@songsid/agend 2.1.6-beta.11 → 2.1.6-beta.13

package/dist/daemon.js

@@ -30,6 +30,8 @@ import { bottomRowIsReady, inputAreaText, inputShowsPastedText, pastedTextSignat
 import { TurnReplyGuard } from "./turn-reply-guard.js";
 import { t } from "./locale.js";
 import { MuseUsageRelay, clearMuseUsageSnapshot } from "./muse-usage-relay.js";
+import { CodexResumeConflictError, CodexResumeIdentityError, CodexResumeUnavailableError } from "./backend/codex-session.js";
+import { codexResumeLockVisible } from "./backend/codex.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -399,6 +401,8 @@ export class PendingWorkTracker {
 const NORMAL_ENTER_SETTLE_MS = 500;
 /** How long to keep looking for proof after a retry Enter before failing it. */
 const POST_ENTER_PROOF_WINDOW_MS = 3_000;
+/** A final bounded observation before an ambiguous Codex submit can be classified. */
+const CODEX_LATE_PROOF_MS = 5_000;
 const POST_ENTER_PROOF_POLL_MS = 250;
 /** Attempts to read the pre-paste pane before a delivery gives up on a baseline. */
 const BASELINE_CAPTURE_ATTEMPTS = 3;
@@ -423,6 +427,16 @@ const STARTUP_DIALOG_BUDGET_MS = 30_000;
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
 /** How many "dialog painted just before the write → wait → retry" rounds a delivery tolerates. */
 const LATE_DIALOG_WRITE_ROUNDS = 3;
+/** How many times a delivery redoes itself when a spawn starts between its settle wait and its pane write. */
+const DELIVERY_SPAWN_RACE_MAX_ROUNDS = 3;
+/**
+ * After relay exhaustion, how long to wait for an authoritatively idle pane
+ * before giving up the immediate resume-direct (the fallback flag and the
+ * notification already cover the next natural restart). Muse turns can run
+ * for many minutes; polling keeps each check a fresh capture.
+ */
+const MUSE_DIRECT_RESUME_IDLE_BUDGET_MS = 10 * 60_000;
+const MUSE_DIRECT_RESUME_IDLE_POLL_MS = 5_000;
 /**
  * Startup failed because the CLI's backend is unreachable (see backend-outage.ts).
  * The session-id is deliberately KEPT; the fleet schedules a delayed retry.
@@ -568,7 +582,7 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
     }
 }
 /** Redact likely credentials and control sequences before pane text reaches logs. */
-export function sanitizePaneTail(pane, lineCount = 5) {
+export function sanitizePaneTail(pane, lineCount = 5, excludeLine) {
     const secretAssignment = /\b(token|secret|password|passwd|api[_-]?key|authorization)\b\s*[:=]\s*\S+/gi;
     const bearer = /\bBearer\s+\S+/gi;
     const knownToken = /\b(?:sk-[A-Za-z0-9_-]+|ghp_[A-Za-z0-9]+|github_pat_[A-Za-z0-9_]+|AKIA[A-Z0-9]{16})\b/g;
@@ -581,6 +595,10 @@ export function sanitizePaneTail(pane, lineCount = 5) {
         lines.pop();
     return lines
         .slice(-lineCount)
+        // The proxy-reply chrome predicate sees only control-normalized lines,
+        // but must run BEFORE redaction. Redaction can replace a status-footer
+        // session UUID with [REDACTED], destroying its structural signature.
+        .filter(line => !excludeLine?.(line))
         .map(line => line
         .replace(bearer, "Bearer [REDACTED]")
         .replace(secretAssignment, "$1=[REDACTED]")
@@ -597,12 +615,14 @@ export function sanitizePaneTail(pane, lineCount = 5) {
  * final answer exists only on screen. Everything up to and including the last
  * line of the inbound message we pasted is cut (the reply starts after it),
  * lines with no letters or digits are dropped (borders, separators, spinners,
- * bare prompts), and the ready-prompt line is dropped by pattern. Returns null
- * when what remains is trivial — a proxy message must carry an answer, not
- * chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
+ * bare prompts), and UI chrome is dropped by a backend-specific per-line
+ * filter when available (or a legacy single-line ready pattern). Whole-pane
+ * readiness regexes cannot identify individual prompt/footer lines. Returns
+ * null when what remains is trivial — a proxy message must carry an answer,
+ * not chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
  */
 export function extractProxyReplyText(pane, opts = {}) {
-    const lines = sanitizePaneTail(pane, opts.maxLines ?? 40);
+    const lines = sanitizePaneTail(pane, opts.maxLines ?? 40, opts.isChromeLine);
     const marker = opts.inboundMarker?.trim();
     // Require a distinctive marker: a short one ("ok") would match agent text.
     if (marker && marker.length >= 8) {
@@ -930,6 +950,8 @@ export class Daemon extends EventEmitter {
     instanceStateBusyPattern = null;
     instanceStateMonitorActive = false;
     sessionCheckpointWarningEmitted = false;
+    codexSessionIdentityHoldNotified = false;
+    recoveredLegacyCodexSessionId = null;
     statePollInFlight = false;
     // One generation-scoped source of truth for human-turn reply completion.
     // It also supplies the older dead-MCP/malformed-call recovery paths, so those
@@ -1185,6 +1207,11 @@ export class Daemon extends EventEmitter {
         this.autoPauseController = new AutoPauseController(Math.max(0, autoPauseMinutes) * 60_000, readLastInboundAt(instanceDir) ?? Date.now());
     }
     async start() {
+        // Do this before touching daemon.pid or a pre-existing window. An unknown
+        // rollout format with an owned marker must not become a fresh session.
+        if (this.backend?.hasInvalidSessionIdentity?.(this.config.working_directory)) {
+            throw new CodexResumeIdentityError();
+        }
         mkdirSync(this.instanceDir, { recursive: true });
         writeFileSync(join(this.instanceDir, "daemon.pid"), String(process.pid));
         this.logger.info(`Starting ${this.name}`);
@@ -1194,8 +1221,16 @@ export class Daemon extends EventEmitter {
             if (existsSync(crashStatePath)) {
                 const state = JSON.parse(readFileSync(crashStatePath, "utf-8"));
                 if (state.resumeDisabled) {
-                    this.skipResume = true;
-                    this.logger.warn("Previous crash loop detected — starting without resume");
+                    if (this.backend?.binaryName === "codex" && this.backend.canResume?.(this.config.working_directory)) {
+                        // A crash-loop heuristic cannot silently discard an explicitly
+                        // owned Codex conversation. Try once, then hold with a visible
+                        // reason rather than cycling or choosing a new session.
