@songsid/agend 2.1.6-beta.9 → 2.1.7-beta.1

package/dist/daemon.js

@@ -29,6 +29,7 @@ import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata,
 import { bottomRowIsReady, inputAreaText, inputShowsPastedText, pastedTextSignature, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
 import { TurnReplyGuard } from "./turn-reply-guard.js";
 import { t } from "./locale.js";
+import { MuseUsageRelay, clearMuseUsageSnapshot } from "./muse-usage-relay.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -36,9 +37,15 @@ const CROSS_INSTANCE_TOOLS = new Set(["send_to_instance", "list_instances", "sta
 const SCHEDULE_TOOLS = new Set(["create_schedule", "list_schedules", "update_schedule", "delete_schedule"]);
 const DECISION_TOOLS = new Set(["post_decision", "list_decisions", "update_decision"]);
 const TASK_TOOL = "task";
-// Tools whose success proves the agent got a message out this turn. While any
-// of these succeeded, a dead-MCP proxy reply would double-post — suppress it.
-const TURN_REPLY_TOOLS = new Set(["reply", "send_to_instance", "report_result", "request_information", "delegate_task", "broadcast"]);
+// Tools whose success proves the agent performed an outbound action this turn.
+// While any of these succeeded, a dead-MCP proxy reply would duplicate output.
+const TURN_OUTBOUND_TOOLS = new Set([
+    "reply", "react", "edit_message", "send_to_instance", "report_result",
+    "request_information", "delegate_task", "broadcast",
+]);
+// These actions reach the human-facing channel and satisfy reply-completion:
+// a deliberate reaction or edit is a valid response even without new text.
+const TURN_COMPLETION_TOOLS = new Set(["reply", "react", "edit_message"]);
 const REPLY_DROP_WARNING_COOLDOWN_MS = 5 * 60_000;
 const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. Use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, send a brief acknowledgement. Do not reply to this system instruction except through the reply tool.";
 /** Point a resumed CLI at its one backend-native instruction source. */
@@ -398,6 +405,8 @@ export class PendingWorkTracker {
 const NORMAL_ENTER_SETTLE_MS = 500;
 /** How long to keep looking for proof after a retry Enter before failing it. */
 const POST_ENTER_PROOF_WINDOW_MS = 3_000;
+/** A final bounded observation before an ambiguous Codex submit can be classified. */
+const CODEX_LATE_PROOF_MS = 5_000;
 const POST_ENTER_PROOF_POLL_MS = 250;
 /** Attempts to read the pre-paste pane before a delivery gives up on a baseline. */
 const BASELINE_CAPTURE_ATTEMPTS = 3;
@@ -422,6 +431,37 @@ const STARTUP_DIALOG_BUDGET_MS = 30_000;
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
 /** How many "dialog painted just before the write → wait → retry" rounds a delivery tolerates. */
 const LATE_DIALOG_WRITE_ROUNDS = 3;
+/** How many times a delivery redoes itself when a spawn starts between its settle wait and its pane write. */
+const DELIVERY_SPAWN_RACE_MAX_ROUNDS = 3;
+/**
+ * After relay exhaustion, how long to wait for an authoritatively idle pane
+ * before giving up the immediate resume-direct (the fallback flag and the
+ * notification already cover the next natural restart). Muse turns can run
+ * for many minutes; polling keeps each check a fresh capture.
+ */
+const MUSE_DIRECT_RESUME_IDLE_BUDGET_MS = 10 * 60_000;
+const MUSE_DIRECT_RESUME_IDLE_POLL_MS = 5_000;
+/** Kiro can drop /quit while a turn is running; cancel it and wait for its
+ * verified prompt before asking the native process to exit. Each instance is
+ * bounded so a fleet update can stop all daemons in parallel. */
+const KIRO_STOP_IDLE_BUDGET_MS = 15_000;
+const KIRO_STOP_QUIT_GRACE_MS = 5_000;
+const KIRO_STOP_SIGTERM_GRACE_MS = 2_000;
+/**
+ * How recently AgEnD must have asked the CLI to stop for a pane death to be
+ * attributed to AgEnD rather than to the CLI itself (#927). Covers the longest
+ * quit grace plus the SIGTERM/SIGKILL fallback, and one health tick more.
+ */
+const STOP_ATTRIBUTION_WINDOW_MS = 90_000;
+/** Lines of pane output kept with a death record: enough for a vendor error. */
+const DEATH_OUTPUT_LINES = 20;
+/** The last `lines` non-empty lines of a captured pane, escape codes already stripped. */
+function paneTail(output, lines = DEATH_OUTPUT_LINES) {
+    if (!output)
+        return undefined;
+    const tail = output.split("\n").filter(line => line.trim()).slice(-lines).join("\n");
+    return tail ? tail.slice(-2_000) : undefined;
+}
 /**
  * Startup failed because the CLI's backend is unreachable (see backend-outage.ts).
  * The session-id is deliberately KEPT; the fleet schedules a delayed retry.
@@ -436,6 +476,10 @@ export class BackendUnreachableStartupError extends Error {
 }
 /** Bounded wait (under the pane lock) for the prompt to return before retrying a dropped Enter. */
 const STRANDED_RETRY_READY_WAIT_MS = 30_000;
+/** A pasted Kiro message may be processing for longer than the retry window. */
+const KIRO_SUBMISSION_OBSERVE_MS = 10 * 60_000;
+const KIRO_SUBMISSION_POLL_MS = 1_000;
+const KIRO_SUBMISSION_UNREADABLE_POLLS = 40;
 /** A passive startup phase must clear within this bound before an Enter is sent. */
 /**
  * How long a passive startup/resume transient may sit WITHOUT REPAINTING before
@@ -457,6 +501,15 @@ const INPUT_TRANSIENT_WAIT_MS = 10 * 60_000;
 const INPUT_TRANSIENT_POLL_MS = 250;
 /** Max "stranded text → submit → wait for prompt → re-check" rounds per delivery; each may send one recovery Enter. */
 const STRANDED_INPUT_MAX_ROUNDS = 3;
+/** Build a status holder from channel metadata, keeping chat and thread apart. */
+function channelStatus(meta) {
+    const chatId = meta.chat_id;
+    const messageId = meta.message_id;
+    if (!chatId || !messageId)
+        return undefined;
+    const threadId = meta.thread_id || undefined;
+    return threadId ? { chatId, messageId, threadId } : { chatId, messageId };
+}
 const FIRST_ENTER_SETTLE_MS = 1_750;
 const FIRST_DELIVERY_WINDOW_MS = 5_000;
 /** After busy native-queue paste+Enter, wait before checking the pane for silent loss. */
@@ -481,9 +534,13 @@ const SPAWN_SETTLE_MAX_WAIT_MS = 60_000;
  * prompt. A TUI that is still completing its first redraw can swallow Enter.
  *
  * Since the adaptive settle (see {@link waitForPasteSettle}) this value is the
- * *fallback* wait — it governs only deliveries where the pane's output cannot
- * be observed (no control mode, native-queue handoff, mid-wait reconnect, or a
- * paste that never visibly renders).
+ * *minimum* settle window for the first delivery — it prevents Enter from firing
+ * before the minimum elapses even when the paste's own render goes quiet early.
+ * For observed deliveries the quiet-exit path in waitForPasteSettle now checks
+ * `now >= fallbackDeadline`, so 1750ms governs every first delivery regardless
+ * of whether output is observed. For unobserved deliveries (no control mode,
+ * native-queue handoff, mid-wait reconnect, or a paste that never visibly
+ * renders) it is the flat fallback delay, same as before.
  */
 export class FirstDeliveryDelay {
     readyAt = 0;
@@ -520,9 +577,15 @@ const PASTE_SETTLE_POLL_MS = 100;
  * So: watch `lastOutputAt` and send Enter only once the paste's own render has
  * been quiet for {@link PASTE_QUIET_MS}. Bounded both ways —
  *
- * - never earlier than the legacy fixed delay when the paste produces no
- *   observable output at all (`usedFallback`), so panes that don't echo keep
- *   their long-standing behaviour;
+ * - never earlier than `fallbackMs` from settle start: `fallbackMs` is a
+ *   **minimum** settle window, not merely a fallback. For first deliveries
+ *   (fallbackMs = 1750ms) the compositor may render quickly then go quiet at
+ *   ~550ms while still initialising — the minimum ensures Enter is held until
+ *   1750ms regardless of observed output. This applies to every backend's first
+ *   delivery after ready, not only codex/Luna Reserve. For normal deliveries
+ *   (fallbackMs = 500ms ≈ PASTE_QUIET_MS) the minimum adds at most a few ms
+ *   and is effectively unchanged. When the paste produces no observable output
+ *   at all (`usedFallback`), the same `fallbackMs` deadline governs;
  * - never later than {@link PASTE_SETTLE_CAP_MS} after the paste (`capHit`),
  *   so a chatty pane cannot stall delivery.
  *
@@ -546,7 +609,13 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
         const last = client.getLastOutputAt(windowId);
         if (last != null && last > pasteStartedAt) {
             observed = true;
-            if (now - last >= PASTE_QUIET_MS) {
+            // Quiet for PASTE_QUIET_MS AND the minimum settle window has elapsed.
+            // The minimum (fallbackDeadline) is the key fix for Luna Reserve: the
+            // TUI's first compositor render produces output quickly then goes quiet,
+            // but Enter sent at the 500ms quiet point lands while the compositor is
+            // still initialising and is swallowed. Holding until fallbackDeadline
+            // (1750ms for first deliveries, 500ms for normal ones) eliminates the race.
+            if (now - last >= PASTE_QUIET_MS && now >= fallbackDeadline) {
                 return { settleMs: now - settleStart, observedPostPasteOutput: true, capHit: false, usedFallback: false };
             }
         }
@@ -558,16 +627,19 @@ export async function waitForPasteSettle(client, windowId, pasteStartedAt, fallb
         }
         // Sleep to the next decision point, at most one poll tick — so the normal
         // paths return at their exact deadlines instead of a poll-width late.
