@songsid/agend 2.3.2-beta.9 → 2.3.3-beta.1

package/dist/daemon.js

@@ -1,10 +1,13 @@
+import { readActiveKiroModel } from "./backend/kiro.js";
 import { dashboardAccessOf } from "./dashboard-permissions.js";
-import { agentWhatsNew, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
+import { sendPackSources } from "./web-office-pack-read.js";
+import { agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, withWhatsNew } from "./agent-whats-new.js";
 import { join, dirname, resolve } from "node:path";
 import { checkoutTarget, readCheckouts, releaseCandidate, reposRoot, verifyWorktree, writeCheckouts } from "./repo-worktree-guard.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
 import { COMPACT_WATCH_TIMEOUT_MS, launchIdentity } from "./compact-watch.js";
 import { KIRO_COMPACT_PANE_LINES, KiroCompactPaneFollower } from "./kiro-compact-pane.js";
+import { clearKiroSessionProof, proveKiroSessionId, recordKiroSessionProof } from "./kiro-session-proof.js";
 import { fileURLToPath } from "node:url";
 import { ensureInstanceDir } from "./private-dir.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
@@ -21,8 +24,9 @@ import { TranscriptMonitor } from "./transcript-monitor.js";
 import { createTranscriptSource } from "./transcript-sources.js";
 import { TranscriptTurnLedger } from "./transcript-turns.js";
 import { credentialProfileStoreHome, resolveCredentialProfile } from "./backend/credential-profile.js";
-import { resolveToolSet } from "./tool-permissions.js";
-import { dashboardAccessProblem, dashboardFeaturesOff } from "./dashboard-permissions.js";
+import { resolveToolSet, toolsFor } from "./tool-permissions.js";
+import { TOOLS, toolsWithCanvasWorker } from "./channel/mcp-tools.js";
+import { dashboardAccessProblem, dashboardFeaturesOff, withoutFeatures } from "./dashboard-permissions.js";
 import { getAgendHome } from "./paths.js";
 import { readCanvasWorkerEnabled, scopedFleetConfigEnvironment } from "./web-experimental.js";
 import { readAgentEffect, sendEffectInParts } from "./web-effect-upload.js";
@@ -36,13 +40,14 @@ import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
 import { daemonBudgetMs } from "./channel/ipc-timeouts.js";
 import { MessageBus } from "./channel/message-bus.js";
-import { shellQuote, UnsupportedCliError } from "./backend/types.js";
+import { shellQuote, UnsupportedCliError, ResumeBlockedError } from "./backend/types.js";
 import { getTmuxSession } from "./config.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { parseReplyButtons, replyButtonsFallbackText } from "./reply-buttons.js";
 import { HangDetector } from "./hang-detector.js";
 import { writeSecretFile } from "./secret-file.js";
 import { PaneWriteLock } from "./pane-write-lock.js";
+import { answerRemoteCard } from "./remote-card-answer.js";
 import { buildFleetInstructions } from "./instructions.js";
 import { formatHumanInboundMessage, prepareDeliveryWire, steerInboundEnvelope, BTW_INBOUND_PREFIX, humanBodyHash, humanOwnerObjectId } from "./human-delivery-receipts.js";
 import { formatCrossInstanceInboundMessage, renderCrossInstanceHandoffMetadata, } from "./cross-instance-envelope.js";
@@ -63,8 +68,6 @@ import { claudeConfigDirFor, claudeProfileConfigDir, claudeSwitchDialog, claudeS
 import { MuseBackend } from "./backend/muse.js";
 import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
 import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
-/** #2140: deliveries that may carry an unwritten what's-new notice before it is recorded anyway. */
-const WHATS_NEW_MAX_UNWRITTEN = 3;
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -89,6 +92,10 @@ const WEB_THEME_IPC = Object.freeze({
     delete_web_effect: "fleet_delete_web_effect",
     // #2578: its own character in the Office view — the args as they are (the fleet checks them).
     office_view: "fleet_office_view", office_set: "fleet_office_set",
+    // #2692: the skin packs — check and upload read the pack here (web-office-pack-read.ts) and send its bytes in parts.
+    office_pack_check: "fleet_office_pack_check", office_pack_upload: "fleet_office_pack_upload",
+    office_pack_delete: "fleet_office_pack_delete", office_pack_restore: "fleet_office_pack_restore",
+    office_pack_list: "fleet_office_pack_list", office_set_style: "fleet_office_set_style",
 });
 /** The largest picture any slot may take (a card slot's ceiling; the fleet checks the limit in force): read no more. */
 const WEB_THEME_ASSET_MAX_BYTES = ASSET_UPLOAD_MAX_BYTES;
@@ -105,7 +112,6 @@ const TURN_OUTBOUND_TOOLS = new Set([
 // These actions reach the human-facing channel and satisfy reply-completion:
 // a deliberate reaction or edit is a valid response even without new text.
 const TURN_COMPLETION_TOOLS = new Set(["reply", "react", "edit_message"]);
-const REPLY_DROP_WARNING_COOLDOWN_MS = 5 * 60_000;
 /**
  * #1241: how long an idle edge must persist — with no reply and no further
  * observed work — before the reply guard declares the turn a miss. A claude
@@ -128,50 +134,12 @@ const TRANSCRIPT_RUNNING_HOLD_MAX_MS = 30 * 60_000;
  */
 export const TRANSCRIPT_OPEN_TURN_QUIET_MS = 15 * 60_000;
 const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. React with an emoji or use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, a brief react is sufficient. If you already replied to this message, do nothing. Do not reply to this system instruction except through the react or reply tool.";
-/** Point a resumed CLI at its one backend-native instruction source. */
 /** The outbox evidence for a delivery the CLI's transcript shows taken (#758; #1201 absorbed; #1647 a raw paste's text). */
 function transcriptMarkerEvidence(kind, rawPaste = false) {
     if (rawPaste)
         return "transcript-turn-user-entry-raw-paste-text";
     return kind === "user" ? "transcript-marker" : kind === "absorbed" ? "transcript-marker-absorbed" : "transcript-marker-queued";
 }
-export function buildInstructionReloadNotice(binaryName, instanceName, instanceDir, backendSource) {
-    const source = backendSource ? backendSource : binaryName === "codex" || binaryName === "grok" || binaryName === "muse"
-        ? "AGENTS.md"
-        : binaryName === "kiro-cli"
-            ? `.kiro/steering/agend-${instanceName}.md`
-            : binaryName === "agy"
-                ? ".agents/AGENTS.md"
-                : join(instanceDir, "fleet-instructions.md");
-    return `[system] Your AgEnD instructions have been updated. Reload only ${source}; do not scan other instruction directories. Do not reply to this message.`;
-}
-/**
- * Whether this backend has to be told in its pane that its instructions moved.
- *
- * A backend that re-reads them on resume already received the new ones from the
- * resume itself, so the notice is pure interruption. Both places that can send
- * it — the warmup paste and the deferred pendingInstructionsNotice — ask through
- * here, so the two cannot drift apart again: the warmup path used to omit this
- * check entirely and told claude-code to reload instructions it had just read.
- */
-export function backendNeedsPaneReloadNotice(backend) {
-    return !backend?.instructionsReloadedOnResume;
-}
-/**
- * What the warmup should do about changed instructions.
- *
- * `skip` — nothing to say, or this backend learns of the change by itself.
- * `defer` — worth saying, but nobody is talking to the instance; say it when a
- *   real message next arrives rather than provoking an unsolicited reply.
- * `paste` — say it now, into a pane that already has a delivery in flight.
- */
-export function warmupNoticeAction(opts) {
-    if (!opts.warmupNeeded)
-        return "skip";
-    if (!backendNeedsPaneReloadNotice(opts.backend))
-        return "skip";
-    return opts.pasteQueueDepth === 0 ? "defer" : "paste";
-}
 export const DEFAULT_STUCK_TIMEOUT_MS = 10 * 60_000;
 export const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2_000;
 export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
@@ -181,6 +149,14 @@ export const PERIODIC_REDRAW_PROBE_MS = 25;
 const KIRO_COMPACT_PANE_POLL_MS = 1_000;
 /** Do not turn a streaming Codex turn into one capture-pane per burst. */
 export const STRUCTURED_IDLE_PROBE_MS = 500;
+/** #2770 (ii): how often output may schedule a look for a layout that repaints while idle (CliBackend.periodicRedrawFrom). */
+export const PERIODIC_LAYOUT_LOOK_MS = 5_000;
+/** #2770: how often a delivery waiting for idle asks again whether it can be handed off instead. */
+export const HANDOFF_RECHECK_MS = 1_000;
+/** #2770: how often a wait for idle asks its stop condition (a cancel, a hand-off that became possible). */
+export const WAIT_STOP_POLL_MS = 250;
+/** #2770: human messages a cancel dropped are told in one notice, this long after the last of them. */
+export const CANCELLED_HUMANS_NOTICE_MS = 1_000;
 /**
  * An instance publishing more than this many execution-state edges inside the
  * window is flapping; its edges stop being logged one by one (#1116). One
@@ -573,6 +549,8 @@ export const OWN_SWITCH_WAIT_MS = 6_000;
 const OWN_SWITCH_SETTLE_MS = 3_000;
 /** A blocking dialog still on screen this long after first being seen is reported for a human. */
 const DIALOG_PARKED_NOTIFY_MS = 60_000;
+/** #2675: a card a person can answer from the chat is posted once it has been on screen, unchanged, this long. */
+const REMOTE_CARD_STABLE_MS = 1_500;
 /** #1691: a prompt no table knows must sit unchanged this long (monotonic) before it holds deliveries and is reported. */
 export const UNRECOGNISED_PROMPT_STABLE_MS = 60_000;
 /** #1691: the rows under a prompt a backend without a composer reader shows its ready chrome in (status bar, hint). */
@@ -701,6 +679,18 @@ const FIRST_DELIVERY_WINDOW_MS = 5_000;
 const NATIVE_QUEUE_PASTE_VERIFY_MS = 2_000;
 /** #1405: how long a steer's paste gets to show in a mode-switched composer before its one Enter (captures included). */
 const STEER_PASTE_VISIBLE_MS = 2_000;
+/**
+ * #2676: the longest one-line paste kiro's TUI composer still shows as typed text; longer, it collapses to a
+ * `N chars ▸` chip (2.34.0 tui.js: more than 10 lines or 500 characters collapse).
+ */
+const KIRO_COLLAPSE_CHARS = 500;
+/**
+ * #1405/#2676: whether a mode-switched composer in `mode` may take a busy hand-off: a steer only on "steer", an ordinary
+ * message on "steer" or "queue" (kiro takes either into its tray), and "idle" — the turn over — only where `allowIdle`.
