@songsid/agend 2.1.2-beta.9 → 2.1.3-beta.1

package/dist/daemon.js

@@ -1,19 +1,23 @@
 import { join, dirname, basename, resolve } from "node:path";
-import { mkdirSync, writeFileSync, readFileSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, chmodSync, renameSync } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createHash, randomBytes } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { rotateLogIfNeeded } from "./logger.js";
+import { mcpServerState } from "./mcp-liveness.js";
 import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
 import { TmuxManager, resolveTmuxLogicalSize } from "./tmux-manager.js";
 import { TranscriptMonitor } from "./transcript-monitor.js";
 import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
+import { daemonBudgetMs } from "./channel/ipc-timeouts.js";
 import { MessageBus } from "./channel/message-bus.js";
 import { shellQuote } from "./backend/types.js";
 import { getTmuxSession } from "./config.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { HangDetector } from "./hang-detector.js";
+import { writeSecretFile } from "./secret-file.js";
+import { PaneWriteLock } from "./pane-write-lock.js";
 import { buildFleetInstructions } from "./instructions.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -38,9 +42,54 @@ export function buildInstructionReloadNotice(binaryName, instanceName, instanceD
 export const DEFAULT_STUCK_TIMEOUT_MS = 10 * 60_000;
 export const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2_000;
 export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
-/** @deprecated State detection is event-driven; this now aliases the safety sweep. */
-export const DEFAULT_STATE_POLL_INTERVAL_MS = DEFAULT_STATE_SAFETY_SWEEP_MS;
 const LAST_INBOUND_FILE = "last-inbound-at";
+/** Minimum gap between "health check is failing" notifications for one instance. */
+const HEALTH_ERROR_NOTIFY_INTERVAL_MS = 10 * 60_000;
+/**
+ * Whether two working directories belong to the same project, so a fleet-scoped
+ * decision recorded in one reaches the other. Covers the worktree/checkout
+ * layout AgEnD fleets actually use — `AgEnD`, `AgEnD-dev1`, `AgEnD-dev2`,
+ * `AgEnD-reviewer`, `AgEnD-main` are one project; `DouPo_Server` is not.
+ * Nesting counts too (a subdirectory of a project belongs to it).
+ */
+export function sameProjectFamily(a, b) {
+    const norm = (p) => p.replace(/\/+$/, "");
+    const x = norm(a), y = norm(b);
+    if (x === y)
+        return true;
+    if (x.startsWith(y + "/") || y.startsWith(x + "/"))
+        return true;
+    // Strip a trailing worktree/role suffix: "AgEnD-dev2" → "agend".
+    const family = (p) => {
+        const base = p.slice(p.lastIndexOf("/") + 1).toLowerCase();
+        return base.replace(/[-_](dev\d*|main|reviewer|tester|leader|sol|codex|worktree|wt\d*)$/i, "");
+    };
+    const fx = family(x), fy = family(y);
+    return fx.length > 0 && fx === fy;
+}
+/**
+ * Pick the decisions worth injecting into one instance's system prompt.
+ *
+ * `scope: "fleet"` previously bypassed the project check outright, so every
+ * instance carried every other project's playbook — measured at 8 of 14 here,
+ * resent on every API call. A fleet decision must now also be relevant: global
+ * (no project_root), the same project, or the same project family.
+ *
+ * `isDispatcher` (a general) opts out of that narrowing on purpose: it routes
+ * work across all projects, so cross-project rules ("X 文件操作由 Y 負責") are
+ * precisely what it must know. Narrowing a general would cause misrouting.
+ */
+export function selectRelevantDecisions(all, workDir, isDispatcher = false) {
+    return all.filter(d => {
+        if (d.project_root === workDir)
+            return true; // own project, any scope
+        if (d.scope !== "fleet")
+            return false; // project-scoped, elsewhere
+        if (!d.project_root)
+            return true; // truly global
+        return isDispatcher || sameProjectFamily(d.project_root, workDir);
+    });
+}
 /** Read the last real channel inbound timestamp persisted across daemon restarts. */
 export function readLastInboundAt(instanceDir, now = Date.now()) {
     try {
@@ -59,6 +108,40 @@ export function writeLastInboundAt(instanceDir, timestamp) {
     writeFileSync(temp, String(timestamp));
     renameSync(temp, target);
 }
+/**
+ * Render the handoff/routing metadata that rides along with an inbound message
+ * into the block actually pasted into the agent's pane.
+ *
+ * These fields were all populated by the sender (outbound-handlers builds them
+ * into `ipcMeta`) and delivered over IPC, but never rendered — so the receiving
+ * agent could not see them, and several documented flows could not work:
+ *
+ * - `report_result` requires a `correlation_id` the agent had no way to know, so
+ *   the "correlation_id not recognized" warning fired on essentially every call.
+ * - Delegation cancel buttons are retired by correlation id, so they never retired.
+ * - `react`, `edit_message` and `reply.reply_to` need `message_id`, which the tool
+ *   descriptions tell the agent to take "from the inbound block".
+ * - `download_attachment` needs `attachment_file_id`.
+ * - `requires_reply` was invisible, so a delegated task looked like an FYI.
+ *
+ * Only non-empty fields are emitted, so a plain user message gains at most a
+ * message_id line.
+ */
+export function renderHandoffMetadata(meta) {
+    const rows = [];
+    const add = (label, value) => {
+        if (value && value.trim())
+            rows.push(`${label}: ${value.trim()}`);
+    };
+    add("message_id", meta.message_id);
+    add("correlation_id", meta.correlation_id);
+    add("request_kind", meta.request_kind);
+    add("task_summary", meta.task_summary);
+    add("working_directory", meta.working_directory);
+    add("branch", meta.branch);
+    add("attachment_file_id", meta.attachment_file_id);
+    return rows.length ? `\n(${rows.join(" | ")})` : "";
+}
 /** Headless inactivity timer used by the daemon and unit tests. */
 export class AutoPauseController {
     thresholdMs;
@@ -103,37 +186,111 @@ export class AutoPauseController {
  * Pane motion wins over a ready match because several backends keep their ready
  * marker in a persistent header/footer while generating. A stable ready pane is
  * idle; changing content is working; stable non-ready content eventually sticks.
+ *
+ * ## Why an optional busy pattern exists
+ *
+ * "Motion wins" degrades badly when a backend's ready marker is *always* on
+ * screen. `stuck` requires `!ready`, so for such a backend the state can only ever
+ * be idle or working — the stuck edge, and with it `handleStuckTransition` and the
+ * hang notification, is unreachable. A frozen CLI is then reported as idle, which
+ * also clears pending work: the message the user sent is quietly booked as done.
+ *
+ * claude-code was exactly this case (see ClaudeCodeBackend.getReadyPattern). A
+ * backend that can point at a marker meaning "generating right now" supplies
+ * `getBusyPattern()`, and that match vetoes ready regardless of what the ready
+ * pattern says.
  */
+/**
+ * A shell command reduced to the part that is safe to show: the program, and a
+ * subcommand when there is one.
+ *
+ *   curl -H "Bearer sk-ant-…" https://api.com   →  curl
+ *   npm test --env=API_KEY=xxx                  →  npm test
+ *   git push origin main                        →  git push
+ *
+ * Arguments are dropped wholesale rather than filtered, because there is no
+ * reliable way to tell a secret from an ordinary argument: tokens, bearer
+ * headers, connection strings and `--password=` values all look like text. The
+ * progress line is posted to a chat channel and, for a public one, so is
+ * anything in it — so the rule is "never the arguments", not "not the arguments
+ * that look dangerous".
+ *
+ * A second token is kept only when it is a bare word (`push`, `test`), which is
+ * what a subcommand looks like and what a flag, path, URL, assignment or quoted
+ * string does not. Everything after it goes, including `git push ORIGIN MAIN`.
+ */
+export function shellCommandLabel(command) {
+    // First line only: heredocs and multi-line scripts carry the payload.
+    const tokens = (command.split("\n")[0] ?? "").trim().split(/\s+/).filter(Boolean);
+    // `FOO=bar cmd …` — leading assignments are env, and their values are exactly
+    // the kind of thing being protected here.
+    while (tokens.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(tokens[0]))
+        tokens.shift();
+    const program = tokens[0];
+    if (!program)
+        return "";
+    const isBareWord = (t) => !!t && /^[A-Za-z][A-Za-z0-9_-]*$/.test(t);
+    const label = isBareWord(tokens[1]) ? `${program} ${tokens[1]}` : program;
+    return label.length > 40 ? `${label.slice(0, 39)}…` : label;
+}
 export class PaneStateMachine {
     stuckTimeoutMs;
     readyPattern;
+    busyPattern;
     lastPaneHash = null;
     lastPaneChangeAt;
     lastObservedAt;
     stateChangedAt;
     currentState = "idle";
-    constructor(readyPattern, stuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS, now = Date.now()) {
+    constructor(readyPattern, stuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS, now = Date.now(), busyPattern) {
         this.stuckTimeoutMs = stuckTimeoutMs;
         // Stateful g/y regexes mutate lastIndex and can alternate true/false across
         // polls. State detection must be deterministic for identical pane content.
         this.readyPattern = new RegExp(readyPattern.source, readyPattern.flags.replace(/[gy]/g, ""));
+        this.busyPattern = busyPattern
+            ? new RegExp(busyPattern.source, busyPattern.flags.replace(/[gy]/g, ""))
+            : null;
         this.lastPaneChangeAt = now;
         this.lastObservedAt = now;
         this.stateChangedAt = now;
     }
-    observe(pane, now = Date.now()) {
+    /** Ready, unless the backend can positively see that it is still generating. */
+    isReady(pane) {
+        if (this.busyPattern?.test(pane))
+            return false;
+        return this.readyPattern.test(pane);
+    }
+    /**
+     * @param now when this observation is being evaluated — drives the idle and
+     *   stuck decisions.
+     * @param opts.changeAt when the content is believed to have changed, if that
+     *   is earlier than `now` (the tmux output timestamp). Only the elapsed-time
+     *   clock uses it; defaults to `now`.
+     * @param opts.settled the caller knows no output has arrived for the debounce
+     *   window, so "the content differs from the last capture" says nothing about
+     *   whether the CLI is still generating — decide on the patterns instead.
+     *
+     *   Captures are event-driven, not periodic: the one taken 2s after output
+     *   stops is compared against a capture that may be a minute old, so it
+     *   *always* differs. Without this flag that difference reads as "still
+     *   working" and a finished turn would not be seen as idle until the next 60s
+     *   safety sweep. Output timestamps are the honest liveness signal here, and
+     *   the caller has them.
+     */
+    observe(pane, now = Date.now(), opts = {}) {
+        const { settled = false, changeAt = now } = opts;
         const paneHash = createHash("sha256").update(pane).digest("hex");
         const firstObservation = this.lastPaneHash === null;
         const paneChanged = this.lastPaneHash !== paneHash;
         if (paneChanged) {
             this.lastPaneHash = paneHash;
-            this.lastPaneChangeAt = now;
+            this.lastPaneChangeAt = changeAt;
         }
         this.lastObservedAt = now;
-        const ready = this.readyPattern.test(pane);
+        const ready = this.isReady(pane);
         const nextState = firstObservation
             ? ready ? "idle" : "working"
-            : paneChanged
+            : paneChanged && !settled
                 ? "working"
                 : ready
                     ? "idle"
@@ -194,6 +351,23 @@ export class PendingWorkTracker {
 const NORMAL_ENTER_SETTLE_MS = 500;
 const FIRST_ENTER_SETTLE_MS = 1_750;
 const FIRST_DELIVERY_WINDOW_MS = 5_000;
+/** After busy native-queue paste+Enter, wait before checking the pane for silent loss. */
+const NATIVE_QUEUE_PASTE_VERIFY_MS = 2_000;
+/** Enter-confirmation poll: 10 × 200ms ≈ 2s of observed silence before giving up. */
+const CONFIRM_BUSY_POLLS = 10;
+const CONFIRM_BUSY_POLL_MS = 200;
+/**
+ * Ceiling on the whole confirmation, including time re-earned after a control-mode
+ * reconnect. Without it a reconnect loop could restart the poll indefinitely and
+ * hold the pane write lock along with it.
+ */
+const CONFIRM_BUSY_MAX_WAIT_MS = 10_000;
+/**
+ * How long a delivery waits for an in-flight spawn. Comfortably past the default
+ * 25s startup timeout plus dialog dismissal; past it we fall back to the old
+ * behaviour rather than holding a message indefinitely.
