@songsid/agend 2.1.10 → 2.1.11-beta.2

package/dist/daemon.js

@@ -4,7 +4,7 @@ import { fileURLToPath } from "node:url";
 import { ensureInstanceDir } from "./private-dir.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
-import { rotateLogIfNeeded } from "./logger.js";
+import { rotateLogIfNeededAsync } from "./logger.js";
 import { coredumpFilterLaunchPrefix } from "./coredump-filter.js";
 import { mcpServerState } from "./mcp-liveness.js";
 import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
@@ -447,6 +447,18 @@ const STARTUP_DIALOG_POLL_MS = 500;
 const STARTUP_DIALOG_BUDGET_MS = 30_000;
 /** A blocking dialog still on screen this long after first being seen is reported for a human. */
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
+/** After a runtime dialog's keys, how long the pane gets to repaint before it is read again to see whether they took. */
+const DIALOG_ANSWER_SETTLE_MS = 300;
+/** Consecutive answers one runtime dialog ignored (still on screen right after the keys) before it is reported for a human. */
+const DIALOG_ANSWER_IGNORED_MAX = 3;
+/**
+ * Once a dialog has been reported as ignoring the answer, how long the scanner waits between answers to the SAME request.
+ * Not a stop: requests that merely look alike (several queued permission requests for one directory) cannot be told
+ * apart from an ignored answer, and each still needs its answer — they get it, slowly — while a dialog that really
+ * ignores the keys is pressed far less. A different request, the dialog going away, or a new spawn restores the
+ * normal pace (and a fresh count).
+ */
+const DIALOG_ANSWER_BACKOFF_MS = 30_000;
 /** How many "dialog painted just before the write → wait → retry" rounds a delivery tolerates. */
 const LATE_DIALOG_WRITE_ROUNDS = 3;
 /** How many times a delivery redoes itself when a spawn starts between its settle wait and its pane write. */
@@ -1024,6 +1036,12 @@ export class Daemon extends EventEmitter {
     /** Identity of that dialog: its pattern, not its description (two tables may describe one screen differently). */
     dialogParkedKey = null;
     dialogParkedReported = false;
+    /**
+     * The runtime dialog the monitor is answering, and how many of its answers in a row did nothing (the dialog was
+     * still on screen right after the keys). Not the on-screen duration: a burst of FRESH prompts, each answered, has a
+     * dialog on screen at every poll and ignores nothing.
+     */
+    dialogAnswers = null;
     /** Current stdin-owning runtime dialog, independent from execution state. */
     inputBlockedDialogKey = null;
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
@@ -1234,6 +1252,9 @@ export class Daemon extends EventEmitter {
      * an immediate restart would destroy in-flight work. Cleared when the server
      * turns up alive again (operator restarted, CLI reconnected) before we fire.
      */
+    /** Consecutive health ticks a failed `list-windows` may defer crash recovery before it counts as "gone" (#1127). */
+    static WINDOW_QUERY_FAILURE_TICKS = 2;
+    windowQueryFailureTicks = 0;
     mcpRestartPending = false;
     mcpRestartStaleTimer = null;
     /** In-flight replacement grace; also the guard against three triggers stacking. */
@@ -1257,6 +1278,13 @@ export class Daemon extends EventEmitter {
     mcpDeathDeferredForPid = null;
     /** Prevent in-flight monitor callbacks from re-arming after a pause. */
     runtimeMonitorsFrozen = false;
+    /**
+     * Bumped by every stop / pause / startup abort (they all freeze the monitors). A launch that has to
+     * await something before it touches the pane (a backend's `prepareLaunch`) remembers the value it
+     * started under and gives up if it moved: a stopped instance must not get a window, a config or a
+     * token from a launch that was already in the air. A wake that STARTS after the freeze is unaffected.
