@songsid/agend 2.1.6-beta.14 → 2.1.6-beta.16

package/dist/daemon.js

@@ -435,6 +435,27 @@ const DELIVERY_SPAWN_RACE_MAX_ROUNDS = 3;
  */
 const MUSE_DIRECT_RESUME_IDLE_BUDGET_MS = 10 * 60_000;
 const MUSE_DIRECT_RESUME_IDLE_POLL_MS = 5_000;
+/** Kiro can drop /quit while a turn is running; cancel it and wait for its
+ * verified prompt before asking the native process to exit. Each instance is
+ * bounded so a fleet update can stop all daemons in parallel. */
+const KIRO_STOP_IDLE_BUDGET_MS = 15_000;
+const KIRO_STOP_QUIT_GRACE_MS = 5_000;
+const KIRO_STOP_SIGTERM_GRACE_MS = 2_000;
+/**
+ * How recently AgEnD must have asked the CLI to stop for a pane death to be
+ * attributed to AgEnD rather than to the CLI itself (#927). Covers the longest
+ * quit grace plus the SIGTERM/SIGKILL fallback, and one health tick more.
+ */
+const STOP_ATTRIBUTION_WINDOW_MS = 90_000;
+/** Lines of pane output kept with a death record: enough for a vendor error. */
+const DEATH_OUTPUT_LINES = 20;
+/** The last `lines` non-empty lines of a captured pane, escape codes already stripped. */
+function paneTail(output, lines = DEATH_OUTPUT_LINES) {
+    if (!output)
+        return undefined;
+    const tail = output.split("\n").filter(line => line.trim()).slice(-lines).join("\n");
+    return tail ? tail.slice(-2_000) : undefined;
+}
 /**
  * Startup failed because the CLI's backend is unreachable (see backend-outage.ts).
  * The session-id is deliberately KEPT; the fleet schedules a delayed retry.
@@ -449,6 +470,10 @@ export class BackendUnreachableStartupError extends Error {
 }
 /** Bounded wait (under the pane lock) for the prompt to return before retrying a dropped Enter. */
 const STRANDED_RETRY_READY_WAIT_MS = 30_000;
+/** A pasted Kiro message may be processing for longer than the retry window. */
+const KIRO_SUBMISSION_OBSERVE_MS = 10 * 60_000;
+const KIRO_SUBMISSION_POLL_MS = 1_000;
+const KIRO_SUBMISSION_UNREADABLE_POLLS = 40;
 /** A passive startup phase must clear within this bound before an Enter is sent. */
 /**
  * How long a passive startup/resume transient may sit WITHOUT REPAINTING before
@@ -494,9 +519,13 @@ const SPAWN_SETTLE_MAX_WAIT_MS = 60_000;
  * prompt. A TUI that is still completing its first redraw can swallow Enter.
  *
  * Since the adaptive settle (see {@link waitForPasteSettle}) this value is the
- * *fallback* wait — it governs only deliveries where the pane's output cannot
- * be observed (no control mode, native-queue handoff, mid-wait reconnect, or a
- * paste that never visibly renders).
+ * *minimum* settle window for the first delivery — it prevents Enter from firing
+ * before the minimum elapses even when the paste's own render goes quiet early.
+ * For observed deliveries the quiet-exit path in waitForPasteSettle now checks
+ * `now >= fallbackDeadline`, so 1750ms governs every first delivery regardless
+ * of whether output is observed. For unobserved deliveries (no control mode,
+ * native-queue handoff, mid-wait reconnect, or a paste that never visibly
+ * renders) it is the flat fallback delay, same as before.
  */
 export class FirstDeliveryDelay {
     readyAt = 0;
@@ -533,9 +562,15 @@ const PASTE_SETTLE_POLL_MS = 100;
  * So: watch `lastOutputAt` and send Enter only once the paste's own render has
  * been quiet for {@link PASTE_QUIET_MS}. Bounded both ways —
  *
- * - never earlier than the legacy fixed delay when the paste produces no
- *   observable output at all (`usedFallback`), so panes that don't echo keep
- *   their long-standing behaviour;
+ * - never earlier than `fallbackMs` from settle start: `fallbackMs` is a
+ *   **minimum** settle window, not merely a fallback. For first deliveries
+ *   (fallbackMs = 1750ms) the compositor may render quickly then go quiet at
+ *   ~550ms while still initialising — the minimum ensures Enter is held until
+ *   1750ms regardless of observed output. This applies to every backend's first
+ *   delivery after ready, not only codex/Luna Reserve. For normal deliveries
+ *   (fallbackMs = 500ms ≈ PASTE_QUIET_MS) the minimum adds at most a few ms
+ *   and is effectively unchanged. When the paste produces no observable output
+ *   at all (`usedFallback`), the same `fallbackMs` deadline governs;
  * - never later than {@link PASTE_SETTLE_CAP_MS} after the paste (`capHit`),
  *   so a chatty pane cannot stall delivery.
