@songsid/agend 2.1.6-beta.15 → 2.1.6-beta.16

package/dist/daemon.d.ts

@@ -217,9 +217,13 @@ export declare class BackendUnreachableStartupError extends Error {
  * prompt. A TUI that is still completing its first redraw can swallow Enter.
  *
  * Since the adaptive settle (see {@link waitForPasteSettle}) this value is the
- * *fallback* wait — it governs only deliveries where the pane's output cannot
- * be observed (no control mode, native-queue handoff, mid-wait reconnect, or a
- * paste that never visibly renders).
+ * *minimum* settle window for the first delivery — it prevents Enter from firing
+ * before the minimum elapses even when the paste's own render goes quiet early.
+ * For observed deliveries the quiet-exit path in waitForPasteSettle now checks
+ * `now >= fallbackDeadline`, so 1750ms governs every first delivery regardless
+ * of whether output is observed. For unobserved deliveries (no control mode,
+ * native-queue handoff, mid-wait reconnect, or a paste that never visibly
+ * renders) it is the flat fallback delay, same as before.
  */
 export declare class FirstDeliveryDelay {
     private readyAt;
@@ -256,9 +260,15 @@ export interface PasteSettleResult {
  * So: watch `lastOutputAt` and send Enter only once the paste's own render has
  * been quiet for {@link PASTE_QUIET_MS}. Bounded both ways —
  *
- * - never earlier than the legacy fixed delay when the paste produces no
- *   observable output at all (`usedFallback`), so panes that don't echo keep
- *   their long-standing behaviour;
+ * - never earlier than `fallbackMs` from settle start: `fallbackMs` is a
+ *   **minimum** settle window, not merely a fallback. For first deliveries
+ *   (fallbackMs = 1750ms) the compositor may render quickly then go quiet at
+ *   ~550ms while still initialising — the minimum ensures Enter is held until
+ *   1750ms regardless of observed output. This applies to every backend's first
+ *   delivery after ready, not only codex/Luna Reserve. For normal deliveries
+ *   (fallbackMs = 500ms ≈ PASTE_QUIET_MS) the minimum adds at most a few ms
+ *   and is effectively unchanged. When the paste produces no observable output
+ *   at all (`usedFallback`), the same `fallbackMs` deadline governs;
  * - never later than {@link PASTE_SETTLE_CAP_MS} after the paste (`capHit`),
  *   so a chatty pane cannot stall delivery.
  *
@@ -610,6 +620,14 @@ export declare class Daemon extends EventEmitter {
     getProcessStatus(): "running" | "crashed" | "stopped";
     get lastPausedAt(): number | null;
     private getPauseWakeState;
+    /**
+     * Codex can show an exhausted-account notice while the user is switching to
+     * a reserve account. Once the live composer and Context footer are back, the
+     * notice is scrollback, not a reason to pause and send /quit.
+     */
+    private isCodexLivePaneSnapshot;
+    /** Re-check the current pane after an async quota probe before pausing it. */
+    isCodexLivePane(): Promise<boolean>;
     /** Whether this instance is in a crash loop (3+ consecutive crashes). */
     get isCrashLoop(): boolean;
     /** The most recent error type detected by the error monitor (e.g. "rate_limit", "auth_error"). */
@@ -811,8 +829,33 @@ export declare class Daemon extends EventEmitter {
      * `y` as a brand-new user message.
      */
     private confirmBackendClearDialog;
+    /**
+     * The last time AgEnD itself asked the CLI to go away, and why (#927). Read
+     * when a pane dies, to tell "AgEnD stopped it" from "the CLI exited on its
+     * own" — a codex that exits 0 on its own and one AgEnD sent /quit look the
+     * same from the pane.
+     */
+    private lastStopRequest;
+    /** Record, and log, that AgEnD is about to stop the CLI. */
+    private noteStopRequest;
+    /** Capture the pane's recent output with escape codes stripped. Never throws. */
+    private capturePaneOutput;
+    /**
+     * One record per pane death: exit status, when, who, and what the CLI printed
+     * last — the line that was missing when a codex on Luna Reserve died with
+     * status 0 and daemon.log said only "exited normally" (#927). Logging only;
+     * the caller decides what happens next.
