@songsid/agend 2.1.5-beta.2 → 2.1.5-beta.21

package/dist/daemon.js

@@ -1,5 +1,5 @@
 import { join, dirname, basename, resolve } from "node:path";
-import { mkdirSync, writeFileSync, readFileSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
+import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { createHash, randomBytes } from "node:crypto";
 import { EventEmitter } from "node:events";
@@ -23,7 +23,9 @@ import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
 import { buildFleetInstructions } from "./instructions.js";
 import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata, } from "./cross-instance-envelope.js";
-import { bottomRowIsReady, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
+import { bottomRowIsReady, inputAreaText, inputShowsPastedText, pastedTextSignature, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
+import { TurnReplyGuard } from "./turn-reply-guard.js";
+import { t } from "./locale.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -34,6 +36,8 @@ const TASK_TOOL = "task";
 // Tools whose success proves the agent got a message out this turn. While any
 // of these succeeded, a dead-MCP proxy reply would double-post — suppress it.
 const TURN_REPLY_TOOLS = new Set(["reply", "send_to_instance", "report_result", "request_information", "delegate_task", "broadcast"]);
+const REPLY_DROP_WARNING_COOLDOWN_MS = 5 * 60_000;
+const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. Use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, send a brief acknowledgement. Do not reply to this system instruction except through the reply tool.";
 /** Point a resumed CLI at its one backend-native instruction source. */
 export function buildInstructionReloadNotice(binaryName, instanceName, instanceDir) {
     const source = binaryName === "codex" || binaryName === "grok"
@@ -47,6 +51,33 @@ export function buildInstructionReloadNotice(binaryName, instanceName, instanceD
                     : join(instanceDir, "fleet-instructions.md");
     return `[system] Your AgEnD instructions have been updated. Reload only ${source}; do not scan other instruction directories. Do not reply to this message.`;
 }
+/**
+ * Whether this backend has to be told in its pane that its instructions moved.
+ *
+ * A backend that re-reads them on resume already received the new ones from the
+ * resume itself, so the notice is pure interruption. Both places that can send
+ * it — the warmup paste and the deferred pendingInstructionsNotice — ask through
+ * here, so the two cannot drift apart again: the warmup path used to omit this
+ * check entirely and told claude-code to reload instructions it had just read.
+ */
+export function backendNeedsPaneReloadNotice(backend) {
+    return !backend?.instructionsReloadedOnResume;
+}
+/**
+ * What the warmup should do about changed instructions.
+ *
+ * `skip` — nothing to say, or this backend learns of the change by itself.
+ * `defer` — worth saying, but nobody is talking to the instance; say it when a
+ *   real message next arrives rather than provoking an unsolicited reply.
+ * `paste` — say it now, into a pane that already has a delivery in flight.
+ */
+export function warmupNoticeAction(opts) {
+    if (!opts.warmupNeeded)
+        return "skip";
+    if (!backendNeedsPaneReloadNotice(opts.backend))
+        return "skip";
+    return opts.pasteQueueDepth === 0 ? "defer" : "paste";
+}
 export const DEFAULT_STUCK_TIMEOUT_MS = 10 * 60_000;
 export const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2_000;
 export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
@@ -350,15 +381,31 @@ export class PendingWorkTracker {
         // An async pane poll can finish after a newer inbound. Do not let its stale
         // observation clear work which had not arrived when the pane was captured.
         if (now < this.lastInboundAt)
-            return;
+            return false;
         this.lastIdleAt = now;
         this.lastIdleOrder = ++this.sequence;
+        return true;
     }
     hasPendingWork() {
         return this.lastInboundOrder > this.lastIdleOrder;
     }
 }
 const NORMAL_ENTER_SETTLE_MS = 500;
+/** How long to keep looking for proof after a retry Enter before failing it. */
+const POST_ENTER_PROOF_WINDOW_MS = 3_000;
+const POST_ENTER_PROOF_POLL_MS = 250;
+/** Attempts to read the pre-paste pane before a delivery gives up on a baseline. */
+const BASELINE_CAPTURE_ATTEMPTS = 3;
+const BASELINE_CAPTURE_RETRY_MS = 150;
+/** Occurrences of `needle` in `haystack` (plain text, no regex semantics). */
+function countOccurrences(haystack, needle) {
+    if (!needle)
+        return 0;
+    let n = 0;
+    for (let i = haystack.indexOf(needle); i !== -1; i = haystack.indexOf(needle, i + needle.length))
+        n++;
+    return n;
+}
 /** Bottom-ready re-poll cadence for Enter-dropping TUIs once the pane is quiet. */
 const BOTTOM_READY_POLL_MS = 250;
 /** Consecutive unreadable pane probes tolerated by the delivery gate before the delivery is failed (≈10s at the poll cadence). */
@@ -384,6 +431,9 @@ export class BackendUnreachableStartupError extends Error {
 }
 /** Bounded wait (under the pane lock) for the prompt to return before retrying a dropped Enter. */
 const STRANDED_RETRY_READY_WAIT_MS = 30_000;
+/** A passive startup phase must clear within this bound before an Enter is sent. */
+const INPUT_TRANSIENT_WAIT_MS = 30_000;
+const INPUT_TRANSIENT_POLL_MS = 250;
 /** Max "stranded text → submit → wait for prompt → re-check" rounds per delivery; each may send one recovery Enter. */
 const STRANDED_INPUT_MAX_ROUNDS = 3;
 const FIRST_ENTER_SETTLE_MS = 1_750;
@@ -810,6 +860,14 @@ export class Daemon extends EventEmitter {
     spawnSettled = null;
     resolveSpawnSettled = null;
     spawnDepth = 0;
+    /** Monotonic identity for nested beginSpawn/endSpawn lifecycles. */
+    spawnGeneration = 0;
+    /**
+     * Keeps passive startup-transient checks alive through the first positively
+     * submitted post-spawn message.  Without this tail, a transient painted just
+     * after the startup scan can still swallow that message's Enter.
+     */
+    inputTransientGuardGeneration = null;
     skipResume = false;
     startupAborted = false;
     /** First time the current on-screen blocking dialog was seen (0 = none); drives the parked report. */
@@ -843,19 +901,14 @@ export class Daemon extends EventEmitter {
     instanceStateMonitorActive = false;
     sessionCheckpointWarningEmitted = false;
     statePollInFlight = false;
-    // ── Dead-MCP proxy reply: per-turn evidence ─────────────────────────────
-    // Set when an inbound message lands in the CLI; cleared on the idle edge that
-    // ends the turn. With a dead MCP server and no successful channel tool call in
-    // between, the agent's answer exists only on screen — the daemon relays it.
-    turnHadInbound = false;
-    turnOutboundDelivered = false;
-    /** Successful `reply` specifically; cross-instance tools do not satisfy #648. */
-    turnReplyDelivered = false;
-    turnCorrelationId;
-    turnInboundMarker;
+    // One generation-scoped source of truth for human-turn reply completion.
+    // It also supplies the older dead-MCP/malformed-call recovery paths, so those
+    // paths cannot disagree about whether the turn already spoke to the channel.
+    turnReplyGuard = new TurnReplyGuard();
     /** Prevent a visible stale XML fragment from being recovered on later turns. */
     lastMalformedToolCallSignature;
     proxyReplySeq = 0;
+    lastReplyDropWarningAt = 0;
     autoPauseController;
     pauseRequested = false;
     /**
@@ -1032,6 +1085,33 @@ export class Daemon extends EventEmitter {
     static errorPatternKey(ep) {
         return `${ep.type}:${ep.pattern.source}`;
     }
+    /**
+     * Undo the auth suspicion a pattern match armed, once the backend's token-free
+     * probe has said the credentials are fine.
+     *
+     * emitErrorPattern arms these BEFORE the pty_error reaches the lifecycle, and
+     * the lifecycle's "valid" verdict used to just drop the incident — leaving the
+     * daemon permanently suspicious of an auth failure that never existed. That
+     * state is not inert: authFailureUnresolved suppresses the stuck/hang
+     * notification and holds MCP auto-restart (a later real MCP death is then read
+     * as already-confirmed auth trouble rather than re-verified), and the recovery
+     * gate suppresses further error detection until a ready pattern shows up.
+     *
+     * Only what an auth match armed is rolled back. If some other pattern has
+     * since armed the recovery gate, that one is still live and stays.
+     */
+    clearSuspectedAuthFailure() {
+        if (!this.authFailureUnresolved && !this.loginScreenReported)
+            return false;
+        this.authFailureUnresolved = false;
+        this.loginScreenReported = false;
+        if (this.lastDetectedErrorType === "auth_error") {
+            this.clearErrorRecoveryGate();
+            this.lastDetectedErrorType = null;
+        }
+        this.logger.info("Auth suspicion withdrawn — the token-free probe reports valid credentials");
+        return true;
+    }
     clearErrorRecoveryGate() {
         this.errorWaitingForRecovery = false;
         this.errorDetectedAt = 0;
@@ -1230,48 +1310,7 @@ export class Daemon extends EventEmitter {
         // the instructions actually changed since the agent last saw them.
         // Skipping the no-op reload saves 10-30s of agent time on every restart
         // where instructions are unchanged.
-        (async () => {
-            try {
-                if (!this.warmupNeeded) {
-                    this.logger.debug("Warmup skipped — instructions unchanged");
-                    return;
-                }
-                // Skip warmup if no one is talking to this instance (avoid triggering
-                // unsolicited agent replies on idle instances after fleet restart).
-                if (this.pasteQueueDepth === 0) {
-                    this.logger.debug("Warmup deferred — no pending inbound messages");
-                    // Convert to pendingInstructionsNotice so it fires on next real message.
-                    this.pendingInstructionsNotice = true;
-                    try {
-                        writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-                    }
-                    catch { }
-                    return;
-                }
-                const wid = existsSync(join(this.instanceDir, "window-id"))
-                    ? readFileSync(join(this.instanceDir, "window-id"), "utf-8").trim() : "";
-                if (wid && this.controlClient) {
-                    await this.controlClient.waitForIdle(wid, 120_000);
-                }
-                else {
-                    await new Promise(r => setTimeout(r, 5000));
-                }
-                // This path only runs when pasteQueueDepth > 0 — i.e. exactly when a real
-                // delivery is already in flight or queued. Without the lock the notice and
-                // that delivery race into the same pane.
