unsnooze 1.19.0 → 1.19.2

package/src/launcher.js

@@ -8,7 +8,7 @@ import { spawn, spawnSync } from 'node:child_process';
 import { getMultiplexer } from './multiplexer.js';
 import { getAgent } from './agents/index.js';
 import { getConfig, resolveLaunchExtraArgs } from './settings.js';
-import { spawnDetached, monitorSpawnArgs } from './spawn.js';
+import { spawnDetached, monitorSpawnArgs, ensureDaemon } from './spawn.js';
 import { makeLogger } from './logger.js';
 import { createLeaseId, processBirth, writeLease, removeLease } from './lease.js';
 import { recordOwnedSession } from './mux-sessions.js';
@@ -36,13 +36,32 @@ export function resolvePaneOwner(muxName, env = process.env) {
   return null;
 }
 
+// A headless revival runs this launcher detached, with no console and no
+// terminal on any stdio. On Windows the agent would then be given a console
+// window of its own — an empty window popping up on the desktop at every
+// reset, which closing kills the revival. Hide it there. Whenever a terminal
+// is attached nothing changes: the agent, a console program, shares the
+// launcher's console, and windowsHide only affects a console Windows creates.
+export function hideAgentWindow(streams = process) {
+  return !(streams.stdin?.isTTY || streams.stdout?.isTTY || streams.stderr?.isTTY);
+}
+
 function runUnwatched(agent, args, reason) {
   if (reason) process.stderr.write(`unsnooze: ${reason}\n`);
+  return runPassthrough(agent, args);
+}
+
+// spawnSync reports a binary it could not start as r.error with no status;
+// `r.status ?? 1` alone turned `spawn codex ENOENT` into a silent exit 1.
+function runPassthrough(agent, args) {
   const r = spawnSync(agent.bin, args, { stdio: 'inherit', env: { ...process.env, UNSNOOZE_ACTIVE: '1' } });
+  if (r.error) return launchFailed(agent, r.error);
   return r.status ?? 1;
 }
 
-export function runLauncher(args, agentId = 'claude', { processBirthFn = processBirth } = {}) {
+export function runLauncher(args, agentId = 'claude', {
+  processBirthFn = processBirth, ensureDaemonFn = ensureDaemon,
+} = {}) {
   const agent = getAgent(agentId);
 
   // Recursion / nested-launch guard: inside an unsnooze-managed session, a
@@ -54,8 +73,7 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
   // or spawning a watcher for `claude --help` flashes the screen and slows down
   // simple queries.
   if (process.env.UNSNOOZE_ACTIVE === '1' || isPassthrough(args) || !getConfig(`agents.${agent.id}`)) {
-    const r = spawnSync(agent.bin, args, { stdio: 'inherit', env: { ...process.env, UNSNOOZE_ACTIVE: '1' } });
-    return r.status ?? 1;
+    return runPassthrough(agent, args);
   }
 
   // Flags the user wants on every session they start (claude's --autocompact
@@ -116,6 +134,12 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
     }
   }
 