+                        this.logger.warn("Previous crash loop detected — preserving explicit Codex resume");
+                    }
+                    else {
+                        this.skipResume = true;
+                        this.logger.warn("Previous crash loop detected — starting without resume");
+                    }
                 }
                 unlinkSync(crashStatePath);
             }
@@ -1323,7 +1358,12 @@ export class Daemon extends EventEmitter {
             if (savedId) {
                 const oldTmux = new TmuxManager(this.tmuxSessionName, savedId);
                 if (await oldTmux.isWindowAlive()) {
-                    this.saveSessionId();
+                    this.backend?.setActivePanePid?.(await TmuxManager.getPanePid(this.tmuxSessionName, savedId));
+                    const recoveredPane = this.backend?.binaryName === "codex"
+                        ? await oldTmux.capturePane().catch(() => undefined) : undefined;
+                    const recoveredId = this.checkpointLivePaneBeforeReplacement(recoveredPane);
+                    if (this.backend?.binaryName === "codex")
+                        this.recoveredLegacyCodexSessionId = recoveredId;
                     await oldTmux.killWindow();
                     this.logger.info({ savedId }, "Killed old tmux window for fresh start");
                 }
@@ -1403,7 +1443,10 @@ export class Daemon extends EventEmitter {
             this.guardian = new ContextGuardian(this.config.context_guardian, this.logger, statusFile);
             this.guardian.startWatching();
             this.guardian.on("status_update", () => {
-                this.saveSessionId();
+                // Codex's /new can leave multiple writer locks in one PID. A status
+                // callback has no pane footer, so it cannot attest the current chat.
+                if (this.backend?.binaryName !== "codex")
+                    this.saveSessionId();
             });
             // Context rotation removed: all CLI backends have built-in auto-compact.
             // Crash recovery (health check + respawn with snapshot) is retained below.
@@ -1947,7 +1990,8 @@ export class Daemon extends EventEmitter {
                         await this.tmux.killWindow();
                     }
                     // Detect claude-code background session conflict — recover without counting as crash
-                    if (lastOutput && (lastOutput.includes("background agent") || lastOutput.includes("Session is currently running"))) {
+                    if (this.backend?.binaryName !== "codex" && lastOutput
+                        && (lastOutput.includes("background agent") || lastOutput.includes("Session is currently running"))) {
                         if (!this.backgroundSessionRecoveryAttempted) {
                             this.backgroundSessionRecoveryAttempted = true;
                             this.logger.warn("Detected lingering background agent session — starting fresh (no resume)");
@@ -1988,6 +2032,14 @@ export class Daemon extends EventEmitter {
                     // and skip resume so the next spawn starts fresh. (skipResume also stops
                     // saveSessionId below from resurrecting the id from statusline.json.)
                     if (this.paneSaysNoConversation(lastOutput)) {
+                        if (this.backend?.binaryName === "codex" && this.backend.hasSessionIdentity?.()) {
+                            // Codex may have changed its rollout format or emitted an error
+                            // that only resembles this generic pattern. A persisted UUID is
+                            // never discarded by a text heuristic; preserve and hold.
+                            this.healthCheckPaused = true;
+                            this.emitSupervisionEnded("Codex could not resume its owned session", "Inspect the preserved session ID/rollout and restart this instance manually.");
+                            return;
+                        }
                         this.setSessionAside("cli_reported_no_conversation");
                         this.skipResume = true;
                     }
@@ -2045,7 +2097,10 @@ export class Daemon extends EventEmitter {
                     this.logger.warn({ crashCount: this.crashCount, delay }, `${cliLabel} window died — respawning after backoff`);
                     await new Promise(r => setTimeout(r, delay));
                     try {
-                        this.saveSessionId();
+                        // The dead Codex pane cannot supply current-session evidence.
+                        // Its last verified checkpoint stays as-is (or held if ambiguous).
+                        if (this.backend?.binaryName !== "codex")
+                            this.saveSessionId();
                         this.transcriptMonitor?.resetOffset();
                         // Kill orphan MCP server from the crashed CLI session.
                         // MCP server writes its PID to channel.mcp.pid on startup.
@@ -2093,7 +2148,16 @@ export class Daemon extends EventEmitter {
                             this.stormWindow?.markRecovered(this.name);
                     }
                     catch (err) {
-                        if (!this.handOffBackendUnreachableRespawn(err)) {
+                        if (err instanceof CodexResumeConflictError || err instanceof CodexResumeUnavailableError) {
+                            // A live owner is not a broken conversation. Stop automatic
+                            // respawns and preserve the explicit session for a human retry.
+                            this.healthCheckPaused = true;
+                            this.logger.warn({ ownerPid: err instanceof CodexResumeConflictError ? err.ownerPid : null }, "Codex resume cannot continue — supervision stopped");
+                            this.emitSupervisionEnded(err.message, err instanceof CodexResumeConflictError
+                                ? "Close the other Codex owner, then restart this instance."
+                                : "Inspect the Codex pane and restart this instance after resolving the startup failure.");
+                        }
+                        else if (!this.handOffBackendUnreachableRespawn(err)) {
                             this.logger.error({ err }, `Failed to respawn ${cliLabel} window`);
                         }
                     }
@@ -2642,7 +2706,9 @@ export class Daemon extends EventEmitter {
         // Quit CLI FIRST — this kills MCP server child processes cleanly.
         // IPC must stay open during quit so MCP servers receive the shutdown message.
         if (this.tmux) {
-            this.saveSessionId();
+            const codexPane = this.backend?.binaryName === "codex"
+                ? await this.tmux.capturePane().catch(() => undefined) : undefined;
+            this.saveSessionId(codexPane);
             this.healthCheckPaused = true;
             let killed = false;
             const quitSent = await this.sendQuitSequence();
@@ -2785,7 +2851,9 @@ export class Daemon extends EventEmitter {
         this.freezeRuntimeMonitors();
         const transition = (async () => {
             try {
-                this.saveSessionId();
+                const codexPane = this.backend?.binaryName === "codex"
+                    ? await this.tmux?.capturePane().catch(() => undefined) : undefined;
+                this.saveSessionId(codexPane);
                 await this.sendQuitSequence();
                 let exited = false;
                 for (let i = 0; i < 15; i++) {
@@ -2924,13 +2992,13 @@ export class Daemon extends EventEmitter {
             return;
         }
         this.instanceState = snapshot.state;
-        // OpenCode creates its session lazily on the first submitted message.
+        // OpenCode and Codex create their session lazily on the first submitted message.
         // Waiting until stop/pause to persist that id loses resume state when the
         // fleet is SIGKILLed or the host reboots.
         // Idle observations are safe checkpoints; the 60s safety sweep also gives
         // us a bounded retry if session creation produced no visible state edge.
-        if (snapshot.state === "idle" && this.backend?.binaryName === "opencode") {
-            this.saveSessionId();
+        if (snapshot.state === "idle" && (this.backend?.binaryName === "opencode" || this.backend?.binaryName === "codex")) {
+            this.saveSessionId(pane);
         }
         // Only a transition back to idle completes pending work. Repeated idle
         // observations between enqueue and paste must not clear a newer inbound.
@@ -3214,7 +3282,11 @@ export class Daemon extends EventEmitter {
                 pane = await this.tmux?.capturePane();
             if (!pane)
                 return;
-            const text = extractProxyReplyText(pane, { inboundMarker: target.inboundMarker, readyPattern: this.instanceStateReadyPattern });
+            const text = extractProxyReplyText(pane, {
+                inboundMarker: target.inboundMarker,
+                readyPattern: this.instanceStateReadyPattern,
+                isChromeLine: line => this.backend?.isProxyReplyChromeLine?.(line) ?? false,
+            });
             if (!text) {
                 this.logger.debug("Dead-MCP proxy reply skipped — pane tail is trivial");
                 return;
@@ -3952,14 +4024,16 @@ export class Daemon extends EventEmitter {
      * steer's verdict decide whether a queued message's sender is told its
      * delivery failed — a false ❌ carrying the wrong correlation id.
