@songsid/agend 2.1.12-beta.1 → 2.1.12-beta.3

package/dist/daemon.js

@@ -35,6 +35,8 @@ import { MuseUsageRelay, clearMuseUsageSnapshot } from "./muse-usage-relay.js";
 import { deliveryContentDigest } from "./delivery-outbox.js";
 import { queueResumePolicyForAttempt } from "./delivery-queue-evidence.js";
 import { scanTranscriptForDeliveryMarker } from "./delivery-reconciliation.js";
+import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
+import { codexLiveRowMatches } from "./backend/codex.js";
 import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -53,7 +55,16 @@ const TURN_OUTBOUND_TOOLS = new Set([
 // a deliberate reaction or edit is a valid response even without new text.
 const TURN_COMPLETION_TOOLS = new Set(["reply", "react", "edit_message"]);
 const REPLY_DROP_WARNING_COOLDOWN_MS = 5 * 60_000;
-const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. React with an emoji or use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, a brief react is sufficient. Do not reply to this system instruction except through the react or reply tool.";
+/**
+ * #1241: how long an idle edge must persist — with no reply and no further
+ * observed work — before the reply guard declares the turn a miss. A claude
+ * turn can repaint idle mid-turn (long thinking, subagent delegation) while
+ * the first reply is still minutes out; recovering on the first edge injects
+ * a prompt the agent later answers twice. A genuine miss stays idle, so the
+ * backstop is delayed by at most this window, never disabled.
+ */
+const REPLY_GUARD_IDLE_CONFIRM_MS = 60_000;
+const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. React with an emoji or use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, a brief react is sufficient. If you already replied to this message, do nothing. Do not reply to this system instruction except through the react or reply tool.";
 /** Point a resumed CLI at its one backend-native instruction source. */
 export function buildInstructionReloadNotice(binaryName, instanceName, instanceDir) {
     const source = binaryName === "codex" || binaryName === "grok" || binaryName === "muse"
@@ -423,6 +434,10 @@ export class PendingWorkTracker {
         this.lastInboundAt = now;
         this.lastInboundOrder = ++this.sequence;
     }
+    /** #1241 P2-1: when the latest delivery entered, bounding pre-arm activity. */
+    lastInboundTimestamp() {
+        return this.lastInboundAt;
+    }
     recordIdle(now = Date.now()) {
         // An async pane poll can finish after a newer inbound. Do not let its stale
         // observation clear work which had not arrived when the pane was captured.
@@ -564,6 +579,12 @@ const INPUT_TRANSIENT_WAIT_MS = 10 * 60_000;
 const INPUT_TRANSIENT_POLL_MS = 250;
 /** Max "stranded text → submit → wait for prompt → re-check" rounds per delivery; each may send one recovery Enter. */
 const STRANDED_INPUT_MAX_ROUNDS = 3;
+/** The Claude phrasing every backend was judged by before #1217; still the default for a backend that names none. */
+const LEGACY_NO_CONVERSATION = /no conversation found|no conversation to (continue|resume)|no previous (session|conversation)/i;
+/** #1217: unproven resume failures, kept across Daemon instances, keyed by session id. */
+const RESUME_FAILURES_FILE = "resume-failures.json";
+/** #1217: the backend that owns the stored session id. */
+const SESSION_OWNER_FILE = "session-id.backend";
 /** #829: most clearing rounds for a restored draft (one row each), and how long one round may take to show. */
 const INPUT_RESIDUE_MAX_ROUNDS = 60;
 const INPUT_RESIDUE_ROUND_WAIT_MS = 1_000;
@@ -1067,6 +1088,12 @@ export class Daemon extends EventEmitter {
      */
     launchAttempt = 0;
     skipResume = false;
+    /**
+     * #1209: whether THIS boot was asked to skip resume by a crash-loop
+     * (crash-state.json). Captured at boot before spawnClaudeWindow resets
+     * skipResume — the #1209 gate reads this, never the resettable flag.
+     */
+    bootSkippedResume = false;
     startupAborted = false;
     /** First time the current on-screen blocking dialog was seen (0 = none); drives the parked report. */
     dialogParkedSince = 0;
@@ -1150,6 +1177,11 @@ export class Daemon extends EventEmitter {
     instanceStateIdleDebounceMs = DEFAULT_STATE_IDLE_DEBOUNCE_MS;
     instanceStateStuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS;
     instanceStateReadyPattern = null;
+    /**
+     * #1241 P2-2: an execution snapshot was suppressed by a blocking dialog.
+     * When the block lifts, the silence since counts as a fresh interval.