-                await this.paneWriteLock.run(async () => {
-                    await this.tmux?.pasteText(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir), this.systemPasteOptions());
-                });
-                // Record the value the agent has now been told about so the next
-                // unchanged restart skips the reload.
-                try {
-                    writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-                }
-                catch { /* best effort */ }
-                this.logger.debug("Warmup sent after idle");
-            }
-            catch { /* non-fatal */ }
-        })();
+        void this.runWarmupInstructionNotice();
         if (!this.config.lightweight) {
             // 3. Pipe-pane for prompt detection. Rotate first so a ballooned log from a
             // previous stuck splash (hundreds of MB of ANSI frames) is truncated before
@@ -1913,12 +1952,8 @@ export class Daemon extends EventEmitter {
                     // --continue again and crash in the same way → loop. Clear the session id
                     // and skip resume so the next spawn starts fresh. (skipResume also stops
                     // saveSessionId below from resurrecting the id from statusline.json.)
-                    if (lastOutput && /no conversation found|no conversation to (continue|resume)|no previous (session|conversation)|--continue/i.test(lastOutput)) {
-                        this.logger.warn("Detected --continue/resume failure — clearing session-id; next spawn starts fresh");
-                        try {
-                            unlinkSync(join(this.instanceDir, "session-id"));
-                        }
-                        catch { /* may not exist */ }
+                    if (this.paneSaysNoConversation(lastOutput)) {
+                        this.setSessionAside("cli_reported_no_conversation");
                         this.skipResume = true;
                     }
                     // Append to crash history
@@ -2498,6 +2533,10 @@ export class Daemon extends EventEmitter {
     }
     async stop() {
         this.logger.info("Stopping daemon instance");
+        this.turnReplyGuard.reset();
+        // Invalidate any bounded pre-Enter wait from the process generation being
+        // stopped. It must fail closed, not press Enter in a replacement pane.
+        this.inputTransientGuardGeneration = null;
         this.freezeRuntimeMonitors();
         this.pendingIpcRequests.clear();
         if (this.adapter)
@@ -2791,7 +2830,7 @@ export class Daemon extends EventEmitter {
         // Only a transition back to idle completes pending work. Repeated idle
         // observations between enqueue and paste must not clear a newer inbound.
         if (snapshot.state === "idle" && previous !== "idle") {
-            this.pendingWork.recordIdle(snapshot.observedAt);
+            const acceptedIdle = this.pendingWork.recordIdle(snapshot.observedAt);
             // The turn is over. A transcript can end on a tool_use with no matching
             // tool_result (interrupted, crashed, cancelled), which would otherwise leave
             // the last tool pinned to the progress line for the rest of the session.
@@ -2799,7 +2838,8 @@ export class Daemon extends EventEmitter {
             this.resetToolProgress();
             // Must run before the mcpRestartPending branch below: the pane text is the
             // only copy of the answer, and the revival restart is about to clear it.
-            this.maybeProxyReplyOnTurnEnd(pane);
+            if (acceptedIdle)
+                this.maybeProxyReplyOnTurnEnd(pane);
         }
         if (snapshot.state !== previous) {
             this.logger.info({
@@ -2850,13 +2890,17 @@ export class Daemon extends EventEmitter {
         // a task result, and a stale one (sol's review of #515).
         if (meta.from_instance || !meta.chat_id)
             return;
-        this.turnHadInbound = true;
-        this.turnOutboundDelivered = false;
-        this.turnReplyDelivered = false;
-        this.turnCorrelationId = meta.correlation_id || undefined;
         // The last non-empty line of what we pasted: everything on screen after it
         // is the agent's own output.
-        this.turnInboundMarker = deliveredText.split(/\r?\n/).map(l => l.trim()).filter(Boolean).pop();
+        const inboundMarker = deliveredText.split(/\r?\n/).map(l => l.trim()).filter(Boolean).pop();
+        this.turnReplyGuard.arm({
+            adapterId: meta.adapter_id || undefined,
+            chatId: meta.chat_id,
+            threadId: meta.thread_id || undefined,
+            messageId: meta.message_id || undefined,
+            correlationId: meta.correlation_id || undefined,
+            inboundMarker,
+        });
     }
     /**
      * Turn ended (busy→idle edge): if the MCP server is dead and none of the
@@ -2866,56 +2910,197 @@ export class Daemon extends EventEmitter {
      * here (edge-triggered, then reset) is what makes it at most once per turn.
      */
     maybeProxyReplyOnTurnEnd(pane) {
-        const hadInbound = this.turnHadInbound;
-        const delivered = this.turnOutboundDelivered;
-        const replyDelivered = this.turnReplyDelivered;
-        const correlationId = this.turnCorrelationId;
-        const inboundMarker = this.turnInboundMarker;
-        this.turnHadInbound = false;
-        this.turnOutboundDelivered = false;
-        this.turnReplyDelivered = false;
-        this.turnCorrelationId = undefined;
-        this.turnInboundMarker = undefined;
-        if (!hadInbound || this.isPaused)
+        const turn = this.turnReplyGuard.snapshot();
+        if (!turn || this.isPaused)
+            return;
+        if (turn.replyDelivered) {
+            if (turn.phase === "recovering") {
+                this.emit("reply_drop_recovered", {
+                    name: this.name,
+                    correlationId: turn.target.correlationId,
+                    generation: turn.generation,
+                });
+            }
+            this.turnReplyGuard.complete(turn.generation);
+            return;
+        }
+        // A second idle edge ends the one permitted recovery turn. Never create a
+        // third turn or guess at terminal text; make the failure visible instead.
+        if (turn.phase === "recovering") {
+            this.turnReplyGuard.complete(turn.generation);
+            this.reportUnrecoveredReplyDrop(turn);
             return;
+        }
         // Claude sometimes prints a broken XML tool call as plain text and returns
         // idle without ever invoking `reply`. This is independent of MCP liveness:
         // the model malformed the call before the server could receive it.
-        if (!replyDelivered && this.isClaudeCodeBackend() && pane) {
-            const malformed = detectMalformedClaudeToolCall(pane, { inboundMarker });
+        if (this.isClaudeCodeBackend() && pane) {
+            const malformed = detectMalformedClaudeToolCall(pane, { inboundMarker: turn.target.inboundMarker });
             if (malformed) {
                 const stale = malformed.signature === this.lastMalformedToolCallSignature;
                 this.lastMalformedToolCallSignature = malformed.signature;
                 if (!stale) {
-                    const recovered = malformed.text != null;
-                    this.logger.warn({ correlationId, recovered }, recovered
+                    this.logger.warn({ correlationId: turn.target.correlationId, extractable: malformed.text != null }, malformed.text
                         ? "Malformed Claude tool call detected — attempting to recover reply text"
                         : "Malformed Claude tool call detected — reply text could not be extracted");
-                    this.emit("malformed_tool_call", { name: this.name, correlationId, recovered });
-                    if (malformed.text)
-                        this.sendRecoveredMalformedReply(malformed.text, correlationId);
+                    if (malformed.text) {
+                        this.queueMalformedReplyRecovery(turn, malformed.text);
+                    }
+                    else if (this.replyCompletionGuardEnabled() && this.mcpServerAlive().alive) {
+                        this.emit("malformed_tool_call", {
+                            name: this.name,
+                            correlationId: turn.target.correlationId,
+                            recovered: false,
+                            recoveryStarted: true,
+                        });
+                        this.startReplyRecovery(turn, "malformed_call");
+                    }
+                    else {
+                        this.emit("malformed_tool_call", {
+                            name: this.name,
+                            correlationId: turn.target.correlationId,
+                            recovered: false,
+                        });
+                        this.turnReplyGuard.complete(turn.generation);
+                    }
+                }
+                else {
+                    this.turnReplyGuard.complete(turn.generation);
                 }
                 // Never let the broader dead-MCP fallback relay the XML/chrome too.
                 return;
             }
         }
-        if (delivered)
+        // Preserve the dead-MCP proxy path and its explicit opt-in. Other outbound
+        // tools still suppress that proxy, but only a delivered `reply` satisfies
+        // the human-facing completion guard below.
+        if (!turn.outboundDelivered && this.config.mcp_proxy_reply === true
+            && mcpServerState(this.instanceDir).state === "dead") {
+            this.turnReplyGuard.complete(turn.generation);
+            void this.sendProxyReply(pane, turn.target);
             return;
-        // Opt-in: raw pane text can carry secrets past the regex redaction.
-        if (this.config.mcp_proxy_reply !== true)
+        }
+        if (!this.replyCompletionGuardEnabled() || !this.mcpServerAlive().alive) {
+            this.turnReplyGuard.complete(turn.generation);
             return;
-        // "dead" only: unknown means not started or exited cleanly — never proxy on it.
-        if (mcpServerState(this.instanceDir).state !== "dead")
+        }
+        if (turn.replyAttempted) {
+            // A provider timeout can be "applied, then timed out". Retrying it would
+            // risk a duplicate; report the unknown result and stop here.