+     */
+    launchFenceEpoch = 0;
     errorWaitingForRecovery = false; // true = error detected, waiting for ready pattern
     errorDetectedAt = 0;
     errorRecoveryDeadlineAt = 0;
@@ -1742,7 +1770,7 @@ export class Daemon extends EventEmitter {
             if (savedId) {
                 const oldTmux = new TmuxManager(this.tmuxSessionName, savedId);
                 if (await oldTmux.isWindowAlive()) {
-                    this.saveSessionId();
+                    await this.checkpointSessionId();
                     await oldTmux.killWindow();
                     this.logger.info({ savedId }, "Killed old tmux window for fresh start");
                 }
@@ -1771,7 +1799,7 @@ export class Daemon extends EventEmitter {
             // we attach — pipe-pane uses `cat >>` on the same inode, so copytruncate
             // keeps the writer attached after size resets.
             const outputLog = join(this.instanceDir, "output.log");
-            rotateLogIfNeeded(outputLog);
+            await rotateLogIfNeededAsync(outputLog);
             await this.tmux.pipeOutput(outputLog).catch(() => { });
             // 4. Transcript monitor. claude-code is handled inside the monitor
             // (statusline transcript); codex/kiro/opencode read their CLI's own
@@ -2302,10 +2330,15 @@ export class Daemon extends EventEmitter {
                         return;
                     }
                     if (paneStatus?.alive) {
+                        this.windowQueryFailureTicks = 0;
+                        this.stormWindow?.noteWindowAlive(this.name);
                         // Instance output.log is fed by tmux pipe-pane and was previously never
                         // rotated (only fleet.log / daemon.log were). Cap growth every tick.
+                        // Fire and forget, on purpose: the size check is one stat, the copy of a
+                        // 10–100 MiB log runs off the event loop, and this tick must not wait for
+                        // it (#1161) — scheduleNext() below is not delayed by a rotation.
                         if (!this.config.lightweight) {
-                            rotateLogIfNeeded(join(this.instanceDir, "output.log"));
+                            void rotateLogIfNeededAsync(join(this.instanceDir, "output.log"));
                         }
                         scheduleNext();
                         return;
@@ -2320,6 +2353,8 @@ export class Daemon extends EventEmitter {
                         paneStatus = await this.tmux.getPaneStatus();
                         if (paneStatus?.alive) {
                             this.logger.debug(`[health] ${cliLabel} pane reported gone then alive on recheck — transient query failure, ignoring`);
+                            this.windowQueryFailureTicks = 0;
+                            this.stormWindow?.noteWindowAlive(this.name);
                             scheduleNext();
                             return;
                         }
@@ -2344,6 +2379,7 @@ export class Daemon extends EventEmitter {
                     // nullReason records *why* getPaneStatus returned null (for diagnosing
                     // whether this was a real window loss or a transient query failure).
                     let crashType = "window";
+                    let inWindowLossBurst = false;
                     let nullReason;
                     if (!paneStatus) {
                         const serverAlive = await TmuxManager.sessionExists(this.tmuxSessionName);
@@ -2377,6 +2413,7 @@ export class Daemon extends EventEmitter {
                             nullReason = "no_window";
                             try {
                                 const windows = await TmuxManager.listWindows(this.tmuxSessionName);
+                                this.windowQueryFailureTicks = 0;
                                 const currentWindowId = this.tmux.getWindowId();
                                 if (windows.some(w => w.id === currentWindowId)) {
                                     // The exact window still exists, so `list-panes` was the query
@@ -2390,9 +2427,27 @@ export class Daemon extends EventEmitter {
                                     nullReason = "same_name_other_window";
                             }
                             catch {
+                                // A failed window query proves nothing: it used to read as "the
+                                // window is gone" and respawned a live CLI. Look again next tick,
+                                // and give up waiting only after WINDOW_QUERY_FAILURE_TICKS in a
+                                // row (tmux that cannot list windows for that long is unhealthy
+                                // enough that recovery is the better bet).