      */
-    failDelivery(verdict, status) {
+    failDelivery(verdict, status, phase = "unknown", proof = "undelivered") {
         verdict.reached = true;
+        verdict.phase = phase;
+        verdict.proof = proof;
         if (status)
             this.emit("message_failed", status); // ❌
         return false;
     }
     /** Tell the fleet when an already-accepted cross-instance pane write failed. */
-    reportCrossInstanceDeliveryFailure(meta, error) {
+    reportCrossInstanceDeliveryFailure(meta, verdict, error) {
         if (!meta.from_instance)
             return;
         this.ipcServer?.broadcast({
@@ -3967,7 +4041,10 @@ export class Daemon extends EventEmitter {
             senderSession: meta.from_instance,
             targetInstance: this.name,
             correlationId: meta.correlation_id ?? "unknown",
-            error: error ?? this.tmux?.getLastPasteError?.() ?? "target pane rejected the delivery",
+            // Never use getLastPasteError as a generic fallback: it may describe an
+            // earlier paste, and #910 was a post-submit proof failure, not a paste
+            // rejection. Keep the sender diagnostic phase-specific and non-secret.
+            error: `delivery failed: phase=${verdict?.phase ?? (error ? "exception" : "unknown")}; proof=${verdict?.proof ?? (error ? "threw" : "none")}`,
         });
     }
     /**
@@ -4021,12 +4098,12 @@ export class Daemon extends EventEmitter {
                 // Same rule as the queued path: a steer that never got to try is not a
                 // delivery failure. This holder is the steer's own, which is the point
                 // — it runs on steerLock while a queued delivery runs on pasteLock.
-                this.reportCrossInstanceDeliveryFailure(meta);
+                this.reportCrossInstanceDeliveryFailure(meta, verdict);
             }
         }).catch(err => {
             this.logger.warn({ err: err.message }, "steer delivery error");
             if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
-                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+                this.reportCrossInstanceDeliveryFailure(meta, undefined, err.message);
             }
         });
     }
@@ -4160,7 +4237,7 @@ export class Daemon extends EventEmitter {
                     // not ready yet, a cancel, a storm hold or a shutdown all return
                     // false without one, and telling the sender its message was lost
                     // there would be the false ❌ of #826 in its other form.
-                    this.reportCrossInstanceDeliveryFailure(meta);
+                    this.reportCrossInstanceDeliveryFailure(meta, verdict);
                 }
             }
             finally {
@@ -4169,7 +4246,7 @@ export class Daemon extends EventEmitter {
         }).catch(err => {
             this.logger.warn({ err: err.message }, "pasteLock delivery error — chain continues");
             if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
-                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+                this.reportCrossInstanceDeliveryFailure(meta, undefined, err.message);
             }
         });
         this.logger.debug({ user: meta.user, text: content.slice(0, 100) }, "Queued channel message for delivery");
@@ -4214,7 +4291,14 @@ export class Daemon extends EventEmitter {
                 return false;
         }
         // Before anything reads the window id: a spawn in progress is about to change it.
-        await this.waitForSpawnToSettle();
+        // A false return means the cap expired with a spawn STILL running — the
+        // generation captured below is in-progress evidence, not settled evidence,
+        // so the critical section must still back out (see settledClean).
+        const settledClean = await this.waitForSpawnToSettle();
+        // Everything captured below (window id, readiness verdicts) belongs to
+        // this spawn generation. A spawn that starts afterwards is detected inside
+        // the critical section, where this delivery backs out and redoes itself.
+        const settleGeneration = this.spawnGeneration;
         if (cancelled())
             return false;
         if (this.refuseFatalStartupDelivery(verdict, status))
@@ -4239,7 +4323,8 @@ export class Daemon extends EventEmitter {
             // fall through to the wait.
             const canHandOff = (supportsQueuedInput || opts?.steer)
                 && readiness === "busy"
-                && (await this.probeBlockingDialog()).state === "clear";
+                && (await this.probeBlockingDialog()).state === "clear"
+                && await this.hasPositiveDeliveryInput();
             if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
@@ -4259,7 +4344,7 @@ export class Daemon extends EventEmitter {
                     // wedged CLI (where the text would sit unsubmitted and the next message
                     // would land on top of it) — and instead of holding the queue silently.
                     this.logger.error("Pane still busy after the idle wait — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "readiness", "timeout-before-write");
                 }
             }
         }
@@ -4280,7 +4365,7 @@ export class Daemon extends EventEmitter {
                 // recovery Enter, so exactly STRANDED_INPUT_MAX_ROUNDS of them go out.
                 if (round >= STRANDED_INPUT_MAX_ROUNDS) {
                     this.logger.error({ round }, "Input row still not clear after the stranded-text recovery budget — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "retry-budget-exhausted");
                 }
                 const stranded = await this.submitStrandedInputIfAny(windowId);
                 if (cancelled())
@@ -4289,14 +4374,14 @@ export class Daemon extends EventEmitter {
                     break;
                 if (stranded === "failed") {
                     this.logger.error({ round }, "Could not submit the stranded text — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "enter-failed");
                 }
                 const readyAgain = await this.waitForPaneReadyForDelivery(windowId);
                 if (cancelled())
                     return false;
                 if (!readyAgain) {
                     this.logger.error("Pane never returned to its prompt after submitting stranded input — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "prompt-timeout");
                 }
             }
         }
@@ -4308,13 +4393,22 @@ export class Daemon extends EventEmitter {
             const outcome = await this.paneWriteLock.run(async () => {
                 if (cancelled())
                     return false;
+                // A spawn that started after the settle wait above invalidates the
+                // window id and every readiness verdict since: the pane about to be
+                // written may already belong to a replacement process. The same holds
+                // when the settle wait itself timed out (!settledClean) or a spawn is
+                // running right now — none of those is settled evidence. Never wait
+                // here (startup dismissal needs this lock) — back out and redo the
+                // delivery from the top, where the settle wait runs again outside it.
+                if (!settledClean || settleGeneration !== this.spawnGeneration || this.spawning)
+                    return "spawn-started";
                 if (this.refuseFatalStartupDelivery(verdict, status))
                     return false;
                 // A passive startup phase may paint after the outer readiness probe.
                 // It clears without input, so waiting under the pane lock cannot starve
                 // a dialog dismisser and closes the final clear→paste TOCTOU window.
                 if (!(await this.waitForInputTransientToClear("pre-write"))) {
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "pre-write", "input-transient-timeout");
                 }
                 // TOCTOU: the probes above ran outside this lock, and the CLI repaints
                 // whenever it likes — a resume prompt can be painted between "clear" and
@@ -4325,8 +4419,22 @@ export class Daemon extends EventEmitter {
                     if (probe.state !== "clear")
                         return "dialog";
                 }
+                if (!(await this.hasPositiveDeliveryInput()))
+                    return "dialog";
                 return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict);
             });
+            if (outcome === "spawn-started") {
+                // The pane changed under this delivery: its queued paste must not land
+                // in the replacement process's first screen. Redo the whole delivery
+                // (fresh window id, fresh probes) — bounded, so spawn churn ends in an
+                // honest failure rather than a message that never lands.
