@songsid/agend 2.1.4-beta.9 → 2.1.4

package/dist/fleet-yaml-slim.d.ts

@@ -0,0 +1,10 @@
+import type { RawFleetConfig } from "./types.js";
+/**
+ * Instance identity/routing fields remain explicit even when they currently
+ * equal a fleet default. Removing one of these makes the YAML harder to audit
+ * and can change which external resource an instance represents.
+ */
+export declare const PRESERVED_INSTANCE_FIELDS: Set<string>;
+export type FleetConfigPath = Array<string | number>;
+/** Return raw YAML leaf paths that are redundant with effective defaults. */
+export declare function collectRedundantInstanceDefaultPaths(raw: RawFleetConfig): FleetConfigPath[];

package/dist/fleet-yaml-slim.js

@@ -0,0 +1,59 @@
+import { isDeepStrictEqual } from "node:util";
+import { getEffectiveInstanceDefaults } from "./config.js";
+/**
+ * Instance identity/routing fields remain explicit even when they currently
+ * equal a fleet default. Removing one of these makes the YAML harder to audit
+ * and can change which external resource an instance represents.
+ */
+export const PRESERVED_INSTANCE_FIELDS = new Set([
+    "working_directory",
+    "topic_id",
+    "channel_id",
+    "general_topic",
+    "description",
+    "tags",
+    "model",
+    "backend",
+    "backend_options",
+    "display_name",
+    "systemPrompt",
+    "worktree_source",
+    "profile",
+]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function collectMatchingLeaves(value, inherited, path, output) {
+    if (isRecord(value) && isRecord(inherited)) {
+        for (const [key, child] of Object.entries(value)) {
+            if (Object.prototype.hasOwnProperty.call(inherited, key)) {
+                collectMatchingLeaves(child, inherited[key], [...path, key], output);
+            }
+        }
+        return;
+    }
+    // Arrays are leaf values here: a partial array cannot inherit safely.
+    if (isDeepStrictEqual(value, inherited))
+        output.push(path);
+}
+/** Return raw YAML leaf paths that are redundant with effective defaults. */
+export function collectRedundantInstanceDefaultPaths(raw) {
+    const instances = raw.instances;
+    if (!instances || !isRecord(instances))
+        return [];
+    const effectiveDefaults = getEffectiveInstanceDefaults((raw.defaults ?? {}));
+    const redundant = [];
+    for (const [name, instance] of Object.entries(instances)) {
+        if (!isRecord(instance))
+            continue;
+        for (const [key, value] of Object.entries(instance)) {
+            if (PRESERVED_INSTANCE_FIELDS.has(key))
+                continue;
+            if (!Object.prototype.hasOwnProperty.call(effectiveDefaults, key))
+                continue;
+            collectMatchingLeaves(value, effectiveDefaults[key], ["instances", name, key], redundant);
+        }
+    }
+    return redundant;
+}
+//# sourceMappingURL=fleet-yaml-slim.js.map

package/dist/fleet-yaml-slim.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fleet-yaml-slim.js","sourceRoot":"","sources":["../src/fleet-yaml-slim.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAC;AAG3D;;;;GAIG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IAC/C,mBAAmB;IACnB,UAAU;IACV,YAAY;IACZ,eAAe;IACf,aAAa;IACb,MAAM;IACN,OAAO;IACP,SAAS;IACT,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AAIH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAc,EACd,SAAkB,EAClB,IAAqB,EACrB,MAAyB;IAEzB,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACjD,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,CAAC;gBACzD,qBAAqB,CAAC,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC;YACvE,CAAC;QACH,CAAC;QACD,OAAO;IACT,CAAC;IAED,sEAAsE;IACtE,IAAI,iBAAiB,CAAC,KAAK,EAAE,SAAS,CAAC;QAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC7D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,oCAAoC,CAClD,GAAmB;IAEnB,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAChC,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IAElD,MAAM,iBAAiB,GAAG,4BAA4B,CACpD,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAA4B,CACrB,CAAC;IAC7B,MAAM,SAAS,GAAsB,EAAE,CAAC;IAExC,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACzD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,SAAS;QAClC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACpD,IAAI,yBAAyB,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,SAAS;YACjD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,iBAAiB,EAAE,GAAG,CAAC;gBAAE,SAAS;YAC5E,qBAAqB,CACnB,KAAK,EACL,iBAAiB,CAAC,GAAG,CAAC,EACtB,CAAC,WAAW,EAAE,IAAI,EAAE,GAAG,CAAC,EACxB,SAAS,CACV,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/general-knowledge/skills/cross-instance-messaging/SKILL.md