+                                if (++this.windowQueryFailureTicks <= Daemon.WINDOW_QUERY_FAILURE_TICKS) {
+                                    this.logger.warn({ failures: this.windowQueryFailureTicks }, `${cliLabel} window list unavailable — deferring crash recovery`);
+                                    scheduleNext();
+                                    return;
+                                }
                                 nullReason = "query_error";
                             }
+                            this.windowQueryFailureTicks = 0;
                             this.logger.warn({ exitCode, nullReason }, `${cliLabel} window not found (tmux server alive)`);
+                            // Several instances losing their windows together is ONE event on
+                            // the host or in tmux, not N crashes (#1127): the first ones to see
+                            // it respawn as usual; the one that makes it a burst opens the storm
+                            // window, which caps the recovery rate and folds the notices into
+                            // one. Later arrivals just join it.
+                            inWindowLossBurst = (this.stormWindow?.noteWindowLoss(this.name) ?? false)
+                                || (this.stormWindow?.needsRecovery(this.name) ?? false);
                         }
                     }
                     else {
@@ -2466,7 +2521,7 @@ export class Daemon extends EventEmitter {
                     // independent CLI crash loops. StormWindow owns its escalation; do
                     // not let the same three server generations permanently trip every
                     // daemon's per-instance 3-in-5m breaker.
-                    if (crashType === "server") {
+                    if (crashType === "server" || inWindowLossBurst) {
                         this.crashTimestamps = [];
                         this.crashCount = 0;
                     }
@@ -2514,7 +2569,13 @@ export class Daemon extends EventEmitter {
                     this.logger.warn({ crashCount: this.crashCount, delay }, `${cliLabel} window died — respawning after backoff`);
                     await new Promise(r => setTimeout(r, delay));
                     try {
-                        this.saveSessionId();
+                        await this.checkpointSessionId();
+                        // stop() / pause() may have landed while this tick sat in the backoff delay or in the
+                        // (bounded) session lookup. They only stop LATER ticks; this continuation is already
+                        // past that check and must not clear the process/window or respawn an instance that
+                        // was just stopped or paused (#1160 review).
+                        if (this.runtimeMonitorsFrozen || this.healthCheckPaused)
+                            return;
                         this.transcriptMonitor?.resetOffset();
                         // Kill orphan MCP server from the crashed CLI session.
                         // MCP server writes its PID to channel.mcp.pid on startup.
@@ -2558,8 +2619,17 @@ export class Daemon extends EventEmitter {
                         this.emit("crash_respawn", this.name);
                         // Emit the per-instance audit event while the storm is still active
                         // so its chat notification is suppressed into the fleet summary.
-                        if (crashType === "server")
+                        // Also the instances that lost their window a moment BEFORE the burst
+                        // was recognised: they respawned as ordinary crashes but are part of
+                        // the incident now, and the window cannot close without them.
+                        if (crashType === "server" || inWindowLossBurst || this.stormWindow?.needsRecovery(this.name)) {
                             this.stormWindow?.markRecovered(this.name);
+                        }
+                        else {
+                            // Not (yet) part of a storm: keep the evidence, in case the next
+                            // window loss makes this one a member whose recovery is already done.
+                            this.stormWindow?.noteWindowRecovered(this.name);
+                        }
                     }
                     catch (err) {
                         if (this.stopOnUnsupportedCliRespawn(err)) {
@@ -2609,7 +2679,7 @@ export class Daemon extends EventEmitter {
             return false;
         this.healthCheckPaused = true;
         this.logger.error({ reason: err.message }, "Not respawning: the installed CLI cannot run this instance as configured");
-        this.emitSupervisionEnded(err.message, "Install a CLI version that supports this instance's configuration, then start it again.");
+        this.emitSupervisionEnded(err.message, "Install a CLI version that supports this instance's configuration, then start it again.", undefined, "cli_unsupported");
         return true;
     }
     /**
@@ -2625,12 +2695,13 @@ export class Daemon extends EventEmitter {
      * `crash_loop` already had this treatment; this is the same bridge for the other
      * four, carrying a human-readable cause and the operator's next step.
