@songsid/agend 2.1.11 → 2.1.12-beta.2

package/dist/daemon.js

@@ -34,6 +34,9 @@ import { t } from "./locale.js";
 import { MuseUsageRelay, clearMuseUsageSnapshot } from "./muse-usage-relay.js";
 import { deliveryContentDigest } from "./delivery-outbox.js";
 import { queueResumePolicyForAttempt } from "./delivery-queue-evidence.js";
+import { scanTranscriptForDeliveryMarker } from "./delivery-reconciliation.js";
+import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
+import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -440,6 +443,18 @@ const POST_ENTER_PROOF_WINDOW_MS = 3_000;
 /** A final bounded observation before an ambiguous Codex submit can be classified. */
 const CODEX_LATE_PROOF_MS = 5_000;
 const POST_ENTER_PROOF_POLL_MS = 250;
+/**
+ * A readerless CLI's delivery is proven by its own transcript, which lags the pane by a flush. Only a delta that was
+ * read and carried no marker for this long is held against the delivery — a late flush must not raise a false ⚠️.
+ * Ten seconds is a chosen grace window: success markers arrive in about a second, and the bound keeps the failure
+ * path small — the fleet lane and the shared pump budget stay held until the verdict (Phase 2c "lane held until
+ * verdict", Option A #1207), so a lost paste blocks its lane for ~10 s. No flush-visibility claim is made here: a
+ * flush landing after the window still settles `uncertain`, and only a final-file scan (see the PR evidence) shows
+ * every recorded delivery did reach its transcript.
+ */
+const TRANSCRIPT_PROOF_WINDOW_MS = 10_000;
+const TRANSCRIPT_PROOF_POLL_MS = 1_000;
+const OUTPUT_EDGE_ONLY_EVIDENCE = "output-edge-only; submission-unverifiable";
 /** Attempts to read the pre-paste pane before a delivery gives up on a baseline. */
 const BASELINE_CAPTURE_ATTEMPTS = 3;
 const BASELINE_CAPTURE_RETRY_MS = 150;
@@ -851,17 +866,20 @@ export class InteractivePromptDetector {
     constructor(stableMs = 10_000) {
         this.stableMs = stableMs;
     }
-    observe(pane, now = Date.now(), outputAt = 0) {
-        const tail = sanitizePaneTail(pane, 5);
-        const tailText = tail.join("\n");
-        let matched = null;
+    /** Recognition is persistent; observe() separately deduplicates notifications. */
+    match(pane) {
+        const tailText = sanitizePaneTail(pane, 5).join("\n");
         for (const candidate of INTERACTIVE_PROMPT_PATTERNS) {
             const match = tailText.match(candidate.pattern);
-            if (!match)
-                continue;
-            matched = { kind: candidate.kind, prompt: match[0].trim().slice(0, 200) };
-            break;
+            if (match)
+                return { kind: candidate.kind, prompt: match[0].trim().slice(0, 200) };
         }
+        return null;
+    }
+    observe(pane, now = Date.now(), outputAt = 0) {
+        const tail = sanitizePaneTail(pane, 5);
+        const tailText = tail.join("\n");
+        const matched = this.match(pane);
         if (!matched) {
             this.reset();
             this.lastOutputAt = outputAt;
@@ -1050,11 +1068,18 @@ export class Daemon extends EventEmitter {
      */
     launchAttempt = 0;
     skipResume = false;
+    /**
+     * #1209: whether THIS boot was asked to skip resume by a crash-loop
+     * (crash-state.json). Captured at boot before spawnClaudeWindow resets
+     * skipResume — the #1209 gate reads this, never the resettable flag.
+     */
+    bootSkippedResume = false;
     startupAborted = false;
     /** First time the current on-screen blocking dialog was seen (0 = none); drives the parked report. */
     dialogParkedSince = 0;
     /** Identity of that dialog: its pattern, not its description (two tables may describe one screen differently). */
     dialogParkedKey = null;
+    dialogParkedInteractionEpisode = null;
     dialogParkedReported = false;
     /**
      * The runtime dialog the monitor is answering, and how many of its answers in a row did nothing (the dialog was
@@ -1080,6 +1105,13 @@ export class Daemon extends EventEmitter {
     capacityNudge = null;
     /** Current stdin-owning runtime dialog, independent from execution state. */
     inputBlockedDialogKey = null;
+    interactionObservation = new InteractionObservation();
+    interactionConfirmationTimer = null;
+    interactionOutputRevision = 0;
+    interactionObservedOutputRevision = 0;
+    interactionCaptureSerial = 0;
+    interactionDialogKey = null;
+    acceptedInstanceSnapshot = null;
     /** Generation/signature fence for safety dialogs while their screen is still visible. */
     autoResolvedDialogKey = null;
     autoResolvedDialogGeneration = 0;
@@ -1517,6 +1549,11 @@ export class Daemon extends EventEmitter {
         const isGeneral = config.general_topic === true || name === "general";
         const autoPauseMinutes = isGeneral ? 0 : (typeof config.auto_pause_after === "number" ? config.auto_pause_after : 0); // default: disabled
         this.autoPauseController = new AutoPauseController(Math.max(0, autoPauseMinutes) * 60_000, readLastInboundAt(instanceDir) ?? Date.now());
+        // #1209: every real completion clears the in-flight marker, so a
+        // finished turn can never resume after a later restart. reset() is
+        // deliberately NOT hooked: stop/spawn abandon the in-memory turn while
+        // the on-disk interruption must survive for the resume gate.