+     */
+    sawBlockedInput = false;
     instanceStateBusyPattern = null;
     instanceStateMonitorActive = false;
     sessionCheckpointWarningEmitted = false;
@@ -1162,6 +1194,62 @@ export class Daemon extends EventEmitter {
     lastMalformedToolCallSignature;
     proxyReplySeq = 0;
     lastReplyDropWarningAt = 0;
+    /**
+     * #1241: an idle edge that has not yet proven the turn ended. Armed instead
+     * of recovering immediately; a steady idle snapshot past confirmAt promotes
+     * it to a real recovery, while a delivered reply, cancel, or newly observed
+     * work dissolves it. Scoped to one guard generation. Split clock domains
+     * (R3): edgeAt is wall-clock (compared only against lastBusyAt, also wall —
+     * event ordering, never a deadline), while confirmAt is monotonic
+     * (performance.now, same domain as the setTimeout firing the deadline), so
+     * a wall jump can neither shorten nor stretch the window.
+     */
+    replyGuardIdleConfirm = null;
+    /**
+     * #1241 P3: the confirmation window's own wake-up. Monitor ticks may be up
+     * to 60 s apart, so without this the real delay could approach two windows.
+     * At the deadline a fresh, fenced capture re-observes the pane instead.
+     */
+    replyGuardConfirmTimer = null;
+    /** #1241: dissolve a pending confirmation and its deadline, if any. */
+    clearReplyGuardConfirm() {
+        this.replyGuardIdleConfirm = null;
+        if (this.replyGuardConfirmTimer) {
+            clearTimeout(this.replyGuardConfirmTimer);
+            this.replyGuardConfirmTimer = null;
+        }
+    }
+    /** #1241: arm a confirmation window with its own deadline capture. */
+    armReplyGuardConfirm(generation) {
+        this.clearReplyGuardConfirm();
+        this.replyGuardIdleConfirm = {
+            generation,
+            edgeAt: Date.now(),
+            confirmAt: performance.now() + REPLY_GUARD_IDLE_CONFIRM_MS,
+        };
+        this.replyGuardConfirmTimer = setTimeout(() => {
+            this.replyGuardConfirmTimer = null;
+            this.fireReplyGuardConfirm();
+        }, REPLY_GUARD_IDLE_CONFIRM_MS);
+    }
+    /**
+     * #1241 P3: the window elapsed with no verdict from monitor ticks — drive
+     * one fresh observation. Generation-fenced twice: a stale record returns
+     * before capturing, and the resulting snapshot still flows through the
+     * normal confirmed evaluation. When the capture cannot run (paused, frozen,
+     * spawning), the record stays and the next monitor tick promotes instead.
+     */
+    fireReplyGuardConfirm() {
+        const pending = this.replyGuardIdleConfirm;
+        if (!pending)
+            return;
+        const turn = this.turnReplyGuard.snapshot();
+        if (!turn || turn.generation !== pending.generation || turn.phase !== "awaiting") {
+            this.clearReplyGuardConfirm();
+            return;
+        }
+        void this.captureAndEvaluateInstanceState("reply_guard_confirm", this.instanceStateLastOutputAt);
+    }
     autoPauseController;
     pauseRequested = false;
     /**
@@ -1542,6 +1630,11 @@ export class Daemon extends EventEmitter {
         const isGeneral = config.general_topic === true || name === "general";
         const autoPauseMinutes = isGeneral ? 0 : (typeof config.auto_pause_after === "number" ? config.auto_pause_after : 0); // default: disabled
         this.autoPauseController = new AutoPauseController(Math.max(0, autoPauseMinutes) * 60_000, readLastInboundAt(instanceDir) ?? Date.now());
+        // #1209: every real completion clears the in-flight marker, so a
+        // finished turn can never resume after a later restart. reset() is
+        // deliberately NOT hooked: stop/spawn abandon the in-memory turn while
+        // the on-disk interruption must survive for the resume gate.
+        this.turnReplyGuard.onComplete = () => clearInFlightTurnMarker(this.instanceDir);
     }
     /** FleetManager and this daemon share a process, so durable begin/ACK is a direct synchronous store call. */
     setDeliveryOutboxPort(port) {
@@ -1811,6 +1904,7 @@ export class Daemon extends EventEmitter {
         // an unreadable marker for a later start; clear successfully read bytes
         // even when the JSON is corrupt so it cannot remain forever.
         const crashStatePath = join(this.instanceDir, "crash-state.json");
+        this.bootSkippedResume = false;
         try {
             if (existsSync(crashStatePath)) {
                 const content = readFileSync(crashStatePath, "utf-8");
@@ -1818,6 +1912,7 @@ export class Daemon extends EventEmitter {
                     const state = JSON.parse(content);
                     if (state?.resumeDisabled === true) {
                         this.skipResume = true;
+                        this.bootSkippedResume = true;
                         this.logger.warn("Previous crash loop detected — starting without resume");
                     }
                 }
@@ -1956,6 +2051,10 @@ export class Daemon extends EventEmitter {
             }
             catch { /* may not exist */ }
         }
+        // #1209: conditional continuation for the turn interrupted by the last
+        // restart, if the gates allow. Detached like the warmup notice; the gate
+        // consumes its one-shot marker first and never throws into boot.
+        void this.maybeResumeInterruptedTurn().catch(() => { });
         // Warmup: wait for CLI idle, then trigger steering reload — but only when
         // the instructions actually changed since the agent last saw them.