+  // Nothing keeps the daemon running on native Windows (see ensureDaemon), so
+  // every watched launch makes sure it is. Here, past the re-exec above, so a
+  // launch that wraps itself asks once, not twice. A no-op everywhere else,
+  // and until `install --daemon` has asked for the daemon.
+  ensureDaemonFn();
+
   const rawPane = mux.currentPaneId();
   const paneOwner = resolvePaneOwner(mux.name, process.env);
   // A backend may know it cannot safely address the pane it is sitting in —
@@ -166,10 +190,17 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
     UNSNOOZE_PANE: pane || '', UNSNOOZE_PANE_OWNER: paneOwner || '',
     UNSNOOZE_LEASE_ID: leaseId,
   };
-  const child = spawn(agent.bin, args, {
-    stdio: 'inherit',
-    env: childEnv,
-  });
+  // The bin can be a path we resolved ourselves (a Windows .cmd shim, say).
+  // Node ≥ 20.12 refuses to spawn .bat/.cmd without a shell, and depending on
+  // the version that is a synchronous throw rather than an 'error' event —
+  // either way it has to come out as the same "failed to launch" line, with
+  // the reason, never as a crash with no exit code for the resumer to read.
+  let child;
+  try {
+    child = spawn(agent.bin, args, { stdio: 'inherit', env: childEnv, windowsHide: hideAgentWindow() });
+  } catch (err) {
+    return launchFailed(agent, err);
+  }
   const lease = pane && child.pid ? {
     leaseId, mux: mux.name, paneOwner, pane, agent: agent.id,
     pid: child.pid, pidBirth: processBirthFn(child.pid),
@@ -186,8 +217,19 @@ export function runLauncher(args, agentId = 'claude', { processBirthFn = process
     child.on('exit', code => { cleanup(); resolve(code ?? 1); });
     child.on('error', err => {
       cleanup();
-      process.stderr.write(`unsnooze: failed to launch ${agent.bin}: ${err.message}\n`);
-      resolve(127);
+      resolve(launchFailed(agent, err));
     });
   });
 }
+
+// One place for the message, because the resumer reads it back out of the
+// headless log when a revival dies (#25). 127 like a shell's "command not
+// found"; the hint names the one misconfiguration that produces EINVAL here.
+function launchFailed(agent, err) {
+  process.stderr.write(`unsnooze: failed to launch ${agent.bin}: ${err.message}\n`);
+  if (/\.(cmd|bat)$/i.test(String(agent.bin))) {
+    process.stderr.write(`unsnooze: ${agent.bin} is a .cmd/.bat shim, which cannot be launched directly — `
+      + `point UNSNOOZE_${agent.id.toUpperCase()}_BIN at the .exe\n`);
+  }
+  return 127;
+}

package/src/monitor.js

@@ -18,6 +18,7 @@ import {
 } from './config.js';
 import { detectLimit, isBusy, overloadMatch, modelRemedy } from './patterns.js';
 import { getAgent } from './agents/index.js';
+import { pendingCodexPrompt } from './agents/codex.js';
 import { getConfig } from './settings.js';
 import { notify } from './notify.js';
 import { parseResetTime, resetAtMs, sourceRank } from './time-parser.js';
@@ -327,6 +328,16 @@ export function createMonitor({
     const visible = mux.capturePaneVisible
       ? await mux.capturePaneVisible(pane).catch(() => '')
       : text;
+    if (agent.id === 'codex' && Object.values(readState().sessions).some(rec =>
+      rec.agent === 'codex' && rec.mux === muxName && rec.pane === pane
+      && rec.paneOwner === paneOwner && (rec.leaseId ?? null) === leaseId
+      && ['resuming', 'failed'].includes(rec.status)
+      && pendingCodexPrompt(visible, rec.pendingPrompt))) {
+      // The resumer owns this unsubmitted draft. Its old banner is not a new
+      // stop; refreshing detectedAt here would invalidate the submit retry.
+      firstTick = false;
+      return;
+    }
     if (agent.menu && agent.menu.isPrompt(visible, PANE_SCAN_LINES)) {
       if (!getConfig('menuAutoAnswer')) {
         // Watch-only mode: record the stop (reset time may not be visible

package/src/multiplexers/headless.js

@@ -18,7 +18,10 @@
 //     session sweep skips headless rather than claiming to own anything.
 
 import { spawn } from 'node:child_process';
-import { mkdirSync, openSync } from 'node:fs';
+import {
+  mkdirSync, openSync, closeSync, readSync, statSync, readFileSync, writeFileSync,
+  renameSync, unlinkSync, readdirSync,
+} from 'node:fs';
 import { join } from 'node:path';
 
 import { HEADLESS_LOG_DIR } from '../config.js';
@@ -27,6 +30,12 @@ export const SUBMIT_DELAY_MS = 0;   // nothing is ever typed
 
 const PID_PREFIX = 'pid:';
 
