@songsid/agend 2.3.5-alpha.3 → 2.3.5-alpha.5

package/dist/daemon.js

@@ -1,5 +1,6 @@
 import { nativePaneToolRefusal } from "./native-pane-tools.js";
 import { generalByName } from "./general-instance.js";
+import { quotaHistoryCount, quotaAfterInput } from "./pane-quota-history.js";
 import { dialogScreenText } from "./dialog-screen-text.js";
 import { readActiveKiroModel } from "./backend/kiro.js";
 import { dashboardAccessOf } from "./dashboard-permissions.js";
@@ -35,14 +36,14 @@ import { scopedFleetConfigEnvironment } from "./web-experimental.js";
 import { readAgentFile } from "./agent-file-read.js";
 import { ASSET_UPLOAD_MAX_BYTES, receivePreview, sendAssetInParts, writePreview } from "./web-asset-parts.js";
 import { LOGIN_FLOWS } from "./login-flows.js";
-import { ProgressAccumulator, summarizeProgress } from "./tool-progress.js";
+import { ProgressAccumulator, isSearchProgram, summarizeProgress } from "./tool-progress.js";
 import { assembleSystemPrompt, resolveWorkflowText } from "./prompt-file-ref.js";
 import { isCrossInstanceVisibility } from "./cross-instance-notice.js";
 import { ContextGuardian } from "./context-guardian.js";
 import { IpcServer } from "./channel/ipc-bridge.js";
 import { daemonBudgetMs } from "./channel/ipc-timeouts.js";
 import { MessageBus } from "./channel/message-bus.js";
-import { shellQuote, UnsupportedCliError, ResumeBlockedError } from "./backend/types.js";
+import { shellQuote, KiroCompatibilityError, UnsupportedCliError, ResumeBlockedError } from "./backend/types.js";
 import { getTmuxSession } from "./config.js";
 import { routeToolCall } from "./channel/tool-router.js";
 import { parseReplyButtons, replyButtonsFallbackText } from "./reply-buttons.js";
@@ -58,13 +59,14 @@ import { agendMessageInInput, bottomRowIsReady, inputAreaText, inputShowsPastedT
 import { TurnReplyGuard, formatReplyDropDetection, turnExpectsPersonReply } from "./turn-reply-guard.js";
 import { CLAUDE_CREDIT_BALANCE_LOW, CLAUDE_MODEL_USAGE_LIMIT, CLAUDE_USAGE_LIMIT_PAUSE } from "./backend/claude-transcript-errors.js";
 import { t } from "./locale.js";
-import { claudeResetTime, quotaPausedLine } from "./quota-notice.js";
+import { claudeResetInstant, claudeResetTime, quotaPausedLine } from "./quota-notice.js";
 import { MuseUsageRelay, clearMuseUsageSnapshot } from "./muse-usage-relay.js";
 import { reconcileNativePaneTarget } from "./native-pane-reconciliation.js";
 import { deliveryContentDigest } from "./delivery-outbox.js";
 import { consumedWatches } from "./delivery-consumed-watch.js";
 import { queueResumePolicyForAttempt } from "./delivery-queue-evidence.js";
-import { scanTranscriptForDeliveryMarker } from "./delivery-reconciliation.js";
+import { markerConsumed, scanTranscriptForDeliveryMarker } from "./delivery-reconciliation.js";
+import { QUEUED_HANDOFF_MAX_REDELIVERIES, QueuedHandoffStore } from "./queued-handoffs.js";
 import { measureSyncWork, noteSyncWork } from "./sync-work-attribution.js";
 import { TranscriptDeltaReader } from "./transcript-delta-reader.js";
 import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
@@ -155,6 +157,8 @@ export const HANDOFF_RECHECK_MS = 1_000;
 export const WAIT_STOP_POLL_MS = 250;
 /** #2770: human messages a cancel dropped are told in one notice, this long after the last of them. */
 export const CANCELLED_HUMANS_NOTICE_MS = 1_000;
+/** #3030: a queued hand-off's watch outlives a long turn (the record outlives the watch in any case). */
+export const QUEUED_HANDOFF_WATCH_LIFETIME_MS = 12 * 60 * 60_000;
 /**
  * An instance publishing more than this many execution-state edges inside the
  * window is flapping; its edges stop being logged one by one (#1116). One
@@ -347,7 +351,8 @@ export function shellCommandLabel(command) {
     if (!program)
         return "";
     const isBareWord = (t) => !!t && /^[A-Za-z][A-Za-z0-9_-]*$/.test(t);
-    const label = isBareWord(tokens[1]) ? `${program} ${tokens[1]}` : program;
+    // A search program's next word is what it searches for, not a subcommand: `grep <token>` keeps only `grep`.
+    const label = isBareWord(tokens[1]) && !isSearchProgram(program) ? `${program} ${tokens[1]}` : program;
     return label.length > 40 ? `${label.slice(0, 39)}…` : label;
 }
 export class PaneStateMachine {
@@ -1585,6 +1590,12 @@ export class Daemon extends EventEmitter {
     pendingWhatsNew = null;
     pasteQueueDepth = 0;
     /** #2770: a person's messages a cancel dropped before they reached the CLI, told together (noteCancelledHuman). */
+    /** #3030: people's messages a CLI never took (or that a restart left unverifiable), told once per batch. */
+    unsettledHandoffs = { "not-taken": [], unverifiable: [] };
+    unsettledHandoffsTimer = null;
+    /** #3030: since when (monotonic) the CLI has been idle without a break; null while it is not. */
+    instanceIdleSinceMono = null;
+    queuedHandoffStore = null;
     cancelledHumans = [];
     cancelledHumansTimer = null;
     firstDeliveryDelay = new FirstDeliveryDelay();
@@ -1789,6 +1800,85 @@ export class Daemon extends EventEmitter {
     // still booting. Its new tmux window starts empty before resume restores the
     // old transcript, so pre-ready scans must not lower this seeded baseline.
     seededErrorCountBaselines = new Map();
+    nativeQuotaReplayTaken = false;
+    quotaReplay = null;
+    paneQuotaPatterns() {
+        if (!["codex", "grok"].includes(this.backend?.binaryName ?? ""))
+            return [];
+        const patterns = this.backend?.getErrorPatterns?.() ?? [];
+        return this.backend?.binaryName === "codex" ? patterns.filter(ep => Daemon.isCodexUsageLimitPause(ep)) : patterns.filter(ep => ep.type === "quota");
+    }
+    async prepareQuotaReplayHistory(reuseWindow) {
+        this.quotaReplay = null;
+        const backend = this.backend, owner = this.tmux, window = owner?.getWindowId?.();
+        const spawn = this.spawnGeneration, fence = this.launchFenceEpoch, attempt = this.launchAttempt;
+        const current = () => backend === this.backend && owner === this.tmux && window === owner?.getWindowId?.()
+            && spawn === this.spawnGeneration && fence === this.launchFenceEpoch && attempt === this.launchAttempt;
+        const replay = backend?.quotaReplayHistory?.();
+        if (replay)
+            this.quotaReplay = { ...replay, spawn, fence, attempt };
+        // A Grok wake keeps its exited pane. The replacement's first ready pane is not history proof.