+                const retries = (opts?.spawnRetry ?? 0) + 1;
+                if (retries > DELIVERY_SPAWN_RACE_MAX_ROUNDS) {
+                    this.logger.error({ rounds: retries }, "A spawn kept starting before the pane write — reporting delivery failure");
+                    return this.failDelivery(verdict, status);
+                }
+                return this.deliverMessage(formatted, status, { ...opts, spawnRetry: retries });
+            }
             if (outcome !== "dialog")
                 return outcome;
             // Wait OUTSIDE the lock (holding it would starve the runtime dismisser),
@@ -4334,14 +4442,14 @@ export class Daemon extends EventEmitter {
             // an honest failure rather than a message that never lands.
             if (round + 1 >= LATE_DIALOG_WRITE_ROUNDS) {
                 this.logger.error({ rounds: round + 1 }, "A dialog kept appearing before the pane write — reporting delivery failure");
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "pre-write", "dialog-or-input-not-ready");
             }
-            this.logger.info("Dialog appeared before the pane write — waiting for it to clear");
+            this.logger.info("Dialog or input transition appeared before the pane write — waiting for readiness");
             const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId) : false;
             if (cancelled())
                 return false;
             if (!clear) {
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "pre-write", "readiness-timeout");
             }
         }
     }
@@ -4602,6 +4710,27 @@ export class Daemon extends EventEmitter {
     async isPaneReadyForDelivery(windowId) {
         return (await this.paneReadinessForDelivery(windowId)) === "ready";
     }
+    needsStartupInputProof() {
+        return !!this.backend?.isDeliveryInputReadyPane
+            && this.inputTransientGuardGeneration === this.spawnGeneration;
+    }
+    /** Codex can paint a prompt before the TTY enters raw mode. Both are required. */
+    async hasPositiveDeliveryInput() {
+        if (!this.needsStartupInputProof())
+            return true;
+        const check = this.backend?.isDeliveryInputReadyPane;
+        if (!check || !this.tmux)
+            return !check;
+        try {
+            const mode = await this.tmux.getPaneInputMode?.();
+            if (mode !== "raw")
+                return false;
+            return check.call(this.backend, await this.tmux.capturePane());
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Why a pane is not deliverable matters. "busy" may be handed to a native
      * input queue or steered (after its own dialog probe); "dialog", "transient"
@@ -4620,6 +4749,9 @@ export class Daemon extends EventEmitter {
             return "transient";
         if (transient.state === "unknown")
             return "unknown";
+        if (this.needsStartupInputProof()) {
+            return await this.hasPositiveDeliveryInput() ? "ready" : "transient";
+        }
         if (this.backend?.dropsEnterWhileBusy?.() !== true)
             return "ready";
         const prompt = this.backend.getBottomReadyPattern?.();
@@ -4664,7 +4796,8 @@ export class Daemon extends EventEmitter {
         // screen", and a dialog disappears without any output edge the silence
         // gate could see.
         const deadline = Date.now() + timeoutMs;
-        const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true;
+        const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true
+            || this.needsStartupInputProof();
         let unknownStreak = 0;
         let transientBudget = null;
         for (;;) {
@@ -4787,11 +4920,12 @@ export class Daemon extends EventEmitter {
             return "busy";
         if (this.backend?.getBusyPattern?.()?.test(pane))
             return "busy";
+        if (this.backend?.isDeliveryInputReadyPane && !this.backend.isDeliveryInputReadyPane(pane))
+            return "busy";
         if (strandedAgendMessageInInput(pane, prompt))
             return "stranded";
-        // Kiro needs a bottom-anchored prompt as positive readiness evidence. Codex
-        // does not: this preflight runs only after its ordinary silence gate and is
-        // enabled solely to recover a positively identified old AgEnD strand.
+        // Kiro uses the bottom row; Codex's positive prompt/footer check above
+        // rules out a historical transcript echo or a transition/modal screen.
         return !requireBottomReady || bottomRowIsReady(pane, prompt) ? "clear" : "busy";
     }
     /**
@@ -4841,7 +4975,7 @@ export class Daemon extends EventEmitter {
         if (!this.fatalStartupBlocked)
             return false;
         this.logger.error("Delivery refused — CLI is parked on a fatal startup screen");
-        this.failDelivery(verdict, status);
+        this.failDelivery(verdict, status, "fatal-startup", "blocked-before-write");
         return true;
     }
     /**
@@ -4944,7 +5078,7 @@ export class Daemon extends EventEmitter {
                 if (!recoverable) {
                     // A tmux error the window cannot be recovered from: the text will
                     // never reach this pane, so it is a verdict like the others.
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "paste", "non-retryable-tmux-error");
                 }
                 windowId = (await this.recoverWindow()) ?? windowId;
                 if (attempt < maxAttempts)
@@ -4974,7 +5108,7 @@ export class Daemon extends EventEmitter {
             }
             let enterAt = Date.now();
             if (!(await this.sendDeliveryEnter("initial-submit"))) {
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "submit-enter", "tmux-send-keys-failed");
             }
             // Kiro's legacy TUI can swallow Enter while it is still processing a large
             // paste — not only during the post-ready redraw (#479): on slower hosts it
@@ -5023,8 +5157,16 @@ export class Daemon extends EventEmitter {
                     // Our text is on the pane but cannot be shown to have left the input
                     // row — either the backend exposes no input row (only /steer reaches
                     // this path on such a backend) or the pre-paste pane was unreadable.
-                    // Re-pasting on that would deliver the message twice, so accept as
-                    // this path always has, and record that it is unproven.
+                    // For Codex, this can also mean its current layout is not a trusted
+                    // input/queue frame. Do not turn that uncertainty into a false ✅.
+                    if (this.backend?.isDeliveryInputReadyPane) {
+                        this.logger.warn({ phase: "native-queue-proof", proof }, "Codex native-queue outcome uncertain — not re-pasting or confirming");
+                        verdict.phase = "native-queue-proof";
+                        verdict.proof = proof;
+                        return false;
+                    }
+                    // Re-pasting on a backend without structured Codex pane evidence
+                    // would risk duplication; retain its legacy best-effort behavior.
                     this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
                     if (status)
                         this.emit("message_confirmed", status); // ✅ (best-effort)
@@ -5057,9 +5199,14 @@ export class Daemon extends EventEmitter {
                     this.logger.warn("Message still in the input row after idle — submitting the existing text instead of pasting it again");
                     const strandedAt = Date.now();
                     if (!(await this.sendDeliveryEnter("native-queue-stranded-submit"))) {
-                        return this.failDelivery(verdict, status);
+                        return this.failDelivery(verdict, status, "native-queue-submit", "tmux-send-keys-failed");
                     }
-                    const afterEnter = await this.confirmSubmitted(signature, pasteBaseline);
+                    // The recovery Enter can be accepted before Codex paints its new
+                    // transcript. One immediate capture is not a failure verdict: give
+                    // that echo/queue a bounded chance to appear, without re-pasting.
+                    const afterEnter = this.backend?.isDeliveryInputReadyPane
+                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline, true)
+                        : await this.confirmSubmitted(signature, pasteBaseline);
                     if (afterEnter === "submitted") {
                         if (status)
                             this.emit("message_confirmed", status); // ✅
@@ -5071,8 +5218,23 @@ export class Daemon extends EventEmitter {
                     // another turn's output — and treating that as proof re-confirms a
                     // message nobody submitted. Output is corroboration; text sitting in
                     // the input row is disqualifying, and disqualifying evidence wins.