@@ -11,6 +11,7 @@ Use fleet tools only (`send_to_instance`, `delegate_task`, `request_information`
 - **Do not wait** for the target to go idle; **do not** treat 30s IPC timeout as failure to re-send.
 - **Error only if the target does not exist** (or similar hard reject) — then fix the name, don't spam.
 - **Never re-send because the reply said `queued`** — that means the message is already queued.
+- Supplement/correction to work you just sent → `steer: true`; a new task → normal send.
 
 ## requires_reply
 

package/dist/general-knowledge/skills/model-discovery/SKILL.md

@@ -1,28 +1,75 @@
 ---
 name: model-discovery
-description: Set and discover models — pass-through to the CLI, no AgEnD allowlist gate
+description: Choose and discover models — when to omit, per-backend defaults, pass-through
 roles: [general, worker]
 ---
 
-## How to set a model
+## Omit the model unless you have a reason
 
-- fleet.yaml: `defaults.model` or per-instance `model`
-- **Pass-through:** AgEnD no longer blocks unknown model ids — it may **warn**, then still pass the string to the CLI
-- **CLI is source of truth** — if the model is invalid, the backend CLI errors (fix the name there)
+Precedence: **explicit arg > `fleet.defaults.model` > CLI/account default**
+
+Omitting is the default answer. It inherits the fleet default, or the CLI's own —
+which is the account's current best model and stays right as the vendor ships new
+ones. A model you pin today is a model someone has to un-pin later.
+
+Pass a model only when: the user named one, the instance needs a *specific*
+capability (cheap/fast vs deep reasoning), or the backend needs one to behave
+(see kiro below).
+
+## Per-backend default behaviour
+
+| Backend | Omit `model` means | Notes |
+|---|---|---|
+| kiro-cli | account default | **`model: auto`** lets kiro pick per turn — usually what you want |
+| claude-code | account default | ids are aliases: `sonnet`, `opus`, `haiku`, `opusplan`, `default` |
+| codex | account default | |
+| grok | account default | |
+| antigravity | account default | |
+| opencode | provider default | ids are **`provider/model`**, e.g. `opencode/big-pickle` |
 