+ */
+function composerModeAdmits(mode, allowIdle, steerOnly) {
+    return mode === "steer" || (!steerOnly && mode === "queue") || (allowIdle && mode === "idle");
+}
 /** `promise`'s value if it settles within `ms`, else undefined — the late answer is dropped, never awaited (#1405). */
 async function withinMs(promise, ms) {
     if (ms <= 0) {
@@ -1138,6 +1128,29 @@ export class Daemon extends EventEmitter {
     logTranscriptPath() { return this.transcriptMonitor?.currentPath() ?? null; }
     /** #1218 (kiro): the launch this daemon's backend last built, for the Log's reason only (kiro-log-gate.ts). */
     logLaunch() { return this.backend?.logLaunch?.() ?? null; }
+    async kiroMigrationIdle() {
+        const tmux = this.tmux, owner = this.interactionOwner();
+        if (!tmux || this.spawning || this.runtimeMonitorsFrozen || this.processStatus !== "running")
+            return false;
+        const pane = await tmux.capturePane(2000).catch(() => null);
+        return pane !== null && tmux === this.tmux && sameInteractionOwner(owner, this.interactionOwner())
+            && this.processStatus === "running" && !this.spawning && !this.runtimeMonitorsFrozen && this.paneAuthoritativelyIdle(pane);
+    }
+    /** One read-only migration observation. Never types into a pane or selects a picker. */
+    async kiroMigrationObservation() {
+        const tmux = this.tmux, owner = this.interactionOwner(), backend = this.backend;
+        if (!tmux || backend?.binaryName !== "kiro-cli" || this.processStatus !== "running" || this.spawning || this.runtimeMonitorsFrozen)
+            return null;
+        const pane = await tmux.capturePane(2000).catch(() => null);
+        if (pane === null || tmux !== this.tmux || !sameInteractionOwner(owner, this.interactionOwner())
+            || this.processStatus !== "running" || this.spawning || this.runtimeMonitorsFrozen || !this.paneAuthoritativelyIdle(pane)
+            || backend.readSteerComposer?.(pane) !== "idle")
+            return null;
+        const launch = backend.transcriptLaunch?.(), path = this.logTranscriptPath();
+        // Agent switching is separately disabled for saved-agent resumes; it is not an observation API.
+        const model = readActiveKiroModel(pane);
+        return launch?.engine === "v2" && launch.sessionId && model && path ? { sessionId: launch.sessionId, model, transcript: path } : null;
+    }
     guardian = null;
     adapter = null;
     pendingIpcRequests = new Map();
@@ -1257,6 +1270,12 @@ export class Daemon extends EventEmitter {
     dialogParkedKey = null;
     dialogParkedInteractionEpisode = null;
     dialogParkedReported = false;
+    /** #2675: the card on screen that a person can answer from the chat — what it asks, since when, and whether it was posted. */
+    remoteCardShown = null;
+    /** #2675: when (performance.now, taken before its capture) the newest read the card tracker used was started. */
+    remoteCardReadAt = -Infinity;
+    /** #2675: an answer from the chat is being keyed in (one at a time). */
+    remoteCardAnswering = false;
     /**
      * #1691: the prompt at the bottom of the pane that no backend table knows — its block, since when (performance.now)
      * it has been unchanged, and whether that has lasted UNRECOGNISED_PROMPT_STABLE_MS. Updated by the runtime scan.
@@ -1347,6 +1366,10 @@ export class Daemon extends EventEmitter {
     /** Consecutive structural idle captures for a noisy, periodically-redrawing
      * pane.  Two are required before a working -> idle transition. */
     instanceStatePeriodicIdleConfirmations = 0;
+    /** #2770 (ii): the latest capture showed a layout that repaints while idle (CliBackend.periodicRedrawFrom). */
+    periodicRedrawLayout = false;
+    /** When output last scheduled a look for that layout (monotonic ms), so a busy pane is not captured on every chunk. */
+    periodicLayoutLookAt = -Infinity;
     /** Recent execution-state edge times, for the flap log limiter (#1116). */
     stateEdgeTimes = [];
     stateEdgesNotLogged = 0;
@@ -1388,7 +1411,6 @@ export class Daemon extends EventEmitter {
     /** Prevent a visible stale XML fragment from being recovered on later turns. */
     lastMalformedToolCallSignature;
     proxyReplySeq = 0;
-    lastReplyDropWarningAt = 0;
     /**
      * #1241: an idle edge that has not yet proven the turn ended. Armed instead
      * of recovering immediately; a steady idle snapshot past confirmAt promotes
@@ -1474,6 +1496,8 @@ export class Daemon extends EventEmitter {
     authFailureUnresolved = false;
     /** One login-screen auth report per spawn — the screen persists across polls. */
     loginScreenReported = false;
+    /** #2795: the auth pattern match the token-free check is still to judge; it arms nothing until confirmAuthFailure(). */
+    unverifiedAuthMatch = null;
     /**
      * While the lifecycle is still starting this daemon, `pty_error` has no
      * listener and `InstanceLifecycle.daemons` has no entry — so an incident the
@@ -1532,19 +1556,12 @@ export class Daemon extends EventEmitter {
     deliveryWritesStopping = false;
     /** #829: the latest pastes, by spawn generation (see ownedInputDraft). */
     recentPastes = [];
-    pendingInstructionsUpdate;
-    pendingInstructionsNotice = false;
     /** #1633: the one-time "what's new for you" notice, pasted before the next real delivery; recorded once pasted. */
     pendingWhatsNew = null;
-    /** #2140: deliveries tried for the pending what's-new notice that never reached the pane (capped: never before every message). */
-    whatsNewUnwritten = 0;
-    // Whether the warmup steering-reload notice should be injected after spawn.
-    // Set in trySpawn by comparing the freshly-built instructions against the
-    // last value the agent was told about (prev-instructions). Skipped when
-    // unchanged so agents don't waste 10-30s re-reading identical steering.
-    warmupNeeded = false;
-    lastBuiltInstructions = "";
     pasteQueueDepth = 0;
+    /** #2770: a person's messages a cancel dropped before they reached the CLI, told together (noteCancelledHuman). */
+    cancelledHumans = [];
+    cancelledHumansTimer = null;
     firstDeliveryDelay = new FirstDeliveryDelay();
     /** Orders /steer pastes against each other. Deliberately NOT pasteLock:
      *  a steer must not queue behind the normal deliveries it exists to
@@ -1787,21 +1804,14 @@ export class Daemon extends EventEmitter {
         return super.emit(event, ...args);
     }
     /**
-     * Undo the auth suspicion a pattern match armed, once the backend's token-free
-     * probe has said the credentials are fine.
-     *
-     * emitErrorPattern arms these BEFORE the pty_error reaches the lifecycle, and
-     * the lifecycle's "valid" verdict used to just drop the incident — leaving the
-     * daemon permanently suspicious of an auth failure that never existed. That
-     * state is not inert: authFailureUnresolved suppresses the stuck/hang
-     * notification and holds MCP auto-restart (a later real MCP death is then read
-     * as already-confirmed auth trouble rather than re-verified), and the recovery
-     * gate suppresses further error detection until a ready pattern shows up.
-     *
-     * Only what an auth match armed is rolled back. If some other pattern has
-     * since armed the recovery gate, that one is still live and stays.
+     * Undo an auth suspicion once the backend's token-free probe has said the credentials are fine. Since #2795 a pane
+     * pattern match arms nothing before that probe (its pending match is just dropped); what is left to undo is a
+     * login-screen report, which arms authFailureUnresolved itself. That state is not inert: it suppresses the
+     * stuck/hang notification and holds MCP auto-restart. If some other pattern has armed the recovery gate, that one
+     * is still live and stays.
      */
     clearSuspectedAuthFailure() {
+        this.unverifiedAuthMatch = null;
         if (!this.authFailureUnresolved && !this.loginScreenReported)
             return false;
         this.authFailureUnresolved = false;
@@ -1813,6 +1823,29 @@ export class Daemon extends EventEmitter {
         this.logger.info("Auth suspicion withdrawn — the token-free probe reports valid credentials");
         return true;
     }
+    armErrorRecoveryGate(key, type, now) {
+        this.errorWaitingForRecovery = true;
+        this.errorDetectedAt = now;
+        this.errorRecoveryDeadlineAt = now + Daemon.ERROR_RECOVERY_TIMEOUT_MS;
+        this.activeErrorPatternKey = key;
+        this.lastDetectedErrorType = type;
+    }
+    /**
+     * #2795: the token-free check did not vouch for the credentials behind an auth pattern match. Only now does the
+     * match become an auth failure: the state the detector used to arm at match time. Remembered for as long as it is
+     * unresolved — an auth-broken CLI cannot finish the turn it is holding, so every other detector would otherwise
+     * keep reporting the same dead instance. A login-screen report arms its own state and has no match to confirm.
+     */
+    confirmAuthFailure() {
+        const match = this.unverifiedAuthMatch;
+        if (!match)
+            return false;
+        this.unverifiedAuthMatch = null;
+        if (match.gate)
+            this.armErrorRecoveryGate(match.key, "auth_error", match.at);
+        this.authFailureUnresolved = true;
+        return true;
+    }
     clearErrorRecoveryGate() {
         this.errorWaitingForRecovery = false;
         this.errorDetectedAt = 0;
@@ -2026,6 +2059,11 @@ export class Daemon extends EventEmitter {
             this.finishDurableDelivery(delivery, "delivered", `steer-accepted; composer emptied (${verdict.proof.slice("steer-composer-".length)})`, verdict);
             return;
         }
+        // #2676: an ordinary message typed into that busy composer, proven the same way: taken into the CLI's tray.
+        if (verdict.proof?.startsWith("handoff-composer-")) {
+            this.finishDurableDelivery(delivery, "delivered", `composer-handoff-accepted; composer emptied (${verdict.proof.slice("handoff-composer-".length)})`, verdict);
+            return;
+        }
         // A backend whose input row cannot be read: all that vouched for this delivery is that the pane printed something
         // after Enter, which a redraw that wiped the paste satisfies too (#758). Its transcript can say more.
         if (verdict.proof === "output-edge") {
@@ -2385,16 +2423,11 @@ export class Daemon extends EventEmitter {
             catch { /* may not exist */ }
         }
         // #1209: conditional continuation for the turn interrupted by the last
-        // restart, if the gates allow. Detached like the warmup notice; the gate
+        // restart, if the gates allow. Detached; the gate
         // consumes its one-shot marker first and never throws into boot.
         const legacyResume = this.maybeResumeInterruptedTurn().catch(() => "unknown");
-        // Warmup: wait for CLI idle, then trigger steering reload — but only when
-        // the instructions actually changed since the agent last saw them.
-        // Skipping the no-op reload saves 10-30s of agent time on every restart
-        // where instructions are unchanged.
