@songsid/agend 2.1.8-beta.1 → 2.1.8-beta.11

package/dist/daemon.js

@@ -454,6 +454,11 @@ const MUSE_DIRECT_RESUME_IDLE_POLL_MS = 5_000;
  * verified prompt before asking the native process to exit. Each instance is
  * bounded so a fleet update can stop all daemons in parallel. */
 const KIRO_STOP_IDLE_BUDGET_MS = 15_000;
+/**
+ * Bound after a non-stop quit before a dead pane with no relaunch is a wedge
+ * (#1030). Exceeds the wake budget (30s+) so a slow relaunch never trips it.
+ */
+const QUIT_RELAUNCH_WATCH_MS = 90_000;
 const KIRO_STOP_QUIT_GRACE_MS = 5_000;
 const KIRO_STOP_SIGTERM_GRACE_MS = 2_000;
 /**
@@ -906,6 +911,11 @@ export class BlockingProcessDetector {
         this.notified = false;
     }
 }
+/** Response types the fleet sends back for tool calls the daemon forwarded. */
+const FLEET_RESPONSE_TYPES = new Set([
+    "fleet_schedule_response", "fleet_outbound_response", "fleet_decision_response", "fleet_task_response",
+    "fleet_display_name_response", "fleet_description_response", "fleet_persona_emoji_response",
+]);
 export class Daemon extends EventEmitter {
     name;
     config;
@@ -1060,6 +1070,16 @@ export class Daemon extends EventEmitter {
      * would silently no-op exactly when we most need to stop feeding the CLI.
      */
     pausePending = false;
+    /**
+     * #1044: pause on the idle edge only if the auth error is still on screen.
+     * Set when nothing could vouch for the hit — the backend has no token-free
+     * auth check (muse), or it could not answer. A real expired session prints
+     * its failure at the end of the turn it broke, so it is still at the bottom
+     * when that turn ends; a phrase the pattern caught mid-turn has scrolled on
+     * by then. Recovery cannot decide this: an expired session is back at its
+     * prompt after every failed turn, which is what "recovered" means.
+     */
+    pauseReconfirmAuth = false;
     /**
      * An auth failure was detected and nothing has resolved it yet.
      *
@@ -1070,6 +1090,15 @@ export class Daemon extends EventEmitter {
     authFailureUnresolved = false;
     /** One login-screen auth report per spawn — the screen persists across polls. */
     loginScreenReported = false;
+    /**
+     * While the lifecycle is still starting this daemon, `pty_error` has no
+     * listener and `InstanceLifecycle.daemons` has no entry — so an incident the
+     * startup scan raises (sign-in screen, fatal modal) would be dropped on the
+     * floor while its dedupe flag stays set forever. Held here, then re-emitted by
+     * releaseStartupIncidents() once the handlers and the registry are in place.
+     */
+    holdingStartupIncidents = false;
+    heldStartupIncidents = [];
     /** A fatal startup screen (see StartupDialog.fatal) was already reported this run. */
     fatalStartupReported = false;
     /**
@@ -1140,6 +1169,8 @@ export class Daemon extends EventEmitter {
     lastProgressBroadcastAt = 0;
     // PTY error pattern monitoring
     errorMonitorTimer = null;
+    quitWatchTimer = null;
+    quitWatchToken = null;
     interactivePromptDetector = new InteractivePromptDetector();
     blockingProcessDetector = new BlockingProcessDetector();
     /** Same 5-min gate the error monitor uses, so a dead MCP server alerts once. */
@@ -1285,6 +1316,24 @@ export class Daemon extends EventEmitter {
         this.lastErrorCount.set(key, count);
         this.seededErrorCountBaselines.set(key, count);
     }
+    /** Start buffering `pty_error` until releaseStartupIncidents(); see holdingStartupIncidents. */
+    holdStartupIncidents() {
+        this.holdingStartupIncidents = true;
+    }
+    /** Stop buffering and deliver, in order, every `pty_error` raised while the lifecycle was starting us. */
+    releaseStartupIncidents() {
+        this.holdingStartupIncidents = false;
+        const held = this.heldStartupIncidents.splice(0);
+        for (const args of held)
+            super.emit("pty_error", ...args);
+    }
+    emit(event, ...args) {
+        if (event === "pty_error" && this.holdingStartupIncidents) {
+            this.heldStartupIncidents.push(args);
+            return true;
+        }
+        return super.emit(event, ...args);
+    }
     /**
      * Undo the auth suspicion a pattern match armed, once the backend's token-free
      * probe has said the credentials are fine.
@@ -1441,6 +1490,11 @@ export class Daemon extends EventEmitter {
     finishDurableDelivery(delivery, outcome, evidence) {
         if (!delivery)
             return;
+        // Delivered or uncertain means the pane write started: the work reached
+        // the CLI (or may have), so it is activity (Phase 2a). Only a failure is
+        // not — a pre-write failure never gets here; it is retried before begin.