 ## Discover real names
 
-| Backend | How |
-|---------|-----|
-| kiro-cli | In pane: `/model` (gpt-*, deepseek-*, minimax-*, glm-*, qwen* supported) |
-| claude-code | `sonnet` / `opus` / `haiku` / `opusplan` / `Fable` / aliases |
-| codex | pane `/model` or docs (`gpt-*`, `o*`) |
+**Use the `list_models` tool** — it reads the fleet's probe cache (refreshed every
+24h) and falls back to a live probe:
+
+- `list_models({ backend: "kiro-cli" })` → the account catalog
+- `list_models({ instance_name: "x" })` → read through **that instance's** config
+
+Check `scope` in the reply. An instance on a custom provider can offer a
+different catalog than the account (a Codex instance with `provider: glm` reads
+its own catalog), so `scope: "instance"` is authoritative for that instance and
+`scope: "global"` is only the account-wide list. `source` tells you `cache` /
+`live` / `fallback`.
+
+An empty list is **not** a failure — see pass-through below.
+
+Underlying commands, if you need them by hand:
+
+| Backend | Command |
+|---|---|
+| kiro-cli | `kiro-cli --list-models` |
 | grok | `grok models` |
-| antigravity | `agy models` — set **base name only** (drop `(Medium)` / `(Thinking)` effort suffix) |
 | opencode | `opencode models` |
+| antigravity | `agy models` |
+| codex | **no command** — the CLI writes `models_cache.json` in its CODEX_HOME |
+| claude-code | fixed alias set (no command) |
+
+## Setting one on create_instance
+
+- No specific need → **omit `model`**
+- Kiro, want per-turn selection → `model: "auto"`
+- Custom provider → pass the **full id** and set `backend_options`, e.g.
+  `backend: "codex"`, `backend_options: { codex: { provider: "glm" } }`
+- opencode → always `provider/model`, never a bare model name
+
+## Two traps
+
+**antigravity: keep the effort suffix.** The suffix is part of the selectable id,
+not decoration — `gemini-3.6-flash-medium` and `gemini-3.6-flash-low` are
+different models. Take the id from `list_models`, not the display label the TUI
+shows (`Gemini 3.5 Flash (Medium)`).
 
-```yaml
-defaults:
-  backend: kiro-cli
-  model: claude-sonnet-4-20250514
-```
+**Pass-through: AgEnD does not gate model names.** An unknown id is warned about,
+then handed to the CLI anyway. So a name missing from `list_models` may still be
+valid, and a typo fails *in the CLI at launch*, not at config time — if an
+instance won't start after a model change, suspect the name first.

package/dist/general-knowledge/skills/session-management/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: session-management
-description: Session stores, forking, and auth-pause recovery
+description: Session stores, forking, cross-backend session recovery, and auth-pause recovery
 roles: [general]
 ---
 
@@ -12,17 +12,180 @@ When AgEnD sees `auth_error` it **pauses** that instance (`pausePending` sticky)
 - Messages while paused stay in the **queue** — do not re-send.
 - After the user re-auths: `wake` / normal wake clears `pausePending`.
 
-## Where sessions live
+## Session recovery: what each backend can do
 
-| | kiro-cli | claude-code |
-|---|---|---|
-| Store | `~/.kiro/sessions/cli/<uuid>.json` | `~/.claude/projects/<path-encoded>/*.jsonl` |
-| Reload | `/chat load <file>` | `--continue` / `--resume <id>` |
+Verified by running each one, not read from docs.
 