+        // When output has been observed but we are still inside the minimum window,
+        // sleep to the later of (last quiet deadline) and (fallback deadline) so
+        // the loop does not busy-spin between quiet and minimum.
         let wake = capDeadline;
         if (last != null && last > pasteStartedAt)
-            wake = Math.min(wake, last + PASTE_QUIET_MS);
+            wake = Math.min(wake, Math.max(last + PASTE_QUIET_MS, fallbackDeadline));
         else
             wake = Math.min(wake, fallbackDeadline);
         await new Promise(r => setTimeout(r, Math.min(PASTE_SETTLE_POLL_MS, Math.max(1, wake - now))));
     }
 }
 /** Redact likely credentials and control sequences before pane text reaches logs. */
-export function sanitizePaneTail(pane, lineCount = 5) {
+export function sanitizePaneTail(pane, lineCount = 5, excludeLine) {
     const secretAssignment = /\b(token|secret|password|passwd|api[_-]?key|authorization)\b\s*[:=]\s*\S+/gi;
     const bearer = /\bBearer\s+\S+/gi;
     const knownToken = /\b(?:sk-[A-Za-z0-9_-]+|ghp_[A-Za-z0-9]+|github_pat_[A-Za-z0-9_]+|AKIA[A-Z0-9]{16})\b/g;
@@ -580,6 +652,10 @@ export function sanitizePaneTail(pane, lineCount = 5) {
         lines.pop();
     return lines
         .slice(-lineCount)
+        // The proxy-reply chrome predicate sees only control-normalized lines,
+        // but must run BEFORE redaction. Redaction can replace a status-footer
+        // session UUID with [REDACTED], destroying its structural signature.
+        .filter(line => !excludeLine?.(line))
         .map(line => line
         .replace(bearer, "Bearer [REDACTED]")
         .replace(secretAssignment, "$1=[REDACTED]")
@@ -596,12 +672,14 @@ export function sanitizePaneTail(pane, lineCount = 5) {
  * final answer exists only on screen. Everything up to and including the last
  * line of the inbound message we pasted is cut (the reply starts after it),
  * lines with no letters or digits are dropped (borders, separators, spinners,
- * bare prompts), and the ready-prompt line is dropped by pattern. Returns null
- * when what remains is trivial — a proxy message must carry an answer, not
- * chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
+ * bare prompts), and UI chrome is dropped by a backend-specific per-line
+ * filter when available (or a legacy single-line ready pattern). Whole-pane
+ * readiness regexes cannot identify individual prompt/footer lines. Returns
+ * null when what remains is trivial — a proxy message must carry an answer,
+ * not chrome. Secrets are redacted by sanitizePaneTail, same as stuck diagnostics.
  */
 export function extractProxyReplyText(pane, opts = {}) {
-    const lines = sanitizePaneTail(pane, opts.maxLines ?? 40);
+    const lines = sanitizePaneTail(pane, opts.maxLines ?? 40, opts.isChromeLine);
     const marker = opts.inboundMarker?.trim();
     // Require a distinctive marker: a short one ("ok") would match agent text.
     if (marker && marker.length >= 8) {
@@ -970,6 +1048,11 @@ export class Daemon extends EventEmitter {
     fatalStartupBlocked = false;
     /** model_error seen mid-turn: notify only if it survives to the idle screen. */
     pendingModelErrorKey = null;
+    /** Optional per-instance localhost relay used to observe Muse usage events. */
+    museUsageRelay = null;
+    /** Set after an in-run relay failure so subsequent Muse respawns go direct. */
+    museRelayFallback = false;
+    museRelayFallbackInFlight = null;
     /**
      * Let the next pause() proceed from a stuck pane. Set only for the auth-deferred
      * pause — see the pausePending consumption site for why waiting for idle there
@@ -1089,6 +1172,42 @@ export class Daemon extends EventEmitter {
     }
     get lastPausedAt() { return this.autoPauseController.lastPausedAt; }
     getPauseWakeState() { return this.pauseWakeState; }
+    /**
+     * Codex can show an exhausted-account notice while the user is switching to
+     * a reserve account. Once the live composer and Context footer are back, the
+     * notice is scrollback, not a reason to pause and send /quit.
+     */
+    isCodexLivePaneSnapshot(pane) {
+        if (this.backend?.binaryName !== "codex")
+            return false;
+        try {
+            if (this.backend.isDeliveryInputReadyPane?.(pane) !== true)
+                return false;
+            const busy = this.backend.getBusyPattern?.();
+            if (busy) {
+                busy.lastIndex = 0;
+                if (busy.test(pane))
+                    return false;
+            }
+            const ready = this.backend.getReadyPattern();
+            ready.lastIndex = 0;
+            return ready.test(pane);
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Re-check the current pane after an async quota probe before pausing it. */
+    async isCodexLivePane() {
+        if (this.backend?.binaryName !== "codex" || !this.tmux)
+            return false;
+        try {
+            return this.isCodexLivePaneSnapshot(await this.tmux.capturePane());
+        }
+        catch {
+            return false;
+        }
+    }
     /** Whether this instance is in a crash loop (3+ consecutive crashes). */
     get isCrashLoop() {
         return this.crashCount >= 3;
@@ -1860,6 +1979,9 @@ export class Daemon extends EventEmitter {
                     // Normal exit (e.g. user Ctrl+C or /exit) — no crash, no respawn
                     if (paneStatus && exitCode === 0) {
                         this.setProcessStatus("stopped");
+                        // Status 0 is not proof of a clean exit: a codex that hits a quota
+                        // wall exits 0 too. Capture what it printed before the window goes.
+                        this.logPaneDeath(cliLabel, exitCode, await this.capturePaneOutput());
                         this.logger.info("CLI exited normally (code 0) — pausing health check");
                         await this.tmux.killWindow();
                         this.healthCheckPaused = true;
@@ -1936,6 +2058,7 @@ export class Daemon extends EventEmitter {
                         lastOutput = cleaned.trimEnd() || undefined;
                     }
                     catch { /* best effort — pane may already be gone */ }
+                    this.logPaneDeath(cliLabel, exitCode, lastOutput);
                     // Kill the dead window (remain-on-exit keeps it around) before respawn
                     if (paneStatus) {
                         await this.tmux.killWindow();
@@ -2007,7 +2130,7 @@ export class Daemon extends EventEmitter {
                     this.crashTimestamps = this.crashTimestamps.filter(t => t > Date.now() - crashWindowMs);
                     if (this.crashTimestamps.length >= 3) {
                         this.healthCheckPaused = true;
-                        this.logger.error({ crashesInWindow: this.crashTimestamps.length }, "3+ crashes in 5 minutes — pausing respawn");
+                        this.logger.error({ crashesInWindow: this.crashTimestamps.length, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "3+ crashes in 5 minutes — pausing respawn");
                         // P1: Persist crash state so next process restart skips resume
                         try {
                             writeFileSync(join(this.instanceDir, "crash-state.json"), JSON.stringify({
@@ -2027,7 +2150,7 @@ export class Daemon extends EventEmitter {
                     this.crashCount++;
                     this.lastCrashAt = Date.now();
                     if (this.crashCount > max_retries) {
-                        this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries }, "Max crash retries exceeded — not respawning");
+                        this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "Max crash retries exceeded — not respawning");
                         this.healthCheckPaused = true;
                         this.emitSupervisionEnded(`it crashed ${this.crashCount} times, exceeding restart_policy.max_retries (${max_retries})`, "Check the logs for the cause, then restart it.");
                         return; // don't schedule next — given up
@@ -2331,6 +2454,7 @@ export class Daemon extends EventEmitter {
         // rebaselining the occurrence count while the error is still displayed — one
         // notification, a false recovery log, then silence.
         const looksReady = () => !busyPattern?.test(pane) && readyPattern.test(pane);
+        const codexLivePane = this.isCodexLivePaneSnapshot(pane);
         // State: waiting for recovery. A missing/outdated ready pattern must not
         // suppress every future error forever, so the gate has a hard deadline.
         if (this.errorWaitingForRecovery) {
@@ -2394,6 +2518,17 @@ export class Daemon extends EventEmitter {
             const key = Daemon.errorPatternKey(ep);
             const count = countMatches(ep.pattern);
             const seen = this.lastErrorCount.get(key) ?? 0;
+            // The generic Codex usage-limit line remains in scrollback after the
+            // user selects Luna Reserve. A live composer + Context footer is positive
+            // evidence that the pane recovered; baseline the stale occurrence so it
+            // cannot reach the destructive quota pause path.
+            if (codexLivePane && ep.type === "quota" && ep.action === "pause"
+                && ep.message.startsWith("Codex usage limit reached")) {
+                if (count > 0)
+                    this.lastErrorCount.set(key, count);
+                this.logger.debug("Codex usage-limit text is stale — live reserve pane is running");
+                continue;
+            }
             if (count <= seen) {
                 // Occurrences scrolled out of the capture buffer → lower the baseline
                 // so a future re-occurrence still counts as new (no permanent suppress).
@@ -2588,12 +2723,61 @@ export class Daemon extends EventEmitter {
         // is a successful no-op here, not an error.
         this.logger.debug({ dialog: dialog.description }, "Backend clear dialog did not appear");
     }
+    /**
+     * The last time AgEnD itself asked the CLI to go away, and why (#927). Read
+     * when a pane dies, to tell "AgEnD stopped it" from "the CLI exited on its
+     * own" — a codex that exits 0 on its own and one AgEnD sent /quit look the
+     * same from the pane.
+     */
+    lastStopRequest = null;
+    /** Record, and log, that AgEnD is about to stop the CLI. */
+    noteStopRequest(via, reason) {
+        this.lastStopRequest = { via, reason, at: Date.now() };
+        this.logger.info({ via, reason }, `AgEnD is stopping the CLI: ${via} (${reason})`);
+    }
+    /** Capture the pane's recent output with escape codes stripped. Never throws. */
+    async capturePaneOutput() {
+        try {
+            const raw = await this.tmux?.capturePaneWithHistory(50);
+            const cleaned = raw?.replace(/\x1b\[[0-9;]*[a-zA-Z]/g, "");
+            return cleaned?.trimEnd() || undefined;
+        }
+        catch {
+            return undefined;
+        }
+    }
+    /**
+     * One record per pane death: exit status, when, who, and what the CLI printed
+     * last — the line that was missing when a codex on Luna Reserve died with
+     * status 0 and daemon.log said only "exited normally" (#927). Logging only;
+     * the caller decides what happens next.
