@songsid/agend 2.2.0-beta.1 → 2.2.0-beta.11

package/dist/daemon.js

@@ -1,3 +1,4 @@
+import { AGENT_WHATS_NEW, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
 import { join, dirname, basename, resolve } from "node:path";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
 import { fileURLToPath } from "node:url";
@@ -8,6 +9,7 @@ import { rotateLogIfNeededAsync } from "./logger.js";
 import { coredumpFilterLaunchPrefix } from "./coredump-filter.js";
 import { mcpServerState } from "./mcp-liveness.js";
 import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
+import { writeBackgroundWorkEndedMarker } from "./background-work-ended.js";
 import { TmuxManager, resolveTmuxLogicalSize } from "./tmux-manager.js";
 import { TranscriptMonitor } from "./transcript-monitor.js";
 import { createTranscriptSource } from "./transcript-sources.js";
@@ -31,6 +33,7 @@ import { HangDetector } from "./hang-detector.js";
 import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
 import { buildFleetInstructions } from "./instructions.js";
+import { formatHumanInboundMessage, prepareDeliveryWire, steerInboundEnvelope, BTW_INBOUND_PREFIX, humanBodyHash, humanOwnerObjectId } from "./human-delivery-receipts.js";
 import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata, } from "./cross-instance-envelope.js";
 import { agendMessageInInput, bottomRowIsReady, inputAreaText, inputShowsPastedText, pastedTextSignature, pasteLeftInInput, strandedAgendMessageInInput } from "./pane-input-residue.js";
 import { TurnReplyGuard } from "./turn-reply-guard.js";
@@ -44,7 +47,9 @@ import { measureSyncWork, noteSyncWork } from "./sync-work-attribution.js";
 import { TranscriptDeltaReader } from "./transcript-delta-reader.js";
 import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
 import { codexLiveRowMatches } from "./backend/codex.js";
+import { claudeConfigDirFor, claudeProfileConfigDir, claudeSwitchDialog, claudeSwitchTargetMatches } from "./backend/claude-code.js";
 import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
+import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -77,10 +82,18 @@ const REPLY_GUARD_IDLE_CONFIRM_MS = 60_000;
  * down like a turn the transcript cannot place — never a recovery.
  */
 const TRANSCRIPT_RUNNING_HOLD_MAX_MS = 30 * 60_000;
+/**
+ * #1641: an open turn in the CLI's transcript holds the instance busy (no paste, whatever the pane shows) only while the
+ * transcript is still moving: a turn whose end was missed must not pin the instance busy forever. A live turn writes
+ * often; a long silent tool run shows its own busy row on the pane.
+ */
+export const TRANSCRIPT_OPEN_TURN_QUIET_MS = 15 * 60_000;
 const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. React with an emoji or use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, a brief react is sufficient. If you already replied to this message, do nothing. Do not reply to this system instruction except through the react or reply tool.";
 /** Point a resumed CLI at its one backend-native instruction source. */
-/** The outbox evidence for a delivery the CLI's transcript shows taken (#758; #1201 absorbed). */
-function transcriptMarkerEvidence(kind) {
+/** The outbox evidence for a delivery the CLI's transcript shows taken (#758; #1201 absorbed; #1647 a raw paste's text). */
+function transcriptMarkerEvidence(kind, rawPaste = false) {
+    if (rawPaste)
+        return "transcript-turn-user-entry-raw-paste-text";
     return kind === "user" ? "transcript-marker" : kind === "absorbed" ? "transcript-marker-absorbed" : "transcript-marker-queued";
 }
 export function buildInstructionReloadNotice(binaryName, instanceName, instanceDir, backendSource) {
@@ -472,6 +485,16 @@ const POST_ENTER_PROOF_WINDOW_MS = 3_000;
 /** A final bounded observation before an ambiguous Codex submit can be classified. */
 const CODEX_LATE_PROOF_MS = 5_000;
 const POST_ENTER_PROOF_POLL_MS = 250;
+/** #1647: a raw paste a pane with no transcript showed taken — its text left the input row (or the CLI's own busy marker
+ * replaced it), with output after the Enter. */
+const RAW_PASTE_LEFT_INPUT = "raw-paste-left-input-after-output";
+/**
+ * #1647/#1663 P1-2: backends whose transcript AgEnD holds for this instance alone, so a raw paste's exact text in it is
+ * this paste's turn. claude-code: the path is its own statusline.json's transcript_path (written by this instance's
+ * CLI). Not codex: its rollout is chosen by working directory, which another instance can share, and AgEnD holds no
+ * session id to bind it — so a codex raw paste the pane could not prove stays uncertain.
+ */
+const RAW_TEXT_TRANSCRIPT_BACKENDS = ["claude-code"];
 /**
  * A readerless CLI's delivery is proven by its own transcript, which lags the pane by a flush. Only a delta that was
  * read and carried no marker for this long is held against the delivery — a late flush must not raise a false ⚠️.
@@ -503,8 +526,16 @@ const DIALOG_PROBE_UNKNOWN_MAX = 40;
 /** Startup dialog scan: poll cadence and wall-clock budget (keys and waits included). */
 const STARTUP_DIALOG_POLL_MS = 500;
 const STARTUP_DIALOG_BUDGET_MS = 30_000;
+/** #1690: after AgEnD's own `/model`, how long the pane is read for claude's "Switch model?" or its result. */
+export const OWN_SWITCH_WAIT_MS = 6_000;
+/** #1690: after an answer to that dialog, how long it gets to go away. */
+const OWN_SWITCH_SETTLE_MS = 3_000;
 /** A blocking dialog still on screen this long after first being seen is reported for a human. */
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
+/** #1691: a prompt no table knows must sit unchanged this long (monotonic) before it holds deliveries and is reported. */
+export const UNRECOGNISED_PROMPT_STABLE_MS = 60_000;
+/** #1691: the rows under a prompt a backend without a composer reader shows its ready chrome in (status bar, hint). */
+const COMPOSER_TAIL_ROWS = 4;
 /** After a runtime dialog's keys, how long the pane gets to repaint before it is read again to see whether they took. */
 const DIALOG_ANSWER_SETTLE_MS = 300;
 /** Consecutive answers one runtime dialog ignored (still on screen right after the keys) before it is reported for a human. */
@@ -614,6 +645,10 @@ export function channelStatus(meta) {
     // they are the dashboard's ticks (the fleet routes them by the message id, never to a platform).
     if (!messageId || (!chatId && meta.source !== "web"))
         return undefined;
+    // #1823: a notice from AgEnD itself (a poll's results) names its chat so the answer goes there, but its message id
+    // is AgEnD's own, not a platform message: there is nothing to react to.
+    if (meta.source === "agend-system")
+        return undefined;
     if (!chatId)
         return { chatId: "", messageId };
     const threadId = meta.thread_id || undefined;
@@ -1058,6 +1093,10 @@ export class Daemon extends EventEmitter {
     ipcServer = null;
     messageBus;
     transcriptMonitor = null;
+    /** #1218: the transcript this instance's monitor follows now (the Log tab reads it on demand; nothing runs for it here). */
+    logTranscriptPath() { return this.transcriptMonitor?.currentPath() ?? null; }
+    /** #1218 (kiro): the launch this daemon's backend last built, for the Log's reason only (kiro-log-gate.ts). */
+    logLaunch() { return this.backend?.logLaunch?.() ?? null; }
     guardian = null;
     adapter = null;
     pendingIpcRequests = new Map();
@@ -1144,6 +1183,34 @@ export class Daemon extends EventEmitter {
     dialogParkedKey = null;
     dialogParkedInteractionEpisode = null;
     dialogParkedReported = false;
+    /**
+     * #1691: the prompt at the bottom of the pane that no backend table knows — its block, since when (performance.now)
+     * it has been unchanged, and whether that has lasted UNRECOGNISED_PROMPT_STABLE_MS. Updated by the runtime scan.
+     */
+    unrecognisedPrompt = null;
+    /**
+     * #1691: when (performance.now) the newest pane read that decided the evidence above was taken — a scan or a fresh
+     * read, confirming, restarting or ending it. A read taken before it finishes late and says nothing about now: it may
+     * neither clear, restart nor confirm (#1695 r4).
+     */
+    unrecognisedPromptReadAt = -Infinity;
+    /**
+     * #1691: the catch-all for that prompt, as a hold-only runtime dialog — so the delivery hold, awaiting_input, the
+     * Needs-you item and the single parked report are the existing ones. Never answered (hold-only, no keys).
+     */
+    unrecognisedPromptDialog = {
+        pattern: /(?!)unrecognised-prompt-1691/,
+        keys: [],
+        description: "a prompt AgEnD does not recognise",
+        holdOnly: true,
+        isActive: (pane) => this.unrecognisedPromptActive(pane),
+        requestIdentity: () => this.unrecognisedPrompt?.block ?? null,
+    };
+    /**
+     * #1690: AgEnD's own runtime `/model` in flight — from the moment its paste went in until its "Switch model?" dialog
+     * (if any) is answered. Every delivery is held meanwhile: the dialog's default cursor is Yes, a stray Enter confirms it.
+     */
+    ownSwitch = null;
     /**
      * The runtime dialog the monitor is answering, and how many of its answers in a row did nothing (the dialog was
      * still on screen right after the keys). Not the on-screen duration: a burst of FRESH prompts, each answered, has a
@@ -1237,6 +1304,11 @@ export class Daemon extends EventEmitter {
     turnReplyGuard = new TurnReplyGuard();
     /** #1510: turn boundaries from the CLI's transcript, for a backend whose guard reads its turn end there. */
     transcriptTurns = new TranscriptTurnLedger();
+    /** #1641: when this launch's transcript monitor last read anything (a turn boundary, a tool, assistant text); performance.now(). */
+    transcriptActivityAt = 0;
+    /** #1641: the launch and composer a stuck pane's idle evidence is about, and since when (performance.now()); see recoverStuck. */
+    stuckRecoveryKey = null;
+    stuckRecoverySince = 0;
     /** #1510: since when (monotonic) this generation has been held as running in the transcript. */
     transcriptRunningSince = null;
     /** Prevent a visible stale XML fragment from being recovered on later turns. */
@@ -1388,6 +1460,8 @@ export class Daemon extends EventEmitter {
     recentPastes = [];
     pendingInstructionsUpdate;
     pendingInstructionsNotice = false;
+    /** #1633: the one-time "what's new for you" notice, pasted before the next real delivery; recorded once pasted. */
+    pendingWhatsNew = null;
     // Whether the warmup steering-reload notice should be injected after spawn.