+ */
+const SPAWN_SETTLE_MAX_WAIT_MS = 60_000;
 /**
  * One-shot timing gate for the first paste after a CLI reaches its ready
  * prompt. Recent tmux versions expose a short interval where the prompt is
@@ -238,6 +412,68 @@ export function sanitizePaneTail(pane, lineCount = 5) {
         .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "")
         .slice(0, 200));
 }
+const INTERACTIVE_PROMPT_PATTERNS = [
+    { kind: "sudo_password", pattern: /^\s*\[sudo\]\s+password\s+for\s+[^:\n]+:\s*$/im },
+    // macOS sudo and several package installers use this exact no-echo prompt.
+    // Tail-only + stability gating is what makes the otherwise-generic word safe.
+    { kind: "password", pattern: /^\s*(?:Password|Passphrase):\s*$/im },
+    { kind: "confirmation", pattern: /^[^\n]{0,180}(?:\([Yy]\/[Nn]\)|\[[Yy]\/[Nn]\]|\((?:yes|no)\/(?:yes|no)\))\s*:?\s*$/im },
+    { kind: "confirmation", pattern: /^\s*Are you sure[^\n]{0,160}\((?:yes\/no)(?:\/\[[^\]]+\])?\)\??\s*$/im },
+    { kind: "press_enter", pattern: /^\s*(?:Please\s+)?Press (?:the )?Enter(?: key)?(?: to [^\n]{0,120})?[.:…]?\s*$/im },
+];
+/**
+ * Detect terminal prompts that require a human, but only after the pane tail is
+ * unchanged and no control-mode output has arrived for the full grace period.
+ * This prevents prose such as "the installer asks [Y/n]" from notifying while
+ * an agent is still writing it.
+ */
+export class InteractivePromptDetector {
+    stableMs;
+    signature = null;
+    stableSince = 0;
+    lastOutputAt = 0;
+    notifiedSignature = null;
+    constructor(stableMs = 10_000) {
+        this.stableMs = stableMs;
+    }
+    observe(pane, now = Date.now(), outputAt = 0) {
+        const tail = sanitizePaneTail(pane, 5);
+        const tailText = tail.join("\n");
+        let matched = null;
+        for (const candidate of INTERACTIVE_PROMPT_PATTERNS) {
+            const match = tailText.match(candidate.pattern);
+            if (!match)
+                continue;
+            matched = { kind: candidate.kind, prompt: match[0].trim().slice(0, 200) };
+            break;
+        }
+        if (!matched) {
+            this.reset();
+            this.lastOutputAt = outputAt;
+            return null;
+        }
+        const signature = `${matched.kind}:${tailText}`;
+        const outputMoved = outputAt > this.lastOutputAt;
+        if (signature !== this.signature || outputMoved) {
+            this.signature = signature;
+            this.stableSince = now;
+            this.lastOutputAt = outputAt;
+            if (signature !== this.notifiedSignature)
+                this.notifiedSignature = null;
+            return null;
+        }
+        this.lastOutputAt = outputAt;
+        if (this.notifiedSignature === signature || now - this.stableSince < this.stableMs)
+            return null;
+        this.notifiedSignature = signature;
+        return matched;
+    }
+    reset() {
+        this.signature = null;
+        this.stableSince = 0;
+        this.notifiedSignature = null;
+    }
+}
 export class Daemon extends EventEmitter {
     name;
     config;
@@ -252,7 +488,6 @@ export class Daemon extends EventEmitter {
     ipcServer = null;
     messageBus;
     transcriptMonitor = null;
-    toolTracker = null;
     guardian = null;
     adapter = null;
     pendingIpcRequests = new Map();
@@ -263,6 +498,8 @@ export class Daemon extends EventEmitter {
     // Pending ack: react 🫡 on first transcript activity after receiving a message
     pendingAckMessage = null;
     // Tool status tracking for channel adapter
+    /** Last activity published to the fleet manager; null when nothing is running. */
+    currentActivity = null;
     toolStatusMessageId = null;
     toolStatusLines = [];
     toolStatusDebounce = null;
@@ -278,9 +515,19 @@ export class Daemon extends EventEmitter {
     lastSpawnAt = 0;
     crashTimestamps = [];
     healthCheckPaused = false;
+    lastHealthErrorNotifyAt = 0;
     /** CLI pane availability, independent from the daemon process and tri-state. */
     processStatus = "running";
     spawning = false;
+    /**
+     * Resolves when the in-flight spawn finishes; null when none is running.
+     *
+     * `spawning` alone can only be polled. Delivery needs to *wait*, and a boolean
+     * poll would either busy-loop or race the flag being cleared.
+     */
+    spawnSettled = null;
+    resolveSpawnSettled = null;
+    spawnDepth = 0;
     skipResume = false;
     backgroundSessionRecoveryAttempted = false;
     /** Whether the last spawn started a fresh session (not resumed). */
@@ -303,10 +550,18 @@ export class Daemon extends EventEmitter {
     instanceStateIdleDebounceMs = DEFAULT_STATE_IDLE_DEBOUNCE_MS;
     instanceStateStuckTimeoutMs = DEFAULT_STUCK_TIMEOUT_MS;
     instanceStateReadyPattern = null;
+    instanceStateBusyPattern = null;
     instanceStateMonitorActive = false;
     statePollInFlight = false;
     autoPauseController;
     pauseRequested = false;
+    /**
+     * Sticky "pause as soon as possible" (auth failure). Unlike pauseRequested —
+     * which the state monitor clears whenever the pane is not idle — this survives
+     * busy/stuck states, because an auth error fires mid-turn and a plain pause()
+     * would silently no-op exactly when we most need to stop feeding the CLI.
+     */
+    pausePending = false;
     pauseWakeState = "active";
     pauseWakeTransition = null;
     // Model failover: override model on next spawn when rate-limited
@@ -316,7 +571,13 @@ export class Daemon extends EventEmitter {
     recentEvents = [];
     recentToolActivity = [];
     snapshotConsumed = false;
+    /** Orders inbound channel messages against each other (queue-depth accounting
+     *  and ⏳/👀/✅ reactions live here). It does NOT cover the other writers that
+     *  reach the pane — {@link paneWriteLock} does. */
     pasteLock = Promise.resolve();
+    /** Mutual exclusion for *every* write into the pane, whichever subsystem it
+     *  comes from. See PaneWriteLock for why interleaving is destructive. */
+    paneWriteLock = new PaneWriteLock();
     pendingInstructionsUpdate;
     pendingInstructionsNotice = false;
     // Whether the warmup steering-reload notice should be injected after spawn.
@@ -329,6 +590,26 @@ export class Daemon extends EventEmitter {
     firstDeliveryDelay = new FirstDeliveryDelay();
     // PTY error pattern monitoring
     errorMonitorTimer = null;
+    interactivePromptDetector = new InteractivePromptDetector();
+    /** Same 5-min gate the error monitor uses, so a dead MCP server alerts once. */
+    static MCP_DEATH_COOLDOWN_MS = 5 * 60_000;
+    lastMcpDeathNotifiedAt = 0;
+    mcpDeathNotifiedForPid = null;
+    /**
+     * Ceiling on how long a dead MCP server waits for an idle window before the
+     * auto-restart fires anyway. A toolless instance cannot reply or report, so
+     * whatever a very long turn produces is stranded until the restart happens —
+     * past this point interrupting the turn costs less than staying mute.
+     */
+    static MCP_RESTART_MAX_WAIT_MS = 30 * 60_000;
+    /**
+     * Sticky "restart to revive the MCP server as soon as the pane idles" — same
+     * shape as pausePending, because the death is usually detected mid-turn when
+     * an immediate restart would destroy in-flight work. Cleared when the server
+     * turns up alive again (operator restarted, CLI reconnected) before we fire.
+     */
+    mcpRestartPending = false;
+    mcpRestartStaleTimer = null;
     /** Prevent in-flight monitor callbacks from re-arming after a pause. */
     runtimeMonitorsFrozen = false;
     errorWaitingForRecovery = false; // true = error detected, waiting for ready pattern
@@ -340,6 +621,10 @@ export class Daemon extends EventEmitter {
         return this.errorWaitingForRecovery || (this.healthCheckPaused && !this.isPaused) || Daemon.tmuxServerPaused;
     }
     get isPaused() { return this.pauseWakeState !== "active"; }
+    /** Current CLI process state for status surfaces and recovery commands. */
+    getProcessStatus() {
+        return this.processStatus;
+    }
     get lastPausedAt() { return this.autoPauseController.lastPausedAt; }
     getPauseWakeState() { return this.pauseWakeState; }
     /** Whether this instance is in a crash loop (3+ consecutive crashes). */
@@ -455,9 +740,6 @@ export class Daemon extends EventEmitter {
             if ((type === "fleet_schedule_response" || type === "fleet_outbound_response" || type === "fleet_decision_response" || type === "fleet_task_response" || type === "fleet_display_name_response" || type === "fleet_description_response") && msg.fleetRequestId) {
                 key = String(msg.fleetRequestId);
             }
-            else if (type === "fleet_outbound_response" && msg.requestId != null) {
-                key = `fleet_out_${msg.requestId}`;
-            }
             if (key && this.pendingIpcRequests.has(key)) {
                 const handler = this.pendingIpcRequests.get(key);
                 this.pendingIpcRequests.delete(key);
@@ -608,7 +890,12 @@ export class Daemon extends EventEmitter {
                 else {
                     await new Promise(r => setTimeout(r, 5000));
                 }
-                await this.tmux?.pasteText(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir));
+                // This path only runs when pasteQueueDepth > 0 — i.e. exactly when a real
+                // delivery is already in flight or queued. Without the lock the notice and
+                // that delivery race into the same pane.
+                await this.paneWriteLock.run(async () => {
+                    await this.tmux?.pasteText(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir), this.systemPasteOptions());
+                });
                 // Record the value the agent has now been told about so the next
                 // unchanged restart skips the reload.
                 try {
@@ -641,27 +928,31 @@ export class Daemon extends EventEmitter {
             this.transcriptMonitor.on("tool_use", (name, input) => {
                 this.logger.debug({ tool: name }, "Tool use");
                 ackIfPending();
-                this.hangDetector?.recordActivity();
                 this.recordRecentEvent({ type: "tool_use", name, preview: this.summarizeTool(name, input) });
                 this.recordRecentToolActivity(this.summarizeTool(name, input));
+                this.publishActivity(this.summarizeTool(name, input));
             });
             this.transcriptMonitor.on("tool_result", (name, _output) => {
-                this.hangDetector?.recordActivity();
                 this.recordRecentEvent({ type: "tool_result", name });
+                // The tool finished; whatever comes next has not started yet. Better to
+                // show only elapsed time than to leave a stale "Bash: npm test" on screen.
+                this.publishActivity(null);
             });
             this.transcriptMonitor.on("assistant_text", (text) => {
                 this.logger.debug({ text: text.slice(0, 200) }, "Claude response");
                 ackIfPending();
-                this.hangDetector?.recordActivity();
                 this.recordRecentEvent({ type: "assistant_text", preview: text.slice(0, 100) });
             });
             this.transcriptMonitor.startPolling();
-            // HangDetector remains the fleet-manager notification event bridge. Its
-            // legacy silence timer is intentionally not started: pane state transitions
-            // below are now the sole source of hang events.
+            // HangDetector is the notification bridge to the fleet manager; pane state
+            // transitions below are the sole source of hang events (see hang-detector.ts).
+            // `hang_detector.enabled: false` opts out of the notification entirely.
+            // NOTE: `hang_detector.timeout_minutes` is NOT read here — the stuck timeout
+            // the pane monitor actually uses is resolved separately below. The two have
+            // long been separate; documented rather than silently ignored.
             const hangConfig = this.config.hang_detector;
             if (hangConfig?.enabled !== false) {
-                this.hangDetector = new HangDetector(hangConfig?.timeout_minutes ?? 10);
+                this.hangDetector = new HangDetector();
             }
             // 8. Context guardian
             const statusFile = join(this.instanceDir, "statusline.json");
@@ -669,7 +960,6 @@ export class Daemon extends EventEmitter {
             this.guardian.startWatching();
             this.guardian.on("status_update", () => {
                 this.saveSessionId();
-                this.hangDetector?.recordStatuslineUpdate();
             });
             // Context rotation removed: all CLI backends have built-in auto-compact.
             // Crash recovery (health check + respawn with snapshot) is retained below.
@@ -689,6 +979,89 @@ export class Daemon extends EventEmitter {
         this.startInstanceStateMonitor();
         this.logger.info(`${this.name} ready`);
     }
+    /**
+     * Detect a CRASHED MCP server and report it once.