+     */
+    private logPaneDeath;
     /** Send the backend-specific graceful quit command/key sequence. */
     private sendQuitSequence;
+    /**
+     * Kiro drops `/quit` while a turn is running. Stop that turn first, then use
+     * the same delivery readiness gate that protects Enter from the busy pane.
+     * Returning false is fail-closed: the caller skips `/quit` and enters the
+     * bounded SIGTERM -> SIGKILL fallback instead of typing into an unknown pane.
+     */
+    private drainBusyKiroForStop;
     stop(): Promise<void>;
     getHangDetector(): HangDetector | null;
     getInstanceState(): InstanceState | "paused";

package/dist/daemon.js

@@ -435,6 +435,27 @@ const DELIVERY_SPAWN_RACE_MAX_ROUNDS = 3;
  */
 const MUSE_DIRECT_RESUME_IDLE_BUDGET_MS = 10 * 60_000;
 const MUSE_DIRECT_RESUME_IDLE_POLL_MS = 5_000;
+/** Kiro can drop /quit while a turn is running; cancel it and wait for its
+ * verified prompt before asking the native process to exit. Each instance is
+ * bounded so a fleet update can stop all daemons in parallel. */
+const KIRO_STOP_IDLE_BUDGET_MS = 15_000;
+const KIRO_STOP_QUIT_GRACE_MS = 5_000;
+const KIRO_STOP_SIGTERM_GRACE_MS = 2_000;
+/**
+ * How recently AgEnD must have asked the CLI to stop for a pane death to be
+ * attributed to AgEnD rather than to the CLI itself (#927). Covers the longest
+ * quit grace plus the SIGTERM/SIGKILL fallback, and one health tick more.
+ */
+const STOP_ATTRIBUTION_WINDOW_MS = 90_000;
+/** Lines of pane output kept with a death record: enough for a vendor error. */
+const DEATH_OUTPUT_LINES = 20;
+/** The last `lines` non-empty lines of a captured pane, escape codes already stripped. */
+function paneTail(output, lines = DEATH_OUTPUT_LINES) {
+    if (!output)
+        return undefined;
+    const tail = output.split("\n").filter(line => line.trim()).slice(-lines).join("\n");
+    return tail ? tail.slice(-2_000) : undefined;
+}
 /**
  * Startup failed because the CLI's backend is unreachable (see backend-outage.ts).
  * The session-id is deliberately KEPT; the fleet schedules a delayed retry.
@@ -498,9 +519,13 @@ const SPAWN_SETTLE_MAX_WAIT_MS = 60_000;
  * prompt. A TUI that is still completing its first redraw can swallow Enter.
  *
  * Since the adaptive settle (see {@link waitForPasteSettle}) this value is the
- * *fallback* wait — it governs only deliveries where the pane's output cannot
- * be observed (no control mode, native-queue handoff, mid-wait reconnect, or a
- * paste that never visibly renders).
+ * *minimum* settle window for the first delivery — it prevents Enter from firing
+ * before the minimum elapses even when the paste's own render goes quiet early.
+ * For observed deliveries the quiet-exit path in waitForPasteSettle now checks
+ * `now >= fallbackDeadline`, so 1750ms governs every first delivery regardless
+ * of whether output is observed. For unobserved deliveries (no control mode,
+ * native-queue handoff, mid-wait reconnect, or a paste that never visibly
+ * renders) it is the flat fallback delay, same as before.
  */
 export class FirstDeliveryDelay {
     readyAt = 0;
@@ -537,9 +562,15 @@ const PASTE_SETTLE_POLL_MS = 100;
  * So: watch `lastOutputAt` and send Enter only once the paste's own render has
  * been quiet for {@link PASTE_QUIET_MS}. Bounded both ways —
  *
- * - never earlier than the legacy fixed delay when the paste produces no
- *   observable output at all (`usedFallback`), so panes that don't echo keep
- *   their long-standing behaviour;
+ * - never earlier than `fallbackMs` from settle start: `fallbackMs` is a
+ *   **minimum** settle window, not merely a fallback. For first deliveries
+ *   (fallbackMs = 1750ms) the compositor may render quickly then go quiet at
+ *   ~550ms while still initialising — the minimum ensures Enter is held until
+ *   1750ms regardless of observed output. This applies to every backend's first
+ *   delivery after ready, not only codex/Luna Reserve. For normal deliveries
+ *   (fallbackMs = 500ms ≈ PASTE_QUIET_MS) the minimum adds at most a few ms
+ *   and is effectively unchanged. When the paste produces no observable output
+ *   at all (`usedFallback`), the same `fallbackMs` deadline governs;
  * - never later than {@link PASTE_SETTLE_CAP_MS} after the paste (`capHit`),
  *   so a chatty pane cannot stall delivery.
