@songsid/agend 2.3.2 → 2.3.3-beta.2

package/dist/daemon.js

@@ -1,7 +1,7 @@
 import { readActiveKiroModel } from "./backend/kiro.js";
 import { dashboardAccessOf } from "./dashboard-permissions.js";
 import { sendPackSources } from "./web-office-pack-read.js";
-import { agentWhatsNew, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
+import { agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, withWhatsNew } from "./agent-whats-new.js";
 import { join, dirname, resolve } from "node:path";
 import { checkoutTarget, readCheckouts, releaseCandidate, reposRoot, verifyWorktree, writeCheckouts } from "./repo-worktree-guard.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
@@ -24,8 +24,9 @@ import { TranscriptMonitor } from "./transcript-monitor.js";
 import { createTranscriptSource } from "./transcript-sources.js";
 import { TranscriptTurnLedger } from "./transcript-turns.js";
 import { credentialProfileStoreHome, resolveCredentialProfile } from "./backend/credential-profile.js";
-import { resolveToolSet } from "./tool-permissions.js";
-import { dashboardAccessProblem, dashboardFeaturesOff } from "./dashboard-permissions.js";
+import { resolveToolSet, toolsFor } from "./tool-permissions.js";
+import { TOOLS, toolsWithCanvasWorker } from "./channel/mcp-tools.js";
+import { dashboardAccessProblem, dashboardFeaturesOff, withoutFeatures } from "./dashboard-permissions.js";
 import { getAgendHome } from "./paths.js";
 import { readCanvasWorkerEnabled, scopedFleetConfigEnvironment } from "./web-experimental.js";
 import { readAgentEffect, sendEffectInParts } from "./web-effect-upload.js";
@@ -67,8 +68,6 @@ import { claudeConfigDirFor, claudeProfileConfigDir, claudeSwitchDialog, claudeS
 import { MuseBackend } from "./backend/muse.js";
 import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
 import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
-/** #2140: deliveries that may carry an unwritten what's-new notice before it is recorded anyway. */
-const WHATS_NEW_MAX_UNWRITTEN = 3;
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 // Tool routing sets — module-level to avoid re-creation on every handleToolCall
@@ -113,7 +112,6 @@ const TURN_OUTBOUND_TOOLS = new Set([
 // These actions reach the human-facing channel and satisfy reply-completion:
 // a deliberate reaction or edit is a valid response even without new text.
 const TURN_COMPLETION_TOOLS = new Set(["reply", "react", "edit_message"]);
-const REPLY_DROP_WARNING_COOLDOWN_MS = 5 * 60_000;
 /**
  * #1241: how long an idle edge must persist — with no reply and no further
  * observed work — before the reply guard declares the turn a miss. A claude
@@ -136,50 +134,12 @@ const TRANSCRIPT_RUNNING_HOLD_MAX_MS = 30 * 60_000;
  */
 export const TRANSCRIPT_OPEN_TURN_QUIET_MS = 15 * 60_000;
 const REPLY_RECOVERY_PROMPT = "[system:reply-required] The previous human-facing turn ended without a successfully delivered reply. Do not redo the work. React with an emoji or use the reply tool exactly once now to send the user a concise conclusion. If no substantive answer is needed, a brief react is sufficient. If you already replied to this message, do nothing. Do not reply to this system instruction except through the react or reply tool.";
-/** Point a resumed CLI at its one backend-native instruction source. */
 /** The outbox evidence for a delivery the CLI's transcript shows taken (#758; #1201 absorbed; #1647 a raw paste's text). */
 function transcriptMarkerEvidence(kind, rawPaste = false) {
     if (rawPaste)
         return "transcript-turn-user-entry-raw-paste-text";
     return kind === "user" ? "transcript-marker" : kind === "absorbed" ? "transcript-marker-absorbed" : "transcript-marker-queued";
 }
-export function buildInstructionReloadNotice(binaryName, instanceName, instanceDir, backendSource) {
-    const source = backendSource ? backendSource : binaryName === "codex" || binaryName === "grok" || binaryName === "muse"
-        ? "AGENTS.md"
-        : binaryName === "kiro-cli"
-            ? `.kiro/steering/agend-${instanceName}.md`
-            : binaryName === "agy"
-                ? ".agents/AGENTS.md"
-                : join(instanceDir, "fleet-instructions.md");
-    return `[system] Your AgEnD instructions have been updated. Reload only ${source}; do not scan other instruction directories. Do not reply to this message.`;
-}
-/**
- * Whether this backend has to be told in its pane that its instructions moved.
- *
- * A backend that re-reads them on resume already received the new ones from the
- * resume itself, so the notice is pure interruption. Both places that can send
- * it — the warmup paste and the deferred pendingInstructionsNotice — ask through
- * here, so the two cannot drift apart again: the warmup path used to omit this
- * check entirely and told claude-code to reload instructions it had just read.
- */
-export function backendNeedsPaneReloadNotice(backend) {
-    return !backend?.instructionsReloadedOnResume;
-}
-/**
- * What the warmup should do about changed instructions.
- *
- * `skip` — nothing to say, or this backend learns of the change by itself.
- * `defer` — worth saying, but nobody is talking to the instance; say it when a
- *   real message next arrives rather than provoking an unsolicited reply.
- * `paste` — say it now, into a pane that already has a delivery in flight.
- */
-export function warmupNoticeAction(opts) {
-    if (!opts.warmupNeeded)
-        return "skip";
-    if (!backendNeedsPaneReloadNotice(opts.backend))
-        return "skip";
-    return opts.pasteQueueDepth === 0 ? "defer" : "paste";
-}
 export const DEFAULT_STUCK_TIMEOUT_MS = 10 * 60_000;
 export const DEFAULT_STATE_IDLE_DEBOUNCE_MS = 2_000;
 export const DEFAULT_STATE_SAFETY_SWEEP_MS = 60_000;
@@ -189,6 +149,14 @@ export const PERIODIC_REDRAW_PROBE_MS = 25;
 const KIRO_COMPACT_PANE_POLL_MS = 1_000;
 /** Do not turn a streaming Codex turn into one capture-pane per burst. */
 export const STRUCTURED_IDLE_PROBE_MS = 500;
+/** #2770 (ii): how often output may schedule a look for a layout that repaints while idle (CliBackend.periodicRedrawFrom). */
+export const PERIODIC_LAYOUT_LOOK_MS = 5_000;
+/** #2770: how often a delivery waiting for idle asks again whether it can be handed off instead. */
+export const HANDOFF_RECHECK_MS = 1_000;
+/** #2770: how often a wait for idle asks its stop condition (a cancel, a hand-off that became possible). */
+export const WAIT_STOP_POLL_MS = 250;
+/** #2770: human messages a cancel dropped are told in one notice, this long after the last of them. */
+export const CANCELLED_HUMANS_NOTICE_MS = 1_000;
 /**
  * An instance publishing more than this many execution-state edges inside the
  * window is flapping; its edges stop being logged one by one (#1116). One
@@ -1295,6 +1263,8 @@ export class Daemon extends EventEmitter {
     bootSkippedResume = false;
     recoveryCrashLoopFresh = false;
     recoveryFreshChoice = false;
+    /** The current boot found a crash-loop marker and is attempting resume rather than going fresh immediately. */
+    bootCrashLoopResume = false;
     startupAborted = false;
     /** First time the current on-screen blocking dialog was seen (0 = none); drives the parked report. */
     dialogParkedSince = 0;
@@ -1398,6 +1368,10 @@ export class Daemon extends EventEmitter {
     /** Consecutive structural idle captures for a noisy, periodically-redrawing
      * pane.  Two are required before a working -> idle transition. */
     instanceStatePeriodicIdleConfirmations = 0;
+    /** #2770 (ii): the latest capture showed a layout that repaints while idle (CliBackend.periodicRedrawFrom). */
+    periodicRedrawLayout = false;
+    /** When output last scheduled a look for that layout (monotonic ms), so a busy pane is not captured on every chunk. */
+    periodicLayoutLookAt = -Infinity;
     /** Recent execution-state edge times, for the flap log limiter (#1116). */
     stateEdgeTimes = [];
     stateEdgesNotLogged = 0;
@@ -1439,7 +1413,6 @@ export class Daemon extends EventEmitter {
     /** Prevent a visible stale XML fragment from being recovered on later turns. */
     lastMalformedToolCallSignature;
     proxyReplySeq = 0;
-    lastReplyDropWarningAt = 0;
     /**
      * #1241: an idle edge that has not yet proven the turn ended. Armed instead
      * of recovering immediately; a steady idle snapshot past confirmAt promotes
@@ -1525,6 +1498,8 @@ export class Daemon extends EventEmitter {
     authFailureUnresolved = false;
     /** One login-screen auth report per spawn — the screen persists across polls. */
     loginScreenReported = false;
+    /** #2795: the auth pattern match the token-free check is still to judge; it arms nothing until confirmAuthFailure(). */
+    unverifiedAuthMatch = null;
     /**
      * While the lifecycle is still starting this daemon, `pty_error` has no
      * listener and `InstanceLifecycle.daemons` has no entry — so an incident the
@@ -1583,19 +1558,12 @@ export class Daemon extends EventEmitter {
     deliveryWritesStopping = false;
     /** #829: the latest pastes, by spawn generation (see ownedInputDraft). */
     recentPastes = [];
-    pendingInstructionsUpdate;
-    pendingInstructionsNotice = false;
     /** #1633: the one-time "what's new for you" notice, pasted before the next real delivery; recorded once pasted. */
     pendingWhatsNew = null;
-    /** #2140: deliveries tried for the pending what's-new notice that never reached the pane (capped: never before every message). */
-    whatsNewUnwritten = 0;
-    // Whether the warmup steering-reload notice should be injected after spawn.