+     *
+     * The MCP server writes its pid to channel.mcp.pid at startup and unlinks it on
+     * a clean exit, so "file present + pid dead" specifically means it died without
+     * cleaning up (crash / OOM / SIGKILL). A missing file is either "not started
+     * yet" or "exited cleanly" — neither is an incident, and an orphan exit implies
+     * the CLI itself died, which the crash detector already covers.
+     *
+     * The daemon deliberately does NOT try to respawn it: MCP is a stdio protocol
+     * where the CLI spawns the server and owns its pipes, so a daemon-spawned
+     * process would have no client reading it. Only the CLI can restore its own
+     * tools — hence notify, and let the operator decide about restarting.
+     */
+    checkMcpServerAlive() {
+        if (this.isPaused)
+            return;
+        const status = mcpServerState(this.instanceDir);
+        if (status.state === "unknown")
+            return;
+        if (status.state === "alive") {
+            this.mcpDeathNotifiedForPid = null; // the CLI respawned it — re-arm
+            this.clearMcpRestartRequest(); // tools are back — stand down a pending auto-restart
+            return;
+        }
+        // Dead: report once per pid, and at most once per cooldown window.
+        if (this.mcpDeathNotifiedForPid === status.pid)
+            return;
+        if (Date.now() - this.lastMcpDeathNotifiedAt < Daemon.MCP_DEATH_COOLDOWN_MS)
+            return;
+        this.mcpDeathNotifiedForPid = status.pid;
+        this.lastMcpDeathNotifiedAt = Date.now();
+        const autoRestart = this.config.mcp_auto_restart !== false;
+        this.logger.error({ pid: status.pid, autoRestart }, "MCP server process is gone — instance has no agend tools");
+        this.emit("mcp_died", { name: this.name, pid: status.pid, autoRestart });
+        if (autoRestart)
+            this.armMcpRestartWhenIdle();
+    }
+    /**
+     * Arm an automatic instance restart to revive a dead MCP server. Fires on the
+     * next busy→idle edge — or immediately when the pane is already idle, which is
+     * the common case for a collab/chat instance parked between messages (no edge
+     * would ever come). A turn that outlives MCP_RESTART_MAX_WAIT_MS is
+     * force-restarted: see that constant for why staying mute costs more.
+     */
+    armMcpRestartWhenIdle() {
+        if (this.mcpRestartPending)
+            return;
+        this.mcpRestartPending = true;
+        this.mcpRestartStaleTimer = setTimeout(() => {
+            this.mcpRestartStaleTimer = null;
+            if (!this.mcpRestartPending || this.runtimeMonitorsFrozen)
+                return;
+            this.fireMcpRestartRequest("stale_timeout");
+        }, Daemon.MCP_RESTART_MAX_WAIT_MS);
+        this.mcpRestartStaleTimer.unref?.();
+        if (this.instanceState === "idle" && this.pasteQueueDepth === 0) {
+            this.fireMcpRestartRequest("already_idle");
+        }
+    }
+    fireMcpRestartRequest(trigger) {
+        // A recovery is already reshaping the CLI: crash-loop handling
+        // (healthCheckPaused), a respawn in flight (spawning), or a pause
+        // (isPaused / frozen monitors). Each of those paths ends in a fresh CLI —
+        // and with it a fresh MCP server — or in supervision ending, where a
+        // restart on top would fight the recovery. Either way the revival restart
+        // is moot: cancel it rather than defer it.
+        if (this.healthCheckPaused || this.spawning || this.isPaused || this.runtimeMonitorsFrozen) {
+            this.logger.warn({ trigger }, "MCP revival restart cancelled — instance is already pausing/spawning/recovering");
+            this.clearMcpRestartRequest();
+            return;
+        }
+        this.clearMcpRestartRequest();
+        this.logger.warn({ trigger }, "Requesting instance restart to revive its MCP server");
+        this.emit("mcp_restart_requested", { name: this.name, trigger });
+    }
+    clearMcpRestartRequest() {
+        this.mcpRestartPending = false;
+        if (this.mcpRestartStaleTimer) {
+            clearTimeout(this.mcpRestartStaleTimer);
+            this.mcpRestartStaleTimer = null;
+        }
+    }
     startHealthCheck() {
         if (this.runtimeMonitorsFrozen || this.healthCheckTimer)
             return;
@@ -704,254 +1077,294 @@ export class Daemon extends EventEmitter {
                 this.healthCheckTimer = null;
                 if (this.runtimeMonitorsFrozen)
                     return;
-                // Instance directory removed externally (e.g. `rm -rf ~/.agend/instances/<name>`).
-                // Stop the loop permanently — otherwise every tick triggers a respawn, whose
-                // writeRotationSnapshot fails with ENOENT and gets caught as "Failed to respawn",
-                // spamming errors every ~30s forever.
-                if (!existsSync(this.instanceDir)) {
-                    this.logger.warn({ instanceDir: this.instanceDir }, "Instance directory missing — stopping health check");
-                    this.healthCheckPaused = true;
-                    this.healthCheckTimer = null;
-                    return;
-                }
-                if (!this.tmux || this.spawning || this.healthCheckPaused || Daemon.tmuxServerPaused) {
-                    scheduleNext();
-                    return;
-                }
-                // Human-readable backend label for logs (e.g. "claude", "kiro-cli")
-                const cliLabel = this.backend?.binaryName ?? "CLI";
-                let paneStatus = await this.tmux.getPaneStatus();
-                // Auto-pause intentionally exits the pane process. A health tick that
-                // began just before pause must not classify that exit as a crash.
-                if (this.isPaused || this.pauseWakeState === "waking") {
-                    scheduleNext();
-                    return;
-                }
-                if (paneStatus?.alive) {
-                    // Instance output.log is fed by tmux pipe-pane and was previously never
-                    // rotated (only fleet.log / daemon.log were). Cap growth every tick.
-                    if (!this.config.lightweight) {
-                        rotateLogIfNeeded(join(this.instanceDir, "output.log"));
+                // The whole tick is guarded: an unguarded throw in here (a tmux hiccup,
+                // ENOSPC on the crash-history write) became an unhandled rejection, which
+                // the CLI turned into stopAll() + exit(1) for the ENTIRE fleet, and it also
+                // ended this instance's health loop because scheduleNext() sat after the
+                // throwing code. Catch, log, and keep checking.
+                try {
+                    // Instance directory removed externally (e.g. `rm -rf ~/.agend/instances/<name>`).
+                    // Stop the loop permanently — otherwise every tick triggers a respawn, whose
+                    // writeRotationSnapshot fails with ENOENT and gets caught as "Failed to respawn",
+                    // spamming errors every ~30s forever.
+                    if (!existsSync(this.instanceDir)) {
+                        this.logger.warn({ instanceDir: this.instanceDir }, "Instance directory missing — stopping health check");
+                        this.healthCheckPaused = true;
+                        this.healthCheckTimer = null;
+                        this.emitSupervisionEnded("instance directory was removed from disk", "Recreate the instance, or delete it from fleet.yaml.");
+                        return;
+                    }
+                    if (!this.tmux || this.spawning || this.healthCheckPaused || Daemon.tmuxServerPaused) {
+                        scheduleNext();
+                        return;
+                    }
+                    // The CLI owns the MCP server process, so the daemon can only observe it.
+                    this.checkMcpServerAlive();
+                    // Human-readable backend label for logs (e.g. "claude", "kiro-cli")
+                    const cliLabel = this.backend?.binaryName ?? "CLI";
+                    let paneStatus = await this.tmux.getPaneStatus();
+                    // Auto-pause intentionally exits the pane process. A health tick that
+                    // began just before pause must not classify that exit as a crash.
+                    if (this.isPaused || this.pauseWakeState === "waking") {
+                        scheduleNext();
+                        return;
                     }
-                    scheduleNext();
-                    return;
-                }
-                // A null status is ambiguous: it can be a transient `tmux list-panes`
-                // failure (e.g. tmux busy during a fleet-restart storm) rather than a
-                // real exit. Re-confirm once after a short delay before treating it as
-                // a crash. A non-null {alive:false} is a definite dead pane (real exit)
-                // and needs no recheck.
-                if (paneStatus === null) {
-                    await new Promise(r => setTimeout(r, 1500));
-                    paneStatus = await this.tmux.getPaneStatus();
                     if (paneStatus?.alive) {
-                        this.logger.debug(`[health] ${cliLabel} pane reported gone then alive on recheck — transient query failure, ignoring`);
+                        // Instance output.log is fed by tmux pipe-pane and was previously never
+                        // rotated (only fleet.log / daemon.log were). Cap growth every tick.
+                        if (!this.config.lightweight) {
+                            rotateLogIfNeeded(join(this.instanceDir, "output.log"));
+                        }
                         scheduleNext();
                         return;
                     }
-                }
-                // paneStatus === null → window gone entirely (e.g. tmux server crash)
-                // paneStatus.alive === false → pane dead, exit code available
-                const exitCode = paneStatus?.exitCode;
-                this.logger.debug({ exitCode }, `[health] pane exited with code: ${exitCode}`);
-                // Normal exit (e.g. user Ctrl+C or /exit) — no crash, no respawn
-                if (paneStatus && exitCode === 0) {
-                    this.setProcessStatus("stopped");
-                    this.logger.info("CLI exited normally (code 0) — pausing health check");
-                    await this.tmux.killWindow();
-                    this.healthCheckPaused = true;
-                    return;
-                }
-                this.setProcessStatus("crashed");
-                // Distinguish tmux server crash from single window crash.
-                // nullReason records *why* getPaneStatus returned null (for diagnosing
-                // whether this was a real window loss or a transient query failure).
-                let crashType = "window";
-                let nullReason;
-                if (!paneStatus) {
-                    const serverAlive = await TmuxManager.sessionExists(this.tmuxSessionName);
-                    if (!serverAlive) {
-                        crashType = "server";
-                        nullReason = "server_gone";
-                        this.logger.error(`tmux server died — all ${cliLabel} windows lost`);
-                        // Fleet-level circuit breaker: pause all instances on repeated tmux server crashes
-                        Daemon.tmuxServerCrashTimestamps.push(Date.now());
-                        const cutoff = Date.now() - 5 * 60_000;
-                        Daemon.tmuxServerCrashTimestamps = Daemon.tmuxServerCrashTimestamps.filter(t => t > cutoff);
-                        if (Daemon.tmuxServerCrashTimestamps.length >= 2 && !Daemon.tmuxServerPaused) {
-                            Daemon.tmuxServerPaused = true;
-                            this.logger.error("Fleet-level tmux server circuit breaker triggered — pausing all respawns for 30s");
-                            this.emit("tmux_server_crash", this.name);
-                            if (!Daemon.tmuxServerRecoveryTimer) {
-                                Daemon.tmuxServerRecoveryTimer = setTimeout(() => {
-                                    Daemon.tmuxServerRecoveryTimer = null;
-                                    Daemon.tmuxServerPaused = false;
-                                }, 30_000);
-                            }
+                    // A null status is ambiguous: it can be a transient `tmux list-panes`
+                    // failure (e.g. tmux busy during a fleet-restart storm) rather than a
+                    // real exit. Re-confirm once after a short delay before treating it as
+                    // a crash. A non-null {alive:false} is a definite dead pane (real exit)
+                    // and needs no recheck.
+                    if (paneStatus === null) {
+                        await new Promise(r => setTimeout(r, 1500));
+                        paneStatus = await this.tmux.getPaneStatus();
+                        if (paneStatus?.alive) {
+                            this.logger.debug(`[health] ${cliLabel} pane reported gone then alive on recheck — transient query failure, ignoring`);
                             scheduleNext();
                             return;
                         }
-                        await new Promise(r => setTimeout(r, 2_000)); // let session stabilize
                     }
-                    else {
-                        // null but server alive: window-level disappearance. Probe whether
-                        // the window truly no longer exists vs a transient query glitch.
-                        nullReason = "no_window";
-                        try {
-                            const windows = await TmuxManager.listWindows(this.tmuxSessionName);
-                            if (windows.some(w => w.name === this.name))
-                                nullReason = "window_present_query_glitch";
+                    // paneStatus === null → window gone entirely (e.g. tmux server crash)
+                    // paneStatus.alive === false → pane dead, exit code available
+                    const exitCode = paneStatus?.exitCode;
+                    this.logger.debug({ exitCode }, `[health] pane exited with code: ${exitCode}`);
+                    // Normal exit (e.g. user Ctrl+C or /exit) — no crash, no respawn
+                    if (paneStatus && exitCode === 0) {
+                        this.setProcessStatus("stopped");
+                        this.logger.info("CLI exited normally (code 0) — pausing health check");
+                        await this.tmux.killWindow();
+                        this.healthCheckPaused = true;
+                        this.emitSupervisionEnded("the CLI exited normally (code 0)", "Nothing crashed — start it again when you need it.");
+                        return;
+                    }
+                    // Distinguish tmux server crash from single window crash.
