@songsid/agend 2.3.4-beta.5 → 2.3.4-beta.7

package/dist/fleet-manager.d.ts

@@ -167,6 +167,11 @@ export interface RestartOpts {
     sessionOomRetry?: SessionOomRetry;
     /** Internal pre-invalidation owner fence for an unclear-OOM action. */
     recoveryCurrent?: () => boolean;
+    /**
+     * #1490 row 27: the lifecycle the caller acts for (lifecyclePin), asked before anything is invalidated. A button or
+     * menu offered for one instance never restarts a later one of the same name, or one restarted since.
+     */
+    ownerCurrent?: () => boolean;
     carry?: {
         backend: string;
         from: string | null;
@@ -271,6 +276,11 @@ export type GuestAuditEntry = {
     name: string;
     outcome: string;
 };
+/** #1490 row 27: a restart asked for one lifecycle of an instance after it was stopped, restarted or replaced. */
+export declare class RestartSupersededError extends Error {
+    /** `shown`: the instance as the chat list names it (shownInstanceName). */
+    constructor(shown: string);
+}
 export declare class FleetManager implements FleetContext, LifecycleContext, ArchiverContext, StatuslineWatcherContext, OutboundContext, AgentEndpointContext {
     dataDir: string;
     private static signalTarget;
@@ -578,6 +588,7 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private watchdogTimer;
     private startupMemoryDeadline;
     private eventLoopWatch;
+    private stallReporter;
     private startedAt;
     private stormOpenNotifyTimer;
     private memoryLogAt;
@@ -618,6 +629,14 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
     private readonly webChatRemovals;
     /** #1774: a removal under way — its replies' fate waits for its outcome (success: theirs no more; failure: theirs). */
     private readonly webChatRemovalsPending;
+    /**
+     * #1490 row 27: "still the same lifecycle of `name`" — its lifecycle epoch, moved on synchronously by every stop,
+     * restart and removal (the map is never pruned, so a same-name replacement has a later one). Taken when a button
+     * or menu is claimed or offered, asked after every await before acting by name.
+     */
+    /** #1490 row 27: an instance as the chat list names it — its display name where it has one, else its name. */
+    private shownInstanceName;
+    private lifecyclePin;
     private webChatGeneration;
     /** #1774: who an instance's reply is from, taken when it is sent: the name's generation and its daemon then. */
     private webChatIdentity;
@@ -3668,12 +3687,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      */
     private locateBinaryOnLoginShell;
     /**
-     * #1092: the binary in one of the directories its own installer installs to,
-     * when no login shell can see it (the installer recorded its PATH in an
-     * interactive-only rc file). The same executable-file check as the login
-     * shell lookup; a symlink to an executable counts, as codex's launcher is one.
+     * #1092: the binary in one of the directories its own installer installs to, when no login shell can see it (the
+     * installer recorded its PATH in an interactive-only rc file) — only those directories (#1092). #3009: through
+     * backend-availability's install-directory check (the one resolveBackendBinary uses): one killable child, never
+     * accessSync/statSync on the fleet's thread. An executable file counts, a symlink to one too (codex's launcher is one).
      */
-    private locateInInstallerBinDirs;
+    private locateInstalledBackend;
     /** Put an installed binary's directory on the fleet's PATH (#1059), once. */
     private adoptBinaryDirectory;
     /** Discord native `/login` slash — shared by every adapter dispatch block. */
@@ -4006,8 +4025,12 @@ export declare class FleetManager implements FleetContext, LifecycleContext, Arc
      * restart backends only read it at launch, so it is persisted and the
      * instance respawns.