+        if (reuseWindow && backend?.resumesPreservedQuotaHistory?.()) {
+            let oldPane;
+            try {
+                oldPane = await owner.capturePane();
+            }
+            catch {
+                return;
+            }
+            this.startupAdmission?.();
+            if (!current())
+                return;
+            const patterns = this.paneQuotaPatterns();
+            const messages = oldPane.split(/\r?\n/).filter(row => patterns.some(ep => ep.pattern.test(row)));
+            this.quotaReplay = { messages, current: () => true, spawn, fence, attempt };
+        }
+    }
+    /** Before admission, this launch may absorb ONLY rows positively known before its resume. */
+    takeQuotaReplayBaseline(pane) {
+        // Native captures carry only a runner-frozen pre-launch proof, revalidated with this capture's owner and seq.
+        const native = !this.nativeQuotaReplayTaken ? this.nativePaneLifecycle?.quotaReplayHistory?.() : null;
+        if (this.nativePaneLifecycle)
+            this.nativeQuotaReplayTaken = true;
+        const history = this.quotaReplay ?? (native ? { ...native, spawn: this.spawnGeneration, fence: this.launchFenceEpoch, attempt: this.launchAttempt } : null);
+        if (!history)
+            return;
+        this.quotaReplay = null;
+        if (history.spawn !== this.spawnGeneration || history.fence !== this.launchFenceEpoch || history.attempt !== this.launchAttempt || !history.current())
+            return;
+        for (const ep of this.paneQuotaPatterns()) {
+            const count = Math.min(Daemon.countOccurrences(ep.pattern, pane), quotaHistoryCount(pane, ep.pattern, history.messages));
+            if (!count)
+                continue;
+            const key = Daemon.errorPatternKey(ep);
+            this.lastErrorCount.set(key, Math.max(this.lastErrorCount.get(key) ?? 0, count));
+            this.logger.debug({ backend: this.backend?.binaryName, count, evidence: "before-resume" }, "Quota rows restored from history — not a new incident");
+        }
+    }
+    // Submission makes captured rows history even when no monitor reported them yet. Keep this acknowledged input's
+    // marker as well: a new error can replace an old row in the viewport without increasing the total match count.
+    quotaInput = null;
+    commitPreInputQuotaHistory(evidence) {
+        const history = evidence?.quotaHistory;
+        if (!history || history.spawn !== this.spawnGeneration || history.fence !== this.launchFenceEpoch || history.attempt !== this.launchAttempt
+            || history.tmux !== this.tmux || history.window !== this.tmux?.getWindowId?.() || this.deliveryWritesStopping)
+            return;
+        for (const row of history.counts)
+            this.lastErrorCount.set(row.key, row.count);
+        this.quotaInput = history.marker && history.occurrences === 0 ? { history, reported: new Map() } : null;
+    }
+    quotaOccurrencesAfterInput(pane, ep) {
+        if (!(this.backend?.binaryName === "codex" && Daemon.isCodexUsageLimitPause(ep)
+            || this.backend?.binaryName === "grok" && ep.type === "quota"))
+            return null;
+        const input = this.quotaInput, history = input?.history;
+        if (!input || !history || history.spawn !== this.spawnGeneration || history.fence !== this.launchFenceEpoch
+            || history.attempt !== this.launchAttempt || history.tmux !== this.tmux || history.window !== this.tmux?.getWindowId?.()
+            || this.deliveryWritesStopping)
+            return null;
+        const suffix = quotaAfterInput(pane, history.marker);
+        return suffix === null ? null : { input, count: Daemon.countOccurrences(ep.pattern, suffix) };
+    }
     lastDetectedErrorType = null;
     /**
      * #2822: Claude's per-model usage limit (`You've reached your <model> limit.`), known only from Claude's own record of
@@ -1810,12 +1900,55 @@ export class Daemon extends EventEmitter {
     static CREDIT_BALANCE_LOW = CLAUDE_CREDIT_BALANCE_LOW;
     /** #2834 (#816): Claude's usage-limit auto-continue note, as it records it (`system` / `informational`). */
     static USAGE_LIMIT_PAUSE = CLAUDE_USAGE_LIMIT_PAUSE;
-    /** #2834 (#816): Claude paused itself until its usage window opens — the same notice the screen pattern gave. */
-    noteClaudeInformational(text) {
-        const match = Daemon.USAGE_LIMIT_PAUSE.exec(text.trim());
+    /** Claude's note that its usage window opened again ("Usage limit reset · continuing automatically"). */
+    static USAGE_LIMIT_RESET = /^Usage limit reset\b/i;
+    /** Repeats of one usage pause ("reached again" every few minutes) collapse into the first notice for this long. */
+    static USAGE_PAUSE_NOTICE_WINDOW_MS = 30 * 60_000;
+    /** The usage-pause notice told last: when (monotonic), Claude's words for the reset, and that reset (wall clock). */
+    usagePauseNotice = null;
+    /** Coarse status for the representative quota hint; never exports model names or transcript text. */
+    quotaPaused() {
+        if (this.usageLimitHold)
+            return true;
+        const pause = this.usagePauseNotice;
+        return !!pause && (pause.resetAt === null
+            ? performance.now() - pause.at < Daemon.USAGE_PAUSE_NOTICE_WINDOW_MS
+            : Date.now() < pause.resetAt);
+    }
+    /**
+     * #2834 (#816): Claude paused itself until its usage window opens — the same notice the screen pattern gave. `at`: when
+     * Claude wrote it (its record's timestamp). One notice per pause: a reset time already past is not this pause (an old
+     * note), and its repeats ("reached again") within the window — or naming the same reset, until it comes — say nothing
+     * more. Claude's own "Usage limit reset" ends it.
+     */
+    /** #3186 review: the lifecycle's second opinion dropped the notice (usage has capacity): nothing was told. */
+    clearUsagePauseNotice() { this.usagePauseNotice = null; }
+    noteClaudeInformational(text, at = null) {
+        const line = text.trim();
+        if (Daemon.USAGE_LIMIT_RESET.test(line)) {
+            this.usagePauseNotice = null;
+            return;
+        }
+        const match = Daemon.USAGE_LIMIT_PAUSE.exec(line);
         if (!match)
             return;
         const when = match[1].trim();
+        const wallNow = Date.now(), now = performance.now();
+        const resetAt = claudeResetInstant(when, at ?? wallNow);
+        if (resetAt !== null && resetAt <= wallNow) {
+            this.logger.debug({ when, writtenAt: at }, "Claude usage-limit note names a reset already past — an old note, not told");
+            return;
+        }
+        // A pause told earlier is this one while its own reset has not come (unknown: within the window): its repeats —
+        // "reached again", or a relative time drifting ("in 3h", "in 2h 55m") — within the window, or naming the same reset.