         // Skipping the no-op reload saves 10-30s of agent time on every restart
@@ -3161,12 +3260,9 @@ export class Daemon extends EventEmitter {
     /** Evaluate one pane snapshot. Kept synchronous so state-machine edges are unit-testable. */
     evaluateErrorPatterns(pane, patterns, readyPattern, now = Date.now(), busyPattern = null) {
         // Count occurrences across the WHOLE pane (not just text after the last
-        // ready prompt). Clone with `g` so stateful backend regexes cannot leak
-        // lastIndex between monitor cycles.
-        const countMatches = (pattern) => {
-            const flags = pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g";
-            return (pane.match(new RegExp(pattern.source, flags)) || []).length;
-        };
+        // ready prompt). One shared counter (the static below): arm requires
+        // count > baseline, so a drifted clone here would silently gate nudges.
+        const countMatches = (pattern) => Daemon.countOccurrences(pattern, pane);
         // Same veto as the state machine: a backend whose ready marker is permanently
         // on screen would otherwise "recover" on the very first tick after the error,
         // rebaselining the occurrence count while the error is still displayed — one
@@ -3395,6 +3491,13 @@ export class Daemon extends EventEmitter {
         // FleetManager calls this synchronously before sendEscape. Cancel only the
         // current human turn; leave already-forwarded tool requests to settle.
         this.turnReplyGuard.cancelByUser();
+        // #1241: a cancelled turn never confirms — its next edge completes it as
+        // intentional. Drop a pending confirmation so it cannot promote afterwards.
+        this.clearReplyGuardConfirm();
+        // #1209: a cancelled turn must never resume (#1199) — drop its marker.
+        // (Completion paths clear via the guard's onComplete; a cancel with no
+        // later idle edge would otherwise leave the marker behind.)
+        clearInFlightTurnMarker(this.instanceDir);
         this.deliveryEpoch = fleetEpoch === undefined
             ? this.deliveryEpoch + 1
             : Math.max(this.deliveryEpoch, fleetEpoch);
@@ -3721,11 +3824,38 @@ export class Daemon extends EventEmitter {
             return false;
         return this.waitForPaneReadyForDelivery(windowId, KIRO_STOP_IDLE_BUDGET_MS);
     }
+    /**
+     * #1217: the CLI answered its quit command with a confirmation that a stray
+     * key would answer for us (Claude's "Background work is running": Enter
+     * picks "Exit and stop tasks"). Never choose an option: cancel the prompt
+     * with Escape and let the caller stop the process itself (SIGTERM), which is
+     * what the bounded grace would have come to anyway — just without waiting
+     * it out. True when that prompt was on screen.
+     */
+    async cancelQuitConfirmation(reason) {
+        const backend = this.backend;
+        if (!backend?.quitBlockedByDialog || !this.tmux)
+            return false;
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return false;
+        }
+        if (!backend.quitBlockedByDialog(pane))
+            return false;
+        this.logger.warn({ reason }, "The CLI asked to confirm its exit (background work is running) — cancelling that prompt and stopping the process, not answering it");
+        await this.tmux.sendSpecialKey("Escape").catch(() => false);
+        return true;
+    }
     async stop() {
         this.logger.info("Stopping daemon instance");
         this.clearQuitRelaunchWatch();
         this.fenceDeliveryWritesForStop();
         this.turnReplyGuard.reset();
+        this.clearReplyGuardConfirm();
+        this.sawBlockedInput = false;
         // Invalidate any bounded pre-Enter wait from the process generation being
         // stopped. It must fail closed, not press Enter in a replacement pane.
         this.inputTransientGuardGeneration = null;
@@ -3767,6 +3897,8 @@ export class Daemon extends EventEmitter {
                         killed = true;
                         break;
                     }
+                    if (await this.cancelQuitConfirmation("stop"))
+                        break;
                 }
             }
             if (!killed) {
@@ -4030,6 +4162,8 @@ export class Daemon extends EventEmitter {
                         exited = true;
                         break;
                     }
+                    if (await this.cancelQuitConfirmation(pauseReason))
+                        break;
                 }
                 if (!exited) {
                     await this.killProcessTree("SIGTERM", `${pauseReason}: the CLI outlived its quit grace`);
@@ -4190,7 +4324,24 @@ export class Daemon extends EventEmitter {
         // dedicated input_blocked event carries the reason to observers.
         if (this.inputBlockedDialogKey !== null) {
             this.logger.debug({ dialog: this.inputBlockedDialogKey }, "Suppressing execution-state edge while CLI input is blocked by a dialog");
-            return;
+            // #1241 P2-2: stdin-owned work is not idle evidence. A pending window
+            // measured through a dialog would recover on pre-dialog idle time, so
+            // the block dissolves it; the silence after the dialog clears starts a
+            // fresh interval below.
+            this.sawBlockedInput = true;
+            this.clearReplyGuardConfirm();
+            return;
+        }
+        // #1241 P2-2: the block just lifted. With the pane idle, evaluate like an
+        // edge so a genuine miss re-accumulates a full window instead of inheriting
+        // pre-dialog idle time (or never re-arming at all when the daemon froze at
+        // idle). Only arming runs here: recovery-phase turns keep their lifecycle.