      */
-    applyEffort(instanceName: string, requested: string): Promise<string>;
-    applyModel(instanceName: string, model: string): Promise<string>;
+    applyEffort(instanceName: string, requested: string, opts?: {
+        current?: () => boolean;
+    }): Promise<string>;
+    applyModel(instanceName: string, model: string, opts?: {
+        current?: () => boolean;
+    }): Promise<string>;
     /** Save an instance's model (fleet.yaml, or its ClassicBot channel). False when neither holds it. */
     private persistInstanceModel;
     /**

package/dist/fleet-manager.js

@@ -27,7 +27,7 @@ import { clearPublicLinkOwner, readPublicLinkOwner, writePublicLinkOwner } from
 import { PUBLIC_PREVIEW_FRAME_SRC, PUBLIC_PREVIEW_TUNNEL_DIR, PublicPreview, publicPreviewWanted } from "./public-preview.js";
 import { CloudflaredProvider } from "./tunnel/cloudflared.js";
 import { ensureCloudflared } from "./tunnel/cloudflared-install.js";
-import { unattendedInstallCommand } from "./unattended-install.js";
+import { unattendedInstallCommand, loginShell } from "./unattended-install.js";
 import { InstallStream } from "./install-stream.js";
 import { namedTestLane, runNamedLinkTest } from "./tunnel/named-link-test.js";
 import { daemonTopicMode, isWebOnlyFleetConfig } from "./web-only-fleet.js";
@@ -39,7 +39,7 @@ import { withinBudget } from "./monotonic-budget.js";
 import { measureSyncWork } from "./sync-work-attribution.js";
 import { RuntimeCpuProfiler, ProfileBusyError, profileDuration } from "./runtime-cpu-profile.js";
 import { ProfileControlServer } from "./profile-control.js";
-import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, accessSync, realpathSync, lstatSync, constants as fsConstants, closeSync } from "node:fs";
+import { existsSync, readFileSync, mkdirSync, writeFileSync, unlinkSync, rmSync, readdirSync, renameSync, copyFileSync, chmodSync, statSync, realpathSync, lstatSync, closeSync } from "node:fs";
 import { atomicWriteFileSync } from "./atomic-write.js";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { freemem, totalmem, homedir } from "node:os";
@@ -56,6 +56,7 @@ import { applyKiroMigration, kiroMigrationPrompt, planKiroMigration } from "./ki
 import { fleetLabel } from "./fleet-label.js";
 import { beginFullRestartProgress as persistFullRestartProgress, beginUpdateProgress as persistUpdateProgress, clearUpdateMarker, isUpdateInProgress, readUpdateProgress, sameUpdateMarker, setUpdateProgressStage, updateMarkerIdentity, updateProgressOperation, updateReceiptOf, } from "./update-marker.js";
 import { formatUpdateProgress } from "./update-progress.js";
+import { startStallReporter } from "./stall-reporter.js";
 import { sdNotify, sdNotifyBlocking, setSdNotifyWarn, startSdWatchdog } from "./sd-notify.js";
 import { StartupMemoryDeadline, fleetStopConcurrency } from "./startup-memory-deadline.js";
 import { readFleetMemory } from "./process-memory.js";
@@ -74,7 +75,7 @@ import { isProbeableRouteTarget } from "./fleet-context.js";
 import { getEffectiveInstanceDefaults, loadFleetConfig, loadRawFleetConfig, loadFleetConfigSource, loadRawFleetConfigSource, DEFAULT_COST_GUARD, DEFAULT_DAILY_SUMMARY, DEFAULT_INSTANCE_CONFIG, autoGeneralInstanceConfig } from "./config.js";
 import { EventLog } from "./event-log.js";
 import { binaryProbe } from "./binary-probe.js";
-import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes } from "./backend-availability.js";
+import { AVAILABILITY_STALE_MS, BackendAvailabilityStore, hostAvailabilityProbes, findExecutableIn, resolveBackendBinary } from "./backend-availability.js";
 import { classifySqliteOpenError } from "./sqlite-open-errors.js";
 import { OutboxOpenError } from "./outbox-open-error.js";
 import { AdapterWorld } from "./adapter-world.js";
@@ -627,6 +628,14 @@ function emojiListFilter(opts) {
 }
 /** #1920: a guest's scope until phase 2 derives one: nothing. */
 const NO_GUEST_SCOPE = new Set();
+/** #1490 row 27: a restart asked for one lifecycle of an instance after it was stopped, restarted or replaced. */
+export class RestartSupersededError extends Error {
+    /** `shown`: the instance as the chat list names it (shownInstanceName). */
+    constructor(shown) {
+        super(t("restart.superseded", shown));
+        this.name = "RestartSupersededError";
+    }
+}
 export class FleetManager {
     dataDir;
     static signalTarget = null;
@@ -1026,6 +1035,7 @@ export class FleetManager {
     watchdogTimer = null;
     startupMemoryDeadline = null;
     eventLoopWatch = null;
+    stallReporter = null;
     startedAt = 0;
     stormOpenNotifyTimer = null;
     memoryLogAt = null;
@@ -1069,6 +1079,37 @@ export class FleetManager {
     webChatRemovals = new Map();
     /** #1774: a removal under way — its replies' fate waits for its outcome (success: theirs no more; failure: theirs). */
     webChatRemovalsPending = new Map();
+    /**
+     * #1490 row 27: "still the same lifecycle of `name`" — its lifecycle epoch, moved on synchronously by every stop,
+     * restart and removal (the map is never pruned, so a same-name replacement has a later one). Taken when a button
+     * or menu is claimed or offered, asked after every await before acting by name.