+            this.turnReplyGuard.complete(turn.generation);
+            this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
             return;
-        void this.sendProxyReply(pane, inboundMarker, correlationId);
+        }
+        this.startReplyRecovery(turn, "no_valid_call");
     }
     isClaudeCodeBackend() {
         return this.runtimeIdentity?.backend === "claude-code"
             || this.config.backend === "claude-code"
             || this.backend?.binaryName === "claude";
     }
+    replyCompletionGuardEnabled() {
+        return this.backend?.replyCompletionGuard === true;
+    }
+    startReplyRecovery(turn, reason) {
+        if (!this.turnReplyGuard.beginRecovery(turn.generation))
+            return;
+        this.emit("reply_drop_detected", {
+            name: this.name,
+            correlationId: turn.target.correlationId,
+            generation: turn.generation,
+            reason,
+            recoveryStarted: true,
+        });
+        void this.deliverDaemonReply(t("inst.reply_drop_retrying"), "replydrop", "Reply-drop status", turn.target, true);
+        this.queueReplyRecoveryPrompt(turn);
+    }
+    reportReplyDropWithoutRetry(turn, reason) {
+        this.emit("reply_drop_detected", {
+            name: this.name,
+            correlationId: turn.target.correlationId,
+            generation: turn.generation,
+            reason,
+            recoveryStarted: false,
+        });
+        void this.deliverDaemonReply(t("inst.reply_drop_unknown"), "replydrop", "Unconfirmed reply status", turn.target, true);
+    }
+    queueReplyRecoveryPrompt(turn) {
+        const deliveryEpoch = this.deliveryEpoch;
+        this.pasteQueueDepth++;
+        this.pasteLock = this.pasteLock.then(async () => {
+            try {
+                const current = this.turnReplyGuard.snapshot();
+                if (!current || current.generation !== turn.generation || current.phase !== "recovering")
+                    return;
+                if (current.replyDelivered) {
+                    this.turnReplyGuard.complete(turn.generation);
+                    this.emit("reply_drop_recovered", {
+                        name: this.name,
+                        correlationId: current.target.correlationId,
+                        generation: current.generation,
+                    });
+                    return;
+                }
+                const delivered = await this.deliverMessage(REPLY_RECOVERY_PROMPT, undefined, {
+                    deliveryEpoch,
+                });
+                if (!delivered) {
+                    this.turnReplyGuard.complete(turn.generation);
+                    this.reportUnrecoveredReplyDrop(turn, "recovery_prompt_delivery_failed");
+                }
+            }
+            finally {
+                this.pasteQueueDepth--;
+            }
+        }).catch(err => {
+            this.logger.error({ err: err.message }, "Reply-drop recovery prompt failed");
+            this.turnReplyGuard.complete(turn.generation);
+            this.reportUnrecoveredReplyDrop(turn, "recovery_prompt_delivery_failed");
+        });
+    }
+    queueMalformedReplyRecovery(turn, text) {
+        // Serialize the delivery decision ahead of any new pane input. If direct
+        // delivery is positively acknowledged, there is no recovery turn. If its
+        // outcome is unknown, do not ask the model to duplicate it.
+        const delivery = this.deliverDaemonReply(text, "malformedreply", "Malformed tool-call recovery", turn.target);
+        this.pasteQueueDepth++;
+        this.pasteLock = this.pasteLock.then(async () => {
+            try {
+                const delivered = await delivery;
+                this.emit("malformed_tool_call", {
+                    name: this.name,
+                    correlationId: turn.target.correlationId,
+                    recovered: delivered,
+                });
+                this.turnReplyGuard.complete(turn.generation);
+                if (!delivered)
+                    this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+            }
+            finally {
+                this.pasteQueueDepth--;
+            }
+        }).catch(err => {
+            this.logger.error({ err: err.message }, "Malformed tool-call recovery attempt failed");
+            this.turnReplyGuard.complete(turn.generation);
+            this.reportReplyDropWithoutRetry(turn, "reply_failed_or_unknown");
+        });
+    }
+    reportUnrecoveredReplyDrop(turn, reason = "recovery_turn_missing_reply") {
+        this.emit("reply_drop_unrecovered", {
+            name: this.name,
+            correlationId: turn.target.correlationId,
+            generation: turn.generation,
+            reason,
+        });
+        const now = Date.now();
+        if (this.lastReplyDropWarningAt !== 0
+            && now - this.lastReplyDropWarningAt < REPLY_DROP_WARNING_COOLDOWN_MS)
+            return;
+        this.lastReplyDropWarningAt = now;
+        void this.deliverDaemonReply(t("inst.reply_drop_unrecovered"), "replydropwarn", "Reply-drop recovery warning", turn.target, true);
+    }
     /** Relay the pane's final text to the channel, marked as a daemon proxy reply. */
-    async sendProxyReply(pane, inboundMarker, correlationId) {
+    async sendProxyReply(pane, target) {
         try {
             // The idle capture normally hands its pane in; fall back only when the
             // edge came from a path without one.
@@ -2923,74 +3108,110 @@ export class Daemon extends EventEmitter {
                 pane = await this.tmux?.capturePane();
             if (!pane)
                 return;
-            const text = extractProxyReplyText(pane, { inboundMarker, readyPattern: this.instanceStateReadyPattern });
+            const text = extractProxyReplyText(pane, { inboundMarker: target.inboundMarker, readyPattern: this.instanceStateReadyPattern });
             if (!text) {
                 this.logger.debug("Dead-MCP proxy reply skipped — pane tail is trivial");
                 return;
             }
             let body = `⚠️ [MCP unavailable — proxy reply]\n\n${text}`;
-            if (correlationId)
-                body += `\n\n(correlation_id: ${correlationId})`;
-            this.logger.warn({ correlationId }, "MCP server dead and the turn sent no reply — relaying the pane text as a proxy reply");
-            this.emit("mcp_proxy_reply", { name: this.name, correlationId });
-            this.deliverDaemonReply(body, "proxyreply", "Dead-MCP proxy reply");
+            if (target.correlationId)
+                body += `\n\n(correlation_id: ${target.correlationId})`;
+            this.logger.warn({ correlationId: target.correlationId }, "MCP server dead and the turn sent no reply — attempting a pane-text proxy reply");
+            const delivered = await this.deliverDaemonReply(body, "proxyreply", "Dead-MCP proxy reply", target);
+            if (delivered)
+                this.emit("mcp_proxy_reply", { name: this.name, correlationId: target.correlationId });
         }
         catch (err) {
             this.logger.error({ err: err.message }, "Dead-MCP proxy reply attempt failed");
         }
     }
-    /** Send a narrowly extracted #648 reply; operator notification is a separate event. */
-    sendRecoveredMalformedReply(text, correlationId) {
-        try {
-            this.deliverDaemonReply(text, "malformedreply", "Malformed tool-call recovery");
-        }
-        catch (err) {
-            this.logger.error({ err: err.message, correlationId }, "Malformed tool-call recovery attempt failed");
-        }
-    }
     /** Context-bound reply path shared by dead-MCP and malformed-call recovery. */
-    deliverDaemonReply(body, requestPrefix, logLabel) {
+    deliverDaemonReply(body, requestPrefix, logLabel, target, statusOnly = false) {
         const args = { text: body };
-        if (this.lastChatId) {
-            args.chat_id = this.lastChatId;
-            if (this.lastThreadId)
-                args.thread_id = this.lastThreadId;
+        const chatId = target?.chatId ?? this.lastChatId;
+        const threadId = target?.threadId ?? this.lastThreadId;
+        const adapterId = target?.adapterId ?? this.lastAdapterId;
+        if (chatId) {
+            args.chat_id = chatId;
+            if (threadId)
+                args.thread_id = threadId;
         }
         const adapters = this.messageBus.getAllAdapters();
         if (adapters.length > 0) {
-            routeToolCall(adapters[0], "reply", args, this.lastThreadId, (_result, error) => {
-                if (error)
-                    this.logger.error({ error }, `${logLabel} failed`);
-                else
-                    this.logger.info(`${logLabel} delivered`);
+            // With one adapter there is nothing to choose and adapters[0] is exact.
+            // With several, "no adapter named" is a routing failure, not a default:
+            // picking the first sends one world's chat id through another world's bot.
+            const adapter = adapterId
+                ? this.messageBus.getAdapter(adapterId)
+                : (adapters.length === 1 ? adapters[0] : undefined);
+            if (!adapter) {
+                this.logger.error({ adapterId, adapterCount: adapters.length }, `${logLabel} failed — ${adapterId ? "target adapter is unavailable" : "no adapter bound to this chat context"}`);
+                return Promise.resolve(false);
+            }
+            return new Promise(resolve => {
+                let settled = false;
+                const finish = (delivered, error) => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    clearTimeout(timeout);
+                    if (delivered)
+                        this.logger.info(`${logLabel} delivered`);
+                    else
+                        this.logger.error({ error }, `${logLabel} failed`);
+                    resolve(delivered);
+                };
+                const timeout = setTimeout(() => finish(false, "adapter reply timed out"), daemonBudgetMs("reply"));
+                timeout.unref?.();
+                try {
+                    if (!routeToolCall(adapter, "reply", args, threadId, (result, error) => finish(!error && result != null, error))) {
+                        finish(false, "reply route unavailable");
+                    }
+                }
+                catch {
+                    finish(false, "adapter reply threw before returning a promise");
+                }
             });
-            return;
         }
         if (!this.ipcServer) {
             this.logger.error(`${logLabel} failed — no adapter or fleet IPC route`);
-            return;
+            return Promise.resolve(false);
         }
-        const fleetReqId = `${requestPrefix}_${++this.proxyReplySeq}`;
-        const timeout = setTimeout(() => {
-            this.pendingIpcRequests.delete(fleetReqId);
-            this.logger.error(`${logLabel} timed out waiting for the fleet manager`);
-        }, daemonBudgetMs("reply"));
-        timeout.unref?.();
-        // Register before broadcast: an in-process/fast adapter can answer in the
-        // same tick, and a waiter installed afterwards would miss that response.
-        this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
-            clearTimeout(timeout);
-            if (respMsg.error)
-                this.logger.error({ error: respMsg.error }, `${logLabel} failed`);
-            else
-                this.logger.info(`${logLabel} delivered`);
-        });
-        this.ipcServer.broadcast({
-            type: "fleet_outbound",
-            tool: "reply",
-            args,
-            fleetRequestId: fleetReqId,
-            adapterId: this.lastAdapterId,
+        return new Promise(resolve => {
+            const fleetReqId = `${requestPrefix}_${++this.proxyReplySeq}`;
+            const timeout = setTimeout(() => {
+                this.pendingIpcRequests.delete(fleetReqId);
+                this.logger.error(`${logLabel} timed out waiting for the fleet manager`);
+                resolve(false);
+            }, daemonBudgetMs("reply"));
+            timeout.unref?.();
+            // Register before broadcast: an in-process/fast adapter can answer in the
+            // same tick, and a waiter installed afterwards would miss that response.