+        const justUnblocked = this.sawBlockedInput;
+        this.sawBlockedInput = false;
+        if (justUnblocked && snapshot.state === "idle") {
+            const unblockedTurn = this.turnReplyGuard.snapshot();
+            if (unblockedTurn && unblockedTurn.phase === "awaiting")
+                this.maybeProxyReplyOnTurnEnd(pane);
         }
         this.instanceState = snapshot.state;
         this.acceptedInstanceSnapshot = { ...snapshot };
@@ -4204,6 +4355,18 @@ export class Daemon extends EventEmitter {
         if (snapshot.state === "idle" && this.backend?.binaryName === "opencode") {
             this.checkpointSessionIdInBackground();
         }
+        // #1241: the turn demonstrably continued — work observed after an idle
+        // edge dissolves a pending guard confirmation. A later genuine end
+        // re-arms it with a fresh edge.
+        if (snapshot.state !== "idle") {
+            this.turnReplyGuard.noteTurnActivity();
+            const pending = this.replyGuardIdleConfirm;
+            const turn = this.turnReplyGuard.snapshot();
+            if (pending && turn && turn.generation === pending.generation && turn.phase === "awaiting") {
+                this.clearReplyGuardConfirm();
+                this.logger.debug({ correlationId: turn.target.correlationId, generation: turn.generation }, "Reply guard confirmation dropped — work observed after the idle edge, the turn continued");
+            }
+        }
         // Only a transition back to idle completes pending work. Repeated idle
         // observations between enqueue and paste must not clear a newer inbound.
         if (snapshot.state === "idle" && previous !== "idle") {
@@ -4218,6 +4381,12 @@ export class Daemon extends EventEmitter {
             if (acceptedIdle)
                 this.maybeProxyReplyOnTurnEnd(pane);
         }
+        else if (snapshot.state === "idle") {
+            // #1241: steady idle between edges. A pending confirmation whose window
+            // has elapsed is promoted to a real evaluation here — proven idle,
+            // not the first output gap.
+            this.maybeConfirmReplyGuardIdle(pane);
+        }
         if (snapshot.state !== previous) {
             this.logStateEdge(previous, snapshot);
             this.emit("instance_state", { name: this.name, ...snapshot });
@@ -4287,6 +4456,8 @@ export class Daemon extends EventEmitter {
         // The last non-empty line of what we pasted: everything on screen after it
         // is the agent's own output.
         const inboundMarker = deliveredText.split(/\r?\n/).map(l => l.trim()).filter(Boolean).pop();
+        // #1241 P2-1: carry pre-arm work evidence over the arm, bounded by this
+        // delivery's ingress — output the paste produced before it confirmed.
         this.turnReplyGuard.arm({
             adapterId: meta.adapter_id || undefined,
             chatId: meta.chat_id,
@@ -4294,7 +4465,126 @@ export class Daemon extends EventEmitter {
             messageId: meta.message_id || undefined,
             correlationId: meta.correlation_id || undefined,
             inboundMarker,
+        }, this.pendingWork.lastInboundTimestamp());
+        // #1209: persist the in-flight turn with a seam checkpoint. A marker
+        // that survives a restart is an interrupted turn by construction —
+        // completion (via the guard's onComplete) and cancel paths delete it.
+        // Synchronous by necessity: a crash between arm and write must not lose
+        // the interruption. Reads are windowed/bounded (see turn-resume.ts).
+        // A resumed continuation never re-arms (P3a): episode-once means a crash
+        // during the continuation boots clean instead of chaining resumes.
+        if (!meta.resumedContinuationOf) {
+            const resumeBackend = this.config.backend ?? this.backend?.binaryName ?? this.runtimeIdentity?.backend;
+            const resumeCwd = this.config.working_directory ?? "";
+            writeInFlightTurnMarker(this.instanceDir, {
+                version: 1,
+                deliveryId: meta.delivery_id || undefined,
+                correlationId: meta.correlation_id || undefined,
+                messageId: meta.message_id || undefined,
+                chatId: meta.chat_id,
+                threadId: meta.thread_id || undefined,
+                adapterId: meta.adapter_id || undefined,
+                backend: resumeBackend ?? "unknown",
+                cwd: resumeCwd,
+                armedAt: Date.now(),
+                before: readResumeFingerprint(normalizeResumeBackend(resumeBackend), {
+                    instanceDir: this.instanceDir,
+                    workingDirectory: resumeCwd,
+                }),
+            });
+        }
+    }
+    /** #1209: which seam reader serves this instance (live config preferred). */
+    resolveResumeBackend() {
+        return normalizeResumeBackend(this.config.backend ?? this.backend?.binaryName ?? this.runtimeIdentity?.backend);
+    }
+    /** #1209: whether the marker's delivery is still owned by the durable path. */
+    isMarkerDeliveryPending(marker) {
+        const id = marker.deliveryId;
+        if (!id)
+            return false;
+        try {
+            const row = this.deliveryOutbox?.get?.(id);
+            return !!row && RESUME_BLOCKING_DELIVERY_STATES.includes(row.state);
+        }
+        catch {
+            return false;
+        }
+    }
+    /**
+     * #1209 ACP-resume-like gate: one bounded continuation for the turn that
+     * was in flight when the process died. The one-shot marker is consumed
+     * FIRST (episode-once: at most one continuation per interrupted turn, even
+     * if the inject below throws or the process dies holding the grace wait),
+     * then the pure gate in turn-resume.ts decides. A hold inside the flush
+     * grace sleeps once and re-gates with a fresh read; a second hold denies
+     * rather than waiting forever. Returns a short outcome for logs/tests.