  *
@@ -563,7 +594,13 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
         const last = client.getLastOutputAt(windowId);
         if (last != null && last > pasteStartedAt) {
             observed = true;
-            if (now - last >= PASTE_QUIET_MS) {
+            // Quiet for PASTE_QUIET_MS AND the minimum settle window has elapsed.
+            // The minimum (fallbackDeadline) is the key fix for Luna Reserve: the
+            // TUI's first compositor render produces output quickly then goes quiet,
+            // but Enter sent at the 500ms quiet point lands while the compositor is
+            // still initialising and is swallowed. Holding until fallbackDeadline
+            // (1750ms for first deliveries, 500ms for normal ones) eliminates the race.
+            if (now - last >= PASTE_QUIET_MS && now >= fallbackDeadline) {
                 return { settleMs: now - settleStart, observedPostPasteOutput: true, capHit: false, usedFallback: false };
             }
         }
@@ -575,9 +612,12 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
         }
         // Sleep to the next decision point, at most one poll tick — so the normal
         // paths return at their exact deadlines instead of a poll-width late.
+        // When output has been observed but we are still inside the minimum window,
+        // sleep to the later of (last quiet deadline) and (fallback deadline) so
+        // the loop does not busy-spin between quiet and minimum.
         let wake = capDeadline;
         if (last != null && last > pasteStartedAt)
-            wake = Math.min(wake, last + PASTE_QUIET_MS);
+            wake = Math.min(wake, Math.max(last + PASTE_QUIET_MS, fallbackDeadline));
         else
             wake = Math.min(wake, fallbackDeadline);
         await new Promise(r => setTimeout(r, Math.min(PASTE_SETTLE_POLL_MS, Math.max(1, wake - now))));
@@ -1117,6 +1157,42 @@ export class Daemon extends EventEmitter {
     }
     get lastPausedAt() { return this.autoPauseController.lastPausedAt; }
     getPauseWakeState() { return this.pauseWakeState; }
+    /**
+     * Codex can show an exhausted-account notice while the user is switching to
+     * a reserve account. Once the live composer and Context footer are back, the
+     * notice is scrollback, not a reason to pause and send /quit.
+     */
+    isCodexLivePaneSnapshot(pane) {
+        if (this.backend?.binaryName !== "codex")
+            return false;
+        try {
+            if (this.backend.isDeliveryInputReadyPane?.(pane) !== true)
+                return false;
+            const busy = this.backend.getBusyPattern?.();
+            if (busy) {
+                busy.lastIndex = 0;
+                if (busy.test(pane))
+                    return false;
+            }
+            const ready = this.backend.getReadyPattern();
+            ready.lastIndex = 0;
+            return ready.test(pane);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Re-check the current pane after an async quota probe before pausing it. */
+    async isCodexLivePane() {
+        if (this.backend?.binaryName !== "codex" || !this.tmux)
+            return false;
+        try {
+            return this.isCodexLivePaneSnapshot(await this.tmux.capturePane());
+        }
+        catch {
+            return false;
+        }
+    }
     /** Whether this instance is in a crash loop (3+ consecutive crashes). */
     get isCrashLoop() {
         return this.crashCount >= 3;
@@ -1888,6 +1964,9 @@ export class Daemon extends EventEmitter {
                     // Normal exit (e.g. user Ctrl+C or /exit) — no crash, no respawn
                     if (paneStatus && exitCode === 0) {
                         this.setProcessStatus("stopped");
+                        // Status 0 is not proof of a clean exit: a codex that hits a quota
+                        // wall exits 0 too. Capture what it printed before the window goes.