  *
@@ -559,7 +594,13 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
         const last = client.getLastOutputAt(windowId);
         if (last != null && last > pasteStartedAt) {
             observed = true;
-            if (now - last >= PASTE_QUIET_MS) {
+            // Quiet for PASTE_QUIET_MS AND the minimum settle window has elapsed.
+            // The minimum (fallbackDeadline) is the key fix for Luna Reserve: the
+            // TUI's first compositor render produces output quickly then goes quiet,
+            // but Enter sent at the 500ms quiet point lands while the compositor is
+            // still initialising and is swallowed. Holding until fallbackDeadline
+            // (1750ms for first deliveries, 500ms for normal ones) eliminates the race.
+            if (now - last >= PASTE_QUIET_MS && now >= fallbackDeadline) {
                 return { settleMs: now - settleStart, observedPostPasteOutput: true, capHit: false, usedFallback: false };
             }
         }
@@ -571,9 +612,12 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
         }
         // Sleep to the next decision point, at most one poll tick — so the normal
         // paths return at their exact deadlines instead of a poll-width late.
+        // When output has been observed but we are still inside the minimum window,
+        // sleep to the later of (last quiet deadline) and (fallback deadline) so
+        // the loop does not busy-spin between quiet and minimum.
         let wake = capDeadline;
         if (last != null && last > pasteStartedAt)
-            wake = Math.min(wake, last + PASTE_QUIET_MS);
+            wake = Math.min(wake, Math.max(last + PASTE_QUIET_MS, fallbackDeadline));
         else
             wake = Math.min(wake, fallbackDeadline);
         await new Promise(r => setTimeout(r, Math.min(PASTE_SETTLE_POLL_MS, Math.max(1, wake - now))));
@@ -1113,6 +1157,42 @@ export class Daemon extends EventEmitter {
     }
     get lastPausedAt() { return this.autoPauseController.lastPausedAt; }
     getPauseWakeState() { return this.pauseWakeState; }
+    /**
+     * Codex can show an exhausted-account notice while the user is switching to
+     * a reserve account. Once the live composer and Context footer are back, the
+     * notice is scrollback, not a reason to pause and send /quit.
+     */
+    isCodexLivePaneSnapshot(pane) {
+        if (this.backend?.binaryName !== "codex")
+            return false;
+        try {
+            if (this.backend.isDeliveryInputReadyPane?.(pane) !== true)
+                return false;
+            const busy = this.backend.getBusyPattern?.();
+            if (busy) {
+                busy.lastIndex = 0;
+                if (busy.test(pane))
+                    return false;
+            }
+            const ready = this.backend.getReadyPattern();
+            ready.lastIndex = 0;
+            return ready.test(pane);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Re-check the current pane after an async quota probe before pausing it. */
+    async isCodexLivePane() {
+        if (this.backend?.binaryName !== "codex" || !this.tmux)
+            return false;
+        try {
+            return this.isCodexLivePaneSnapshot(await this.tmux.capturePane());
+        }
+        catch {
+            return false;
+        }
+    }
     /** Whether this instance is in a crash loop (3+ consecutive crashes). */
     get isCrashLoop() {
         return this.crashCount >= 3;
@@ -1884,6 +1964,9 @@ export class Daemon extends EventEmitter {
                     // Normal exit (e.g. user Ctrl+C or /exit) — no crash, no respawn
                     if (paneStatus && exitCode === 0) {
                         this.setProcessStatus("stopped");
+                        // Status 0 is not proof of a clean exit: a codex that hits a quota
+                        // wall exits 0 too. Capture what it printed before the window goes.