+// How long a recorded exit stays on disk. A revival is verified ~20s after
+// launch and retried within the hour; a day covers a daemon that was asleep.
+const EXIT_TTL_MS = 24 * 3_600_000;
+// Enough of the child's own output to say why it died, never the whole log.
+const EXIT_OUTPUT_BYTES = 4096;
+
 export function parsePidAddress(pane) {
   if (typeof pane !== 'string' || !pane.startsWith(PID_PREFIX)) return null;
   const pid = Number.parseInt(pane.slice(PID_PREFIX.length), 10);
@@ -60,6 +69,64 @@ export function createHeadless({
   env = process.env,
   platform = process.platform,
 } = {}) {
+  const exitsDir = join(logDir, 'exits');
+  const exitPath = pid => join(exitsDir, `${pid}.json`);
+
+  function writeExit(pid, record) {
+    try {
+      mkdirSync(exitsDir, { recursive: true, mode: 0o700 });
+      const tmp = join(exitsDir, `.${pid}.${process.pid}.tmp`);
+      writeFileSync(tmp, JSON.stringify(record), { mode: 0o600 });
+      renameSync(tmp, exitPath(pid));
+    } catch { /* evidence only — a revival must never fail on bookkeeping */ }
+  }
+
+  function readExit(pid) {
+    try {
+      const parsed = JSON.parse(readFileSync(exitPath(pid), 'utf-8'));
+      return parsed && typeof parsed === 'object' && parsed.pid === pid ? parsed : null;
+    } catch {
+      return null;
+    }
+  }
+
+  function pruneExits(now = Date.now()) {
+    let names;
+    try { names = readdirSync(exitsDir); } catch { return; }
+    for (const name of names) {
+      if (!name.endsWith('.json')) continue;
+      const path = join(exitsDir, name);
+      try {
+        if (now - statSync(path).mtimeMs > EXIT_TTL_MS) unlinkSync(path);
+      } catch { /* raced or gone */ }
+    }
+  }
+
+  // The last lines the child wrote to the shared log, read between the offsets
+  // recorded at its launch and at its exit. The upper bound matters: the
+  // resumer staggers revivals 8s apart and verifies 20s later, so a revival
+  // that died at once is read back after the next one has written its own
+  // lines into the same log. (One running alongside it can still interleave.)
+  function childOutput(exit) {
+    if (!exit.log || !Number.isFinite(exit.from)) return null;
+    let fd;
+    try {
+      const { size } = statSync(exit.log);
+      const end = Number.isFinite(exit.to) ? Math.min(exit.to, size) : size;
+      const start = Math.max(exit.from, end - EXIT_OUTPUT_BYTES);
+      if (end <= start) return null;
+      fd = openSync(exit.log, 'r');
+      const buf = Buffer.alloc(end - start);
+      const n = readSync(fd, buf, 0, buf.length, start);
+      const lines = buf.toString('utf-8', 0, n).split(/\r?\n/).map(l => l.trim()).filter(Boolean);
+      return lines.length ? lines.slice(-3).join(' | ') : null;
+    } catch {
+      return null;
+    } finally {
+      if (fd !== undefined) closeSync(fd);
+    }
+  }
+
   const backend = {
     name: 'headless',
     SUBMIT_DELAY_MS,
@@ -95,24 +162,105 @@ export function createHeadless({
 