-`<path-encoded>` = absolute cwd with `/` → `-`.
+| Backend | List all sessions | Restore a *specific* session | Read summary only |
+|---|---|---|---|
+| **kiro-cli** | ✅ `conversations_v2` | ✅ export → `/chat load` | ✅ `latest_summary` |
+| **grok** | ✅ `session_search.sqlite` (FTS5) | ✅ `grok --resume <id>` | ✅ `summary.json` |
+| **claude-code** | ✅ list `*.jsonl` in project dir | ✅ `claude -r <id>` | ✅ `ai-title` line |
+| **codex** | ⚠️ no index — parse rollout files | ✅ `codex exec resume <id>` | ❌ must parse the rollout |
+| **antigravity** | ❌ index covers ~23%, 2 months stale | ✅ `agy --conversation <id>` | ⚠️ `title` empty, use `preview` |
+
+**Restoring a specific session is a manual operator action, not an AgEnD feature.** AgEnD always launches a backend on its *most recent* session (`--continue` / `--last` / `--resume`). To reach any other session someone must drive the pane or the CLI by hand.
+
+**kiro is the exception worth knowing:** its export → `/chat load` works on a **live, idle instance** with no restart. Every other backend needs the instance stopped (or the CLI run manually) because the session is chosen by a launch flag.
+
+## Safety — applies to every backend below
+
+1. **Reads are read-only.** Open SQLite with `readonly` and never write to these databases; they belong to a running CLI, and the `-wal`/`-shm` files are live.
+2. **Restore through the CLI's own mechanism** — a resume flag, or kiro's `/chat load`. Never edit a session DB or JSONL to "fix" a conversation.
+3. **Confirm the target instance is idle first** (tmux shows the ready prompt). Restoring into a working pane interrupts a turn.
+4. Nothing here needs `sudo` or touches another user's files.
+
+---
+
+## kiro-cli
+
+- **Store:** `~/.kiro/sessions/cli/<uuid>.json`
+- **DB:** `~/.local/share/kiro-cli/data.sqlite3`, table `conversations_v2`
+  - `key` — the instance's working directory
+  - `conversation_id` — session ID
+  - `value` — full session state JSON (**same format as `/chat save`**)
+  - `created_at` / `updated_at` — epoch ms
+
+**List sessions for an instance**
+```python
+import sqlite3, os
+db = os.path.expanduser('~/.local/share/kiro-cli/data.sqlite3')
+cur = sqlite3.connect(f'file:{db}?mode=ro', uri=True).cursor()
+cur.execute(
+    "SELECT conversation_id, updated_at FROM conversations_v2 WHERE key LIKE ? ORDER BY updated_at DESC LIMIT 5",
+    ('%<instance-name>%',)
+)
+# Most recent = currently active. De-duplicate by conversation_id.
+```
+
+**Restore (works on a live idle instance — no restart)**
+```python
+cur.execute("SELECT value FROM conversations_v2 WHERE conversation_id = ?", (target_cid,))
+open('<instance-workspace>/restore.json', 'w').write(cur.fetchone()[0])
+```
+```bash
+tmux send-keys -t agend:<instance> '/chat load restore.json' Enter
+# Success: "✔ Imported chat session state", context % jumps up
+```
+
+**Summary without restoring:** the session JSON has `latest_summary` (list; `[1]` is the text) and `history`.
+
+---
+
+## grok
+
+The most capable backend here. It also ships its own manual at `~/.grok/docs/user-guide/17-sessions.md`.
+
+- **Store:** `~/.grok/sessions/<URL-encoded cwd>/<session-id>/`
+  - `summary.json` — index entry: summary, timestamps, model, message counts
+  - `updates.jsonl` — the authoritative conversation log that drives resume
+  - also `chat_history.jsonl`, `plan.json`, `rewind_points.jsonl`, `signals.json`
+- **Index:** `~/.grok/sessions/session_search.sqlite` → `session_docs(session_id, cwd, updated_at, title, content)` plus a `session_docs_fts` FTS5 table, so you can full-text search past conversations.
+
+**List / search**
+```python
+import sqlite3, os
+db = os.path.expanduser('~/.grok/sessions/session_search.sqlite')
+cur = sqlite3.connect(f'file:{db}?mode=ro', uri=True).cursor()
+cur.execute("SELECT session_id, title, updated_at FROM session_docs ORDER BY updated_at DESC LIMIT 10")
+# Full-text over conversation content:
+cur.execute("SELECT session_id FROM session_docs_fts WHERE session_docs_fts MATCH ?", ('deploy',))
+```
+
+**Restore:** `grok --resume <session-id-or-title>` (a UUID is always treated as an ID; anything else matches a title in the current directory). Bare `grok --resume` takes the most recent for that cwd. In the TUI, `/resume` opens a picker that searches conversation content as you type.
+
+**Summary without restoring:** read `summary.json` directly.
+