+                    // nullReason records *why* getPaneStatus returned null (for diagnosing
+                    // whether this was a real window loss or a transient query failure).
+                    let crashType = "window";
+                    let nullReason;
+                    if (!paneStatus) {
+                        const serverAlive = await TmuxManager.sessionExists(this.tmuxSessionName);
+                        if (!serverAlive) {
+                            crashType = "server";
+                            nullReason = "server_gone";
+                            this.logger.error(`tmux server died — all ${cliLabel} windows lost`);
+                            // Fleet-level circuit breaker: pause all instances on repeated tmux server crashes
+                            Daemon.tmuxServerCrashTimestamps.push(Date.now());
+                            const cutoff = Date.now() - 5 * 60_000;
+                            Daemon.tmuxServerCrashTimestamps = Daemon.tmuxServerCrashTimestamps.filter(t => t > cutoff);
+                            if (Daemon.tmuxServerCrashTimestamps.length >= 2 && !Daemon.tmuxServerPaused) {
+                                Daemon.tmuxServerPaused = true;
+                                this.logger.error("Fleet-level tmux server circuit breaker triggered — pausing all respawns for 30s");
+                                this.emit("tmux_server_crash", this.name);
+                                if (!Daemon.tmuxServerRecoveryTimer) {
+                                    Daemon.tmuxServerRecoveryTimer = setTimeout(() => {
+                                        Daemon.tmuxServerRecoveryTimer = null;
+                                        Daemon.tmuxServerPaused = false;
+                                    }, 30_000);
+                                }
+                                scheduleNext();
+                                return;
+                            }
+                            await new Promise(r => setTimeout(r, 2_000)); // let session stabilize
                         }
-                        catch {
-                            nullReason = "query_error";
+                        else {
+                            // null but server alive: window-level disappearance. Probe whether
+                            // the window truly no longer exists vs a transient query glitch.
+                            nullReason = "no_window";
+                            try {
+                                const windows = await TmuxManager.listWindows(this.tmuxSessionName);
+                                const currentWindowId = this.tmux.getWindowId();
+                                if (windows.some(w => w.id === currentWindowId)) {
+                                    // The exact window still exists, so `list-panes` was the query
+                                    // that glitched. Keep the process/state intact and retry on
+                                    // the next health tick instead of killing a live Kiro TUI.
+                                    this.logger.warn({ windowId: currentWindowId }, `${cliLabel} pane status unavailable but window is present — deferring crash recovery`);
+                                    scheduleNext();
+                                    return;
+                                }
+                                if (windows.some(w => w.name === this.name))
+                                    nullReason = "same_name_other_window";
+                            }
+                            catch {
+                                nullReason = "query_error";
+                            }
+                            this.logger.warn({ exitCode, nullReason }, `${cliLabel} window not found (tmux server alive)`);
                         }
-                        this.logger.warn({ exitCode, nullReason }, `${cliLabel} window not found (tmux server alive)`);
                     }
-                }
-                else {
-                    this.logger.warn({ exitCode }, `${cliLabel} process exited`);
-                }
-                // Capture last output before killing. Best-effort even when the pane is
-                // gone (paneStatus null) — gives the crash record something to diagnose
-                // from instead of an empty lastOutput.
-                let lastOutput;
-                try {
-                    const raw = await this.tmux.capturePaneWithHistory(50);
-                    // Strip ANSI escape codes for readability
-                    const cleaned = raw.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
-                    lastOutput = cleaned.trimEnd() || undefined;
-                }
-                catch { /* best effort — pane may already be gone */ }
-                // Kill the dead window (remain-on-exit keeps it around) before respawn
-                if (paneStatus) {
-                    await this.tmux.killWindow();
-                }
-                // Detect claude-code background session conflict — recover without counting as crash
-                if (lastOutput && (lastOutput.includes("background agent") || lastOutput.includes("Session is currently running"))) {
-                    if (!this.backgroundSessionRecoveryAttempted) {
-                        this.backgroundSessionRecoveryAttempted = true;
-                        this.logger.warn("Detected lingering background agent session — starting fresh (no resume)");
-                        const sidFile = join(this.instanceDir, "session-id");
+                    else {
+                        this.logger.warn({ exitCode }, `${cliLabel} process exited`);
+                    }
+                    this.setProcessStatus("crashed");
+                    // Capture last output before killing. Best-effort even when the pane is
+                    // gone (paneStatus null) — gives the crash record something to diagnose
+                    // from instead of an empty lastOutput.
+                    let lastOutput;
+                    try {
+                        const raw = await this.tmux.capturePaneWithHistory(50);
+                        // Strip ANSI escape codes for readability
+                        const cleaned = raw.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+                        lastOutput = cleaned.trimEnd() || undefined;
+                    }
+                    catch { /* best effort — pane may already be gone */ }
+                    // Kill the dead window (remain-on-exit keeps it around) before respawn
+                    if (paneStatus) {
+                        await this.tmux.killWindow();
+                    }
+                    // Detect claude-code background session conflict — recover without counting as crash
+                    if (lastOutput && (lastOutput.includes("background agent") || lastOutput.includes("Session is currently running"))) {
+                        if (!this.backgroundSessionRecoveryAttempted) {
+                            this.backgroundSessionRecoveryAttempted = true;
+                            this.logger.warn("Detected lingering background agent session — starting fresh (no resume)");
+                            const sidFile = join(this.instanceDir, "session-id");
+                            try {
+                                unlinkSync(sidFile);
+                            }
+                            catch { }
+                            this.skipResume = true;
+                            await new Promise(r => setTimeout(r, 2_000));
+                            try {
+                                await this.spawnClaudeWindow();
+                                this.setProcessStatus("running");
+                                this.logger.info("Recovered from background session conflict");
+                                this.emit("crash_respawn", this.name);
+                            }
+                            catch (err) {
+                                this.logger.error({ err: err.message }, "Recovery from background session conflict failed");
+                            }
+                            return; // Don't count as crash
+                        }
+                        // Already attempted recovery — fall through to normal crash handling
+                    }
+                    // Detect a --continue/--resume failure (no conversation to resume). The
+                    // session-id file persists across the crash, so a blind respawn would add
+                    // --continue again and crash in the same way → loop. Clear the session id
+                    // and skip resume so the next spawn starts fresh. (skipResume also stops
+                    // saveSessionId below from resurrecting the id from statusline.json.)
+                    if (lastOutput && /no conversation found|no conversation to (continue|resume)|no previous (session|conversation)|--continue/i.test(lastOutput)) {
+                        this.logger.warn("Detected --continue/resume failure — clearing session-id; next spawn starts fresh");
                         try {
-                            unlinkSync(sidFile);
+                            unlinkSync(join(this.instanceDir, "session-id"));
                         }
-                        catch { }
+                        catch { /* may not exist */ }
                         this.skipResume = true;
-                        await new Promise(r => setTimeout(r, 2_000));
+                    }
+                    // Append to crash history
+                    this.appendCrashHistory({ exitCode, lastOutput, crashType, reason: nullReason });
+                    if (max_retries <= 0) {
+                        this.healthCheckPaused = true;
+                        this.logger.warn(`${cliLabel} window died — automatic restart is disabled`);
+                        this.emitSupervisionEnded("the CLI died and automatic restart is disabled (restart_policy.max_retries is 0)", "Start it manually, or raise max_retries in fleet.yaml.");
+                        return;
+                    }
+                    // Detect rapid crash: sliding window — 3+ crashes in 5 minutes
+                    this.crashTimestamps.push(Date.now());
+                    const crashWindowMs = 5 * 60_000;
+                    this.crashTimestamps = this.crashTimestamps.filter(t => t > Date.now() - crashWindowMs);
+                    if (this.crashTimestamps.length >= 3) {
+                        this.healthCheckPaused = true;
+                        this.logger.error({ crashesInWindow: this.crashTimestamps.length }, "3+ crashes in 5 minutes — pausing respawn");
+                        // P1: Persist crash state so next process restart skips resume
                         try {
-                            await this.spawnClaudeWindow();
-                            this.setProcessStatus("running");
-                            this.logger.info("Recovered from background session conflict");
-                            this.emit("crash_respawn", this.name);
+                            writeFileSync(join(this.instanceDir, "crash-state.json"), JSON.stringify({
+                                crashesInWindow: this.crashTimestamps.length,
+                                lastCrashAt: Date.now(),
+                                resumeDisabled: true,
+                            }));
                         }
-                        catch (err) {
-                            this.logger.error({ err: err.message }, "Recovery from background session conflict failed");
-                        }
-                        return; // Don't count as crash
+                        catch { /* best effort */ }
+                        this.emit("crash_loop", this.name);
+                        return; // don't schedule next — paused
                     }
-                    // Already attempted recovery — fall through to normal crash handling
-                }
-                // Detect a --continue/--resume failure (no conversation to resume). The
-                // session-id file persists across the crash, so a blind respawn would add
-                // --continue again and crash in the same way → loop. Clear the session id
-                // and skip resume so the next spawn starts fresh. (skipResume also stops
-                // saveSessionId below from resurrecting the id from statusline.json.)
-                if (lastOutput && /no conversation found|no conversation to (continue|resume)|no previous (session|conversation)|--continue/i.test(lastOutput)) {
-                    this.logger.warn("Detected --continue/resume failure — clearing session-id; next spawn starts fresh");
-                    try {
-                        unlinkSync(join(this.instanceDir, "session-id"));
+                    // Reset crash count if enough time has passed
+                    if (reset_after > 0 && Date.now() - this.lastCrashAt > reset_after) {
+                        this.crashCount = 0;
                     }
-                    catch { /* may not exist */ }
-                    this.skipResume = true;
-                }
-                // Append to crash history
-                this.appendCrashHistory({ exitCode, lastOutput, crashType, reason: nullReason });
-                if (max_retries <= 0) {
-                    this.healthCheckPaused = true;
-                    this.logger.warn(`${cliLabel} window died — automatic restart is disabled`);
-                    return;
-                }
-                // Detect rapid crash: sliding window — 3+ crashes in 5 minutes
-                this.crashTimestamps.push(Date.now());
-                const crashWindowMs = 5 * 60_000;
-                this.crashTimestamps = this.crashTimestamps.filter(t => t > Date.now() - crashWindowMs);
-                if (this.crashTimestamps.length >= 3) {
-                    this.healthCheckPaused = true;
-                    this.logger.error({ crashesInWindow: this.crashTimestamps.length }, "3+ crashes in 5 minutes — pausing respawn");
-                    // P1: Persist crash state so next process restart skips resume
-                    try {
-                        writeFileSync(join(this.instanceDir, "crash-state.json"), JSON.stringify({
-                            crashesInWindow: this.crashTimestamps.length,
-                            lastCrashAt: Date.now(),
-                            resumeDisabled: true,
-                        }));
+                    this.crashCount++;
+                    this.lastCrashAt = Date.now();
+                    if (this.crashCount > max_retries) {
+                        this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries }, "Max crash retries exceeded — not respawning");
+                        this.healthCheckPaused = true;
+                        this.emitSupervisionEnded(`it crashed ${this.crashCount} times, exceeding restart_policy.max_retries (${max_retries})`, "Check the logs for the cause, then restart it.");
+                        return; // don't schedule next — given up
                     }
-                    catch { /* best effort */ }
-                    this.emit("crash_loop", this.name);
-                    return; // don't schedule next — paused
-                }
-                // Reset crash count if enough time has passed
-                if (reset_after > 0 && Date.now() - this.lastCrashAt > reset_after) {
-                    this.crashCount = 0;
-                }
-                this.crashCount++;
-                this.lastCrashAt = Date.now();
-                if (this.crashCount > max_retries) {
-                    this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries }, "Max crash retries exceeded — not respawning");
-                    return; // don't schedule next — given up
-                }
-                // Calculate backoff delay
-                const delay = backoff === "exponential"
-                    ? Math.min(1000 * Math.pow(2, this.crashCount - 1), 60_000)
-                    : 1000 * this.crashCount;
-                this.logger.warn({ crashCount: this.crashCount, delay }, `${cliLabel} window died — respawning after backoff`);
-                await new Promise(r => setTimeout(r, delay));
-                try {
-                    this.saveSessionId();
-                    this.transcriptMonitor?.resetOffset();
-                    // Kill orphan MCP server from the crashed CLI session.