     // Set in trySpawn by comparing the freshly-built instructions against the
     // last value the agent was told about (prev-instructions). Skipped when
@@ -1856,8 +1930,14 @@ export class Daemon extends EventEmitter {
             this.finishDurableDelivery(delivery, "delivered", OUTPUT_EDGE_ONLY_EVIDENCE);
             return;
         }
+        // #1647: a raw paste on a pane with no transcript (kiro), taken by the CLI as its own input row shows.
+        if (verdict.proof === RAW_PASTE_LEFT_INPUT) {
+            this.finishDurableDelivery(delivery, "delivered", verdict.proof, verdict);
+            return;
+        }
         this.finishDurableDelivery(delivery, "delivered", verdict.transcriptProof
-            ? `positive submission proof; ${transcriptMarkerEvidence(verdict.transcriptProof)}` : "positive submission proof", verdict);
+            ? `positive submission proof; ${transcriptMarkerEvidence(verdict.transcriptProof, verdict.submissionMode === "raw_paste")}`
+            : "positive submission proof", verdict);
     }
     /**
      * Finish a delivery that only the output edge vouched for, by the delivery's own marker in the CLI's transcript (#758).
@@ -1873,23 +1953,28 @@ export class Daemon extends EventEmitter {
      * TRANSCRIPT_PROOF_WINDOW_MS). It never finishes a row that stop has handed to reconciliation; a pause or respawn
      * only ends the wait, falling back to today's outcome.
      */
-    async proveDeliveryFromTranscript(delivery, checkpoint) {
+    async proveDeliveryFromTranscript(delivery, checkpoint, rawPaste) {
         const spawn = this.spawnGeneration;
         const fence = this.launchFenceEpoch;
         let last = "unavailable";
         let outcome = "delivered";
         let evidence = OUTPUT_EDGE_ONLY_EVIDENCE;
+        // #1647: a raw paste has no marker; its text is the needle, and its pane proof already failed — so without the turn
+        // in the transcript it stays uncertain (with the pane's reason), never the output-edge outcome.
+        const needle = rawPaste ? { rawText: rawPaste.text } : delivery.deliveryId;
+        let found = false;
         try {
             for (let polls = 0; polls <= TRANSCRIPT_PROOF_WINDOW_MS / TRANSCRIPT_PROOF_POLL_MS; polls++) {
                 if (this.deliveryWritesStopping)
                     return; // reconciliation owns the row now
-                const found = await scanTranscriptForDeliveryMarker(checkpoint.path, checkpoint.offset, checkpoint.backend, delivery.deliveryId);
-                if (found === "user" || found === "absorbed" || found === "queued") {
+                const look = await scanTranscriptForDeliveryMarker(checkpoint.path, checkpoint.offset, checkpoint.backend, needle);
+                if (look === "user" || look === "absorbed" || look === "queued") {
+                    found = true;
                     outcome = "delivered";
-                    evidence = transcriptMarkerEvidence(found);
+                    evidence = transcriptMarkerEvidence(look, !!rawPaste);
                     break;
                 }
-                last = found;
+                last = look;
                 if (spawn !== this.spawnGeneration || fence !== this.launchFenceEpoch) {
                     last = "unavailable";
                     break;
@@ -1909,6 +1994,11 @@ export class Daemon extends EventEmitter {
         catch (err) {
             this.logger.debug({ err }, "Transcript proof of a delivery failed — keeping the output-edge outcome");
         }
+        if (rawPaste && !found) {
+            outcome = "uncertain";
+            evidence = `${rawPaste.unproven}; no-transcript-turn (${last})`;
+            this.logger.warn({ deliveryId: delivery.deliveryId, cause: evidence }, "Raw paste outcome uncertain — not re-pasting");
+        }
         // The settlement itself can throw (e.g. the outbox store is unhealthy), and this runs on a detached `void`
         // promise: an uncaught throw is an unhandled rejection, which the fleet restart path turns into a global fault.
         // Settle observably and leave the row for reconciliation — never a false completion, never another paste (#1207 P2).
@@ -1922,6 +2012,7 @@ export class Daemon extends EventEmitter {
         }
     }
     deferDurableDelivery(meta, reason) {
+        this.finishHumanReceipt(meta, { reached: false });
         const delivery = this.durableDeliveryAttempt(meta);
         if (delivery === null || delivery === false)
             return;
@@ -3174,7 +3265,6 @@ export class Daemon extends EventEmitter {
         if (this.runtimeMonitorsFrozen || this.errorMonitorTimer)
             return;
         const patterns = this.backend?.getErrorPatterns?.() ?? [];
-        const dialogs = this.backend?.getRuntimeDialogs?.() ?? [];
         if (!this.tmux)
             return;
         if (!this.backend)
@@ -3210,6 +3300,9 @@ export class Daemon extends EventEmitter {
                 scanStartedAt = performance.now();
                 if (stale())
                     return;
+                this.trackUnrecognisedPrompt(pane, captureMono, this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureAt);
+                // The backend's dialogs, and #1691's catch-all while an unrecognised prompt is active (decided just above).
+                const dialogs = this.runtimeDialogs();
                 if (this.instanceStateLastOutputAt > 0 && this.instanceStateLastOutputAt >= captureAt) {
                     this.unverifyInteraction(captureMono, captureOrder);
                 }
@@ -3689,14 +3782,21 @@ export class Daemon extends EventEmitter {
     isDeliveryEpochCurrent(epoch) {
         return epoch === this.deliveryEpoch;
     }
-    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch, confirmClear = false, durableAttempt) {
+    queueRawPaste(rawText, deliveryEpoch = this.deliveryEpoch, confirmClear = false, durableAttempt, ownSwitch) {
+        const reportSwitch = (result) => {
+            if (!ownSwitch)
+                return;
+            this.ipcServer?.broadcast({ type: "runtime_switch_result", id: ownSwitch.id, ...result });
+        };
         if (!this.tmux || !this.isDeliveryEpochCurrent(deliveryEpoch)) {
             if (durableAttempt)
                 this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste target unavailable before pane queue");
+            reportSwitch({ outcome: "not_sent" });
             return;
         }
         this.pasteLock = this.pasteLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                reportSwitch({ outcome: "not_sent" });
                 this.logger.info("Pending raw delivery dropped by user cancel");
                 if (durableAttempt)
                     this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste epoch changed while queued");
@@ -3708,6 +3808,7 @@ export class Daemon extends EventEmitter {
                 if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     if (durableAttempt)
                         this.retryDurableDeliveryBeforeBegin(durableAttempt, "raw_paste epoch changed while waking");
+                    reportSwitch({ outcome: "not_sent" }); // #1690: cancelled before anything was typed — said at once, nothing saved
                     return;
                 }
                 const delivered = await this.deliverMessage(rawText, undefined, {
@@ -3715,11 +3816,25 @@ export class Daemon extends EventEmitter {
                     verdict,
                     durableAttempt,
                     preserveExactBytes: true,
+                    // #1690: our own /model holds every other delivery from its write on — before the lock is released, so a steer
+                    // or /btw waiting on it cannot type into the gap before claude paints "Switch model?" (default cursor: Yes).
+                    ...(ownSwitch ? { onPaneWritten: () => { this.ownSwitch = ownSwitch; } } : {}),
                 });
                 if (delivered)
                     this.finishDurableSubmission(durableAttempt ?? null, verdict);
                 else if (durableAttempt && verdict.paneWriteStarted) {
-                    this.finishDurableDelivery(durableAttempt, "uncertain", `${verdict.phase ?? "raw-paste"}:${verdict.proof ?? "unverified"}`);
+                    const unproven = `${verdict.phase ?? "raw-paste"}:${verdict.proof ?? "unverified"}`;
+                    const checkpoint = verdict.transcriptCheckpoint;
+                    if (checkpoint && RAW_TEXT_TRANSCRIPT_BACKENDS.includes(checkpoint.backend)) {
+                        // #1647: the pane could not show it, but the CLI's transcript records the turn the paste started — later
+                        // than the pane window sometimes. Wait for it there (bounded), off the paste lock.
+                        this.logger.info({ deliveryId: durableAttempt.deliveryId, unproven }, "Raw paste not proven on the pane — asking the CLI's transcript for the turn it started");
+                        void this.proveDeliveryFromTranscript(durableAttempt, checkpoint, { text: rawText, unproven });
+                    }
+                    else {
+                        this.logger.warn({ deliveryId: durableAttempt.deliveryId, cause: unproven }, "Raw paste outcome uncertain — not re-pasting");
+                        this.finishDurableDelivery(durableAttempt, "uncertain", unproven);
+                    }
                 }
                 else if (durableAttempt && verdict.durableBeginCommitted) {
                     this.abortDurableDelivery(durableAttempt, `${verdict.phase ?? "raw-paste"}:${verdict.proof ?? "no-pane-write"}`);
@@ -3736,10 +3851,31 @@ export class Daemon extends EventEmitter {
                 else if (durableAttempt)
                     this.retryDurableDeliveryBeforeBegin(durableAttempt, err.message);
                 this.logger.warn({ err: err.message }, "raw_paste delivery error");
+                if (ownSwitch) {
+                    if (this.ownSwitch === ownSwitch)
+                        this.ownSwitch = null;
+                    reportSwitch({ outcome: "not_confirmed" });
+                }
                 return;
             }
             if (confirmClear)
                 await this.confirmBackendClearDialog();
+            if (ownSwitch) {
+                if (this.ownSwitch !== ownSwitch)
+                    reportSwitch({ outcome: "not_sent" }); // its write never began
+                else {
+                    try {
+                        reportSwitch(await this.answerOwnSwitchDialog(ownSwitch));
+                    }
+                    catch (err) {
+                        this.logger.warn({ err: err.message }, "Answering our own model switch failed");
+                        reportSwitch({ outcome: "not_confirmed" });
+                    }
+                    finally {
+                        this.ownSwitch = null;
+                    }
+                }
+            }
             this.logger.debug({ text: rawText.slice(0, 100) }, "Raw paste delivered");
         });
         this.pasteLock = this.pasteLock.catch(err => {
@@ -3758,7 +3894,93 @@ export class Daemon extends EventEmitter {
             this.deferDurableDelivery(deliveryMeta, "invalid raw_paste delivery attempt metadata");
             return;
         }
-        this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch), msg.confirm_clear === true, durableAttempt ? { ...durableAttempt, submissionMode: "raw_paste" } : undefined);
+        const sw = msg.runtime_switch;
+        const ownSwitch = sw && typeof sw.id === "string" && sw.kind === "model" && typeof sw.requested === "string"
+            ? { id: sw.id, kind: "model", requested: sw.requested } : undefined;
+        this.queueRawPaste(msg.content, this.captureDeliveryEpoch(msg.delivery_epoch), msg.confirm_clear === true, durableAttempt ? { ...durableAttempt, submissionMode: "raw_paste" } : undefined, ownSwitch);
+    }
+    /**
+     * #1690 (the user's choice A): after AgEnD's own `/model <name>`, claude may ask "Switch model?" (a warm cache for
+     * another model). When the model it names is the one asked for, answer Yes; otherwise No (Escape — `Kept model as …`),
+     * and say so. Every key goes on a freshly read, verified dialog under the pane write lock: the same target, and for
+     * Enter the cursor on "1. Yes"; the cursor is walked there with Up, one verified step at a time, never a blind key.
