@songsid/agend 2.1.4-beta.9 → 2.1.4

package/dist/daemon.js

@@ -9,6 +9,7 @@ import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
 import { TmuxManager, resolveTmuxLogicalSize } from "./tmux-manager.js";
 import { TranscriptMonitor } from "./transcript-monitor.js";
 import { createTranscriptSource } from "./transcript-sources.js";
+import { LOGIN_FLOWS } from "./login-flows.js";
 import { ProgressAccumulator, summarizeProgress } from "./tool-progress.js";
 import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
@@ -21,6 +22,8 @@ import { HangDetector } from "./hang-detector.js";
 import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
 import { buildFleetInstructions } from "./instructions.js";
+import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata, } from "./cross-instance-envelope.js";
+import { bottomRowIsReady, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -47,6 +50,10 @@ export function buildInstructionReloadNotice(binaryName, instanceName, instanceD
 export const DEFAULT_STUCK_TIMEOUT_MS = 10 * 60_000;
 export const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2_000;
 export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
+/** Coalesce one cosmetic-redraw burst before comparing the visible pane. */
+export const PERIODIC_REDRAW_PROBE_MS = 25;
+/** A foreground server/port-forward should hand control back or be acknowledged. */
+export const DEFAULT_BLOCKING_PROCESS_GRACE_MS = 2 * 60_000;
 const LAST_INBOUND_FILE = "last-inbound-at";
 /** Minimum gap between "health check is failing" notifications for one instance. */
 const HEALTH_ERROR_NOTIFY_INTERVAL_MS = 10 * 60_000;
@@ -133,19 +140,7 @@ export function writeLastInboundAt(instanceDir, timestamp) {
  * message_id line.
  */
 export function renderHandoffMetadata(meta) {
-    const rows = [];
-    const add = (label, value) => {
-        if (value && value.trim())
-            rows.push(`${label}: ${value.trim()}`);
-    };
-    add("message_id", meta.message_id);
-    add("correlation_id", meta.correlation_id);
-    add("request_kind", meta.request_kind);
-    add("task_summary", meta.task_summary);
-    add("working_directory", meta.working_directory);
-    add("branch", meta.branch);
-    add("attachment_file_id", meta.attachment_file_id);
-    return rows.length ? `\n(${rows.join(" | ")})` : "";
+    return renderCrossInstanceHandoffMetadata(meta);
 }
 /** Headless inactivity timer used by the daemon and unit tests. */
 export class AutoPauseController {
@@ -159,6 +154,11 @@ export class AutoPauseController {
     recordActivity(now = Date.now()) {
         this.lastActivityAt = now;
     }
+    /** Apply a new idle threshold and start a fresh countdown from this update. */
+    reconfigure(thresholdMs, now = Date.now()) {
+        this.thresholdMs = Math.max(0, thresholdMs);
+        this.lastActivityAt = now;
+    }
     observe(state, now = Date.now()) {
         if (this.pausedAt !== null || this.thresholdMs <= 0)
             return false;
@@ -281,9 +281,11 @@ export class PaneStateMachine {
      *   working" and a finished turn would not be seen as idle until the next 60s
      *   safety sweep. Output timestamps are the honest liveness signal here, and
      *   the caller has them.
+     * @param opts.forceBusy the backend has positively identified a still-running
+     *   foreground tool even though its TUI keeps an old ready footer visible.
      */
     observe(pane, now = Date.now(), opts = {}) {
-        const { settled = false, changeAt = now } = opts;
+        const { settled = false, changeAt = now, forceBusy = false } = opts;
         const paneHash = createHash("sha256").update(pane).digest("hex");
         const firstObservation = this.lastPaneHash === null;
         const paneChanged = this.lastPaneHash !== paneHash;
@@ -292,7 +294,10 @@ export class PaneStateMachine {
             this.lastPaneChangeAt = changeAt;
         }
         this.lastObservedAt = now;
-        const ready = this.isReady(pane);
+        // Some TUIs keep their ready footer visible while a foreground tool owns
+        // stdin. Backends can positively identify that tool from the pane; in that
+        // case the old prompt must not clear pending work or retire Cancel.
+        const ready = !forceBusy && this.isReady(pane);
         const nextState = firstObservation
             ? ready ? "idle" : "working"
             : paneChanged && !settled
@@ -354,6 +359,33 @@ export class PendingWorkTracker {
     }
 }
 const NORMAL_ENTER_SETTLE_MS = 500;
+/** Bottom-ready re-poll cadence for Enter-dropping TUIs once the pane is quiet. */
+const BOTTOM_READY_POLL_MS = 250;
+/** Consecutive unreadable pane probes tolerated by the delivery gate before the delivery is failed (≈10s at the poll cadence). */
+const DIALOG_PROBE_UNKNOWN_MAX = 40;
+/** Startup dialog scan: poll cadence and wall-clock budget (keys and waits included). */
+const STARTUP_DIALOG_POLL_MS = 500;
+const STARTUP_DIALOG_BUDGET_MS = 30_000;
+/** A blocking dialog still on screen this long after first being seen is reported for a human. */
+const DIALOG_PARKED_NOTIFY_MS = 60_000;
+/** How many "dialog painted just before the write → wait → retry" rounds a delivery tolerates. */
+const LATE_DIALOG_WRITE_ROUNDS = 3;
+/**
+ * Startup failed because the CLI's backend is unreachable (see backend-outage.ts).
+ * The session-id is deliberately KEPT; the fleet schedules a delayed retry.
+ */
+export class BackendUnreachableStartupError extends Error {
+    backend;
+    constructor(backend) {
+        super(`CLI failed to start: the ${backend} backend is unreachable — session kept for a later retry`);
+        this.backend = backend;
+        this.name = "BackendUnreachableStartupError";
+    }
+}
+/** Bounded wait (under the pane lock) for the prompt to return before retrying a dropped Enter. */
+const STRANDED_RETRY_READY_WAIT_MS = 30_000;
+/** Max "stranded text → submit → wait for prompt → re-check" rounds per delivery; each may send one recovery Enter. */
+const STRANDED_INPUT_MAX_ROUNDS = 3;
 const FIRST_ENTER_SETTLE_MS = 1_750;
 const FIRST_DELIVERY_WINDOW_MS = 5_000;
 /** After busy native-queue paste+Enter, wait before checking the pane for silent loss. */
@@ -531,6 +563,66 @@ export function extractProxyReplyText(pane, opts = {}) {
     // The end of the turn is the answer — when over budget, keep the tail.
     return text.length > maxChars ? text.slice(text.length - maxChars) : text;
 }
+/**
+ * Find the narrow Claude XML failure signature reported in #648.
+ *
+ * This intentionally runs only at the daemon's busy→idle edge (the caller
+ * enforces that) and only scans output after the current inbound marker. A
+ * partial tool call while Claude is still streaming is therefore never acted
+ * on. The extracted argument goes through the same credential redaction as the
+ * dead-MCP pane proxy before it can leave the host.
+ */
+export function detectMalformedClaudeToolCall(pane, opts = {}) {
+    let clean = pane
+        .replace(/\x1B(?:[@-Z\\-_]|\[[0-?]*[ -/]*[@-~])/g, "")
+        .replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");
+    const marker = opts.inboundMarker?.trim();
+    if (marker) {
+        const markerAt = clean.lastIndexOf(marker);
+        if (markerAt >= 0)
+            clean = clean.slice(markerAt + marker.length);
+    }
+    const lines = clean.split(/\r?\n/).slice(-(opts.maxLines ?? 120));
+    const tail = lines.join("\n");
+    const closingTags = [...tail.matchAll(/<\/(?:parameter|invoke|function_calls)>/gi)];
+    if (closingTags.length === 0)
+        return null;
+    const parameterOpen = /<parameter\b[^>]*\bname\s*=\s*["']text["'][^>]*>/gi;
+    const parameterOpens = [...tail.matchAll(parameterOpen)];
+    const open = parameterOpens.at(-1);
+    if (!open || open.index === undefined) {
+        // Base stale suppression on the XML artifact itself, not unrelated pane
+        // redraws appended after it. The occurrence counts still distinguish a
+        // genuinely new identical malformed call while both remain visible.
+        const signature = createHash("sha256")
+            .update(`0:${closingTags.length}:${closingTags.map(tag => tag[0].toLowerCase()).join(":")}`)
+            .digest("hex");
+        return { signature, text: null };
+    }
+    const contentAt = open.index + open[0].length;
+    const closeAt = tail.slice(contentAt).search(/<\/parameter>/i);
+    if (closeAt < 0) {
+        const signature = createHash("sha256")
+            .update(`${parameterOpens.length}:${closingTags.length}:${open[0]}`)
+            .digest("hex");
+        return { signature, text: null };
+    }
+    const fragment = tail.slice(contentAt, contentAt + closeAt);
+    // Fingerprint only the malformed XML artifact; never put its contents in logs.
+    const signature = createHash("sha256")
+        .update(`${parameterOpens.length}:${closingTags.length}:${open[0]}${fragment}</parameter>`)
+        .digest("hex");
+    let text = sanitizePaneTail(fragment, opts.maxLines ?? 120)
+        .join("\n")
+        .replace(/\n{3,}/g, "\n\n")
+        .trim();
+    if (text.replace(/[^\p{L}\p{N}]/gu, "").length < 2)
+        return { signature, text: null };
+    const maxChars = opts.maxChars ?? 12_000;
+    if (text.length > maxChars)
+        text = text.slice(0, maxChars);
+    return { signature, text };
+}
 const INTERACTIVE_PROMPT_PATTERNS = [
     { kind: "sudo_password", pattern: /^\s*\[sudo\]\s+password\s+for\s+[^:\n]+:\s*$/im },
     // macOS sudo and several package installers use this exact no-echo prompt.
@@ -593,6 +685,69 @@ export class InteractivePromptDetector {
         this.notifiedSignature = null;
     }
 }
+const BLOCKING_PROCESS_PATTERNS = [
+    // kubectl port-forward (including a backgrounded child whose inherited
+    // stdout keeps the parent shell tool open).
+    /^\s*(?:Forwarding from\s+(?:127\.0\.0\.1|localhost|\[::1\]):\d+\s+->\s+\d+|Handling connection for\s+\d+)\s*$/im,
+    // Common development servers. Keep these line-shaped and require an address
+    // or port so prose such as "the server is running" does not arm the detector.
+    /^\s*(?:(?:INFO:\s*)?Uvicorn running on|Serving HTTP on|Listening on|Server (?:is )?(?:listening|running) (?:at|on)|Application startup complete[^\n]*(?:port|https?:\/\/))[^\n]*(?:https?:\/\/|\b(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::\]|port)\b)[^\n]*$/im,
+];
+/**
+ * Detect a foreground shell tool which has become a long-lived server.
+ *
+ * Unlike the generic pane-stuck clock, this clock deliberately survives new
+ * output: access logs and `Handling connection` lines are exactly why a
+ * foreground server can remain blocked forever without ever looking silent.
+ * Once a server marker is seen, the still-running tool identity is the stable
+ * signal; the marker may scroll out of the 32-row pane.
+ */
+export class BlockingProcessDetector {
+    graceMs;
+    activity = null;
+    evidence = null;
+    detectedAt = 0;
+    notified = false;
+    constructor(graceMs = DEFAULT_BLOCKING_PROCESS_GRACE_MS) {
+        this.graceMs = graceMs;
+    }
+    observe(pane, activity, now = Date.now()) {
+        const shellActivity = activity && /^(?:shell|bash|exec_command|terminal|command)(?::|$)/i.test(activity);
+        if (!shellActivity) {
+            this.reset();
+            return null;
+        }
+        if (activity !== this.activity) {
+            this.reset();
+            this.activity = activity;
+        }
+        if (!this.evidence) {
+            const tail = sanitizePaneTail(pane, 40).join("\n");
+            for (const pattern of BLOCKING_PROCESS_PATTERNS) {
+                const match = tail.match(pattern);
+                if (!match)
+                    continue;
+                this.evidence = match[0].trim().slice(0, 200);
+                this.detectedAt = now;
+                break;
+            }
+        }
+        if (!this.evidence || this.notified || now - this.detectedAt < this.graceMs)
+            return null;
+        this.notified = true;
+        return {
+            activity,
+            evidence: this.evidence,
+            blockedForMs: now - this.detectedAt,
+        };
+    }
+    reset() {
+        this.activity = null;
+        this.evidence = null;
+        this.detectedAt = 0;
+        this.notified = false;
+    }
+}
 export class Daemon extends EventEmitter {
     name;
     config;
@@ -601,6 +756,9 @@ export class Daemon extends EventEmitter {
     backend;
     controlClient;
     runtimeIdentity;
+    spawnGate;
+    stormWindow;
+    backendOutage;
     logger;
     tmuxSessionName;
     tmux = null;
@@ -610,6 +768,13 @@ export class Daemon extends EventEmitter {
     guardian = null;
     adapter = null;
     pendingIpcRequests = new Map();
+    /**
+     * Daemon-global request sequence. MCP request ids are only process-local:
+     * Claude can have more than one MCP child connected to the same daemon and
+     * each starts at 1, so using requestId alone lets one caller steal another's
+     * response.
+     */
+    fleetRequestSeq = 0;
     // Track chatId/threadId from inbound messages for automatic outbound routing
     lastChatId;
     lastThreadId;
@@ -620,10 +785,12 @@ export class Daemon extends EventEmitter {
     currentActivity = null;
     // Session identity: map IPC socket → sessionName (from mcp_ready)
     socketSessionNames = new Map();
-    // Crash recovery
-    static tmuxServerCrashTimestamps = [];
-    static tmuxServerPaused = false;
-    static tmuxServerRecoveryTimer = null;
+    /** pid each connected MCP server announced in mcp_ready (or pong); keyed like socketSessionNames. */
+    socketPids = new Map();
+    mcpPingSeq = 0;
+    mcpPingWaiters = new Map();
+    // Crash recovery is fleet-owned; all daemon objects share the coordinators
+    // injected by FleetManager below.
     healthCheckTimer = null;
     crashCount = 0;
     lastCrashAt = 0;
@@ -644,6 +811,12 @@ export class Daemon extends EventEmitter {
     resolveSpawnSettled = null;
     spawnDepth = 0;
     skipResume = false;
+    startupAborted = false;
+    /** First time the current on-screen blocking dialog was seen (0 = none); drives the parked report. */
+    dialogParkedSince = 0;
+    /** Identity of that dialog: its pattern, not its description (two tables may describe one screen differently). */
+    dialogParkedKey = null;
+    dialogParkedReported = false;
     backgroundSessionRecoveryAttempted = false;
     /** Whether the last spawn started a fresh session (not resumed). */
     isNewSession = false;
@@ -657,6 +830,7 @@ export class Daemon extends EventEmitter {
     /** Fallback safety sweep used only when no shared tmux control client exists. */
     instanceStateMonitorTimer = null;
     instanceStateIdleTimer = null;
+    instanceStateOutputProbeTimer = null;
     instanceStateStuckTimer = null;
     instanceStateOutputListener = null;
     instanceStateOutputEventName = null;
@@ -675,8 +849,12 @@ export class Daemon extends EventEmitter {
     // between, the agent's answer exists only on screen — the daemon relays it.
     turnHadInbound = false;
     turnOutboundDelivered = false;
+    /** Successful `reply` specifically; cross-instance tools do not satisfy #648. */
+    turnReplyDelivered = false;
     turnCorrelationId;
     turnInboundMarker;
+    /** Prevent a visible stale XML fragment from being recovered on later turns. */
+    lastMalformedToolCallSignature;
     proxyReplySeq = 0;
     autoPauseController;
     pauseRequested = false;
@@ -687,6 +865,35 @@ export class Daemon extends EventEmitter {
      * would silently no-op exactly when we most need to stop feeding the CLI.
      */
     pausePending = false;
+    /**
+     * An auth failure was detected and nothing has resolved it yet.
+     *
+     * Separate from `pausePending` because it must outlive it: the deferred pause
+     * clears `pausePending` as soon as it fires, but if that pause is refused the
+     * instance is still auth-broken and must not resume raising alarms.
+     */
+    authFailureUnresolved = false;
+    /** One login-screen auth report per spawn — the screen persists across polls. */
+    loginScreenReported = false;
+    /** A fatal startup screen (see StartupDialog.fatal) was already reported this run. */
+    fatalStartupReported = false;
+    /**
+     * The CLI is parked on a fatal startup screen and every pane write must be
+     * refused. This is deliberately separate from the pause that the reported
+     * pty_error triggers: the pause is applied by an async handler, and a queued
+     * delivery would race it into the modal (where paste+Enter can confirm
+     * "Exit and fix manually"). Set synchronously at dialog-match time; cleared
+     * when a startup scan reaches a real ready prompt, or on wake().
+     */
+    fatalStartupBlocked = false;
+    /** model_error seen mid-turn: notify only if it survives to the idle screen. */
+    pendingModelErrorKey = null;
+    /**
+     * Let the next pause() proceed from a stuck pane. Set only for the auth-deferred
+     * pause — see the pausePending consumption site for why waiting for idle there
+     * is waiting forever.
+     */
+    pauseAllowStuck = false;
     pauseWakeState = "active";
     pauseWakeTransition = null;
     // Model failover: override model on next spawn when rate-limited
@@ -700,6 +907,12 @@ export class Daemon extends EventEmitter {
      *  and ⏳/👀/✅ reactions live here). It does NOT cover the other writers that
      *  reach the pane — {@link paneWriteLock} does. */
     pasteLock = Promise.resolve();
+    /**
+     * Fleet cancellation epoch. Queue entries retain the epoch they arrived with;
+     * advancing it invalidates only work received before the cancel, never a new
+     * user message which arrives immediately afterwards.
+     */
+    deliveryEpoch = 0;
     /** Mutual exclusion for *every* write into the pane, whichever subsystem it
      *  comes from. See PaneWriteLock for why interleaving is destructive. */
     paneWriteLock = new PaneWriteLock();
@@ -727,7 +940,9 @@ export class Daemon extends EventEmitter {
     // PTY error pattern monitoring
     errorMonitorTimer = null;
     interactivePromptDetector = new InteractivePromptDetector();
+    blockingProcessDetector = new BlockingProcessDetector();
     /** Same 5-min gate the error monitor uses, so a dead MCP server alerts once. */
+    static MCP_PING_TIMEOUT_MS = 2_000;
     static MCP_DEATH_COOLDOWN_MS = 5 * 60_000;
     lastMcpDeathNotifiedAt = 0;
     mcpDeathNotifiedForPid = null;
@@ -738,6 +953,16 @@ export class Daemon extends EventEmitter {
      * past this point interrupting the turn costs less than staying mute.
      */
     static MCP_RESTART_MAX_WAIT_MS = 30 * 60_000;
+    /**
+     * How long the revival restart waits, at the point of firing, for a
+     * CLI-respawned MCP server to announce itself.