     // A revive is just a detached child. Its output goes to a per-session log
     // because there is no scrollback to read it out of later.
+    //
+    // The child's exit is recorded next to that log (exits/<pid>.json). With no
+    // pane to capture, an empty capture proves nothing — verifyOne used to read
+    // it as a cleared banner and mark a launcher that had died with `spawn
+    // codex ENOENT` as resumed (#25). The exit record, plus the slice of the
+    // log the child wrote, is what paneOutcome() answers with instead.
     async newWindow(sessionName, cwd, launchSpec) {
       // 0700/0600: this log is the entire stdout+stderr of an unattended
       // agent run — the most revealing thing under the state dir.
       mkdirSync(logDir, { recursive: true, mode: 0o700 });
       const logPath = join(logDir, `${sessionName}.log`);
       const fd = openSync(logPath, 'a', 0o600);
-      const child = spawner(launchSpec.file, launchSpec.args || [], {
-        cwd,
-        detached: true,
-        stdio: ['ignore', fd, fd],
-        env: { ...env, ...launchSpec.env },
-        windowsHide: true,
-      });
+      // The log is shared by every revival into this session name, so remember
+      // where this child's output starts.
+      let from = 0;
+      try { from = statSync(logPath).size; } catch { /* just created */ }
+      // The child gets this process's environment — the one backend that
+      // passes it through. A resumer spawned by the StopFailure hook runs in
+      // claude's, which carries UNSNOOZE_ACTIVE=1: the launcher's "nested
+      // call, pass straight through" marker. A revival is a fresh top-level
+      // launch; with the marker it dropped launchExtraArgs and, on a spawn
+      // failure, exited 1 without saying why.
+      const childEnv = { ...env, ...launchSpec.env };
+      delete childEnv.UNSNOOZE_ACTIVE;
+      let child;
+      try {
+        child = spawner(launchSpec.file, launchSpec.args || [], {
+          cwd,
+          detached: true,
+          stdio: ['ignore', fd, fd],
+          env: childEnv,
+          windowsHide: true,
+        });
+      } finally {
+        // The child has its own copy; the daemon's would otherwise stay open
+        // for the life of the process, one descriptor per revival.
+        try { closeSync(fd); } catch { /* already closed */ }
+      }
+      const pid = child?.pid;
+      const startedAt = Date.now();
+      let spawnError = null;
+      // Listen before anything below can throw. A spawn that fails — the
+      // session's cwd was a worktree that has since been deleted, say — says
+      // so with an 'error' event after spawn() has returned, and an 'error'
+      // nobody listens for is an uncaught exception: the daemon dies with it.
+      if (typeof child?.on === 'function') {
+        const record = (code, signal, error) => {
+          if (!pid) return;
+          // Where this child's output ends in the shared log (childOutput).
+          let to = null;
+          try { to = statSync(logPath).size; } catch { /* gone */ }
+          writeExit(pid, {
+            pid, code, signal: signal ?? null, error: error ?? null,
+            startedAt, at: Date.now(), log: logPath, from, to,
+          });
+        };
+        child.on('exit', (code, signal) => record(code, signal, null));
+        child.on('error', err => {
+          spawnError = err;
+          record(null, null, err?.message || String(err));
+        });
+      }
       if (typeof child?.unref === 'function') child.unref();
-      if (!child?.pid) {
-        throw new Error(`unsnooze: headless launch of ${launchSpec.file} produced no pid`);
+      if (!pid) {
+        // The reason arrives on the next tick; wait for it so the record's
+        // lastError says why, not just that there was no pid.
+        await new Promise(resolve => setImmediate(resolve));
+        throw new Error(`unsnooze: headless launch of ${launchSpec.file} produced no pid`
+          + (spawnError ? ` (${spawnError.message})` : ''));
       }
-      return { pane: `${PID_PREFIX}${child.pid}`, paneOwner: null, session: sessionName };
+      // A recycled pid must not inherit an old exit. Best-effort, like the
+      // pruning: an exit record is evidence, never something a launch needs.
+      // (No event can have fired yet — nothing above has yielded since spawn.)
+      try { unlinkSync(exitPath(pid)); } catch { /* none */ }
+      pruneExits();
+      return { pane: `${PID_PREFIX}${pid}`, paneOwner: null, session: sessionName };
+    },
+
+    // What became of a revival: { exited: false } while it runs, and once it is
+    // gone { exited: true, code, signal, output } from the recorded exit, where
+    // output is the tail of what the child itself wrote. null when the process
+    // is gone and nothing was recorded (a resumer that was not the parent) —
+    // the caller then knows exactly as much as it did before.
+    async paneOutcome(pane) {
+      const pid = parsePidAddress(pane);
+      if (pid === null) return null;
+      // The record first: newWindow clears any old one for this pid at spawn,
+      // so a record here is our child's exit — even if the pid has since been
+      // handed to another process (Windows recycles them quickly), which a
+      // liveness check alone would read as our revival still running.
+      const exit = readExit(pid);
+      if (!exit) return alive(pid) ? { exited: false } : null;
+      return {
+        exited: true,
+        code: exit.code ?? null,
+        signal: exit.signal ?? null,
+        error: exit.error ?? null,
+        output: childOutput(exit),
+      };
     },
 