+        // Once its reset has passed, a later note is a new pause even without Claude's "Usage limit reset" (#3186 review).
+        const told = this.usagePauseNotice;
+        const toldOpen = !!told && (told.resetAt === null || wallNow < told.resetAt);
+        if (told && toldOpen && (now - told.at < Daemon.USAGE_PAUSE_NOTICE_WINDOW_MS || (told.when === when && told.resetAt !== null))) {
+            this.logger.debug({ when }, "Claude usage-limit note repeats a pause already told — collapsed");
+            return;
+        }
+        this.usagePauseNotice = { at: now, when, resetAt };
         this.emit("pty_error", { name: this.name, type: "quota", action: "notify", verifyQuota: true, skipCooldown: true, skipRecoveryWait: true,
             message: `Claude Code usage limit reached — paused; continuing automatically ${when}`,
             notice: quotaPausedLine("Claude", "usage", claudeResetTime(when)) });
@@ -1954,6 +2087,13 @@ export class Daemon extends EventEmitter {
     nativeFleetBridge;
     nativeTranscriptSource;
     usesNativePane() { return !!this.nativePaneLifecycle; }
+    /** cc3ce4fe: the CLI version this pane's launch actually ran, as its helper recorded it (undefined: not known). */
+    nativePaneCliVersion() { try {
+        return this.nativePaneLifecycle?.snapshot?.()?.cliVersion;
+    }
+    catch {
+        return undefined;
+    } }
     logNativeInputRefusal(details) {
         this.logger.warn({ component: "runtime-pane-host", reason: "expected_seq_changed", ...details }, "Native pane input refused before write");
     }
@@ -2076,6 +2216,9 @@ export class Daemon extends EventEmitter {
             this.publishWorkingState("turn_closed");
         };
     }
+    /** Register each issued HTTP credential with the same-process lifecycle owner. */
+    agentCredentialIssuer;
+    setAgentCredentialIssuer(issue) { this.agentCredentialIssuer = issue; }
     /** FleetManager and this daemon share a process, so durable begin/ACK is a direct synchronous store call. */
     setDeliveryOutboxPort(port) {
         this.deliveryOutbox = port;
@@ -2228,6 +2371,246 @@ export class Daemon extends EventEmitter {
             logger: this.logger,
         });
     }
+    handoffStore() {
+        return this.queuedHandoffStore ??= new QueuedHandoffStore(this.instanceDir);
+    }
+    /** #3030: the CLI that holds a queued hand-off; a record is settled only by a later one. */
+    handoffHolder() { return `${this.bootId}:${this.spawnGeneration}`; }
+    /**
+     * #3030: before the paste. A hand-off into a busy Claude Code / Codex queue gets its record — the transcript
+     * checkpoint before the paste, the unique leading marker and what a redelivery needs — or, for a redelivery written
+     * as an ordinary idle submission, its record moves its checkpoint here, so a crash right after this paste is still
+     * judged from the transcript that will show it. A write that did not keep a record runs as before.
+     */
+    async recordQueuedHandoff(formatted, handingOff, verdict, durableAttempt, humanVerificationId) {
+        const track = verdict.trackHandoff;
+        if (!track)
+            return;
+        if (!handingOff && !track.id) {
+            // An earlier attempt of this delivery was a hand-off; this one is an idle submission.
+            if (verdict.handoff)
+                this.dropQueuedHandoff(verdict);
+            return;
+        }
+        const backend = this.config.backend ?? this.backend?.binaryName ?? "";
+        if (!["claude-code", "codex"].includes(backend))
+            return;
+        const marker = durableAttempt ? `[agend-delivery-id:${durableAttempt.deliveryId}]`
+            : humanVerificationId ? `[agend-human-id:${humanVerificationId}]` : null;
+        if (!marker || !formatted.startsWith(marker))
+            return;
+        let found = verdict.transcriptCheckpoint ?? null;
+        if (!found) {
+            try {
+                found = await this.transcriptMonitor?.reconciliationCheckpoint() ?? null;
+            }
+            catch (err) {
+                this.logger.debug({ err }, "Could not checkpoint the transcript before a queued hand-off");
+            }
+        }
+        // main→alpha sync: a hand-off record is judged against a local transcript file. A native or remote runtime's
+        // transcript (no local path) has none: it runs as before (✅ at the hand-off), as with no checkpoint at all.
+        const checkpoint = found && typeof found.path === "string" && typeof found.offset === "number" ? { path: found.path, offset: found.offset } : null;
+        if (!checkpoint)
+            return; // nothing could judge it later: it runs as before (✅ at the hand-off)
+        const entry = {
+            id: track.id ?? randomUUID(), marker, backend, path: checkpoint.path, offset: checkpoint.offset,
+            content: track.content, meta: track.meta, holder: this.handoffHolder(), createdAt: Date.now(),
+            redeliveries: track.redeliveries ?? 0,
+        };
+        try {
+            const dropped = this.handoffStore().put(entry);
+            if (handingOff)
+                verdict.handoff = entry;
+            for (const old of dropped)
+                this.logger.warn({ handoff: old.id, createdAt: old.createdAt }, "Queued hand-off record dropped: too many on record");
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not record a queued hand-off; it runs as before (✅ at the hand-off)");
+        }
+    }
+    /**
+     * #3030: after pushChannelMessage's write. A hand-off on record whose paste went out is watched (✅ when a turn
+     * takes it); one that was never written goes. A redelivery that ended as an ordinary submission is done; one that a
+     * cancel dropped goes too (a cancel is the person's); one stopped before its write stays for the next CLI.
+     */
+    afterTrackedWrite(meta, verdict, sent, deliveryEpoch) {
+        try {
+            // A stale epoch with writes still allowed is a cancel (the person's); a stop fences writes too, and keeps records.
+            const cancelled = !this.isDeliveryEpochCurrent(deliveryEpoch) && !this.deliveryWritesStopping;
+            if (verdict.handoff) {
+                if (sent || verdict.paneWriteStarted)
+                    this.watchQueuedHandoff(verdict.handoff);
+                else if (!verdict.trackHandoff?.id || cancelled)
+                    this.dropQueuedHandoff(verdict);
+                return;
+            }
+            const id = meta.handoff_redelivery;
+            if (!id)
+                return;
+            if (sent || verdict.paneWriteStarted || cancelled) {
+                this.handoffStore().remove(id);
+                this.logger.info({ handoff: id, sent, proof: verdict.proof ?? null }, "Queued hand-off redelivered as an ordinary submission");
+            }
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not update the queued hand-off record after its write");
+        }
+    }
+    redeliveryStillOurs(meta) {
+        const holder = this.handoffHolder();
+        if (meta.handoff_holder !== holder)
+            return false;
+        try {
+            return this.handoffStore().get(meta.handoff_redelivery)?.holder === holder;
+        }
+        catch {
+            return false;
+        }
+    }
+    dropQueuedHandoff(verdict) {
+        const entry = verdict.handoff;
+        verdict.handoff = undefined;
+        if (!entry)
+            return;
+        try {
+            this.handoffStore().remove(entry.id);
+        }
+        catch (err) {
+            this.logger.warn({ err, handoff: entry.id }, "Could not remove a queued hand-off record");
+        }
+    }
+    /**
+     * #3030: the hand-off's CLI is the current one: watch its transcript for the turn that takes it (✅ then), and for an
+     * idle CLI that never did (reported). A stop ends the watch; the record stays for the next CLI to settle.