+                    if (this.backend?.isDeliveryInputReadyPane && afterEnter !== "stranded") {
+                        this.logger.warn({ phase: "native-queue-submit", proof: afterEnter, strandedAt }, "Codex recovery Enter outcome uncertain — no hard failure or duplicate paste");
+                        verdict.phase = "native-queue-submit";
+                        verdict.proof = afterEnter;
+                        return false;
+                    }
                     this.logger.error({ afterEnter, strandedAt }, "Stranded message could not be submitted by Enter");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-submit", afterEnter);
+                }
+                if (this.backend?.isDeliveryInputReadyPane) {
+                    // In Codex a missing viewport echo is inconclusive, not a proof of
+                    // loss. Another paste could run the same request twice. Leave the
+                    // already-pasted delivery at 👀 and let the next observation decide.
+                    this.logger.warn({ phase: "native-queue-proof", proof: settled }, "Codex native-queue outcome uncertain — not re-pasting");
+                    verdict.phase = "native-queue-proof";
+                    verdict.proof = settled;
+                    return false;
                 }
                 // "unproven": nothing of ours is on screen — the paste itself was lost,
                 // so pasting it again cannot duplicate anything.
@@ -5081,12 +5243,12 @@ export class Daemon extends EventEmitter {
                     this.logger.error({
                         tmuxError: this.tmux.getLastPasteError?.() ?? "unknown tmux paste failure",
                     }, "Idle-gated redelivery paste failed after native-queue silent loss");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-redelivery", "tmux-paste-failed");
                 }
                 await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
                 const retryAt = Date.now();
                 if (!(await this.sendDeliveryEnter("native-queue-idle-redelivery"))) {
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-redelivery", "tmux-send-keys-failed");
                 }
                 if (windowId && this.controlClient) {
                     if (await this.confirmAfterEnter(windowId, retryAt, signature, pasteBaseline, "native-queue-idle-redelivery-retry")) {
@@ -5101,7 +5263,7 @@ export class Daemon extends EventEmitter {
                     return true;
                 }
                 this.logger.error("Idle-gated redelivery also failed after native-queue silent loss");
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "native-queue-redelivery", "not-submitted");
             }
             if (windowId && this.controlClient && this.backend?.dropsEnterWhileBusy?.() === true) {
                 // F2: output after Enter is necessary but not sufficient — the paste
@@ -5115,7 +5277,7 @@ export class Daemon extends EventEmitter {
                     const promptBack = await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS);
                     const retryAt = Date.now();
                     if (promptBack && !(await this.sendDeliveryEnter("stranded-text-retry"))) {
-                        return this.failDelivery(verdict, status);
+                        return this.failDelivery(verdict, status, "stranded-text-retry", "tmux-send-keys-failed");
                     }
                     submitted = promptBack && await this.confirmSubmittedAfterEnter(windowId, retryAt, formatted);
                 }
@@ -5125,7 +5287,7 @@ export class Daemon extends EventEmitter {
                 }
                 else {
                     this.logger.error("Message pasted but never submitted (text still in the input row after Enter retry)");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-text-retry", "stranded");
                 }
             }
             else if (windowId && this.controlClient) {
@@ -5145,12 +5307,26 @@ export class Daemon extends EventEmitter {
                         this.emit("message_confirmed", status); // ✅
                 }
                 else {
-                    // Both Enters were swallowed: the text is sitting UNSUBMITTED in the
-                    // CLI's input box. This used to return true, so the reaction stayed at 👀
-                    // forever and the next delivery pasted on top — submitting two messages
-                    // as one. Say so instead.
-                    this.logger.error("Message pasted but never submitted (no idle→busy after two Enters)");
-                    return this.failDelivery(verdict, status);
+                    const proof = this.backend?.isDeliveryInputReadyPane
+                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline)
+                        : await this.confirmSubmitted(signature, pasteBaseline);
+                    if (proof === "submitted") {
+                        if (status)
+                            this.emit("message_confirmed", status);
+                        return true;
+                    }
+                    if (this.backend?.isDeliveryInputReadyPane && proof !== "stranded") {
+                        // This is the observed #910 race: the CLI processed the message
+                        // although its echo had not appeared within the proof window. A
+                        // missing viewport signature cannot establish non-delivery; keep
+                        // 👀 and never emit the sender's hard ❌ or re-paste blindly.
+                        this.logger.warn({ phase: "post-submit-proof", proof }, "Codex delivery outcome uncertain — no hard failure or duplicate paste");
+                        verdict.phase = "post-submit-proof";
+                        verdict.proof = proof;
+                        return false;
+                    }
+                    this.logger.error({ phase: "post-submit-proof", proof }, "Message remains unsubmitted after Enter retry");
+                    return this.failDelivery(verdict, status, "post-submit-proof", proof);
                 }
             }
             else {
@@ -5163,7 +5339,7 @@ export class Daemon extends EventEmitter {
             return true;
         }
         this.logger.error("Message delivery failed after retries — window not ready");
-        return this.failDelivery(verdict, status);
+        return this.failDelivery(verdict, status, "paste", "retry-budget-exhausted");
     }
     /**
      * The single place a pasted message is judged submitted, shared by the
@@ -5221,6 +5397,42 @@ export class Daemon extends EventEmitter {
             }
             return busy;
         }
+        if (this.backend?.isDeliveryInputReadyPane) {
+            // Codex's first post-wake redraw may hide the echo for a few seconds.
+            // Absence from a viewport is NOT proof the paste was lost, so only a
+            // positively identified strand authorizes another Enter. Never re-paste
+            // here: the CLI may already be processing the unique message_id.
+            let proof = "unproven";
+            const firstDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            for (;;) {
+                proof = await this.confirmSubmitted(signature, baseline);
+                if (proof === "submitted")
+                    return true;
+                if (proof === "stranded" || Date.now() >= firstDeadline)
+                    break;
+                await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+            }
+            if (proof !== "stranded")
+                return false;
+            if (!(await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS)))
+                return false;
+            proof = await this.confirmSubmitted(signature, baseline);
+            if (proof === "submitted")
+                return true;
+            if (proof !== "stranded")
+                return false;
+            if (!(await this.sendDeliveryEnter(retryPhase)))
+                return false;
+            const retryDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            for (;;) {
+                proof = await this.confirmSubmitted(signature, baseline);
+                if (proof === "submitted")
+                    return true;
+                if (Date.now() >= retryDeadline)
+                    return false;
+                await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+            }
+        }
         if (await this.confirmSubmitted(signature, baseline) === "submitted")
             return true;
         // Retry once the prompt is back — an Enter sent into a mid-redraw TUI is
@@ -5270,6 +5482,14 @@ export class Daemon extends EventEmitter {
                 : "unproven";
         }
         const after = this.paneEvidence(pane, signature);
+        // A Codex layout without its current input/footer pair may show a quoted
+        // or historical `›` row. Unless its active Working banner corroborates a
+        // real turn, text on that unknown screen cannot prove it left stdin.