+                        this.logPaneDeath(cliLabel, exitCode, await this.capturePaneOutput());
                         this.logger.info("CLI exited normally (code 0) — pausing health check");
                         await this.tmux.killWindow();
                         this.healthCheckPaused = true;
@@ -1960,6 +2043,7 @@ export class Daemon extends EventEmitter {
                         lastOutput = cleaned.trimEnd() || undefined;
                     }
                     catch { /* best effort — pane may already be gone */ }
+                    this.logPaneDeath(cliLabel, exitCode, lastOutput);
                     // Kill the dead window (remain-on-exit keeps it around) before respawn
                     if (paneStatus) {
                         await this.tmux.killWindow();
@@ -2031,7 +2115,7 @@ export class Daemon extends EventEmitter {
                     this.crashTimestamps = this.crashTimestamps.filter(t => t > Date.now() - crashWindowMs);
                     if (this.crashTimestamps.length >= 3) {
                         this.healthCheckPaused = true;
-                        this.logger.error({ crashesInWindow: this.crashTimestamps.length }, "3+ crashes in 5 minutes — pausing respawn");
+                        this.logger.error({ crashesInWindow: this.crashTimestamps.length, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "3+ crashes in 5 minutes — pausing respawn");
                         // P1: Persist crash state so next process restart skips resume
                         try {
                             writeFileSync(join(this.instanceDir, "crash-state.json"), JSON.stringify({
@@ -2051,7 +2135,7 @@ export class Daemon extends EventEmitter {
                     this.crashCount++;
                     this.lastCrashAt = Date.now();
                     if (this.crashCount > max_retries) {
-                        this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries }, "Max crash retries exceeded — not respawning");
+                        this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "Max crash retries exceeded — not respawning");
                         this.healthCheckPaused = true;
                         this.emitSupervisionEnded(`it crashed ${this.crashCount} times, exceeding restart_policy.max_retries (${max_retries})`, "Check the logs for the cause, then restart it.");
                         return; // don't schedule next — given up
@@ -2355,6 +2439,7 @@ export class Daemon extends EventEmitter {
         // rebaselining the occurrence count while the error is still displayed — one
         // notification, a false recovery log, then silence.
         const looksReady = () => !busyPattern?.test(pane) && readyPattern.test(pane);
+        const codexLivePane = this.isCodexLivePaneSnapshot(pane);
         // State: waiting for recovery. A missing/outdated ready pattern must not
         // suppress every future error forever, so the gate has a hard deadline.
         if (this.errorWaitingForRecovery) {
@@ -2418,6 +2503,17 @@ export class Daemon extends EventEmitter {
             const key = Daemon.errorPatternKey(ep);
             const count = countMatches(ep.pattern);
             const seen = this.lastErrorCount.get(key) ?? 0;
+            // The generic Codex usage-limit line remains in scrollback after the
+            // user selects Luna Reserve. A live composer + Context footer is positive
+            // evidence that the pane recovered; baseline the stale occurrence so it
+            // cannot reach the destructive quota pause path.
+            if (codexLivePane && ep.type === "quota" && ep.action === "pause"
+                && ep.message.startsWith("Codex usage limit reached")) {
+                if (count > 0)
+                    this.lastErrorCount.set(key, count);
+                this.logger.debug("Codex usage-limit text is stale — live reserve pane is running");
+                continue;
+            }
             if (count <= seen) {
                 // Occurrences scrolled out of the capture buffer → lower the baseline
                 // so a future re-occurrence still counts as new (no permanent suppress).
@@ -2612,12 +2708,61 @@ export class Daemon extends EventEmitter {
         // is a successful no-op here, not an error.
         this.logger.debug({ dialog: dialog.description }, "Backend clear dialog did not appear");
     }
+    /**
+     * The last time AgEnD itself asked the CLI to go away, and why (#927). Read
+     * when a pane dies, to tell "AgEnD stopped it" from "the CLI exited on its
+     * own" — a codex that exits 0 on its own and one AgEnD sent /quit look the
+     * same from the pane.