-        const warmup = this.runWarmupInstructionNotice();
         const recoveryOwner = JSON.stringify(this.interactionOwner());
-        void Promise.allSettled([legacyResume, warmup]).then(() => {
+        void Promise.allSettled([legacyResume]).then(() => {
             if (JSON.stringify(this.interactionOwner()) === recoveryOwner) {
                 this.recoveryBootWorkPending = false;
                 this.recoveryBootSettled = true;
@@ -3432,6 +3465,11 @@ export class Daemon extends EventEmitter {
         if (!(err instanceof UnsupportedCliError))
             return false;
         this.healthCheckPaused = true;
+        if (err instanceof ResumeBlockedError) {
+            this.logger.error({ reason: err.message }, "Not respawning: retained session needs store repair");
+            this.emitSupervisionEnded(err.message, err.remedy, undefined, "resume_blocked");
+            return true;
+        }
         this.logger.error({ reason: err.message }, "Not respawning: the installed CLI cannot run this instance as configured");
         this.emitSupervisionEnded(err.message, "Install a CLI version that supports this instance's configuration, then start it again.", undefined, "cli_unsupported");
         return true;
@@ -3743,6 +3781,7 @@ export class Daemon extends EventEmitter {
                 if (!answersBackedOff)
                     this.dialogAnswers = null;
                 this.trackDialogParked(blockingSeen);
+                this.trackRemoteCard(blockingSeen, pane, captureMono);
                 if (blockingSeen)
                     return; // held dialog: skip error checks this cycle
                 this.evaluateErrorPatterns(pane, patterns, readyPattern, Date.now(), busyPattern);
@@ -3786,6 +3825,14 @@ export class Daemon extends EventEmitter {
                 rebasedSeededBaselines.add(key);
             }
         }
+        // #2795: an auth match the token-free check has not judged yet holds the other detectors, as the armed gate did
+        // before: a real auth failure's text also matches generic patterns (kiro's "having trouble responding"). It is not
+        // an error state — nobody is warned — and it is bounded like the gate.
+        if (this.unverifiedAuthMatch?.gate) {
+            if (now - this.unverifiedAuthMatch.at < Daemon.ERROR_RECOVERY_TIMEOUT_MS)
+                return;
+            this.unverifiedAuthMatch = null;
+        }
         // State: waiting for recovery. A missing/outdated ready pattern must not
         // suppress every future error forever, so the gate has a hard deadline.
         if (this.errorWaitingForRecovery) {
@@ -3931,25 +3978,20 @@ export class Daemon extends EventEmitter {
     }
     /** Arm the recovery gates and emit one detected error pattern. */
     emitErrorPattern(ep, key, pane, now) {
+        // #2795: auth text on the pane proves nothing about the credentials (22 of 22 such matches on the main host were
+        // conversation text). It arms nothing here; it only asks the lifecycle's token-free check, and a failing check
+        // arms the auth state through confirmAuthFailure().
+        if (ep.type === "auth_error")
+            this.unverifiedAuthMatch = { key, at: now, gate: !ep.skipRecoveryWait };
         // skipRecoveryWait: this error self-recovers (e.g. a timeout — Kiro is
         // back at its prompt immediately). Keep monitoring so the next occurrence
         // can fire without waiting for a possibly startup-only ready pattern.
-        if (!ep.skipRecoveryWait) {
-            this.errorWaitingForRecovery = true;
-            this.errorDetectedAt = now;
-            this.errorRecoveryDeadlineAt = now + Daemon.ERROR_RECOVERY_TIMEOUT_MS;
-            this.activeErrorPatternKey = key;
-            this.lastDetectedErrorType = ep.type;
-        }
+        else if (!ep.skipRecoveryWait)
+            this.armErrorRecoveryGate(key, ep.type, now);
         this.lastErrorNotifiedAt.set(key, now);
         if (ep.action === "failover")
             this.lastFailoverAt = now;
         const message = this.resolveErrorMessage(pane, ep);
-        // Remember an auth failure for as long as it is unresolved. An auth-broken
-        // CLI cannot finish the turn it is holding, so every other detector in this
-        // scan would otherwise keep reporting the same dead instance forever.
-        if (ep.type === "auth_error")
-            this.authFailureUnresolved = true;
         this.logger.warn({ errorType: ep.type, action: ep.action }, `PTY error detected: ${message}`);
         this.lastErrorEpisode = { key, pattern: ep.pattern, pane, spawn: this.spawnGeneration, fence: this.launchFenceEpoch };
         this.emit("pty_error", { name: this.name, ...ep, message });
@@ -5124,6 +5166,7 @@ export class Daemon extends EventEmitter {
         this.pausePending = false;
         this.pauseReconfirmAuth = false;
         this.authFailureUnresolved = false;
+        this.unverifiedAuthMatch = null;
         this.loginScreenReported = false;
         this.fatalStartupReported = false;
         this.fatalStartupBlocked = false;
@@ -5968,20 +6011,7 @@ export class Daemon extends EventEmitter {
             reason,
             message: formatReplyDropDetection(turn, reason),
         });
-        this.deliverReplyDropNotice("inst.reply_drop_unrecovered", "replydropwarn", "Reply-drop recovery warning", turn, reason, true);
-    }
-    /** Channel notice for a reply-drop. `rateLimit` shares the per-instance cooldown (#2544). */
-    deliverReplyDropNotice(key, kind, title, turn, reason, rateLimit) {
-        if (rateLimit) {
-            const now = Date.now();
-            if (this.lastReplyDropWarningAt !== 0
-                && now - this.lastReplyDropWarningAt < REPLY_DROP_WARNING_COOLDOWN_MS) {
-                this.logger.debug({ reason, kind }, "Reply-drop channel notice rate-limited");
-                return;
-            }
-            this.lastReplyDropWarningAt = now;
-        }
-        void this.deliverDaemonReply(t(key), kind, title, turn.target, true);
+        // #2802: the event stays (Log tab); the person is no longer told in the topic or the web chat.
     }
     /** Relay the pane's final text to the channel, marked as a daemon proxy reply. */
     async sendProxyReply(pane, target) {
@@ -6014,7 +6044,7 @@ export class Daemon extends EventEmitter {
         }
     }
     /** Context-bound reply path shared by dead-MCP and malformed-call recovery. */
-    deliverDaemonReply(body, requestPrefix, logLabel, target, statusOnly = false) {
+    deliverDaemonReply(body, requestPrefix, logLabel, target) {
         const args = { text: body };
         const chatId = target?.chatId ?? this.lastChatId;
         const threadId = target?.threadId ?? this.lastThreadId;
@@ -6091,7 +6121,6 @@ export class Daemon extends EventEmitter {
                     args,
                     fleetRequestId: fleetReqId,
                     adapterId,
-                    statusOnly,
                 });
             }
             catch {
@@ -6267,7 +6296,9 @@ export class Daemon extends EventEmitter {
             // changed when tmux reported output (observedChangeAt), but idle/stuck are
             // decisions about *now*. The old double-observe expressed that by calling
             // observe twice, which silently disabled the "content moved" branch.
-            const structuredPeriodicIdle = this.backend?.isPeriodicRedrawIdlePane;
+            if (this.backend?.periodicRedrawFrom)
+                this.periodicRedrawLayout = this.backend.periodicRedrawFrom(pane);
+            const structuredPeriodicIdle = this.periodicIdleProof();
             // #1641: the transcript outranks the pane: while it shows the turn running, no reading of this pane is idle (codex
             // hides its status row while streaming, leaving the idle composer and footer in view mid-turn).
             const transcriptTurn = this.transcriptTurnState();
@@ -6459,7 +6490,7 @@ export class Daemon extends EventEmitter {
             return;
         this.instanceStateLastOutputAt = event.at;
         this.interactionOutputRevision++;
-        const canProvePeriodicIdle = !!this.backend?.isPeriodicRedrawIdlePane;
+        const canProvePeriodicIdle = !!this.periodicIdleProof();
         if (canProvePeriodicIdle || (this.backend?.hasPeriodicPaneRedraw?.() === true && this.instanceState === "idle")) {
             // Do not emit idle→working solely because agy repainted an identical
             // footer. Codex additionally uses a structural probe while working: two
@@ -6477,6 +6508,25 @@ export class Daemon extends EventEmitter {
         this.applyInstanceStateSnapshot(snapshot);
         this.scheduleInstanceStateIdleCapture();
         this.scheduleInstanceStateStuckDeadline(event.at);
+        // #2770 (ii): a layout that repaints while idle (Claude's background-agent list) never leaves the quiet window the
+        // idle capture waits for, so nothing would look at the pane again before the 60 s sweep. Look now and then.
+        if (this.backend?.periodicRedrawFrom && performance.now() - this.periodicLayoutLookAt >= PERIODIC_LAYOUT_LOOK_MS) {
+            this.periodicLayoutLookAt = performance.now();
+            this.scheduleInstanceStateOutputProbe(STRUCTURED_IDLE_PROBE_MS);
+        }
+    }
+    /**
+     * The backend's structural idle proof for periodically repainting panes, when it applies to the current layout: always
+     * for a backend that repaints in every layout (Codex, Muse), only while the latest capture showed such a layout for one
+     * that names it (CliBackend.periodicRedrawFrom — Claude's background-agent list, #2770 (ii)).
+     */
+    periodicIdleProof() {
+        const proof = this.backend?.isPeriodicRedrawIdlePane;
+        if (!proof)
+            return undefined;
+        if (this.backend?.periodicRedrawFrom && !this.periodicRedrawLayout)
+            return undefined;
+        return proof;
     }
     bindInstanceStateOutputListener(windowId) {
         if (!this.controlClient || !this.instanceStateMonitorActive)
@@ -6493,6 +6543,7 @@ export class Daemon extends EventEmitter {
     startInstanceStateMonitor() {
         if (this.runtimeMonitorsFrozen || !this.tmux || !this.backend || this.instanceStateMonitorActive)
             return;
+        this.periodicRedrawLayout = false; // a new launch's layout is not the old one's
         const rawConfig = this.config.hang_detector;
         const timeoutMinutes = rawConfig?.timeout_minutes;
         this.instanceStateStuckTimeoutMs = typeof timeoutMinutes === "number" && timeoutMinutes > 0
@@ -6739,6 +6790,10 @@ export class Daemon extends EventEmitter {
             this.config.office_access = update.office_access;
         else if (update.office_access === null)
             delete this.config.office_access;
+        if (typeof update.office_pack_access === "boolean")
+            this.config.office_pack_access = update.office_pack_access;
+        else if (update.office_pack_access === null)
+            delete this.config.office_pack_access;
         if (update.dashboard && typeof update.dashboard === "object" && !dashboardAccessProblem(update.dashboard))
             this.config.dashboard = update.dashboard;
         else if (update.dashboard === null)
@@ -6905,6 +6960,26 @@ export class Daemon extends EventEmitter {
         return { receiptId: id, verificationId: meta.verification_id, expectedWireHash: meta.human_wire_sha256,
             ownerKey: meta.human_owner_key, current: () => this.captureHumanReceiptOwner() === daemonOwner };
     }
+    /**
+     * #2770: a person's message a cancel dropped before it reached the CLI is told, not left as a silent "uncertain":
+     * the messages dropped together go out as one `human_messages_cancelled` (the fleet marks each ❌ and says so once).
+     * Agents' messages are not a person's, and a durable row (delivery_id) is retried by the outbox: neither is ❌'d. A
+     * message with no chat to mark has nowhere to say it.