+> ⚠️ **Titles can be ours, not the user's.** Grok auto-titles from the first prompt, and AgEnD sometimes injects a session snapshot as that first prompt — so a title may read `[system:session-snapshot] ## Previous session…`. Filter that prefix before showing titles to a user, and fall back to `updated_at` + message count.
+
+---
+
+## claude-code
+
+- **Store:** `~/.claude/projects/<path-encoded>/<session-uuid>.jsonl` — **the filename is the session ID**.
+- `<path-encoded>` = the absolute cwd with every `/` replaced by `-`.
+
+**List sessions for an instance**
+```bash
+enc=$(echo "<instance-working-dir>" | sed 's|/|-|g')
+ls -t ~/.claude/projects/"$enc"/*.jsonl        # newest first; basename = session id
+```
+
+**Summary without restoring** — the transcript contains auto-title lines; take the last one:
+```bash
+grep -h '"type":"ai-title"' <file>.jsonl | tail -1
+# {"type":"ai-title","aiTitle":"Review updated instructions","sessionId":"..."}
+```
+A session with no `ai-title` line is simply untitled — say so rather than inventing a label.
+
+**Restore:** `claude -r <session-id>` (or `claude --resume` for a picker that accepts a search term). `-c` / `--continue` takes the most recent for the cwd — that is what AgEnD launches with.
+
+> ⚠️ **Check the ID exists before using it.** AgEnD guards `--continue` precisely because resuming a session that isn't there sends claude into a restart loop. Confirm the `<id>.jsonl` file is present in the encoded project dir first.
+
+---
+
+## codex
+
+Restoring works well; **listing is the weak part — there is no index table.**
+
+- **Store:** `~/.codex/sessions/YYYY/MM/DD/rollout-<timestamp>-<uuid>.jsonl`
+- Line 0 of every rollout is the header:
+  `{"type":"session_meta","payload":{"session_id":…,"cwd":…,"timestamp":…}}`
+
+**List sessions for a working directory** — walk the tree and read only the first line of each file:
+```python
+import json, os, pathlib
+root = pathlib.Path(os.path.expanduser('~/.codex/sessions'))
+want = '<instance-working-dir>'
+out = []
+for p in root.rglob('*.jsonl'):
+    try:
+        head = json.loads(p.open(encoding='utf-8').readline())
+    except Exception:
+        continue
+    if head.get('type') == 'session_meta' and head['payload'].get('cwd') == want:
+        out.append((head['payload']['timestamp'], head['payload']['session_id']))
+for ts, sid in sorted(out, reverse=True):
+    print(ts, sid)
+```
+It opens many files, but only one line each, so it stays cheap.
+
+**Restore:** `codex exec resume <session-id> "<prompt>"` non-interactively, or `codex resume <session-id>` for the TUI (bare `codex resume` opens a picker). `codex resume --last` is what AgEnD launches with. The ID argument also accepts a session *name*.
+
+**Summary:** ❌ none available without parsing. `session_meta` carries only id/cwd/timestamp; to describe a session you must read further `event_msg` lines. Tell the user the timestamp and let them pick, rather than guessing at a topic.
+
+---
+
+## antigravity (agy)
+
+Restore is reliable; **the session list is not — do not present it as complete.**
+
+- **Store:** `~/.gemini/antigravity-cli/conversations/<uuid>.db` — one SQLite database per conversation.
+- **Index:** `~/.gemini/antigravity-cli/conversation_summaries.db`, table `conversation_summaries`
+  (`conversation_id`, `title`, `preview`, `step_count`, `last_modified_time`, `workspace_uris`, …)
+
+**List (with the caveat below)**
+```python
+import sqlite3, os
+db = os.path.expanduser('~/.gemini/antigravity-cli/conversation_summaries.db')
+cur = sqlite3.connect(f'file:{db}?mode=ro', uri=True).cursor()
+cur.execute("SELECT conversation_id, preview, step_count, last_modified_time "
+            "FROM conversation_summaries ORDER BY last_modified_time DESC")
+```
+
+**Restore:** `agy --conversation <conversation-id>`. Verified: it loads the full prior conversation, not just a stub. `-c` / `--continue` takes the most recent — that is what AgEnD launches with.
+
+> ⚠️ **The index is badly incomplete.** Measured on a live machine: 31 conversation databases on disk but only 14 index rows, of which just **7** matched a real conversation — about 23% coverage — and the newest row was **two months old**. Whatever you list, say plainly that it is a partial view and that older or recent conversations may be missing entirely. If the user knows a conversation ID, `--conversation` still works even when the index does not show it.
+>
+> ⚠️ **`title` is empty in practice** — use `preview` (the first user message) as the label, plus `step_count` for size.
+>
+> ⚠️ **`agy -p` (print mode) records nothing.** A non-interactive run leaves no conversation behind, so don't expect one to show up afterwards.
+
+---
 