      */
-    emitSupervisionEnded(reason, remedy, exitCode) {
+    emitSupervisionEnded(reason, remedy, exitCode, cause) {
         this.emit("supervision_ended", {
             name: this.name,
             reason,
             remedy,
             ...(exitCode !== undefined ? { exitCode } : {}),
+            ...(cause ? { cause } : {}),
         });
     }
     setProcessStatus(status) {
@@ -2680,11 +2751,18 @@ export class Daemon extends EventEmitter {
         this.errorMonitorTimer = setInterval(async () => {
             if (!this.tmux || this.spawning)
                 return;
+            // This poll belongs to the spawn and the monitors it started under. Every await below can outlive them (a stop,
+            // a pause, a respawn); a stale poll must not touch state a newer one owns, so it checks before committing.
+            const pollSpawn = this.spawnGeneration;
+            const pollFence = this.launchFenceEpoch;
+            const stale = () => pollSpawn !== this.spawnGeneration || pollFence !== this.launchFenceEpoch;
             try {
                 const alive = await this.tmux.isWindowAlive();
                 if (!alive)
                     return;
                 const pane = await this.tmux.capturePane();
+                if (stale())
+                    return;
                 const inputBlockedDialog = this.updateInputBlockedState(pane, dialogs);
                 // A sign-in screen that appears AFTER the startup scan ended (first run:
                 // theme → login can take longer than its budget) is the same auth
@@ -2724,6 +2802,7 @@ export class Daemon extends EventEmitter {
                 // on). Runtime table only: startup patterns are loose on purpose and
                 // must never send keys into an ordinary transcript.
                 let blockingSeen = null;
+                let answersBackedOff = false;
                 for (const dialog of dialogs) {
                     if (!Daemon.dialogMatches(dialog, pane))
                         continue;
@@ -2732,6 +2811,20 @@ export class Daemon extends EventEmitter {
                         blockingSeen = dialog;
                     if (dialog.holdOnly)
                         break; // recognised, deliberately not answered; trackDialogParked reports it
+                    // Reported as ignoring the daemon: the SAME request (the identity the count was made on — verbatim, the
+                    // backend's own when it names one) is answered only once per DIALOG_ANSWER_BACKOFF_MS. Anything else — another
+                    // request, an unexplained difference, the dialog gone — is not held back here; the answer path below ends or
+                    // keeps the episode by its own rules.
+                    const episode = this.dialogAnswers;
+                    // A wall clock that moved BACKWARDS since the last answer (NTP step, VM resume) gives a negative elapsed time:
+                    // the backoff has expired, not "not started" — held to it, the answers would stop until the clock caught up.
+                    const sinceLastAnswer = episode ? Date.now() - episode.lastAnswerAt : 0;
+                    if (episode?.reported && episode.key === Daemon.answerKey(dialog)
+                        && episode.screen === Daemon.screenOf(dialog, pane)
+                        && sinceLastAnswer >= 0 && sinceLastAnswer < DIALOG_ANSWER_BACKOFF_MS) {
+                        answersBackedOff = true;
+                        continue;
+                    }
                     const autoKey = dialog.autoResolutionKey;
                     if (dialog.verifyAfterKeys && autoKey
                         && this.autoResolvedDialogGeneration === this.spawnGeneration
@@ -2751,10 +2844,23 @@ export class Daemon extends EventEmitter {
                         // while a delivery was finishing. A stale danger menu must never
                         // receive a blind key sequence.
                         const currentPane = await this.tmux.capturePane();
+                        // Every await below can outlive the spawn / monitors this poll started under: after each one, before
+                        // any state is touched or any further key is sent, `stale()` (fixed at the poll's start) is asked again.