+     */
+    noteCancelledHuman(meta) {
+        if (meta.from_instance || meta.delivery_id || !meta.chat_id || !meta.message_id)
+            return;
+        this.cancelledHumans.push({ chatId: meta.chat_id, messageId: meta.message_id, ...(meta.thread_id ? { threadId: meta.thread_id } : {}) });
+        if (this.cancelledHumansTimer)
+            clearTimeout(this.cancelledHumansTimer);
+        this.cancelledHumansTimer = setTimeout(() => {
+            this.cancelledHumansTimer = null;
+            const messages = this.cancelledHumans.splice(0);
+            if (messages.length)
+                this.emit("human_messages_cancelled", { messages });
+        }, CANCELLED_HUMANS_NOTICE_MS);
+        this.cancelledHumansTimer.unref?.();
+    }
     finishHumanReceipt(meta, verdict) {
         if (!meta.human_receipt_id || !meta.human_owner_key)
             return;
@@ -6979,6 +7054,7 @@ export class Daemon extends EventEmitter {
     steerMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
         if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
             this.deferDurableDelivery(meta, "delivery epoch changed before steer began");
+            this.noteCancelledHuman(meta);
             return;
         }
         // The fleet facade prevents a steer from overtaking an item still in its
@@ -7002,14 +7078,17 @@ export class Daemon extends EventEmitter {
         this.steerLock = this.steerLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.deferDurableDelivery(meta, "delivery epoch changed before steer began");
+                this.noteCancelledHuman(meta);
                 return;
             }
             await this.wake();
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.deferDurableDelivery(meta, "delivery epoch changed while waking for steer");
+                this.noteCancelledHuman(meta);
                 return;
             }
             const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+            let delivered = false;
             try {
                 if (await this.deliverMessage(formatted, status, {
                     steer: true,
@@ -7019,6 +7098,7 @@ export class Daemon extends EventEmitter {
                     verdict,
                     durableAttempt: durableAttempt || undefined,
                 })) {
+                    delivered = true;
                     this.finishDurableSubmission(durableAttempt, verdict);
                     this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
@@ -7048,6 +7128,8 @@ export class Daemon extends EventEmitter {
             }
             finally {
                 this.finishHumanReceipt(meta, verdict);
+                if (!delivered && !verdict.paneWriteStarted && !this.isDeliveryEpochCurrent(deliveryEpoch))
+                    this.noteCancelledHuman(meta);
             }
         }).catch(err => {
             this.deferDurableDelivery(meta, `target wake/steer failed before pane submission: ${err.message}`);
@@ -7066,6 +7148,7 @@ export class Daemon extends EventEmitter {
     btwMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
         if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
             this.finishHumanReceipt(meta, { reached: false });
+            this.noteCancelledHuman(meta);
             return;
         }
         this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
@@ -7076,22 +7159,28 @@ export class Daemon extends EventEmitter {
         this.steerLock = this.steerLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.finishHumanReceipt(meta, { reached: false });
+                this.noteCancelledHuman(meta);
                 return;
             }
             await this.wake();
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.finishHumanReceipt(meta, { reached: false });
+                this.noteCancelledHuman(meta);
                 return;
             }
             const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+            let delivered = false;
             try {
                 if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id,
                     ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}), verdict })) {
+                    delivered = true;
                     this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
             }
             finally {
                 this.finishHumanReceipt(meta, verdict);
+                if (!delivered && !verdict.paneWriteStarted && !this.isDeliveryEpochCurrent(deliveryEpoch))
+                    this.noteCancelledHuman(meta);
             }
         }).catch(err => {
             this.finishHumanReceipt(meta, { reached: false });
@@ -7107,6 +7196,7 @@ export class Daemon extends EventEmitter {
         if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
             this.logger.info("Pending channel delivery dropped by user cancel");
             this.deferDurableDelivery(meta, "delivery epoch changed before queue admission");
+            this.noteCancelledHuman(meta);
             return;
         }
         if (!this.tmux) {
@@ -7128,10 +7218,6 @@ export class Daemon extends EventEmitter {
                 this.logger.warn({ err: err.message }, "Failed to persist last inbound timestamp");
             }
         }
-        if (this.pendingInstructionsUpdate) {
-            writeFileSync(join(this.instanceDir, "prev-instructions"), this.pendingInstructionsUpdate);
-            this.pendingInstructionsUpdate = undefined;
-        }
         this.pendingWork.recordInbound();
         // v3: record user messages for rotation snapshot
         this.recordRecentUserMessage(content, meta);
@@ -7170,6 +7256,7 @@ export class Daemon extends EventEmitter {
         this.pasteLock = this.pasteLock.then(async () => {
             let durable = null;
             let verdict = { reached: false };
+            let delivered = false;
             try {
                 if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     this.logger.info("Pending channel delivery dropped by user cancel");
@@ -7181,44 +7268,11 @@ export class Daemon extends EventEmitter {
                     if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                         return;
                 }
-                if (this.pendingInstructionsNotice) {
-                    this.pendingInstructionsNotice = false;
-                    await this.deliverMessage(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir, this.backend?.instructionsSource?.()), undefined, { deliveryEpoch });
-                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
-                        return;
-                }
-                const whatsNew = this.pendingWhatsNew ? this.currentWhatsNew(this.pendingWhatsNew) : null;
-                if (whatsNew) {
-                    // #1633: here, inside the delivery lock and ahead of a real delivery — never into a busy turn, never to an
-                    // instance nobody writes to. #2140: told at most once. Once its paste reached the pane it is recorded, proven
-                    // submitted or not. A system paste has no unique id: its only pane proof is its opening line on the screen, and
-                    // a long notice (every entry since an old session began) scrolls that line above the captured rows once Claude
-                    // paints it — unproven, though the agent read it. One that never reached the pane (cancelled, never idle) is
-                    // tried again, at most WHATS_NEW_MAX_UNWRITTEN times, then recorded with a warning.
-                    const attempt = { reached: false };
-                    const pasted = await this.deliverMessage(whatsNew.notice, undefined, { deliveryEpoch, verdict: attempt });
-                    if (this.pendingWhatsNew === whatsNew) {
-                        const written = pasted || attempt.paneWriteStarted === true;
-                        if (!written)
-                            this.whatsNewUnwritten++;
-                        if (written || this.whatsNewUnwritten >= WHATS_NEW_MAX_UNWRITTEN) {
-                            if (!pasted) {
-                                this.logger.warn({ entries: whatsNew.ids, written, attempts: this.whatsNewUnwritten, phase: attempt.phase, proof: attempt.proof }, written ? "what's-new notice pasted but its submission could not be proven — recorded so it is not sent again"
-                                    : "what's-new notice did not reach the pane after several deliveries — recorded so it is not sent again");
-                            }
-                            this.pendingWhatsNew = null;
-                            this.whatsNewUnwritten = 0;
-                            try {
-                                recordWhatsNew(this.instanceDir, whatsNew.ids, whatsNew.version);
-                            }
-                            catch (err) {
-                                this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
-                            }
-                        }
-                    }
-                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
-                        return;
-                }
+                // #2800: with this real message, in the same paste — never a paste or turn of its own: after its delivery marker
+                // (transcript proof anchors on it), before the message. A person's message with a verified receipt is pasted
+                // byte for byte (its proof is the wire's hash), so the notice waits for the next delivery without one.
+                const whatsNew = this.pendingWhatsNew && !meta.human_receipt_id ? this.currentWhatsNew(this.pendingWhatsNew) : null;
+                const pasted = whatsNew ? withWhatsNew(formatted, whatsNew.notice) : formatted;
                 const status = channelStatus(meta);
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
@@ -7230,13 +7284,24 @@ export class Daemon extends EventEmitter {
                     return;
                 }
                 durable = durableAttempt;
-                if (await this.deliverMessage(formatted, status, {
-                    deliveryEpoch,
-                    submissionId: meta.message_id,
-                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
-                    verdict,
-                    durableAttempt: durableAttempt || undefined,
-                })) {
+                let sent = false;
+                try {
+                    sent = await this.deliverMessage(pasted, status, {
+                        deliveryEpoch,
+                        submissionId: meta.message_id,
+                        ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
+                        verdict,
+                        durableAttempt: durableAttempt || undefined,
+                    });
+                }
+                finally {
+                    // #2800: told once — recorded as soon as it went out with this message, proven submitted or not, also when
+                    // a later step of the write threw; a paste that never reached the pane keeps it for the next message.
+                    if (whatsNew && (sent || verdict.paneWriteStarted))
+                        this.recordWhatsNewSent(whatsNew);
+                }
+                if (sent) {
+                    delivered = true;
                     this.finishDurableSubmission(durable, verdict);
                     this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
@@ -7282,6 +7347,8 @@ export class Daemon extends EventEmitter {
             }
             finally {
                 this.finishHumanReceipt(meta, verdict);
+                if (!delivered && !verdict.paneWriteStarted && !this.isDeliveryEpochCurrent(deliveryEpoch))
+                    this.noteCancelledHuman(meta);
                 this.pasteQueueDepth--;
             }
         }).catch(err => {
@@ -7346,12 +7413,29 @@ export class Daemon extends EventEmitter {
             return false;
         let windowId = this.getWindowId();
         const supportsQueuedInput = this.backend?.supportsQueuedInput?.() === true;
+        const composerQueue = !opts?.steer && this.composerTakesBusyInput() && this.composerCanShowPaste(formatted);
         let handingOffToNativeQueue = false;
         // If the CLI is busy, either hand the complete submission to its native input
         // queue or wait for idle. Native queue support is an explicit backend capability:
         // normal Enter input has steering/interrupt semantics in several other CLIs.
         let readiness = "ready";
         const gateWindowId = windowId;
+        const handOffEligible = !!(supportsQueuedInput || opts?.steer || composerQueue);
+        const handOffAdmissible = async () => (await this.probeBlockingDialog()).state === "clear"
+            && await this.hasPositiveDeliveryInput(true)
+            && ((!opts?.steer && !composerQueue) || (this.launchTakesSteer() && await this.steerComposerAdmits(false, opts?.steer === true)));
+        // #2770: a delivery waiting for idle holds the paste queue, and every message behind it. It stops waiting at once
+        // on a cancel, and as soon as the busy pane can take it the way it would have on arrival (a box that reads again, a
+        // dialog gone) — rather than for the end of whatever keeps the pane moving (2026-10-27: 11 minutes).
+        let handOffCheckedAt = -Infinity;
+        const waitStop = async () => {
+            if (cancelled())
+                return true;
+            if (!handOffEligible || !gateWindowId || performance.now() - handOffCheckedAt < HANDOFF_RECHECK_MS)
+                return false;
+            handOffCheckedAt = performance.now();
+            return (await this.paneReadinessForDelivery(gateWindowId)) === "busy" && await handOffAdmissible() && !cancelled();
+        };
         if (gateWindowId && this.controlClient)
             readiness = await this.paneReadinessForDelivery(gateWindowId);
         if (readiness !== "ready") {
@@ -7362,11 +7446,9 @@ export class Daemon extends EventEmitter {
             // press Enter at once. A dialog painted a moment ago is still "busy" to
             // the silence gate, so the probe is mandatory here; "dialog"/"unknown"
             // fall through to the wait.