+     *
+     * Codex <0.146 tears down and recreates ALL MCP connections on an auth/config
+     * change — healthy ones included — so the daemon sees the old pid die while
+     * the CLI is fine and a replacement is seconds away. Module load measured
+     * ~0.36s, so 2s is roughly 5x headroom without making a genuine loss wait.
+     */
+    static MCP_REPLACEMENT_GRACE_MS = 2_000;
     /**
      * Sticky "restart to revive the MCP server as soon as the pane idles" — same
      * shape as pausePending, because the death is usually detected mid-turn when
@@ -746,6 +971,25 @@ export class Daemon extends EventEmitter {
      */
     mcpRestartPending = false;
     mcpRestartStaleTimer = null;
+    /** In-flight replacement grace; also the guard against three triggers stacking. */
+    mcpRestartGraceTimer = null;
+    /**
+     * Which trigger the in-flight grace will commit under.
+     *
+     * The single-timer guard would otherwise SWALLOW a stale_timeout that lands
+     * during an idle-gated grace — and because the stale timer is one-shot and
+     * already cleared itself, the 30-minute backstop would be gone for good on an
+     * instance that never idles, which is the exact case it exists for.
+     */
+    mcpRestartGraceTrigger = null;
+    /**
+     * A dead-MCP sighting held back once, pending a possible replacement.
+     *
+     * Deliberately NOT the same field as `mcpDeathNotifiedForPid`: deferring must
+     * not consume the once-per-pid budget, or a suspicion that turns out to be a
+     * real loss could never be reported at all.
+     */
+    mcpDeathDeferredForPid = null;
     /** Prevent in-flight monitor callbacks from re-arming after a pause. */
     runtimeMonitorsFrozen = false;
     errorWaitingForRecovery = false; // true = error detected, waiting for ready pattern
@@ -754,7 +998,7 @@ export class Daemon extends EventEmitter {
     activeErrorPatternKey = null;
     /** Whether this instance is in an abnormal error state (auto-pause is normal). */
     get isErrorState() {
-        return this.errorWaitingForRecovery || (this.healthCheckPaused && !this.isPaused) || Daemon.tmuxServerPaused;
+        return this.errorWaitingForRecovery || (this.healthCheckPaused && !this.isPaused) || this.stormWindow?.isActive() === true;
     }
     get isPaused() { return this.pauseWakeState !== "active"; }
     /** Current CLI process state for status surfaces and recovery commands. */
@@ -794,7 +1038,9 @@ export class Daemon extends EventEmitter {
         this.errorRecoveryDeadlineAt = 0;
         this.activeErrorPatternKey = null;
     }
-    constructor(name, config, instanceDir, topicMode = false, backend, controlClient, rootLogger, runtimeIdentity) {
+    constructor(name, config, instanceDir, topicMode = false, backend, controlClient, rootLogger, runtimeIdentity, spawnGate, stormWindow, 
+    /** Fleet-level "is this CLI's backend down?" memory — see backend-outage.ts. */
+    backendOutage) {
         super();
         this.name = name;
         this.config = config;
@@ -803,6 +1049,9 @@ export class Daemon extends EventEmitter {
         this.backend = backend;
         this.controlClient = controlClient;
         this.runtimeIdentity = runtimeIdentity;
+        this.spawnGate = spawnGate;
+        this.stormWindow = stormWindow;
+        this.backendOutage = backendOutage;
         if (!rootLogger)
             throw new Error("Daemon requires a shared root logger");
         this.runtimeIdentity ??= {
@@ -891,20 +1140,10 @@ export class Daemon extends EventEmitter {
                 this.handleToolCall(msg, socket);
             }
             else if (msg.type === "mcp_ready") {
-                const sessionName = msg.sessionName;
-                if (sessionName) {
-                    this.socketSessionNames.set(socket, sessionName);
-                    socket.on("close", () => {
-                        this.socketSessionNames.delete(socket);
-                        // Notify fleet manager so it can clean up sessionRegistry
-                        if (sessionName !== this.name) {
-                            this.ipcServer?.broadcast({ type: "session_disconnected", sessionName });
-                        }
-                    });
-                }
-                this.logger.debug({ sessionName }, "MCP channel server connected and ready");
-                // Notify FleetManager's IPC client that MCP is ready
-                this.ipcServer?.broadcast({ type: "mcp_ready", sessionName });
+                this.handleMcpReady(msg, socket);
+            }
+            else if (msg.type === "pong") {
+                this.handleMcpPong(msg, socket);
             }
             else if (msg.type === "query_sessions") {
                 // Fleet manager asks for all registered session names (catches sessions
@@ -924,47 +1163,38 @@ export class Daemon extends EventEmitter {
                 // Fleet manager routed a message to us (topic mode)
                 const meta = msg.meta;
                 const targetSession = msg.targetSession;
+                const deliveryEpoch = this.captureDeliveryEpoch(msg.delivery_epoch);
                 void this.wake().then(() => {
-                    this.pushChannelMessage(msg.content, meta, targetSession);
+                    this.pushChannelMessage(msg.content, meta, targetSession, deliveryEpoch);
                 }).catch(err => {
                     this.logger.error({ err: err.message }, "Wake failed for inbound delivery");
                 });
             }
             else if (msg.type === "raw_paste") {
                 // Paste raw text directly to CLI without [user:] wrapping.
-                if (this.tmux) {
-                    const rawText = msg.content;
-                    this.pasteLock = this.pasteLock.then(async () => {
-                        await this.wake();
-                        await this.deliverMessage(rawText);
-                        this.logger.debug({ text: rawText.slice(0, 100) }, "Raw paste delivered");
-                    }).catch(err => {
-                        this.logger.warn({ err: err.message }, "raw_paste delivery error");
-                    });
-                }
+                this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch), msg.confirm_clear === true);
+            }
+            else if (msg.type === "config_update") {
+                this.applyConfigUpdate(msg.config);
             }
             else if (msg.type === "steer") {
                 const meta = (msg.meta ?? {});
-                this.steerMessage(msg.content, meta);
+                this.steerMessage(msg.content, meta, this.captureDeliveryEpoch(msg.delivery_epoch));
+            }
+            else if (msg.type === "btw") {
+                const meta = (msg.meta ?? {});
+                this.btwMessage(msg.content, meta, this.captureDeliveryEpoch(msg.delivery_epoch));
             }
             else if (msg.type === "fleet_schedule_trigger") {
                 const payload = msg.payload;
                 const meta = msg.meta;
-                void this.wake().then(() => this.pushChannelMessage(payload.message, meta)).catch(err => {
+                const deliveryEpoch = this.captureDeliveryEpoch(msg.delivery_epoch);
+                void this.wake().then(() => this.pushChannelMessage(payload.message, meta, undefined, deliveryEpoch)).catch(err => {
                     this.logger.error({ err: err.message }, "Wake failed for scheduled delivery");
                 });
             }
             else if (msg.type === "query_instance_state") {
-                const snapshot = this.getInstanceStateSnapshot();
-                this.ipcServer?.send(socket, {
-                    type: "instance_state_response",
-                    requestId: msg.requestId,
-                    instanceName: this.name,
-                    ...snapshot,
-                    state: this.isPaused ? "paused" : snapshot.state,
-                    processStatus: this.processStatus,
-                    pausedAt: this.lastPausedAt,
-                });
+                void this.respondToInstanceStateQuery(msg, socket);
             }
         });
         // 2. Tmux — ensure session, create window if not alive
@@ -1133,30 +1363,119 @@ export class Daemon extends EventEmitter {
      * process would have no client reading it. Only the CLI can restore its own
      * tools — hence notify, and let the operator decide about restarting.
      */
+    /**
+       * An MCP server has connected and announced itself.
+       *
+       * Beyond the existing session bookkeeping this is the earliest evidence that
+       * tools are back — roughly 30s ahead of the next health tick, which is
+       * exactly the window #663's false restarts fired in.
+       */
+    handleMcpReady(msg, socket) {
+        const sessionName = msg.sessionName;
+        if (typeof msg.pid === "number")
+            this.socketPids.set(socket, msg.pid);
+        if (sessionName) {
+            this.socketSessionNames.set(socket, sessionName);
+            socket.on("close", () => {
+                this.socketSessionNames.delete(socket);
+                this.socketPids.delete(socket);
+                // Notify fleet manager so it can clean up sessionRegistry
+                if (sessionName !== this.name) {
+                    this.ipcServer?.broadcast({ type: "session_disconnected", sessionName });
+                }
+            });
+        }
+        this.logger.debug({ sessionName, pid: msg.pid }, "MCP channel server connected and ready");
+        // Gated on ownership: this ipcServer also accepts EXTERNAL sessions (a
+        // `claude` run in another directory registers as `external-<cwd>-<pid>`).
+        // Without the gate an unrelated session could stand down a restart armed
+        // for THIS instance's genuinely dead server. The liveness re-read below is
+        // a second guard, but ownership is the one that is semantically right.
+        if (sessionName === this.name) {
+            // A server for THIS instance just connected: that is proof of life at
+            // the IPC layer, whatever channel.mcp.pid says (a replacement or a
+            // sub-agent's server may have left a dead pid in the slot).
+            this.noteMcpProofOfLife("mcp_ready", typeof msg.pid === "number" ? msg.pid : undefined);
+        }
+        this.ipcServer?.broadcast({ type: "mcp_ready", sessionName });
+    }
     checkMcpServerAlive() {
         if (this.isPaused)
             return;
         const status = mcpServerState(this.instanceDir);
-        if (status.state === "unknown")
-            return;
         if (status.state === "alive") {
+            if (this.mcpDeathNotifiedForPid != null)
+                this.emitMcpRecovered("pid", status.pid);
             this.mcpDeathNotifiedForPid = null; // the CLI respawned it — re-arm
+            this.mcpDeathDeferredForPid = null;
             this.clearMcpRestartRequest(); // tools are back — stand down a pending auto-restart
             return;
         }
+        // The pid slot does not name a live process — dead, or missing. It is a
+        // single last-writer slot shared by every mcp-server process of this
+        // instance (a CLI-driven replacement, a sub-agent's server), so "that pid
+        // is gone" is not "no server is serving", and "the last writer exited
+        // cleanly and unlinked its slot" is not "nothing ever started". Ask the
+        // IPC layer — the one thing every serving mcp-server must hold — before
+        // deciding. Reproduced deterministically: two servers, SIGKILL the last
+        // writer, the other keeps serving while the slot reads DEAD forever; or
+        // the last writer exits cleanly and the slot stays MISSING, so the
+        // survivor's later real death would never be seen.
+        const sockets = this.liveMcpSockets();
+        if (sockets.length > 0) {
+            const livePid = this.socketPids.get(sockets[sockets.length - 1]);
+            const stalePid = status.state === "dead" ? status.pid : undefined;
+            this.logger.info({ slot: status.state, stalePid, livePid, connections: sockets.length }, "channel.mcp.pid does not name a live process, but a live MCP connection still serves this instance — not an incident");
+            this.repairMcpPidSlot(livePid, status.state === "dead" ? "stale pid slot" : "missing pid slot");
+            this.pingMcpSockets(sockets);
+            this.noteMcpProofOfLife("connection", livePid);
+            return;
+        }
+        if (status.state === "unknown")
+            return; // never started, or nothing left to watch — as before
         // Dead: report once per pid, and at most once per cooldown window.
         if (this.mcpDeathNotifiedForPid === status.pid)
             return;
+        // An auth-broken CLI cannot keep an MCP server alive, and restarting it
+        // only loops back to the sign-in screen — hold the auto-restart until a
+        // re-login (which restarts the instance and replaces this daemon anyway).
+        const authSuspected = this.authFailureUnresolved;
+        const autoRestart = this.config.mcp_auto_restart !== false && !authSuspected;
+        // Codex <0.146 kills and recreates its MCP connections wholesale, so the
+        // FIRST sighting of a dead pid under a live Codex is more likely a swap
+        // than a loss. Hold the alarm for one tick — only the alarm: the restart is
+        // still armed, and the chokepoint's re-read cancels it if the replacement
+        // arrives. Not generalised to other backends, where a dead MCP under a live
+        // CLI is a genuine incident that silence would mask.
+        //
+        // Crucially this does NOT touch mcpDeathNotifiedForPid or the cooldown
+        // clock: if the suspicion is wrong the incident must still be reportable.
+        if (this.suspectsTransientMcpReplacement() && this.mcpDeathDeferredForPid !== status.pid) {
+            this.mcpDeathDeferredForPid = status.pid;
+            this.logger.warn({ pid: status.pid }, "MCP server pid is gone under a live Codex — holding the alarm one tick for a possible replacement");
+            if (autoRestart)
+                this.armMcpRestartWhenIdle();
+            return;
+        }
         if (Date.now() - this.lastMcpDeathNotifiedAt < Daemon.MCP_DEATH_COOLDOWN_MS)
             return;
         this.mcpDeathNotifiedForPid = status.pid;
+        this.mcpDeathDeferredForPid = null;
         this.lastMcpDeathNotifiedAt = Date.now();
-        const autoRestart = this.config.mcp_auto_restart !== false;
-        this.logger.error({ pid: status.pid, autoRestart }, "MCP server process is gone — instance has no agend tools");
-        this.emit("mcp_died", { name: this.name, pid: status.pid, autoRestart });
+        this.logger.error({ pid: status.pid, autoRestart, authSuspected }, "MCP server process is gone — instance has no agend tools");
+        this.emit("mcp_died", { name: this.name, pid: status.pid, autoRestart, authSuspected });
         if (autoRestart)
             this.armMcpRestartWhenIdle();
     }
+    /**
+     * Whether a dead MCP pid on this backend is more likely a CLI-driven
+     * replacement than a real loss. Codex only, and deliberately narrow: it is
+     * the backend whose released fix (0.146) confirms it tore down healthy MCP
+     * connections alongside the one it meant to restart.
+     */
+    suspectsTransientMcpReplacement() {
+        return (this.config.backend ?? this.backend?.binaryName) === "codex";
+    }
     /**
      * Arm an automatic instance restart to revive a dead MCP server. Fires on the
      * next busy→idle edge — or immediately when the pane is already idle, which is
@@ -1179,21 +1498,210 @@ export class Daemon extends EventEmitter {
             this.fireMcpRestartRequest("already_idle");
         }
     }
+    /**
+     * Single chokepoint for all three revival triggers (already_idle, idle_edge,
+     * stale_timeout) — and therefore the one place worth re-checking reality.
+     *
+     * The pending flag is armed by a health tick that saw the OLD pid die, and
+     * was previously fired without ever looking again. When a CLI legitimately
+     * respawns its own MCP child, the replacement is already serving by the time
+     * the turn ends — but the idle edge fires inside the ~30s before the next
+     * health tick can stand the request down, restarting a healthy instance. One
+     * external user was restarted 18 times in two days this way (#663).
+     *
+     * Re-reading here is safe for every backend: worst case it clears a pending
+     * restart that should not have existed.
+     */
     fireMcpRestartRequest(trigger) {
-        // A recovery is already reshaping the CLI: crash-loop handling
-        // (healthCheckPaused), a respawn in flight (spawning), or a pause
-        // (isPaused / frozen monitors). Each of those paths ends in a fresh CLI —
-        // and with it a fresh MCP server — or in supervision ending, where a
-        // restart on top would fight the recovery. Either way the revival restart
-        // is moot: cancel it rather than defer it.
-        if (this.healthCheckPaused || this.spawning || this.isPaused || this.runtimeMonitorsFrozen) {
-            this.logger.warn({ trigger }, "MCP revival restart cancelled — instance is already pausing/spawning/recovering");
+        if (this.mcpRestartCancelledByRecovery(trigger))
+            return;
+        // Authoritative re-read — the CLI may have replaced the server since the
+        // health tick that armed this.
+        if (this.mcpServerAlive().alive) {
+            this.logger.info({ trigger }, "MCP revival restart stood down — a live MCP server is already serving");
+            this.clearMcpRestartRequest();
+            return;
+        }
+        // Not back yet: give a CLI-driven replacement a bounded moment rather than
+        // restarting the instance out from under it. One timer covers all three
+        // triggers; a second trigger during the wait is a no-op.
+        if (this.mcpRestartGraceTimer) {
+            // stale_timeout outranks the idle-gated triggers: it is the backstop for
+            // a turn that never ends, so it must not be lost to an in-flight grace.
+            if (trigger === "stale_timeout")
+                this.mcpRestartGraceTrigger = "stale_timeout";
+            return;
+        }
+        this.mcpRestartGraceTrigger = trigger;
+        this.mcpRestartGraceTimer = setTimeout(() => {
+            this.mcpRestartGraceTimer = null;
+            const committed = this.mcpRestartGraceTrigger ?? trigger;
+            this.mcpRestartGraceTrigger = null;
+            if (!this.mcpRestartPending || this.runtimeMonitorsFrozen)
+                return;
+            if (this.mcpRestartCancelledByRecovery(committed))
+                return;
+            if (this.mcpServerAlive().alive) {
+                this.logger.info({ trigger: committed }, "MCP revival restart stood down — replacement came up during the grace window");
+                this.clearMcpRestartRequest();
+                return;
+            }
+            // Re-check the idle gate. The grace turned what used to be a synchronous
+            // decision into a 2s window, and "idle edge, then a queued message lands"
+            // is the NORMAL ordering for queued delivery — so without this the
+            // restart tears down a turn that started during the wait. Worse than the
+            // race it replaced: the #485 proxy reply only runs at turn end, so an
+            // in-flight answer would be swallowed with no fallback. Only the
+            // 30-minute stale timer may interrupt a live turn, by design.
+            //
+            // Deliberately does NOT clear pending: the MCP really is gone, so the
+            // request must survive to the next idle edge (which re-enters here), and
+            // the stale timer keeps running underneath as the backstop.
+            if (committed !== "stale_timeout" && !(this.instanceState === "idle" && this.pasteQueueDepth === 0)) {
+                this.logger.info({ trigger: committed, instanceState: this.instanceState, pasteQueueDepth: this.pasteQueueDepth }, "MCP revival restart deferred — the pane went busy during the grace window");
+                return;
+            }
+            // The suspicion was wrong: a real loss. Report it BEFORE asking for the
+            // restart — instance-lifecycle's suppression path documents that it
+            // assumes the mcp_died notification has already gone out, and this daemon
+            // does not survive the restart to send it afterwards.
+            this.reportDeferredMcpDeath();
             this.clearMcpRestartRequest();
+            this.logger.warn({ trigger: committed }, "Requesting instance restart to revive its MCP server");
+            this.emit("mcp_restart_requested", { name: this.name, trigger: committed });
+        }, Daemon.MCP_REPLACEMENT_GRACE_MS);
+        this.mcpRestartGraceTimer.unref?.();
+    }
+    /**
+     * A recovery is already reshaping the CLI: crash-loop handling
+     * (healthCheckPaused), a respawn in flight (spawning), or a pause
+     * (isPaused / frozen monitors). Each ends in a fresh CLI — and with it a
+     * fresh MCP server — or in supervision ending, where a restart on top would
+     * fight the recovery. Either way the revival restart is moot.