+     */
+    watchQueuedHandoff(entry) {
+        const spawn = this.spawnGeneration, fence = this.launchFenceEpoch, epoch = this.deliveryEpoch;
+        const started = consumedWatches.start({
+            deliveryId: `handoff:${entry.id}`,
+            attemptNo: entry.redeliveries,
+            backend: entry.backend,
+            path: entry.path,
+            offset: entry.offset,
+            marker: entry.marker,
+            // A cancel or stop moves the epoch: the watch ends quietly (a cancel cleared the record, a stop leaves it).
+            current: () => !this.deliveryWritesStopping && spawn === this.spawnGeneration && fence === this.launchFenceEpoch
+                && epoch === this.deliveryEpoch,
+            consumed: (via) => this.settleQueuedHandoff(entry, "taken", `transcript:${via}`),
+            idleForMs: () => this.instanceIdleSinceMono === null ? null : performance.now() - this.instanceIdleSinceMono,
+            notTaken: () => this.settleQueuedHandoff(entry, "not-taken", "transcript:absent-while-idle"),
+            // A queued message waits for the running turn, however long that is.
+            lifetimeMs: QUEUED_HANDOFF_WATCH_LIFETIME_MS,
+            logger: this.logger,
+        });
+        if (!started) {
+            // No watch (the fleet's cap): ✅ as before; the record still lets a restart judge it.
+            const status = channelStatus(entry.meta);
+            if (status)
+                this.emit("message_confirmed", status);
+        }
+    }
+    /** #3030: a record's end — taken (✅), or never taken / not judgeable (❌, told once per batch). */
+    settleQueuedHandoff(entry, outcome, proof) {
+        try {
+            this.handoffStore().remove(entry.id);
+        }
+        catch (err) {
+            this.logger.warn({ err, handoff: entry.id }, "Could not remove a settled queued hand-off record");
+        }
+        const meta = entry.meta;
+        const status = channelStatus(meta);
+        if (outcome === "taken") {
+            this.logger.info({ handoff: entry.id, proof, redeliveries: entry.redeliveries }, "Queued hand-off taken by the CLI");
+            if (status)
+                this.emit("message_confirmed", status);
+            return;
+        }
+        this.logger.warn({ handoff: entry.id, outcome, proof, redeliveries: entry.redeliveries }, "Queued hand-off was not taken by the CLI");
+        if (meta.from_instance) {
+            this.reportCrossInstanceDeliveryFailure(meta, { reached: true, phase: "handoff-not-consumed", proof: outcome === "not-taken" ? "not-taken" : "unverifiable" });
+            return;
+        }
+        if (!status)
+            return;
+        this.unsettledHandoffs[outcome].push({ chatId: status.chatId, messageId: status.messageId, ...(status.threadId ? { threadId: status.threadId } : {}) });
+        if (this.unsettledHandoffsTimer)
+            clearTimeout(this.unsettledHandoffsTimer);
+        this.unsettledHandoffsTimer = setTimeout(() => {
+            this.unsettledHandoffsTimer = null;
+            for (const reason of ["not-taken", "unverifiable"]) {
+                const messages = this.unsettledHandoffs[reason].splice(0);
+                if (messages.length)
+                    this.emit("human_handoffs_unsettled", { reason, messages });
+            }
+        }, CANCELLED_HUMANS_NOTICE_MS);
+        this.unsettledHandoffsTimer.unref?.();
+    }
+    /**
+     * #3030: right after a CLI came up — the records left by CLIs that are gone. Their queue went with them, so each is
+     * judged by its own transcript from its checkpoint: taken there (✅, nothing pasted); proven not taken (the whole
+     * delta read, the marker absent or only enqueued) → redelivered once, with the same marker, through the ordinary
+     * queue; anything that cannot be judged → never pasted, reported. Ownership is evidence: never pasted twice.
+     */
+    async reconcileQueuedHandoffs() {
+        let entries;
+        try {
+            entries = this.handoffStore().list().filter(e => e.holder !== this.handoffHolder());
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not read the queued hand-off records");
+            return;
+        }
+        if (!entries.length)
+            return;
+        // Captured before any await: a reconciliation that outlives its CLI can never claim the next CLI's holder.
+        const holder = this.handoffHolder();
+        const spawn = this.spawnGeneration, fence = this.launchFenceEpoch, epoch = this.deliveryEpoch;
+        const fresh = () => spawn === this.spawnGeneration && fence === this.launchFenceEpoch && epoch === this.deliveryEpoch
+            && !this.deliveryWritesStopping;
+        let redelivered = 0, taken = 0, unverifiable = 0;
+        for (const entry of entries) {
+            const kind = await scanTranscriptForDeliveryMarker(entry.path, entry.offset, entry.backend, { marker: entry.marker });
+            // This CLI is gone already, or a cancel came: the next CLI settles them (a cancel cleared them).
+            if (!fresh())
+                return;
+            // …and the record is still the one that was read (another reconciliation or a cancel did not change it meanwhile).
+            let current;
+            try {
+                current = this.handoffStore().get(entry.id);
+            }
+            catch {
+                current = undefined;
+            }
+            if (!current || current.holder !== entry.holder || current.redeliveries !== entry.redeliveries)
+                continue;
+            if (markerConsumed(kind)) {
+                taken++;
+                this.settleQueuedHandoff(entry, "taken", `restart-transcript:${kind}`);
+                continue;
+            }
+            if (kind === "unavailable" || entry.redeliveries >= QUEUED_HANDOFF_MAX_REDELIVERIES) {
+                unverifiable++;
+                this.settleQueuedHandoff(entry, "unverifiable", kind === "unavailable" ? "restart-transcript:unavailable" : "redelivery-limit");
+                continue;
+            }
+            // Proven not taken: the CLI that queued it is gone and its transcript, read to the end, never took it.
+            const next = { ...entry, holder, redeliveries: entry.redeliveries + 1 };
+            try {
+                this.handoffStore().put(next);
+            }
+            catch (err) {
+                this.logger.warn({ err, handoff: entry.id }, "Could not update a queued hand-off record; not redelivered now");
+                continue;
+            }
+            redelivered++;
+            // The person's receipt was settled by the first write: the redelivery carries its marker, not its receipt binding.