+     */
+    logPaneDeath(cliLabel, exitCode, lastOutput) {
+        const request = this.lastStopRequest;
+        const sinceStopMs = request ? Date.now() - request.at : null;
+        const byAgend = request !== null && sinceStopMs !== null && sinceStopMs <= STOP_ATTRIBUTION_WINDOW_MS;
+        const record = {
+            exitCode: exitCode ?? null,
+            diedAt: new Date().toISOString(),
+            initiatedBy: byAgend ? "agend" : "cli",
+            ...(byAgend ? { stopVia: request.via, stopReason: request.reason, sinceStopMs } : {}),
+            lastOutput: paneTail(lastOutput) ?? null,
+        };
+        if (byAgend) {
+            this.logger.info(record, `${cliLabel} exited after AgEnD stopped it (${request.via}: ${request.reason})`);
+        }
+        else {
+            this.logger.warn(record, `${cliLabel} exited on its own (exit code ${exitCode ?? "unknown"}) — last output recorded`);
+        }
+    }
     /** Send the backend-specific graceful quit command/key sequence. */
-    async sendQuitSequence() {
+    async sendQuitSequence(reason = "unspecified") {
         if (!this.tmux || !this.backend)
             return false;
         const quitCmd = this.backend.getQuitCommand();
         const quitKey = this.backend.getQuitKey?.();
+        if (quitCmd || quitKey)
+            this.noteStopRequest(quitCmd ? `quit command ${quitCmd}` : `quit key ${quitKey}`, reason);
         if (quitCmd) {
             if (!await this.tmux.sendKeys(quitCmd))
                 return false;
@@ -2614,6 +2798,26 @@ export class Daemon extends EventEmitter {
         }
         return true;
     }
+    /**
+     * Kiro drops `/quit` while a turn is running. Stop that turn first, then use
+     * the same delivery readiness gate that protects Enter from the busy pane.
+     * Returning false is fail-closed: the caller skips `/quit` and enters the
+     * bounded SIGTERM -> SIGKILL fallback instead of typing into an unknown pane.
+     */
+    async drainBusyKiroForStop(windowId) {
+        if (this.backend?.binaryName !== "kiro-cli")
+            return true;
+        const readiness = await this.paneReadinessForDelivery(windowId);
+        if (readiness === "ready")
+            return true;
+        if (readiness !== "busy")
+            return false;
+        const cancelKey = this.backend.getCancelKey?.() ?? "Escape";
+        const sent = await this.tmux?.sendSpecialKey(cancelKey);
+        if (!sent)
+            return false;
+        return this.waitForPaneReadyForDelivery(windowId, KIRO_STOP_IDLE_BUDGET_MS);
+    }
     async stop() {
         this.logger.info("Stopping daemon instance");
         this.turnReplyGuard.reset();
@@ -2622,6 +2826,13 @@ export class Daemon extends EventEmitter {
         this.inputTransientGuardGeneration = null;
         this.freezeRuntimeMonitors();
         this.pendingIpcRequests.clear();
+        if (this.museUsageRelay) {
+            await this.museUsageRelay.stop().catch(() => { });
+            this.museUsageRelay = null;
+        }
+        else if (this.backend?.binaryName === "muse") {
+            clearMuseUsageSnapshot(this.instanceDir);
+        }
         if (this.adapter)
             await this.adapter.stop();
         // Notify MCP servers of graceful shutdown (prevents reconnect attempts)
@@ -2632,11 +2843,18 @@ export class Daemon extends EventEmitter {
             this.saveSessionId();
             this.healthCheckPaused = true;
             let killed = false;
-            const quitSent = await this.sendQuitSequence();
+            const windowId = this.tmux.getWindowId();
+            const kiroReady = windowId ? await this.drainBusyKiroForStop(windowId) : true;
+            const quitSent = kiroReady && await this.sendQuitSequence("graceful stop");
+            const quitGraceMs = this.backend?.binaryName === "kiro-cli"
+                ? KIRO_STOP_QUIT_GRACE_MS : 3_000;
+            const sigtermGraceMs = this.backend?.binaryName === "kiro-cli"
+                ? KIRO_STOP_SIGTERM_GRACE_MS : 1_000;
             if (quitSent) {
-                // Wait up to 3s for graceful exit, polling every 200ms. A healthy CLI
+                // Wait up to the backend's bounded graceful-exit window, polling every
+                // 200ms. A healthy CLI
                 // exits within ~1s; a longer wait just delays the force-kill fallback.
-                for (let i = 0; i < 15; i++) {
+                for (let elapsed = 0; elapsed < quitGraceMs; elapsed += 200) {
                     await new Promise(r => setTimeout(r, 200));
                     const status = await this.tmux.getPaneStatus();
                     if (!status || !status.alive) {
@@ -2646,9 +2864,9 @@ export class Daemon extends EventEmitter {
                 }
             }
             if (!killed) {
-                this.logger.warn({ quitSent }, "CLI did not exit gracefully within 3s — falling back to SIGTERM");
-                await this.killProcessTree("SIGTERM");
-                for (let i = 0; i < 5; i++) {
+                this.logger.warn({ quitSent, quitGraceMs }, "CLI did not exit gracefully within its bounded quit grace — falling back to SIGTERM");
+                await this.killProcessTree("SIGTERM", "graceful stop: the CLI outlived its quit grace");
+                for (let elapsed = 0; elapsed < sigtermGraceMs; elapsed += 200) {
                     await new Promise(r => setTimeout(r, 200));
                     const status = await this.tmux.getPaneStatus();
                     if (!status || !status.alive) {
@@ -2659,7 +2877,7 @@ export class Daemon extends EventEmitter {
             }
             if (!killed) {
                 this.logger.warn("CLI process tree survived SIGTERM — falling back to SIGKILL");
-                await this.killProcessTree("SIGKILL");
+                await this.killProcessTree("SIGKILL", "graceful stop: the CLI survived SIGTERM");
                 await new Promise(r => setTimeout(r, 200));
             }
             // Always kill window — remain-on-exit keeps dead panes around after CLI exits
@@ -2761,6 +2979,9 @@ export class Daemon extends EventEmitter {
         // into an ordinary idle-timeout pause of a busy instance.
         const allowStuck = this.pauseAllowStuck;
         this.pauseAllowStuck = false;
+        // Why this pause, for the stop record (#927): an idle pause and an
+        // auth-deferred one look the same from the pane.
+        const pauseReason = allowStuck ? "pause (auth-deferred, stuck pane)" : "pause (idle)";
         const pausableState = this.instanceState === "idle"
             || (allowStuck && this.instanceState === "stuck");
         if (!pausableState || this.pasteQueueDepth > 0) {
@@ -2773,7 +2994,7 @@ export class Daemon extends EventEmitter {
         const transition = (async () => {
             try {
                 this.saveSessionId();
-                await this.sendQuitSequence();
+                await this.sendQuitSequence(pauseReason);
                 let exited = false;
                 for (let i = 0; i < 15; i++) {
                     await new Promise(r => setTimeout(r, 200));
@@ -2784,11 +3005,11 @@ export class Daemon extends EventEmitter {
                     }
                 }
                 if (!exited) {
-                    await this.killProcessTree("SIGTERM");
+                    await this.killProcessTree("SIGTERM", `${pauseReason}: the CLI outlived its quit grace`);
                     await new Promise(r => setTimeout(r, 1_000));
                     const status = await this.tmux?.getPaneStatus();
                     if (status?.alive) {
-                        await this.killProcessTree("SIGKILL");
+                        await this.killProcessTree("SIGKILL", `${pauseReason}: the CLI survived SIGTERM`);
                         await new Promise(r => setTimeout(r, 200));
                     }
                 }
@@ -3005,7 +3226,7 @@ export class Daemon extends EventEmitter {
         const turn = this.turnReplyGuard.snapshot();
         if (!turn || this.isPaused)
             return;
-        if (turn.replyDelivered) {
+        if (turn.completionDelivered) {
             if (turn.phase === "recovering") {
                 this.emit("reply_drop_recovered", {
                     name: this.name,
@@ -3063,9 +3284,9 @@ export class Daemon extends EventEmitter {
                 return;
             }
         }
-        // Preserve the dead-MCP proxy path and its explicit opt-in. Other outbound
-        // tools still suppress that proxy, but only a delivered `reply` satisfies
-        // the human-facing completion guard below.
+        // Preserve the dead-MCP proxy path and its explicit opt-in. Any verified
+        // outbound action suppresses a duplicate proxy; only a delivered
+        // human-facing channel action satisfies the completion guard below.
         if (!turn.outboundDelivered && this.config.mcp_proxy_reply === true
             && mcpServerState(this.instanceDir).state === "dead") {
             this.turnReplyGuard.complete(turn.generation);
@@ -3125,7 +3346,7 @@ export class Daemon extends EventEmitter {
                 const current = this.turnReplyGuard.snapshot();
                 if (!current || current.generation !== turn.generation || current.phase !== "recovering")
                     return;
-                if (current.replyDelivered) {
+                if (current.completionDelivered) {
                     this.turnReplyGuard.complete(turn.generation);
                     this.emit("reply_drop_recovered", {
                         name: this.name,
@@ -3201,7 +3422,11 @@ export class Daemon extends EventEmitter {
                 pane = await this.tmux?.capturePane();
             if (!pane)
                 return;
-            const text = extractProxyReplyText(pane, { inboundMarker: target.inboundMarker, readyPattern: this.instanceStateReadyPattern });
+            const text = extractProxyReplyText(pane, {
+                inboundMarker: target.inboundMarker,
+                readyPattern: this.instanceStateReadyPattern,
+                isChromeLine: line => this.backend?.isProxyReplyChromeLine?.(line) ?? false,
+            });
             if (!text) {
                 this.logger.debug("Dead-MCP proxy reply skipped — pane tail is trivial");
                 return;
@@ -3939,14 +4164,16 @@ export class Daemon extends EventEmitter {
      * steer's verdict decide whether a queued message's sender is told its
      * delivery failed — a false ❌ carrying the wrong correlation id.
      */
-    failDelivery(verdict, status) {
+    failDelivery(verdict, status, phase = "unknown", proof = "undelivered") {
         verdict.reached = true;
+        verdict.phase = phase;
+        verdict.proof = proof;
         if (status)
             this.emit("message_failed", status); // ❌
         return false;
     }
     /** Tell the fleet when an already-accepted cross-instance pane write failed. */
-    reportCrossInstanceDeliveryFailure(meta, error) {
+    reportCrossInstanceDeliveryFailure(meta, verdict, error) {
         if (!meta.from_instance)
             return;
         this.ipcServer?.broadcast({
@@ -3954,7 +4181,10 @@ export class Daemon extends EventEmitter {
             senderSession: meta.from_instance,
             targetInstance: this.name,
             correlationId: meta.correlation_id ?? "unknown",
-            error: error ?? this.tmux?.getLastPasteError?.() ?? "target pane rejected the delivery",
+            // Never use getLastPasteError as a generic fallback: it may describe an
+            // earlier paste, and #910 was a post-submit proof failure, not a paste
+            // rejection. Keep the sender diagnostic phase-specific and non-secret.