-    // Set in trySpawn by comparing the freshly-built instructions against the
-    // last value the agent was told about (prev-instructions). Skipped when
-    // unchanged so agents don't waste 10-30s re-reading identical steering.
-    warmupNeeded = false;
-    lastBuiltInstructions = "";
     pasteQueueDepth = 0;
+    /** #2770: a person's messages a cancel dropped before they reached the CLI, told together (noteCancelledHuman). */
+    cancelledHumans = [];
+    cancelledHumansTimer = null;
     firstDeliveryDelay = new FirstDeliveryDelay();
     /** Orders /steer pastes against each other. Deliberately NOT pasteLock:
      *  a steer must not queue behind the normal deliveries it exists to
@@ -1799,6 +1767,59 @@ export class Daemon extends EventEmitter {
     // old transcript, so pre-ready scans must not lower this seeded baseline.
     seededErrorCountBaselines = new Map();
     lastDetectedErrorType = null;
+    /**
+     * #2822: Claude's per-model usage limit (`You've reached your <model> limit.`), known only from Claude's own record of
+     * the failed call in its transcript (`isApiErrorMessage`, a 429) — never from pane text, which an agent can print. It
+     * names no reset time. While it holds it is told once, and the reply guard stays quiet while the transcript's newest
+     * event is that error; any later assistant output (of any turn, from a person or not) ends it. The order is Claude's
+     * own: a 429 is recorded within a second, often before AgEnD has armed the turn, so no AgEnD-side clock is used.
+     */
+    usageLimitHold = null;
+    /** Transcript events in Claude's order (prompts, output, every API error): the newest, and the latest limit error. */
+    transcriptEventSeq = 0;
+    usageLimitErrorSeq = 0;
+    static MODEL_USAGE_LIMIT = /^You['’]ve reached your ([A-Za-z0-9][A-Za-z0-9 .-]{0,40}?) limit\./;
+    /** #2822: the usage-limit hold, while it lasts — Needs you lists it. */
+    usageHold() {
+        return this.usageLimitHold ? { ...this.usageLimitHold } : null;
+    }
+    /** #2822: Claude recorded a failed API call. */
+    noteClaudeApiError(text, status) {
+        const seq = ++this.transcriptEventSeq;
+        const match = status === 429 ? Daemon.MODEL_USAGE_LIMIT.exec(text.trim()) : null;
+        if (!match)
+            return;
+        this.usageLimitErrorSeq = seq;
+        if (this.usageLimitHold)
+            return; // told already: one notice per hold
+        const model = match[1].trim();
+        this.usageLimitHold = { model, since: Date.now() };
+        const message = t("inst.model_usage_limit", model);
+        this.logger.warn({ model }, "Usage-limit hold started (reset time unknown)");
+        this.emit("usage_hold", { name: this.name, held: true });
+        this.emit("pty_error", { name: this.name, type: "quota", action: "notify", message, skipCooldown: true, skipRecoveryWait: true });
+    }
+    /** #2822: Claude produced output (text or a tool call): the model answers again, so a hold ends. */
+    noteClaudeOutput() {
+        ++this.transcriptEventSeq;
+        if (!this.usageLimitHold)
+            return;
+        this.logger.info({ model: this.usageLimitHold.model }, "Usage-limit hold cleared — Claude answered again");
+        this.usageLimitHold = null;
+        this.emit("usage_hold", { name: this.name, held: false });
+    }
+    /** #2822: a prompt reached Claude (recorded in its transcript). */
+    noteClaudePrompt() {
+        ++this.transcriptEventSeq;
+    }
+    /**
+     * #2822: the turn ended on the limit error — the transcript's newest event of any kind. A prompt after it (a new
+     * message the error is older than), output after it (the model answered) or another API error after it (a 500, a
+     * different 429) means the limit error is not this turn's end.
+     */
+    personTurnEndedOnUsageLimit() {
+        return this.usageLimitErrorSeq > 0 && this.usageLimitErrorSeq === this.transcriptEventSeq;
+    }
     static errorPatternKey(ep) {
         return `${ep.type}:${ep.pattern.source}`;
     }
@@ -1838,21 +1859,14 @@ export class Daemon extends EventEmitter {
         return super.emit(event, ...args);
     }
     /**
-     * Undo the auth suspicion a pattern match armed, once the backend's token-free
-     * probe has said the credentials are fine.
-     *
-     * emitErrorPattern arms these BEFORE the pty_error reaches the lifecycle, and
-     * the lifecycle's "valid" verdict used to just drop the incident — leaving the
-     * daemon permanently suspicious of an auth failure that never existed. That
-     * state is not inert: authFailureUnresolved suppresses the stuck/hang
-     * notification and holds MCP auto-restart (a later real MCP death is then read
-     * as already-confirmed auth trouble rather than re-verified), and the recovery
-     * gate suppresses further error detection until a ready pattern shows up.
-     *
-     * Only what an auth match armed is rolled back. If some other pattern has
-     * since armed the recovery gate, that one is still live and stays.
+     * Undo an auth suspicion once the backend's token-free probe has said the credentials are fine. Since #2795 a pane
+     * pattern match arms nothing before that probe (its pending match is just dropped); what is left to undo is a
+     * login-screen report, which arms authFailureUnresolved itself. That state is not inert: it suppresses the
+     * stuck/hang notification and holds MCP auto-restart. If some other pattern has armed the recovery gate, that one
+     * is still live and stays.
      */
     clearSuspectedAuthFailure() {
+        this.unverifiedAuthMatch = null;
         if (!this.authFailureUnresolved && !this.loginScreenReported)
             return false;
         this.authFailureUnresolved = false;
@@ -1864,6 +1878,29 @@ export class Daemon extends EventEmitter {
         this.logger.info("Auth suspicion withdrawn — the token-free probe reports valid credentials");
         return true;
     }
+    armErrorRecoveryGate(key, type, now) {
+        this.errorWaitingForRecovery = true;
+        this.errorDetectedAt = now;
+        this.errorRecoveryDeadlineAt = now + Daemon.ERROR_RECOVERY_TIMEOUT_MS;
+        this.activeErrorPatternKey = key;
+        this.lastDetectedErrorType = type;
+    }
+    /**
+     * #2795: the token-free check did not vouch for the credentials behind an auth pattern match. Only now does the
+     * match become an auth failure: the state the detector used to arm at match time. Remembered for as long as it is
+     * unresolved — an auth-broken CLI cannot finish the turn it is holding, so every other detector would otherwise
+     * keep reporting the same dead instance. A login-screen report arms its own state and has no match to confirm.