+     */
+    mcpRestartCancelledByRecovery(trigger) {
+        if (!(this.healthCheckPaused || this.spawning || this.isPaused || this.runtimeMonitorsFrozen || this.stormWindow?.isActive()))
+            return false;
+        this.logger.warn({ trigger }, "MCP revival restart cancelled — instance is already pausing/spawning/recovering");
+        this.clearMcpRestartRequest();
+        return true;
+    }
+    /**
+     * Emit a dead-MCP report that was held back as a suspected replacement, once
+     * it is clear no replacement is coming. Consumes the once-per-pid budget
+     * here — deferring was to avoid spending it on a false alarm, not to drop
+     * the incident.
+     */
+    reportDeferredMcpDeath() {
+        const pid = this.mcpDeathDeferredForPid;
+        if (pid == null || this.mcpDeathNotifiedForPid === pid)
+            return;
+        if (this.mcpServerAlive().alive) {
+            this.logger.info({ pid }, "Deferred MCP death not reported — a live MCP server is serving");
+            this.mcpDeathDeferredForPid = null;
             return;
         }
+        const authSuspected = this.authFailureUnresolved;
+        const autoRestart = this.config.mcp_auto_restart !== false && !authSuspected;
+        this.mcpDeathNotifiedForPid = pid;
+        this.lastMcpDeathNotifiedAt = Date.now();
+        this.logger.error({ pid, autoRestart, authSuspected }, "MCP server process is gone — no replacement arrived, instance has no agend tools");
+        this.emit("mcp_died", { name: this.name, pid, autoRestart, authSuspected });
+    }
+    /** Socket-layer answer to pingMcpSockets(); records the pid the server reports. */
+    handleMcpPong(msg, socket) {
+        const waiter = this.mcpPingWaiters.get(msg.requestId);
+        if (waiter) {
+            this.mcpPingWaiters.delete(msg.requestId);
+            waiter(true);
+        }
+        if (typeof msg.pid === "number")
+            this.socketPids.set(socket, msg.pid);
+    }
+    /** Live IPC sockets of mcp-server processes that announced THIS instance's session. */
+    liveMcpSockets() {
+        const out = [];
+        for (const [socket, sessionName] of this.socketSessionNames) {
+            if (sessionName === this.name && !socket.destroyed)
+                out.push(socket);
+        }
+        return out;
+    }
+    /**
+     * MCP liveness with the pid slot as the first opinion and the IPC layer as
+     * the authority: a live connection from a server announcing our session is
+     * proof that tools are being served, whatever channel.mcp.pid says.
+     */
+    mcpServerAlive() {
+        const status = mcpServerState(this.instanceDir);
+        if (status.state === "alive")
+            return { alive: true, source: "pid", pid: status.pid };
+        const sockets = this.liveMcpSockets();
+        if (sockets.length > 0)
+            return { alive: true, source: "connection", pid: this.socketPids.get(sockets[sockets.length - 1]) };
+        return { alive: false, source: "none", pid: status.state === "dead" ? status.pid : undefined };
+    }
+    /** Point the pid slot at the server that is actually serving, so pid-based readers agree with the IPC layer. */
+    repairMcpPidSlot(pid, reason) {
+        if (!pid)
+            return;
+        try {
+            writeFileSync(join(this.instanceDir, "channel.mcp.pid"), String(pid));
+            this.logger.info({ pid, reason }, "channel.mcp.pid repaired to the live MCP server");
+        }
+        catch (err) {
+            this.logger.debug({ err }, "could not repair channel.mcp.pid");
+        }
+    }
+    /**
+     * Active, LLM-free confirmation: ask each live socket to answer a ping at
+     * the socket layer. Only logged — the open connection is already the
+     * decision; a missing pong means an older mcp-server build or a wedged
+     * process, and a truly dead socket closes on its own and drops out of
+     * liveMcpSockets() by the next tick.
+     */
+    pingMcpSockets(sockets) {
+        for (const socket of sockets) {
+            const requestId = ++this.mcpPingSeq;
+            const timer = setTimeout(() => {
+                if (!this.mcpPingWaiters.delete(requestId))
+                    return;
+                this.logger.warn({ pid: this.socketPids.get(socket) }, "connected MCP server did not answer ping within 2s (older mcp-server build, or wedged)");
+            }, Daemon.MCP_PING_TIMEOUT_MS);
+            timer.unref?.();
+            this.mcpPingWaiters.set(requestId, () => {
+                clearTimeout(timer);
+                this.logger.debug({ pid: this.socketPids.get(socket) }, "MCP server answered ping");
+            });
+            if (!this.ipcServer?.send(socket, { type: "ping", requestId })) {
+                this.mcpPingWaiters.delete(requestId);
+                clearTimeout(timer);
+            }
+        }
+    }
+    /**
+     * Evidence that a server for this instance is serving (mcp_ready, a tool
+     * call, a live connection). Stands down any pending revival restart and,
+     * if an alarm had already gone out, retracts it.
+     */
+    noteMcpProofOfLife(source, pid) {
+        const hadAlarm = this.mcpDeathNotifiedForPid != null;
+        const hadPending = this.mcpRestartPending || this.mcpDeathDeferredForPid != null;
+        if (!hadAlarm && !hadPending)
+            return;
+        if (hadPending)
+            this.logger.info({ source, pid }, "MCP server is serving again — standing down the pending revival restart");
+        if (hadAlarm)
+            this.emitMcpRecovered(source, pid);
+        this.mcpDeathNotifiedForPid = null;
+        this.mcpDeathDeferredForPid = null;
         this.clearMcpRestartRequest();
-        this.logger.warn({ trigger }, "Requesting instance restart to revive its MCP server");
-        this.emit("mcp_restart_requested", { name: this.name, trigger });
+        if (pid && mcpServerState(this.instanceDir).state !== "alive")
+            this.repairMcpPidSlot(pid, source);
+    }
+    emitMcpRecovered(source, pid) {
+        this.logger.info({ source, pid }, "MCP server recovered — retracting the earlier death report");
+        this.emit("mcp_recovered", { name: this.name, source, pid });
     }
     clearMcpRestartRequest() {
         this.mcpRestartPending = false;
@@ -1201,6 +1709,11 @@ export class Daemon extends EventEmitter {
             clearTimeout(this.mcpRestartStaleTimer);
             this.mcpRestartStaleTimer = null;
         }
+        if (this.mcpRestartGraceTimer) {
+            clearTimeout(this.mcpRestartGraceTimer);
+            this.mcpRestartGraceTimer = null;
+        }
+        this.mcpRestartGraceTrigger = null;
     }
     startHealthCheck() {
         if (this.runtimeMonitorsFrozen || this.healthCheckTimer)
@@ -1234,7 +1747,7 @@ export class Daemon extends EventEmitter {
                         this.emitSupervisionEnded("instance directory was removed from disk", "Recreate the instance, or delete it from fleet.yaml.");
                         return;
                     }
-                    if (!this.tmux || this.spawning || this.healthCheckPaused || Daemon.tmuxServerPaused) {
+                    if (!this.tmux || this.spawning || this.healthCheckPaused) {
                         scheduleNext();
                         return;
                     }
@@ -1292,28 +1805,29 @@ export class Daemon extends EventEmitter {
                     let nullReason;
                     if (!paneStatus) {
                         const serverAlive = await TmuxManager.sessionExists(this.tmuxSessionName);
-                        if (!serverAlive) {
+                        // A server may have already restarted before this daemon's health
+                        // tick. The new PID is the durable generation boundary: treat it as
+                        // a fleet storm even though `has-session` is true again.
+                        const generationChanged = serverAlive
+                            ? this.stormWindow?.observeServerAlive(await TmuxManager.getServerPid(this.tmuxSessionName)) === true
+                            : false;
+                        if (generationChanged)
+                            this.emit("tmux_server_crash", this.name);
+                        if (!serverAlive || generationChanged || this.stormWindow?.needsRecovery(this.name)) {
                             crashType = "server";
-                            nullReason = "server_gone";
-                            this.logger.error(`tmux server died — all ${cliLabel} windows lost`);
-                            // Fleet-level circuit breaker: pause all instances on repeated tmux server crashes
-                            Daemon.tmuxServerCrashTimestamps.push(Date.now());
-                            const cutoff = Date.now() - 5 * 60_000;
-                            Daemon.tmuxServerCrashTimestamps = Daemon.tmuxServerCrashTimestamps.filter(t => t > cutoff);
-                            if (Daemon.tmuxServerCrashTimestamps.length >= 2 && !Daemon.tmuxServerPaused) {
-                                Daemon.tmuxServerPaused = true;
-                                this.logger.error("Fleet-level tmux server circuit breaker triggered — pausing all respawns for 30s");
-                                this.emit("tmux_server_crash", this.name);
-                                if (!Daemon.tmuxServerRecoveryTimer) {
-                                    Daemon.tmuxServerRecoveryTimer = setTimeout(() => {
-                                        Daemon.tmuxServerRecoveryTimer = null;
-                                        Daemon.tmuxServerPaused = false;
-                                    }, 30_000);
-                                }
-                                scheduleNext();
-                                return;
+                            nullReason = serverAlive ? "server_storm_window_loss" : "server_gone";
+                            if (!serverAlive) {
+                                this.logger.error(`tmux server died — all ${cliLabel} windows lost`);
+                                const distinct = this.stormWindow?.recordServerDead(this.name, [this.name]) ?? true;
+                                if (distinct)
+                                    this.emit("tmux_server_crash", this.name);
+                            }
+                            else {
+                                this.stormWindow?.addAffected(this.name);
                             }
-                            await new Promise(r => setTimeout(r, 2_000)); // let session stabilize
+                            // The fleet breaker owns the delay and extends it on every new
+                            // server generation. Do not schedule a competing fixed timer.
+                            await this.stormWindow?.waitForSpawnAllowed();
                         }
                         else {
                             // null but server alive: window-level disappearance. Probe whether
@@ -1409,6 +1923,14 @@ export class Daemon extends EventEmitter {
                     }
                     // Append to crash history
                     this.appendCrashHistory({ exitCode, lastOutput, crashType, reason: nullReason });
+                    // A fleet-wide server loss is one infrastructure incident, not N
+                    // independent CLI crash loops. StormWindow owns its escalation; do
+                    // not let the same three server generations permanently trip every
+                    // daemon's per-instance 3-in-5m breaker.
+                    if (crashType === "server") {
+                        this.crashTimestamps = [];
+                        this.crashCount = 0;
+                    }
                     if (max_retries <= 0) {
                         this.healthCheckPaused = true;
                         this.logger.warn(`${cliLabel} window died — automatic restart is disabled`);
@@ -1495,9 +2017,15 @@ export class Daemon extends EventEmitter {
                         this.setProcessStatus("running");
                         this.logger.info({ resumed }, `Respawned ${cliLabel} window after crash`);
                         this.emit("crash_respawn", this.name);
+                        // Emit the per-instance audit event while the storm is still active
+                        // so its chat notification is suppressed into the fleet summary.
+                        if (crashType === "server")
+                            this.stormWindow?.markRecovered(this.name);
                     }
                     catch (err) {
-                        this.logger.error({ err }, `Failed to respawn ${cliLabel} window`);
+                        if (!this.handOffBackendUnreachableRespawn(err)) {
+                            this.logger.error({ err }, `Failed to respawn ${cliLabel} window`);
+                        }
                     }
                 }
                 catch (err) {
@@ -1606,10 +2134,37 @@ export class Daemon extends EventEmitter {
                     // A prompt is not an error and must not enter the PTY recovery gate.
                     // Continue scanning real errors in this same snapshot.
                 }
-                // Auto-dismiss runtime dialogs (e.g. Codex rate limit model switch)
+                // If a backend can derive activity from this exact pane, trust its
+                // explicit null (tool completed) instead of falling back to a possibly
+                // stale transcript activity from the previous scan.
+                const paneActivity = this.backend?.getPaneActivity
+                    ? this.backend.getPaneActivity(pane)
+                    : this.currentActivity;
+                const hasPendingWork = this.pendingWork.hasPendingWork();
+                if (!hasPendingWork)
+                    this.blockingProcessDetector.reset();
+                const blockingProcess = hasPendingWork
+                    ? this.blockingProcessDetector.observe(pane, paneActivity, Date.now())
+                    : null;
+                if (blockingProcess) {
+                    // Reuse the hang-notification bridge: it offers explicit Restart/Wait
+                    // choices and, unlike pty_error, does not retire a still-useful Cancel
+                    // button merely because a foreground process owns stdin.
+                    this.logger.warn(blockingProcess, "Foreground process is blocking the agent input loop");
+                    this.hangDetector?.emit("hang", { unchangedForMs: blockingProcess.blockedForMs });
+                }
+                // Auto-dismiss runtime dialogs (e.g. Codex rate limit model switch, or
+                // Claude's session-resume prompt painted after the startup scan moved
+                // on). Runtime table only: startup patterns are loose on purpose and
+                // must never send keys into an ordinary transcript.
+                let blockingSeen = null;
                 for (const dialog of dialogs) {
-                    if (!dialog.pattern.test(pane))
+                    if (!Daemon.dialogMatches(dialog, pane))
                         continue;
+                    if (dialog.blocksDelivery || dialog.holdOnly)
+                        blockingSeen = dialog;
+                    if (dialog.holdOnly)
+                        break; // recognised, deliberately not answered; trackDialogParked reports it
                     // These keys go straight into the pane. Sent while a message delivery is
                     // mid-transaction, an `Escape` wipes the pasted text and an `Enter`
                     // submits it half-composed — the user sees a message that vanished. Skip
@@ -1629,10 +2184,14 @@ export class Daemon extends EventEmitter {
                         }
                     });
                     if (!dismissed) {
-                        this.logger.debug({ dialog: dialog.description }, "Dialog dismissal deferred — pane write in flight");
+                        this.logger.info({ dialog: dialog.description }, "Dialog dismissal deferred — pane write in flight");
                     }
+                    this.trackDialogParked(blockingSeen);
                     return; // Dialog handled (or deliberately deferred): skip error checks this cycle
                 }
+                this.trackDialogParked(blockingSeen);
+                if (blockingSeen)
+                    return; // held dialog: skip error checks this cycle
                 this.evaluateErrorPatterns(pane, patterns, readyPattern, Date.now(), busyPattern);
             }
             catch {
@@ -1678,6 +2237,7 @@ export class Daemon extends EventEmitter {
                     if (seen > 0)
                         this.lastErrorCount.set(Daemon.errorPatternKey(ep), seen);
                 }
+                this.authFailureUnresolved = false;
                 this.clearErrorRecoveryGate();
                 this.logger.info({ downtime_s: downtime }, "PTY error recovered — agent is ready again");
                 this.emit("pty_recovered", { name: this.name, downtime_s: downtime });
@@ -1698,6 +2258,19 @@ export class Daemon extends EventEmitter {
             this.logger.warn({ errorType: this.lastDetectedErrorType }, "PTY error recovery deadline expired — resuming error scan");
             this.clearErrorRecoveryGate();
         }
+        // A model_error deferred mid-turn: the turn is over (or the pane left
+        // "working"), so decide now — still on screen means the CLI gave up and
+        // the user must act; gone means a retry got past it and nobody needs to know.
+        if (this.pendingModelErrorKey && this.instanceState !== "working") {
+            const key = this.pendingModelErrorKey;
+            this.pendingModelErrorKey = null;
+            const ep = patterns.find(candidate => Daemon.errorPatternKey(candidate) === key);
+            if (ep && ep.pattern.test(pane)) {
+                this.emitErrorPattern(ep, key, pane, now);
+                return;
+            }
+            this.logger.debug({ errorKey: key }, "Deferred model_error cleared before idle — dropped");
+        }
         // State: monitoring — count-based new-error detection over the full pane.
         for (const ep of patterns) {
             const key = Daemon.errorPatternKey(ep);
@@ -1725,25 +2298,49 @@ export class Daemon extends EventEmitter {
                 continue;
             }
             this.lastErrorCount.set(key, count);
-            // skipRecoveryWait: this error self-recovers (e.g. a timeout — Kiro is
-            // back at its prompt immediately). Keep monitoring so the next occurrence
-            // can fire without waiting for a possibly startup-only ready pattern.
-            if (!ep.skipRecoveryWait) {
-                this.errorWaitingForRecovery = true;
-                this.errorDetectedAt = now;
-                this.errorRecoveryDeadlineAt = now + Daemon.ERROR_RECOVERY_TIMEOUT_MS;
-                this.activeErrorPatternKey = key;
-                this.lastDetectedErrorType = ep.type;
-            }
-            this.lastErrorNotifiedAt.set(key, now);
-            if (ep.action === "failover")
-                this.lastFailoverAt = now;
-            const message = this.resolveErrorMessage(pane, ep);
-            this.logger.warn({ errorType: ep.type, action: ep.action }, `PTY error detected: ${message}`);
-            this.emit("pty_error", { name: this.name, ...ep, message });
+            // Kiro's `auto` model picks a concrete model per turn and reroutes around
+            // a temporarily unavailable one on its own — telling the user to run
+            // /model would ask them to fix something the CLI is already handling.
+            if (ep.type === "model_error" && ep.action === "notify" && this.config.model === "auto") {
+                this.logger.debug({ errorType: ep.type }, "model_error suppressed — model 'auto' reroutes on its own");
+                continue;
+            }
+            // A mid-turn model error is often a transient the CLI retries past. Hold
+            // the notification until the turn ends and notify only if the error is
+            // still on the idle screen (see the deferred check above).
+            if (ep.type === "model_error" && ep.action === "notify" && this.instanceState === "working") {
+                this.pendingModelErrorKey = key;
+                this.logger.debug({ errorType: ep.type }, "model_error deferred — instance is mid-turn, re-checking at idle");
+                continue;
+            }
+            this.emitErrorPattern(ep, key, pane, now);
             break; // Only handle first unsuppressed new error per scan
         }
     }
+    /** Arm the recovery gates and emit one detected error pattern. */
+    emitErrorPattern(ep, key, pane, now) {
+        // skipRecoveryWait: this error self-recovers (e.g. a timeout — Kiro is
+        // back at its prompt immediately). Keep monitoring so the next occurrence
+        // can fire without waiting for a possibly startup-only ready pattern.
+        if (!ep.skipRecoveryWait) {
+            this.errorWaitingForRecovery = true;
+            this.errorDetectedAt = now;
+            this.errorRecoveryDeadlineAt = now + Daemon.ERROR_RECOVERY_TIMEOUT_MS;
+            this.activeErrorPatternKey = key;
+            this.lastDetectedErrorType = ep.type;
+        }
+        this.lastErrorNotifiedAt.set(key, now);
+        if (ep.action === "failover")
+            this.lastFailoverAt = now;
+        const message = this.resolveErrorMessage(pane, ep);
+        // Remember an auth failure for as long as it is unresolved. An auth-broken
+        // CLI cannot finish the turn it is holding, so every other detector in this
+        // scan would otherwise keep reporting the same dead instance forever.