+                        if (stale())
+                            return;
                         if (!Daemon.dialogMatches(dialog, currentPane)) {
                             this.updateInputBlockedState(currentPane, dialogs);
+                            this.endDialogEpisode(); // somebody (or the CLI) already cleared it: that screen is over
                             return;
                         }
+                        // What is being answered: the request's identity when the backend can name it (verbatim, without whatever
+                        // ticks around it), else the whole screen.
+                        const before = Daemon.screenOf(dialog, currentPane);
+                        // Another request since the last answer: the count and the report belong to that one. Its parked clock goes
+                        // too only when the backend vouches for the identity — an unrecognised difference (a timer, a spinner) is
+                        // not evidence that the old request was answered, and the one-minute fallback must keep running.
+                        if (this.dialogAnswers?.key === Daemon.answerKey(dialog) && this.dialogAnswers.screen !== before)
+                            this.endDialogEpisode(dialog.requestIdentity !== undefined);
                         if (dialog.verifyAfterKeys && autoKey
                             && this.autoResolvedDialogGeneration === this.spawnGeneration
                             && this.autoResolvedDialogKey === autoKey)
@@ -2773,17 +2879,24 @@ export class Daemon extends EventEmitter {
                             else {
                                 sent = await this.tmux.pasteText(key, this.systemPasteOptions());
                             }
+                            if (stale())
+                                return;
                             if (!sent) {
                                 if (dialog.verifyAfterKeys && autoKey) {
                                     this.autoResolvedDialogGeneration = 0;
                                     this.autoResolvedDialogKey = null;
                                 }
+                                this.breakAnswerStreak(dialog);
                                 return;
                             }
                             await new Promise(r => setTimeout(r, 200));
+                            if (stale())
+                                return;
                         }
                         if (dialog.verifyAfterKeys) {
                             const afterKeysPane = await this.tmux.capturePane();
+                            if (stale())
+                                return;
                             const dialogStillActive = dialog.inputBlocked
                                 ? dialogs.some(candidate => candidate.inputBlocked && Daemon.dialogMatches(candidate, afterKeysPane))
                                 : Daemon.dialogMatches(dialog, afterKeysPane);
@@ -2799,8 +2912,27 @@ export class Daemon extends EventEmitter {
                                 resolved = true;
                             }
                         }
+                        else if (dialog.keys.length > 0) {
+                            // Did the keys take? Read the pane again. The same request still there is an answer that did nothing. A request
+                            // the backend names as DIFFERENT (the next queued one), or no dialog at all, means it took. Without a
+                            // backend-named identity any difference on the screen (a ticking timer) proves nothing either way: nothing
+                            // is reported and the parked clock is left alone. Two requests that look exactly alike cannot be told apart.
+                            await new Promise(r => setTimeout(r, DIALOG_ANSWER_SETTLE_MS));
+                            const afterPane = await this.tmux.capturePane();
+                            if (stale())
+                                return; // (nothing was touched since the last check: only a read)
+                            const stillThere = Daemon.dialogMatches(dialog, afterPane);
+                            const same = stillThere && Daemon.screenOf(dialog, afterPane) === before;
+                            this.noteDialogAnswer(dialog, same ? "ignored" : (!stillThere || dialog.requestIdentity) ? "took" : "unproven", before);
+                        }
+                        else {
+                            this.breakAnswerStreak(dialog);
+                        }
                     });
+                    if (stale())
+                        return; // the answer-and-look outlived its spawn / monitors: it commits nothing
                     if (!dismissed) {
+                        this.breakAnswerStreak(dialog);
                         this.logger.info({ dialog: dialog.description }, "Dialog dismissal deferred — pane write in flight");
                     }
                     else if (dialog.verifyAfterKeys && !resolved) {
@@ -2809,6 +2941,11 @@ export class Daemon extends EventEmitter {
                     this.trackDialogParked(blockingSeen);
                     return; // Dialog handled (or deliberately deferred): skip error checks this cycle
                 }
+                // Reached only when no dialog was answered this poll (none on screen, a fenced one, or one waiting out its
+                // backoff): unless it is the one backing off, the screen that was being answered is gone, and the next dialog is
+                // a new one.