+     */
+    confirmAuthFailure() {
+        const match = this.unverifiedAuthMatch;
+        if (!match)
+            return false;
+        this.unverifiedAuthMatch = null;
+        if (match.gate)
+            this.armErrorRecoveryGate(match.key, "auth_error", match.at);
+        this.authFailureUnresolved = true;
+        return true;
+    }
     clearErrorRecoveryGate() {
         this.errorWaitingForRecovery = false;
         this.errorDetectedAt = 0;
@@ -2283,19 +2320,40 @@ export class Daemon extends EventEmitter {
         this.bootSkippedResume = false;
         this.recoveryCrashLoopFresh = false;
         this.recoveryFreshChoice = false;
+        this.bootCrashLoopResume = false;
         try {
             if (existsSync(crashStatePath)) {
                 const content = readFileSync(crashStatePath, "utf-8");
                 try {
                     const state = JSON.parse(content);
-                    if (state?.resumeDisabled === true) {
+                    if (state?.resumeFailed === true) {
+                        // The previous start tried resume after a crash loop but the resumed
+                        // session died before reaching ready. Go fresh this time.
                         this.skipResume = true;
                         this.bootSkippedResume = true;
-                        this.recoveryCrashLoopFresh = (state.reason === undefined || state.reason === "crash_loop")
+                        this.recoveryCrashLoopFresh = true;
+                        this.recoveryFreshChoice = false;
+                        this.logger.warn("Previously resumed session died quickly after a crash loop — starting fresh");
+                    }
+                    else if (state?.resumeDisabled === true) {
+                        // Crash loop detected, but the session is not proven broken.
+                        // Try resume first; if it dies before reaching ready, the next
+                        // boot will see resumeFailed and go fresh (PR #2809).
+                        const isCrashLoop = (state.reason === undefined || state.reason === "crash_loop")
                             && Number.isInteger(state.crashesInWindow) && state.crashesInWindow >= 3
                             && Number.isFinite(state.lastCrashAt) && state.lastCrashAt > 0;
-                        this.recoveryFreshChoice = !this.recoveryCrashLoopFresh;
-                        this.logger.warn("Previous crash loop detected — starting without resume");
+                        if (isCrashLoop) {
+                            this.bootCrashLoopResume = true;
+                            this.logger.warn("Previous crash loop detected — attempting resume (will fall back to fresh if session is broken)");
+                        }
+                        else {
+                            // Explicit fresh-start request (not a crash loop); honour it.
+                            this.skipResume = true;
+                            this.bootSkippedResume = true;
+                            this.recoveryCrashLoopFresh = false;
+                            this.recoveryFreshChoice = true;
+                            this.logger.warn("Previous crash loop detected — starting without resume");
+                        }
                     }
                 }
                 finally {
@@ -2441,16 +2499,11 @@ export class Daemon extends EventEmitter {
             catch { /* may not exist */ }
         }
         // #1209: conditional continuation for the turn interrupted by the last
-        // restart, if the gates allow. Detached like the warmup notice; the gate
+        // restart, if the gates allow. Detached; the gate
         // consumes its one-shot marker first and never throws into boot.
         const legacyResume = this.maybeResumeInterruptedTurn().catch(() => "unknown");
-        // Warmup: wait for CLI idle, then trigger steering reload — but only when
-        // the instructions actually changed since the agent last saw them.
-        // Skipping the no-op reload saves 10-30s of agent time on every restart
-        // where instructions are unchanged.
-        const warmup = this.runWarmupInstructionNotice();
         const recoveryOwner = JSON.stringify(this.interactionOwner());
-        void Promise.allSettled([legacyResume, warmup]).then(() => {
+        void Promise.allSettled([legacyResume]).then(() => {
             if (JSON.stringify(this.interactionOwner()) === recoveryOwner) {
                 this.recoveryBootWorkPending = false;
                 this.recoveryBootSettled = true;
@@ -2488,6 +2541,7 @@ export class Daemon extends EventEmitter {
                     .catch(e => this.logger.debug({ err: e.message }, "Ack react failed"));
             };
             this.transcriptMonitor.on("tool_use", (name, input) => {
+                this.noteClaudeOutput();
                 this.logger.debug({ tool: name }, "Tool use");
                 ackIfPending();
                 this.recordRecentEvent({ type: "tool_use", name, preview: this.summarizeTool(name, input) });
@@ -2501,7 +2555,10 @@ export class Daemon extends EventEmitter {
                 // show only elapsed time than to leave a stale "Bash: npm test" on screen.
                 this.publishActivity(null);
             });
+            this.transcriptMonitor.on("api_error", (text, status) => this.noteClaudeApiError(text, status));
+            this.transcriptMonitor.on("user_prompt", () => this.noteClaudePrompt());
             this.transcriptMonitor.on("assistant_text", (text) => {
+                this.noteClaudeOutput();
                 this.logger.debug({ text: text.slice(0, 200) }, "Claude response");
                 ackIfPending();
                 this.recordRecentEvent({ type: "assistant_text", preview: text.slice(0, 100) });
@@ -3848,6 +3905,14 @@ export class Daemon extends EventEmitter {
                 rebasedSeededBaselines.add(key);
             }
         }
+        // #2795: an auth match the token-free check has not judged yet holds the other detectors, as the armed gate did
+        // before: a real auth failure's text also matches generic patterns (kiro's "having trouble responding"). It is not
+        // an error state — nobody is warned — and it is bounded like the gate.
+        if (this.unverifiedAuthMatch?.gate) {
+            if (now - this.unverifiedAuthMatch.at < Daemon.ERROR_RECOVERY_TIMEOUT_MS)
+                return;
+            this.unverifiedAuthMatch = null;
+        }
         // State: waiting for recovery. A missing/outdated ready pattern must not
         // suppress every future error forever, so the gate has a hard deadline.
         if (this.errorWaitingForRecovery) {
@@ -3993,25 +4058,20 @@ export class Daemon extends EventEmitter {
     }
     /** Arm the recovery gates and emit one detected error pattern. */
     emitErrorPattern(ep, key, pane, now) {
+        // #2795: auth text on the pane proves nothing about the credentials (22 of 22 such matches on the main host were
+        // conversation text). It arms nothing here; it only asks the lifecycle's token-free check, and a failing check
+        // arms the auth state through confirmAuthFailure().
+        if (ep.type === "auth_error")
+            this.unverifiedAuthMatch = { key, at: now, gate: !ep.skipRecoveryWait };
         // skipRecoveryWait: this error self-recovers (e.g. a timeout — Kiro is
         // back at its prompt immediately). Keep monitoring so the next occurrence
         // can fire without waiting for a possibly startup-only ready pattern.
-        if (!ep.skipRecoveryWait) {
-            this.errorWaitingForRecovery = true;
-            this.errorDetectedAt = now;
-            this.errorRecoveryDeadlineAt = now + Daemon.ERROR_RECOVERY_TIMEOUT_MS;
-            this.activeErrorPatternKey = key;
-            this.lastDetectedErrorType = ep.type;
-        }
+        else if (!ep.skipRecoveryWait)
+            this.armErrorRecoveryGate(key, ep.type, now);
         this.lastErrorNotifiedAt.set(key, now);
         if (ep.action === "failover")
             this.lastFailoverAt = now;
         const message = this.resolveErrorMessage(pane, ep);
-        // Remember an auth failure for as long as it is unresolved. An auth-broken
-        // CLI cannot finish the turn it is holding, so every other detector in this
-        // scan would otherwise keep reporting the same dead instance forever.