     // Nothing to wrap into: the user's own terminal is the session. Returning

package/src/resumer.js

@@ -9,13 +9,14 @@ import { homedir } from 'node:os';
 import { spawnSync } from 'node:child_process';
 import { getMultiplexer, backendCanType } from './multiplexer.js';
 import {
-  RESUMER_LOCK, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS, ensureStateDir,
+  RESUMER_LOCK, POLL_INTERVAL_MS, STAGGER_MS, VERIFY_DELAY_MS, HEADLESS_SETTLE_MS, ensureStateDir,
   BUSY_DEFER_MS, MAX_BUSY_DEFERS, MAX_RESUME_ATTEMPTS, READY_TIMEOUT_MS,
   CAPTURE_LINES, PANE_SCAN_LINES, RESUME_SESSION_NAME,
   RESET_MARGIN_MS, FALLBACK_RESET_MS, PROBE_INTERVAL_MS, PROBE_MAX_MS,
 } from './config.js';
 import { detectLimit, isBusy, modelRemedy } from './patterns.js';
 import { getAgent } from './agents/index.js';
+import { pendingCodexPrompt } from './agents/codex.js';
 import { parseResetTime, resetAtMs, nextProbeDelayMs } from './time-parser.js';
 import {
   readState, updateState, setStatus, dueSessions, activeStopped,
@@ -123,6 +124,15 @@ export function resolveRecordMux(rec) {
   return getMultiplexer(rec.mux, { owner: rec.paneOwner });
 }
 
+// The user's resumeExtraArgs, placed where the adapter's command parses them:
+// appended, unless the adapter names an index (codex's `exec resume` takes
+// its options after `exec`, not after the prompt).
+function withResumeExtraArgs(resume, agentId) {
+  const extra = resolveResumeExtraArgs(agentId);
+  const at = Number.isInteger(resume.extraArgsAt) ? resume.extraArgsAt : resume.args.length;
+  return [...resume.args.slice(0, at), ...extra, ...resume.args.slice(at)];
+}
+
 const stopEpisodeAt = rec => rec?.bannerAt ?? rec?.detectedAt;
 