 ## Fork (source must be idle)
 
 - **kiro:** `/chat save name.json -f` → `create_instance` → copy workspace file → `/chat load name.json`
-- **claude-code:** copy newest `*.jsonl` into target's encoded project dir → start (uses `--continue`)
+- **claude-code:** copy the newest `*.jsonl` into the target's encoded project dir → start (uses `--continue`)
+- **grok:** `/fork` inside the TUI branches the conversation into a peer session
 - Prefer `replace_instance` when the whole session is poisoned (see instance-lifecycle)

package/dist/instance-lifecycle.d.ts

@@ -5,6 +5,10 @@ import type { IpcClient } from "./channel/ipc-bridge.js";
 import type { EventLog } from "./event-log.js";
 import type { TmuxControlClient } from "./tmux-control.js";
 import type { FleetInstructionsParams } from "./instructions.js";
+import { type ProviderUsage } from "./usage/providers.js";
+import type { SpawnGate } from "./spawn-gate.js";
+import type { StormWindow } from "./storm-window.js";
+import type { BackendOutageTracker } from "./backend-outage.js";
 export { isFleetStartCommandLine } from "./fleet-lock.js";
 export interface BackendInstallationInfo {
     binary: string;
@@ -34,7 +38,21 @@ export interface LifecycleContext {
     readonly sessionRegistry: Map<string, string>;
     readonly eventLog: EventLog | null;
     readonly controlClient: TmuxControlClient | null;
+    readonly spawnGate?: SpawnGate;
+    readonly stormWindow?: StormWindow;
+    /** Fleet-level backend reachability memory (see backend-outage.ts). */
+    readonly backendOutage?: BackendOutageTracker;
     getInstanceDir(name: string): string;
+    /** Fleet-level (General topic) notification, throttled per message text. */
+    notifyFleetError?(text: string): void;
+    /** Hand a failed/blocked instance to the fleet's delayed automatic startup retry. */
+    scheduleStartupRetry?(name: string, attempt: number): void;
+    /**
+     * Stop THIS daemon (identity-checked) and schedule the delayed startup retry,
+     * serialized against operator stop/restart so neither can be undone by the
+     * other. Fleet-owned; the lifecycle falls back to stopIfCurrent without it.
+     */
+    handOffToStartupRetry?(name: string, daemon: unknown): Promise<void>;
     saveFleetConfig(): void;
     /** Full stop+start. freshStart forces the respawn to skip session resume. */
     restartSingleInstance(name: string, opts?: {
@@ -48,7 +66,12 @@ export interface LifecycleContext {
     removeInstance(name: string): Promise<void>;
     touchActivity(name: string): void;
     sendHangNotification(name: string, unchangedForMs?: number): Promise<void>;
-    notifyInstanceTopic(name: string, text: string): void;
+    /**
+     * Returns whether the notice was dispatched. Production (FleetManager) says
+     * `false` when there is no adapter/route (#693 semantics); `void` from
+     * legacy contexts and test doubles counts as dispatched.
+     */
+    notifyInstanceTopic(name: string, text: string): boolean | void;
     /** Notify the blocked instance and offer an interactive assist action in General. */
     notifyInteractivePrompt(name: string, kind: string): Promise<void>;
     /** Notify a clean CLI exit and offer an admin-only restart action in General. */
@@ -57,6 +80,8 @@ export interface LifecycleContext {
     isClassicInstance?(name: string): boolean;
     /** True while the fleet is stopping on purpose or an `agend update` is running. */
     isPlannedRestart(): boolean;
+    /** Suppress only incident kinds caused by the active tmux server storm. */
+    stormSuppressed?(kind: string): boolean;
     /** List claimed tasks for an instance (from task board). Returns empty array if unavailable. */