-                    // MCP server writes its PID to channel.mcp.pid on startup.
+                    // Calculate backoff delay
+                    const delay = backoff === "exponential"
+                        ? Math.min(1000 * Math.pow(2, this.crashCount - 1), 60_000)
+                        : 1000 * this.crashCount;
+                    this.logger.warn({ crashCount: this.crashCount, delay }, `${cliLabel} window died — respawning after backoff`);
+                    await new Promise(r => setTimeout(r, delay));
                     try {
-                        const pidFile = join(this.instanceDir, "channel.mcp.pid");
-                        const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
-                        process.kill(pid, "SIGTERM");
-                        this.logger.info({ pid }, "Killed orphan MCP server");
-                    }
-                    catch { /* no pid file or process already dead */ }
-                    // Kill any same-name windows before respawn to prevent orphans.
-                    // Wrapped in try-catch: if tmux server is dead, listWindows throws —
-                    // must not block spawnClaudeWindow (which calls ensureSession).
-                    try {
-                        const windows = await TmuxManager.listWindows(this.tmuxSessionName);
-                        for (const w of windows) {
-                            if (w.name === this.name) {
-                                const tm = new TmuxManager(this.tmuxSessionName, w.id);
-                                await tm.killWindow();
-                            }
+                        this.saveSessionId();
+                        this.transcriptMonitor?.resetOffset();
+                        // Kill orphan MCP server from the crashed CLI session.
+                        // MCP server writes its PID to channel.mcp.pid on startup.
+                        try {
+                            const pidFile = join(this.instanceDir, "channel.mcp.pid");
+                            const pid = parseInt(readFileSync(pidFile, "utf-8").trim(), 10);
+                            process.kill(pid, "SIGTERM");
+                            this.logger.info({ pid }, "Killed orphan MCP server");
                         }
-                    }
-                    catch { /* tmux server may be dead — ensureSession in trySpawn will recover */ }
-                    // Write snapshot before spawn — consumed only if resume fails
-                    this.writeRotationSnapshot("crash");
-                    // Try --resume first; spawnClaudeWindow falls back to fresh session if resume fails
-                    const resumed = await this.spawnClaudeWindow();
-                    if (!resumed) {
-                        // Resume failed → fresh session → inject snapshot for context
-                        await this.injectSnapshotMessage();
-                    }
-                    else {
-                        // Clean up stale snapshot — resume restored full context
+                        catch { /* no pid file or process already dead */ }
+                        // Kill any same-name windows before respawn to prevent orphans.
+                        // Wrapped in try-catch: if tmux server is dead, listWindows throws —
+                        // must not block spawnClaudeWindow (which calls ensureSession).
                         try {
-                            unlinkSync(join(this.instanceDir, "rotation-state.json"));
+                            const windows = await TmuxManager.listWindows(this.tmuxSessionName);
+                            for (const w of windows) {
+                                if (w.name === this.name) {
+                                    const tm = new TmuxManager(this.tmuxSessionName, w.id);
+                                    await tm.killWindow();
+                                }
+                            }
                         }
-                        catch { /* may not exist */ }
+                        catch { /* tmux server may be dead — ensureSession in trySpawn will recover */ }
+                        // Write snapshot before spawn — consumed only if resume fails
+                        this.writeRotationSnapshot("crash");
+                        // Try --resume first; spawnClaudeWindow falls back to fresh session if resume fails
+                        const resumed = await this.spawnClaudeWindow();
+                        if (!resumed) {
+                            // Resume failed → fresh session → inject snapshot for context
+                            await this.injectSnapshotMessage();
+                        }
+                        else {
+                            // Clean up stale snapshot — resume restored full context
+                            try {
+                                unlinkSync(join(this.instanceDir, "rotation-state.json"));
+                            }
+                            catch { /* may not exist */ }
+                        }
+                        this.setProcessStatus("running");
+                        this.logger.info({ resumed }, `Respawned ${cliLabel} window after crash`);
+                        this.emit("crash_respawn", this.name);
+                    }
+                    catch (err) {
+                        this.logger.error({ err }, `Failed to respawn ${cliLabel} window`);
                     }
-                    this.setProcessStatus("running");
-                    this.logger.info({ resumed }, `Respawned ${cliLabel} window after crash`);
-                    this.emit("crash_respawn", this.name);
                 }
                 catch (err) {
-                    this.logger.error({ err }, `Failed to respawn ${cliLabel} window`);
+                    this.logger.error({ err }, "Health check tick failed — continuing");
+                    // Surface it to the operator, not just the log — a health check that
+                    // keeps throwing means this instance is no longer being supervised.
+                    // Throttled: the tick repeats every ~30s, so an unnotified persistent
+                    // fault would otherwise post twice a minute forever.
+                    const now = Date.now();
+                    if (now - this.lastHealthErrorNotifyAt > HEALTH_ERROR_NOTIFY_INTERVAL_MS) {
+                        this.lastHealthErrorNotifyAt = now;
+                        this.emit("health_check_error", {
+                            name: this.name,
+                            message: err instanceof Error ? err.message : String(err),
+                        });
+                    }
+                    scheduleNext();
+                    return;
                 }
                 scheduleNext();
             }, healthCheckIntervalMs);
@@ -963,6 +1376,21 @@ export class Daemon extends EventEmitter {
      * A dead remain-on-exit pane still contains the old ready prompt, so allowing
      * the pane monitor to capture it would re-create a false idle state.
      */
+    /**
+     * Announce that this instance is no longer being supervised.
+     *
+     * Four health-check exits set `healthCheckPaused = true` and returned without
+     * telling anyone: a clean CLI exit, `max_retries <= 0`, crash retries exhausted,
+     * and the instance directory being deleted. Only the crash-LOOP case emitted an
+     * event, so a fleet could quietly contain a dead instance that still looked fine
+     * on the dashboard — while messages routed to it queued or failed with a bare ❌.
+     *
+     * `crash_loop` already had this treatment; this is the same bridge for the other
+     * four, carrying a human-readable cause and the operator's next step.
+     */
+    emitSupervisionEnded(reason, remedy) {
+        this.emit("supervision_ended", { name: this.name, reason, remedy });
+    }
     setProcessStatus(status) {
         if (this.processStatus === status)
             return;
@@ -1001,13 +1429,12 @@ export class Daemon extends EventEmitter {
             return;
         const patterns = this.backend?.getErrorPatterns?.() ?? [];
         const dialogs = this.backend?.getRuntimeDialogs?.() ?? [];
-        if (!patterns.length && !dialogs.length)
-            return;
         if (!this.tmux)
             return;
         if (!this.backend)
             return; // lightweight mode has no backend
         const readyPattern = this.backend.getReadyPattern();
+        const busyPattern = this.backend.getBusyPattern?.() ?? null;
         this.errorMonitorTimer = setInterval(async () => {
             if (!this.tmux || this.spawning)
                 return;
@@ -1016,24 +1443,41 @@ export class Daemon extends EventEmitter {
                 if (!alive)
                     return;
                 const pane = await this.tmux.capturePane();
+                const interactivePrompt = this.interactivePromptDetector.observe(pane, Date.now(), this.instanceStateLastOutputAt);
+                if (interactivePrompt) {
+                    this.logger.warn(interactivePrompt, "Interactive terminal prompt is waiting for human input");
+                    this.emit("interactive_prompt", { name: this.name, ...interactivePrompt });
+                    // A prompt is not an error and must not enter the PTY recovery gate.
+                    // Continue scanning real errors in this same snapshot.
+                }
                 // Auto-dismiss runtime dialogs (e.g. Codex rate limit model switch)
                 for (const dialog of dialogs) {
                     if (!dialog.pattern.test(pane))
                         continue;
-                    this.logger.info(`Auto-dismissing runtime dialog: ${dialog.description}`);
-                    const SPECIAL_KEYS = new Set(["Up", "Down", "Enter", "Escape", "Right", "Left"]);
-                    for (const key of dialog.keys) {
-                        if (SPECIAL_KEYS.has(key)) {
-                            await this.tmux.sendSpecialKey(key);
-                        }
-                        else {
-                            await this.tmux.pasteText(key);
+                    // These keys go straight into the pane. Sent while a message delivery is
+                    // mid-transaction, an `Escape` wipes the pasted text and an `Enter`
+                    // submits it half-composed — the user sees a message that vanished. Skip
+                    // (not queue) when the pane is busy: this poller runs every 5s, and the
+                    // dialog will still be on screen next tick.
+                    const dismissed = await this.paneWriteLock.tryRun(async () => {
+                        this.logger.info(`Auto-dismissing runtime dialog: ${dialog.description}`);
+                        const SPECIAL_KEYS = new Set(["Up", "Down", "Enter", "Escape", "Right", "Left"]);
+                        for (const key of dialog.keys) {
+                            if (SPECIAL_KEYS.has(key)) {
+                                await this.tmux.sendSpecialKey(key);
+                            }
+                            else {
+                                await this.tmux.pasteText(key, this.systemPasteOptions());
+                            }
+                            await new Promise(r => setTimeout(r, 200));
                         }
-                        await new Promise(r => setTimeout(r, 200));
+                    });
+                    if (!dismissed) {
+                        this.logger.debug({ dialog: dialog.description }, "Dialog dismissal deferred — pane write in flight");
                     }
-                    return; // Dialog dismissed, skip error checks this cycle
+                    return; // Dialog handled (or deliberately deferred): skip error checks this cycle
                 }
-                this.evaluateErrorPatterns(pane, patterns, readyPattern);
+                this.evaluateErrorPatterns(pane, patterns, readyPattern, Date.now(), busyPattern);
             }
             catch {
                 // capturePane can fail if window is transitioning — ignore
@@ -1041,7 +1485,7 @@ export class Daemon extends EventEmitter {
         }, 5_000); // Check every 5 seconds (runtime dialogs need fast response)
     }
     /** Evaluate one pane snapshot. Kept synchronous so state-machine edges are unit-testable. */
-    evaluateErrorPatterns(pane, patterns, readyPattern, now = Date.now()) {
+    evaluateErrorPatterns(pane, patterns, readyPattern, now = Date.now(), busyPattern = null) {
         // Count occurrences across the WHOLE pane (not just text after the last
         // ready prompt). Clone with `g` so stateful backend regexes cannot leak
         // lastIndex between monitor cycles.
@@ -1049,14 +1493,34 @@ export class Daemon extends EventEmitter {
             const flags = pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g";
             return (pane.match(new RegExp(pattern.source, flags)) || []).length;
         };
+        // Same veto as the state machine: a backend whose ready marker is permanently
+        // on screen would otherwise "recover" on the very first tick after the error,
+        // rebaselining the occurrence count while the error is still displayed — one
+        // notification, a false recovery log, then silence.
+        const looksReady = () => !busyPattern?.test(pane) && readyPattern.test(pane);
         // State: waiting for recovery. A missing/outdated ready pattern must not
         // suppress every future error forever, so the gate has a hard deadline.
         if (this.errorWaitingForRecovery) {
-            if (readyPattern.test(pane)) {
+            if (looksReady()) {
                 const downtime = Math.round((now - this.errorDetectedAt) / 1000);
-                const active = patterns.find(ep => Daemon.errorPatternKey(ep) === this.activeErrorPatternKey);
-                if (active) {
-                    this.lastErrorCount.set(Daemon.errorPatternKey(active), countMatches(active.pattern));
+                // Re-baseline EVERY pattern, not just the one that fired. Patterns
+                // legitimately overlap — kiro prints one header ("having trouble
+                // responding") above the specific cause — and only the first match is
+                // reported before the `break`, leaving the others at a stale baseline.
+                // Rebasing just the active one meant the first scan after recovery saw
+                // count > seen on the very text we already reported and fired a second,
+                // contradictory notification ("Rate limit") for an incident the user had
+                // just been told about. Recovery means the pane is now history, so all
+                // of it is history. Deliberately NOT done at detection time: a pattern
+                // skipped for cooldown must keep its count unconsumed so it can still
+                // fire once that cooldown expires.
+                for (const ep of patterns) {
+                    const seen = countMatches(ep.pattern);
+                    // Only patterns actually present in the pane. Storing zeros would be a
+                    // no-op for detection (count 0 === absent) but grows the map with an
+                    // entry per pattern per recovery.