 // Newer non-error parent-context Claude usage proves that a user/provider retry
@@ -215,7 +225,7 @@ function paneStopOwner(rec, state = readState()) {
 // One live pane can accept one wake. Legacy/subagent detections outside the
 // short ingest-dedupe window are therefore collapsed here: the newest active
 // stop owns the target and older active records become explicit history.
-function claimStopForResume(rec) {
+function claimStopForResume(rec, pendingPrompt = null) {
   const cutoff = stopEpisodeAt(rec);
   let claimed = false;
   updateState(state => {
@@ -245,6 +255,7 @@ function claimStopForResume(rec) {
         // single point where unsnooze takes ownership of a stop, whether the
         // wake is typed, driven through the menu, or reopened.
         resumedBy: 'unsnooze',
+        pendingPrompt, submitRetries: 0,
       });
       claimed = true;
     }
@@ -366,13 +377,16 @@ function rescheduleProbe(rec, now = Date.now()) {
     // never by waiting it out. Typing a wake into it would hit the same wall,
     // so make the stall a visible terminal state instead of a futile resume.
     if (rec.limitType === 'model') {
+      // The agent's own remedy: `unsnooze status` shows this line, and
+      // Claude's slash commands mean nothing to a Codex workspace wall.
+      const remedy = modelRemedy(getAgent(rec.agent));
       setStatus(key, 'failed', {
-        lastError: 'model limit still active — switch models (/model) or add credits',
+        lastError: `model limit still active — ${remedy}`,
         probeCount: probeCount + 1,
       }, { expect: ['stopped'] });
       log(`${key}: model limit still active at probe ceiling — needs a human`);
       notify('unsnooze: model limit needs you ⚠️',
-        `${rec.cwd}: still limited after probing — ${modelRemedy(getAgent(rec.agent))}`,
+        `${rec.cwd}: still limited after probing — ${remedy}`,
         { context: ctxOf(rec), priority: 4 });
       return 'held';
     }
@@ -585,10 +599,12 @@ export async function planFor(rec, {
     return { ...base, action: 'superseded', target: { key: superseded.key } };
   }
   const target = await reviveTarget(mux, rec);
-  const resume = agent.resumeArgs(rec.sessionId, message);
+  // The same argv reopen() builds: on a backend with no pane the prompt rides
+  // in argv, and for codex the command itself changes (`exec resume`).
+  const resume = agent.resumeArgs(rec.sessionId, message, { canType: backendCanType(mux) });
   return {
     ...base, action: 'reopen', target: { session: target }, message,
-    argv: [agent.id, ...resume.args, ...resolveResumeExtraArgs(agent.id)],
+    argv: [agent.id, ...withResumeExtraArgs(resume, agent.id)],
     messageViaPane: !!resume.messageViaPane,
   };
 }
@@ -699,7 +715,7 @@ export async function dispatchOne(rec, {
       // assessPane is asynchronous. Close the final human/provider-resume race
       // after assessment and immediately before the keystroke.
       if (finishIfClaudeProgressed(rec, agent)) return 'already-resumed';
-      if (!claimStopForResume(rec)) return 'stale';
+      if (!claimStopForResume(rec, agent.id === 'codex' ? resumeMessage : null)) return 'stale';
       await mux.sendText(rec.pane, resumeMessage);
       log(`${key}: sent continue via ${rec.mux} ${rec.paneOwner ?? '-'}:${rec.pane}`);
       notifyContext();
@@ -758,7 +774,7 @@ async function reopen(rec, { mux, resolveMux, agent, resumeMessage, selfCmd, onD
   const leaseId = createLeaseId();
   const target = await reviveTarget(mux, rec);
   const launchSpec = {
-    file: selfCmd[0], args: [...selfCmd.slice(1), '_run', agent.id, ...resume.args, ...resolveResumeExtraArgs(agent.id)],
+    file: selfCmd[0], args: [...selfCmd.slice(1), '_run', agent.id, ...withResumeExtraArgs(resume, agent.id)],
     env: reopenEnv(rec, leaseId, target),
   };
   // reviveTarget can await a multiplexer query. Recheck after it and claim the
@@ -860,11 +876,11 @@ function recordVerifyRetry(rec, lastError) {
   let applied;
   if (verifyRetries >= MAX_VERIFY_RETRIES) {
     const attempts = (rec.attempts || 0) + 1;
-    applied = transitionStopEpisode(rec, 'stopped', {
+    applied = transitionStopEpisode(rec, rec.pendingPrompt ? 'failed' : 'stopped', {
       attempts,
       // Same backoff (and same manual exemption) as routed retries.
       resetAt: rec.manual ? Date.now() : Date.now() + retryBackoffMs(attempts),
-      lastError,
+      lastError: rec.pendingPrompt ? `${lastError} — wake submission unconfirmed; inspect the Codex pane` : lastError,
       verifyRetries: 0, resumeEpisodeAt: null,
     }, { expect: ['resuming'] });
   } else {
@@ -903,6 +919,29 @@ export async function verifyOne(key, { resolveMux = resolveRecordMux } = {}) {
   catch (err) {
     return recordVerifyRetry(rec, `verify capture: ${err.message}`);
   }