     listClaimedTasks(assignee: string): Array<{
         id: string;
@@ -66,6 +91,10 @@ export interface LifecycleContext {
     checkModelFailover(name: string, fiveHourPct: number): void;
     /** Retire (delete) any pending Cancel button for an instance. No-op if none. */
     clearCancelButton(name: string): void;
+    /** Test/integration seam for the non-LLM Codex quota second opinion. */
+    verifyCodexQuota?(): Promise<CodexQuotaVerdict>;
+    /** Test/integration seam for the non-LLM Claude quota second opinion. */
+    verifyClaudeQuota?(): Promise<ClaudeQuotaVerdict>;
     startStatuslineWatcher(name: string): void;
     stopStatuslineWatcher(name: string): void;
     reactMessageStatus(instanceName: string, chatId: string, messageId: string, emoji: string): void;
@@ -113,12 +142,45 @@ export interface LifecycleReplaceArgs {
     name: string;
     reason?: string;
 }
+export type CodexQuotaVerdict = "available" | "exhausted" | "unknown";
+type CodexUsageResult = Omit<ProviderUsage, "id" | "name">;
+export type ClaudeQuotaVerdict = "available" | "exhausted" | "unknown";
+type ClaudeUsageResult = Omit<ProviderUsage, "id" | "name">;
+/**
+ * Convert the live Codex usage row into a conservative quota verdict. A
+ * successful response with at least one window below 100% proves that stale
+ * terminal text is no longer current only when no other window is exhausted.
+ * Missing credentials, API errors, and metric-less responses prove nothing.
+ */
+export declare function codexQuotaVerdictFromUsage(usage: CodexUsageResult): CodexQuotaVerdict;
+/** Run only the Codex usage provider, bounded independently of its network timeout. */
+export declare function verifyCodexQuotaStatus(fetchUsage?: () => Promise<CodexUsageResult>, timeoutMs?: number): Promise<CodexQuotaVerdict>;
+/**
+ * Convert a LIVE Claude usage API row into a conservative verdict. The
+ * provider can degrade to statusline data when the network/API is unavailable;
+ * that fallback is intentionally unknown because stale local limits cannot
+ * disprove a current API credit-balance error.
+ */
+export declare function claudeQuotaVerdictFromUsage(usage: ClaudeUsageResult): ClaudeQuotaVerdict;
+/** Run only the Claude usage provider, bounded independently of its network timeout. */
+export declare function verifyClaudeQuotaStatus(fetchUsage?: () => Promise<ClaudeUsageResult>, timeoutMs?: number): Promise<ClaudeQuotaVerdict>;
 export declare class InstanceLifecycle {
     private ctx;
     /** Active daemon processes: instanceName → Daemon */
     readonly daemons: Map<string, import("./daemon.js").Daemon>;
     /** backend → last auth-error alert time, so one expiry sends one alert. */
     private lastAuthAlertAt;
+    /**
+     * backend → cached token-free auth verification (see AUTH_VERIFY_CACHE_MS).
+     * The PROMISE is cached, not the result: a shared credential expiring makes
+     * every instance of the backend fire in the same tick, and they must join
+     * one in-flight check instead of each spawning their own.
+     */
+    private authVerifyCache;
+    /** Same-tick Codex quota alerts join one live usage probe. */
+    private codexQuotaVerifyInFlight;
+    /** Same-tick Claude quota alerts join one live usage probe. */
+    private claudeQuotaVerifyInFlight;
     /**
      * Minimum gap between MCP-revival auto-restarts of one instance. Kept here —
      * not in the daemon — because each restart replaces the daemon object, which
@@ -142,9 +204,41 @@ export declare class InstanceLifecycle {
      * suppresses the chat message, not the record. A crash outside a planned
      * restart notifies exactly as before.
      */
+    /** @returns whether the notice was actually dispatched (false when suppressed). */