+                if (!answersBackedOff)
+                    this.dialogAnswers = null;
                 this.trackDialogParked(blockingSeen);
                 if (blockingSeen)
                     return; // held dialog: skip error checks this cycle
@@ -3402,8 +3539,9 @@ export class Daemon extends EventEmitter {
         // Quit CLI FIRST — this kills MCP server child processes cleanly.
         // IPC must stay open during quit so MCP servers receive the shutdown message.
         if (this.tmux) {
-            this.saveSessionId();
+            // Paused before the (bounded) checkpoint wait, so a health tick cannot run in that gap.
             this.healthCheckPaused = true;
+            await this.checkpointSessionId();
             let killed = false;
             const windowId = this.tmux.getWindowId();
             const kiroReady = windowId ? await this.drainBusyKiroForStop(windowId) : true;
@@ -3581,7 +3719,7 @@ export class Daemon extends EventEmitter {
         this.freezeRuntimeMonitors();
         const transition = (async () => {
             try {
-                this.saveSessionId();
+                await this.checkpointSessionId();
                 await this.sendQuitSequence(pauseReason, "pause", { watchRelaunch: true });
                 let exited = false;
                 for (let i = 0; i < 15; i++) {
@@ -3759,8 +3897,10 @@ export class Daemon extends EventEmitter {
         // fleet is SIGKILLed or the host reboots.
         // Idle observations are safe checkpoints; the 60s safety sweep also gives
         // us a bounded retry if session creation produced no visible state edge.
+        // The discovery behind it is a CLI listing: it runs in the background (single-flight, at most
+        // once per SESSION_CHECKPOINT_IDLE_THROTTLE_MS), never on this synchronous path (#1160).
         if (snapshot.state === "idle" && this.backend?.binaryName === "opencode") {
-            this.saveSessionId();
+            this.checkpointSessionIdInBackground();
         }
         // Only a transition back to idle completes pending work. Repeated idle
         // observations between enqueue and paste must not clear a newer inbound.
@@ -4601,6 +4741,7 @@ export class Daemon extends EventEmitter {
     /** Stop every runtime poller/watcher while preserving IPC and daemon state. */
     freezeRuntimeMonitors() {
         this.runtimeMonitorsFrozen = true;
+        this.launchFenceEpoch++;
         if (this.healthCheckTimer) {
             clearTimeout(this.healthCheckTimer);
             this.healthCheckTimer = null;
@@ -5668,6 +5809,64 @@ export class Daemon extends EventEmitter {
         this.trackDialogParked(null);
         return { state: "clear" };
     }
+    /** What identifies the request on screen: the backend's own identity when it has one, else the whole screen verbatim. */
+    static screenOf(dialog, pane) {
+        return dialog.requestIdentity?.(pane) ?? pane;
+    }
+    static answerKey(dialog) {
+        return `${Daemon.dialogKey(dialog)}\0${dialog.description}`;
+    }
+    /**
+     * The episode being counted is over: its count and its report. Its parked clock ends too (`clearParked`) only when the
+     * dialog is gone or a different request is positively identified — not on a difference nobody can explain.
+     */
+    endDialogEpisode(clearParked = true) {
+        this.dialogAnswers = null;
+        if (clearParked)
+            this.trackDialogParked(null);
+    }
+    /**
+     * A poll that did not complete an answer-and-look (lock busy, keys not sent, nothing to press) breaks "in a row" for
+     * this dialog; if the dialog on screen is a DIFFERENT one, the episode being counted belongs to a screen that is gone.