+        this.turnReplyGuard.onComplete = () => clearInFlightTurnMarker(this.instanceDir);
     }
     /** FleetManager and this daemon share a process, so durable begin/ACK is a direct synchronous store call. */
     setDeliveryOutboxPort(port) {
@@ -1633,8 +1670,82 @@ export class Daemon extends EventEmitter {
             this.finishDurableDelivery(delivery, "delivered", "steer-accepted-marker-on-pane; input-row-unreadable");
             return;
         }
+        // A backend whose input row cannot be read: all that vouched for this delivery is that the pane printed something
+        // after Enter, which a redraw that wiped the paste satisfies too (#758). Its transcript can say more.
+        if (verdict.proof === "output-edge") {
+            const checkpoint = verdict.transcriptCheckpoint;
+            if (delivery && checkpoint && ["claude-code", "codex"].includes(checkpoint.backend)) {
+                void this.proveDeliveryFromTranscript(delivery, checkpoint);
+                return;
+            }
+            // No transcript to ask: nothing to hold against it and nothing to prove it with. Today's outcome, honestly labelled.
+            this.finishDurableDelivery(delivery, "delivered", OUTPUT_EDGE_ONLY_EVIDENCE);
+            return;
+        }
         this.finishDurableDelivery(delivery, "delivered", "positive submission proof");
     }
+    /**
+     * Finish a delivery that only the output edge vouched for, by the delivery's own marker in the CLI's transcript (#758).
+     *
+     *  - marker found       → delivered (`transcript-marker`; `transcript-marker-queued` when the CLI has it queued, not yet read);
+     *  - delta read, no marker for the whole window → uncertain (`unverifiable-no-transcript-marker`) — the pane printed
+     *    something, yet the CLI never took the message in. Never a re-paste: the message may still land;
+     *  - transcript unreadable on the last look → today's outcome, labelled — there is nothing to hold against it.
+     *
+     * It runs after the paste lock is released, but the fleet lane and the shared pump budget stay held until the
+     * verdict settles the row (Phase 2c "lane held until verdict", Option A #1207): a success settles in about a
+     * second, a delivery whose marker never arrives holds them for the bounded proof window (see
+     * TRANSCRIPT_PROOF_WINDOW_MS). It never finishes a row that stop has handed to reconciliation; a pause or respawn
+     * only ends the wait, falling back to today's outcome.
+     */
+    async proveDeliveryFromTranscript(delivery, checkpoint) {
+        const spawn = this.spawnGeneration;
+        const fence = this.launchFenceEpoch;
+        let last = "unavailable";
+        let outcome = "delivered";
+        let evidence = OUTPUT_EDGE_ONLY_EVIDENCE;
+        try {
+            for (let polls = 0; polls <= TRANSCRIPT_PROOF_WINDOW_MS / TRANSCRIPT_PROOF_POLL_MS; polls++) {
+                if (this.deliveryWritesStopping)
+                    return; // reconciliation owns the row now
+                const found = await scanTranscriptForDeliveryMarker(checkpoint.path, checkpoint.offset, checkpoint.backend, delivery.deliveryId);
+                if (found === "user" || found === "queued") {
+                    outcome = "delivered";
+                    evidence = found === "user" ? "transcript-marker" : "transcript-marker-queued";
+                    break;
+                }
+                last = found;
+                if (spawn !== this.spawnGeneration || fence !== this.launchFenceEpoch) {
+                    last = "unavailable";
+                    break;
+                }
+                await new Promise(r => setTimeout(r, TRANSCRIPT_PROOF_POLL_MS));
+            }
+            // Only a delta that was read on the last look and still lacks the marker is held against the delivery. A
+            // pause/freeze or respawn during the final sleep must end the wait with today's labelled outcome, not
+            // `uncertain`: re-check the same fixed epochs after the last await, before settling (#1207 P2).
+            if (spawn !== this.spawnGeneration || fence !== this.launchFenceEpoch)
+                last = "unavailable";
+            if (last === "no-match" && evidence === OUTPUT_EDGE_ONLY_EVIDENCE) {
+                outcome = "uncertain";
+                evidence = "unverifiable-no-transcript-marker";
+            }
+        }
+        catch (err) {
+            this.logger.debug({ err }, "Transcript proof of a delivery failed — keeping the output-edge outcome");
+        }
+        // The settlement itself can throw (e.g. the outbox store is unhealthy), and this runs on a detached `void`
+        // promise: an uncaught throw is an unhandled rejection, which the fleet restart path turns into a global fault.
+        // Settle observably and leave the row for reconciliation — never a false completion, never another paste (#1207 P2).