+        if (this.backend?.isDeliveryInputReadyPane
+            && !this.backend.isDeliveryInputReadyPane(pane)
+            && !this.backend.getBusyPattern?.()?.test(pane)) {
+            return after.payload > 0 ? "unverifiable" : "unproven";
+        }
         // 1. Disqualifying evidence, checked FIRST and never overridden by the
         //    corroborating evidence below: our text is sitting in the input row, so
         //    it was not submitted — whatever else is on screen.
@@ -5308,6 +5528,35 @@ export class Daemon extends EventEmitter {
         this.logger.warn("Could not read the pane before pasting — this delivery cannot be verified either way");
         return "unverifiable";
     }
+    /** Only positive echo/queue evidence may turn an ambiguous Codex write into ✅. */
+    async lateCodexSubmissionProof(signature, baseline, waitThroughStranded = false) {
+        const deadline = Date.now() + CODEX_LATE_PROOF_MS;
+        let proof = "unproven";
+        for (;;) {
+            proof = await this.confirmSubmitted(signature, baseline);
+            // Ordinary idle-path proof may return a strand immediately. After a
+            // native-queue recovery Enter, though, it can be the previous frame
+            // still on screen; only a strand that survives the bounded repaint
+            // window proves that Enter was swallowed.
+            if (proof === "submitted" || (proof === "stranded" && !waitThroughStranded))
+                return proof;
+            if (signature.unique && this.tmux?.capturePaneWithHistory) {
+                try {
+                    const history = await this.tmux.capturePaneWithHistory(300);
+                    const seen = this.paneEvidence(history, signature);
+                    const known = !this.backend?.isDeliveryInputReadyPane
+                        || this.backend.isDeliveryInputReadyPane(history)
+                        || this.backend.getBusyPattern?.()?.test(history);
+                    if (known && seen.payload > 0 && !seen.strandedInput)
+                        return this.submittedProof();
+                }
+                catch { /* a failed history read proves neither delivery nor loss */ }
+            }
+            if (Date.now() >= deadline)
+                return proof;
+            await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+        }
+    }
     /**
      * What the pane currently shows of a given message. Taken once before the
      * paste and once after, so confirmSubmitted can require a NEW marker or a NEW
@@ -5323,7 +5572,8 @@ export class Daemon extends EventEmitter {
                 const pane = await this.tmux.capturePane();
                 const evidence = this.paneEvidence(pane, signature);
                 const prompt = this.backend?.getBottomReadyPattern?.();
-                if (prompt && strandedAgendMessageInInput(pane, prompt)) {
+                if (prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
+                    && strandedAgendMessageInInput(pane, prompt)) {
                     // Whatever we paste now lands after it, and one Enter submits both as
                     // a single message. Nothing here can undo that; saying so beats
                     // letting two messages silently merge.
@@ -5344,7 +5594,8 @@ export class Daemon extends EventEmitter {
     paneEvidence(pane, signature) {
         const marker = this.backend?.getQueuedInputMarker?.();
         const prompt = this.backend?.getBottomReadyPattern?.();
-        const input = prompt ? inputAreaText(pane, prompt) : null;
+        const input = prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
+            ? inputAreaText(pane, prompt) : null;
         return {
             queued: marker ? pane.split(/\r?\n/).filter(row => marker.test(row)).length : 0,
             payload: countOccurrences(pane.replace(/\s+/g, ""), signature.value),
@@ -5395,6 +5646,13 @@ export class Daemon extends EventEmitter {
             return false;
         let proof = await this.confirmSubmitted(signature, baseline);
         if (proof === "unverifiable") {
+            if (this.backend?.isDeliveryInputReadyPane) {
+                // A Codex screen without a structurally current input/footer pair is
+                // not a successful snapshot restore. The old best-effort rule below
+                // is only for backends that expose no readable input row at all.
+                this.logger.warn({ label }, "Codex system paste could not be verified");
+                return false;
+            }
             // No input row to read: this backend gets exactly what the old pasteText
             // path gave it, including the unconditional second Enter for queue-less
             // TUIs that swallow the first. Narrowing that to one Enter on the grounds
@@ -5996,26 +6254,33 @@ export class Daemon extends EventEmitter {
      * Bounded, and called BEFORE the pane lock is taken — waiting on the spawn while
      * holding the lock the spawn itself needs would deadlock.
      */
-    async waitForSpawnToSettle() {
+    /**
+     * Wait for an in-flight spawn to finish, up to the cap. Returns true when no
+     * spawn is in flight afterwards; false when the cap expired with one still
+     * running. A false return is NOT settled evidence — the caller must not
+     * treat the current generation as a completed spawn.
+     */
+    async waitForSpawnToSettle(capMs = SPAWN_SETTLE_MAX_WAIT_MS) {
         const settled = this.spawnSettled;
         if (!settled)
-            return;
+            return true;
         this.logger.debug("Holding delivery until the CLI has finished starting up");
         let timer;
         const cap = new Promise(resolve => {
-            timer = setTimeout(resolve, SPAWN_SETTLE_MAX_WAIT_MS);
+            timer = setTimeout(() => resolve(false), capMs);
             timer.unref?.();
         });
         try {
-            await Promise.race([settled, cap]);
+            const finished = await Promise.race([settled.then(() => true), cap]);
+            if (!finished) {
+                this.logger.warn("CLI still starting after the delivery hold — the pane is not settled evidence");
+            }
+            return finished;
         }
         finally {
             if (timer)
                 clearTimeout(timer);
         }
-        if (this.spawning) {
-            this.logger.warn("CLI still starting after the delivery hold — delivering anyway");
-        }
     }
     /** Spawn a CLI window. Returns true if --resume was used successfully. */
     /**
@@ -6088,11 +6353,25 @@ export class Daemon extends EventEmitter {
             if (!this.backend) {
                 throw new Error("No backend configured — cannot spawn CLI window");
             }
-            const attemptedResume = !this.skipResume;
+            const attemptedResume = !this.skipResume
+                && (this.backend.canResume?.(this.config.working_directory) ?? true);
             // A resume launch may get a longer budget than a fresh one (kiro: the
             // conversation must come back from the backend before anything paints).
             const resumeBudget = attemptedResume ? this.startupBudgetFor(true) : undefined;
             let alive = await this.trySpawn(false, resumeBudget);
+            if (!alive && attemptedResume && this.backend.binaryName === "codex") {
+                const status = await this.tmux?.getPaneStatus().catch(() => null);
+                if (status?.exitCode === 75)
+                    throw new CodexResumeConflictError(null);
+                const pane = await this.tmux?.capturePane().catch(() => "");
+                if (pane?.includes("[agend:codex-session-held]"))
+                    throw new CodexResumeConflictError(null);
+                if (pane && codexResumeLockVisible(pane))
+                    throw new CodexResumeConflictError(null);
+                // A failed explicit resume is not evidence that the conversation is
+                // unusable. Never enter the generic abandon/--fresh recovery path.
+                throw new CodexResumeUnavailableError();
+            }
             if (!alive && attemptedResume) {
                 // Resume failed. Before abandoning the session:
                 //  1. If the backend is unreachable (fleet-level memory, or this very pane
@@ -6286,7 +6565,9 @@ export class Daemon extends EventEmitter {
             this.logger.debug({ err }, "IPC server close failed during startup abort");
         }
         this.ipcServer = null;
-        for (const file of ["daemon.pid", "window-id"]) {
+        // A rejection before tmux setup did not create a replacement window; its
+        // pre-existing window-id still belongs to the old pane and must survive.