-        if (ep.type === "auth_error")
-            this.authFailureUnresolved = true;
         this.logger.warn({ errorType: ep.type, action: ep.action }, `PTY error detected: ${message}`);
         this.lastErrorEpisode = { key, pattern: ep.pattern, pane, spawn: this.spawnGeneration, fence: this.launchFenceEpoch };
         this.emit("pty_error", { name: this.name, ...ep, message });
@@ -5186,6 +5246,7 @@ export class Daemon extends EventEmitter {
         this.pausePending = false;
         this.pauseReconfirmAuth = false;
         this.authFailureUnresolved = false;
+        this.unverifiedAuthMatch = null;
         this.loginScreenReported = false;
         this.fatalStartupReported = false;
         this.fatalStartupBlocked = false;
@@ -5681,6 +5742,15 @@ export class Daemon extends EventEmitter {
             this.turnReplyGuard.complete(turn.generation);
             return;
         }
+        // #2822: a turn whose newest transcript event is Claude's usage-limit error could not have replied — no recovery
+        // turn, no drop report: the limit is told once (the notice and Needs you). Only that record counts: pane text and
+        // an error from before this turn began do not.
+        if (this.personTurnEndedOnUsageLimit()) {
+            this.logger.info({ correlationId: turn.target.correlationId }, "Turn ended on Claude's usage-limit error — no reply recovery");
+            this.clearReplyGuardConfirm();
+            this.turnReplyGuard.complete(turn.generation);
+            return;
+        }
         // A second idle edge ends the one permitted recovery turn. Never create a
         // third turn or guess at terminal text; make the failure visible instead.
         if (turn.phase === "recovering") {
@@ -6030,20 +6100,7 @@ export class Daemon extends EventEmitter {
             reason,
             message: formatReplyDropDetection(turn, reason),
         });
-        this.deliverReplyDropNotice("inst.reply_drop_unrecovered", "replydropwarn", "Reply-drop recovery warning", turn, reason, true);
-    }
-    /** Channel notice for a reply-drop. `rateLimit` shares the per-instance cooldown (#2544). */
-    deliverReplyDropNotice(key, kind, title, turn, reason, rateLimit) {
-        if (rateLimit) {
-            const now = Date.now();
-            if (this.lastReplyDropWarningAt !== 0
-                && now - this.lastReplyDropWarningAt < REPLY_DROP_WARNING_COOLDOWN_MS) {
-                this.logger.debug({ reason, kind }, "Reply-drop channel notice rate-limited");
-                return;
-            }
-            this.lastReplyDropWarningAt = now;
-        }
-        void this.deliverDaemonReply(t(key), kind, title, turn.target, true);
+        // #2802: the event stays (Log tab); the person is no longer told in the topic or the web chat.
     }
     /** Relay the pane's final text to the channel, marked as a daemon proxy reply. */
     async sendProxyReply(pane, target) {
@@ -6076,7 +6133,7 @@ export class Daemon extends EventEmitter {
         }
     }
     /** Context-bound reply path shared by dead-MCP and malformed-call recovery. */
-    deliverDaemonReply(body, requestPrefix, logLabel, target, statusOnly = false) {
+    deliverDaemonReply(body, requestPrefix, logLabel, target) {
         const args = { text: body };
         const chatId = target?.chatId ?? this.lastChatId;
         const threadId = target?.threadId ?? this.lastThreadId;
@@ -6153,7 +6210,6 @@ export class Daemon extends EventEmitter {
                     args,
                     fleetRequestId: fleetReqId,
                     adapterId,
-                    statusOnly,
                 });
             }
             catch {
@@ -6329,7 +6385,9 @@ export class Daemon extends EventEmitter {
             // changed when tmux reported output (observedChangeAt), but idle/stuck are
             // decisions about *now*. The old double-observe expressed that by calling
             // observe twice, which silently disabled the "content moved" branch.
-            const structuredPeriodicIdle = this.backend?.isPeriodicRedrawIdlePane;
+            if (this.backend?.periodicRedrawFrom)
+                this.periodicRedrawLayout = this.backend.periodicRedrawFrom(pane);
+            const structuredPeriodicIdle = this.periodicIdleProof();
             // #1641: the transcript outranks the pane: while it shows the turn running, no reading of this pane is idle (codex
             // hides its status row while streaming, leaving the idle composer and footer in view mid-turn).
             const transcriptTurn = this.transcriptTurnState();
@@ -6521,7 +6579,7 @@ export class Daemon extends EventEmitter {
             return;
         this.instanceStateLastOutputAt = event.at;
         this.interactionOutputRevision++;
-        const canProvePeriodicIdle = !!this.backend?.isPeriodicRedrawIdlePane;
+        const canProvePeriodicIdle = !!this.periodicIdleProof();
         if (canProvePeriodicIdle || (this.backend?.hasPeriodicPaneRedraw?.() === true && this.instanceState === "idle")) {
             // Do not emit idle→working solely because agy repainted an identical
             // footer. Codex additionally uses a structural probe while working: two
@@ -6539,6 +6597,25 @@ export class Daemon extends EventEmitter {
         this.applyInstanceStateSnapshot(snapshot);
         this.scheduleInstanceStateIdleCapture();
         this.scheduleInstanceStateStuckDeadline(event.at);
+        // #2770 (ii): a layout that repaints while idle (Claude's background-agent list) never leaves the quiet window the
+        // idle capture waits for, so nothing would look at the pane again before the 60 s sweep. Look now and then.
+        if (this.backend?.periodicRedrawFrom && performance.now() - this.periodicLayoutLookAt >= PERIODIC_LAYOUT_LOOK_MS) {
+            this.periodicLayoutLookAt = performance.now();
+            this.scheduleInstanceStateOutputProbe(STRUCTURED_IDLE_PROBE_MS);
+        }
+    }
+    /**
+     * The backend's structural idle proof for periodically repainting panes, when it applies to the current layout: always
+     * for a backend that repaints in every layout (Codex, Muse), only while the latest capture showed such a layout for one
+     * that names it (CliBackend.periodicRedrawFrom — Claude's background-agent list, #2770 (ii)).
+     */
+    periodicIdleProof() {
+        const proof = this.backend?.isPeriodicRedrawIdlePane;
+        if (!proof)
+            return undefined;
+        if (this.backend?.periodicRedrawFrom && !this.periodicRedrawLayout)
+            return undefined;
+        return proof;
     }
     bindInstanceStateOutputListener(windowId) {
         if (!this.controlClient || !this.instanceStateMonitorActive)
@@ -6555,6 +6632,7 @@ export class Daemon extends EventEmitter {
     startInstanceStateMonitor() {
         if (this.runtimeMonitorsFrozen || !this.tmux || !this.backend || this.instanceStateMonitorActive)
             return;
+        this.periodicRedrawLayout = false; // a new launch's layout is not the old one's
         const rawConfig = this.config.hang_detector;
         const timeoutMinutes = rawConfig?.timeout_minutes;
         this.instanceStateStuckTimeoutMs = typeof timeoutMinutes === "number" && timeoutMinutes > 0
@@ -6971,6 +7049,26 @@ export class Daemon extends EventEmitter {
         return { receiptId: id, verificationId: meta.verification_id, expectedWireHash: meta.human_wire_sha256,
             ownerKey: meta.human_owner_key, current: () => this.captureHumanReceiptOwner() === daemonOwner };
     }
+    /**
+     * #2770: a person's message a cancel dropped before it reached the CLI is told, not left as a silent "uncertain":
+     * the messages dropped together go out as one `human_messages_cancelled` (the fleet marks each ❌ and says so once).
+     * Agents' messages are not a person's, and a durable row (delivery_id) is retried by the outbox: neither is ❌'d. A
+     * message with no chat to mark has nowhere to say it.