+     */
+    async maybeResumeInterruptedTurn() {
+        const marker = consumeInFlightTurnMarker(this.instanceDir);
+        if (!marker)
+            return "none";
+        // P1 fence: capture before any await. A cancel (deliveryEpoch),
+        // respawn (spawnGeneration) or stop/pause (launchFenceEpoch) during the
+        // grace hold must stale this gate — the push below rechecks, and the
+        // push path itself carries the then-current epoch, so a post-push
+        // cancel still drops the queued paste. Fence follows the write (#1192).
+        const gateEpoch = this.deliveryEpoch;
+        const gateSpawn = this.spawnGeneration;
+        const gateFence = this.launchFenceEpoch;
+        const gateFresh = () => this.deliveryEpoch === gateEpoch
+            && this.spawnGeneration === gateSpawn
+            && this.launchFenceEpoch === gateFence;
+        const backend = this.resolveResumeBackend() ?? normalizeResumeBackend(marker.backend);
+        const roots = { instanceDir: this.instanceDir, workingDirectory: this.config.working_directory ?? "" };
+        // This boot's CLI spawn is what the daemon itself caused: pre-restart
+        // writes (including pre-crash progress) are excluded, and the flush
+        // grace holds the decision until post-spawn writes are observable.
+        const daemonCausedMtimeMs = this.lastSpawnAt > 0 ? this.lastSpawnAt : -1;
+        const gate = (after, nowMs) => decideTurnResume({
+            marker,
+            before: marker.before,
+            after,
+            daemonCausedMtimeMs,
+            nowMs,
+            crashLoopBoot: this.bootSkippedResume,
+            deliveryPending: this.isMarkerDeliveryPending(marker),
         });
+        const readAfter = () => backend ? readResumeFingerprint(backend, roots) : null;
+        let decision = gate(readAfter(), Date.now());
+        if (decision.action === "wait") {
+            const waitMs = decision.waitMs;
+            await new Promise(resolve => setTimeout(resolve, waitMs));
+            const recheck = gate(readAfter(), Date.now());
+            decision = recheck.action === "wait"
+                ? {
+                    action: "skip",
+                    reason: "unobservable",
+                    detail: "still inside the flush grace after the hold; default-deny",
+                }
+                : recheck;
+        }
+        // The hold above is the only await on this path: recheck the fence
+        // after it (and before the write). Stale → skip quietly, never an
+        // error notice — the cancel/stop owner already reported itself.
+        if (!gateFresh()) {
+            this.logger.info("Interrupted-turn continuation dropped — cancel/stop/pause/respawn during the grace hold");
+            return "skipped-stale";
+        }
+        if (decision.action === "inject") {
+            const continuation = buildResumeContinuation(marker);
+            try {
+                this.pushChannelMessage(continuation.text, continuation.meta);
+            }
+            catch (err) {
+                this.logger.warn({ err }, "Interrupted-turn continuation failed to queue");
+                return "inject-failed";
+            }
+            this.logger.info({ correlationId: marker.correlationId }, "Injected one bounded continuation for the interrupted turn");
+            return "injected";
+        }
+        this.logger.info({ reason: decision.reason, detail: decision.detail }, "Interrupted turn NOT resumed");
+        return `skipped-${decision.reason}`;
     }
     /**
      * Turn ended (busy→idle edge): if the MCP server is dead and none of the
@@ -4303,7 +4593,18 @@ export class Daemon extends EventEmitter {
      * manager does not pass through the dead MCP server. Consuming the turn state
      * here (edge-triggered, then reset) is what makes it at most once per turn.
      */
-    maybeProxyReplyOnTurnEnd(pane) {
+    /**
+     * #1241: promote a pending idle-edge confirmation once the window has
+     * elapsed. Steady idle with no reply and no work since the edge is proven
+     * idle; anything else dissolves the confirmation and leaves the turn armed.