-            const canHandOff = (supportsQueuedInput || opts?.steer)
-                && readiness === "busy"
-                && (await this.probeBlockingDialog()).state === "clear"
-                && await this.hasPositiveDeliveryInput(true)
-                && (!opts?.steer || (this.launchTakesSteer() && await this.steerComposerAdmits(false)));
+            // #2676: an ordinary message goes into a mode-switched composer (kiro TUI) mid-turn too, on a launch whose busy
+            // composer AgEnD drives, by the steer path's own gates and proof — when its box can show it is this paste.
+            const canHandOff = handOffEligible && readiness === "busy" && await handOffAdmissible();
             if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
@@ -7374,14 +7456,20 @@ export class Daemon extends EventEmitter {
                 // visibility check + idle-gated fallback catch TUIs that swallow
                 // busy input (see steerMessage).
                 handingOffToNativeQueue = true;
-                this.logger.debug(opts?.steer ? "CLI busy — steering into the running turn" : "CLI busy — handing message to backend-native input queue");
+                this.logger.debug(opts?.steer ? "CLI busy — steering into the running turn"
+                    : composerQueue ? "CLI busy — typing message into the busy composer"
+                        : "CLI busy — handing message to backend-native input queue");
             }
             else {
                 this.logger.debug("CLI busy — queuing message until idle");
-                const becameIdle = await this.waitForPaneReadyForDelivery(gateWindowId);
+                const becameIdle = await this.waitForPaneReadyForDelivery(gateWindowId, undefined, waitStop);
                 if (cancelled())
                     return false;
-                if (!becameIdle) {
+                if (becameIdle === "stopped") {
+                    handingOffToNativeQueue = true;
+                    this.logger.info("The busy CLI can take this delivery now — handing it off instead of waiting for idle (#2770)");
+                }
+                else if (!becameIdle) {
                     // The pane never freed up. Report the failure instead of pasting into a
                     // wedged CLI (where the text would sit unsubmitted and the next message
                     // would land on top of it) — and instead of holding the queue silently.
@@ -7468,9 +7556,9 @@ export class Daemon extends EventEmitter {
                 // #1405: a launch that no longer takes a steer is not the one the gate saw — redo from the top (bounded), where
                 // the gate sends it down the idle path. The composer can also have changed mode since (the user's Ctrl+S), or
                 // the turn ended.
-                if (handingOffToNativeQueue && opts?.steer && !this.launchTakesSteer())
+                if (handingOffToNativeQueue && (opts?.steer || composerQueue) && !this.launchTakesSteer())
                     return "spawn-started";
-                if (handingOffToNativeQueue && opts?.steer && !(await this.steerComposerAdmits(true)))
+                if (handingOffToNativeQueue && (opts?.steer || composerQueue) && !(await this.steerComposerAdmits(true, opts?.steer === true)))
                     return "dialog";
                 // #829: a CLI that restores a cancelled prompt into its input box would
                 // have this message pasted onto it and both submitted as one. Clear it
@@ -7526,9 +7614,13 @@ export class Daemon extends EventEmitter {
                 return this.failDelivery(verdict, status, "pre-write", "dialog-or-input-not-ready");
             }
             this.logger.info("Dialog or input transition appeared before the pane write — waiting for readiness");
-            const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId) : false;
+            const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId, undefined, waitStop) : false;
             if (cancelled())
                 return false;
+            if (clear === "stopped") {
+                handingOffToNativeQueue = true;
+                continue;
+            }
             if (!clear) {
                 return this.failDelivery(verdict, status, "pre-write", "readiness-timeout");
             }
@@ -7968,9 +8060,11 @@ export class Daemon extends EventEmitter {
                 && dialogs.some(other => other !== dialog && Daemon.dialogMatches(other, pane)))
                 continue;
             this.trackDialogParked(dialog);
+            this.trackRemoteCard(dialog, pane, probeMono);
             return { state: "dialog", dialog };
         }
         this.trackDialogParked(null);
+        this.trackRemoteCard(null, pane, probeMono);
         return { state: "clear" };
     }
     /**
@@ -8211,6 +8305,77 @@ export class Daemon extends EventEmitter {
         this.logger.warn({ dialog: dialog.description, attempts: episode.ignored, holdsDeliveries }, "Runtime dialog is ignoring AgEnD's answer — reporting for a human");
         this.emit("dialog_answer_ignored", { name: this.name, description: dialog.description, attempts: episode.ignored, holdsDeliveries });
     }
+    /**
+     * #2675: a held card a person can answer from the chat (the dialog's remoteCard reader) is posted once it has stayed
+     * the same card for REMOTE_CARD_STABLE_MS — `remote_card` with what it asks; the fleet posts it with its buttons. When
+     * it closes or another card replaces it, `remote_card_gone` retires that post. Moving through the card (ours or the
+     * person's in the pane) is the same card: its identity has no cursor. `readAt` is when the pane's capture was started
+     * (performance.now): a read that started before the newest one used here finishes late and says nothing about now —
+     * it may neither retire a newer card nor bring an older one back (#2677 review).
+     */
+    trackRemoteCard(dialog, pane, readAt) {
+        if (readAt < this.remoteCardReadAt)
+            return;
+        this.remoteCardReadAt = readAt;
+        const card = dialog?.remoteCard?.(pane) ?? null;
+        const shown = this.remoteCardShown;
+        if (shown && shown.identity !== card?.identity) {
+            this.remoteCardShown = null;
+            if (shown.posted)
+                this.emit("remote_card_gone", { name: this.name, identity: shown.identity });
+        }
+        if (!card)
+            return;
+        if (!this.remoteCardShown) {
+            this.remoteCardShown = { identity: card.identity, since: performance.now(), posted: false };
+            return;
+        }
+        if (this.remoteCardShown.posted || performance.now() - this.remoteCardShown.since < REMOTE_CARD_STABLE_MS)
+            return;
+        this.remoteCardShown.posted = true;
+        this.logger.info({ kind: card.kind }, "A card a person can answer from the chat is on screen — posting it");
+        this.emit("remote_card", { name: this.name, card });
+    }
+    /** #2675: the card's post was used up without answering it (refused, stopped part-way): post it again once it holds still. */
+    repostRemoteCard() {
+        this.remoteCardShown = null;
+    }
+    /**
+     * #2675: answer the card on screen from the chat, as the person chose: only while it is the card they saw
+     * (`identity`), on a verified cursor, under the pane write lock (remote-card-answer.ts). Never logs the answer.
+     */
+    async answerRemoteCard(identity, action) {
+        const tmux = this.tmux;
+        const readers = this.runtimeDialogs().filter(dialog => dialog.remoteCard);
+        if (!tmux || readers.length === 0)
+            return { outcome: "stale" };
+        if (this.remoteCardAnswering)
+            return { outcome: "refused", reason: "another answer to this card is being keyed in" };
+        this.remoteCardAnswering = true;
+        try {
+            const outcome = await answerRemoteCard({
+                locked: fn => this.paneWriteLock.run(fn),
+                // An unreadable screen (a failed capture, another spawn's pane) is unknown — never "the card closed".
+                read: () => this.tmux === tmux ? tmux.capturePane().catch(() => null) : Promise.resolve(null),
+                key: key => this.tmux !== tmux ? Promise.resolve(false) : key === "Space" ? tmux.sendKeys(" ") : tmux.sendSpecialKey(key),
+                paste: text => this.tmux !== tmux ? Promise.resolve(false) : tmux.pasteBuffer(text),
+                sleep: ms => new Promise(resolve => setTimeout(resolve, ms)),
+                now: () => performance.now(),
+            }, pane => {
+                for (const dialog of readers) {
+                    const card = dialog.remoteCard(pane);
+                    if (card)
+                        return card;
+                }
+                return null;
+            }, identity, action);
+            this.logger.info({ action: action.kind, ...outcome }, "Answered a card from the chat");
+            return outcome;
+        }
+        finally {
+            this.remoteCardAnswering = false;
+        }
+    }
     /**
      * Remember how long a blocking dialog has been on screen. Once it has
      * outlived DIALOG_PARKED_NOTIFY_MS — the auto-dismiss did not take, or the
@@ -8314,21 +8479,48 @@ export class Daemon extends EventEmitter {
      * while a fresh capture reads its composer as "steer" — or "idle" once the turn has ended (`allowIdle`, the pre-write
      * re-check). "queue" (the user's choice), text in the box, or a screen it cannot read: not now — the caller waits for
      * the idle prompt as for any message. AgEnD never switches the mode. Backends without the reader are not asked.
+     * #2676: an ordinary message (`steerOnly` false) goes in on "queue" too — kiro takes it into the same tray either way,
+     * held for the turn's end instead of steered into it.
      */
-    async steerComposerAdmits(allowIdle) {
+    async steerComposerAdmits(allowIdle, steerOnly = true) {
         const read = this.backend?.readSteerComposer;
         if (!read)
             return true;
         if (!this.tmux)
             return false;
-        let mode;
+        let pane;
         try {
-            mode = read.call(this.backend, await this.tmux.capturePane());
+            pane = await this.tmux.capturePane();
         }
         catch {
             return false;
         }
-        return mode === "steer" || (allowIdle && mode === "idle");
+        return composerModeAdmits(read.call(this.backend, pane), allowIdle, steerOnly) && this.busyInputReachesTurn(pane);
+    }
+    /** #2682: a busy composer's typed input reaches the CLI's own turn (busyTurnTakesInput); an idle box, or no reader: yes. */
+    busyInputReachesTurn(pane) {
+        const mode = this.backend?.readSteerComposer?.(pane);
+        if (mode !== "steer" && mode !== "queue")
+            return true;
+        return this.backend?.busyTurnTakesInput?.(pane) !== false;
+    }
+    /**
+     * #2676: whether an ordinary message may be typed into this CLI's busy composer — a mode-switched one (kiro TUI) on a
+     * launch whose busy composer AgEnD drives (the same evidence as a steer: KIRO_STEER_VERIFIED). The legacy UI, an
+     * unlisted version and every backend without the reader answer false; claude and codex hand off by
+     * supportsQueuedInput instead.
+     */
+    composerTakesBusyInput() {
+        return !!this.backend?.readSteerComposer && this.backend.supportsSteer?.() === true;
+    }
+    /**
+     * #2676: whether the box can show this payload as this delivery's paste before the Enter (steerPasteIsOurs): its
+     * first line, or a collapsed paste's line count. A one-line payload kiro would collapse (over 500 characters) shows only
+     * a character count, which kiro's own normalisation (tabs widened) makes no proof: it waits for the idle prompt.
+     * kiro measures after widening each tab to its 2-column stop, so a tab is counted as 2 here (at most what it becomes).