+     */
+    noteCancelledHuman(meta) {
+        if (meta.from_instance || meta.delivery_id || !meta.chat_id || !meta.message_id)
+            return;
+        this.cancelledHumans.push({ chatId: meta.chat_id, messageId: meta.message_id, ...(meta.thread_id ? { threadId: meta.thread_id } : {}) });
+        if (this.cancelledHumansTimer)
+            clearTimeout(this.cancelledHumansTimer);
+        this.cancelledHumansTimer = setTimeout(() => {
+            this.cancelledHumansTimer = null;
+            const messages = this.cancelledHumans.splice(0);
+            if (messages.length)
+                this.emit("human_messages_cancelled", { messages });
+        }, CANCELLED_HUMANS_NOTICE_MS);
+        this.cancelledHumansTimer.unref?.();
+    }
     finishHumanReceipt(meta, verdict) {
         if (!meta.human_receipt_id || !meta.human_owner_key)
             return;
@@ -7045,6 +7143,7 @@ export class Daemon extends EventEmitter {
     steerMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
         if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
             this.deferDurableDelivery(meta, "delivery epoch changed before steer began");
+            this.noteCancelledHuman(meta);
             return;
         }
         // The fleet facade prevents a steer from overtaking an item still in its
@@ -7068,14 +7167,17 @@ export class Daemon extends EventEmitter {
         this.steerLock = this.steerLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.deferDurableDelivery(meta, "delivery epoch changed before steer began");
+                this.noteCancelledHuman(meta);
                 return;
             }
             await this.wake();
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.deferDurableDelivery(meta, "delivery epoch changed while waking for steer");
+                this.noteCancelledHuman(meta);
                 return;
             }
             const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+            let delivered = false;
             try {
                 if (await this.deliverMessage(formatted, status, {
                     steer: true,
@@ -7085,6 +7187,7 @@ export class Daemon extends EventEmitter {
                     verdict,
                     durableAttempt: durableAttempt || undefined,
                 })) {
+                    delivered = true;
                     this.finishDurableSubmission(durableAttempt, verdict);
                     this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
@@ -7114,6 +7217,8 @@ export class Daemon extends EventEmitter {
             }
             finally {
                 this.finishHumanReceipt(meta, verdict);
+                if (!delivered && !verdict.paneWriteStarted && !this.isDeliveryEpochCurrent(deliveryEpoch))
+                    this.noteCancelledHuman(meta);
             }
         }).catch(err => {
             this.deferDurableDelivery(meta, `target wake/steer failed before pane submission: ${err.message}`);
@@ -7132,6 +7237,7 @@ export class Daemon extends EventEmitter {
     btwMessage(content, meta, deliveryEpoch = this.deliveryEpoch) {
         if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
             this.finishHumanReceipt(meta, { reached: false });
+            this.noteCancelledHuman(meta);
             return;
         }
         this.updateLastChat(meta.chat_id, meta.thread_id, meta.adapter_id);
@@ -7142,22 +7248,28 @@ export class Daemon extends EventEmitter {
         this.steerLock = this.steerLock.then(async () => {
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.finishHumanReceipt(meta, { reached: false });
+                this.noteCancelledHuman(meta);
                 return;
             }
             await this.wake();
             if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                 this.finishHumanReceipt(meta, { reached: false });
+                this.noteCancelledHuman(meta);
                 return;
             }
             const verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+            let delivered = false;
             try {
                 if (await this.deliverMessage(formatted, status, { steer: true, deliveryEpoch, submissionId: meta.message_id,
                     ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}), verdict })) {
+                    delivered = true;
                     this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
             }
             finally {
                 this.finishHumanReceipt(meta, verdict);
+                if (!delivered && !verdict.paneWriteStarted && !this.isDeliveryEpochCurrent(deliveryEpoch))
+                    this.noteCancelledHuman(meta);
             }
         }).catch(err => {
             this.finishHumanReceipt(meta, { reached: false });
@@ -7173,6 +7285,7 @@ export class Daemon extends EventEmitter {
         if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
             this.logger.info("Pending channel delivery dropped by user cancel");
             this.deferDurableDelivery(meta, "delivery epoch changed before queue admission");
+            this.noteCancelledHuman(meta);
             return;
         }
         if (!this.tmux) {
@@ -7194,10 +7307,6 @@ export class Daemon extends EventEmitter {
                 this.logger.warn({ err: err.message }, "Failed to persist last inbound timestamp");
             }
         }
-        if (this.pendingInstructionsUpdate) {
-            writeFileSync(join(this.instanceDir, "prev-instructions"), this.pendingInstructionsUpdate);
-            this.pendingInstructionsUpdate = undefined;
-        }
         this.pendingWork.recordInbound();
         // v3: record user messages for rotation snapshot
         this.recordRecentUserMessage(content, meta);
@@ -7236,6 +7345,7 @@ export class Daemon extends EventEmitter {
         this.pasteLock = this.pasteLock.then(async () => {
             let durable = null;
             let verdict = { reached: false };
+            let delivered = false;
             try {
                 if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     this.logger.info("Pending channel delivery dropped by user cancel");
@@ -7247,44 +7357,11 @@ export class Daemon extends EventEmitter {
                     if (!this.isDeliveryEpochCurrent(deliveryEpoch))
                         return;
                 }
-                if (this.pendingInstructionsNotice) {
-                    this.pendingInstructionsNotice = false;
-                    await this.deliverMessage(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir, this.backend?.instructionsSource?.()), undefined, { deliveryEpoch });
-                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
-                        return;
-                }
-                const whatsNew = this.pendingWhatsNew ? this.currentWhatsNew(this.pendingWhatsNew) : null;
-                if (whatsNew) {
-                    // #1633: here, inside the delivery lock and ahead of a real delivery — never into a busy turn, never to an
-                    // instance nobody writes to. #2140: told at most once. Once its paste reached the pane it is recorded, proven
-                    // submitted or not. A system paste has no unique id: its only pane proof is its opening line on the screen, and
-                    // a long notice (every entry since an old session began) scrolls that line above the captured rows once Claude
-                    // paints it — unproven, though the agent read it. One that never reached the pane (cancelled, never idle) is
-                    // tried again, at most WHATS_NEW_MAX_UNWRITTEN times, then recorded with a warning.
-                    const attempt = { reached: false };
-                    const pasted = await this.deliverMessage(whatsNew.notice, undefined, { deliveryEpoch, verdict: attempt });
-                    if (this.pendingWhatsNew === whatsNew) {
-                        const written = pasted || attempt.paneWriteStarted === true;
-                        if (!written)
-                            this.whatsNewUnwritten++;
-                        if (written || this.whatsNewUnwritten >= WHATS_NEW_MAX_UNWRITTEN) {
-                            if (!pasted) {
-                                this.logger.warn({ entries: whatsNew.ids, written, attempts: this.whatsNewUnwritten, phase: attempt.phase, proof: attempt.proof }, written ? "what's-new notice pasted but its submission could not be proven — recorded so it is not sent again"
-                                    : "what's-new notice did not reach the pane after several deliveries — recorded so it is not sent again");
-                            }
-                            this.pendingWhatsNew = null;
-                            this.whatsNewUnwritten = 0;
-                            try {
-                                recordWhatsNew(this.instanceDir, whatsNew.ids, whatsNew.version);
-                            }
-                            catch (err) {
-                                this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
-                            }
-                        }
-                    }
-                    if (!this.isDeliveryEpochCurrent(deliveryEpoch))
-                        return;
-                }
+                // #2800: with this real message, in the same paste — never a paste or turn of its own: after its delivery marker
+                // (transcript proof anchors on it), before the message. A person's message with a verified receipt is pasted
+                // byte for byte (its proof is the wire's hash), so the notice waits for the next delivery without one.
+                const whatsNew = this.pendingWhatsNew && !meta.human_receipt_id ? this.currentWhatsNew(this.pendingWhatsNew) : null;
+                const pasted = whatsNew ? withWhatsNew(formatted, whatsNew.notice) : formatted;
                 const status = channelStatus(meta);
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
@@ -7296,13 +7373,24 @@ export class Daemon extends EventEmitter {
                     return;
                 }
                 durable = durableAttempt;
-                if (await this.deliverMessage(formatted, status, {
-                    deliveryEpoch,
-                    submissionId: meta.message_id,
-                    ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
-                    verdict,
-                    durableAttempt: durableAttempt || undefined,
-                })) {
+                let sent = false;
+                try {
+                    sent = await this.deliverMessage(pasted, status, {
+                        deliveryEpoch,
+                        submissionId: meta.message_id,
+                        ...(meta.verification_id ? { humanVerificationId: meta.verification_id } : {}),
+                        verdict,
+                        durableAttempt: durableAttempt || undefined,
+                    });
+                }
+                finally {
+                    // #2800: told once — recorded as soon as it went out with this message, proven submitted or not, also when
+                    // a later step of the write threw; a paste that never reached the pane keeps it for the next message.