+            const { human_receipt_id: _r, human_owner_key: _o, human_daemon_owner: _d, human_wire_sha256: _w, ...meta } = entry.meta;
+            this.pushChannelMessage(entry.content, { ...meta, handoff_redelivery: entry.id,
+                handoff_redeliveries: String(next.redeliveries), handoff_holder: next.holder }, undefined, epoch);
+        }
+        this.logger.info({ instance: this.name, redelivered, taken, unverifiable, proof: "transcript" }, "Queued hand-offs left by the previous CLI settled");
+    }
     finishDurableSubmission(delivery, verdict) {
         // Legacy backends may accept a pane write without enough pane evidence to
         // claim submission. Keep that row inspectable instead of recording a false
@@ -2596,7 +2979,20 @@ export class Daemon extends EventEmitter {
                 // New/resumed native processes can still be painting their first frame. Keep deliveries behind the same
                 // bounded dialog/readiness scan as local startup. An already-running reattachment may be busy: do not
                 // wait for that work to finish or inject a startup key into it.
-                if (acquired.disposition !== "reattached") {
+                if (acquired.disposition === "reattached") {
+                    if (this.backend?.binaryName === "codex") {
+                        const native = this.nativePaneLifecycle, spawn = this.spawnGeneration, fence = this.launchFenceEpoch, attempt = this.launchAttempt;
+                        try {
+                            const pane = await acquired.pane.capturePane();
+                            this.startupAdmission?.();
+                            if (!this.startupAborted && !this.deliveryWritesStopping && this.nativePaneLifecycle === native && this.tmux === acquired.pane
+                                && spawn === this.spawnGeneration && fence === this.launchFenceEpoch && attempt === this.launchAttempt && native.current())
+                                this.takeQuotaReplayBaseline(pane);
+                        }
+                        catch { /* An old runner or unavailable proof keeps the existing fail-closed scanner. */ }
+                    }
+                }
+                else {
                     if (!await this.finishStartupScan(120_000))
                         throw Error("Native CLI exited during startup; retained session was not replaced");
                     this.startupAdmission?.();
@@ -2705,7 +3101,7 @@ export class Daemon extends EventEmitter {
                 this.publishActivity(null);
             });
             this.transcriptMonitor.on("api_error", (text, status, _at, errorKind) => this.noteClaudeApiError(text, status, errorKind));
-            this.transcriptMonitor.on("system_informational", (text) => this.noteClaudeInformational(text));
+            this.transcriptMonitor.on("system_informational", (text, at) => this.noteClaudeInformational(text, at));
             this.transcriptMonitor.on("user_prompt", () => this.noteClaudePrompt());
             this.transcriptMonitor.on("assistant_text", (text) => {
                 this.noteClaudeOutput();
@@ -2750,6 +3146,8 @@ export class Daemon extends EventEmitter {
             this.startErrorMonitor();
         }
         this.startInstanceStateMonitor();
+        // #3030: messages a gone CLI still had queued — judged by its transcript, redelivered once or reported.
+        void this.reconcileQueuedHandoffs().catch(err => this.logger.warn({ err }, "Queued hand-off reconciliation failed"));
         this.logger.info(`${this.name} ready`);
     }
     /**
@@ -3253,8 +3651,6 @@ export class Daemon extends EventEmitter {
                         scheduleNext();
                         return;
                     }
-                    // The CLI owns the MCP server process, so the daemon can only observe it.
-                    measureSyncWork("daemon.healthCheck", () => this.checkMcpServerAlive());
                     // Human-readable backend label for logs (e.g. "claude", "kiro-cli")
                     const cliLabel = this.backend?.binaryName ?? "CLI";
                     const healthTmux = this.tmux;
@@ -3275,6 +3671,9 @@ export class Daemon extends EventEmitter {
                     if (discardStaleHealth())
                         return;
                     if (paneStatus?.alive) {
+                        // A CLI shutdown also closes its MCP children. Revive tools only for
+                        // a positively live pane, never while its exit is being classified.
+                        measureSyncWork("daemon.healthCheck", () => this.checkMcpServerAlive());
                         // Capture only a known primary while it lives. No extra tmux call: PID comes
                         // from this same status read. Fast/unobserved deaths remain ordinary crashes.
                         const key = this.oomSessionKey();
@@ -3321,6 +3720,29 @@ export class Daemon extends EventEmitter {
                             return;
                         }
                     }
+                    // tmux marks the PTY dead when its fd closes, before SIGCHLD can fill
+                    // pane_dead_status. Claude /exit (and any other CLI) can hit this gap.
+                    // Give the status four bounded re-probes; missing is never exit zero.
+                    if (paneStatus && !paneStatus.alive && paneStatus.exitCode === undefined) {
+                        for (let attempt = 0; attempt < 4; attempt++) {
+                            await new Promise(resolve => setTimeout(resolve, 250));
+                            if (discardStaleHealth())
+                                return;
+                            const observed = await healthTmux.getPaneStatus();
+                            if (discardStaleHealth())
+                                return;
+                            if (observed)
+                                paneStatus = observed;
+                            if (paneStatus.alive || paneStatus.exitCode !== undefined)
+                                break;
+                        }
+                        if (paneStatus.alive) {
+                            this.windowQueryFailureTicks = 0;
+                            this.stormWindow?.noteWindowAlive(this.name);
+                            scheduleNext();
+                            return;
+                        }
+                    }
                     // paneStatus === null → window gone entirely (e.g. tmux server crash)
                     // paneStatus.alive === false → pane dead, exit code available
                     const exitCode = paneStatus?.exitCode;
@@ -3504,6 +3926,8 @@ export class Daemon extends EventEmitter {
                             try {
                                 await this.spawnClaudeWindow();
                                 this.setProcessStatus("running");
+                                // #3030: messages a gone CLI still had queued — judged by its transcript, redelivered once or reported.
+                                void this.reconcileQueuedHandoffs().catch(err => this.logger.warn({ err }, "Queued hand-off reconciliation failed"));
                                 this.logger.info("Recovered from background session conflict");
                                 this.emit("crash_respawn", this.name);
                             }
@@ -3663,6 +4087,8 @@ export class Daemon extends EventEmitter {
                             catch { /* may not exist */ }
                         }
                         this.setProcessStatus("running");
+                        // #3030: messages a gone CLI still had queued — judged by its transcript, redelivered once or reported.