+     */
+    composerCanShowPaste(formatted) {
+        return /[\r\n]/.test(formatted) || formatted.replace(/\t/g, "  ").length <= KIRO_COLLAPSE_CHARS;
     }
     /**
      * #1405: one look at a mode-switched composer for a steer's own proof: on the tmux of this write, inside `deadline`
@@ -8362,10 +8554,18 @@ export class Daemon extends EventEmitter {
         if (first === "")
             return false;
         const row = norm(shown);
+        // #2676: a long paste is collapsed to a chip naming its line count (kiro TUI: more than 10 lines or 500 characters);
+        // it is this paste when that count is exactly this payload's as kiro counts it. tmux pastes every LF as CR (no -r),
+        // so a CRLF arrives as CR CR, and kiro turns each CR into a line break: every CR and every LF is one.
+        const collapsed = this.backend?.readSteerComposerPasteLines?.(shown);
+        if (collapsed != null)
+            return collapsed > 1 && collapsed === formatted.split(/\r|\n/).length;
         // The marker line holds nothing but the marker: the row is exactly it.
         if (/^\[agend-(?:delivery|human)-id:[^\]\s]+\]$/.test(first))
             return row === first;
-        return row === first || row.startsWith(`${first} `);
+        // #2676: a first line wider than the box is word-wrapped onto indented rows (live, 2.34.0): the row is its start, cut
+        // at a word boundary.
+        return row === first || row.startsWith(`${first} `) || first.startsWith(`${row} `);
     }
     /**
      * Codex can paint a prompt before the TTY enters raw mode. Both are required.
@@ -8512,6 +8712,18 @@ export class Daemon extends EventEmitter {
         if (this.needsStartupInputProof()) {
             return await this.hasPositiveDeliveryInput() ? "ready" : "transient";
         }
+        // #2682: a backend that can read its own idle input box (kiro's TUI) must show it before an idle paste. Anything
+        // else — another program owning the pane, a frame it cannot read, a capture that fails — is not one to type into.
+        if (this.backend?.idleComposerReady && this.tmux) {
+            try {
+                if (!this.backend.idleComposerReady(await this.tmux.capturePane()))
+                    return "busy";
+            }
+            catch (err) {
+                this.logger.debug({ err }, "capture-pane failed during the composer check — treating the pane as not ready");
+                return "busy";
+            }
+        }
         if (this.backend?.dropsEnterWhileBusy?.() !== true)
             return "ready";
         const prompt = this.backend.getBottomReadyPattern?.();
@@ -8545,13 +8757,7 @@ export class Daemon extends EventEmitter {
             return "busy";
         }
     }
-    /**
-     * Like waitForPaneIdleForDelivery, plus the bottom-anchored prompt check for
-     * Enter-dropping TUIs. Polls at a coarse cadence (each poll is a capture-pane)
-     * only after the pane is already quiet, so the common fast-idle delivery still
-     * costs a single capture.
-     */
-    async waitForPaneReadyForDelivery(windowId, timeoutMs = 30 * 60_000) {
+    async waitForPaneReadyForDelivery(windowId, timeoutMs = 30 * 60_000, stop) {
         // Every backend polls: readiness now also means "no blocking dialog on
         // screen", and a dialog disappears without any output edge the silence
         // gate could see.
@@ -8564,9 +8770,10 @@ export class Daemon extends EventEmitter {
             const remaining = deadline - Date.now();
             if (remaining <= 0)
                 return false;
-            const idle = await this.waitForPaneIdleForDelivery(windowId, remaining);
-            if (!idle)
-                return false;
+            const idle = stop ? await this.waitForPaneIdleForDelivery(windowId, remaining, stop)
+                : await this.waitForPaneIdleForDelivery(windowId, remaining);
+            if (idle !== true)
+                return idle;
             // The idle wait just resolved, so re-reading the silence gate would only
             // add a stale-cache race; ask the pane the remaining questions directly.
             const transient = await this.probeInputTransient();
@@ -8586,6 +8793,8 @@ export class Daemon extends EventEmitter {
                         this.retireInputTransients("transient stalled");
                     return false;
                 }
+                if (stop && await stop())
+                    return "stopped";
                 await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
                 continue;
             }
@@ -8595,6 +8804,8 @@ export class Daemon extends EventEmitter {
                     this.logger.error({ probes: unknownStreak }, "Pane stayed unreadable during the input-transient probe — refusing to deliver blind");
                     return false;
                 }
+                if (stop && await stop())
+                    return "stopped";
                 await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
                 continue;
             }
@@ -8616,6 +8827,8 @@ export class Daemon extends EventEmitter {
                     unknownStreak = 0;
                 }
             }
+            if (stop && await stop())
+                return "stopped";
             await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
         }
     }
@@ -9023,9 +9236,11 @@ export class Daemon extends EventEmitter {
         return observedAt >= lastOutputAt
             && observedAt >= this.controlClient.getObservationResetAt();
     }
-    waitForPaneIdleForDelivery(windowId, timeoutMs = 30 * 60_000) {
+    waitForPaneIdleForDelivery(windowId, timeoutMs = 30 * 60_000, stop) {
         if (!this.controlClient)
             return Promise.resolve(true);
+        if (stop)
+            return this.waitForPaneIdleOrStop(windowId, timeoutMs, stop);
         if (!this.canTrustRedrawIdleState()) {
             return this.controlClient.waitUntilIdle(windowId, timeoutMs);
         }
@@ -9045,6 +9260,44 @@ export class Daemon extends EventEmitter {
             }, timeoutMs);
         });
     }
+    /**
+     * #2770: waitForPaneIdleForDelivery that also ends as soon as `stop` says so ("stopped"). The same idle readings
+     * (tmux silence, or the state machine where its idle is trusted), polled here so nothing outlives a stopped wait.
+     */
+    waitForPaneIdleOrStop(windowId, timeoutMs, stop) {
+        const control = this.controlClient;
+        const trusted = this.canTrustRedrawIdleState();
+        if (trusted && this.isPaneIdleForDelivery(windowId))
+            return Promise.resolve(true);
+        return new Promise(resolve => {
+            let done = false, asking = false, askedAt = -Infinity;
+            const finish = (outcome) => {
+                if (done)
+                    return;
+                done = true;
+                clearInterval(check);
+                clearTimeout(timer);
+                resolve(outcome);
+            };
+            // The same idle readings as the plain wait: tmux silence (abandoned once this wait ends), or the state machine.
+            if (!trusted) {
+                control.waitUntilIdle(windowId, timeoutMs, () => done).then(idle => finish(idle), () => finish(false));
+            }
+            const check = setInterval(() => {
+                if (trusted && this.isPaneIdleForDelivery(windowId)) {
+                    finish(true);
+                    return;
+                }
+                if (asking || performance.now() - askedAt < WAIT_STOP_POLL_MS)
+                    return;
+                asking = true;
+                askedAt = performance.now();
+                stop().then(stopNow => { asking = false; if (stopNow)
+                    finish("stopped"); }, err => { asking = false; this.logger.debug({ err }, "Delivery wait stop check failed — still waiting"); });
+            }, 50);
+            const timer = setTimeout(() => finish(false), timeoutMs);
+        });
+    }
     /**
      * Antigravity has always opted into pane-state delivery readiness because its
      * footer redraws while idle.  Codex's structural idle proof is useful only
@@ -9057,7 +9310,7 @@ export class Daemon extends EventEmitter {
     canTrustRedrawIdleState() {
         if (this.backend?.hasPeriodicPaneRedraw?.() === true)
             return true;
-        return this.instanceStateMonitorActive && !!this.backend?.isPeriodicRedrawIdlePane;
+        return this.instanceStateMonitorActive && !!this.periodicIdleProof();
     }
     /**
      * The write half of a delivery: paste → Enter → confirm, with retries.
@@ -9155,15 +9408,16 @@ export class Daemon extends EventEmitter {
             }
             // #1405: on that same last capture a mode-switched composer (kiro TUI) must still read "steer" — or "idle", the
             // turn over. "queue", text in the box or an unreadable row: not written; handled as the unread box above.
-            if (handingOffToNativeQueue && steer && this.backend?.readSteerComposer
-                && pasteBaseline?.steerComposer !== "steer" && pasteBaseline?.steerComposer !== "idle") {
+            // #2676: an ordinary message typed into it (every other hand-off there) may also find "queue".
+            if (handingOffToNativeQueue && this.backend?.readSteerComposer
+                && (!composerModeAdmits(pasteBaseline?.steerComposer ?? null, true, steer) || pasteBaseline?.busyInputReachesTurn === false)) {
                 if (!verdict.durableBeginCommitted)
                     return "handoff-box-unread";
-                return this.failDelivery(verdict, status, "paste", "steer-composer-not-steering");
+                return this.failDelivery(verdict, status, "paste", steer ? "steer-composer-not-steering" : "composer-not-empty");
             }
             // …and the launch must still take a steer (see launchTakesSteer). Not written: before the durable begin the row
-            // is retried, as a steer the gate will then send down the idle path.
-            if (handingOffToNativeQueue && steer && !this.launchTakesSteer()) {
+            // is retried, as a steer the gate will then send down the idle path (#2676: so is a message typed into the box).
+            if (handingOffToNativeQueue && (steer || this.backend?.readSteerComposer) && !this.launchTakesSteer()) {
                 verdict.fenced = !verdict.durableBeginCommitted;
                 return false;
             }
@@ -9293,7 +9547,8 @@ export class Daemon extends EventEmitter {
             // #1405: a steer into a mode-switched composer (kiro TUI) is proven by the box alone — before the Enter it must
             // positively hold typed text, and after it be the empty placeholder again. The empty placeholder here means the
             // paste never reached the box; an unreadable box (a failed or late capture, a dialog) proves nothing: no Enter.
-            const steerComposerProof = handingOffToNativeQueue && steer && !!this.backend?.readSteerComposer && tmuxAtWrite !== null;
+            // #2676: an ordinary message typed into the busy box is proven the same way.
+            const steerComposerProof = handingOffToNativeQueue && !!this.backend?.readSteerComposer && tmuxAtWrite !== null;
             let humanComposerOwned = false;
             let steerEnterDeadline = Infinity;
             if (steerComposerProof) {
@@ -9394,8 +9649,8 @@ export class Daemon extends EventEmitter {
                                 if (humanComposerOwned)
                                     signature.humanPositive?.(after === "steer" ? "composer-empty-steer"
                                         : after === "queue" ? "composer-empty-queue" : "composer-empty-idle");
-                                verdict.phase = "steer-accepted";
-                                verdict.proof = `steer-composer-${after}`;
+                                verdict.phase = steer ? "steer-accepted" : "composer-accepted";
+                                verdict.proof = `${steer ? "steer" : "handoff"}-composer-${after}`;
                                 if (status)
                                     this.emit("message_confirmed", status); // ✅ taken from the box
                                 return true;
@@ -10086,6 +10341,7 @@ export class Daemon extends EventEmitter {
             collapsedPastes: input?.collapsedPastes ?? 0,
             inputReadable: input != null,
             steerComposer: this.backend?.readSteerComposer?.(pane) ?? null,
+            busyInputReachesTurn: this.busyInputReachesTurn(pane),
         };
     }
     /**
@@ -10581,6 +10837,12 @@ export class Daemon extends EventEmitter {
                     reply(failed ? null : answer, failed);
                     return;
                 }
+                if (tool === "office_pack_check" || tool === "office_pack_upload") {
+                    // #2692: the folder (or the manifest's files) is read here, on the agent's side; the fleet gets bytes in parts.