+            this.pendingIpcRequests.set(fleetReqId, (respMsg) => {
+                clearTimeout(timeout);
+                const delivered = !respMsg.error && respMsg.result != null;
+                if (!delivered)
+                    this.logger.error({ error: respMsg.error }, `${logLabel} failed`);
+                else
+                    this.logger.info(`${logLabel} delivered`);
+                resolve(delivered);
+            });
+            try {
+                this.ipcServer.broadcast({
+                    type: "fleet_outbound",
+                    tool: "reply",
+                    args,
+                    fleetRequestId: fleetReqId,
+                    adapterId,
+                    statusOnly,
+                });
+            }
+            catch {
+                clearTimeout(timeout);
+                this.pendingIpcRequests.delete(fleetReqId);
+                this.logger.error(`${logLabel} failed — fleet IPC broadcast threw`);
+                resolve(false);
+            }
         });
     }
     clearInstanceStateIdleTimer() {
@@ -3557,7 +3778,7 @@ export class Daemon extends EventEmitter {
             await this.wake();
             if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                 return;
-            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch })) {
+            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id })) {
                 this.markTurnStarted(meta, formatted);
             }
             else if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
@@ -3595,7 +3816,7 @@ export class Daemon extends EventEmitter {
             await this.wake();
             if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                 return;
-            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch })) {
+            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id })) {
                 this.markTurnStarted(meta, formatted);
             }
         }).catch(err => {
@@ -3647,8 +3868,7 @@ export class Daemon extends EventEmitter {
             this.pasteLock = this.pasteLock.then(async () => {
                 if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                     return;
-                if (await this.deliverMessage(rawText, undefined, { deliveryEpoch }))
-                    this.markTurnStarted(meta, rawText);
+                await this.deliverMessage(rawText, undefined, { deliveryEpoch });
             }).catch(err => {
                 this.logger.warn({ err: err.message }, "pasteLock raw delivery error");
             });
@@ -3691,7 +3911,7 @@ export class Daemon extends EventEmitter {
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
-                if (await this.deliverMessage(formatted, status, { deliveryEpoch })) {
+                if (await this.deliverMessage(formatted, status, { deliveryEpoch, submissionId: meta.message_id })) {
                     this.markTurnStarted(meta, formatted);
                 }
                 else if (meta.from_instance && this.isDeliveryEpochCurrent(deliveryEpoch)) {
@@ -3840,16 +4060,24 @@ export class Daemon extends EventEmitter {
                 }
             }
         }
-        // Everything above is *waiting*; everything below *writes*. Only the write is
-        // held under the pane lock — holding it across the idle wait (up to 30 min)
-        // would starve the runtime-dialog dismisser, which is often the very thing
-        // that would let the pane go idle again.
+        // Everything above is *waiting*; everything below owns the write lock.
+        // Long idle/dialog waits stay outside because the runtime dismisser may be
+        // what makes progress. The one under-lock wait below is explicitly passive:
+        // it clears by itself and closes a repaint race immediately before paste.
         for (let round = 0;; round++) {
             const outcome = await this.paneWriteLock.run(async () => {
                 if (cancelled())
                     return false;
                 if (this.refuseFatalStartupDelivery(status))
                     return false;
+                // A passive startup phase may paint after the outer readiness probe.
+                // It clears without input, so waiting under the pane lock cannot starve
+                // a dialog dismisser and closes the final clear→paste TOCTOU window.
+                if (!(await this.waitForInputTransientToClear("pre-write"))) {
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
                 // TOCTOU: the probes above ran outside this lock, and the CLI repaints
                 // whenever it likes — a resume prompt can be painted between "clear" and
                 // this critical section. Re-probe here, right before the write; a
@@ -3859,7 +4087,7 @@ export class Daemon extends EventEmitter {
                     if (probe.state !== "clear")
                         return "dialog";
                 }
-                return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status);
+                return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId);
             });
             if (outcome !== "dialog")
                 return outcome;
@@ -3893,6 +4121,75 @@ export class Daemon extends EventEmitter {
     deliveryBlockingDialogs() {
         return (this.backend?.getRuntimeDialogs?.() ?? []).filter(d => d.blocksDelivery || d.holdOnly);
     }
+    /** Passive input-unavailable phases relevant to the current spawn only. */
+    guardedInputTransients() {
+        if (this.inputTransientGuardGeneration === null
+            || this.inputTransientGuardGeneration !== this.spawnGeneration)
+            return [];
+        return this.backend?.getInputUnavailableTransients?.() ?? [];
+    }
+    /** Match a passive transient against the current interactive screen. */
+    inputTransientInPane(pane) {
+        for (const transient of this.guardedInputTransients()) {
+            // `pattern` is only a cheap pre-filter. `isActive` is deliberately the
+            // authority because users and agents routinely quote diagnostic text.
+            transient.pattern.lastIndex = 0;
+            if (!transient.pattern.test(pane))
+                continue;
+            if (transient.isActive(pane))
+                return transient;
+        }
+        return null;
+    }
+    /** Capture failure is unknown, never evidence that input is available. */
+    async probeInputTransient() {
+        if (this.guardedInputTransients().length === 0 || !this.tmux)
+            return { state: "clear" };
+        try {
+            const pane = await this.tmux.capturePane();
+            const transient = this.inputTransientInPane(pane);
+            return transient ? { state: "active", transient } : { state: "clear" };
+        }
+        catch (err) {
+            this.logger.debug({ err }, "capture-pane failed during the input-transient probe — pane state unknown");
+            return { state: "unknown" };
+        }
+    }
+    /**
+     * Wait under the pane lock for a passive transient to disappear. Unlike a
+     * dialog, this state clears by itself, so the wait cannot starve a keypress
+     * dismisser. Stop or a replacement spawn invalidates the captured identity.
+     */
+    async waitForInputTransientToClear(phase, timeoutMs = INPUT_TRANSIENT_WAIT_MS) {
+        const generation = this.inputTransientGuardGeneration;
+        if (generation === null || generation !== this.spawnGeneration)
+            return true;
+        const deadline = Date.now() + timeoutMs;
+        let observedDescription = null;
+        for (;;) {
+            if (this.inputTransientGuardGeneration !== generation || this.spawnGeneration !== generation) {
+                this.logger.warn({ phase, generation }, "Spawn changed while waiting for input availability — refusing to send Enter into the replacement pane");
+                return false;
+            }
+            const probe = await this.probeInputTransient();
+            if (this.inputTransientGuardGeneration !== generation || this.spawnGeneration !== generation) {
+                this.logger.warn({ phase, generation }, "Spawn changed during the input-availability probe — refusing to send Enter into the replacement pane");
+                return false;
+            }
+            if (probe.state === "clear")
+                return true;
+            if (probe.state === "active" && observedDescription !== probe.transient.description) {
+                observedDescription = probe.transient.description;
+                this.logger.info({ phase, transient: probe.transient.description, generation }, "CLI is still completing startup — waiting before sending Enter");
+            }
+            const remaining = deadline - Date.now();
+            if (remaining <= 0) {
+                this.logger.error({ phase, generation, timeoutMs, transient: observedDescription }, "CLI input stayed unavailable — refusing to send Enter");
+                return false;
+            }
+            await new Promise(r => setTimeout(r, Math.min(INPUT_TRANSIENT_POLL_MS, remaining)));
+        }
+    }
     static dialogKey(dialog) {
         return `${dialog.pattern.source}/${dialog.pattern.flags}`;
     }
@@ -4003,10 +4300,10 @@ export class Daemon extends EventEmitter {
     }
     /**
      * Why a pane is not deliverable matters. "busy" may be handed to a native
-     * input queue or steered (after its own dialog probe); "dialog" and "unknown"
-     * must never be — a paste + Enter into a dialog answers it with its default,
-     * and an unreadable pane proves nothing. The silence gate comes first and
-     * costs no capture, so a CLI that is simply working never pays for the probe.
+     * input queue or steered (after its own dialog probe); "dialog", "transient"
+     * and "unknown" must never be — a paste + Enter into a dialog answers it
+     * with its default, while a startup transient swallows it and an unreadable
+     * pane proves nothing. The silence gate comes first and costs no capture.
      */
     async paneReadinessForDelivery(windowId) {
         if (!this.isPaneIdleForDelivery(windowId))
@@ -4014,6 +4311,11 @@ export class Daemon extends EventEmitter {
         const probe = await this.probeBlockingDialog();
         if (probe.state !== "clear")
             return probe.state;
+        const transient = await this.probeInputTransient();
+        if (transient.state === "active")
+            return "transient";
+        if (transient.state === "unknown")
+            return "unknown";
         if (this.backend?.dropsEnterWhileBusy?.() !== true)
             return "ready";
         const prompt = this.backend.getBottomReadyPattern?.();
@@ -4060,6 +4362,7 @@ export class Daemon extends EventEmitter {
         const deadline = Date.now() + timeoutMs;
         const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true;
         let unknownStreak = 0;
+        let transientDeadline = 0;
         for (;;) {
             const remaining = deadline - Date.now();
             if (remaining <= 0)
@@ -4069,6 +4372,26 @@ export class Daemon extends EventEmitter {
                 return false;
             // The idle wait just resolved, so re-reading the silence gate would only
             // add a stale-cache race; ask the pane the remaining questions directly.
+            const transient = await this.probeInputTransient();
+            if (transient.state === "active") {
+                unknownStreak = 0;
+                transientDeadline ||= Math.min(deadline, Date.now() + INPUT_TRANSIENT_WAIT_MS);
+                if (Date.now() >= transientDeadline) {
+                    this.logger.error({ transient: transient.transient.description, timeoutMs: INPUT_TRANSIENT_WAIT_MS }, "CLI input stayed unavailable during the delivery-readiness wait");
+                    return false;
+                }
+                await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
+                continue;
+            }
+            transientDeadline = 0;
+            if (transient.state === "unknown") {
+                if (++unknownStreak >= DIALOG_PROBE_UNKNOWN_MAX) {
+                    this.logger.error({ probes: unknownStreak }, "Pane stayed unreadable during the input-transient probe — refusing to deliver blind");
+                    return false;
+                }
+                await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
+                continue;
+            }
             if (bottomGated) {
                 if (await this.isPaneReadyForDelivery(windowId))
                     return true;
@@ -4104,15 +4427,16 @@ export class Daemon extends EventEmitter {
      * must fail rather than paste on top of the stranded text).