+        if (ep.type === "auth_error")
+            this.authFailureUnresolved = true;
+        this.logger.warn({ errorType: ep.type, action: ep.action }, `PTY error detected: ${message}`);
+        this.emit("pty_error", { name: this.name, ...ep, message });
+    }
     /**
      * Notification text for a detected pattern. `formatMessage` patterns build it
      * from the match so the user gets the specifics (e.g. which period and what
@@ -1782,6 +2379,97 @@ export class Daemon extends EventEmitter {
         const cancelKey = this.backend?.getCancelKey() ?? "Escape";
         await this.tmux?.sendSpecialKey(cancelKey);
     }
+    /**
+     * Drop every not-yet-started pane delivery which predates a user cancel.
+     * Promise chains cannot be removed, so entries become generation-checked
+     * no-ops. An entry already past its check is allowed to finish its current PTY
+     * transaction; the interrupt key still cancels the CLI generation.
+     */
+    clearPendingDeliveries(fleetEpoch) {
+        this.deliveryEpoch = fleetEpoch === undefined
+            ? this.deliveryEpoch + 1
+            : Math.max(this.deliveryEpoch, fleetEpoch);
+        this.logger.info({ deliveryEpoch: this.deliveryEpoch }, "Pending delivery queue cleared by user cancel");
+    }
+    captureDeliveryEpoch(value) {
+        const epoch = typeof value === "number" && Number.isSafeInteger(value) && value >= 0
+            ? value
+            : this.deliveryEpoch;
+        if (epoch > this.deliveryEpoch)
+            this.deliveryEpoch = epoch;
+        return epoch;
+    }
+    isDeliveryEpochCurrent(epoch) {
+        return epoch === this.deliveryEpoch;
+    }
+    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch, confirmClear = false) {
+        if (!this.tmux || !this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
+        this.pasteLock = this.pasteLock.then(async () => {
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.logger.info("Pending raw delivery dropped by user cancel");
+                return;
+            }
+            await this.wake();
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            await this.deliverMessage(rawText, undefined, { deliveryEpoch });
+            if (confirmClear)
+                await this.confirmBackendClearDialog();
+            this.logger.debug({ text: rawText.slice(0, 100) }, "Raw paste delivered");
+        }).catch(err => {
+            this.logger.warn({ err: err.message }, "raw_paste delivery error");
+        });
+    }
+    /**
+     * Confirm a backend's terminal-level /clear prompt after the channel-level
+     * admin confirmation has already succeeded. Poll instead of pasting `/clear\ny`
+     * as one buffer: Kiro versions that clear immediately interpret that queued
+     * `y` as a brand-new user message.
+     */
+    async confirmBackendClearDialog() {
+        const dialog = this.backend?.getClearConfirmationDialog?.();
+        if (!dialog || !this.tmux)
+            return;
+        const matches = (pane) => {
+            dialog.pattern.lastIndex = 0;
+            return dialog.pattern.test(pane);
+        };
+        const deadline = Date.now() + 3_000;
+        while (Date.now() <= deadline) {
+            const pane = await this.tmux.capturePane().catch(() => "");
+            if (matches(pane)) {
+                const sent = await this.paneWriteLock.run(async () => {
+                    // Re-check under the write lock so a prompt that disappeared between
+                    // capture and lock acquisition never receives a stray literal `y`.
+                    const currentPane = await this.tmux.capturePane().catch(() => "");
+                    if (!matches(currentPane))
+                        return false;
+                    const specialKeys = new Set(["Up", "Down", "Enter", "Escape", "Right", "Left"]);
+                    for (const key of dialog.keys) {
+                        const ok = specialKeys.has(key)
+                            ? await this.tmux.sendSpecialKey(key)
+                            : await this.tmux.sendKeys(key);
+                        if (!ok)
+                            return false;
+                        await new Promise(resolve => setTimeout(resolve, 100));
+                    }
+                    return true;
+                });
+                if (sent) {
+                    this.logger.info({ dialog: dialog.description }, "Auto-confirmed backend clear dialog");
+                }
+                else {
+                    this.logger.warn({ dialog: dialog.description }, "Backend clear dialog disappeared or confirmation keys failed");
+                }
+                return;
+            }
+            await new Promise(resolve => setTimeout(resolve, 100));
+        }
+        // Recent Kiro releases may clear immediately without a second prompt. That
+        // is a successful no-op here, not an error.
+        this.logger.debug({ dialog: dialog.description }, "Backend clear dialog did not appear");
+    }
     /** Send the backend-specific graceful quit command/key sequence. */
     async sendQuitSequence() {
         if (!this.tmux || !this.backend)
@@ -1789,18 +2477,20 @@ export class Daemon extends EventEmitter {
         const quitCmd = this.backend.getQuitCommand();
         const quitKey = this.backend.getQuitKey?.();
         if (quitCmd) {
-            await this.tmux.sendKeys(quitCmd);
+            if (!await this.tmux.sendKeys(quitCmd))
+                return false;
             // Delay before Enter to prevent tmux server races when instances stop in
             // parallel (same pattern as pasteText).
             await new Promise(r => setTimeout(r, 150));
-            await this.tmux.sendSpecialKey("Enter");
-            return true;
+            return this.tmux.sendSpecialKey("Enter");
         }
         if (!quitKey)
             return false;
         const presses = Math.max(1, Math.floor(this.backend.getQuitKeyPresses?.() ?? 1));
         for (let i = 0; i < presses; i++) {
-            await this.tmux.sendSpecialKey(quitKey);
+            const sent = await this.tmux.sendSpecialKey(quitKey);
+            if (!sent)
+                return false;
             if (i + 1 < presses)
                 await new Promise(r => setTimeout(r, 250));
         }
@@ -1833,8 +2523,23 @@ export class Daemon extends EventEmitter {
                     }
                 }
             }
-            if (!killed)
-                this.logger.warn("CLI did not exit gracefully within 3s, force killing window");
+            if (!killed) {
+                this.logger.warn({ quitSent }, "CLI did not exit gracefully within 3s — falling back to SIGTERM");
+                await this.killProcessTree("SIGTERM");
+                for (let i = 0; i < 5; i++) {
+                    await new Promise(r => setTimeout(r, 200));
+                    const status = await this.tmux.getPaneStatus();
+                    if (!status || !status.alive) {
+                        killed = true;
+                        break;
+                    }
+                }
+            }
+            if (!killed) {
+                this.logger.warn("CLI process tree survived SIGTERM — falling back to SIGKILL");
+                await this.killProcessTree("SIGKILL");
+                await new Promise(r => setTimeout(r, 200));
+            }
             // Always kill window — remain-on-exit keeps dead panes around after CLI exits
             const stoppedWindowId = this.tmux.getWindowId();
             await this.tmux.killWindow();
@@ -1883,6 +2588,33 @@ export class Daemon extends EventEmitter {
             stateChangedAt: Date.now(),
         };
     }
+    /**
+     * Answer a FleetManager state query. Most callers only need the cached state,
+     * but lifecycle decisions such as post-reply Cancel retirement need an
+     * authoritative pane observation: after startup the last transition can stay
+     * "working" even though the CLI has since settled without emitting another
+     * control-mode output record.
+     */
+    async respondToInstanceStateQuery(msg, socket) {
+        try {
+            if (msg.refresh === true) {
+                await this.captureAndEvaluateInstanceState("state_query");
+            }
+            const snapshot = this.getInstanceStateSnapshot();
+            this.ipcServer?.send(socket, {
+                type: "instance_state_response",
+                requestId: msg.requestId,
+                instanceName: this.name,
+                ...snapshot,
+                state: this.isPaused ? "paused" : snapshot.state,
+                processStatus: this.processStatus,
+                pausedAt: this.lastPausedAt,
+            });
+        }
+        catch (err) {
+            this.logger.debug({ err: err.message }, "Instance state query failed");
+        }
+    }
     /** Gracefully stop the CLI while keeping its remain-on-exit tmux window. */
     /**
      * Mark the instance to pause as soon as its pane is idle. Used for auth
@@ -1902,7 +2634,14 @@ export class Daemon extends EventEmitter {
             if (this.getPauseWakeState() !== "active")
                 return;
         }
-        if (this.instanceState !== "idle" || this.pasteQueueDepth > 0) {
+        // `pauseAllowStuck` is consumed here, not merely read: it authorises exactly
+        // one pause from a stuck pane (the auth-deferred one) and must never leak
+        // into an ordinary idle-timeout pause of a busy instance.
+        const allowStuck = this.pauseAllowStuck;
+        this.pauseAllowStuck = false;
+        const pausableState = this.instanceState === "idle"
+            || (allowStuck && this.instanceState === "stuck");
+        if (!pausableState || this.pasteQueueDepth > 0) {
             this.pauseRequested = false;
             return;
         }
@@ -1966,6 +2705,10 @@ export class Daemon extends EventEmitter {
         // An explicit wake (e.g. after the user re-logs in) cancels a deferred
         // auth pause — otherwise the instance would pause again the moment it idles.
         this.pausePending = false;
+        this.authFailureUnresolved = false;
+        this.loginScreenReported = false;
+        this.fatalStartupReported = false;
+        this.fatalStartupBlocked = false;
         if (this.pauseWakeState === "active")
             return;
         if (this.pauseWakeState === "pausing")
@@ -1978,19 +2721,30 @@ export class Daemon extends EventEmitter {
         }
         this.pauseWakeState = "waking";
         this.beginSpawn();
+        // A wake is a real resume launch: it gets at least the backend's resume
+        // budget (kiro: 60s — the conversation must come back from the backend
+        // before anything paints), never less than the caller's or the configured
+        // startup_timeout_ms.
+        const budgetMs = this.wakeBudgetMs(timeoutMs);
+        // No outer race. trySpawn cannot be cancelled: racing it against a timer
+        // and giving up left the daemon "paused" (monitors frozen) while the spawn
+        // went on to revive the window behind its back. Every phase inside is
+        // bounded on its own terms — the SpawnGate wait is deliberate storm /
+        // concurrency coordination, first output + idle is `budgetMs`, the dialog
+        // scan is STARTUP_DIALOG_BUDGET_MS — so the outcome is always trySpawn's
+        // own verdict. A soft timer only makes a slow wake visible in the log.
         const transition = this.autoPauseController.wakeOnDeliver(async () => {
-            let timeout;
+            const slow = setTimeout(() => {
+                this.logger.warn({ budgetMs }, "Wake is exceeding its budget — still waiting for the spawn (it cannot be cancelled)");
+            }, budgetMs + STARTUP_DIALOG_BUDGET_MS);
+            slow.unref?.();
             try {
-                const ready = await Promise.race([
-                    this.trySpawn(true, timeoutMs),
-                    new Promise(resolve => { timeout = setTimeout(() => resolve(false), timeoutMs); }),
-                ]);
+                const ready = await this.trySpawn(true, budgetMs);
                 if (!ready)
-                    throw new Error(`Wake timed out before CLI became ready (${timeoutMs}ms)`);
+                    throw new Error(`Wake failed: the CLI did not become ready (budget ${budgetMs}ms)`);
             }
             finally {
-                if (timeout)
-                    clearTimeout(timeout);
+                clearTimeout(slow);
             }
         });
         this.pauseWakeTransition = transition;
@@ -2062,8 +2816,13 @@ export class Daemon extends EventEmitter {
         if (snapshot.state !== "idle")
             this.pauseRequested = false;
         // A pause deferred by an auth failure: retry the moment the pane settles.
-        if (this.pausePending && snapshot.state === "idle" && this.pasteQueueDepth === 0) {
+        // "stuck" counts as settled here, and that is the whole point — an expired
+        // session cannot complete the turn it is holding, so the pane never returns
+        // to idle and waiting for idle meant waiting forever. The instance stayed
+        // live, kept its warm slot, and re-raised a hang alert on every scan.
+        if (this.pausePending && (snapshot.state === "idle" || snapshot.state === "stuck") && this.pasteQueueDepth === 0) {
             this.pausePending = false;
+            this.pauseAllowStuck = snapshot.state === "stuck";
             this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt });
             return;
         }
@@ -2093,6 +2852,7 @@ export class Daemon extends EventEmitter {
             return;
         this.turnHadInbound = true;
         this.turnOutboundDelivered = false;
+        this.turnReplyDelivered = false;
         this.turnCorrelationId = meta.correlation_id || undefined;
         // The last non-empty line of what we pasted: everything on screen after it
         // is the agent's own output.
@@ -2108,13 +2868,38 @@ export class Daemon extends EventEmitter {
     maybeProxyReplyOnTurnEnd(pane) {
         const hadInbound = this.turnHadInbound;
         const delivered = this.turnOutboundDelivered;
+        const replyDelivered = this.turnReplyDelivered;
         const correlationId = this.turnCorrelationId;
         const inboundMarker = this.turnInboundMarker;
         this.turnHadInbound = false;
         this.turnOutboundDelivered = false;
+        this.turnReplyDelivered = false;
         this.turnCorrelationId = undefined;
         this.turnInboundMarker = undefined;
-        if (!hadInbound || delivered || this.isPaused)
+        if (!hadInbound || this.isPaused)
+            return;
+        // Claude sometimes prints a broken XML tool call as plain text and returns
+        // idle without ever invoking `reply`. This is independent of MCP liveness:
+        // the model malformed the call before the server could receive it.
+        if (!replyDelivered && this.isClaudeCodeBackend() && pane) {
+            const malformed = detectMalformedClaudeToolCall(pane, { inboundMarker });
+            if (malformed) {
+                const stale = malformed.signature === this.lastMalformedToolCallSignature;
+                this.lastMalformedToolCallSignature = malformed.signature;
+                if (!stale) {
+                    const recovered = malformed.text != null;
+                    this.logger.warn({ correlationId, recovered }, recovered
+                        ? "Malformed Claude tool call detected — attempting to recover reply text"
+                        : "Malformed Claude tool call detected — reply text could not be extracted");
+                    this.emit("malformed_tool_call", { name: this.name, correlationId, recovered });
+                    if (malformed.text)
+                        this.sendRecoveredMalformedReply(malformed.text, correlationId);
+                }
+                // Never let the broader dead-MCP fallback relay the XML/chrome too.
+                return;
+            }
+        }
+        if (delivered)
             return;
         // Opt-in: raw pane text can carry secrets past the regex redaction.
         if (this.config.mcp_proxy_reply !== true)
@@ -2124,6 +2909,11 @@ export class Daemon extends EventEmitter {
             return;
         void this.sendProxyReply(pane, inboundMarker, correlationId);
     }
+    isClaudeCodeBackend() {
+        return this.runtimeIdentity?.backend === "claude-code"
+            || this.config.backend === "claude-code"
+            || this.backend?.binaryName === "claude";
+    }
     /** Relay the pane's final text to the channel, marked as a daemon proxy reply. */
     async sendProxyReply(pane, inboundMarker, correlationId) {
         try {
@@ -2141,59 +2931,96 @@ export class Daemon extends EventEmitter {
             let body = `⚠️ [MCP unavailable — proxy reply]\n\n${text}`;
             if (correlationId)
                 body += `\n\n(correlation_id: ${correlationId})`;
-            const args = { text: body };
-            // Same context-bound routing as the reply tool in handleToolCall.
-            if (this.lastChatId) {
-                args.chat_id = this.lastChatId;
-                if (this.lastThreadId)
-                    args.thread_id = this.lastThreadId;
-            }
             this.logger.warn({ correlationId }, "MCP server dead and the turn sent no reply — relaying the pane text as a proxy reply");
             this.emit("mcp_proxy_reply", { name: this.name, correlationId });
-            const adapters = this.messageBus.getAllAdapters();
-            if (adapters.length > 0) {
-                routeToolCall(adapters[0], "reply", args, this.lastThreadId, (_result, error) => {
-                    if (error)
-                        this.logger.error({ error }, "Dead-MCP proxy reply failed");
-                });
-                return;
-            }
-            if (!this.ipcServer)
-                return;
-            const fleetReqId = `proxyreply_${++this.proxyReplySeq}`;
-            this.ipcServer.broadcast({
-                type: "fleet_outbound",
-                tool: "reply",
-                args,
-                fleetRequestId: fleetReqId,
-                adapterId: this.lastAdapterId,
-            });
-            const timeout = setTimeout(() => {
-                this.pendingIpcRequests.delete(fleetReqId);
-                this.logger.error("Dead-MCP proxy reply timed out waiting for the fleet manager");
-            }, daemonBudgetMs("reply"));
-            timeout.unref?.();
-            this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
-                clearTimeout(timeout);
-                if (respMsg.error)
-                    this.logger.error({ error: respMsg.error }, "Dead-MCP proxy reply failed");
-                else
-                    this.logger.info("Dead-MCP proxy reply delivered");
-            });
+            this.deliverDaemonReply(body, "proxyreply", "Dead-MCP proxy reply");
         }
         catch (err) {
             this.logger.error({ err: err.message }, "Dead-MCP proxy reply attempt failed");
         }
     }
+    /** Send a narrowly extracted #648 reply; operator notification is a separate event. */
+    sendRecoveredMalformedReply(text, correlationId) {
+        try {
+            this.deliverDaemonReply(text, "malformedreply", "Malformed tool-call recovery");
+        }
+        catch (err) {
+            this.logger.error({ err: err.message, correlationId }, "Malformed tool-call recovery attempt failed");
+        }
+    }
+    /** Context-bound reply path shared by dead-MCP and malformed-call recovery. */
+    deliverDaemonReply(body, requestPrefix, logLabel) {
+        const args = { text: body };
+        if (this.lastChatId) {
+            args.chat_id = this.lastChatId;
+            if (this.lastThreadId)
+                args.thread_id = this.lastThreadId;
+        }
+        const adapters = this.messageBus.getAllAdapters();
+        if (adapters.length > 0) {
+            routeToolCall(adapters[0], "reply", args, this.lastThreadId, (_result, error) => {
+                if (error)
+                    this.logger.error({ error }, `${logLabel} failed`);
+                else
+                    this.logger.info(`${logLabel} delivered`);
+            });
+            return;
+        }
+        if (!this.ipcServer) {
+            this.logger.error(`${logLabel} failed — no adapter or fleet IPC route`);
+            return;
+        }
+        const fleetReqId = `${requestPrefix}_${++this.proxyReplySeq}`;
+        const timeout = setTimeout(() => {
+            this.pendingIpcRequests.delete(fleetReqId);
+            this.logger.error(`${logLabel} timed out waiting for the fleet manager`);
+        }, daemonBudgetMs("reply"));
+        timeout.unref?.();
+        // Register before broadcast: an in-process/fast adapter can answer in the
+        // same tick, and a waiter installed afterwards would miss that response.