+                    const answer = await sendPackSources(args, { workspace: this.config.working_directory, configuredWorkspace: this.config.working_directory, stateDir: getAgendHome(), instance: this.name }, async (payload) => { const r = await ask(payload); return r.error ? { error: "fleet", message: r.error } : (r.result && typeof r.result === "object" ? r.result : {}); });
+                    reply(answer, undefined);
+                    return;
+                }
                 if (tool === "upload_web_effect") {
                     const owner = { fence: this.launchFenceEpoch, spawn: this.spawnGeneration, boot: this.bootId, ipc: this.ipcServer };
                     const current = () => !!owner.ipc && owner.ipc === this.ipcServer && owner.fence === this.launchFenceEpoch && owner.spawn === this.spawnGeneration && owner.boot === this.bootId && !this.deliveryWritesStopping && !this.startupAborted;
@@ -11029,10 +11291,6 @@ export class Daemon extends EventEmitter {
         const snapshot = this.buildSnapshotPrompt();
         if (!snapshot || !this.tmux)
             return;
-        if (this.pendingInstructionsUpdate) {
-            writeFileSync(join(this.instanceDir, "prev-instructions"), this.pendingInstructionsUpdate);
-            this.pendingInstructionsUpdate = undefined;
-        }
         // Small delay to let the CLI fully render its ready prompt
         await new Promise(r => setTimeout(r, 1_000));
         admission?.();
@@ -11351,6 +11609,23 @@ export class Daemon extends EventEmitter {
                         paneText = await this.tmux?.capturePaneWithHistory(50);
                     }
                     catch { /* pane may be gone */ }
+                    if (paneText && this.backend.resumeBlockedPattern?.().test(paneText)) {
+                        // #2598: a duplicate id proves the conversation exists. The generic retry escape hatch must not
+                        // abandon that pin or turn a store-selection error into a fresh conversation, even after many retries.
+                        await this.killProcessTree("SIGTERM", "spawn: retained session is blocked");
+                        this.startupAdmission?.();
+                        await this.tmux.killWindow();
+                        this.startupAdmission?.();
+                        throw new ResumeBlockedError(t("inst.kiro_resume_ambiguous"), t("inst.kiro_resume_ambiguous_remedy"));
+                    }
+                    const retained = this.backend.retainedResumeBlock?.();
+                    if (retained) {
+                        await this.killProcessTree("SIGTERM", "spawn: carried session must be preserved");
+                        this.startupAdmission?.();
+                        await this.tmux.killWindow();
+                        this.startupAdmission?.();
+                        throw new ResumeBlockedError(retained.reason, retained.remedy);
+                    }
                     const proven = this.paneSaysNoConversation(paneText);
                     if (!proven) {
                         const failures = this.bumpUnprovenResumeFailures();
@@ -11543,6 +11818,188 @@ export class Daemon extends EventEmitter {
             this.logger.warn({ err }, "The agent switch after resume failed — the shared entries stay; the next launch tries again");
         }
     }
+    /**
+     * M-2025: after a tui/V3 launch is ready, type `/session-id` and `/title` once
+     * each, under the pane-write lock, with the same fences as {@link ensureBackendAgent}.
+     * Does not touch the delivery epoch. A mismatch with the #2617 pin is surfaced;
+     * the pin is never replaced by a file-store guess. Legacy backends return null
+     * from sessionProof().
+     *
+     * #2683: these are AgEnD's own housekeeping, so unlike a delivery (which may join
+     * a person's draft) each one goes only into a composer the final capture shows
+     * positively EMPTY; Enter only once a capture shows exactly the command in the box;
+     * and it counts as run only once the box is empty again — a command left in the
+     * box stops here (it is taken back when the box shows exactly it), and nothing
+     * else is typed after it. The id is taken only from kiro's `/session-id` alert
+     * (readSessionIdAlert) on a capture after the command ran, and never when that
+     * alert was already on the final capture before it was typed: an announcement
+     * that was there before is not an answer to this request.
+     */
+    async ensureKiroSessionProof() {
+        let proof = null;
+        try {
+            proof = this.backend?.sessionProof?.() ?? null;
+        }
+        catch {
+            proof = null;
+        }
+        const tmux = this.tmux;
+        if (!proof || !tmux || !this.backend)
+            return;
+        const windowId = tmux.getWindowId();
+        const spawn = this.spawnGeneration, fence = this.launchFenceEpoch, phase = this.pauseWakeState;
+        const fenced = () => !this.startupAborted && !this.deliveryWritesStopping && !this.fatalStartupBlocked
+            && (phase === "active" || phase === "waking") && this.pauseWakeState === phase
+            && spawn === this.spawnGeneration && fence === this.launchFenceEpoch && this.tmux === tmux;
+        const deadline = performance.now() + Daemon.AGENT_SWITCH_BUDGET_MS;
+        const live = () => { this.startupAdmission?.(); return fenced() && performance.now() < deadline; };
+        if (!live())
+            return;
+        // A proof belongs to the launch that read it: an earlier launch's never stands for this one.
+        try {
+            clearKiroSessionProof(this.instanceDir);
+        }
+        catch { /* recorded again below only on a fresh match */ }
+        const TIMEOUT = Symbol("deadline");
+        const within = (work) => {
+            const left = deadline - performance.now();
+            if (left <= 0) {
+                work.catch(() => { });
+                return Promise.resolve(TIMEOUT);
+            }
+            let timer;
+            return Promise.race([work, new Promise(r => { timer = setTimeout(() => r(TIMEOUT), left); })])
+                .finally(() => clearTimeout(timer));
+        };
+        const capture = async () => {
+            const pane = await within(tmux.capturePane().catch(() => null));
+            return pane === TIMEOUT ? null : pane;
+        };
+        const pause = (ms) => within(new Promise(r => setTimeout(r, ms)));
+        const op = Daemon.AGENT_SWITCH_TMUX_OP_MS;
+        const box = async () => {
+            const pane = await capture();
+            return pane === null ? null : proof.readComposer(pane);
+        };
+        /**
+         * Our command, and only it, is in the box: take it back — also past the deadline, on its own bounded capture.
+         * Anything else there is left as it is.
+         */
+        const takeBack = async (command) => {
+            let timer;
+            const pane = await Promise.race([tmux.capturePane().catch(() => null), new Promise(r => { timer = setTimeout(() => r(null), op); })])
+                .finally(() => clearTimeout(timer));
+            if (pane !== null && fenced() && proof.readComposer(pane) === command)
+                await tmux.deleteBackward(command.length, op);
+        };
+        /**
+         * "ran": typed, Enter, and the box is empty again; `after` then read the pane with the capture from before the
+         * paste, still under the lock. "stuck": typed but not run — nothing more may be typed. null: nothing typed.
+         */
+        const typeOnce = async (command, after) => {
+            const wrote = await within(this.paneWriteLock.run(async () => {
+                if (!live())
+                    return null;
+                const readiness = await within(this.paneReadinessForDelivery(windowId));
+                if (readiness !== "ready" || !live())
+                    return null;
+                const before = await capture();
+                if (before === null || !live())
+                    return null;
+                if (this.inputTransientInPane(before) || !this.paneAuthoritativelyIdle(before))
+                    return null;
+                if (proof.readComposer(before) !== "")
+                    return null; // a draft, or a box that cannot be read
+                if (deadline - performance.now() < Daemon.AGENT_SWITCH_WRITE_RESERVE_MS)
+                    return null;
+                if (!await tmux.pasteBuffer(command, { guard: live, timeoutMs: op }))
+                    return "stuck";
+                let shown = null;
+                for (let i = 0; i < 4 && live() && shown !== command; i++) {
+                    await pause(i === 0 ? Daemon.AGENT_SWITCH_PASTE_SETTLE_MS : Daemon.AGENT_SWITCH_POLL_MS);
+                    shown = await box();
+                }
+                if (shown !== command || !live()) {
+                    await takeBack(command);
+                    return "stuck";
+                }
+                if (!await tmux.sendSpecialKey("Enter", op)) {
+                    await takeBack(command);
+                    return "stuck";
+                }
+                let left = command;
+                for (let i = 0; i < 6 && left !== ""; i++) {
+                    await pause(Daemon.AGENT_SWITCH_POLL_MS);
+                    if (!fenced())
+                        return "stuck";
+                    left = await box();
+                }
+                if (left !== "") {
+                    await takeBack(command);
+                    return "stuck";
+                }
+                return { ran: true, value: await after(before) };
+            }));
+            return wrote === TIMEOUT ? "stuck" : wrote;
+        };
+        try {
+            const sid = await typeOnce(proof.sessionIdCommand, async (before) => {
+                if (proof.readSessionIdAlert(before) !== null)
+                    return null; // already there: ours cannot be told apart
+                for (let i = 0; i < 6 && live(); i++) {
+                    const pane = await capture();
+                    if (pane === null)
+                        break;
+                    const id = proof.readSessionIdAlert(pane);
+                    if (id !== null)
+                        return id;
+                    await pause(Daemon.AGENT_SWITCH_POLL_MS);
+                }
+                return null;
+            });
+            if (!live())
+                return;
+            if (sid === "stuck") {
+                this.logger.warn("kiro /session-id did not run from an empty composer; /title is not typed after it");
+                return;
+            }
+            // Unread/mismatch are about kiro's answer after we ran /session-id.
+            // A composer that never read empty is not unread — we never asked.
+            if (sid) {
+                const verdict = proveKiroSessionId(proof.pinned, sid.value);
+                if (verdict.kind === "mismatch") {
+                    const message = t("kiro.session_id_mismatch", verdict.pinned, verdict.observed);
+                    this.logger.warn({ pinned: verdict.pinned, observed: verdict.observed }, "kiro /session-id does not match the pinned conversation");
+                    this.emit("backend_launch_warning", { name: this.name, message });
+                }
+                else if (verdict.kind === "unread") {
+                    const message = t("kiro.session_id_unread");
+                    this.logger.warn("kiro /session-id did not answer on the pane; not guessing from files");
+                    this.emit("backend_launch_warning", { name: this.name, message });
+                }
+                else if (verdict.kind === "match" || verdict.kind === "fresh") {
+                    this.logger.info({ id: verdict.id, kind: verdict.kind }, "kiro /session-id on the pane");
+                    try {
+                        recordKiroSessionProof(this.instanceDir, { sessionId: verdict.id, kind: verdict.kind });
+                    }
+                    catch (err) {
+                        this.logger.warn({ err, id: verdict.id }, "kiro /session-id was proven on the pane but could not be recorded");
+                    }
+                }
+            }
+            if (!live() || !proof.titleCommand)
+                return;
+            const titled = await typeOnce(proof.titleCommand, async () => true);
+            if (titled && titled !== "stuck")
+                this.logger.info({ title: proof.titleCommand }, "kiro /title sent for this instance");
+            else if (titled === "stuck")
+                this.logger.warn({ title: proof.titleCommand }, "kiro /title did not run from an empty composer");
+        }
+        catch (err) {
+            this.startupAdmission?.();
+            this.logger.warn({ err }, "kiro /session-id or /title after launch failed — the pin was not guessed from files");
+        }
+    }
     /**
      * Startup budget for this launch: the backend's override (resume-aware), never
      * below a user-configured startup_timeout_ms; undefined = trySpawn's default.