+        try {
+            if (this.deliveryWritesStopping)
+                return;
+            this.finishDurableDelivery(delivery, outcome, evidence);
+        }
+        catch (err) {
+            this.logger.error({ err, deliveryId: delivery.deliveryId, attemptNo: delivery.attemptNo, outcome, evidence }, "Durable delivery settlement failed — row left for reconciliation");
+        }
+    }
     deferDurableDelivery(meta, reason) {
         const delivery = this.durableDeliveryAttempt(meta);
         if (delivery === null || delivery === false)
@@ -1691,6 +1802,19 @@ export class Daemon extends EventEmitter {
             return false;
         }
     }
+    /**
+     * #1206: rotate + attach the pipe-pane log feed. An attach failure warns
+     * (like the wake path) instead of vanishing silently and leaving the
+     * instance with no log feed. Extracted so the failure path is unit-testable
+     * without driving the real lifecycle.
+     */
+    async attachPipePaneLog() {
+        const outputLog = join(this.instanceDir, "output.log");
+        await rotateLogIfNeededAsync(outputLog);
+        await this.tmux.pipeOutput(outputLog).catch(err => {
+            this.logger.warn({ err }, "Failed to attach pipe-pane — instance output log will be missing");
+        });
+    }
     async start() {
         ensureInstanceDir(this.instanceDir);
         writeFileSync(join(this.instanceDir, "daemon.pid"), String(process.pid));
@@ -1699,6 +1823,7 @@ export class Daemon extends EventEmitter {
         // an unreadable marker for a later start; clear successfully read bytes
         // even when the JSON is corrupt so it cannot remain forever.
         const crashStatePath = join(this.instanceDir, "crash-state.json");
+        this.bootSkippedResume = false;
         try {
             if (existsSync(crashStatePath)) {
                 const content = readFileSync(crashStatePath, "utf-8");
@@ -1706,6 +1831,7 @@ export class Daemon extends EventEmitter {
                     const state = JSON.parse(content);
                     if (state?.resumeDisabled === true) {
                         this.skipResume = true;
+                        this.bootSkippedResume = true;
                         this.logger.warn("Previous crash loop detected — starting without resume");
                     }
                 }
@@ -1844,6 +1970,10 @@ export class Daemon extends EventEmitter {
             }
             catch { /* may not exist */ }
         }
+        // #1209: conditional continuation for the turn interrupted by the last
+        // restart, if the gates allow. Detached like the warmup notice; the gate
+        // consumes its one-shot marker first and never throws into boot.
+        void this.maybeResumeInterruptedTurn().catch(() => { });
         // Warmup: wait for CLI idle, then trigger steering reload — but only when
         // the instructions actually changed since the agent last saw them.
         // Skipping the no-op reload saves 10-30s of agent time on every restart
@@ -1854,9 +1984,7 @@ export class Daemon extends EventEmitter {
             // previous stuck splash (hundreds of MB of ANSI frames) is truncated before
             // we attach — pipe-pane uses `cat >>` on the same inode, so copytruncate
             // keeps the writer attached after size resets.
-            const outputLog = join(this.instanceDir, "output.log");
-            await rotateLogIfNeededAsync(outputLog);
-            await this.tmux.pipeOutput(outputLog).catch(() => { });
+            await this.attachPipePaneLog();
             // 4. Transcript monitor. claude-code is handled inside the monitor
             // (statusline transcript); codex/kiro/opencode read their CLI's own
             // conversation store via a pluggable source. Backends with no known
@@ -2811,14 +2939,28 @@ export class Daemon extends EventEmitter {
             // a pause, a respawn); a stale poll must not touch state a newer one owns, so it checks before committing.
             const pollSpawn = this.spawnGeneration;
             const pollFence = this.launchFenceEpoch;
-            const stale = () => pollSpawn !== this.spawnGeneration || pollFence !== this.launchFenceEpoch;
+            const pollOwner = this.interactionOwner();
+            const captureOrder = ++this.interactionCaptureSerial;
+            const captureMono = performance.now();
+            const stale = () => pollSpawn !== this.spawnGeneration || pollFence !== this.launchFenceEpoch
+                || !sameInteractionOwner(pollOwner, this.interactionOwner()) || this.runtimeMonitorsFrozen || this.spawning;
             try {
                 const alive = await this.tmux.isWindowAlive();
+                if (stale())
+                    return;
                 if (!alive)
                     return;
+                const captureAt = Date.now();
                 const pane = await this.tmux.capturePane();
                 if (stale())
                     return;
+                if (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureAt) {
+                    this.unverifyInteraction(captureMono, captureOrder);
+                }
+                else {
+                    if (!this.observeInteractionPane(pane, captureAt, captureMono, dialogs, captureOrder))
+                        return;
+                }
                 this.takeNudgeBaselines(pane, patterns);
                 this.tickCapacityNudge(pane);
                 const inputBlockedDialog = this.updateInputBlockedState(pane, dialogs);
@@ -2901,12 +3043,21 @@ export class Daemon extends EventEmitter {
                         // Re-read under the lock: the first capture may have gone stale
                         // while a delivery was finishing. A stale danger menu must never
                         // receive a blind key sequence.
+                        const currentAt = Date.now();
+                        const currentMono = performance.now();
+                        const currentOrder = ++this.interactionCaptureSerial;
                         const currentPane = await this.tmux.capturePane();
                         // Every await below can outlive the spawn / monitors this poll started under: after each one, before
                         // any state is touched or any further key is sent, `stale()` (fixed at the poll's start) is asked again.