+     */
+    breakAnswerStreak(dialog) {
+        if (!this.dialogAnswers)
+            return;
+        if (this.dialogAnswers.key === Daemon.answerKey(dialog))
+            this.dialogAnswers.ignored = 0;
+        else
+            this.endDialogEpisode();
+    }
+    /**
+     * One answer of the runtime scanner to a dialog, and whether the SAME dialog (same kind, same content) was still
+     * on screen right after it.
+     * An answer that took ends the episode (what shows next is a new dialog, so the parked clock restarts too);
+     * DIALOG_ANSWER_IGNORED_MAX in a row that did not is reported ONCE per episode, for ANY backend's dialog —
+     * not only the ones that hold deliveries — so a human is told in about a quarter of a minute instead of the
+     * instance sitting there until a hang detector (and only with pending work) notices. The event carries the
+     * dialog's static description and a count, never the pane: a pane can hold anything the agent printed.
+     */
+    noteDialogAnswer(dialog, outcome, screen) {
+        const key = Daemon.answerKey(dialog);
+        if (!this.dialogAnswers || this.dialogAnswers.key !== key)
+            this.dialogAnswers = { key, ignored: 0, reported: false, screen, lastAnswerAt: 0 }; // the exact screen being counted: every answer in the episode saw this same one
+        const episode = this.dialogAnswers;
+        if (outcome !== "ignored") {
+            this.endDialogEpisode(outcome === "took");
+            return;
+        }
+        episode.ignored++;
+        episode.lastAnswerAt = Date.now();
+        if (episode.ignored < DIALOG_ANSWER_IGNORED_MAX || episode.reported)
+            return;
+        episode.reported = true;
+        // The time-based "parked" report would say the same thing again a minute later.
+        if (this.dialogParkedKey === Daemon.dialogKey(dialog))
+            this.dialogParkedReported = true;
+        const holdsDeliveries = dialog.blocksDelivery === true || dialog.holdOnly === true;
+        this.logger.warn({ dialog: dialog.description, attempts: episode.ignored, holdsDeliveries }, "Runtime dialog is ignoring AgEnD's answer — reporting for a human");
+        this.emit("dialog_answer_ignored", { name: this.name, description: dialog.description, attempts: episode.ignored, holdsDeliveries });
+    }
     /**
      * Remember how long a blocking dialog has been on screen. Once it has
      * outlived DIALOG_PARKED_NOTIFY_MS — the auto-dismiss did not take, or the
@@ -7548,6 +7747,7 @@ export class Daemon extends EventEmitter {
      * into exactly the window this exists to close.
      */
     beginSpawn() {
+        this.dialogAnswers = null;
         // A relaunch settles any outstanding quit watch: the CLI came back.
         this.clearQuitRelaunchWatch();
         // A restarted CLI has no trustworthy turn edge for the process it replaced.
@@ -8032,7 +8232,7 @@ export class Daemon extends EventEmitter {
             if (!claimed)
                 return;
             try {
-                this.saveSessionId();
+                this.saveSessionId(); // the muse switch: a backend with no CLI lookup, nothing to wait for
                 const ready = await this.trySpawn(true, this.wakeBudgetMs(30_000));
                 this.transcriptMonitor?.resetOffset();
                 if (ready)
@@ -8123,6 +8323,7 @@ export class Daemon extends EventEmitter {
         catch { /* non-fatal */ }
     }
     async trySpawnInsideGate(reuseWindow = false, startupTimeoutMs) {
+        const launchFence = this.launchFenceEpoch;
         const backendConfig = this.buildBackendConfig();
         // Compare freshly-built instructions against the last value the agent was
         // told about. Computed for ALL backends (not gated by
@@ -8158,6 +8359,16 @@ export class Daemon extends EventEmitter {
                 this.pendingInstructionsUpdate = backendConfig.instructions;
             }
         }
+        // A backend that has to ask its CLI something before the launch command exists (OpenCode: does
+        // this binary take --auto?) does it here, off the event loop, bounded, and never fails the launch.