+                    if (whatsNew && (sent || verdict.paneWriteStarted))
+                        this.recordWhatsNewSent(whatsNew);
+                }
+                if (sent) {
+                    delivered = true;
                     this.finishDurableSubmission(durable, verdict);
                     this.markTurnStarted(meta, formatted, deliveryEpoch);
                 }
@@ -7348,6 +7436,8 @@ export class Daemon extends EventEmitter {
             }
             finally {
                 this.finishHumanReceipt(meta, verdict);
+                if (!delivered && !verdict.paneWriteStarted && !this.isDeliveryEpochCurrent(deliveryEpoch))
+                    this.noteCancelledHuman(meta);
                 this.pasteQueueDepth--;
             }
         }).catch(err => {
@@ -7419,6 +7509,22 @@ export class Daemon extends EventEmitter {
         // normal Enter input has steering/interrupt semantics in several other CLIs.
         let readiness = "ready";
         const gateWindowId = windowId;
+        const handOffEligible = !!(supportsQueuedInput || opts?.steer || composerQueue);
+        const handOffAdmissible = async () => (await this.probeBlockingDialog()).state === "clear"
+            && await this.hasPositiveDeliveryInput(true)
+            && ((!opts?.steer && !composerQueue) || (this.launchTakesSteer() && await this.steerComposerAdmits(false, opts?.steer === true)));
+        // #2770: a delivery waiting for idle holds the paste queue, and every message behind it. It stops waiting at once
+        // on a cancel, and as soon as the busy pane can take it the way it would have on arrival (a box that reads again, a
+        // dialog gone) — rather than for the end of whatever keeps the pane moving (2026-10-27: 11 minutes).
+        let handOffCheckedAt = -Infinity;
+        const waitStop = async () => {
+            if (cancelled())
+                return true;
+            if (!handOffEligible || !gateWindowId || performance.now() - handOffCheckedAt < HANDOFF_RECHECK_MS)
+                return false;
+            handOffCheckedAt = performance.now();
+            return (await this.paneReadinessForDelivery(gateWindowId)) === "busy" && await handOffAdmissible() && !cancelled();
+        };
         if (gateWindowId && this.controlClient)
             readiness = await this.paneReadinessForDelivery(gateWindowId);
         if (readiness !== "ready") {
@@ -7431,11 +7537,7 @@ export class Daemon extends EventEmitter {
             // fall through to the wait.
             // #2676: an ordinary message goes into a mode-switched composer (kiro TUI) mid-turn too, on a launch whose busy
             // composer AgEnD drives, by the steer path's own gates and proof — when its box can show it is this paste.
-            const canHandOff = (supportsQueuedInput || opts?.steer || composerQueue)
-                && readiness === "busy"
-                && (await this.probeBlockingDialog()).state === "clear"
-                && await this.hasPositiveDeliveryInput(true)
-                && ((!opts?.steer && !composerQueue) || (this.launchTakesSteer() && await this.steerComposerAdmits(false, opts?.steer === true)));
+            const canHandOff = handOffEligible && readiness === "busy" && await handOffAdmissible();
             if (canHandOff) {
                 // Native queue (codex), or an explicit /steer: hand the complete
                 // paste+Enter transaction to the busy CLI now. For steer this is the
@@ -7449,10 +7551,14 @@ export class Daemon extends EventEmitter {
             }
             else {
                 this.logger.debug("CLI busy — queuing message until idle");
-                const becameIdle = await this.waitForPaneReadyForDelivery(gateWindowId);
+                const becameIdle = await this.waitForPaneReadyForDelivery(gateWindowId, undefined, waitStop);
                 if (cancelled())
                     return false;
-                if (!becameIdle) {
+                if (becameIdle === "stopped") {
+                    handingOffToNativeQueue = true;
+                    this.logger.info("The busy CLI can take this delivery now — handing it off instead of waiting for idle (#2770)");
+                }
+                else if (!becameIdle) {
                     // The pane never freed up. Report the failure instead of pasting into a
                     // wedged CLI (where the text would sit unsubmitted and the next message
                     // would land on top of it) — and instead of holding the queue silently.
@@ -7597,9 +7703,13 @@ export class Daemon extends EventEmitter {
                 return this.failDelivery(verdict, status, "pre-write", "dialog-or-input-not-ready");
             }
             this.logger.info("Dialog or input transition appeared before the pane write — waiting for readiness");
-            const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId) : false;
+            const clear = gateWindowId ? await this.waitForPaneReadyForDelivery(gateWindowId, undefined, waitStop) : false;
             if (cancelled())
                 return false;
+            if (clear === "stopped") {
+                handingOffToNativeQueue = true;
+                continue;
+            }
             if (!clear) {
                 return this.failDelivery(verdict, status, "pre-write", "readiness-timeout");
             }
@@ -8736,13 +8846,7 @@ export class Daemon extends EventEmitter {
             return "busy";
         }
     }
-    /**
-     * Like waitForPaneIdleForDelivery, plus the bottom-anchored prompt check for
-     * Enter-dropping TUIs. Polls at a coarse cadence (each poll is a capture-pane)
-     * only after the pane is already quiet, so the common fast-idle delivery still
-     * costs a single capture.
-     */
-    async waitForPaneReadyForDelivery(windowId, timeoutMs = 30 * 60_000) {
+    async waitForPaneReadyForDelivery(windowId, timeoutMs = 30 * 60_000, stop) {
         // Every backend polls: readiness now also means "no blocking dialog on
         // screen", and a dialog disappears without any output edge the silence
         // gate could see.
@@ -8755,9 +8859,10 @@ export class Daemon extends EventEmitter {
             const remaining = deadline - Date.now();
             if (remaining <= 0)
                 return false;
-            const idle = await this.waitForPaneIdleForDelivery(windowId, remaining);
-            if (!idle)
-                return false;
+            const idle = stop ? await this.waitForPaneIdleForDelivery(windowId, remaining, stop)
+                : await this.waitForPaneIdleForDelivery(windowId, remaining);
+            if (idle !== true)
+                return idle;
             // The idle wait just resolved, so re-reading the silence gate would only
             // add a stale-cache race; ask the pane the remaining questions directly.
             const transient = await this.probeInputTransient();
@@ -8777,6 +8882,8 @@ export class Daemon extends EventEmitter {
                         this.retireInputTransients("transient stalled");
                     return false;
                 }
+                if (stop && await stop())
+                    return "stopped";
                 await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
                 continue;
             }
@@ -8786,6 +8893,8 @@ export class Daemon extends EventEmitter {
                     this.logger.error({ probes: unknownStreak }, "Pane stayed unreadable during the input-transient probe — refusing to deliver blind");
                     return false;
                 }
+                if (stop && await stop())
+                    return "stopped";
                 await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
                 continue;
             }
@@ -8807,6 +8916,8 @@ export class Daemon extends EventEmitter {
                     unknownStreak = 0;
                 }
             }
+            if (stop && await stop())
+                return "stopped";
             await new Promise(r => setTimeout(r, BOTTOM_READY_POLL_MS));
         }
     }
@@ -9214,9 +9325,11 @@ export class Daemon extends EventEmitter {
         return observedAt >= lastOutputAt
             && observedAt >= this.controlClient.getObservationResetAt();
     }
-    waitForPaneIdleForDelivery(windowId, timeoutMs = 30 * 60_000) {
+    waitForPaneIdleForDelivery(windowId, timeoutMs = 30 * 60_000, stop) {
         if (!this.controlClient)
             return Promise.resolve(true);
+        if (stop)
+            return this.waitForPaneIdleOrStop(windowId, timeoutMs, stop);
         if (!this.canTrustRedrawIdleState()) {
             return this.controlClient.waitUntilIdle(windowId, timeoutMs);
         }
@@ -9236,6 +9349,44 @@ export class Daemon extends EventEmitter {
             }, timeoutMs);
         });
     }
+    /**
+     * #2770: waitForPaneIdleForDelivery that also ends as soon as `stop` says so ("stopped"). The same idle readings
+     * (tmux silence, or the state machine where its idle is trusted), polled here so nothing outlives a stopped wait.