+        for (const file of this.tmux ? ["daemon.pid", "window-id"] : ["daemon.pid"]) {
             try {
                 unlinkSync(join(this.instanceDir, file));
             }
@@ -6313,28 +6594,79 @@ export class Daemon extends EventEmitter {
      * Returns true if CLI is ready, false if it failed or got stuck.
      */
     async trySpawn(reuseWindow = false, startupTimeoutMs) {
-        if (!this.spawnGate)
-            return this.trySpawnInsideGate(reuseWindow, startupTimeoutMs);
-        return this.spawnGate.run({
-            instanceName: this.name,
-            workingDirectory: this.config.working_directory,
-            reason: reuseWindow ? "wake" : this.lastSpawnAt > 0 ? "recovery" : "startup",
-        }, () => this.trySpawnInsideGate(reuseWindow, startupTimeoutMs));
+        const ready = !this.spawnGate
+            ? await this.trySpawnInsideGate(reuseWindow, startupTimeoutMs)
+            : await this.spawnGate.run({
+                instanceName: this.name,
+                workingDirectory: this.config.working_directory,
+                reason: reuseWindow ? "wake" : this.lastSpawnAt > 0 ? "recovery" : "startup",
+            }, () => this.trySpawnInsideGate(reuseWindow, startupTimeoutMs));
+        // All successful launches, including wake's trySpawn(true), cross this
+        // point. The previous checkpoint in spawnClaudeWindow missed wake and
+        // kept reading the dead pane PID after a resumed session changed.
+        if (ready && !this.fatalStartupBlocked && this.backend?.binaryName === "codex" && this.tmux) {
+            this.backend.setActivePanePid?.(await TmuxManager.getPanePid(this.tmuxSessionName, this.tmux.getWindowId()));
+            this.saveSessionId(await this.tmux.capturePane().catch(() => undefined));
+        }
+        return ready;
+    }
+    /**
+     * One fresh pane capture judged as ready && !busy && !dialog. Transcript
+     * silence is deliberately NOT the gate: its monitor is inert for muse, so a
+     * quiet-but-working pane would read as idle and the respawn below would kill
+     * a live turn. Fail closed: an unreadable pane is never idle.
+     */
+    async isPaneAuthoritativelyIdle() {
+        const backend = this.backend;
+        if (!this.tmux || !backend)
+            return false;
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return false;
+        }
+        if (backend.getBusyPattern?.()?.test(pane))
+            return false;
+        for (const dialog of this.deliveryBlockingDialogs()) {
+            if (Daemon.dialogMatches(dialog, pane))
+                return false;
+        }
+        if (!backend.getReadyPattern().test(pane))
+            return false;
+        return true;
+    }
+    /**
+     * Poll the authoritative pane check until it reports idle or the budget runs
+     * out. Each poll is a fresh capture, so a turn that ends mid-wait is seen.
+     */
+    async waitForAuthoritativePaneIdle(budgetMs = MUSE_DIRECT_RESUME_IDLE_BUDGET_MS, pollMs = MUSE_DIRECT_RESUME_IDLE_POLL_MS) {
+        const deadline = Date.now() + budgetMs;
+        for (;;) {
+            if (await this.isPaneAuthoritativelyIdle())
+                return true;
+            if (Date.now() >= deadline)
+                return false;
+            await new Promise(r => setTimeout(r, pollMs));
+        }
     }
     /**
      * A relay crash must not make the daemon kill a live Muse process. The
      * supervisor normally reclaims the same port; when that bounded recovery
-     * fails, mark usage unavailable and leave Muse untouched. A later natural
-     * spawn sees museRelayFallback and starts direct, without interrupting the
-     * current conversation or destroying its session.
+     * fails, move Muse back to a direct connection once it is authoritatively
+     * idle (session preserved via the existing resume path) and mark usage
+     * unavailable. The fallback flag also covers every later natural spawn.
+     * Never throws: the floor is the old behavior (flag set, relay stopped,
+     * next restart direct).
      */
-    switchMuseToDirect() {
+    switchMuseToDirect(idleBudgetMs = MUSE_DIRECT_RESUME_IDLE_BUDGET_MS, idlePollMs = MUSE_DIRECT_RESUME_IDLE_POLL_MS) {
         if (this.museRelayFallbackInFlight || this.startupAborted || this.backend?.binaryName !== "muse") {
             return this.museRelayFallbackInFlight ?? Promise.resolve();
         }
         this.museRelayFallbackInFlight = (async () => {
             this.museRelayFallback = true;
-            this.logger.warn("Muse usage relay could not recover — usage is unavailable until the next natural Muse restart");
+            this.logger.warn("Muse usage relay could not recover — usage is unavailable until Muse restarts direct");
             try {
                 if (this.museUsageRelay) {
                     await this.museUsageRelay.stop().catch(() => { });
@@ -6344,6 +6676,60 @@ export class Daemon extends EventEmitter {
             catch (err) {
                 this.logger.warn({ reason: err instanceof Error ? err.message : "relay stop failed" }, "Muse usage relay cleanup failed");
             }
+            // Say so where the operator is looking: without this, muse keeps running
+            // with --base-url pointed at the dead relay port and every turn fails.
+            this.emit("muse_relay_exhausted", { name: this.name });
+            // An idle muse can be moved now; a busy, paused, or supervised-paused one
+            // is left alone — pausing/wake respawns direct anyway via the fallback
+            // flag, and interrupting a live turn (or fighting supervision) would be
+            // worse than waiting for the next natural restart.
+            if (this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped" || !this.tmux)
+                return;
+            const generation = this.spawnGeneration;
+            const idle = await this.waitForAuthoritativePaneIdle(idleBudgetMs, idlePollMs);
+            // Another spawn (wake/restart) completed while waiting — it owns the pane
+            // now, and respawning here would kill its fresh process mid-turn.
+            if (generation !== this.spawnGeneration)
+                return;
+            if (!idle)
+                return;
+            if (this.startupAborted || this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped")
+                return;
+            // Final re-verification under pane-write exclusion: no delivery can paste
+            // a new turn between this verdict and the respawn it authorizes. The
+            // spawn itself runs outside the lock (its dialog dismissal re-takes it).
+            let claimed = false;
+            await this.paneWriteLock.run(async () => {
+                const stillIdle = await this.isPaneAuthoritativelyIdle();
+                if (generation !== this.spawnGeneration)
+                    return;
+                if (!stillIdle)
+                    return;
+                // The final capture awaited above: re-check the full guards here, not
+                // just generation and idle — pause needs no generation bump to take
+                // effect, and respawning a freshly paused pane strands its state.