+     */
+    lastStopRequest = null;
+    /** Record, and log, that AgEnD is about to stop the CLI. */
+    noteStopRequest(via, reason) {
+        this.lastStopRequest = { via, reason, at: Date.now() };
+        this.logger.info({ via, reason }, `AgEnD is stopping the CLI: ${via} (${reason})`);
+    }
+    /** Capture the pane's recent output with escape codes stripped. Never throws. */
+    async capturePaneOutput() {
+        try {
+            const raw = await this.tmux?.capturePaneWithHistory(50);
+            const cleaned = raw?.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+            return cleaned?.trimEnd() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * One record per pane death: exit status, when, who, and what the CLI printed
+     * last — the line that was missing when a codex on Luna Reserve died with
+     * status 0 and daemon.log said only "exited normally" (#927). Logging only;
+     * the caller decides what happens next.
+     */
+    logPaneDeath(cliLabel, exitCode, lastOutput) {
+        const request = this.lastStopRequest;
+        const sinceStopMs = request ? Date.now() - request.at : null;
+        const byAgend = request !== null && sinceStopMs !== null && sinceStopMs <= STOP_ATTRIBUTION_WINDOW_MS;
+        const record = {
+            exitCode: exitCode ?? null,
+            diedAt: new Date().toISOString(),
+            initiatedBy: byAgend ? "agend" : "cli",
+            ...(byAgend ? { stopVia: request.via, stopReason: request.reason, sinceStopMs } : {}),
+            lastOutput: paneTail(lastOutput) ?? null,
+        };
+        if (byAgend) {
+            this.logger.info(record, `${cliLabel} exited after AgEnD stopped it (${request.via}: ${request.reason})`);
+        }
+        else {
+            this.logger.warn(record, `${cliLabel} exited on its own (exit code ${exitCode ?? "unknown"}) — last output recorded`);
+        }
+    }
     /** Send the backend-specific graceful quit command/key sequence. */
-    async sendQuitSequence() {
+    async sendQuitSequence(reason = "unspecified") {
         if (!this.tmux || !this.backend)
             return false;
         const quitCmd = this.backend.getQuitCommand();
         const quitKey = this.backend.getQuitKey?.();
+        if (quitCmd || quitKey)
+            this.noteStopRequest(quitCmd ? `quit command ${quitCmd}` : `quit key ${quitKey}`, reason);
         if (quitCmd) {
             if (!await this.tmux.sendKeys(quitCmd))
                 return false;
@@ -2638,6 +2783,26 @@ export class Daemon extends EventEmitter {
         }
         return true;
     }
+    /**
+     * Kiro drops `/quit` while a turn is running. Stop that turn first, then use
+     * the same delivery readiness gate that protects Enter from the busy pane.
+     * Returning false is fail-closed: the caller skips `/quit` and enters the
+     * bounded SIGTERM -> SIGKILL fallback instead of typing into an unknown pane.
+     */
+    async drainBusyKiroForStop(windowId) {
+        if (this.backend?.binaryName !== "kiro-cli")
+            return true;
+        const readiness = await this.paneReadinessForDelivery(windowId);
+        if (readiness === "ready")
+            return true;
+        if (readiness !== "busy")
+            return false;
+        const cancelKey = this.backend.getCancelKey?.() ?? "Escape";
+        const sent = await this.tmux?.sendSpecialKey(cancelKey);
+        if (!sent)
+            return false;
+        return this.waitForPaneReadyForDelivery(windowId, KIRO_STOP_IDLE_BUDGET_MS);
+    }
     async stop() {
         this.logger.info("Stopping daemon instance");
         this.turnReplyGuard.reset();
@@ -2663,11 +2828,18 @@ export class Daemon extends EventEmitter {
             this.saveSessionId();
             this.healthCheckPaused = true;
             let killed = false;
-            const quitSent = await this.sendQuitSequence();
+            const windowId = this.tmux.getWindowId();
+            const kiroReady = windowId ? await this.drainBusyKiroForStop(windowId) : true;
+            const quitSent = kiroReady && await this.sendQuitSequence("graceful stop");
+            const quitGraceMs = this.backend?.binaryName === "kiro-cli"
+                ? KIRO_STOP_QUIT_GRACE_MS : 3_000;
+            const sigtermGraceMs = this.backend?.binaryName === "kiro-cli"
+                ? KIRO_STOP_SIGTERM_GRACE_MS : 1_000;
             if (quitSent) {
-                // Wait up to 3s for graceful exit, polling every 200ms. A healthy CLI
+                // Wait up to the backend's bounded graceful-exit window, polling every
+                // 200ms. A healthy CLI
                 // exits within ~1s; a longer wait just delays the force-kill fallback.