+            error: `delivery failed: phase=${verdict?.phase ?? (error ? "exception" : "unknown")}; proof=${verdict?.proof ?? (error ? "threw" : "none")}`,
         });
     }
     /**
@@ -3989,11 +4219,7 @@ export class Daemon extends EventEmitter {
         this.recordRecentUserMessage(content, meta);
         const formatted = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n"
             + this.formatInboundMessage(content, meta);
-        const chatId = meta.chat_id;
-        const messageId = meta.message_id;
-        const status = (chatId && messageId)
-            ? { chatId: meta.thread_id || chatId, messageId }
-            : undefined;
+        const status = channelStatus(meta);
         this.steerLock = this.steerLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                 return;
@@ -4008,12 +4234,12 @@ export class Daemon extends EventEmitter {
                 // Same rule as the queued path: a steer that never got to try is not a
                 // delivery failure. This holder is the steer's own, which is the point
                 // — it runs on steerLock while a queued delivery runs on pasteLock.
-                this.reportCrossInstanceDeliveryFailure(meta);
+                this.reportCrossInstanceDeliveryFailure(meta, verdict);
             }
         }).catch(err => {
             this.logger.warn({ err: err.message }, "steer delivery error");
             if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
-                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+                this.reportCrossInstanceDeliveryFailure(meta, undefined, err.message);
             }
         });
     }
@@ -4031,11 +4257,7 @@ export class Daemon extends EventEmitter {
         this.recordRecentUserMessage(content, meta);
         const formatted = "[BTW — side question from the user. Answer it separately without changing or interrupting the CURRENT work.]\n"
             + this.formatInboundMessage(content, meta);
-        const chatId = meta.chat_id;
-        const messageId = meta.message_id;
-        const status = (chatId && messageId)
-            ? { chatId: meta.thread_id || chatId, messageId }
-            : undefined;
+        const status = channelStatus(meta);
         this.steerLock = this.steerLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                 return;
@@ -4112,7 +4334,9 @@ export class Daemon extends EventEmitter {
             this.logger.warn({ depth: this.pasteQueueDepth }, "Message delivery queue backing up");
         }
         if (wasQueued && chatId && messageId) {
-            this.emit("message_queued", { chatId: meta.thread_id || chatId, messageId });
+            const queuedStatus = channelStatus(meta);
+            if (queuedStatus)
+                this.emit("message_queued", queuedStatus);
         }
         this.pasteLock = this.pasteLock.then(async () => {
             try {
@@ -4131,9 +4355,7 @@ export class Daemon extends EventEmitter {
                     if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                         return;
                 }
-                const status = (chatId && messageId)
-                    ? { chatId: meta.thread_id || chatId, messageId }
-                    : undefined;
+                const status = channelStatus(meta);
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
@@ -4147,7 +4369,7 @@ export class Daemon extends EventEmitter {
                     // not ready yet, a cancel, a storm hold or a shutdown all return
                     // false without one, and telling the sender its message was lost
                     // there would be the false ❌ of #826 in its other form.
-                    this.reportCrossInstanceDeliveryFailure(meta);
+                    this.reportCrossInstanceDeliveryFailure(meta, verdict);
                 }
             }
             finally {
@@ -4156,7 +4378,7 @@ export class Daemon extends EventEmitter {
         }).catch(err => {
             this.logger.warn({ err: err.message }, "pasteLock delivery error — chain continues");
             if (this.isDeliveryEpochCurrent(deliveryEpoch)) {
-                this.reportCrossInstanceDeliveryFailure(meta, err.message);
+                this.reportCrossInstanceDeliveryFailure(meta, undefined, err.message);
             }
         });
         this.logger.debug({ user: meta.user, text: content.slice(0, 100) }, "Queued channel message for delivery");
@@ -4201,7 +4423,16 @@ export class Daemon extends EventEmitter {
                 return false;
         }
         // Before anything reads the window id: a spawn in progress is about to change it.
-        await this.waitForSpawnToSettle();
+        // A false return means the cap expired with a spawn STILL running — the
+        // generation captured below is in-progress evidence, not settled evidence,
+        // so the critical section must still back out (see settledClean).
+        if (this.spawnSettled && status)
+            this.emit("message_queued", status);
+        const settledClean = await this.waitForSpawnToSettle();
+        // Everything captured below (window id, readiness verdicts) belongs to
+        // this spawn generation. A spawn that starts afterwards is detected inside
+        // the critical section, where this delivery backs out and redoes itself.
+        const settleGeneration = this.spawnGeneration;
         if (cancelled())
             return false;
         if (this.refuseFatalStartupDelivery(verdict, status))
@@ -4226,7 +4457,8 @@ export class Daemon extends EventEmitter {
             // fall through to the wait.
             const canHandOff = (supportsQueuedInput || opts?.steer)
                 && readiness === "busy"
-                && (await this.probeBlockingDialog()).state === "clear";
+                && (await this.probeBlockingDialog()).state === "clear"
+                && await this.hasPositiveDeliveryInput();
             if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
@@ -4246,7 +4478,7 @@ export class Daemon extends EventEmitter {
                     // wedged CLI (where the text would sit unsubmitted and the next message
                     // would land on top of it) — and instead of holding the queue silently.
                     this.logger.error("Pane still busy after the idle wait — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "readiness", "timeout-before-write");
                 }
             }
         }
@@ -4267,7 +4499,7 @@ export class Daemon extends EventEmitter {
                 // recovery Enter, so exactly STRANDED_INPUT_MAX_ROUNDS of them go out.
                 if (round >= STRANDED_INPUT_MAX_ROUNDS) {
                     this.logger.error({ round }, "Input row still not clear after the stranded-text recovery budget — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "retry-budget-exhausted");
                 }
                 const stranded = await this.submitStrandedInputIfAny(windowId);
                 if (cancelled())
@@ -4276,14 +4508,14 @@ export class Daemon extends EventEmitter {
                     break;
                 if (stranded === "failed") {
                     this.logger.error({ round }, "Could not submit the stranded text — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "enter-failed");
                 }
                 const readyAgain = await this.waitForPaneReadyForDelivery(windowId);
                 if (cancelled())
                     return false;
                 if (!readyAgain) {
                     this.logger.error("Pane never returned to its prompt after submitting stranded input — reporting delivery failure");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-input", "prompt-timeout");
                 }
             }
         }
@@ -4295,13 +4527,22 @@ export class Daemon extends EventEmitter {
             const outcome = await this.paneWriteLock.run(async () => {
                 if (cancelled())
                     return false;
+                // A spawn that started after the settle wait above invalidates the
+                // window id and every readiness verdict since: the pane about to be
+                // written may already belong to a replacement process. The same holds
+                // when the settle wait itself timed out (!settledClean) or a spawn is
+                // running right now — none of those is settled evidence. Never wait
+                // here (startup dismissal needs this lock) — back out and redo the
+                // delivery from the top, where the settle wait runs again outside it.
+                if (!settledClean || settleGeneration !== this.spawnGeneration || this.spawning)
+                    return "spawn-started";
                 if (this.refuseFatalStartupDelivery(verdict, status))
                     return false;
                 // A passive startup phase may paint after the outer readiness probe.
                 // It clears without input, so waiting under the pane lock cannot starve
                 // a dialog dismisser and closes the final clear→paste TOCTOU window.
                 if (!(await this.waitForInputTransientToClear("pre-write"))) {
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "pre-write", "input-transient-timeout");
                 }
                 // TOCTOU: the probes above ran outside this lock, and the CLI repaints
                 // whenever it likes — a resume prompt can be painted between "clear" and
@@ -4312,8 +4553,25 @@ export class Daemon extends EventEmitter {
                     if (probe.state !== "clear")
                         return "dialog";
                 }
+                if (!(await this.hasPositiveDeliveryInput()))
+                    return "dialog";
                 return this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict);
             });
+            if (outcome === "spawn-started") {
+                // The pane changed under this delivery: its queued paste must not land
+                // in the replacement process's first screen. Redo the whole delivery
+                // (fresh window id, fresh probes) — bounded, so spawn churn ends in an
+                // honest failure rather than a message that never lands.
+                const retries = (opts?.spawnRetry ?? 0) + 1;
+                if (retries > DELIVERY_SPAWN_RACE_MAX_ROUNDS) {
+                    this.logger.error({ rounds: retries }, "A spawn kept starting before the pane write — reporting delivery failure");
+                    return this.failDelivery(verdict, status);
+                }
+                return this.deliverMessage(formatted, status, { ...opts, spawnRetry: retries });
+            }
+            if (typeof outcome === "object") {
+                return this.observeKiroSubmission(formatted, outcome, status, verdict, cancelled);
+            }
             if (outcome !== "dialog")
                 return outcome;
             // Wait OUTSIDE the lock (holding it would starve the runtime dismisser),
@@ -4321,14 +4579,14 @@ export class Daemon extends EventEmitter {
             // an honest failure rather than a message that never lands.
             if (round + 1 >= LATE_DIALOG_WRITE_ROUNDS) {
                 this.logger.error({ rounds: round + 1 }, "A dialog kept appearing before the pane write — reporting delivery failure");
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "pre-write", "dialog-or-input-not-ready");
             }
-            this.logger.info("Dialog appeared before the pane write — waiting for it to clear");
+            this.logger.info("Dialog or input transition appeared before the pane write — waiting for readiness");
             const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId) : false;
             if (cancelled())
                 return false;
             if (!clear) {
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "pre-write", "readiness-timeout");
             }
         }
     }
@@ -4436,8 +4694,18 @@ export class Daemon extends EventEmitter {
                 this.logger.warn({ phase, generation }, "Spawn changed during the input-availability probe — refusing to send Enter into the replacement pane");
                 return false;
             }
-            if (probe.state === "clear")
+            if (probe.state === "clear") {
+                // Re-arm the first-delivery delay when a transient was actually observed
+                // and then cleared, but ONLY from the pre-write phase. That phase runs
+                // before consume() in writeMessageToPane, so the re-arm benefits the
+                // current delivery's paste settle. Enter-path callers (initial-submit,
+                // retries) run after consume() — re-arming there would leave the flag
+                // for the NEXT unrelated delivery, which must not be slowed.