+     * Without the dialog, claude's own "Set model to …" line after the command is the result.
+     */
+    async answerOwnSwitchDialog(spec) {
+        const tmux = this.tmux;
+        if (!tmux)
+            return { outcome: "not_confirmed" };
+        const read = () => tmux.capturePane().catch(() => "");
+        const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+        /** One key on a dialog re-read under the lock: still the same target, and (when given) the cursor where expected. */
+        const press = (target, cursor, key) => this.paneWriteLock.run(async () => {
+            if (this.tmux !== tmux)
+                return false;
+            const now = claudeSwitchDialog(await read());
+            if (!now || now.kind !== "model" || now.target !== target || (cursor !== null && now.cursor !== cursor))
+                return false;
+            return tmux.sendSpecialKey(key);
+        });
+        const gone = async () => {
+            const until = performance.now() + OWN_SWITCH_SETTLE_MS;
+            while (performance.now() < until) {
+                if (!claudeSwitchDialog(await read()))
+                    return true;
+                await sleep(150);
+            }
+            return false;
+        };
+        const deadline = performance.now() + OWN_SWITCH_WAIT_MS;
+        while (performance.now() < deadline && this.tmux === tmux) {
+            const pane = await read();
+            const dialog = claudeSwitchDialog(pane);
+            if (dialog && dialog.kind === "model") {
+                const shown = dialog.target;
+                if (!claudeSwitchTargetMatches(spec.requested, shown)) {
+                    const answered = await press(shown, null, "Escape") && await gone();
+                    this.logger.warn({ requested: spec.requested, shown, answered }, "claude would switch to another model than asked — answered No");
+                    return { outcome: "mismatch", shown, answered };
+                }
+                // Walk the cursor to "1. Yes" (it starts there; a human may have moved it): Up from row 2, re-read each time.
+                let current = dialog;
+                for (let step = 0; step < 2 && current.cursor === 2; step++) {
+                    if (!await press(shown, 2, "Up"))
+                        break;
+                    await sleep(120);
+                    const next = claudeSwitchDialog(await read());
+                    if (!next || next.target !== shown)
+                        break;
+                    current = next;
+                }
+                if (current.cursor !== 1 || !await press(shown, 1, "Enter") || !await gone()) {
+                    this.logger.warn({ requested: spec.requested, shown, cursor: current.cursor }, "Our own model switch dialog could not be confirmed on a verified cursor — left for a human");
+                    return { outcome: "not_confirmed", shown };
+                }
+                this.logger.info({ requested: spec.requested, shown }, "Confirmed our own model switch (claude: the next reply re-reads the history)");
+                return { outcome: "switched", confirmed: true, shown };
+            }
+            if (Daemon.switchResultAfterCommand(pane, spec.requested))
+                return { outcome: "switched", confirmed: false };
+            await sleep(200);
+        }
+        return { outcome: "not_confirmed" };
+    }
+    /**
+     * #1690: claude's "Set model to …" line under our `/model <requested>` (no dialog was needed). Only the newest command
+     * on the pane counts: an older identical `/model` with its result further up (switched away and back) must not pass
+     * for this one before it has even painted — that left its dialog unanswered (live, 2.1.296).
+     */
+    static switchResultAfterCommand(pane, requested) {
+        const rows = pane.replace(/\r/g, "").split("\n");
+        let last = -1;
+        for (let i = rows.length - 1; i >= 0; i--)
+            if (/^❯[ \t\u00a0]+\S/.test(rows[i])) {
+                last = i;
+                break;
+            }
+        if (last < 0 || rows[last].replace(/^❯[ \t\u00a0]+/, "").trimEnd() !== `/model ${requested}`)
+            return false;
+        return rows.slice(last + 1).some(row => /^\s*⎿?\s*Set model to /.test(row));
     }
     /**
      * Confirm a backend's terminal-level /clear prompt after the channel-level
@@ -4021,6 +4243,13 @@ export class Daemon extends EventEmitter {
         if (!backend.quitBlockedByDialog(pane))
             return false;
         this.logger.warn({ reason }, "The CLI asked to confirm its exit (background work is running) — cancelling that prompt and stopping the process, not answering it");
+        // #1716: the background work is about to be ended — record it where the
+        // stop/restart reply and the instance topic notice can report it, so the
+        // kill is never silent.
+        try {
+            writeBackgroundWorkEndedMarker(this.instanceDir, reason);
+        }
+        catch { /* reporting only */ }
         await this.tmux.sendSpecialKey("Escape").catch(() => false);
         return true;
     }
@@ -4222,7 +4451,9 @@ export class Daemon extends EventEmitter {
             // Bare backend regexes are not proof of a live modal. The canonical
             // isActive predicate replaces pattern.test(), preserving table order.
             const dialog = dialogs.find(d => d.isActive && (d.inputBlocked || d.blocksDelivery || d.holdOnly)
-                && Daemon.dialogMatches(d, pane));
+                && Daemon.dialogMatches(d, pane)
+                // #1690: AgEnD's own switch dialog, being answered right now, is nobody's to answer.
+                && !(this.ownSwitch && claudeSwitchDialog(pane) !== null));
             if (dialog) {
                 const identity = dialog.requestIdentity?.(pane) ?? pane.replace(/\r/g, "")
                     .split("\n").map(row => row.replace(/^([ \t]*)[❯›]([ \t]+)(?=\d\.|Yes\b|No\b|Resume\b)/, "$1$2").trimEnd())
@@ -4238,7 +4469,7 @@ export class Daemon extends EventEmitter {
         // No captured text leaves this function or the private observer identity.
         return evidence ? { ...evidence, identity: createHash("sha256").update(evidence.identity).digest("hex") } : null;
     }
-    observeInteractionPane(pane, observedAt, monotonicAt, dialogs = this.backend?.getRuntimeDialogs?.() ?? [], order = ++this.interactionCaptureSerial, allowConfirmation = true) {
+    observeInteractionPane(pane, observedAt, monotonicAt, dialogs = this.runtimeDialogs(), order = ++this.interactionCaptureSerial, allowConfirmation = true) {
         const owner = this.interactionOwner();
         const evidence = this.interactionEvidence(pane, dialogs);
         if (!this.interactionObservation.observe(evidence, owner, observedAt, monotonicAt, this.interactionOutputRevision !== this.interactionObservedOutputRevision, order))
@@ -4351,6 +4582,39 @@ export class Daemon extends EventEmitter {
             this.pauseRequested = false;
             return;
         }
+        // #1717: an idle pause is AgEnD-initiated and silent — it must not kill
+        // the user's running background work the way an explicit stop may. Defer
+        // this cycle while the backend reports background work; the next idle
+        // tick retries once the task ends. A pane-capture failure proceeds (the
+        // quit-menu handler below stays the backstop), never wedges unpaused.
+        if (this.backend?.backgroundWorkRunning && this.tmux) {
+            const tmux = this.tmux;
+            const windowId = tmux.getWindowId?.();
+            const generation = this.spawnGeneration;
+            let pane = null;
+            try {
+                pane = await tmux.capturePane();
+            }
+            catch { /* capture failed — pause as before, after revalidation */ }
+            // #1730 P2-2: the await yields — the pane read is only valid for the
+            // world it was taken from. Revalidate owner, phase, state and queue
+            // before acting on it; anything that moved defers this cycle.
+            if (this.tmux !== tmux
+                || this.tmux?.getWindowId?.() !== windowId
+                || this.spawnGeneration !== generation
+                || this.getPauseWakeState() !== "active"
+                || !(this.instanceState === "idle" || (allowStuck && this.instanceState === "stuck"))
+                || this.pasteQueueDepth > 0) {
+                this.logger.info("Deferring auto-pause: pause preconditions changed during the pane read");
+                this.pauseRequested = false;
+                return;
+            }
+            if (pane !== null && this.backend?.backgroundWorkRunning?.(pane)) {
+                this.logger.info("Deferring auto-pause: background work is still running");
+                this.pauseRequested = false;
+                return;
+            }
+        }
         this.pauseWakeState = "pausing";
         this.healthCheckPaused = true;
         this.freezeRuntimeMonitors();
@@ -4723,10 +4987,7 @@ export class Daemon extends EventEmitter {
                 backend: resumeBackend ?? "unknown",
                 cwd: resumeCwd,
                 armedAt: Date.now(),
-                before: readResumeFingerprint(normalizeResumeBackend(resumeBackend), {
-                    instanceDir: this.instanceDir,
-                    workingDirectory: resumeCwd,
-                }),
+                before: readResumeFingerprint(normalizeResumeBackend(resumeBackend), this.resumeRoots(resumeCwd)),
             });
         }
     }
@@ -4772,7 +5033,7 @@ export class Daemon extends EventEmitter {
             && this.spawnGeneration === gateSpawn
             && this.launchFenceEpoch === gateFence;
         const backend = this.resolveResumeBackend() ?? normalizeResumeBackend(marker.backend);
-        const roots = { instanceDir: this.instanceDir, workingDirectory: this.config.working_directory ?? "" };
+        const roots = this.resumeRoots(this.config.working_directory ?? "");
         // This boot's CLI spawn is what the daemon itself caused: pre-restart
         // writes (including pre-crash progress) are excluded, and the flush
         // grace holds the decision until post-spawn writes are observable.