+     */
+    maybeConfirmReplyGuardIdle(pane) {
+        const pending = this.replyGuardIdleConfirm;
+        if (!pending || this.isPaused || performance.now() < pending.confirmAt)
+            return;
+        this.maybeProxyReplyOnTurnEnd(pane, true);
+    }
+    maybeProxyReplyOnTurnEnd(pane, confirmed = false) {
         const turn = this.turnReplyGuard.snapshot();
         if (!turn || this.isPaused)
             return;
@@ -4315,18 +4616,21 @@ export class Daemon extends EventEmitter {
                     generation: turn.generation,
                 });
             }
+            this.clearReplyGuardConfirm();
             this.turnReplyGuard.complete(turn.generation);
             return;
         }
         // An intentional stop is not a dropped reply. Successful in-flight replies
         // still settle above, but cancellation cannot start another model turn.
         if (turn.cancelledByUser) {
+            this.clearReplyGuardConfirm();
             this.turnReplyGuard.complete(turn.generation);
             return;
         }
         // A second idle edge ends the one permitted recovery turn. Never create a
         // third turn or guess at terminal text; make the failure visible instead.
         if (turn.phase === "recovering") {
+            this.clearReplyGuardConfirm();
             this.turnReplyGuard.complete(turn.generation);
             this.reportUnrecoveredReplyDrop(turn);
             return;
@@ -4387,10 +4691,50 @@ export class Daemon extends EventEmitter {
         if (turn.replyAttempted) {
             // A provider timeout can be "applied, then timed out". Retrying it would
             // risk a duplicate; report the unknown result and stop here.
+            this.clearReplyGuardConfirm();
             this.turnReplyGuard.complete(turn.generation);
             this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
             return;
         }
+        // #1241: an idle edge is not proof the turn ended. Two gates before the
+        // recovery prompt goes anywhere near the CLI's input:
+        // 1. work must have been observed after this generation armed — otherwise
+        //    the "edge" is a pane flicker (or a stale working state) mid-turn,
+        //    and the turn stays armed for its real end;
+        // 2. the edge must persist: the first qualifying edge only arms a
+        //    confirmation window, and recovery starts only when steady idle past
+        //    the window still shows no reply and no further work.
+        if (!turn.busyObserved) {
+            this.logger.info({
+                correlationId: turn.target.correlationId,
+                generation: turn.generation,
+                reason: "no_busy_since_arm",
+            }, "Reply guard holding — idle edge with no work observed since the turn armed, not a turn end");
+            return;
+        }
+        if (!confirmed) {
+            if (this.replyGuardIdleConfirm?.generation === turn.generation)
+                return;
+            this.armReplyGuardConfirm(turn.generation);
+            this.logger.info({
+                correlationId: turn.target.correlationId,
+                generation: turn.generation,
+                reason: "idle_edge_pending_confirm",
+                confirmMs: REPLY_GUARD_IDLE_CONFIRM_MS,
+            }, "Reply guard idle edge pending confirmation — holding recovery until idle persists");
+            return;
+        }
+        if (this.replyGuardIdleConfirm && turn.lastBusyAt > this.replyGuardIdleConfirm.edgeAt) {
+            this.clearReplyGuardConfirm();
+            this.logger.info({ correlationId: turn.target.correlationId, generation: turn.generation }, "Reply guard confirmation dropped — work observed after the idle edge, the turn continued");
+            return;
+        }
+        // A stale confirmation for another generation proves nothing about this one.
+        if (this.replyGuardIdleConfirm && this.replyGuardIdleConfirm.generation !== turn.generation) {
+            this.clearReplyGuardConfirm();
+            return;
+        }
+        this.clearReplyGuardConfirm();
         this.startReplyRecovery(turn, "no_valid_call");
     }
     isClaudeCodeBackend() {
@@ -4403,6 +4747,9 @@ export class Daemon extends EventEmitter {
             && this.backend?.replyCompletionGuard === true;
     }
     startReplyRecovery(turn, reason) {
+        // The confirmation served its purpose: recovery has its own lifecycle now
+        // (a second edge ends it), so a pending window must not linger past this.
+        this.clearReplyGuardConfirm();
         const current = this.turnReplyGuard.snapshot();
         if (current?.generation === turn.generation && current.cancelledByUser) {
             this.turnReplyGuard.complete(turn.generation);
@@ -6218,8 +6565,12 @@ export class Daemon extends EventEmitter {
         const baseline = this.nudgeBaselines?.get(episode.key);
         if (baseline === undefined || Daemon.countOccurrences(pattern, episode.pane) <= baseline)
             return false;
+        // And only when the row is the live item, not a quotation or scrollback above a newer turn. (Never a regex
+        // lookahead on the counting pattern: whole-pane dedup would max at 1 and miss later hits. See #1215.)
+        if (!codexLiveRowMatches(episode.pane, pattern))
+            return false;
         this.capacityNudge = {
-            pane: episode.pane, spawn: episode.spawn, fence: episode.fence,
+            pane: episode.pane, pattern, spawn: episode.spawn, fence: episode.fence,
             epoch: this.deliveryEpoch, dueAt: performance.now() + delayMs,
         };
         this.logger.info({ delayMs }, "Model-capacity nudge armed");
@@ -6293,7 +6644,8 @@ export class Daemon extends EventEmitter {
             // vouching for the first — "same screen" here, "idle" there — would let a half-typed draft through.)