+     */
+    /** #1490 row 27: an instance as the chat list names it — its display name where it has one, else its name. */
+    shownInstanceName(name) {
+        try {
+            const classic = this.classicChannels?.getAll().find(ch => ch.instanceName === name) ?? null;
+            return resolveInstanceIdentity({ cfg: this.fleetConfig?.instances[name], classic, profile: profileIdentities(this.dataDir).get(name) }).display_name || name;
+        }
+        catch {
+            return name;
+        }
+    }
+    lifecyclePin(name) {
+        // Fail closed: a lifecycle that cannot say its epoch holds nothing (and never stops a prompt from being posted).
+        let epoch;
+        try {
+            epoch = this.lifecycle?.epochOf(name);
+        }
+        catch {
+            return () => false;
+        }
+        return () => { try {
+            return !this.shuttingDown && this.lifecycle?.epochOf(name) === epoch;
+        }
+        catch {
+            return false;
+        } };
+    }
     webChatGeneration(name) { return this.webChatGenerations.get(name) ?? 0; }
     /** #1774: who an instance's reply is from, taken when it is sent: the name's generation and its daemon then. */
     webChatIdentity(name) { return { generation: this.webChatGeneration(name), daemon: this.daemons.get(name) }; }
@@ -5641,6 +5682,23 @@ export class FleetManager {
             if (resumePaused)
                 this.lifecycle.markActivitySeedNow(name);
             const backend = config.backend ?? this.fleetConfig?.defaults?.backend ?? "claude-code";
+            // #1490 row 67: off-loop resolve before skill/instruction publication
+            // constructs a backend (resolveKnowledgeWorkDir). Capture stop/lifecycle
+            // ownership first: a Stop during this wait finishes and bumps the epoch,
+            // and the inner lifecycle check would otherwise capture the new epoch and
+            // accept the stale start. Lifecycle start looks up again before its own
+            // createBackend; the probe cache makes that cheap.
+            const epoch = this.lifecycle.epochOf(name);
+            const stopGen = this.explicitStopGeneration.get(name) ?? 0;
+            const resolved = await resolveBackendBinary(backend);
+            execution?.assert();
+            if (this.lifecycle.epochOf(name) !== epoch
+                || (this.explicitStopGeneration.get(name) ?? 0) !== stopGen) {
+                throw new SupersededStartError(name);
+            }
+            const binary = BACKEND_INSTALLATION_INFO[backend]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, resolved ?? binary);
             if (config.general_topic) {
                 this.ensureGeneralInstructions(config.working_directory, backend, name);
             }
@@ -6291,6 +6349,8 @@ export class FleetManager {
     }
     /** Restart a single instance, reloading fleet.yaml first to pick up config changes. */
     async restartSingleInstance(name, opts) {
+        if (opts?.ownerCurrent && !opts.ownerCurrent())
+            throw new RestartSupersededError(this.shownInstanceName(name));
         const migration = this.kiroMigrationRuns?.get(name);
         if (migration && migration.token !== opts?.kiroMigration)
             throw new Error(t("kiro_migrate.in_progress"));
@@ -7591,7 +7651,7 @@ export class FleetManager {
             return { kind: "refused" };
         if (device.tier === "guest")
             return this.requestGuestDeviceCode(device, input, token);
-        const paused = this.webLoginCodes.pausedForMs();
+        const paused = this.webLoginCodes.pausedForMs(input.exposureId ?? "local");
         if (paused > 0)
             return { kind: "limited", retryAfterMs: paused };
         const admitted = this.codeRequestLimiter.admit(device.idHash);
@@ -8076,6 +8136,9 @@ export class FleetManager {
         this.watchdogTimer = startSdWatchdog();
         this.eventLoopWatch?.stop();
         this.eventLoopWatch = startEventLoopWatch({ logger: this.logger });
+        // #3009: the event-loop watch runs on the main thread; this one does not, so a stall that never ends is still named.