+                        this.logPaneDeath(cliLabel, exitCode, await this.capturePaneOutput());
                         this.logger.info("CLI exited normally (code 0) — pausing health check");
                         await this.tmux.killWindow();
                         this.healthCheckPaused = true;
@@ -1964,6 +2043,7 @@ export class Daemon extends EventEmitter {
                         lastOutput = cleaned.trimEnd() || undefined;
                     }
                     catch { /* best effort — pane may already be gone */ }
+                    this.logPaneDeath(cliLabel, exitCode, lastOutput);
                     // Kill the dead window (remain-on-exit keeps it around) before respawn
                     if (paneStatus) {
                         await this.tmux.killWindow();
@@ -2035,7 +2115,7 @@ export class Daemon extends EventEmitter {
                     this.crashTimestamps = this.crashTimestamps.filter(t => t > Date.now() - crashWindowMs);
                     if (this.crashTimestamps.length >= 3) {
                         this.healthCheckPaused = true;
-                        this.logger.error({ crashesInWindow: this.crashTimestamps.length }, "3+ crashes in 5 minutes — pausing respawn");
+                        this.logger.error({ crashesInWindow: this.crashTimestamps.length, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "3+ crashes in 5 minutes — pausing respawn");
                         // P1: Persist crash state so next process restart skips resume
                         try {
                             writeFileSync(join(this.instanceDir, "crash-state.json"), JSON.stringify({
@@ -2055,7 +2135,7 @@ export class Daemon extends EventEmitter {
                     this.crashCount++;
                     this.lastCrashAt = Date.now();
                     if (this.crashCount > max_retries) {
-                        this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries }, "Max crash retries exceeded — not respawning");
+                        this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "Max crash retries exceeded — not respawning");
                         this.healthCheckPaused = true;
                         this.emitSupervisionEnded(`it crashed ${this.crashCount} times, exceeding restart_policy.max_retries (${max_retries})`, "Check the logs for the cause, then restart it.");
                         return; // don't schedule next — given up
@@ -2359,6 +2439,7 @@ export class Daemon extends EventEmitter {
         // rebaselining the occurrence count while the error is still displayed — one
         // notification, a false recovery log, then silence.
         const looksReady = () => !busyPattern?.test(pane) && readyPattern.test(pane);
+        const codexLivePane = this.isCodexLivePaneSnapshot(pane);
         // State: waiting for recovery. A missing/outdated ready pattern must not
         // suppress every future error forever, so the gate has a hard deadline.
         if (this.errorWaitingForRecovery) {
@@ -2422,6 +2503,17 @@ export class Daemon extends EventEmitter {
             const key = Daemon.errorPatternKey(ep);
             const count = countMatches(ep.pattern);
             const seen = this.lastErrorCount.get(key) ?? 0;
+            // The generic Codex usage-limit line remains in scrollback after the
+            // user selects Luna Reserve. A live composer + Context footer is positive
+            // evidence that the pane recovered; baseline the stale occurrence so it
+            // cannot reach the destructive quota pause path.
+            if (codexLivePane && ep.type === "quota" && ep.action === "pause"
+                && ep.message.startsWith("Codex usage limit reached")) {
+                if (count > 0)
+                    this.lastErrorCount.set(key, count);
+                this.logger.debug("Codex usage-limit text is stale — live reserve pane is running");
+                continue;
+            }
             if (count <= seen) {
                 // Occurrences scrolled out of the capture buffer → lower the baseline
                 // so a future re-occurrence still counts as new (no permanent suppress).
@@ -2616,12 +2708,61 @@ export class Daemon extends EventEmitter {
         // is a successful no-op here, not an error.
         this.logger.debug({ dialog: dialog.description }, "Backend clear dialog did not appear");
     }
+    /**
+     * The last time AgEnD itself asked the CLI to go away, and why (#927). Read
+     * when a pane dies, to tell "AgEnD stopped it" from "the CLI exited on its
+     * own" — a codex that exits 0 on its own and one AgEnD sent /quit look the
+     * same from the pane.
+     */
+    lastStopRequest = null;
+    /** Record, and log, that AgEnD is about to stop the CLI. */
+    noteStopRequest(via, reason) {
+        this.lastStopRequest = { via, reason, at: Date.now() };
+        this.logger.info({ via, reason }, `AgEnD is stopping the CLI: ${via} (${reason})`);
+    }
+    /** Capture the pane's recent output with escape codes stripped. Never throws. */
+    async capturePaneOutput() {
+        try {
+            const raw = await this.tmux?.capturePaneWithHistory(50);
+            const cleaned = raw?.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+            return cleaned?.trimEnd() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * One record per pane death: exit status, when, who, and what the CLI printed
+     * last — the line that was missing when a codex on Luna Reserve died with
+     * status 0 and daemon.log said only "exited normally" (#927). Logging only;
+     * the caller decides what happens next.