             const sent = await this.submitSystemPaste(t("inst.codex_capacity_nudge_text"), "capacity-continue", {
                 current,
-                accept: pane => pane === nudge.pane && this.paneAuthoritativelyIdle(pane),
+                accept: pane => pane === nudge.pane && this.paneAuthoritativelyIdle(pane)
+                    && codexLiveRowMatches(pane, nudge.pattern),
             });
             this.logger.info({ sent }, "Model-capacity nudge attempted");
         });
@@ -8004,6 +8356,12 @@ export class Daemon extends EventEmitter {
             // for this turn: the agent proved it can still speak for itself.
             if (!error && result != null && TURN_OUTBOUND_TOOLS.has(tool)) {
                 this.turnReplyGuard.settleToolAttempt(replyAttempt, true);
+                // #1209 P2: the user got an answer — the turn is over for resume
+                // purposes even before the idle edge completes the guard. Without
+                // this, a restart in the reply-to-idle window would re-inject a
+                // continuation for an already-answered turn.
+                if (replyAttempt?.completionAction)
+                    clearInFlightTurnMarker(this.instanceDir);
             }
             const sent = this.ipcServer?.send(socket, { requestId, result, error, operationId }) ?? false;
             if (!sent) {
@@ -8022,16 +8380,21 @@ export class Daemon extends EventEmitter {
             this.handleReleaseRepo(args, respond);
             return;
         }
-        if (tool === "set_display_name" || tool === "set_description" || tool === "list_emojis" || tool === "set_persona_emoji" || tool === "preview_emojis") {
+        if (tool === "set_display_name" || tool === "set_description" || tool === "list_emojis" || tool === "set_persona_emoji" || tool === "preview_emojis"
+            || tool === "list_stickers" || tool === "preview_stickers") {
             const type = tool === "set_display_name" ? "fleet_set_display_name"
                 : tool === "set_description" ? "fleet_set_description"
                     : tool === "list_emojis" ? "fleet_list_emojis"
-                        : tool === "preview_emojis" ? "fleet_preview_emojis" : "fleet_set_persona_emoji";
+                        : tool === "preview_emojis" ? "fleet_preview_emojis"
+                            : tool === "list_stickers" ? "fleet_list_stickers"
+                                : tool === "preview_stickers" ? "fleet_preview_stickers" : "fleet_set_persona_emoji";
             const fleetReqId = `${tool === "set_display_name" ? "dn" : tool === "set_description" ? "desc" : "emoji"}_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
                 respond(null, `${tool} timed out`);
-            }, 10_000);
+                // The shared budget (ipc-timeouts.ts), so the MCP ceiling stays above it and this message is the one seen;
+                // a preview downloads pictures and needs more than the old fixed 10s.
+            }, daemonBudgetMs(tool));
             this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
@@ -8453,6 +8816,8 @@ export class Daemon extends EventEmitter {
         // warning is safer than treating the replacement's startup idle as the old
         // turn ending and injecting a stale recovery prompt.
         this.turnReplyGuard.reset();
+        this.clearReplyGuardConfirm();
+        this.sawBlockedInput = false;
         if (this.spawnDepth === 0) {
             this.spawnGeneration++;
             this.interactionObservation.reset(this.interactionOwner());
@@ -8536,13 +8901,80 @@ export class Daemon extends EventEmitter {
     paneSaysNoConversation(paneText) {
         if (!paneText)
             return false;
-        return /no conversation found|no conversation to (continue|resume)|no previous (session|conversation)/i
-            .test(paneText);
+        // Each CLI says it in its own words (#1217): muse's "retained session not
+        // found" never matched the Claude phrasing, so a muse session that was not
+        // there could never be proven gone. Backends that name no pattern keep the
+        // phrasing this always used.
+        const pattern = this.backend?.resumeMissingPattern?.() ?? LEGACY_NO_CONVERSATION;
+        return pattern.test(paneText);
     }
-    /** How many consecutive startups have failed without proving the session is gone. */
-    unprovenResumeFailures = 0;
     /** After this many, start fresh anyway — loudly — so a truly broken session still recovers. */
     static MAX_UNPROVEN_RESUME_FAILURES = 3;
+    /**
+     * #1217: the unproven-failure count lives in the instance directory, keyed by
+     * the session id. Each start builds a new Daemon, so a count kept on the
+     * object was always "attempt 1/3": the escape hatch could never fire, and an
+     * unresumable session failed every start forever. A different session id (or
+     * none) starts the count again; a successful resume or a set-aside ends it.
+     */
+    bumpUnprovenResumeFailures() {
+        const path = join(this.instanceDir, RESUME_FAILURES_FILE);
+        let sessionId = "";
+        try {
+            sessionId = readFileSync(join(this.instanceDir, "session-id"), "utf-8").trim();
+        }
+        catch { /* none */ }
+        let previous = null;
+        try {
+            previous = JSON.parse(readFileSync(path, "utf-8"));
+        }
+        catch { /* first failure, or unreadable */ }
+        const count = previous && previous.sessionId === sessionId && Number.isInteger(previous.count) && previous.count > 0
+            ? previous.count + 1
+            : 1;
+        try {
+            writeFileSync(path, JSON.stringify({ sessionId, count }));
+        }
+        catch { /* best effort: counts as before */ }
+        return count;
+    }
+    clearUnprovenResumeFailures() {
+        try {
+            unlinkSync(join(this.instanceDir, RESUME_FAILURES_FILE));
+        }
+        catch { /* none */ }
+    }
+    /**
+     * #1217: a session id belongs to the backend that made it. After a backend
+     * switch the old id names nothing the new CLI knows (a Claude id handed to
+     * muse is "retained session not found"), so resuming it can only fail. The
+     * owner is recorded on every successful start; an id recorded for another
+     * backend is set aside (kept on disk, as always) and this start is fresh.