+        this.stallReporter?.stop();
+        this.stallReporter = startStallReporter({ logFile: join(this.dataDir, "daemon.log") });
         try {
             await this.startAllWithinDeadline(configPath, deadline);
         }
@@ -8089,6 +8152,8 @@ export class FleetManager {
                     this.watchdogTimer = null;
                     this.eventLoopWatch?.stop();
                     this.eventLoopWatch = null;
+                    this.stallReporter?.stop();
+                    this.stallReporter = null;
                 }
             }
         }
@@ -8356,6 +8421,10 @@ export class FleetManager {
             const generalDir = join(getAgendHome(), name);
             mkdirSync(generalDir, { recursive: true, mode: 0o700 });
             const backendName = fleet.defaults.backend ?? "claude-code";
+            const resolved = await resolveBackendBinary(backendName);
+            const binary = BACKEND_INSTALLATION_INFO[backendName]?.binary;
+            if (binary)
+                noteResolvedBinary(binary, resolved ?? binary);
             this.ensureGeneralInstructions(generalDir, backendName, name);
             fleet.instances[name] = autoGeneralInstanceConfig(fleet.defaults, generalDir, need.adapterId); // #2598: its kiro_ui is the fleet's
             generalsCreated = true;
@@ -12866,6 +12935,9 @@ export class FleetManager {
                 await this.lifecycle.remove(name, authorization, execution, transition);
             else
                 await this.lifecycle.remove(name, authorization);
+            // #1490 row 27: its hang/exit offers were for the instance now gone (stopInstance clears them; removal stops
+            // through the lifecycle directly). The offers' own lifecycle pins refuse them too.
+            this.clearNoncePromptsForInstance(name);
             // #1774: removed — its replies still copying their files are no one's to show, replaced or not (a failed removal
             // throws above: its replies stay its own).
             this.webChatRemovals.set(name, { below: removedBelow, ...(removedDaemon !== undefined ? { daemon: removedDaemon } : {}) });
@@ -14540,6 +14612,7 @@ export class FleetManager {
             threadId: opts.threadId,
             expiredText: opts.expiredText,
             createdAt: Date.now(),
+            lifecycleCurrent: this.lifecyclePin(opts.instanceName),
             ...opts.extra,
         };
         entry.timer = setTimeout(() => {
@@ -16253,21 +16326,27 @@ export class FleetManager {
         if (claimed === "consumed")
             return true;
         const { entry: pending, action } = claimed;
+        // #1490 row 27: the lifecycle the button was offered for — a replacement since (removal does not clear prompts) is stale.
+        const current = pending.lifecycleCurrent ?? this.lifecyclePin(pending.instanceName);
         this.eventLog?.insert(pending.instanceName, oom ? "session_oom_action" : "normal_exit_action", { action, userId: data.userId });
         if (action === "ignore") {
             await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("exit.ignored", pending.instanceName));
             return true;
         }
+        if (!current()) {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("restart.superseded", this.shownInstanceName(pending.instanceName)));
+            return true;
+        }
         await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("exit.restarting", pending.instanceName));
         try {
-            await this.restartSingleInstance(pending.instanceName, { explicit: true, ...(oom ? { freshStart: action === "fresh", sessionOomRetry: pending.sessionOomRetry,
+            await this.restartSingleInstance(pending.instanceName, { explicit: true, ownerCurrent: current, ...(oom ? { freshStart: action === "fresh", sessionOomRetry: pending.sessionOomRetry,
                     ...(pending.confirmationCurrent ? { recoveryCurrent: pending.confirmationCurrent } : {}) } : {}) });
             await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("exit.restarted", pending.instanceName), pending.threadId);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             this.logger.error({ err, instanceName: pending.instanceName }, "Normal-exit restart failed");
-            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("exit.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show normal-exit restart error"));
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, err instanceof RestartSupersededError ? message : t("exit.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show normal-exit restart error"));
         }
         return true;
     }
@@ -17379,7 +17458,10 @@ export class FleetManager {
         return this.browserBackendSignInsInstance ??= new BrowserBackendSignIns({
             dataDir: this.dataDir, lock: this.loginWindow,
             current: owner => this.browserSignInOwnerCurrent(owner),
-            installed: async () => ONBOARDING_BACKENDS.filter(backend => this.isCliInstalled(backend)),
+            installed: async () => {
+                const found = await Promise.all(ONBOARDING_BACKENDS.map(async (backend) => (await this.isCliInstalledOffLoop(backend)) ? backend : null));
+                return found.filter((backend) => backend !== null);
+            },
             checkAuth: backend => checkAuthStatus(LOGIN_FLOWS[backend].authCheck),
             checkConsoleAuth: () => checkAuthStatus(LOGIN_FLOWS.antigravity.authCheck),
             transport: () => createStructuredSignInTransport(),
@@ -17483,13 +17565,13 @@ export class FleetManager {
      * #2233: `/login` for a dashboard requester. The same controller and checks; a CLI that is not installed is refused
      * with its install command (chat's install-first runs a terminal of its own, which the dashboard does not offer).
