;
+                    this.logger.debug({ decision: "ignore", evidence: "reserve-menu-seen", count, acknowledged: ack.count }, "codex usage-limit: stale text of the handled Luna Reserve incident");
+                    continue;
+                }
+                if (count > seen) {
+                    this.logger.info({ decision: "candidate", evidence: ack && ack.generation === this.spawnGeneration ? "new-hit-after-reserve" : "no-reserve-proof", count, livePane: codexLivePane }, "codex usage-limit: new occurrence — handing to the quota probe");
+                }
             }
             if (count <= seen) {
                 // Occurrences scrolled out of the capture buffer → lower the baseline
@@ -3632,6 +3709,39 @@ export class Daemon extends EventEmitter {
                 this.pauseWakeTransition = null;
         }
     }
+    /**
+     * One line per edge, until the instance is flapping. The edges themselves are
+     * still published to every observer; only the log is limited, so the next
+     * flap cannot bury the fleet log the way #1116 did. The first suppressed edge
+     * warns once (that is the signal worth reading), and a summary follows every
+     * window while it lasts and at the first edge after it calms.
+     */
+    logStateEdge(previous, snapshot) {
+        const now = Date.now();
+        this.stateEdgeTimes.push(now);
+        while (this.stateEdgeTimes.length && this.stateEdgeTimes[0] <= now - STATE_EDGE_LOG_WINDOW_MS)
+            this.stateEdgeTimes.shift();
+        const edges = this.stateEdgeTimes.length;
+        const fields = { previousState: previous, state: snapshot.state, unchangedForMs: snapshot.unchangedForMs };
+        if (edges <= STATE_EDGE_LOG_BURST) {
+            if (this.stateEdgesNotLogged > 0) {
+                this.logger.info({ notLogged: this.stateEdgesNotLogged }, "Instance execution state edges were not logged while it was flapping");
+                this.stateEdgesNotLogged = 0;
+            }
+            this.logger.info(fields, "Instance execution state changed");
+            return;
+        }
+        if (this.stateEdgesNotLogged === 0) {
+            this.stateEdgeSummaryAt = now;
+            this.logger.warn({ edgesInWindow: edges, windowMs: STATE_EDGE_LOG_WINDOW_MS, backend: this.backend?.binaryName }, "Instance execution state is flapping — per-edge logging suppressed; the pane is repainting without a stable idle/working reading");
+        }
+        else if (now - this.stateEdgeSummaryAt >= STATE_EDGE_LOG_WINDOW_MS) {
+            this.stateEdgeSummaryAt = now;
+            this.logger.warn({ notLogged: this.stateEdgesNotLogged, edgesInWindow: edges }, "Instance execution state is still flapping");
+        }
+        this.stateEdgesNotLogged++;
+        this.logger.debug(fields, "Instance execution state changed (flapping, not logged at info)");
+    }
     applyInstanceStateSnapshot(snapshot, pane) {
         const previous = this.instanceState;
         // A live safety menu owns stdin.  It may still contain Claude's persistent
@@ -3667,11 +3777,7 @@ export class Daemon extends EventEmitter {
                 this.maybeProxyReplyOnTurnEnd(pane);
         }
         if (snapshot.state !== previous) {
-            this.logger.info({
-                previousState: previous,
-                state: snapshot.state,
-                unchangedForMs: snapshot.unchangedForMs,
-            }, "Instance execution state changed");
+            this.logStateEdge(previous, snapshot);
             this.emit("instance_state", { name: this.name, ...snapshot });
             this.ipcServer?.broadcast({ type: "instance_state", instanceName: this.name, ...snapshot });
             if (snapshot.state === "stuck" && pane && this.instanceStateReadyPattern) {
@@ -4169,6 +4275,19 @@ export class Daemon extends EventEmitter {
                 if (reason === "delivery_idle_gate")
                     this.resetFooterFallback();
                 if (reason === "output_probe") {
+                    // A TUI that repaints without changing a cell (muse parks its cursor
+                    // ~18 times a second while idle; Codex's star field) never leaves the
+                    // probe a quiet moment, so roughly one probe in five is overtaken. An
+                    // idle instance whose stale capture still shows the structural idle
+                    // layout has nothing to be called working on: the rule that cosmetic
+                    // output must not manufacture an idle -> working edge holds here too.