+                if (observedDescription !== null && phase === "pre-write") {
+                    this.firstDeliveryDelay.recordReady();
+                }
                 return true;
+            }
             if (probe.state === "active" && observedDescription !== probe.transient.description) {
                 observedDescription = probe.transient.description;
                 this.logger.info({ phase, transient: probe.transient.description, generation }, "CLI is still completing startup — waiting before sending Enter");
@@ -4589,6 +4857,27 @@ export class Daemon extends EventEmitter {
     async isPaneReadyForDelivery(windowId) {
         return (await this.paneReadinessForDelivery(windowId)) === "ready";
     }
+    needsStartupInputProof() {
+        return !!this.backend?.isDeliveryInputReadyPane
+            && this.inputTransientGuardGeneration === this.spawnGeneration;
+    }
+    /** Codex can paint a prompt before the TTY enters raw mode. Both are required. */
+    async hasPositiveDeliveryInput() {
+        if (!this.needsStartupInputProof())
+            return true;
+        const check = this.backend?.isDeliveryInputReadyPane;
+        if (!check || !this.tmux)
+            return !check;
+        try {
+            const mode = await this.tmux.getPaneInputMode?.();
+            if (mode !== "raw")
+                return false;
+            return check.call(this.backend, await this.tmux.capturePane());
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Why a pane is not deliverable matters. "busy" may be handed to a native
      * input queue or steered (after its own dialog probe); "dialog", "transient"
@@ -4607,6 +4896,9 @@ export class Daemon extends EventEmitter {
             return "transient";
         if (transient.state === "unknown")
             return "unknown";
+        if (this.needsStartupInputProof()) {
+            return await this.hasPositiveDeliveryInput() ? "ready" : "transient";
+        }
         if (this.backend?.dropsEnterWhileBusy?.() !== true)
             return "ready";
         const prompt = this.backend.getBottomReadyPattern?.();
@@ -4651,7 +4943,8 @@ export class Daemon extends EventEmitter {
         // screen", and a dialog disappears without any output edge the silence
         // gate could see.
         const deadline = Date.now() + timeoutMs;
-        const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true;
+        const bottomGated = this.backend?.dropsEnterWhileBusy?.() === true
+            || this.needsStartupInputProof();
         let unknownStreak = 0;
         let transientBudget = null;
         for (;;) {
@@ -4774,11 +5067,12 @@ export class Daemon extends EventEmitter {
             return "busy";
         if (this.backend?.getBusyPattern?.()?.test(pane))
             return "busy";
+        if (this.backend?.isDeliveryInputReadyPane && !this.backend.isDeliveryInputReadyPane(pane))
+            return "busy";
         if (strandedAgendMessageInInput(pane, prompt))
             return "stranded";
-        // Kiro needs a bottom-anchored prompt as positive readiness evidence. Codex
-        // does not: this preflight runs only after its ordinary silence gate and is
-        // enabled solely to recover a positively identified old AgEnD strand.
+        // Kiro uses the bottom row; Codex's positive prompt/footer check above
+        // rules out a historical transcript echo or a transition/modal screen.
         return !requireBottomReady || bottomRowIsReady(pane, prompt) ? "clear" : "busy";
     }
     /**
@@ -4816,6 +5110,126 @@ export class Daemon extends EventEmitter {
             this.logger.warn("Could not read the pane after Enter — not confirming the submission");
         return sawOutput && residue === "absent";
     }
+    /** Once Kiro returns to its prompt, its unique envelope id in history proves submission. */
+    async kiroSubmissionEvidence(windowId, formatted, signature) {
+        if (!this.tmux)
+            return "unreadable";
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return "unreadable";
+        }
+        const prompt = this.backend?.getBottomReadyPattern?.();
+        if (prompt && bottomRowIsReady(pane, prompt)
+            && inputShowsPastedText(inputAreaText(pane, prompt) ?? "", signature.value))
+            return "stranded";
+        if (prompt && pasteLeftInInput(pane, prompt, formatted))
+            return "stranded";
+        // During generation the same text can still be typeahead for an older
+        // turn. A history hit is safe only after this pane returns to its prompt.
+        if (!signature.unique || !this.tmux.capturePaneWithHistory
+            || !(await this.isPaneReadyForDelivery(windowId)))
+            return "unknown";
+        try {
+            const history = await this.tmux.capturePaneWithHistory(300);
+            // History includes the CURRENT input row. The earlier viewport capture
+            // and readiness probe may belong to an older frame: Kiro can finish a
+            // turn and expose our unsent typeahead between those reads. Judge both
+            // readiness and input residue on this same, final snapshot before its
+            // message id can count as a submitted transcript echo.
+            if (!prompt || !bottomRowIsReady(history, prompt))
+                return "unknown";
+            if (inputShowsPastedText(inputAreaText(history, prompt) ?? "", signature.value)
+                || pasteLeftInInput(history, prompt, formatted))
+                return "stranded";
+            if (countOccurrences(history.replace(/\s+/g, ""), signature.value) > 0)
+                return "submitted";
+        }
+        catch { /* missing history cannot establish a verdict */ }
+        return "unknown";
+    }
+    /** Observe the Kiro paste outside paneWriteLock; a long agent turn must not block dialog handling. */
+    async observeKiroSubmission(formatted, pending, status, verdict, cancelled) {
+        const deadline = Date.now() + KIRO_SUBMISSION_OBSERVE_MS;
+        let retriedStrand = false;
+        let unreadable = 0;
+        const current = () => !cancelled()
+            && !this.spawning
+            && this.spawnGeneration === pending.spawnGeneration
+            && this.getWindowId() === pending.windowId
+            && this.tmux?.getWindowId() === pending.windowId;
+        for (;;) {
+            if (!current())
+                return false;
+            const evidence = await this.kiroSubmissionEvidence(pending.windowId, formatted, pending.signature);
+            if (!current())
+                return false;
+            if (evidence === "submitted") {
+                if (status)
+                    this.emit("message_confirmed", status);
+                return true;
+            }
+            unreadable = evidence === "unreadable" ? unreadable + 1 : 0;
+            if (unreadable >= KIRO_SUBMISSION_UNREADABLE_POLLS) {
+                return this.failDelivery(verdict, status, "post-submit-proof", "pane-unreadable");
+            }
+            if (evidence === "stranded" && await this.isPaneReadyForDelivery(pending.windowId)) {
+                if (!current())
+                    return false;
+                if (retriedStrand)
+                    return this.failDelivery(verdict, status, "stranded-text-retry", "stranded");
+                const retry = await this.paneWriteLock.run(async () => {
+                    if (!current())
+                        return "cancelled";
+                    const fresh = await this.kiroSubmissionEvidence(pending.windowId, formatted, pending.signature);
+                    if (!current())
+                        return "cancelled";
+                    if (fresh === "submitted")
+                        return "submitted";
+                    if (fresh !== "stranded" || !(await this.isPaneReadyForDelivery(pending.windowId)))
+                        return "changed";
+                    if (!current())
+                        return "cancelled";
+                    const sent = await this.sendDeliveryEnter("stranded-text-retry", current);
+                    if (!current())
+                        return "cancelled";
+                    return sent ? "sent" : "failed";
+                });
+                if (!current())
+                    return false;
+                if (retry === "cancelled")
+                    return false;
+                if (retry === "submitted") {
+                    if (status)
+                        this.emit("message_confirmed", status);
+                    return true;
+                }
+                if (retry === "failed")
+                    return this.failDelivery(verdict, status, "stranded-text-retry", "tmux-send-keys-failed");
+                if (retry === "sent") {
+                    retriedStrand = true;
+                    await new Promise(r => setTimeout(r, POST_ENTER_PROOF_WINDOW_MS));
+                    continue;
+                }
+            }
+            const alive = await this.tmux?.isWindowAlive().catch(() => false);
+            if (!current())
+                return false;
+            if (!alive)
+                return this.failDelivery(verdict, status, "post-submit-proof", "window-gone");
+            if (Date.now() >= deadline) {
+                // A live, busy pane and no positive strand are still ambiguous. The
+                // hang detector owns hung CLI recovery; elapsed time alone is not ❌.
+                this.logger.warn("Kiro submission remains unproven; keeping the delivery queued without a false failure");
+                verdict.phase = "post-submit-proof";
+                verdict.proof = "unproven";
+                return false;
+            }
+            await new Promise(r => setTimeout(r, KIRO_SUBMISSION_POLL_MS));
+        }
+    }
     /**
      * While the CLI is parked on a fatal startup screen (see fatalStartupBlocked),
      * no pane write may happen: paste+Enter into the corrupt-config modal would
@@ -4828,7 +5242,7 @@ export class Daemon extends EventEmitter {
         if (!this.fatalStartupBlocked)
             return false;
         this.logger.error("Delivery refused — CLI is parked on a fatal startup screen");
-        this.failDelivery(verdict, status);
+        this.failDelivery(verdict, status, "fatal-startup", "blocked-before-write");
         return true;
     }
     /**
@@ -4895,9 +5309,13 @@ export class Daemon extends EventEmitter {
      * precisely so the lock's scope is visible at the call site rather than being
      * an invariant maintained by comments.
      */
-    async sendDeliveryEnter(phase) {
+    async sendDeliveryEnter(phase, stillCurrent) {
         if (!(await this.waitForInputTransientToClear(phase)))
             return false;
+        // A recovery Enter may have waited for a transient while cancel or spawn
+        // replaced the delivery. Check at the last point before the tmux write.
+        if (stillCurrent && !stillCurrent())
+            return false;
         const sent = await this.tmux.sendSpecialKey("Enter");
         if (!sent) {
             this.logger.error({
@@ -4931,7 +5349,7 @@ export class Daemon extends EventEmitter {
                 if (!recoverable) {
                     // A tmux error the window cannot be recovered from: the text will
                     // never reach this pane, so it is a verdict like the others.
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "paste", "non-retryable-tmux-error");
                 }
                 windowId = (await this.recoverWindow()) ?? windowId;
                 if (attempt < maxAttempts)
@@ -4961,7 +5379,7 @@ export class Daemon extends EventEmitter {
             }
             let enterAt = Date.now();
             if (!(await this.sendDeliveryEnter("initial-submit"))) {
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "submit-enter", "tmux-send-keys-failed");
             }
             // Kiro's legacy TUI can swallow Enter while it is still processing a large
             // paste — not only during the post-ready redraw (#479): on slower hosts it
@@ -5010,8 +5428,16 @@ export class Daemon extends EventEmitter {
                     // Our text is on the pane but cannot be shown to have left the input
                     // row — either the backend exposes no input row (only /steer reaches
                     // this path on such a backend) or the pre-paste pane was unreadable.
-                    // Re-pasting on that would deliver the message twice, so accept as
-                    // this path always has, and record that it is unproven.
+                    // For Codex, this can also mean its current layout is not a trusted
+                    // input/queue frame. Do not turn that uncertainty into a false ✅.