-                for (let i = 0; i < 15; i++) {
+                for (let elapsed = 0; elapsed < quitGraceMs; elapsed += 200) {
                     await new Promise(r => setTimeout(r, 200));
                     const status = await this.tmux.getPaneStatus();
                     if (!status || !status.alive) {
@@ -2677,9 +2849,9 @@ export class Daemon extends EventEmitter {
                 }
             }
             if (!killed) {
-                this.logger.warn({ quitSent }, "CLI did not exit gracefully within 3s — falling back to SIGTERM");
-                await this.killProcessTree("SIGTERM");
-                for (let i = 0; i < 5; i++) {
+                this.logger.warn({ quitSent, quitGraceMs }, "CLI did not exit gracefully within its bounded quit grace — falling back to SIGTERM");
+                await this.killProcessTree("SIGTERM", "graceful stop: the CLI outlived its quit grace");
+                for (let elapsed = 0; elapsed < sigtermGraceMs; elapsed += 200) {
                     await new Promise(r => setTimeout(r, 200));
                     const status = await this.tmux.getPaneStatus();
                     if (!status || !status.alive) {
@@ -2690,7 +2862,7 @@ export class Daemon extends EventEmitter {
             }
             if (!killed) {
                 this.logger.warn("CLI process tree survived SIGTERM — falling back to SIGKILL");
-                await this.killProcessTree("SIGKILL");
+                await this.killProcessTree("SIGKILL", "graceful stop: the CLI survived SIGTERM");
                 await new Promise(r => setTimeout(r, 200));
             }
             // Always kill window — remain-on-exit keeps dead panes around after CLI exits
@@ -2792,6 +2964,9 @@ export class Daemon extends EventEmitter {
         // into an ordinary idle-timeout pause of a busy instance.
         const allowStuck = this.pauseAllowStuck;
         this.pauseAllowStuck = false;
+        // Why this pause, for the stop record (#927): an idle pause and an
+        // auth-deferred one look the same from the pane.
+        const pauseReason = allowStuck ? "pause (auth-deferred, stuck pane)" : "pause (idle)";
         const pausableState = this.instanceState === "idle"
             || (allowStuck && this.instanceState === "stuck");
         if (!pausableState || this.pasteQueueDepth > 0) {
@@ -2804,7 +2979,7 @@ export class Daemon extends EventEmitter {
         const transition = (async () => {
             try {
                 this.saveSessionId();
-                await this.sendQuitSequence();
+                await this.sendQuitSequence(pauseReason);
                 let exited = false;
                 for (let i = 0; i < 15; i++) {
                     await new Promise(r => setTimeout(r, 200));
@@ -2815,11 +2990,11 @@ export class Daemon extends EventEmitter {
                     }
                 }
                 if (!exited) {
-                    await this.killProcessTree("SIGTERM");
+                    await this.killProcessTree("SIGTERM", `${pauseReason}: the CLI outlived its quit grace`);
                     await new Promise(r => setTimeout(r, 1_000));
                     const status = await this.tmux?.getPaneStatus();
                     if (status?.alive) {
-                        await this.killProcessTree("SIGKILL");
+                        await this.killProcessTree("SIGKILL", `${pauseReason}: the CLI survived SIGTERM`);
                         await new Promise(r => setTimeout(r, 200));
                     }
                 }
@@ -4244,6 +4419,8 @@ export class Daemon extends EventEmitter {
         // A false return means the cap expired with a spawn STILL running — the
         // generation captured below is in-progress evidence, not settled evidence,
         // so the critical section must still back out (see settledClean).