     private notifyIncident;
+    /**
+     * Per-instance MCP incident fence. The mcp_died handler awaits an auth probe
+     * (up to 5s) before it notifies; a recovery that lands inside that window
+     * bumps the generation so the late death handler sends nothing — otherwise
+     * the user would see "retracted" followed by the stale red alarm. The
+     * retraction itself is only sent when a death notice really reached the
+     * user (not when it was storm- or planned-restart-suppressed).
+     */
+    private mcpIncidents;
+    private mcpIncident;
     /** Backend a running instance uses (config → fleet default). */
     private backendOf;
+    /**
+     * Confirm a pane-detected auth error with the backend's token-free status
+     * probe before pausing anything: pattern matching over terminal text also
+     * fires on an agent DISCUSSING a 401. "valid" means false positive — ignore.
+     * "invalid" and "unknown" (timeout, missing binary) both pause: for a
+     * suspected expiry, pausing too much is recoverable, delivering into a dead
+     * CLI is not. Cached per backend so simultaneous alerts run one check.
+     */
+    private verifyAuthError;
+    private verifyCodexQuota;
+    private verifyClaudeQuota;
+    /** Same verification keyed by backend (used by startup pre-flight priming). */
+    verifyBackendAuth(backend: string): Promise<"valid" | "invalid" | "unknown">;
+    /**
+     * Startup pre-flight: warm the per-backend auth verification cache so the
+     * detectors that fire seconds later (login-screen scan, MCP-died gate) get an
+     * instant answer. Advisory only — a pre-flight result alone never pauses
+     * anything, because e.g. codex on a custom provider runs fine while
+     * `codex login status` reports logged out (live-verified on this fleet).
+     */
+    primeAuthVerification(backends: Iterable<string>): void;
     /**
      * One alert per backend per cooldown, naming every affected instance — a CLI's
      * credentials are shared, so N instances failing is ONE problem with ONE fix
@@ -152,6 +246,13 @@ export declare class InstanceLifecycle {
      * instances, so the fleet-level map does it here.
      */
     private notifyAuthErrorOnce;
+    /**
+     * A fleet-wide backend outage (see backend-outage.ts): record the sighting so
+     * startup stops spending `--resume` attempts on it, and notify ONCE per
+     * outage at fleet level — kiro prints the line every 10s on every instance,
+     * so per-instance incidents would be N × (one message per cooldown).
+     */
+    private noteBackendOutage;
     /**
      * System errors from a ClassicBot belong in the operator's General topic,
      * never in the end user's chat channel. Fleet-topic instances retain their
@@ -171,6 +272,18 @@ export declare class InstanceLifecycle {
     getLastPausedAt(name: string): number | null;
     pause(name: string): Promise<void>;
     wake(name: string, timeoutMs?: number): Promise<void>;
+    /**
+     * Ownership boundary for a daemon that is not yet registered: if start()
+     * rejects, nothing else will ever dispose it, so do it here before
+     * rethrowing. The abort is best-effort — the start error is the one to
+     * surface.
+     */
+    static startOrDispose(daemon: {
+        start(): Promise<void>;
+        abortStartup(): Promise<void>;
+    }, name: string, logger: Logger): Promise<void>;
+    /** Stop the registered daemon only if it is still `daemon` (a concurrent restart may have replaced it). */
+    stopIfCurrent(name: string, daemon: unknown): Promise<boolean>;
     stop(name: string): Promise<void>;
     remove(name: string): Promise<void>;
     /** Handle create_instance tool call from a daemon. */