+        if (outcome !== "failed")
+            this.noteWorkActivity();
         this.deliveryOutbox?.complete(delivery.deliveryId, this.bootId, delivery.attemptNo, outcome, evidence);
     }
     finishDurableSubmission(delivery, verdict) {
@@ -1459,6 +1513,56 @@ export class Daemon extends EventEmitter {
             return;
         this.retryDurableDeliveryBeforeBegin(delivery, reason);
     }
+    /** Restart the idle clock for work that reached the CLI, and persist it like a user inbound. */
+    noteWorkActivity(now = Date.now()) {
+        this.autoPauseController.recordActivity(now);
+        try {
+            writeLastInboundAt(this.instanceDir, now);
+        }
+        catch (err) {
+            this.logger.warn({ err: err.message }, "Failed to persist last activity timestamp");
+        }
+    }
+    /**
+     * A daemon started to wake, restart or explicitly start an instance begins
+     * its idle window now (Phase 2a). Only the fleet's own boot keeps the
+     * persisted last-inbound seed, so a long-idle fleet still pauses after a
+     * restart; a woken instance used to inherit a week-old timestamp and pause
+     * one second after it became ready.
+     */
+    seedActivityNow(now = Date.now()) {
+        this.autoPauseController.recordActivity(now);
+    }
+    /**
+     * Phase 2b (design §1.4): why this awake instance is not taking input, in
+     * words for a notice, or null when nothing known holds it. Read from the
+     * daemon's own state only; it never inspects the pane itself.
+     */
+    notAcceptingReason() {
+        if (this.pauseWakeState !== "active")
+            return `it is ${this.pauseWakeState}`;
+        if (this.inputBlockedDialogKey !== null)
+            return `a dialog is holding its input (${this.inputBlockedDialogKey})`;
+        if (this.authFailureUnresolved)
+            return "its login is failing";
+        if (this.instanceState === "stuck")
+            return "the CLI looks stuck";
+        return null;
+    }
+    workLeaseCheck = null;
+    /** Lifecycle-provided: whether the fleet holds a work lease on this instance. */
+    setWorkLeaseCheck(check) {
+        this.workLeaseCheck = check ?? null;
+    }
+    workLeaseActive() {
+        try {
+            return this.workLeaseCheck?.() === true;
+        }
+        catch (err) {
+            this.logger.debug({ err }, "Work lease check failed; treating as no lease");
+            return false;
+        }
+    }
     async start() {
         mkdirSync(this.instanceDir, { recursive: true });
         writeFileSync(join(this.instanceDir, "daemon.pid"), String(process.pid));
@@ -1506,21 +1610,7 @@ export class Daemon extends EventEmitter {
         await this.ipcServer.listen();
         ipcListening = true;
         // Permanent IPC dispatcher: routes responses to pending requests by type+id key
-        this.ipcServer.on("message", (msg) => {
-            const type = msg.type;
-            if (!type)
-                return;
-            // Build lookup key matching the pattern used when registering
-            let key;
-            if ((type === "fleet_schedule_response" || type === "fleet_outbound_response" || type === "fleet_decision_response" || type === "fleet_task_response" || type === "fleet_display_name_response" || type === "fleet_description_response") && msg.fleetRequestId) {
-                key = String(msg.fleetRequestId);
-            }
-            if (key && this.pendingIpcRequests.has(key)) {
-                const handler = this.pendingIpcRequests.get(key);
-                this.pendingIpcRequests.delete(key);
-                handler(msg);
-            }
-        });
+        this.ipcServer.on("message", (msg) => this.routeFleetResponse(msg));
         // IPC message relay: when daemon wants to push a channel message to Claude,
         // it broadcasts to all IPC clients (the MCP server is one of them).
         // When MCP server sends a tool_call, daemon handles it via the messageBus.
@@ -2477,6 +2567,13 @@ export class Daemon extends EventEmitter {
                     return;
                 const pane = await this.tmux.capturePane();
                 const inputBlockedDialog = this.updateInputBlockedState(pane, dialogs);
+                // A sign-in screen that appears AFTER the startup scan ended (first run:
+                // theme → login can take longer than its budget) is the same auth
+                // incident the scan reports. Structural predicate only — the loose
+                // patterns are for a fresh startup pane, not a long-lived transcript.
+                const loginFlow = LOGIN_FLOWS[this.config.backend ?? "claude-code"];
+                if (loginFlow?.loginScreenActive && this.reportLoginScreen(pane))
+                    return;
                 const interactivePrompt = this.interactivePromptDetector.observe(pane, Date.now(), this.instanceStateLastOutputAt);
                 if (interactivePrompt) {
                     this.logger.warn(interactivePrompt, "Interactive terminal prompt is waiting for human input");
@@ -3004,33 +3101,128 @@ export class Daemon extends EventEmitter {
             this.logger.warn(record, `${cliLabel} exited on its own (exit code ${exitCode ?? "unknown"}) — last output recorded`);
         }
     }
-    /** Send the backend-specific graceful quit command/key sequence. */
-    async sendQuitSequence(reason = "unspecified") {
+    /**
+     * Send the backend-specific graceful quit command/key sequence.
+     *
+     * Observability (#1030): every send is logged with reason + caller, the
+     * outcome is logged, and a non-stop quit arms a bounded relaunch watch —
+     * sol's silent wedge (quit landed, codex exited to its resume screen, no
+     * relaunch, daemon still running) was invisible precisely because none of
+     * this existed.