+                if (this.startupAborted || this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped")
+                    return;
+                this.beginSpawn();
+                claimed = true;
+            });
+            if (!claimed)
+                return;
+            try {
+                this.saveSessionId();
+                const ready = await this.trySpawn(true, this.wakeBudgetMs(30_000));
+                this.transcriptMonitor?.resetOffset();
+                if (ready)
+                    this.logger.info("Muse resumed direct after relay exhaustion (session preserved)");
+                else
+                    this.logger.warn("Muse direct resume after relay exhaustion did not become ready — next natural restart retries");
+            }
+            catch (err) {
+                this.logger.warn({ reason: err instanceof Error ? err.message : String(err) }, "Muse direct resume after relay exhaustion failed — next natural restart retries");
+            }
+            finally {
+                this.endSpawn();
+            }
         })().finally(() => { this.museRelayFallbackInFlight = null; });
         return this.museRelayFallbackInFlight;
     }
@@ -6458,6 +6844,21 @@ export class Daemon extends EventEmitter {
         }
         this.backend.writeConfig(backendConfig);
         this.backend.preTrust?.(this.config.working_directory);
+        // Bounded preflight for an owner left by a restart or another app. Codex
+        // must not be launched as a competing resumer. The command's flock is the
+        // atomic second fence for a race after this observation.
+        if (!backendConfig.skipResume && this.backend.resumeOwner) {
+            let owner = null;
+            for (let attempt = 0; attempt < 3; attempt++) {
+                owner = this.backend.resumeOwner(this.config.working_directory);
+                if (owner === null)
+                    break;
+                if (attempt < 2)
+                    await new Promise(r => setTimeout(r, 1_000));
+            }
+            if (owner !== null)
+                throw new CodexResumeConflictError(owner);
+        }
         // Resolve working directory (e.g. symlink for hidden paths)
         const resolvedCwd = this.backend.resolveWorkingDirectory?.(this.config.working_directory, this.name) ?? this.config.working_directory;
         // Generate a fresh per-instance agent token each spawn. agent-cli reads
@@ -6619,6 +7020,10 @@ export class Daemon extends EventEmitter {
         let lastTransient = null;
         let captureFailures = 0;
         let attempts = 0;
+        // A safety-critical startup choice is one-shot. If the CLI has not
+        // repainted after Enter, let the following hold-only entry report it
+        // instead of sending a second Enter into a possibly changed screen.
+        const attemptedSafetyChoices = new Set();
         do {
             attempts++;
             let pane;
@@ -6655,6 +7060,11 @@ export class Daemon extends EventEmitter {
                 lastDialog = null;
                 for (const dialog of startupDialogs) {
                     if (Daemon.dialogMatches(dialog, pane)) {
+                        if (dialog.autoResolutionKey
+                            && (attemptedSafetyChoices.has(dialog.autoResolutionKey)
+                                || (this.autoResolvedDialogGeneration === this.spawnGeneration
+                                    && this.autoResolvedDialogKey === dialog.autoResolutionKey)))
+                            continue;
                         lastDialog = dialog;
                         cleanReadyPolls = 0;
                         // Start the parked clock for every delivery-blocking dialog, exact
@@ -6696,17 +7106,38 @@ export class Daemon extends EventEmitter {
                         // Restart is exactly when inbound messages pile up, and nothing gates
                         // delivery on `spawning`. Take the pane lock for the key sequence so a
                         // queued message cannot be pasted into a half-dismissed trust dialog.
-                        await this.paneWriteLock.run(async () => {
+                        const sent = await this.paneWriteLock.run(async () => {
+                            // The capture above may have gone stale while waiting for the
+                            // write lock. Trust/other safety prompts must still be the
+                            // CURRENT menu, with the same safe cursor, at the instant of
+                            // the key send. A changed pane falls through to the next scan.
+                            if (dialog.inputBlocked) {
+                                const currentPane = await this.tmux.capturePane();
+                                if (!Daemon.dialogMatches(dialog, currentPane))
+                                    return false;
+                            }
+                            if (dialog.autoResolutionKey) {
+                                attemptedSafetyChoices.add(dialog.autoResolutionKey);
+                                this.autoResolvedDialogGeneration = this.spawnGeneration;
+                                this.autoResolvedDialogKey = dialog.autoResolutionKey;
+                            }
                             for (const key of dialog.keys) {
                                 if (key === "Up" || key === "Down" || key === "Enter" || key === "Escape") {
-                                    await this.tmux.sendSpecialKey(key);
+                                    if (!await this.tmux.sendSpecialKey(key))
+                                        return false;
                                 }
                                 else {
-                                    await this.tmux.sendKeys(key);
+                                    if (!await this.tmux.sendKeys(key))
+                                        return false;
                                 }
                                 await new Promise(r => setTimeout(r, 200));
                             }
+                            return true;
                         });
+                        if (!sent) {
+                            matched = true;
+                            break;
+                        }
                         // Wait for next screen to render — bounded by what is left of the budget.
                         const renderWait = Math.max(0, Math.min(10_000, remaining()));
                         if (this.controlClient) {
@@ -6816,26 +7247,34 @@ export class Daemon extends EventEmitter {
         }
         catch { /* best effort */ }
     }
-    saveSessionId() {
+    /** The returned ID was durably checkpointed or already matched on disk. */
+    saveSessionId(pane) {
         // When a resume failure has forced a fresh start, don't persist the stale id
         // back from statusline.json — that would re-arm --continue and re-loop.
         if (this.skipResume)
-            return;
+            return null;
         try {
-            const sid = this.backend?.getSessionId();
-            if (!sid)
-                return;
+            const sid = this.backend?.getSessionId(pane);
+            if (!sid) {
+                if (this.backend?.hasUnconfirmedSessionIdentity?.() && !this.codexSessionIdentityHoldNotified) {
+                    this.codexSessionIdentityHoldNotified = true;
+                    this.emit("codex_session_identity_unconfirmed", { name: this.name });
+                }
+                return null;
+            }
+            this.codexSessionIdentityHoldNotified = false;
             const path = join(this.instanceDir, "session-id");
             // Idle observations happen after turns. Avoid needless writes (and mtime
             // churn) while still updating the marker when /new changes the session.
             try {
                 if (readFileSync(path, "utf-8").trim() === sid)
-                    return;
+                    return sid;
             }
             catch { /* first checkpoint */ }
             writeFileSync(path, sid);
             this.sessionCheckpointWarningEmitted = false;
             this.logger.debug("Session id checkpointed");
+            return sid;
         }
         catch (err) {
             // Session discovery is best-effort and must never break the pane state
@@ -6844,8 +7283,24 @@ export class Daemon extends EventEmitter {
                 this.sessionCheckpointWarningEmitted = true;
                 this.logger.warn({ err: err.message }, "Session id checkpoint failed");
             }
+            return null;
         }
     }
+    checkpointLivePaneBeforeReplacement(pane) {
+        // A pre-upgrade Codex pane can provide stronger, exact ownership
+        // evidence than an old crash-loop heuristic. Discover it before
+        // saveSessionId's skip-resume guard, then arm resume only if the
+        // checkpoint was actually durable. Never fall back to --last.
+        const exactCodexId = this.backend?.binaryName === "codex" ? this.backend.getSessionId(pane) : null;
+        if (exactCodexId)
+            this.skipResume = false;
+        const recoveredId = this.saveSessionId(pane);
+        if (exactCodexId && !recoveredId)
+            this.skipResume = true;
+        return recoveredId;
+    }
+    /** Only a live pre-upgrade pane can provide this positive migration proof. */
+    getRecoveredLegacyCodexSessionId() { return this.recoveredLegacyCodexSessionId; }
     readContextPercentage() {
         return this.backend?.getContextUsage() ?? 0;
     }