+        this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
+            clearTimeout(timeout);
+            if (respMsg.error)
+                this.logger.error({ error: respMsg.error }, `${logLabel} failed`);
+            else
+                this.logger.info(`${logLabel} delivered`);
+        });
+        this.ipcServer.broadcast({
+            type: "fleet_outbound",
+            tool: "reply",
+            args,
+            fleetRequestId: fleetReqId,
+            adapterId: this.lastAdapterId,
+        });
+    }
     clearInstanceStateIdleTimer() {
         if (this.instanceStateIdleTimer)
             clearTimeout(this.instanceStateIdleTimer);
         this.instanceStateIdleTimer = null;
     }
-    clearInstanceStateStuckTimer() {
-        if (this.instanceStateStuckTimer)
-            clearTimeout(this.instanceStateStuckTimer);
-        this.instanceStateStuckTimer = null;
+    clearInstanceStateOutputProbeTimer() {
+        if (this.instanceStateOutputProbeTimer)
+            clearTimeout(this.instanceStateOutputProbeTimer);
+        this.instanceStateOutputProbeTimer = null;
+    }
+    /**
+     * Periodic status-line hooks can generate `%output` without changing a single
+     * visible cell. Probe the pane once per burst: a changed capture is real work;
+     * an identical ready capture remains idle and emits no state edge.
+     */
+    scheduleInstanceStateOutputProbe() {
+        if (this.instanceStateOutputProbeTimer)
+            return;
+        this.instanceStateOutputProbeTimer = setTimeout(() => {
+            this.instanceStateOutputProbeTimer = null;
+            void this.captureAndEvaluateInstanceState("output_probe", this.instanceStateLastOutputAt);
+        }, PERIODIC_REDRAW_PROBE_MS);
+        this.instanceStateOutputProbeTimer.unref?.();
+    }
+    clearInstanceStateStuckTimer() {
+        if (this.instanceStateStuckTimer)
+            clearTimeout(this.instanceStateStuckTimer);
+        this.instanceStateStuckTimer = null;
     }
     scheduleInstanceStateStuckDeadline(changeAt) {
         // Keep one deadline timer per instance. High-volume TUIs can emit hundreds
@@ -2234,6 +3061,8 @@ export class Daemon extends EventEmitter {
         if (this.statePollInFlight) {
             if (reason === "idle_debounce")
                 this.scheduleInstanceStateIdleCapture();
+            if (reason === "output_probe")
+                this.scheduleInstanceStateOutputProbe();
             return;
         }
         this.statePollInFlight = true;
@@ -2242,9 +3071,19 @@ export class Daemon extends EventEmitter {
             const pane = await this.tmux.capturePane();
             // Output received while capture-pane was in flight makes this snapshot
             // stale. Its output handler has already armed a new debounce.
-            if ((expectedOutputAt > 0 && this.instanceStateLastOutputAt > expectedOutputAt)
-                || (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureStartedAt))
+            const outputMovedDuringCapture = (expectedOutputAt > 0 && this.instanceStateLastOutputAt > expectedOutputAt)
+                || (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureStartedAt);
+            if (outputMovedDuringCapture) {
+                if (reason === "output_probe") {
+                    // A second burst overtook the probe. Do not bless its stale capture as
+                    // idle: continuous output is the safer working signal, while the next
+                    // quiet probe/debounce can still prove that it was only repainting.
+                    this.applyInstanceStateSnapshot(this.instanceStateMachine.recordOutput(this.instanceStateLastOutputAt));
+                    this.scheduleInstanceStateIdleCapture();
+                    this.scheduleInstanceStateStuckDeadline(this.instanceStateLastOutputAt);
+                }
                 return;
+            }
             const observedChangeAt = expectedOutputAt || captureStartedAt;
             // One observation per capture. This used to call observe() twice with the
             // same pane: the second call always saw an unchanged pane, so the
@@ -2253,6 +3092,7 @@ export class Daemon extends EventEmitter {
             // mismatched spinner frame was enough to report idle mid-turn.
             const settled = this.instanceStateLastOutputAt === 0
                 || captureStartedAt - this.instanceStateLastOutputAt >= this.instanceStateIdleDebounceMs;
+            const paneActivity = this.backend?.getPaneActivity?.(pane) ?? null;
             // The two times are genuinely different and both matter: the content
             // changed when tmux reported output (observedChangeAt), but idle/stuck are
             // decisions about *now*. The old double-observe expressed that by calling
@@ -2260,6 +3100,7 @@ export class Daemon extends EventEmitter {
             const snapshot = this.instanceStateMachine.observe(pane, Date.now(), {
                 settled,
                 changeAt: observedChangeAt,
+                forceBusy: paneActivity !== null,
             });
             this.applyInstanceStateSnapshot(snapshot, pane);
             // Backends without a transcript feed can still say what they are doing, if
@@ -2267,7 +3108,7 @@ export class Daemon extends EventEmitter {
             // extra tmux call. Cadence is the capture cadence (idle debounce + the 60s
             // safety sweep), which matches the progress ticker's own 60s interval.
             if (this.backend?.getPaneActivity) {
-                this.publishActivity(snapshot.state === "idle" ? null : this.backend.getPaneActivity(pane));
+                this.publishActivity(snapshot.state === "idle" ? null : paneActivity);
             }
             if (snapshot.state === "idle") {
                 this.clearInstanceStateStuckTimer();
@@ -2294,6 +3135,14 @@ export class Daemon extends EventEmitter {
         if (!windowId || event.windowId !== windowId || !this.instanceStateMachine)
             return;
         this.instanceStateLastOutputAt = event.at;
+        if (this.backend?.hasPeriodicPaneRedraw?.() === true && this.instanceState === "idle") {
+            // Do not emit idle→working solely because agy repainted an identical
+            // footer. The short capture probe below still observes genuine pane
+            // changes promptly and moves the state to working.
+            this.scheduleInstanceStateOutputProbe();
+            this.scheduleInstanceStateIdleCapture();
+            return;
+        }
         const snapshot = this.instanceStateMachine.recordOutput(event.at);
         this.applyInstanceStateSnapshot(snapshot);
         this.scheduleInstanceStateIdleCapture();
@@ -2344,6 +3193,7 @@ export class Daemon extends EventEmitter {
     stopInstanceStateMonitor() {
         this.instanceStateMonitorActive = false;
         this.clearInstanceStateIdleTimer();
+        this.clearInstanceStateOutputProbeTimer();
         this.clearInstanceStateStuckTimer();
         if (this.instanceStateMonitorTimer)
             clearInterval(this.instanceStateMonitorTimer);
@@ -2378,6 +3228,15 @@ export class Daemon extends EventEmitter {
             this.logger.debug(diagnostic, "Suppressing stuck notification without pending work");
             return;
         }
+        // An auth-broken instance IS stuck, and stays stuck: it cannot finish the
+        // turn it is holding, so pendingWork never clears and this fired on every
+        // scan forever. The notification is also useless — it offers Restart/Wait
+        // and asks General for help, but only the user re-logging in fixes this, and
+        // they have already been told exactly that by the auth alert.
+        if (this.authFailureUnresolved) {
+            this.logger.debug(diagnostic, "Suppressing stuck notification — unresolved auth failure (re-login required)");
+            return;
+        }
         this.logger.warn(diagnostic, "Instance pane stuck with pending work");
         this.hangDetector?.emit("hang", { unchangedForMs: snapshot.unchangedForMs });
     }
@@ -2397,6 +3256,7 @@ export class Daemon extends EventEmitter {
         // fire into a stopped daemon).
         this.clearMcpRestartRequest();
         this.interactivePromptDetector.reset();
+        this.blockingProcessDetector.reset();
         this.stopInstanceStateMonitor();
         this.transcriptMonitor?.stop();
         this.guardian?.stop();
@@ -2422,9 +3282,9 @@ export class Daemon extends EventEmitter {
      * Tell the fleet manager what this instance is doing right now, for the live
      * progress line on the cancel button.
      *
-     * Purely cosmetic — nothing decides anything from it, so it is fine that only
-     * backends with a transcript feed report at all (claude-code today). For the
-     * rest the progress line keeps showing just elapsed time.
+     * Primarily cosmetic. The foreground-process detector also uses a current
+     * shell activity as one of several positive signals, but never makes a state
+     * decision from an arbitrary activity label alone.
      *
      * Repeats are dropped: the ticker only edits the channel message when the text
      * changes, and a stream of identical broadcasts would defeat that.
@@ -2440,10 +3300,84 @@ export class Daemon extends EventEmitter {
             activity: next,
         });
     }
-    /** Effective tool_progress level, hardened against junk config values. */
+    /** Effective tool_progress level, hardened against junk config values.
+     *  Off unless explicitly enabled: an update must never make bubbles start
+     *  listing tool activity the operator did not ask to broadcast. */
     toolProgressLevel() {
         const raw = this.config.tool_progress;
-        return raw === "off" || raw === "verbose" ? raw : "standard";
+        return raw === "standard" || raw === "verbose" ? raw : "off";
+    }
+    /**
+     * Apply a tool-progress setting without restarting the CLI session.
+     *
+     * Drop the current accumulator at the boundary: verbose entries may contain
+     * command previews which must not survive a downgrade to standard/off, and a
+     * newly enabled level should start with a clean, internally consistent list.
+     */
+    updateToolProgress(level) {
+        const previous = this.toolProgressLevel();
+        this.config.tool_progress = level;
+        if (this.toolProgressLevel() !== previous)
+            this.resetToolProgress();
+    }
+    /** Snapshot the configuration actually owned by this live daemon. */
+    getConfigSnapshot() {
+        return structuredClone(this.config);
+    }
+    /**
+     * Apply the whitelisted hot configuration carried by FleetManager IPC.
+     * null removes an optional value; invalid/unlisted fields are ignored rather
+     * than allowing another client on the per-instance socket to mutate cold
+     * process/session settings.
+     */
+    applyConfigUpdate(value) {
+        if (!value || typeof value !== "object" || Array.isArray(value))
+            return;
+        const update = value;
+        if (update.tool_progress === null || ["off", "standard", "verbose"].includes(String(update.tool_progress))) {
+            this.updateToolProgress(update.tool_progress === null ? undefined : update.tool_progress);
+        }
+        if (typeof update.mcp_proxy_reply === "boolean")
+            this.config.mcp_proxy_reply = update.mcp_proxy_reply;
+        else if (update.mcp_proxy_reply === null)
+            delete this.config.mcp_proxy_reply;
+        if (typeof update.warm_cap === "number" && Number.isInteger(update.warm_cap) && update.warm_cap >= 0)
+            this.config.warm_cap = update.warm_cap;
+        else if (update.warm_cap === null)
+            delete this.config.warm_cap;
+        const nextAutoPause = typeof update.auto_pause_after === "number"
+            && Number.isFinite(update.auto_pause_after)
+            && update.auto_pause_after >= 0
+            ? update.auto_pause_after
+            : update.auto_pause_after === null ? 0 : undefined;
+        if (nextAutoPause !== undefined) {
+            const previousAutoPause = typeof this.config.auto_pause_after === "number" ? this.config.auto_pause_after : 0;
+            if (update.auto_pause_after === null)
+                delete this.config.auto_pause_after;
+            else
+                this.config.auto_pause_after = nextAutoPause;
+            if (nextAutoPause !== previousAutoPause) {
+                const isGeneral = this.config.general_topic === true || this.name === "general";
+                this.autoPauseController.reconfigure((isGeneral ? 0 : nextAutoPause) * 60_000);
+            }
+        }
+        for (const key of ["display_name", "description"]) {
+            if (typeof update[key] === "string")
+                this.config[key] = update[key];
+            else if (update[key] === null)
+                delete this.config[key];
+        }
+        if (Array.isArray(update.tags) && update.tags.every(tag => typeof tag === "string"))
+            this.config.tags = [...update.tags];
+        else if (update.tags === null)
+            delete this.config.tags;
+        if (["trace", "debug", "info", "warn", "error"].includes(String(update.log_level))) {
+            const level = update.log_level;
+            if (this.config.log_level !== level) {
+                this.config.log_level = level;
+                this.logger.level = level;
+            }
+        }
     }
     /**
      * Accumulate one semantic progress line for the channel bubble and schedule
@@ -2548,16 +3482,7 @@ export class Daemon extends EventEmitter {
         const fromInstance = meta.from_instance;
         let formatted;
         if (fromInstance) {
-            // #77: show the sender's display name for readability, keeping the machine
-            // instance name in parens so the recipient's send_to_instance target is valid.
-            const fromLabel = meta.from_display ? `${meta.from_display} (${fromInstance})` : fromInstance;
-            formatted = `[from:${fromLabel}] ${content}`;
-            formatted += renderHandoffMetadata(meta);
-            // A delegated task that requires a reply must not read like a chatty FYI —
-            // the "you may stay silent" line is for the latter only.
-            formatted += meta.requires_reply === "true"
-                ? "\n(A reply IS required: use report_result with the correlation_id above — or send_to_instance. Not direct text.)"
-                : "\n(If you need to reply, use send_to_instance tool, NOT direct text. If there is nothing to add, you may stay silent.)";
+            formatted = formatCrossInstanceInboundMessage(content, meta);
         }
         else {
             const via = meta.source ? ` via ${meta.source}` : "";
@@ -2577,11 +3502,24 @@ export class Daemon extends EventEmitter {
         }
         return formatted;
     }
+    /** Tell the fleet when an already-accepted cross-instance pane write failed. */
+    reportCrossInstanceDeliveryFailure(meta, error) {
+        if (!meta.from_instance)
+            return;
+        this.ipcServer?.broadcast({
+            type: "cross_instance_delivery_failed",
+            senderSession: meta.from_instance,
+            targetInstance: this.name,
+            correlationId: meta.correlation_id ?? "unknown",
+            error: error ?? this.tmux?.getLastPasteError?.() ?? "target pane rejected the delivery",
+        });
+    }
     /**
      * /steer: interject into the CURRENT turn instead of queueing for idle.
      *
      * Differences from pushChannelMessage, and nothing else:
-     *  - serialized on steerLock, not pasteLock — it must overtake, not queue
+     *  - serialized on steerLock, not pasteLock — it may overtake current work,
+     *    but never an ordinary delivery already queued ahead of it
      *  - deliverMessage runs with { steer: true }, which takes the busy branch
      *    that pastes immediately (the codex native-queue transaction) instead of
      *    waiting for idle. Verification and silent-loss fallback are the ones
@@ -2592,11 +3530,21 @@ export class Daemon extends EventEmitter {
      * The steered text goes through formatInboundMessage so the agent sees a
      * normal inbound message, with a steering notice prepended for context.
      */
-    steerMessage(content, meta) {
+    steerMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
+        // The fleet facade prevents a steer from overtaking an item still in its
+        // idle queue. Close the second race window here: an earlier item may already
+        // have reached this daemon's paste queue by the time the steer IPC arrives.
+        if (this.pasteQueueDepth > 0) {
+            this.logger.info("Steer queued behind an earlier pane delivery to preserve message order");
+            this.pushChannelMessage(content, meta, undefined, deliveryEpoch);
+            return;
+        }
         this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
         this.pendingWork.recordInbound();
         this.recordRecentUserMessage(content, meta);
-        const formatted = "[STEERING — mid-task course correction from the user. Fold this into the CURRENT work.]\n"
+        const formatted = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n"
             + this.formatInboundMessage(content, meta);
         const chatId = meta.chat_id;
         const messageId = meta.message_id;
@@ -2604,12 +3552,54 @@ export class Daemon extends EventEmitter {
             ? { chatId: meta.thread_id || chatId, messageId }
             : undefined;
         this.steerLock = this.steerLock.then(async () => {
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
             await this.wake();
-            if (await this.deliverMessage(formatted, status, { steer: true })) {
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch })) {
                 this.markTurnStarted(meta, formatted);
             }
+            else if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.reportCrossInstanceDeliveryFailure(meta);
+            }
         }).catch(err => {
             this.logger.warn({ err: err.message }, "steer delivery error");
+            if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+            }
+        });
+    }
+    /**
+     * /btw: submit a separately-labelled side question immediately while asking
+     * the agent not to change the active task. Claude's native `/btw` opens a
+     * branchAndResume panel whose answer never reaches the channel or transcript,
+     * so channel delivery intentionally uses a normal wrapped inbound instead.
+     */
+    btwMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            return;
+        this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
+        this.pendingWork.recordInbound();
+        this.recordRecentUserMessage(content, meta);
+        const formatted = "[BTW — side question from the user. Answer it separately without changing or interrupting the CURRENT work.]\n"
+            + this.formatInboundMessage(content, meta);
+        const chatId = meta.chat_id;
+        const messageId = meta.message_id;
+        const status = (chatId && messageId)
+            ? { chatId: meta.thread_id || chatId, messageId }
+            : undefined;
+        this.steerLock = this.steerLock.then(async () => {
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            await this.wake();
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                return;
+            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch })) {
+                this.markTurnStarted(meta, formatted);
+            }
+        }).catch(err => {
+            this.logger.warn({ err: err.message }, "btw delivery error");
         });
     }
     /**
@@ -2617,7 +3607,11 @@ export class Daemon extends EventEmitter {
      * If targetSession is provided, only send to the matching socket.
      * Otherwise send to the instance's own session (this.name).
      */
-    pushChannelMessage(content, meta, _targetSession) {
+    pushChannelMessage(content, meta, _targetSession, deliveryEpoch = this.deliveryEpoch) {
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+            this.logger.info("Pending channel delivery dropped by user cancel");
+            return;
+        }
         if (!this.tmux) {
             this.logger.warn("Cannot push channel message: tmux not running");
             return;
@@ -2651,7 +3645,9 @@ export class Daemon extends EventEmitter {
             const rawText = content.slice(5);
             this.logger.info({ user }, "Raw paste from topic mode user");
             this.pasteLock = this.pasteLock.then(async () => {
-                if (await this.deliverMessage(rawText))
+                if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                    return;
+                if (await this.deliverMessage(rawText, undefined, { deliveryEpoch }))
                     this.markTurnStarted(meta, rawText);
             }).catch(err => {
                 this.logger.warn({ err: err.message }, "pasteLock raw delivery error");
@@ -2661,8 +3657,7 @@ export class Daemon extends EventEmitter {
         const formatted = this.formatInboundMessage(content, meta);
         // Serialize deliveries: each message waits for the previous to complete,
         // and each waits for the CLI to be idle before pasting. Messages are never
-        // dropped for age — a long-busy CLI just queues them until it frees up
-        // (the user can press Cancel to interrupt and let the queue drain sooner).