+     */
+    logPaneDeath(cliLabel, exitCode, lastOutput) {
+        const request = this.lastStopRequest;
+        const sinceStopMs = request ? Date.now() - request.at : null;
+        const byAgend = request !== null && sinceStopMs !== null && sinceStopMs <= STOP_ATTRIBUTION_WINDOW_MS;
+        const record = {
+            exitCode: exitCode ?? null,
+            diedAt: new Date().toISOString(),
+            initiatedBy: byAgend ? "agend" : "cli",
+            ...(byAgend ? { stopVia: request.via, stopReason: request.reason, sinceStopMs } : {}),
+            lastOutput: paneTail(lastOutput) ?? null,
+        };
+        if (byAgend) {
+            this.logger.info(record, `${cliLabel} exited after AgEnD stopped it (${request.via}: ${request.reason})`);
+        }
+        else {
+            this.logger.warn(record, `${cliLabel} exited on its own (exit code ${exitCode ?? "unknown"}) — last output recorded`);
+        }
+    }
     /** Send the backend-specific graceful quit command/key sequence. */
-    async sendQuitSequence() {
+    async sendQuitSequence(reason = "unspecified") {
         if (!this.tmux || !this.backend)
             return false;
         const quitCmd = this.backend.getQuitCommand();
         const quitKey = this.backend.getQuitKey?.();
+        if (quitCmd || quitKey)
+            this.noteStopRequest(quitCmd ? `quit command ${quitCmd}` : `quit key ${quitKey}`, reason);
         if (quitCmd) {
             if (!await this.tmux.sendKeys(quitCmd))
                 return false;
@@ -2642,6 +2783,26 @@ export class Daemon extends EventEmitter {
         }
         return true;
     }
+    /**
+     * Kiro drops `/quit` while a turn is running. Stop that turn first, then use
+     * the same delivery readiness gate that protects Enter from the busy pane.
+     * Returning false is fail-closed: the caller skips `/quit` and enters the
+     * bounded SIGTERM -> SIGKILL fallback instead of typing into an unknown pane.
+     */
+    async drainBusyKiroForStop(windowId) {
+        if (this.backend?.binaryName !== "kiro-cli")
+            return true;
+        const readiness = await this.paneReadinessForDelivery(windowId);
+        if (readiness === "ready")
+            return true;
+        if (readiness !== "busy")
+            return false;
+        const cancelKey = this.backend.getCancelKey?.() ?? "Escape";
+        const sent = await this.tmux?.sendSpecialKey(cancelKey);
+        if (!sent)
+            return false;
+        return this.waitForPaneReadyForDelivery(windowId, KIRO_STOP_IDLE_BUDGET_MS);
+    }
     async stop() {
         this.logger.info("Stopping daemon instance");
         this.turnReplyGuard.reset();
@@ -2667,11 +2828,18 @@ export class Daemon extends EventEmitter {
             this.saveSessionId();
             this.healthCheckPaused = true;
             let killed = false;
-            const quitSent = await this.sendQuitSequence();
+            const windowId = this.tmux.getWindowId();
+            const kiroReady = windowId ? await this.drainBusyKiroForStop(windowId) : true;
+            const quitSent = kiroReady && await this.sendQuitSequence("graceful stop");
+            const quitGraceMs = this.backend?.binaryName === "kiro-cli"
+                ? KIRO_STOP_QUIT_GRACE_MS : 3_000;
+            const sigtermGraceMs = this.backend?.binaryName === "kiro-cli"
+                ? KIRO_STOP_SIGTERM_GRACE_MS : 1_000;
             if (quitSent) {
-                // Wait up to 3s for graceful exit, polling every 200ms. A healthy CLI
+                // Wait up to the backend's bounded graceful-exit window, polling every
+                // 200ms. A healthy CLI
                 // exits within ~1s; a longer wait just delays the force-kill fallback.