+     */
+    async sendQuitSequence(reason = "unspecified", caller = "unknown", opts) {
         if (!this.tmux || !this.backend)
             return false;
+        const backend = this.backend.binaryName;
         const quitCmd = this.backend.getQuitCommand();
         const quitKey = this.backend.getQuitKey?.();
+        const quitVia = quitCmd ? `quit command ${quitCmd}` : quitKey ? `quit key ${quitKey}` : "no quit sequence";
+        this.logger.info({ backend, quit: quitCmd ?? quitKey ?? null, reason, caller }, `Sending backend quit sequence (${reason} via ${caller})`);
         if (quitCmd || quitKey)
-            this.noteStopRequest(quitCmd ? `quit command ${quitCmd}` : `quit key ${quitKey}`, reason);
+            this.noteStopRequest(quitVia, reason);
+        let sent = false;
+        let step = "sendKeys";
         if (quitCmd) {
-            if (!await this.tmux.sendKeys(quitCmd))
-                return false;
-            // Delay before Enter to prevent tmux server races when instances stop in
-            // parallel (same pattern as pasteText).
-            await new Promise(r => setTimeout(r, 150));
-            return this.tmux.sendSpecialKey("Enter");
+            if (await this.tmux.sendKeys(quitCmd)) {
+                // Delay before Enter to prevent tmux server races when instances stop in
+                // parallel (same pattern as pasteText).
+                await new Promise(r => setTimeout(r, 150));
+                step = "enter";
+                sent = await this.tmux.sendSpecialKey("Enter");
+            }
+        }
+        else if (quitKey) {
+            step = "quit key";
+            sent = true;
+            const presses = Math.max(1, Math.floor(this.backend.getQuitKeyPresses?.() ?? 1));
+            for (let i = 0; i < presses; i++) {
+                if (!await this.tmux.sendSpecialKey(quitKey)) {
+                    sent = false;
+                    break;
+                }
+                if (i + 1 < presses)
+                    await new Promise(r => setTimeout(r, 250));
+            }
         }
-        if (!quitKey)
+        else {
+            this.logger.warn({ backend, reason, caller }, "Backend has no quit command or key — nothing sent");
             return false;
-        const presses = Math.max(1, Math.floor(this.backend.getQuitKeyPresses?.() ?? 1));
-        for (let i = 0; i < presses; i++) {
-            const sent = await this.tmux.sendSpecialKey(quitKey);
-            if (!sent)
-                return false;
-            if (i + 1 < presses)
-                await new Promise(r => setTimeout(r, 250));
         }
-        return true;
+        if (sent) {
+            this.logger.info({ backend, quit: quitCmd ?? quitKey, reason, caller }, "Backend quit sequence sent");
+            if (opts?.watchRelaunch)
+                this.armQuitRelaunchWatch(reason, caller, opts.watchMs);
+        }
+        else {
+            this.logger.warn({ backend, quit: quitCmd ?? quitKey, reason, caller, step }, "Backend quit sequence failed to send");
+        }
+        return sent;
+    }
+    /**
+     * Codex names its own resume command on its exit screen — the wedge
+     * signature. Backend-generic shell, codex-specific match (#1030 ask 4):
+     * other backends' panes simply never match.
+     */
+    isCodexResumeScreen(pane) {
+        return /codex\s+resume\b/i.test(pane);
+    }
+    clearQuitRelaunchWatch() {
+        if (this.quitWatchTimer) {
+            clearTimeout(this.quitWatchTimer);
+            this.quitWatchTimer = null;
+        }
+        // Invalidates any already-started checkQuitRelaunch whose pane reads are
+        // still pending: it must bail on return, not warn from stale results.
+        this.quitWatchToken = null;
+    }
+    /**
+     * After a non-stop quit, warn if the backend exited but nothing relaunched
+     * within the bound while this daemon still considers itself active.
+     * Skipped when paused/pausing/waking/stopped or a relaunch (new spawn
+     * generation) already happened — only the wedged state warns.
+     */
+    armQuitRelaunchWatch(reason, caller, delayMs = QUIT_RELAUNCH_WATCH_MS) {
+        this.clearQuitRelaunchWatch();
+        const generation = this.spawnGeneration;
+        const quitAt = Date.now();
+        const token = {};
+        this.quitWatchToken = token;
+        this.quitWatchTimer = setTimeout(() => {
+            this.quitWatchTimer = null;
+            void this.checkQuitRelaunch({ reason, caller, generation, quitAt, token }).catch(() => { });
+        }, delayMs);
+    }
+    async checkQuitRelaunch(opts) {
+        if (this.pauseWakeState !== "active")
+            return;
+        if (opts.generation !== this.spawnGeneration)
+            return;
+        if (!this.tmux)
+            return;
+        // TOCTOU guard: the token is captured at arm time, so a beginSpawn/stop
+        // that lands while the pane reads below are pending invalidates this
+        // check. Re-validate after every await before using the results.