+        // dropped for age — only an explicit user Cancel invalidates queued work.
         const chatId = meta.chat_id;
         const messageId = meta.message_id;
         const wasQueued = this.pasteQueueDepth > 0;
@@ -2675,12 +3670,20 @@ export class Daemon extends EventEmitter {
         }
         this.pasteLock = this.pasteLock.then(async () => {
             try {
+                if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                    this.logger.info("Pending channel delivery dropped by user cancel");
+                    return;
+                }
                 if (this.config.pre_task_command) {
-                    await this.deliverMessage(this.config.pre_task_command);
+                    await this.deliverMessage(this.config.pre_task_command, undefined, { deliveryEpoch });
+                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                        return;
                 }
                 if (this.pendingInstructionsNotice) {
                     this.pendingInstructionsNotice = false;
-                    await this.deliverMessage(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir));
+                    await this.deliverMessage(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir), undefined, { deliveryEpoch });
+                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                        return;
                 }
                 const status = (chatId && messageId)
                     ? { chatId: meta.thread_id || chatId, messageId }
@@ -2688,14 +3691,21 @@ export class Daemon extends EventEmitter {
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
-                if (await this.deliverMessage(formatted, status))
+                if (await this.deliverMessage(formatted, status, { deliveryEpoch })) {
                     this.markTurnStarted(meta, formatted);
+                }
+                else if (meta.from_instance && this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                    this.reportCrossInstanceDeliveryFailure(meta);
+                }
             }
             finally {
                 this.pasteQueueDepth--;
             }
         }).catch(err => {
             this.logger.warn({ err: err.message }, "pasteLock delivery error — chain continues");
+            if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+            }
         });
         this.logger.debug({ user: meta.user, text: content.slice(0, 100) }, "Queued channel message for delivery");
     }
@@ -2716,24 +3726,53 @@ export class Daemon extends EventEmitter {
      * serial in both cases so separate PTY writes can never overlap.
      */
     async deliverMessage(formatted, status, opts) {
+        const cancelled = () => opts?.deliveryEpoch !== undefined
+            && !this.isDeliveryEpochCurrent(opts.deliveryEpoch);
+        if (cancelled() || this.stormWindow?.isStopped())
+            return false;
         // Sanitize unclosed code fences — they cause CLI to wait for closure on Enter
         const fenceCount = (formatted.match(/```/g) || []).length;
         if (fenceCount % 2 !== 0) {
             // Odd number of fences = unclosed. Remove all code fences from the message.
             formatted = formatted.replace(/```/g, "");
         }
+        // Direct paths such as /steer, /btw, /raw and schedules do not pass the
+        // FleetManager idle gate. Hold them at the final common pane-write path so
+        // a tmux storm cannot force any text into a half-booted CLI.
+        if (this.stormWindow?.isDeliveryHeld(this.name)) {
+            this.logger.warn("Pane delivery held during tmux server recovery");
+            await this.stormWindow.waitForDeliveryAllowed(this.name);
+            if (cancelled() || this.stormWindow.isStopped())
+                return false;
+        }
         // Before anything reads the window id: a spawn in progress is about to change it.
         await this.waitForSpawnToSettle();
+        if (cancelled())
+            return false;
+        if (this.refuseFatalStartupDelivery(status))
+            return false;
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
         let handingOffToNativeQueue = false;
         // If the CLI is busy, either hand the complete submission to its native input
         // queue or wait for idle. Native queue support is an explicit backend capability:
         // normal Enter input has steering/interrupt semantics in several other CLIs.
-        if (windowId && this.controlClient && !this.controlClient.isIdle(windowId)) {
+        let readiness = "ready";
+        const gateWindowId = windowId;
+        if (gateWindowId && this.controlClient)
+            readiness = await this.paneReadinessForDelivery(gateWindowId);
+        if (readiness !== "ready") {
             if (status)
                 this.emit("message_queued", status);
-            if (supportsQueuedInput || opts?.steer) {
+            // Only a pane that is busy AND verifiably free of a blocking dialog may
+            // be handed to the native input queue or steered — those paths paste and
+            // press Enter at once. A dialog painted a moment ago is still "busy" to
+            // the silence gate, so the probe is mandatory here; "dialog"/"unknown"
+            // fall through to the wait.
+            const canHandOff = (supportsQueuedInput || opts?.steer)
+                && readiness === "busy"
+                && (await this.probeBlockingDialog()).state === "clear";
+            if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
                 // point — the user asked to interject, and the transaction's
@@ -2744,7 +3783,9 @@ export class Daemon extends EventEmitter {
             }
             else {
                 this.logger.debug("CLI busy — queuing message until idle");
-                const becameIdle = await this.controlClient.waitUntilIdle(windowId);
+                const becameIdle = await this.waitForPaneReadyForDelivery(gateWindowId);
+                if (cancelled())
+                    return false;
                 if (!becameIdle) {
                     // The pane never freed up. Report the failure instead of pasting into a
                     // wedged CLI (where the text would sit unsubmitted and the next message
@@ -2756,11 +3797,459 @@ export class Daemon extends EventEmitter {
                 }
             }
         }
+        // F3 (#kiro-enter-drop): an earlier delivery's Enter may have been dropped,
+        // leaving that message in the input row. Pasting on top would submit both as
+        // one. Submit the stranded text first (a bare Enter — a no-op on an empty
+        // prompt, verified live), then wait for the prompt to come back before our
+        // own paste. The wait happens OUTSIDE the pane lock like every other wait.
+        if (windowId && this.controlClient && !handingOffToNativeQueue) {
+            // Only a positively verified clear input row ("idle") lets the paste
+            // proceed. After "submitted" (the stranded text's turn is running) or
+            // "busy" (the pane changed under us, or could not be read) the prompt
+            // must come back AND the check runs again — the stranded text may still
+            // be there. "failed" (the Enter could not be sent) fails the delivery:
+            // pasting now would submit both messages as one.
+            for (let round = 0;; round++) {
+                // Budget check BEFORE the next mutating call: each round may send one
+                // recovery Enter, so exactly STRANDED_INPUT_MAX_ROUNDS of them go out.
+                if (round >= STRANDED_INPUT_MAX_ROUNDS) {
+                    this.logger.error({ round }, "Input row still not clear after the stranded-text recovery budget — reporting delivery failure");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
+                const stranded = await this.submitStrandedInputIfAny(windowId);
+                if (cancelled())
+                    return false;
+                if (stranded === "idle")
+                    break;
+                if (stranded === "failed") {
+                    this.logger.error({ round }, "Could not submit the stranded text — reporting delivery failure");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
+                const readyAgain = await this.waitForPaneReadyForDelivery(windowId);
+                if (cancelled())
+                    return false;
+                if (!readyAgain) {
+                    this.logger.error("Pane never returned to its prompt after submitting stranded input — reporting delivery failure");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
+            }
+        }
         // Everything above is *waiting*; everything below *writes*. Only the write is
         // held under the pane lock — holding it across the idle wait (up to 30 min)
         // would starve the runtime-dialog dismisser, which is often the very thing
         // that would let the pane go idle again.
-        return this.paneWriteLock.run(() => this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status));
+        for (let round = 0;; round++) {
+            const outcome = await this.paneWriteLock.run(async () => {
+                if (cancelled())
+                    return false;
+                if (this.refuseFatalStartupDelivery(status))
+                    return false;
+                // TOCTOU: the probes above ran outside this lock, and the CLI repaints
+                // whenever it likes — a resume prompt can be painted between "clear" and
+                // this critical section. Re-probe here, right before the write; a
+                // dialog or an unreadable pane means "not now", never "paste anyway".
+                if (this.deliveryBlockingDialogs().length > 0) {
+                    const probe = await this.probeBlockingDialog();
+                    if (probe.state !== "clear")
+                        return "dialog";
+                }
+                return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status);
+            });
+            if (outcome !== "dialog")
+                return outcome;
+            // Wait OUTSIDE the lock (holding it would starve the runtime dismisser),
+            // then try the write again — bounded, so a dialog nobody answers ends in
+            // an honest failure rather than a message that never lands.
+            if (round + 1 >= LATE_DIALOG_WRITE_ROUNDS) {
+                this.logger.error({ rounds: round + 1 }, "A dialog kept appearing before the pane write — reporting delivery failure");
+                if (status)
+                    this.emit("message_failed", status); // ❌
+                return false;
+            }
+            this.logger.info("Dialog appeared before the pane write — waiting for it to clear");
+            const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId) : false;
+            if (cancelled())
+                return false;
+            if (!clear) {
+                if (status)
+                    this.emit("message_failed", status); // ❌
+                return false;
+            }
+        }
+    }
+    /**
+     * The runtime dialogs that hold delivery while on screen (`blocksDelivery`
+     * or `holdOnly`). One canonical list and order, shared by the delivery gate
+     * and the runtime scanner, so both observers agree on which dialog they see.
+     * Startup-only patterns are deliberately excluded: several of them are loose
+     * on purpose ("I trust", "Yes, continue") and would match ordinary prose.
+     */
+    deliveryBlockingDialogs() {
+        return (this.backend?.getRuntimeDialogs?.() ?? []).filter(d => d.blocksDelivery || d.holdOnly);
+    }
+    static dialogKey(dialog) {
+        return `${dialog.pattern.source}/${dialog.pattern.flags}`;
+    }
+    /** A dialog counts only when it is the CURRENT interactive region, if the backend can tell; else by pattern. */
+    static dialogMatches(dialog, pane) {
+        return dialog.isActive ? dialog.isActive(pane) : dialog.pattern.test(pane);
+    }
+    /**
+     * Tri-state liveness. tmux's own isWindowAlive folds every query failure
+     * into `false`, so a transient tmux hiccup would read as "the CLI died" —
+     * and callers that clear the session on death must not act on that.
+     * getPaneStatus returns null on a failed/ambiguous query and a definite
+     * `{alive:false}` for a dead pane; only the latter is evidence.
+     */
+    async paneLiveness() {
+        if (!this.tmux)
+            return "unknown";
+        const tmux = this.tmux;
+        if (typeof tmux.getPaneStatus === "function") {
+            try {
+                const status = await tmux.getPaneStatus();
+                if (status === null)
+                    return "unknown";
+                return status.alive ? "alive" : "dead";
+            }
+            catch {
+                return "unknown";
+            }
+        }
+        try {
+            return (await tmux.isWindowAlive()) ? "alive" : "dead";
+        }
+        catch {
+            return "unknown";
+        }
+    }
+    /**
+     * Capture the pane and classify it. "unknown" (capture failed) is a distinct
+     * outcome on purpose: the resume dialog is silent, so silence cannot vouch
+     * for the pane, and treating an unreadable pane as clear is exactly the
+     * fail-open that answers a dialog with its default. Callers retry unknown
+     * within a bound and then fail loudly.
+     */
+    async probeBlockingDialog() {
+        if (!this.tmux || !this.backend)
+            return { state: "clear" };
+        const dialogs = this.deliveryBlockingDialogs();
+        if (dialogs.length === 0)
+            return { state: "clear" };
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch (err) {
+            this.logger.debug({ err }, "capture-pane failed during the dialog probe — pane state unknown");
+            return { state: "unknown" };
+        }
+        for (const dialog of dialogs) {
+            if (Daemon.dialogMatches(dialog, pane)) {
+                this.trackDialogParked(dialog);
+                return { state: "dialog", dialog };
+            }
+        }
+        this.trackDialogParked(null);
+        return { state: "clear" };
+    }
+    /**
+     * Remember how long a blocking dialog has been on screen. Once it has
+     * outlived DIALOG_PARKED_NOTIFY_MS — the auto-dismiss did not take, or the
+     * dialog is a hold-only variant — report it ONCE so a human answers it.
+     * Never presses a key: the whole point is that we do not know which option
+     * is safe. Identity is the pattern, so the delivery gate and the runtime
+     * scanner (same canonical list) never reset each other's clock.
+     */
+    trackDialogParked(dialog) {
+        if (!dialog) {
+            if (this.dialogParkedSince !== 0)
+                this.logger.info({ dialog: this.dialogParkedKey }, "Blocking dialog is gone from the pane");
+            this.dialogParkedSince = 0;
+            this.dialogParkedKey = null;
+            this.dialogParkedReported = false;
+            return;
+        }
+        const key = Daemon.dialogKey(dialog);
+        if (this.dialogParkedSince === 0 || this.dialogParkedKey !== key) {
+            this.dialogParkedSince = Date.now();
+            this.dialogParkedKey = key;
+            this.dialogParkedReported = false;
+            return;
+        }
+        if (!this.dialogParkedReported && Date.now() - this.dialogParkedSince >= DIALOG_PARKED_NOTIFY_MS) {
+            this.dialogParkedReported = true;
+            this.logger.warn({ dialog: dialog.description, parkedForMs: Date.now() - this.dialogParkedSince }, "CLI dialog is still on screen — not auto-answering, reporting for a human");
+            this.emit("dialog_parked", { name: this.name, description: dialog.description, holdOnly: dialog.holdOnly === true });
+        }
+    }
+    /**
+     * Bottom-anchored readiness for TUIs that drop Enter while busy (see
+     * CliBackend.dropsEnterWhileBusy). Output silence is necessary but not
+     * sufficient for them: Kiro paints nothing for the whole duration of a shell
+     * or MCP tool call (and for each 10s backend retry), yet an Enter arriving
+     * then is discarded. Reproduced deterministically: `sleep 9` tool, paste at
+     * t+6s → text stranded in the prompt row, next message submitted both.
+     * Other backends keep the silence-based gate byte-for-byte.
+     */
+    async isPaneReadyForDelivery(windowId) {
+        return (await this.paneReadinessForDelivery(windowId)) === "ready";
+    }
+    /**
+     * Why a pane is not deliverable matters. "busy" may be handed to a native
+     * input queue or steered (after its own dialog probe); "dialog" and "unknown"
+     * must never be — a paste + Enter into a dialog answers it with its default,
+     * and an unreadable pane proves nothing. The silence gate comes first and
+     * costs no capture, so a CLI that is simply working never pays for the probe.
+     */
+    async paneReadinessForDelivery(windowId) {
+        if (!this.isPaneIdleForDelivery(windowId))
+            return "busy";
+        const probe = await this.probeBlockingDialog();
+        if (probe.state !== "clear")
+            return probe.state;
+        if (this.backend?.dropsEnterWhileBusy?.() !== true)
+            return "ready";
+        const prompt = this.backend.getBottomReadyPattern?.();
+        if (!prompt || !this.tmux)
+            return "ready";
+        try {
+            const pane = await this.tmux.capturePane();
+            if (this.backend.getBusyPattern?.()?.test(pane))
+                return "busy";
+            if (bottomRowIsReady(pane, prompt))
+                return "ready";
+            // FAIL CLOSED on any non-blank screen without the prompt at the bottom.
+            // The obvious "unknown layout → fall back to silence" shortcut re-opened
+            // the bug: a long tool output scrolls the turn's own `N% !>` row out of
+            // the visible pane (capture-pane -p is the viewport only), the bottom row
+            // is tool output, the pane is quiet — and a paste there strands the text
+            // exactly as before. The prompt row is the only evidence Kiro accepts an
+            // Enter; a modal or panel is handled by the dialog dismisser, and the
+            // bounded wait reports a failure rather than pasting into a screen we do
+            // not understand. That includes a completely BLANK capture: a clear /
+            // redraw / alternate-screen transition paints nothing for a frame, tmux
+            // still accepts a paste, and "nothing visible" is not evidence the TUI is
+            // idle. The next 250ms poll sees the prompt if it is coming.
+            return "busy";
+        }
+        catch (err) {
+            // Same rule for a capture that fails: no positive proof, no paste. The
+            // poll retries; a persistently unreadable pane ends in the bounded
+            // timeout's ❌ rather than in a silently stranded message.
+            this.logger.debug({ err }, "capture-pane failed during the readiness check — treating the pane as not ready");
+            return "busy";
+        }
+    }
+    /**
+     * Like waitForPaneIdleForDelivery, plus the bottom-anchored prompt check for
+     * Enter-dropping TUIs. Polls at a coarse cadence (each poll is a capture-pane)
+     * only after the pane is already quiet, so the common fast-idle delivery still
+     * costs a single capture.
+     */
+    async waitForPaneReadyForDelivery(windowId, timeoutMs = 30 * 60_000) {
+        // Every backend polls: readiness now also means "no blocking dialog on
+        // screen", and a dialog disappears without any output edge the silence
+        // gate could see.
+        const deadline = Date.now() + timeoutMs;
+        const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true;
+        let unknownStreak = 0;
+        for (;;) {
+            const remaining = deadline - Date.now();
+            if (remaining <= 0)
+                return false;
+            const idle = await this.waitForPaneIdleForDelivery(windowId, remaining);
+            if (!idle)
+                return false;
+            // The idle wait just resolved, so re-reading the silence gate would only
+            // add a stale-cache race; ask the pane the remaining questions directly.
+            if (bottomGated) {
+                if (await this.isPaneReadyForDelivery(windowId))
+                    return true;
+            }
+            else {
+                const probe = await this.probeBlockingDialog();
+                if (probe.state === "clear")
+                    return true;
+                if (probe.state === "unknown") {
+                    if (++unknownStreak >= DIALOG_PROBE_UNKNOWN_MAX) {
+                        this.logger.error({ probes: unknownStreak }, "Pane stayed unreadable during the dialog probe — refusing to deliver blind");
+                        return false;
+                    }
+                }
+                else {
+                    unknownStreak = 0;
+                }
+            }
+            await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
+        }
+    }
+    /**
+     * F3: if an AgEnD message is sitting unsubmitted in the input row (a previous
+     * delivery's Enter was dropped), submit it with one bare Enter under the pane
+     * lock. Only acts on a positive signature — the `[user:`/`[from:` marker every
+     * pasted message carries — never on Kiro's own placeholder hints.
+     *
+     * Outcomes: "idle" = positively verified nothing stranded (the caller may
+     * paste); "submitted" = an Enter went out for the stranded text; "busy" = the
+     * pane is not at its prompt or could not be read (the caller must wait for
+     * the prompt and run this check AGAIN before pasting — never assume someone
+     * else submitted it); "failed" = the Enter could not be sent (the delivery
+     * must fail rather than paste on top of the stranded text).
+     */
+    async submitStrandedInputIfAny(windowId) {
+        if (this.backend?.dropsEnterWhileBusy?.() !== true || !this.tmux)
+            return "idle";
+        const prompt = this.backend.getBottomReadyPattern?.();
+        if (!prompt)
+            return "idle";
+        // Pre-check outside the lock so the common case (verified clear) never
+        // contends with the dialog dismisser. Only a POSITIVE "clear" skips the
+        // lock; an unreadable pane is re-examined under it, not waved through.
+        const pre = await this.strandedInputState(prompt);
+        if (pre === "clear")
+            return "idle";
+        if (pre === "busy")
+            return "busy";
+        if (pre === "stranded") {
+            this.logger.warn({ windowId }, "Unsubmitted message found in the input row — submitting it before this delivery");
+        }
+        return this.paneWriteLock.run(async () => {
+            // Re-check UNDER the lock right before the key goes out: between the
+            // pre-check and acquiring the lock the CLI may have started generating
+            // (the stranded text got submitted by someone else, or the dismisser
+            // acted), or a fatal startup screen may have come up. A bare Enter is a
+            // no-op at an empty prompt, but into a modal it is a confirmation.