@@ -5041,9 +5302,68 @@ export class Daemon extends EventEmitter {
     buildTranscriptMonitor(source) {
         const monitor = new TranscriptMonitor(this.instanceDir, this.logger, source);
         this.transcriptTurns.reset();
-        monitor.on("turns", (turns) => this.transcriptTurns.observe(turns));
+        this.transcriptActivityAt = 0;
+        // Monotonic: a wall-clock correction must neither end nor extend the open-turn hold (#1641 R1).
+        const touch = () => { this.transcriptActivityAt = performance.now(); };
+        monitor.on("turns", (turns) => { this.transcriptTurns.observe(turns, performance.now()); touch(); });
+        // #1641 R2: a re-baselined source starts over, and so does what it said (an open turn read before is withdrawn).
+        monitor.on("reset", () => { if (this.transcriptMonitor === monitor) {
+            this.transcriptTurns.reset();
+            this.transcriptActivityAt = 0;
+        } });
+        for (const event of ["tool_use", "tool_result", "assistant_text"])
+            monitor.on(event, touch);
         return monitor;
     }
+    /**
+     * #1641: what the CLI's own transcript (codex's rollout) says about its turn. `open`: a turn started and has not ended,
+     * and the transcript moved within TRANSCRIPT_OPEN_TURN_QUIET_MS. `closed`: every turn read since this launch's monitor
+     * began has ended. `unknown`: not a transcript backend, nothing followed, or an open turn gone quiet (a missed end).
+     */
+    transcriptTurnState(now = performance.now()) {
+        if (this.backend?.turnEndFromTranscript !== true || this.transcriptMonitor?.following() !== true)
+            return "unknown";
+        // #1641 R2: an empty ledger after a baseline that could not see the current turn's start is not "closed".
+        if (this.transcriptMonitor.turnStateKnown?.() !== true)
+            return "unknown";
+        const since = this.transcriptTurns.openSince();
+        if (since === null)
+            return "closed";
+        return now - Math.max(since, this.transcriptActivityAt) < TRANSCRIPT_OPEN_TURN_QUIET_MS ? "open" : "unknown";
+    }
+    /**
+     * #1641: a stuck pane that is in fact an idle CLI (a footer this build cannot read) must not stay stuck for hours with
+     * every delivery parked behind it. It recovers when the backend sees its own live, EMPTY composer with no busy, queued
+     * or dialog marker (isStableUnknownLayoutIdlePane) AND the transcript shows no open turn — or, with no transcript to
+     * ask, that same composer held unchanged for UNKNOWN_LAYOUT_STABLE_MS (#978's rule). An open turn never recovers.
+     */
+    recoverStuck(pane, snapshot, changeAt, turn) {
+        const machine = this.instanceStateMachine;
+        const idleComposer = this.backend?.isStableUnknownLayoutIdlePane?.(pane) === true;
+        // The resume load (#1031: `Resuming session…` over the same composer) is input that is not open yet (#1641 R1).
+        if (!machine || !idleComposer || turn === "open" || this.inputTransientInPane(pane)) {
+            this.stuckRecoveryKey = null;
+            return snapshot;
+        }
+        // The evidence is about this launch and this screen. Once it holds, it keeps holding — a still pane reads stuck
+        // again at the next sweep (its footer is still unreadable) and must not start the window over (#1641 R1).
+        const mono = performance.now();
+        const key = `${this.spawnGeneration}:${this.launchAttempt}\n${pane.replace(/⋆/gu, "").replace(/[ \t]+$/gmu, "")}`;
+        if (key !== this.stuckRecoveryKey) {
+            this.stuckRecoveryKey = key;
+            this.stuckRecoverySince = mono;
+        }
+        if (turn === "unknown" && mono - this.stuckRecoverySince < UNKNOWN_LAYOUT_STABLE_MS)
+            return snapshot;
+        // A footer this build cannot read stays unreadable: the same still pane reads stuck again at every sweep and is
+        // recovered again. Only the edge into idle is news.
+        const fields = { evidence: turn === "closed" ? "transcript_no_open_turn" : "stable_empty_composer", unchangedForMs: snapshot.unchangedForMs };
+        if (this.instanceState !== "idle")
+            this.logger.info(fields, "Stuck instance recovered — the CLI shows its idle composer and is not running a turn (#1641)");
+        else
+            this.logger.debug(fields, "Still idle on its unreadable footer — the stuck reading was recovered again (#1641)");
+        return machine.observe(pane, Date.now(), { settled: true, changeAt, forceReady: true });
+    }
     replyCompletionGuardEnabled() {
         return this.config.reply_completion_guard !== false
             && this.backend?.replyCompletionGuard === true;
@@ -5425,7 +5745,9 @@ export class Daemon extends EventEmitter {
                     // a pair every ~1.6s for as long as the repaint lasted (#1116). Real
                     // work cannot hide behind this: it changes the layout, the next
                     // output arms another probe, and the debounce capture still fires.
-                    if (this.instanceState === "idle" && this.backend?.isPeriodicRedrawIdlePane?.(pane) === true)
+                    // #1641: never while the transcript shows a turn running — that idle-looking screen is mid-turn.
+                    if (this.instanceState === "idle" && this.backend?.isPeriodicRedrawIdlePane?.(pane) === true
+                        && this.transcriptTurnState() !== "open")
                         return;
                     // A second burst overtook the probe. Do not bless its stale capture as
                     // idle: continuous output is the safer working signal, while the next
@@ -5440,6 +5762,8 @@ export class Daemon extends EventEmitter {
                 return;
             if (!this.observeInteractionPane(pane, captureStartedAt, interactionCaptureAt, undefined, interactionCaptureOrder, reason !== "interaction_confirmation"))
                 return;
+            // #1691: an accepted capture of this launch is a fresh read for the unrecognised-prompt evidence too (#1695 r3).
+            this.noteFreshPaneRead(pane, interactionCaptureAt);
             this.updateInputBlockedState(pane);
             // Advance the shared 10s timer only for a fresh capture of this launch.
             const deliveryFallback = deliveryCandidate === true
@@ -5458,6 +5782,10 @@ export class Daemon extends EventEmitter {
             // decisions about *now*. The old double-observe expressed that by calling
             // observe twice, which silently disabled the "content moved" branch.
             const structuredPeriodicIdle = this.backend?.isPeriodicRedrawIdlePane;
+            // #1641: the transcript outranks the pane: while it shows the turn running, no reading of this pane is idle (codex
+            // hides its status row while streaming, leaving the idle composer and footer in view mid-turn).
+            const transcriptTurn = this.transcriptTurnState();
+            const transcriptBusy = transcriptTurn === "open";
             let snapshot;
             if (deliveryFallback !== null) {
                 // A missing footer cannot fall through to a broad ready match. All
@@ -5466,7 +5794,7 @@ export class Daemon extends EventEmitter {
                     settled: true,
                     changeAt: observedChangeAt,
                     forceReady: deliveryFallback,
-                    forceBusy: !deliveryFallback || paneActivity !== null,
+                    forceBusy: !deliveryFallback || paneActivity !== null || transcriptBusy,
                 });
             }
             else if (structuredPeriodicIdle && reason === "output_probe") {
@@ -5488,6 +5816,7 @@ export class Daemon extends EventEmitter {
                         snapshot = this.instanceStateMachine.observe(pane, Date.now(), {
                             settled: true,
                             changeAt: observedChangeAt,
+                            forceBusy: transcriptBusy,
                         });
                     }
                 }
@@ -5521,6 +5850,7 @@ export class Daemon extends EventEmitter {
                             settled: true,
                             changeAt: observedChangeAt,
                             forceReady: true,
+                            forceBusy: transcriptBusy,
                         });
                     }
                     else {
@@ -5569,6 +5899,7 @@ export class Daemon extends EventEmitter {
                     snapshot = this.instanceStateMachine.observe(pane, Date.now(), {
                         settled: true,
                         changeAt: observedChangeAt,
+                        forceBusy: transcriptBusy,
                     });
                 }
                 else {
@@ -5586,9 +5917,11 @@ export class Daemon extends EventEmitter {
                 snapshot = this.instanceStateMachine.observe(pane, Date.now(), {
                     settled,
                     changeAt: observedChangeAt,
-                    forceBusy: paneActivity !== null,
+                    forceBusy: paneActivity !== null || transcriptBusy,
                 });
             }
+            if (snapshot.state === "stuck")
+                snapshot = this.recoverStuck(pane, snapshot, observedChangeAt, transcriptTurn);
             this.applyInstanceStateSnapshot(snapshot, pane);
             // Backends without a transcript feed can still say what they are doing, if
             // their TUI names it. Free-riding on a capture that already happened: no
@@ -5999,11 +6332,7 @@ export class Daemon extends EventEmitter {
      * is a durable delivery) must LEAD the persisted user message — restart reconciliation recognises a delivery only by a
      * marker at the start of the body (#1197) — so the banner goes right after it, not in front of it.
      */
-    static steerEnvelope(inbound) {
-        const banner = "[STEERING — mid-task course correction. Fold this into the CURRENT work if one is active.]\n";
-        const marker = inbound.match(/^\[agend-delivery-id:[^\]\r\n]+\]\r?\n/);
-        return marker ? marker[0] + banner + inbound.slice(marker[0].length) : banner + inbound;
-    }
+    static steerEnvelope(inbound) { return steerInboundEnvelope(inbound); }
     /**
      * The one place an inbound message grows its metadata wrapper ([user:]/
      * [from:] prefix, pending reactions, handoff metadata, reply instructions).
@@ -6011,33 +6340,68 @@ export class Daemon extends EventEmitter {
      * here — a steered message must read EXACTLY like a queued one to the
      * agent, or the two drift apart in what the agent is told about replying.