+                    if (this.backend?.isDeliveryInputReadyPane) {
+                        this.logger.warn({ phase: "native-queue-proof", proof }, "Codex native-queue outcome uncertain — not re-pasting or confirming");
+                        verdict.phase = "native-queue-proof";
+                        verdict.proof = proof;
+                        return false;
+                    }
+                    // Re-pasting on a backend without structured Codex pane evidence
+                    // would risk duplication; retain its legacy best-effort behavior.
                     this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
                     if (status)
                         this.emit("message_confirmed", status); // ✅ (best-effort)
@@ -5044,9 +5470,14 @@ export class Daemon extends EventEmitter {
                     this.logger.warn("Message still in the input row after idle — submitting the existing text instead of pasting it again");
                     const strandedAt = Date.now();
                     if (!(await this.sendDeliveryEnter("native-queue-stranded-submit"))) {
-                        return this.failDelivery(verdict, status);
+                        return this.failDelivery(verdict, status, "native-queue-submit", "tmux-send-keys-failed");
                     }
-                    const afterEnter = await this.confirmSubmitted(signature, pasteBaseline);
+                    // The recovery Enter can be accepted before Codex paints its new
+                    // transcript. One immediate capture is not a failure verdict: give
+                    // that echo/queue a bounded chance to appear, without re-pasting.
+                    const afterEnter = this.backend?.isDeliveryInputReadyPane
+                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline, true)
+                        : await this.confirmSubmitted(signature, pasteBaseline);
                     if (afterEnter === "submitted") {
                         if (status)
                             this.emit("message_confirmed", status); // ✅
@@ -5058,8 +5489,23 @@ export class Daemon extends EventEmitter {
                     // another turn's output — and treating that as proof re-confirms a
                     // message nobody submitted. Output is corroboration; text sitting in
                     // the input row is disqualifying, and disqualifying evidence wins.
+                    if (this.backend?.isDeliveryInputReadyPane && afterEnter !== "stranded") {
+                        this.logger.warn({ phase: "native-queue-submit", proof: afterEnter, strandedAt }, "Codex recovery Enter outcome uncertain — no hard failure or duplicate paste");
+                        verdict.phase = "native-queue-submit";
+                        verdict.proof = afterEnter;
+                        return false;
+                    }
                     this.logger.error({ afterEnter, strandedAt }, "Stranded message could not be submitted by Enter");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-submit", afterEnter);
+                }
+                if (this.backend?.isDeliveryInputReadyPane) {
+                    // In Codex a missing viewport echo is inconclusive, not a proof of
+                    // loss. Another paste could run the same request twice. Leave the
+                    // already-pasted delivery at 👀 and let the next observation decide.
+                    this.logger.warn({ phase: "native-queue-proof", proof: settled }, "Codex native-queue outcome uncertain — not re-pasting");
+                    verdict.phase = "native-queue-proof";
+                    verdict.proof = settled;
+                    return false;
                 }
                 // "unproven": nothing of ours is on screen — the paste itself was lost,
                 // so pasting it again cannot duplicate anything.
@@ -5068,12 +5514,12 @@ export class Daemon extends EventEmitter {
                     this.logger.error({
                         tmuxError: this.tmux.getLastPasteError?.() ?? "unknown tmux paste failure",
                     }, "Idle-gated redelivery paste failed after native-queue silent loss");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-redelivery", "tmux-paste-failed");
                 }
                 await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
                 const retryAt = Date.now();
                 if (!(await this.sendDeliveryEnter("native-queue-idle-redelivery"))) {
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "native-queue-redelivery", "tmux-send-keys-failed");
                 }
                 if (windowId && this.controlClient) {
                     if (await this.confirmAfterEnter(windowId, retryAt, signature, pasteBaseline, "native-queue-idle-redelivery-retry")) {
@@ -5088,21 +5534,31 @@ export class Daemon extends EventEmitter {
                     return true;
                 }
                 this.logger.error("Idle-gated redelivery also failed after native-queue silent loss");
-                return this.failDelivery(verdict, status);
+                return this.failDelivery(verdict, status, "native-queue-redelivery", "not-submitted");
             }
             if (windowId && this.controlClient && this.backend?.dropsEnterWhileBusy?.() === true) {
                 // F2: output after Enter is necessary but not sufficient — the paste
                 // must also have LEFT the input row.
                 let submitted = await this.confirmSubmittedAfterEnter(windowId, enterAt, formatted);
+                if (!submitted && signature.unique) {
+                    submitted = await this.kiroSubmissionEvidence(windowId, formatted, signature) === "submitted";
+                    if (!submitted) {
+                        // No output edge is not proof of a lost message. Leave the pane
+                        // lock before waiting through a long Kiro turn, so runtime dialog
+                        // handling can still make progress.
+                        if (status)
+                            this.emit("message_queued", status);
+                        return { kind: "kiro-pending", windowId, spawnGeneration: this.spawnGeneration, signature };
+                    }
+                }
                 if (!submitted) {
-                    // The Enter landed while the TUI was still busy (it kept the text but
-                    // dropped the key). A retry is only useful once the prompt is back —
-                    // bounded, since we hold the pane lock here.
+                    // Legacy system pastes have no unique envelope id. Preserve their
+                    // existing bounded retry until they can be tied to a specific turn.
                     this.logger.warn("Message not submitted after Enter — waiting for the prompt, then re-sending Enter once");
                     const promptBack = await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS);
                     const retryAt = Date.now();
                     if (promptBack && !(await this.sendDeliveryEnter("stranded-text-retry"))) {
-                        return this.failDelivery(verdict, status);
+                        return this.failDelivery(verdict, status, "stranded-text-retry", "tmux-send-keys-failed");
                     }
                     submitted = promptBack && await this.confirmSubmittedAfterEnter(windowId, retryAt, formatted);
                 }
@@ -5112,7 +5568,7 @@ export class Daemon extends EventEmitter {
                 }
                 else {
                     this.logger.error("Message pasted but never submitted (text still in the input row after Enter retry)");
-                    return this.failDelivery(verdict, status);
+                    return this.failDelivery(verdict, status, "stranded-text-retry", "stranded");
                 }
             }
             else if (windowId && this.controlClient) {
@@ -5132,12 +5588,26 @@ export class Daemon extends EventEmitter {
                         this.emit("message_confirmed", status); // ✅
                 }
                 else {
-                    // Both Enters were swallowed: the text is sitting UNSUBMITTED in the
-                    // CLI's input box. This used to return true, so the reaction stayed at 👀
-                    // forever and the next delivery pasted on top — submitting two messages
-                    // as one. Say so instead.
-                    this.logger.error("Message pasted but never submitted (no idle→busy after two Enters)");
-                    return this.failDelivery(verdict, status);
+                    const proof = this.backend?.isDeliveryInputReadyPane
+                        ? await this.lateCodexSubmissionProof(signature, pasteBaseline)
+                        : await this.confirmSubmitted(signature, pasteBaseline);
+                    if (proof === "submitted") {
+                        if (status)
+                            this.emit("message_confirmed", status);
+                        return true;
+                    }
+                    if (this.backend?.isDeliveryInputReadyPane && proof !== "stranded") {
+                        // This is the observed #910 race: the CLI processed the message
+                        // although its echo had not appeared within the proof window. A
+                        // missing viewport signature cannot establish non-delivery; keep
+                        // 👀 and never emit the sender's hard ❌ or re-paste blindly.
+                        this.logger.warn({ phase: "post-submit-proof", proof }, "Codex delivery outcome uncertain — no hard failure or duplicate paste");
+                        verdict.phase = "post-submit-proof";
+                        verdict.proof = proof;
+                        return false;
+                    }
+                    this.logger.error({ phase: "post-submit-proof", proof }, "Message remains unsubmitted after Enter retry");
+                    return this.failDelivery(verdict, status, "post-submit-proof", proof);
                 }
             }
             else {
@@ -5150,7 +5620,7 @@ export class Daemon extends EventEmitter {
             return true;
         }
         this.logger.error("Message delivery failed after retries — window not ready");
-        return this.failDelivery(verdict, status);
+        return this.failDelivery(verdict, status, "paste", "retry-budget-exhausted");
     }
     /**
      * The single place a pasted message is judged submitted, shared by the
@@ -5208,6 +5678,42 @@ export class Daemon extends EventEmitter {
             }
             return busy;
         }
+        if (this.backend?.isDeliveryInputReadyPane) {
+            // Codex's first post-wake redraw may hide the echo for a few seconds.
+            // Absence from a viewport is NOT proof the paste was lost, so only a
+            // positively identified strand authorizes another Enter. Never re-paste
+            // here: the CLI may already be processing the unique message_id.
+            let proof = "unproven";
+            const firstDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            for (;;) {
+                proof = await this.confirmSubmitted(signature, baseline);
+                if (proof === "submitted")
+                    return true;
+                if (proof === "stranded" || Date.now() >= firstDeadline)
+                    break;
+                await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+            }
+            if (proof !== "stranded")
+                return false;
+            if (!(await this.waitForPaneReadyForDelivery(windowId, STRANDED_RETRY_READY_WAIT_MS)))
+                return false;
+            proof = await this.confirmSubmitted(signature, baseline);
+            if (proof === "submitted")
+                return true;
+            if (proof !== "stranded")
+                return false;
+            if (!(await this.sendDeliveryEnter(retryPhase)))
+                return false;
+            const retryDeadline = Date.now() + POST_ENTER_PROOF_WINDOW_MS;
+            for (;;) {
+                proof = await this.confirmSubmitted(signature, baseline);
+                if (proof === "submitted")
+                    return true;
+                if (Date.now() >= retryDeadline)
+                    return false;
+                await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+            }
+        }
         if (await this.confirmSubmitted(signature, baseline) === "submitted")
             return true;
         // Retry once the prompt is back — an Enter sent into a mid-redraw TUI is
@@ -5257,6 +5763,14 @@ export class Daemon extends EventEmitter {
                 : "unproven";
         }
         const after = this.paneEvidence(pane, signature);
+        // A Codex layout without its current input/footer pair may show a quoted
+        // or historical `›` row. Unless its active Working banner corroborates a
+        // real turn, text on that unknown screen cannot prove it left stdin.
+        if (this.backend?.isDeliveryInputReadyPane
+            && !this.backend.isDeliveryInputReadyPane(pane)
+            && !this.backend.getBusyPattern?.()?.test(pane)) {
+            return after.payload > 0 ? "unverifiable" : "unproven";
+        }
         // 1. Disqualifying evidence, checked FIRST and never overridden by the
         //    corroborating evidence below: our text is sitting in the input row, so
         //    it was not submitted — whatever else is on screen.