+            if (this.fatalStartupBlocked)
+                return "busy";
+            const state = await this.strandedInputState(prompt);
+            if (state === "clear")
+                return "idle";
+            if (state !== "stranded")
+                return "busy"; // busy, or unreadable: no evidence the prompt is free
+            const sent = await this.sendDeliveryEnter("stranded-input-submit");
+            return sent ? "submitted" : "failed";
+        });
+    }
+    /**
+     * "stranded": an AgEnD message sits in the input row; "clear": the prompt is
+     * at the bottom with no stranded text; "busy": generating, or the prompt is
+     * not at the bottom (incl. a blank frame); "unknown": the pane could not be
+     * read. Only "clear" is positive evidence.
+     */
+    async strandedInputState(prompt) {
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return "unknown";
+        }
+        if (this.backend?.getBusyPattern?.()?.test(pane))
+            return "busy";
+        if (strandedAgendMessageInInput(pane, prompt))
+            return "stranded";
+        return bottomRowIsReady(pane, prompt) ? "clear" : "busy";
+    }
+    /**
+     * F2: for Enter-dropping TUIs, "some output after Enter" proves nothing — the
+     * turn that made the pane look idle keeps producing output. Confirm the
+     * SUBMISSION instead: the pasted text is gone from the input row ("absent"),
+     * or the TUI's own busy marker is up. "unknown" = the pane could not be read;
+     * it never counts as confirmed.
+     */
+    async pasteResidue(formatted) {
+        const prompt = this.backend?.getBottomReadyPattern?.();
+        if (!prompt || !this.tmux)
+            return "absent";
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return "unknown";
+        }
+        if (this.backend?.getBusyPattern?.()?.test(pane))
+            return "absent"; // generating = submitted
+        return pasteLeftInInput(pane, prompt, formatted) ? "present" : "absent";
+    }
+    /**
+     * Submission = the legacy idle→busy output signal AND the pasted text has
+     * verifiably left the input row. The first alone is what produced false ✅s:
+     * the turn that made the pane look idle keeps emitting output after our
+     * (dropped) Enter — and an unreadable pane is not a verified absence either.
+     */
+    async confirmSubmittedAfterEnter(windowId, enterAt, formatted) {
+        const sawOutput = await this.confirmBusyAfterEnter(windowId, enterAt);
+        const residue = await this.pasteResidue(formatted);
+        if (residue === "unknown")
+            this.logger.warn("Could not read the pane after Enter — not confirming the submission");
+        return sawOutput && residue === "absent";
+    }
+    /**
+     * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
+     * no pane write may happen: paste+Enter into the corrupt-config modal would
+     * confirm "Exit and fix manually" and exit the CLI. The message is failed (❌)
+     * rather than held — the accompanying config_error notification tells the user
+     * what to fix, and holding would only build a queue that floods the pane the
+     * moment the flag clears.
+     */
+    refuseFatalStartupDelivery(status) {
+        if (!this.fatalStartupBlocked)
+            return false;
+        this.logger.error("Delivery refused — CLI is parked on a fatal startup screen");
+        if (status)
+            this.emit("message_failed", status); // ❌
+        return true;
+    }
+    /**
+     * A raw `%output` silence check is authoritative for ordinary TUIs. It is not
+     * for a backend such as agy whose status-line hook periodically redraws an
+     * identical screen. In that case trust an idle pane-state snapshot only when
+     * it was captured after both the latest output and the latest control-client
+     * observation reset.
+     */
+    isPaneIdleForDelivery(windowId) {
+        if (!this.controlClient)
+            return true;
+        if (this.controlClient.isIdle(windowId))
+            return true;
+        if (this.backend?.hasPeriodicPaneRedraw?.() !== true || this.instanceState !== "idle")
+            return false;
+        const lastOutputAt = this.controlClient.getLastOutputAt(windowId);
+        if (lastOutputAt === undefined || !this.instanceStateMachine)
+            return false;
+        const observedAt = this.instanceStateMachine.snapshot().observedAt;
+        return observedAt >= lastOutputAt
+            && observedAt >= this.controlClient.getObservationResetAt();
+    }
+    waitForPaneIdleForDelivery(windowId, timeoutMs = 30 * 60_000) {
+        if (!this.controlClient)
+            return Promise.resolve(true);
+        if (this.backend?.hasPeriodicPaneRedraw?.() !== true) {
+            return this.controlClient.waitUntilIdle(windowId, timeoutMs);
+        }
+        if (this.isPaneIdleForDelivery(windowId))
+            return Promise.resolve(true);
+        return new Promise(resolve => {
+            const check = setInterval(() => {
+                if (!this.isPaneIdleForDelivery(windowId))
+                    return;
+                clearInterval(check);
+                clearTimeout(timer);
+                resolve(true);
+            }, 50);
+            const timer = setTimeout(() => {
+                clearInterval(check);
+                resolve(false);
+            }, timeoutMs);
+        });
     }
     /**
      * The write half of a delivery: paste → Enter → confirm, with retries.
@@ -2788,7 +4277,16 @@ export class Daemon extends EventEmitter {
             const pasteStartedAt = Date.now();
             const pasted = await this.tmux.pasteBuffer(formatted);
             if (!pasted) {
-                this.logger.warn({ attempt }, "pasteBuffer failed — recovering window and backing off");
+                const tmuxError = this.tmux.getLastPasteError?.() ?? "unknown tmux paste failure";
+                const recoverable = this.tmux.isLastPasteFailureRecoverable?.() ?? true;
+                this.logger[recoverable ? "warn" : "error"]({ attempt, tmuxError, recoverable }, recoverable
+                    ? "pasteBuffer failed — recovering window and backing off"
+                    : "pasteBuffer failed — non-retryable tmux error");
+                if (!recoverable) {
+                    if (status)
+                        this.emit("message_failed", status);
+                    return false;
+                }
                 windowId = (await this.recoverWindow()) ?? windowId;
                 if (attempt < maxAttempts)
                     await new Promise(r => setTimeout(r, 2000));
@@ -2870,7 +4368,9 @@ export class Daemon extends EventEmitter {
                 }
                 const repasted = await this.tmux.pasteBuffer(formatted);
                 if (!repasted) {
-                    this.logger.error("Idle-gated redelivery paste failed after native-queue silent loss");
+                    this.logger.error({
+                        tmuxError: this.tmux.getLastPasteError?.() ?? "unknown tmux paste failure",
+                    }, "Idle-gated redelivery paste failed after native-queue silent loss");
                     if (status)
                         this.emit("message_failed", status); // ❌
                     return false;
@@ -2910,7 +4410,36 @@ export class Daemon extends EventEmitter {
                     this.emit("message_failed", status); // ❌
                 return false;
             }
-            if (windowId && this.controlClient) {
+            if (windowId && this.controlClient && this.backend?.dropsEnterWhileBusy?.() === true) {
+                // F2: output after Enter is necessary but not sufficient — the paste
+                // must also have LEFT the input row.
+                let submitted = await this.confirmSubmittedAfterEnter(windowId, enterAt, formatted);
+                if (!submitted) {
+                    // The Enter landed while the TUI was still busy (it kept the text but
+                    // dropped the key). A retry is only useful once the prompt is back —
+                    // bounded, since we hold the pane lock here.
+                    this.logger.warn("Message not submitted after Enter — waiting for the prompt, then re-sending Enter once");
+                    const promptBack = await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS);
+                    const retryAt = Date.now();
+                    if (promptBack && !(await this.sendDeliveryEnter("stranded-text-retry"))) {
+                        if (status)
+                            this.emit("message_failed", status); // ❌
+                        return false;
+                    }
+                    submitted = promptBack && await this.confirmSubmittedAfterEnter(windowId, retryAt, formatted);
+                }
+                if (submitted) {
+                    if (status)
+                        this.emit("message_confirmed", status); // ✅
+                }
+                else {
+                    this.logger.error("Message pasted but never submitted (text still in the input row after Enter retry)");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
+            }
+            else if (windowId && this.controlClient) {
                 let becameBusy = await this.confirmBusyAfterEnter(windowId, enterAt);
                 if (!becameBusy) {
                     this.logger.warn("No idle→busy transition after Enter — re-sending Enter once");
@@ -3064,14 +4593,24 @@ export class Daemon extends EventEmitter {
         const args = (msg.args ?? {});
         const requestId = msg.requestId;
         this.logger.debug({ tool, requestId }, "Tool call from MCP server");
+        // A tool call can only come from a live MCP server of ours — proof of life
+        // that outranks whatever the pid slot says.
+        if (this.socketSessionNames.get(socket) === this.name) {
+            this.noteMcpProofOfLife("tool_call", this.socketPids.get(socket));
+        }
         // For now, log and respond. Full adapter routing will be wired in fleet manager.
         const respond = (result, error) => {
             // A message that verifiably went out stands down the dead-MCP proxy reply
             // for this turn: the agent proved it can still speak for itself.
             if (!error && result != null && TURN_REPLY_TOOLS.has(tool)) {
                 this.turnOutboundDelivered = true;
+                if (tool === "reply")
+                    this.turnReplyDelivered = true;
+            }
+            const sent = this.ipcServer?.send(socket, { requestId, result, error }) ?? false;
+            if (!sent) {
+                this.logger.warn({ tool, requestId }, "Tool result could not be returned — originating MCP socket is closed");
             }
-            this.ipcServer?.send(socket, { requestId, result, error });
         };
         // Repo checkout — handled locally in daemon (no fleet-manager)
         if (tool === "checkout_repo") {
@@ -3084,13 +4623,7 @@ export class Daemon extends EventEmitter {
         }
         if (tool === "set_display_name" || tool === "set_description") {
             const type = tool === "set_display_name" ? "fleet_set_display_name" : "fleet_set_description";
-            const fleetReqId = `${tool === "set_display_name" ? "dn" : "desc"}_${requestId}`;
-            this.ipcServer?.broadcast({
-                type,
-                payload: args,
-                meta: { instance_name: this.name },
-                fleetRequestId: fleetReqId,
-            });
+            const fleetReqId = `${tool === "set_display_name" ? "dn" : "desc"}_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
                 respond(null, `${tool} timed out`);
@@ -3099,16 +4632,16 @@ export class Daemon extends EventEmitter {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
             });
-            return;
-        }
-        if (tool === TASK_TOOL) {
-            const fleetReqId = `task_${requestId}`;
             this.ipcServer?.broadcast({
-                type: "fleet_task",
+                type,
                 payload: args,
                 meta: { instance_name: this.name },
                 fleetRequestId: fleetReqId,
             });
+            return;
+        }
+        if (tool === TASK_TOOL) {
+            const fleetReqId = `task_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
                 respond(null, `Task operation timed out after ${daemonBudgetMs(tool) / 1000}s`);
@@ -3117,6 +4650,12 @@ export class Daemon extends EventEmitter {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
             });
+            this.ipcServer?.broadcast({
+                type: "fleet_task",
+                payload: args,
+                meta: { instance_name: this.name },
+                fleetRequestId: fleetReqId,
+            });
             return;
         }
         if (DECISION_TOOLS.has(tool)) {
@@ -3125,13 +4664,7 @@ export class Daemon extends EventEmitter {
                 list_decisions: "fleet_decision_list",
                 update_decision: "fleet_decision_update",
             };
-            const fleetReqId = `dec_${requestId}`;
-            this.ipcServer?.broadcast({
-                type: typeMap[tool],
-                payload: args,
-                meta: { instance_name: this.name, working_directory: this.config.working_directory },
-                fleetRequestId: fleetReqId,
-            });
+            const fleetReqId = `dec_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
                 respond(null, `Decision operation timed out after ${daemonBudgetMs(tool) / 1000}s`);
@@ -3140,6 +4673,12 @@ export class Daemon extends EventEmitter {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
             });
+            this.ipcServer?.broadcast({
+                type: typeMap[tool],
+                payload: args,
+                meta: { instance_name: this.name, working_directory: this.config.working_directory },
+                fleetRequestId: fleetReqId,
+            });
             return;
         }
         if (SCHEDULE_TOOLS.has(tool)) {
@@ -3151,13 +4690,7 @@ export class Daemon extends EventEmitter {
             };
             // Use fleetRequestId (not requestId) to avoid MCP server resolving the
             // pending tool call prematurely when it receives the broadcast.
-            const fleetReqId = `sched_${requestId}`;
-            this.ipcServer?.broadcast({
-                type: typeMap[tool],
-                payload: args,
-                meta: { chat_id: this.lastChatId, thread_id: this.lastThreadId, instance_name: this.name },
-                fleetRequestId: fleetReqId,
-            });
+            const fleetReqId = `sched_${++this.fleetRequestSeq}_${requestId}`;
             // Wait for fleet_schedule_response via pending request map
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
@@ -3167,6 +4700,12 @@ export class Daemon extends EventEmitter {
                 clearTimeout(timeout);
                 respond(respMsg.result, respMsg.error);
             });
+            this.ipcServer?.broadcast({
+                type: typeMap[tool],
+                payload: args,
+                meta: { chat_id: this.lastChatId, thread_id: this.lastThreadId, instance_name: this.name },
+                fleetRequestId: fleetReqId,
+            });
             return;
         }
         if (CROSS_INSTANCE_TOOLS.has(tool)) {
@@ -3174,15 +4713,8 @@ export class Daemon extends EventEmitter {
             if (this.topicMode && this.ipcServer) {
                 // Use fleetRequestId (not requestId) to avoid MCP server resolving the
                 // pending tool call prematurely when it receives the broadcast.
-                const fleetReqId = `xmsg_${requestId}`;
+                const fleetReqId = `xmsg_${++this.fleetRequestSeq}_${requestId}`;
                 const senderSessionName = this.socketSessionNames.get(socket);
-                this.ipcServer.broadcast({
-                    type: "fleet_outbound",
-                    tool,
-                    args,
-                    fleetRequestId: fleetReqId,
-                    senderSessionName,
-                });
                 // Shared table, so delete_instance and the deployment tools get the same
                 // budget here as the MCP client expects (the ad-hoc list omitted them).
                 const crossTimeoutMs = daemonBudgetMs(tool);
@@ -3194,6 +4726,13 @@ export class Daemon extends EventEmitter {
                     clearTimeout(timeout);
                     respond(respMsg.result, respMsg.error);
                 });
+                this.ipcServer.broadcast({
+                    type: "fleet_outbound",
+                    tool,
+                    args,
+                    fleetRequestId: fleetReqId,
+                    senderSessionName,
+                });
             }
             else {
                 respond(null, "Cross-instance messaging requires topic mode");
@@ -3227,8 +4766,24 @@ export class Daemon extends EventEmitter {
             // The fleet manager's IPC client receives this and routes to shared adapter.
             // Use fleetRequestId (not requestId) to avoid other MCP sessions on this daemon
             // from prematurely resolving their pending requests when they receive the broadcast.
-            const fleetReqId = `tool_${requestId}`;
+            // requestId is local to one MCP server process. Claude may keep multiple
+            // MCP children attached (main session, resumed session, subagent); those
+            // processes all emit requestId=1,2,... and previously overwrote this
+            // shared pending map. The wrong caller could then receive another POST's
+            // success + messageId while its own reply had never been confirmed.
+            const fleetReqId = `tool_${++this.fleetRequestSeq}_${requestId}`;
             const outboundKey = fleetReqId;
+            const timeout = setTimeout(() => {
+                this.pendingIpcRequests.delete(outboundKey);
+                respond(null, `Fleet outbound timed out after ${daemonBudgetMs(tool) / 1000}s`);
+            }, daemonBudgetMs(tool));
+            this.pendingIpcRequests.set(outboundKey, (respMsg) => {
+                clearTimeout(timeout);
+                respond(respMsg.result, respMsg.error);
+            });
+            // Register the waiter before broadcasting. A fast/mock adapter can settle
+            // immediately; broadcasting first left a response-before-registration
+            // window that degraded into a timeout despite a completed POST.
             this.ipcServer?.broadcast({
                 type: "fleet_outbound",
                 tool,
@@ -3239,14 +4794,6 @@ export class Daemon extends EventEmitter {
                 // from a secondary world, and message ids are not portable across bots.
                 adapterId: this.lastAdapterId,
             });
-            const timeout = setTimeout(() => {
-                this.pendingIpcRequests.delete(outboundKey);
-                respond(null, `Fleet outbound timed out after ${daemonBudgetMs(tool) / 1000}s`);
-            }, daemonBudgetMs(tool));
-            this.pendingIpcRequests.set(outboundKey, (respMsg) => {
-                clearTimeout(timeout);
-                respond(respMsg.result, respMsg.error);
-            });
             return;
         }
         const adapter = adapters[0];
@@ -3256,7 +4803,10 @@ export class Daemon extends EventEmitter {
     }
     /** Build config object for the CLI backend */
     buildBackendConfig() {
-        const isCliMode = this.config.agent_mode === "cli" || (this.config.agent_mode == null && this.config.backend === "antigravity");
+        // Antigravity 1.1.17 has no per-workspace MCP config, but its global MCP
+        // children inherit the CLI process environment. The backend installs one
+        // environment-selecting launcher, so MCP is now the safe default here too.
+        const isCliMode = this.config.agent_mode === "cli";
         const sockPath = join(this.instanceDir, "channel.sock");
         let serverJs = join(__dirname, "channel", "mcp-server.js");
         if (!existsSync(serverJs)) {
@@ -3515,9 +5065,35 @@ export class Daemon extends EventEmitter {
                 throw new Error("No backend configured — cannot spawn CLI window");
             }
             const attemptedResume = !this.skipResume;
-            const alive = await this.trySpawn();
+            // A resume launch may get a longer budget than a fresh one (kiro: the
+            // conversation must come back from the backend before anything paints).
+            const resumeBudget = attemptedResume ? this.startupBudgetFor(true) : undefined;
+            let alive = await this.trySpawn(false, resumeBudget);
+            if (!alive && attemptedResume) {
+                // Resume failed. Before abandoning the session:
+                //  1. If the backend is unreachable (fleet-level memory, or this very pane
+                //     shows the outage text), clearing the session would trade a
+                //     transient outage for permanent conversation loss — and the fresh
+                //     start would hang on the same backend. Fail the startup and keep the
+                //     session; the fleet's delayed retry comes back once it is up.
+                //  2. Otherwise, for backends that ask for it, retry resume ONCE — the
+                //     first miss is usually slowness, not a broken session.
+                await this.noteStartupPaneForBackendOutage();
+                await this.failStartupIfBackendUnreachable();
+                if (this.backend.retriesResumeOnStartupFailure?.() === true) {
+                    this.logger.warn("Resume startup failed — retrying resume once before abandoning the session");
+                    await this.killProcessTree();
+                    await this.tmux.killWindow();
+                    alive = await this.trySpawn(false, resumeBudget);
+                    if (!alive) {
+                        await this.noteStartupPaneForBackendOutage();
+                        await this.failStartupIfBackendUnreachable();
+                    }
+                }
+            }
             if (!alive) {
-                // First attempt failed (stale --resume, crash, rate limit, etc.)
+                // Resume (or a fresh start) failed for a reason we do not recognise as an
+                // outage (stale --resume, crash, rate limit, etc.).