      */
     async submitStrandedInputIfAny(windowId) {
-        if (this.backend?.dropsEnterWhileBusy?.() !== true || !this.tmux)
+        if (!this.tmux || !this.backend)
             return "idle";
         const prompt = this.backend.getBottomReadyPattern?.();
         if (!prompt)
             return "idle";
+        const requireBottomReady = this.backend.dropsEnterWhileBusy?.() === true;
         // Pre-check outside the lock so the common case (verified clear) never
         // contends with the dialog dismisser. Only a POSITIVE "clear" skips the
         // lock; an unreadable pane is re-examined under it, not waved through.
-        const pre = await this.strandedInputState(prompt);
+        const pre = await this.strandedInputState(prompt, requireBottomReady);
         if (pre === "clear")
             return "idle";
         if (pre === "busy")
@@ -4128,7 +4452,7 @@ export class Daemon extends EventEmitter {
             // no-op at an empty prompt, but into a modal it is a confirmation.
             if (this.fatalStartupBlocked)
                 return "busy";
-            const state = await this.strandedInputState(prompt);
+            const state = await this.strandedInputState(prompt, requireBottomReady);
             if (state === "clear")
                 return "idle";
             if (state !== "stranded")
@@ -4138,12 +4462,12 @@ export class Daemon extends EventEmitter {
         });
     }
     /**
-     * "stranded": an AgEnD message sits in the input row; "clear": the prompt is
-     * at the bottom with no stranded text; "busy": generating, or the prompt is
-     * not at the bottom (incl. a blank frame); "unknown": the pane could not be
-     * read. Only "clear" is positive evidence.
+     * "stranded": an AgEnD message sits in the input row; "clear": no strand is
+     * visible under the backend's readiness policy; "busy": generating, or (for
+     * a bottom-gated backend) the prompt is not at the bottom; "unknown": the
+     * pane could not be read. Only "clear" permits the next paste.
      */
-    async strandedInputState(prompt) {
+    async strandedInputState(prompt, requireBottomReady) {
         let pane;
         try {
             pane = await this.tmux.capturePane();
@@ -4151,11 +4475,16 @@ export class Daemon extends EventEmitter {
         catch {
             return "unknown";
         }
+        if (this.inputTransientInPane(pane))
+            return "busy";
         if (this.backend?.getBusyPattern?.()?.test(pane))
             return "busy";
         if (strandedAgendMessageInInput(pane, prompt))
             return "stranded";
-        return bottomRowIsReady(pane, prompt) ? "clear" : "busy";
+        // Kiro needs a bottom-anchored prompt as positive readiness evidence. Codex
+        // does not: this preflight runs only after its ordinary silence gate and is
+        // enabled solely to recover a positively identified old AgEnD strand.
+        return !requireBottomReady || bottomRowIsReady(pane, prompt) ? "clear" : "busy";
     }
     /**
      * F2: for Enter-dropping TUIs, "some output after Enter" proves nothing — the
@@ -4259,6 +4588,8 @@ export class Daemon extends EventEmitter {
      * an invariant maintained by comments.
      */
     async sendDeliveryEnter(phase) {
+        if (!(await this.waitForInputTransientToClear(phase)))
+            return false;
         const sent = await this.tmux.sendSpecialKey("Enter");
         if (!sent) {
             this.logger.error({
@@ -4268,13 +4599,17 @@ export class Daemon extends EventEmitter {
         }
         return sent;
     }
-    async writeMessageToPane(formatted, initialWindowId, handingOffToNativeQueue, status) {
+    async writeMessageToPane(formatted, initialWindowId, handingOffToNativeQueue, status, submissionId) {
+        const signature = this.submissionSignature(formatted, submissionId);
         let windowId = initialWindowId;
         // Bug A: paste with backoff. Transient failures are usually a stale window id
         // after a crash/respawn — recover by name and retry (max 3 attempts, 2s apart).
         const maxAttempts = 3;
         for (let attempt = 1; attempt <= maxAttempts; attempt++) {
             const pasteStartedAt = Date.now();
+            // Read the pane BEFORE writing to it, so the submission check can require
+            // evidence this paste ADDED rather than evidence that was already there.
+            const pasteBaseline = await this.capturePaneEvidence(signature);
             const pasted = await this.tmux.pasteBuffer(formatted);
             if (!pasted) {
                 const tmuxError = this.tmux.getLastPasteError?.() ?? "unknown tmux paste failure";
@@ -4356,16 +4691,73 @@ export class Daemon extends EventEmitter {
             // can silently swallow it). Idle submissions keep the swallowed-Enter path.
             if (handingOffToNativeQueue) {
                 await new Promise(r => setTimeout(r, NATIVE_QUEUE_PASTE_VERIFY_MS));
-                if (await this.nativeQueuePasteVisible(formatted)) {
+                const proof = await this.confirmSubmitted(signature, pasteBaseline);
+                if (proof === "submitted") {
                     if (status)
                         this.emit("message_confirmed", status); // ✅ native queue accepted
                     return true;
                 }
-                // Silent loss: fall back once to the normal idle-gated path.
-                this.logger.warn("Native-queue paste not visible in pane — retrying via idle-gated delivery");
+                if (proof === "unverifiable") {
+                    // Our text is on the pane but cannot be shown to have left the input
+                    // row — either the backend exposes no input row (only /steer reaches
+                    // this path on such a backend) or the pre-paste pane was unreadable.
+                    // Re-pasting on that would deliver the message twice, so accept as
+                    // this path always has, and record that it is unproven.
+                    this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
+                    if (status)
+                        this.emit("message_confirmed", status); // ✅ (best-effort)
+                    return true;
+                }
+                // Not submitted (or not provably submitted): fall back once to the
+                // normal idle-gated path, which is the only one with a full
+                // confirmation ladder. "stranded" is the case that used to be a silent
+                // ✅ — the text was visible, so the old check called it delivered.
+                this.logger.warn({ proof }, "Native-queue paste not confirmed as submitted — retrying via idle-gated delivery");
                 if (windowId && this.controlClient) {
                     await this.controlClient.waitUntilIdle(windowId);
                 }
+                // Re-read before doing anything: the CLI had a whole turn to flush its
+                // queue while we waited, and the right recovery differs per outcome.
+                // Re-pasting a payload that is STILL in the input row appends it to
+                // itself — paste-buffer writes at the cursor — and the next Enter then
+                // submits the message twice over. That is the trap this fix would walk
+                // into if it treated "not confirmed" as one state.
+                const settled = await this.confirmSubmitted(signature, pasteBaseline);
+                if (settled === "submitted") {
+                    this.logger.info("Native-queue message submitted itself while we waited for idle");
+                    if (status)
+                        this.emit("message_confirmed", status); // ✅
+                    return true;
+                }
+                if (settled === "stranded") {
+                    // The text is already there in full: it needs submitting, not sending
+                    // again. The prompt is back now, so an Enter can land.
+                    this.logger.warn("Message still in the input row after idle — submitting the existing text instead of pasting it again");
+                    const strandedAt = Date.now();
+                    if (!(await this.sendDeliveryEnter("native-queue-stranded-submit"))) {
+                        if (status)
+                            this.emit("message_failed", status); // ❌
+                        return false;
+                    }
+                    const afterEnter = await this.confirmSubmitted(signature, pasteBaseline);
+                    if (afterEnter === "submitted") {
+                        if (status)
+                            this.emit("message_confirmed", status); // ✅
+                        return true;
+                    }
+                    // Deliberately NOT "or the pane went busy". This branch runs because
+                    // the text was still in the input row; if the recovery Enter was
+                    // swallowed too, the pane is busy with something else — a late redraw,
+                    // another turn's output — and treating that as proof re-confirms a
+                    // message nobody submitted. Output is corroboration; text sitting in
+                    // the input row is disqualifying, and disqualifying evidence wins.
+                    this.logger.error({ afterEnter, strandedAt }, "Stranded message could not be submitted by Enter");
+                    if (status)
+                        this.emit("message_failed", status); // ❌
+                    return false;
+                }
+                // "unproven": nothing of ours is on screen — the paste itself was lost,
+                // so pasting it again cannot duplicate anything.
                 const repasted = await this.tmux.pasteBuffer(formatted);
                 if (!repasted) {
                     this.logger.error({
@@ -4383,24 +4775,13 @@ export class Daemon extends EventEmitter {
                     return false;
                 }
                 if (windowId && this.controlClient) {
-                    let becameBusy = await this.confirmBusyAfterEnter(windowId, retryAt);
-                    if (!becameBusy) {
-                        this.logger.warn("No idle→busy after idle-gated redelivery — re-sending Enter once");
-                        const retry2At = Date.now();
-                        if (!(await this.sendDeliveryEnter("native-queue-idle-redelivery-retry"))) {
-                            if (status)
-                                this.emit("message_failed", status); // ❌
-                            return false;
-                        }
-                        becameBusy = await this.confirmBusyAfterEnter(windowId, retry2At);
-                    }
-                    if (becameBusy) {
+                    if (await this.confirmAfterEnter(windowId, retryAt, signature, pasteBaseline, "native-queue-idle-redelivery-retry")) {
                         if (status)
                             this.emit("message_confirmed", status); // ✅
                         return true;
                     }
                 }
-                else if (await this.nativeQueuePasteVisible(formatted)) {
+                else if (await this.confirmSubmitted(signature, pasteBaseline) === "submitted") {
                     if (status)
                         this.emit("message_confirmed", status); // ✅
                     return true;
@@ -4440,17 +4821,17 @@ export class Daemon extends EventEmitter {
                 }
             }
             else if (windowId && this.controlClient) {
-                let becameBusy = await this.confirmBusyAfterEnter(windowId, enterAt);
-                if (!becameBusy) {
-                    this.logger.warn("No idle→busy transition after Enter — re-sending Enter once");
-                    const retryAt = Date.now();
-                    if (!(await this.sendDeliveryEnter("idle-to-busy-retry"))) {
-                        if (status)
-                            this.emit("message_failed", status); // ❌
-                        return false;
-                    }
-                    becameBusy = await this.confirmBusyAfterEnter(windowId, retryAt);
-                }
+                // An idle delivery used to be judged by output alone: anything the pane
+                // printed after Enter counted as "submitted". Waking a paused instance
+                // breaks that — the CLI's final redraw arrives right as we press Enter,
+                // so a swallowed Enter is confirmed by the redraw it was lost to, and
+                // the message is never in a turn (#745 left this path on the old rule).