+  // A delayed TUI can process text and Enter as a single paste burst (#30).
+  // Recover only our exact draft, never type it again or treat the banner
+  // above it as a fresh refusal. Re-check the normal ownership/busy gates
+  // and the stop episode immediately before every additional Enter.
+  if (agent.id === 'codex' && pendingCodexPrompt(text, rec.pendingPrompt)) {
+    const a = await assessPane(rec, agent, { mux });
+    const current = readState().sessions[key];
+    if (!current || current.status !== 'resuming' || !samePaneTarget(current, rec)
+      || stopEpisodeAt(current) !== stopEpisodeAt(rec)) return 'stale';
+    if (a.busy) return 'pending';
+    if ((rec.submitRetries || 0) >= 3 || !a.authorized || typeof mux.sendKey !== 'function') {
+      transitionStopEpisode(rec, 'failed', {
+        lastError: 'wake prompt not submitted — inspect the Codex pane and press Enter to continue',
+      }, { expect: ['resuming'] });
+      return 'held';
+    }
+    if (!pendingCodexPrompt(a.text, rec.pendingPrompt)) return 'pending';
+    if (!transitionStopEpisode(rec, 'resuming', { submitRetries: (rec.submitRetries || 0) + 1 },
+      { expect: ['resuming'] })) return 'stale';
+    try { await mux.sendKey(rec.pane, 'Enter'); }
+    catch (err) { log(`${key}: submit retry failed: ${err.message}`); }
+    return 'pending';
+  }
   const d = detectLimit(text, PANE_SCAN_LINES, agent.patterns);
   if (d.hit || (agent.menu && agent.menu.isPrompt(text, PANE_SCAN_LINES))) {
     // Limit not actually reset — reschedule from the fresh banner.
@@ -936,6 +975,44 @@ export async function verifyOne(key, { resolveMux = resolveRecordMux } = {}) {
     log(`${key}: limit still active, rescheduled to ${new Date(at).toISOString()} (${source})`);
     return;
   }
+  // A pane-less backend answers every capture with '', so "no banner" is not
+  // evidence there. Headless records what became of the launcher it spawned;
+  // a child that already died non-zero (`spawn codex ENOENT`, the Codex TUI's
+  // "stdin is not a terminal") resumed nothing, and marking it resumed would
+  // drop a retryable stop from the ledger and announce a wake that never
+  // happened (#25). Exit 0 is fine — `claude --resume … "prompt"` runs to
+  // completion and exits before the verify delay — and so is running on
+  // past HEADLESS_SETTLE_MS. A revival that is still young stays in flight:
+  // the loop verifies every resuming record each tick, and once it counts as
+  // resumed nothing reads its exit again (the sweep drops the record when
+  // the pid goes), so a death at 25s would have been announced as a wake.
+  if (typeof mux.paneOutcome === 'function') {
+    let outcome = null;
+    try { outcome = await mux.paneOutcome(rec.pane); } catch { outcome = null; }
+    if (outcome && outcome.exited === false
+        && Date.now() - (rec.lastAttemptAt || 0) < HEADLESS_SETTLE_MS) {
+      return 'pending';
+    }
+    if (outcome?.exited && outcome.code !== 0) {
+      const attempts = (rec.attempts || 0) + 1;
+      const how = outcome.code != null ? `exit ${outcome.code}`
+        : outcome.signal ? `killed by ${outcome.signal}` : 'failed to start';
+      const why = outcome.output || outcome.error || '';
+      const lastError = `revive died before it could resume (${how}${why ? `: ${why}` : ''})`;
+      const applied = transitionStopEpisode(rec, 'stopped', {
+        attempts,
+        // Same backoff (and same manual exemption) as every other retry.
+        resetAt: rec.manual ? Date.now() : Date.now() + retryBackoffMs(attempts),
+        lastError, verifyRetries: 0, resumeEpisodeAt: null,
+      }, { expect: ['resuming'] });
+      if (!applied) {
+        releaseSupersededResume(key);
+        return 'stale';
+      }
+      log(`${key}: ${lastError}`);
+      return 'retry';
+    }
+  }
   if (!transitionStopEpisode(rec, 'resumed', {
     lastError: null, verifyRetries: 0, resumeEpisodeAt: null,
     bannerCleared: true,
@@ -1108,8 +1185,14 @@ export async function runResumer({
       // Anything over the attempts cap is dead — mark failed so we can exit.
       for (const s of dueForDispatch()) {
         if ((s.attempts || 0) >= MAX_RESUME_ATTEMPTS) {
+          // Keep the last attempt's reason: this is the state `unsnooze status`
+          // shows after the "gave up" notification, and "exceeded" alone does
+          // not say that every revival died with `spawn codex ENOENT` (#25).
           const applied = transitionStopEpisode(s, 'failed', {
-            lastError: 'max resume attempts exceeded', verifyRetries: 0,
+            lastError: s.lastError
+              ? `max resume attempts exceeded — last: ${s.lastError}`
+              : 'max resume attempts exceeded',
+            verifyRetries: 0,
             resumeEpisodeAt: null,
           }, { expect: ['stopped'] });
           if (!applied) continue;