+                    // Without this every overtaken probe published the edge, and the next
+                    // clean probe (one confirmation was still banked) published it back —
+                    // a pair every ~1.6s for as long as the repaint lasted (#1116). Real
+                    // work cannot hide behind this: it changes the layout, the next
+                    // output arms another probe, and the debounce capture still fires.
+                    if (this.instanceState === "idle" && this.backend?.isPeriodicRedrawIdlePane?.(pane) === true)
+                        return;
                     // A second burst overtook the probe. Do not bless its stale capture as
                     // idle: continuous output is the safer working signal, while the next
                     // quiet probe/debounce can still prove that it was only repainting.
@@ -5533,10 +5652,18 @@ export class Daemon extends EventEmitter {
             return { state: "unknown" };
         }
         for (const dialog of dialogs) {
-            if (Daemon.dialogMatches(dialog, pane)) {
-                this.trackDialogParked(dialog);
-                return { state: "dialog", dialog };
-            }
+            if (!Daemon.dialogMatches(dialog, pane))
+                continue;
+            // Same one-shot fence as the scanners: a safety choice already sent in
+            // this spawn is not what the screen is waiting on any more — the entry
+            // after it (typically a hold) describes it.
+            if (dialog.verifyAfterKeys && dialog.autoResolutionKey
+                && this.autoResolvedDialogGeneration === this.spawnGeneration
+                && this.autoResolvedDialogKey === dialog.autoResolutionKey
+                && dialogs.some(other => other !== dialog && Daemon.dialogMatches(other, pane)))
+                continue;
+            this.trackDialogParked(dialog);
+            return { state: "dialog", dialog };
         }
         this.trackDialogParked(null);
         return { state: "clear" };
@@ -8080,7 +8207,10 @@ export class Daemon extends EventEmitter {
                 clearMuseUsageSnapshot(this.instanceDir);
             }
         }
-        const cmd = `${envPrefix} ` + this.backend.buildCommand(launchConfig);
+        // The CLI's own shell sets a zero coredump_filter first (#1113): this pane
+        // may belong to a tmux server the fleet did not start, which would hand
+        // the CLI its own (full) filter instead of the fleet's.
+        const cmd = coredumpFilterLaunchPrefix() + `${envPrefix} ` + this.backend.buildCommand(launchConfig);
         // Every launched command re-arms the passive-transient check, including a
         // retry inside the same spawn: its load is a new one.
         this.launchAttempt++;
@@ -8245,7 +8375,7 @@ export class Daemon extends EventEmitter {
                 // Transient tmux trouble is not evidence about the CLI. Returning false
                 // here would clear the session; retry within the budget instead.
                 captureFailures++;
-                this.logger.warn({ err, captureFailures }, "capture-pane failed during the startup dialog scan — retrying");
+                this.logger.debug({ err, captureFailures }, "capture-pane failed during the startup dialog scan — retrying");
                 // Only a POSITIVE dead pane ends the scan; an unanswerable liveness
                 // query is the same transient trouble and must not clear the session.
                 if ((await this.paneLiveness()) === "dead")
@@ -8277,6 +8407,7 @@ export class Daemon extends EventEmitter {
                                     && this.autoResolvedDialogKey === dialog.autoResolutionKey)))
                             continue;
                         lastDialog = dialog;
+                        this.noteCodexReserveDialog(dialog, pane);
                         cleanReadyPolls = 0;
                         // Start the parked clock for every delivery-blocking dialog, exact
                         // ones included: if the auto-dismiss keeps failing here, the human