+                //
+                // Where the input row can be read, it decides: text still sitting there
+                // is disqualifying and no amount of output may override it. Where it
+                // cannot (a backend with no prompt pattern), the output signal remains
+                // exactly as before — this must not regress backends we cannot read.
+                const becameBusy = await this.confirmAfterEnter(windowId, enterAt, signature, pasteBaseline, "idle-to-busy-retry");
                 if (becameBusy) {
                     if (status)
                         this.emit("message_confirmed", status); // ✅
@@ -4481,31 +4862,260 @@ export class Daemon extends EventEmitter {
         return false;
     }
     /**
-     * True when a busy native-queue paste appears to have landed: Codex shows a
-     * `↳` queue marker, or a distinctive slice of the pasted text is on screen.
-     * Used only to detect silent paste loss — not as a general ready check.
+     * The single place a pasted message is judged submitted, shared by the
+     * native-queue handoff, the idle-gated redelivery and the system pastes.
+     *
+     * It replaces three divergent weak checks, the weakest of which accepted "the
+     * pasted text is visible somewhere in the pane". That one was satisfied BY
+     * the failure it was meant to catch: text stranded in the input row is on
+     * screen, so a message nobody submitted was confirmed ✅ with no warning
+     * anywhere. Evidence is weighed in order of what it can prove, and the
+     * disqualifying evidence is checked first.
      */
-    async nativeQueuePasteVisible(formatted) {
-        if (!this.tmux)
+    /**
+     * Whether this backend exposes an input row we can actually read, i.e. whether
+     * confirmSubmitted can ever return a verdict stronger than a guess.
+     *
+     * This is a property of the BACKEND, not of one delivery's verdict. Keying the
+     * output-signal fallback off the verdict instead let codex — which can be read
+     * — fall back to "the pane printed something" whenever a paste left no trace,
+     * which is the same false confirmation one layer down.
+     */
+    canProveSubmission() {
+        return !!this.backend?.getBottomReadyPattern?.();
+    }
+    /** Positive submission retires the startup transient guard for this spawn. */
+    submittedProof() {
+        if (this.inputTransientGuardGeneration === this.spawnGeneration) {
+            this.inputTransientGuardGeneration = null;
+        }
+        return "submitted";
+    }
+    /**
+     * Decide a submission after an Enter, with one bounded retry.
+     *
+     * Backends we can read must SHOW the text left the input row: neither a
+     * strand nor a vanished paste may be upgraded to success by output, because
+     * the output that would do the upgrading is usually the very redraw the Enter
+     * was lost to. Backends we cannot read keep the legacy output signal — there
+     * is nothing better available for them, and taking it away would fail every
+     * one of their deliveries.
+     *
+     * One ladder, used by every post-Enter confirmation, so an escape hatch
+     * cannot reappear in just one of them (it did: three copies, two of which
+     * still confirmed on output alone).
+     */
+    async confirmAfterEnter(windowId, enterAt, signature, baseline, retryPhase) {
+        if (!this.canProveSubmission()) {
+            let busy = await this.confirmBusyAfterEnter(windowId, enterAt);
+            if (!busy) {
+                this.logger.warn("No idle→busy transition after Enter — re-sending Enter once");
+                const retryAt = Date.now();
+                if (!(await this.sendDeliveryEnter(retryPhase)))
+                    return false;
+                busy = await this.confirmBusyAfterEnter(windowId, retryAt);
+            }
+            return busy;
+        }
+        if (await this.confirmSubmitted(signature, baseline) === "submitted")
+            return true;
+        // Retry once the prompt is back — an Enter sent into a mid-redraw TUI is
+        // how we got here. Then poll briefly rather than judging on one capture:
+        // the key takes a moment to be digested, and a single early look would
+        // report a failure for a message that did go out.
+        this.logger.warn("Enter did not submit — waiting for the prompt, then re-sending once");
+        if (!(await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS)))
             return false;
-        try {
-            const pane = await this.tmux.capturePane();
-            if (pane.includes("↳"))
+        if (!(await this.sendDeliveryEnter(retryPhase)))
+            return false;
+        const deadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+        for (;;) {
+            if (await this.confirmSubmitted(signature, baseline) === "submitted")
                 return true;
-            for (const line of formatted.split(/\r?\n/)) {
-                const t = line.trim();
-                if (t.length >= 8 && pane.includes(t))
-                    return true;
+            if (Date.now() >= deadline)
+                return false;
+            await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+        }
+    }
+    async confirmSubmitted(signature, baseline) {
+        if (!this.tmux)
+            return "unproven";
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return "unproven";
+        }
+        // Without a way to tell the input row from the transcript, "the text is on
+        // screen" cannot distinguish submitted from stranded — that ambiguity IS
+        // the bug. Such a backend gets an explicit verdict rather than a guess:
+        // "unverifiable" (something of ours appeared, but not provably out of the
+        // input row) or "unproven" (nothing of ours appeared, so the paste itself
+        // was lost). The caller keeps that backend's existing best-effort handling
+        // for the first and recovers on the second, which is what it did before —
+        // the fix here is for backends that CAN be read, not a new guess for those
+        // that cannot.
+        const prompt = this.backend?.getBottomReadyPattern?.();
+        if (!prompt) {
+            const seen = this.paneEvidence(pane, signature);
+            if (signature.unique && seen.payload > 0)
+                return "unverifiable";
+            return seen.payload > (baseline?.payload ?? Infinity) || seen.queued > (baseline?.queued ?? Infinity)
+                ? "unverifiable"
+                : "unproven";
+        }
+        const after = this.paneEvidence(pane, signature);
+        // 1. Disqualifying evidence, checked FIRST and never overridden by the
+        //    corroborating evidence below: our text is sitting in the input row, so
+        //    it was not submitted — whatever else is on screen.
+        //
+        //    It must be OUR text. A unique signature settles that on its own; a
+        //    body-derived one cannot, so it is only attributed to this delivery
+        //    when the input row did not already show it before we pasted.
+        //    Otherwise an older stranded message with the same opening would be
+        //    read as ours, we would press Enter to "recover" it, and the turn IT
+        //    starts would confirm a message that never reached the pane.
+        if (after.strandedInput && (signature.unique || baseline?.strandedInput === false))
+            return "stranded";
+        // 2. Positive evidence. A unique signature needs no baseline: no earlier
+        //    message can carry this delivery's message_id, so finding it outside
+        //    the input row is proof in itself — which also means a momentary
+        //    failure to read the pane BEFORE pasting cannot turn a delivered
+        //    message into a re-paste.
+        if (signature.unique && after.payload > 0)
+            return this.submittedProof();
+        // 3. Otherwise the evidence must be NEW relative to the pane as it was
+        //    before we pasted: a queue marker left by an earlier message, or an
+        //    older transcript entry that opens the same way, are on screen either
+        //    way and would otherwise confirm a paste that never landed.
+        if (baseline) {
+            if (after.queued > baseline.queued)
+                return this.submittedProof();
+            if (after.payload > baseline.payload)
+                return this.submittedProof();
+            // 4. Nothing new of ours anywhere: the paste was swallowed by a redraw.
+            return "unproven";
+        }
+        // No baseline and nothing that identifies this delivery on its own. "The
+        // paste was lost" is a guess, not a finding, and acting on it re-pastes a
+        // message that may well have been submitted — so say the evidence is
+        // missing instead of inventing a verdict.
+        this.logger.warn("Could not read the pane before pasting — this delivery cannot be verified either way");
+        return "unverifiable";
+    }
+    /**
+     * What the pane currently shows of a given message. Taken once before the
+     * paste and once after, so confirmSubmitted can require a NEW marker or a NEW
+     * echo rather than accepting whatever was already there.
+     */
+    async capturePaneEvidence(signature) {
+        if (!this.tmux)
+            return null;
+        // Bounded re-probe: a capture that fails here costs the delivery its only
+        // "before" picture, and a momentary failure should not decide anything.
+        for (let attempt = 1; attempt <= BASELINE_CAPTURE_ATTEMPTS; attempt++) {
+            try {
+                const pane = await this.tmux.capturePane();
+                const evidence = this.paneEvidence(pane, signature);
+                const prompt = this.backend?.getBottomReadyPattern?.();
+                if (prompt && strandedAgendMessageInInput(pane, prompt)) {
+                    // Whatever we paste now lands after it, and one Enter submits both as
+                    // a single message. Nothing here can undo that; saying so beats
+                    // letting two messages silently merge.
+                    this.logger.warn("An unsubmitted message is already in the input row — this delivery will be appended to it");
+                }
+                return evidence;
             }
-            const compact = formatted.replace(/\s+/g, " ").trim();
-            if (compact.length >= 8 && pane.includes(compact.slice(0, Math.min(80, compact.length)))) {
-                return true;
+            catch {
+                if (attempt < BASELINE_CAPTURE_ATTEMPTS)
+                    await new Promise(r => setTimeout(r, BASELINE_CAPTURE_RETRY_MS));
             }
+        }
+        // Still unreadable: confirmSubmitted falls back to evidence that stands on
+        // its own (a unique message_id) and refuses to guess without it.
+        this.logger.warn("Could not read the pane before pasting — no baseline for this delivery");
+        return null;
+    }
+    paneEvidence(pane, signature) {
+        const marker = this.backend?.getQueuedInputMarker?.();
+        const prompt = this.backend?.getBottomReadyPattern?.();
+        const input = prompt ? inputAreaText(pane, prompt) : null;
+        return {
+            queued: marker ? pane.split(/\r?\n/).filter(row => marker.test(row)).length : 0,
+            payload: countOccurrences(pane.replace(/\s+/g, ""), signature.value),
+            strandedInput: input != null && inputShowsPastedText(input, signature.value),
+        };
+    }
+    /**
+     * What identifies THIS message on screen. The routing envelope carries a
+     * message_id that no earlier transcript entry can share, so prefer it: the
+     * body alone is not distinctive enough — short repeated instructions ("carry
+     * on", a status ping) recur verbatim, and an older copy would vouch for a
+     * paste that never landed. System pastes carry no envelope and fall back to
+     * the body signature, which the baseline comparison still ties to this paste.