      */
+    /** #1650: how this instance talks to the fleet — MCP tools, or agend-agent commands (agent_mode: cli). */
+    agentMode() { return this.config.agent_mode === "cli" ? "cli" : "mcp"; }
     formatInboundMessage(content, meta) {
-        const user = meta.user || "unknown";
-        const fromInstance = meta.from_instance;
-        let formatted;
-        if (fromInstance) {
-            formatted = formatCrossInstanceInboundMessage(content, meta);
+        if (!meta.from_instance)
+            return formatHumanInboundMessage(content, meta, this.agentMode());
+        let formatted = formatCrossInstanceInboundMessage(content, meta, this.agentMode());
+        if (meta.reply_to_text)
+            formatted += '\n(reply_to: "' + meta.reply_to_text + '")';
+        if (meta.delivery_id)
+            formatted = "[agend-delivery-id:" + meta.delivery_id + "]\n" + formatted;
+        return formatted;
+    }
+    /** Pure cached owner: no pane/process query on ingress. */
+    captureHumanReceiptOwner() {
+        try {
+            if (this.deliveryWritesStopping || this.spawning || !this.tmux)
+                return null;
+            const o = this.interactionOwner();
+            const window = this.tmux.getWindowId();
+            if (!window || !o.bootId || ![o.spawnGeneration, o.launchAttempt, o.launchFenceEpoch, this.deliveryEpoch]
+                .every(n => Number.isSafeInteger(n) && n >= 0))
+                return null;
+            return JSON.stringify([o.bootId, o.spawnGeneration, o.launchAttempt, o.launchFenceEpoch,
+                this.deliveryEpoch, humanOwnerObjectId(this.tmux), window]);
         }
-        else {
-            const via = meta.source ? ` via ${meta.source}` : "";
-            const idTag = meta.user_id ? `, id:${meta.user_id}` : "";
-            formatted = `[user:${user}${via}${idTag}] ${content}`;
-            // Reactions queued since the last real message (#432). One leading line of
-            // context, present only when something is pending — a reaction no longer
-            // costs a turn of its own.
-            if (meta.pending_reactions) {
-                formatted = `[Recent reactions: ${meta.pending_reactions}]\n${formatted}`;
-            }
-            formatted += renderHandoffMetadata(meta);
-            formatted += "\n(Reply using the reply tool — do NOT respond with direct text)";
+        catch {
+            return null;
         }
-        if (meta.reply_to_text) {
-            formatted += `\n(reply_to: "${meta.reply_to_text}")`;
+    }
+    /** The same formatter/sanitizer used by the actual write; snapshot only. */
+    humanReceiptWire(content, meta, kind) {
+        let wire = kind === "raw_paste" ? content
+            : !meta.from_instance && content.startsWith("/raw ") && kind === "fleet_inbound"
+                ? content.slice(5) : this.formatInboundMessage(content, meta);
+        if (kind === "steer")
+            wire = Daemon.steerEnvelope(wire);
+        else if (kind === "btw")
+            wire = BTW_INBOUND_PREFIX + wire;
+        return prepareDeliveryWire(wire, kind === "raw_paste");
+    }
+    humanReceiptAttempt(meta, wire) {
+        const id = meta.human_receipt_id;
+        const daemonOwner = meta.human_daemon_owner;
+        if (!id || !/^[a-f0-9]{8}-(?:[a-f0-9]{4}-){3}[a-f0-9]{12}$/.test(id) || meta.verification_id !== "hmsg-" + id
+            || !daemonOwner || !meta.human_owner_key || !/^[a-f0-9]{64}$/.test(meta.human_wire_sha256 ?? "")
+            || humanBodyHash(prepareDeliveryWire(wire)) !== meta.human_wire_sha256)
+            return undefined;
+        return { receiptId: id, verificationId: meta.verification_id, expectedWireHash: meta.human_wire_sha256,
+            ownerKey: meta.human_owner_key, current: () => this.captureHumanReceiptOwner() === daemonOwner };
+    }
+    finishHumanReceipt(meta, verdict) {
+        if (!meta.human_receipt_id || !meta.human_owner_key)
+            return;
+        const attempt = verdict.humanReceipt;
+        const proof = attempt?.current() && !["unverified", "output-edge", "unverifiable"].includes(verdict.proof ?? "")
+            ? attempt.proof ?? null : null;
+        try {
+            this.emit("human_receipt_result", { receipt_id: meta.human_receipt_id, owner_key: meta.human_owner_key, proof });
         }
-        if (meta.delivery_id) {
-            formatted = `[agend-delivery-id:${meta.delivery_id}]\n${formatted}`;
+        catch (err) {
+            this.logger.error({ err }, "Could not publish human delivery evidence");
         }
-        return formatted;
     }
     /**
      * Whether ONE delivery reached a verdict, carried by that delivery.
@@ -6130,12 +6494,13 @@ export class Daemon extends EventEmitter {
                 this.deferDurableDelivery(meta, "delivery epoch changed while waking for steer");
                 return;
             }
-            const verdict = { reached: false };
+            const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
             try {
                 if (await this.deliverMessage(formatted, status, {
                     steer: true,
                     deliveryEpoch,
                     submissionId: meta.message_id,
+                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
                     verdict,
                     durableAttempt: durableAttempt || undefined,
                 })) {
@@ -6166,6 +6531,9 @@ export class Daemon extends EventEmitter {
                     this.retryDurableDeliveryBeforeBegin(durableAttempt, err.message);
                 throw err;
             }
+            finally {
+                this.finishHumanReceipt(meta, verdict);
+            }
         }).catch(err => {
             this.deferDurableDelivery(meta, `target wake/steer failed before pane submission: ${err.message}`);
             this.logger.warn({ err: err.message }, "steer delivery error");
@@ -6181,24 +6549,37 @@ export class Daemon extends EventEmitter {
      * so channel delivery intentionally uses a normal wrapped inbound instead.
      */
     btwMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
-        if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+        if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+            this.finishHumanReceipt(meta, { reached: false });
             return;
+        }
         this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
         this.pendingWork.recordInbound();
         this.recordRecentUserMessage(content, meta);
-        const formatted = "[BTW — side question from the user. Answer it separately without changing or interrupting the CURRENT work.]\n"
-            + this.formatInboundMessage(content, meta);
+        const formatted = BTW_INBOUND_PREFIX + this.formatInboundMessage(content, meta);
         const status = channelStatus(meta);
         this.steerLock = this.steerLock.then(async () => {
-            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.finishHumanReceipt(meta, { reached: false });
                 return;
+            }
             await this.wake();
-            if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+            if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
+                this.finishHumanReceipt(meta, { reached: false });
                 return;
-            if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id })) {
-                this.markTurnStarted(meta, formatted, deliveryEpoch);
+            }
+            const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+            try {
+                if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id,
+                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}), verdict })) {
+                    this.markTurnStarted(meta, formatted, deliveryEpoch);
+                }
+            }
+            finally {
+                this.finishHumanReceipt(meta, verdict);
             }
         }).catch(err => {
+            this.finishHumanReceipt(meta, { reached: false });
             this.logger.warn({ err: err.message }, "btw delivery error");
         });
     }
@@ -6291,11 +6672,28 @@ export class Daemon extends EventEmitter {
                     if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                         return;
                 }
+                const whatsNew = this.pendingWhatsNew ? this.currentWhatsNew(this.pendingWhatsNew) : null;
+                if (whatsNew) {
+                    // #1633: here, inside the delivery lock and ahead of a real delivery — never into a busy turn, never to an
+                    // instance nobody writes to. Recorded only once pasted: a failed or cancelled paste stays pending.
+                    const pasted = await this.deliverMessage(whatsNew.notice, undefined, { deliveryEpoch });
+                    if (pasted && this.pendingWhatsNew === whatsNew) {
+                        this.pendingWhatsNew = null;
+                        try {
+                            recordWhatsNew(this.instanceDir, whatsNew.ids, whatsNew.version);
+                        }
+                        catch (err) {
+                            this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
+                        }
+                    }
+                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
+                        return;
+                }
                 const status = channelStatus(meta);
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
-                verdict = { reached: false };
+                verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
                 const durableAttempt = this.durableDeliveryAttempt(meta, content);
                 if (durableAttempt === false) {
                     this.deferDurableDelivery(meta, "invalid durable delivery attempt metadata");
@@ -6305,6 +6703,7 @@ export class Daemon extends EventEmitter {
                 if (await this.deliverMessage(formatted, status, {
                     deliveryEpoch,
                     submissionId: meta.message_id,
+                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
                     verdict,
                     durableAttempt: durableAttempt || undefined,
                 })) {
@@ -6352,6 +6751,7 @@ export class Daemon extends EventEmitter {
                 this.logger.warn({ err: err.message }, "Durable pane delivery deferred after exception");
             }
             finally {
+                this.finishHumanReceipt(meta, verdict);
                 this.pasteQueueDepth--;
             }
         }).catch(err => {
@@ -6388,12 +6788,7 @@ export class Daemon extends EventEmitter {
             && !this.isDeliveryEpochCurrent(opts.deliveryEpoch);
         if (cancelled() || this.stormWindow?.isStopped())
             return false;
-        // Sanitize unclosed code fences — they cause CLI to wait for closure on Enter
-        const fenceCount = (formatted.match(/```/g) || []).length;
-        if (!opts?.preserveExactBytes && fenceCount % 2 !== 0) {
-            // Odd number of fences = unclosed. Remove all code fences from the message.
-            formatted = formatted.replace(/```/g, "");
-        }
+        formatted = prepareDeliveryWire(formatted, opts?.preserveExactBytes);
         // Direct paths such as /steer, /btw, /raw and schedules do not pass the
         // FleetManager idle gate. Hold them at the final common pane-write path so
         // a tmux storm cannot force any text into a half-booted CLI.
@@ -6566,7 +6961,10 @@ export class Daemon extends EventEmitter {
                     return stale();
                 if (residue !== "clear")
                     return this.failDelivery(verdict, status, "input-residue", residue);
-                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent);
+                const written = await this.writeMessageToPane(formatted, windowId, handingOffToNativeQueue, status, opts?.submissionId, verdict, opts?.durableAttempt, opts?.steer === true, writeCurrent, opts?.humanVerificationId);
+                // #1690: still under the lock — whatever waits on it next must already see what this write started.
+                if (verdict.paneWriteStarted)
+                    opts?.onPaneWritten?.();
                 // The hand-off's last capture had no box: nothing was begun or written — wait for readiness, then try again.
                 if (written === "handoff-box-unread")
                     return "dialog";
@@ -6614,7 +7012,148 @@ export class Daemon extends EventEmitter {
      * on purpose ("I trust", "Yes, continue") and would match ordinary prose.