+                    if (seen > 0)
+                        this.lastErrorCount.set(Daemon.errorPatternKey(ep), seen);
                 }
                 this.clearErrorRecoveryGate();
                 this.logger.info({ downtime_s: downtime }, "PTY error recovered — agent is ready again");
@@ -1151,6 +1615,12 @@ export class Daemon extends EventEmitter {
      * Interrupt the CLI's current generation (cancel button / `/cancel`).
      * Direct tmux key event (not a paste) so it registers as the interrupt key.
      * kiro-cli interrupts on Ctrl+C; the others (claude-code, codex, …) on Escape.
+     *
+     * Deliberately NOT taken through `paneWriteLock`. Cancel is the user's way out
+     * of a pane that is busy or wedged — queueing it behind the very delivery chain
+     * it exists to unblock would make the button useless exactly when it is needed.
+     * The cost is accepted: an Escape landing between a paste and its Enter discards
+     * that message, which is what the user asked for anyway.
      */
     async sendEscape() {
         const cancelKey = this.backend?.getCancelKey() ?? "Escape";
@@ -1188,7 +1658,6 @@ export class Daemon extends EventEmitter {
             this.toolStatusDebounce = null;
         }
         this.pendingIpcRequests.clear();
-        this.hangDetector?.stop();
         if (this.adapter)
             await this.adapter.stop();
         // Notify MCP servers of graceful shutdown (prevents reconnect attempts)
@@ -1215,7 +1684,12 @@ export class Daemon extends EventEmitter {
             if (!killed)
                 this.logger.warn("CLI did not exit gracefully within 3s, force killing window");
             // Always kill window — remain-on-exit keeps dead panes around after CLI exits
+            const stoppedWindowId = this.tmux.getWindowId();
             await this.tmux.killWindow();
+            // The control client is shared across the fleet and outlives this daemon, so
+            // a registration left behind here is re-resolved on every reconnect forever.
+            if (stoppedWindowId)
+                this.controlClient?.unregisterWindow(stoppedWindowId);
             const windowIdFile = join(this.instanceDir, "window-id");
             try {
                 unlinkSync(windowIdFile);
@@ -1258,6 +1732,16 @@ export class Daemon extends EventEmitter {
         };
     }
     /** Gracefully stop the CLI while keeping its remain-on-exit tmux window. */
+    /**
+     * Mark the instance to pause as soon as its pane is idle. Used for auth
+     * failures: pause() alone no-ops while the CLI is busy/stuck, which is the
+     * usual state when the error surfaces. Cleared by a successful pause or wake.
+     */
+    requestPauseWhenIdle() {
+        if (this.pauseWakeState === "paused")
+            return;
+        this.pausePending = true;
+    }
     async pause() {
         if (this.pauseWakeState === "paused")
             return;
@@ -1327,6 +1811,9 @@ export class Daemon extends EventEmitter {
     }
     /** Respawn the CLI in the preserved window and block until its prompt is ready. */
     async wake(timeoutMs = 30_000) {
+        // An explicit wake (e.g. after the user re-logs in) cancels a deferred
+        // auth pause — otherwise the instance would pause again the moment it idles.
+        this.pausePending = false;
         if (this.pauseWakeState === "active")
             return;
         if (this.pauseWakeState === "pausing")
@@ -1338,7 +1825,7 @@ export class Daemon extends EventEmitter {
             return;
         }
         this.pauseWakeState = "waking";
-        this.spawning = true;
+        this.beginSpawn();
         const transition = this.autoPauseController.wakeOnDeliver(async () => {
             let timeout;
             try {
@@ -1379,7 +1866,7 @@ export class Daemon extends EventEmitter {
             throw err;
         }
         finally {
-            this.spawning = false;
+            this.endSpawn();
             if (this.pauseWakeTransition === transition)
                 this.pauseWakeTransition = null;
         }
@@ -1391,6 +1878,10 @@ export class Daemon extends EventEmitter {
         // observations between enqueue and paste must not clear a newer inbound.
         if (snapshot.state === "idle" && previous !== "idle") {
             this.pendingWork.recordIdle(snapshot.observedAt);
+            // The turn is over. A transcript can end on a tool_use with no matching
+            // tool_result (interrupted, crashed, cancelled), which would otherwise leave
+            // the last tool pinned to the progress line for the rest of the session.
+            this.publishActivity(null);
         }
         if (snapshot.state !== previous) {
             this.logger.info({
@@ -1406,6 +1897,18 @@ export class Daemon extends EventEmitter {
         }
         if (snapshot.state !== "idle")
             this.pauseRequested = false;
+        // A pause deferred by an auth failure: retry the moment the pane settles.
+        if (this.pausePending && snapshot.state === "idle" && this.pasteQueueDepth === 0) {
+            this.pausePending = false;
+            this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt });
+            return;
+        }
+        // A restart deferred by a dead MCP server: the turn it must not interrupt is
+        // over. Skip auto-pause evaluation this tick — the restart supersedes it.
+        if (this.mcpRestartPending && snapshot.state === "idle" && this.pasteQueueDepth === 0) {
+            this.fireMcpRestartRequest("idle_edge");
+            return;
+        }
         if (!this.pauseRequested && this.pasteQueueDepth === 0 && this.autoPauseController.observe(snapshot.state)) {
             this.pauseRequested = true;
             this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt });
@@ -1472,9 +1975,29 @@ export class Daemon extends EventEmitter {
                 || (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureStartedAt))
                 return;
             const observedChangeAt = expectedOutputAt || captureStartedAt;
-            this.instanceStateMachine.observe(pane, observedChangeAt);
-            const snapshot = this.instanceStateMachine.observe(pane, Date.now());
+            // One observation per capture. This used to call observe() twice with the
+            // same pane: the second call always saw an unchanged pane, so the
+            // "content moved → still working" branch could never fire and the state
+            // came down to the busy/ready patterns alone. That is why a single
+            // mismatched spinner frame was enough to report idle mid-turn.
+            const settled = this.instanceStateLastOutputAt === 0
+                || captureStartedAt - this.instanceStateLastOutputAt >= this.instanceStateIdleDebounceMs;
+            // The two times are genuinely different and both matter: the content
+            // changed when tmux reported output (observedChangeAt), but idle/stuck are
+            // decisions about *now*. The old double-observe expressed that by calling
+            // observe twice, which silently disabled the "content moved" branch.
+            const snapshot = this.instanceStateMachine.observe(pane, Date.now(), {
+                settled,
+                changeAt: observedChangeAt,
+            });
             this.applyInstanceStateSnapshot(snapshot, pane);
+            // Backends without a transcript feed can still say what they are doing, if
+            // their TUI names it. Free-riding on a capture that already happened: no
+            // extra tmux call. Cadence is the capture cadence (idle debounce + the 60s
+            // safety sweep), which matches the progress ticker's own 60s interval.
+            if (this.backend?.getPaneActivity) {
+                this.publishActivity(snapshot.state === "idle" ? null : this.backend.getPaneActivity(pane));
+            }
             if (snapshot.state === "idle") {
                 this.clearInstanceStateStuckTimer();
             }
@@ -1529,7 +2052,8 @@ export class Daemon extends EventEmitter {
             ? rawConfig.idle_debounce_ms
             : DEFAULT_STATE_IDLE_DEBOUNCE_MS;
         this.instanceStateReadyPattern = this.backend.getReadyPattern();
-        this.instanceStateMachine = new PaneStateMachine(this.instanceStateReadyPattern, this.instanceStateStuckTimeoutMs);
+        this.instanceStateBusyPattern = this.backend.getBusyPattern?.() ?? null;
+        this.instanceStateMachine = new PaneStateMachine(this.instanceStateReadyPattern, this.instanceStateStuckTimeoutMs, Date.now(), this.instanceStateBusyPattern);
         this.instanceStateLastOutputAt = 0;
         this.instanceStateMonitorActive = true;
         if (this.controlClient) {
@@ -1570,6 +2094,12 @@ export class Daemon extends EventEmitter {
             paneTail: sanitizePaneTail(pane),
             readyPattern: readyPattern.toString(),
             readyMatched: deterministicReadyPattern.test(pane),
+            // A pane that is stuck *while* the ready marker matches means the busy
+            // pattern is what held it back — worth seeing when tuning either regex.
+            busyPattern: this.instanceStateBusyPattern?.toString(),
+            busyMatched: this.instanceStateBusyPattern
+                ? new RegExp(this.instanceStateBusyPattern.source, this.instanceStateBusyPattern.flags.replace(/[gy]/g, "")).test(pane)
+                : undefined,
             unchangedForMs: snapshot.unchangedForMs,
             pendingWork: this.pendingWork.hasPendingWork(),
         };
@@ -1591,6 +2121,11 @@ export class Daemon extends EventEmitter {
             clearInterval(this.errorMonitorTimer);
             this.errorMonitorTimer = null;
         }
+        // A pause or stop tears the CLI down anyway — the respawn brings a fresh MCP
+        // server, so a deferred MCP-revival restart is moot (and its timer must not
+        // fire into a stopped daemon).
+        this.clearMcpRestartRequest();
+        this.interactivePromptDetector.reset();
         this.stopInstanceStateMonitor();
         this.transcriptMonitor?.stop();
         this.guardian?.stop();
@@ -1612,6 +2147,40 @@ export class Daemon extends EventEmitter {
         return this.messageBus;
     }
     // ── Tool status tracking ──────────────────────────────────────
+    /**
+     * Tell the fleet manager what this instance is doing right now, for the live
+     * progress line on the cancel button.
+     *
+     * Purely cosmetic — nothing decides anything from it, so it is fine that only
+     * backends with a transcript feed report at all (claude-code today). For the
+     * rest the progress line keeps showing just elapsed time.
+     *
+     * Repeats are dropped: the ticker only edits the channel message when the text
+     * changes, and a stream of identical broadcasts would defeat that.
+     */
+    publishActivity(activity) {
+        const next = activity && activity.trim() ? activity.trim() : null;
+        if (next === this.currentActivity)
+            return;
+        this.currentActivity = next;
+        this.ipcServer?.broadcast({
+            type: "instance_activity",
+            instanceName: this.name,
+            activity: next,
+        });
+    }
+    /**
+     * Options for every system-initiated paste (startup notice, session snapshot,
+     * runtime-dialog keys).
+     *
+     * One place, so the three call sites cannot drift apart on it. Backends with a
+     * native input queue do not get the retry Enter: on those, a second bare Enter
+     * is not the no-op the retry assumed but a queue mutation — the same reason
+     * `deliverMessage` refuses to probe for busy with one.
+     */
+    systemPasteOptions() {
+        return { retryEnter: this.backend?.supportsQueuedInput?.() !== true };
+    }
     summarizeTool(name, input) {
         const inp = input;
         if (!inp)
@@ -1622,8 +2191,9 @@ export class Daemon extends EventEmitter {
             return `Edit ${inp.file_path ?? ""}`;
         if (name === "Write")
             return `Write ${inp.file_path ?? ""}`;
+        // Command name only — never the arguments. See shellCommandLabel.
         if (name === "Bash")
-            return `$ ${String(inp.command ?? "").slice(0, 50)}`;
+            return `$ ${shellCommandLabel(String(inp.command ?? ""))}`;
         if (name === "Glob")
             return `Glob ${inp.pattern ?? ""}`;
         if (name === "Grep")
@@ -1701,7 +2271,6 @@ export class Daemon extends EventEmitter {
             writeFileSync(join(this.instanceDir, "prev-instructions"), this.pendingInstructionsUpdate);
             this.pendingInstructionsUpdate = undefined;
         }
-        this.hangDetector?.recordInbound();
         this.pendingWork.recordInbound();
         // v3: record user messages for rotation snapshot
         this.recordRecentUserMessage(content, meta);
@@ -1724,12 +2293,26 @@ export class Daemon extends EventEmitter {
             // #77: show the sender's display name for readability, keeping the machine
             // instance name in parens so the recipient's send_to_instance target is valid.
             const fromLabel = meta.from_display ? `${meta.from_display} (${fromInstance})` : fromInstance;
-            formatted = `[from:${fromLabel}] ${content}\n(If you need to reply, use send_to_instance tool, NOT direct text. If there is nothing to add, you may stay silent.)`;
+            formatted = `[from:${fromLabel}] ${content}`;
+            formatted += renderHandoffMetadata(meta);
+            // A delegated task that requires a reply must not read like a chatty FYI —
+            // the "you may stay silent" line is for the latter only.