+     */
+    submissionSignature(formatted, trustedId) {
+        // The id must come from the message's own metadata, never from scanning the
+        // rendered text: agents and users discuss message ids in the body all the
+        // time ("check message_id: abc"), and a body-scanned value would match an
+        // older transcript entry quoting the same thing — then be trusted as unique
+        // and confirm a paste that never landed. Only the value AgEnD itself put in
+        // the handoff metadata identifies THIS delivery.
+        const id = trustedId?.trim();
+        if (id)
+            return { value: `message_id:${id}`, unique: true };
+        return { value: pastedTextSignature(formatted), unique: false };
+    }
+    /**
+     * Paste + submit + confirm for the SYSTEM messages that used to go out via
+     * tmux.pasteText: one Enter (two for queue-less backends) and no verification
+     * at all, so a swallowed Enter left the notice sitting in the input row where
+     * the next delivery submitted both as one message. Shares confirmSubmitted
+     * with the delivery path — having one primitive is the point.
+     *
+     * Best effort by design: these notices must never fail a delivery or throw.
+     * The caller already holds paneWriteLock.
+     */
+    async submitSystemPaste(text, label) {
+        if (!this.tmux)
+            return false;
+        const signature = this.submissionSignature(text);
+        const baseline = await this.capturePaneEvidence(signature);
+        if (!(await this.tmux.pasteBuffer(text))) {
+            this.logger.warn({ label }, "System paste failed to reach the pane");
             return false;
         }
-        catch {
+        await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
+        if (!(await this.sendDeliveryEnter(label)))
+            return false;
+        let proof = await this.confirmSubmitted(signature, baseline);
+        if (proof === "unverifiable") {
+            // No input row to read: this backend gets exactly what the old pasteText
+            // path gave it, including the unconditional second Enter for queue-less
+            // TUIs that swallow the first. Narrowing that to one Enter on the grounds
+            // that "the text is visible" would be the very inference this change
+            // exists to remove — visible text is also what a strand looks like.
+            if (this.systemPasteOptions().retryEnter) {
+                await new Promise(r => setTimeout(r, 1_000));
+                await this.sendDeliveryEnter(`${label}-defensive-retry`);
+            }
+            return true; // best effort, exactly as before — nothing here is verified
+        }
+        if (proof !== "submitted") {
+            // A bare Enter is a no-op at an empty prompt, so this is safe even if the
+            // first one did land; when the text is still in the input row it is the
+            // submit it never got. Re-pasting would append the text to itself.
+            await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
+            if (!(await this.sendDeliveryEnter(`${label}-retry`)))
+                return false;
+            proof = await this.confirmSubmitted(signature, baseline);
+        }
+        if (proof !== "submitted") {
+            this.logger.warn({ label, proof }, "System paste may not have been submitted");
             return false;
         }
+        return true;
     }
     /** Re-resolve this instance's tmux window by name (stale id after crash/respawn). */
     async recoverWindow() {
@@ -4598,14 +5208,21 @@ export class Daemon extends EventEmitter {
         if (this.socketSessionNames.get(socket) === this.name) {
             this.noteMcpProofOfLife("tool_call", this.socketPids.get(socket));
         }
+        // A tool invocation is not delivery evidence. Capture which obligation it
+        // belongs to now, then settle it only after the adapter/fleet responds.
+        // Explicitly mapped sibling sessions must not satisfy this instance's turn;
+        // an unmapped socket is retained for legacy/tests where mcp_ready was not
+        // observed before the first tool call.
+        const sourceSession = this.socketSessionNames.get(socket);
+        const replyAttempt = TURN_REPLY_TOOLS.has(tool) && (!sourceSession || sourceSession === this.name)
+            ? this.turnReplyGuard.beginToolAttempt(tool === "reply")
+            : null;
         // For now, log and respond. Full adapter routing will be wired in fleet manager.
         const respond = (result, error) => {
             // A message that verifiably went out stands down the dead-MCP proxy reply
             // for this turn: the agent proved it can still speak for itself.
             if (!error && result != null && TURN_REPLY_TOOLS.has(tool)) {
-                this.turnOutboundDelivered = true;
-                if (tool === "reply")
-                    this.turnReplyDelivered = true;
+                this.turnReplyGuard.settleToolAttempt(replyAttempt, true);
             }
             const sent = this.ipcServer?.send(socket, { requestId, result, error }) ?? false;
             if (!sent) {
@@ -4796,7 +5413,15 @@ export class Daemon extends EventEmitter {
             });
             return;
         }
-        const adapter = adapters[0];
+        // Same rule as deliverDaemonReply: one adapter is unambiguous, several with
+        // no bound world is a routing failure rather than a first-wins guess.
+        const adapter = this.lastAdapterId
+            ? this.messageBus.getAdapter(this.lastAdapterId) ?? (adapters.length === 1 ? adapters[0] : undefined)
+            : (adapters.length === 1 ? adapters[0] : undefined);
+        if (!adapter) {
+            respond(null, "No channel world bound to this chat context — awaiting an inbound message to establish it");
+            return;
+        }
         if (!routeToolCall(adapter, tool, args, this.lastThreadId, respond)) {
             respond(null, `Unknown tool: ${tool}`);
         }
@@ -4987,7 +5612,16 @@ export class Daemon extends EventEmitter {
         try {
             // Messages can arrive during a restart and be queued on pasteLock before the
             // snapshot lands; both write to the pane, so both go through the same lock.
-            await this.paneWriteLock.run(() => this.tmux.pasteText(`[system:session-snapshot]\n${snapshot}\n\nThis is a background context restore — do NOT reply to or acknowledge this message. Simply resume normal operation when the next user or instance message arrives.`, this.systemPasteOptions()));
+            const restoreNotice = `[system:session-snapshot]\n${snapshot}\n\nThis is a background context restore — do NOT reply to or acknowledge this message. Simply resume normal operation when the next user or instance message arrives.`;
+            const injected = await this.paneWriteLock.run(() => this.submitSystemPaste(restoreNotice, "session-snapshot-restore"));
+            if (!injected) {
+                // rotation-state.json was deleted when the prompt was built, so there is
+                // nothing left to retry from: the restore is gone either way. Say so —
+                // reporting it as injected is how a lost context restore stays invisible.
+                this.logger.error("Session snapshot could not be submitted — session continues without context");
+                this.emit("snapshot_failed", this.name);
+                return;
+            }
             this.logger.info("Injected session snapshot as first message");
             this.emit("snapshot_injected", this.name);
         }
@@ -5003,6 +5637,17 @@ export class Daemon extends EventEmitter {
      * into exactly the window this exists to close.
      */
     beginSpawn() {
+        // A restarted CLI has no trustworthy turn edge for the process it replaced.
+        // v1 deliberately does not persist obligations across restarts: missing one
+        // warning is safer than treating the replacement's startup idle as the old
+        // turn ending and injecting a stale recovery prompt.
+        this.turnReplyGuard.reset();
+        if (this.spawnDepth === 0) {
+            this.spawnGeneration++;
+            this.inputTransientGuardGeneration = (this.backend?.getInputUnavailableTransients?.().length ?? 0) > 0
+                ? this.spawnGeneration
+                : null;
+        }
         this.spawnDepth++;
         this.spawning = true;
         if (!this.spawnSettled) {
@@ -5057,6 +5702,69 @@ export class Daemon extends EventEmitter {
         }
     }
     /** Spawn a CLI window. Returns true if --resume was used successfully. */
+    /**
+     * Positive proof from the CLI that there is no conversation left to resume.
+     *
+     * Only this may justify abandoning a session. A startup that merely ran out of
+     * budget proves nothing: a healthy cold start on a loaded host looks exactly
+     * the same, which is how 9 instances silently lost their history.
+     *
+     * Deliberately does NOT match a bare "--continue": the pane text can mention
+     * the flag (a usage error, an echoed invocation) without the CLI ever saying
+     * the conversation is gone.
+     */
+    paneSaysNoConversation(paneText) {
+        if (!paneText)
+            return false;
+        return /no conversation found|no conversation to (continue|resume)|no previous (session|conversation)/i
+            .test(paneText);
+    }
+    /** How many consecutive startups have failed without proving the session is gone. */
+    unprovenResumeFailures = 0;
+    /** After this many, start fresh anyway — loudly — so a truly broken session still recovers. */
+    static MAX_UNPROVEN_RESUME_FAILURES = 3;
+    /**
+     * Set the session aside instead of deleting it.
+     *
+     * The whole defect being fixed here is silent, irreversible loss of a user's
+     * conversation. Renaming costs nothing and turns a wrong call into something
+     * recoverable: the id is still on disk under a dated name.
+     */
+    setSessionAside(reason) {
+        const sidFile = join(this.instanceDir, "session-id");
+        try {
+            if (!existsSync(sidFile))
+                return;
+            const stamp = new Date().toISOString().replace(/[:.]/g, "-");
+            renameSync(sidFile, join(this.instanceDir, `session-id.abandoned-${stamp}`));
+            this.logger.warn({ reason }, "Session set aside (kept on disk as session-id.abandoned-*), starting fresh");
+            this.pruneAbandonedSessions();
+        }
+        catch (err) {
+            // Never let bookkeeping block a spawn; falling back to the old behaviour
+            // is still better than not starting.