      */
     deliveryBlockingDialogs() {
-        return (this.backend?.getRuntimeDialogs?.() ?? []).filter(d => d.blocksDelivery || d.holdOnly);
+        return this.runtimeDialogs().filter(d => d.blocksDelivery || d.holdOnly);
+    }
+    /**
+     * The backend's runtime dialogs, then #1691's catch-all for a prompt none of them knows (last: known ones win). The
+     * catch-all is listed only while such a prompt is active: otherwise it could match nothing, and a backend with no
+     * dialogs keeps its empty list (its delivery path skips the dialog probe, as before).
+     */
+    runtimeDialogs() {
+        const dialogs = this.backend?.getRuntimeDialogs?.() ?? [];
+        return this.unrecognisedPromptCurrent()?.active ? [...dialogs, this.unrecognisedPromptDialog] : dialogs;
+    }
+    /**
+     * #1691: is the pane at the CLI's own idle composer? Then whatever looks like a prompt above it is transcript output
+     * (an agent's numbered list, a quoted "[y/n]"), not a prompt. The backend's own reading, most specific first.
+     */
+    cliComposerShowing(pane, shape) {
+        const backend = this.backend;
+        if (!backend)
+            return false;
+        if (backend.readInputRow)
+            return backend.readInputRow(pane) !== null;
+        // muse: its live input box — null when the bottom of the screen is not its layout (#829), e.g. a selection menu.
+        if (backend.inputDraft)
+            return backend.inputDraft(pane) !== null;
+        if (backend.isDeliveryInputReadyPane)
+            return backend.isDeliveryInputReadyPane(pane);
+        const bottom = backend.getBottomReadyPattern?.();
+        if (bottom) {
+            bottom.lastIndex = 0;
+            return bottom.test(pane);
+        }
+        // No reader of its own (opencode, grok, …): its ready chrome BELOW the prompt rows — a status bar or prompt hint drawn
+        // under its input box (opencode's "ctrl+p commands"), which a prompt shown in place of the input has nothing of. Not
+        // the whole pane (a reply quoting "ctrl+p commands" higher up), and never the prompt's own rows: a ready pattern that
+        // is just a cursor glyph would otherwise read the menu's own "❯ 1." as the CLI's prompt (#1695 r2).
+        const rows = pane.replace(/\r/g, "").split("\n").map(r => r.trimEnd());
+        const lastOwn = (shape.block.split("\n").at(-1) ?? "").trim();
+        let end = -1;
+        for (let i = rows.length - 1; i >= 0; i--)
+            if (rows[i].trim() === lastOwn) {
+                end = i;
+                break;
+            }
+        if (end < 0)
+            return false;
+        const below = rows.slice(end + 1).filter(r => r.trim() !== "").slice(0, COMPOSER_TAIL_ROWS).join("\n");
+        const ready = backend.getReadyPattern();
+        ready.lastIndex = 0;
+        return below !== "" && ready.test(below);
+    }
+    /**
+     * #1691: the prompt shape this pane shows, when nothing else explains it (no known dialog, login, idle composer, and
+     * the CLI is not showing its busy indicator).
+     */
+    unrecognisedPromptCandidate(pane) {
+        const shape = unrecognisedPromptShape(pane);
+        if (!shape)
+            return null;
+        const busy = this.backend?.getBusyPattern?.() ?? null;
+        if (busy) {
+            busy.lastIndex = 0;
+            if (busy.test(pane))
+                return null;
+        }
+        if ((this.backend?.getRuntimeDialogs?.() ?? []).some(dialog => Daemon.dialogMatches(dialog, pane)))
+            return null;
+        if (LOGIN_FLOWS[this.config.backend ?? "claude-code"]?.loginScreenActive?.(pane))
+            return null;
+        if (this.cliComposerShowing(pane, shape))
+            return null;
+        return shape;
+    }
+    /**
+     * #1691, from each runtime scan: the same unexplained prompt block unchanged for UNRECOGNISED_PROMPT_STABLE_MS
+     * becomes active (held, awaiting_input, reported once by trackDialogParked). Any other screen ends it. A turn keeps
+     * changing the pane (spinner, timer, streamed text), so its clock never completes mid-turn.
+     */
+    trackUnrecognisedPrompt(pane, mono, outputMoved) {
+        if (mono < this.unrecognisedPromptReadAt)
+            return;
+        this.unrecognisedPromptReadAt = mono;
+        const shape = this.unrecognisedPromptCandidate(pane);
+        if (!shape) {
+            this.unrecognisedPrompt = null;
+            return;
+        }
+        const screen = Daemon.stableScreen(pane);
+        const owner = this.interactionOwner();
+        const current = this.unrecognisedPromptCurrent();
+        // Restart the minute on any change: another prompt, motion anywhere on the screen, output that arrived while this
+        // capture was taken, or evidence from another launch (#1695 review).
+        if (!current || current.block !== shape.block || current.screen !== screen || outputMoved) {
+            this.unrecognisedPrompt = { block: shape.block, shape, since: mono, active: false, reportedElsewhere: false, screen, owner };
+            return;
+        }
+        if (!current.active && mono - current.since >= UNRECOGNISED_PROMPT_STABLE_MS) {
+            current.active = true;
+            // A [y/n] the interactive-prompt detector knows was already told (interactive_prompt, after 10 s): held and
+            // awaiting input from here on, but not reported a second time.
+            current.reportedElsewhere = shape.kind === "yes-no" && this.interactivePromptDetector.match(pane) !== null;
+            this.logger.warn({ shape: shape.kind, options: shape.options, question: shape.question, unchangedForMs: Math.round(mono - current.since) }, "CLI is waiting on a prompt AgEnD does not recognise — holding deliveries, reporting for a human (capture this pane for the per-version audit, ffb8104e)");
+        }
+    }
+    /** #1691: the tracked evidence, if it still belongs to this launch (else it is dropped). */
+    unrecognisedPromptCurrent() {
+        const current = this.unrecognisedPrompt;
+        if (current && (this.runtimeMonitorsFrozen || !sameInteractionOwner(current.owner, this.interactionOwner()))) {
+            this.unrecognisedPrompt = null;
+            return null;
+        }
+        return current;
+    }
+    /**
+     * #1691: the catch-all's predicate — the tracked prompt is active and this pane still shows exactly it (any reader:
+     * the scan, a probe, an interaction re-capture). Ending the evidence on a read without it is noteFreshPaneRead's.
+     */
+    unrecognisedPromptActive(pane) {
+        const current = this.unrecognisedPromptCurrent();
+        return !!current?.active && this.unrecognisedPromptCandidate(pane)?.block === current.block && Daemon.stableScreen(pane) === current.screen;
+    }
+    /**
+     * #1691: a fresh pane read outside the scan (a delivery probe, an accepted state re-capture), taken at `mono`. When it
+     * no longer shows exactly the tracked prompt, the evidence ends — counting or active, so a return needs a fresh minute
+     * (#1695 r2). When it does, it is the newest confirmation. Either way only a read newer than the newest read that
+     * decided the evidence counts: an older one, finishing late, says nothing about now (#1695 r3, r4).
+     */
+    noteFreshPaneRead(pane, mono) {
+        if (mono < this.unrecognisedPromptReadAt)
+            return;
+        // Advanced even with nothing tracked: a scan whose capture is older must not start evidence this read contradicts
+        // (#1695 r5).
+        this.unrecognisedPromptReadAt = mono;
+        const current = this.unrecognisedPromptCurrent();
+        if (!current)
+            return;
+        if (this.unrecognisedPromptCandidate(pane)?.block === current.block && Daemon.stableScreen(pane) === current.screen)
+            return;
+        this.unrecognisedPrompt = null;
+    }
+    /** #1691: the screen as the stability clock compares it (trailing blanks are not motion). */
+    static stableScreen(pane) {
+        return pane.replace(/\r/g, "").split("\n").map(r => r.trimEnd()).join("\n").trimEnd();
     }
     /** Passive input-unavailable phases relevant to the current spawn only. */
     guardedInputTransients() {
@@ -6782,7 +7321,7 @@ export class Daemon extends EventEmitter {
         return dialog.isActive ? dialog.isActive(pane) : dialog.pattern.test(pane);
     }
     /** Refresh the separate stdin-blocked observation from one pane capture. */
-    updateInputBlockedState(pane, dialogs = this.backend?.getRuntimeDialogs?.() ?? []) {
+    updateInputBlockedState(pane, dialogs = this.runtimeDialogs()) {
         const active = dialogs.find(dialog => dialog.inputBlocked && Daemon.dialogMatches(dialog, pane)) ?? null;
         const nextKey = active ? Daemon.dialogKey(active) : null;
         if (nextKey !== this.inputBlockedDialogKey) {
@@ -6870,9 +7409,15 @@ export class Daemon extends EventEmitter {
     async probeBlockingDialog() {
         if (!this.tmux || !this.backend)
             return { state: "clear" };
+        // #1691: a probe is a fresh read — it may end unrecognised-prompt evidence even when no dialog is listed.
+        const tracking = this.unrecognisedPrompt !== null;
         const dialogs = this.deliveryBlockingDialogs();
-        if (dialogs.length === 0)
+        // #1690: our own switch is being answered — nothing else types into the pane until it has settled.
+        if (this.ownSwitch && dialogs.length > 0)
+            return { state: "dialog", dialog: dialogs[0] };
+        if (dialogs.length === 0 && !tracking)
             return { state: "clear" };
+        const probeMono = performance.now();
         let pane;
         try {
             pane = await this.tmux.capturePane();
@@ -6881,6 +7426,7 @@ export class Daemon extends EventEmitter {
             this.logger.debug({ err }, "capture-pane failed during the dialog probe — pane state unknown");
             return { state: "unknown" };
         }
+        this.noteFreshPaneRead(pane, probeMono);
         for (const dialog of dialogs) {
             if (!Daemon.dialogMatches(dialog, pane))
                 continue;
@@ -7090,11 +7636,16 @@ export class Daemon extends EventEmitter {
             this.dialogParkedReported = false;
             return;
         }
-        if (!this.dialogParkedReported && Date.now() - this.dialogParkedSince >= DIALOG_PARKED_NOTIFY_MS) {
+        // #1691: the catch-all waited its minute before it became active; it is reported on the next scan.