+     */
+    waitForPaneIdleOrStop(windowId, timeoutMs, stop) {
+        const control = this.controlClient;
+        const trusted = this.canTrustRedrawIdleState();
+        if (trusted && this.isPaneIdleForDelivery(windowId))
+            return Promise.resolve(true);
+        return new Promise(resolve => {
+            let done = false, asking = false, askedAt = -Infinity;
+            const finish = (outcome) => {
+                if (done)
+                    return;
+                done = true;
+                clearInterval(check);
+                clearTimeout(timer);
+                resolve(outcome);
+            };
+            // The same idle readings as the plain wait: tmux silence (abandoned once this wait ends), or the state machine.
+            if (!trusted) {
+                control.waitUntilIdle(windowId, timeoutMs, () => done).then(idle => finish(idle), () => finish(false));
+            }
+            const check = setInterval(() => {
+                if (trusted && this.isPaneIdleForDelivery(windowId)) {
+                    finish(true);
+                    return;
+                }
+                if (asking || performance.now() - askedAt < WAIT_STOP_POLL_MS)
+                    return;
+                asking = true;
+                askedAt = performance.now();
+                stop().then(stopNow => { asking = false; if (stopNow)
+                    finish("stopped"); }, err => { asking = false; this.logger.debug({ err }, "Delivery wait stop check failed — still waiting"); });
+            }, 50);
+            const timer = setTimeout(() => finish(false), timeoutMs);
+        });
+    }
     /**
      * Antigravity has always opted into pane-state delivery readiness because its
      * footer redraws while idle.  Codex's structural idle proof is useful only
@@ -9248,7 +9399,7 @@ export class Daemon extends EventEmitter {
     canTrustRedrawIdleState() {
         if (this.backend?.hasPeriodicPaneRedraw?.() === true)
             return true;
-        return this.instanceStateMonitorActive && !!this.backend?.isPeriodicRedrawIdlePane;
+        return this.instanceStateMonitorActive && !!this.periodicIdleProof();
     }
     /**
      * The write half of a delivery: paste → Enter → confirm, with retries.
@@ -11229,10 +11380,6 @@ export class Daemon extends EventEmitter {
         const snapshot = this.buildSnapshotPrompt();
         if (!snapshot || !this.tmux)
             return;
-        if (this.pendingInstructionsUpdate) {
-            writeFileSync(join(this.instanceDir, "prev-instructions"), this.pendingInstructionsUpdate);
-            this.pendingInstructionsUpdate = undefined;
-        }
         // Small delay to let the CLI fully render its ready prompt
         await new Promise(r => setTimeout(r, 1_000));
         admission?.();
@@ -11505,6 +11652,8 @@ export class Daemon extends EventEmitter {
             // as this backend's and resumed by the next start.
             this.startupAdmission?.();
             this.setAsideForeignSession();
+            // A crash-loop-resume boot should attempt resume even though skipResume is false:
+            // bootCrashLoopResume set at boot means we had a crash loop but try resume first.
             const attemptedResume = !this.skipResume;
             // A resume launch may get a longer budget than a fresh one (kiro: the
             // conversation must come back from the backend before anything paints).
@@ -11589,6 +11738,20 @@ export class Daemon extends EventEmitter {
                     }
                     this.setSessionAside(proven ? "cli_reported_no_conversation" : "resume_failed_repeatedly");
                     this.skipResume = true;
+                    // If this was a crash-loop-resume attempt, the session is now proven
+                    // broken. Persist resumeFailed so the next restart goes fresh without
+                    // attempting resume again.
+                    if (this.bootCrashLoopResume) {
+                        try {
+                            writeFileSync(join(this.instanceDir, "crash-state.json"), JSON.stringify({
+                                resumeFailed: true,
+                                failedAt: Date.now(),
+                            }));
+                        }
+                        catch { /* best effort */ }
+                        this.logger.warn("Crash-loop-resume: session abandoned — next boot will go fresh");
+                        this.bootCrashLoopResume = false;
+                    }
                 }
                 // A fresh start that also failed retries once, as before. It never clears
                 // a session: nothing about a failed fresh launch says the stored
@@ -11606,9 +11769,37 @@ export class Daemon extends EventEmitter {
                     this.startupAdmission?.();
                     throw new Error("CLI failed to start after retry");
                 }
+                // Fresh fallback succeeded. Clear any resumeFailed marker written during this
+                // boot's setSessionAside path, so the next normal restart is not forced fresh.
+                // NOTE: bootCrashLoopResume is already false here (cleared by setSessionAside path),
+                // so check the marker directly rather than relying on the flag.
+                try {
+                    const p = join(this.instanceDir, "crash-state.json");
+                    if (existsSync(p)) {
+                        const s = JSON.parse(readFileSync(p, "utf-8"));
+                        if (s?.resumeFailed === true)
+                            unlinkSync(p);
+                    }
+                }
+                catch { /* best effort */ }
             }
             else if (attemptedResume) {
                 resumedSuccessfully = true;
+                if (this.bootCrashLoopResume) {
+                    // Resume succeeded after a crash loop — clear any stale resumeFailed marker
+                    // that might have been written by a concurrent write or a previous attempt,
+                    // so the next restart is not forced fresh.
+                    this.bootCrashLoopResume = false;
+                    try {
+                        const p = join(this.instanceDir, "crash-state.json");
+                        if (existsSync(p)) {
+                            const s = JSON.parse(readFileSync(p, "utf-8"));
+                            if (s?.resumeFailed === true)
+                                unlinkSync(p);
+                        }
+                    }
+                    catch { /* best effort */ }
+                }
                 this.clearUnprovenResumeFailures();
                 // A resume needs the backend: its success is positive proof the backend
                 // is reachable again (a fresh prompt is local and proves nothing).
@@ -12064,10 +12255,13 @@ export class Daemon extends EventEmitter {
     }
     /** Kill the entire process tree of the current tmux pane (CLI + MCP server). */
     async killProcessTree(signal = "SIGTERM", reason = "unspecified") {
-        if (!this.tmux)
+        const windowId = this.tmux?.getWindowId();
+        // Before createWindow succeeds there is no pane owned by this daemon.
+        // tmux interprets an empty selector as the session's active window.
+        if (!windowId?.trim())
             return;
         try {
-            const pid = await TmuxManager.getPanePid(this.tmuxSessionName, this.tmux.getWindowId());
+            const pid = await TmuxManager.getPanePid(this.tmuxSessionName, windowId);
             if (pid) {
                 this.noteStopRequest(signal, reason);
                 process.kill(-pid, signal);
@@ -12239,113 +12433,40 @@ export class Daemon extends EventEmitter {
         return this.museRelayFallbackInFlight;
     }
     /**
-     * Tell the agent its instructions moved, once the CLI is idle.
-     *
-     * A named method rather than an inline closure so the wiring itself is
-     * testable: warmupNoticeAction's own tests pass even if this call site stops
-     * consulting it, which is exactly the bug this path had — the decision was
-     * made inline and never asked whether the backend needed telling at all.
-     *
-     * Never throws: a missed reload notice must not fail a spawn.
-     */
-    async runWarmupInstructionNotice() {
-        try {
-            const action = warmupNoticeAction({
-                warmupNeeded: this.warmupNeeded,
-                backend: this.backend ?? undefined,
-                pasteQueueDepth: this.pasteQueueDepth,
-            });
-            if (action === "skip") {
-                this.logger.debug(this.warmupNeeded
-                    ? "Warmup skipped — this backend reloads instructions on resume"
-                    : "Warmup skipped — instructions unchanged");
-                // When the backend learns of the change on its own, record what it now
-                // holds: leaving prev-instructions behind would keep every later
-                // restart comparing against a value the agent has long since replaced.
-                if (this.warmupNeeded) {
-                    try {
-                        writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-                    }
-                    catch { /* best effort */ }
-                }
-                return;
-            }
-            if (action === "defer") {
-                this.logger.debug("Warmup deferred — no pending inbound messages");
-                // Convert to pendingInstructionsNotice so it fires on next real message.