+        const token = opts.token ?? this.quitWatchToken;
+        let pane;
+        let alive = true;
+        try {
+            const status = await this.tmux.getPaneStatus();
+            alive = !!status?.alive;
+            pane = await this.tmux.capturePane().catch(() => undefined);
+        }
+        catch {
+            return;
+        }
+        if (this.pauseWakeState !== "active")
+            return;
+        if (opts.generation !== this.spawnGeneration)
+            return;
+        if (token !== this.quitWatchToken)
+            return;
+        const resumeScreen = !!pane && this.isCodexResumeScreen(pane);
+        if (alive && !resumeScreen)
+            return;
+        this.logger.warn({ backend: this.backend?.binaryName, reason: opts.reason, caller: opts.caller, quitAt: opts.quitAt, paneAlive: alive, resumeScreen }, "codex-exited-without-relaunch: backend quit but no relaunch followed while this daemon is still active");
     }
     /**
      * Kiro drops `/quit` while a turn is running. Stop that turn first, then use
@@ -3054,6 +3246,7 @@ export class Daemon extends EventEmitter {
     }
     async stop() {
         this.logger.info("Stopping daemon instance");
+        this.clearQuitRelaunchWatch();
         this.fenceDeliveryWritesForStop();
         this.turnReplyGuard.reset();
         // Invalidate any bounded pre-Enter wait from the process generation being
@@ -3080,7 +3273,7 @@ export class Daemon extends EventEmitter {
             let killed = false;
             const windowId = this.tmux.getWindowId();
             const kiroReady = windowId ? await this.drainBusyKiroForStop(windowId) : true;
-            const quitSent = kiroReady && await this.sendQuitSequence("graceful stop");
+            const quitSent = kiroReady && await this.sendQuitSequence("graceful stop", "stop");
             const quitGraceMs = this.backend?.binaryName === "kiro-cli"
                 ? KIRO_STOP_QUIT_GRACE_MS : 3_000;
             const sigtermGraceMs = this.backend?.binaryName === "kiro-cli"
@@ -3166,13 +3359,16 @@ export class Daemon extends EventEmitter {
     /**
      * Answer a FleetManager state query. Most callers only need the cached state,
      * but lifecycle decisions such as post-reply Cancel retirement need an
-     * authoritative pane observation: after startup the last transition can stay
-     * "working" even though the CLI has since settled without emitting another
-     * control-mode output record.
+     * authoritative pane observation, as do delivery idle gates: after startup
+     * the last transition can stay "working" even though the CLI has since
+     * settled without emitting another control-mode output record.
      */
     async respondToInstanceStateQuery(msg, socket) {
         try {
-            if (msg.refresh === true) {
+            if (msg.deliveryIdle === true) {
+                await this.captureAndEvaluateInstanceState("delivery_idle_gate");
+            }
+            else if (msg.refresh === true) {
                 await this.captureAndEvaluateInstanceState("state_query");
             }
             const snapshot = this.getInstanceStateSnapshot();
@@ -3196,12 +3392,35 @@ export class Daemon extends EventEmitter {
      * failures: pause() alone no-ops while the CLI is busy/stuck, which is the
      * usual state when the error surfaces. Cleared by a successful pause or wake.
      */
-    requestPauseWhenIdle() {
+    requestPauseWhenIdle(opts = {}) {
         if (this.pauseWakeState === "paused")
             return;
+        const reconfirm = opts.reconfirmAuth === true;
+        // An auth request wins over a pending non-auth one: the marker must not
+        // later read as auto-wakeable when a login failure is among the causes.
+        const reason = opts.reason ?? "auth";
+        this.pendingPauseReason = this.pausePending && this.pendingPauseReason === "auth" ? "auth" : reason;
+        // A pause already pending unconditionally stays unconditional.
+        this.pauseReconfirmAuth = this.pausePending ? this.pauseReconfirmAuth && reconfirm : reconfirm;
         this.pausePending = true;
-    }
-    async pause() {
+        // A conditional request is the only pause path it has (#1044): decide on
+        // the current pane now instead of at the next state sweep, so a pane that
+        // is already idle is not left open to a delivery in the meantime.
+        if (reconfirm)
+            void this.captureAndEvaluateInstanceState("deferred_pause");
+    }
+    /** The backend's own auth-error pattern, within the pane's last rows. */
+    authErrorAtPaneBottom(pane) {
+        const rows = pane.replace(/\r/g, "").split("\n").filter(r => r.trim() !== "");
+        const bottom = rows.slice(-Daemon.AUTH_RECONFIRM_ROWS).join("\n");
+        return (this.backend?.getErrorPatterns?.() ?? [])
+            .filter(ep => ep.type === "auth_error")
+            .some(ep => new RegExp(ep.pattern.source, ep.pattern.flags.replace("g", "")).test(bottom));
+    }
+    static AUTH_RECONFIRM_ROWS = 15;
+    /** Why the deferred pause was requested; what its marker records (Phase 2a). */
+    pendingPauseReason = "auth";
+    async pause(reason = "operator") {
         if (this.pauseWakeState === "paused")
             return;
         if (this.pauseWakeState === "pausing" || this.pauseWakeState === "waking") {
@@ -3229,7 +3448,7 @@ export class Daemon extends EventEmitter {
         const transition = (async () => {
             try {
                 this.saveSessionId();
-                await this.sendQuitSequence(pauseReason);
+                await this.sendQuitSequence(pauseReason, "pause", { watchRelaunch: true });
                 let exited = false;
                 for (let i = 0; i < 15; i++) {
                     await new Promise(r => setTimeout(r, 200));
@@ -3254,7 +3473,7 @@ export class Daemon extends EventEmitter {
                 }
                 this.pauseWakeState = "paused";
                 this.autoPauseController.markPaused();
-                writePausedMarker(this.instanceDir, this.lastPausedAt ?? Date.now());
+                writePausedMarker(this.instanceDir, this.lastPausedAt ?? Date.now(), reason);
                 this.logger.info({ pausedAt: this.lastPausedAt }, "Instance auto-paused");
                 this.ipcServer?.broadcast({
                     type: "instance_state", instanceName: this.name, state: "paused", pausedAt: this.lastPausedAt,
@@ -3283,6 +3502,7 @@ export class Daemon extends EventEmitter {
         // An explicit wake (e.g. after the user re-logs in) cancels a deferred
         // auth pause — otherwise the instance would pause again the moment it idles.