      */
-    startWebDashboardLogin(backendArg, chat, opts) {
+    async startWebDashboardLogin(backendArg, chat, opts) {
         const wanted = LOGIN_BACKEND_ALIASES[backendArg.toLowerCase()] ?? backendArg.toLowerCase();
         if (isRemovedBackend(wanted))
-            return Promise.resolve(removedBackendMessage(wanted));
+            return removedBackendMessage(wanted);
         const info = BACKEND_INSTALLATION_INFO[wanted];
-        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !this.isCliInstalled(wanted)) {
-            return Promise.resolve(t("login.web_dashboard_not_installed", wanted, info.install));
+        if (info && LOGIN_FLOWS[wanted]?.remoteLogin !== "unsupported" && !(await this.isCliInstalledOffLoop(wanted))) {
+            return t("login.web_dashboard_not_installed", wanted, info.install);
         }
         if (!opts.skipAuthCheck)
             this.recordLoginFlow(wanted, "login", chat.userId);
@@ -17537,8 +17619,10 @@ export class FleetManager {
                 ? removedBackendMessage(backend)
                 : !installed.has(backend)
                     ? (BACKEND_INSTALLATION_INFO[backend] ? t("login.install_by_name", backend) : t("login.install_on_host", backend))
+                    // #2981: one short line in the bare /login list — the full refusal (why, and what to run) is `/login <it>`'s;
+                    // a bare /login used to post Antigravity's whole paragraph to someone who never asked about it.
                     : flow?.remoteLogin === "unsupported"
-                        ? t("login.remote_unsupported_agent_cli", backend, flow.command)
+                        ? t("login.host_only", flow.command)
                         : backend === "opencode" ? t("login.unsupported", backend) : t("login.no_remote_flow", backend)}`).join("\n");
             await chat.adapter.sendText(chat.chatId, guidance, { threadId: chat.threadId })
                 .catch(err => this.logger.warn({ err }, "Failed to post unsupported login guidance"));
@@ -17981,9 +18065,14 @@ export class FleetManager {
         // session only judges that verdict; it does not read the output for URLs or prompts.
         // M-2281 (#2980): no terminal to ask on, low priority, stoppable as a whole, the user's own $SHELL — see
         // unattended-install.ts. A prompt nobody can answer fails at once instead of waiting out the timeout.
+        const shell = (await loginShell()) ?? null;
+        if (!this.loginWindow.isCurrent(claim)) {
+            this.loginWindow.release(claim);
+            return t("login.web_shutting_down");
+        }
         const flow = {
             backend,
-            command: unattendedInstallCommand(info.unattended ?? info.install),
+            command: unattendedInstallCommand(info.unattended ?? info.install, shell),
             successPattern: /$^/,
             timeoutMs: this.installTimeoutMs,
         };
@@ -18027,7 +18116,9 @@ export class FleetManager {
                     return;
                 // The installer may only have added the binary to a profile PATH; a
                 // fresh login shell sees that, the fleet process's PATH may not.
-                const installedAt = (await this.locateBinaryOnLoginShell(info.binary)) ?? this.locateInInstallerBinDirs(info);
+                // #3009 (leader, cid-3017-3029-overlap): both lookups off the fleet's main thread — the login shell's own check,
+                // then the installer's own directories through backend-availability's check (a killable child tests each one).
+                const installedAt = (await this.locateBinaryOnLoginShell(info.binary)) ?? (await this.locateInstalledBackend(backend));
                 if (handoff.cancelled || this.installHandoff !== handoff)
                     return;
                 if (!installedAt) {
@@ -18119,38 +18210,27 @@ export class FleetManager {
      */
     async locateBinaryOnLoginShell(binary) {
         try {
-            const result = await runOnLoginShell(`command -v ${binary}`);
+            // #3009: the executable-file check runs inside the same login shell (a killable child), never as accessSync/statSync
+            // on the fleet's thread — a path on a filesystem that stopped answering held the whole fleet there.