@@ -5295,6 +5809,35 @@ export class Daemon extends EventEmitter {
         this.logger.warn("Could not read the pane before pasting — this delivery cannot be verified either way");
         return "unverifiable";
     }
+    /** Only positive echo/queue evidence may turn an ambiguous Codex write into ✅. */
+    async lateCodexSubmissionProof(signature, baseline, waitThroughStranded = false) {
+        const deadline = Date.now() + CODEX_LATE_PROOF_MS;
+        let proof = "unproven";
+        for (;;) {
+            proof = await this.confirmSubmitted(signature, baseline);
+            // Ordinary idle-path proof may return a strand immediately. After a
+            // native-queue recovery Enter, though, it can be the previous frame
+            // still on screen; only a strand that survives the bounded repaint
+            // window proves that Enter was swallowed.
+            if (proof === "submitted" || (proof === "stranded" && !waitThroughStranded))
+                return proof;
+            if (signature.unique && this.tmux?.capturePaneWithHistory) {
+                try {
+                    const history = await this.tmux.capturePaneWithHistory(300);
+                    const seen = this.paneEvidence(history, signature);
+                    const known = !this.backend?.isDeliveryInputReadyPane
+                        || this.backend.isDeliveryInputReadyPane(history)
+                        || this.backend.getBusyPattern?.()?.test(history);
+                    if (known && seen.payload > 0 && !seen.strandedInput)
+                        return this.submittedProof();
+                }
+                catch { /* a failed history read proves neither delivery nor loss */ }
+            }
+            if (Date.now() >= deadline)
+                return proof;
+            await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+        }
+    }
     /**
      * What the pane currently shows of a given message. Taken once before the
      * paste and once after, so confirmSubmitted can require a NEW marker or a NEW
@@ -5310,7 +5853,8 @@ export class Daemon extends EventEmitter {
                 const pane = await this.tmux.capturePane();
                 const evidence = this.paneEvidence(pane, signature);
                 const prompt = this.backend?.getBottomReadyPattern?.();
-                if (prompt && strandedAgendMessageInInput(pane, prompt)) {
+                if (prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
+                    && strandedAgendMessageInInput(pane, prompt)) {
                     // Whatever we paste now lands after it, and one Enter submits both as
                     // a single message. Nothing here can undo that; saying so beats
                     // letting two messages silently merge.
@@ -5331,7 +5875,8 @@ export class Daemon extends EventEmitter {
     paneEvidence(pane, signature) {
         const marker = this.backend?.getQueuedInputMarker?.();
         const prompt = this.backend?.getBottomReadyPattern?.();
-        const input = prompt ? inputAreaText(pane, prompt) : null;
+        const input = prompt && (!this.backend?.isDeliveryInputReadyPane || this.backend.isDeliveryInputReadyPane(pane))
+            ? inputAreaText(pane, prompt) : null;
         return {
             queued: marker ? pane.split(/\r?\n/).filter(row => marker.test(row)).length : 0,
             payload: countOccurrences(pane.replace(/\s+/g, ""), signature.value),
@@ -5382,6 +5927,13 @@ export class Daemon extends EventEmitter {
             return false;
         let proof = await this.confirmSubmitted(signature, baseline);
         if (proof === "unverifiable") {
+            if (this.backend?.isDeliveryInputReadyPane) {
+                // A Codex screen without a structurally current input/footer pair is
+                // not a successful snapshot restore. The old best-effort rule below
+                // is only for backends that expose no readable input row at all.
+                this.logger.warn({ label }, "Codex system paste could not be verified");
+                return false;
+            }
             // No input row to read: this backend gets exactly what the old pasteText
             // path gave it, including the unconditional second Enter for queue-less
             // TUIs that swallow the first. Narrowing that to one Enter on the grounds
@@ -5505,14 +6057,14 @@ export class Daemon extends EventEmitter {
         // an unmapped socket is retained for legacy/tests where mcp_ready was not
         // observed before the first tool call.
         const sourceSession = this.socketSessionNames.get(socket);
-        const replyAttempt = TURN_REPLY_TOOLS.has(tool) && (!sourceSession || sourceSession === this.name)
-            ? this.turnReplyGuard.beginToolAttempt(tool === "reply")
+        const replyAttempt = TURN_OUTBOUND_TOOLS.has(tool) && (!sourceSession || sourceSession === this.name)
+            ? this.turnReplyGuard.beginToolAttempt(tool === "reply", TURN_COMPLETION_TOOLS.has(tool))
             : null;
         // For now, log and respond. Full adapter routing will be wired in fleet manager.
         const respond = (result, error) => {
             // A message that verifiably went out stands down the dead-MCP proxy reply
             // for this turn: the agent proved it can still speak for itself.
-            if (!error && result != null && TURN_REPLY_TOOLS.has(tool)) {
+            if (!error && result != null && TURN_OUTBOUND_TOOLS.has(tool)) {
                 this.turnReplyGuard.settleToolAttempt(replyAttempt, true);
             }
             const sent = this.ipcServer?.send(socket, { requestId, result, error }) ?? false;
@@ -5983,26 +6535,33 @@ export class Daemon extends EventEmitter {
      * Bounded, and called BEFORE the pane lock is taken — waiting on the spawn while
      * holding the lock the spawn itself needs would deadlock.
      */
-    async waitForSpawnToSettle() {
+    /**
+     * Wait for an in-flight spawn to finish, up to the cap. Returns true when no
+     * spawn is in flight afterwards; false when the cap expired with one still
+     * running. A false return is NOT settled evidence — the caller must not
+     * treat the current generation as a completed spawn.
+     */
+    async waitForSpawnToSettle(capMs = SPAWN_SETTLE_MAX_WAIT_MS) {
         const settled = this.spawnSettled;
         if (!settled)
-            return;
+            return true;
         this.logger.debug("Holding delivery until the CLI has finished starting up");
         let timer;
         const cap = new Promise(resolve => {
-            timer = setTimeout(resolve, SPAWN_SETTLE_MAX_WAIT_MS);
+            timer = setTimeout(() => resolve(false), capMs);
             timer.unref?.();
         });
         try {
-            await Promise.race([settled, cap]);
+            const finished = await Promise.race([settled.then(() => true), cap]);
+            if (!finished) {
+                this.logger.warn("CLI still starting after the delivery hold — the pane is not settled evidence");
+            }
+            return finished;
         }
         finally {
             if (timer)
                 clearTimeout(timer);
         }
-        if (this.spawning) {
-            this.logger.warn("CLI still starting after the delivery hold — delivering anyway");
-        }
     }
     /** Spawn a CLI window. Returns true if --resume was used successfully. */
     /**
@@ -6093,7 +6652,7 @@ export class Daemon extends EventEmitter {
                 await this.failStartupIfBackendUnreachable();
                 if (this.backend.retriesResumeOnStartupFailure?.() !== false) {
                     this.logger.warn("Resume startup failed — retrying resume once before abandoning the session");
-                    await this.killProcessTree();
+                    await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                     await this.tmux.killWindow();
                     alive = await this.trySpawn(false, resumeBudget);
                     if (!alive) {
@@ -6119,7 +6678,7 @@ export class Daemon extends EventEmitter {
                         if (this.unprovenResumeFailures < Daemon.MAX_UNPROVEN_RESUME_FAILURES) {
                             // Keep the session and fail this attempt; the fleet retries with
                             // backoff, which is also how the backend-outage path behaves.
-                            await this.killProcessTree();
+                            await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                             await this.tmux.killWindow();
                             throw new Error(`CLI startup failed with a session to resume (attempt ${this.unprovenResumeFailures}/${Daemon.MAX_UNPROVEN_RESUME_FAILURES}) `
                                 + "— session kept, will retry");
@@ -6136,11 +6695,11 @@ export class Daemon extends EventEmitter {
                 // A fresh start that also failed retries once, as before. It never clears
                 // a session: nothing about a failed fresh launch says the stored
                 // conversation is unusable.
-                await this.killProcessTree();
+                await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                 await this.tmux.killWindow();
                 const retryAlive = await this.trySpawn(false, this.startupBudgetFor(false));
                 if (!retryAlive) {
-                    await this.killProcessTree();
+                    await this.killProcessTree("SIGTERM", "spawn: clearing the previous CLI process");
                     await this.tmux.killWindow();
                     throw new Error("CLI failed to start after retry");
                 }
@@ -6212,7 +6771,7 @@ export class Daemon extends EventEmitter {
         if (!this.backendOutage?.isActive(this.backendKey()))
             return;
         this.logger.warn("Backend unreachable — keeping the session and failing startup for a delayed retry");
-        await this.killProcessTree();
+        await this.killProcessTree("SIGTERM", "startup: backend unreachable");
         await this.tmux.killWindow();
         throw new BackendUnreachableStartupError(this.backendKey());
     }
@@ -6249,8 +6808,12 @@ export class Daemon extends EventEmitter {
         this.startupAborted = true;
         this.freezeRuntimeMonitors();
         this.pendingIpcRequests.clear();
+        if (this.museUsageRelay) {
+            await this.museUsageRelay.stop().catch(() => { });
+            this.museUsageRelay = null;
+        }
         try {
-            await this.killProcessTree();
+            await this.killProcessTree("SIGTERM", "startup aborted");
         }
         catch { /* nothing running */ }
         if (this.tmux) {
@@ -6277,12 +6840,13 @@ export class Daemon extends EventEmitter {
         }
     }
     /** Kill the entire process tree of the current tmux pane (CLI + MCP server). */
-    async killProcessTree(signal = "SIGTERM") {
+    async killProcessTree(signal = "SIGTERM", reason = "unspecified") {
         if (!this.tmux)
             return;
         try {
             const pid = await TmuxManager.getPanePid(this.tmuxSessionName, this.tmux.getWindowId());
             if (pid) {
+                this.noteStopRequest(signal, reason);
                 process.kill(-pid, signal);
                 this.logger.debug({ pid, signal }, "Killed process group");
             }
@@ -6304,6 +6868,129 @@ export class Daemon extends EventEmitter {
             reason: reuseWindow ? "wake" : this.lastSpawnAt > 0 ? "recovery" : "startup",
         }, () => this.trySpawnInsideGate(reuseWindow, startupTimeoutMs));
     }
+    /**
+     * One fresh pane capture judged as ready && !busy && !dialog. Transcript
+     * silence is deliberately NOT the gate: its monitor is inert for muse, so a
+     * quiet-but-working pane would read as idle and the respawn below would kill
+     * a live turn. Fail closed: an unreadable pane is never idle.
+     */
+    async isPaneAuthoritativelyIdle() {
+        const backend = this.backend;
+        if (!this.tmux || !backend)
+            return false;
+        let pane;
+        try {
+            pane = await this.tmux.capturePane();
+        }
+        catch {
+            return false;
+        }
+        if (backend.getBusyPattern?.()?.test(pane))
+            return false;
+        for (const dialog of this.deliveryBlockingDialogs()) {
+            if (Daemon.dialogMatches(dialog, pane))
+                return false;
+        }
+        if (!backend.getReadyPattern().test(pane))
+            return false;
+        return true;
+    }
+    /**
+     * Poll the authoritative pane check until it reports idle or the budget runs
+     * out. Each poll is a fresh capture, so a turn that ends mid-wait is seen.