+        if (this.spawnSettled && status)
+            this.emit("message_queued", status);
         const settledClean = await this.waitForSpawnToSettle();
         // Everything captured below (window id, readiness verdicts) belongs to
         // this spawn generation. A spawn that starts afterwards is detected inside
@@ -4385,6 +4562,9 @@ export class Daemon extends EventEmitter {
                 }
                 return this.deliverMessage(formatted, status, { ...opts, spawnRetry: retries });
             }
+            if (typeof outcome === "object") {
+                return this.observeKiroSubmission(formatted, outcome, status, verdict, cancelled);
+            }
             if (outcome !== "dialog")
                 return outcome;
             // Wait OUTSIDE the lock (holding it would starve the runtime dismisser),
@@ -4507,8 +4687,18 @@ export class Daemon extends EventEmitter {
                 this.logger.warn({ phase, generation }, "Spawn changed during the input-availability probe — refusing to send Enter into the replacement pane");
                 return false;
             }
-            if (probe.state === "clear")
+            if (probe.state === "clear") {
+                // Re-arm the first-delivery delay when a transient was actually observed
+                // and then cleared, but ONLY from the pre-write phase. That phase runs
+                // before consume() in writeMessageToPane, so the re-arm benefits the
+                // current delivery's paste settle. Enter-path callers (initial-submit,
+                // retries) run after consume() — re-arming there would leave the flag
+                // for the NEXT unrelated delivery, which must not be slowed.
+                if (observedDescription !== null && phase === "pre-write") {
+                    this.firstDeliveryDelay.recordReady();
+                }
                 return true;
+            }
             if (probe.state === "active" && observedDescription !== probe.transient.description) {
                 observedDescription = probe.transient.description;
                 this.logger.info({ phase, transient: probe.transient.description, generation }, "CLI is still completing startup — waiting before sending Enter");
@@ -4913,6 +5103,126 @@ export class Daemon extends EventEmitter {
             this.logger.warn("Could not read the pane after Enter — not confirming the submission");
         return sawOutput && residue === "absent";
     }
+    /** Once Kiro returns to its prompt, its unique envelope id in history proves submission. */
+    async kiroSubmissionEvidence(windowId, formatted, signature) {
+        if (!this.tmux)
+            return "unreadable";
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return "unreadable";
+        }
+        const prompt = this.backend?.getBottomReadyPattern?.();
+        if (prompt && bottomRowIsReady(pane, prompt)
+            && inputShowsPastedText(inputAreaText(pane, prompt) ?? "", signature.value))
+            return "stranded";
+        if (prompt && pasteLeftInInput(pane, prompt, formatted))
+            return "stranded";
+        // During generation the same text can still be typeahead for an older
+        // turn. A history hit is safe only after this pane returns to its prompt.
+        if (!signature.unique || !this.tmux.capturePaneWithHistory
+            || !(await this.isPaneReadyForDelivery(windowId)))
+            return "unknown";
+        try {
+            const history = await this.tmux.capturePaneWithHistory(300);
+            // History includes the CURRENT input row. The earlier viewport capture
+            // and readiness probe may belong to an older frame: Kiro can finish a
+            // turn and expose our unsent typeahead between those reads. Judge both
+            // readiness and input residue on this same, final snapshot before its
+            // message id can count as a submitted transcript echo.
+            if (!prompt || !bottomRowIsReady(history, prompt))
+                return "unknown";
+            if (inputShowsPastedText(inputAreaText(history, prompt) ?? "", signature.value)
+                || pasteLeftInInput(history, prompt, formatted))
+                return "stranded";
+            if (countOccurrences(history.replace(/\s+/g, ""), signature.value) > 0)
+                return "submitted";
+        }
+        catch { /* missing history cannot establish a verdict */ }
+        return "unknown";
+    }
+    /** Observe the Kiro paste outside paneWriteLock; a long agent turn must not block dialog handling. */
+    async observeKiroSubmission(formatted, pending, status, verdict, cancelled) {
+        const deadline = Date.now() + KIRO_SUBMISSION_OBSERVE_MS;
+        let retriedStrand = false;
+        let unreadable = 0;
+        const current = () => !cancelled()
+            && !this.spawning
+            && this.spawnGeneration === pending.spawnGeneration
+            && this.getWindowId() === pending.windowId
+            && this.tmux?.getWindowId() === pending.windowId;
+        for (;;) {
+            if (!current())
+                return false;
+            const evidence = await this.kiroSubmissionEvidence(pending.windowId, formatted, pending.signature);
+            if (!current())
+                return false;
+            if (evidence === "submitted") {
+                if (status)