+                        void this.reconcileQueuedHandoffs().catch(err => this.logger.warn({ err }, "Queued hand-off reconciliation failed"));
                         this.logger.info({ resumed }, `Respawned ${cliLabel} window after crash`);
                         this.emit("crash_respawn", this.name);
                         // Emit the per-instance audit event while the storm is still active
@@ -4179,7 +4605,13 @@ export class Daemon extends EventEmitter {
         for (const ep of patterns) {
             const key = Daemon.errorPatternKey(ep);
             const count = countMatches(ep.pattern);
-            const seen = this.lastErrorCount.get(key) ?? 0;
+            let seen = this.lastErrorCount.get(key) ?? 0;
+            const afterInput = this.quotaOccurrencesAfterInput(pane, ep);
+            // Only a new echo of our acknowledged input can re-arm a same-count replacement. Old rows before that echo,
+            // an ambiguous/missing marker or a superseded input owner retain the ordinary count-based decision.
+            const newQuotaAfterInput = !!afterInput && afterInput.count > (afterInput.input.reported.get(key) ?? 0);
+            if (newQuotaAfterInput)
+                seen = Math.min(seen, count - 1);
             // #2282: a resumed exhausted429 row is history, not even a new
             // notification/failover incident; so is a resumed codex workspace-limit row
             // (#2844: a wake must not pause again on it). Wait for the first live
@@ -4201,7 +4633,7 @@ export class Daemon extends EventEmitter {
             // the lifecycle, whose usage probe decides (available / reserve / exhausted).
             if (Daemon.isCodexUsageLimitPause(ep)) {
                 const ack = this.codexReserveAck;
-                if (ack && ack.generation === this.spawnGeneration && count <= ack.count) {
+                if (ack && ack.generation === this.spawnGeneration && count <= ack.count && !newQuotaAfterInput) {
                     // The handled incident's lines can scroll out of the capture buffer as
                     // the reserve session talks on. Lower the proof (and the occurrence
                     // baseline) with them: otherwise `count <= ack.count` would keep
@@ -4242,6 +4674,8 @@ export class Daemon extends EventEmitter {
                 continue;
             }
             this.lastErrorCount.set(key, count);
+            if (afterInput)
+                afterInput.input.reported.set(key, Math.max(afterInput.input.reported.get(key) ?? 0, afterInput.count));
             // Kiro's `auto` model picks a concrete model per turn and reroutes around
             // a temporarily unavailable one on its own — telling the user to run
             // /model would ask them to fix something the CLI is already handling.
@@ -4375,6 +4809,14 @@ export class Daemon extends EventEmitter {
         // (Completion paths clear via the guard's onComplete; a cancel with no
         // later idle edge would otherwise leave the marker behind.)
         clearInFlightTurnMarker(this.instanceDir);
+        // #3030: what the person cancelled is not kept for a redelivery (nor reported as not taken).
+        try {
+            for (const entry of this.handoffStore().list())
+                this.handoffStore().remove(entry.id);
+        }
+        catch (err) {
+            this.logger.warn({ err }, "Could not clear queued hand-off records on cancel");
+        }
         this.deliveryEpoch = fleetEpoch === undefined
             ? this.deliveryEpoch + 1
             : Math.max(this.deliveryEpoch, fleetEpoch);
@@ -5803,6 +6245,10 @@ export class Daemon extends EventEmitter {
         if (snapshot.state === "working" && this.recoveryBootSettled
             && this.workingRecoveryInputOwner !== JSON.stringify(this.interactionOwner()))
             this.recoveryNativeWork = true;
+        if (snapshot.state !== "idle")
+            this.instanceIdleSinceMono = null;
+        else if (this.instanceState !== "idle" || this.instanceIdleSinceMono === null)
+            this.instanceIdleSinceMono = performance.now();
         this.instanceState = snapshot.state;
         this.acceptedInstanceSnapshot = { ...snapshot };
         // Reuse an already-captured pane and the backend's pure parser, never capture for the journal.
@@ -5914,7 +6360,7 @@ export class Daemon extends EventEmitter {
      * message can arrive mid-turn and sit queued, and marking at arrival would let
      * the PREVIOUS turn's idle edge consume (and reset) the new turn's state.
      */
-    markTurnStarted(meta, deliveredText, deliveryEpoch = this.deliveryEpoch) {
+    markTurnStarted(meta, deliveredText, deliveryEpoch = this.deliveryEpoch, queuedHandoff = false) {
         // Cancel may have interrupted an in-flight paste before its promise settled.
         // Its late success must not re-arm the turn that the user just cancelled.
         if (!this.isDeliveryEpochCurrent(deliveryEpoch))
@@ -5962,7 +6408,9 @@ export class Daemon extends EventEmitter {
         // during the continuation boots clean instead of chaining resumes.
         // #2544: a reply that settled before this arm already answered the person —
         // writing a marker would re-inject a continuation for a finished turn.
-        if (!this.nativePaneLifecycle && !meta.resumedContinuationOf && !armed.completionDelivered) {
+        // #3030: a message only queued in the busy CLI has not started a turn: the interrupted turn is still the running one,
+        // and a queued message lost to a restart is the hand-off record's to redeliver, not a continuation's.
+        if (!this.nativePaneLifecycle && !meta.resumedContinuationOf && !armed.completionDelivered && !queuedHandoff) {
             const resumeBackend = this.config.backend ?? this.backend?.binaryName ?? this.runtimeIdentity?.backend;
             const resumeCwd = this.config.working_directory ?? "";
             writeInFlightTurnMarker(this.instanceDir, {
@@ -7367,10 +7815,12 @@ export class Daemon extends EventEmitter {
         // Command name only — never the arguments. See shellCommandLabel.
         if (name === "Bash")
             return `$ ${shellCommandLabel(String(inp.command ?? ""))}`;
+        // The tool name only — never the search pattern: it can be a literal secret someone is looking for, and this label
+        // reaches the channel's progress line.
         if (name === "Glob")
-            return `Glob ${inp.pattern ?? ""}`;
+            return "Glob";
         if (name === "Grep")
-            return `Grep ${inp.pattern ?? ""}`;
+            return "Grep";
         if (name === "Agent")
             return "Agent (subagent)";
         if (name.startsWith("mcp__agend__"))
@@ -7741,6 +8191,13 @@ export class Daemon extends EventEmitter {
                 if (!this.isDeliveryEpochCurrent(deliveryEpoch)) {
                     this.logger.info("Pending channel delivery dropped by user cancel");
                     this.deferDurableDelivery(meta, "delivery epoch changed while queued");
+                    // #3030: a cancel is the person's — a queued redelivery it dropped is not redelivered later.
+                    if (meta.handoff_redelivery && !this.deliveryWritesStopping) {
+                        try {
+                            this.handoffStore().remove(meta.handoff_redelivery);
+                        }
+                        catch { /* the next CLI judges it */ }
+                    }
                     return;
                 }
                 if (this.config.pre_task_command) {
@@ -7751,13 +8208,26 @@ export class Daemon extends EventEmitter {
                 // #2800: with this real message, in the same paste — never a paste or turn of its own: after its delivery marker
                 // (transcript proof anchors on it), before the message. A person's message with a verified receipt is pasted
                 // byte for byte (its proof is the wire's hash), so the notice waits for the next delivery without one.