         this.pausePending = false;
+        this.pauseReconfirmAuth = false;
         this.authFailureUnresolved = false;
         this.loginScreenReported = false;
         this.fatalStartupReported = false;
@@ -3410,8 +3630,20 @@ export class Daemon extends EventEmitter {
         // live, kept its warm slot, and re-raised a hang alert on every scan.
         if (this.pausePending && (snapshot.state === "idle" || snapshot.state === "stuck") && this.pasteQueueDepth === 0) {
             this.pausePending = false;
+            const reconfirm = this.pauseReconfirmAuth;
+            this.pauseReconfirmAuth = false;
+            // An unreadable pane keeps the pause: when in doubt, stop feeding a CLI
+            // that may be unable to answer (42512a46).
+            if (reconfirm && pane !== undefined && !this.authErrorAtPaneBottom(pane)) {
+                this.authFailureUnresolved = false;
+                this.logger.warn({ state: snapshot.state }, "Deferred auth pause dropped: the auth-error text is no longer at the bottom of the pane at the end of the turn, "
+                    + "and this backend has no auth check to confirm it (likely conversation text)");
+                return;
+            }
             this.pauseAllowStuck = snapshot.state === "stuck";
-            this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt });
+            const reason = this.pendingPauseReason;
+            this.pendingPauseReason = "auth";
+            this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt, reason });
             return;
         }
         // A restart deferred by a dead MCP server: the turn it must not interrupt is
@@ -3420,9 +3652,14 @@ export class Daemon extends EventEmitter {
             this.fireMcpRestartRequest("idle_edge");
             return;
         }
-        if (!this.pauseRequested && this.pasteQueueDepth === 0 && this.autoPauseController.observe(snapshot.state)) {
+        // A work lease (Phase 2a) holds only this idle-timeout pause: a target the
+        // fleet just woke for queued work, or one with a submission in flight, must
+        // not be put back to sleep before that work reaches it. The auth-deferred
+        // pause above and operator pauses never consult it.
+        if (!this.pauseRequested && this.pasteQueueDepth === 0 && this.autoPauseController.observe(snapshot.state)
+            && !this.workLeaseActive()) {
             this.pauseRequested = true;
-            this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt });
+            this.emit("auto_pause_requested", { name: this.name, idleSince: snapshot.stateChangedAt, reason: "idle" });
         }
     }
     /**
@@ -3841,14 +4078,39 @@ export class Daemon extends EventEmitter {
         }
         this.statePollInFlight = true;
         const captureStartedAt = Date.now();
+        const captureEpoch = `${this.spawnGeneration}:${this.launchAttempt}`;
+        const currentDeliveryCapture = () => captureEpoch === `${this.spawnGeneration}:${this.launchAttempt}`
+            && !this.spawning && !this.runtimeMonitorsFrozen && this.instanceStateMonitorActive;
         try {
             const pane = await this.tmux.capturePane();
+            // An old capture must not retire a new launch's transient guard either.
+            if (reason === "delivery_idle_gate" && !currentDeliveryCapture()) {
+                this.resetFooterFallback();
+                return;
+            }
+            // Delivery's unknown-footer proof also awaits the TTY mode. Validate
+            // output and launch freshness AFTER both awaits, before accepting it.
+            const deliveryCandidate = reason === "delivery_idle_gate"
+                ? await this.probeDeliveryIdleFallback(pane) : null;
+            if (reason === "delivery_idle_gate" && !currentDeliveryCapture()) {
+                this.resetFooterFallback();
+                return;
+            }
             this.updateInputBlockedState(pane);
+            // A monitor/lifecycle capture can see a busy moment between fleet polls.
+            // Even a stale capture of changed content disproves continuous stability;
+            // invalidate it before the output-freshness check can return early.
+            if (currentDeliveryCapture() && this.footerFallbackPaneKey !== null
+                && pane.replace(/⋆/gu, "").replace(/[ \t]+$/gmu, "") !== this.footerFallbackPaneKey) {
+                this.resetFooterFallback();
+            }
             // Output received while capture-pane was in flight makes this snapshot
             // stale. Its output handler has already armed a new debounce.
             const outputMovedDuringCapture = (expectedOutputAt > 0 && this.instanceStateLastOutputAt > expectedOutputAt)
                 || (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureStartedAt);
             if (outputMovedDuringCapture) {
+                if (reason === "delivery_idle_gate")
+                    this.resetFooterFallback();
                 if (reason === "output_probe") {
                     // A second burst overtook the probe. Do not bless its stale capture as
                     // idle: continuous output is the safer working signal, while the next
@@ -3859,6 +4121,9 @@ export class Daemon extends EventEmitter {
                 }
                 return;
             }
+            // Advance the shared 10s timer only for a fresh capture of this launch.