+     * An id with no recorded owner (from before this was recorded) is left to
+     * the resume itself — its failure is proven or counted like any other.
+     */
+    setAsideForeignSession() {
+        if (!existsSync(join(this.instanceDir, "session-id")))
+            return;
+        let owner = "";
+        try {
+            owner = readFileSync(join(this.instanceDir, SESSION_OWNER_FILE), "utf-8").trim();
+        }
+        catch {
+            return;
+        }
+        const current = this.config.backend ?? "claude-code";
+        if (!owner || owner === current)
+            return;
+        this.logger.warn({ from: owner, to: current }, "The stored session belongs to another backend — not resuming it");
+        this.setSessionAside(`backend_switched:${owner}->${current}`);
+    }
+    recordSessionOwner() {
+        try {
+            writeFileSync(join(this.instanceDir, SESSION_OWNER_FILE), this.config.backend ?? "claude-code");
+        }
+        catch { /* best effort */ }
+    }
     /**
      * Set the session aside instead of deleting it.
      *
@@ -8558,6 +8990,7 @@ export class Daemon extends EventEmitter {
             const stamp = new Date().toISOString().replace(/[:.]/g, "-");
             renameSync(sidFile, join(this.instanceDir, `session-id.abandoned-${stamp}`));
             this.logger.warn({ reason }, "Session set aside (kept on disk as session-id.abandoned-*), starting fresh");
+            this.clearUnprovenResumeFailures();
             this.pruneAbandonedSessions();
         }
         catch (err) {
@@ -8592,6 +9025,10 @@ export class Daemon extends EventEmitter {
             if (!this.backend) {
                 throw new Error("No backend configured — cannot spawn CLI window");
             }
+            // Fresh start or not: the owner is recorded below once this CLI is up, so an
+            // id it does not own must be out of the way first, or it would be recorded
+            // as this backend's and resumed by the next start.
+            this.setAsideForeignSession();
             const attemptedResume = !this.skipResume;
             // A resume launch may get a longer budget than a fresh one (kiro: the
             // conversation must come back from the backend before anything paints).
@@ -8632,18 +9069,18 @@ export class Daemon extends EventEmitter {
                     catch { /* pane may be gone */ }
                     const proven = this.paneSaysNoConversation(paneText);
                     if (!proven) {
-                        this.unprovenResumeFailures++;
-                        if (this.unprovenResumeFailures < Daemon.MAX_UNPROVEN_RESUME_FAILURES) {
+                        const failures = this.bumpUnprovenResumeFailures();
+                        if (failures < Daemon.MAX_UNPROVEN_RESUME_FAILURES) {
                             // Keep the session and fail this attempt; the fleet retries with
                             // backoff, which is also how the backend-outage path behaves.
                             await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                             await this.tmux.killWindow();
-                            throw new Error(`CLI startup failed with a session to resume (attempt ${this.unprovenResumeFailures}/${Daemon.MAX_UNPROVEN_RESUME_FAILURES}) `
+                            throw new Error(`CLI startup failed with a session to resume (attempt ${failures}/${Daemon.MAX_UNPROVEN_RESUME_FAILURES}) `
                                 + "— session kept, will retry");
                         }
                         // Escape hatch: a genuinely broken session must still recover. Say so
                         // out loud — this start does NOT continue the previous conversation.
-                        this.logger.error({ attempts: this.unprovenResumeFailures }, "Giving up on resuming after repeated startup failures — starting fresh. "
+                        this.logger.error({ attempts: failures }, "Giving up on resuming after repeated startup failures — starting fresh. "
                             + "The previous conversation is NOT continued; its context is lost to this session.");
                         this.emit("context_lost", this.name, "resume_repeatedly_failed");
                     }
@@ -8664,11 +9101,14 @@ export class Daemon extends EventEmitter {
             }
             else if (attemptedResume) {
                 resumedSuccessfully = true;
+                this.clearUnprovenResumeFailures();
                 // A resume needs the backend: its success is positive proof the backend
                 // is reachable again (a fresh prompt is local and proves nothing).
                 this.backendOutage?.clear(this.backendKey());
             }
             this.lastSpawnAt = Date.now();
+            // #1217: whatever session this CLI writes from here on is this backend's.
+            this.recordSessionOwner();
             this.skipResume = false; // CLI started successfully — reset for next spawn
             this.backgroundSessionRecoveryAttempted = false;
         }