+            const result = await runOnLoginShell(`p=$(command -v ${binary}) && [ -f "$p" ] && [ -x "$p" ] && printf '%s\n' "$p"`);
             if (result.status !== 0)
                 return null;
             const path = result.stdout.trim().split("\n").pop()?.trim() ?? "";
-            if (!isAbsolute(path))
-                return null;
-            accessSync(path, fsConstants.X_OK);
-            return statSync(path).isFile() ? path : null;
+            return isAbsolute(path) ? path : null;
         }
         catch {
             return null;
         }
     }
     /**
-     * #1092: the binary in one of the directories its own installer installs to,
-     * when no login shell can see it (the installer recorded its PATH in an
-     * interactive-only rc file). The same executable-file check as the login
-     * shell lookup; a symlink to an executable counts, as codex's launcher is one.
+     * #1092: the binary in one of the directories its own installer installs to, when no login shell can see it (the
+     * installer recorded its PATH in an interactive-only rc file) — only those directories (#1092). #3009: through
+     * backend-availability's install-directory check (the one resolveBackendBinary uses): one killable child, never
+     * accessSync/statSync on the fleet's thread. An executable file counts, a symlink to one too (codex's launcher is one).
      */
-    locateInInstallerBinDirs(info) {
-        for (const dir of info.binDirs?.(process.env, homedir()) ?? []) {
-            if (!isAbsolute(dir))
-                continue;
-            const path = join(dir, info.binary);
-            try {
-                accessSync(path, fsConstants.X_OK);
-                if (statSync(path).isFile())
-                    return path;
-            }
-            catch { /* not there */ }
-        }
-        return null;
+    async locateInstalledBackend(backend) {
+        const info = BACKEND_INSTALLATION_INFO[backend];
+        return info ? (await findExecutableIn(info.binary, info.binDirs?.(process.env, homedir()) ?? [])) ?? null : null;
     }
     /** Put an installed binary's directory on the fleet's PATH (#1059), once. */
     adoptBinaryDirectory(binaryPath, backend) {
@@ -18466,20 +18546,26 @@ export class FleetManager {
         if (claimed === "consumed")
             return true;
         const { entry: pending, action } = claimed;
+        // #1490 row 27: the lifecycle the button was offered for — a replacement since (removal does not clear prompts) is stale.
+        const current = pending.lifecycleCurrent ?? this.lifecyclePin(pending.instanceName);
         this.eventLog?.insert(pending.instanceName, "hang_action", { action, userId: data.userId });
         if (action === "wait") {
             await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("hang.waiting", pending.instanceName));
             return true;
         }
+        if (!current()) {
+            await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("restart.superseded", this.shownInstanceName(pending.instanceName)));
+            return true;
+        }
         await this.retireNonceButtons(pending, pending.messageId ?? data.messageId, t("hang.restarting", pending.instanceName));
         try {
-            await this.restartSingleInstance(pending.instanceName, { explicit: true });
+            await this.restartSingleInstance(pending.instanceName, { explicit: true, ownerCurrent: current });
             await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("hang.restarted", pending.instanceName), pending.threadId);
         }
         catch (err) {
             const message = err instanceof Error ? err.message : String(err);
             this.logger.error({ err, instanceName: pending.instanceName }, "Hang force-restart failed");
-            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, t("hang.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show hang restart error"));
+            await pending.adapter.editMessage(pending.chatId, pending.messageId ?? data.messageId, err instanceof RestartSupersededError ? message : t("hang.restart_failed", pending.instanceName, message), pending.threadId).catch(editErr => this.logger.warn({ err: editErr, instanceName: pending.instanceName }, "Failed to show hang restart error"));
         }
         return true;
     }
@@ -18555,6 +18641,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
     resolveKnowledgeWorkDir(workDir, backend, instanceName) {
         // Backend resolution may create/normalize the real cwd. Instructions and
         // skills must land where the CLI actually runs, not an assumed path.