-                const whatsNew = this.pendingWhatsNew && !meta.human_receipt_id ? this.currentWhatsNew(this.pendingWhatsNew) : null;
+                const whatsNew = this.pendingWhatsNew && !meta.human_receipt_id && !meta.handoff_redelivery
+                    ? this.currentWhatsNew(this.pendingWhatsNew) : null;
                 const pasted = whatsNew ? withWhatsNew(formatted, whatsNew.notice) : formatted;
                 const status = channelStatus(meta);
                 // A fresh delivery begins a fresh turn — its bubble must not inherit
                 // the previous turn's tool list.
                 this.resetToolProgress();
                 verdict = { reached: false, humanReceipt: this.humanReceiptAttempt(meta, formatted) };
+                // #3030: a hand-off into the CLI's own queue stays on record until a turn takes it (redeliveries included).
+                if (!content.startsWith("/raw ") || meta.from_instance) {
+                    const { handoff_redelivery: redeliveryOf, handoff_redeliveries: redeliveries, handoff_holder: _holder, ...kept } = meta;
+                    verdict.trackHandoff = { content, meta: kept,
+                        ...(redeliveryOf ? { id: redeliveryOf, redeliveries: Number(redeliveries) || 0 } : {}) };
+                }
+                // #3030: a redelivery is written only by the CLI it was issued for, and only while its record still says so —
+                // one queued for a CLI that was replaced meanwhile is that next CLI's reconciliation's to judge again.
+                if (meta.handoff_redelivery && !this.redeliveryStillOurs(meta)) {
+                    this.logger.info({ handoff: meta.handoff_redelivery }, "Queued hand-off redelivery dropped: its CLI was replaced before the write");
+                    return;
+                }
                 const durableAttempt = this.durableDeliveryAttempt(meta, content);
                 if (durableAttempt === false) {
                     this.deferDurableDelivery(meta, "invalid durable delivery attempt metadata");
@@ -7780,10 +8250,11 @@ export class Daemon extends EventEmitter {
                     if (whatsNew && (sent || verdict.paneWriteStarted))
                         this.recordWhatsNewSent(whatsNew);
                 }
+                this.afterTrackedWrite(meta, verdict, !!sent, deliveryEpoch);
                 if (sent) {
                     delivered = true;
                     this.finishDurableSubmission(durable, verdict);
-                    this.markTurnStarted(meta, formatted, deliveryEpoch);
+                    this.markTurnStarted(meta, formatted, deliveryEpoch, !!verdict.handoff);
                 }
                 else if (durableAttempt && verdict.paneWriteStarted) {
                     this.finishDurableDelivery(durable, "uncertain", `${verdict.phase ?? "post-submit"}:${verdict.proof ?? "unproven"}`, verdict);
@@ -10274,6 +10745,17 @@ export class Daemon extends EventEmitter {
                     }
                 }
             }
+            // #3030: a hand-off into a busy CLI's own queue is on record before its paste (write-ahead): that queue lives only
+            // in the CLI process, and a stop before a turn takes it would lose it without a trace.
+            if (verdict.trackHandoff && !rawPaste) {
+                await this.recordQueuedHandoff(formatted, handingOffToNativeQueue, verdict, durableAttempt, humanVerificationId);
+                if (stillCurrent && !stillCurrent()) {
+                    if (!verdict.trackHandoff.id)
+                        this.dropQueuedHandoff(verdict);
+                    verdict.fenced = !verdict.durableBeginCommitted;
+                    return false;
+                }
+            }
             if (lookBeforePaste) {
                 await lookBeforePaste();
                 // The look awaited: this attempt is still this write's — the same fence, tmux and launch — or nothing is written.
@@ -10440,6 +10922,7 @@ export class Daemon extends EventEmitter {
                     return this.failDelivery(verdict, status, "submit-enter", "pre-enter-deadline");
                 return this.failDelivery(verdict, status, "submit-enter", "tmux-send-keys-failed");
             }
+            this.commitPreInputQuotaHistory(pasteBaseline);
             // The proof's whole budget, from the Enter: every capture and dialog probe inside it, a late answer dropped.
             const steerProofDeadline = performance.now() + NATIVE_QUEUE_PASTE_VERIFY_MS + POST_ENTER_PROOF_WINDOW_MS;
             // Kiro's legacy TUI can swallow Enter while it is still processing a large
@@ -10521,8 +11004,9 @@ export class Daemon extends EventEmitter {
                 }
                 const proof = await this.confirmSubmitted(signature, pasteBaseline);
                 if (proof === "submitted") {
-                    if (status)
-                        this.emit("message_confirmed", status); // ✅ native queue accepted
+                    // ✅ native queue accepted — unless it is on record (#3030): then ✅ waits for the turn that takes it.
+                    if (status && !verdict.handoff)
+                        this.emit("message_confirmed", status);
                     return true;
                 }
                 if (proof === "unverifiable") {
@@ -10554,8 +11038,8 @@ export class Daemon extends EventEmitter {
                     this.logger.warn("Paste reached the pane but could not be verified as submitted — accepting without proof");
                     verdict.phase = "best-effort-submission";
                     verdict.proof = "unverified";
-                    if (status)
-                        this.emit("message_confirmed", status); // ✅ (best-effort)
+                    if (status && !verdict.handoff)
+                        this.emit("message_confirmed", status); // ✅ (best-effort; on record: when taken, #3030)
                     return true;
                 }
                 // raw_paste has no unique marker and is not allowed to re-paste or
@@ -10570,6 +11054,10 @@ export class Daemon extends EventEmitter {
                 // confirmation ladder. "stranded" is the case that used to be a silent
                 // ✅ — the text was visible, so the old check called it delivered.
                 this.logger.warn({ proof }, "Native-queue paste not confirmed as submitted — retrying via idle-gated delivery");
+                // #3030: what follows is an idle submission (or a failure the caller reports): no longer a queued hand-off.