+            const deliveryFallback = deliveryCandidate === true
+                ? this.deliveryInputReadyPane(pane) : deliveryCandidate;
             const observedChangeAt = expectedOutputAt || captureStartedAt;
             // One observation per capture. This used to call observe() twice with the
             // same pane: the second call always saw an unchanged pane, so the
@@ -3874,7 +4139,17 @@ export class Daemon extends EventEmitter {
             // observe twice, which silently disabled the "content moved" branch.
             const structuredPeriodicIdle = this.backend?.isPeriodicRedrawIdlePane;
             let snapshot;
-            if (structuredPeriodicIdle && reason === "output_probe") {
+            if (deliveryFallback !== null) {
+                // A missing footer cannot fall through to a broad ready match. All
+                // of the same #1032 conditions must hold continuously for 10 seconds.
+                snapshot = this.instanceStateMachine.observe(pane, Date.now(), {
+                    settled: true,
+                    changeAt: observedChangeAt,
+                    forceReady: deliveryFallback,
+                    forceBusy: !deliveryFallback || paneActivity !== null,
+                });
+            }
+            else if (structuredPeriodicIdle && reason === "output_probe") {
                 const idlePane = structuredPeriodicIdle.call(this.backend, pane);
                 if (idlePane) {
                     if (this.instanceState === "idle") {
@@ -4015,6 +4290,8 @@ export class Daemon extends EventEmitter {
             }
         }
         catch (err) {
+            if (reason === "delivery_idle_gate")
+                this.resetFooterFallback();
             this.logger.debug({ err: err.message, reason }, "Instance state capture failed");
         }
         finally {
@@ -5045,10 +5322,13 @@ export class Daemon extends EventEmitter {
             // The pane text comes back with the verdict: a transient that is still
             // repainting is still working, and that is the only thing separating a
             // slow resume from a wedged one.
+            if (transient)
+                this.resetFooterFallback();
             return transient ? { state: "active", transient, pane } : { state: "clear" };
         }
         catch (err) {
             this.logger.debug({ err }, "capture-pane failed during the input-transient probe — pane state unknown");
+            this.resetFooterFallback();
             return { state: "unknown" };
         }
     }
@@ -5250,6 +5530,35 @@ export class Daemon extends EventEmitter {
         return !!this.backend?.isDeliveryInputReadyPane
             && this.inputTransientGuardGeneration === this.spawnGeneration;
     }
+    /**
+     * null preserves native readiness; false is an ineligible unknown layout.
+     * true means the caller may advance the timer after checking freshness.
+     * Share #1032's candidate/timer with the later paste gate, rather than
+     * reporting idle after 10s only to make that gate wait another 10s (#1035).
+     */
+    async probeDeliveryIdleFallback(pane) {
+        const inputReady = this.backend?.isDeliveryInputReadyPane;
+        const stableUnknown = this.backend?.isStableUnknownLayoutIdlePane;
+        if (!inputReady || !stableUnknown || inputReady.call(this.backend, pane)) {
+            this.resetFooterFallback();
+            return null;
+        }
+        const busy = this.backend?.getBusyPattern?.();
+        if (busy)
+            busy.lastIndex = 0;
+        if (!stableUnknown.call(this.backend, pane) || busy?.test(pane)
+            || this.backend?.getPaneActivity?.(pane)
+            || this.deliveryBlockingDialogs().some(dialog => Daemon.dialogMatches(dialog, pane))
+            || this.inputTransientInPane(pane)) {
+            this.resetFooterFallback();
+            return false;
+        }
+        if (await this.tmux?.getPaneInputMode?.() !== "raw") {
+            this.resetFooterFallback();
+            return false;
+        }
+        return true;
+    }
     /** Codex can paint a prompt before the TTY enters raw mode. Both are required. */
     async hasPositiveDeliveryInput() {
         if (!this.needsStartupInputProof())
@@ -5259,13 +5568,77 @@ export class Daemon extends EventEmitter {
             return !check;
         try {
             const mode = await this.tmux.getPaneInputMode?.();
-            if (mode !== "raw")
+            if (mode !== "raw") {
+                this.resetFooterFallback();
                 return false;
-            return check.call(this.backend, await this.tmux.capturePane());
+            }
+            return this.deliveryInputReadyPane(await this.tmux.capturePane());
         }
         catch {
+            this.resetFooterFallback();
+            return false;
+        }
+    }
+    /** Pane text of the current footer-fallback candidate, and since when it has been unchanged. */
+    footerFallbackPaneKey = null;
+    footerFallbackStableSince = 0;
+    /** The launch the candidate was seen in: a new spawn or launch attempt starts over. */
+    footerFallbackEpoch = null;
+    /**
+     * Forget the footer-fallback candidate. Called whenever the pane is seen
+     * outside the candidate state (busy, a dialog, a transient, unreadable) and
+     * on every spawn: "stable for UNKNOWN_LAYOUT_STABLE_MS" must mean this screen,
+     * continuously, not time accumulated across an interruption.