                         if (stale())
                             return;
                         if (!Daemon.dialogMatches(dialog, currentPane)) {
+                            if (this.instanceStateLastOutputAt >= currentAt && this.instanceStateLastOutputAt > 0) {
+                                this.unverifyInteraction(currentMono, currentOrder);
+                                return;
+                            }
+                            if (!this.observeInteractionPane(currentPane, currentAt, currentMono, dialogs, currentOrder))
+                                return;
                             this.updateInputBlockedState(currentPane, dialogs);
                             this.endDialogEpisode(); // somebody (or the CLI) already cleared it: that screen is over
                             return;
@@ -2952,6 +3103,9 @@ export class Daemon extends EventEmitter {
                                 return;
                         }
                         if (dialog.verifyAfterKeys) {
+                            const afterKeysAt = Date.now();
+                            const afterKeysMono = performance.now();
+                            const afterKeysOrder = ++this.interactionCaptureSerial;
                             const afterKeysPane = await this.tmux.capturePane();
                             if (stale())
                                 return;
@@ -2962,6 +3116,12 @@ export class Daemon extends EventEmitter {
                                 this.logger.warn({ dialog: dialog.description }, "Runtime dialog remained after its safety choice");
                                 return;
                             }
+                            if (this.instanceStateLastOutputAt >= afterKeysAt && this.instanceStateLastOutputAt > 0) {
+                                this.unverifyInteraction(afterKeysMono, afterKeysOrder);
+                                return;
+                            }
+                            if (!this.observeInteractionPane(afterKeysPane, afterKeysAt, afterKeysMono, dialogs, afterKeysOrder))
+                                return;
                             this.updateInputBlockedState(afterKeysPane, dialogs);
                             if (dialog.postDismissNotice) {
                                 resolved = await this.submitSystemPaste(dialog.postDismissNotice.text, dialog.postDismissNotice.label);
@@ -3010,6 +3170,8 @@ export class Daemon extends EventEmitter {
                 this.evaluateErrorPatterns(pane, patterns, readyPattern, Date.now(), busyPattern);
             }
             catch {
+                if (!stale())
+                    this.unverifyInteraction(captureMono, captureOrder);
                 // capturePane can fail if window is transitioning — ignore
             }
         }, 5_000); // Check every 5 seconds (runtime dialogs need fast response)
@@ -3251,6 +3413,10 @@ export class Daemon extends EventEmitter {
         // FleetManager calls this synchronously before sendEscape. Cancel only the
         // current human turn; leave already-forwarded tool requests to settle.
         this.turnReplyGuard.cancelByUser();
+        // #1209: a cancelled turn must never resume (#1199) — drop its marker.
+        // (Completion paths clear via the guard's onComplete; a cancel with no
+        // later idle edge would otherwise leave the marker behind.)
+        clearInFlightTurnMarker(this.instanceDir);
         this.deliveryEpoch = fleetEpoch === undefined
             ? this.deliveryEpoch + 1
             : Math.max(this.deliveryEpoch, fleetEpoch);
@@ -3683,12 +3849,107 @@ export class Daemon extends EventEmitter {
         return this.isPaused ? "paused" : this.instanceState;
     }
     getInstanceStateSnapshot() {
-        return this.instanceStateMachine?.snapshot() ?? {
+        const snapshot = this.instanceStateMachine?.snapshot() ?? {
             state: this.instanceState,
             unchangedForMs: 0,
             observedAt: Date.now(),
             stateChangedAt: Date.now(),
         };
+        // A machine observation rejected by the modal hold never became a control
+        // state. A query must not publish that unaccepted idle as permission to act.
+        if (this.inputBlockedDialogKey !== null) {
+            snapshot.state = this.instanceState;
+            snapshot.stateChangedAt = this.acceptedInstanceSnapshot?.stateChangedAt ?? snapshot.stateChangedAt;
+        }
+        return { ...snapshot, interaction: this.getInteractionSnapshot() };
+    }
+    interactionOwner() {
+        return { bootId: this.bootId, spawnGeneration: this.spawnGeneration,
+            launchAttempt: this.launchAttempt, launchFenceEpoch: this.launchFenceEpoch };
+    }
+    /** Cached, pure observation read; it never captures, constructs a backend or writes stdin. */
+    getInteractionSnapshot() {
+        return this.interactionObservation.snapshot(this.interactionOwner());
+    }
+    publishInteraction() {
+        const interaction = this.getInteractionSnapshot();
+        // Presentation telemetry must not interrupt the execution-state/hold path.
+        try {
+            this.emit("instance_interaction", { name: this.name, interaction });
+        }
+        catch (err) {
+            this.logger.debug({ err }, "Interaction listener failed");
+        }
+        try {
+            this.ipcServer?.broadcast({ type: "instance_interaction", instanceName: this.name, interaction });
+        }
+        catch (err) {
+            this.logger.debug({ err }, "Interaction broadcast failed");
+        }
+    }
+    clearInteractionConfirmation() {
+        if (this.interactionConfirmationTimer)
+            clearTimeout(this.interactionConfirmationTimer);
+        this.interactionConfirmationTimer = null;
+    }
+    unverifyInteraction(monotonicAt = performance.now(), order = ++this.interactionCaptureSerial) {
+        if (!this.interactionObservation.unverify(this.interactionOwner(), monotonicAt, order))
+            return;
+        this.clearInteractionConfirmation();
+        this.publishInteraction();
+    }
+    interactionEvidence(pane, dialogs) {
+        const login = LOGIN_FLOWS[this.config.backend ?? "claude-code"];
+        let evidence = null;
+        if (login?.loginScreenActive?.(pane)) {
+            evidence = { kind: "login", identity: pane.trim() };
+        }
+        else {
+            // Bare backend regexes are not proof of a live modal. The canonical
+            // isActive predicate replaces pattern.test(), preserving table order.