-                for (let i = 0; i < 15; i++) {
+                for (let elapsed = 0; elapsed < quitGraceMs; elapsed += 200) {
                     await new Promise(r => setTimeout(r, 200));
                     const status = await this.tmux.getPaneStatus();
                     if (!status || !status.alive) {
@@ -2681,9 +2849,9 @@ export class Daemon extends EventEmitter {
                 }
             }
             if (!killed) {
-                this.logger.warn({ quitSent }, "CLI did not exit gracefully within 3s — falling back to SIGTERM");
-                await this.killProcessTree("SIGTERM");
-                for (let i = 0; i < 5; i++) {
+                this.logger.warn({ quitSent, quitGraceMs }, "CLI did not exit gracefully within its bounded quit grace — falling back to SIGTERM");
+                await this.killProcessTree("SIGTERM", "graceful stop: the CLI outlived its quit grace");
+                for (let elapsed = 0; elapsed < sigtermGraceMs; elapsed += 200) {
                     await new Promise(r => setTimeout(r, 200));
                     const status = await this.tmux.getPaneStatus();
                     if (!status || !status.alive) {
@@ -2694,7 +2862,7 @@ export class Daemon extends EventEmitter {
             }
             if (!killed) {
                 this.logger.warn("CLI process tree survived SIGTERM — falling back to SIGKILL");
-                await this.killProcessTree("SIGKILL");
+                await this.killProcessTree("SIGKILL", "graceful stop: the CLI survived SIGTERM");
                 await new Promise(r => setTimeout(r, 200));
             }
             // Always kill window — remain-on-exit keeps dead panes around after CLI exits
@@ -2796,6 +2964,9 @@ export class Daemon extends EventEmitter {
         // into an ordinary idle-timeout pause of a busy instance.
         const allowStuck = this.pauseAllowStuck;
         this.pauseAllowStuck = false;
+        // Why this pause, for the stop record (#927): an idle pause and an
+        // auth-deferred one look the same from the pane.
+        const pauseReason = allowStuck ? "pause (auth-deferred, stuck pane)" : "pause (idle)";
         const pausableState = this.instanceState === "idle"
             || (allowStuck && this.instanceState === "stuck");
         if (!pausableState || this.pasteQueueDepth > 0) {
@@ -2808,7 +2979,7 @@ export class Daemon extends EventEmitter {
         const transition = (async () => {
             try {
                 this.saveSessionId();
-                await this.sendQuitSequence();
+                await this.sendQuitSequence(pauseReason);
                 let exited = false;
                 for (let i = 0; i < 15; i++) {
                     await new Promise(r => setTimeout(r, 200));
@@ -2819,11 +2990,11 @@ export class Daemon extends EventEmitter {
                     }
                 }
                 if (!exited) {
-                    await this.killProcessTree("SIGTERM");
+                    await this.killProcessTree("SIGTERM", `${pauseReason}: the CLI outlived its quit grace`);
                     await new Promise(r => setTimeout(r, 1_000));
                     const status = await this.tmux?.getPaneStatus();
                     if (status?.alive) {
-                        await this.killProcessTree("SIGKILL");
+                        await this.killProcessTree("SIGKILL", `${pauseReason}: the CLI survived SIGTERM`);
                         await new Promise(r => setTimeout(r, 200));
                     }
                 }
@@ -4516,8 +4687,18 @@ export class Daemon extends EventEmitter {
                 this.logger.warn({ phase, generation }, "Spawn changed during the input-availability probe — refusing to send Enter into the replacement pane");
                 return false;
             }
-            if (probe.state === "clear")
+            if (probe.state === "clear") {
+                // Re-arm the first-delivery delay when a transient was actually observed
+                // and then cleared, but ONLY from the pre-write phase. That phase runs
+                // before consume() in writeMessageToPane, so the re-arm benefits the
+                // current delivery's paste settle. Enter-path callers (initial-submit,
+                // retries) run after consume() — re-arming there would leave the flag
+                // for the NEXT unrelated delivery, which must not be slowed.