+     */
+    resetFooterFallback() {
+        this.footerFallbackPaneKey = null;
+        this.footerFallbackEpoch = null;
+    }
+    footerFallbackWarnedGeneration = null;
+    /**
+     * The input-row proof used before a paste (#931/#947), with one fallback
+     * (#1031). Codex sometimes paints an idle composer without its Context
+     * status item even though tui.status_line asks for it: after four fleet
+     * restarts, sol's resumed session showed only `⚠ 2 warnings · f2 to view`.
+     * The proof needs a recognised footer, so the first delivery after each
+     * restart waited 30 minutes, failed, and waited again, for seven hours.
+     *
+     * When the footer is the only thing missing, the #978 structural evidence
+     * stands in for it, all of it required: the backend's own stable-unknown
+     * idle check (an empty live composer; no busy row, esc-to-interrupt row,
+     * queued ↳ input or known picker), no input transient such as the resume
+     * load, and the same screen for UNKNOWN_LAYOUT_STABLE_MS. The raw-tty
+     * requirement stays with the caller.
+     */
+    deliveryInputReadyPane(pane) {
+        const check = this.backend?.isDeliveryInputReadyPane;
+        if (!check)
+            return true;
+        if (check.call(this.backend, pane)) {
+            this.footerFallbackPaneKey = null;
+            return true;
+        }
+        const stableUnknown = this.backend?.isStableUnknownLayoutIdlePane;
+        if (!stableUnknown?.call(this.backend, pane) || this.inputTransientInPane(pane)) {
+            this.footerFallbackPaneKey = null;
+            return false;
+        }
+        const key = pane.replace(/⋆/gu, "").replace(/[ \t]+$/gmu, "");
+        const epoch = `${this.spawnGeneration}:${this.launchAttempt}`;
+        const now = Date.now();
+        if (key !== this.footerFallbackPaneKey || epoch !== this.footerFallbackEpoch) {
+            this.footerFallbackPaneKey = key;
+            this.footerFallbackEpoch = epoch;
+            this.footerFallbackStableSince = now;
             return false;
         }
+        if (now - this.footerFallbackStableSince < UNKNOWN_LAYOUT_STABLE_MS)
+            return false;
+        if (this.footerFallbackWarnedGeneration !== this.spawnGeneration) {
+            this.footerFallbackWarnedGeneration = this.spawnGeneration;
+            this.logger.warn({ backend: this.backend?.binaryName, stableForMs: now - this.footerFallbackStableSince }, "Idle footer not recognised — delivering on the #978 fallback (stable empty composer, no busy/queued/dialog, raw tty, no transient)");
+        }
+        return true;
     }
     /**
      * Why a pane is not deliverable matters. "busy" may be handed to a native
@@ -5275,16 +5648,26 @@ export class Daemon extends EventEmitter {
      * pane proves nothing. The silence gate comes first and costs no capture.
      */
     async paneReadinessForDelivery(windowId) {
-        if (!this.isPaneIdleForDelivery(windowId))
+        // Each early return below is the pane seen outside the footer-fallback
+        // candidate state, and never reaches deliveryInputReadyPane: reset here.
+        if (!this.isPaneIdleForDelivery(windowId)) {
+            this.resetFooterFallback();
             return "busy";
+        }
         const probe = await this.probeBlockingDialog();
-        if (probe.state !== "clear")
+        if (probe.state !== "clear") {
+            this.resetFooterFallback();
             return probe.state;
+        }
         const transient = await this.probeInputTransient();
-        if (transient.state === "active")
+        if (transient.state === "active") {
+            this.resetFooterFallback();
             return "transient";
-        if (transient.state === "unknown")
+        }
+        if (transient.state === "unknown") {
+            this.resetFooterFallback();
             return "unknown";
+        }
         if (this.needsStartupInputProof()) {
             return await this.hasPositiveDeliveryInput() ? "ready" : "transient";
         }
@@ -5461,7 +5844,7 @@ export class Daemon extends EventEmitter {
             return "busy";
         if (this.backend?.getBusyPattern?.()?.test(pane))
             return "busy";
-        if (this.backend?.isDeliveryInputReadyPane && !this.backend.isDeliveryInputReadyPane(pane))
+        if (!this.deliveryInputReadyPane(pane))
             return "busy";
         if (strandedAgendMessageInInput(pane, prompt))
             return "stranded";
@@ -6501,6 +6884,18 @@ export class Daemon extends EventEmitter {
         }
         return undefined;
     }
+    /** The fleet's answers to forwarded tool calls: settle the pending request they name. */
+    routeFleetResponse(msg) {
+        const type = msg.type;
+        if (!type || !FLEET_RESPONSE_TYPES.has(type) || !msg.fleetRequestId)
+            return;
+        const key = String(msg.fleetRequestId);
+        const handler = this.pendingIpcRequests.get(key);
+        if (!handler)
+            return;
+        this.pendingIpcRequests.delete(key);
+        handler(msg);
+    }
     /**
      * Handle a tool call from the MCP server (forwarded by Claude).