+        const unrecognised = dialog === this.unrecognisedPromptDialog;
+        if (unrecognised && this.unrecognisedPrompt?.reportedElsewhere)
+            this.dialogParkedReported = true;
+        if (!this.dialogParkedReported && Date.now() - this.dialogParkedSince >= (unrecognised ? 0 : DIALOG_PARKED_NOTIFY_MS)) {
             this.dialogParkedReported = true;
             this.logger.warn({ dialog: dialog.description, parkedForMs: Date.now() - this.dialogParkedSince }, "CLI dialog is still on screen — not auto-answering, reporting for a human");
             this.emit("dialog_parked", { name: this.name, description: dialog.description, holdOnly: dialog.holdOnly === true,
-                ...(episode !== null && interaction.kind ? { kind: interaction.kind, episode, backend: this.config.backend ?? "claude-code" } : {}) });
+                ...(episode !== null && interaction.kind ? { kind: interaction.kind, episode, backend: this.config.backend ?? "claude-code" } : {}),
+                ...(unrecognised ? { unrecognised: true, question: this.unrecognisedPrompt?.shape.question ?? null } : {}) });
         }
     }
     /**
@@ -7205,7 +7756,7 @@ export class Daemon extends EventEmitter {
             return false;
         const row = norm(shown);
         // The marker line holds nothing but the marker: the row is exactly it.
-        if (/^\[agend-delivery-id:[^\]\s]+\]$/.test(first))
+        if (/^\[agend-(?:delivery|human)-id:[^\]\s]+\]$/.test(first))
             return row === first;
         return row === first || row.startsWith(`${first} `);
     }
@@ -7663,6 +8214,33 @@ export class Daemon extends EventEmitter {
             this.logger.warn("Could not read the pane after Enter — not confirming the submission");
         return sawOutput && residue === "absent";
     }
+    /**
+     * #1647: whether a raw paste on a pane with no transcript (kiro) was taken: its text gone from the input row (or the
+     * CLI's own busy marker shown instead — pasteResidue's rule) with output after the Enter. That is the confirmation's
+     * own rule, looked at more than once: kiro repaints its composer late, so the single look right after Enter misread
+     * pastes it took. A generic `working` reading is not evidence (#1663 P1-3: a repaint looks like work).
+     *
+     * Bounded by the budget that confirmation already has, measured from the Enter (#1663 P2-1): the busy wait plus the
+     * post-Enter proof window. Every reading is asked again after its await — still this write's owner (`current`: the
+     * caller's fence, no stop, the same tmux and spawn, #1663 P2-2) and still inside the budget — before it counts; a late
+     * or fenced answer proves nothing. Null: not shown — the caller settles uncertain, never a second Enter.
+     */
+    async rawPasteTakenOnPane(windowId, enterAt, enterMono, formatted, current) {
+        const deadline = enterMono + CONFIRM_BUSY_POLLS * CONFIRM_BUSY_POLL_MS + POST_ENTER_PROOF_WINDOW_MS;
+        const live = () => current() && performance.now() <= deadline;
+        for (;;) {
+            if (!live())
+                return null;
+            if (this.controlClient?.hasOutputSince?.(windowId, enterAt)) {
+                const residue = await this.pasteResidue(formatted);
+                if (!live())
+                    return null;
+                if (residue === "absent")
+                    return RAW_PASTE_LEFT_INPUT;
+            }
+            await new Promise(r => setTimeout(r, POST_ENTER_PROOF_POLL_MS));
+        }
+    }
     /** Once Kiro returns to its prompt, its unique envelope id in history proves submission. */
     async kiroSubmissionEvidence(windowId, formatted, signature) {
         if (!this.tmux)
@@ -7720,6 +8298,8 @@ export class Daemon extends EventEmitter {
             if (!current())
                 return false;
             if (evidence === "submitted") {
+                if (pending.signature.unique)
+                    pending.signature.humanPositive?.("unique-id-pane");
                 if (status)
                     this.emit("message_confirmed", status);
                 return true;
@@ -7755,6 +8335,8 @@ export class Daemon extends EventEmitter {
                 if (retry === "cancelled")
                     return false;
                 if (retry === "submitted") {
+                    if (pending.signature.unique)
+                        pending.signature.humanPositive?.("unique-id-pane");
                     if (status)
                         this.emit("message_confirmed", status);
                     return true;
@@ -7895,9 +8477,24 @@ export class Daemon extends EventEmitter {
     verdict = { reached: false }, durableAttempt, steer = false, 
     // #829: the caller's fence, asked once more after the last await before the
     // first side effect. Stale means unwritten: false, with no failure verdict.
-    stillCurrent) {
-        const signature = this.submissionSignature(formatted, submissionId);
+    stillCurrent, humanVerificationId) {
+        const signature = this.submissionSignature(formatted, humanVerificationId ?? submissionId, humanVerificationId !== undefined);
         const rawPaste = durableAttempt?.submissionMode === "raw_paste";
+        const humanAttempt = verdict.humanReceipt;
+        const humanMode = rawPaste ? "raw_paste" : steer ? "steer"
+            : handingOffToNativeQueue ? "native_queue_handoff" : "idle_submit";
+        if (humanAttempt && signature.unique && signature.value === "agend-human-id:" + humanAttempt.verificationId
+            && humanBodyHash(formatted) === humanAttempt.expectedWireHash) {
+            signature.humanPositive = tag => {
+                if (!humanAttempt.current() || (stillCurrent && !stillCurrent()))
+                    return;
+                humanAttempt.proof = {
+                    receipt_id: humanAttempt.receiptId, verification_id: humanAttempt.verificationId,
+                    wire_sha256: humanBodyHash(formatted), owner_key: humanAttempt.ownerKey,
+                    mode: humanMode, tag,
+                };
+            };
+        }
         let windowId = initialWindowId;
         // The spawn this write belongs to: acceptance evidence is only read while it is still the current one (#1197).
         const spawnAtWrite = this.spawnGeneration;
@@ -7975,9 +8572,11 @@ export class Daemon extends EventEmitter {
                         offset: attemptEvidence.transcriptOffset,
                     };
                     // From here every proof of this write may also ask the CLI's transcript (the pane can lose the echo to the
-                    // reply, or still be painting the paste) — this delivery's exact marker only.
-                    if (["claude-code", "codex"].includes(attemptEvidence.backend)) {
-                        signature.transcript = this.transcriptProofFor(verdict.transcriptCheckpoint, durableAttempt.deliveryId, spawnAtWrite, stillCurrent, kind => { verdict.transcriptProof = kind; });
+                    // reply, or still be painting the paste) — this delivery's exact marker only, or a raw paste's exact text (#1647).
+                    // A raw paste's text only where the transcript is this instance's alone (RAW_TEXT_TRANSCRIPT_BACKENDS).
+                    if (["claude-code", "codex"].includes(attemptEvidence.backend)
+                        && (!rawPaste || RAW_TEXT_TRANSCRIPT_BACKENDS.includes(attemptEvidence.backend))) {
+                        signature.transcript = this.transcriptProofFor(verdict.transcriptCheckpoint, rawPaste ? { rawText: formatted } : durableAttempt.deliveryId, spawnAtWrite, stillCurrent, kind => { verdict.transcriptProof = kind; });
                     }
                 }
             }
@@ -8041,6 +8640,7 @@ export class Daemon extends EventEmitter {
             // positively hold typed text, and after it be the empty placeholder again. The empty placeholder here means the
             // paste never reached the box; an unreadable box (a failed or late capture, a dialog) proves nothing: no Enter.
             const steerComposerProof = handingOffToNativeQueue && steer && !!this.backend?.readSteerComposer && tmuxAtWrite !== null;
+            let humanComposerOwned = false;
             let steerEnterDeadline = Infinity;
             if (steerComposerProof) {
                 const deadline = performance.now() + STEER_PASTE_VISIBLE_MS;
@@ -8064,10 +8664,13 @@ export class Daemon extends EventEmitter {
                     return this.failDelivery(verdict, status, "steer-paste", before === null ? "box-unread" : `box-still-${before.mode}`);
                 if (!this.steerPasteIsOurs(before.pane, formatted))
                     return this.failDelivery(verdict, status, "steer-paste", "box-not-this-paste");
+                const shown = this.backend?.readSteerComposerText?.(before.pane)?.replace(/\s+/g, " ").trim();
+                humanComposerOwned = !!humanAttempt && shown === "[agend-human-id:" + humanAttempt.verificationId + "]";
                 // …and so is the Enter: the key is sent only while the reading is still within it.
                 steerEnterDeadline = deadline;
             }
             let enterAt = Date.now();
+            const enterMono = performance.now();
             const steerEnterCurrent = () => steerCurrent() && performance.now() <= steerEnterDeadline;
             if (!(await this.sendDeliveryEnter("initial-submit", steerComposerProof ? steerEnterCurrent : undefined, durableAttempt))) {
                 if (steerComposerProof && !steerCurrent()) {
@@ -8134,6 +8737,9 @@ export class Daemon extends EventEmitter {
                         if (after === "steer" || after === "queue" || after === "idle") {
                             const probe = await withinMs(this.probeBlockingDialog(), deadline - performance.now());
                             if (probe?.state === "clear" && performance.now() <= deadline && steerCurrent() && this.getWindowId() === windowId) {
+                                if (humanComposerOwned)
+                                    signature.humanPositive?.(after === "steer" ? "composer-empty-steer"
+                                        : after === "queue" ? "composer-empty-queue" : "composer-empty-idle");
                                 verdict.phase = "steer-accepted";
                                 verdict.proof = `steer-composer-${after}`;
                                 if (status)
@@ -8313,12 +8919,20 @@ export class Daemon extends EventEmitter {
                         return { kind: "kiro-pending", windowId, spawnGeneration: this.spawnGeneration, signature };
                     }
                 }
-                if (!submitted) {
-                    if (rawPaste) {
+                if (!submitted && rawPaste) {
+                    // #1647: kiro paints output at once but its composer late, so one residue look right after Enter misreads a
+                    // paste it took. Keep looking within the confirmation's own budget from the Enter, under this write's fence;
+                    // never a second Enter (a raw command must not run twice).
+                    const taken = await this.rawPasteTakenOnPane(windowId, enterAt, enterMono, formatted, steerCurrent);
+                    if (!taken) {
                         verdict.phase = "raw-paste-submit-proof";
                         verdict.proof = "no-positive-acceptance-proof";
                         return false;
                     }
+                    verdict.proof = taken;
+                    submitted = true;
+                }
+                if (!submitted) {
                     // Legacy system pastes have no unique envelope id. Preserve their
                     // existing bounded retry until they can be tied to a specific turn.
                     this.logger.warn("Message not submitted after Enter — waiting for the prompt, then re-sending Enter once");
@@ -8631,10 +9245,10 @@ export class Daemon extends EventEmitter {
      * A write's transcript proof: bounded looks from its checkpoint, fenced to the write — its spawn and launch, a stop,
      * and the caller's own fence — so a look that lands after any of them is never used (#1380 review).