+     */
+    async waitForAuthoritativePaneIdle(budgetMs = MUSE_DIRECT_RESUME_IDLE_BUDGET_MS, pollMs = MUSE_DIRECT_RESUME_IDLE_POLL_MS) {
+        const deadline = Date.now() + budgetMs;
+        for (;;) {
+            if (await this.isPaneAuthoritativelyIdle())
+                return true;
+            if (Date.now() >= deadline)
+                return false;
+            await new Promise(r => setTimeout(r, pollMs));
+        }
+    }
+    /**
+     * A relay crash must not make the daemon kill a live Muse process. The
+     * supervisor normally reclaims the same port; when that bounded recovery
+     * fails, move Muse back to a direct connection once it is authoritatively
+     * idle (session preserved via the existing resume path) and mark usage
+     * unavailable. The fallback flag also covers every later natural spawn.
+     * Never throws: the floor is the old behavior (flag set, relay stopped,
+     * next restart direct).
+     */
+    switchMuseToDirect(idleBudgetMs = MUSE_DIRECT_RESUME_IDLE_BUDGET_MS, idlePollMs = MUSE_DIRECT_RESUME_IDLE_POLL_MS) {
+        if (this.museRelayFallbackInFlight || this.startupAborted || this.backend?.binaryName !== "muse") {
+            return this.museRelayFallbackInFlight ?? Promise.resolve();
+        }
+        this.museRelayFallbackInFlight = (async () => {
+            this.museRelayFallback = true;
+            this.logger.warn("Muse usage relay could not recover — usage is unavailable until Muse restarts direct");
+            try {
+                if (this.museUsageRelay) {
+                    await this.museUsageRelay.stop().catch(() => { });
+                    this.museUsageRelay = null;
+                }
+            }
+            catch (err) {
+                this.logger.warn({ reason: err instanceof Error ? err.message : "relay stop failed" }, "Muse usage relay cleanup failed");
+            }
+            // Say so where the operator is looking: without this, muse keeps running
+            // with --base-url pointed at the dead relay port and every turn fails.
+            this.emit("muse_relay_exhausted", { name: this.name });
+            // An idle muse can be moved now; a busy, paused, or supervised-paused one
+            // is left alone — pausing/wake respawns direct anyway via the fallback
+            // flag, and interrupting a live turn (or fighting supervision) would be
+            // worse than waiting for the next natural restart.
+            if (this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped" || !this.tmux)
+                return;
+            const generation = this.spawnGeneration;
+            const idle = await this.waitForAuthoritativePaneIdle(idleBudgetMs, idlePollMs);
+            // Another spawn (wake/restart) completed while waiting — it owns the pane
+            // now, and respawning here would kill its fresh process mid-turn.
+            if (generation !== this.spawnGeneration)
+                return;
+            if (!idle)
+                return;
+            if (this.startupAborted || this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped")
+                return;
+            // Final re-verification under pane-write exclusion: no delivery can paste
+            // a new turn between this verdict and the respawn it authorizes. The
+            // spawn itself runs outside the lock (its dialog dismissal re-takes it).
+            let claimed = false;
+            await this.paneWriteLock.run(async () => {
+                const stillIdle = await this.isPaneAuthoritativelyIdle();
+                if (generation !== this.spawnGeneration)
+                    return;
+                if (!stillIdle)
+                    return;
+                // The final capture awaited above: re-check the full guards here, not
+                // just generation and idle — pause needs no generation bump to take
+                // effect, and respawning a freshly paused pane strands its state.
+                if (this.startupAborted || this.isPaused || this.healthCheckPaused || this.getProcessStatus() === "stopped")
+                    return;
+                this.beginSpawn();
+                claimed = true;
+            });
+            if (!claimed)
+                return;
+            try {
+                this.saveSessionId();
+                const ready = await this.trySpawn(true, this.wakeBudgetMs(30_000));
+                this.transcriptMonitor?.resetOffset();
+                if (ready)
+                    this.logger.info("Muse resumed direct after relay exhaustion (session preserved)");
+                else
+                    this.logger.warn("Muse direct resume after relay exhaustion did not become ready — next natural restart retries");
+            }
+            catch (err) {
+                this.logger.warn({ reason: err instanceof Error ? err.message : String(err) }, "Muse direct resume after relay exhaustion failed — next natural restart retries");
+            }
+            finally {
+                this.endSpawn();
+            }
+        })().finally(() => { this.museRelayFallbackInFlight = null; });
+        return this.museRelayFallbackInFlight;
+    }
     /**
      * Tell the agent its instructions moved, once the CLI is idle.
      *
@@ -6439,7 +7126,30 @@ export class Daemon extends EventEmitter {
         if (backendConfig.agentMode === "cli" && backendConfig.agentPort) {
             envPrefix += ` AGEND_PORT=${backendConfig.agentPort}`;
         }
-        const cmd = `${envPrefix} ` + this.backend.buildCommand(backendConfig);
+        // Muse's usage relay must be listening before its command is assembled.
+        // Preparation is best-effort: if the loopback port cannot be bound, leave
+        // museBaseUrl unset and let Muse connect directly so usage never blocks a
+        // conversation.
+        let launchConfig = backendConfig;
+        if (this.backend?.binaryName === "muse" && !this.museRelayFallback) {
+            try {
+                this.museUsageRelay ??= new MuseUsageRelay({
+                    instanceDir: this.instanceDir,
+                    onUnavailable: () => { void this.switchMuseToDirect(); },
+                });
+                const baseUrl = await this.museUsageRelay.start();
+                launchConfig = { ...backendConfig, museBaseUrl: baseUrl };
+            }
+            catch (err) {
+                this.logger.warn({ reason: err instanceof Error ? err.message : "relay unavailable" }, "Muse usage relay unavailable — using direct connection");
+                if (this.museUsageRelay) {
+                    await this.museUsageRelay.stop().catch(() => { });
+                    this.museUsageRelay = null;
+                }
+                clearMuseUsageSnapshot(this.instanceDir);
+            }
+        }
+        const cmd = `${envPrefix} ` + this.backend.buildCommand(launchConfig);
         // Ensure tmux session exists (may have been destroyed if all windows died)
         await TmuxManager.ensureSession(this.tmuxSessionName);
         if (this.stormWindow?.observeServerAlive(await TmuxManager.getServerPid(this.tmuxSessionName))) {
@@ -6553,6 +7263,10 @@ export class Daemon extends EventEmitter {
         let lastTransient = null;
         let captureFailures = 0;
         let attempts = 0;
+        // A safety-critical startup choice is one-shot. If the CLI has not
+        // repainted after Enter, let the following hold-only entry report it
+        // instead of sending a second Enter into a possibly changed screen.
+        const attemptedSafetyChoices = new Set();
         do {
             attempts++;
             let pane;
@@ -6589,6 +7303,11 @@ export class Daemon extends EventEmitter {
                 lastDialog = null;
                 for (const dialog of startupDialogs) {
                     if (Daemon.dialogMatches(dialog, pane)) {
+                        if (dialog.autoResolutionKey
+                            && (attemptedSafetyChoices.has(dialog.autoResolutionKey)
+                                || (this.autoResolvedDialogGeneration === this.spawnGeneration
+                                    && this.autoResolvedDialogKey === dialog.autoResolutionKey)))
+                            continue;
                         lastDialog = dialog;
                         cleanReadyPolls = 0;
                         // Start the parked clock for every delivery-blocking dialog, exact
@@ -6630,17 +7349,38 @@ export class Daemon extends EventEmitter {
                         // Restart is exactly when inbound messages pile up, and nothing gates
                         // delivery on `spawning`. Take the pane lock for the key sequence so a
                         // queued message cannot be pasted into a half-dismissed trust dialog.
-                        await this.paneWriteLock.run(async () => {
+                        const sent = await this.paneWriteLock.run(async () => {
+                            // The capture above may have gone stale while waiting for the
+                            // write lock. Trust/other safety prompts must still be the
+                            // CURRENT menu, with the same safe cursor, at the instant of
+                            // the key send. A changed pane falls through to the next scan.
+                            if (dialog.inputBlocked) {
+                                const currentPane = await this.tmux.capturePane();
+                                if (!Daemon.dialogMatches(dialog, currentPane))
+                                    return false;
+                            }
+                            if (dialog.autoResolutionKey) {
+                                attemptedSafetyChoices.add(dialog.autoResolutionKey);
+                                this.autoResolvedDialogGeneration = this.spawnGeneration;
+                                this.autoResolvedDialogKey = dialog.autoResolutionKey;
+                            }
                             for (const key of dialog.keys) {
                                 if (key === "Up" || key === "Down" || key === "Enter" || key === "Escape") {
-                                    await this.tmux.sendSpecialKey(key);
+                                    if (!await this.tmux.sendSpecialKey(key))
+                                        return false;
                                 }
                                 else {
-                                    await this.tmux.sendKeys(key);
+                                    if (!await this.tmux.sendKeys(key))
+                                        return false;
                                 }
                                 await new Promise(r => setTimeout(r, 200));
                             }
+                            return true;
                         });
+                        if (!sent) {
+                            matched = true;
+                            break;
+                        }
                         // Wait for next screen to render — bounded by what is left of the budget.
                         const renderWait = Math.max(0, Math.min(10_000, remaining()));
                         if (this.controlClient) {
@@ -6666,7 +7406,16 @@ export class Daemon extends EventEmitter {
                 // CLI is ready (pattern defined by each backend). Require it on two
                 // consecutive polls: the first ready frame is also the moment a late
                 // dialog is about to be painted over it.
-                if (this.backend.getReadyPattern().test(pane)) {
+                const readyPatternMatches = this.backend.getReadyPattern().test(pane);
+                // Codex's broad prompt/footer regex is necessary for inline layouts,
+                // but startup must also prove that the current composer owns the
+                // footer. This matters when a usage-limit picker is being resolved:
+                // its old prompt can remain in scrollback while the reserve session is
+                // still transitioning. Once the live composer is back, do not keep the
+                // scan parked on the old limit text.
+                const codexReady = this.backend.binaryName !== "codex"
+                    || this.isCodexLivePaneSnapshot(pane);
+                if (readyPatternMatches && codexReady) {
                     cleanReadyPolls++;
                     if (cleanReadyPolls >= 2 || remaining() <= 0) {
                         // A real ready prompt (with no fatal dialog on screen — those are