+                if (verdict.handoff && !verdict.trackHandoff?.id)
+                    this.dropQueuedHandoff(verdict);
+                verdict.handoff = undefined;
                 if (windowId && this.controlClient && !(await this.controlClient.waitUntilIdle(windowId))) {
                     verdict.phase = "native-queue-idle-wait";
                     verdict.proof = "idle-wait-failed";
@@ -11161,12 +11649,18 @@ export class Daemon extends EventEmitter {
     async capturePaneEvidence(signature) {
         if (!this.tmux)
             return null;
+        const owner = this.tmux, window = owner.getWindowId?.(), spawn = this.spawnGeneration, fence = this.launchFenceEpoch, launch = this.launchAttempt;
         // Bounded re-probe: a capture that fails here costs the delivery its only
         // "before" picture, and a momentary failure should not decide anything.
         for (let attempt = 1; attempt <= BASELINE_CAPTURE_ATTEMPTS; attempt++) {
             try {
                 const pane = await this.tmux.capturePane();
                 const evidence = this.paneEvidence(pane, signature);
+                if (owner === this.tmux && window === owner.getWindowId?.() && spawn === this.spawnGeneration && fence === this.launchFenceEpoch && launch === this.launchAttempt) {
+                    const counts = this.paneQuotaPatterns().map(ep => ({ key: Daemon.errorPatternKey(ep), count: Daemon.countOccurrences(ep.pattern, pane) }));
+                    if (counts.length)
+                        evidence.quotaHistory = { spawn, fence, attempt: launch, tmux: owner, window, counts, marker: signature.value, occurrences: evidence.payload };
+                }
                 const input = this.inputRegion(pane);
                 if (input && agendMessageInInput(input.text)) {
                     // Whatever we paste now lands after it, and one Enter submits both as
@@ -11290,6 +11784,10 @@ export class Daemon extends EventEmitter {
             if (!current() || !guard.accept(pane))
                 return false;
             baseline = this.paneEvidence(pane, signature);
+            if (native && this.backend?.binaryName === "codex") {
+                const counts = this.paneQuotaPatterns().map(ep => ({ key: Daemon.errorPatternKey(ep), count: Daemon.countOccurrences(ep.pattern, pane) }));
+                baseline.quotaHistory = { spawn: ownerGeneration, fence: ownerFence, attempt: this.launchAttempt, tmux: ownerTmux, window: ownerWindow, counts, marker: signature.value, occurrences: baseline.payload };
+            }
         }
         else {
             baseline = await this.capturePaneEvidence(signature);
@@ -11308,6 +11806,7 @@ export class Daemon extends EventEmitter {
         await new Promise(r => setTimeout(r, NORMAL_ENTER_SETTLE_MS));
         if (!(await this.sendDeliveryEnter(label, current)))
             return false;
+        this.commitPreInputQuotaHistory(baseline);
         let proof = await this.confirmSubmitted(signature, baseline);
         if (current && !current())
             return false;
@@ -12183,6 +12682,9 @@ export class Daemon extends EventEmitter {
         }
         this.cancelCapacityNudge("the instance was stopped, paused or respawned");
         this.lastErrorEpisode = null;
+        this.quotaReplay = null;
+        this.nativeQuotaReplayTaken = false;
+        this.quotaInput = null;
         this.nudgeBaselines = null;
         // A relaunch settles any outstanding quit watch: the CLI came back.
         this.clearQuitRelaunchWatch();
@@ -13052,7 +13554,12 @@ export class Daemon extends EventEmitter {
                 || this.startupAborted || this.deliveryWritesStopping || this.runtimeMonitorsFrozen || this.healthCheckPaused)) {
                 throw new Error("OOM recovery cancelled: the instance was stopped, paused or replaced while memory was unavailable");
             }
-            return this.trySpawnInsideGate(reuseWindow, startupTimeoutMs);
+            return this.trySpawnInsideGate(reuseWindow, startupTimeoutMs).catch(err => {
+                // Includes an in-place binary replacement during asynchronous launch preparation.
+                if (err instanceof KiroCompatibilityError)
+                    this.emit("kiro_compatibility_hold", err.message);
+                throw err;
+            });
         };
         const ready = !this.spawnGate ? await enter() : await this.spawnGate.run({
             instanceName: this.name,
@@ -13277,6 +13784,11 @@ export class Daemon extends EventEmitter {
         this.startupAdmission?.();
         const launchFence = this.launchFenceEpoch;
         const backendConfig = this.buildBackendConfig();
+        // A compatibility refusal is not a failed resume: no configuration, pin, history or pane may change.
+        if (this.backend?.assertLaunchSupported) {
+            this.backend.assertLaunchSupported(backendConfig);
+            this.emit("kiro_compatibility_hold", null);
+        }
         // #1633: decided before prev-instructions is first written — its absence is what says "never launched before".
         this.prepareWhatsNew(!existsSync(join(this.instanceDir, "prev-instructions")));
         // Record what this launch writes. #2787: a change is never announced in the pane; the CLI takes the new
@@ -13313,6 +13825,7 @@ export class Daemon extends EventEmitter {
         const agentTokenPath = join(this.instanceDir, "agent.token");
         const agentToken = randomBytes(32).toString("hex");
         const tokenWrite = writeSecretFile(agentTokenPath, agentToken);
+        this.agentCredentialIssuer?.(agentToken);
         if (!tokenWrite.ok) {
             // Do not fail the spawn over it — an instance that cannot start is worse
             // than one whose token is readable. But say so, loudly: the whole point of
@@ -13358,6 +13871,8 @@ export class Daemon extends EventEmitter {
         // Every launched command re-arms the passive-transient check, including a
         // retry inside the same spawn: its load is a new one.
         this.launchAttempt++;
+        await this.prepareQuotaReplayHistory(reuseWindow);
+        this.startupAdmission?.();
         this.interactionObservation.reset(this.interactionOwner());
         this.clearInteractionConfirmation();
         // A launch that cannot paint a passive transient (Codex: a fresh start
@@ -13514,6 +14029,7 @@ export class Daemon extends EventEmitter {
         let lastDialog = null;
         let lastTransient = null;
         let captureFailures = 0;
+        let lastPane = null;
         let attempts = 0;
         // A safety-critical startup choice is one-shot. If the CLI has not
         // repainted after Enter, let the following hold-only entry report it
@@ -13537,11 +14053,13 @@ export class Daemon extends EventEmitter {
             try {
                 pane = await this.tmux.capturePane();
                 this.startupAdmission?.();
+                lastPane = pane;
             }
             catch (err) {
                 this.startupAdmission?.();
                 // Transient tmux trouble is not evidence about the CLI. Returning false
                 // here would clear the session; retry within the budget instead.
+                lastPane = null;
                 captureFailures++;
                 this.logger.debug({ err, captureFailures }, "capture-pane failed during the startup dialog scan — retrying");
                 // Only a POSITIVE dead pane ends the scan; an unanswerable liveness
@@ -13720,6 +14238,8 @@ export class Daemon extends EventEmitter {
                         // matched above, before this check) means the fatal screen is gone,
                         // e.g. the user fixed the config and the instance respawned.
                         this.fatalStartupBlocked = false;
+                        if (owned())
+                            this.takeQuotaReplayBaseline(pane);
                         return true;
                     }
                     await sleep();
@@ -13758,6 +14278,8 @@ export class Daemon extends EventEmitter {
             this.logger.warn({ attempts, budgetMs, captureFailures }, "Startup scan exhausted without a ready prompt or a known dialog — assuming ready (unknown CLI screen)");
         }
         this.startupAdmission?.();
+        if (owned() && lastPane !== null && !lastDialog && !lastTransient)
+            this.takeQuotaReplayBaseline(lastPane);
         return true;
     }
     /**