+            const dialog = dialogs.find(d => d.isActive && (d.inputBlocked || d.blocksDelivery || d.holdOnly)
+                && Daemon.dialogMatches(d, pane));
+            if (dialog) {
+                const identity = dialog.requestIdentity?.(pane) ?? pane.replace(/\r/g, "")
+                    .split("\n").map(row => row.replace(/^([ \t]*)[❯›]([ \t]+)(?=\d\.|Yes\b|No\b|Resume\b)/, "$1$2").trimEnd())
+                    .filter(row => row.trim() !== "").join("\n");
+                evidence = { kind: dialog.interactionKind ?? "dialog", dialogKey: Daemon.dialogKey(dialog), identity: `${dialog.pattern.source}\n${identity}` };
+            }
+            else {
+                const weak = this.interactivePromptDetector.match(pane);
+                if (weak)
+                    evidence = { kind: "suspected_terminal_input", identity: sanitizePaneTail(pane, 5).join("\n"), suspected: true };
+            }
+        }
+        // No captured text leaves this function or the private observer identity.
+        return evidence ? { ...evidence, identity: createHash("sha256").update(evidence.identity).digest("hex") } : null;
+    }
+    observeInteractionPane(pane, observedAt, monotonicAt, dialogs = this.backend?.getRuntimeDialogs?.() ?? [], order = ++this.interactionCaptureSerial, allowConfirmation = true) {
+        const owner = this.interactionOwner();
+        const evidence = this.interactionEvidence(pane, dialogs);
+        if (!this.interactionObservation.observe(evidence, owner, observedAt, monotonicAt, this.interactionOutputRevision !== this.interactionObservedOutputRevision, order))
+            return false;
+        this.interactionDialogKey = evidence?.dialogKey ?? null;
+        this.interactionObservedOutputRevision = this.interactionOutputRevision;
+        const interaction = this.getInteractionSnapshot();
+        this.publishInteraction();
+        if (interaction.phase !== "candidate" || interaction.suspected) {
+            this.clearInteractionConfirmation();
+            return true;
+        }
+        // One bounded extra read per ordinary observation. A confirmation that
+        // finds a changed request waits for the existing monitor's next capture;
+        // it cannot recursively create a permanent fast poll.
+        if (allowConfirmation && !this.interactionConfirmationTimer) {
+            this.interactionConfirmationTimer = setTimeout(() => {
+                this.interactionConfirmationTimer = null;
+                if (!sameInteractionOwner(owner, this.interactionOwner()) || this.runtimeMonitorsFrozen || this.spawning)
+                    return;
+                void this.captureAndEvaluateInstanceState("interaction_confirmation");
+            }, INTERACTION_CONFIRM_MS);
+            this.interactionConfirmationTimer.unref?.();
+        }
+        return true;
     }
     /**
      * Answer a FleetManager state query. Most callers only need the cached state,
@@ -3954,6 +4215,7 @@ export class Daemon extends EventEmitter {
             return;
         }
         this.instanceState = snapshot.state;
+        this.acceptedInstanceSnapshot = { ...snapshot };
         // OpenCode creates its session lazily on the first submitted message.
         // Waiting until stop/pause to persist that id loses resume state when the
         // fleet is SIGKILLed or the host reboots.
@@ -4055,6 +4317,125 @@ export class Daemon extends EventEmitter {
             correlationId: meta.correlation_id || undefined,
             inboundMarker,
         });
+        // #1209: persist the in-flight turn with a seam checkpoint. A marker
+        // that survives a restart is an interrupted turn by construction —
+        // completion (via the guard's onComplete) and cancel paths delete it.
+        // Synchronous by necessity: a crash between arm and write must not lose
+        // the interruption. Reads are windowed/bounded (see turn-resume.ts).
+        // A resumed continuation never re-arms (P3a): episode-once means a crash
+        // during the continuation boots clean instead of chaining resumes.