+            formatted += meta.requires_reply === "true"
+                ? "\n(A reply IS required: use report_result with the correlation_id above — or send_to_instance. Not direct text.)"
+                : "\n(If you need to reply, use send_to_instance tool, NOT direct text. If there is nothing to add, you may stay silent.)";
         }
         else {
             const via = meta.source ? ` via ${meta.source}` : "";
             const idTag = meta.user_id ? `, id:${meta.user_id}` : "";
-            formatted = `[user:${user}${via}${idTag}] ${content}\n(Reply using the reply tool — do NOT respond with direct text)`;
+            formatted = `[user:${user}${via}${idTag}] ${content}`;
+            // Reactions queued since the last real message (#432). One leading line of
+            // context, present only when something is pending — a reaction no longer
+            // costs a turn of its own.
+            if (meta.pending_reactions) {
+                formatted = `[Recent reactions: ${meta.pending_reactions}]\n${formatted}`;
+            }
+            formatted += renderHandoffMetadata(meta);
+            formatted += "\n(Reply using the reply tool — do NOT respond with direct text)";
         }
         if (meta.reply_to_text) {
             formatted += `\n(reply_to: "${meta.reply_to_text}")`;
@@ -1793,6 +2376,8 @@ export class Daemon extends EventEmitter {
             // Odd number of fences = unclosed. Remove all code fences from the message.
             formatted = formatted.replace(/```/g, "");
         }
+        // Before anything reads the window id: a spawn in progress is about to change it.
+        await this.waitForSpawnToSettle();
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
         let handingOffToNativeQueue = false;
@@ -1808,9 +2393,33 @@ export class Daemon extends EventEmitter {
             }
             else {
                 this.logger.debug("CLI busy — queuing message until idle");
-                await this.controlClient.waitUntilIdle(windowId);
+                const becameIdle = await this.controlClient.waitUntilIdle(windowId);
+                if (!becameIdle) {
+                    // The pane never freed up. Report the failure instead of pasting into a
+                    // wedged CLI (where the text would sit unsubmitted and the next message
+                    // would land on top of it) — and instead of holding the queue silently.
+                    this.logger.error("Pane still busy after the idle wait — reporting delivery failure");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
             }
         }
+        // Everything above is *waiting*; everything below *writes*. Only the write is
+        // held under the pane lock — holding it across the idle wait (up to 30 min)
+        // would starve the runtime-dialog dismisser, which is often the very thing
+        // that would let the pane go idle again.
+        return this.paneWriteLock.run(() => this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status));
+    }
+    /**
+     * The write half of a delivery: paste → Enter → confirm, with retries.
+     *
+     * Always called under {@link paneWriteLock}. Split out from `deliverMessage`
+     * precisely so the lock's scope is visible at the call site rather than being
+     * an invariant maintained by comments.
+     */
+    async writeMessageToPane(formatted, initialWindowId, handingOffToNativeQueue, status) {
+        let windowId = initialWindowId;
         // Bug A: paste with backoff. Transient failures are usually a stale window id
         // after a crash/respawn — recover by name and retry (max 3 attempts, 2s apart).
         const maxAttempts = 3;
@@ -1831,19 +2440,79 @@ export class Daemon extends EventEmitter {
                 this.logger.debug({ enterSettleMs }, "First delivery after ready — extending Enter settle delay");
             }
             await new Promise(r => setTimeout(r, enterSettleMs));
-            const enterAt = Date.now();
+            let enterAt = Date.now();
             await this.tmux.sendSpecialKey("Enter");
+            // Kiro's legacy TUI can swallow Enter while it is still processing a large
+            // paste — not only during the post-ready redraw (#479): on slower hosts it
+            // happens on ordinary deliveries too (v2.1.2 stable, WSL2 + tmux 3.4).
+            // The busy confirmation below cannot be trusted to catch that: it accepts
+            // ANY output after Enter, and the paste's own late render satisfies it, so
+            // the message is confirmed ✅ while the text sits unsubmitted. Kiro has no
+            // native input queue and a bare Enter is a no-op both at an empty prompt
+            // and during generation (both verified live on kiro-cli 2.16.1), so the
+            // defensive retry runs on EVERY delivery — which is also what the legacy
+            // pasteText path has always done for queue-less backends. enterAt is
+            // re-baselined to the second Enter so leftover paste-render output between
+            // the two cannot be what "confirms" the submission.
+            if (this.backend?.requiresDeliveryEnterRetry?.() === true) {
+                await new Promise(r => setTimeout(r, 1_000));
+                enterAt = Date.now();
+                await this.tmux.sendSpecialKey("Enter");
+                this.logger.debug("Sent defensive Enter retry (queue-less TUI can swallow the first)");
+            }
             if (status)
                 this.emit("message_delivered", status); // 👀
-            // A busy queue-capable CLI does not necessarily emit output when it accepts
-            // queued input. Treat the successful paste+Enter as the handoff confirmation;
-            // probing for idle→busy would time out and a second bare Enter could mutate
-            // the queue/TUI state. Idle submissions retain the swallowed-Enter safeguard.
+            // Busy queue-capable CLIs (codex) may accept paste without an idle→busy
+            // transition. Do NOT probe for busy — a second bare Enter can mutate the
+            // queue. Instead verify the paste actually landed in the pane (TUI redraw
+            // can silently swallow it). Idle submissions keep the swallowed-Enter path.
             if (handingOffToNativeQueue) {
+                await new Promise(r => setTimeout(r, NATIVE_QUEUE_PASTE_VERIFY_MS));
+                if (await this.nativeQueuePasteVisible(formatted)) {
+                    if (status)
+                        this.emit("message_confirmed", status); // ✅ native queue accepted
+                    return true;
+                }
+                // Silent loss: fall back once to the normal idle-gated path.
+                this.logger.warn("Native-queue paste not visible in pane — retrying via idle-gated delivery");
+                if (windowId && this.controlClient) {
+                    await this.controlClient.waitUntilIdle(windowId);
+                }
+                const repasted = await this.tmux.pasteBuffer(formatted);
+                if (!repasted) {
+                    this.logger.error("Idle-gated redelivery paste failed after native-queue silent loss");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
+                await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
+                const retryAt = Date.now();
+                await this.tmux.sendSpecialKey("Enter");
+                if (windowId && this.controlClient) {
+                    let becameBusy = await this.confirmBusyAfterEnter(windowId, retryAt);
+                    if (!becameBusy) {
+                        this.logger.warn("No idle→busy after idle-gated redelivery — re-sending Enter once");
+                        const retry2At = Date.now();
+                        await this.tmux.sendSpecialKey("Enter");
+                        becameBusy = await this.confirmBusyAfterEnter(windowId, retry2At);
+                    }
+                    if (becameBusy) {
+                        if (status)
+                            this.emit("message_confirmed", status); // ✅
+                        return true;
+                    }
+                }
+                else if (await this.nativeQueuePasteVisible(formatted)) {
+                    if (status)
+                        this.emit("message_confirmed", status); // ✅
+                    return true;
+                }
+                this.logger.error("Idle-gated redelivery also failed after native-queue silent loss");
                 if (status)
-                    this.emit("message_confirmed", status); // ✅ native queue accepted
+                    this.emit("message_failed", status); // ❌
+                return false;
             }
-            else if (windowId && this.controlClient) {
+            if (windowId && this.controlClient) {
                 let becameBusy = await this.confirmBusyAfterEnter(windowId, enterAt);
                 if (!becameBusy) {
                     this.logger.warn("No idle→busy transition after Enter — re-sending Enter once");
@@ -1851,8 +2520,20 @@ export class Daemon extends EventEmitter {
                     await this.tmux.sendSpecialKey("Enter");
                     becameBusy = await this.confirmBusyAfterEnter(windowId, retryAt);
                 }
-                if (becameBusy && status)
-                    this.emit("message_confirmed", status); // ✅
+                if (becameBusy) {
+                    if (status)
+                        this.emit("message_confirmed", status); // ✅
+                }
+                else {
+                    // Both Enters were swallowed: the text is sitting UNSUBMITTED in the
+                    // CLI's input box. This used to return true, so the reaction stayed at 👀
+                    // forever and the next delivery pasted on top — submitting two messages
+                    // as one. Say so instead.
+                    this.logger.error("Message pasted but never submitted (no idle→busy after two Enters)");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
             }
             else {
                 // No control client to observe output: fall back to the legacy double-Enter.
@@ -1868,8 +2549,36 @@ export class Daemon extends EventEmitter {
             this.emit("message_failed", status); // ❌
         return false;
     }
+    /**
+     * True when a busy native-queue paste appears to have landed: Codex shows a
+     * `↳` queue marker, or a distinctive slice of the pasted text is on screen.
+     * Used only to detect silent paste loss — not as a general ready check.
+     */
+    async nativeQueuePasteVisible(formatted) {
+        if (!this.tmux)
+            return false;
+        try {
+            const pane = await this.tmux.capturePane();
+            if (pane.includes("↳"))
+                return true;
+            for (const line of formatted.split(/\r?\n/)) {
+                const t = line.trim();
+                if (t.length >= 8 && pane.includes(t))
+                    return true;
+            }
+            const compact = formatted.replace(/\s+/g, " ").trim();
+            if (compact.length >= 8 && pane.includes(compact.slice(0, Math.min(80, compact.length)))) {
+                return true;
+            }
+            return false;
+        }
+        catch {
+            return false;
+        }
+    }
     /** Re-resolve this instance's tmux window by name (stale id after crash/respawn). */
     async recoverWindow() {
+        const previousWindowId = this.tmux?.getWindowId();
         try {
             const windows = await TmuxManager.listWindows(this.tmuxSessionName);
             const match = windows.find(w => w.name === this.name);
@@ -1877,6 +2586,12 @@ export class Daemon extends EventEmitter {
                 return undefined;
             this.tmux = new TmuxManager(this.tmuxSessionName, match.id, resolveTmuxLogicalSize(this.config.terminal));
             writeFileSync(join(this.instanceDir, "window-id"), match.id);
+            // The window we were talking to is gone; leaving it registered means the
+            // control client re-resolves a dead id — one tmux subprocess — on every
+            // reconnect, for the life of the fleet process.
+            if (previousWindowId && previousWindowId !== match.id) {
+                this.controlClient?.unregisterWindow(previousWindowId);
+            }
             await this.controlClient?.registerWindow(match.id);
             this.bindInstanceStateOutputListener(match.id);
             this.logger.info({ windowId: match.id }, "Recovered window ID for message delivery");
@@ -1887,12 +2602,38 @@ export class Daemon extends EventEmitter {
             return undefined;
         }
     }
-    /** Poll up to ~2s (200ms × 10) for the pane to emit output after `since`. */
+    /**
+     * Poll up to ~2s (200ms × 10) for the pane to emit output after `since`.
+     *
+     * A `false` here is not "no output" — it is read as **"the message was pasted but
+     * never submitted"**, which re-sends Enter and then reports ❌ to the user. So a
+     * false negative costs a possible double submit and a failure notice for a
+     * message that actually arrived.
+     *
+     * That is exactly what a control-mode reconnect used to produce. `connect()`
+     * drops every output timestamp, so `hasOutputSince` answers `false` for a pane
+     * that did react — the evidence was thrown away, not absent. Blind time is
+     * therefore not counted against the budget: after a reset the poll restarts from
+     * the moment observation resumed. A hard wall-clock cap keeps a reconnect loop
+     * from extending this forever.