+        // Caller pins resolveBackendBinary first so createBackend does not `which`.
         try {
             const resolved = createBackend(backend, join(getAgendHome(), "cli-env"))
                 .resolveWorkingDirectory?.(workDir, instanceName);
@@ -19877,7 +19964,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }));
         const timer = setTimeout(() => this.pendingEffortSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName: name, userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond });
+        this.pendingEffortSelects.set(nonce, { instanceName: name, instanceCurrent: this.lifecyclePin(name), userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond });
         try {
             await data.respondChoices(t("effort.menu", this.effortMenuHeader(name)), choices);
         }
@@ -19912,7 +19999,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingEffortSelects.set(nonce, { instanceName, userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingEffortSelects.set(nonce, { instanceName, instanceCurrent: this.lifecyclePin(instanceName), userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("effort.menu", this.effortMenuHeader(instanceName)), choices, { threadId });
             const pending = this.pendingEffortSelects.get(nonce);
@@ -19937,6 +20024,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingEffortSelects.get(match[1]);
         if (!pending)
             return true;
+        // #1490 row 27: the menu was for one lifecycle of the instance; stopped, restarted or replaced since, it is stale.
+        if (!pending.instanceCurrent()) {
+            this.pendingEffortSelects.delete(match[1]);
+            clearTimeout(pending.timer);
+            data.ack?.(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName)));
+            await pending.respond(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))).catch(() => { });
+            return true;
+        }
         // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
         // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
@@ -19979,17 +20074,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             let result;
             try {
                 // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
-                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
-                    ? await withSpawnHoldReply(async (text) => {
-                        if (pending.adapter && pending.adapterChatId) {
-                            if (progressMsgId)
-                                await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                result = !pending.instanceCurrent() ? t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))
+                    : this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                        ? await withSpawnHoldReply(async (text) => {
+                            if (pending.adapter && pending.adapterChatId) {
+                                if (progressMsgId)
+                                    await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                                else
+                                    await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
+                            }
                             else
-                                await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
-                        }
-                        else
-                            await pending.respond(text);
-                    }, () => this.applyEffort(pending.instanceName, level)) : t("menu.click_stale");
+                                await pending.respond(text);
+                        }, () => this.applyEffort(pending.instanceName, level, { current: pending.instanceCurrent })) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, level }, "Effort switch failed");
@@ -20046,7 +20142,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const choices = this.modelMenuChoices(name, nonce, options, currentModel);
         const timer = setTimeout(() => this.pendingModelSelects.delete(nonce), CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName: name, model: "", userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond, respondChoices: data.respondChoices });
+        this.pendingModelSelects.set(nonce, { instanceName: name, instanceCurrent: this.lifecyclePin(name), model: "", userId: data.userId, channelId: data.channelId, adapterId, timer, respond: data.respond, respondChoices: data.respondChoices });
         try {
             await data.respondChoices(t("model.menu", `**${currentDisplay}**`), choices);
         }
@@ -20082,7 +20178,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             }
         }, CLASSIC_BACKEND_SELECTION_TIMEOUT_MS);
         timer.unref?.();
-        this.pendingModelSelects.set(nonce, { instanceName, model: "", userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
+        this.pendingModelSelects.set(nonce, { instanceName, instanceCurrent: this.lifecyclePin(instanceName), model: "", userId, channelId, adapterId, timer, respond, adapter, adapterChatId: chatId, adapterThreadId: threadId });
         try {
             const menuMessageId = await adapter.promptUser(chatId, t("model.menu", currentDisplay), choices, { threadId });
             const pending = this.pendingModelSelects.get(nonce);
@@ -20255,6 +20351,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         const pending = this.pendingModelSelects.get(match[1]);
         if (!pending)
             return true;
+        // #1490 row 27: the menu was for one lifecycle of the instance; stopped, restarted or replaced since, it is stale.
+        if (!pending.instanceCurrent()) {
+            this.pendingModelSelects.delete(match[1]);
+            clearTimeout(pending.timer);
+            data.ack?.(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName)));
+            await pending.respond(t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))).catch(() => { });
+            return true;
+        }
         // The admin who opened the menu, through the adapter that posted it, in the same channel — and still an admin
         // when they click (#754 audit): the menu lives for a minute, and a click carries its own callback data.
         const cbChannel = data.threadId ?? data.chatId;
@@ -20315,17 +20419,18 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             let result;
             try {
                 // Asked again after the progress edit awaited above: the instance may have moved, or the admin lost admin.