+                    this.emit("message_confirmed", status);
+                return true;
+            }
+            unreadable = evidence === "unreadable" ? unreadable + 1 : 0;
+            if (unreadable >= KIRO_SUBMISSION_UNREADABLE_POLLS) {
+                return this.failDelivery(verdict, status, "post-submit-proof", "pane-unreadable");
+            }
+            if (evidence === "stranded" && await this.isPaneReadyForDelivery(pending.windowId)) {
+                if (!current())
+                    return false;
+                if (retriedStrand)
+                    return this.failDelivery(verdict, status, "stranded-text-retry", "stranded");
+                const retry = await this.paneWriteLock.run(async () => {
+                    if (!current())
+                        return "cancelled";
+                    const fresh = await this.kiroSubmissionEvidence(pending.windowId, formatted, pending.signature);
+                    if (!current())
+                        return "cancelled";
+                    if (fresh === "submitted")
+                        return "submitted";
+                    if (fresh !== "stranded" || !(await this.isPaneReadyForDelivery(pending.windowId)))
+                        return "changed";
+                    if (!current())
+                        return "cancelled";
+                    const sent = await this.sendDeliveryEnter("stranded-text-retry", current);
+                    if (!current())
+                        return "cancelled";
+                    return sent ? "sent" : "failed";
+                });
+                if (!current())
+                    return false;
+                if (retry === "cancelled")
+                    return false;
+                if (retry === "submitted") {
+                    if (status)
+                        this.emit("message_confirmed", status);
+                    return true;
+                }
+                if (retry === "failed")
+                    return this.failDelivery(verdict, status, "stranded-text-retry", "tmux-send-keys-failed");
+                if (retry === "sent") {
+                    retriedStrand = true;
+                    await new Promise(r => setTimeout(r, POST_ENTER_PROOF_WINDOW_MS));
+                    continue;
+                }
+            }
+            const alive = await this.tmux?.isWindowAlive().catch(() => false);
+            if (!current())
+                return false;
+            if (!alive)
+                return this.failDelivery(verdict, status, "post-submit-proof", "window-gone");
+            if (Date.now() >= deadline) {
+                // A live, busy pane and no positive strand are still ambiguous. The
+                // hang detector owns hung CLI recovery; elapsed time alone is not ❌.
+                this.logger.warn("Kiro submission remains unproven; keeping the delivery queued without a false failure");
+                verdict.phase = "post-submit-proof";
+                verdict.proof = "unproven";
+                return false;
+            }
+            await new Promise(r => setTimeout(r, KIRO_SUBMISSION_POLL_MS));
+        }
+    }
     /**
      * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
      * no pane write may happen: paste+Enter into the corrupt-config modal would
@@ -4992,9 +5302,13 @@ export class Daemon extends EventEmitter {
      * precisely so the lock's scope is visible at the call site rather than being
      * an invariant maintained by comments.
      */
-    async sendDeliveryEnter(phase) {
+    async sendDeliveryEnter(phase, stillCurrent) {
         if (!(await this.waitForInputTransientToClear(phase)))
             return false;
+        // A recovery Enter may have waited for a transient while cancel or spawn
+        // replaced the delivery. Check at the last point before the tmux write.
+        if (stillCurrent && !stillCurrent())
+            return false;
         const sent = await this.tmux.sendSpecialKey("Enter");
         if (!sent) {
             this.logger.error({
@@ -5219,10 +5533,20 @@ export class Daemon extends EventEmitter {
                 // F2: output after Enter is necessary but not sufficient — the paste
                 // must also have LEFT the input row.
                 let submitted = await this.confirmSubmittedAfterEnter(windowId, enterAt, formatted);
+                if (!submitted && signature.unique) {
+                    submitted = await this.kiroSubmissionEvidence(windowId, formatted, signature) === "submitted";
+                    if (!submitted) {
+                        // No output edge is not proof of a lost message. Leave the pane
+                        // lock before waiting through a long Kiro turn, so runtime dialog
+                        // handling can still make progress.
+                        if (status)
+                            this.emit("message_queued", status);
+                        return { kind: "kiro-pending", windowId, spawnGeneration: this.spawnGeneration, signature };
+                    }
+                }
                 if (!submitted) {
-                    // The Enter landed while the TUI was still busy (it kept the text but
-                    // dropped the key). A retry is only useful once the prompt is back —
-                    // bounded, since we hold the pane lock here.