@@ -11665,10 +12122,13 @@ export class Daemon extends EventEmitter {
     }
     /** Kill the entire process tree of the current tmux pane (CLI + MCP server). */
     async killProcessTree(signal = "SIGTERM", reason = "unspecified") {
-        if (!this.tmux)
+        const windowId = this.tmux?.getWindowId();
+        // Before createWindow succeeds there is no pane owned by this daemon.
+        // tmux interprets an empty selector as the session's active window.
+        if (!windowId?.trim())
             return;
         try {
-            const pid = await TmuxManager.getPanePid(this.tmuxSessionName, this.tmux.getWindowId());
+            const pid = await TmuxManager.getPanePid(this.tmuxSessionName, windowId);
             if (pid) {
                 this.noteStopRequest(signal, reason);
                 process.kill(-pid, signal);
@@ -11705,6 +12165,9 @@ export class Daemon extends EventEmitter {
         if (ready)
             await this.ensureBackendAgent();
         this.startupAdmission?.();
+        if (ready)
+            await this.ensureKiroSessionProof();
+        this.startupAdmission?.();
         return ready;
     }
     /**
@@ -11837,113 +12300,40 @@ export class Daemon extends EventEmitter {
         return this.museRelayFallbackInFlight;
     }
     /**
-     * Tell the agent its instructions moved, once the CLI is idle.
-     *
-     * A named method rather than an inline closure so the wiring itself is
-     * testable: warmupNoticeAction's own tests pass even if this call site stops
-     * consulting it, which is exactly the bug this path had — the decision was
-     * made inline and never asked whether the backend needed telling at all.
-     *
-     * Never throws: a missed reload notice must not fail a spawn.
-     */
-    async runWarmupInstructionNotice() {
-        try {
-            const action = warmupNoticeAction({
-                warmupNeeded: this.warmupNeeded,
-                backend: this.backend ?? undefined,
-                pasteQueueDepth: this.pasteQueueDepth,
-            });
-            if (action === "skip") {
-                this.logger.debug(this.warmupNeeded
-                    ? "Warmup skipped — this backend reloads instructions on resume"
-                    : "Warmup skipped — instructions unchanged");
-                // When the backend learns of the change on its own, record what it now
-                // holds: leaving prev-instructions behind would keep every later
-                // restart comparing against a value the agent has long since replaced.
-                if (this.warmupNeeded) {
-                    try {
-                        writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-                    }
-                    catch { /* best effort */ }
-                }
-                return;
-            }
-            if (action === "defer") {
-                this.logger.debug("Warmup deferred — no pending inbound messages");
-                // Convert to pendingInstructionsNotice so it fires on next real message.
-                this.pendingInstructionsNotice = true;
-                try {
-                    writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-                }
-                catch { }
-                return;
-            }
-            const wid = existsSync(join(this.instanceDir, "window-id"))
-                ? readFileSync(join(this.instanceDir, "window-id"), "utf-8").trim() : "";
-            if (wid && this.controlClient) {
-                await this.controlClient.waitForIdle(wid, 120_000);
-            }
-            else {
-                await new Promise(r => setTimeout(r, 5000));
-            }
-            // This path only runs when pasteQueueDepth > 0 — i.e. exactly when a real
-            // delivery is already in flight or queued. Without the lock the notice and
-            // that delivery race into the same pane.
-            const told = await this.paneWriteLock.run(() => this.submitSystemPaste(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir, this.backend?.instructionsSource?.()), "instruction-reload-notice"));
-            if (!told) {
-                // Recording the new instructions here would mark the agent as told about
-                // a notice it never received, and every later restart would then skip
-                // the reload. Leave the snapshot behind and hand it to the deferred
-                // notice, which fires on the next real message.
-                this.logger.warn("Instruction reload notice not confirmed — deferring it to the next message");
-                this.pendingInstructionsNotice = true;
-                return;
-            }
-            // Record the value the agent has now been told about so the next
-            // unchanged restart skips the reload.
-            try {
-                writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-            }
-            catch { /* best effort */ }
-            this.logger.debug("Warmup sent after idle");
-        }
-        catch { /* non-fatal */ }
-    }
-    /**
-     * #1633 (#1639 review): the pending notice as the record stands NOW, just before the paste — it was decided at launch,
-     * and the record may have changed while the delivery waited. Unreadable → nothing is sent (and nothing pending);
-     * entries recorded meanwhile are dropped from it; none left → nothing.
+     * #1633 (#1639 review): the pending notice as things stand NOW, just before the paste — it was decided at launch, and
+     * the record, a switch or the instance's tools may have changed while the delivery waited. Planned again from the
+     * record (#2800: the running release only, tools it has now); nothing left to tell → recorded, nothing pending.
      */
     currentWhatsNew(pending) {
-        const record = readWhatsNewRecord(this.instanceDir);
-        if (record === "unreadable") {
+        const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh: false, version: pending.version,
+            roles: this.whatsNewRoles(), tools: this.whatsNewTools(), canvasWorker: readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")) });
+        if (!plan || "silent" in plan) {
             this.pendingWhatsNew = null;
+            if (plan)
+                this.recordWhatsNewSent({ ids: plan.silent, version: plan.version });
             return null;
         }
-        const known = new Set(record?.announced ?? []);
-        const ids = pending.ids.filter(id => !known.has(id));
-        if (!ids.length) {
+        this.pendingWhatsNew = plan;
+        return plan;
+    }
+    recordWhatsNewSent(told) {
+        if (this.pendingWhatsNew && told.ids.every(id => this.pendingWhatsNew.ids.includes(id)))
             this.pendingWhatsNew = null;
-            return null;
+        try {
+            recordWhatsNew(this.instanceDir, told.ids, told.version);
         }
-        // Rebuild even when ids are unchanged: an experimental switch may have changed
-        // while this delivery waited. Never paste the old enabled capability text.
-        // #2163: rebuilt as planned — only the entries this instance's roles are told; the rest are recorded with them.
-        const roles = this.whatsNewRoles();
-        const shown = agentWhatsNew(readCanvasWorkerEnabled(join(this.instanceDir, "..", ".."))).filter(e => ids.includes(e.id) && (!e.audience || e.audience.some(r => roles.includes(r))));
-        if (!shown.length) {
-            this.pendingWhatsNew = null;
-            try {
-                recordWhatsNew(this.instanceDir, ids, pending.version);
-            }
-            catch (err) {
-                this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
-            }
-            return null;
+        catch (err) {
+            this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
         }
-        const narrowed = { notice: whatsNewNotice(pending.version, shown), ids, version: pending.version };
-        this.pendingWhatsNew = narrowed;
-        return narrowed;
+    }
+    /**
+     * #2800: the tools this instance's agend MCP server lists now — the same filters (tool set, dashboard switches, the
+     * Canvas Worker switch) — so a notice names only changes to tools it has.
+     */
+    whatsNewTools() {
+        const allowed = toolsFor(resolveToolSet(this.config, this.name));
+        const listed = withoutFeatures(TOOLS.filter(t => allowed.has(t.name)), dashboardFeaturesOff(dashboardAccessOf(this.config)));
+        return new Set(toolsWithCanvasWorker(readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")), listed).map(t => t.name));
     }
     /**
      * #2163: who this instance is to the what's-new notices — a ClassicBot room's agent, General, or a fleet worker (with
@@ -11960,7 +12350,8 @@ export class Daemon extends EventEmitter {
     /** #1633: what this instance has not been told about its AgEnD version yet (see agent-whats-new.ts). */
     prepareWhatsNew(fresh, version = agendVersion()) {
         try {
-            const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh, version, roles: this.whatsNewRoles(), canvasWorker: readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")) });
+            const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh, version, roles: this.whatsNewRoles(),
+                tools: this.whatsNewTools(), canvasWorker: readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")) });
             if (!plan) {
                 this.pendingWhatsNew = null;
                 return;
@@ -11971,8 +12362,7 @@ export class Daemon extends EventEmitter {
                 return;
             }
             this.pendingWhatsNew = plan;
-            this.whatsNewUnwritten = 0;
-            this.logger.info({ entries: plan.ids }, "what's-new notice pending for the next delivery");
+            this.logger.debug({ entries: plan.ids }, "what's-new notice pending for the next delivery");
         }
         catch (err) {
             this.logger.debug({ err }, "what's-new not prepared");
@@ -11983,41 +12373,15 @@ export class Daemon extends EventEmitter {
         this.startupAdmission?.();
         const launchFence = this.launchFenceEpoch;
         const backendConfig = this.buildBackendConfig();
-        // Compare freshly-built instructions against the last value the agent was
-        // told about. Computed for ALL backends (not gated by
-        // instructionsReloadedOnResume) so the warmup steering-reload can be
-        // skipped when nothing changed.
-        this.lastBuiltInstructions = backendConfig.instructions ?? "";
         // #1633: decided before prev-instructions is first written — its absence is what says "never launched before".
         this.prepareWhatsNew(!existsSync(join(this.instanceDir, "prev-instructions")));
-        {
-            const prevFile = join(this.instanceDir, "prev-instructions");
-            let prev = "";
+        // Record what this launch writes. #2787: a change is never announced in the pane; the CLI takes the new
+        // instructions whenever it next reads its own file.
+        if (backendConfig.instructions) {
             try {
-                prev = readFileSync(prevFile, "utf-8");
-            }
-            catch { }
-            if (!prev && backendConfig.instructions) {
-                // First time (no prev-instructions file): write current hash, skip warmup.
-                try {
-                    writeFileSync(prevFile, backendConfig.instructions);
-                }
-                catch { }
-                this.warmupNeeded = false;
-            }
-            else {
-                this.warmupNeeded = !!backendConfig.instructions && prev !== backendConfig.instructions;
-            }
-            // For backends that don't re-read instructions on resume (kiro/codex),
-            // also notify the agent on next message instead of forcing a new
-            // session. Resume is preserved so context isn't lost.
-            if (!backendConfig.skipResume && backendNeedsPaneReloadNotice(this.backend) && this.warmupNeeded) {
-                if (prev) {
-                    this.logger.info("Instructions changed — will notify agent on next message");
-                    this.pendingInstructionsNotice = true;
-                }
-                this.pendingInstructionsUpdate = backendConfig.instructions;
+                writeFileSync(join(this.instanceDir, "prev-instructions"), backendConfig.instructions);
             }
+            catch { /* best effort */ }
         }
         // A backend that has to ask its CLI something before the launch command exists (OpenCode: does
         // this binary take --auto?) does it here, off the event loop, bounded, and never fails the launch.