+     */
     async confirmBusyAfterEnter(windowId, since) {
-        for (let i = 0; i < 10; i++) {
-            await new Promise(r => setTimeout(r, 200));
-            if (this.controlClient.hasOutputSince(windowId, since))
+        const client = this.controlClient;
+        const hardDeadline = Date.now() + CONFIRM_BUSY_MAX_WAIT_MS;
+        let observedFrom = since;
+        let polls = 0;
+        while (polls < CONFIRM_BUSY_POLLS) {
+            await new Promise(r => setTimeout(r, CONFIRM_BUSY_POLL_MS));
+            if (client.hasOutputSince(windowId, observedFrom))
                 return true;
+            const resetAt = client.getObservationResetAt();
+            if (resetAt > observedFrom && Date.now() < hardDeadline) {
+                this.logger.debug({ windowId, resetAt }, "Control mode reconnected mid-confirmation — restarting the Enter check from when we could see again");
+                observedFrom = resetAt;
+                polls = 0;
+                continue;
+            }
+            polls++;
         }
         return false;
     }
@@ -1963,8 +2704,8 @@ export class Daemon extends EventEmitter {
             });
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
-                respond(null, "Task operation timed out after 30s");
-            }, 30_000);
+                respond(null, `Task operation timed out after ${daemonBudgetMs(tool) / 1000}s`);
+            }, daemonBudgetMs(tool));
             this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
@@ -1986,8 +2727,8 @@ export class Daemon extends EventEmitter {
             });
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
-                respond(null, "Decision operation timed out after 30s");
-            }, 30_000);
+                respond(null, `Decision operation timed out after ${daemonBudgetMs(tool) / 1000}s`);
+            }, daemonBudgetMs(tool));
             this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
@@ -2013,8 +2754,8 @@ export class Daemon extends EventEmitter {
             // Wait for fleet_schedule_response via pending request map
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
-                respond(null, "Schedule operation timed out after 30s");
-            }, 30_000);
+                respond(null, `Schedule operation timed out after ${daemonBudgetMs(tool) / 1000}s`);
+            }, daemonBudgetMs(tool));
             this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
@@ -2035,7 +2776,9 @@ export class Daemon extends EventEmitter {
                     fleetRequestId: fleetReqId,
                     senderSessionName,
                 });
-                const crossTimeoutMs = (tool === "start_instance" || tool === "create_instance" || tool === "replace_instance") ? 60_000 : 30_000;
+                // Shared table, so delete_instance and the deployment tools get the same
+                // budget here as the MCP client expects (the ad-hoc list omitted them).
+                const crossTimeoutMs = daemonBudgetMs(tool);
                 const timeout = setTimeout(() => {
                     this.pendingIpcRequests.delete(fleetReqId);
                     respond(null, `Cross-instance operation timed out after ${crossTimeoutMs / 1000}s`);
@@ -2062,7 +2805,11 @@ export class Daemon extends EventEmitter {
             }
             if (this.lastChatId) {
                 args.chat_id = this.lastChatId;
-                if (tool === "reply")
+                // Discord messages live in the channel/thread id, not the guild id in
+                // chat_id. This is required for react/edit as well as reply. In
+                // particular, general_topic deliberately has no configured reply thread,
+                // so FleetManager cannot reconstruct this address from fleet.yaml.
+                if (this.lastThreadId)
                     args.thread_id = this.lastThreadId;
             }
         }
@@ -2075,11 +2822,20 @@ export class Daemon extends EventEmitter {
             // from prematurely resolving their pending requests when they receive the broadcast.
             const fleetReqId = `tool_${requestId}`;
             const outboundKey = fleetReqId;
-            this.ipcServer?.broadcast({ type: "fleet_outbound", tool, args, fleetRequestId: fleetReqId });
+            this.ipcServer?.broadcast({
+                type: "fleet_outbound",
+                tool,
+                args,
+                fleetRequestId: fleetReqId,
+                // Preserve the exact adapter world that supplied the chat context. An
+                // instance binding is only a fallback: persisted/runtime context can be
+                // from a secondary world, and message ids are not portable across bots.
+                adapterId: this.lastAdapterId,
+            });
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(outboundKey);
-                respond(null, "Fleet outbound timed out after 30s");
-            }, 30_000);
+                respond(null, `Fleet outbound timed out after ${daemonBudgetMs(tool) / 1000}s`);
+            }, daemonBudgetMs(tool));
             this.pendingIpcRequests.set(outboundKey, (respMsg) => {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
@@ -2143,7 +2899,14 @@ export class Daemon extends EventEmitter {
             try {
                 const all = JSON.parse(process.env.AGEND_DECISIONS);
                 const workDir = this.config.working_directory;
-                decisions = all.filter(d => d.scope === "fleet" || d.project_root === workDir);
+                // `scope: "fleet"` used to bypass the project check entirely, so a
+                // single-project worker inherited every other project's playbook (8 of
+                // 14 injected here were foreign) — resent on every API call. Now a
+                // fleet decision must also be RELEVANT: global (no project_root), the
+                // same project, or the same project family (worktrees/checkouts of one
+                // repo). A general is exempt: it dispatches across all projects, so
+                // cross-project routing rules are exactly what it needs.
+                decisions = selectRelevantDecisions(all, workDir, this.config.general_topic === true);
                 // Stable ordering so identical decision sets always build byte-identical
                 // instructions — otherwise source ordering jitter flips the warmup hash.
                 decisions.sort((a, b) => a.title.localeCompare(b.title));
@@ -2161,8 +2924,14 @@ export class Daemon extends EventEmitter {
             AGEND_BACKEND: this.runtimeIdentity?.backend ?? this.config.backend ?? this.backend?.binaryName ?? "unknown",
             AGEND_MODEL: this.runtimeIdentity?.model ?? this.config.model ?? "default",
         };
-        if (this.config.tool_set)
-            mcpEnv.AGEND_TOOL_SET = this.config.tool_set;
+        // A general is a dispatcher, not a worker: default it to the `general` tool
+        // profile instead of `full`. Every tool's schema is resent on every API call,
+        // so full (44 tools) costs a general ~22k chars per turn — the single largest
+        // slice of its prompt. Explicit config still wins.
+        const defaultToolSet = this.config.general_topic ? "general" : undefined;
+        const toolSet = this.config.tool_set ?? defaultToolSet;
+        if (toolSet)
+            mcpEnv.AGEND_TOOL_SET = toolSet;
         if (this.config.display_name)
             mcpEnv.AGEND_DISPLAY_NAME = this.config.display_name;
         if (this.config.description)
@@ -2230,6 +2999,7 @@ export class Daemon extends EventEmitter {
             },
             skipPermissions: this.config.skipPermissions,
             model: this.modelOverride ?? this.config.model,
+            effort: this.config.effort,
             kiroUi: this.config.kiro_ui,
             skipResume: this.skipResume,
             instructions,
@@ -2255,7 +3025,9 @@ export class Daemon extends EventEmitter {
         // Small delay to let the CLI fully render its ready prompt
         await new Promise(r => setTimeout(r, 1_000));
         try {
-            await this.tmux.pasteText(`[system:session-snapshot]\n${snapshot}\n\nThis is a background context restore — do NOT reply to or acknowledge this message. Simply resume normal operation when the next user or instance message arrives.`);
+            // Messages can arrive during a restart and be queued on pasteLock before the
+            // snapshot lands; both write to the pane, so both go through the same lock.
+            await this.paneWriteLock.run(() => this.tmux.pasteText(`[system:session-snapshot]\n${snapshot}\n\nThis is a background context restore — do NOT reply to or acknowledge this message. Simply resume normal operation when the next user or instance message arrives.`, this.systemPasteOptions()));
             this.logger.info("Injected session snapshot as first message");
             this.emit("snapshot_injected", this.name);
         }
@@ -2264,9 +3036,69 @@ export class Daemon extends EventEmitter {
             this.emit("snapshot_failed", this.name);
         }
     }
+    /**
+     * Depth, not a flag: the wake path marks a spawn and then calls trySpawn, which
+     * marks another. With a plain boolean the inner one's completion would clear the
+     * latch while the outer spawn was still dismissing dialogs, releasing delivery
+     * into exactly the window this exists to close.
+     */
+    beginSpawn() {
+        this.spawnDepth++;
+        this.spawning = true;
+        if (!this.spawnSettled) {
+            this.spawnSettled = new Promise(resolve => { this.resolveSpawnSettled = resolve; });
+        }
+    }
+    endSpawn() {
+        this.spawnDepth = Math.max(0, this.spawnDepth - 1);
+        if (this.spawnDepth > 0)
+            return; // an enclosing spawn is still running
+        this.spawning = false;
+        const resolve = this.resolveSpawnSettled;
+        this.spawnSettled = null;
+        this.resolveSpawnSettled = null;
+        resolve?.();
+    }
+    /**
+     * Hold until the CLI has finished starting up.
+     *
+     * Startup is not a quiet period: `dismissDialogsUntilReady` is clicking through
+     * trust prompts and session pickers. A pane showing a modal dialog produces no
+     * output, so `waitUntilIdle` reports it idle and a queued message gets pasted
+     * *into the dialog* — where the text is discarded and the Enter picks a menu
+     * item. The paste and the Enter both "succeed", so this loses the message
+     * without even a ❌.
+     *
+     * The pane write lock (#414) does not cover this: it serialises each key
+     * sequence, but it is released between one dialog and the next.
+     *
+     * Bounded, and called BEFORE the pane lock is taken — waiting on the spawn while
+     * holding the lock the spawn itself needs would deadlock.
+     */
+    async waitForSpawnToSettle() {
+        const settled = this.spawnSettled;
+        if (!settled)
+            return;
+        this.logger.debug("Holding delivery until the CLI has finished starting up");
+        let timer;
+        const cap = new Promise(resolve => {
+            timer = setTimeout(resolve, SPAWN_SETTLE_MAX_WAIT_MS);
+            timer.unref?.();
+        });
+        try {
+            await Promise.race([settled, cap]);
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+        if (this.spawning) {
+            this.logger.warn("CLI still starting after the delivery hold — delivering anyway");
+        }
+    }
     /** Spawn a CLI window. Returns true if --resume was used successfully. */
     async spawnClaudeWindow() {
-        this.spawning = true;
+        this.beginSpawn();
         let resumedSuccessfully = false;
         try {
             this.toolStatusLines = [];
@@ -2303,7 +3135,7 @@ export class Daemon extends EventEmitter {
             this.backgroundSessionRecoveryAttempted = false;
         }
         finally {
-            this.spawning = false;
+            this.endSpawn();
         }
         return resumedSuccessfully;
     }
@@ -2374,11 +3206,13 @@ export class Daemon extends EventEmitter {
         // the global web token) from impersonating instances.
         const agentTokenPath = join(this.instanceDir, "agent.token");
         const agentToken = randomBytes(32).toString("hex");
-        writeFileSync(agentTokenPath, agentToken, { mode: 0o600 });
-        try {
-            chmodSync(agentTokenPath, 0o600);
+        const tokenWrite = writeSecretFile(agentTokenPath, agentToken);
+        if (!tokenWrite.ok) {
+            // Do not fail the spawn over it — an instance that cannot start is worse
+            // than one whose token is readable. But say so, loudly: the whole point of
+            // this token is that other local processes cannot use it.
+            this.logger.error({ path: agentTokenPath, mode: tokenWrite.mode?.toString(8), reason: tokenWrite.reason }, "Agent token file is not owner-only — other local users can impersonate this instance");
         }
-        catch { }
         // AGEND_HOME points the child's agent-cli at the same data dir the daemon
         // is using, so it can locate <instanceDir>/agent.token.
         const agendHome = join(this.instanceDir, "..", "..");
@@ -2396,7 +3230,12 @@ export class Daemon extends EventEmitter {
             windowId = this.tmux.getWindowId();
         }
         else {
+            // A crash respawn makes a brand new window. The dead one stays registered
+            // unless we say so — the respawn branch above already does.
+            const retired = this.tmux.getWindowId();
             windowId = await this.tmux.createWindow(cmd, resolvedCwd, this.name);
+            if (retired && retired !== windowId)
+                this.controlClient?.unregisterWindow(retired);
         }
         writeFileSync(join(this.instanceDir, "window-id"), windowId);
         // Enable remain-on-exit to capture exit codes on crash
@@ -2462,15 +3301,20 @@ export class Daemon extends EventEmitter {
                 for (const dialog of startupDialogs) {
                     if (dialog.pattern.test(pane)) {
                         this.logger.debug(`Dismissing startup dialog: ${dialog.description}`);
-                        for (const key of dialog.keys) {
-                            if (key === "Up" || key === "Down" || key === "Enter" || key === "Escape") {
-                                await this.tmux.sendSpecialKey(key);
+                        // Restart is exactly when inbound messages pile up, and nothing gates
+                        // delivery on `spawning`. Take the pane lock for the key sequence so a
+                        // queued message cannot be pasted into a half-dismissed trust dialog.
+                        await this.paneWriteLock.run(async () => {
+                            for (const key of dialog.keys) {
+                                if (key === "Up" || key === "Down" || key === "Enter" || key === "Escape") {
+                                    await this.tmux.sendSpecialKey(key);
+                                }
+                                else {
+                                    await this.tmux.sendKeys(key);
+                                }
+                                await new Promise(r => setTimeout(r, 200));
                             }
-                            else {
-                                await this.tmux.sendKeys(key);
-                            }
-                            await new Promise(r => setTimeout(r, 200));
-                        }
+                        });
                         // Wait for next screen to render
                         if (this.controlClient) {
                             const wid = readFileSync(join(this.instanceDir, "window-id"), "utf-8").trim();