+                    // Legacy system pastes have no unique envelope id. Preserve their
+                    // existing bounded retry until they can be tied to a specific turn.
                     this.logger.warn("Message not submitted after Enter — waiting for the prompt, then re-sending Enter once");
                     const promptBack = await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS);
                     const retryAt = Date.now();
@@ -6321,7 +6645,7 @@ export class Daemon extends EventEmitter {
                 await this.failStartupIfBackendUnreachable();
                 if (this.backend.retriesResumeOnStartupFailure?.() !== false) {
                     this.logger.warn("Resume startup failed — retrying resume once before abandoning the session");
-                    await this.killProcessTree();
+                    await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                     await this.tmux.killWindow();
                     alive = await this.trySpawn(false, resumeBudget);
                     if (!alive) {
@@ -6347,7 +6671,7 @@ export class Daemon extends EventEmitter {
                         if (this.unprovenResumeFailures < Daemon.MAX_UNPROVEN_RESUME_FAILURES) {
                             // Keep the session and fail this attempt; the fleet retries with
                             // backoff, which is also how the backend-outage path behaves.
-                            await this.killProcessTree();
+                            await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                             await this.tmux.killWindow();
                             throw new Error(`CLI startup failed with a session to resume (attempt ${this.unprovenResumeFailures}/${Daemon.MAX_UNPROVEN_RESUME_FAILURES}) `
                                 + "— session kept, will retry");
@@ -6364,11 +6688,11 @@ export class Daemon extends EventEmitter {
                 // A fresh start that also failed retries once, as before. It never clears
                 // a session: nothing about a failed fresh launch says the stored
                 // conversation is unusable.
-                await this.killProcessTree();
+                await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                 await this.tmux.killWindow();
                 const retryAlive = await this.trySpawn(false, this.startupBudgetFor(false));
                 if (!retryAlive) {
-                    await this.killProcessTree();
+                    await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                     await this.tmux.killWindow();
                     throw new Error("CLI failed to start after retry");
                 }
@@ -6440,7 +6764,7 @@ export class Daemon extends EventEmitter {
         if (!this.backendOutage?.isActive(this.backendKey()))
             return;
         this.logger.warn("Backend unreachable — keeping the session and failing startup for a delayed retry");
-        await this.killProcessTree();
+        await this.killProcessTree("SIGTERM", "startup: backend unreachable");
         await this.tmux.killWindow();
         throw new BackendUnreachableStartupError(this.backendKey());
     }
@@ -6482,7 +6806,7 @@ export class Daemon extends EventEmitter {
             this.museUsageRelay = null;
         }
         try {
-            await this.killProcessTree();
+            await this.killProcessTree("SIGTERM", "startup aborted");
         }
         catch { /* nothing running */ }
         if (this.tmux) {
@@ -6509,12 +6833,13 @@ export class Daemon extends EventEmitter {
         }
     }
     /** Kill the entire process tree of the current tmux pane (CLI + MCP server). */
-    async killProcessTree(signal = "SIGTERM") {
+    async killProcessTree(signal = "SIGTERM", reason = "unspecified") {
         if (!this.tmux)
             return;
         try {
             const pid = await TmuxManager.getPanePid(this.tmuxSessionName, this.tmux.getWindowId());
             if (pid) {
+                this.noteStopRequest(signal, reason);
                 process.kill(-pid, signal);
                 this.logger.debug({ pid, signal }, "Killed process group");
             }
@@ -7074,7 +7399,16 @@ export class Daemon extends EventEmitter {
                 // CLI is ready (pattern defined by each backend). Require it on two
                 // consecutive polls: the first ready frame is also the moment a late
                 // dialog is about to be painted over it.
-                if (this.backend.getReadyPattern().test(pane)) {
+                const readyPatternMatches = this.backend.getReadyPattern().test(pane);
+                // Codex's broad prompt/footer regex is necessary for inline layouts,
+                // but startup must also prove that the current composer owns the
+                // footer. This matters when a usage-limit picker is being resolved:
+                // its old prompt can remain in scrollback while the reserve session is
+                // still transitioning. Once the live composer is back, do not keep the
+                // scan parked on the old limit text.
+                const codexReady = this.backend.binaryName !== "codex"
+                    || this.isCodexLivePaneSnapshot(pane);
+                if (readyPatternMatches && codexReady) {
                     cleanReadyPolls++;
                     if (cleanReadyPolls >= 2 || remaining() <= 0) {
                         // A real ready prompt (with no fatal dialog on screen — those are