+        try {
+            await this.backend.prepareLaunch?.();
+        }
+        catch { /* unknown capability → the backend's conservative form */ }
+        // Thrown, not `false`: a false verdict reads as "the CLI failed to start" and sends the startup path
+        // into its resume-retry / set-the-session-aside handling, for an instance somebody just stopped.
+        if (launchFence !== this.launchFenceEpoch)
+            throw new Error("Launch cancelled: the instance was stopped or paused while the launch was being prepared");
         this.backend.writeConfig(backendConfig);
         this.backend.preTrust?.(this.config.working_directory);
         // Resolve working directory (e.g. symlink for hidden paths)
@@ -8251,7 +8462,7 @@ export class Daemon extends EventEmitter {
         });
         if (reuseWindow && !this.config.lightweight) {
             const outputLog = join(this.instanceDir, "output.log");
-            rotateLogIfNeeded(outputLog);
+            await rotateLogIfNeededAsync(outputLog);
             await this.tmux.pipeOutput(outputLog).catch(err => {
                 this.logger.warn({ err }, "Failed to restore pipe-pane after wake");
             });
@@ -8592,6 +8803,55 @@ export class Daemon extends EventEmitter {
         }
         catch { /* best effort */ }
     }
+    /**
+     * How long a stop / pause / crash respawn / wake waits for a backend's session lookup before it
+     * goes on with what it has (the cache or the persisted id). A missed checkpoint is retried at the
+     * next idle observation — the same as when the lookup used to fail — and a clean stop must never
+     * wait on a CLI listing for its whole 15 s timeout.
+     */
+    static SESSION_CHECKPOINT_BUDGET_MS = 5_000;
+    /** Idle observations ask a backend that needs a CLI lookup at most this often. */
+    static SESSION_CHECKPOINT_IDLE_THROTTLE_MS = 30_000;
+    lastIdleSessionRefreshAt = Number.NEGATIVE_INFINITY;
+    /**
+     * Persist the session id for a lifecycle transition. A backend that answers from a file (or not at
+     * all) is saved at once, exactly as before. One that must ask a CLI (`refreshSessionId`, OpenCode)
+     * is awaited — bounded — first, so the checkpoint is the CURRENT session, not a stale cache. The
+     * lookup is the backend's own single-flight one: an idle observation already running it is joined,
+     * not repeated. Never rejects.
+     */
+    checkpointSessionId() {
+        const refresh = this.backend?.refreshSessionId;
+        if (this.skipResume || !refresh) {
+            this.saveSessionId();
+            return;
+        }
+        return this.refreshThenSave(refresh.call(this.backend), Daemon.SESSION_CHECKPOINT_BUDGET_MS);
+    }
+    async refreshThenSave(lookup, budgetMs) {
+        let timer;
+        const budget = new Promise(resolve => { timer = setTimeout(resolve, budgetMs); timer.unref?.(); });
+        try {
+            await Promise.race([lookup.then(() => undefined, () => undefined), budget]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+        this.saveSessionId();
+    }
+    /** The idle-observation checkpoint: persist what is known now, look again in the background at most every 30 s. */
+    checkpointSessionIdInBackground() {
+        this.saveSessionId();
+        const refresh = this.backend?.refreshSessionId;
+        if (this.skipResume || !refresh)
+            return;
+        const now = Date.now();
+        if (now - this.lastIdleSessionRefreshAt < Daemon.SESSION_CHECKPOINT_IDLE_THROTTLE_MS)
+            return;
+        this.lastIdleSessionRefreshAt = now;
+        void refresh.call(this.backend).then(() => this.saveSessionId(), () => { });
+    }
     saveSessionId() {
         // When a resume failure has forced a fresh start, don't persist the stale id
         // back from statusline.json — that would re-arm --continue and re-loop.