-                result = this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
-                    ? await withSpawnHoldReply(async (text) => {
-                        if (pending.adapter && pending.adapterChatId) {
-                            if (progressMsgId)
-                                await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                result = !pending.instanceCurrent() ? t("menu.instance_replaced", this.shownInstanceName(pending.instanceName))
+                    : this.menuClickStillCurrent(pending.instanceName, data.userId, pending.channelId, adapterId, pending.adapterChatId)
+                        ? await withSpawnHoldReply(async (text) => {
+                            if (pending.adapter && pending.adapterChatId) {
+                                if (progressMsgId)
+                                    await pending.adapter.editMessage(pending.adapterChatId, progressMsgId, text, pending.adapterThreadId);
+                                else
+                                    await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
+                            }
                             else
-                                await pending.adapter.sendText(pending.adapterChatId, text, { threadId: pending.adapterThreadId });
-                        }
-                        else
-                            await pending.respond(text);
-                    }, () => this.applyModel(pending.instanceName, model)) : t("menu.click_stale");
+                                await pending.respond(text);
+                        }, () => this.applyModel(pending.instanceName, model, { current: pending.instanceCurrent })) : t("menu.click_stale");
             }
             catch (err) {
                 this.logger.error({ err, instance: pending.instanceName, model }, "Model switch failed");
@@ -20418,7 +20523,10 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
      * restart backends only read it at launch, so it is persisted and the
      * instance respawns.
      */
-    async applyEffort(instanceName, requested) {
+    async applyEffort(instanceName, requested, opts) {
+        // #1490 row 27: a menu's choice is for the lifecycle it was offered to — asked first and fenced into the restart.
+        if (opts?.current && !opts.current())
+            return t("menu.instance_replaced", this.shownInstanceName(instanceName));
         const level = requested.trim().toLowerCase();
         const backendName = this.backendNameForInstance(instanceName);
         let strategy = "unsupported";
@@ -20453,10 +20561,14 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pasteRawToClassicInstance(instanceName, `/effort ${applied}`);
             return `${warn}${t("effort.runtime_success", instanceName, applied)}`;
         }
-        await this.restartSingleInstance(instanceName);
+        await this.restartSingleInstance(instanceName, { ownerCurrent: opts?.current });
         return `${warn}${t("effort.restart_success", instanceName, applied)}`;
     }
-    async applyModel(instanceName, model) {
+    async applyModel(instanceName, model, opts) {
+        // #1490 row 27: a menu's choice is for the lifecycle it was offered to — asked first, after the runtime switch's
+        // await, and fenced into the restart.
+        if (opts?.current && !opts.current())
+            return t("menu.instance_replaced", this.shownInstanceName(instanceName));
         // Reject model names with newlines or control characters: they would be
         // persisted to fleet.yaml and pasted raw into the CLI (P3 from #1490 audit).
         if (/[\x00-\x1f\x7f]/.test(model)) {
@@ -20482,6 +20594,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         // #1690: claude-code's runtime switch reports what it came to; the model is saved unless claude was told No.
         if (strategy === "runtime" && backendName === "claude-code") {
             const result = await this.runRuntimeModelSwitch(instanceName, model);
+            if (opts?.current && !opts.current())
+                return t("menu.instance_replaced", this.shownInstanceName(instanceName));
             if (result.outcome === "mismatch")
                 return `${warn}${t("model.switch_mismatch", instanceName, result.shown, model)}`;
             if (result.outcome === "not_sent")
@@ -20502,7 +20616,7 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
             this.pasteRawToClassicInstance(instanceName, `/model ${model}`);
             return `${warn}${t("model.runtime_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
         }
-        await this.restartSingleInstance(instanceName);
+        await this.restartSingleInstance(instanceName, { ownerCurrent: opts?.current });
         return `${warn}${t("model.restart_success", instanceName, model)}${this.effortSuffix(instanceName)}`;
     }
     /** Save an instance's model (fleet.yaml, or its ClassicBot channel). False when neither holds it. */
@@ -21435,6 +21549,8 @@ Plus the operational skills (fleet-health, instance-lifecycle, scheduling, sessi
         }
         this.eventLoopWatch?.stop();
         this.eventLoopWatch = null;
+        this.stallReporter?.stop();
+        this.stallReporter = null;
         // A login/install window is a dedicated tmux server with its own TTL
         // timer and HTTP listener living in THIS process: without an explicit
         // shutdown it would outlive us as an owner-less login CLI (sol B3).