                 // Clean slate: clear session-id, skip resume, and retry once.
                 this.logger.warn("CLI startup failed — clearing session-id and retrying without resume");
                 const sidFile = join(this.instanceDir, "session-id");
@@ -3528,7 +5104,7 @@ export class Daemon extends EventEmitter {
                 this.skipResume = true;
                 await this.killProcessTree();
                 await this.tmux.killWindow();
-                const retryAlive = await this.trySpawn();
+                const retryAlive = await this.trySpawn(false, this.startupBudgetFor(false));
                 if (!retryAlive) {
                     await this.killProcessTree();
                     await this.tmux.killWindow();
@@ -3537,6 +5113,9 @@ export class Daemon extends EventEmitter {
             }
             else if (attemptedResume) {
                 resumedSuccessfully = true;
+                // A resume needs the backend: its success is positive proof the backend
+                // is reachable again (a fresh prompt is local and proves nothing).
+                this.backendOutage?.clear(this.backendKey());
             }
             this.lastSpawnAt = Date.now();
             this.skipResume = false; // CLI started successfully — reset for next spawn
@@ -3547,6 +5126,122 @@ export class Daemon extends EventEmitter {
         }
         return resumedSuccessfully;
     }
+    /**
+     * Startup budget for this launch: the backend's override (resume-aware), never
+     * below a user-configured startup_timeout_ms; undefined = trySpawn's default.
+     */
+    startupBudgetFor(resume) {
+        const override = this.backend?.getStartupBudgetMs?.({ resume });
+        if (override == null)
+            return undefined;
+        const configured = this.config.startup_timeout_ms;
+        return configured != null ? Math.max(configured, override) : override;
+    }
+    /** Effective wake budget = max(caller timeout, backend resume override, configured startup_timeout_ms). */
+    wakeBudgetMs(timeoutMs) {
+        return Math.max(timeoutMs, this.startupBudgetFor(!this.skipResume) ?? 0, this.config.startup_timeout_ms ?? 0);
+    }
+    /** The fleet-level backend key this instance runs on (matches the lifecycle's backendOf). */
+    backendKey() {
+        return this.runtimeIdentity?.backend ?? this.config.backend ?? this.backend?.binaryName ?? "unknown";
+    }
+    /**
+     * After a failed launch, read the pane for the backend's fleet-wide outage
+     * text (e.g. kiro's `dispatch failure (timeout) … kiro.dev`) and record it.
+     * The lifecycle only learns about outages from RUNNING instances; during a
+     * post-update herd nothing is running yet, so the startup path must report
+     * what it sees or the first instance in would clear its session for nothing.
+     */
+    async noteStartupPaneForBackendOutage() {
+        if (!this.backendOutage || !this.backend || !this.tmux)
+            return;
+        const outagePattern = this.backend.getErrorPatterns?.().find(p => p.fleetWide && p.type === "network");
+        if (!outagePattern)
+            return;
+        try {
+            const pane = await this.tmux.capturePane();
+            if (!outagePattern.pattern.test(pane))
+                return;
+            const detail = this.resolveErrorMessage(pane, outagePattern);
+            this.backendOutage.record(this.backendKey(), this.name, detail);
+            this.logger.warn({ detail }, "Startup pane shows the backend outage text");
+        }
+        catch { /* capture failed — nothing to learn */ }
+    }
+    /**
+     * Fail the startup WITHOUT touching the session while the backend is known to
+     * be down. The failed window is torn down first: the alternative — a live but
+     * never-ready CLI left behind while the daemon reports `crashed` — would keep
+     * the health monitor from ever seeing a dead pane and retrying.
+     */
+    async failStartupIfBackendUnreachable() {
+        if (!this.backendOutage?.isActive(this.backendKey()))
+            return;
+        this.logger.warn("Backend unreachable — keeping the session and failing startup for a delayed retry");
+        await this.killProcessTree();
+        await this.tmux.killWindow();
+        throw new BackendUnreachableStartupError(this.backendKey());
+    }
+    /**
+     * Crash-respawn ran into the backend outage: the ordinary path would leave
+     * `crashed` + a paused monitor + nothing scheduled (and count it as a crash).
+     * Hand the instance to the fleet instead — the lifecycle stops this daemon
+     * and the fleet's delayed startup retry re-creates it later with the session
+     * intact. Returns true when someone took the hand-off.
+     */
+    handOffBackendUnreachableRespawn(err) {
+        if (!(err instanceof BackendUnreachableStartupError))
+            return false;
+        if (this.listenerCount("startup_backend_unreachable") === 0)
+            return false;
+        this.logger.warn({ backend: err.backend }, "Respawn blocked by backend outage — handing off to the fleet's delayed startup retry");
+        this.healthCheckPaused = true;
+        this.emit("startup_backend_unreachable", { name: this.name, backend: err.backend });
+        return true;
+    }
+    /**
+     * Dispose a Daemon whose start() rejected. The lifecycle registers a daemon
+     * only after start() resolves, so nothing else owns this object — and by the
+     * time the spawn fails it has already bound its IPC server (channel.sock),
+     * written daemon.pid and possibly created a window. Left alone, each failed
+     * start leaks one live-but-unreachable server handle (the next start unlinks
+     * the socket path and binds a new one), multiplied by the automatic startup
+     * retries. Idempotent, and fast: no graceful CLI quit, the CLI never reached
+     * its prompt.
+     */
+    async abortStartup() {
+        if (this.startupAborted)
+            return;
+        this.startupAborted = true;
+        this.freezeRuntimeMonitors();
+        this.pendingIpcRequests.clear();
+        try {
+            await this.killProcessTree();
+        }
+        catch { /* nothing running */ }
+        if (this.tmux) {
+            const windowId = this.tmux.getWindowId();
+            try {
+                await this.tmux.killWindow();
+            }
+            catch { /* window may not exist */ }
+            if (windowId)
+                this.controlClient?.unregisterWindow(windowId);
+        }
+        try {
+            await this.ipcServer?.close();
+        }
+        catch (err) {
+            this.logger.debug({ err }, "IPC server close failed during startup abort");
+        }
+        this.ipcServer = null;
+        for (const file of ["daemon.pid", "window-id"]) {
+            try {
+                unlinkSync(join(this.instanceDir, file));
+            }
+            catch { /* absent */ }
+        }
+    }
     /** Kill the entire process tree of the current tmux pane (CLI + MCP server). */
     async killProcessTree(signal = "SIGTERM") {
         if (!this.tmux)
@@ -3567,6 +5262,15 @@ export class Daemon extends EventEmitter {
      * Returns true if CLI is ready, false if it failed or got stuck.
      */
     async trySpawn(reuseWindow = false, startupTimeoutMs) {
+        if (!this.spawnGate)
+            return this.trySpawnInsideGate(reuseWindow, startupTimeoutMs);
+        return this.spawnGate.run({
+            instanceName: this.name,
+            workingDirectory: this.config.working_directory,
+            reason: reuseWindow ? "wake" : this.lastSpawnAt > 0 ? "recovery" : "startup",
+        }, () => this.trySpawnInsideGate(reuseWindow, startupTimeoutMs));
+    }
+    async trySpawnInsideGate(reuseWindow = false, startupTimeoutMs) {
         const backendConfig = this.buildBackendConfig();
         // Compare freshly-built instructions against the last value the agent was
         // told about. Computed for ALL backends (not gated by
@@ -3631,6 +5335,9 @@ export class Daemon extends EventEmitter {
         const cmd = `${envPrefix} ` + this.backend.buildCommand(backendConfig);
         // Ensure tmux session exists (may have been destroyed if all windows died)
         await TmuxManager.ensureSession(this.tmuxSessionName);
+        if (this.stormWindow?.observeServerAlive(await TmuxManager.getServerPid(this.tmuxSessionName))) {
+            this.emit("tmux_server_crash", this.name);
+        }
         let windowId;
         if (reuseWindow) {
             this.controlClient?.unregisterWindow(this.tmux.getWindowId());
@@ -3682,18 +5389,47 @@ export class Daemon extends EventEmitter {
         // Dismiss confirmation dialogs and verify CLI reached prompt.
         // With remain-on-exit, isWindowAlive() returns true even for dead panes,
         // but a startup crash would already be caught by waitForOutput/waitForIdle above.
-        if (!await this.tmux.isWindowAlive())
+        return this.finishStartupScan(STARTUP_DIALOG_BUDGET_MS);
+    }
+    /**
+     * The last leg of a spawn: confirm the pane is not positively dead, then run
+     * the dialog scan. The old pre-check used tmux's isWindowAlive(), which folds
+     * every query failure into `false` — so one transient tmux error right here
+     * read as "the CLI died", the caller abandoned --resume and cleared the
+     * session, before the tri-state scanner ever got a look. Only a POSITIVE
+     * dead pane fails; an unknown liveness is the scanner's problem (bounded,
+     * session-preserving).
+     */
+    async finishStartupScan(budgetMs) {
+        if ((await this.paneLiveness()) === "dead")
             return false;
-        const ready = await this.dismissDialogsUntilReady(3);
-        if (ready)
+        const ready = await this.dismissDialogsUntilReady(budgetMs);
+        // A fatal startup screen returns true (the spawn is over — respawning
+        // would only re-show the same screen) but is NOT ready-for-delivery:
+        // fatalStartupBlocked gates every pane write in deliverMessage.
+        if (ready && !this.fatalStartupBlocked)
             this.firstDeliveryDelay.recordReady();
         return ready;
     }
     /**
-     * Repeatedly check pane content, dismiss any confirmation dialogs,
-     * and return true once CLI reaches a ready prompt.
+     * Poll the pane within a wall-clock budget, dismiss the confirmation dialogs
+     * the backend knows, and return true once the CLI shows a ready prompt with
+     * no dialog on screen for two consecutive polls.
+     *
+     * Polls are spaced by `pollMs` and every key sequence / render wait counts
+     * against the budget: Claude paints its session-resume prompt only after
+     * loading the session, i.e. AFTER the first quiet moment, and three
+     * back-to-back captures used to miss it — the scan then "assumed ok", the
+     * `❯` inside the dialog satisfied the ready pattern, and the instance sat on
+     * the dialog with deliveries free to press Enter into it.
+     *
+     * Only hard evidence returns false: a dead window or "command not found".
+     * A transient capture failure is logged and retried; exhausting the budget is
+     * logged at WARN and returns true — false makes the caller abandon --resume
+     * and clear the session, which is the loss this code exists to prevent. The
+     * delivery gate keeps refusing pastes while a blocking dialog is visible.
      */
-    async dismissDialogsUntilReady(maxAttempts) {
+    async dismissDialogsUntilReady(budgetMs, pollMs = STARTUP_DIALOG_POLL_MS) {
         // Backend-specific startup dialogs, with hardcoded fallback for backward compat
         const startupDialogs = this.backend?.getStartupDialogs?.() ?? [
             { pattern: /[❯›]\s*\d+\.\s*No/m, keys: ["Down", "Enter"], description: "Confirmation dialog — navigate past No" },
@@ -3701,14 +5437,76 @@ export class Daemon extends EventEmitter {
             { pattern: /No, exit|No, quit|Don't trust|I accept|I trust|Yes, continue|Trust folder/i, keys: ["Enter"], description: "Generic confirmation dialog" },
             { pattern: /Resume Session/i, keys: ["Escape"], description: "Resume session picker — start fresh" },
         ];
-        for (let i = 0; i < maxAttempts; i++) {
+        const deadline = Date.now() + budgetMs;
+        const remaining = () => deadline - Date.now();
+        const sleep = async () => { if (remaining() > 0)
+            await new Promise(r => setTimeout(r, Math.min(pollMs, Math.max(remaining(), 0)))); };
+        let cleanReadyPolls = 0;
+        let lastDialog = null;
+        let captureFailures = 0;
+        let attempts = 0;
+        do {
+            attempts++;
+            let pane;
+            try {
+                pane = await this.tmux.capturePane();
+            }
+            catch (err) {
+                // Transient tmux trouble is not evidence about the CLI. Returning false
+                // here would clear the session; retry within the budget instead.
+                captureFailures++;
+                this.logger.warn({ err, captureFailures }, "capture-pane failed during the startup dialog scan — retrying");
+                // Only a POSITIVE dead pane ends the scan; an unanswerable liveness
+                // query is the same transient trouble and must not clear the session.
+                if ((await this.paneLiveness()) === "dead")
+                    return false;
+                await sleep();
+                continue;
+            }
             try {
-                const pane = await this.tmux.capturePane();
                 // Try each startup dialog pattern before checking ready state
                 let matched = false;
+                lastDialog = null;
                 for (const dialog of startupDialogs) {
-                    if (dialog.pattern.test(pane)) {
-                        this.logger.debug(`Dismissing startup dialog: ${dialog.description}`);
+                    if (Daemon.dialogMatches(dialog, pane)) {
+                        lastDialog = dialog;
+                        cleanReadyPolls = 0;
+                        // Start the parked clock for every delivery-blocking dialog, exact
+                        // ones included: if the auto-dismiss keeps failing here, the human
+                        // report should count from first sight, not from the runtime scan.
+                        if (!dialog.fatal && this.deliveryBlockingDialogs().some(d => Daemon.dialogKey(d) === Daemon.dialogKey(dialog))) {
+                            this.trackDialogParked(dialog);
+                        }
+                        // A fatal startup screen cannot be dismissed by keypresses (e.g. a
+                        // corrupt claude.json modal offering only "exit" / "reset config").
+                        // It must be caught HERE and not fall through to the ready check:
+                        // the modal contains the `❯` selector the ready pattern matches, so
+                        // it would otherwise pass as ready and queued messages would be
+                        // typed into the modal. Report the error (pause stops delivery) and
+                        // stop the retry loop — like the sign-in screen case below, only a
+                        // human fixing the config ends this state.
+                        if (dialog.fatal) {
+                            // Block deliveries BEFORE the emit: the pty_error pause handler
+                            // is async, and a queued message would otherwise win the race
+                            // and be pasted into the modal.
+                            this.fatalStartupBlocked = true;
+                            if (!this.fatalStartupReported) {
+                                this.fatalStartupReported = true;
+                                this.logger.warn({ description: dialog.description }, "Fatal startup screen detected — reporting instead of dismissing");
+                                this.emit("pty_error", { name: this.name, ...dialog.fatal });
+                            }
+                            return true;
+                        }
+                        if (dialog.holdOnly) {
+                            // Recognised but deliberately not answered (see RuntimeDialog.holdOnly).
+                            if (this.dialogParkedKey !== Daemon.dialogKey(dialog)) {
+                                this.logger.warn({ description: dialog.description }, "Startup dialog held — not auto-answering, deliveries stay blocked");
+                            }
+                            this.trackDialogParked(dialog);
+                            matched = true;
+                            break;
+                        }
+                        this.logger.info(`Dismissing startup dialog: ${dialog.description}`);
                         // Restart is exactly when inbound messages pile up, and nothing gates
                         // delivery on `spawning`. Take the pane lock for the key sequence so a
                         // queued message cannot be pasted into a half-dismissed trust dialog.
@@ -3723,35 +5521,82 @@ export class Daemon extends EventEmitter {
                                 await new Promise(r => setTimeout(r, 200));
                             }
                         });
-                        // Wait for next screen to render
+                        // Wait for next screen to render — bounded by what is left of the budget.
+                        const renderWait = Math.max(0, Math.min(10_000, remaining()));
                         if (this.controlClient) {
                             const wid = readFileSync(join(this.instanceDir, "window-id"), "utf-8").trim();
-                            await this.controlClient.waitForIdle(wid, 10_000);
+                            await this.controlClient.waitForIdle(wid, renderWait);
                         }
                         else {
-                            await new Promise(r => setTimeout(r, 3_000));
+                            await new Promise(r => setTimeout(r, Math.min(3_000, renderWait)));
                         }
-                        if (!await this.tmux.isWindowAlive())
+                        if ((await this.paneLiveness()) === "dead")
                             return false;
                         matched = true;
                         break;
                     }
                 }
-                if (matched)
+                if (matched) {
+                    if (lastDialog?.holdOnly)
+                        await sleep();
+                    continue;
+                }
+                if (this.dialogParkedSince !== 0 && !this.deliveryBlockingDialogs().some(d => Daemon.dialogMatches(d, pane)))
+                    this.trackDialogParked(null);
+                // CLI is ready (pattern defined by each backend). Require it on two
+                // consecutive polls: the first ready frame is also the moment a late
+                // dialog is about to be painted over it.
+                if (this.backend.getReadyPattern().test(pane)) {
+                    cleanReadyPolls++;
+                    if (cleanReadyPolls >= 2 || remaining() <= 0) {
+                        // A real ready prompt (with no fatal dialog on screen — those are
+                        // matched above, before this check) means the fatal screen is gone,
+                        // e.g. the user fixed the config and the instance respawned.
+                        this.fatalStartupBlocked = false;
+                        return true;
+                    }
+                    await sleep();
                     continue;
-                // CLI is ready (pattern defined by each backend)
-                if (this.backend.getReadyPattern().test(pane))
+                }
+                cleanReadyPolls = 0;
+                // A CLI parked at its own sign-in screen is an AUTH incident: no dialog
+                // key can dismiss it and no ready pattern will ever appear. Report it as
+                // an auth error (the lifecycle double-checks with the token-free probe)
+                // instead of letting it decay into crash/hang/MCP-died noise, and stop
+                // the retry loop — only re-login (see /login) ends this state.
+                const loginScreen = LOGIN_FLOWS[this.config.backend ?? "claude-code"]?.loginScreenPattern;
+                if (loginScreen?.test(pane) && !this.loginScreenReported) {
+                    this.loginScreenReported = true;
+                    this.authFailureUnresolved = true;
+                    this.logger.warn({ backend: this.config.backend }, "CLI is waiting at its sign-in screen — reporting auth error");
+                    this.emit("pty_error", {
+                        name: this.name,
+                        type: "auth_error",
+                        action: "pause",
+                        message: "CLI is waiting at its sign-in screen — credentials are missing or expired",
+                    });
                     return true;
+                }
                 // Fatal: command not found (must match full phrase to avoid false positives
                 // like Kiro's "agent X not found, using default")
                 if (/command not found|: not found$/m.test(pane))
                     return false;
             }
-            catch {
-                return false;
+            catch (err) {
+                // Key sends / isWindowAlive failing: same rule — log, retry within the budget.
+                this.logger.warn({ err }, "startup dialog scan step failed — retrying");
+                if ((await this.paneLiveness()) === "dead")
+                    return false;
             }
+            await sleep();
+        } while (remaining() > 0);
+        // Budget exhausted. Never silently: say which way it went.
+        if (lastDialog) {
+            this.logger.warn({ description: lastDialog.description, attempts, budgetMs }, "Startup scan exhausted with a dialog still on screen — reporting the CLI alive; deliveries stay blocked until it is answered");
+        }
+        else {
+            this.logger.warn({ attempts, budgetMs, captureFailures }, "Startup scan exhausted without a ready prompt or a known dialog — assuming ready (unknown CLI screen)");
         }
-        // Exhausted attempts — assume ok for unknown CLI prompts
         return true;
     }
     /**