+        if (!meta.resumedContinuationOf) {
+            const resumeBackend = this.config.backend ?? this.backend?.binaryName ?? this.runtimeIdentity?.backend;
+            const resumeCwd = this.config.working_directory ?? "";
+            writeInFlightTurnMarker(this.instanceDir, {
+                version: 1,
+                deliveryId: meta.delivery_id || undefined,
+                correlationId: meta.correlation_id || undefined,
+                messageId: meta.message_id || undefined,
+                chatId: meta.chat_id,
+                threadId: meta.thread_id || undefined,
+                adapterId: meta.adapter_id || undefined,
+                backend: resumeBackend ?? "unknown",
+                cwd: resumeCwd,
+                armedAt: Date.now(),
+                before: readResumeFingerprint(normalizeResumeBackend(resumeBackend), {
+                    instanceDir: this.instanceDir,
+                    workingDirectory: resumeCwd,
+                }),
+            });
+        }
+    }
+    /** #1209: which seam reader serves this instance (live config preferred). */
+    resolveResumeBackend() {
+        return normalizeResumeBackend(this.config.backend ?? this.backend?.binaryName ?? this.runtimeIdentity?.backend);
+    }
+    /** #1209: whether the marker's delivery is still owned by the durable path. */
+    isMarkerDeliveryPending(marker) {
+        const id = marker.deliveryId;
+        if (!id)
+            return false;
+        try {
+            const row = this.deliveryOutbox?.get?.(id);
+            return !!row && RESUME_BLOCKING_DELIVERY_STATES.includes(row.state);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * #1209 ACP-resume-like gate: one bounded continuation for the turn that
+     * was in flight when the process died. The one-shot marker is consumed
+     * FIRST (episode-once: at most one continuation per interrupted turn, even
+     * if the inject below throws or the process dies holding the grace wait),
+     * then the pure gate in turn-resume.ts decides. A hold inside the flush
+     * grace sleeps once and re-gates with a fresh read; a second hold denies
+     * rather than waiting forever. Returns a short outcome for logs/tests.
+     */
+    async maybeResumeInterruptedTurn() {
+        const marker = consumeInFlightTurnMarker(this.instanceDir);
+        if (!marker)
+            return "none";
+        // P1 fence: capture before any await. A cancel (deliveryEpoch),
+        // respawn (spawnGeneration) or stop/pause (launchFenceEpoch) during the
+        // grace hold must stale this gate — the push below rechecks, and the
+        // push path itself carries the then-current epoch, so a post-push
+        // cancel still drops the queued paste. Fence follows the write (#1192).
+        const gateEpoch = this.deliveryEpoch;
+        const gateSpawn = this.spawnGeneration;
+        const gateFence = this.launchFenceEpoch;
+        const gateFresh = () => this.deliveryEpoch === gateEpoch
+            && this.spawnGeneration === gateSpawn
+            && this.launchFenceEpoch === gateFence;
+        const backend = this.resolveResumeBackend() ?? normalizeResumeBackend(marker.backend);
+        const roots = { instanceDir: this.instanceDir, workingDirectory: this.config.working_directory ?? "" };
+        // This boot's CLI spawn is what the daemon itself caused: pre-restart
+        // writes (including pre-crash progress) are excluded, and the flush
+        // grace holds the decision until post-spawn writes are observable.
+        const daemonCausedMtimeMs = this.lastSpawnAt > 0 ? this.lastSpawnAt : -1;
+        const gate = (after, nowMs) => decideTurnResume({
+            marker,
+            before: marker.before,
+            after,
+            daemonCausedMtimeMs,
+            nowMs,
+            crashLoopBoot: this.bootSkippedResume,
+            deliveryPending: this.isMarkerDeliveryPending(marker),
+        });
+        const readAfter = () => backend ? readResumeFingerprint(backend, roots) : null;
+        let decision = gate(readAfter(), Date.now());
+        if (decision.action === "wait") {
+            const waitMs = decision.waitMs;
+            await new Promise(resolve => setTimeout(resolve, waitMs));
+            const recheck = gate(readAfter(), Date.now());
+            decision = recheck.action === "wait"
+                ? {
+                    action: "skip",
+                    reason: "unobservable",
+                    detail: "still inside the flush grace after the hold; default-deny",
+                }
+                : recheck;
+        }
+        // The hold above is the only await on this path: recheck the fence
+        // after it (and before the write). Stale → skip quietly, never an
+        // error notice — the cancel/stop owner already reported itself.
+        if (!gateFresh()) {
+            this.logger.info("Interrupted-turn continuation dropped — cancel/stop/pause/respawn during the grace hold");
+            return "skipped-stale";
+        }
+        if (decision.action === "inject") {
+            const continuation = buildResumeContinuation(marker);
+            try {
+                this.pushChannelMessage(continuation.text, continuation.meta);
+            }
+            catch (err) {
+                this.logger.warn({ err }, "Interrupted-turn continuation failed to queue");
+                return "inject-failed";
+            }
+            this.logger.info({ correlationId: marker.correlationId }, "Injected one bounded continuation for the interrupted turn");
+            return "injected";
+        }
+        this.logger.info({ reason: decision.reason, detail: decision.detail }, "Interrupted turn NOT resumed");
+        return `skipped-${decision.reason}`;
     }
     /**
      * Turn ended (busy→idle edge): if the MCP server is dead and none of the
@@ -4481,11 +4862,17 @@ export class Daemon extends EventEmitter {
         }
         this.statePollInFlight = true;
         const captureStartedAt = Date.now();
+        const interactionCaptureAt = performance.now();
+        const interactionCaptureOrder = ++this.interactionCaptureSerial;
+        const interactionOwner = this.interactionOwner();
         const captureEpoch = `${this.spawnGeneration}:${this.launchAttempt}`;
         const currentDeliveryCapture = () => captureEpoch === `${this.spawnGeneration}:${this.launchAttempt}`
             && !this.spawning && !this.runtimeMonitorsFrozen && this.instanceStateMonitorActive;
         try {
-            const pane = await this.tmux.capturePane();
+            const pane = reason === "interaction_confirmation"
+                ? await this.tmux.capturePane(1_000) : await this.tmux.capturePane();
+            if (!currentDeliveryCapture() || !sameInteractionOwner(interactionOwner, this.interactionOwner()))
+                return;
             // An old capture must not retire a new launch's transient guard either.
             if (reason === "delivery_idle_gate" && !currentDeliveryCapture()) {
                 this.resetFooterFallback();
@@ -4499,7 +4886,6 @@ export class Daemon extends EventEmitter {
                 this.resetFooterFallback();
                 return;
             }
-            this.updateInputBlockedState(pane);
             // A monitor/lifecycle capture can see a busy moment between fleet polls.