+                if (observedDescription !== null && phase === "pre-write") {
+                    this.firstDeliveryDelay.recordReady();
+                }
                 return true;
+            }
             if (probe.state === "active" && observedDescription !== probe.transient.description) {
                 observedDescription = probe.transient.description;
                 this.logger.info({ phase, transient: probe.transient.description, generation }, "CLI is still completing startup — waiting before sending Enter");
@@ -6464,7 +6645,7 @@ export class Daemon extends EventEmitter {
                 await this.failStartupIfBackendUnreachable();
                 if (this.backend.retriesResumeOnStartupFailure?.() !== false) {
                     this.logger.warn("Resume startup failed — retrying resume once before abandoning the session");
-                    await this.killProcessTree();
+                    await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                     await this.tmux.killWindow();
                     alive = await this.trySpawn(false, resumeBudget);
                     if (!alive) {
@@ -6490,7 +6671,7 @@ export class Daemon extends EventEmitter {
                         if (this.unprovenResumeFailures < Daemon.MAX_UNPROVEN_RESUME_FAILURES) {
                             // Keep the session and fail this attempt; the fleet retries with
                             // backoff, which is also how the backend-outage path behaves.
-                            await this.killProcessTree();
+                            await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                             await this.tmux.killWindow();
                             throw new Error(`CLI startup failed with a session to resume (attempt ${this.unprovenResumeFailures}/${Daemon.MAX_UNPROVEN_RESUME_FAILURES}) `
                                 + "— session kept, will retry");
@@ -6507,11 +6688,11 @@ export class Daemon extends EventEmitter {
                 // A fresh start that also failed retries once, as before. It never clears
                 // a session: nothing about a failed fresh launch says the stored
                 // conversation is unusable.
-                await this.killProcessTree();
+                await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                 await this.tmux.killWindow();
                 const retryAlive = await this.trySpawn(false, this.startupBudgetFor(false));
                 if (!retryAlive) {
-                    await this.killProcessTree();
+                    await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                     await this.tmux.killWindow();
                     throw new Error("CLI failed to start after retry");
                 }
@@ -6583,7 +6764,7 @@ export class Daemon extends EventEmitter {
         if (!this.backendOutage?.isActive(this.backendKey()))
             return;
         this.logger.warn("Backend unreachable — keeping the session and failing startup for a delayed retry");
-        await this.killProcessTree();
+        await this.killProcessTree("SIGTERM", "startup: backend unreachable");
         await this.tmux.killWindow();
         throw new BackendUnreachableStartupError(this.backendKey());
     }
@@ -6625,7 +6806,7 @@ export class Daemon extends EventEmitter {
             this.museUsageRelay = null;
         }
         try {
-            await this.killProcessTree();
+            await this.killProcessTree("SIGTERM", "startup aborted");
         }
         catch { /* nothing running */ }
         if (this.tmux) {
@@ -6652,12 +6833,13 @@ export class Daemon extends EventEmitter {
         }
     }
     /** Kill the entire process tree of the current tmux pane (CLI + MCP server). */
-    async killProcessTree(signal = "SIGTERM") {
+    async killProcessTree(signal = "SIGTERM", reason = "unspecified") {
         if (!this.tmux)
             return;
         try {
             const pid = await TmuxManager.getPanePid(this.tmuxSessionName, this.tmux.getWindowId());
             if (pid) {
+                this.noteStopRequest(signal, reason);
                 process.kill(-pid, signal);
                 this.logger.debug({ pid, signal }, "Killed process group");
             }
@@ -7217,7 +7399,16 @@ export class Daemon extends EventEmitter {
                 // CLI is ready (pattern defined by each backend). Require it on two
                 // consecutive polls: the first ready frame is also the moment a late
                 // dialog is about to be painted over it.
-                if (this.backend.getReadyPattern().test(pane)) {
+                const readyPatternMatches = this.backend.getReadyPattern().test(pane);
+                // Codex's broad prompt/footer regex is necessary for inline layouts,
+                // but startup must also prove that the current composer owns the
+                // footer. This matters when a usage-limit picker is being resolved:
+                // its old prompt can remain in scrollback while the reserve session is
+                // still transitioning. Once the live composer is back, do not keep the
+                // scan parked on the old limit text.
+                const codexReady = this.backend.binaryName !== "codex"
+                    || this.isCodexLivePaneSnapshot(pane);
+                if (readyPatternMatches && codexReady) {
                     cleanReadyPolls++;
                     if (cleanReadyPolls >= 2 || remaining() <= 0) {
                         // A real ready prompt (with no fatal dialog on screen — those are