      * Routes to the channel adapter via MessageBus.
@@ -6549,9 +6944,12 @@ export class Daemon extends EventEmitter {
             this.handleReleaseRepo(args, respond);
             return;
         }
-        if (tool === "set_display_name" || tool === "set_description") {
-            const type = tool === "set_display_name" ? "fleet_set_display_name" : "fleet_set_description";
-            const fleetReqId = `${tool === "set_display_name" ? "dn" : "desc"}_${++this.fleetRequestSeq}_${requestId}`;
+        if (tool === "set_display_name" || tool === "set_description" || tool === "list_emojis" || tool === "set_persona_emoji" || tool === "preview_emojis") {
+            const type = tool === "set_display_name" ? "fleet_set_display_name"
+                : tool === "set_description" ? "fleet_set_description"
+                    : tool === "list_emojis" ? "fleet_list_emojis"
+                        : tool === "preview_emojis" ? "fleet_preview_emojis" : "fleet_set_persona_emoji";
+            const fleetReqId = `${tool === "set_display_name" ? "dn" : tool === "set_description" ? "desc" : "emoji"}_${++this.fleetRequestSeq}_${requestId}`;
             const timeout = setTimeout(() => {
                 this.pendingIpcRequests.delete(fleetReqId);
                 respond(null, `${tool} timed out`);
@@ -6966,6 +7364,8 @@ export class Daemon extends EventEmitter {
      * into exactly the window this exists to close.
      */
     beginSpawn() {
+        // A relaunch settles any outstanding quit watch: the CLI came back.
+        this.clearQuitRelaunchWatch();
         // A restarted CLI has no trustworthy turn edge for the process it replaced.
         // v1 deliberately does not persist obligations across restarts: missing one
         // warning is safer than treating the replacement's startup idle as the old
@@ -7716,6 +8116,29 @@ export class Daemon extends EventEmitter {
             this.firstDeliveryDelay.recordReady();
         return ready;
     }
+    /**
+     * Report the CLI's logged-out startup screen as an auth incident. Returns true
+     * when this call reported it (the scan is then over: only re-login ends the
+     * state); false when the screen is absent or was already reported this spawn.
+     * `loginScreenActive`, when the backend flow has one, replaces the bare
+     * pattern test so a transcript that merely mentions the screen cannot trip it.
+     */
+    reportLoginScreen(pane) {
+        const flow = LOGIN_FLOWS[this.config.backend ?? "claude-code"];
+        const onScreen = flow?.loginScreenActive ? flow.loginScreenActive(pane) : flow?.loginScreenPattern?.test(pane) === true;
+        if (!onScreen || this.loginScreenReported)
+            return false;
+        this.loginScreenReported = true;
+        this.authFailureUnresolved = true;
+        this.logger.warn({ backend: this.config.backend }, "CLI is waiting at its sign-in screen — reporting auth error");
+        this.emit("pty_error", {
+            name: this.name,
+            type: "auth_error",
+            action: "pause",
+            message: "CLI is waiting at its sign-in screen — credentials are missing or expired",
+        });
+        return true;
+    }
     /**
      * Poll the pane within a wall-clock budget, dismiss the confirmation dialogs
      * the backend knows, and return true once the CLI shows a ready prompt with
@@ -7891,6 +8314,11 @@ export class Daemon extends EventEmitter {
                 }
                 if (this.dialogParkedSince !== 0 && !this.deliveryBlockingDialogs().some(d => Daemon.dialogMatches(d, pane)))
                     this.trackDialogParked(null);
+                // A sign-in screen that carries the ready pattern's own glyph (Claude's
+                // `❯ 1. …` login menu) must be recognised BEFORE the ready check, or the
+                // ready check swallows it and the incident is never reported (#1074).
+                if (LOGIN_FLOWS[this.config.backend ?? "claude-code"]?.loginScreenBeforeReady && this.reportLoginScreen(pane))
+                    return true;
                 // CLI is ready (pattern defined by each backend). Require it on two
                 // consecutive polls: the first ready frame is also the moment a late
                 // dialog is about to be painted over it.
@@ -7921,19 +8349,8 @@ export class Daemon extends EventEmitter {
                 // an auth error (the lifecycle double-checks with the token-free probe)
                 // instead of letting it decay into crash/hang/MCP-died noise, and stop
                 // the retry loop — only re-login (see /login) ends this state.
-                const loginScreen = LOGIN_FLOWS[this.config.backend ?? "claude-code"]?.loginScreenPattern;
-                if (loginScreen?.test(pane) && !this.loginScreenReported) {
-                    this.loginScreenReported = true;
-                    this.authFailureUnresolved = true;
-                    this.logger.warn({ backend: this.config.backend }, "CLI is waiting at its sign-in screen — reporting auth error");
-                    this.emit("pty_error", {
-                        name: this.name,
-                        type: "auth_error",
-                        action: "pause",
-                        message: "CLI is waiting at its sign-in screen — credentials are missing or expired",
-                    });
+                if (this.reportLoginScreen(pane))
                     return true;
-                }
                 // Fatal: command not found (must match full phrase to avoid false positives
                 // like Kiro's "agent X not found, using default")
                 if (/command not found|: not found$/m.test(pane))