             // Even a stale capture of changed content disproves continuous stability;
             // invalidate it before the output-freshness check can return early.
@@ -4512,6 +4898,7 @@ export class Daemon extends EventEmitter {
             const outputMovedDuringCapture = (expectedOutputAt > 0 && this.instanceStateLastOutputAt > expectedOutputAt)
                 || (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureStartedAt);
             if (outputMovedDuringCapture) {
+                this.unverifyInteraction(interactionCaptureAt, interactionCaptureOrder);
                 if (reason === "delivery_idle_gate")
                     this.resetFooterFallback();
                 if (reason === "output_probe") {
@@ -4537,6 +4924,11 @@ export class Daemon extends EventEmitter {
                 }
                 return;
             }
+            if (!currentDeliveryCapture() || !sameInteractionOwner(interactionOwner, this.interactionOwner()))
+                return;
+            if (!this.observeInteractionPane(pane, captureStartedAt, interactionCaptureAt, undefined, interactionCaptureOrder, reason !== "interaction_confirmation"))
+                return;
+            this.updateInputBlockedState(pane);
             // Advance the shared 10s timer only for a fresh capture of this launch.
             const deliveryFallback = deliveryCandidate === true
                 ? this.deliveryInputReadyPane(pane) : deliveryCandidate;
@@ -4709,6 +5101,8 @@ export class Daemon extends EventEmitter {
             }
         }
         catch (err) {
+            if (currentDeliveryCapture() && sameInteractionOwner(interactionOwner, this.interactionOwner()))
+                this.unverifyInteraction(interactionCaptureAt, interactionCaptureOrder);
             if (reason === "delivery_idle_gate")
                 this.resetFooterFallback();
             this.logger.debug({ err: err.message, reason }, "Instance state capture failed");
@@ -4724,6 +5118,7 @@ export class Daemon extends EventEmitter {
         if (!windowId || event.windowId !== windowId || !this.instanceStateMachine)
             return;
         this.instanceStateLastOutputAt = event.at;
+        this.interactionOutputRevision++;
         const canProvePeriodicIdle = !!this.backend?.isPeriodicRedrawIdlePane;
         if (canProvePeriodicIdle || (this.backend?.hasPeriodicPaneRedraw?.() === true && this.instanceState === "idle")) {
             // Do not emit idle→working solely because agy repainted an identical
@@ -4787,6 +5182,7 @@ export class Daemon extends EventEmitter {
         void this.captureAndEvaluateInstanceState("initial");
     }
     stopInstanceStateMonitor() {
+        this.clearInteractionConfirmation();
         this.instanceStateMonitorActive = false;
         this.instanceStatePeriodicIdleConfirmations = 0;
         this.clearInstanceStateIdleTimer();
@@ -4845,6 +5241,8 @@ export class Daemon extends EventEmitter {
     freezeRuntimeMonitors() {
         this.runtimeMonitorsFrozen = true;
         this.launchFenceEpoch++;
+        this.interactionObservation.reset(this.interactionOwner());
+        this.clearInteractionConfirmation();
         if (this.healthCheckTimer) {
             clearTimeout(this.healthCheckTimer);
             this.healthCheckTimer = null;
@@ -6113,10 +6511,18 @@ export class Daemon extends EventEmitter {
                 this.logger.info({ dialog: this.dialogParkedKey }, "Blocking dialog is gone from the pane");
             this.dialogParkedSince = 0;
             this.dialogParkedKey = null;
+            this.dialogParkedInteractionEpisode = null;
             this.dialogParkedReported = false;
             return;
         }
         const key = Daemon.dialogKey(dialog);
+        const interaction = this.getInteractionSnapshot();
+        const episode = this.interactionDialogKey === key ? interaction.episode : null;
+        if (episode !== null && this.dialogParkedInteractionEpisode !== null && episode !== this.dialogParkedInteractionEpisode) {
+            this.dialogParkedSince = 0;
+        }
+        if (episode !== null)
+            this.dialogParkedInteractionEpisode = episode;
         if (this.dialogParkedSince === 0 || this.dialogParkedKey !== key) {
             this.dialogParkedSince = Date.now();
             this.dialogParkedKey = key;
@@ -6126,7 +6532,8 @@ export class Daemon extends EventEmitter {
         if (!this.dialogParkedReported && Date.now() - this.dialogParkedSince >= DIALOG_PARKED_NOTIFY_MS) {
             this.dialogParkedReported = true;
             this.logger.warn({ dialog: dialog.description, parkedForMs: Date.now() - this.dialogParkedSince }, "CLI dialog is still on screen — not auto-answering, reporting for a human");
-            this.emit("dialog_parked", { name: this.name, description: dialog.description, holdOnly: dialog.holdOnly === true });
+            this.emit("dialog_parked", { name: this.name, description: dialog.description, holdOnly: dialog.holdOnly === true,
+                ...(episode !== null && interaction.kind ? { kind: interaction.kind, episode, backend: this.config.backend ?? "claude-code" } : {}) });
         }
     }
     /**
@@ -6882,6 +7289,13 @@ export class Daemon extends EventEmitter {
                     return false;
                 }
                 verdict.durableBeginCommitted = true;
+                if (attemptEvidence.transcriptPath && attemptEvidence.transcriptOffset !== null) {
+                    verdict.transcriptCheckpoint = {
+                        backend: attemptEvidence.backend,
+                        path: attemptEvidence.transcriptPath,
+                        offset: attemptEvidence.transcriptOffset,
+                    };
+                }
             }
             if (rawPaste)
                 verdict.paneWriteStarted = true;
@@ -7174,6 +7588,12 @@ export class Daemon extends EventEmitter {
                 if (becameBusy) {
                     if (status)
                         this.emit("message_confirmed", status); // ✅
+                    // A backend whose input row cannot be read was confirmed by "the pane printed something after Enter" — which a
+                    // redraw that wiped the paste also satisfies (#758). The outbox must not call that a submission proof.