+            this.logger.warn({ err: err.message }, "Could not set session aside");
+            try {
+                unlinkSync(sidFile);
+            }
+            catch { /* may not exist */ }
+        }
+    }
+    /** Keep the newest few set-aside sessions; they are insurance, not an archive. */
+    pruneAbandonedSessions(keep = 5) {
+        try {
+            const files = readdirSync(this.instanceDir)
+                .filter((f) => f.startsWith("session-id.abandoned-"))
+                .sort();
+            for (const f of files.slice(0, Math.max(0, files.length - keep))) {
+                try {
+                    unlinkSync(join(this.instanceDir, f));
+                }
+                catch { /* best effort */ }
+            }
+        }
+        catch { /* best effort */ }
+    }
     async spawnClaudeWindow() {
         this.beginSpawn();
         let resumedSuccessfully = false;
@@ -5080,7 +5788,7 @@ export class Daemon extends EventEmitter {
                 //     first miss is usually slowness, not a broken session.
                 await this.noteStartupPaneForBackendOutage();
                 await this.failStartupIfBackendUnreachable();
-                if (this.backend.retriesResumeOnStartupFailure?.() === true) {
+                if (this.backend.retriesResumeOnStartupFailure?.() !== false) {
                     this.logger.warn("Resume startup failed — retrying resume once before abandoning the session");
                     await this.killProcessTree();
                     await this.tmux.killWindow();
@@ -5092,16 +5800,39 @@ export class Daemon extends EventEmitter {
                 }
             }
             if (!alive) {
-                // Resume (or a fresh start) failed for a reason we do not recognise as an
-                // outage (stale --resume, crash, rate limit, etc.).
-                // Clean slate: clear session-id, skip resume, and retry once.
-                this.logger.warn("CLI startup failed — clearing session-id and retrying without resume");
-                const sidFile = join(this.instanceDir, "session-id");
-                try {
-                    unlinkSync(sidFile);
+                // The session may only be abandoned on positive proof that there is
+                // nothing to resume. Running out of budget is not proof: on a loaded host
+                // a healthy cold start misses the same deadline as a broken session, and
+                // treating the two alike is what silently discarded users' conversations.
+                if (attemptedResume) {
+                    let paneText;
+                    try {
+                        paneText = await this.tmux?.capturePaneWithHistory(50);
+                    }
+                    catch { /* pane may be gone */ }
+                    const proven = this.paneSaysNoConversation(paneText);
+                    if (!proven) {
+                        this.unprovenResumeFailures++;
+                        if (this.unprovenResumeFailures < Daemon.MAX_UNPROVEN_RESUME_FAILURES) {
+                            // Keep the session and fail this attempt; the fleet retries with
+                            // backoff, which is also how the backend-outage path behaves.
+                            await this.killProcessTree();
+                            await this.tmux.killWindow();
+                            throw new Error(`CLI startup failed with a session to resume (attempt ${this.unprovenResumeFailures}/${Daemon.MAX_UNPROVEN_RESUME_FAILURES}) `
+                                + "— session kept, will retry");
+                        }
+                        // Escape hatch: a genuinely broken session must still recover. Say so
+                        // out loud — this start does NOT continue the previous conversation.
+                        this.logger.error({ attempts: this.unprovenResumeFailures }, "Giving up on resuming after repeated startup failures — starting fresh. "
+                            + "The previous conversation is NOT continued; its context is lost to this session.");
+                        this.emit("context_lost", this.name, "resume_repeatedly_failed");
+                    }
+                    this.setSessionAside(proven ? "cli_reported_no_conversation" : "resume_failed_repeatedly");
+                    this.skipResume = true;
                 }
-                catch { /* may not exist */ }
-                this.skipResume = true;
+                // A fresh start that also failed retries once, as before. It never clears
+                // a session: nothing about a failed fresh launch says the stored
+                // conversation is unusable.
                 await this.killProcessTree();
                 await this.tmux.killWindow();
                 const retryAlive = await this.trySpawn(false, this.startupBudgetFor(false));
@@ -5270,6 +6001,79 @@ export class Daemon extends EventEmitter {
             reason: reuseWindow ? "wake" : this.lastSpawnAt > 0 ? "recovery" : "startup",
         }, () => this.trySpawnInsideGate(reuseWindow, startupTimeoutMs));
     }
+    /**
+     * Tell the agent its instructions moved, once the CLI is idle.
+     *
+     * A named method rather than an inline closure so the wiring itself is
+     * testable: warmupNoticeAction's own tests pass even if this call site stops
+     * consulting it, which is exactly the bug this path had — the decision was
+     * made inline and never asked whether the backend needed telling at all.
+     *
+     * Never throws: a missed reload notice must not fail a spawn.
+     */
+    async runWarmupInstructionNotice() {
+        try {
+            const action = warmupNoticeAction({
+                warmupNeeded: this.warmupNeeded,
+                backend: this.backend ?? undefined,
+                pasteQueueDepth: this.pasteQueueDepth,
+            });
+            if (action === "skip") {
+                this.logger.debug(this.warmupNeeded
+                    ? "Warmup skipped — this backend reloads instructions on resume"
+                    : "Warmup skipped — instructions unchanged");
+                // When the backend learns of the change on its own, record what it now
+                // holds: leaving prev-instructions behind would keep every later
+                // restart comparing against a value the agent has long since replaced.
+                if (this.warmupNeeded) {
+                    try {
+                        writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
+                    }
+                    catch { /* best effort */ }
+                }
+                return;
+            }
+            if (action === "defer") {
+                this.logger.debug("Warmup deferred — no pending inbound messages");
+                // Convert to pendingInstructionsNotice so it fires on next real message.
+                this.pendingInstructionsNotice = true;
+                try {
+                    writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
+                }
+                catch { }
+                return;
+            }
+            const wid = existsSync(join(this.instanceDir, "window-id"))
+                ? readFileSync(join(this.instanceDir, "window-id"), "utf-8").trim() : "";
+            if (wid && this.controlClient) {
+                await this.controlClient.waitForIdle(wid, 120_000);
+            }
+            else {
+                await new Promise(r => setTimeout(r, 5000));
+            }
+            // This path only runs when pasteQueueDepth > 0 — i.e. exactly when a real
+            // delivery is already in flight or queued. Without the lock the notice and
+            // that delivery race into the same pane.
+            const told = await this.paneWriteLock.run(() => this.submitSystemPaste(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir), "instruction-reload-notice"));
+            if (!told) {
+                // Recording the new instructions here would mark the agent as told about
+                // a notice it never received, and every later restart would then skip
+                // the reload. Leave the snapshot behind and hand it to the deferred
+                // notice, which fires on the next real message.
+                this.logger.warn("Instruction reload notice not confirmed — deferring it to the next message");
+                this.pendingInstructionsNotice = true;
+                return;
+            }
+            // Record the value the agent has now been told about so the next
+            // unchanged restart skips the reload.
+            try {
+                writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
+            }
+            catch { /* best effort */ }
+            this.logger.debug("Warmup sent after idle");
+        }
+        catch { /* non-fatal */ }
+    }
     async trySpawnInsideGate(reuseWindow = false, startupTimeoutMs) {
         const backendConfig = this.buildBackendConfig();
         // Compare freshly-built instructions against the last value the agent was
@@ -5298,7 +6102,7 @@ export class Daemon extends EventEmitter {
             // For backends that don't re-read instructions on resume (kiro/codex/
             // gemini), also notify the agent on next message instead of forcing a new
             // session. Resume is preserved so context isn't lost.
-            if (!backendConfig.skipResume && !this.backend.instructionsReloadedOnResume && this.warmupNeeded) {
+            if (!backendConfig.skipResume && backendNeedsPaneReloadNotice(this.backend) && this.warmupNeeded) {
                 if (prev) {
                     this.logger.info("Instructions changed — will notify agent on next message");
                     this.pendingInstructionsNotice = true;
@@ -5443,6 +6247,7 @@ export class Daemon extends EventEmitter {
             await new Promise(r => setTimeout(r, Math.min(pollMs, Math.max(remaining(), 0)))); };
         let cleanReadyPolls = 0;
         let lastDialog = null;
+        let lastTransient = null;
         let captureFailures = 0;
         let attempts = 0;
         do {
@@ -5464,6 +6269,18 @@ export class Daemon extends EventEmitter {
                 continue;
             }
             try {
+                // Some TUIs expose a real-looking input row before they accept Enter.
+                // This phase clears by itself: never send a key, and let its structural
+                // current-screen matcher outrank the otherwise-valid ready pattern.
+                const transient = this.inputTransientInPane(pane);
+                if (transient) {
+                    cleanReadyPolls = 0;
+                    lastDialog = null;
+                    lastTransient = transient;
+                    await sleep();
+                    continue;
+                }
+                lastTransient = null;
                 // Try each startup dialog pattern before checking ready state
                 let matched = false;
                 lastDialog = null;
@@ -5591,7 +6408,10 @@ export class Daemon extends EventEmitter {
             await sleep();
         } while (remaining() > 0);
         // Budget exhausted. Never silently: say which way it went.
-        if (lastDialog) {
+        if (lastTransient) {
+            this.logger.warn({ description: lastTransient.description, attempts, budgetMs }, "Startup scan exhausted while CLI input was still unavailable — retaining the delivery guard");
+        }
+        else if (lastDialog) {
             this.logger.warn({ description: lastDialog.description, attempts, budgetMs }, "Startup scan exhausted with a dialog still on screen — reporting the CLI alive; deliveries stay blocked until it is answered");
         }
         else {
@@ -5607,12 +6427,21 @@ export class Daemon extends EventEmitter {
     updateLastChat(chatId, threadId, adapterId) {
         if (!chatId)
             return;
+        const chatChanged = this.lastChatId !== chatId;
         this.lastChatId = chatId;
         // An unthreaded inbound must clear a previous topic rather than leaking it
         // into the next reply target.
         this.lastThreadId = threadId || undefined;
         if (adapterId)
             this.lastAdapterId = adapterId;
+        else if (chatChanged) {
+            // A NEW chat with no adapter named alongside it: the old adapter belonged
+            // to the old chat, and keeping it asserts a pairing nobody supplied. That
+            // is how one platform's chat id ends up being sent through another
+            // platform's bot. Unknown is recoverable (a single-adapter fleet is
+            // unambiguous anyway); a confidently wrong world is not.
+            this.lastAdapterId = undefined;
+        }
         try {
             writeFileSync(join(this.instanceDir, "last-chat.json"), JSON.stringify({ chatId: this.lastChatId, threadId: this.lastThreadId, adapterId: this.lastAdapterId }));
         }