-                this.pendingInstructionsNotice = true;
-                try {
-                    writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-                }
-                catch { }
-                return;
-            }
-            const wid = existsSync(join(this.instanceDir, "window-id"))
-                ? readFileSync(join(this.instanceDir, "window-id"), "utf-8").trim() : "";
-            if (wid && this.controlClient) {
-                await this.controlClient.waitForIdle(wid, 120_000);
-            }
-            else {
-                await new Promise(r => setTimeout(r, 5000));
-            }
-            // This path only runs when pasteQueueDepth > 0 — i.e. exactly when a real
-            // delivery is already in flight or queued. Without the lock the notice and
-            // that delivery race into the same pane.
-            const told = await this.paneWriteLock.run(() => this.submitSystemPaste(buildInstructionReloadNotice(this.backend?.binaryName ?? "unknown", this.name, this.instanceDir, this.backend?.instructionsSource?.()), "instruction-reload-notice"));
-            if (!told) {
-                // Recording the new instructions here would mark the agent as told about
-                // a notice it never received, and every later restart would then skip
-                // the reload. Leave the snapshot behind and hand it to the deferred
-                // notice, which fires on the next real message.
-                this.logger.warn("Instruction reload notice not confirmed — deferring it to the next message");
-                this.pendingInstructionsNotice = true;
-                return;
-            }
-            // Record the value the agent has now been told about so the next
-            // unchanged restart skips the reload.
-            try {
-                writeFileSync(join(this.instanceDir, "prev-instructions"), this.lastBuiltInstructions);
-            }
-            catch { /* best effort */ }
-            this.logger.debug("Warmup sent after idle");
-        }
-        catch { /* non-fatal */ }
-    }
-    /**
-     * #1633 (#1639 review): the pending notice as the record stands NOW, just before the paste — it was decided at launch,
-     * and the record may have changed while the delivery waited. Unreadable → nothing is sent (and nothing pending);
-     * entries recorded meanwhile are dropped from it; none left → nothing.
+     * #1633 (#1639 review): the pending notice as things stand NOW, just before the paste — it was decided at launch, and
+     * the record, a switch or the instance's tools may have changed while the delivery waited. Planned again from the
+     * record (#2800: the running release only, tools it has now); nothing left to tell → recorded, nothing pending.
      */
     currentWhatsNew(pending) {
-        const record = readWhatsNewRecord(this.instanceDir);
-        if (record === "unreadable") {
+        const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh: false, version: pending.version,
+            roles: this.whatsNewRoles(), tools: this.whatsNewTools(), canvasWorker: readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")) });
+        if (!plan || "silent" in plan) {
             this.pendingWhatsNew = null;
+            if (plan)
+                this.recordWhatsNewSent({ ids: plan.silent, version: plan.version });
             return null;
         }
-        const known = new Set(record?.announced ?? []);
-        const ids = pending.ids.filter(id => !known.has(id));
-        if (!ids.length) {
+        this.pendingWhatsNew = plan;
+        return plan;
+    }
+    recordWhatsNewSent(told) {
+        if (this.pendingWhatsNew && told.ids.every(id => this.pendingWhatsNew.ids.includes(id)))
             this.pendingWhatsNew = null;
-            return null;
+        try {
+            recordWhatsNew(this.instanceDir, told.ids, told.version);
         }
-        // Rebuild even when ids are unchanged: an experimental switch may have changed
-        // while this delivery waited. Never paste the old enabled capability text.
-        // #2163: rebuilt as planned — only the entries this instance's roles are told; the rest are recorded with them.
-        const roles = this.whatsNewRoles();
-        const shown = agentWhatsNew(readCanvasWorkerEnabled(join(this.instanceDir, "..", ".."))).filter(e => ids.includes(e.id) && (!e.audience || e.audience.some(r => roles.includes(r))));
-        if (!shown.length) {
-            this.pendingWhatsNew = null;
-            try {
-                recordWhatsNew(this.instanceDir, ids, pending.version);
-            }
-            catch (err) {
-                this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
-            }
-            return null;
+        catch (err) {
+            this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
         }
-        const narrowed = { notice: whatsNewNotice(pending.version, shown), ids, version: pending.version };
-        this.pendingWhatsNew = narrowed;
-        return narrowed;
+    }
+    /**
+     * #2800: the tools this instance's agend MCP server lists now — the same filters (tool set, dashboard switches, the
+     * Canvas Worker switch) — so a notice names only changes to tools it has.
+     */
+    whatsNewTools() {
+        const allowed = toolsFor(resolveToolSet(this.config, this.name));
+        const listed = withoutFeatures(TOOLS.filter(t => allowed.has(t.name)), dashboardFeaturesOff(dashboardAccessOf(this.config)));
+        return new Set(toolsWithCanvasWorker(readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")), listed).map(t => t.name));
     }
     /**
      * #2163: who this instance is to the what's-new notices — a ClassicBot room's agent, General, or a fleet worker (with
@@ -12362,7 +12483,8 @@ export class Daemon extends EventEmitter {
     /** #1633: what this instance has not been told about its AgEnD version yet (see agent-whats-new.ts). */
     prepareWhatsNew(fresh, version = agendVersion()) {
         try {
-            const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh, version, roles: this.whatsNewRoles(), canvasWorker: readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")) });
+            const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh, version, roles: this.whatsNewRoles(),
+                tools: this.whatsNewTools(), canvasWorker: readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")) });
             if (!plan) {
                 this.pendingWhatsNew = null;
                 return;
@@ -12373,8 +12495,7 @@ export class Daemon extends EventEmitter {
                 return;
             }
             this.pendingWhatsNew = plan;
-            this.whatsNewUnwritten = 0;
-            this.logger.info({ entries: plan.ids }, "what's-new notice pending for the next delivery");
+            this.logger.debug({ entries: plan.ids }, "what's-new notice pending for the next delivery");
         }
         catch (err) {
             this.logger.debug({ err }, "what's-new not prepared");
@@ -12385,41 +12506,15 @@ export class Daemon extends EventEmitter {
         this.startupAdmission?.();
         const launchFence = this.launchFenceEpoch;
         const backendConfig = this.buildBackendConfig();
-        // Compare freshly-built instructions against the last value the agent was
-        // told about. Computed for ALL backends (not gated by
-        // instructionsReloadedOnResume) so the warmup steering-reload can be
-        // skipped when nothing changed.
-        this.lastBuiltInstructions = backendConfig.instructions ?? "";
         // #1633: decided before prev-instructions is first written — its absence is what says "never launched before".
         this.prepareWhatsNew(!existsSync(join(this.instanceDir, "prev-instructions")));
-        {
-            const prevFile = join(this.instanceDir, "prev-instructions");
-            let prev = "";
+        // Record what this launch writes. #2787: a change is never announced in the pane; the CLI takes the new
+        // instructions whenever it next reads its own file.
+        if (backendConfig.instructions) {
             try {
-                prev = readFileSync(prevFile, "utf-8");
-            }
-            catch { }
-            if (!prev && backendConfig.instructions) {
-                // First time (no prev-instructions file): write current hash, skip warmup.
-                try {
-                    writeFileSync(prevFile, backendConfig.instructions);
-                }
-                catch { }
-                this.warmupNeeded = false;
-            }
-            else {
-                this.warmupNeeded = !!backendConfig.instructions && prev !== backendConfig.instructions;
-            }
-            // For backends that don't re-read instructions on resume (kiro/codex),
-            // also notify the agent on next message instead of forcing a new
-            // session. Resume is preserved so context isn't lost.
-            if (!backendConfig.skipResume && backendNeedsPaneReloadNotice(this.backend) && this.warmupNeeded) {
-                if (prev) {
-                    this.logger.info("Instructions changed — will notify agent on next message");
-                    this.pendingInstructionsNotice = true;
-                }
-                this.pendingInstructionsUpdate = backendConfig.instructions;
+                writeFileSync(join(this.instanceDir, "prev-instructions"), backendConfig.instructions);
             }
+            catch { /* best effort */ }
         }
         // A backend that has to ask its CLI something before the launch command exists (OpenCode: does
         // this binary take --auto?) does it here, off the event loop, bounded, and never fails the launch.