+                    // A steer keeps its pre-#758 settlement (steer-accepted / positive submission proof): routing it into the
+                    // transcript-proof wait would hold a steer to `uncertain` whenever the CLI files no transcript marker (#1207 P2).
+                    if (!rawPaste && !steer && !this.canProveSubmission())
+                        verdict.proof = "output-edge";
                 }
                 else {
                     const proof = this.backend?.isDeliveryInputReadyPane
@@ -7725,6 +8145,12 @@ export class Daemon extends EventEmitter {
             // for this turn: the agent proved it can still speak for itself.
             if (!error && result != null && TURN_OUTBOUND_TOOLS.has(tool)) {
                 this.turnReplyGuard.settleToolAttempt(replyAttempt, true);
+                // #1209 P2: the user got an answer — the turn is over for resume
+                // purposes even before the idle edge completes the guard. Without
+                // this, a restart in the reply-to-idle window would re-inject a
+                // continuation for an already-answered turn.
+                if (replyAttempt?.completionAction)
+                    clearInFlightTurnMarker(this.instanceDir);
             }
             const sent = this.ipcServer?.send(socket, { requestId, result, error, operationId }) ?? false;
             if (!sent) {
@@ -7743,16 +8169,21 @@ export class Daemon extends EventEmitter {
             this.handleReleaseRepo(args, respond);
             return;
         }
-        if (tool === "set_display_name" || tool === "set_description" || tool === "list_emojis" || tool === "set_persona_emoji" || tool === "preview_emojis") {
+        if (tool === "set_display_name" || tool === "set_description" || tool === "list_emojis" || tool === "set_persona_emoji" || tool === "preview_emojis"
+            || tool === "list_stickers" || tool === "preview_stickers") {
             const type = tool === "set_display_name" ? "fleet_set_display_name"
                 : tool === "set_description" ? "fleet_set_description"
                     : tool === "list_emojis" ? "fleet_list_emojis"
-                        : tool === "preview_emojis" ? "fleet_preview_emojis" : "fleet_set_persona_emoji";
+                        : tool === "preview_emojis" ? "fleet_preview_emojis"
+                            : tool === "list_stickers" ? "fleet_list_stickers"
+                                : tool === "preview_stickers" ? "fleet_preview_stickers" : "fleet_set_persona_emoji";
             const fleetReqId = `${tool === "set_display_name" ? "dn" : tool === "set_description" ? "desc" : "emoji"}_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
                 respond(null, `${tool} timed out`);
-            }, 10_000);
+                // The shared budget (ipc-timeouts.ts), so the MCP ceiling stays above it and this message is the one seen;
+                // a preview downloads pictures and needs more than the old fixed 10s.
+            }, daemonBudgetMs(tool));
             this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
@@ -8176,6 +8607,8 @@ export class Daemon extends EventEmitter {
         this.turnReplyGuard.reset();
         if (this.spawnDepth === 0) {
             this.spawnGeneration++;
+            this.interactionObservation.reset(this.interactionOwner());
+            this.clearInteractionConfirmation();
             this.inputTransientGuardGeneration = (this.backend?.getInputUnavailableTransients?.().length ?? 0) > 0
                 ? this.spawnGeneration
                 : null;
@@ -8850,6 +9283,8 @@ export class Daemon extends EventEmitter {
         // Every launched command re-arms the passive-transient check, including a
         // retry inside the same spawn: its load is a new one.
         this.launchAttempt++;
+        this.interactionObservation.reset(this.interactionOwner());
+        this.clearInteractionConfirmation();
         // A launch that cannot paint a passive transient (Codex: a fresh start
         // never shows "Resuming session…") must not honour one quoted on screen.
         if (this.backend.launchMayShowInputTransient?.() === false)