      */
-    transcriptProofFor(checkpoint, deliveryId, spawnAtWrite, stillCurrent, onProof) {
+    transcriptProofFor(checkpoint, needle, spawnAtWrite, stillCurrent, onProof) {
         const launchAtWrite = this.launchFenceEpoch;
         return {
-            reader: new TranscriptDeltaReader(checkpoint.path, checkpoint.offset, checkpoint.backend, deliveryId),
+            reader: new TranscriptDeltaReader(checkpoint.path, checkpoint.offset, checkpoint.backend, needle),
             current: () => !this.deliveryWritesStopping && this.spawnGeneration === spawnAtWrite
                 && this.launchFenceEpoch === launchAtWrite && (stillCurrent?.() ?? true),
             onProof,
@@ -8712,8 +9326,11 @@ export class Daemon extends EventEmitter {
         //    the input row is proof in itself — which also means a momentary
         //    failure to read the pane BEFORE pasting cannot turn a delivered
         //    message into a re-paste.
-        if (signature.unique && after.payload > 0)
+        if (signature.unique && after.payload > 0) {
+            if (after.inputReadable)
+                signature.humanPositive?.("unique-id-pane");
             return this.submittedProof();
+        }
         if (unattributedResidue)
             return "unverifiable";
         // 3. Otherwise the evidence must be NEW relative to the pane as it was
@@ -8850,7 +9467,7 @@ export class Daemon extends EventEmitter {
      * paste that never landed. System pastes carry no envelope and fall back to
      * the body signature, which the baseline comparison still ties to this paste.
      */
-    submissionSignature(formatted, trustedId) {
+    submissionSignature(formatted, trustedId, verification = false) {
         // The id must come from the message's own metadata, never from scanning the
         // rendered text: agents and users discuss message ids in the body all the
         // time ("check message_id: abc"), and a body-scanned value would match an
@@ -8859,7 +9476,7 @@ export class Daemon extends EventEmitter {
         // the handoff metadata identifies THIS delivery.
         const id = trustedId?.trim();
         if (id)
-            return { value: `message_id:${id}`, unique: true };
+            return { value: (verification ? "agend-human-id:" : "message_id:") + id, unique: true };
         return { value: pastedTextSignature(formatted), unique: false };
     }
     /**
@@ -9381,6 +9998,11 @@ export class Daemon extends EventEmitter {
                 respond(null, `reply: ${buttons.error}`);
                 return;
             }
+            // #1823: a poll's results need the fleet's store and outbox; as text it would never close.
+            if (args.poll !== undefined && args.poll !== null) {
+                respond(null, "reply: a poll needs AgEnD's fleet; send the question without poll");
+                return;
+            }
             if (buttons) {
                 routed = { ...args, text: `${String(args.text)}\n\n${replyButtonsFallbackText(buttons.buttons)}` };
                 delete routed.buttons;
@@ -9966,7 +10588,7 @@ export class Daemon extends EventEmitter {
      * the same tmux window, not aborted, writes not stopping — re-checked after every await, and between the paste and
      * its Enter. The whole step, every await included, ends at one monotonic deadline: a late capture never confirms
      * and a late admission never writes; a paste whose Enter would land past it is taken back. Not confirmed in time:
-     * the old setup stays, a launch warning says so, the next launch tries again. A stop, pause or respawn ends it
+     * the old setup stays, the next launch tries again, and a quiet launch warning (#1794: logged and on the Log tab, not posted) says so. A stop, pause or respawn ends it
      * silently, confirming and removing nothing. Never throws into the spawn.
      */
     async ensureBackendAgent() {
@@ -10012,8 +10634,10 @@ export class Daemon extends EventEmitter {
                 if (active === sw.agent && (wroteAt === null || capturedAt > wroteAt)) {
                     if (sw.alreadyConfirmed && wroteAt === null)
                         return; // already ours, already on record
-                    for (const warning of sw.confirm())
-                        this.emit("backend_launch_warning", { name: this.name, message: warning });
+                    for (const { message, quiet } of sw.confirm()) {
+                        this.logger.warn({ agent: sw.agent, warning: message }, "The agent switch was confirmed with a warning");
+                        this.emit("backend_launch_warning", { name: this.name, message, quiet: quiet === true });
+                    }
                     this.logger.info({ agent: sw.agent, switched: wroteAt !== null }, "The resumed conversation runs as this instance's agent");
                     return;
                 }
@@ -10062,7 +10686,9 @@ export class Daemon extends EventEmitter {
             if (!fenced())
                 return; // a stop, pause or respawn: nothing to say, nothing to do
             this.logger.warn({ agent: sw.agent, typed: wroteAt !== null }, "The resumed conversation did not switch to this instance's agent in time");
-            this.emit("backend_launch_warning", { name: this.name, message: t("kiro.switch_timeout", Daemon.AGENT_SWITCH_BUDGET_MS / 1000) });
+            // #1794: quiet — the conversation keeps running as its saved agent with the shared entries, and the next launch
+            // tries again; the user loses nothing and has nothing to do. Logged above and kept on the Log tab only.
+            this.emit("backend_launch_warning", { name: this.name, message: t("kiro.switch_timeout", Daemon.AGENT_SWITCH_BUDGET_MS / 1000), quiet: true });
         }
         catch (err) {
             this.startupAdmission?.();
@@ -10426,6 +11052,49 @@ export class Daemon extends EventEmitter {
         }
         catch { /* non-fatal */ }
     }
+    /**
+     * #1633 (#1639 review): the pending notice as the record stands NOW, just before the paste — it was decided at launch,
+     * and the record may have changed while the delivery waited. Unreadable → nothing is sent (and nothing pending);
+     * entries recorded meanwhile are dropped from it; none left → nothing.
+     */
+    currentWhatsNew(pending) {
+        const record = readWhatsNewRecord(this.instanceDir);
+        if (record === "unreadable") {
+            this.pendingWhatsNew = null;
+            return null;
+        }
+        const known = new Set(record?.announced ?? []);
+        const ids = pending.ids.filter(id => !known.has(id));
+        if (!ids.length) {
+            this.pendingWhatsNew = null;
+            return null;
+        }
+        if (ids.length === pending.ids.length)
+            return pending;
+        const narrowed = { notice: whatsNewNotice(pending.version, AGENT_WHATS_NEW.filter(e => ids.includes(e.id))), ids, version: pending.version };
+        this.pendingWhatsNew = narrowed;
+        return narrowed;
+    }
+    /** #1633: what this instance has not been told about its AgEnD version yet (see agent-whats-new.ts). */
+    prepareWhatsNew(fresh, version = agendVersion()) {
+        try {
+            const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh, version });
+            if (!plan) {
+                this.pendingWhatsNew = null;
+                return;
+            }
+            if ("silent" in plan) {
+                recordWhatsNew(this.instanceDir, plan.silent, plan.version);
+                this.pendingWhatsNew = null;
+                return;
+            }
+            this.pendingWhatsNew = plan;
+            this.logger.info({ entries: plan.ids }, "what's-new notice pending for the next delivery");
+        }
+        catch (err) {
+            this.logger.debug({ err }, "what's-new not prepared");
+        }
+    }
     async trySpawnInsideGate(reuseWindow = false, startupTimeoutMs) {
         this.startupAdmission?.();
         const launchFence = this.launchFenceEpoch;
@@ -10435,6 +11104,8 @@ export class Daemon extends EventEmitter {
         // instructionsReloadedOnResume) so the warmup steering-reload can be
         // skipped when nothing changed.
         this.lastBuiltInstructions = backendConfig.instructions ?? "";
+        // #1633: decided before prev-instructions is first written — its absence is what says "never launched before".
+        this.prepareWhatsNew(!existsSync(join(this.instanceDir, "prev-instructions")));
         {
             const prevFile = join(this.instanceDir, "prev-instructions");
             let prev = "";
@@ -10476,7 +11147,7 @@ export class Daemon extends EventEmitter {
         if (launchFence !== this.launchFenceEpoch)
             throw new Error("Launch cancelled: the instance was stopped or paused while the launch was being prepared");
         this.backend.writeConfig(backendConfig);
-        this.backend.preTrust?.(this.config.working_directory);
+        this.backend.preTrust?.(this.config.working_directory, backendConfig);
         // Resolve working directory (e.g. symlink for hidden paths)
         const resolvedCwd = this.backend.resolveWorkingDirectory?.(this.config.working_directory, this.name) ?? this.config.working_directory;
         // Generate a fresh per-instance agent token each spawn. agent-cli reads
@@ -10546,6 +11217,11 @@ export class Daemon extends EventEmitter {
             this.logger.warn({ warning: launchWarning }, "Backend launch fell back");
             this.emit("backend_launch_warning", { name: this.name, message: launchWarning });
         }
+        // #1811: what the launch left out and why (an effort this CLI or model does not take) — the Log tab, not the chat.
+        for (const note of this.backend.consumeQuietLaunchNotes?.() ?? []) {
+            this.logger.info({ note }, "Launch note");
+            this.emit("backend_launch_warning", { name: this.name, message: note, quiet: true });
+        }
         // Ensure tmux session exists (may have been destroyed if all windows died)
         await TmuxManager.ensureSession(this.tmuxSessionName);
         if (this.stormWindow?.observeServerAlive(await TmuxManager.getServerPid(this.tmuxSessionName))) {
@@ -11116,6 +11792,14 @@ export class Daemon extends EventEmitter {
         }, "Snapshot written");
         return snapshot;
     }
+    /** #1699: the claude config dir this instance's CLI uses — its credential profile's, else exactly as before. */
+    claudeConfigDir() {
+        return claudeConfigDirFor(claudeProfileConfigDir(this.config.backend_options?.["claude-code"]));
+    }
+    /** Where this instance's CLI keeps the conversation a turn resume is judged on (#1699: claude's follows the profile). */
+    resumeRoots(workingDirectory) {
+        return { instanceDir: this.instanceDir, workingDirectory, claudeConfigDir: this.claudeConfigDir() };
+    }
     /**
      * The credential profile's store this instance's CLI writes to, if any.
      *